# buyer/.env.example
#
# Copy to buyer/.env and fill in. .env is gitignored — never commit.
#
# To generate a fresh Ed25519 wallet seed:
#     openssl rand -hex 32
# Fund the resulting address with enough AP3X to cover prompt payment +
# bond + tx fees before posting any escrow.

# ─── Required ─────────────────────────────────────────────────────────────

# 64-char hex Ed25519 private key seed for the buyer wallet. SECRET.
BUYER_PRIV_KEY_HEX=PASTE_64_HEX_CHARS_HERE

# Indexer base URL. Inside compose this is the service name.
INDEXER_URL=http://indexer:8090

# Single-operator login password. Anyone who knows this can spend funds
# via /v1/submit-prompt + /v1/accept, so treat it like BUYER_PRIV_KEY_HEX.
BUYER_PASSWORD=CHANGE_ME

# HMAC key for the buyer_session cookie (HttpOnly, SameSite=Lax, 7-day rolling).
# Minimum 32 chars. Generate with:  openssl rand -hex 32
SESSION_SECRET=PASTE_64_HEX_CHARS_HERE_OR_LONGER

# ─── Optional ─────────────────────────────────────────────────────────────

# HTTP listen port (default 3002 in buyer/src/config.ts; we override to
# 8070 in compose to free up the 3xxx range for local dev tooling).
BUYER_PORT=8070

# Cardano network ID. "0" = testnet, "1" = mainnet. (Note: this matches
# the supplier convention, NOT indexer's "testnet"/"mainnet" string.
# See ARCHITECTURE.md §9 follow-up — naming drift to be reconciled.)
NETWORK_ID=0

# Set "0" for plain-HTTP local dev so the buyer_session cookie still rides
# along over loopback. Production behind TLS should leave this unset / "1".
# COOKIE_SECURE=1

# Internal, redacted data source for the authenticated /dashboard page.
# SURPLUS_DASHBOARD_URL=http://surplus-seller:8080/internal/resale-dashboard

# ─── Optional: PDF Book Summarizer (/book page, /v1/pdf-* routes) ─────────
# Upload a PDF → chunk it → pay suppliers to summarize each chunk (one escrow
# per map + reduce call) → full-book summary. All knobs are optional; defaults
# shown. Tune the caps to bound spend/abuse on mainnet.
# Kill switch: "0" disables the feature entirely (every /v1/pdf-* route 503s):
# PDF_ENABLED=1
#
# Hard caps (a job is refused if it would exceed these):
# PDF_MAX_PAGES=400               # reject books larger than this
# PDF_MAX_CHUNKS=200              # reject books that chunk into more calls
# PDF_MAX_PDF_BYTES=25000000      # multipart upload size limit (bytes)
# Refuse to START a job if projected spend would drop the wallet below this:
# PDF_WALLET_FLOOR_LOVELACE=50000000   # 50 AP3X
# Chunking + reduce shape:
# PDF_CHUNK_TARGET_TOKENS=2200    # target tokens per chunk
# PDF_CHUNK_MAX_TOKENS=3000       # hard ceiling per chunk
# PDF_REDUCE_FANIN=8              # summaries collapsed per reduce node
# PDF_RETRY_K=2                   # per-call retries on a different supplier
# Supplier selection (comma-separated model-name substrings):
# PDF_MODEL_ALLOWLIST=kimi,deepseek,gpt
# PDF_MODEL_DENYLIST=qwen2.5:0.5b,qwen2.5-0.5b
# Concurrency. v1 must stay 1 (serial PostEscrow — the shared tx builder
# can't pin wallet inputs yet, so parallel escrows would double-spend):
# PDF_LANE_COUNT=1

# ─── Optional: CIP-33 reference scripts ───────────────────────────────────
# When set, buyer-signed script-spending txs (Accept, Reclaim) read the
# escrow validator from an on-chain reference UTxO instead of inlining
# its CBOR — saving witness-set fees. Must match the values published
# by `supplier tx:publish-reference-scripts` (printed to stdout by that
# CLI). Leave unset to use inlined scripts (current behavior).
# ESCROW_REF_UTXO=<txhash>#0
# ADVERT_REF_UTXO=<txhash>#1   # not used by buyer; kept for env-file symmetry

# ─── Reserved for M1-F ────────────────────────────────────────────────────
# INDEXER_TIMEOUT_MS is referenced in deploy/README.md but is NOT yet read
# by buyer/src/config.ts. M1-F should add it; see follow-ups.
# INDEXER_TIMEOUT_MS=15000