const HeaderAndApp = (name, port, baseUrl, appKey) => [
    '# ZinTrust — Project Environment (.env)',
    '#',
    '# Generated by: zin new / ProjectScaffolder',
    '#',
    '# Notes:',
    '# - No ${VAR} interpolation: compatible with standard Node dotenv behavior.',
    '# - Secrets are intentionally empty unless auto-generated (APP_KEY).',
    '# - For the complete key list (auto-generated), see: -envexample.generated',
    '',
    '# ============================================================================',
    '# APP',
    '# ============================================================================',
    '',
    'NODE_ENV=development',
    `APP_NAME=${name}`,
    'HOST=localhost',
    `PORT=${port}`,
    `BASE_URL=${baseUrl}`,
    '',
    '# Runtime override (optional): auto | nodejs | cloudflare | deno | lambda',
    'RUNTIME=',
    '',
    'DEBUG=true',
    'METRICS_ENABLED=false',
    '',
    '# Cloudflare Workers (TCP sockets) — set true if using TCP adapters on Workers.',
    'ENABLE_CLOUDFLARE_SOCKETS=false',
    '',
    '# CLI / tooling',
    'ZINTRUST_RUN_FROM_SOURCE=0',
    'ZINTRUST_VERSION_CHECK=true',
    'ZINTRUST_VERSION_CHECK_INTERVAL=24',
    'ZINTRUST_CLI_DEBUG_ARGS=0',
    '',
    '# Optional debug output (local only)',
    'ZIN_DEBUG_VALIDATION_BODY=false',
    'ZIN_DEBUG_BODY_PARSING=false',
    'ZIN_DEBUG_FILE_UPLOAD=false',
    '',
    '# ============================================================================',
    '# STARTUP (boot-time checks)',
    '# ============================================================================',
    '',
    'STARTUP_HEALTH_CHECKS=true',
    'STARTUP_VALIDATE_SECRETS=true',
    '',
    '# Strict required-env validation. Recommended for new projects.',
    'STARTUP_REQUIRE_ENV=true',
    '',
    'STARTUP_CHECK_DB=false',
    'STARTUP_CHECK_CACHE=false',
    'STARTUP_HEALTH_TIMEOUT_MS=2500',
    'STARTUP_CONTINUE_ON_FAILURE=false',
    '',
    '# ============================================================================',
    '# SECURITY (keys, auth, headers)',
    '# ============================================================================',
    '',
    '# Auto-generated secure APP_KEY for encryption interoperability (32 bytes, base64).',
    `APP_KEY=${appKey}`,
    '',
];
const SecurityAndDeployment = () => [
    '# Optional: key rotation support (comma-separated OR JSON array of base64 keys)',
    'APP_PREVIOUS_KEYS=',
    '',
    '# Supported: aes-256-cbc | aes-256-gcm',
    'ENCRYPTION_CIPHER=aes-256-cbc',
    '',
    'JWT_ENABLED=true',
    '# If empty, JWT uses APP_KEY in dev. For production, set a dedicated JWT_SECRET.',
    'JWT_SECRET=',
    'JWT_ALGORITHM=HS256',
    'JWT_EXPIRES_IN=3600',
    'JWT_REFRESH_EXPIRES_IN=7d',
    'JWT_ISSUER=zintrust',
    'JWT_AUDIENCE=zintrust-api',
    '',
    'API_KEY_ENABLED=false',
    'API_KEY_HEADER=x-api-key',
    'API_KEY_SECRET=',
    '',
