{"repo": "calyflow/calyflow-app", "files": {".env.example": {"06eb238dc7d4776bee340dddcb1a1ebf3484025a": {"t": 1785747432.9068897, "n": 7430, "h": "11bae244957ff04e", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights. Two privileges hang off\n# it: workspace Owner (everyone is one while this is empty) and PLATFORM admin\n# (the cross-workspace /admin dashboard), which is never granted without an\n# explicit entry here — empty means \"no platform admins\", not \"everyone\".\n# REQUIRED in production: sign-in refuses without it, so a shared-password\n# instance can't quietly make every invited user an Owner.\nADMIN_EMAILS=you@example.com\n# REQUIRED in production for a single-workspace deployment: a shared passphrase\n# required at sign-in. Without it, anyone who can reach the app can sign in as\n# any email. Leave unset only for local dev.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Usage-based credits (Calyflow Cloud only) ─────────────────────────────\n# These apply ONLY on the hosted product (billing on: Stripe configured, not\n# single-workspace). Self-hosted runs on your OWN provider + connector keys and\n# is never billed — leave these unset. On Cloud, AI + 3rd-party tool usage draws\n# a prepaid CREDIT balance; BYO keys are disabled there (managed keys billed as\n# credits). Users buy region-priced credit packs (lib/billing/packs.ts).\n#   CREDIT_COST_USD          real USD one credit is worth (sets how big the\n#                            made-up numbers are; 0.002 → $1 = 500 credits, so a\n#                            $1 AI call after the 6× margin burns 3,000 credits)\n#   AI_USAGE_MARGIN          markup on AI provider cost (default 6 — $1 → $6)\n#   CONNECTOR_USAGE_MARGIN   markup on 3rd-party vendor cost (default 2)\n#   SIGNUP_GRANT_USD         starter grant per new workspace (default 30 → 15,000 credits)\n#   STARTER_CREDIT_DAYS      starter/trial grant expiry (default 14)\n#   AI_FALLBACK_COST_PER_1M  used only when a model is missing from model_catalog\n#   LOW_COST_COUNTRIES       ISO codes billed at the discounted region band\n# CREDIT_COST_USD=0.002\n# AI_USAGE_MARGIN=6\n# CONNECTOR_USAGE_MARGIN=2\n# SIGNUP_GRANT_USD=30\n# STARTER_CREDIT_DAYS=14\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "8b8c794e639e8daeb354fd41fb044053031725ef": {"t": 1785773268.2325633, "n": 7430, "h": "11bae244957ff04e", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights. Two privileges hang off\n# it: workspace Owner (everyone is one while this is empty) and PLATFORM admin\n# (the cross-workspace /admin dashboard), which is never granted without an\n# explicit entry here — empty means \"no platform admins\", not \"everyone\".\n# REQUIRED in production: sign-in refuses without it, so a shared-password\n# instance can't quietly make every invited user an Owner.\nADMIN_EMAILS=you@example.com\n# REQUIRED in production for a single-workspace deployment: a shared passphrase\n# required at sign-in. Without it, anyone who can reach the app can sign in as\n# any email. Leave unset only for local dev.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Usage-based credits (Calyflow Cloud only) ─────────────────────────────\n# These apply ONLY on the hosted product (billing on: Stripe configured, not\n# single-workspace). Self-hosted runs on your OWN provider + connector keys and\n# is never billed — leave these unset. On Cloud, AI + 3rd-party tool usage draws\n# a prepaid CREDIT balance; BYO keys are disabled there (managed keys billed as\n# credits). Users buy region-priced credit packs (lib/billing/packs.ts).