Encore OS — Documentation

Authoritative sources: the branch ↔ Vercel ↔ Supabase mapping lives in supabase/config.toml and VERCEL_SUPABASE_ENV_ALIGNMENT.md. Frontend Supabase credentials are baked at build time by vite.config.ts (keyed off the VERCEL_PROJECT_ID system variable) — they are not regenerated by Lovable and not taken from user-defined Vercel env vars (CI guards this via npm run check:no-vercel-env-config). This file is a human-readable reference; if it disagrees with config.toml/vite.config.ts, those win.

PHI guardrail: node-side code (RLS/integration tests, CLI, agents) hard-fails when its resolved Supabase URL is the prod project, unless ALLOW_PROD=1 is set deliberately — enforced by scripts/database/supabase-tier.ts and the static npm run check:no-prod-refs guard. Design: 2026-06-01-environment-consistency-design.md. Node-side .env.local template: env.local.example.

Quick Reference

Environment	Git branch	Vercel project	Supabase project	Project ID	Status
Dev	`development` (default)	`encoreos_dev`	`encore_os_dev2`	`anuwknikgsijbameytzr`	🟢 Active
Production	`production`	`encoreos_prod`	`encore_os_prod2`	`aximlomrwfuhctxjhrsf`	🟢 Active
Builder	— (Lovable)	—	`encore_builder`	`lylmlcxmrkdzokagycpr`	🟢 Active
Local	any	—	local OrbStack stack	—	on demand

The development branch is the working default and pairs with the dev project. The Lovable encore_builder project is used by the Lovable editor only and is not a deployment target for the app.

How frontend credentials are resolved

There is no .env-driven switch and no Lovable client regeneration step. vite.config.ts maps VERCEL_PROJECT_ID → Supabase target and inlines the URL + publishable key as build-time defines for both npm run dev and production builds:

`VERCEL_PROJECT_ID`	Supabase target
`prj_iMHAljBMLDQXONzL9g7XUHH6CzrP` (encoreos_dev)	`dev`
`prj_NZTWEPkUXJ3jM51uh91Ty8Np9K7c` (encoreos_prod)	`prod`
unset (local) / unmapped (Lovable, external)	falls through to `dev`

Because of this, a plain npm run dev / build / preview / test:e2e already points at the dev project with no secrets required. src/integrations/supabase/client.ts reads import.meta.env.VITE_SUPABASE_URL / VITE_SUPABASE_PUBLISHABLE_KEY, which Vite has replaced with the baked values.

When `.env.local` matters

.env.local (gitignored) is only needed for node-side consumers that read process.env directly — RLS tests, integration tests, and CLI/scripts — or to point a local dev server at a non-default project. Generate it via bash scripts/setup/web-env-setup.sh (see also VERCEL_SUPABASE_ENV_ALIGNMENT.md).

Environment Credentials

Publishable / anon keys are client-safe and ship in the bundle; treat them as public. The service-role key bypasses RLS — never commit it; provide it only as an environment secret when RLS/integration tests need it.

Dev (`encore_os_dev`)

VITE_SUPABASE_URL="https://anuwknikgsijbameytzr.supabase.co"
# Anon JWT baked into vite.config.ts (SUPABASE_PROJECTS.dev) — authoritative source:
VITE_SUPABASE_PUBLISHABLE_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImFudXdrbmlrZ3NpamJhbWV5dHpyIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzk5OTg5NzQsImV4cCI6MjA5NTU3NDk3NH0.foLE-MASIWaVMjbNJrcB1D2TGf5Ync9ZNsvk7rx9vMc"

Dashboard: https://supabase.com/dashboard/project/anuwknikgsijbameytzr

Production (`encore_os_prod`)

⚠️ Live data and real PHI. Do not point local/test sessions here without a reason.

VITE_SUPABASE_URL="https://aximlomrwfuhctxjhrsf.supabase.co"
# Anon JWT baked into vite.config.ts (SUPABASE_PROJECTS.prod) — authoritative source:
VITE_SUPABASE_PUBLISHABLE_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImF4aW1sb21yd2Z1aGN0eGpocnNmIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzk5OTg5OTQsImV4cCI6MjA5NTU3NDk5NH0._G_7nLRH6H962jc2SZthpJtvNxPXYRw2L5TBKUx_BSE"

Dashboard: https://supabase.com/dashboard/project/aximlomrwfuhctxjhrsf

Supabase CLI: linking to a remote

supabase/config.toml defines [remotes.dev] (anuwknikgsijbameytzr) and [remotes.production] (aximlomrwfuhctxjhrsf). Link with:

# Dev
npx supabase link --project-ref anuwknikgsijbameytzr

# Production (be deliberate)
npx supabase link --project-ref aximlomrwfuhctxjhrsf

# Local stack
npx supabase start    # bring up local Supabase on OrbStack
npx supabase status   # print local URL + keys
npx supabase stop

See SUPABASE_MULTI_ENV_SETUP.md for the full multi-environment runbook and MCP_MULTI_PROJECT_SETUP.md for MCP project scoping.

Environment Purposes

Environment	Purpose	Data
Production	Live application	Real tenant data / PHI
Dev	Development, migration testing, E2E	Synthetic / test data
Local	Offline iteration, isolated schema changes	Ephemeral local data

Module Guided Setup Environment Variables Guide

Start Here

Module Engineering Snapshots

Canonical AI Governance

Architecture

Integrations

Development

Decision Guides

Database

Module Reference

Testing

Migration

Operations

Governance & Security

Platform Internals

Environment Configuration

Quick Reference

How frontend credentials are resolved

When `.env.local` matters

Environment Credentials

Dev (`encore_os_dev`)

Production (`encore_os_prod`)

Supabase CLI: linking to a remote

Environment Purposes

​Quick Reference

​How frontend credentials are resolved

​When .env.local matters

​Environment Credentials

​Dev (encore_os_dev)

​Production (encore_os_prod)

​Supabase CLI: linking to a remote

​Environment Purposes

Quick Reference

How frontend credentials are resolved

When `.env.local` matters

Environment Credentials

Dev (`encore_os_dev`)

Production (`encore_os_prod`)

Supabase CLI: linking to a remote

Environment Purposes