# ============================================================
# EvoNexus — Environment Variables
# ============================================================
# Generated by: make setup
# Edit this file with your API keys.
# ============================================================

# ── Dashboard API Token (for headless agents / CLI) ──
# Bearer token for local agents to call the dashboard API without
# a browser session. Keep it secret — grants full API access.
# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
# Usage: curl -H "Authorization: Bearer $DASHBOARD_API_TOKEN" ...
DASHBOARD_API_TOKEN=
# Optional: which user the token impersonates (defaults to first admin)
DASHBOARD_API_USER=

# Dashboard session secret. Required in production.
EVONEXUS_SECRET_KEY=

# Comma-separated list of allowed browser origins for the Flask dashboard.
# Use "*" for local development; set explicit origins in production.
CORS_ALLOWED_ORIGINS=*

# ── AI Provider Configuration ────────────────────────
# EvoNexus supports multiple AI providers via OpenClaude.
# Configure via dashboard (Providers page) or edit config/providers.json.
# The active provider determines which CLI (claude or openclaude) is used.
#
# Anthropic (default): no extra config needed — uses native 'claude' CLI.
#
# OpenRouter (200+ models):
#   CLAUDE_CODE_USE_OPENAI=1
#   OPENAI_BASE_URL=https://openrouter.ai/api/v1
#   OPENAI_API_KEY=sk-or-...
#   OPENAI_MODEL=anthropic/claude-sonnet-4
#
# OpenAI:
#   CLAUDE_CODE_USE_OPENAI=1
#   OPENAI_API_KEY=sk-...
#   OPENAI_MODEL=gpt-4.1
#
# Google Gemini:
#   CLAUDE_CODE_USE_GEMINI=1
#   GEMINI_API_KEY=...
#   GEMINI_MODEL=gemini-2.5-pro
#
# Install openclaude for non-Anthropic providers:
#   npm install -g @gitlawb/openclaude

# ── Omie ERP ─────────────────────────────────────────
# Omie API (omie.com.br → Settings → Integrations → API)
OMIE_APP_KEY=
OMIE_APP_SECRET=

# ── Bling ERP ────────────────────────────────────────
# Bling API v3 — OAuth2 with automatic refresh.
# 1. Create an app at https://developer.bling.com.br
# 2. Set redirect URI to: http://localhost:8787/callback
# 3. Paste Client ID/Secret below, then run `make bling-auth` to complete login.
# The CLI opens your browser, captures the code, and fills ACCESS/REFRESH tokens here.
BLING_CLIENT_ID=
BLING_CLIENT_SECRET=
BLING_ACCESS_TOKEN=
BLING_REFRESH_TOKEN=

# ── Asaas (payments) ─────────────────────────────────
# Asaas API key (account settings → Integrations → API Key)
# Set ASAAS_SANDBOX=true to hit sandbox.asaas.com (safe default)
ASAAS_API_KEY=
ASAAS_SANDBOX=true

# ── Stripe ───────────────────────────────────────────
# Stripe Secret Key (dashboard.stripe.com → Developers → API Keys)
STRIPE_SECRET_KEY=

# ── Todoist ──────────────────────────────────────────
# Todoist API Token (app.todoist.com → Settings → Integrations → API Token)
TODOIST_API_TOKEN=

# ── Fathom (Meetings) ───────────────────────────────
# Fathom API Key (fathom.video → Settings → API)
FATHOM_API_KEY=

# ── Discord ──────────────────────────────────────────
# Discord Bot Token (discord.com/developers → Bot → Token)
DISCORD_BOT_TOKEN=
# Server Guild ID (enable Developer Mode → right-click server → Copy ID)
DISCORD_GUILD_ID=

# ── Telegram ─────────────────────────────────────────
# Bot Token from @BotFather
TELEGRAM_BOT_TOKEN=
# Chat ID (send /start to your bot, check via getUpdates API)
TELEGRAM_CHAT_ID=

