.env.example

# StackIntercept — Environment Configuration
# Copy to .env and customize:
#   cp .env.example .env

# === Required ===
# API key for your upstream LLM provider.
# For the OpenAI trial compose profile, set OPENAI_API_KEY in your shell/.env
# and keep STACK_INTERCEPT_UPSTREAM_URL=https://api.openai.com.
OPENAI_API_KEY=sk-your-openai-key-here

# DeepSeek is the default local Rust upstream unless STACK_INTERCEPT_UPSTREAM_URL is changed.
# StackIntercept forwards client Authorization headers to the upstream on normal passthrough requests.
DEEPSEEK_API_KEY=sk-your-key-here

# === Caching ===
# Cache mode: "off", "exact" (default), or "semantic"
#   off       — no caching, every request goes to the provider
#   exact     - SHA256 hash of full request payload. Repeat -> local replay.
#   semantic  — BGE embeddings for similar-prompt matching within same context.
#               Requires model weights: run ./download_model.sh
# STACK_INTERCEPT_CACHE_MODE=exact

# HTTP header for tenant-level cache isolation.
# Example: "X-Tenant-Id" → requests with different header values get separate caches
# STACK_INTERCEPT_TENANT_ID_HEADER=

# Path to BGE model weights (only used in semantic mode)
# STACK_INTERCEPT_MODEL_DIR=./model

# === Semantic Cache Tuning (only applies in "semantic" mode) ===
# Maximum total cache items across all context buckets.
# STACK_INTERCEPT_SEMANTIC_MAX_ITEMS=10000

# Maximum items per context bucket (older entries evicted first).
# STACK_INTERCEPT_SEMANTIC_MAX_BUCKET_ITEMS=256

# TTL in seconds for semantic cache entries.
# STACK_INTERCEPT_SEMANTIC_TTL_SECS=3600

# === Disk Persistence ===
# Path to cache snapshot file (e.g., /var/cache/stack-intercept/snapshot.msgpack).
# Leave unset to keep cache in-memory only (default behavior).
# STACK_INTERCEPT_CACHE_PATH=

# Set to "true" or "1" to disable disk persistence even if CACHE_PATH is set.
# STACK_INTERCEPT_DISABLE_PERSISTENCE=false

# === Model Routing (opt-in) ===
# Enable dynamic model routing: simple prompts on premium models (gpt-4o, etc.)
# are automatically downgraded to a cheaper fallback model.
# WARNING: Opt-in only. Defaults to false for safety.
# STACK_INTERCEPT_ALLOW_MODEL_REWRITE=false

# Upstream provider (where the original model lives)
# STACK_INTERCEPT_UPSTREAM_URL=https://api.deepseek.com

# Fallback provider (cheap model for routed requests)
# STACK_INTERCEPT_FALLBACK_URL=https://api.deepseek.com

# API key for the fallback provider.
# Falls back to DEEPSEEK_API_KEY if not set.
# If neither is configured, routing is disabled (no auth leakage).
# STACK_INTERCEPT_FALLBACK_API_KEY=