Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/astrxnomo/manizalesdepie/llms.txt

Use this file to discover all available pages before exploring further.

All environment variables are validated at build time by lib/env.ts (public variables) and lib/env.server.ts (server-only secrets). Both use Zod to parse the values the moment the module loads. A missing or empty variable throws immediately with a descriptive error — failing the build rather than surfacing as a null pointer at 3 a.m. during an active emergency.

​
Public variables

Variables prefixed NEXT_PUBLIC_ are inlined into the browser bundle by Next.js. They are visible to anyone who inspects the page source. Never put a secret in a NEXT_PUBLIC_ variable.
​
NEXT_PUBLIC_SUPABASE_URL
string
required
The project URL from Supabase Project Settings → API.Example: https://lriozoktdpkggzywimek.supabase.coUsed to initialize both the browser Supabase client and the server-side SSR client. Must be a valid URL — lib/env.ts validates it with z.url().
​
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY
string
required
The publishable (anon) key from Supabase Project Settings → API.This key is safe in the browser because row-level security limits what it can read and write. It cannot bypass RLS. Published rows are readable by the anon role; everything else is gated by policy.
​
NEXT_PUBLIC_SITE_URL
string
required
The full URL of your deployment. Used for OAuth redirect URLs and OpenGraph metadata.
  • Local development: http://localhost:3000
  • Production: https://manizales-de-pie.vercel.app (or your custom domain)
Must be a valid URL — lib/env.ts validates it with z.url().
​
NEXT_PUBLIC_CURATOR_WHATSAPP
string
Phone number for curator contact. Digits only, with country code. No spaces, dashes, or plus signs.Example: 573001234567 (where 57 is Colombia’s country code)Displayed across the app as the contact point for affected people and reporters. This is not validated as required — the app runs without it — but it should be set before the deployment is shared publicly.

​
Server-only variables

Server-only variables are never prefixed NEXT_PUBLIC_. They live in lib/env.server.ts, which opens with import "server-only". That import turns an accidental client-side import of this module into a build error, not a code review comment.
SUPABASE_SECRET_KEY bypasses row-level security entirely. If this key ever reaches the client bundle, any user can read and write any row in the database — including work_order_contact rows that contain addresses of households with damaged homes.The ESLint rule in eslint.config.mjs blocks any import of @/lib/supabase/admin or @/lib/env.server from app/ or components/. Do not disable or work around that rule.
​
SUPABASE_SECRET_KEY
string
required
The service role key from Supabase Project Settings → API.Bypasses all RLS policies. Only *.dal.ts files may access this key, and only through the admin client at lib/supabase/admin.ts. No page, component, route handler, or server action may import it directly.

​
The env split in practice

The two modules enforce the public/server split at the import graph level:
lib/env.ts
// Public — Zod-parsed at module load, crashes loud if missing or malformed
const clientSchema = z.object({
  NEXT_PUBLIC_SUPABASE_URL: z.url(),
  NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: z.string().min(1),
  NEXT_PUBLIC_SITE_URL: z.url(),
});

export const clientEnv = clientSchema.parse({ /* process.env values */ });
lib/env.server.ts
import "server-only";
// Server — never reaches the browser bundle; accidental client import → build error
const serverSchema = z.object({
  SUPABASE_SECRET_KEY: z.string().min(1),
  NODE_ENV: z.enum(["development", "test", "production"]).default("development"),
});

export const serverEnv = serverSchema.parse({ /* process.env values */ });
lib/env.ts is safe to import anywhere — pages, components, the proxy, server actions. lib/env.server.ts may only be imported by server-side code in lib/ and data/. The server-only package makes that boundary enforced rather than advisory.

​
Setting up .env.local

Copy the example file and fill in each variable: 
cp .env.example .env.local
# Then fill in each variable
A complete .env.local template:
.env.local
# ---- public: inlined into the browser bundle, never put a secret here -------
NEXT_PUBLIC_SUPABASE_URL="https://your-project-ref.supabase.co"
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY="your-anon-key"
NEXT_PUBLIC_SITE_URL="http://localhost:3000"
NEXT_PUBLIC_CURATOR_WHATSAPP="573001234567"

# ---- server only: never prefixed NEXT_PUBLIC_ -------------------------------
# Bypasses row-level security. Only *.dal.ts may reach it.
SUPABASE_SECRET_KEY="your-service-role-key"
All four required variable names are exactly as shown. The build fails fast with a Zod validation error if NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, NEXT_PUBLIC_SITE_URL, or SUPABASE_SECRET_KEY is missing or empty. NEXT_PUBLIC_CURATOR_WHATSAPP is an optional extra variable not present in .env.example — the app runs without it, but it should be set before the deployment is shared publicly.

Build docs developers (and LLMs) love

Get started for freeTalk to us