@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/config.d.ts

@@ -0,0 +1,221 @@
+/**
+ * Runtime configuration.
+ *
+ * Validates the non-secret `vars` (and any string secrets) with Zod so a
+ * misconfigured deployment fails loudly and early instead of at some random
+ * call site. Bindings (D1, KV, Workflows, ...) are objects supplied by the
+ * runtime and are typed by `src/env.ts` (`OracleBindings`), not validated here.
+ *
+ * This is the COMPLETE env for every lane of the oracle: a new var or secret
+ * lands HERE first, then in `src/env.ts` (`OracleVars` — the package's contract with a provider's
+ * wrangler.jsonc), then in wrangler.jsonc `vars` / .dev.vars.example.
+ */
+import { z } from "zod";
+import type { OracleEnv } from "./env.js";
+declare const ConfigSchema: z.ZodPipe<z.ZodObject<{
+    ENVIRONMENT: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        production: "production";
+        staging: "staging";
+    }>>;
+    LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+        debug: "debug";
+        error: "error";
+        info: "info";
+        warn: "warn";
+    }>>;
+    LOG_PRETTY: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
+    SERVICE_NAME: z.ZodDefault<z.ZodString>;
+    SERVICE_VERSION: z.ZodDefault<z.ZodString>;
+    CORS_ORIGINS: z.ZodDefault<z.ZodString>;
+    CRON_COLLECTIONS_PER_TICK: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    IXO_NETWORK: z.ZodDefault<z.ZodEnum<{
+        devnet: "devnet";
+        mainnet: "mainnet";
+        testnet: "testnet";
+    }>>;
+    BLOCKSYNC_GRAPHQL_URL: z.ZodOptional<z.ZodString>;
+    CHAIN_RPC_URL: z.ZodOptional<z.ZodString>;
+    MATRIX_HOMESERVER_URL: z.ZodOptional<z.ZodString>;
+    UCAN_STORE_URL: z.ZodOptional<z.ZodString>;
+    VFS_URL: z.ZodOptional<z.ZodString>;
+    IPFS_GATEWAY_URL: z.ZodOptional<z.ZodString>;
+    CLAIM_BOT_URL_OVERRIDE: z.ZodOptional<z.ZodString>;
+    IXO_CLIENT_SEQUENCE_MIN_DELAY_MS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    ORACLE_HOSTNAME: z.ZodString;
+    ORACLE_DID: z.ZodString;
+    ORACLE_ADDRESS: z.ZodString;
+    ORACLE_MATRIX_USER_ID: z.ZodString;
+    ORACLE_ENTITY_DID: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
+    EVAL_ENGINE_HOSTNAME: z.ZodOptional<z.ZodString>;
+    EVALUATION_DENOM: z.ZodOptional<z.ZodString>;
+    EVALUATION_MIN_AMOUNT: z.ZodOptional<z.ZodString>;
+    AI_CHECK_MODEL: z.ZodDefault<z.ZodString>;
+    AI_PROVIDER: z.ZodDefault<z.ZodEnum<{
+        cloudflare: "cloudflare";
+        openrouter: "openrouter";
+    }>>;
+    AI_GATEWAY_ID: z.ZodOptional<z.ZodString>;
+    AI_AUDIO_VIDEO: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
+    AI_CHECK_MIN_CONFIDENCE: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    AI_IMAGE_DETAIL: z.ZodDefault<z.ZodEnum<{
+        auto: "auto";
+        high: "high";
+        low: "low";
+    }>>;
+    C2PA_IMAGE_CHECK: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>>, z.ZodTransform<boolean, "false" | "true">>;
+    AUTO_SIGN: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
+    PORTAL_BASE_URL: z.ZodOptional<z.ZodString>;
+    API_LANE: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
+    API_PAYMENTS: z.ZodDefault<z.ZodCodec<z.ZodString, z.ZodBoolean>>;
+    API_PRICE_USD_CENTS: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    X402_FACILITATOR_URL: z.ZodOptional<z.ZodURL>;
+    X402_NETWORK: z.ZodOptional<z.ZodString>;
+    EARNINGS_ADDRESS: z.ZodOptional<z.ZodString>;
+    EARNINGS_BASE_WALLET: z.ZodOptional<z.ZodString>;
+    BILLING_ENGINE_URL: z.ZodOptional<z.ZodURL>;
+    CONSOLE_URL: z.ZodOptional<z.ZodURL>;
+    AUTH_HUB_URL: z.ZodOptional<z.ZodURL>;
+    ORACLE_ADMIN_DIDS: z.ZodPipe<z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>, z.ZodArray<z.ZodString>>;
+    STATUS_READER_DIDS: z.ZodPipe<z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[], string | undefined>>, z.ZodArray<z.ZodString>>;
+    SENTRY_TRACES_SAMPLE_RATE: z.ZodCatch<z.ZodCoercedNumber<unknown>>;
