local.env.example

# Optional overlay for `pnpm local:up`, applied on top of the committed
# `e2e/stack.env`. Copy to `~/.config/repkey/local.env` to use it in every
# checkout and worktree, or to this checkout's `local.env` (gitignored), which
# overrides the shared file. An EMPTY value unsets the variable.
#
# ── Your own admin ────────────────────────────────────────────────────────────
# Every seed makes this address an AccountAdmin of the seeded organization, with
# the `test@example.com` password (E2E_TEST_PASSWORD) unless you set one.
#
# LOCAL_ADMIN_EMAIL=you@example.com
# LOCAL_ADMIN_NAME=Your Name
# LOCAL_ADMIN_PASSWORD=
#
# ── Real Google ───────────────────────────────────────────────────────────────
# Connect a real Google account and import real locations from this stack. The
# runner then drops every `provider-sandbox` endpoint pin and selects the
# approved Google endpoints (`production-fixed`).
#
# Prerequisites, once, in the Google Cloud project that already carries the
# Business Profile API allowlist (the same project as production):
#   1. APIs & Services → Credentials → an OAuth 2.0 Client ID of type
#      "Web application" (a new "RepKey local" client keeps production's client
#      untouched; reusing production's client works too).
#   2. Authorised redirect URIs → add exactly:
#        http://127.0.0.1:3000/api/auth/google/callback
#      (Google accepts loopback URIs over http for web clients.)
#   3. The Google account you connect must manage at least one Business Profile
#      location, and must be a test user if the consent screen is in Testing.
#
# Real API quota is consumed and real reviewer data lands in the local
# database; `pnpm local:down` deletes that volume.
#
# REPKEY_LOCAL_GOOGLE=real
# GOOGLE_CLIENT_ID=000000000000-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com
# GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxxxxxxxxxx
#
# ── Real AI ───────────────────────────────────────────────────────────────────
# Run the analysis, reply-drafting and trend routes against OpenAI instead of
# the Compose stub. The runner drops `AI_PROVIDER_LOCAL_STUB`, so the gateway
# builds its pinned `api.openai.com` connector; every keyring it needs is
# already in `e2e/stack.env`.
#
# The account must be able to call the model snapshot the deployment profile
# pins (`src/shared/ai-openai-provider-profile.ts`):
#   curl -sI -H "Authorization: Bearer $OPENAI_API_KEY" \
#     https://api.openai.com/v1/models/<snapshot>   # expect 200
#
# Every enabled capability then spends real tokens, and the redacted review
# text plus the property's public display name leave this machine under the
# consented notice - AI still has to be enabled per property in Settings.
#
# REPKEY_LOCAL_AI=real
# OPENAI_API_KEY=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx