.env.example

# PostgreSQL (required — start with: docker compose up -d)
DATABASE_URL=postgres://skill_platform:skill_platform@127.0.0.1:15432/skill_platform

# Optional MinIO artifact storage. When enabled, newly published version ZIPs
# are the source of file content; PostgreSQL stores only path, size, and SHA-256 metadata.
MINIO_ENABLED=true
MINIO_ENDPOINT=127.0.0.1
MINIO_PORT=9000
MINIO_USE_SSL=false
MINIO_ACCESS_KEY=skill_platform
MINIO_SECRET_KEY=skill_platform_secret
MINIO_BUCKET=skill-artifacts

# Web -> API
NEXT_PUBLIC_API_URL=http://127.0.0.1:3000

# Platform display name (Web UI, API /health, registration emails).
# Brand-dependent copy follows this value; the usage install guide is
# templated with the {{brand_name}} placeholder and synced on dev/build.
# Default when unset: SkillNavigator
# Note: the server reads this at runtime, but the Web UI half reaches the browser
# through next.config.ts (inlined as NEXT_PUBLIC_BRAND_NAME at `next build`), so
# re-run `npm run build:web` after changing it — otherwise the browser keeps the
# previous name and server/client copy disagree.
# BRAND_NAME = SkillNavigator

# Optional sub-path embedding (build-time only, injected at `next build`, NOT read at runtime).
# Required for embedded deployments — tells Next.js where the app is mounted.
# Set only when embedding as a sub-application, e.g. NEXT_PUBLIC_BASE_PATH=/{your-base-path} npm run build:web
# Leave unset (empty string) for standalone deployment. See docs/platform-integration.md §2.1.
# NEXT_PUBLIC_BASE_PATH=

# Local development bypass for publish and verification rate limiting (one publish/verification per user per minute when false).
# Also selects the `npm run setup` seed path:
#   true  -> ADMIN_* is required; setup seeds the official skillnav-skill for it.
#   false -> ADMIN_* seeds skillnav-skill; without ADMIN_* setup seeds the demo Skill under 'alice'.
ON_DEV=true

# Login error strictness. Default true: unified "Invalid username or password"
# (never discloses whether the account exists). Set false for internal/trusted
# environments to get "Invalid username" vs "Invalid password" separately.
LOGIN_ERROR_STRICT=true

# Allow public self-registration via /auth/register. Default true.
# Set false when accounts are managed via scripts/direct DB writes.
PUBLIC_REGISTRATION_ENABLED=true

# Administrator bootstrap (used by `npm run setup`).
# Set all three fields to create the initial admin (first user becomes admin)
# and seed the official skillnav-skill into the registry.
#   ON_DEV=true  -> all three are REQUIRED; setup fails without them.
#   ON_DEV=false -> leaving ALL of them empty seeds the demo Skill under 'alice'
#                   (demo deployments) instead of skipping initialization.
# A partially filled set is always a WARNING naming the missing field(s).
# The initial password is generated randomly and emailed to ADMIN_EMAIL when
# REPORT_MAIL_* is configured; otherwise it is printed once in the setup log.
# ADMIN_DISPLAY_NAME=
# ADMIN_USERNAME=
# ADMIN_EMAIL=

# Explicit dotenv file to load (overrides default .env / .env.rapid fallback).
# Note: `NEXT_PUBLIC_*` have two different readers, so "runtime dotenv never
# affects them" is only half true:
#   - NEXT_PUBLIC_BASE_PATH is read by `next build` alone. Next only auto-loads
#     .env / .env.local / .env.production — it does NOT read .env.rapid, so that
#     one has to be passed on the build command line instead.
#   - NEXT_PUBLIC_WEB_URL / NEXT_PUBLIC_REGISTRY_API_URL / NEXT_PUBLIC_BRAND_NAME
#     are read by scripts/sync-usage-public.mjs (the web app's `prebuild` hook),
#     which DOES load .env.rapid — they are baked into public/install and
#     public/usage/*, so the web app must be rebuilt after changing them.
# DOTENV_FILE=.env.rapid

# Require registration verification email before login. Set false to skip email verification locally.
REGISTRATION_EMAIL_VERIFICATION_REQUIRED=false
# Delete unverified accounts after N days (0 disables). Requires verification to be enabled.
REGISTRATION_UNVERIFIED_RETENTION_DAYS=3

