export type EnvValueType =
  | "boolean"
  | "enum"
  | "integer"
  | "path"
  | "secret"
  | "string"
  | "url";

export type EnvGroup =
  | "ai"
  | "desktop"
  | "feature"
  | "packaging"
  | "server"
  | "storage"
  | "test"
  | "web";

export type EnvStatus = "active" | "documented" | "packaging" | "planned";

export interface EnvVarDefinition {
  readonly name: string;
  readonly group: EnvGroup;
  readonly type: EnvValueType;
  readonly status: EnvStatus;
  readonly description: string;
  readonly defaultValue?: string;
  readonly example?: string;
  readonly values?: readonly string[];
  readonly secret?: boolean;
}

export const COVEL_ENV_REGISTRY = [
  {
    name: "STORE_BACKEND",
    group: "storage",
    type: "enum",
    status: "active",
    values: ["memory", "sqlite", "pg"],
    defaultValue: "sqlite",
    example: "sqlite",
    description:
      "Server DataStore backend. Browser callers can use idb through @covel/store createStore().",
  },
  {
    name: "SQLITE_PATH",
    group: "storage",
    type: "path",
    status: "active",
    defaultValue: "./data/covel.db",
    description: "SQLite database path for the server store.",
  },
  {
    name: "DATABASE_URL",
    group: "storage",
    type: "url",
    status: "active",
    example: "postgresql://covel:covel_dev@localhost:5432/covel",
    description: "PostgreSQL connection string for the pg store and Drizzle.",
  },
  {
    name: "MEDIA_BACKEND",
    group: "storage",
    type: "enum",
    status: "active",
    values: ["mirror", "memory", "sqlite", "pg", "none"],
    defaultValue: "mirror",
    example: "mirror",
    description:
      "Server MediaStore backend. mirror follows STORE_BACKEND; none disables media routes.",
  },
  {
    name: "MEDIA_ROOT",
    group: "storage",
    type: "path",
    status: "active",
    description:
      "Filesystem root for sqlite media blobs. Defaults to a media directory beside SQLITE_PATH.",
  },
  {
    name: "MEDIA_S3_BUCKET",
    group: "storage",
    type: "string",
    status: "planned",
    description: "S3-compatible bucket for future explicit S3 media wiring.",
  },
  {
    name: "MEDIA_S3_REGION",
    group: "storage",
    type: "string",
    status: "planned",
    description: "S3-compatible region for future explicit S3 media wiring.",
  },
  {
    name: "MEDIA_S3_ENDPOINT",
    group: "storage",
    type: "url",
    status: "planned",
    description: "S3-compatible endpoint for future explicit S3 media wiring.",
  },
  {
    name: "MEDIA_S3_KEY_PREFIX",
    group: "storage",
    type: "string",
    status: "planned",
    description: "Object key prefix for future explicit S3 media wiring.",
  },
  {
    name: "MEDIA_S3_PUBLIC_BASE_URL",
    group: "storage",
    type: "url",
    status: "planned",
    description:
      "Public base URL for resolving explicitly wired S3 media assets without signed URLs.",
  },
  {
    name: "VECTOR_BACKEND",
    group: "storage",
    type: "enum",
    status: "active",
    values: ["embedded", "none", "external"],
    defaultValue: "embedded",
    example: "embedded",
    description:
      "VectorStore backend. embedded uses the active DataStore vector capability; none disables vector search; external is reserved for an injected adapter.",
  },
  {
    name: "POSTGRES_USER",
    group: "storage",
    type: "string",
    status: "active",
    defaultValue: "covel",
    description: "Docker Compose PostgreSQL username.",
  },
  {
    name: "POSTGRES_PASSWORD",
    group: "storage",
    type: "secret",
    status: "active",
    secret: true,
    description: "Docker Compose PostgreSQL password.",
  },
  {
    name: "POSTGRES_DB",
    group: "storage",
    type: "string",
    status: "active",
    defaultValue: "covel",
    description: "Docker Compose PostgreSQL database name.",
  },
  {
    name: "POSTGRES_PORT",
    group: "storage",
    type: "integer",
    status: "active",
    defaultValue: "5432",
    description: "Host port for the Docker Compose PostgreSQL service.",
  },
  {
    name: "SERVER_PORT",
