aimeat 1.40.0 → 2.0.0

package/dist/.env.example

@@ -1,495 +1,528 @@
-# AIMEAT Node Configuration
-# Copy this file to .env and adjust values for your environment.
-# All values shown are defaults — uncomment and change as needed.
-
-# ── Node Identity ──────────────────────────────────────────────
-AIMEAT_NODE_ID="aimeat-local-001-dev"
-AIMEAT_PORT=40050
-# AIMEAT_NODE_TYPE="full"         # full | relay | mirror
-# AIMEAT_BASE_URL="https://your-domain.com"  # Public URL (default: http://localhost:$PORT)
-
-# ── App Origin Isolation (H-2) ─────────────────────────────────
-# User-published apps run on a dedicated origin so they can never reach the
-# authenticated SPA's session. Requires DNS + a *.apps.<host> TLS cert + an nginx
-# server_name block (see docs/internal/app-origin-deployment.md). Keep DISABLED
-# until that infra is live — enabling it without DNS/cert would 301 apps to a host
-# that does not resolve.
-# AIMEAT_APP_HOST="apps.your-domain.com"   # default: apps.<AIMEAT_BASE_URL host>, empty for localhost/IP
-# AIMEAT_APP_ORIGIN_ENABLED=false          # true → apex inline app HTML 301s to the app origin
-
-# ── Portfolio Origin ──────────────────────────────────────────
-# Published portfolios served standalone at <username>.portfolio.<host> (same
-# isolation model + infra as the app origin: wildcard DNS + TLS + nginx block).
-# AIMEAT_PORTFOLIO_HOST="portfolio.your-domain.com"  # default: portfolio.<AIMEAT_BASE_URL host>, empty for localhost/IP
-# AIMEAT_PORTFOLIO_ORIGIN_ENABLED=false              # true → standalone portfolio URLs advertised + served
-
-# ── Storage Backend ───────────────────────────────────────────
-# Choose storage: memory (default, data lost on restart), sqlite (file-based, zero-config),
-# mongodb (production), or postgresql (production). `postgres` is accepted as an alias.
-# AIMEAT_STORAGE="memory"
-
-# SQLite — file path for the database (auto-created on first run)
-# AIMEAT_SQLITE_PATH="./data/aimeat.db"
-
-# MongoDB — required when AIMEAT_STORAGE=mongodb
-# DATABASE_URL="mongodb://user:pass@localhost:27017/AIMEAT?replicaSet=rs0&authSource=admin"
-
-# PostgreSQL — required when AIMEAT_STORAGE=postgresql
-# DATABASE_URL="postgresql://user:pass@localhost:5432/aimeat?schema=public"
-
-# ── Operator / Admin ───────────────────────────────────────────
-# Auto-generated on startup if not set (printed to console)
-# AIMEAT_ADMIN_PASSWORD="TestAdminPw123!"
-
-# ── Modes ──────────────────────────────────────────────────────
-# Dev mode: allows localhost webhooks, re-registration resets password only (preserves agents/data)
-# AIMEAT_DEV_MODE=false
-
-# Test mode: re-registration wipes account entirely (E2E test isolation). Never use in production.
-# AIMEAT_TEST_MODE=false
-
-# Anonymous mode: no auth required, all agents share one memory space.
-# Runs alongside normal auth — both work simultaneously.
-# On startup creates anonymous owner+agent automatically.
-# Startup logs will show the anonymous prompt URL and share prompt URL.
-# AIMEAT_ANONYMOUS=false
-# AIMEAT_SCREENSHOT_AUTO=false             # true → node auto-generates app thumbnails (needs a headless browser; uses system Edge/Chrome)
-# AIMEAT_SCREENSHOT_INTERVAL_MIN=15        # minutes between auto-screenshot scans
-# CORS: comma-separated list of allowed origins, or * for all (default: *)
-# By architecture, AIMEAT accepts requests from any origin -- the platform
-# is Bearer-token-only (OAuth 2.1), no cookies, so CORS is not the protection
-# layer. Apps published on the network attach from arbitrary browser origins.
-# Set this only if you specifically want to restrict which origins can attach.
-# AIMEAT_CORS_ALLOWED_ORIGINS=*
-# AIMEAT_CORS_ALLOWED_ORIGINS=https://portal.aimeat.fi,https://my-app.example.com
-
-# ── Operator info (REQUIRED for /v1/privacy page) ──────────────
-# These fields identify the operator of THIS node as the GDPR data controller.
-# Every AIMEAT node must fill them in -- otherwise /v1/privacy returns 503
-# "Privacy policy not configured" so the operator is forced to address it
-# before going public. Do NOT ship a deployment that names someone else.
-#
-# Privacy policy template substitution: these env vars feed {{placeholder}}
-# tokens in aimeat/public/privacy.html and privacy.fi.html at render time.
-#
-# REQUIRED:
-# AIMEAT_OPERATOR_NAME="Your Name or Company Ltd"
-# AIMEAT_OPERATOR_ADDRESS="Street, Postcode City, Country"
-# AIMEAT_OPERATOR_COUNTRY="Finland"
-# AIMEAT_OPERATOR_EMAIL="privacy@example.com"
-# AIMEAT_OPERATOR_HOSTING_NAME="Scaleway SAS"
-# AIMEAT_OPERATOR_HOSTING_LOCATION="France (EU/EEA)"
-# AIMEAT_OPERATOR_SUPERVISORY_NAME="Office of the Data Protection Ombudsman"
-# AIMEAT_OPERATOR_SUPERVISORY_URL="https://tietosuoja.fi"
-# AIMEAT_OPERATOR_EFFECTIVE_DATE="2026-05-29"
-#
-# OPTIONAL:
-# AIMEAT_OPERATOR_TYPE="natural_person"   # natural_person | company | organisation | association
-# AIMEAT_OPERATOR_SECURITY_EMAIL=""       # defaults to AIMEAT_OPERATOR_EMAIL
-# AIMEAT_OPERATOR_HOSTING_URL=""          # hyperlink to your hosting provider
-# AIMEAT_OPERATOR_POLICY_VERSION="1.0"
-
-# ── Security Limits ────────────────────────────────────────────
-# AIMEAT_LOGIN_RATE_LIMIT_MAX=15              # Max login attempts per window (default: 15)
-# AIMEAT_LOGIN_RATE_LIMIT_WINDOW_MS=60000     # Login rate limit window in ms (default: 60s)
-# AIMEAT_REGISTRATION_RATE_LIMIT_MAX=5        # Max registrations per window (default: 5)
-# AIMEAT_REGISTRATION_RATE_LIMIT_WINDOW_MS=60000
-# AIMEAT_ADMIN_AUTH_RATE_LIMIT_MAX=5          # Max admin auth attempts per window (default: 5)
-# AIMEAT_ADMIN_AUTH_RATE_LIMIT_WINDOW_MS=60000
-# AIMEAT_PASSWORD_LOCKOUT_ATTEMPTS=5          # Failed attempts before lockout (default: 5)
-# AIMEAT_PASSWORD_LOCKOUT_MINUTES=15          # Lockout duration in minutes (default: 15)
-# AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
-# AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
-# AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
-# AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
-# AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
-
-# ── Security Posture (localhost-flexible → public-strict) ──────
-# AIMEAT runs the SAME code wide-open on localhost AND hardened on the public internet.
-# Security is DRIVEN BY CONFIG, never a code fork. The profile sets safe DEFAULTS for the
-# knobs below; any explicit AIMEAT_* var always overrides it. Full rationale + the ten
-# security invariants: docs/coding-guidelines/security-development-dna.md
-#
-# AIMEAT_SECURITY_PROFILE — local | public
-#   The master switch. Default: `local` when AIMEAT_BASE_URL is http://localhost /
-#   127.0.0.1 / an RFC1918 host, OR AIMEAT_NODE_TYPE=personal; otherwise `public`.
-#   Set it explicitly on a real deployment. `public` flips the two egress knobs below to
-#   their strict values and arms the startup self-check.
-# AIMEAT_SECURITY_PROFILE=public
-#
-# AIMEAT_ALLOW_PRIVATE_EGRESS — may SERVER-SIDE fetches target LOOPBACK (127.0.0.1 / ::1 / localhost)?
-#   Governs every outbound fetch whose URL is user/owner/agent/peer-influenced: the AI-provider
-#   baseUrl, agent/board webhooks, extension ctx.fetch, federation download URLs.
-#   local  default: true  — so the node can reach a LOCAL model server (Ollama / LM Studio at
-#                           http://127.0.0.1:11434 etc.). This is why localhost stays flexible.
-#   public default: false — blocks loopback SSRF (localhost-bound services). NOTE: RFC1918
-#                           (10./172.16./192.168.*), link-local + cloud-metadata (169.254.169.254)
-#                           are ALWAYS blocked server-side regardless of this flag. Redirects are
-#                           re-validated per hop. (AIMEAT_DEV_MODE=true is a back-compat alias.)
-# AIMEAT_ALLOW_PRIVATE_EGRESS=false
-#
-# AIMEAT_AI_PROVIDER_ALLOWLIST — comma-separated HOST allowlist an AI `baseUrl` may point at.
-#   Empty = any host (local dev / self-hosted models). On a public multi-tenant node, restrict
-#   WHERE a decrypted AI key may be sent so a poisoned baseUrl can't exfiltrate it.
-#   Example: openrouter.ai,api.openai.com,api.anthropic.com,api.groq.com
-# AIMEAT_AI_PROVIDER_ALLOWLIST=""
-#
-# Startup self-check: when the resolved profile is `public`, the node warns loudly (or refuses
-# to start) on an unsafe combination — AIMEAT_ANONYMOUS=true, AIMEAT_ALLOW_PRIVATE_EGRESS=true,
-# AIMEAT_FEDERATION_OPEN_JOIN=true, missing AIMEAT_ENCRYPTION_KEY, AIMEAT_CORS_ALLOWED_ORIGINS=*,
-# or AIMEAT_STATS_ACCESS=public. Being insecure on the internet must be a conscious override.
