# Supabase
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# Prisma (Supabase session pooler connection string, port 5432)
DATABASE_URL=postgresql://postgres.[ref]:[password]@aws-0-[region].pooler.supabase.com:5432/postgres

# Seed admin account password (required for seed_auth.ts)
SEED_ADMIN_PASSWORD=your-admin-password-here

# Cloudflare R2 (photo upload — presigned URL endpoint)
R2_ACCOUNT_ID=your-cloudflare-account-id
R2_ACCESS_KEY_ID=your-r2-access-key
R2_SECRET_ACCESS_KEY=your-r2-secret-key
R2_BUCKET_NAME=your-r2-bucket-name

# R2 public base URL (client-side — accessible to the browser)
# For R2.dev subdomain: https://pub-<hash>.r2.dev
# For custom domain:    https://photos.yourdomain.com
VITE_R2_PUBLIC_URL=https://pub-xxxxxxxxxxxxxxxx.r2.dev

# Public address of the deployed site (used in emailed verification / reset links)
SITE_URL=https://usc.syntaxure.dev

# Resend (password-reset and student verification emails)
RESEND_API_KEY=your-resend-api-key
RESEND_FROM_EMAIL="USC Attendance <noreply@syntaxure.dev>"

# Shared secret for the daily signature-retention cron (Vercel sends it as a Bearer token)
CRON_SECRET=a-long-random-string

# QR token signing (server-only — never exposed to the client; rotate if leaked)
QR_SECRET=your-qr-signing-secret-here