# Copy to .env.local and fill in real values. .env.local is gitignored.
#
# NEVER put real credentials in this file. It is tracked by git, so anything
# written here is published to every clone and lives in history forever.

# The PocketBase instance. This one is public by design — the browser connects
# to it directly — so the URL itself is not a secret.
NEXT_PUBLIC_PB_URL=https://pocketbase.example.com

# Public address of this app. Used as a fallback when a link is generated
# without a browser Origin header. Set this to your production HTTPS domain.
NEXT_PUBLIC_APP_URL=https://planner.example.com

# Superuser credentials, used server-side only by scripts/setup-remote.ts,
# scripts/seed-demo.ts, and the /api/client/* route handlers.
PB_SUPERUSER_EMAIL=you@example.com
PB_SUPERUSER_PASSWORD=replace-me

# A long random secret for the agent API (see docs/superpowers/specs/
# 2026-09-25-phase-8-agent-api-design.md). Generate with:
#   openssl rand -hex 32
# Anyone holding this can read every project and write comments/subtasks/
# moves as the owner — treat it like the superuser credentials above.
AGENT_API_TOKEN=replace-me