-#
-# ── Reserved-key write guard (NOT a knob — always-on code invariant) ──
-# A role-'app' token (H-2 app grant) has memory:write over the OWNER's namespace. It must NOT
-# be able to write keys the SERVER reads and trusts for behavior, or a granted app could redirect
-# the owner's AI key, reset their spend cap, or force a public directory listing. Denylisted
-# prefixes for non-owner-session principals on POST/PUT /v1/memory (mirrors the ecosystem path's
-# ecoMayWriteKey — see DNA invariant #2):
-#   openrouter.*   → AI provider config incl. the baseUrl the decrypted key is sent to
-#   ai-usage.*     → the daily AI-spend ledger that enforces the budget cap
-#   profile.*      → public directory-listing flag + matchmaking inputs
-# (Enforcement of this guard and the three posture knobs above lands in config.ts + the memory
-#  write path together with the security fixes; documented here as the config/security surface.)
-
-# ── Auth & Tokens ──────────────────────────────────────────────
-# AIMEAT_JWT_TTL=3600              # Legacy / agent JWT lifetime in seconds (default: 1h)
-# Owner sessions: short access token + rotating httpOnly refresh cookie (no key re-signing).
-# AIMEAT_ACCESS_TTL=900            # Owner access-token (JWT) lifetime in seconds (default: 15min)
-# AIMEAT_REFRESH_IDLE_DAYS=30      # Owner refresh-cookie idle window in days (default: 30)
-# AIMEAT_REFRESH_ABSOLUTE_DAYS=90  # Owner refresh-cookie hard cap in days, never extended (default: 90)
-# AIMEAT_REFRESH_GRACE_MS=60000    # Refresh-rotation grace window in ms for concurrency (default: 60s)
-# AIMEAT_OTK_TTL_MS=300000        # OTK expiry in ms (default: 5min)
-# AIMEAT_OTK_GRACE_MS=60000       # OTK grace period in ms (default: 1min)
-
-# ── Morsel Economy ─────────────────────────────────────────────
-# AIMEAT_WELCOME_BONUS=100
-# AIMEAT_DAILY_ALLOWANCE=50
-# AIMEAT_DAILY_ALLOWANCE_CAP=500
-# AIMEAT_BURN_RATE=0.10
-# AIMEAT_MAX_OPERATOR_MINT_PER_DAY=10000
-# AIMEAT_BOARD_POST_BASE_COST=5
-# AIMEAT_BOARD_POST_COST_PER_KB=2
-
-# ── Features ───────────────────────────────────────────────────
-# AIMEAT_KEYED_BROWSE=true         # Tier 0.5 keyed browse (set "false" to disable)
-# AIMEAT_EXTENDED_FEATURES=true    # Boards, federation, storage, validate (set "false" to disable)
-
-# ── Quotas ─────────────────────────────────────────────────────
-# AIMEAT_MEMORY_QUOTA_MB=10
-# AIMEAT_MEMORY_MAX_VALUE_SIZE_KB=1024
-# AIMEAT_MEMORY_MAX_KEYS=1000
-# AIMEAT_STORAGE_QUOTA_MB=100
-# AIMEAT_STORAGE_MAX_FILE_SIZE_MB=10
-# AIMEAT_STORAGE_MAX_CHUNKED_FILE_SIZE_GB=5
-# AIMEAT_MICRO_MEMORY_QUOTA_KB=500
-# AIMEAT_MICRO_MEMORY_MAX_SETS=50
-# AIMEAT_MICRO_MEMORY_MAX_KEYS_PER_SET=100
-# AIMEAT_MICRO_MEMORY_MAX_VALUE_SIZE=16384
-# AIMEAT_MAX_ACTIONS_PER_AGENT=20
-# AIMEAT_MIN_TRUST_PAID_ACTIONS=10
-# AIMEAT_APP_MAX_SIZE_MB=5
-# AIMEAT_AGENT_PORTING_FEE=50
-# AIMEAT_MEMORY_OVERAGE_MORSELS=10
-# AIMEAT_STORAGE_OVERAGE_MORSELS=100
-# AIMEAT_MAX_URL_LENGTH=8192
-
-# ── Federation ─────────────────────────────────────────────────
-# AIMEAT_FEDERATION_ROLE="standalone"  # operator | contributor | standalone
-# AIMEAT_GENESIS_URL=""                # Genesis node URL (for contributor role)
-# AIMEAT_MAX_RELAY_HOPS=3
-# AIMEAT_DEPEERING_GRACE_HOURS=72
-# AIMEAT_KEY_CACHE_REFRESH_MINUTES=5
-
-# ── Work Queue ─────────────────────────────────────────────────
-# AIMEAT_WEBHOOK_MAX_RETRIES=5
-# AIMEAT_WORK_QUEUE_MAX_PENDING=10
-
-# ── Rate Limits (requests per second) ─────────────────────────
-# Global default — all endpoints inherit this unless overridden
-# AIMEAT_RL_GLOBAL=300
-#
-# Per-tier limits (applied to route groups)
-# AIMEAT_RL_AUTH=20
-# AIMEAT_RL_WORK=60
-# AIMEAT_RL_MEMORY=120
-# AIMEAT_RL_BOARDS=60
-#
-# Per-endpoint overrides (optional — defaults to global if not set)
-# AIMEAT_RL_OWNERS=300
-# AIMEAT_RL_GHII=300
-# AIMEAT_RL_FLAGS=300
-# AIMEAT_RL_APPEALS=300
-# AIMEAT_RL_ADMIN_SETUP=300
-# AIMEAT_RL_FEDERATION=300
-# AIMEAT_RL_CATALOGUE=300
-# AIMEAT_RL_AUTH_CHALLENGE=300
-
-# ── Personal Nodes ───────────────────────────────────────────
-# AIMEAT_PERSONAL_NODES_ENABLED=true
-# AIMEAT_PERSONAL_NODE_MAX_SLOTS=100
-# AIMEAT_PERSONAL_MAILBOX_QUOTA_MB=50
-# AIMEAT_PERSONAL_MAILBOX_RETENTION_DAYS=7
-# AIMEAT_PERSONAL_HEARTBEAT_MS=30000
-# AIMEAT_PERSONAL_OFFLINE_MS=300000
-
-# ── Connector Forward Tunnel ─────────────────────────────────
-# One persistent WS per agent identity at /v1/connect/tunnel: carries forward
-# API calls (agent→server) + realtime reverse delivery (server→agent push).
-# OPT-IN — off by default until the Node connector client (Phase 3) ships.
-# AIMEAT_CONNECT_TUNNEL_ENABLED=false
-# AIMEAT_CONNECT_TUNNEL_HEARTBEAT_MS=30000
-# AIMEAT_CONNECT_TUNNEL_OFFLINE_MS=90000
-# AIMEAT_CONNECT_TUNNEL_REQUEST_TIMEOUT_MS=30000
-
-# ── Email / SMTP (Phase 1.1) ────────────────────────────────
-# AIMEAT_SMTP_HOST="smtp.example.com"
-# AIMEAT_SMTP_PORT=587
-# AIMEAT_SMTP_USER="noreply@example.com"
-# AIMEAT_SMTP_PASS="secret"
-# AIMEAT_SMTP_FROM="AIMEAT <noreply@example.com>"
-# AIMEAT_SMTP_SECURE=false
-# AIMEAT_SMTP_REJECT_UNAUTHORIZED=false  # Set to false for STARTTLS with self-signed certs
-# AIMEAT_EMAIL_CONFIRMATION_REQUIRED=false
-
-# ── Consent Layer (Phase 0.3) ────────────────────────────────
-# AIMEAT_CONSENT_EXPIRY_CHECK_INTERVAL_MS=60000  # How often to check for expired consents (default: 1 min)
-# AIMEAT_CONSENT_DEFAULT_SCOPE="federation"       # Default consent scope: private | dmz | federation
-# AIMEAT_CONSENT_MAX_PER_AGENT=100                # Max consent grants per agent
-
-# ── TOTP / 2FA (Phase 0.5) ──────────────────────────────────
-# AIMEAT_TOTP_ENABLED=true                # Enable TOTP 2FA support
-# AIMEAT_TOTP_ISSUER="AIMEAT"             # Issuer name shown in authenticator apps
-# AIMEAT_TOTP_PERIOD=30                   # TOTP code period in seconds
-# AIMEAT_TOTP_WINDOW=1                    # Acceptable time drift window (±1 period)
-# AIMEAT_TOTP_BACKUP_CODE_COUNT=10        # Number of backup codes generated
-# AIMEAT_TOTP_SECRET_ENCRYPTION_KEY=""    # Hex-encoded 32-byte AES key for encrypting TOTP secrets
-#                                          # Generate: openssl rand -hex 32
-# AIMEAT_TOTP_MAX_FAILED_ATTEMPTS=5       # Max failed TOTP attempts before lockout
-# AIMEAT_TOTP_LOCKOUT_SECONDS=300         # Lockout duration after max failed attempts (default: 5 min)
-
-# ── Match Notifications (Phase 1.6) ────────────────────────────
-# AIMEAT_MATCH_NOTIFICATION_INTERVAL_HOURS=24  # How often to check for new matches
-# AIMEAT_MATCH_NOTIFICATION_ENABLED=true        # Operator can disable
-
-# ── AI Matching (Phase 2.1) ─────────────────────────────────
-# AIMEAT_MATCHING_ENABLED=true
-# AIMEAT_MATCH_INTERVAL_HOURS=24          # How often matching runs
-# AIMEAT_MATCH_THRESHOLD=0.5              # Minimum match score (0.0-1.0)
-# AIMEAT_MATCH_MAX_SUGGESTIONS=5          # Max suggestions per user per round
-# AIMEAT_MATCH_MAX_DISTANCE_KM=100        # Max distance for matching
-# AIMEAT_MATCH_COOLDOWN_DAYS=7            # Same pair re-suggested after this
-
-# ── Marketplace (Phase 2.6) ───────────────────────────────────
-# AIMEAT_MARKETPLACE_ENABLED=true           # Enable marketplace feature
-# AIMEAT_MARKETPLACE_LISTING_FEE=2          # Listing fee in morsels
-# AIMEAT_MARKETPLACE_TX_FEE_PERCENT=5       # Transaction fee percentage (buyer pays)
-# AIMEAT_MARKETPLACE_ESCROW=true            # Enable escrow for purchases
-
-# ── Commerce core + fee policy (TARGET-033) ───────────────────
-# AIMEAT_MARKETPLACE_FEE_MODE=operator      # Fee destination: operator (credit node operator) | burn (remove from supply)
-# AIMEAT_OPERATOR_FEE_ACCOUNT=              # Owner name receiving operator-mode fees (empty = first operator-role owner)
-# AIMEAT_COMMERCE_FEE_PERCENT=              # Checkout fee % (empty inherits AIMEAT_MARKETPLACE_TX_FEE_PERCENT)
-# AIMEAT_COMMERCE_ENABLED=true              # Checkout sessions (/v1/commerce) + UCP checkout capability
-# AIMEAT_COMMERCE_SESSION_TTL_MINUTES=60    # Open checkout-session lifetime
-# AIMEAT_MCP_CARD_COMMERCE_TOOLS=inline     # /.well-known/mcp.json commerce_tools block: inline (embed the priced app-tool catalog) | pointer (lean card linking /v1/commerce/tools)
-# AIMEAT_PLATFORM_STRIPE_KEY=              # Operator's OWN Stripe Connect platform secret (EE) — takes the platform application-fee on money sales; NOT custody (direct charges land on the seller)
-
-# ── Crawlers / Content Signals / Web Bot Auth ──────────────────
-# AIMEAT_WEB_BOT_AUTH_SIGN=false           # Sign outbound HTTP (RFC 9421 Web Bot Auth, node Ed25519 key) so peers/CDNs can verify AIMEAT traffic against /.well-known/http-message-signatures-directory. OFF by default: stamps identifying Signature headers on every outbound request (linkability; rare strict endpoints may reject unknown headers). The key directory is always served.