# ── YouTube OAuth ────────────────────────────────────
# Google Cloud Console → APIs → Credentials → OAuth Client
YOUTUBE_OAUTH_CLIENT_ID=
YOUTUBE_OAUTH_CLIENT_SECRET=

# ── Meta / Instagram OAuth ───────────────────────────
# Facebook App (developers.facebook.com → My Apps → Settings → Basic)
META_APP_ID=
META_APP_SECRET=

# ── LinkedIn OAuth ───────────────────────────────────
# LinkedIn App (linkedin.com/developers → My Apps → Auth)
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=

# ── License — headless auto-activation ───────────────
# Set this to the email used in your first manual license registration.
# On startup, EvoNexus calls /v1/register/auto silently and skips the manual
# setup screen. Falls back to manual setup if the email isn't registered yet.
# Leave empty (or unset) to keep the default behavior.
# EVOLUTION_OPERATOR_EMAIL=operator@example.com

# ── Evolution API ────────────────────────────────────
# Your Evolution API instance URL and global API key
EVOLUTION_API_URL=
EVOLUTION_API_KEY=

# ── Evolution Go ─────────────────────────────────────
# Your Evolution Go instance URL and API key
EVOLUTION_GO_URL=
EVOLUTION_GO_KEY=

# ── Evo AI CRM ──────────────────────────────────────
# Your Evo AI CRM instance URL and access token
EVO_CRM_URL=
EVO_CRM_TOKEN=

# ── Backup (S3-compatible) ───────────────────────────
# S3 bucket for remote backups (any S3-compatible: AWS, MinIO, R2, etc.)
BACKUP_S3_BUCKET=
# Prefix/folder inside the bucket (default: evonexus-backups/)
BACKUP_S3_PREFIX=evonexus-backups/
# AWS credentials (or S3-compatible endpoint)
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_ENDPOINT_URL=           # For non-AWS (MinIO, R2, etc.)
# Retention: how many backups to keep (empty = unlimited)
# BACKUP_RETAIN_LOCAL=7       # Keep last 7 local backups
# BACKUP_RETAIN_S3=30         # Keep last 30 S3 backups

# ── Social Accounts ──────────────────────────────────
# Managed via the dashboard Integrations page.
# Pattern: SOCIAL_{PLATFORM}_{N}_{FIELD}
# Example:
# SOCIAL_YOUTUBE_1_LABEL=My Channel
# SOCIAL_YOUTUBE_1_ACCESS_TOKEN=ya29...
# SOCIAL_YOUTUBE_1_CHANNEL_ID=UC...

# -- AI Image Creator (image generation) ----------------
# Cloudflare AI Gateway mode (recommended):
AI_IMG_CREATOR_CF_ACCOUNT_ID=
AI_IMG_CREATOR_CF_GATEWAY_ID=
AI_IMG_CREATOR_CF_TOKEN=
# Direct API keys (simpler alternative):
AI_IMG_CREATOR_OPENROUTER_KEY=
AI_IMG_CREATOR_GEMINI_KEY=

# ── Knowledge Base — Embedder (optional) ────────────
# The Knowledge Base (pgvector) uses one of three embedders:
#   local   — sentence-transformers/paraphrase-multilingual-mpnet-base-v2 (default)
#             768 dim · offline · ~420 MB model download on first use
#   openai  — text-embedding-3-small / -3-large / ada-002
#             1536 or 3072 dim · requires OPENAI_API_KEY
#   gemini  — gemini-embedding-001 (stable) or gemini-embedding-2-preview
#             768 / 1536 / 3072 dim (MRL) · requires GEMINI_API_KEY
#
# Most users should configure this via the dashboard at /knowledge/settings
# rather than editing .env directly. The provider is locked once the first
# connection is created.
#
# KNOWLEDGE_EMBEDDER_PROVIDER=local
#
# -- Gemini embedder ----------------------------------
# Get a free key at https://aistudio.google.com/apikey (generous free tier).
# GEMINI_API_KEY=AIzaSy...
# KNOWLEDGE_GEMINI_MODEL=gemini-embedding-001   # or gemini-embedding-2-preview
# KNOWLEDGE_GEMINI_DIM=768                      # 768 (default, aligns with local), 1536, or 3072


