# ============================================================================
# ENVIRONMENT VARIABLE CONFIGURATION
# ============================================================================
# This file documents all environment variables used by the application.
# Copy this to .env and fill in your actual values.
#
# REQUIRED vs OPTIONAL:
# - REQUIRED variables MUST be set or the application will fail to start
# - OPTIONAL variables enable specific features but are not critical
#
# ============================================================================
# REQUIRED FOR PRODUCTION
# ============================================================================
# These variables are REQUIRED when NODE_ENV=production:
#   - NODE_ENV, PORT
#   - MONGODB_URI
#   - SESSION_SECRET, JWT_SECRET
#   - DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_CALLBACK_URL
#   - DISCORD_BOT_TOKEN
#   - ENCRYPTION_KEY
#   - AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_KMS_CMK_ID
#   - DASHBOARD_URL, FRONTEND_URL
#
# ============================================================================
# REQUIRED FOR DEVELOPMENT
# ============================================================================
# These variables are REQUIRED when NODE_ENV=development:
#   - MONGODB_URI
#   - DISCORD_BOT_TOKEN
#   - DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET, DISCORD_CALLBACK_URL
#
# ============================================================================
# OPTIONAL VARIABLES
# ============================================================================
# These variables enable specific features but are not required:
#   - Broker credentials (ALPACA_*, IBKR_*, MOOMOO_*)
#   - Exchange API keys (BINANCE_*, COINBASE_*, KRAKEN_*)
#   - TradingView webhook (TRADINGVIEW_WEBHOOK_SECRET)
#   - Redis (REDIS_URL) - for WebSocket scaling
#   - Additional URLs (LANDING_PAGE_URL, DISCORD_INVITE_URL)
#   - Feature flags (DEMO_MODE)
#
# ============================================================================

# Discord Bot Configuration
DISCORD_BOT_TOKEN=your_discord_bot_token_here

# Discord OAuth2 (Dashboard Authentication)
# Get these from https://discord.com/developers/applications
# 1. Create a new application or select existing one
# 2. Go to OAuth2 → General
# 3. Copy Client ID and Client Secret
# 4. Add redirect URL: https://yourdomain.com/auth/discord/callback (production)
DISCORD_CLIENT_ID=your_discord_app_client_id_here
DISCORD_CLIENT_SECRET=your_discord_app_client_secret_here
DISCORD_CALLBACK_URL=https://yourdomain.com/auth/discord/callback

# Session & Encryption
# Generate SESSION_SECRET: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
# Generate ENCRYPTION_KEY: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SESSION_SECRET=generate_strong_random_string_here
ENCRYPTION_KEY=generate_32_byte_hex_string_here

# Multi-Factor Authentication (MFA) Encryption
# Generate MFA_ENCRYPTION_KEY: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Used to encrypt TOTP secrets (AES-256-GCM)
# REQUIRED in production if MFA is enabled
# Separate from ENCRYPTION_KEY for security isolation
MFA_ENCRYPTION_KEY=generate_32_byte_hex_string_here

# JWT Authentication (Multi-Tenant Security)
# Generate JWT_SECRET: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
JWT_SECRET=generate_strong_jwt_secret_here
JWT_EXPIRATION=7d

# AWS KMS Encryption (Multi-Tenant Credential Security)
# Required for production-grade encryption at rest
# Setup instructions:
# 1. Create AWS account: https://aws.amazon.com/
# 2. Go to KMS console: https://console.aws.amazon.com/kms
# 3. Create Customer Master Key (CMK) with "Encrypt and decrypt" permissions
# 4. Create IAM user with kms:Encrypt, kms:Decrypt, kms:GenerateDataKey permissions
# 5. Copy CMK ARN and IAM credentials below
# Cost: ~$1/month per CMK + $0.03 per 10,000 requests (~$68/month for 1,000 tenants)
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your_aws_access_key_id_here
AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key_here
AWS_KMS_CMK_ID=arn:aws:kms:us-east-1:123456789012:key/your-cmk-id-here

# Trading Exchange APIs

# Crypto Exchange - Binance
BINANCE_API_KEY=your_binance_api_key
BINANCE_SECRET=your_binance_secret

# Stock Broker - Alpaca
# Get paper trading credentials: https://app.alpaca.markets/paper/dashboard/overview
# Click "Generate New Key" → Copy API Key ID and Secret Key
# Paper trading is FREE and completely separate from live trading
ALPACA_PAPER_KEY=your_alpaca_paper_api_key_here
ALPACA_PAPER_SECRET=your_alpaca_paper_secret_here
# Live trading credentials (⚠️ USE WITH CAUTION)
ALPACA_LIVE_KEY=your_alpaca_live_api_key_here
ALPACA_LIVE_SECRET=your_alpaca_live_secret_here