-# AIMEAT_CONTENT_SIGNAL="search=yes, ai-input=yes, ai-train=no"   # robots.txt Content Signals Policy directive (contentsignals.org). Keep consistent with the per-bot rules in public/robots.txt; 'off' removes the directive.
-
-# ── IndexNow (Bing/Yandex search indexing) ─────────────────────
-# Generate a key: openssl rand -hex 16
-# After setting, run: pnpm indexnow
-# AIMEAT_INDEXNOW_KEY="your-hex-key-here"
-
-# ── Push Notifications / PWA (Phase 3.1) ────────────────────
-# Generate VAPID keys: npx web-push generate-vapid-keys
-# AIMEAT_PUSH_ENABLED=true
-# AIMEAT_VAPID_PUBLIC_KEY=""
-# AIMEAT_VAPID_PRIVATE_KEY=""
-# AIMEAT_VAPID_SUBJECT="mailto:admin@aimeat.example.com"
-# AIMEAT_PUSH_NOTIFY_TYPES="work_assignment,action_request"  # message types that trigger push notification
-# AIMEAT_PUSH_COOLDOWN_MIN=5                                 # minimum minutes between notifications per node
-# AIMEAT_PUSH_MAX_SUBSCRIPTIONS_PER_NODE=5                   # max push subscriptions per personal node
-# AIMEAT_PUSH_MAX_FAILURES=3                                 # auto-remove subscription after N consecutive failures
-# AIMEAT_EMAIL_RATE_LIMIT_MIN=30                             # minimum minutes between email notifications per node
-
-# ── EUDIW / Identity Verification (Phase 3.3) ────────────────
-# AIMEAT_EUDIW_ENABLED=false
-# AIMEAT_EUDIW_CLIENT_ID="aimeat-verifier-001"
-# AIMEAT_EUDIW_REDIRECT_URI="https://your-node.example/v1/ghii/verify/eudiw/callback"
-# AIMEAT_FTN_ENABLED=false
-# AIMEAT_FTN_PROVIDER_URL="https://tunnistautuminen.suomi.fi"
-# AIMEAT_FTN_CLIENT_ID=""                                      # OIDC client_id from FTN broker
-# AIMEAT_FTN_CLIENT_SECRET=""                                  # OIDC client_secret from FTN broker
-# AIMEAT_VC_ISSUER_DID="did:web:your-node.example"
-# AIMEAT_NONCE_TTL_SECONDS=300                                 # verification nonce TTL (60-3600)
-# AIMEAT_NATIONAL_EID_PID_CLAIM="personal_identity_code"       # FI: personal_identity_code, SE: personalNumber, DK: dk.cpr
-
-# ── Social login — Google sign-in (OIDC) ─────────────────────
-# Create OAuth credentials at https://console.cloud.google.com/apis/credentials
-# Authorized redirect URI must exactly match the callback below.
-# AIMEAT_GOOGLE_OAUTH_ENABLED=false
-# AIMEAT_GOOGLE_OAUTH_CLIENT_ID=""                             # OAuth 2.0 client ID from Google Cloud Console
-# AIMEAT_GOOGLE_OAUTH_CLIENT_SECRET=""                         # OAuth 2.0 client secret
-# AIMEAT_GOOGLE_OAUTH_REDIRECT_URI=""                          # default: <baseUrl>/v1/ghii/login/google/callback
-
-# ── Social login — Casdoor sign-in (OIDC) ────────────────────
-# Casdoor is an open-source IdP. In its admin: create an Application, add the redirect URI below,
-# then copy the client id/secret here. Casdoor is the authority for its org's accounts, so AIMEAT
-# treats emails it returns as verified (enables link-by-email) — only enable IdPs you trust for that.
-# AIMEAT_CASDOOR_OAUTH_ENABLED=false
-# AIMEAT_CASDOOR_OAUTH_ENDPOINT=""                             # Casdoor server URL, e.g. https://casdoor.example.com
-# AIMEAT_CASDOOR_OAUTH_CLIENT_ID=""                            # Application client ID from Casdoor
-# AIMEAT_CASDOOR_OAUTH_CLIENT_SECRET=""                        # Application client secret from Casdoor
-# AIMEAT_CASDOOR_OAUTH_REDIRECT_URI=""                         # default: <baseUrl>/v1/ghii/login/casdoor/callback
-
-# ── Social login — Microsoft Entra ID sign-in (OIDC) ─────────
-# Register an app (free) at https://entra.microsoft.com → App registrations. Add a "Web" platform
-# with the redirect URI below and create a client secret. TENANT controls who may sign in:
-#   • a Directory (tenant) GUID  → ONLY that org's members (enterprise gating; AIMEAT also checks the
-#     `tid` claim and treats the email as verified so members auto-link).
-#   • common        → any work/school account AND personal Microsoft accounts (widest).
-#   • organizations → any work/school account (any org).  • consumers → personal accounts only.
-# Note: for the non-GUID modes strict issuer validation can be finicky; pin a tenant GUID for the
-# most reliable + gated setup.
-# AIMEAT_ENTRA_OAUTH_ENABLED=false
-# AIMEAT_ENTRA_OAUTH_TENANT="common"                           # tenant GUID | common | organizations | consumers
-# AIMEAT_ENTRA_OAUTH_CLIENT_ID=""                              # Application (client) ID from the app registration
-# AIMEAT_ENTRA_OAUTH_CLIENT_SECRET=""                          # Client secret value from the app registration
-# AIMEAT_ENTRA_OAUTH_REDIRECT_URI=""                           # default: <baseUrl>/v1/ghii/login/entra/callback
-
-# ── Consul (optional fleet management) ───────────────────────
-# Connect to HashiCorp Consul for centralized config management across nodes.
-# Values in Consul KV take precedence over file/.env but below database overrides.
-# AIMEAT_CONSUL_ENABLED=false
-# AIMEAT_CONSUL_URL=http://localhost:8500
-# AIMEAT_CONSUL_PREFIX=aimeat/config
-# AIMEAT_CONSUL_TOKEN=
-# AIMEAT_CONSUL_WATCH_INTERVAL=30
-# AIMEAT_CONSUL_DATACENTER=
-
-# ── Cross-Federation (Phase 3.4) ────────────────────────────
-# AIMEAT_CROSS_FEDERATION_ENABLED=true
-# AIMEAT_MAX_GENESIS_PEERS=10
-# AIMEAT_GENESIS_SYNC_INTERVAL_HOURS=6
-
-# ── Federation Data Sync ─────────────────────────────────
-# AIMEAT_SYNC_MODE="hybrid"                   # bulk | instant | hybrid
-# AIMEAT_SYNC_INTERVAL_HOURS=6                # Scheduled sync fallback interval
-# AIMEAT_SYNC_BATCH_DELAY_MS=5000             # Event batching window (instant/hybrid mode)
-# AIMEAT_REPLICATION_QUEUE_MAX=10000           # Max replication queue entries
-# AIMEAT_REPLICATION_QUEUE_TTL_HOURS=72        # Max age of replication queue entries
-# AIMEAT_MAX_CONCURRENT_SYNCS=5               # Max parallel outbound sync operations
-# AIMEAT_FEDERATION_TIMEOUT_MS=10000           # Timeout for outbound federation HTTP requests
-# AIMEAT_MESSAGE_RETRY_INTERVAL_MS=60000       # Retry interval for queued cross-node direct messages
-# AIMEAT_MESSAGE_RETRY_TTL_HOURS=168           # Give up on undelivered direct messages after this (7 days)
-# AIMEAT_GENESIS_MEMORY_CACHE=false            # Cache routed genesis memory results locally
-# AIMEAT_GENESIS_MEMORY_CACHE_TTL_HOURS=4      # Genesis memory cache TTL
-
-# ── Cookie Consent (for service builders) ────────────────────
-# Opt-in cookie consent banner for portal HTML pages.