\n#   CREDIT_COST_USD          real USD one credit is worth (sets how big the\n#                            made-up numbers are; 0.002 → $1 = 500 credits, so a\n#                            $1 AI call after the 6× margin burns 3,000 credits)\n#   AI_USAGE_MARGIN          markup on AI provider cost (default 6 — $1 → $6)\n#   CONNECTOR_USAGE_MARGIN   markup on 3rd-party vendor cost (default 2)\n#   SIGNUP_GRANT_USD         starter grant per new workspace (default 30 → 15,000 credits)\n#   STARTER_CREDIT_DAYS      starter/trial grant expiry (default 14)\n#   AI_FALLBACK_COST_PER_1M  used only when a model is missing from model_catalog\n#   LOW_COST_COUNTRIES       ISO codes billed at the discounted region band\n# CREDIT_COST_USD=0.002\n# AI_USAGE_MARGIN=6\n# CONNECTOR_USAGE_MARGIN=2\n# SIGNUP_GRANT_USD=30\n# STARTER_CREDIT_DAYS=14\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "3102cf6deaf87bca88b1276976f33096e07016d8": {"t": 1785773269.9670215, "n": 7150, "h": "fc58ebb75cb22aeb", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Usage-based credits (Calyflow Cloud only) ─────────────────────────────\n# These apply ONLY on the hosted product (billing on: Stripe configured, not\n# single-workspace). Self-hosted runs on your OWN provider + connector keys and\n# is never billed — leave these unset. On Cloud, AI + 3rd-party tool usage draws\n# a prepaid CREDIT balance; BYO keys are disabled there (managed keys billed as\n# credits). Users buy region-priced credit packs (lib/billing/packs.ts).\n#   CREDIT_COST_USD          real USD one credit is worth (sets how big the\n#                            made-up numbers are; 0.002 → $1 = 500 credits, so a\n#                            $1 AI call after the 6× margin burns 3,000 credits)\n#   AI_USAGE_MARGIN          markup on AI provider cost (default 6 — $1 → $6)\n#   CONNECTOR_USAGE_MARGIN   markup on 3rd-party vendor cost (default 2)\n#   SIGNUP_GRANT_USD         starter grant per new workspace (default 30 → 15,000 credits)\n#   STARTER_CREDIT_DAYS      starter/trial grant expiry (default 14)\n#   AI_FALLBACK_COST_PER_1M  used only when a model is missing from model_catalog\n#   LOW_COST_COUNTRIES       ISO codes billed at the discounted region band\n# CREDIT_COST_USD=0.002\n# AI_USAGE_MARGIN=6\n# CONNECTOR_USAGE_MARGIN=2\n# SIGNUP_GRANT_USD=30\n# STARTER_CREDIT_DAYS=14\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "77f5901c5805ca876fbe1f5cb5404c5f6170b2e8": {"t": 1785773271.9723651, "n": 7047, "h": "608ae61db0e55750", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Usage-based credits (Calyflow Cloud only) ─────────────────────────────\n# These apply ONLY on the hosted product (billing on: Stripe configured, not\n# single-workspace). Self-hosted runs on your OWN provider + connector keys and\n# is never billed — leave these unset. On Cloud, AI + 3rd-party tool usage draws\n# a prepaid CREDIT balance; BYO keys are disabled there (managed keys billed as\n# credits). Users buy region-priced credit packs (lib/billing/packs.ts).\n#   CREDIT_COST_USD          real USD one credit is worth (sets how big the\n#                            made-up numbers are; 0.000001 → 10,000,000 = $10)\n#   AI_USAGE_MARGIN          markup on AI provider cost (default 9)\n#   CONNECTOR_USAGE_MARGIN   markup on 3rd-party vendor cost (default 1.3)\n#   SIGNUP_GRANT_USD         starter grant per new workspace (default 10)\n#   STARTER_CREDIT_DAYS      starter/trial grant expiry (default 14)\n#   AI_FALLBACK_COST_PER_1M  used only when a model is missing from model_catalog\n#   LOW_COST_COUNTRIES       ISO codes billed at the discounted region band\n# CREDIT_COST_USD=0.000001\n# AI_USAGE_MARGIN=9\n# CONNECTOR_USAGE_MARGIN=1.3\n# SIGNUP_GRANT_USD=10\n# STARTER_CREDIT_DAYS=14\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "0662b5049724aec211a797e52d4a0490677f5707": {"t": 1785773275.5082679, "n": 7044, "h": "009941f5149ba655", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Usage-based credits (Calyflow Cloud only) ─────────────────────────────\n# These apply ONLY on the hosted product (billing on: Stripe configured, not\n# single-workspace). Self-hosted runs on your OWN provider + connector keys and\n# is never billed — leave these unset. On Cloud, AI + 3rd-party tool usage draws\n# a prepaid CREDIT balance; BYO keys are disabled there (managed keys billed as\n# credits). Users buy region-priced credit packs (lib/billing/packs.ts).