    'CSRF_ENABLED=true',
    'CSRF_HEADER_NAME=x-csrf-token',
    'CSRF_TOKEN_NAME=_csrf',
    'CSRF_COOKIE_NAME=XSRF-TOKEN',
    'CSRF_COOKIE_SECURE=false',
    'CSRF_COOKIE_HTTP_ONLY=true',
    'CSRF_COOKIE_SAME_SITE=lax',
    'CSRF_SKIP_PATHS=/api/*,/queue-monitor/*,/api/_sys/queue/*,/api/_sys/schedule/*',
    '',
    'CORS_ENABLED=true',
    'CORS_ORIGINS=*',
    'CORS_METHODS=GET,POST,PUT,PATCH,DELETE',
    'CORS_ALLOWED_HEADERS=Content-Type,Authorization',
    'CORS_EXPOSED_HEADERS=',
    'CORS_CREDENTIALS=false',
    'CORS_MAX_AGE=86400',
    '',
    'RATE_LIMIT_ENABLED=true',
    'RATE_LIMIT_WINDOW_MS=900000',
    'RATE_LIMIT_MAX_REQUESTS=100',
    'RATE_LIMIT_MESSAGE=Too many requests, please try again later',
    '',
    'HELMET_ENABLED=true',
    'CSP_ENABLED=false',
    'HSTS_ENABLED=false',
    'HSTS_MAX_AGE=31536000',
    'HSTS_INCLUDE_SUBDOMAINS=true',
    'XSS_ENABLED=true',
    'XSS_REPORT_URI=',
    '',
    'SESSION_NAME=zintrust_session',
    'SESSION_SECRET=',
    'SESSION_EXPIRES_IN=1800000',
    'SESSION_SECURE=false',
    'SESSION_HTTP_ONLY=true',
    'SESSION_SAME_SITE=lax',
    '',
    'PASSWORD_MIN_LENGTH=8',
    'PASSWORD_REQUIRE_UPPERCASE=true',
    'PASSWORD_REQUIRE_NUMBERS=true',
    'PASSWORD_REQUIRE_SPECIAL_CHARS=true',
    'BCRYPT_ROUNDS=10',
    '',
    '# ============================================================================',
    '# DEPLOYMENT / LIMITS',
    '# ============================================================================',
    '',
    'ENVIRONMENT=development',
    'REQUEST_TIMEOUT=30000',
    'APP_TIMEZONE=UTC',
    'MAX_BODY_SIZE=10485760',
    'SHUTDOWN_TIMEOUT=10000',
    '',
];
const DatabaseAndCloudflare = (databaseNormalized, dbLines, sqliteDbPath) => [
    '# ============================================================================',
    '# DATABASE',
    '# ============================================================================',
    '',
    '# Options: sqlite | postgresql | mysql | sqlserver | d1 | d1-remote',
    `DB_CONNECTION=${databaseNormalized}`,
    '',
    ...(databaseNormalized === 'sqlite' ? [`DB_PATH=${sqliteDbPath}`, ''] : []),
    ...dbLines,
    '',
    '# Generic SQL defaults (used by some adapters)',
    '',
    '# PostgreSQL (optional)',
    'DB_PORT_POSTGRESQL=5432',
    'DB_DATABASE_POSTGRESQL=postgres',
    'DB_USERNAME_POSTGRESQL=postgres',
    'DB_PASSWORD_POSTGRESQL=',
    'DB_READ_HOSTS_POSTGRESQL=',
    '',
    '# SQL Server (MSSQL) (optional)',
    'DB_HOST_MSSQL=localhost',
    'DB_PORT_MSSQL=1433',
    'DB_DATABASE_MSSQL=zintrust',
    'DB_USERNAME_MSSQL=sa',
    'DB_PASSWORD_MSSQL=',
    'DB_READ_HOSTS_MSSQL=',
    '',
    '# Pooling / logging (optional)',
    'DB_POOLING=true',
    'DB_POOL_MIN=5',
    'DB_POOL_MAX=20',
    'DB_IDLE_TIMEOUT=30000',
    'DB_CONNECTION_TIMEOUT=10000',
    'DB_SSL=false',
    'DB_LOG_QUERIES=false',
    'DB_LOG_LEVEL=info',
    'DB_MIGRATION_EXT=ts',
    '',
