export default () => ({
  app: {
    port: parseInt(process.env.APP_PORT || '3002', 10),
    env: process.env.APP_ENV || 'development',
  },
  database: {
    url: process.env.DATABASE_URL,
  },
  security: {
    serviceJwtSecret: process.env.SERVICE_JWT_SECRET,
    allowedServices: (process.env.ALLOWED_SERVICES || 'identity-service,recovery-service')
      .split(',')
      .map((s) => s.trim()),
  },
  encryption: {
    key: process.env.BACKUP_ENCRYPTION_KEY,
    keyId: process.env.BACKUP_ENCRYPTION_KEY_ID || 'key-v1',
  },
  rateLimit: {
    maxRetrievePerDay: parseInt(process.env.MAX_RETRIEVE_PER_DAY || '3', 10),
    maxStorePerMinute: parseInt(process.env.MAX_STORE_PER_MINUTE || '10', 10),
  },
  audit: {
    logRetentionDays: parseInt(process.env.AUDIT_LOG_RETENTION_DAYS || '365', 10),
  },
  monitoring: {
    prometheusEnabled: process.env.PROMETHEUS_ENABLED === 'true',
    prometheusPort: parseInt(process.env.PROMETHEUS_PORT || '9102', 10),
  },
});