-# Uses vanilla-cookieconsent v3. Disabled by default.
-# AIMEAT_COOKIE_CONSENT_ENABLED=false
-# AIMEAT_COOKIE_CONSENT_CATEGORIES="necessary,analytics,marketing"
-# AIMEAT_COOKIE_CONSENT_POLICY_URL="https://example.com/privacy"
-
-# ── Realtime P2P Rooms ───────────────────────────────────────
-# AIMEAT_REALTIME_ENABLED=true                      # Enable realtime room discovery & signaling
-# AIMEAT_REALTIME_MAX_ROOMS=100                     # Max concurrent rooms on this node
-# AIMEAT_REALTIME_MAX_PEERS_PER_ROOM=20             # Max peers per room
-# AIMEAT_REALTIME_ROOM_IDLE_TIMEOUT_MS=3600000      # Empty room cleanup timeout (default: 1h)
-# AIMEAT_REALTIME_MAX_MESSAGE_SIZE_BYTES=16384      # Max WebSocket message size (default: 16 KB)
-# AIMEAT_STUN_SERVERS="stun:stun.l.google.com:19302,stun:stun1.l.google.com:19302"
-# AIMEAT_TURN_SERVER=""                              # TURN server URL (e.g. turn:turn.example.com:3478)
-# AIMEAT_TURN_USERNAME=""                            # TURN credentials
-# AIMEAT_TURN_CREDENTIAL=""
-# ── Encrypted Chat ────────────────────────────────────────────
-# AIMEAT_ECHAT_ANONYMOUS=false                     # Allow anonymous echat WS connections (default: false)
-
-# ── Node Portal (Site) ──────────────────────────────────────
-# AIMEAT_SITE_ENABLED=true                           # Serve portal at GET /
-# AIMEAT_SITE_MAX_TEMPLATE_SIZE_KB=512               # Max custom template size
-# AIMEAT_SITE_CACHE_TTL_SECONDS=60                   # Resolved HTML cache lifetime
-# AIMEAT_SITE_KV_REGION="Helsinki"                   # Custom KV pair → {{kv:region}}
-# AIMEAT_SITE_KV_CONTACT="admin@example.fi"          # Custom KV pair → {{kv:contact}}
-
-# ── Node Portal Load-Balancer Sync ──────────────────────────
-# AIMEAT_SITE_LB_ENABLED=false                        # Enable LB sync mode (mirrors portal from origin)
-# AIMEAT_SITE_LB_ORIGIN_URL=https://aimeat.io         # Origin node URL to sync from
-# AIMEAT_SITE_LB_SYNC_INTERVAL_MIN=30                 # Sync interval in minutes
-# AIMEAT_SITE_LB_SYNC_ON_STARTUP=true                 # Sync immediately on startup
-
-# ── Setup Wizard (Phase 1.2) ───────────────────────────────
-# Restrict setup wizard access to specific IPs (comma-separated, empty = no restriction)
-# AIMEAT_SETUP_ALLOWED_IPS=127.0.0.1,::1
-
-# ── Content Moderation ─────────────────────────────────────
-# Auto-hide content after this many active flags (default: 5)
-# AIMEAT_AUTO_HIDE_THRESHOLD=5
-
-# ── Statistics ──────────────────────────────────────────────
-AIMEAT_STATS_ENABLED=true
-AIMEAT_STATS_ACCESS=public          # public | authenticated | operator
-
-# ── Scoped Agent Capabilities (REQ-006) ───────────────────────
-# AIMEAT_DEFAULT_AGENT_SCOPES="memory:read,memory:write,catalogue:read"
-# AIMEAT_MAX_AGENT_SCOPES="*"
-# Enforce per-agent scopes on the /v1/mcp tool surface (mirrors REST requireScope gates).
-# Default true. Set false for a warn-only rollout: all tools stay registered, but tools that
-# WOULD be filtered are logged so you can measure impact before enforcing.
-# AIMEAT_MCP_ENFORCE_SCOPES=true
-
-# ── Ecosystem Applications (GEAI) ──────────────────────────────
-# Scope bounds for ecosystem-app (GEAI) connections, parallel to the agent knobs above.
-# Defaults lean read + deposit (ecosystem apps mostly deposit refined data into owner areas).
-# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,knowledge:contribute,organism:read"
-# AIMEAT_MAX_ECO_SCOPES="*"
-# GEAI credential lifetime in seconds (default 90 days, same class as agent JWTs).
-# AIMEAT_ECO_JWT_TTL=7776000
-
-# ── Prometheus Metrics ─────────────────────────────────────
-# Prometheus metrics endpoint (GET /v1/metrics)
-AIMEAT_METRICS_ENABLED=false
-AIMEAT_METRICS_ACCESS=operator      # public | authenticated | operator
-
-# ── Node Extensions (V8 Isolates) ────────────────────────────
-# AIMEAT_EXTENSIONS_ENABLED=true       # Extension system (default: true)
-# AIMEAT_EXT_MAX_MEMORY_MB=64          # V8 isolate memory limit per action
-# AIMEAT_EXT_TIMEOUT_MS=5000           # V8 isolate CPU timeout per action
-# AIMEAT_EXT_MAX_API_CALLS=50          # Max AIMEAT API calls per action invocation
-# AIMEAT_EXT_MAX_CODE_SIZE_KB=256      # Max JS source size per action
-# AIMEAT_EXT_MAX_INSTALLED=20          # Max extensions installed on this node
-# AIMEAT_EXT_INSTALL_ROLE=operator     # Role required to install extensions: operator | owner (default: operator)
-# AIMEAT_MAX_EXTENSIONS_PER_OWNER=10   # Max extensions per owner when owner-role installs enabled (default: 10)
-
-# ── Service Generator ────────────────────────────────────
-# AIMEAT_GENERATOR_ENABLED=true        # Show Generator tab in profile view (default: true)
-
-# ── Packages & Templates ──────────────────────────────────
-# Master switch for the package system
-# AIMEAT_PACKAGES_ENABLED=true
-# Who can create packages: "operator" (default) or "owner"
-# AIMEAT_PACKAGE_CREATE_ROLE=operator
-# Maximum total size of all components in a package (MB)
-# AIMEAT_PACKAGE_MAX_SIZE_MB=50
-# Maximum number of components per package
-# AIMEAT_PACKAGE_MAX_COMPONENTS=20
-# Maximum packages per author
-# AIMEAT_PACKAGE_MAX_PER_AUTHOR=50
-# Master switch for template gallery
-# AIMEAT_TEMPLATES_ENABLED=true
-# Allow reviews on template listings
-# AIMEAT_TEMPLATE_REVIEWS_ENABLED=true
-# Allow discussions on template listings
-# AIMEAT_TEMPLATE_DISCUSSIONS_ENABLED=true
-# Enable cross-node template sharing via federation
-# AIMEAT_PACKAGE_FEDERATION_ENABLED=false
-# Auto-accept federated templates without operator review
-# AIMEAT_PACKAGE_FEDERATION_AUTO_ACCEPT=false
-
-# ── Portfolio ──
-# AIMEAT_PORTFOLIO=true              # Enable portfolio feature (default: true)
-# AIMEAT_PORTFOLIO_MAX_SIZE_KB=512   # Max portfolio HTML file size (default: 512KB)
-# AIMEAT_PORTFOLIO_MAX_IMAGES=20     # Max images selectable for portfolio prompt (default: 20)
+# AIMEAT Node Configuration
+# Copy this file to .env and adjust values for your environment.
+# All values shown are defaults — uncomment and change as needed.
+
+# ── Node Identity ──────────────────────────────────────────────
+AIMEAT_NODE_ID="aimeat-local-001-dev"
+AIMEAT_PORT=40050
+# AIMEAT_NODE_TYPE="full"         # full | relay | mirror
+# AIMEAT_BASE_URL="https://your-domain.com"  # Public URL (default: http://localhost:$PORT)
+
+# ── App Origin Isolation (H-2) ─────────────────────────────────
+# User-published apps run on a dedicated origin so they can never reach the
+# authenticated SPA's session. Requires DNS + a *.apps.<host> TLS cert + an nginx
+# server_name block (see docs/internal/app-origin-deployment.md). Keep DISABLED
+# until that infra is live — enabling it without DNS/cert would 301 apps to a host
+# that does not resolve.
+# AIMEAT_APP_HOST="apps.your-domain.com"   # default: apps.<AIMEAT_BASE_URL host>, empty for localhost/IP
+# AIMEAT_APP_ORIGIN_ENABLED=false          # true → apex inline app HTML 301s to the app origin
+
+# ── Portfolio Origin ──────────────────────────────────────────
+# Published portfolios served standalone at <username>.portfolio.<host> (same
+# isolation model + infra as the app origin: wildcard DNS + TLS + nginx block).
+# AIMEAT_PORTFOLIO_HOST="portfolio.your-domain.com"  # default: portfolio.<AIMEAT_BASE_URL host>, empty for localhost/IP
+# AIMEAT_PORTFOLIO_ORIGIN_ENABLED=false              # true → standalone portfolio URLs advertised + served
+
+# ── Storage Backend ───────────────────────────────────────────
+# Choose storage: memory (default, data lost on restart), sqlite (file-based, zero-config),
+# or postgres-kysely (production PostgreSQL; schema migrates on boot).