    '# ============================================================================',
    '# CLOUDFLARE (D1 / KV)',
    '# ============================================================================',
    '',
    'D1_DATABASE_ID=',
    'KV_NAMESPACE_ID=',
    '',
    '# Remote D1 (outside Cloudflare) via proxy',
    'D1_REMOTE_URL=',
    'D1_REMOTE_KEY_ID=',
    'D1_REMOTE_SECRET=',
    'D1_REMOTE_MODE=registry',
    '',
    '# Remote KV (outside Cloudflare) via proxy',
    'KV_REMOTE_URL=',
    'KV_REMOTE_KEY_ID=',
    'KV_REMOTE_SECRET=',
    'KV_REMOTE_NAMESPACE=',
    '',
    '# Cloudflare API (only needed for CLI provisioning)',
    'CLOUDFLARE_ACCOUNT_ID=',
    'CLOUDFLARE_API_TOKEN=',
    'CLOUDFLARE_KV_NAMESPACE_ID=',
    '',
];
const HttpProxies = () => [
    '# ============================================================================',
    '# HTTP PROXIES (for Workers compatibility)',
    '# ============================================================================',
    '',
    'ZT_PROXY_TIMEOUT_MS=30000',
    'ZT_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_MYSQL_PROXY=false',
    'MYSQL_PROXY_URL=',
    'MYSQL_PROXY_HOST=127.0.0.1',
    'MYSQL_PROXY_PORT=8789',
    'MYSQL_PROXY_MAX_BODY_BYTES=131072',
    'MYSQL_PROXY_POOL_LIMIT=10',
    'MYSQL_PROXY_KEY_ID=',
    'MYSQL_PROXY_SECRET=',
    'MYSQL_PROXY_TIMEOUT_MS=30000',
    'MYSQL_PROXY_REQUIRE_SIGNING=true',
    'MYSQL_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_POSTGRES_PROXY=false',
    'POSTGRES_PROXY_URL=',
    'POSTGRES_PROXY_HOST=127.0.0.1',
    'POSTGRES_PROXY_PORT=8790',
    'POSTGRES_PROXY_MAX_BODY_BYTES=131072',
    'POSTGRES_PROXY_POOL_LIMIT=10',
    'POSTGRES_PROXY_KEY_ID=',
    'POSTGRES_PROXY_SECRET=',
    'POSTGRES_PROXY_TIMEOUT_MS=30000',
    'POSTGRES_PROXY_REQUIRE_SIGNING=true',
    'POSTGRES_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_REDIS_PROXY=false',
    'REDIS_PROXY_URL=',
    'REDIS_PROXY_HOST=127.0.0.1',
    'REDIS_PROXY_PORT=8791',
    'REDIS_PROXY_MAX_BODY_BYTES=131072',
    'REDIS_PROXY_KEY_ID=',
    'REDIS_PROXY_SECRET=',
    'REDIS_PROXY_TIMEOUT_MS=30000',
    'REDIS_PROXY_REQUIRE_SIGNING=true',
    'REDIS_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_SMTP_PROXY=false',
    'SMTP_PROXY_URL=',
    'SMTP_PROXY_HOST=127.0.0.1',
    'SMTP_PROXY_PORT=8794',
    'SMTP_PROXY_MAX_BODY_BYTES=131072',
    'SMTP_PROXY_KEY_ID=',
    'SMTP_PROXY_SECRET=',
    'SMTP_PROXY_TIMEOUT_MS=30000',
    'SMTP_PROXY_REQUIRE_SIGNING=true',
    'SMTP_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_MONGODB_PROXY=false',
    'MONGODB_PROXY_URL=',
    'MONGODB_PROXY_HOST=127.0.0.1',
    'MONGODB_PROXY_PORT=8792',
    'MONGODB_PROXY_MAX_BODY_BYTES=131072',
    'MONGODB_PROXY_KEY_ID=',
    'MONGODB_PROXY_SECRET=',
    'MONGODB_PROXY_TIMEOUT_MS=30000',
    'MONGODB_PROXY_REQUIRE_SIGNING=true',
    'MONGODB_PROXY_SIGNING_WINDOW_MS=60000',
    '',
    'USE_SQLSERVER_PROXY=false',
