3148c05119
Add Level-B for SideShift: the server creates a SideShift variable shift via the authenticated API and shows the deposit address in-wallet; BCH settles to the user's OWN address, so self-custody is preserved end-to-end (funds never touch the wallet operator). Other providers stay link-out. - src/onramp/sideshift-shift.ts: createVariableShift / getShiftStatus / verifySideShiftSecret (injected fetch, typed errors). Endpoints verified against docs.sideshift.ai; live secret check passes GET /v2/account. - web: OnrampContext.sideshiftSecret/affiliate from SIDESHIFT_SECRET / SIDESHIFT_AFFILIATE env; handlers + routes GET /api/onramp/config, POST /api/onramp/shift, GET /api/onramp/shift?id=. Secret stays server-side (a test asserts it never appears in the response). - ui: SideShift card gets "Swap in wallet" (deposit address + range + 6s status poll) when shiftEnabled, with an "Open site" link-out fallback. - guard: mainnet-only — a bchtest:/bchreg: settle address is rejected with a switch-to-mainnet message (SideShift settles mainnet BCH). - scripts/deviant-web.mjs auto-loads .env; .env.example documents the keys. - ADR-0036 amended: Tier-3 admitted narrowly for non-custodial API swap providers only. Full suite 478 pass / 0 fail. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.3 KiB
Text
28 lines
1.3 KiB
Text
# Deviant Wallet — environment config (on-ramp providers, ADR-0036)
|
|
#
|
|
# HOW TO USE:
|
|
# 1. Copy this file to `.env` in the project root: cp .env.example .env
|
|
# 2. Fill in the values you have (all are OPTIONAL — the wallet runs without
|
|
# any of them; missing keys just leave that provider's feature dormant).
|
|
# 3. Start the web UI: npm run deviant:web (it auto-loads `.env`)
|
|
#
|
|
# `.env` is gitignored — it is never committed. This `.env.example` is the
|
|
# safe, value-free template; keep your real secrets only in `.env`.
|
|
|
|
# --- Reputation (external, read-only) ---
|
|
# kycnot.me API key. Admin-approved: request access at https://kycnot.me/contact,
|
|
# then generate the key at https://kycnot.me/account/api-keys (format: kycnot_...).
|
|
# Without it, providers show "kycnot.me · n/a" and ranking uses facts + your ratings.
|
|
KYCNOT_API_KEY=
|
|
|
|
# --- Provider API keys (Tier-2 live quotes) ---
|
|
# Trocador affiliate/API key — required for Trocador live quotes (handoff works
|
|
# without it). Register: https://trocador.app/en/register/affiliate
|
|
TROCADOR_API_KEY=
|
|
|
|
# --- Referral / affiliate IDs (optional revenue; never affect ranking) ---
|
|
# These only ride in the Tier-1 handoff URL to attribute commission to you.
|
|
GUARDARIAN_REF=
|
|
SIDESHIFT_AFFILIATE=
|
|
TROCADOR_REF=
|
|
CHANGELLY_REF=
|