/**
 * Runtime configuration for the secrets-controller binary.
 *
 * The controller is a small standalone Node service. It reads everything
 * from env vars and never mutates the runtime state — `loadConfig()` is
 * called once at startup and the result is passed down.
 */
function required(name) {
    const v = process.env[name];
    if (!v)
        throw new Error(`${name} is required`);
    return v;
}
export function loadConfig() {
    const parseInt10 = (v, fallback) => {
        if (!v)
            return fallback;
        const n = Number.parseInt(v, 10);
        if (Number.isNaN(n) || n <= 0) {
            throw new Error(`invalid numeric env value: ${v}`);
        }
        return n;
    };
    return {
        databaseUrl: required("DATABASE_URL"),
        dbNamespace: process.env.DB_NAMESPACE ?? "vetra-cloud-secrets",
        openbaoAddr: required("OPENBAO_ADDR"),
        transitRole: process.env.OPENBAO_TRANSIT_ROLE ?? "vetra-secrets-controller",
        transitKeyPrefix: process.env.OPENBAO_TRANSIT_KEY_PREFIX ?? "vetra-tenant-",
        fullReconcileIntervalMs: parseInt10(process.env.FULL_RECONCILE_INTERVAL_MS, 5 * 60 * 1000),
        healthPort: parseInt10(process.env.HEALTH_PORT, 8080),
        notifyChannel: process.env.NOTIFY_CHANNEL ?? "vetra_secrets_changed",
        managedLabelValue: "vetra-secrets-controller",
    };
}
