Phase 8

.env.example

@@ -26,7 +26,11 @@ EMAIL_SMTP_PORT="587"
 EMAIL_SMTP_USERNAME=""
 EMAIL_SMTP_PASSWORD=""
 EMAIL_FROM_ADDRESS=""
-EMAIL_FROM_NAME="NextChair"
+# EMAIL_FROM_NAME is optional and is only used when no business name can
+# be resolved. Normal business emails use the installed business name
+# automatically (see docs/phase-8-email-sender-summary.md) — you do not
+# need to set or keep this in sync with Business Settings.
+EMAIL_FROM_NAME=""
 
 # Web Push (Phase 7) — generate with: npx web-push generate-vapid-keys
 # NEXT_PUBLIC_VAPID_PUBLIC_KEY must be the same value as VAPID_PUBLIC_KEY —
@@ -42,3 +46,19 @@ VAPID_SUBJECT="mailto:owner@example.com"
 # scheduler presents as `Authorization: Bearer <value>` to
 # /api/cron/process-notifications. Generate with: openssl rand -hex 32
 CRON_SECRET=""
+
+# First-run installation wizard (Phase 8) — required before /install will
+# create the first business/administrator. Generate with:
+# openssl rand -hex 32
+INSTALLATION_TOKEN=""
+
+# Staff Google Calendar sync (Phase 8) — separate OAuth client from
+# AUTH_GOOGLE_ID/SECRET above (different scopes; see
+# src/services/calendar/google-calendar.provider.ts). Leave unset to keep
+# calendar sync disabled — Settings shows a "not configured" state rather
+# than crashing.
+GOOGLE_CALENDAR_CLIENT_ID=""
+GOOGLE_CALENDAR_CLIENT_SECRET=""
+GOOGLE_CALENDAR_REDIRECT_URI="http://localhost:3000/api/staff/calendar/google/callback"
+# Encrypts stored refresh tokens at rest. Generate with: openssl rand -hex 32
+CALENDAR_TOKEN_ENCRYPTION_KEY=""