.dev.vars.example

# Copy to .dev.vars and fill in. .dev.vars is gitignored.
# These are picked up by `wrangler dev` as the Worker's secrets in local mode.

# Local public origin. Overrides the committed wrangler.toml [vars] default so
# OAuth callbacks + the MCP base URL resolve to your local HTTPS dev server.
PUBLIC_BASE_URL=https://localhost:8787

# Outbound IdP credentials. Configure at least one IdP (plus its allowlist
# below) — you cannot sign in otherwise.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# Per-deployment allowlists. wrangler.toml [vars] holds the committed
# defaults (empty); override here for local dev or sensitive prod values.
# Either allowlist enables the corresponding IdP.
#   - ALLOWED_GOOGLE_HD: Workspace hosted-domain (e.g. "acme.com")
#   - ALLOWED_GOOGLE_EMAILS: comma-separated emails for solo accounts
#   - ALLOWED_GITHUB_ORG: GitHub org slug (e.g. "acme-inc")
#   - ALLOWED_GITHUB_USERS: comma-separated GitHub logins
# ALLOWED_GOOGLE_HD=
# ALLOWED_GOOGLE_EMAILS=
# ALLOWED_GITHUB_ORG=
# ALLOWED_GITHUB_USERS=

# Admission policy (plan L): open_domain (default — allowlist is the gate) |
# request (admin-approval queue, Admin · Users › Pending) | invite (invite /
# join-code only). Override here to exercise the request/invite flows locally.
# ACCESS_POLICY=request

# Comma-separated emails auto-promoted to admin on first sign-in. Set this to
# your own email so the admin pages are reachable in local dev.
ADMIN_EMAILS=

# 32 random bytes base64 — used by crypto/aead.ts (AES-GCM at rest for user_credentials)
# Generate: openssl rand -base64 32
ENCRYPTION_KEY=

# HMAC key for the SPA session cookie. 32 random bytes base64.
# Generate: openssl rand -base64 32
SESSION_COOKIE_SECRET=

# CI smoke harness only — leave blank for normal dev
CI_SMOKE_OAUTH_CLIENT_ID=
CI_SMOKE_OAUTH_CLIENT_SECRET=

# Observability (optional; leave blank to disable). Slack/Discord/generic
# incoming webhook — cron/queue/poison failures are POSTed here.
ALERT_WEBHOOK_URL=