The environment

Every environment value this package reads goes through one reader, readEnv in src/env.ts, and every one of them is read on the call that uses it. None is read when press.config.ts runs. That used to differ per variable: CMS_URL and CMS_TENANT were read inside defineConfig, the rest per request, so when a value was read depended on which value it was.

Variable	What it sets
CMS_URL	Where the delivery API is. cmsUrl in the config wins
CMS_TENANT	Pins the process to one tenant. tenant in the config wins
CMS_DEFAULT_TENANT	The tenant for a host the CMS does not know. sites.defaultTenant wins
CMS_RENDERER_KEY	Sent to the CMS when a share link is redeemed. See Share links
PRESS_CONSOLE_ORIGINS	Browser origins allowed to read the block schema, comma separated
PRESS_SECRET	The HMAC key for everything this renderer signs. See One secret
REVALIDATE_SECRET	The webhook key before PRESS_SECRET, read only while that is unset
PRESS_PREVIEW_SECRET	The share key before PRESS_SECRET, read only while that is unset

Values are used exactly as the environment has them, untrimmed. A secret with a trailing space is a different HMAC key, so trimming one here would stop a webhook that verifies today.

A site is build time or request time. Without sites, identity is build time: the index, the feed, the sitemap and robots are prerendered, so anything your own press.config.ts reads from the environment is baked when you build, not when the server starts. Write per-site values as literals in that file. Getting this wrong is how a client site ships with the vendor's name in its masthead. With sites, identity is data in the CMS and read per request, which is the next section.