From 89e180fc49ee2cff4f340d598649d7712815a258 Mon Sep 17 00:00:00 2001 From: Simon Axelsson Date: Wed, 22 Jul 2026 18:48:58 +0200 Subject: [PATCH] chore: add .env.example, fix .gitignore blanket .env* rule (#3) .env.example was referenced by README.md and required by docs/09-build-plan.md (Phase 0) but never existed in the repo. Root cause: .gitignore's `.env*` rule silently ignored it too, so `git add .env.example` was always a no-op even if someone created it locally. - Add .gitignore exception: `!.env.example`. - Add .env.example covering every process.env.* read found in this pass (grep-verified across app/, lib/, src/), organized by concern, each section marked "wired in code today" or "documented target, not yet read by code" per docs/08-infrastructure.md. No real values; matches repo convention. Excluded ODOO_BASE_URL: only appears inside a comment describing a past refactor away from module-level env reads, not an actual process.env read. pnpm test: 88 passed, 1 todo, 0 failures (13 files, tests/**/*.test.ts). tsc --noEmit: clean. --- .env.example | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++ .gitignore | 1 + 2 files changed, 116 insertions(+) create mode 100644 .env.example diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..64e7f3b --- /dev/null +++ b/.env.example @@ -0,0 +1,115 @@ +# 0pt (edge plane) — environment inventory +# See docs/08-infrastructure.md for the canonical description of each integration. +# Never commit real values. Vercel env for the edge app; VPS .env (git-ignored) for infra/docker-compose.yml. +# +# Sections marked "wired in code today" are read via process.env.* somewhere in this repo right now +# (grep-verified, not assumed). Sections marked "documented target, not yet read by code" come from +# docs/08-infrastructure.md / docs/02-architecture.md but have no process.env.* read yet -- filling +# them in unblocks the integration, it does not by itself change behavior. + +# --------------------------------------------------------------------------- +# Database (wired in code today: lib/db.ts, app/api/health) +# --------------------------------------------------------------------------- +# Vercel Postgres sets POSTGRES_URL / POSTGRES_PRISMA_URL automatically when the +# integration is attached. DATABASE_URL, if set, takes priority over both (lib/db.ts +# fallback order: DATABASE_URL || POSTGRES_URL || POSTGRES_PRISMA_URL). +DATABASE_URL= +POSTGRES_URL= +POSTGRES_PRISMA_URL= + +# --------------------------------------------------------------------------- +# Auth (wired in code today: DEV_LOGIN_KEY gate; AUTH_SECRET declared, full +# Auth.js flow lands with the DB per README "Status" -- not complete yet) +# --------------------------------------------------------------------------- +AUTH_SECRET= +# AUTH_URL is documented (docs/08) but not yet read by any route in this pass. +AUTH_URL=https://0pt.app +DEV_LOGIN_KEY= + +# --------------------------------------------------------------------------- +# Data engine bridge (wired in code today: lib/engine.ts) +# --------------------------------------------------------------------------- +# When set, edge route handlers defer to the FastAPI engine (services/api) as the +# single source of truth (orders/estimates/catalog/ai-parse). When unset, the edge +# computes locally / falls back to an honest heuristic -- see lib/engine.ts, app/api/ai/parse. +ENGINE_URL= +# Sent as X-Internal-Token on every engineFetch() call. +INTERNAL_TOKEN= + +# --------------------------------------------------------------------------- +# SIAX platform clients (documented target, not yet read by code) +# --------------------------------------------------------------------------- +# src/clients/{cl0ud,n0d,aud0}-client.ts currently only accept an optional +# constructor baseUrl and fall back to an in-memory mock -- none of these three +# vars is read via process.env yet (grep-verified). Setting them does nothing +# until those clients are wired to read them; a future pass should add that. +CL0UD_URL= +N0D_URL= +AUD0_URL= +# ST0RE_URL IS read (src/clients/st0re-client.ts, src/clients/st0re-lakehouse-client.ts) +# but still only exercised against a live endpoint if this is set -- unset today, +# per docs/ICEBERG_WRITE_BOUNDARY.md's "not live-verified" note. +ST0RE_URL= + +# --------------------------------------------------------------------------- +# Payments (wired in code today: app/api/payments/*, app/api/webhooks/stripe) +# --------------------------------------------------------------------------- +STRIPE_SECRET_KEY= +STRIPE_WEBHOOK_SECRET= +# Documented target (docs/08); not yet read by any route in this pass. +NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY= + +# --------------------------------------------------------------------------- +# File storage — Cloudflare R2 (wired in code today: R2_ACCESS_KEY_ID/R2_BUCKET/ +# R2_ENDPOINT are read; R2_ACCOUNT_ID and R2_SECRET_ACCESS_KEY are documented in +# docs/08 but not found via a process.env.* read in this pass -- verify before +# assuming the R2 client is fully wired.) +R2_ACCOUNT_ID= +R2_ACCESS_KEY_ID= +R2_SECRET_ACCESS_KEY= +R2_BUCKET= +R2_ENDPOINT= +# Fallback local artifact store used when no object storage is configured +# (src/adapters/local-blob-store.ts). Leave unset in production. +OPT_LOCAL_BLOB_DIR= + +# --------------------------------------------------------------------------- +# Email — Resend (documented target, docs/08; no Resend call site found in this +# pass -- treat as not-yet-implemented, not just unconfigured) +# --------------------------------------------------------------------------- +RESEND_API_KEY= + +# --------------------------------------------------------------------------- +# Embedded analytics (documented target, docs/08; no call site found in this pass) +# --------------------------------------------------------------------------- +METABASE_SITE_URL= +METABASE_SECRET_KEY= +NOCODB_BASE_URL= +NOCODB_API_TOKEN= + +# --------------------------------------------------------------------------- +# Document intelligence / OCR (wired in code today: src/services/document-extraction-service.ts) +# --------------------------------------------------------------------------- +DOC_INTELLIGENCE_ENDPOINT= +DOC_INTELLIGENCE_KEY= +DOC_INTELLIGENCE_API_VERSION= + +# --------------------------------------------------------------------------- +# Customer DB-grant encryption (wired in code today: connections/db-grant flow) +# --------------------------------------------------------------------------- +# 32-byte key, AES-GCM. Encrypts customer-supplied read-only connection strings at rest. +GRANT_ENC_KEY= + +# --------------------------------------------------------------------------- +# Misc / public +# --------------------------------------------------------------------------- +NEXT_PUBLIC_APP_URL=https://0pt.app +# Documented target (docs/08); no call site found reading it in this pass. +NEXT_PUBLIC_API_URL=https://api.0pt.app + +# --------------------------------------------------------------------------- +# Cache / queue (wired in code today: app/api/health only checks presence; +# no other call site found reading it in this pass -- worker queue usage, if +# any, lives in services/api, outside this repo's scope) +# --------------------------------------------------------------------------- +REDIS_URL= diff --git a/.gitignore b/.gitignore index f650315..3c35968 100644 --- a/.gitignore +++ b/.gitignore @@ -18,6 +18,7 @@ yarn-error.log* # env files .env* +!.env.example # vercel .vercel