+# `postgres` / `postgresql` are accepted as aliases for postgres-kysely.
+# AIMEAT_STORAGE="memory"
+
+# SQLite — file path for the database (auto-created on first run)
+# AIMEAT_SQLITE_PATH="./data/aimeat.db"
+
+# PostgreSQL — required when AIMEAT_STORAGE=postgres-kysely
+# DATABASE_URL="postgresql://user:pass@localhost:5432/aimeat?schema=public"
+
+# ── Operator / Admin ───────────────────────────────────────────
+# Auto-generated on startup if not set (printed to console)
+# AIMEAT_ADMIN_PASSWORD="TestAdminPw123!"
+
+# ── Diagnostics ────────────────────────────────────────────────
+# Per-request storage profiler. When =true, storage calls are timed+counted for any request that opts
+# in with `?trace=1` or the `x-aimeat-trace: 1` header; the summary (query count, DB ms, wall ms,
+# hottest methods) is in the `X-Aimeat-Perf` response header and the log. Safe-off default; leave unset
+# in production (a Proxy wraps every storage call when on). See services/perf-trace.ts.
+# AIMEAT_PERF_TRACE=true
+
+# ── Modes ──────────────────────────────────────────────────────
+# Dev mode: allows localhost webhooks, re-registration resets password only (preserves agents/data)
+# AIMEAT_DEV_MODE=false
+
+# Test mode: re-registration wipes account entirely (E2E test isolation). Never use in production.
+# AIMEAT_TEST_MODE=false
+
+# Anonymous mode: no auth required, all agents share one memory space.
+# Runs alongside normal auth — both work simultaneously.
+# On startup creates anonymous owner+agent automatically.
+# Startup logs will show the anonymous prompt URL and share prompt URL.
+# AIMEAT_ANONYMOUS=false
+# AIMEAT_SCREENSHOT_AUTO=false             # true → node auto-generates app thumbnails (needs a headless browser; uses system Edge/Chrome)
+# AIMEAT_SCREENSHOT_INTERVAL_MIN=15        # minutes between auto-screenshot scans
+# CORS: comma-separated list of allowed origins, or * for all (default: *)
+# By architecture, AIMEAT accepts requests from any origin -- the platform
+# is Bearer-token-only (OAuth 2.1), no cookies, so CORS is not the protection
+# layer. Apps published on the network attach from arbitrary browser origins.
+# Set this only if you specifically want to restrict which origins can attach.
+# AIMEAT_CORS_ALLOWED_ORIGINS=*
+# AIMEAT_CORS_ALLOWED_ORIGINS=https://portal.aimeat.fi,https://my-app.example.com
+
+# ── Operator info (REQUIRED for /v1/privacy page) ──────────────
+# These fields identify the operator of THIS node as the GDPR data controller.
+# Every AIMEAT node must fill them in -- otherwise /v1/privacy returns 503
+# "Privacy policy not configured" so the operator is forced to address it
+# before going public. Do NOT ship a deployment that names someone else.
+#
+# Privacy policy template substitution: these env vars feed {{placeholder}}
+# tokens in aimeat/public/privacy.html and privacy.fi.html at render time.
+#
+# REQUIRED:
+# AIMEAT_OPERATOR_NAME="Your Name or Company Ltd"
+# AIMEAT_OPERATOR_ADDRESS="Street, Postcode City, Country"
+# AIMEAT_OPERATOR_COUNTRY="Finland"
+# AIMEAT_OPERATOR_EMAIL="privacy@example.com"
+# AIMEAT_OPERATOR_HOSTING_NAME="Scaleway SAS"
+# AIMEAT_OPERATOR_HOSTING_LOCATION="France (EU/EEA)"
+# AIMEAT_OPERATOR_SUPERVISORY_NAME="Office of the Data Protection Ombudsman"
+# AIMEAT_OPERATOR_SUPERVISORY_URL="https://tietosuoja.fi"
+# AIMEAT_OPERATOR_EFFECTIVE_DATE="2026-05-29"
+#
+# OPTIONAL:
+# AIMEAT_OPERATOR_TYPE="natural_person"   # natural_person | company | organisation | association
+# AIMEAT_OPERATOR_SECURITY_EMAIL=""       # defaults to AIMEAT_OPERATOR_EMAIL
+# AIMEAT_OPERATOR_HOSTING_URL=""          # hyperlink to your hosting provider
+# AIMEAT_OPERATOR_POLICY_VERSION="1.0"
+
+# ── Security Limits ────────────────────────────────────────────
+# AIMEAT_LOGIN_RATE_LIMIT_MAX=15              # Max login attempts per window (default: 15)
+# AIMEAT_LOGIN_RATE_LIMIT_WINDOW_MS=60000     # Login rate limit window in ms (default: 60s)
+# AIMEAT_REGISTRATION_RATE_LIMIT_MAX=5        # Max registrations per window (default: 5)
+# AIMEAT_REGISTRATION_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_MAX=5          # Max admin auth attempts per window (default: 5)
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_PASSWORD_LOCKOUT_ATTEMPTS=5          # Failed attempts before lockout (default: 5)
+# AIMEAT_PASSWORD_LOCKOUT_MINUTES=15          # Lockout duration in minutes (default: 15)
+# AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
+# AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
+# AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
+# AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
+# AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
+
+# ── Security Posture (localhost-flexible → public-strict) ──────
+# AIMEAT runs the SAME code wide-open on localhost AND hardened on the public internet.
+# Security is DRIVEN BY CONFIG, never a code fork. The profile sets safe DEFAULTS for the
+# knobs below; any explicit AIMEAT_* var always overrides it. Full rationale + the ten
+# security invariants: docs/coding-guidelines/security-development-dna.md
+#
+# AIMEAT_SECURITY_PROFILE — local | public
+#   The master switch. Default: `local` when AIMEAT_BASE_URL is http://localhost /
+#   127.0.0.1 / an RFC1918 host, OR AIMEAT_NODE_TYPE=personal; otherwise `public`.
+#   Set it explicitly on a real deployment. `public` flips the two egress knobs below to
+#   their strict values and arms the startup self-check.
+# AIMEAT_SECURITY_PROFILE=public
+#
+# AIMEAT_ALLOW_PRIVATE_EGRESS — may SERVER-SIDE fetches target LOOPBACK (127.0.0.1 / ::1 / localhost)?
+#   Governs every outbound fetch whose URL is user/owner/agent/peer-influenced: the AI-provider
+#   baseUrl, agent/board webhooks, extension ctx.fetch, federation download URLs.
+#   local  default: true  — so the node can reach a LOCAL model server (Ollama / LM Studio at
+#                           http://127.0.0.1:11434 etc.). This is why localhost stays flexible.
+#   public default: false — blocks loopback SSRF (localhost-bound services). NOTE: RFC1918
+#                           (10./172.16./192.168.*), link-local + cloud-metadata (169.254.169.254)
+#                           are ALWAYS blocked server-side regardless of this flag. Redirects are
+#                           re-validated per hop. (AIMEAT_DEV_MODE=true is a back-compat alias.)
+# AIMEAT_ALLOW_PRIVATE_EGRESS=false
+#
+# AIMEAT_AI_PROVIDER_ALLOWLIST — comma-separated HOST allowlist an AI `baseUrl` may point at.
+#   Empty = any host (local dev / self-hosted models). On a public multi-tenant node, restrict
+#   WHERE a decrypted AI key may be sent so a poisoned baseUrl can't exfiltrate it.
+#   Example: openrouter.ai,api.openai.com,api.anthropic.com,api.groq.com
+# AIMEAT_AI_PROVIDER_ALLOWLIST=""
+#
+# Startup self-check: when the resolved profile is `public`, the node warns loudly (or refuses
+# to start) on an unsafe combination — AIMEAT_ANONYMOUS=true, AIMEAT_ALLOW_PRIVATE_EGRESS=true,
+# AIMEAT_FEDERATION_OPEN_JOIN=true, missing AIMEAT_ENCRYPTION_KEY, AIMEAT_CORS_ALLOWED_ORIGINS=*,
+# or AIMEAT_STATS_ACCESS=public. Being insecure on the internet must be a conscious override.
+#
+# ── Reserved-key write guard (NOT a knob — always-on code invariant) ──
+# A role-'app' token (H-2 app grant) has memory:write over the OWNER's namespace. It must NOT
+# be able to write keys the SERVER reads and trusts for behavior, or a granted app could redirect
+# the owner's AI key, reset their spend cap, or force a public directory listing. Denylisted
+# prefixes for non-owner-session principals on POST/PUT /v1/memory (mirrors the ecosystem path's
+# ecoMayWriteKey — see DNA invariant #2):
+#   openrouter.*   → AI provider config incl. the baseUrl the decrypted key is sent to
+#   ai-usage.*     → the daily AI-spend ledger that enforces the budget cap
+#   profile.*      → public directory-listing flag + matchmaking inputs
+# (Enforcement of this guard and the three posture knobs above lands in config.ts + the memory
+#  write path together with the security fixes; documented here as the config/security surface.)
+
+# ── Auth & Tokens ──────────────────────────────────────────────
+# AIMEAT_JWT_TTL=3600              # Legacy / agent JWT lifetime in seconds (default: 1h)
+# Owner sessions: short access token + rotating httpOnly refresh cookie (no key re-signing).
