# -----------------------------------------------------------------------------
# WACRM — Environment template
# Copy to .env.development, .env.staging, .env.production and fill in values.
# NEVER commit real secrets.  Use your platform's secret store in production
# (Docker Swarm secrets, Kubernetes Secrets, AWS SSM/Secrets Manager, etc.).
# -----------------------------------------------------------------------------

# ---- Public (bundled into the client, safe to expose) ----
VITE_SUPABASE_URL=
VITE_SUPABASE_PUBLISHABLE_KEY=
VITE_APP_ENV=production            # development | staging | production

# ---- White-label branding (client bundle) ----
# VITE_BRAND_NAME is the product name shown in page titles, emails and docs.
# VITE_BRAND_SLUG is its machine-readable form (SDK package names, env-var
# prefixes, status/API subdomains) and must be lower-case and identifier-safe.
VITE_BRAND_NAME=WACRM
VITE_BRAND_SLUG=wacrm
VITE_BRAND_API_HOST=api.wacrm.io
# --- Environment Mode System (single source of truth: see docs/demo-mode.md) ---
APP_MODE=production                # demo | production   (server-side)
VITE_APP_MODE=production           # demo | production   (client bundle)
# Legacy aliases (still honored if APP_MODE is unset):
DEMO_MODE=false
VITE_DEMO_MODE=false

# ---- Server-only (never expose to the browser) ----
SUPABASE_URL=
SUPABASE_PUBLISHABLE_KEY=
SUPABASE_SERVICE_ROLE_KEY=         # ⚠ bypasses RLS — server-only
SETUP_BOOTSTRAP_TOKEN=             # Required only to create the first super admin in /setup or /install; use a random 16+ character secret

# ---- App runtime ----
NODE_ENV=production
HOST=0.0.0.0
PORT=3000
APP_ORIGIN=https://app.example.com  # canonical URL, used for OAuth callbacks & CORS
LOG_LEVEL=info                      # trace|debug|info|warn|error

# ---- Signing / session ----
SESSION_SECRET=                     # openssl rand -hex 32
WEBHOOK_SECRET=                     # openssl rand -hex 32

# ---- Provider integrations ----
WHATSAPP_APP_SECRET=
WHATSAPP_VERIFY_TOKEN=
WHATSAPP_ACCESS_TOKEN=              # WhatsApp Cloud API token (catalog sync, send)
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GEMINI_API_KEY=

# -----------------------------------------------------------------------------
# Meta (Facebook Messenger + Instagram)
# -----------------------------------------------------------------------------
# Without these the inbound webhooks FAIL CLOSED and no Messenger/Instagram
# message ever reaches the inbox — the channel still shows "connected" and
# "healthy", because those checks only exercise the outbound Graph API.
# Symptom: messages appear only after a manual Sync, or not at all.
META_APP_ID=                        # Meta app id (page/IG account linking)
META_APP_SECRET=                    # REQUIRED for inbound: verifies X-Hub-Signature-256.
                                    # Unset → webhook POST returns 500 "app secret not configured".
META_WEBHOOK_VERIFY_TOKEN=          # REQUIRED for inbound: the hub.verify_token you enter in
                                    # Meta → Webhooks. One value per Meta app, shared by
                                    # Messenger and Instagram and by ALL channel accounts.
                                    # Unset → webhook GET returns 500 "Verify token not configured".
# Per-product overrides. Only set these if Messenger and Instagram are wired to
# different Meta apps; otherwise META_WEBHOOK_VERIFY_TOKEN covers both.
MESSENGER_WEBHOOK_VERIFY_TOKEN=     # falls back to META_WEBHOOK_VERIFY_TOKEN
IG_WEBHOOK_VERIFY_TOKEN=            # falls back to META_WEBHOOK_VERIFY_TOKEN
META_TOKEN_ENCRYPTION_KEY=          # encrypts stored page/IG tokens at rest.
                                    # Falls back to APP_USER_CONNECTION_KEY_SECRET, then SESSION_SECRET.