+    SENTRY_ENVIRONMENT: z.ZodOptional<z.ZodString>;
+    SERVICE_ED25519_MNEMONIC: z.ZodOptional<z.ZodString>;
+    ORACLE_SECP_MNEMONIC: z.ZodOptional<z.ZodString>;
+    OWNER_DELEGATION_CAR: z.ZodOptional<z.ZodString>;
+    ORACLE_MATRIX_ACCESS_TOKEN: z.ZodOptional<z.ZodString>;
+    OPENROUTER_API_KEY: z.ZodOptional<z.ZodString>;
+    UNIQUE_HMAC_KEY: z.ZodOptional<z.ZodString>;
+    WEBHOOK_ENCRYPTION_KEY: z.ZodOptional<z.ZodString>;
+    SENTRY_DSN: z.ZodOptional<z.ZodString>;
+    OPS_ALERT_WEBHOOK_URL: z.ZodPreprocess<z.ZodOptional<z.ZodURL>>;
+    EMAIL_FROM_ADDRESS: z.ZodOptional<z.ZodString>;
+    EMAIL_FROM_NAME: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodTransform<{
+    ENVIRONMENT: "development" | "production" | "staging";
+    LOG_LEVEL: "debug" | "error" | "info" | "warn";
+    LOG_PRETTY: boolean;
+    SERVICE_NAME: string;
+    SERVICE_VERSION: string;
+    CORS_ORIGINS: string;
+    CRON_COLLECTIONS_PER_TICK: number;
+    IXO_NETWORK: "devnet" | "mainnet" | "testnet";
+    CLAIM_BOT_URL_OVERRIDE?: string | undefined;
+    IXO_CLIENT_SEQUENCE_MIN_DELAY_MS: number;
+    ORACLE_HOSTNAME: string;
+    ORACLE_DID: string;
+    ORACLE_ADDRESS: string;
+    ORACLE_MATRIX_USER_ID: string;
+    ORACLE_ENTITY_DID?: string | undefined;
+    EVALUATION_DENOM?: string | undefined;
+    EVALUATION_MIN_AMOUNT?: string | undefined;
+    AI_CHECK_MODEL: string;
+    AI_PROVIDER: "cloudflare" | "openrouter";
+    AI_GATEWAY_ID?: string | undefined;
+    AI_AUDIO_VIDEO: boolean;
+    AI_CHECK_MIN_CONFIDENCE: number;
+    AI_IMAGE_DETAIL: "auto" | "high" | "low";
+    C2PA_IMAGE_CHECK: boolean;
+    AUTO_SIGN: boolean;
+    API_LANE: boolean;
+    API_PAYMENTS: boolean;
+    API_PRICE_USD_CENTS?: number | undefined;
+    X402_FACILITATOR_URL?: string | undefined;
+    X402_NETWORK?: string | undefined;
+    EARNINGS_ADDRESS?: string | undefined;
+    EARNINGS_BASE_WALLET?: string | undefined;
+    BILLING_ENGINE_URL?: string | undefined;
+    CONSOLE_URL?: string | undefined;
+    ORACLE_ADMIN_DIDS: string[];
+    STATUS_READER_DIDS: string[];
+    SENTRY_TRACES_SAMPLE_RATE: number;
+    SENTRY_ENVIRONMENT?: string | undefined;
+    SERVICE_ED25519_MNEMONIC?: string | undefined;
+    ORACLE_SECP_MNEMONIC?: string | undefined;
+    OWNER_DELEGATION_CAR?: string | undefined;
+    ORACLE_MATRIX_ACCESS_TOKEN?: string | undefined;
+    OPENROUTER_API_KEY?: string | undefined;
+    UNIQUE_HMAC_KEY?: string | undefined;
+    WEBHOOK_ENCRYPTION_KEY?: string | undefined;
+    SENTRY_DSN?: string | undefined;
+    OPS_ALERT_WEBHOOK_URL?: string | undefined;
+    EMAIL_FROM_ADDRESS?: string | undefined;
+    EMAIL_FROM_NAME?: string | undefined;
+    BLOCKSYNC_GRAPHQL_URL: string;
+    CHAIN_RPC_URL: string;
+    MATRIX_HOMESERVER_URL: string;
+    UCAN_STORE_URL: string;
+    VFS_URL: string;
+    IPFS_GATEWAY_URL: string;
+    EVAL_ENGINE_HOSTNAME: string;
+    PORTAL_BASE_URL: string;
+    AUTH_HUB_URL: string;
+}, {
+    ENVIRONMENT: "development" | "production" | "staging";
+    LOG_LEVEL: "debug" | "error" | "info" | "warn";
+    LOG_PRETTY: boolean;
+    SERVICE_NAME: string;
+    SERVICE_VERSION: string;
+    CORS_ORIGINS: string;
+    CRON_COLLECTIONS_PER_TICK: number;
+    IXO_NETWORK: "devnet" | "mainnet" | "testnet";
+    BLOCKSYNC_GRAPHQL_URL?: string | undefined;
+    CHAIN_RPC_URL?: string | undefined;
+    MATRIX_HOMESERVER_URL?: string | undefined;
+    UCAN_STORE_URL?: string | undefined;
+    VFS_URL?: string | undefined;
+    IPFS_GATEWAY_URL?: string | undefined;
+    CLAIM_BOT_URL_OVERRIDE?: string | undefined;
+    IXO_CLIENT_SEQUENCE_MIN_DELAY_MS: number;
+    ORACLE_HOSTNAME: string;
+    ORACLE_DID: string;
+    ORACLE_ADDRESS: string;
+    ORACLE_MATRIX_USER_ID: string;
+    ORACLE_ENTITY_DID?: string | undefined;
+    EVAL_ENGINE_HOSTNAME?: string | undefined;
+    EVALUATION_DENOM?: string | undefined;
+    EVALUATION_MIN_AMOUNT?: string | undefined;
+    AI_CHECK_MODEL: string;
+    AI_PROVIDER: "cloudflare" | "openrouter";
+    AI_GATEWAY_ID?: string | undefined;