+# AIMEAT_ACCESS_TTL=900            # Owner access-token (JWT) lifetime in seconds (default: 15min)
+# AIMEAT_REFRESH_IDLE_DAYS=30      # Owner refresh-cookie idle window in days (default: 30)
+# AIMEAT_REFRESH_ABSOLUTE_DAYS=90  # Owner refresh-cookie hard cap in days, never extended (default: 90)
+# AIMEAT_REFRESH_GRACE_MS=60000    # Refresh-rotation grace window in ms for concurrency (default: 60s)
+# AIMEAT_OTK_TTL_MS=300000        # OTK expiry in ms (default: 5min)
+# AIMEAT_OTK_GRACE_MS=60000       # OTK grace period in ms (default: 1min)
+
+# ── Morsel Economy ─────────────────────────────────────────────
+# AIMEAT_WELCOME_BONUS=100
+# AIMEAT_DAILY_ALLOWANCE=50
+# AIMEAT_DAILY_ALLOWANCE_CAP=500
+# AIMEAT_BURN_RATE=0.10
+# AIMEAT_MAX_OPERATOR_MINT_PER_DAY=10000
+# AIMEAT_BOARD_POST_BASE_COST=5
+# AIMEAT_BOARD_POST_COST_PER_KB=2
+
+# ── Features ───────────────────────────────────────────────────
+# AIMEAT_KEYED_BROWSE=true         # Tier 0.5 keyed browse (set "false" to disable)
+# AIMEAT_EXTENDED_FEATURES=true    # Boards, federation, storage, validate (set "false" to disable)
+
+# ── Quotas ─────────────────────────────────────────────────────
+# AIMEAT_MEMORY_QUOTA_MB=10
+# AIMEAT_MEMORY_MAX_VALUE_SIZE_KB=1024
+# AIMEAT_MEMORY_MAX_KEYS=1000
+# Max retained gate-audit (meta.decisions.*) entries per organism; oldest pruned on write. 0 = unlimited.
+# AIMEAT_ORGANISM_DECISION_LOG_CAP=500
+# Max retained .version.N history snapshots per workspace record; older ones are pruned on publish.
+# A manifest objectType's `maxVersions` overrides this per space; append-only (create_only) spaces
+# are NEVER pruned. 0 = keep all history (unbounded — the pre-retention behaviour).
+# AIMEAT_WS_MAX_VERSIONS=20
+# AIMEAT_STORAGE_QUOTA_MB=100
+# AIMEAT_STORAGE_MAX_FILE_SIZE_MB=10
+# AIMEAT_STORAGE_MAX_CHUNKED_FILE_SIZE_GB=5
+# AIMEAT_MICRO_MEMORY_QUOTA_KB=500
+# AIMEAT_MICRO_MEMORY_MAX_SETS=50
+# AIMEAT_MICRO_MEMORY_MAX_KEYS_PER_SET=100
+# AIMEAT_MICRO_MEMORY_MAX_VALUE_SIZE=16384
+# AIMEAT_MAX_ACTIONS_PER_AGENT=20
+# AIMEAT_MIN_TRUST_PAID_ACTIONS=10
+# AIMEAT_APP_MAX_SIZE_MB=5
+# AIMEAT_AGENT_PORTING_FEE=50
+# AIMEAT_MEMORY_OVERAGE_MORSELS=10
+# AIMEAT_STORAGE_OVERAGE_MORSELS=100
+# AIMEAT_MAX_URL_LENGTH=8192
+
+# ── Federation ─────────────────────────────────────────────────
+# AIMEAT_FEDERATION_ROLE="standalone"  # operator | contributor | standalone
+# AIMEAT_GENESIS_URL=""                # Genesis node URL (for contributor role)
+# AIMEAT_MAX_RELAY_HOPS=3
+# AIMEAT_DEPEERING_GRACE_HOURS=72
+# AIMEAT_KEY_CACHE_REFRESH_MINUTES=5
+
+# ── Work Queue ─────────────────────────────────────────────────
+# AIMEAT_WEBHOOK_MAX_RETRIES=5
+# AIMEAT_WORK_QUEUE_MAX_PENDING=10
+
+# ── Rate Limits (requests per second) ─────────────────────────
+# Global default — all endpoints inherit this unless overridden
+# AIMEAT_RL_GLOBAL=300
+#
+# Per-tier limits (applied to route groups)
+# AIMEAT_RL_AUTH=20
+# AIMEAT_RL_WORK=60
+# AIMEAT_RL_MEMORY=120
+# AIMEAT_RL_BOARDS=60
+#
+# Per-endpoint overrides (optional — defaults to global if not set)
+# AIMEAT_RL_OWNERS=300
+# AIMEAT_RL_GHII=300
+# AIMEAT_RL_FLAGS=300
+# AIMEAT_RL_APPEALS=300
+# AIMEAT_RL_ADMIN_SETUP=300
+# AIMEAT_RL_FEDERATION=300
+# AIMEAT_RL_CATALOGUE=300
+# AIMEAT_RL_AUTH_CHALLENGE=300
+
+# ── Personal Nodes ───────────────────────────────────────────
+# AIMEAT_PERSONAL_NODES_ENABLED=true
+# AIMEAT_PERSONAL_NODE_MAX_SLOTS=100
+# AIMEAT_PERSONAL_MAILBOX_QUOTA_MB=50
+# AIMEAT_PERSONAL_MAILBOX_RETENTION_DAYS=7
+# AIMEAT_PERSONAL_HEARTBEAT_MS=30000
+# AIMEAT_PERSONAL_OFFLINE_MS=300000
+
+# ── Connector Forward Tunnel ─────────────────────────────────
+# One persistent WS per agent identity at /v1/connect/tunnel: carries forward
+# API calls (agent→server) + realtime reverse delivery (server→agent push).
+# OPT-IN — off by default until the Node connector client (Phase 3) ships.
+# AIMEAT_CONNECT_TUNNEL_ENABLED=false
+# AIMEAT_CONNECT_TUNNEL_HEARTBEAT_MS=30000
+# AIMEAT_CONNECT_TUNNEL_OFFLINE_MS=90000
+# AIMEAT_CONNECT_TUNNEL_REQUEST_TIMEOUT_MS=30000
+
+# ── Email / SMTP (Phase 1.1) ────────────────────────────────
+# AIMEAT_SMTP_HOST="smtp.example.com"
+# AIMEAT_SMTP_PORT=587
+# AIMEAT_SMTP_USER="noreply@example.com"
+# AIMEAT_SMTP_PASS="secret"
+# AIMEAT_SMTP_FROM="AIMEAT <noreply@example.com>"
+# AIMEAT_SMTP_SECURE=false
+# AIMEAT_SMTP_REJECT_UNAUTHORIZED=false  # Set to false for STARTTLS with self-signed certs
+# AIMEAT_EMAIL_CONFIRMATION_REQUIRED=false
+
+# ── Consent Layer (Phase 0.3) ────────────────────────────────
+# AIMEAT_CONSENT_EXPIRY_CHECK_INTERVAL_MS=60000  # How often to check for expired consents (default: 1 min)
+# AIMEAT_CONSENT_DEFAULT_SCOPE="federation"       # Default consent scope: private | dmz | federation
+# AIMEAT_CONSENT_MAX_PER_AGENT=100                # Max consent grants per agent
+
+# ── TOTP / 2FA (Phase 0.5) ──────────────────────────────────
+# AIMEAT_TOTP_ENABLED=true                # Enable TOTP 2FA support
+# AIMEAT_TOTP_ISSUER="AIMEAT"             # Issuer name shown in authenticator apps
+# AIMEAT_TOTP_PERIOD=30                   # TOTP code period in seconds
+# AIMEAT_TOTP_WINDOW=1                    # Acceptable time drift window (±1 period)
+# AIMEAT_TOTP_BACKUP_CODE_COUNT=10        # Number of backup codes generated
+# AIMEAT_TOTP_SECRET_ENCRYPTION_KEY=""    # Hex-encoded 32-byte AES key for encrypting TOTP secrets
+#                                          # Generate: openssl rand -hex 32
+# AIMEAT_TOTP_MAX_FAILED_ATTEMPTS=5       # Max failed TOTP attempts before lockout
+# AIMEAT_TOTP_LOCKOUT_SECONDS=300         # Lockout duration after max failed attempts (default: 5 min)
+
+# ── Match Notifications (Phase 1.6) ────────────────────────────
+# AIMEAT_MATCH_NOTIFICATION_INTERVAL_HOURS=24  # How often to check for new matches
+# AIMEAT_MATCH_NOTIFICATION_ENABLED=true        # Operator can disable
+
+# ── AI Matching (Phase 2.1) ─────────────────────────────────
+# AIMEAT_MATCHING_ENABLED=true
+# AIMEAT_MATCH_INTERVAL_HOURS=24          # How often matching runs
+# AIMEAT_MATCH_THRESHOLD=0.5              # Minimum match score (0.0-1.0)
+# AIMEAT_MATCH_MAX_SUGGESTIONS=5          # Max suggestions per user per round
+# AIMEAT_MATCH_MAX_DISTANCE_KM=100        # Max distance for matching
+# AIMEAT_MATCH_COOLDOWN_DAYS=7            # Same pair re-suggested after this
+
+# ── Marketplace (Phase 2.6) ───────────────────────────────────
+# AIMEAT_MARKETPLACE_ENABLED=true           # Enable marketplace feature
+# AIMEAT_MARKETPLACE_LISTING_FEE=2          # Listing fee in morsels
+# AIMEAT_MARKETPLACE_TX_FEE_PERCENT=5       # Transaction fee percentage (buyer pays)
+# AIMEAT_MARKETPLACE_ESCROW=true            # Enable escrow for purchases
+
+# ── Commerce core + fee policy (TARGET-033) ───────────────────
+# AIMEAT_MARKETPLACE_FEE_MODE=operator      # Fee destination: operator (credit node operator) | burn (remove from supply)
+# AIMEAT_OPERATOR_FEE_ACCOUNT=              # Owner name receiving operator-mode fees (empty = first operator-role owner)
+# AIMEAT_COMMERCE_FEE_PERCENT=              # Checkout fee % (empty inherits AIMEAT_MARKETPLACE_TX_FEE_PERCENT)
+# AIMEAT_COMMERCE_ENABLED=true              # Checkout sessions (/v1/commerce) + UCP checkout capability
+# AIMEAT_COMMERCE_SESSION_TTL_MINUTES=60    # Open checkout-session lifetime
+# AIMEAT_MCP_CARD_COMMERCE_TOOLS=inline     # /.well-known/mcp.json commerce_tools block: inline (embed the priced app-tool catalog) | pointer (lean card linking /v1/commerce/tools)
+# ── Stripe Connect (EE, TARGET-043) — Platform model, NON-CUSTODIAL, TEST MODE until you activate live ──
+# The operator's OWN Stripe Platform secret (Overscale's account). Sellers onboard as Stripe EXPRESS
+# connected accounts under it; charges take the operator's application fee and settle to the seller's
+# account — money never touches the operator balance. Env-ONLY; NEVER commit a live key. Empty (default)
+# = money selling off. Use a TEST-MODE key (sk_test_…) until the account is live-activated.