    group: "server",
    type: "integer",
    status: "active",
    defaultValue: "3001",
    description: "HTTP server listen port.",
  },
  {
    name: "NODE_ENV",
    group: "server",
    type: "enum",
    status: "active",
    values: ["development", "production", "test"],
    defaultValue: "development",
    description: "Node runtime mode used by logging and diagnostics.",
  },
  {
    name: "SERVE_STATIC",
    group: "server",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Serve built web assets from the server process.",
  },
  {
    name: "STATIC_DIR",
    group: "server",
    type: "path",
    status: "active",
    defaultValue: "./web-dist",
    description: "Directory served when SERVE_STATIC is enabled.",
  },
  {
    name: "DEPLOYMENT_TIER",
    group: "server",
    type: "enum",
    status: "active",
    values: ["self", "demo", "commercial", "T1"],
    defaultValue: "self",
    description: "Deployment posture used by security-sensitive endpoints.",
  },
  {
    name: "CORS_ORIGIN",
    group: "server",
    type: "string",
    status: "active",
    description: "Comma-separated HTTP origins allowed by CORS.",
  },
  {
    name: "ENABLE_DEBUG_PAGE",
    group: "server",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Enables debug and internal routes in production.",
  },
  {
    name: "RATE_LIMIT_RPM",
    group: "server",
    type: "integer",
    status: "active",
    defaultValue: "60",
    description: "Default per-IP requests per minute for rate-limited routes.",
  },
  {
    name: "TRUSTED_PROXY_IPS",
    group: "server",
    type: "string",
    status: "active",
    description:
      "Comma-separated proxy IP allowlist used before trusting X-Forwarded-For / X-Real-IP for rate limiting.",
  },
  {
    name: "COVEL_MEDIA_TOKEN_SECRET",
    group: "server",
    type: "secret",
    status: "active",
    secret: true,
    description:
      "HMAC-SHA256 secret used to sign /api/media/:id short-lived URLs (5min TTL). Required in production; dev generates a per-process random secret if absent.",
  },
  {
    name: "COVEL_MEDIA_CLEANUP_ENABLED",
    group: "server",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description:
      "Enables the destructive POST /api/media/cleanup endpoint. Off by default; never enable in DEPLOYMENT_TIER=commercial without an admin auth layer (the route forces 503 there).",
  },
  {
    name: "COVEL_INSTALL_API_ENABLED",
    group: "server",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description:
      "Explicit production opt-in for POST /api/install/plugin and POST /api/install/world when no desktop bearer token is configured.",
  },
  {
    name: "APP_PORT",
    group: "server",
    type: "integer",
    status: "active",
    defaultValue: "3001",
    description: "Host port for the Docker Compose app service.",
  },
  {
    name: "COVEL_HOME",
    group: "desktop",
    type: "path",
    status: "active",
    defaultValue: "~/.covel",
    description: "Desktop config root and keys.env location.",
  },
  {
    name: "COVEL_DATA_ROOT",
    group: "desktop",
    type: "path",
    status: "active",
    description: "Desktop runtime data root for SQLite, worlds, and logs.",
  },
  {
    name: "COVEL_DESKTOP_REST",
    group: "desktop",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Enables privileged desktop REST config endpoints.",
  },
  {
    name: "COVEL_DESKTOP_REST_TOKEN",
    group: "desktop",
    type: "string",
    status: "active",
    description:
      "Per-launch bearer token for privileged /api/config/* writes. Generated by the desktop shell at startup and forwarded via Authorization: Bearer. When absent, write endpoints stay open (web/dev/Demo Host).",
  },
  {
    name: "COVEL_LLM_TOML",
    group: "desktop",
    type: "path",
    status: "active",
    defaultValue: "./llm.toml",
    description: "Path to the active llm.toml model slot config.",
  },
  {
    name: "COVEL_PLUGINS_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "Bundled plugin directory override.",