# -----------------------------------------------------------------------------
# Social Studio OAuth (X, Threads, TikTok, LinkedIn "Continue with ..." login)
# -----------------------------------------------------------------------------
# Set credentials only for the social providers enabled on this deployment.
X_CLIENT_ID=
X_CLIENT_SECRET=
THREADS_APP_ID=
THREADS_APP_SECRET=
TIKTOK_CLIENT_KEY=                  # TikTok for Developers app "client key" (Login Kit).
TIKTOK_CLIENT_SECRET=               # Server-only. Never sent to the browser — used only in
                                    # tiktok-callback.ts's token exchange.
LINKEDIN_CLIENT_ID=                 # LinkedIn developer app client ID (Sign In with LinkedIn / OpenID Connect).
LINKEDIN_CLIENT_SECRET=             # Server-only. Never sent to the browser — used only in
                                    # linkedin-callback.ts's token exchange.
YOUTUBE_CLIENT_ID=                  # Google Cloud OAuth client (YouTube Data API v3, youtube.force-ssl).
YOUTUBE_CLIENT_SECRET=              # Server-only. Enables "Continue with Google" for YouTube with
                                    # automatic token renewal. Falls back to GOOGLE_CLIENT_ID/SECRET.
# TikTok API for Business app (business-api.tiktok.com) — TikTok DMs, TikTok comments and the
# TikTok chatbot. Separate from the Login Kit app above.
TIKTOK_BUSINESS_APP_ID=
TIKTOK_BUSINESS_APP_SECRET=         # Server-only. Also verifies the Tiktok-Signature webhook header.
# SOCIAL_OAUTH_STATE_SECRET signs the OAuth `state` param for X/Threads/TikTok/LinkedIn connect.
# Falls back to META_APP_SECRET, then WIDGET_SIGNING_SECRET.
SOCIAL_OAUTH_STATE_SECRET=

# Google Workspace direct OAuth (server only).
# Alternatively save these in Super Admin > Platform Settings > Integrations.
# Register https://<APP_ORIGIN-host>/api/public/integrations/google-workspace/callback
# and https://<APP_ORIGIN-host>/api/public/booking/google-calendar/callback
# and https://<APP_ORIGIN-host>/api/public/integrations/gmail-channel/callback
# (the Gmail inbox channel — Settings > Email > Connect Gmail; reuses this
# same client, with its own narrower gmail.readonly/gmail.send scope)
# as authorized redirect URIs in Google Cloud. Supabase Auth Google sign-in
# has its own redirect URI: <SUPABASE_URL>/auth/v1/callback.
GOOGLE_WORKSPACE_CLIENT_ID=
GOOGLE_WORKSPACE_CLIENT_SECRET=

# Microsoft 365 Calendar direct OAuth (server only). Add this Web redirect URI
# in Microsoft Entra: https://<APP_ORIGIN-host>/api/public/booking/microsoft-calendar/callback
MICROSOFT_CALENDAR_CLIENT_ID=
MICROSOFT_CALENDAR_CLIENT_SECRET=
MICROSOFT_TENANT_ID=common

# ---- Transactional email ----
SMTP_HOST=                          # outbound email host. Unset → password resets and
                                    # notifications are disabled (flagged in Setup → Environment).

# ---- Billing providers ----
STRIPE_SECRET_KEY=
PADDLE_API_KEY=
PADDLE_ENV=sandbox                  # sandbox | production

# ---- Internal signing / service-to-service ----
# All of these are secrets: openssl rand -hex 32
APP_USER_CONNECTION_KEY_SECRET=     # 32 random bytes in base64: openssl rand -base64 32
INTERNAL_CRON_TOKEN=                # authorises /api/public/hooks/* scheduled endpoints.
                                    # pg_cron reads its target from Supabase Vault, NOT from this file. Store the
                                    # same value + this deployment's origin there (SQL editor, as postgres):
                                    #   select vault.create_secret('https://app.example.com', 'wacrm_cron_base_url');
                                    #   select vault.create_secret('<INTERNAL_CRON_TOKEN>',   'wacrm_cron_token');
                                    # Until both exist every scheduled job is a no-op (Release Readiness flags it).
WEBHOOK_DISPATCH_SECRET=            # signs outbound webhook deliveries
WIDGET_SIGNING_SECRET=              # signs embedded live-chat / booking widget sessions

# ---- WhatsApp QR worker (optional; only if running the qr-worker service) ----
WA_QR_WORKER_URL=                   # e.g. http://qr-worker:8080
WA_QR_WORKER_TOKEN=                 # bearer token the app sends to the worker
WA_QR_WORKER_SIGNING_SECRET=        # signs requests to the worker
WA_QR_WEBHOOK_SECRET=               # verifies callbacks from the worker

# ---- Knowledge base ----
KB_VECTOR_STORE=                    # vector store backend for KB embeddings

# ---- Scaling & ops ----
APP_REPLICAS=2
WACRM_VERSION=v7.2.3
CLOUDFLARE_WORKER_NAME=wacrm
CLOUDFLARE_DOMAIN=wacrm.example.com
CLOUDFLARE_ZONE_NAME=example.com

# ---- Test harness only (never set in staging or production) ----
# RLS_TEST_HARNESS_SECRET=
# RLS_TEST_HARNESS_ALLOW_PROD=false
