# ─── SuperAdmin server ports (see PORTS.md) ─────────────────────────────
SUPERADMIN_PORT=3002                          # SuperAdmin API (superadmin/server/src/index.js)

# ─── SuperAdmin JWT / master keys ──────────────────────────────────────
SUPERADMIN_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEI...REPLACE_ME...\n-----END PRIVATE KEY-----
SUPERADMIN_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAGB9...REPLACE_ME...\n-----END PUBLIC KEY-----
# Keep the literal \n escapes in SUPERADMIN_PRIVATE_KEY and SUPERADMIN_PUBLIC_KEY; the server replaces them with real newlines at load time.

SUPERADMIN_JWT_SECRET=replace-me-with-a-long-random-string
SUPERADMIN_MASTER_KEY=replace-me-with-a-master-key

# ─── SuperAdmin client Vite port (consumed by superadmin/client/vite.config.ts) ──
# VITE_PORT=3003                              # set this in superadmin/client/.env

# ─── Supabase Cloud (env-only — anon key only; writes go via SECURITY DEFINER RPC) ──
# The SuperAdmin server reads Supabase credentials from these env vars
# at startup. The SuperAdmin UI has no key-entry form; update this
# file and restart the process to rotate keys.
#
# - SUPABASE_URL is the project REST endpoint
#   (e.g. https://<project-ref>.supabase.co)
# - SUPABASE_KEY is the anon / publishable JWT. The SuperAdmin never
#   holds the service-role key. Writes are gated by SECURITY DEFINER
#   Postgres RPC functions (upsert_tenant_cloud, upsert_license_cloud)
#   installed by migration 2026072900000100.
SUPABASE_URL=https://api.next_gen.techarvest.co.zw
SUPABASE_KEY=replace-me-with-supabase-anon-jwt

# ─── Misc ──────────────────────────────────────────────────────────────
DB_PATH=