# Public Web URL used in registration verification links (must match how users open the site).
# Embedded deploy: use the full entry URL including the base path, e.g.
# WEB_PUBLIC_URL=https://your-domain.example/MonoSkillNavigator
WEB_PUBLIC_URL=http://127.0.0.1:3001

# Web UI build-time URL (NEXT_PUBLIC_*). Used by the homepage "copy to AI install" prompt.
# May be either the bare origin OR the full entry URL (with base path) — the app dedupes
# against NEXT_PUBLIC_BASE_PATH when building install-guide links. Rebuild after changing.
# NEXT_PUBLIC_WEB_URL=https://your-domain.example
# NEXT_PUBLIC_WEB_URL=https://your-domain.example/MonoSkillNavigator
# Optional full override for the install guide URL in the copy prompt:
# NEXT_PUBLIC_REGISTRY_INSTALL_GUIDE_URL=https://your-domain.example/MonoSkillNavigator/usage/skillnavigator.md
# Registry API address shown to end users in the install guide and the Agent prompt
# (what skillnav connects to). Sub-path deployments include the prefix, e.g.:
# NEXT_PUBLIC_REGISTRY_API_URL=https://your-domain.example/{your-base-path}/api

# pip index for installing the vendored review dependencies (SkillSpector /
# HaluCatch). NOTE: the variable is pip's own `PIP_INDEX_URL` — it must NOT
# carry the NEXT_PUBLIC_ prefix; a NEXT_PUBLIC_PIP_INDEX_URL entry does nothing.
# Scope caveat: scripts/install-skillspector.sh reads the process environment
# only (it does not load dotenv files), and scripts/setup.sh does not invoke it
# — the preflight just reports the gap and tells you to run
# `npm run setup:skillspector` yourself. So an entry here only helps if you
# export it first, e.g.
#   PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/ npm run setup:skillspector
# For a server-wide effect prefer a pip config file instead:
#   ~/.config/pip/pip.conf
#     [global]
#     index-url = https://mirrors.aliyun.com/pypi/simple/
# PIP_INDEX_URL=https://mirrors.aliyun.com/pypi/simple/

# Registration verification email (MailManager / SMTP).
REPORT_MAIL_USERNAME=
REPORT_MAIL_PASSWORD=
REPORT_MAIL_SMTP_SERVER=
REPORT_MAIL_SMTP_PORT=465
# Port 465 defaults to SMTP_SSL; port 587 defaults to STARTTLS.
# REPORT_MAIL_SMTP_SSL=true
# REPORT_MAIL_SMTP_TLS=false
# REGISTRATION_VERIFY_EXPIRES_MS=86400000
# REGISTRATION_EMAIL_PYTHON=python
# HTML 邮件模板（MailManager）：MSN - Obsidian | MSN - Editorial | MSN - Horizon | MSN - General
# MSN_MAIL_TEMPLATE_STYLE=MSN - Obsidian

# Skill 发布结果通知（沿用上面的 REPORT_MAIL_* SMTP 配置）。
# 审查成功：作者/协作者收件，平台 admin 抄送；审查中断或未通过：仅作者/协作者收件。
# 未配置 REPORT_MAIL_* 时不会阻断发布，只会跳过邮件投递。
# SKILL_PUBLISH_EMAIL_NOTIFICATIONS_ENABLED=true
# SKILL_PUBLISH_EMAIL_PYTHON=python
# SKILL_PUBLISH_EMAIL_SCRIPT=scripts/send-skill-publish-email.py

# Fastify JSON body limit for publish/review uploads (ZIP sent as base64 in JSON).
# Default: 50 (MiB). Increase only if you accept larger in-memory request bodies.
API_BODY_LIMIT_MB=50

# Optional HaluCatch reliability evaluation (five static reliability dimensions).
# Vendored at packages/halucatch-1.8.8 (self-contained; needs Python only).
# HALUCATCH_ENABLED=false switches back to the static taskset evaluator
# (Skill-provided tests/*.json) — a valid config, not an error.
# Python 3.8+ is required when enabled.
# HALUCATCH_ENABLED=false
# HALUCATCH_PYTHON=python
# HALUCATCH_DIR=
# HALUCATCH_TIMEOUT_MS=30000