\n#   CREDIT_COST_USD          real USD one credit is worth (sets how big the\n#                            made-up numbers are; 0.00001 → 1,000,000 = $10)\n#   AI_USAGE_MARGIN          markup on AI provider cost (default 9)\n#   CONNECTOR_USAGE_MARGIN   markup on 3rd-party vendor cost (default 1.3)\n#   SIGNUP_GRANT_USD         starter grant per new workspace (default 10)\n#   STARTER_CREDIT_DAYS      starter/trial grant expiry (default 14)\n#   AI_FALLBACK_COST_PER_1M  used only when a model is missing from model_catalog\n#   LOW_COST_COUNTRIES       ISO codes billed at the discounted region band\n# CREDIT_COST_USD=0.00001\n# AI_USAGE_MARGIN=9\n# CONNECTOR_USAGE_MARGIN=1.3\n# SIGNUP_GRANT_USD=10\n# STARTER_CREDIT_DAYS=14\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "79e66076eab361b990d314a2543f17fc71f197ec": {"t": 1785773277.9856575, "n": 5855, "h": "3c40a44bd58d405e", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.ai\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "096d85a2602810e33258c6c7a2ff4fd18f1e5cca": {"t": 1785773279.2376351, "n": 5856, "h": "e174305daacbe4ff", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.com\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Managed \"Included\" connector credentials (optional) ───────────────────\n# Calyflow's OWN vendor keys for a handful of sourcing connectors, used by\n# workspaces that haven't connected their own key (BYO always wins), gated by\n# a one-time per-workspace trial credit pool per provider. Each provider is\n# inert until its key is set. VIP overrides live in managed_credit_grants.\n# MANAGED_FIRECRAWL_API_KEY falls back to FIRECRAWL_API_KEY when unset.\n# Kill switch: MANAGED_CREDENTIALS_ENABLED=false. Self-host (single-workspace)\n# runs ungated unless MANAGED_CREDITS_ENFORCE=true.\nMANAGED_CONTACTOUT_API_KEY=\nMANAGED_CONTACTOUT_CREDITS_DEFAULT=50\nMANAGED_SIGNALHIRE_API_KEY=\nMANAGED_SIGNALHIRE_CREDITS_DEFAULT=10\nMANAGED_CORESIGNAL_API_KEY=\nMANAGED_CORESIGNAL_CREDITS_DEFAULT=50\nMANAGED_BRIGHTDATA_API_KEY=\nMANAGED_BRIGHTDATA_CREDITS_DEFAULT=50\nMANAGED_FIRECRAWL_API_KEY=\nMANAGED_FIRECRAWL_CREDITS_DEFAULT=100\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "1c0ec80c30f8e3a422edb37673e64d82bdfbc089": {"t": 1785773280.7916968, "n": 4941, "h": "c5d4a3134026f226", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── CalyflowDB — recruiting database connector (optional) ─────────────────\n# Base URL of the CalyflowDB API the calyflowdb_* tools call. Defaults to the\n# hosted API; point it at a self-hosted or local instance for development\n# (e.g. http://localhost:8787). API keys are per-workspace, pasted in\n# Settings → Connectors — not env.\n# CALYFLOW_DB_API_BASE=https://api.calyflow.com\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "612e9de58949f81d91bd9213885307316e86399c": {"t": 1785773282.171027, "n": 4557, "h": "ab87126129dae93e", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── LinkedIn Proxy — managed people search (optional) ─────────────────────\n# A zero-setup sourcing source powered by Calyflow's OWN provider key, so\n# non-technical users find candidates with nothing to connect. The provider\n# behind it is hidden and swappable. The source card + tools stay hidden until\n# LINKEDIN_PROXY_API_KEY is set. LINKEDIN_PROXY_CREDITS_DEFAULT is the credit\n# pool granted to EACH workspace (a search costs 1–2, a collect 1–2); it's read\n# at run time, so changing it re-grants everyone.\nLINKEDIN_PROXY_API_KEY=\nLINKEDIN_PROXY_CREDITS_DEFAULT=50\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "d14475c6a118bcf723c4b91d4c3c2096c2fc77ef": {"t": 1785773283.469955, "n": 3983, "h": "4a0708d3c974ef18", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n# STRONGLY RECOMMENDED for any internet-reachable single-workspace deployment:\n# a shared passphrase required at sign-in. Without it, anyone who can reach the\n# app can sign in as any email — and become admin by typing an ADMIN_EMAILS\n# address. Leave unset only for local dev or instances behind network auth.\nSINGLE_WORKSPACE_PASSWORD=\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "57d93b5d33f91a4cc0b52d429c9e584d1440b041": {"t": 1785773284.6042283, "n": 3645, "h": "415a1658bd2d1568", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Client domain import (optional) ───────────────────────────────────────\n# Firecrawl powers the \"Import from domain\" researcher on the client knowledge\n# base (scrapes the site + key subpages). The import option only appears when\n# this is set. Get a key at https://www.firecrawl.dev → Dashboard → API Keys.