import { z } from 'zod';

const envSchema = z.object({
  PORT: z.coerce.number().default(4003),
  HOST: z.string().default('0.0.0.0'),
  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
  CORS_ORIGIN: z.string().optional(),
  SERVICE_NAME: z.string().default('platform-service'),
  COSMOS_ENDPOINT: z.string().min(1, 'COSMOS_ENDPOINT is required'),
  COSMOS_KEY: z.string().min(1, 'COSMOS_KEY is required'),
  COSMOS_DATABASE: z.string().default('lysnrai'),
  JWT_SECRET: z.string().min(1, 'JWT_SECRET is required'),
  AZURE_BLOB_CONNECTION_STRING: z.string().optional(),
  AZURE_BLOB_ACCOUNT_NAME: z.string().optional(),
  AZURE_BLOB_ACCOUNT_KEY: z.string().optional(),
  RATE_LIMIT_CONFIG_JSON: z.string().optional(),
  RATE_LIMIT_STORE_MODE: z.enum(['datastore', 'memory']).default('datastore'),
  API_KEY_RATE_LIMIT_CONFIG_JSON: z.string().optional(),
  API_KEY_PRODUCT_RATE_LIMIT_CONFIG_JSON: z.string().optional(),
  // ── Growth (merged) ──
  WEBHOOK_INVITATION_REDEEMED_URL: z.string().optional(),
  WEBHOOK_REFERRAL_STATUS_URL: z.string().optional(),
  // ── AI Diagnostics ──
  AZURE_OPENAI_KEY: z.string().optional(),
  AZURE_OPENAI_ENDPOINT: z.string().optional(),
  // ── Billing (merged) ──
  STRIPE_SECRET_KEY: z.string().optional(),
  STRIPE_WEBHOOK_SECRET: z.string().optional(),
  STRIPE_PRICE_PRO: z.string().optional(),
  STRIPE_PRICE_ENTERPRISE: z.string().optional(),
  BACKEND_URL: z.string().default('http://localhost:8000'),
  PLAN_LIMITS_JSON: z.string().optional(),
  USAGE_WARN_THRESHOLD: z.coerce.number().default(0.8),
  // ── SmartAuth OAuth ──
  GOOGLE_CLIENT_ID_WEB: z.string().optional(),
  GOOGLE_CLIENT_ID_IOS: z.string().optional(),
  GOOGLE_CLIENT_ID_ANDROID: z.string().optional(),
  MICROSOFT_CLIENT_ID: z.string().optional(),
  MICROSOFT_TENANT_ID: z.string().default('common'),
  APPLE_CLIENT_ID: z.string().optional(),
  APPLE_TEAM_ID: z.string().optional(),
  APPLE_KEY_ID: z.string().optional(),
  // ── SmartAuth MFA ──
  AUTH_TOTP_ENCRYPTION_KEY: z.string().optional(),
  // ── SmartAuth WebAuthn ──
  WEBAUTHN_RP_ID: z.string().default('bytelyst.com'),
  WEBAUTHN_RP_NAME: z.string().default('ByteLyst'),
  WEBAUTHN_ORIGINS: z.string().optional(),
  // ── SmartAuth CORS ──
  CORS_ALLOWED_ORIGINS: z.string().optional(),
  EMAIL_PROVIDER: z.enum(['smtp', 'sendgrid', 'postmark', 'bytelyst', 'console']).optional(),
  EMAIL_API_KEY: z.string().optional(),
  EMAIL_FROM_ADDRESS: z.string().optional(),
  EMAIL_FROM_NAME: z.string().optional(),
  SMTP_HOST: z.string().optional(),
  SMTP_PORT: z.coerce.number().optional(),
  SMTP_SECURE: z
    .enum(['true', 'false'])
    .transform(value => value === 'true')
    .optional(),
  SMTP_USER: z.string().optional(),
  SMTP_PASSWORD: z.string().optional(),
  TELEGRAM_BOT_TOKEN: z.string().optional(),
  TELEGRAM_DEFAULT_CHAT_ID: z.string().optional(),
  SLACK_WEBHOOK_URL: z.string().optional(),
  SLACK_DEFAULT_CHANNEL: z.string().optional(),
  EVENT_BUS_BACKEND: z.enum(['memory', 'file']).default('file'),
  EVENT_BUS_FILE: z.string().default('.data/platform-events.json'),
  EVENT_BUS_POLL_MS: z.coerce.number().default(100),
  EVENT_BUS_LEASE_MS: z.coerce.number().default(30_000),
  // ── Cross-Service: DevIntelli ──
  DEVINTELLI_BACKEND_URL: z.string().default('http://localhost:4021'),
  DEVINTELLI_INTERNAL_API_KEY: z.string().default('dev-internal-key-do-not-use-in-prod'),
});

export const config = envSchema.parse(process.env);
