🔐 Configuracao de APIs e Variaveis

# .env - Base (commitado como .env.example)
NODE_ENV=development
PORT=3000
LOG_LEVEL=debug
APP_URL=http://localhost:3000

# Provedores de IA
OPENAI_API_KEY=
ANTHROPIC_API_KEY=
GOOGLE_API_KEY=

# Banco de dados
DATABASE_URL=
SUPABASE_URL=
SUPABASE_ANON_KEY=
SUPABASE_SERVICE_KEY=

# Telegram
TELEGRAM_TOKEN=
ALLOWED_CHAT_ID=

# Dashboard
DASHBOARD_TOKEN=
DASHBOARD_PORT=3141

# .gitignore - Padrao para plataformas de agentes
.env
.env.local
.env.production
.env.staging
*.pem
*.key
credentials.json
service-account.json
node_modules/
dist/
.turbo/
.next/

// providers/index.ts - Camada de abstracao
interface AIProvider {
  name: string;
  chat(messages: Message[], options?: ChatOptions): Promise<ChatResponse>;
  costPer1kTokens: { input: number; output: number };
}

// providers/openai.ts
export const openai: AIProvider = {
  name: 'openai',
  costPer1kTokens: { input: 0.003, output: 0.015 },
  async chat(messages, options) {
    const response = await fetch('https://api.openai.com/v1/chat/completions', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${env.OPENAI_API_KEY}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        model: options?.model || 'gpt-4o',
        messages,
        temperature: options?.temperature || 0.7,
      }),
    });
    return parseResponse(response);
  }
};

// providers/anthropic.ts
export const anthropic: AIProvider = {
  name: 'anthropic',
  costPer1kTokens: { input: 0.003, output: 0.015 },
  async chat(messages, options) {
    const response = await fetch('https://api.anthropic.com/v1/messages', {
      method: 'POST',
      headers: {
        'x-api-key': env.ANTHROPIC_API_KEY,
        'anthropic-version': '2023-06-01',
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        model: options?.model || 'claude-sonnet-4-20250514',
        max_tokens: options?.maxTokens || 4096,
        messages,
      }),
    });
    return parseResponse(response);
  }
};

// config/providers.ts - Fallback chain
export const providerChain = [
  { provider: anthropic, priority: 1, tasks: ['reasoning', 'analysis'] },
  { provider: openai,    priority: 2, tasks: ['general', 'coding'] },
  { provider: google,    priority: 3, tasks: ['vision', 'multimodal'] },
  { provider: ollama,    priority: 99, tasks: ['*'] }, // fallback local
];

async function chatWithFallback(messages: Message[], task: string) {
  const sorted = providerChain
    .filter(p => p.tasks.includes(task) || p.tasks.includes('*'))
    .sort((a, b) => a.priority - b.priority);

  for (const { provider } of sorted) {
    try {
      return await provider.chat(messages);
    } catch (error) {
      log.warn(`${provider.name} failed, trying next...`);
    }
  }
  throw new Error('All providers failed');
}

// Exemplo: Doppler como vault em producao
// Em vez de .env, o Doppler injeta variaveis no processo
// doppler run -- node dist/server.js

// Exemplo: 1Password CLI para desenvolvimento
// op run --env-file=.env -- npm run dev

// Para rotacao automatizada:
// 1. Gerar nova chave no provider
const newKey = await openai.apiKeys.create({ name: 'prod-v2' });

// 2. Atualizar no vault
await doppler.secrets.update('OPENAI_API_KEY', newKey.key);

// 3. Trigger redeploy (a nova chave e injetada automaticamente)
await triggerDeploy();

// 4. Verificar health check
await waitForHealthy();

// 5. Revogar chave antiga
await openai.apiKeys.delete(oldKeyId);

# .env - Configuracao Supabase
SUPABASE_URL=https://xyzproject.supabase.co
SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIs...  # Publica, pode ir ao client
SUPABASE_SERVICE_KEY=eyJhbGciOiJIUzI1NiIs... # SECRETA, server-only

# Connection string direta (para migrations e queries complexas)
DATABASE_URL=postgresql://postgres:[PASSWORD]@db.xyzproject.supabase.co:5432/postgres

# Connection pooling (para producao com muitas conexoes)
DATABASE_POOL_URL=postgresql://postgres:[PASSWORD]@db.xyzproject.supabase.co:6543/postgres?pgbouncer=true

