# PIN gate — change this in production. Exposed to the client because the
# lock screen validates it locally before talking to PocketBase.
NEXT_PUBLIC_APP_PIN=2468

# Brand
NEXT_PUBLIC_APP_NAME=MEGA INFRASTRUCTURE
NEXT_PUBLIC_DEFAULT_THEME=light

# Local API base URL (the Next.js app's own /api routes — currently a stub)
NEXT_PUBLIC_API_BASE_URL=http://localhost:3000/api

# ── PocketBase ─────────────────────────────────────────────────────────────
# Public client-side URL. Safe to expose because PocketBase handles
# auth at the collection-rule level — public reads need a token, the
# URL alone is not a credential.
NEXT_PUBLIC_POCKETBASE_URL=https://your-pocketbase.example.com

# Server-side only — used by Next.js server components / route handlers
# to seed data, sync files and run admin operations. NEVER prefix with
# NEXT_PUBLIC_ or the credentials leak into every browser bundle.
POCKETBASE_ADMIN_EMAIL=admin@example.com
POCKETBASE_ADMIN_PASSWORD=change-me

# If you have an existing auth token you can paste it here instead of
# having the server re-authenticate on every cold start. Leave blank
# to let the server log in with the email + password above.
POCKETBASE_ADMIN_TOKEN=

# ── n8n (Purchase Order ingestion) ──────────────────────────────────────
# Webhook URL the Next.js server forwards PO uploads to.
# Server-only (no NEXT_PUBLIC_ prefix) — never exposed to the browser.
N8N_PO_INGEST_URL=https://n8n.your-host.example/webhook/purchase-order-upload

# Shared secret n8n sends in the x-ingest-secret header when calling
# /api/purchase-orders/ingest. Generate with: openssl rand -hex 32
N8N_INGEST_SECRET=replace-with-output-of-openssl-rand-hex-32