Pull one

.claude/settings.json

@@ -0,0 +1,51 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm install:*)",
+      "Bash(npm ci:*)",
+      "Bash(npm run:*)",
+      "Bash(npm test:*)",
+      "Bash(pnpm install:*)",
+      "Bash(pnpm run:*)",
+      "Bash(pnpm test:*)",
+      "Bash(pnpm lint:*)",
+      "Bash(pnpm build:*)",
+      "Bash(pnpm dev:*)",
+      "Bash(pnpm typecheck:*)",
+      "Bash(npx hardhat:*)",
+      "Bash(aiken:*)",
+      "Bash(pytest:*)",
+      "Bash(python -m pytest:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(git branch:*)",
+      "Bash(git fetch:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(git checkout:*)",
+      "Bash(git switch:*)",
+      "Bash(git restore:*)",
+      "Bash(git stash:*)",
+      "Bash(ls:*)",
+      "Bash(cat:*)",
+      "Bash(rg:*)",
+      "Bash(grep:*)",
+      "Bash(find:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(wc:*)",
+      "Bash(tree:*)",
+      "Bash(echo:*)",
+      "Bash(which:*)",
+      "Bash(pwd)"
+    ],
+    "deny": [
+      "Bash(rm -rf:*)",
+      "Bash(git push --force:*)",
+      "Bash(git push -f:*)",
+      "Bash(git reset --hard:*)"
+    ]
+  }
+}

.env.example

@@ -11,8 +11,23 @@ KAFKA_BOOTSTRAP=localhost:9092
 # Cardano (Blockfrost API for Pre-Prod)
 BLOCKFROST_PROJECT_ID=preprodYourProjectId
 
-# EVM (Base Sepolia RPC)
+# ── EVM network switch (lib/evm-network.ts) ──────────────────────────────────
+# THE go-live switch. "base" = Base mainnet (real USDC/NFTs); "base-sepolia" =
+# testnet (default). Governs chain, RPC, USDC token, explorer + OpenSea links,
+# and which network the mint/transfer flows enforce in the wallet.
+NEXT_PUBLIC_EVM_NETWORK=base-sepolia
+
+# RPCs (public defaults work but are rate-limited; set dedicated RPCs for prod).
 BASE_SEPOLIA_RPC_URL=https://sepolia.base.org
+NEXT_PUBLIC_BASE_SEPOLIA_RPC_URL=https://sepolia.base.org
+# Used when NEXT_PUBLIC_EVM_NETWORK=base
+BASE_RPC_URL=https://mainnet.base.org
+NEXT_PUBLIC_BASE_RPC_URL=https://mainnet.base.org
+
+# Genesis ERC-721 for the ACTIVE network. Mainnet (Base 8453):
+#   0x93c26c9B9fe702D7944aE62fc54e451d4470F21D
+# Set this to match NEXT_PUBLIC_EVM_NETWORK (mainnet address when on "base").
+NEXT_PUBLIC_GENESIS_CONTRACT_ADDRESS=0x93c26c9B9fe702D7944aE62fc54e451d4470F21D
 
 # Contract deployment keys (use test keys only)
 AI_VALIDATOR_KEY=0x_your_test_private_key
@@ -36,14 +51,13 @@ AUTH0_SECRET=
 # Optional API audience (resource identifier) for access tokens / Magic IDP alignment
 AUTH0_AUDIENCE=
 
-# Genesis NFT (EVM) — used by web mint + card/custodial flow
-NEXT_PUBLIC_GENESIS_CONTRACT_ADDRESS=0x_your_genesis_validator
+# (Genesis contract address + Base RPCs are configured in the EVM network switch
+#  section near the top of this file — see NEXT_PUBLIC_EVM_NETWORK.)
 
 # Card checkout (Stripe) + custodial wallet — default `magic` (Magic Email OTP → embedded wallet).
 # Use `server` for legacy server-generated keys + transfer link only.
 MALAMA_CARD_CUSTODY=magic
 NEXT_PUBLIC_MAGIC_API_KEY=pk_live_or_test_your_magic_publishable_key
-NEXT_PUBLIC_BASE_SEPOLIA_RPC_URL=https://sepolia.base.org
 # Magic Secret API key (server) — validates DID tokens from /launch; same key family as Magic Express if applicable
 MAGIC_SECRET_KEY=
 
@@ -75,3 +89,24 @@ MAGIC_IDP_AUDIENCE=your-app-audience
 MAGIC_IDP_JWKS_URI=https://your-auth-provider.com/.well-known/jwks.json
 # Protects admin Magic routes (x-malama-ops-key or Authorization: Bearer)
 MALAMA_OPS_KEY=change_me_long_random_secret
+
+# ── Partner referral payouts (USDC on Base) ──────────────────────────────────
+# Admin-approved, system-sent commissions. SAFE BY DEFAULT: dry-run ON and
+# testnet selected until you explicitly opt in. See lib/usdc-payout.ts.
+#
+# Dedicated payout HOT WALLET key — fund with operating float ONLY, never a
+# treasury/multisig. Server env only; never commit. Needs USDC + a little ETH
+# for gas on the selected network.
+PAYOUT_WALLET_PRIVATE_KEY=0x_dedicated_payout_wallet_key
+# "base-sepolia" (default, testnet) | "base" (mainnet, real money)
+PAYOUT_NETWORK=base-sepolia
+# Base mainnet RPC (used only when PAYOUT_NETWORK=base)
+BASE_RPC_URL=https://mainnet.base.org
+# Must be exactly "false" to send real USDC. Anything else = dry run (no chain tx).
+PAYOUT_DRY_RUN=true
+# Hard ceiling per payout batch in USD — batches above this are rejected.
+PAYOUT_MAX_BATCH_USD=5000
+# Admin API secret (x-admin-secret) — required for /api/admin/* including payouts.
+ADMIN_SECRET=change_me_long_random_secret
+# Comma-separated admin emails allowed into the admin dashboard.
+ADMIN_EMAILS=tyler@malamaproject.org

.github/workflows/ci.yml

@@ -1,10 +1,14 @@
 name: Continuous Integration
 
 on:
-  push:
-    branches: [ "main", "develop" ]
-  pull_request:
-    branches: [ "main", "develop" ]
+  # Auto-triggers disabled. GitHub Actions is not executing jobs on this account
+  # (every run fails at startup in ~2s with no steps/logs). Re-enable CI by
+  # restoring the push/pull_request triggers below once Actions/billing is resolved:
+  #   push:
+  #     branches: [ "main", "develop" ]
+  #   pull_request:
+  #     branches: [ "main", "develop" ]
+  workflow_dispatch:
 
 jobs:
   cardano-contracts:

.github/workflows/deploy-testnet.yml

@@ -1,9 +1,12 @@
 name: Deploy to Testnet
 
 on:
-  push:
-    branches:
-      - develop
+  # Auto-trigger disabled (Actions not executing on this account). Re-enable by
+  # restoring the develop push trigger below once Actions/billing is resolved:
+  #   push:
+  #     branches:
+  #       - develop
+  workflow_dispatch:
 
 permissions:
   contents: read

.gitignore

@@ -82,3 +82,9 @@ docker-volumes/
 .env*.local
 
 *.tsbuildinfo
+
+# Geo seed data cache (large GeoJSON)
+scripts/.cache/
+apps/web/src/data/regions.json.bak
+!apps/web/public/sensors/*.png
+!apps/web/public/sensors/*.jpg