+    AI_AUDIO_VIDEO: boolean;
+    AI_CHECK_MIN_CONFIDENCE: number;
+    AI_IMAGE_DETAIL: "auto" | "high" | "low";
+    C2PA_IMAGE_CHECK: boolean;
+    AUTO_SIGN: boolean;
+    PORTAL_BASE_URL?: string | undefined;
+    API_LANE: boolean;
+    API_PAYMENTS: boolean;
+    API_PRICE_USD_CENTS?: number | undefined;
+    X402_FACILITATOR_URL?: string | undefined;
+    X402_NETWORK?: string | undefined;
+    EARNINGS_ADDRESS?: string | undefined;
+    EARNINGS_BASE_WALLET?: string | undefined;
+    BILLING_ENGINE_URL?: string | undefined;
+    CONSOLE_URL?: string | undefined;
+    AUTH_HUB_URL?: string | undefined;
+    ORACLE_ADMIN_DIDS: string[];
+    STATUS_READER_DIDS: string[];
+    SENTRY_TRACES_SAMPLE_RATE: number;
+    SENTRY_ENVIRONMENT?: string | undefined;
+    SERVICE_ED25519_MNEMONIC?: string | undefined;
+    ORACLE_SECP_MNEMONIC?: string | undefined;
+    OWNER_DELEGATION_CAR?: string | undefined;
+    ORACLE_MATRIX_ACCESS_TOKEN?: string | undefined;
+    OPENROUTER_API_KEY?: string | undefined;
+    UNIQUE_HMAC_KEY?: string | undefined;
+    WEBHOOK_ENCRYPTION_KEY?: string | undefined;
+    SENTRY_DSN?: string | undefined;
+    OPS_ALERT_WEBHOOK_URL?: string | undefined;
+    EMAIL_FROM_ADDRESS?: string | undefined;
+    EMAIL_FROM_NAME?: string | undefined;
+}>>;
+export type Config = z.infer<typeof ConfigSchema>;
+export declare function loadConfig(env: OracleEnv): Config;
+export declare function corsOrigins(config: Config): "*" | string[];
+export declare const isProduction: (config: Config) => boolean;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AASvC,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwZd,CAAC;AAIL,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAKlD,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAcjD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,GAAG,MAAM,EAAE,CAO1D;AAED,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,OAA8C,CAAC"}

package/dist/config.js

@@ -0,0 +1,431 @@
+/**
+ * Runtime configuration.
+ *
+ * Validates the non-secret `vars` (and any string secrets) with Zod so a
+ * misconfigured deployment fails loudly and early instead of at some random
+ * call site. Bindings (D1, KV, Workflows, ...) are objects supplied by the
+ * runtime and are typed by `src/env.ts` (`OracleBindings`), not validated here.
+ *
+ * This is the COMPLETE env for every lane of the oracle: a new var or secret
+ * lands HERE first, then in `src/env.ts` (`OracleVars` — the package's contract with a provider's
+ * wrangler.jsonc), then in wrangler.jsonc `vars` / .dev.vars.example.
+ */
+import { z } from "zod";
+import { bech32Valid } from "./lib/bech32.js";
+import { networkDefaults } from "./networks.js";
+const LogLevelSchema = z.enum(["debug", "info", "warn", "error"]);
+/** A base URL the lane joins paths onto — a trailing slash would double every `/`. */
+const BaseUrl = z.url().refine((u) => !u.endsWith("/"), "no trailing slash");
+const ConfigSchema = z
+    .object({
+    ENVIRONMENT: z.enum(["development", "staging", "production"]).default("development"),
+    LOG_LEVEL: LogLevelSchema.default("info"),
+    /**
+     * Human-readable, colorized logs for the local terminal. Set ONLY in
+     * `.dev.vars` (loaded by `wrangler dev`, never uploaded) so every deployed env
+     * emits JSON — which is what Workers Logs ingests and makes queryable.
+     */
+    LOG_PRETTY: z.stringbool().default(false),
+    SERVICE_NAME: z.string().min(1).default("eval-oracle"),
+    SERVICE_VERSION: z.string().min(1).default("0.0.0"),
+    /** Comma-separated allowed origins, or "*" for any. */
+    CORS_ORIGINS: z.string().default("*"),
+    /**
+     * Watched collections visited per cron tick (cron/scan.ts `runCronTick`) — bounds that tick's
+     * D1 select; a fleet larger than this rotates in across ticks, least-recently-scanned first
+     * (`lastScannedAt`). Raise it for a large fleet. Does not bound `scanCollection`
+     * (src/runtime.ts), which always scans the one collection it's given.