# Stock Broker - Interactive Brokers (IBKR)
# Setup: https://www.interactivebrokers.com/en/trading/tws.php
# 1. Download TWS (Trader Workstation) or IB Gateway
# 2. Enable API connections in TWS: Configure → Settings → API → Settings
#    - Enable ActiveX and Socket Clients ✓
#    - Socket port: 4001 (paper trading) or 7496 (live trading)
#    - Master API client ID: 1 (or any positive integer)
#    - Read-only API: ✗ (uncheck to allow trading)
# 3. Paper trading account: https://www.interactivebrokers.com/en/index.php?f=1286
IBKR_CLIENT_ID=1
IBKR_HOST=127.0.0.1
# Paper trading port: 4001, Live trading port: 7496
IBKR_PORT=4001
IBKR_PAPER_TRADING=true

# Stock Broker - Moomoo
# Setup: https://www.moomoo.com/download/OpenAPI
# 1. Sign up for Moomoo account (free): https://www.moomoo.com
# 2. Download Moomoo OpenD gateway program (similar to TWS)
# 3. Install Python/Node.js SDK: pip install moomoo-api OR npm install moomoo-api
# 4. Login to OpenD with your Moomoo ID and password
# 5. OpenD runs locally and provides API gateway
# Free paper trading available for US, HK, A-share markets
# API Documentation: https://openapi.moomoo.com/moomoo-api-doc/en/
MOOMOO_ID=your_moomoo_user_id_here
MOOMOO_PASSWORD=your_moomoo_password_here
MOOMOO_HOST=127.0.0.1
MOOMOO_PORT=11111
MOOMOO_PAPER_TRADING=true

# ============================================================================
# OAUTH2 BROKER INTEGRATIONS (OPTIONAL - Phase 2 Feature)
# ============================================================================
# These enable automated broker authentication via OAuth2 for stock trading.
# If not configured, users can still connect brokers via API keys manually.
# The application will gracefully skip OAuth2 brokers if credentials are missing.
#
# Setup Instructions per broker:
# 1. Register developer application at broker's developer portal
# 2. Configure OAuth2 redirect URI: https://yourdomain.com/auth/broker/callback
# 3. Copy Client ID and Client Secret below
# 4. Restart application to enable OAuth2 flow for that broker
#
# ⚠️ DEPLOYMENT NOTE: Missing credentials will show warnings in logs but won't
#    block application startup. These are safe to ignore until you have approval.
# ============================================================================

# Alpaca Markets OAuth2 (Stock Trading)
# Developer Portal: https://app.alpaca.markets/oauth/applications
# Docs: https://alpaca.markets/docs/oauth/overview/
ALPACA_OAUTH_CLIENT_ID=
ALPACA_OAUTH_CLIENT_SECRET=

# Interactive Brokers (IBKR) OAuth2
# Developer Portal: https://www.interactivebrokers.com/webtradingapi/
# Docs: https://interactivebrokers.github.io/cpwebapi/
IBKR_OAUTH_CLIENT_ID=
IBKR_OAUTH_CLIENT_SECRET=

# TD Ameritrade OAuth2
# Developer Portal: https://developer.tdameritrade.com/user/me/apps
# Docs: https://developer.tdameritrade.com/authentication/apis
TDAMERITRADE_OAUTH_CLIENT_ID=
TDAMERITRADE_OAUTH_CLIENT_SECRET=

# E*TRADE OAuth2 (Uses OAuth 1.0a)
# Developer Portal: https://us.etrade.com/etx/ris/apikey
# Docs: https://apisb.etrade.com/docs/api/authorization/
ETRADE_OAUTH_CLIENT_ID=
ETRADE_OAUTH_CLIENT_SECRET=

# Charles Schwab OAuth2
# Developer Portal: https://developer.schwab.com/
# Docs: https://developer.schwab.com/products/trader-api--individual
SCHWAB_OAUTH_CLIENT_ID=
SCHWAB_OAUTH_CLIENT_SECRET=

# ============================================================================
# BILLING PROVIDER ABSTRACTION
# ============================================================================
# Select billing provider (only 'polar' is supported)
# See: docs/billing/BILLING_PROVIDER_IMPLEMENTATION_GUIDE.md
BILLING_PROVIDER=polar