    'SQLSERVER_PROXY_URL=',
    'SQLSERVER_PROXY_HOST=127.0.0.1',
    'SQLSERVER_PROXY_PORT=8793',
    'SQLSERVER_PROXY_MAX_BODY_BYTES=131072',
    'SQLSERVER_PROXY_POOL_LIMIT=10',
    'SQLSERVER_PROXY_KEY_ID=',
    'SQLSERVER_PROXY_SECRET=',
    'SQLSERVER_PROXY_TIMEOUT_MS=30000',
    'SQLSERVER_PROXY_REQUIRE_SIGNING=true',
    'SQLSERVER_PROXY_SIGNING_WINDOW_MS=60000',
    '',
];
const CacheAndRedis = () => [
    '# ============================================================================',
    '# CACHE / REDIS',
    '# ============================================================================',
    '',
    'CACHE_DRIVER=memory',
    'CACHE_CONNECTION=',
    'CACHE_KEY_PREFIX=zintrust:',
    '',
    'CACHE_MEMORY_TTL=3600',
    'CACHE_REDIS_TTL=3600',
    'CACHE_MONGO_TTL=3600',
    'CACHE_KV_TTL=3600',
    '',
    'REDIS_HOST=localhost',
    'REDIS_PORT=6379',
    'REDIS_PASSWORD=',
    'REDIS_DB=0',
    'REDIS_QUEUE_DB=1',
    'REDIS_URL=',
    '',
    'REDIS_HTTPS_ENDPOINT=',
    'REDIS_HTTPS_TOKEN=',
    '',
    'MONGO_URI=',
    'MONGO_DB=zintrust_cache',
    '',
];
const QueueConfig = () => [
    '# ============================================================================',
    '# QUEUE',
    '# ============================================================================',
    '',
    '# Options: sync | memory | database | redis | rabbitmq | sqs',
    'QUEUE_DRIVER=sync',
    'QUEUE_CONNECTION=',
    '',
    'QUEUE_TABLE=jobs',
    'QUEUE_DB_CONNECTION=default',
    '',
    'FAILED_JOBS_DB_CONNECTION=default',
    'FAILED_JOBS_TABLE=failed_jobs',
    '',
    'QUEUE_JOB_TIMEOUT=60',
    'QUEUE_JOB_RETRIES=3',
    'QUEUE_JOB_BACKOFF=0',
    'QUEUE_WORKERS=1',
    'QUEUE_MEMORY_TTL=3600000',
    '',
    'QUEUE_MONITOR_ENABLED=true',
    'QUEUE_MONITOR_BASE_PATH=/queue-monitor',
    'QUEUE_MONITOR_MIDDLEWARE=',
    'QUEUE_MONITOR_AUTO_REFRESH=true',
    'QUEUE_MONITOR_REFRESH_MS=5000',
    '',
    'QUEUE_HTTP_PROXY_ENABLED=false',
    'QUEUE_HTTP_PROXY_GATEWAY_ENABLED=true',
    'QUEUE_HTTP_PROXY_URL=',
    'QUEUE_HTTP_PROXY_PATH=/api/_sys/queue/rpc',
    'QUEUE_HTTP_PROXY_KEY_ID=',
    'QUEUE_HTTP_PROXY_KEY=',
    'QUEUE_HTTP_PROXY_TIMEOUT_MS=30000',
    'QUEUE_HTTP_PROXY_MAX_SKEW_MS=60000',
    'QUEUE_HTTP_PROXY_NONCE_TTL_MS=120000',
    'QUEUE_HTTP_PROXY_MIDDLEWARE=',
    '',
];
const WorkersSchedulingAndSSE = () => [
    '# ============================================================================',
    '# WORKERS / SCHEDULER',
    '# ============================================================================',
    '',
    'WORKER_ENABLED=false',
    'WORKER_AUTO_START=false',
    'WORKER_CONCURRENCY=5',
    'WORKER_TIMEOUT=60',
    'WORKER_RETRIES=3',
    'WORKER_PRIORITY=1',
    'WORKER_HEALTH_CHECK_INTERVAL=60',
    'WORKER_CLUSTER_MODE=false',
    'WORKER_REGION=us-east-1',
    '',
    'WORKER_PERSISTENCE_DRIVER=memory',
