# ─── Root .env — shared across all apps ───────────────────────────────────────
# apps/web and apps/arena both set envDir to the workspace root, so Vite picks
# up vars from here. apps/mobile reads EXPO_PUBLIC_SUPABASE_* from its own
# .env.local (Expo requires the EXPO_PUBLIC_ prefix for client-side inlining).
# Server-only vars (SERVICE_ROLE_KEY, platform-api, workers) also live here.

# ─── Supabase (client — browser: apps/web + apps/arena) ──────────────────────
# Local dev: values from `pnpm supabase start` output (or Tailscale IP for device dev).
# SUPABASE_URL=http://localhost:54321
# SUPABASE_PUBLISHABLE_KEY=your-publishable-key

# ─── Supabase (server — platform-api, workers) ────────────────────────────────
# Never expose these to the browser.
# SUPABASE_URL=https://your-project.supabase.co
# SUPABASE_ANON_KEY=your-anon-key
# SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# ─── Platform API ─────────────────────────────────────────────────────────────
# PORT=8786
# CORS_ORIGIN=*
# PLATFORM_API_WORKER_INTERVAL_MS=2000
# PLATFORM_API_WORKER_ONCE=false

# ─── Partner — Chainabit ──────────────────────────────────────────────────────
# Server-side only — used by platform-api, not the browser.
# CHAINABIT_API_URL=https://api.chainabit.com
# CHAINABIT_PARTNER_API_KEY=your-partner-api-key
#
# Chainabit sign-in (login/register) uses the Supabase Auth custom:chainabit provider.
# Configure it in the Supabase dashboard (Auth → Providers → Add custom provider):
#   Provider identifier : custom:chainabit
#   Authorization URL   : https://api.chainabit.com/api/v1/oauth/authorize
#   Token URL           : https://api.chainabit.com/api/v1/oauth/token
#   UserInfo URL        : https://api.chainabit.com/api/v1/oauth/userinfo
#   Scopes              : profile:read email:read
#   Client ID           : <confidential client ID from Chainabit partner admin>
#   Client Secret       : <confidential client secret from Chainabit partner admin>
# Copy the Supabase-generated callback URL into Chainabit's allowed redirect URIs.
#
# Supabase CLI env substitution (for local dev, sign-in provider not functional locally)
# SUPABASE_AUTH_CHAINABIT_CLIENT_ID=your-client-id
# SUPABASE_AUTH_CHAINABIT_SECRET=your-client-secret

# ─── LenserFight Cloud / CLI ──────────────────────────────────────────────────
# LENSERFIGHT_API_KEY=lf_replace_me
# LENSERFIGHT_DEVELOPER_TOKEN=lf_replace_me
# LENSERFIGHT_DEVELOPER_TOKEN_EXPIRES_AT=
# LENSERFIGHT_OLLAMA_BASE_URL=http://localhost:11434
# OLLAMA_BASE_URL=http://localhost:11434

# ─── Local BYOK keys (apps/cli + apps/gateway) ────────────────────────────────
# Local BYOK keys live under `~/.lenserfight/keys/` encrypted at rest with
# AES-256-GCM. The master passphrase is held in the OS keychain by default
# (set up via `lf keys init`). Only set the env var below in CI / headless
# environments without a keychain. Treat it like a database password —
# anyone who can read it can decrypt every key in that directory.
#
# Generate one with:   openssl rand -base64 48
# LENSERFIGHT_KEYS_PASSPHRASE=
# LENSERFIGHT_KEYS_PASSPHRASE_FORCE_ENV=0

# Override the keys directory (default: ~/.lenserfight/keys).
# LENSERFIGHT_KEYS_DIR=

# Override the runtime root (default: ~/.lenserfight).
# LENSERFIGHT_RUNTIME_DIR=

# Gateway daemon listen socket (default: 127.0.0.1:38080).
# LF_GATEWAY_BIND=127.0.0.1
# LF_GATEWAY_PORT=38080
# LF_GATEWAY_TAILSCALE=0

# ─── AI Providers ─────────────────────────────────────────────────────────────
# GEMINI_API_KEY=your-gemini-api-key

# ─── Analytics (production/cloud only — auto-disabled on localhost) ────────────
# GA_MEASUREMENT_ID=G-XXXXXXXXXX
PUBLIC_POSTHOG_PROJECT_TOKEN=phc_jOsBkqwLBmICZ5fFzVj3dyRtUuMz3jgKLdmDCWtLD72
PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

MCP_SERVER_URL=