# Runtime mode. "sandbox" is clearly labeled and never calls production services.
# Use "live" only after configuring all required 0G credentials and contracts.
ACTIONPROOF_MODE=sandbox
NODE_ENV=development
API_HOST=127.0.0.1
API_PORT=8787
API_BODY_LIMIT=262144
API_RATE_LIMIT_MAX=120
API_RATE_LIMIT_WINDOW=1 minute
API_CORS_ORIGINS=http://127.0.0.1:3000,http://localhost:3000
API_DATA_DIR=.actionproof-data
# Production persistence. When unset, the atomic JSON store remains available for local/single-host use.
DATABASE_URL=
QUEUE_LEASE_MS=300000
QUEUE_POLL_MS=1000
# Server-only token required by POST /v1/jobs whenever live writes are enabled (32+ random chars).
ACTIONPROOF_OPERATOR_TOKEN=
# JSON array of {id,apiKeySha256,requestsPerMinute,webhookUrl?,webhookSecret?}.
# Store only SHA-256 API-key digests. Production webhooks require PostgreSQL.
ACTIONPROOF_TENANTS_JSON=[]
WEBHOOK_TIMEOUT_MS=10000
NEXT_PUBLIC_API_URL=http://127.0.0.1:8787
NEXT_PUBLIC_ACTIONPROOF_MODE=sandbox
NEXT_PUBLIC_OG_CHAIN_ID=16602
# Public IDs for preserved Galileo evidence; configure:hosting fills these from docs/evidence.
NEXT_PUBLIC_SAFE_TRACE_ID=
NEXT_PUBLIC_BLOCK_TRACE_ID=

# 0G network. Galileo is the safe default; mainnet broadcasting needs explicit opt-in.
OG_NETWORK=galileo
OG_RPC_URL=https://evmrpc-testnet.0g.ai
OG_CHAIN_ID=16602
OG_EXPLORER_URL=https://chainscan-galileo.0g.ai
OG_STORAGE_INDEXER_URL=https://indexer-storage-testnet-turbo.0g.ai
OG_STORAGE_EXPLORER_URL=https://storagescan-galileo.0g.ai

# 0G Compute Router (recommended server-side path).
# Create and fund a TESTNET key at https://pc.testnet.0g.ai/.
OG_COMPUTE_BASE_URL=https://router-api-testnet.integratenetwork.work/v1
OG_COMPUTE_API_KEY=
# Galileo-tested on 2026-08-15; recheck GET /v1/models before a future live run.
OG_COMPUTE_MODEL=qwen2.5-omni
OG_COMPUTE_TIMEOUT_MS=60000
READINESS_TIMEOUT_MS=10000
# Optional debug_traceCall state-footprint summary. Enable only on an RPC that supports the tracer.
ENABLE_STATE_DIFF=false
MAX_STATE_DIFF_ACCOUNTS=8

# Server-only signing keys. Never prefix these with NEXT_PUBLIC_ or commit them.
# Store 0x-prefixed keys only in a local .env or your hosting secret manager.
DEPLOYER_PRIVATE_KEY=
VERIFIER_PRIVATE_KEY=
# Production alternative: an HTTPS KMS/HSM gateway implementing actionproof-remote-signer/1.
# Configure all three and leave VERIFIER_PRIVATE_KEY empty.
VERIFIER_SIGNER_URL=
VERIFIER_SIGNER_TOKEN=
AUTHORIZED_VERIFIER=
RELAYER_PRIVATE_KEY=
# Prefer a separate low-value funded key for paid Storage writes.
OG_STORAGE_PRIVATE_KEY=

# Deployed ActionProof contracts. Fill from packages/contracts/deployments/<network>.json.
ACTIONPROOF_GUARD_ADDRESS=
ACTIONPROOF_AGENT_ADDRESS=
NEXT_PUBLIC_ACTIONPROOF_AGENT_ADDRESS=
# Optional read-only ERC-8004 identity. Its registered agentWallet must match the action agent.
OG_AGENTIC_ID=
DEMO_COUNTER_ADDRESS=
DEMO_TOKEN_ADDRESS=
NEXT_PUBLIC_DEMO_COUNTER_ADDRESS=
NEXT_PUBLIC_DEMO_TOKEN_ADDRESS=

# Explicit safety gates. Mainnet transactions remain disabled unless both are true.
ENABLE_LIVE_WRITES=false
ALLOW_MAINNET_BROADCAST=false

# Policy configuration.
MAX_NATIVE_VALUE_WEI=10000000000000000
ALLOWED_TARGETS=
DENIED_SPENDERS=
POLICY_PACKS=base,erc20-approvals,asset-movement,nft-operators,contract-administration,proxy-upgrades
JOB_TTL_MS=900000

# Full live smoke writes require this exact acknowledgement in addition to write gates.
LIVE_SMOKE_CONFIRM=