    'WORKER_PERSISTENCE_TABLE=zintrust_workers',
    'WORKER_PERSISTENCE_DB_CONNECTION=default',
    'WORKER_PERSISTENCE_REDIS_DB=',
    'WORKER_PERSISTENCE_REDIS_KEY_PREFIX=',
    '',
    'WORKER_SHUTDOWN_ON_APP_EXIT=true',
    '',
    'SCHEDULES_ENABLED=false',
    'SCHEDULE_SHUTDOWN_TIMEOUT_MS=30000',
    'SCHEDULE_OVERLAP_LOCK_TTL_MS=300000',
    'SCHEDULE_OVERLAP_LOCK_ACQUIRE_TIMEOUT_MS=2000',
    '',
    'SCHEDULE_LEADER_ENABLED=false',
    'SCHEDULE_LEADER_LOCK_PROVIDER=redis',
    'SCHEDULE_LEADER_LOCK_KEY=scheduler:leader',
    'SCHEDULE_LEADER_LOCK_TTL_MS=30000',
    'SCHEDULE_LEADER_LOCK_RENEW_MS=15000',
    'SCHEDULE_LEADER_LOCK_RETRY_MS=5000',
    'SCHEDULE_LEADER_LOCK_ACQUIRE_TIMEOUT_MS=2000',
    '',
    'SCHEDULE_HTTP_PROXY_PATH=/api/_sys/schedule/rpc',
    'SCHEDULE_HTTP_PROXY_KEY_ID=',
    'SCHEDULE_HTTP_PROXY_KEY=',
    'SCHEDULE_HTTP_PROXY_MAX_SKEW_MS=60000',
    'SCHEDULE_HTTP_PROXY_NONCE_TTL_MS=120000',
    'SCHEDULE_HTTP_PROXY_MIDDLEWARE=',
    '',
    'JOB_TRACKING_CLEANUP_ENABLED=false',
    'JOB_TRACKING_CLEANUP_INTERVAL_MS=21600000',
    'JOB_TRACKING_CLEANUP_RETENTION_DAYS=30',
    'JOB_TRACKING_CLEANUP_RETENTION_HOURS=',
    'JOB_TRACKING_CLEANUP_BATCH_SIZE=5000',
    'JOB_TRACKING_CLEANUP_MAX_BATCHES=1',
    'JOB_TRACKING_CLEANUP_LOCK_PROVIDER=redis',
    '',
    '# ============================================================================',
    '# SSE',
    '# ============================================================================',
    '',
    'SSE_HEARTBEAT_INTERVAL=15000',
    'SSE_SNAPSHOT_INTERVAL=5000',
    '',
];
const LoggingAndMail = () => [
    '# ============================================================================',
    '# LOGGING',
    '# ============================================================================',
    '',
    'LOG_LEVEL=debug',
    'LOG_FORMAT=text',
    'LOG_CHANNEL=file',
    'DISABLE_LOGGING=false',
    'LOG_HTTP_REQUEST=false',
    'LOG_TO_FILE=false',
    'LOG_ROTATION_SIZE=10485760',
    'LOG_ROTATION_DAYS=7',
    'DOCKER_WORKER=false',
    '',
    '# ============================================================================',
    '# MAIL',
    '# ============================================================================',
    '',
    'MAIL_DRIVER=disabled',
    'MAIL_CONNECTION=',
    'MAIL_FROM_ADDRESS=',
    'MAIL_FROM_NAME=',
    'MAIL_HOST=',
    'MAIL_PORT=587',
    'MAIL_USERNAME=',
    'MAIL_PASSWORD',
    'MAIL_SECURE=starttls',
    'SENDGRID_API_KEY=',
    'MAILGUN_API_KEY=',
    'MAILGUN_DOMAIN=',
    'MAILGUN_BASE_URL=https://api.mailgun.net',
    '',
];
const StorageAndBroadcast = () => [
    '# ============================================================================',
    '# STORAGE',
    '# ============================================================================',
    '',
    'STORAGE_CONNECTION=local',
    'STORAGE_PATH=storage',
    'STORAGE_URL=/storage',
    'STORAGE_VISIBILITY=private',
