# Server
PORT=3030
NODE_ENV=production
# Comma-separated allowlist of browser origins permitted to call the API.
CORS_ORIGIN=http://localhost:5173,http://localhost:5174
# LOCAL DEV ONLY — set to true to skip Firebase auth when no Bearer token is sent.
# Leave unset/false in any deployed environment (fail closed).
# ALLOW_DEV_AUTH_BYPASS=true

# Data source. Defaults to false — the real data source. Set true ONLY for local
# dev: mock rows live in process memory, so every write is lost on restart.
# The server REFUSES to start with USE_MOCK_DATA=true and NODE_ENV=production.
# USE_MOCK_DATA=true

# Firebase (required for auth and as the real data source)
# LOCAL DEV ONLY — pointing a deployed server at an emulator that isn't there
# leaves it reading an empty database under a placeholder project id.
# FIRESTORE_EMULATOR_HOST=localhost:8080
# FIREBASE_PROJECT_ID=
# FIREBASE_CLIENT_EMAIL=
# FIREBASE_PRIVATE_KEY=

# Client (set in packages/client/.env)
# VITE_API_URL=http://localhost:3030