mise.toml

#:schema https://mise.en.dev/schema/mise.json

min_version = "2026.7.6"

[settings]
pin = true

# 💡 TIP
#
# If you want to override anything in this file, create an adjacent file called
# `mise.local.toml`. That file is not checked in to the repository. Using this
# file, you can specify more tools or different version of listed ones below as
# well as overriding environment variables.
[tools]
"aqua:ariga/atlas" = "1.0.0"
"github:speakeasy-api/openapi" = "1.24.0"
# Keep in sync with speakeasyVersion in .speakeasy/workflow.yaml, otherwise the
# installed version and the version generation runs on can mismatch.
"github:speakeasy-api/speakeasy" = "1.791.1"
"github:FiloSottile/mkcert" = "1.4.4"
apko = "1.2.31"
flyctl = "0.4.77"
go = "1.26.5"
golangci-lint = "2.12.2"
gomigrate = "4.19.1"
gum = "0.17.0"
jq = "1.8.2"
melange = "0.56.5"
# Authoritative Node pin. `.node-version` mirrors it and must be kept in sync:
# aube resolves its own runtime and cannot read this file, so without that
# mirror it falls through to whatever `node` is first on PATH.
nodejs = "24.16.0"
aube = "1.38.1"
# Kept for `changeset publish` only, which shells out to a package manager by
# name and has no aube branch — it picks between pnpm, yarn and npm. Both
# versions resolve to pnpm here, off different inputs: 2.31.0 (what we pin)
# asks package-manager-detector, which answers pnpm because pnpm-lock.yaml is
# on disk; 3.0.0 asks manypkg for the workspace tool, which answers pnpm
# because pnpm-workspace.yaml is. aube keeps writing both files in place, so
# releases need a real pnpm on PATH either way.
#
# Publishing via npm instead is not a drop-in: our public packages carry
# `workspace:` and `catalog:` specifiers that pnpm rewrites at pack time and
# npm would ship verbatim.
"github:pnpm/pnpm" = "11.19.0"
watchexec = "2.5.1"
uv = "0.12.1"
yq = "4.53.3"
# hk ≥1.47 fails to evaluate the json.Parser usage in hk.pkl
# ("unknown method 'parse'"); keep 1.46.0 until hk.pkl is ported.
hk = "1.46.0"
pkl = "0.32.1"
"github:temporalio/cli" = "1.8.2"
"github:pb33f/openapi-changes" = "0.2.10"
"github:sqlc-dev/sqlc" = "1.31.1"
"github:gotestyourself/gotestsum" = "1.13.0"
buf = "1.72.0"
ruff = "0.16.1"
"github:ast-grep/ast-grep" = "0.45.0"
pitchfork = "2.20.0"
"npm:@playwright/cli" = "0.1.17"

# ℹ️ The settings below are sensible defaults for local development. When
# deploying to production, you will want to configure these more carefully.
[env]
###########################
## Runtime configuration ##
###########################
PYTHONASYNCIODEBUG = "1" ## Enabled for local development only
############################
## Database configuration ##
############################
## The following DB_* variables are only needed to configure the postgres local
## development database and to run SQLc (`mise run gen:sqlc-server`). They do
## not need to be set in a production deployment.
DB_USER = "gram"
DB_PASSWORD = "gram"
DB_NAME = "gram"
DB_HOST = "127.0.0.1"
DB_PORT = "5439"
## Only this variable is relevant to production deployments. It can be set to a
## static connection string. In this case, we use interpolation to point to the
## local development database configured above.
GRAM_DATABASE_URL = "postgres://{{env.DB_USER}}:{{env.DB_PASSWORD}}@{{env.DB_HOST}}:{{env.DB_PORT}}/{{env.DB_NAME}}?sslmode=disable&search_path=public"
GRAM_DATABASE_READ_REPLICA_URL = "{{env.GRAM_DATABASE_URL}}"