+     */
+    CRON_COLLECTIONS_PER_TICK: z.coerce.number().int().min(1).max(500).default(25),
+    // --- IXO network (the pull lane) ---
+    // Every URL below must be on the SAME network as IXO_NETWORK or did resolution 401s. Unset ⇒
+    // defaulted from IXO_NETWORK by the transform below (networks.ts) — set one only to override
+    // (self-hosted Blocksync, a local engine, a tunnel).
+    IXO_NETWORK: z.enum(["devnet", "testnet", "mainnet"]).default("devnet"),
+    BLOCKSYNC_GRAPHQL_URL: z.string().min(1).optional(),
+    /** Chain RPC — the SDK query client behind the authz-grants read and the chain write. */
+    CHAIN_RPC_URL: z.string().min(1).optional(),
+    /** Default/fallback Matrix home server when an entity DID declares no MatrixHomeServer service. */
+    MATRIX_HOMESERVER_URL: z.string().min(1).optional(),
+    UCAN_STORE_URL: z.string().min(1).optional(),
+    /**
+     * The IXO Virtual Filesystem — the first two claim-body lanes (lib/ixo/index.ts): the
+     * collection's claims lane (`/api/fs/cid`, read under our evaluate grant), then public copies
+     * (`/public/cid`).
+     */
+    VFS_URL: z.string().min(1).optional(),
+    /** The IPFS gateway a claim body is read from (`/ipfs/<cid>`) when neither the VFS nor Matrix has it. */
+    IPFS_GATEWAY_URL: z.string().min(1).optional(),
+    /**
+     * Local-dev escape hatch: when set, the claim-bot URL is used as-is instead
+     * of being derived (`https://claim.bot.<homeserver domain>`) — local
+     * harnesses run the bot on a plain host:port. Never set in deployed envs.
+     */
+    CLAIM_BOT_URL_OVERRIDE: z.string().min(1).optional(),
+    /**
+     * Read by the SDK's SequenceManagerDO straight off `env`, not through this config — listed so
+     * the schema is the one complete inventory. Minimum gap (ms) between two sequence allocations
+     * from the oracle account.
+     */
+    IXO_CLIENT_SEQUENCE_MIN_DELAY_MS: z.coerce.number().int().nonnegative().default(1000),
+    // --- This oracle's identity ---
+    /**
+     * OUR canonical did:web host. The audience of every inbound UCAN invocation is pinned to THIS,
+     * never the request Host; it is also the issuer of every invocation we mint.
+     */
+    ORACLE_HOSTNAME: z.string().min(1),
+    /**
+     * The oracle's PUBLIC chain identifiers — config, not credentials. `ORACLE_ADDRESS` must be
+     * the `ORACLE_SECP_MNEMONIC` wallet's address (asserted at first use by the chain client);
+     * `ORACLE_MATRIX_USER_ID` is the MXID derived from `ORACLE_DID` (cross-checked, never re-derived).
+     */
+    ORACLE_DID: z.string().min(1),
+    ORACLE_ADDRESS: z.string().min(1),
+    ORACLE_MATRIX_USER_ID: z.string().min(1),
+    /**
+     * The on-chain oracle ENTITY (`did:ixo:entity:…`, declared by `decision-oracle oracle init`
+     * and owned by the provider's AuthHub session) — NOT the kit's runtime `ORACLE_DID`, which is an
+     * address DID with no entity record. The portal resolves this kit's API from that entity's
+     * `#eval` service (blocksync `entity(id) { service }` → its did.json), so it is what the Matrix
+     * review card and the room's eval-context event name as `oracleDid`. Unset (or "" — the
+     * wrangler.jsonc placeholder) ⇒ falls back to `ORACLE_DID`: the card is still delivered but
+     * cannot be answered from chat, only from the portal's claim page.
+     */
+    ORACLE_ENTITY_DID: z.preprocess((v) => v || undefined, z
+        .string()
+        .startsWith("did:ixo:entity:", "expected the oracle ENTITY did (did:ixo:entity:…)")
+        .optional()),
+    /**
+     * The decision engine we ask for decisions (docs/ENGINE-CONTRACT.md). A host we CALL: the
+     * invocation audience is its did:web, resolved from `https://<host>/.well-known/did.json`
+     * (lib/ixo/did.ts; plain http for localhost — lib/engine/client.ts `engineBaseUrl`) — a
+     * different thing from ORACLE_HOSTNAME, which is who WE are. Defaults to the network's engine
+     * host (`networks.ts`); set it for a local engine (`localhost:8787`) or a tunnel.
+     */
+    EVAL_ENGINE_HOSTNAME: z.string().min(1).optional(),
+    // --- The chain fee (register gate 4) ---
+    /**
+     * The coin a collection's on-chain `Payments.evaluation` must pay this oracle in, per network
+     * (owner ruling: mainnet real USDC over IBC, devnet/testnet any stand-in such as `uixo`). Both
+     * or neither; when set they REPLACE `pricing.evaluation` (oracle.ts `effectivePricing`) at the
+     * register gate and on `/v1/info` — a `pricing.byProtocol` entry still wins for its protocol.
+     * REQUIRED on mainnet (refined below), with no default anywhere in code: a mainnet oracle can
+     * never fall back to a stand-in coin written in `defineOracle`. The denom is matched EXACTLY
+     * (`requireEvaluationPayment`); the amount is an integer base-unit string.
