.env.example

# Server-only model selection. Never prefix secrets with NEXT_PUBLIC_.
EXPLANATION_MODEL_PROVIDER=deepseek

# Server-only HMAC secret for signed recursive explanation context. The local
# launcher generates an ephemeral value automatically; hosted or production
# multi-instance deployments must provide at least 32 bytes.
EXPLANATION_CONTEXT_TOKEN_SECRET=

# Backward-compatible alias. Used only when EXPLANATION_MODEL_PROVIDER is absent.
# LINEAGE_MODEL_PROVIDER=deepseek

# Primary provider: fixed DeepSeek V4 Pro model.
# Recommended local mode: run `npm run dev:local` and save the key from the
# in-page model settings. The launcher-owned companion variables are intentionally
# not listed here and must never be copied into browser-exposed configuration.
#
# Optional server-only alternative for `npm run dev` or hosted deployments:
DEEPSEEK_API_KEY=
DEEPSEEK_BASE_URL=https://api.deepseek.com

# Optional provider: set EXPLANATION_MODEL_PROVIDER=openai to use this adapter.
OPENAI_API_KEY=
OPENAI_MODEL=gpt-5.6

# Java backend used by durable history, selection chat, provider profiles, and
# bounded web_search. `npm run dev:local` starts it on loopback and supplies the
# two secrets automatically. Set these explicitly only when the web and Java
# processes are started or deployed separately.
VISUALIZED_EXP_BACKEND_URL=http://127.0.0.1:8080
VISUALIZED_EXP_BACKEND_TOKEN=
BACKEND_PORT=8080

# Java process settings. APP_INTERNAL_TOKEN must equal
# VISUALIZED_EXP_BACKEND_TOKEN. APP_CREDENTIAL_MASTER_KEY must be a base64 or
# base64url encoding of exactly 32 random bytes; it encrypts provider API keys
# and must remain stable for the lifetime of the database.
APP_BIND_ADDRESS=127.0.0.1
APP_INTERNAL_TOKEN=
APP_CREDENTIAL_MASTER_KEY=
APP_DATABASE_URL=jdbc:h2:file:./data/visualized-exp;MODE=PostgreSQL;DATABASE_TO_LOWER=TRUE;DEFAULT_NULL_ORDERING=HIGH
APP_DATABASE_USERNAME=sa
APP_DATABASE_PASSWORD=