.env.example

# ── API Keys (GitHub Actions Secrets) ─────────────────────
RESEND_API_KEY=re_xxxx
NEWS_API_KEY=xxxx

# ── AI providers (set ONE or BOTH) ────────────────────────
# Set at least one for AI-powered recommendations. Set both to enable
# multi-AI mode: providers run in parallel, scores average, and a
# per-AI breakdown appears beneath each rec. See docs/api-keys.md.
GEMINI_API_KEY=xxxx
ANTHROPIC_API_KEY=

# Optional Claude tuning
# CLAUDE_MODEL=claude-sonnet-4-6              # default; try claude-haiku-4-5-20251001 for cheaper runs
# AI_DETAILED_PROVIDER=gemini                 # force which provider writes STRONG BUY analysis pages (gemini|claude)

# ── Telegram (GitHub Actions Secrets, optional) ──────────
TELEGRAM_BOT_TOKEN=
TELEGRAM_CHAT_ID=

# ── Social posting (GitHub Actions Secrets, all optional) ─
# Generic STRONG BUY / BUY signals are posted to whichever platforms have
# credentials set. No holdings/allocations are ever disclosed. Daily +
# intraday only. Master switch + X-link toggle live in config.json "social".
#
# X / Twitter — OAuth 1.0a user context. NOTE: X removed its free tier in
# Feb 2026; posting is now pay-per-use (~$0.015/post). Leave unset to skip.
X_API_KEY=
X_API_SECRET=
X_ACCESS_TOKEN=
X_ACCESS_TOKEN_SECRET=
# Facebook Page — needs a long-lived Page access token + pages_manage_posts.
FACEBOOK_PAGE_ID=
FACEBOOK_PAGE_TOKEN=
# Setup-only (NOT used at runtime — never add to GitHub secrets). These are
# read solely by `npx tsx smoke/fb-page-token.ts` to mint the long-lived Page
# token above, then should be deleted from .env once you have it.
# FACEBOOK_APP_ID=your_meta_app_id
# FACEBOOK_APP_SECRET=
# FB_USER_TOKEN=
# LinkedIn Page — OAuth 2.0 token with w_organization_social + org URN.
LINKEDIN_ACCESS_TOKEN=
LINKEDIN_ORG_URN=
# LINKEDIN_API_VERSION=202406                  # optional override (YYYYMM)
# Threads — long-lived token (threads_basic + threads_content_publish) + user id.
# NOTE: Threads long-lived tokens expire in ~60 days; refresh before expiry.
THREADS_USER_ID=
THREADS_ACCESS_TOKEN=
# Setup-only (NOT used at runtime). Read by `npx tsx smoke/threads-token.ts` to
# mint the long-lived token above, then delete from .env.
# THREADS_APP_SECRET=
# THREADS_SHORT_TOKEN=

# ── Actions Variables (not secrets — easy to view/edit) ──
# In GitHub Actions, these are set as repository Variables
# (Settings → Secrets and variables → Actions → Variables)
RECIPIENT_EMAIL=you@example.com
# CONFIG_JSON is a GitHub Actions Variable (not .env) — local dev uses config.json directly

# ── Display timezone (optional, defaults to UTC) ─────────
# IANA zone name (e.g. Australia/Sydney, America/New_York, Europe/London).
# Node.js natively respects TZ — every Date formatted in emails/Telegram
# uses this zone. Handles daylight savings automatically.
#
# In GitHub Actions, set this as a Variable named TIME_ZONE (matches the
# project's env-var naming style); the workflow maps it to POSIX TZ for
# Node.js. Locally, just set TZ here in .env — it's the POSIX standard.
# TZ=Australia/Sydney