+     */
+    EVALUATION_DENOM: z.string().min(1).optional(),
+    EVALUATION_MIN_AMOUNT: z.string().regex(/^\d+$/, "an integer base-unit string").optional(),
+    // --- Connectors (the facts lane, README "How a claim flows" step 4) ---
+    /**
+     * The model pinned for `aiChecks` facts (either provider) — per-CLAIM calls. Frequent + needs image
+     * support, so it stays lean; the FactSet records what actually answered. It must also support
+     * strict `json_schema` structured output (stock/ai-check.ts sends one) — a cheaper model that
+     * does not, such as `qwen/qwen3.7-flash`, cannot answer this lane at all.
+     */
+    // GPT-6 Luna: OpenAI's high-volume tier ("Fast" in the org's mapping), half gpt-5.6-luna's price;
+    // the image/PDF/strict-schema/judge lanes were evaluated on the gateway before it became the pin.
+    AI_CHECK_MODEL: z.string().min(1).default("openai/gpt-6-luna"),
+    /**
+     * Which provider every AI lane calls — the AI check, `tools.ai.judge`, the same-event judge
+     * (stock/ai-provider.ts). `cloudflare`: the Worker's `AI` binding through the AI Gateway
+     * `AI_GATEWAY_ID` (Unified Billing credits or the gateway's stored keys — no third-party key
+     * here). `openrouter`: the OpenRouter API with `OPENROUTER_API_KEY`. Either one's pieces are
+     * checked at the point of use, as the key always was: an oracle whose rubrics declare no AI
+     * fact needs none of them.
+     */
+    AI_PROVIDER: z.enum(["cloudflare", "openrouter"]).default("cloudflare"),
+    /** The AI Gateway the `cloudflare` provider routes through — its name in the dashboard. */
+    AI_GATEWAY_ID: z.string().min(1).optional(),
+    /**
+     * The audio + video input lanes. Off ⇒ an audio/video attachment reaches the model as a
+     * labelled descriptor ("content not sent"), so a rule that needed it fails honestly. Only
+     * OpenRouter can read them: on with any other provider fails at isolate start (refined below).
+     */
+    AI_AUDIO_VIDEO: z.stringbool().default(false),
+    /**
+     * Confidence floor for an AI check's verdict: a response scoring below this is the UNREACHABLE
+     * path (→ the fact's `error`), not a trusted verdict.
+     */
+    AI_CHECK_MIN_CONFIDENCE: z.coerce.number().int().min(0).max(100).default(60),
+    /**
+     * `image_url.detail` for every image the AI lanes send (an AI check's photos, the same-event
+     * judge's pair evidence). `high` because a photographed screen (moiré, a pixel grid, a cursor)
+     * or a generated image (garbled text) is only visible at full resolution — `low` downsamples
+     * it away and the fake gets paid. `high` costs more image tokens per call; `low` is the flat,
+     * cheap setting for an oracle whose checks never turn on fine detail.
+     */
+    AI_IMAGE_DETAIL: z.enum(["low", "high", "auto"]).default("high"),
+    /**
+     * C2PA image provenance gate: when on AND an aiCheck carries an image, the raw bytes are read for
+     * a signed Content Credentials manifest BEFORE the model call. A cryptographically TRUSTED,
+     * AI-generated manifest fails the check outright — proof, not a guess, so no model call.
+     * Anything inconclusive (no manifest — the common case, since a screenshot strips it — untrusted,
+     * or unreadable) falls through to the LLM. Fail-safe: it can only ever ADD a rejection, so a trust
+     * glitch never rejects real work. Verified against the official C2PA Trust List. OFF by default.
+     */
+    C2PA_IMAGE_CHECK: z
+        .enum(["true", "false"])
+        .default("false")
+        .transform((v) => v === "true"),
+    // --- Policy (the act lane, README "How a claim flows" step 6) ---
+    /**
+     * Sign `MsgEvaluateClaim` on a terminal verdict without a human in the loop. `false` ⇒ the
+     * decision is still recorded and receipted, but submission is the operator's (portal) job.
+     * Mirrored by the oracle config (`defineOracle`) `policies.autoSign` for the provider-facing surface.
+     */
+    AUTO_SIGN: z.stringbool().default(true),
+    /** Portal origin for the deep links in review notifications. No trailing slash. */
+    PORTAL_BASE_URL: z.string().min(1).optional(),
+    // --- The Decision API lane (Go Prod) ---
+    // A second, off-chain intake (go-prod spec §3, App. C): paid claims submitted over HTTP to
+    // `/v1/api`, decided by the same engine, never written to chain. EVERY knob below defaults to
+    // off or unset, so an oracle that never opts in runs exactly the chain lane it always has
+    // (§16.1: "the chain lane is untouched throughout"). The URLs are not defaulted per network:
+    // each lane that needs one refuses loudly at the point of use.
+    /** Mount the `/v1/api` router (§16.1). Off ⇒ the lane is dormant: no routes, no cron work. */
+    API_LANE: z.stringbool().default(false),
+    /**
+     * The x402 payment gate (§4, §16.1). Off ⇒ every NEW submit answers
+     * `503 SOURCE_PAUSED { reason: payments-disabled }` — nothing is ever accepted unpaid. Also the
+     * runbook's kill switch for a facilitator outage (§16.4).
