# nuxt-auth-utils session cookie encryption (32+ char random string)
# Generate: openssl rand -base64 32
NUXT_SESSION_PASSWORD=

# Demo mode — lets /login mint a fake-user ADMIN session without
# configuring OAuth or a DB. Auto-on only when NODE_ENV=development
# (`npm run dev`); off in every deployment unless set to true.
#   true  = always on — only for a deliberate public demo deployment
#   false = always off
#   unset = auto (see shared/demo-mode.ts → resolveDemoMode)
NUXT_DEMO_MODE=

# GitHub OAuth App credentials
# Create at: https://github.com/settings/applications/new
# Authorization callback URL: http://localhost:3000/auth/github
NUXT_OAUTH_GITHUB_CLIENT_ID=
NUXT_OAUTH_GITHUB_CLIENT_SECRET=

# Postgres (Neon, Supabase pooler, or local)
DATABASE_URL=

# Public site URL — used for OAuth redirects + emails
NUXT_PUBLIC_SITE_URL=http://localhost:3000

# Bootstrap admin logins (comma-separated GitHub usernames).
# Matched users are CREATED as role='admin' on their first OAuth sign-in.
# This only affects the initial row — once a user exists, the DB is the
# source of truth and this env is ignored (so demotions stick).
# Leave empty in production unless you actually want a new env-driven
# admin to land on next first-sign-in.
NUXT_INITIAL_ADMIN_LOGINS=

# i18now — translations CDN + dev-time key sync
# Get from https://i18now.com dashboard.
# API key only needed for dev-time auto-sync of new $t() keys.
I18NOW_PROJECT_ID=
I18NOW_API_KEY=

# Axiom — structured log shipping (free tier: 500GB/mo).
# Sign up at https://app.axiom.co. Create a dataset, then an API token
# scoped to that dataset.
# Both must be set together (or both left empty — boot fails on partial).
# Leave empty in dev; the logger falls back to consola-only stdout.
AXIOM_TOKEN=
AXIOM_DATASET=
AXIOM_ORG_ID=

# Sentry — error monitoring + session replay.
# Sign up at https://sentry.io. Create a project, copy the DSN (public).
# DSN unset = @sentry/nuxt module not registered; Sentry.init() is a
# no-op. Leave empty in dev unless you want errors to flow.
# Auth token is build-time only, used for sourcemap upload — fine to
# leave empty in development.
NUXT_PUBLIC_SENTRY_DSN=
SENTRY_AUTH_TOKEN=
SENTRY_ORG=
SENTRY_PROJECT=

# PostHog — product analytics (free tier: 1M events/mo).
# Both values are public by design — PostHog's client SDK is the one
# sending events, so the project key lives in the browser. Empty key =
# plugin no-ops + posthog-js never enters the client bundle.
# HOST: 'https://us.i.posthog.com' (default) or 'https://eu.i.posthog.com'.
NUXT_PUBLIC_POSTHOG_KEY=
NUXT_PUBLIC_POSTHOG_HOST=

# Resend — transactional email (free tier: 100 emails/day, 3000/mo).
# Sign up at https://resend.com. Verify your sending domain first.
# Without RESEND_API_KEY the mailer consola-prints emails to the dev
# server log instead of sending — fine for development.
# EMAIL_FROM must be a verified sender on your Resend account;
# 'onboarding@resend.dev' is allowed for local testing only.
# EMAIL_OPS is where in-app forms (feedback, alerts) deliver to. If
# unset, those messages route to EMAIL_FROM so they don't go to a
# random address.
RESEND_API_KEY=
EMAIL_FROM=
EMAIL_OPS=

# Polar — billing / checkout / subscriptions.
# Sign up at https://polar.sh. Create an organization, then a product
# for each plan tier you want to offer. Mint an access token under
# Settings → Developers → New token (scope: products:read, checkouts:
# write, customer_sessions:write, customers:read).
# Configure a webhook pointing to <SITE_URL>/api/webhooks/polar and
# copy the signing secret.
# Both ACCESS_TOKEN and WEBHOOK_SECRET must be set together (boot fails
# on partial config). Without them all /api/billing/* endpoints return
# an instructive INTERNAL error.
# POLAR_SERVER toggles between Polar's sandbox and production
# environments. Use sandbox while testing — sandbox checkouts don't
# charge real money and have a separate token + product catalog.
POLAR_ACCESS_TOKEN=
POLAR_WEBHOOK_SECRET=
POLAR_SERVER=sandbox
POLAR_PRO_PRODUCT_ID=
POLAR_TEAM_PRODUCT_ID=
POLAR_ENTERPRISE_PRODUCT_ID=