/**
 * Master list of every env key the SDP API reads. The local development and
 * self-hosted Docker projections derive from it, so a key absent from this
 * list reaches neither surface.
 */
export const API_LOCAL_ENV_KEYS = [
  "DATABASE_URL",
  "REDIS_URL",
  "PUBLIC_API_ORIGIN",
  "DISABLE_CRON",
  "SENTRY_DSN",
  "SENTRY_TRACES_SAMPLE_RATE",
  "SDP_DEPLOYMENT_MODE",
  "CREDENTIAL_SECRET_STORE_BACKEND",
  "GCP_SECRET_MANAGER_PROJECT_ID",
  "GCP_SECRET_MANAGER_SECRET_PREFIX",
  "GCP_SECRET_MANAGER_API_BASE_URL",
  "API_KEY_PEPPER",
  "CREDENTIAL_FINGERPRINT_PEPPER",
  "CUSTODY_ENCRYPTION_KEY",
  "SPC_CREDENTIAL_ENCRYPTION_KEY",
  "COUNTERPARTY_PII_ENCRYPTION_KEY",
  "COUNTERPARTY_PII_KMS_KEY_NAME",
  "EMAIL_PROVIDER",
  "EMAIL_FROM",
  "RESEND_API_KEY",
  "FRONTEND_URL",
  "CLERK_ISSUER",
  "CLERK_JWKS_URL",
  "CLERK_SECRET_KEY",
  "CLERK_API_URL",
  "CLERK_WEBHOOK_SECRET",
  "ALLOWLIST_ADMIN_KEY",
  "ALLOWLIST_ADMIN_ORG_ID",
  "SOLANA_RPC_URL",
  "SOLANA_RPC_DEFAULT_PROVIDER",
  "SOLANA_RPC_TRITON_URL",
  "SOLANA_RPC_TRITON_API_KEY",
  "SOLANA_RPC_HELIUS_URL",
  "SOLANA_RPC_HELIUS_API_KEY",
  "SOLANA_RPC_ALCHEMY_URL",
  "SOLANA_RPC_ALCHEMY_API_KEY",
  "SOLANA_RPC_QUICKNODE_URL",
  "SOLANA_RPC_QUICKNODE_API_KEY",
  "SOLANA_RPC_VALIDATIONCLOUD_URL",
  "SOLANA_RPC_VALIDATIONCLOUD_API_KEY",
  "SOLANA_RPC_NODIT_URL",
  "SOLANA_RPC_NODIT_API_KEY",
  "SOLANA_NETWORK",
  "CUSTODY_PRIVATE_KEY",
  "SOLANA_MOCK",
  "RUN_INTEGRATION_TESTS",
  "ORGANIZATION_REGISTRATION_TOKEN",
  "SIGNING_PROVIDER",
  "FEE_PAYER_PRIVATE_KEY",
  "FIREBLOCKS_API_KEY",
  "FIREBLOCKS_API_SECRET",
  "FIREBLOCKS_VAULT_ID",
  "FIREBLOCKS_ASSET_ID",
  "FIREBLOCKS_API_BASE_URL",
  "PRIVY_APP_ID",
  "PRIVY_APP_SECRET",
  "PRIVY_BYOK_ENABLED",
  "PRIVY_WALLET_ID",
  "PRIVY_API_BASE_URL",
  "PRIVY_REQUEST_DELAY_MS",
  "COINBASE_CDP_API_KEY_ID",
  "COINBASE_CDP_API_KEY_SECRET",
  "COINBASE_CDP_WALLET_SECRET",
  "COINBASE_CDP_API_BASE_URL",
  "COINBASE_CDP_NETWORK",
  "COINBASE_CDP_WALLET_ID",
  "COINBASE_CDP_ACCOUNT_NAMESPACE",
  "PARA_API_KEY",
  "PARA_API_BASE_URL",
  "PARA_REQUEST_DELAY_MS",
  "PARA_WALLET_ID",
  "TURNKEY_API_PUBLIC_KEY",
  "TURNKEY_API_PRIVATE_KEY",
  "TURNKEY_ORGANIZATION_ID",
  "TURNKEY_API_BASE_URL",
  "TURNKEY_REQUEST_DELAY_MS",
  "TURNKEY_PRIVATE_KEY_ID",
  "TURNKEY_PUBLIC_KEY",
  "DFNS_AUTH_TOKEN",
  "DFNS_CREDENTIAL_ID",
  "DFNS_PRIVATE_KEY",
  "DFNS_API_BASE_URL",
  "DFNS_WALLET_ID",
