# Default is live. Demo is explicit and visibly labeled; never used as an error fallback.
APP_MODE=live
APP_ORIGIN=http://localhost:5173
APP_AUTH_ISSUER=http://localhost:5173
REFERENCE_DIR=./data/reference

# Browser-reachable URL vs Bun-server-reachable URL. Compose overrides server URL.
PUBLIC_CONVEX_URL=http://localhost:3210
CONVEX_URL=http://localhost:3210
CONVEX_SELF_HOSTED_URL=http://localhost:3210
# CLI/deployment only. Never sent to browser or web-container environment.
CONVEX_SELF_HOSTED_ADMIN_KEY=
# Generate independent bridge/encryption/signing values using `bun run keys:generate`.
CONVEX_BRIDGE_SECRET=
TOKEN_ENCRYPTION_KEY=
APP_AUTH_PRIVATE_KEY=
APP_AUTH_JWKS=

# Register the exact callback in https://developers.eveonline.com/
# Public PKCE app: leave secret empty. Confidential web app: set its secret.
EVE_CLIENT_ID=
EVE_CLIENT_SECRET=
EVE_CALLBACK_URL=http://localhost:5173/auth/eve/callback
ESI_USER_AGENT=EVE-Intelligence/0.1 (operator: replace-with-your-contact)
# Reviewed ESI date is pinned in source, NOT recomputed from the clock: 2026-08-18.

# Optional: without this key only explicit /assets and /value commands are recognized.
TYPESAFE_API_KEY=

# Compose: set APP_ORIGIN, issuer, callback to http://localhost:3000 for local containers.
# Default remains loopback. Set explicit bind interfaces only behind a firewall/proxy.
WEB_BIND_ADDRESS=127.0.0.1
CONVEX_BIND_ADDRESS=127.0.0.1
WEB_PORT=3000
CONVEX_PORT=3210
CONVEX_SITE_PORT=3211
CONVEX_SITE_ORIGIN=http://localhost:3211
# Backend digest exercised by the isolated self-hosted smoke test.
# Pin the optional dashboard too before production use.
CONVEX_IMAGE=ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a
CONVEX_DASHBOARD_IMAGE=ghcr.io/get-convex/convex-dashboard:latest