+# AIMEAT_STRIPE_SECRET_KEY=                # Operator Stripe Platform secret (sk_test_… in test mode). Empty = money selling disabled.
+# AIMEAT_STRIPE_PUBLISHABLE_KEY=           # Operator Stripe publishable key (pk_test_… in test mode) — for a client that tokenizes cards.
+# AIMEAT_STRIPE_CHARGE_MODE=direct         # direct = charge ON the connected account (funds never touch the operator balance) | destination = platform charge + transfer_data. Default direct.
+# AIMEAT_STRIPE_CONNECT_COUNTRY=FI         # Country for new Express connected accounts (falls back to AIMEAT_OPERATOR_COUNTRY, then FI).
+# AIMEAT_VAT_RATE_PERCENT=25.5             # Default ALV/VAT rate for money-sale bookings (Finland standard 25.5%); overridable per company.
+# AIMEAT_PLATFORM_STRIPE_KEY=              # Legacy alias for AIMEAT_STRIPE_SECRET_KEY (only used if the latter is unset).
+
+# ── x402 stablecoin settlement (TARGET-042) — NON-CUSTODIAL USDC on a USD price ──
+# AIMEAT_X402_ENABLED=false               # Register the x402 USDC PaymentHandler (settles money/USD sessions via the exact scheme + facilitator). OFF by default: advertise the exact scheme only when the node can settle it.
+# AIMEAT_X402_NETWORK=base-sepolia        # Network id in the accepts[] exact scheme: base-sepolia (testnet) | base (mainnet). A parameter, not hardcoded — Solana etc. drop in via the network registry (src/commerce/x402-facilitator.ts).
+# AIMEAT_X402_FACILITATOR_URL=https://x402.org/facilitator  # Facilitator /verify + /settle base URL (all calls go through safeFetch). Coinbase CDP facilitator in prod; the public x402.org one covers Base Sepolia.
+# AIMEAT_X402_TEST_FACILITATOR=false      # TEST ONLY: an off-chain facilitator double so the x402 chain is E2E-provable without a testnet wallet. NEVER in prod (real settlement = the real facilitator).
+
+# ── Crawlers / Content Signals / Web Bot Auth ──────────────────
+# AIMEAT_WEB_BOT_AUTH_SIGN=false           # Sign outbound HTTP (RFC 9421 Web Bot Auth, node Ed25519 key) so peers/CDNs can verify AIMEAT traffic against /.well-known/http-message-signatures-directory. OFF by default: stamps identifying Signature headers on every outbound request (linkability; rare strict endpoints may reject unknown headers). The key directory is always served.
+# AIMEAT_CONTENT_SIGNAL="search=yes, ai-input=yes, ai-train=no"   # robots.txt Content Signals Policy directive (contentsignals.org). Keep consistent with the per-bot rules in public/robots.txt; 'off' removes the directive.
+
+# ── IndexNow (Bing/Yandex search indexing) ─────────────────────
+# Generate a key: openssl rand -hex 16
+# After setting, run: pnpm indexnow
+# AIMEAT_INDEXNOW_KEY="your-hex-key-here"
+
+# ── Push Notifications / PWA (Phase 3.1) ────────────────────
+# Generate VAPID keys: npx web-push generate-vapid-keys
+# AIMEAT_PUSH_ENABLED=true
+# AIMEAT_VAPID_PUBLIC_KEY=""
+# AIMEAT_VAPID_PRIVATE_KEY=""
+# AIMEAT_VAPID_SUBJECT="mailto:admin@aimeat.example.com"
+# AIMEAT_PUSH_NOTIFY_TYPES="work_assignment,action_request"  # message types that trigger push notification
+# AIMEAT_PUSH_COOLDOWN_MIN=5                                 # minimum minutes between notifications per node
+# AIMEAT_PUSH_MAX_SUBSCRIPTIONS_PER_NODE=5                   # max push subscriptions per personal node
+# AIMEAT_PUSH_MAX_FAILURES=3                                 # auto-remove subscription after N consecutive failures
+# AIMEAT_EMAIL_RATE_LIMIT_MIN=30                             # minimum minutes between email notifications per node
+
+# ── EUDIW / Identity Verification (Phase 3.3) ────────────────
+# AIMEAT_EUDIW_ENABLED=false
+# AIMEAT_EUDIW_CLIENT_ID="aimeat-verifier-001"
+# AIMEAT_EUDIW_REDIRECT_URI="https://your-node.example/v1/ghii/verify/eudiw/callback"
+# AIMEAT_FTN_ENABLED=false
+# AIMEAT_FTN_PROVIDER_URL="https://tunnistautuminen.suomi.fi"
+# AIMEAT_FTN_CLIENT_ID=""                                      # OIDC client_id from FTN broker
+# AIMEAT_FTN_CLIENT_SECRET=""                                  # OIDC client_secret from FTN broker
+# AIMEAT_VC_ISSUER_DID="did:web:your-node.example"
+# AIMEAT_NONCE_TTL_SECONDS=300                                 # verification nonce TTL (60-3600)
+# AIMEAT_NATIONAL_EID_PID_CLAIM="personal_identity_code"       # FI: personal_identity_code, SE: personalNumber, DK: dk.cpr
+
+# ── Social login — Google sign-in (OIDC) ─────────────────────
+# Create OAuth credentials at https://console.cloud.google.com/apis/credentials
+# Authorized redirect URI must exactly match the callback below.
+# AIMEAT_GOOGLE_OAUTH_ENABLED=false
+# AIMEAT_GOOGLE_OAUTH_CLIENT_ID=""                             # OAuth 2.0 client ID from Google Cloud Console
+# AIMEAT_GOOGLE_OAUTH_CLIENT_SECRET=""                         # OAuth 2.0 client secret
+# AIMEAT_GOOGLE_OAUTH_REDIRECT_URI=""                          # default: <baseUrl>/v1/ghii/login/google/callback
+
+# ── Social login — Casdoor sign-in (OIDC) ────────────────────
+# Casdoor is an open-source IdP. In its admin: create an Application, add the redirect URI below,
+# then copy the client id/secret here. Casdoor is the authority for its org's accounts, so AIMEAT
+# treats emails it returns as verified (enables link-by-email) — only enable IdPs you trust for that.
+# AIMEAT_CASDOOR_OAUTH_ENABLED=false
+# AIMEAT_CASDOOR_OAUTH_ENDPOINT=""                             # Casdoor server URL, e.g. https://casdoor.example.com
+# AIMEAT_CASDOOR_OAUTH_CLIENT_ID=""                            # Application client ID from Casdoor
+# AIMEAT_CASDOOR_OAUTH_CLIENT_SECRET=""                        # Application client secret from Casdoor
+# AIMEAT_CASDOOR_OAUTH_REDIRECT_URI=""                         # default: <baseUrl>/v1/ghii/login/casdoor/callback
+
+# ── Social login — Microsoft Entra ID sign-in (OIDC) ─────────
+# Register an app (free) at https://entra.microsoft.com → App registrations. Add a "Web" platform
+# with the redirect URI below and create a client secret. TENANT controls who may sign in:
+#   • a Directory (tenant) GUID  → ONLY that org's members (enterprise gating; AIMEAT also checks the
+#     `tid` claim and treats the email as verified so members auto-link).
+#   • common        → any work/school account AND personal Microsoft accounts (widest).
+#   • organizations → any work/school account (any org).  • consumers → personal accounts only.
+# Note: for the non-GUID modes strict issuer validation can be finicky; pin a tenant GUID for the
+# most reliable + gated setup.
+# AIMEAT_ENTRA_OAUTH_ENABLED=false
+# AIMEAT_ENTRA_OAUTH_TENANT="common"                           # tenant GUID | common | organizations | consumers
+# AIMEAT_ENTRA_OAUTH_CLIENT_ID=""                              # Application (client) ID from the app registration
+# AIMEAT_ENTRA_OAUTH_CLIENT_SECRET=""                          # Client secret value from the app registration
+# AIMEAT_ENTRA_OAUTH_REDIRECT_URI=""                           # default: <baseUrl>/v1/ghii/login/entra/callback
+
+# ── Consul (optional fleet management) ───────────────────────
+# Connect to HashiCorp Consul for centralized config management across nodes.
+# Values in Consul KV take precedence over file/.env but below database overrides.
