.env.example

# sendblue: imessage gateway
SENDBLUE_API_KEY=
SENDBLUE_API_SECRET=
SENDBLUE_FROM_NUMBER=

# webhook token: put this in the registered sendblue webhook URL as ?t=<token>
# sendblue does not sign inbound payloads. generate one with: openssl rand -hex 24
WEBHOOK_URL_TOKEN=

# optional, recommended: store only the SHA-256 of the token instead of the raw
# value. when set, the webhook verifies sha256(?t=...) against this digest with a
# constant-time compare, so the plaintext token never lives in env.
#   printf '%s' "<token>" | openssl dgst -sha256   # 64 lowercase hex chars
# if set, WEBHOOK_URL_TOKEN may be left blank. if unset, the raw token is used.
WEBHOOK_URL_TOKEN_SHA256=

# postgres: use a TCP/session connection string
# neon-http will not work here because the flush path needs transactions.
DATABASE_URL=

# openrouter: one key, one free tool-capable model
OPENROUTER_API_KEY=
OPENROUTER_MODEL=openai/gpt-oss-120b:free
# optional: point model traffic at an OpenRouter-compatible proxy/self-host.
# defaults to the public OpenRouter API when unset. mainly for tests.
OPENROUTER_BASE_URL=

# single-user allowlist, E.164 format, example: +639XXXXXXXXX
ALLOWED_PHONE=

# local time
# APP_TIMEZONE labels prompts. APP_TIMEZONE_OFFSET_MINUTES drives date math.
APP_TIMEZONE=Asia/Manila
APP_TIMEZONE_OFFSET_MINUTES=480

# vercel cron auth. the env var name must stay CRON_SECRET.
# generate with: openssl rand -hex 24
CRON_SECRET=

# write-safety policy: writes at or above this many centavos require an explicit
# "yes" before they commit. default is ₱50,000.00 (5_000_000 centavos).
ANDY_CONFIRM_AMOUNT_THRESHOLD_CENTAVOS=5000000

# inbound rate limiting. optional; defaults are 60 requests per 60-second
# window. enforced durably in Postgres (keyed on a hash of token+phone), so the
# limit holds across serverless instances. the webhook fails closed if the
# check errors.
ANDY_INBOUND_RATE_LIMIT=60
ANDY_INBOUND_RATE_WINDOW_SECONDS=60