##############################
## ClickHouse configuration ##
##############################
CLICKHOUSE_USERNAME = "gram"
CLICKHOUSE_PASSWORD = "gram"
CLICKHOUSE_HOST = "127.0.0.1"
CLICKHOUSE_HTTP_PORT = "8123"
CLICKHOUSE_NATIVE_PORT = "9440"
CLICKHOUSE_DATABASE = "default"
CLICKHOUSE_INSECURE = true
GRAM_CLICKHOUSE_URL = "clickhouse://{{env.CLICKHOUSE_USERNAME}}:{{env.CLICKHOUSE_PASSWORD}}@{{env.CLICKHOUSE_HOST}}:{{env.CLICKHOUSE_NATIVE_PORT}}/{{env.CLICKHOUSE_DATABASE}}?secure=true&skip_verify=true"
## golang-migrate requires username/password as query parameters instead of in the URL
GRAM_CLICKHOUSE_GOMIGRATE_URL = "clickhouse://{{env.CLICKHOUSE_HOST}}:{{env.CLICKHOUSE_NATIVE_PORT}}/{{env.CLICKHOUSE_DATABASE}}?username={{env.CLICKHOUSE_USERNAME}}&password={{env.CLICKHOUSE_PASSWORD}}&secure=true&skip_verify=true&x-multi-statement=true"

############################
## Temporal configuration ##
############################
TEMPORAL_HOST = "127.0.0.1"
TEMPORAL_PORT = "7233"
TEMPORAL_NAMESPACE = "default"
TEMPORAL_TASK_QUEUE = "main"
## When using Temporal Cloud, the following variable should like something like:
##     "<namespace>.<account>.tmprl.cloud:7233".
TEMPORAL_ADDRESS = "{{env.TEMPORAL_HOST}}:{{env.TEMPORAL_PORT}}"

##############################
## Presidio configuration   ##
##############################
PRESIDIO_PORT = "5050"
PRESIDIO_ANALYZER_URL = "http://127.0.0.1:{{env.PRESIDIO_PORT}}"

