.env.example

# Copy to .env.local and fill with real values. .env.local is git-ignored.
NEXT_PUBLIC_SUPABASE_URL=https://xxxx.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_xxx

# server-only — NEVER prefix these with NEXT_PUBLIC_
SUPABASE_SERVICE_ROLE_KEY=sb_secret_xxx
# One client_id serves every environment — it does NOT change between sandbox and production.
PLAID_CLIENT_ID=xxx
# The secret DOES differ per environment (dashboard shows "Sandbox secret" / "Production secret").
PLAID_SECRET=xxx
# Exactly "sandbox" or "production" — any other value is rejected at startup rather than
# silently falling back to sandbox.
PLAID_ENV=sandbox
# Where an OAuth bank returns the user. Must be registered in the Plaid dashboard first.
# Local: http://localhost:3000/plaid/oauth — Production: the https Vercel URL.
PLAID_REDIRECT_URI=http://localhost:3000/plaid/oauth
# Where Plaid POSTs item/transaction webhooks. Must be a public https URL, so leave blank
# locally. Cannot be added to an Item after it is created.
PLAID_WEBHOOK_URL=
# Long random string; must match the ?key= on the webhook URL registered with Plaid.
PLAID_WEBHOOK_SECRET=
TOKEN_ENCRYPTION_KEY=32_byte_hex   # generate with: openssl rand -hex 32

# TypeSafe (System One judgments). Read by @typesafe-ai/sdk automatically — this exact
# name is why `new TypeSafeClient()` takes no argument. Server-only: the docs are explicit
# that credentials stay server-side, so never prefix this with NEXT_PUBLIC_.
TYPESAFE_API_KEY=xxx

# Jev category suggestions (#28 spec §14.7). "on" enables the job and applies stored suggestions;
# anything else (or unset) is off, and is also the rollback.
CATEGORY_SUGGESTIONS=