  },
  {
    name: "COVEL_USER_PLUGINS_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "User plugin directory mounted by desktop shells.",
  },
  {
    name: "COVEL_WORLDS_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "Bundled world package directory override.",
  },
  {
    name: "COVEL_USER_WORLDS_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "User world package directory mounted by desktop shells.",
  },
  {
    name: "COVEL_USER_CONFIG_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "Desktop config directory for model DB and settings.",
  },
  {
    name: "COVEL_LOGS_DIR",
    group: "desktop",
    type: "path",
    status: "active",
    description: "Desktop logs directory surfaced in Settings.",
  },
  {
    name: "COVEL_LOG_MAX_SIZE_MB",
    group: "desktop",
    type: "integer",
    status: "active",
    defaultValue: "10",
    description: "Desktop log rotation file-size cap.",
  },
  {
    name: "COVEL_LOG_MAX_FILES",
    group: "desktop",
    type: "integer",
    status: "active",
    defaultValue: "10",
    description: "Desktop log rotation retained file count.",
  },
  {
    name: "COVEL_APP_VERSION",
    group: "desktop",
    type: "string",
    status: "active",
    defaultValue: "0.0.1-beta",
    description: "Desktop preload app version fallback.",
  },
  {
    name: "COVEL_AUTO_UPDATE",
    group: "desktop",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Electron auto-updater opt-in flag.",
  },
  {
    name: "COVEL_UPDATE_CHANNEL",
    group: "desktop",
    type: "enum",
    status: "active",
    values: ["latest", "beta", "alpha"],
    description: "Electron auto-updater release channel override.",
  },
  {
    name: "COVEL_MODEL_DB_PATH",
    group: "ai",
    type: "path",
    status: "active",
    description: "Explicit model database JSON override.",
  },
  {
    name: "COVEL_PROMPTS_DIR",
    group: "ai",
    type: "path",
    status: "active",
    description: "Prompt template root directory override.",
  },
  {
    name: "LANGFUSE_PUBLIC_KEY",
    group: "ai",
    type: "string",
    status: "active",
    description: "Langfuse public key for LLM trace export.",
  },
  {
    name: "LANGFUSE_SECRET_KEY",
    group: "ai",
    type: "secret",
    status: "active",
    secret: true,
    description: "Langfuse secret key for LLM trace export.",
  },
  {
    name: "LANGFUSE_BASE_URL",
    group: "ai",
    type: "url",
    status: "active",
    defaultValue: "https://cloud.langfuse.com",
    description: "Langfuse API base URL.",
  },
  {
    name: "COVEL_LLM_RETRY_DISABLED",
    group: "ai",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Disables provider HTTP retry when set to 1.",
  },
  {
    name: "COVEL_LLM_REPLAY",
    group: "ai",
    type: "enum",
    status: "documented",
    values: ["auto", "record", "replay"],
    description: "Documented dev LLM replay cache mode.",
  },
  {
    name: "COVEL_LLM_REPLAY_DIR",
    group: "ai",
    type: "path",
    status: "documented",
    defaultValue: "debugs/llm-cache",
    description: "Documented dev LLM replay cache directory.",
  },
  {
    name: "COVEL_ALLOWED_LLM_HOSTS",
    group: "ai",
    type: "string",
    status: "documented",
    description: "Documented custom LLM host allowlist.",
  },
  {
    name: "COVEL_COMPACTOR_CONTEXT_WINDOW",
    group: "feature",
    type: "integer",
    status: "active",
    defaultValue: "32768",
    description: "Compactor context window used for threshold comparisons.",
  },
  {
    name: "COVEL_TRACE_TRUNCATE",
    group: "feature",
    type: "boolean",
    status: "planned",
    defaultValue: "false",
    description: "Planned trace payload truncation switch.",
  },
  {
    name: "RUNTIME_HOST",
    group: "web",
    type: "string",
    status: "active",
    defaultValue: "127.0.0.1",
    description: "Vite dev proxy target host for server API calls.",
  },
  {
    name: "RUNTIME_PORT",
    group: "web",
    type: "integer",
    status: "active",
    defaultValue: "3001",