+# AIMEAT_CONSUL_ENABLED=false
+# AIMEAT_CONSUL_URL=http://localhost:8500
+# AIMEAT_CONSUL_PREFIX=aimeat/config
+# AIMEAT_CONSUL_TOKEN=
+# AIMEAT_CONSUL_WATCH_INTERVAL=30
+# AIMEAT_CONSUL_DATACENTER=
+
+# ── Cross-Federation (Phase 3.4) ────────────────────────────
+# AIMEAT_CROSS_FEDERATION_ENABLED=true
+# AIMEAT_MAX_GENESIS_PEERS=10
+# AIMEAT_GENESIS_SYNC_INTERVAL_HOURS=6
+
+# ── Federation Data Sync ─────────────────────────────────
+# AIMEAT_SYNC_MODE="hybrid"                   # bulk | instant | hybrid
+# AIMEAT_SYNC_INTERVAL_HOURS=6                # Scheduled sync fallback interval
+# AIMEAT_SYNC_BATCH_DELAY_MS=5000             # Event batching window (instant/hybrid mode)
+# AIMEAT_REPLICATION_QUEUE_MAX=10000           # Max replication queue entries
+# AIMEAT_REPLICATION_QUEUE_TTL_HOURS=72        # Max age of replication queue entries
+# AIMEAT_MAX_CONCURRENT_SYNCS=5               # Max parallel outbound sync operations
+# AIMEAT_FEDERATION_TIMEOUT_MS=10000           # Timeout for outbound federation HTTP requests
+# AIMEAT_MESSAGE_RETRY_INTERVAL_MS=60000       # Retry interval for queued cross-node direct messages
+# AIMEAT_MESSAGE_RETRY_TTL_HOURS=168           # Give up on undelivered direct messages after this (7 days)
+# AIMEAT_GENESIS_MEMORY_CACHE=false            # Cache routed genesis memory results locally
+# AIMEAT_GENESIS_MEMORY_CACHE_TTL_HOURS=4      # Genesis memory cache TTL
+
+# ── Cookie Consent (for service builders) ────────────────────
+# Opt-in cookie consent banner for portal HTML pages.
+# Uses vanilla-cookieconsent v3. Disabled by default.
+# AIMEAT_COOKIE_CONSENT_ENABLED=false
+# AIMEAT_COOKIE_CONSENT_CATEGORIES="necessary,analytics,marketing"
+# AIMEAT_COOKIE_CONSENT_POLICY_URL="https://example.com/privacy"
+
+# ── Realtime P2P Rooms ───────────────────────────────────────
+# AIMEAT_REALTIME_ENABLED=true                      # Enable realtime room discovery & signaling
+# AIMEAT_REALTIME_MAX_ROOMS=100                     # Max concurrent rooms on this node
+# AIMEAT_REALTIME_MAX_PEERS_PER_ROOM=20             # Max peers per room
+# AIMEAT_REALTIME_ROOM_IDLE_TIMEOUT_MS=3600000      # Empty room cleanup timeout (default: 1h)
+# AIMEAT_REALTIME_MAX_MESSAGE_SIZE_BYTES=16384      # Max WebSocket message size (default: 16 KB)
+# AIMEAT_STUN_SERVERS="stun:stun.l.google.com:19302,stun:stun1.l.google.com:19302"
+# AIMEAT_TURN_SERVER=""                              # TURN server URL (e.g. turn:turn.example.com:3478)
+# AIMEAT_TURN_USERNAME=""                            # TURN credentials
+# AIMEAT_TURN_CREDENTIAL=""
+# ── Encrypted Chat ────────────────────────────────────────────
+# AIMEAT_ECHAT_ANONYMOUS=false                     # Allow anonymous echat WS connections (default: false)
+
+# ── Node Portal (Site) ──────────────────────────────────────
+# AIMEAT_SITE_ENABLED=true                           # Serve portal at GET /
+# AIMEAT_SITE_MAX_TEMPLATE_SIZE_KB=512               # Max custom template size
+# AIMEAT_SITE_CACHE_TTL_SECONDS=60                   # Resolved HTML cache lifetime
+# AIMEAT_SITE_KV_REGION="Helsinki"                   # Custom KV pair → {{kv:region}}
+# AIMEAT_SITE_KV_CONTACT="admin@example.fi"          # Custom KV pair → {{kv:contact}}
+
+# ── Node Portal Load-Balancer Sync ──────────────────────────
+# AIMEAT_SITE_LB_ENABLED=false                        # Enable LB sync mode (mirrors portal from origin)
+# AIMEAT_SITE_LB_ORIGIN_URL=https://aimeat.io         # Origin node URL to sync from
+# AIMEAT_SITE_LB_SYNC_INTERVAL_MIN=30                 # Sync interval in minutes
+# AIMEAT_SITE_LB_SYNC_ON_STARTUP=true                 # Sync immediately on startup
+
+# ── Setup Wizard (Phase 1.2) ───────────────────────────────
+# Restrict setup wizard access to specific IPs (comma-separated, empty = no restriction)
+# AIMEAT_SETUP_ALLOWED_IPS=127.0.0.1,::1
+
+# ── Content Moderation ─────────────────────────────────────
+# Auto-hide content after this many active flags (default: 5)
+# AIMEAT_AUTO_HIDE_THRESHOLD=5
+
+# ── Statistics ──────────────────────────────────────────────
+AIMEAT_STATS_ENABLED=true
+AIMEAT_STATS_ACCESS=public          # public | authenticated | operator
+
+# ── Scoped Agent Capabilities (REQ-006) ───────────────────────
+# AIMEAT_DEFAULT_AGENT_SCOPES="memory:read,memory:write,catalogue:read"
+# AIMEAT_MAX_AGENT_SCOPES="*"
+# Enforce per-agent scopes on the /v1/mcp tool surface (mirrors REST requireScope gates).
+# Default true. Set false for a warn-only rollout: all tools stay registered, but tools that
+# WOULD be filtered are logged so you can measure impact before enforcing.
+# AIMEAT_MCP_ENFORCE_SCOPES=true
+# Same-owner device-auth auto-approval (Agent-Bundled Apps): a device-authorize call
+# authenticated as the SAME owner it registers for (the owner session, or one of that
+# owner's agents — e.g. crew-forge registering an agent it just deployed) skips the manual
+# consent step. Never cross-owner; an agent approver cannot grant scopes beyond its own
+# token's; the approval is attributed. Default true (public-safe: no cross-owner reach, no
+# scope escalation). Set false to force EVERY registration through the manual consent page.
+# AIMEAT_SAME_OWNER_AUTO_APPROVE=true
+
+# ── Ecosystem Applications (GEAI) ──────────────────────────────
+# Scope bounds for ecosystem-app (GEAI) connections, parallel to the agent knobs above.
+# Defaults lean read + deposit (ecosystem apps mostly deposit refined data into owner areas).
+# AIMEAT_DEFAULT_ECO_SCOPES="memory:read,memory:write,knowledge:contribute,organism:read"
+# AIMEAT_MAX_ECO_SCOPES="*"
+# GEAI credential lifetime in seconds (default 90 days, same class as agent JWTs).
+# AIMEAT_ECO_JWT_TTL=7776000
+
+# ── Prometheus Metrics ─────────────────────────────────────
+# Prometheus metrics endpoint (GET /v1/metrics)
+AIMEAT_METRICS_ENABLED=false
+AIMEAT_METRICS_ACCESS=operator      # public | authenticated | operator
+
+# ── Node Extensions (V8 Isolates) ────────────────────────────
+# AIMEAT_EXTENSIONS_ENABLED=true       # Extension system (default: true)
+# AIMEAT_EXT_MAX_MEMORY_MB=64          # V8 isolate memory limit per action
+# AIMEAT_EXT_TIMEOUT_MS=5000           # V8 isolate CPU timeout per action
+# AIMEAT_EXT_MAX_API_CALLS=50          # Max AIMEAT API calls per action invocation
+# AIMEAT_EXT_MAX_CODE_SIZE_KB=256      # Max JS source size per action
+# AIMEAT_EXT_MAX_INSTALLED=20          # Max extensions installed on this node
+# AIMEAT_EXT_INSTALL_ROLE=operator     # Role required to install extensions: operator | owner (default: operator)
+# AIMEAT_MAX_EXTENSIONS_PER_OWNER=10   # Max extensions per owner when owner-role installs enabled (default: 10)
+
+# ── Service Generator ────────────────────────────────────
+
+# ── Packages & Templates ──────────────────────────────────
+# Master switch for the package system
+# AIMEAT_PACKAGES_ENABLED=true
+# Who can create packages: "operator" (default) or "owner"
+# AIMEAT_PACKAGE_CREATE_ROLE=operator
+# Maximum total size of all components in a package (MB)
+# AIMEAT_PACKAGE_MAX_SIZE_MB=50
+# Maximum number of components per package
+# AIMEAT_PACKAGE_MAX_COMPONENTS=20
+# Maximum packages per author
+# AIMEAT_PACKAGE_MAX_PER_AUTHOR=50
+# Master switch for template gallery
+# AIMEAT_TEMPLATES_ENABLED=true
+# Allow reviews on template listings
+# AIMEAT_TEMPLATE_REVIEWS_ENABLED=true
+# Allow discussions on template listings
+# AIMEAT_TEMPLATE_DISCUSSIONS_ENABLED=true
+# Enable cross-node template sharing via federation
+# AIMEAT_PACKAGE_FEDERATION_ENABLED=false
+# Auto-accept federated templates without operator review
+# AIMEAT_PACKAGE_FEDERATION_AUTO_ACCEPT=false
+
+# ── Portfolio ──
+# AIMEAT_PORTFOLIO=true              # Enable portfolio feature (default: true)
+# AIMEAT_PORTFOLIO_MAX_SIZE_KB=512   # Max portfolio HTML file size (default: 512KB)
+# AIMEAT_PORTFOLIO_MAX_IMAGES=20     # Max images selectable for portfolio prompt (default: 20)