+     */
+    API_PAYMENTS: z.stringbool().default(false),
+    /**
+     * The published price per decision in whole USD cents (1 PAY = 1 USD) — every source pays it,
+     * there are no per-source prices. Unset ⇒ the gate refuses loudly at use rather than quote a
+     * guessed price.
+     */
+    API_PRICE_USD_CENTS: z.coerce.number().int().positive().optional(),
+    /** Our x402 facilitator worker (App. E #10). No trailing slash. */
+    X402_FACILITATOR_URL: BaseUrl.optional(),
+    /**
+     * The chain every 402 names, as x402 v2 spells networks — CAIP-2, whose namespace for a Cosmos
+     * SDK chain is `cosmos:` (`cosmos:devnet-1`, `cosmos:pandora-8` testnet, `cosmos:ixo-5` mainnet).
+     */
+    X402_NETWORK: z
+        .string()
+        .regex(/^cosmos:[-_a-zA-Z0-9]{1,32}$/, "expected cosmos:<chain-id>")
+        .optional(),
+    /**
+     * Where this operator's earnings land (payments spec §3.2: named as each offer's `payTo`; IXO
+     * never sets it). `EARNINGS_ADDRESS`: the `ixo1…` account for PAY and USDC on IXO — "payouts"
+     * means only a company paying its people (`OracleConfig.payouts`), never this. Unset ⇒ those
+     * ways to pay are not offered (today: no 402 can be made, 503 payments-disabled). Checked
+     * here, checksum included, so a typo fails at isolate start.
+     */
+    EARNINGS_ADDRESS: z
+        .string()
+        .regex(/^ixo1[02-9ac-hj-np-z]{38}$/, "expected an ixo1… account")
+        .refine(bech32Valid, "not a valid ixo1 address (bad checksum)")
+        .optional(),
+    /** The operator's Base wallet (`0x…`) for USDC on Base. Unset ⇒ that way to pay is not offered. */
+    EARNINGS_BASE_WALLET: z
+        .string()
+        .regex(/^0x[0-9a-fA-F]{40}$/, "expected a 0x… wallet address")
+        .optional(),
+    /** Charge lookups and the spend figures on `/v1/api/me`. No trailing slash. */
+    BILLING_ENGINE_URL: BaseUrl.optional(),
+    /**
+     * The Decision Console — every error's `docsUrl`, the 402's `fundingUrl` and every email link
+     * (unset ⇒ the API lane's emails are skipped). No trailing slash.
+     */
+    CONSOLE_URL: BaseUrl.optional(),
+    /**
+     * IXO AuthHub — the OAuth authorization server of `/v1/mcp` (MCP over OAuth, spec
+     * 2026-10-06): the PRM's `authorization_servers`, the access token's exact `iss` (its JWKS at
+     * `<url>/.well-known/jwks.json`), the approve link's host, and the one `did:web` the approvals
+     * back-channel (`/v1/oauth/approvals/:id`) accepts. Defaults to the network's AuthHub
+     * (`networks.ts`); set it for a local AuthHub. No trailing slash.
+     */
+    AUTH_HUB_URL: BaseUrl.optional(),
+    /**
+     * Comma-separated `did:ixo` admins of THIS oracle — its operator's people — allowed on
+     * `GET /v1/admin/status` and `/v1/api/admin/*` (pauses, allow-lists — the console's operator
+     * view). Split and checked HERE, so a typo fails
+     * at isolate start rather than silently locking the operators out; unset ⇒ nobody is an
+     * operator.
+     */
+    ORACLE_ADMIN_DIDS: z
+        .string()
+        .optional()
+        .transform((v) => (v ?? "")
+        .split(",")
+        .map((d) => d.trim())
+        .filter(Boolean))
+        .pipe(z.array(z.string().startsWith("did:ixo:", "expected a did:ixo operator DID"))),
+    /**
+     * Comma-separated DIDs of any method (a monitoring service's `did:web`, say) allowed to read
+     * `GET /v1/admin/status` and nothing else. Kept apart from ORACLE_ADMIN_DIDS because operators also
+     * gate write routes — a monitor must never need to be made one. Unset ⇒ nobody.
+     */
+    STATUS_READER_DIDS: z
+        .string()
+        .optional()
+        .transform((v) => (v ?? "")
+        .split(",")
+        .map((d) => d.trim())
+        .filter(Boolean))
+        .pipe(z.array(z.string().regex(/^did:[a-z0-9]+:\S+$/, "expected a did:<method>:<id>"))),
+    /**
+     * Share of requests Sentry traces, 0..1. Unset ⇒ 0.1 — full tracing is a cost, not a default
+     * (observability spec §5.1). `sentryOptions` (lib/sentry.ts) reads the raw var itself, since the
+     * SDK is initialized before this schema runs. A bad value is the default here too, never a
+     * failed `loadConfig`: telemetry must not take the oracle down.