# -- Databases (db-postgres, db-mysql) ----------------
# Numbered blocks — one per database. Same pattern as SOCIAL_YOUTUBE_N_*.
# Skills pick connections by LABEL (case-insensitive) or numeric index.
# LABEL is the only required field. DSN, if set, wins over component fields.
# Read-only by default — set ALLOW_WRITE=true per connection to permit writes.
#
# Drivers are NOT pre-installed. First use:
#   uv pip install psycopg2-binary   # for db-postgres
#   uv pip install pymysql           # for db-mysql
#
# ── Postgres ─────────────────────────────────────────
# DB_POSTGRES_1_LABEL=msgops-dev
# DB_POSTGRES_1_HOST=db.dev.internal
# DB_POSTGRES_1_PORT=5432
# DB_POSTGRES_1_DATABASE=msgops
# DB_POSTGRES_1_USER=agent_readonly
# DB_POSTGRES_1_PASSWORD=
# DB_POSTGRES_1_SSL_MODE=require             # disable | require | verify-ca | verify-full
# DB_POSTGRES_1_SSL_CA_PATH=                 # optional, if verify-*
# DB_POSTGRES_1_ALLOW_WRITE=false
# DB_POSTGRES_1_QUERY_TIMEOUT=30
# DB_POSTGRES_1_MAX_ROWS=1000
#
# Or a full DSN alternative (DSN wins over components):
# DB_POSTGRES_2_LABEL=evo-ai-dev
# DB_POSTGRES_2_DSN=postgresql://user:pw@host:5432/db?sslmode=require
#
# ── MySQL / MariaDB ──────────────────────────────────
# DB_MYSQL_1_LABEL=orders-dev
# DB_MYSQL_1_HOST=mysql.dev.internal
# DB_MYSQL_1_PORT=3306
# DB_MYSQL_1_DATABASE=orders
# DB_MYSQL_1_USER=agent_readonly
# DB_MYSQL_1_PASSWORD=
# DB_MYSQL_1_SSL_CA_PATH=                    # optional, enables TLS verification
# DB_MYSQL_1_ALLOW_WRITE=false
# DB_MYSQL_1_QUERY_TIMEOUT=30
# DB_MYSQL_1_MAX_ROWS=1000
#
# ── MongoDB ──────────────────────────────────────────
# DB_MONGO_1_LABEL=orders-dev
# DB_MONGO_1_URI=mongodb+srv://user:pw@cluster0.abc.mongodb.net/orders?retryWrites=true
# # Or components instead of URI:
# # DB_MONGO_1_HOST=mongo.dev.internal
# # DB_MONGO_1_PORT=27017
# # DB_MONGO_1_DATABASE=orders
# # DB_MONGO_1_USER=agent_readonly
# # DB_MONGO_1_PASSWORD=
# # DB_MONGO_1_AUTH_SOURCE=admin
# # DB_MONGO_1_TLS=true
# DB_MONGO_1_ALLOW_WRITE=false
# DB_MONGO_1_QUERY_TIMEOUT=30
# DB_MONGO_1_MAX_ROWS=1000
#
# ── Redis ────────────────────────────────────────────
# DB_REDIS_1_LABEL=cache-dev
# DB_REDIS_1_URL=rediss://user:pw@host:6380/0
# # Or components instead of URL:
# # DB_REDIS_1_HOST=redis.dev.internal
# # DB_REDIS_1_PORT=6379
# # DB_REDIS_1_DB=0
# # DB_REDIS_1_USERNAME=
# # DB_REDIS_1_PASSWORD=
# # DB_REDIS_1_TLS=false
# DB_REDIS_1_ALLOW_WRITE=false
# DB_REDIS_1_QUERY_TIMEOUT=30
# DB_REDIS_1_MAX_ROWS=1000