# ─────────────────────────────────────────────────────────────────────────────
# iios-service configuration contract.
# Copy to `.env` for local dev; in prod, inject via your secrets manager / orchestrator.
# 🔒 = secret (never commit a real value). ⚠️ = must be set correctly for prod safety.
# ─────────────────────────────────────────────────────────────────────────────

# ── Core ─────────────────────────────────────────────────────────────────────
DATABASE_URL=postgresql://iios:iios@localhost:5434/iios?schema=public   # 🔒 Postgres connection
PORT=3200
# NODE_ENV=production   # set by the Docker image
# Realtime fan-out across replicas (socket.io Redis adapter). REQUIRED when running
# more than one instance with live chat; omit for a single instance (in-memory adapter).
# REDIS_URL=redis://localhost:6379                                       # 🔒

# ── Secrets ──────────────────────────────────────────────────────────────────
# JSON map of appId → HS256 signing secret used to verify session JWTs (SessionVerifier).
APP_SECRETS={"portal-demo":"dev-secret"}                                 # 🔒
# JSON map of channelType → inbound webhook HMAC secret (adapter signature check).
ADAPTER_SECRETS={"WEBHOOK":"dev-adapter-secret"}                         # 🔒
# Default scope an unauthenticated adapter webhook ingests into.
ADAPTER_APP=portal-demo
ADAPTER_ORG=org_demo

# ── ⚠️ Production-safety flags ────────────────────────────────────────────────
# Enables /v1/dev/* (token mint, webhook inject, chaos, retention sweep). MUST be unset
# or 0 in production — leaving it on exposes unauthenticated token minting.
IIOS_DEV_TOKENS=0
# Skip `prisma migrate deploy` at boot (set to 1 when a separate migration job runs).
IIOS_SKIP_MIGRATE=0

# ── Tenant isolation ─────────────────────────────────────────────────────────
IIOS_CELL_ID=cell-default            # physical cell this instance serves (blast-radius partition)

# ── Background workers ───────────────────────────────────────────────────────
IIOS_RELAY_INTERVAL_MS=500           # outbox relay tick; 0 disables the timer
IIOS_OUTBOX_MAX_ATTEMPTS=5           # relay dead-letters an event after N failed publishes
IIOS_RETENTION_SWEEP_INTERVAL_MS=0   # retention sweep tick; 0 disables (run via job instead)
IIOS_RETENTION_POLICY_VERSION=v1
IIOS_RETENTION_ARCHIVE_DAYS=90       # default archive window (per-class override: _INTERNAL/_RESTRICTED/_CONFIDENTIAL/_REGULATED)
IIOS_RETENTION_DELETE_DAYS=365       # default delete (redact) window; same per-class overrides

# ── Rate limits / quotas / budgets ───────────────────────────────────────────
IIOS_OUTBOUND_LIMIT=5                # per-(channel,target) sends per window
IIOS_OUTBOUND_WINDOW_MS=60000
IIOS_TENANT_OUTBOUND_LIMIT=10000     # per-tenant egress cap per window (noisy-neighbor guard)
IIOS_TENANT_OUTBOUND_WINDOW_MS=60000
IIOS_AI_BUDGET_UNITS=100000          # per-scope AI cost-unit budget (KG-12)

# ── Capability providers (governed egress targets) ───────────────────────────
# Per-channel provider endpoint the CapabilityBroker calls, e.g.:
# IIOS_PROVIDER_URL_EMAIL=https://provider.internal/email

# ── Context attestation (July 12 trust layer) ──
# Audience IIOS requires on attestations addressed to it.
IIOS_ATTESTATION_AUDIENCE=iios-core
# Dev only: shared HS256 secret AppShell's stand-in signs attestations with (seeds the
# appshell-crm client into the registry when IIOS_DEV_TOKENS=1).
# IIOS_ATTESTATION_DEV_SECRET=appshell-dev-signing-key
# When '1', every guarded request MUST carry a valid X-Context-Attestation (else 403).
# Leave OFF until callers (AppShell/be-crm) forward attestations. Verified-if-present regardless.
IIOS_REQUIRE_ATTESTATION=0

# ─── Object storage (media + email attachments) ───────────────────
# Unset → local disk (MEDIA_DIR). Set these → S3-compatible (AWS S3 / MinIO / R2 / Supabase).
# IIOS_S3_ENDPOINT=https://minio.your-server:9000   # omit for AWS S3
# IIOS_S3_BUCKET=iios-media
# IIOS_S3_ACCESS_KEY=...
# IIOS_S3_SECRET_KEY=...
# IIOS_S3_REGION=us-east-1                            # any value for MinIO
# IIOS_S3_FORCE_PATH_STYLE=true                       # true for MinIO/self-hosted