# Optional SkillSpector static security review (no LLM).
# `npm run setup` installs skillspector from PyPI when available, otherwise clones
# https://github.com/nvidia/skillspector into packages/SkillSpector-main.
# SKILLSPECTOR_ENABLED=false disables the provider (a valid config); when enabled,
# Python 3.12+ is required. Defaults: enabled, `python` on Windows, `python3` on Unix,
# 60 seconds timeout, packages/SkillSpector-main source fallback.
# SKILLSPECTOR_ENABLED=false
# SKILLSPECTOR_PYTHON=python
# SKILLSPECTOR_DIR=
# SKILLSPECTOR_TIMEOUT_MS=60000

# Optional VirusTotal package scan. Setting an API key enables hash lookups during
# review; without a key the provider simply stays disabled (valid config).
# VIRUSTOTAL_UPLOAD_ON_MISS=true only if you approve uploading previously unknown
# Skill archives to VirusTotal; uploads may disclose the package to a third party.
# Polling defaults are conservative for lower API quotas.
VIRUSTOTAL_ENABLED=true
VIRUSTOTAL_API_KEY=
# Packages VirusTotal has never seen: true uploads and scans them (recommended), false
# leaves them unchecked — which the platform now reports as "not checked", never as clean.
VIRUSTOTAL_UPLOAD_ON_MISS=true

# Inspection dependency preflight (npm run verify:inspection-deps). `npm run setup` runs it
# and FAILS FAST when ON_DEV=false (production); dev mode only warns unless this is
# set to true. When true, missing VirusTotal configuration is treated as an error too.
# REVIEW_DEPS_STRICT=false

# Async inspection maintenance (API startup + every 5 minutes). Background publish inspections
# do not survive process restarts; on startup, all skill_versions still in "inspecting"
# are marked interrupted (retryable with `skillnav retry-inspection`). Set false to skip startup
# recovery (e.g. local dev with long-running inspections). Default: true (any value except "false").
# INSPECTION_RECOVER_ALL_ON_STARTUP=true
# Fail inspecting versions whose updatedAt is older than this threshold (ms). Default: 1800000 (30 min).
# The same 5-minute timer also sweeps deferred VirusTotal analyses (see VIRUSTOTAL_WAIT_FOR_ANALYSIS).
# INSPECTION_STALE_MS=1800000

VIRUSTOTAL_TIMEOUT_MS=90000
VIRUSTOTAL_LOOKUP_TIMEOUT_MS=30000
VIRUSTOTAL_UPLOAD_URL_TIMEOUT_MS=30000
VIRUSTOTAL_UPLOAD_TIMEOUT_MS=120000
VIRUSTOTAL_ANALYSIS_POLL_TIMEOUT_MS=30000
VIRUSTOTAL_METADATA_LOOKUP_TIMEOUT_MS=30000
# Inline-analysis budget, used only by the synchronous path (VIRUSTOTAL_WAIT_FOR_ANALYSIS=true).
# Allow time for queued scans without exceeding lower API-tier polling rates.
VIRUSTOTAL_ANALYSIS_TIMEOUT_MS=300000
VIRUSTOTAL_POLL_INTERVAL_MS=30000
# Deferred analysis (default): the upload is accepted during review and the report is
# collected by the background sweep (5-minute maintenance timer), so publishing never
# blocks on VirusTotal's queue. Until the report lands the version stays "inspecting"
# (owner-only — the public index requires "completed"). Set true to wait inline instead,
# which is what benchmarks and one-shot report tooling do.
# VIRUSTOTAL_WAIT_FOR_ANALYSIS=false
# Give up on a deferred analysis after this long (ms). VirusTotal publishes no retention
# rule, so the sweep trusts responses first: a dropped analysis is detected right away,
# while one that stays "queued" forever is failed here so the owner can retry-inspection.
# Default: 2700000 (45 minutes).
# VIRUSTOTAL_DEFERRED_TIMEOUT_MS=2700000

# Optional SKILL.md license field enforcement (MIT-0). Off by default on this platform.
# SKILL_LICENSE_VALIDATION_ENABLED=true