# Add your Google OAuth credentials here (or configure via the setup wizard in the app)
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=

# Preferred low-scope Google credentials for "Continue with Google" app login.
# Falls back to GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET above when unset.
# GOOGLE_SIGN_IN_CLIENT_ID=
# GOOGLE_SIGN_IN_CLIENT_SECRET=

# OAuth state signing — REQUIRED in prod for Google OAuth flows
# Falls back to BETTER_AUTH_SECRET if unset; setting it explicitly is recommended
# Generate via: openssl rand -hex 32
# OAUTH_STATE_SECRET=

# Gmail Pub/Sub push notifications (production only — see docs)
# Only set in environments with a publicly-reachable push endpoint.
# Leaving these unset disables push; the app falls back to history-delta polling.
# GMAIL_WATCH_TOPIC=projects/<project>/topics/<topic>
# GMAIL_PUSH_AUDIENCE=https://<your-domain>/api/gmail/push
# GMAIL_PUSH_SIGNER_EMAIL=<pubsub-signer>@<project>.iam.gserviceaccount.com
# GMAIL_WATCH_RENEW_AUDIENCE=https://<your-domain>/api/gmail/renew

# Inbound email webhooks (Resend / SendGrid)
# REQUIRED in prod when inbound email is enabled — webhooks fail-closed without it
# EMAIL_INBOUND_WEBHOOK_SECRET=

# Slack draft intake (optional)
# SLACK_BOT_TOKEN=
# SLACK_SIGNING_SECRET=
# ANTHROPIC_API_KEY=
# A2A_SECRET=

# Background jobs — in production these run automatically.
# Set to 1 to enable locally, 0 to disable in production.
# RUN_BACKGROUND_JOBS=1