/**
 * CLI-only env accessors for db seed scripts (tsx / pnpm db:seed*).
 * Uses bracket notation — the only place seed tooling reads process env.
 */

export type SeedCliEnv = {
  DATABASE_URL: string;
  PII_KEY: string;
  PASSWORD_PEPPER_V1: string;
};

export function readSeedCliEnv(): SeedCliEnv {
  const DATABASE_URL = process.env['DATABASE_URL'];
  const PII_KEY = process.env['PII_KEY'];
  const PASSWORD_PEPPER_V1 = process.env['PASSWORD_PEPPER_V1'];
  if (!DATABASE_URL || !PII_KEY || !PASSWORD_PEPPER_V1) {
    throw new Error('DATABASE_URL, PII_KEY and PASSWORD_PEPPER_V1 required');
  }
  return { DATABASE_URL, PII_KEY, PASSWORD_PEPPER_V1 };
}

export function readSeedDatabaseUrl(): string {
  const DATABASE_URL = process.env['DATABASE_URL'];
  if (!DATABASE_URL) throw new Error('DATABASE_URL env var required');
  return DATABASE_URL;
}

export function readSeedDemoGuardEnv(): { databaseUrl: string; confirm: string } {
  return {
    databaseUrl: process.env['DATABASE_URL'] ?? '',
    confirm: process.env['CONFIRM_DB_RESET'] ?? '',
  };
}

export function readSeedDemoRuntimeEnv(): SeedCliEnv {
  const DATABASE_URL = process.env['DATABASE_URL'];
  const PII_KEY = process.env['PII_KEY'];
  const PASSWORD_PEPPER_V1 = process.env['PASSWORD_PEPPER_V1'];
  if (!DATABASE_URL) throw new Error('DATABASE_URL env var required');
  if (!PII_KEY) throw new Error('PII_KEY env var required');
  if (!PASSWORD_PEPPER_V1) throw new Error('PASSWORD_PEPPER_V1 env var required');
  return { DATABASE_URL, PII_KEY, PASSWORD_PEPPER_V1 };
}

export function readOptionalAnthropicApiKey(): string | undefined {
  return process.env['ANTHROPIC_API_KEY'];
}