+     */
+    SENTRY_TRACES_SAMPLE_RATE: z.coerce.number().min(0).max(1).catch(0.1),
+    /**
+     * The Sentry environment tag. Unset ⇒ `ENVIRONMENT` — set it only to tell apart two deploys that
+     * share one (a testnet and a mainnet oracle both `production`, say). Read raw by `sentryOptions`.
+     */
+    SENTRY_ENVIRONMENT: z.string().min(1).optional(),
+    // --- Secrets (from .dev.vars / `wrangler secret put`) ---
+    // Optional so non-auth routes (health) boot without secrets; each read path fails loudly
+    // (AppError.internal) — or no-ops where the comment says so — at the point of use.
+    /**
+     * The did:web key: SHA256(mnemonic) → Ed25519 seed (lib/ixo/identity.ts). Signs every UCAN
+     * invocation we mint (engine, claim bot, UCAN Store) and backs `/.well-known/did.json`.
+     */
+    SERVICE_ED25519_MNEMONIC: z.string().min(1).optional(),
+    /**
+     * The oracle ACCOUNT key (secp256k1) — signs `MsgEvaluateClaim`. `ORACLE_ADDRESS` must be this
+     * wallet's address. Unset ⇒ the chain-write lane logs one line and skips — the decision itself
+     * is never affected.
+     */
+    ORACLE_SECP_MNEMONIC: z.string().min(1).optional(),
+    /**
+     * The oracle OWNER's UCAN delegation to the decision engine (base64 CAR) — sent once, at
+     * register. The engine bills the owner's credits per decision (ENGINE-CONTRACT.md "Billing"),
+     * and this is how it finds their subscription: `subscriptions/read` on `ixo:subscriptions`, plus
+     * `billing/pay` bound to THIS oracle's did:web. Mint it with eval-engine's
+     * `decision-oracle delegation --for engine` as the owner. Unset ⇒ register refuses, loudly.
+     */
+    OWNER_DELEGATION_CAR: z.string().min(1).optional(),
+    /**
+     * The oracle bot's Matrix access token — a full account credential, so a secret, never a var,
+     * never logged. Read by the review-notification lane (lib/matrix/deliver.ts): unset ⇒ every
+     * lane entry point (`notify-review`, `notify-folded`) logs one line and skips — no claim is
+     * ever blocked on it.
+     */
+    ORACLE_MATRIX_ACCESS_TOKEN: z.string().min(1).optional(),
+    /** OpenRouter key — read only when AI_PROVIDER=openrouter and a rubric asks for an AI fact. */
+    OPENROUTER_API_KEY: z.string().min(1).optional(),
+    /**
+     * HMAC key for the duplicate-detection body digest (dup-detection spec §4 L1; the stock
+     * producer's `unique` lane, lib/facts/stock/unique.ts) — KEYED because claim answers are
+     * low-entropy PII: a plain hash is dictionary-reversible, and the keyed digest is what lets
+     * `claim_body_digests` outlive lawful erasure of `normalized_text`. One long-lived secret per
+     * oracle: rotating it orphans every registered digest (the registries would need re-filling).
+     * REQUIRED when `API_LANE` is on (the refinement below): an API submit with a `submitter` is
+     * counted by this key's digest, so without it the first such submit would 500 — a missing key
+     * must fail at isolate start instead. Otherwise required only at the point of use — a rubric
+     * declaring `unique` fails loudly without it, mirroring OPENROUTER_API_KEY.
+     */
+    UNIQUE_HMAC_KEY: z.string().min(1).optional(),
+    /**
+     * The per-deployment key the Decision API lane encrypts webhook signing secrets with at rest —
+     * every endpoint's and every source's own (go-prod §4.5, §6.1 — App. C names no var for it;
+     * this is it). REQUIRED when `API_LANE` is on (the refinement below): every source is created
+     * with a signing secret (contracts v1.1), so without the key the lane could not create a
+     * source, and a missing key must fail at isolate start — not as a trail of dead deliveries.
+     * Like UNIQUE_HMAC_KEY it is for life: rotating it strands every stored secret.
+     */
+    WEBHOOK_ENCRYPTION_KEY: z.string().min(1).optional(),
+    /**
+     * Sentry DSN. UNSET ⇒ the whole error-reporting lane is a no-op — the same "unset ⇒ lane off"
+     * contract as the Matrix and chain-write lanes, so local dev and CI never ship events. A DSN is
+     * not a credential (it only permits *writing* events), but it lives with the secrets because it
+     * decides where this service's errors go.
+     */
+    SENTRY_DSN: z.string().min(1).optional(),
+    /**
+     * A Slack-compatible incoming webhook (`{ text }`) for ops alerts — `reportAlert`
+     * (lib/sentry.ts): the pages (a lost settlement, a dead webhook, a paused collection or source,
+     * a failing cron job), one message per condition per 30 minutes. A secret: the URL is the
+     * credential. UNSET (or "") ⇒ alerts go to Sentry only (and nowhere without `SENTRY_DSN`) — no
+     * POST, no error.
