.env.example

# Hospitality OS environment variables.
# Copy to .env.local for local development. Do not commit real values.

# "mock" (default if unset): Phase 1 behavior — static tenant list, no auth
#   required, MockDashboardDataProvider. Safe with no Supabase project at all.
# "supabase": real authentication + membership-verified tenant resolution +
#   SupabaseDashboardDataProvider. Requires the variables below and a running
#   Supabase project (`npm run supabase:start` for local dev).
# Server-only — never read on the client, never client-submitted.
DASHBOARD_DATA_PROVIDER=mock

# Public — safe to expose to the browser. Get these from `supabase status`
# for local dev, or Project Settings > API for a hosted project.
NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=your_supabase_publishable_key

# Server-only. NEVER prefix this with NEXT_PUBLIC_, never commit a real
# value, never send it to the browser. Bypasses Row-Level Security entirely.
# Only lib/supabase/service-role.ts reads this, for explicit, audited,
# server-only administration paths — no request path uses it.
# SUPABASE_SECRET_KEY=