MEGAINFRA-WEBAPP/.env.local.example

# PIN gate — change this in production. Exposed to the client because the
# lock screen validates it locally before talking to PocketBase.
NEXT_PUBLIC_APP_PIN=2468

# Brand
NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
NEXT_PUBLIC_DEFAULT_THEME=light

# Local API base URL (the Next.js app's own /api routes — currently a stub)
NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api

# ── PocketBase ─────────────────────────────────────────────────────────────
# Public client-side URL. Safe to expose because PocketBase handles
# auth at the collection-rule level — public reads need a token, the
# URL alone is not a credential.
NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com

# Server-side only — used by Next.js server components / route handlers
# to seed data, sync files and run admin operations. NEVER prefix with
# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
POCKETBASE_ADMIN_EMAIL=admin@example.com
POCKETBASE_ADMIN_PASSWORD=change-me

# If you have an existing auth token you can paste it here instead of
# having the server re-authenticate on every cold start. Leave blank
# to let the server log in with the email + password above.
POCKETBASE_ADMIN_TOKEN=

# ── n8n (Purchase Order ingestion) ──────────────────────────────────────
# Webhook URL the Next.js server forwards PO uploads to.
# Server-only (no NEXT_PUBLIC_ prefix) — never exposed to the browser.
N8N_PO_INGEST_URL=https://n8n.your-host.example/webhook/purchase-order-upload

# Shared secret n8n sends in the x-ingest-secret header when calling
# /api/purchase-orders/ingest. Generate with: openssl rand -hex 32
N8N_INGEST_SECRET=replace-with-output-of-openssl-rand-hex-32

# ── n8n (Delivery Note OCR webhook) ─────────────────────────────────────
# Same shared secret as above — used by /api/delivery-notes/[id]/ocr-result.
# The Delivery Note OCR workflow in n8n imports docs/n8n/delivery-note-ocr-workflow.json
# and calls POST {MEGA_NEXT_URL}/api/delivery-notes/{id}/ocr-result with this header.

# Public URL of the n8n instance (used by your local Codex MCP config).
N8N_MCP_URL=https://wfdash.n8n.apphub.co.za/mcp-server/http

# ── AI chat (phase 3) ─────────────────────────────────────────────────────
# Master switch. The /api/chat route 404s and /dashboard/chat is unreachable
# unless this is exactly "true". MUST stay unset in production until real
# authentication exists — the chat reads every site's financials and spends
# LLM credits for anyone who can reach it.
ENABLE_CHAT=true

# Which provider the chat uses: "anthropic" or "minimax".
CHAT_PROVIDER=anthropic

# Anthropic. Leave unset to use an `ant auth login` profile instead.
ANTHROPIC_API_KEY=

# MiniMax. This must be an Open Platform API key from platform.minimax.io —
# a Token Plan "Subscription Key" is a different credential and will not work
# here. Consumer Hailuo / MiniMax Agent subscriptions cannot be used at all.
MINIMAX_API_KEY=
MINIMAX_BASE_URL=https://api.minimax.io/v1
MINIMAX_MODEL=MiniMax-M2