# ── Apple App Store ──────────────────────────────────────
# From App Store Connect → Users and Access → Integrations → Keys
APPLE_BUNDLE_ID=com.yourapp.id
APPLE_SHARED_SECRET=your_shared_secret

# ── Google Play ─────────────────────────────────────────
# Service account JSON from Google Cloud Console (single-line)
GOOGLE_PACKAGE_NAME=com.yourapp.id
GOOGLE_SERVICE_ACCOUNT_KEY={"type":"service_account","project_id":"..."}
# REQUIRED IN PRODUCTION: the Pub/Sub push endpoint URL, verified as the OIDC `aud`.
# Without it the Google webhook cannot attribute a request to Google and answers 401
# when NODE_ENV=production. Leave it unset for local development.
# GOOGLE_PUSH_AUDIENCE=https://api.yourapp.com/onesub/webhook/google
# Restricts push tokens to your Pub/Sub service account; set it with the audience.
# GOOGLE_PUSH_SERVICE_ACCOUNT_EMAIL=push@your-project.iam.gserviceaccount.com

# ── Database ────────────────────────────────────────────
# Uncomment for Postgres; leave unset for in-memory (dev only)
# DATABASE_URL=postgresql://onesub:onesub@localhost:5432/onesub

# ── Admin (optional) ────────────────────────────────────
# Enables /onesub/purchase/admin/* routes
# ADMIN_SECRET=change-me

# ── Server ──────────────────────────────────────────────
PORT=4100