+     */
+    OPS_ALERT_WEBHOOK_URL: z.preprocess((v) => (v === "" ? undefined : v), z.url().optional()),
+    /**
+     * The FROM address for pause/resume/review-request notices (lib/email/send.ts). UNSET ⇒ the
+     * whole email lane no-ops — the same "unset ⇒ off" contract as ORACLE_MATRIX_ACCESS_TOKEN — so
+     * local dev and a fresh deploy never fail loud over a domain that hasn't been onboarded onto
+     * Cloudflare Email Sending yet (`wrangler email sending enable <domain>`, out of band).
+     */
+    EMAIL_FROM_ADDRESS: z.string().min(1).optional(),
+    /** Display name on outbound notices. Unset ⇒ the oracle's own `name` (`defineOracle`). */
+    EMAIL_FROM_NAME: z.string().min(1).optional(),
+})
+    .refine((c) => (c.EVALUATION_DENOM === undefined) === (c.EVALUATION_MIN_AMOUNT === undefined), {
+    path: ["EVALUATION_MIN_AMOUNT"],
+    message: "EVALUATION_DENOM and EVALUATION_MIN_AMOUNT are set together or not at all",
+})
+    .refine((c) => c.IXO_NETWORK !== "mainnet" || c.EVALUATION_DENOM !== undefined, {
+    path: ["EVALUATION_DENOM"],
+    message: "required on mainnet (with EVALUATION_MIN_AMOUNT): the coin collections pay this oracle in — real USDC, never a stand-in",
+})
+    .refine((c) => !c.API_LANE || c.WEBHOOK_ENCRYPTION_KEY !== undefined, {
+    path: ["WEBHOOK_ENCRYPTION_KEY"],
+    message: "required when API_LANE is on (it encrypts every source's webhook signing secret)",
+})
+    .refine((c) => !c.API_LANE || c.UNIQUE_HMAC_KEY !== undefined, {
+    path: ["UNIQUE_HMAC_KEY"],
+    message: "required when API_LANE is on (a submit's submitter is recorded by its digest)",
+})
+    .refine((c) => !c.API_PAYMENTS || c.X402_FACILITATOR_URL !== undefined, {
+    path: ["X402_FACILITATOR_URL"],
+    message: "required when API_PAYMENTS is on (every paid submit verifies and settles through it)",
+})
+    // `cloudflare` became the default: an oracle upgrading with only its OpenRouter key would fail
+    // every AI fact at the point of use — say so once, at start, instead.
+    .refine((c) => !(c.AI_PROVIDER === "cloudflare" && c.OPENROUTER_API_KEY && c.AI_GATEWAY_ID === undefined), {
+    path: ["AI_PROVIDER"],
+    message: "OPENROUTER_API_KEY is set but AI_PROVIDER defaults to cloudflare and AI_GATEWAY_ID is unset — set AI_PROVIDER=openrouter to keep OpenRouter, or AI_GATEWAY_ID (+ the `ai` binding) for the Cloudflare AI Gateway",
+})
+    .refine((c) => !c.AI_AUDIO_VIDEO || c.AI_PROVIDER === "openrouter", {
+    path: ["AI_AUDIO_VIDEO"],
+    message: "audio/video inputs need AI_PROVIDER=openrouter (the Cloudflare AI Gateway route cannot read them)",
+})
+    .transform((c) => {
+    // The one place the nine per-network URLs turn from "maybe set" into "definitely set": an
+    // explicit var always wins, an unset one falls back to IXO_NETWORK's row in networks.ts.
+    const d = networkDefaults(c.IXO_NETWORK);
+    return {
+        ...c,
+        BLOCKSYNC_GRAPHQL_URL: c.BLOCKSYNC_GRAPHQL_URL ?? d.blocksync,
+        CHAIN_RPC_URL: c.CHAIN_RPC_URL ?? d.rpc,
+        MATRIX_HOMESERVER_URL: c.MATRIX_HOMESERVER_URL ?? d.matrix,
+        UCAN_STORE_URL: c.UCAN_STORE_URL ?? d.ucanStore,
+        VFS_URL: c.VFS_URL ?? d.vfs,
+        IPFS_GATEWAY_URL: c.IPFS_GATEWAY_URL ?? d.ipfsGateway,
+        EVAL_ENGINE_HOSTNAME: c.EVAL_ENGINE_HOSTNAME ?? d.engineHost,
+        PORTAL_BASE_URL: c.PORTAL_BASE_URL ?? d.portal,
+        AUTH_HUB_URL: c.AUTH_HUB_URL ?? d.authHub,
+    };
+});
+// Memoize per Env object so we validate once per isolate, not once per request.
+const cache = new WeakMap();
+export function loadConfig(env) {
+    const cached = cache.get(env);
+    if (cached)
+        return cached;
+    const parsed = ConfigSchema.safeParse(env);
+    if (!parsed.success) {
+        const issues = parsed.error.issues
+            .map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`)
+            .join("; ");
+        throw new Error(`Invalid environment configuration: ${issues}`);
+    }
+    cache.set(env, parsed.data);
+    return parsed.data;
+}
+export function corsOrigins(config) {
+    const raw = config.CORS_ORIGINS.trim();
+    if (raw === "*" || raw === "")
+        return "*";
+    return raw
+        .split(",")
+        .map((o) => o.trim())
+        .filter(Boolean);
+}
+export const isProduction = (config) => config.ENVIRONMENT === "production";
+//# sourceMappingURL=config.js.map