.env.example

# SecurePrompt local environment template.
#
# Copy to `.env` and fill in real values. `.env` is git-ignored — never commit.
#
#     cp .env.example .env
#
# All scripts under scripts/ that need these variables will source `.env`
# automatically when present. Variables already set in your shell take
# precedence over values in `.env`.

# ── Semantic analysis (optional) ─────────────────────────────────────────────
# HuggingFace API token (free at https://huggingface.co/settings/tokens).
#
# IMPORTANT: the token MUST have the "Make calls to Inference Providers"
# permission enabled. A "Read" classic token works; a fine-grained token
# only works if that scope is explicitly checked when the token is created
# or edited at https://huggingface.co/settings/tokens.
#
# Symptom of a missing scope: HTTP 403 from the HF router with the message
# "This authentication method does not have sufficient permissions to call
# Inference Providers".
HF_TOKEN=

# Toggle the semantic layer. "true" / "false".
SP_SEMANTIC=true

# Profile: minimal | balanced | thorough. Default: balanced.
SP_SEMANTIC_PROFILE=balanced

# Per-request HF API timeout in ms. First-call cold-start needs a higher value.
SP_SEMANTIC_TIMEOUT=8000

# Override the HuggingFace endpoint base URL. Leave unset for the default
# Inference Providers router. Set this only if HF moves the endpoint again
# or you proxy through a corporate gateway.
# SP_SEMANTIC_API_BASE=https://router.huggingface.co/hf-inference/models

# ── Server ───────────────────────────────────────────────────────────────────
# Port the server listens on. Default: 8080.
PORT=8080

# Audit-log HMAC secret (override the dev fallback in production).
# HMAC_SECRET=change-me