# Polar.sh Configuration (default provider)
# Setup: https://polar.sh
# 1. Create account at https://polar.sh
# 2. Create products for each tier (Professional, Enterprise)
# 3. Set metadata: tier=professional, type=community (for community subscriptions)
# 4. Set metadata: tier=professional, type=trader (for trader subscriptions)
# 5. Get Access Token from API settings
# 6. Configure webhook endpoint: POST /webhook/polar
POLAR_ACCESS_TOKEN=polar_at_your_access_token_here
POLAR_WEBHOOK_SECRET=polar_wh_your_webhook_secret_here
POLAR_WEBHOOK_INSPECT_TOKEN=optional_token_for_webhook_events
# Optional: limit how many webhook events we retain in memory (default 50)
POLAR_WEBHOOK_EVENT_LIMIT=50
POLAR_PRODUCT_BASIC=polar_prod_basic_plan_id
POLAR_PRODUCT_PRO=polar_prod_pro_plan_id
POLAR_PRODUCT_PREMIUM=polar_prod_premium_plan_id
POLAR_CHECKOUT_URL=https://polar.sh/checkout/demo-link

# TradingView Integration
TRADINGVIEW_WEBHOOK_SECRET=your_tradingview_webhook_secret

# Database
MONGODB_URI=mongodb://localhost:27017/trade-executor

# Marketing Automation
LANDING_PAGE_URL=https://yourdomain.com
DISCORD_INVITE_URL=https://discord.gg/yourinvite
TWITTER_API_KEY=your_twitter_api_key
TWITTER_API_SECRET=your_twitter_api_secret
TWITTER_ACCESS_TOKEN=your_twitter_access_token
TWITTER_ACCESS_SECRET=your_twitter_access_secret
REDDIT_CLIENT_ID=your_reddit_client_id
REDDIT_CLIENT_SECRET=your_reddit_client_secret
REDDIT_USERNAME=your_reddit_username
REDDIT_PASSWORD=your_reddit_password
EMAIL_SERVICE_API_KEY=your_email_service_api_key
WORDPRESS_API_URL=https://yourblog.com/wp-json/wp/v2
WORDPRESS_USERNAME=your_wp_username
WORDPRESS_APP_PASSWORD=your_wp_app_password

# Environment
NODE_ENV=production
PORT=5000

# Application URLs (REQUIRED in production)
DASHBOARD_URL=https://yourdomain.com
FRONTEND_URL=https://yourdomain.com

# Demo Mode (set to false in production)
# When true, simulates trades without actual exchange API calls
DEMO_MODE=false

# ============================================================================
# POLYMARKET BLOCKCHAIN INTELLIGENCE
# ============================================================================
# RPC providers for Polygon blockchain access (at least one required)
# Get free keys from:
# - Infura: https://infura.io (3 requests/sec free tier)
# - Alchemy: https://alchemy.com (300M compute units/month free)
# - QuickNode: https://quicknode.com (free tier available)

# Infura Polygon RPC (RECOMMENDED)
POLYGON_RPC_INFURA=https://polygon-mainnet.infura.io/v3/your_infura_project_id
INFURA_PROJECT_ID=your_infura_project_id_here

# Alchemy Polygon RPC (RECOMMENDED)
POLYGON_RPC_ALCHEMY=https://polygon-mainnet.g.alchemy.com/v2/your_alchemy_api_key
ALCHEMY_API_KEY=your_alchemy_api_key_here

# QuickNode Polygon RPC (OPTIONAL)
POLYGON_RPC_QUICKNODE=

# Verified Polymarket smart contract addresses (DO NOT MODIFY)
POLYMARKET_CTF_EXCHANGE=0x4bFb41d5B3570DeFd03C39a9A4D8dE6Bd8B8982E
POLYMARKET_CONDITIONAL_TOKENS=0x4D97DCd97eC945f40cf65F87097ACe5EA0476045
POLYMARKET_NEG_RISK_FEE_MODULE=0x78769d50be1763ed1ca0d5e878d93f05aabff29e
POLYMARKET_UMA_CTF_ADAPTER=0x6A9D222616C90FcA5754cd1333cFD9b7fb6a4F74
POLYMARKET_PROXY_WALLET_FACTORY=0xaB45c5A4B0c941a2F231C04C3f49182e1A254052
POLYGON_USDC=0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174

# Discord webhooks for Polymarket alerts (OPTIONAL)
# Create webhooks in Discord: Server Settings → Integrations → Webhooks
DISCORD_POLYMARKET_ALERTS_WEBHOOK=
DISCORD_POLYMARKET_WHALES_WEBHOOK=
DISCORD_POLYMARKET_ANOMALIES_WEBHOOK=