\nFIRECRAWL_API_KEY=\n# Hunter.io (optional) — when set, the importer enriches the company profile\n# with key contacts. https://hunter.io → API.\nHUNTER_API_KEY=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "f127308098f2b286cc56d407f3f78b50b537ce48": {"t": 1785773286.8232226, "n": 3173, "h": "bd6da7a677a96915", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Data-source connectors (optional) ─────────────────────────────────────\n# Public base URL of this deployment, used to build OAuth redirect URIs\n# (no trailing slash). e.g. https://app.calyflow.com or http://localhost:3000\nAPP_BASE_URL=http://localhost:3000\n# Airtable OAuth app (https://airtable.com/create/oauth). Register the redirect\n# URL as ${APP_BASE_URL}/api/connectors/airtable/callback and request scopes\n# data.records:read schema.bases:read\nAIRTABLE_CLIENT_ID=\nAIRTABLE_CLIENT_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "ead754bf1d762085602d4202e7f0dfc601208f69": {"t": 1785773288.1398306, "n": 2670, "h": "6ea140a788a029f3", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\n# The real provider the key + model belong to. Must match the key:\n# anthropic (sk-ant-…) | openai (sk-…) | google | mistral | xai | deepseek | groq | cohere\nCALYFLOW_PLATFORM_PROVIDER=anthropic\n# A model id for that provider (e.g. claude-sonnet-4-6 for anthropic, gpt-5.1 for openai).\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}, "e44b801d1127703f7a936be2cd97720cf8089797": {"t": 1785773290.373881, "n": 2384, "h": "17a6e3f5fe3a2440", "c": "# ───────────────────────────────────────────────────────────────────────────\n# Calyflow environment configuration\n#\n# Copy this file to `.env.local` and fill in the values:\n#   cp .env.example .env.local\n#\n# `.env.local` is gitignored — never commit real secrets.\n# ───────────────────────────────────────────────────────────────────────────\n\n# ─── Supabase (required) ───────────────────────────────────────────────────\n# Project URL and keys from your Supabase project:\n#   Dashboard → Project Settings → API\nSUPABASE_URL=https://your-project-ref.supabase.co\nSUPABASE_SERVICE_ROLE_KEY=your-service-role-key\n# Public anon key — safe to expose to the browser.\nNEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key\n\n# ─── App security (required) ───────────────────────────────────────────────\n# Secret used to encrypt provider API keys at rest. Generate a strong value:\n#   openssl rand -base64 32\nAPP_ENCRYPTION_KEY=change-me-to-a-long-random-string\n\n# ─── Auth / workspace mode ─────────────────────────────────────────────────\n# Self-host mode: no Clerk orgs, every user lands in one shared workspace.\n# Defaults to single-workspace whenever CLERK_SECRET_KEY is unset.\nSINGLE_WORKSPACE=true\n# Comma-separated list of emails granted admin rights.\nADMIN_EMAILS=you@example.com\n\n# Clerk (multi-workspace mode) — leave blank to stay in single-workspace mode.\n# Dashboard → API Keys\nNEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=\nCLERK_SECRET_KEY=\n# Webhooks → add endpoint /api/webhooks/clerk, subscribe to organization.updated,\n# then paste its Signing Secret here so Clerk org renames sync back to the DB.\nCLERK_WEBHOOK_SIGNING_SECRET=\n\n# ─── Calyflow platform provider (optional) ─────────────────────────────────\n# When set, offers a hosted \"Calyflow default\" AI provider so users can run\n# workflows without bringing their own key. Set ENABLED=false to disable.\nPLATFORM_PROVIDER_ENABLED=false\nCALYFLOW_PLATFORM_API_KEY=\nCALYFLOW_PLATFORM_MODEL=claude-sonnet-4-6\n# Free credit (USD) granted to new workspaces on the platform provider.\nONE_TIME_PLATFORM_CREDIT_DEFAULT_USD=11.00\n\n# ─── Cron / scheduled jobs (optional) ──────────────────────────────────────\n# Shared secret required in the Authorization header of cron endpoints.\nCRON_SECRET=\n\n# ─── Development ───────────────────────────────────────────────────────────\n# Stream a canned response instead of calling a real AI provider.\nMOCK_AI=false\n"}}}}