# Copy to .env and adjust. Never commit .env.

# Where the data lives. Relative paths resolve from the repo root.
#   <dir>/control.db    accounts, workspaces, memberships, sessions, invites
#   <dir>/workspaces/   one SQLite file per workspace
WELLFORMED_DATA_DIR=./data

# A pre-tenancy single-database install. If this file exists and is not yet
# registered, the next boot adopts it as the first workspace: its users move to
# the control database and keep their passwords, and the file stays where it is.
WELLFORMED_DB=./data/wellformed.db
WELLFORMED_LEGACY_SLUG=main
WELLFORMED_LEGACY_NAME=Workspace

# HTTP
PORT=4000
HOST=127.0.0.1

# Signing secret for session cookies. Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Required in production; a dev-only default is used when NODE_ENV !== 'production'.
WELLFORMED_SECRET=

# Set to 'production' to enable secure cookies and serve the built web app.
NODE_ENV=development

# Origin allowed to call the API in development (Vite dev server).
WELLFORMED_CORS_ORIGIN=http://localhost:5173

# 'closed' turns off self-serve signup, so the only way in is an invitation or
# `npm run provision`. Anything else leaves /signup open.
WELLFORMED_SIGNUPS=open

# Workspace database handles kept open at once, and how long an unused one
# lingers before the sweep closes it.
WELLFORMED_MAX_OPEN_WORKSPACES=64
WELLFORMED_WORKSPACE_IDLE_MS=600000

# Where people reach this install. Only used to make links inside outbound mail
# absolute — everything in the app builds URLs from the browser's own origin.
WELLFORMED_PUBLIC_URL=http://localhost:4000

# One workspace, published read-only to anyone with no account, by slug. Leave
# it empty for none. Deliberately not a button in the product: publishing a
# customer's database should take shell access.
WELLFORMED_DEMO_SLUG=

# Outbound email. Off unless all three are set, and the product works with it
# off — invites are links you pass on yourself. What it buys is the one flow a
# link cannot do: reaching someone who is locked out.
#   WELLFORMED_EMAIL_PROVIDER=resend|postmark
WELLFORMED_EMAIL_PROVIDER=none
WELLFORMED_EMAIL_KEY=
WELLFORMED_EMAIL_FROM=

# Whose licence this install runs under.
#
# One line, signed by the copyright holder, naming the party the licence was
# granted to. It comes in the package handed over with the licence — the file
# in there called license.env holds exactly this line, ready to paste. It is
# long; keep it on one line, unbroken and unquoted.
#
# Leave it empty and the hosted plans apply: a workspace has a row and table
# ceiling and a new one gets a 14-day trial. Set a valid licence and they do
# not apply at all — no limits, no trial, no prices anywhere in the product,
# because on a licensed install the money was settled on paper and a ceiling
# would only be a wall on a machine nobody is watching.
#
# Setting it grants nothing (see section 2 of LICENSE) and it is not a lock:
# Wellformed starts either way and no data is ever out of reach because of it.
# What it does is state, in a form that cannot be forged, whose licence this
# installation is running under. The server prints that name on start.
#
# This used to take the words `hosted` and `selfhosted`. Those are gone: a mode
# word asserts nothing anyone can check. An install still carrying one is told
# so on start and runs on the hosted plans until a licence is set.
WELLFORMED_LICENSE=

# Billing. Off unless all of these are set, in which case every workspace runs
# on the free plan and `npm run plan` is how the operator moves one. Ignored
# entirely when WELLFORMED_LICENSE=selfhosted.
# Paddle is a merchant of record, so VAT across the EU is theirs, not yours.
WELLFORMED_BILLING_PROVIDER=none
WELLFORMED_BILLING_CHECKOUT_URL=
WELLFORMED_BILLING_PORTAL_URL=
WELLFORMED_BILLING_WEBHOOK_SECRET=
WELLFORMED_BILLING_PRICE_TEAM=

# Used by `npm run provision` when its flags are omitted.
WELLFORMED_ADMIN_EMAIL=admin@wellformed.local
WELLFORMED_ADMIN_PASSWORD=
WELLFORMED_WORKSPACE_NAME=Workspace