.env.example

# Local API runtime. Copy to .env and replace placeholders; never commit real secrets.
DATABASE_URL=postgresql://oneshot:oneshot@localhost:5432/oneshot
# Use a randomly generated value with at least 16 characters.
SERVICE_BEARER_TOKEN=replace-me-with-a-random-secret
HOST=0.0.0.0
PORT=3000
# Worker deployments require at least 2 (one outbox claim + one ledger action).
DB_POOL_MAX=10
ONESHOT_SUBMISSIONS_DISABLED=false
# One server-configured allowlisted workspace. Clients never choose this value.
ONESHOT_WORKSPACE_ID=team-testnet-workspace
# Shared PostgreSQL-backed API admission control.
ONESHOT_API_RATE_LIMIT_MAX_REQUESTS=60
ONESHOT_API_RATE_LIMIT_WINDOW_MS=60000

# One-tool MCP. Each Privy user generates a workspace-bound bearer in Profile.
# The optional deployment bearer keeps one operator-controlled client working.
# ONESHOT_MCP_BEARER_TOKEN=<optional-random-secret-at-least-32-characters>
# Public frontend route returned by MCP for explicit wallet signing.
# ONESHOT_APP_URL=https://oneshot.kapustazh.dev/app
# ONESHOT_MCP_PAYER_ADDRESS=0x<40-hex-privy-server-wallet-address>
# ONESHOT_MCP_WAIT_MS=2500

# Production worker effect boundary. Public identifiers are placeholders;
# secrets must be injected by the deployment secret store, never committed.
ONESHOT_ARC_PROFILE=arc-testnet
ONESHOT_ARC_RPC_URL=https://<arc-rpc-host>
# ONESHOT_ARC_EXPLORER_URL=https://testnet.arcscan.app
ONESHOT_PRIVY_APP_ID=<privy-app-id>
ONESHOT_PRIVY_APP_SECRET=<set-in-secret-store-not-here>
ONESHOT_PRIVY_WALLET_ID=<privy-wallet-id>
ONESHOT_PRIVY_WALLET_ADDRESS=0x<40-hex-wallet-address>
ONESHOT_PRIVY_POLICY_ID=<privy-policy-id>
# SHA-256 of the canonical Privy policy response reviewed for this deployment.
ONESHOT_PRIVY_POLICY_DIGEST=<64-hex-policy-digest>
ONESHOT_SETTLEMENT_CAP_ATOMIC=1000000
ONESHOT_RPC_TIMEOUT_MS=10000
ONESHOT_ALLOW_MAINNET_ACTIVATION=false

# Operator login boundary. Separate from the ONESHOT_PRIVY_* wallet-authorization
# variables above; both may reference the same Privy application.
# The verification key is the PUBLIC ES256 key from the Privy dashboard.
# Leave all three empty to keep the service-bearer-only behavior.
PRIVY_AUTH_APP_ID=<privy-app-id>
PRIVY_AUTH_VERIFICATION_KEY=<privy-es256-spki-public-key>
PRIVY_AUTH_ALLOWED_SUBJECTS=did:privy:<operator-did>
# Public/demo-only wildcard access requires this separate explicit opt-in.
# PRIVY_AUTH_ALLOW_ALL_SUBJECTS=true

# Recovery discovery and advisory configuration. Graph evidence is candidate-only;
# Vertex recommendations cannot authorize or submit settlement.
# Arc Testnet's active demo path uses the rate-limited Studio GraphQL endpoint.
ONESHOT_SUBGRAPH_SOURCE=STUDIO_GRAPHQL
ONESHOT_SUBGRAPH_QUERY_URL=https://api.studio.thegraph.com/query/<studio-id>/<subgraph>/<version>
# Configure these only for a supported Network/MCP profile.
# ONESHOT_SUBGRAPH_MCP_ENDPOINT=https://mcp.example.invalid
ONESHOT_GRAPH_API_KEY=<set-in-secret-store-not-here>
# The API uses ONESHOT_SUBGRAPH_QUERY_URL automatically for the authenticated
# cabinet. Keep this legacy variable only when the activity path needs a
# different pinned deployment; it overrides the canonical URL.
# ONESHOT_GRAPH_QUERY_URL=https://api.studio.thegraph.com/query/<studio-id>/<subgraph>/<version>
# Optional server-wallet fallback for Graph activity. User-wallet payer
# addresses are discovered from durable workspace jobs automatically.
# ONESHOT_ACTIVITY_WALLET_ADDRESS=0x<40-hex-server-wallet-address>
# ONESHOT_SUBGRAPH_MCP_SERVER_VERSION=1.0.0
ONESHOT_SUBGRAPH_DEPLOYMENT_ID=0x<64-hex-deployment-id>
ONESHOT_SUBGRAPH_MANIFEST_CID=<subgraph-manifest-cid>
ONESHOT_SUBGRAPH_MAX_LAG_BLOCKS=5
ONESHOT_SUBGRAPH_MAX_CANDIDATES=5
ONESHOT_SUBGRAPH_MAX_RESULT_BYTES=65536
ONESHOT_RECOVERY_FROM_BLOCK=0
ONESHOT_RECOVERY_TO_BLOCK=<current-bounded-upper-block>
ONESHOT_VERTEX_PROJECT_ID=<gcp-project-id>
ONESHOT_VERTEX_LOCATION=europe-west1
ONESHOT_VERTEX_MODEL=gemini-2.5-flash

# Continuous durable outbox runner.
ONESHOT_WORKER_POLL_INTERVAL_MS=1000
ONESHOT_WORKER_MAX_JOBS=50
ONESHOT_SUBMISSION_LEASE_MS=30000

# R4 testnet-only fault injection. Leave disabled for normal operation. To
# rehearse a single lost response after broadcast, set both values explicitly;
# the worker refuses this hook on any non-Arc-Testnet profile.
# ONESHOT_DEMO_RESPONSE_LOSS_AFTER_BROADCAST=true
# ONESHOT_DEMO_CONFIRM_TESTNET=true

# Cloud Run + Cloud SQL alternative. Remove DATABASE_URL when using these values.
# INSTANCE_CONNECTION_NAME=project-id:region:instance-name
# DB_USER=oneshot
# DB_PASS=replace-with-secret-manager-value
# DB_NAME=oneshot