# Discord webhook for critical error notifications (OPTIONAL - Production Recommended)
# Create webhook in Discord: Server Settings → Integrations → Webhooks
# This webhook receives notifications for:
# - 500+ HTTP errors (server errors)
# - Uncaught exceptions
# - Unhandled promise rejections
# - Database connection failures
# - Broker connection failures
# Rate limited to 1 notification per error type every 5 minutes
DISCORD_ERROR_WEBHOOK_URL=

# Slack webhook for performance alerts (OPTIONAL - US6-T04)
# Create webhook in Slack: https://api.slack.com/messaging/webhooks
# This webhook receives notifications for:
# - Slow query patterns (avgTime > 2000ms)
# - Query optimization recommendations
# - Performance degradation alerts
# Rate limited to 1 alert per query pattern every 5 minutes
SLACK_ALERTS_WEBHOOK_URL=

# Whale detection thresholds (OPTIONAL - defaults provided)
POLYMARKET_WHALE_VOLUME_THRESHOLD=1000000
POLYMARKET_WHALE_BET_THRESHOLD=100000
POLYMARKET_ALERT_MIN_BET_SIZE=50000

# ============================================================================
# POLYMARKET INTELLIGENCE FEATURES (Phase 2)
# ============================================================================

# ============================================================================
# REDIS CACHING (Production REQUIRED for dual dashboard & analytics)
# ============================================================================
# Redis provides distributed caching for analytics endpoints and horizontal scaling
#
# ⚠️ USER ACTION REQUIRED (Production Deployment):
# 1. Provision Redis instance from one of these providers:
#    - Railway: `railway add redis` (recommended - automatic setup)
#    - Heroku: `heroku addons:create heroku-redis:mini` (~$15/month)
#    - AWS ElastiCache: cache.t3.micro instance (~$13/month)
#    - Self-hosted: Docker Redis container (free but requires management)
#
# 2. Get connection URL from provider and set REDIS_URL below
#
# 3. Test connection:
#    node -e "const redis = require('redis'); const client = redis.createClient({url: process.env.REDIS_URL}); client.connect().then(() => console.log('Connected')).then(() => client.quit());"
#
# 4. Monitor health: curl https://yourdomain.com/health/redis
#
# Development: Leave empty to use in-memory fallback (automatic)
# Production: MUST be set for Constitution compliance (Principles V & VII)
#
# Format: redis://[username:password@]host[:port][/database]
# Example: redis://default:password123@redis-internal.railway.app:6379
REDIS_URL=

# Optional: Disable Redis entirely (not recommended for production)
# REDIS_ENABLED=false

# Alert Cooldown Periods (seconds) - Prevent duplicate alerts
# Controls how long to wait before sending same alert type again
POLYMARKET_ALERT_COOLDOWN_WHALE=3600        # 1 hour for whale bets
POLYMARKET_ALERT_COOLDOWN_SPIKE=900         # 15 minutes for volume spikes
POLYMARKET_ALERT_COOLDOWN_SENTIMENT=900     # 15 minutes for sentiment shifts
POLYMARKET_ALERT_COOLDOWN_ANOMALY=1800      # 30 minutes for anomalies

# Alert Rate Limiting
# Maximum alerts sent to Discord per minute (prevents webhook throttling)
POLYMARKET_ALERT_RATE_LIMIT=10

# Analysis Pipeline Thresholds
# Controls when different alert types trigger
PIPELINE_WHALE_ALERT_THRESHOLD=250000       # $250K+ triggers whale alert
PIPELINE_CRITICAL_AMOUNT=100000             # $100K+ gets real-time analysis
PIPELINE_MAX_PROCESSING_TIME=5000           # 5 seconds max per transaction
PIPELINE_ENABLE_MONITORING=true

# Anomaly Detection Thresholds
ANOMALY_CRITICAL_THRESHOLD=100000           # $100K+ for real-time anomaly check
ANOMALY_COORDINATED_MIN_WALLETS=5           # 5+ wallets = coordinated betting
ANOMALY_REVERSAL_THRESHOLD=30               # 30% shift = sudden reversal
ANOMALY_FLASH_WHALE_RATIO=0.5               # 50% opposite bets = flash whale
ANOMALY_BATCH_INTERVAL=30000                # 30 seconds for batch processing

# BullMQ Job Configuration (requires REDIS_URL)
# Controls background job processing behavior
BULLMQ_WHALE_UPDATE_BATCH_SIZE=1000         # Wallets per batch
BULLMQ_ANOMALY_BATCH_INTERVAL=30000         # 30 seconds
BULLMQ_ANALYSIS_CONCURRENCY=10              # Parallel analysis workers
BULLMQ_ALERTS_CONCURRENCY=5                 # Parallel alert workers

# Cache Configuration
POLYMARKET_CACHE_MAX_MEMORY=1000            # Max items in memory cache