NODE_ENV=development
DEPLOYMENT_MODE=local

# --- Docker 宿主机发布（避免与同机其他容器端口冲突时只改这里）---
# 数据服务固定绑定本机回环。需要局域网访问时仅调整网关地址。
GATEWAY_BIND_ADDRESS=127.0.0.1
GATEWAY_PORT=8088
POSTGRES_PORT=15432
REDIS_PORT=16379
MINIO_API_PORT=19000
MINIO_CONSOLE_PORT=19001
MAILPIT_SMTP_PORT=1025
MAILPIT_WEB_PORT=8025
# 宿主机映射端口；容器内通知接收器仍固定监听 4080。
NOTIFICATION_SINK_HOST_PORT=4080
# 兼容旧变量名：若未设置 NOTIFICATION_SINK_HOST_PORT，仍可读 NOTIFICATION_SINK_PORT。
NOTIFICATION_SINK_PORT=4080

# 改 GATEWAY_PORT 时务必同步更新下列 Origin / URL。
PUBLIC_ORIGIN=http://localhost:8088
ADMIN_ORIGIN=http://admin.localhost:8088
# Independent WeChat payment surface. Keep this distinct from PUBLIC_ORIGIN.
PAYMENT_PUBLIC_ORIGIN=http://www.localhost:8088
PAYMENT_PUBLIC_BASE_PATH=/pay/hui
PAYMENT_PUBLIC_URL=http://www.localhost:8088/pay/hui

# --- pnpm 源码开发端口（与 Docker 宿主机映射无关）---
API_PORT=4100
API_BIND_ADDRESS=127.0.0.1
WEB_PORT=3000
ADMIN_PORT=3200
PUBLIC_WEB_URL=http://localhost:3000
ADMIN_WEB_URL=http://localhost:3200
NUXT_PUBLIC_API_BASE=http://localhost:4100/api/v1
NUXT_PUBLIC_ORGANIZATION_SLUG=geo-conference
VITE_API_BASE=http://localhost:4100/api/v1
VITE_PUBLIC_WEB_URL=http://localhost:3000
VITE_SIMPLE_AUTH=false
POSTGRES_IMAGE=pgvector/pgvector:pg16
DATABASE_URL=postgresql://conference:conference@localhost:15432/conference
REDIS_URL=redis://localhost:16379
DOCKER_DATABASE_URL=postgresql://conference:conference@postgres:5432/conference
DOCKER_REDIS_URL=redis://redis:6379
DATABASE_POOL_SIZE=10
MINIO_ROOT_USER=conference
MINIO_ROOT_PASSWORD=conference-secret
WORKER_TMPFS_SIZE=512m
S3_ENDPOINT=http://localhost:19000
DOCKER_S3_ENDPOINT=http://minio:9000
S3_PUBLIC_ENDPOINT=http://localhost:19000
INVOICE_ASYNC_EXPORT_THRESHOLD=50000
S3_ACCESS_KEY=conference
S3_SECRET_KEY=conference-secret
S3_BUCKET=conference-assets
S3_REGION=us-east-1
JWT_SECRET=replace-with-at-least-32-random-characters
# Agent Access ships disabled. Generate an independent 32-byte base64 secret before enabling it.
TOKEMS_AGENT_ACCESS_ENABLED=false
TOKEMS_AGENT_WRITES_ENABLED=false
TOKEMS_AGENT_CRITICAL_ACTIONS_ENABLED=false
AGENT_ACCESS_TOKEN_SECRET=
# Keep the previous secret only for the documented 15-minute verification window.
AGENT_ACCESS_TOKEN_PREVIOUS_SECRET=
INVOICE_DOWNLOAD_SIGNING_SECRET=replace-with-an-independent-random-signing-secret
CUSTOMER_OTP_PEPPER=replace-with-at-least-32-random-characters
CUSTOMER_SESSION_SECRET=replace-with-at-least-32-random-characters
NOTIFICATION_PAYLOAD_ENCRYPTION_SECRET=replace-with-at-least-32-random-characters
# Local frontend OTP is always 123456. Production deployments must use provider.
CUSTOMER_OTP_MODE=fake
CUSTOMER_OTP_ORG_DAILY_LIMIT=10000
CUSTOMER_OTP_PLATFORM_HOURLY_LIMIT=8
ALLOW_INSECURE_LOCAL_AUTH=false
ADMIN_USERNAME=admin
ADMIN_USER_ID=aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa
ADMIN_EMAIL=admin@tokems.local
ADMIN_PASSWORD=replace-with-a-strong-random-password
SEED_DEMO_DATA=false
OUTBOX_POLL_INTERVAL_MS=2000
WORKER_CONCURRENCY=5
INVENTORY_RELEASE_INTERVAL_MS=30000
SMS_RECEIPT_INTERVAL_MS=30000
PUBLIC_ORGANIZATION_SLUG=geo-conference
PUBLIC_SITE_URL=http://localhost:3000
PUBLIC_API_URL=http://localhost:4100
# 合作伙伴推广归因和提现敏感数据使用独立密钥；生产环境均需至少 32 个字符。
PARTNER_ATTRIBUTION_SECRET=replace-with-at-least-32-random-characters
PARTNER_PAYOUT_DATA_SECRET=replace-with-at-least-32-random-characters
# 微信收款人 OAuth 完成后返回合作伙伴中心的公开来源。
PAYOUT_PUBLIC_URL=http://localhost:3000
TRUST_PROXY=127.0.0.1,::1,172.16.0.0/12
API_RATE_LIMIT_PER_MINUTE=5000
PAYMENT_WEBHOOK_SECRET=replace-with-a-random-provider-webhook-secret
INTEGRATION_ENCRYPTION_KEY=replace-with-32-random-bytes-encoded-as-base64
INTEGRATION_ENCRYPTION_KEY_VERSION=1
# JSON object for decryption during key rotation, for example {"1":"old-base64-key"}
INTEGRATION_ENCRYPTION_PREVIOUS_KEYS=
ENABLE_LOCAL_PAYMENT_SIMULATION=false
LOCAL_PAYMENT_SIMULATION_MOBILES=
NOTIFICATION_WEBHOOK_URL=
NOTIFICATION_WEBHOOK_TOKEN=conference-local-notification-token
AI_API_URL=
AI_API_KEY=
AI_MODEL=conference-copywriter-local-v1
HTML_TEMPLATE_IMPORT_ENABLED=true
# Comma-separated organization UUIDs. Empty enables every organization when import is enabled.
HTML_TEMPLATE_IMPORT_ORG_ALLOWLIST=
HTML_TEMPLATE_ORG_ASSET_BYTES=2147483648
HTML_TEMPLATE_ORG_ASSET_COUNT=10000
HTML_TEMPLATE_AI_MAPPING_ENABLED=false
HTML_TEMPLATE_AI_ORG_MINUTE_LIMIT=5
HTML_TEMPLATE_AI_ORG_DAILY_LIMIT=100
# WeChat merchant credentials are configured in the admin console, not via WEIXIN_* env vars.
# Stable notify URL uses PUBLIC_API_URL / PUBLIC_ORIGIN (hui domain). OAuth/H5 redirects use PAYMENT_PUBLIC_URL.