<?php

declare(strict_types=1);

$config = [
    'app_name' => 'Karvi Partner with Gulab and Flamers',
    // Leave empty or set to "auto" to detect from the live domain. Set manually only if auto-detect is wrong.
    'base_url' => '',
    // Subfolder path, e.g. /karvi-pro/contract — empty = auto-detect from URL.
    'base_path' => '',
    'admin_username' => 'admin',
    'admin_password' => '123456',
    'session_name' => 'karvi_admin_session',
    'uploads_dir' => __DIR__ . '/../uploads',
    'contracts_dir' => __DIR__ . '/../uploads/contracts',
    'signatures_dir' => __DIR__ . '/../uploads/signatures',
    'signed_dir' => __DIR__ . '/../uploads/signed',
    'template_pdf' => __DIR__ . '/../templates/karvi_partner_contract_template.pdf',
    'templates_dir' => __DIR__ . '/../templates',
    'logo_path' => __DIR__ . '/../assets/img/KARVI.png',
    'invoice_logo_path' => __DIR__ . '/../assets/img/logo..jpeg',
    'local_db' => __DIR__ . '/../database/data.json',
    // Set true on production. Set false to skip the contract-page location gate (testing only).
    'require_contract_location' => true,
    // Bcrypt hash for contract delete confirmation. Generate: php -r "echo password_hash('YOUR_PASSWORD', PASSWORD_DEFAULT);"
    'admin_action_password' => '$2y$12$pG72USyZ9u4JO41IKCZWfOZRDDtJBFHG1uLXBfJ1K8NOPLMCLE.0S',
    // Set true in production to require delete password. false = dev delete (one click, no password).
    'require_delete_password' => false,
    // When false, admin create/duplicate/list use Partner API only (no data.json contract rows).
    // Customer signing still writes a short-lived local signing record when needed.
    'persist_local_contracts' => true,
];

$localConfig = __DIR__ . '/config.local.php';
if (is_file($localConfig)) {
    $overrides = require $localConfig;
    if (is_array($overrides)) {
        $config = array_merge($config, $overrides);
    }
}

return $config;