-- migrations/001_create_conversations.sql
CREATE TABLE conversations (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID REFERENCES auth.users(id),
  agent_id TEXT NOT NULL,
  created_at TIMESTAMPTZ DEFAULT now(),
  updated_at TIMESTAMPTZ DEFAULT now()
);

-- Row Level Security: usuarios so veem suas conversas
ALTER TABLE conversations ENABLE ROW LEVEL SECURITY;

CREATE POLICY "Users see own conversations"
  ON conversations FOR SELECT
  USING (auth.uid() = user_id);

CREATE POLICY "Users create own conversations"
  ON conversations FOR INSERT
  WITH CHECK (auth.uid() = user_id);

// config/env.ts - Validacao com Zod
import { z } from 'zod';
import { config } from 'dotenv';

config(); // Carrega .env

const envSchema = z.object({
  // App
  NODE_ENV: z.enum(['development', 'staging', 'production']).default('development'),
  PORT: z.string().transform(Number).default('3000'),
  APP_URL: z.string().url().default('http://localhost:3000'),

  // Provedores de IA (pelo menos um obrigatorio)
  OPENAI_API_KEY: z.string().startsWith('sk-').optional(),
  ANTHROPIC_API_KEY: z.string().startsWith('sk-ant-').optional(),
  GOOGLE_API_KEY: z.string().optional(),

  // Banco de dados
  DATABASE_URL: z.string().startsWith('postgresql://'),
  SUPABASE_URL: z.string().url(),
  SUPABASE_ANON_KEY: z.string().min(100), // JWTs sao longos
  SUPABASE_SERVICE_KEY: z.string().min(100),

  // Telegram
  TELEGRAM_TOKEN: z.string().regex(/^\d+:[A-Za-z0-9_-]+$/),
  ALLOWED_CHAT_ID: z.string().regex(/^\d+$/),

  // Dashboard
  DASHBOARD_TOKEN: z.string().min(8),
  DASHBOARD_PORT: z.string().transform(Number).default('3141'),
}).refine(
  (data) => data.OPENAI_API_KEY || data.ANTHROPIC_API_KEY || data.GOOGLE_API_KEY,
  { message: 'At least one AI provider key is required' }
);

// Validar e exportar
const parsed = envSchema.safeParse(process.env);

if (!parsed.success) {
  console.error('Invalid environment variables:');
  console.error(parsed.error.flatten().fieldErrors);
  process.exit(1); // Fail fast
}

export const env = parsed.data;
export type Env = z.infer<typeof envSchema>;

// scripts/test-config.ts
import { env } from '../config/env';

async function testProviders() {
  console.log('Environment:', env.NODE_ENV);
  console.log('Port:', env.PORT);

  // Testar OpenAI
  if (env.OPENAI_API_KEY) {
    try {
      const res = await fetch('https://api.openai.com/v1/models', {
        headers: { 'Authorization': `Bearer ${env.OPENAI_API_KEY}` }
      });
      console.log('OpenAI:', res.ok ? 'OK' : 'FAIL');
    } catch (e) {
      console.log('OpenAI: UNREACHABLE');
    }
  }

  // Testar Anthropic
  if (env.ANTHROPIC_API_KEY) {
    try {
      const res = await fetch('https://api.anthropic.com/v1/messages', {
        method: 'POST',
        headers: {
          'x-api-key': env.ANTHROPIC_API_KEY,
          'anthropic-version': '2023-06-01',
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          model: 'claude-sonnet-4-20250514',
          max_tokens: 10,
          messages: [{ role: 'user', content: 'ping' }]
        })
      });
      console.log('Anthropic:', res.ok ? 'OK' : 'FAIL');
    } catch (e) {
      console.log('Anthropic: UNREACHABLE');
    }
  }

  // Testar Supabase
  try {
    const res = await fetch(`${env.SUPABASE_URL}/rest/v1/`, {
      headers: {
        'apikey': env.SUPABASE_ANON_KEY,
        'Authorization': `Bearer ${env.SUPABASE_ANON_KEY}`
      }
    });
    console.log('Supabase:', res.ok ? 'OK' : 'FAIL');
  } catch (e) {
    console.log('Supabase: UNREACHABLE');
  }

  console.log('\nAll checks complete.');
}

testProviders();