    'TEMP_PATH=storage/temp',
    'TEMP_FILE_MAX_AGE=86400',
    'MAX_UPLOAD_SIZE=100mb',
    'ALLOWED_UPLOAD_MIMES=jpg,jpeg,png,pdf,doc,docx',
    'UPLOADS_PATH=storage/uploads',
    'BACKUP_DRIVER=s3',
    'BACKUPS_PATH=storage/backups',
    '',
    'AWS_REGION=us-east-1',
    'AWS_DEFAULT_REGION=',
    'AWS_ACCESS_KEY_ID=',
    'AWS_SECRET_ACCESS_KEY=',
    'AWS_SESSION_TOKEN=',
    'AWS_S3_BUCKET=',
    'AWS_S3_ENDPOINT=',
    'AWS_S3_URL=',
    'AWS_S3_USE_PATH_STYLE_URL=false',
    'AWS_SQS_QUEUE_URL=',
    '',
    'R2_ACCESS_KEY_ID=',
    'R2_SECRET_ACCESS_KEY=',
    'R2_REGION=',
    'R2_BUCKET=',
    'R2_ENDPOINT=',
    'R2_URL=',
    'R2_BINDING=',
    '',
    'GCS_PROJECT_ID=',
    'GCS_KEY_FILE=',
    'GCS_BUCKET=',
    'GCS_URL=',
    '',
    '# ============================================================================',
    '# BROADCAST',
    '# ============================================================================',
    '',
    'BROADCAST_CONNECTION=inmemory',
    'PUSHER_APP_ID=',
    'PUSHER_APP_KEY=',
    'PUSHER_APP_SECRET=',
    'PUSHER_APP_CLUSTER=',
    'PUSHER_USE_TLS=true',
    'BROADCAST_REDIS_HOST=',
    'BROADCAST_REDIS_PORT=',
    'BROADCAST_REDIS_PASSWORD=',
    'BROADCAST_CHANNEL_PREFIX=broadcast:',
    '',
];
const NotificationsAndObservability = () => [
    '# ============================================================================',
    '# NOTIFICATIONS',
    '# ============================================================================',
    '',
    'NOTIFICATION_CONNECTION=console',
    'TERMII_API_KEY=',
    'TERMII_SENDER=ZinTrust',
    'TERMII_ENDPOINT=https://api.termii.com/sms/send',
    'TWILIO_ACCOUNT_SID=',
    'TWILIO_AUTH_TOKEN=',
    'TWILIO_FROM_NUMBER=',
    'SLACK_WEBHOOK_URL=',
    '',
    '# ============================================================================',
    '# OBSERVABILITY (optional)',
    '# ============================================================================',
    '',
    'OTEL_ENABLED=false',
    'OTEL_EXPORTER_OTLP_ENDPOINT=',
    'TRACING_EXPORT_INTERVAL=',
    'JAEGER_AGENT_HOST=',
    '',
    '# ============================================================================',
    '# CI / SCANNING (optional)',
    '# ============================================================================',
    '',
    'SNYK_TOKEN=',
    'SONAR_ORGANIZATION=',
    'SONAR_PROJECT_ID=',
    'SONAR_HOST_URL=',
    'SONAR_TOKEN=',
    'CODECOV_TOKEN=',
    '',
];
export const EnvData = (name, port, baseUrl, appKey, databaseNormalized, dbLines, sqliteDbPath) => [
    ...HeaderAndApp(name, port, baseUrl, appKey),
    ...SecurityAndDeployment(),
    ...DatabaseAndCloudflare(databaseNormalized, dbLines, sqliteDbPath),
    ...HttpProxies(),
    ...CacheAndRedis(),
    ...QueueConfig(),
    ...WorkersSchedulingAndSSE(),
    ...LoggingAndMail(),
    ...StorageAndBroadcast(),
    ...NotificationsAndObservability(),
];