    description: "Vite dev proxy target port for server API calls.",
  },
  {
    name: "VITE_API_URL",
    group: "web",
    type: "url",
    status: "documented",
    description: "Typed browser env placeholder from vite-env.d.ts.",
  },
  {
    name: "VITE_ROUTER_DEVTOOLS",
    group: "web",
    type: "boolean",
    status: "active",
    defaultValue: "true",
    description:
      "Toggles the TanStack Router devtools floating button in dev. Defaults on; set to false to hide.",
  },
  {
    name: "E2E_BASE_URL",
    group: "test",
    type: "url",
    status: "active",
    defaultValue: "http://localhost:3001",
    description: "Playwright base URL override.",
  },
  {
    name: "E2E_MODEL_SLOT",
    group: "test",
    type: "string",
    status: "active",
    defaultValue: "e2e",
    description: "Model slot used by the e2e plugin verification script.",
  },
  {
    name: "CI",
    group: "test",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "CI mode for lint and Playwright behavior.",
  },
  {
    name: "LIVE_LLM_ENABLED",
    group: "test",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Enables live LLM provider tests.",
  },
  {
    name: "LIVE_IMAGE_ENABLED",
    group: "test",
    type: "boolean",
    status: "active",
    defaultValue: "false",
    description: "Enables live image-generation provider tests.",
  },
  {
    name: "BASE_URL",
    group: "test",
    type: "url",
    status: "active",
    defaultValue: "http://localhost:5173",
    description: "README screenshot script frontend URL.",
  },
  {
    name: "SESSION_ID",
    group: "test",
    type: "string",
    status: "active",
    description: "README screenshot script session id.",
  },
  {
    name: "COVEL_PG_PREFLIGHT_HOST",
    group: "test",
    type: "string",
    status: "active",
    defaultValue: "127.0.0.1",
    description: "dev:pg TCP preflight target host.",
  },
  {
    name: "COVEL_PG_PREFLIGHT_PORT",
    group: "test",
    type: "integer",
    status: "active",
    defaultValue: "5432",
    description: "dev:pg TCP preflight target port.",
  },
  {
    name: "COVEL_PG_PREFLIGHT_SKIP",
    group: "test",
    type: "boolean",
    status: "documented",
    defaultValue: "false",
    description: "Documented dev:pg preflight bypass flag.",
  },
  {
    name: "COVEL_STORY_BASE_URL",
    group: "test",
    type: "url",
    status: "documented",
    description: "Documented story LLM endpoint override for e2e tests.",
  },
  {
    name: "COVEL_PLUGIN_BASE_URL",
    group: "test",
    type: "url",
    status: "documented",
    description: "Documented plugin LLM endpoint override for e2e tests.",
  },
  {
    name: "CSC_LINK",
    group: "packaging",
    type: "secret",
    status: "packaging",
    secret: true,
    description: "electron-builder code-signing certificate path or URL.",
  },
  {
    name: "CSC_KEY_PASSWORD",
    group: "packaging",
    type: "secret",
    status: "packaging",
    secret: true,
    description: "electron-builder code-signing certificate password.",
  },
  {
    name: "WIN_CSC_TIMESTAMP_SERVER",
    group: "packaging",
    type: "url",
    status: "packaging",
    defaultValue: "http://timestamp.digicert.com",
    description: "Windows signing timestamp server.",
  },
  {
    name: "APPLE_ID",
    group: "packaging",
    type: "secret",
    status: "packaging",
    secret: true,
    description: "Apple Developer account for notarization.",
  },
  {
    name: "APPLE_APP_SPECIFIC_PASSWORD",
    group: "packaging",
    type: "secret",
    status: "packaging",
    secret: true,
    description: "electron-builder Apple notarization app-specific password.",
  },
  {
    name: "APPLE_TEAM_ID",
    group: "packaging",
    type: "string",
    status: "packaging",
    description: "Apple Developer Team ID.",
  },
] as const satisfies readonly EnvVarDefinition[];

export type CovelEnvName = (typeof COVEL_ENV_REGISTRY)[number]["name"];

export const COVEL_FEATURE_FLAGS = ["COVEL_LLM_RETRY_DISABLED"] as const;

export type CovelFeatureFlag = (typeof COVEL_FEATURE_FLAGS)[number];