##########################################
## Gram server, admin and worker config ##
##########################################
## Setting this to 1 will run the server and worker in a single process.
## This is useful when debugging during local development. It can also be used
## for simple production deployments although you are encouraged to run the gram
## server and worker as separate processes that can be scaled independently.
GRAM_SINGLE_PROCESS = 0
GRAM_SERVER_PORT = "8080"
GRAM_SERVER_ADDRESS = ":{{env.GRAM_SERVER_PORT}}"
GRAM_CONTROL_PORT = "8081"
GRAM_CONTROL_ADDRESS = ":{{env.GRAM_CONTROL_PORT}}"
GRAM_WORKER_CONTROL_PORT = "8082"
GRAM_WORKER_CONTROL_ADDRESS = ":{{env.GRAM_WORKER_CONTROL_PORT}}"
GRAM_STREAMS_CONTROL_PORT = "8087"
GRAM_STREAMS_CONTROL_ADDRESS = ":{{env.GRAM_STREAMS_CONTROL_PORT}}"
## The following variable can be one of: local, test, prod
GRAM_ENVIRONMENT = "local"
GRAM_HOST = "localhost" # Only needed for local development. In production, you should set GRAM_SERVER_URL and GRAM_SITE_URL directly.
GRAM_SITE_PORT = "5173"
GRAM_SITE_URL = "https://{{env.GRAM_HOST}}:{{env.GRAM_SITE_PORT}}"
GRAM_SERVER_URL = "https://{{env.GRAM_HOST}}:{{env.GRAM_SERVER_PORT}}"
## Cannot reuse GRAM_SERVER_URL: viteprod unsets it.
GRAM_APP_URL = "{{env.GRAM_SERVER_URL}}"
GRAM_ASSETS_BACKEND = "fs"
GRAM_ASSETS_URI = ".assets"
## The following variable is used to encrypt env vars stored in the database.
GRAM_ENCRYPTION_KEY = "unset"
GRAM_REDIS_CACHE_HOST = "127.0.0.1"
GRAM_REDIS_CACHE_PORT = "5445"
GRAM_REDIS_CACHE_ADDR = "{{env.GRAM_REDIS_CACHE_HOST}}:{{env.GRAM_REDIS_CACHE_PORT}}"
GRAM_REDIS_CACHE_PASSWORD = "xi9XILbY"
GRAM_REDIS_ENABLE_TRACING = "false"
## Local-only value; real deployments inject this via secrets.
GRAM_TUNNEL_FORWARD_TOKEN = "local-dev-tunnel-forward-token"
TUNNEL_GATEWAY_PUBLIC_PORT = "8090"
TUNNEL_GATEWAY_PUBLIC_ADDR = ":{{env.TUNNEL_GATEWAY_PUBLIC_PORT}}"
TUNNEL_GATEWAY_FORWARD_PORT = "8091"
TUNNEL_GATEWAY_FORWARD_ADDR = ":{{env.TUNNEL_GATEWAY_FORWARD_PORT}}"
OPENROUTER_DEV_KEY = "unset"
## The dev-idp is a top-level project (dev-idp/) backed by SQLite.
## GRAM_DEVIDP_PORT is auto-remapped by `mise work:init` for parallel worktrees.
GRAM_DEVIDP_HOST = "localhost"
GRAM_DEVIDP_PORT = "35291"
GRAM_DEVIDP_CONTROL_PORT = "35292"
GRAM_DEVIDP_DASHBOARD_PORT = "35293"
GRAM_DEVIDP_ADDRESS = ":{{env.GRAM_DEVIDP_PORT}}"
GRAM_DEVIDP_CONTROL_ADDRESS = ":{{env.GRAM_DEVIDP_CONTROL_PORT}}"
GRAM_DEVIDP_EXTERNAL_URL = "http://{{env.GRAM_DEVIDP_HOST}}:{{env.GRAM_DEVIDP_PORT}}"
GRAM_DEVIDP_DB = "file:{{ config_root }}/local/devidp/devidp.db"
GRAM_IDP_BASE_URL = "{{env.GRAM_DEVIDP_EXTERNAL_URL}}/oauth2"
GRAM_IDP_CLIENT_ID = "gram-local-dev"
## WorkOS API key. In mock-workos mode the mock endpoint accepts any value.
## Override in mise.local.toml with a real sk_test_... key for workos mode.
GRAM_IDP_CLIENT_SECRET = "unset"
## IDP mode: "mock-workos" (default) or "workos".
##
## mock-workos — fully local, zero config. dev-idp emulates the WorkOS API.
##               No overrides needed.
##
## workos      — real WorkOS via dev-idp proxy. Add these to mise.local.toml:
##                 GRAM_IDP_MODE = "workos"
##                 GRAM_IDP_CLIENT_SECRET = "sk_test_..."
##                 WORKOS_API_URL = "https://api.workos.com"
##                 GRAM_IDP_CLIENT_ID = "<your WorkOS client ID>"
##
## See CONTRIBUTING.md "Local auth and identity" for details.
GRAM_IDP_MODE = "mock-workos"
## Points the Gram server and dev-idp at the WorkOS-compatible API.
## In mock-workos mode this is the dev-idp emulator; override in
## mise.local.toml for workos mode.
WORKOS_API_URL = "{{env.GRAM_DEVIDP_EXTERNAL_URL}}/mock-workos"
## PEM-encoded RSA private key for stable JWKS across dev-idp restarts.
# GRAM_DEVIDP_RSA_PRIVATE_KEY = ""
## The following variables are only needed if you want to do one of the following:
## - Run the server with SSL enabled and not rely on SSL termination at a load balancer.
## - Local development with SSL enabled.
GRAM_HTTP_SCHEME = "https"
GRAM_SSL_CERT_FILE = "{{config_root}}/local/ssl/certs/local.pem"
GRAM_SSL_KEY_FILE = "{{config_root}}/local/ssl/keys/local-key.pem"
## GitHub App for plugin publishing (leave unset to disable)
# GRAM_PLUGINS_GITHUB_APP_ID = ""
# GRAM_PLUGINS_GITHUB_PRIVATE_KEY = ""
# GRAM_PLUGINS_GITHUB_ORG = ""
# GRAM_PLUGINS_GITHUB_INSTALLATION_ID = ""
GRAM_PYSTREAMS_CONTROL_PORT = "8089"
GRAM_PYSTREAMS_CONTROL_HOST = "127.0.0.1"
## Raise on blocking code detected on the pystreams event loop (aiocop). On by
## default locally; unset in production. Set to "" in mise.local.toml to disable.
GRAM_PYSTREAMS_DETECT_BLOCKING = "1"

##########################
## Observability config ##
##########################
OTLP_GRPC_HOST = "localhost"
OTLP_GRPC_PORT = "4317"
OTLP_HTTP_PORT = "4318"
OTEL_EXPORTER_OTLP_ENDPOINT = "http://{{env.OTLP_GRPC_HOST}}:{{env.OTLP_GRPC_PORT}}"
OTEL_EXPORTER_OTLP_PROTOCOL = "grpc"
## Change these to 0 to disable OpenTelemetry traces and metrics to be emitted.
GRAM_ENABLE_OTEL_TRACES = 1
GRAM_ENABLE_OTEL_METRICS = 1

################################
## Local development settings ##
################################
GRAFANA_PORT = "13000"
TEMPO_HTTP_PORT = "13200"
LOKI_HTTP_PORT = "13100"
PROMETHEUS_PORT = "9099"
LITELLM_PORT = "4001"
GRAM_LOG_PRETTY = { default = "1" }
## Default Gram API URL baked into the dashboard's inlined Elements code and
## used by the CLI to point to the correct Gram API server
GRAM_API_URL = "{{env.GRAM_SERVER_URL}}"
VITE_DEV_HOSTNAMES = "localhost"
## Base URL of the CDN serving the dashboard's static assets (e.g.
## https://cdn.dev.getgram.ai). Not a build-time setting: the dashboard
## container's nginx reads it at runtime to rewrite /assets/ URLs in
## index.html to the CDN host (see client/dashboard/nginx.conf and the
## renderBuiltUrl comment in client/dashboard/vite.config.ts). Unset locally
## and by default in production — assets are then served same-origin.
# GRAM_CDN_URL = "https://cdn.dev.getgram.ai"
TEMPORAL_WEB_PORT = "8233"
## If you want to enable/disable certain feature flags during local development,
## copy the following line to mise.local.toml and point to a CSV file containing
## flag settings. The server and worker run from the `server/` directory, and
## the local flag loader rejects paths outside its current working directory, so
## keep this CSV under `server/`. Check out server/flags.local.csv.example for
## an example of the format.
## For a list of feature flags, check `server/internal/feature/flags.go`.
# GRAM_LOCAL_FEATURE_FLAGS_CSV = "{{config_root}}/server/flags.csv"
## Set to 1 to disable air hot reload and run server/worker directly
PUBSUB_EMULATOR_PORT = "8088"
PUBSUB_EMULATOR_HOST = "localhost:{{env.PUBSUB_EMULATOR_PORT}}"

####################################
## Gram Functions runner settings ##
####################################
## Where to deploy functions.
## Allowed values: local, flyio.
GRAM_FUNCTIONS_PROVIDER = "local"
GRAM_FUNCTIONS_RUNNER_OCI_IMAGE = "gram-runner"
## By default, the runner version is inferred from the version of the
## server/worker. If needed, you can pin the version with the following
## variable. You must ensure the required version is available for the given OCI
## image in ther registry.
# GRAM_FUNCTIONS_RUNNER_VERSION = ""
GRAM_FUNCTIONS_LOCAL_RUNNER_ROOT = "{{config_root}}/local/functions"
## fly.io api token for deploying gram function runners
# GRAM_FUNCTIONS_FLYIO_API_TOKEN = "unset"
## Default app for deploying fly.io apps
# GRAM_FUNCTIONS_FLYIO_ORG = "unset"
## Default region for deploying fly.io apps
# GRAM_FUNCTIONS_FLYIO_REGION = "sjc"

########################################
## Gram Assistant runtime settings ##
########################################
## Where assistant runtimes run.
## Allowed values: local, flyio, gke.
## The local provider starts runtime containers on demand on this machine's
## Docker daemon. Build the image with `mise run build:assistants-runtime-image`.
GRAM_ASSISTANT_RUNTIME_PROVIDER = "local"
GRAM_ASSISTANT_RUNTIME_OCI_IMAGE = "gram-assistant-runtime"

##################
## MCP Registry ##
##################
PULSE_REGISTRY_TENANT = { default = "unset" }
PULSE_REGISTRY_KEY = { default = "unset" }

##########
## Risk ##
##########
GRAM_RISK_FINGERPRINT_PEPPER_KEYRING = '{"current": "v1", "keys": {"v1": "bmvSy6Zn8YAN/32TAgGQrkXwaN2Fzp32kvB9j2Aa4ws="}}'

##########################
## Stripe configuration ##
##########################
## PAYG self-serve billing. Run `mise run stripe:setup` to provision and
## validate the sandbox TUM meter, product, and metered price. The task writes
## the catalog values into mise.local.toml. Requires a Stripe sandbox API key.
STRIPE_API_KEY = { default = "unset" }
STRIPE_WEBHOOK_SECRET = { default = "unset" }
STRIPE_PRICE_ID_TUM = { default = "" }
STRIPE_METER_EVENT_NAME = { default = "tum" }

#########################
## Polar configuration ##
#########################
POLAR_PRODUCT_ID_FREE = "cc768f24-c85a-4779-8863-030f1abc3f40"
POLAR_PRODUCT_ID_PRO = "1361707d-e9c2-4693-91bd-0789fbc09d68"
POLAR_PRODUCT_ID_ASSISTANTS = ""
POLAR_METER_ID_TOOL_CALLS = "7ec16f6d-6189-4262-9898-c64bed7b8a91"
POLAR_METER_ID_SERVERS = "af37f394-69c8-4d46-8308-9b92407ee52e"
POLAR_METER_ID_CREDITS = "b96fda22-2147-4089-bedb-72c3304b17eb"

#############################
## Admin API Configuration ##
#############################
GRAM_ADMIN_HOST = "localhost"
GRAM_ADMIN_PORT = "8083"
GRAM_ADMIN_SERVER_ADDRESS = ":{{env.GRAM_ADMIN_PORT}}"
GRAM_ADMIN_CONTROL_PORT = "8084"
GRAM_ADMIN_CONTROL_ADDRESS = ":{{env.GRAM_ADMIN_CONTROL_PORT}}"
GRAM_ADMIN_DASHBOARD_PORT = "5174"
## Where the admin API itself listens. Only the admin dashboard dev proxy
## dials this; browsers never do.
GRAM_ADMIN_BACKEND_URL = "https://{{env.GRAM_ADMIN_HOST}}:{{env.GRAM_ADMIN_PORT}}"
## The browser-facing admin origin, and therefore the origin the OIDC redirect
## URI is built from. In production the SPA and the admin API share one origin
## behind one ingress. Locally the Vite dev server is that origin, because it
## proxies /admin through to GRAM_ADMIN_BACKEND_URL.
GRAM_ADMIN_SERVER_URL = "https://{{env.GRAM_ADMIN_HOST}}:{{env.GRAM_ADMIN_DASHBOARD_PORT}}"
## AdminOriginCheck rejects every unsafe method whose Origin is not listed, and
## the flag has no default, so local writes 403 without this.
GRAM_ADMIN_ALLOWED_ORIGINS = "{{env.GRAM_ADMIN_SERVER_URL}}"
GRAM_ADMIN_ENCRYPTION_KEY = "unset"
GRAM_ADMIN_OIDC_EMULATOR_HOST = "localhost"
GRAM_ADMIN_OIDC_EMULATOR_PORT = "4000"
GRAM_ADMIN_OIDC_EMULATOR_URL = "http://{{env.GRAM_ADMIN_OIDC_EMULATOR_HOST}}:{{env.GRAM_ADMIN_OIDC_EMULATOR_PORT}}"
GRAM_ADMIN_OIDC_CLIENT_ID = "gram-local.apps.googleusercontent.com"
GRAM_ADMIN_OIDC_CLIENT_SECRET = "GOCSPX-example_secret"
GRAM_ADMIN_ALLOWED_HDS = "speakeasyapi.dev,speakeasy.com"
## Used for admin local development as a fake Google IDP. Derived from the
## admin emulator vars (not a standalone *_PORT) so zero:remap-ports cannot
## randomize the listen port and issuer out of sync with the admin client.
MOCK_OIDC_ADDRESS = ":{{env.GRAM_ADMIN_OIDC_EMULATOR_PORT}}"
MOCK_OIDC_ISSUER = "{{env.GRAM_ADMIN_OIDC_EMULATOR_URL}}"

########################
## Svix configuration ##
########################
GRAM_SVIX_API_KEY = { default = "unset" }

################
## GCP config ##
################
## Typically this variable is omitted and the GCP SDK will detect project ID
## from the environment. However, for local development, it can be set to a
## static value.
GRAM_GCP_PROJECT_ID = "local-dev-project"