  "IBM_HAVEN_AUTH_TOKEN",
  "IBM_HAVEN_CREDENTIAL_ID",
  "IBM_HAVEN_PRIVATE_KEY",
  "IBM_HAVEN_API_BASE_URL",
  "IBM_HAVEN_WALLET_ID",
  "ANCHORAGE_API_KEY",
  "ANCHORAGE_API_BASE_URL",
  "UTILA_SERVICE_ACCOUNT_EMAIL",
  "UTILA_SERVICE_ACCOUNT_PRIVATE_KEY",
  "UTILA_VAULT_ID",
  "UTILA_WALLET_ID",
  "UTILA_NETWORK",
  "UTILA_API_BASE_URL",
  "UTILA_POLL_INTERVAL_MS",
  "UTILA_MAX_POLL_ATTEMPTS",
  "UTILA_DESIGNATED_SIGNERS",
  "FEE_PAYMENT_PROVIDER",
  "KORA_RPC_URL",
  "KORA_API_KEY",
  "KORA_CLOUD_RUN_AUDIENCE",
  "KORA_TIMEOUT_MS",
  "MAGICBLOCK_PRIVATE_PAYMENTS_API_BASE_URL",
  "MAGICBLOCK_PRIVATE_PAYMENTS_AUTH_TOKEN",
  "MAGICBLOCK_PRIVATE_PAYMENTS_EPHEMERAL_RPC_URL",
  "PAYMENTS_RECURRING_COLLECTION_ENABLED",
  "PAYMENTS_RECURRING_COLLECTION_BATCH_SIZE",
  "PAYMENTS_RECURRING_COLLECTION_RETRY_AFTER_MINUTES",
  "PRIVATE_CHANNELS_ENABLED",
  "MOONPAY_API_KEY",
  "MOONPAY_SECRET_KEY",
  "MOONPAY_ONRAMP_URL",
  "MOONPAY_OFFRAMP_URL",
  "MOONPAY_SANDBOX_API_KEY",
  "MOONPAY_SANDBOX_SECRET_KEY",
  "MOONPAY_WEBHOOK_KEY",
  "MOONPAY_SANDBOX_WEBHOOK_KEY",
  "RANGE_API_KEY",
  "RANGE_API_BASE_URL",
  "ELLIPTIC_API_TOKEN",
  "ELLIPTIC_API_KEY",
  "ELLIPTIC_API_SECRET",
  "ELLIPTIC_API_BASE_URL",
  "TRM_API_KEY",
  "TRM_API_BASE_URL",
  "CHAINALYSIS_API_KEY",
  "CHAINALYSIS_API_BASE_URL",
  "LIGHTSPARK_GRID_CLIENT_ID",
  "LIGHTSPARK_GRID_CLIENT_SECRET",
  "LIGHTSPARK_GRID_WEBHOOK_PUBLIC_KEY",
  "LIGHTSPARK_GRID_SANDBOX_CLIENT_ID",
  "LIGHTSPARK_GRID_SANDBOX_CLIENT_SECRET",
  "LIGHTSPARK_GRID_SANDBOX_WEBHOOK_PUBLIC_KEY",
  "BVNK_HAWK_AUTH_ID",
  "BVNK_HAWK_SECRET_KEY",
  "BVNK_WALLET_ID",
  "BVNK_WEBHOOK_SECRET",
  "BVNK_API_BASE_URL",
  "BVNK_SIGNING_HOST",
  "PROXY_SHARED_SECRET",
  "BVNK_SANDBOX_HAWK_AUTH_ID",
  "BVNK_SANDBOX_HAWK_SECRET_KEY",
  "BVNK_SANDBOX_WALLET_ID",
  "BVNK_SANDBOX_WEBHOOK_SECRET",
  "MONEYGRAM_SANDBOX_PUBLIC_KEY",
  "MONEYGRAM_SANDBOX_SECRET_KEY",
  "MURAL_PAY_API_KEY",
  "MURAL_PAY_TRANSFER_API_KEY",
  "MURAL_PAY_WEBHOOK_PUBLIC_KEY",
  "MURAL_PAY_SANDBOX_API_KEY",
  "MURAL_PAY_SANDBOX_TRANSFER_API_KEY",
  "MURAL_PAY_SANDBOX_WEBHOOK_PUBLIC_KEY",
  "STRIPE_SECRET_KEY",
  "STRIPE_PUBLISHABLE_KEY",
  "STRIPE_WEBHOOK_SECRET",
  "MARKETS_ENABLED",
  "EARN_ENABLED",
  "VEDA_API_KEY",
  "VEDA_SANDBOX_API_KEY",
  "UPSHIFT_API_KEY",
  "UPSHIFT_SANDBOX_API_KEY",
  "PERENA_API_KEY",
  "PERENA_SANDBOX_API_KEY",
  "GROUND_API_KEY",
  "GROUND_SANDBOX_API_KEY",
  "GOOGLE_ADDRESS_COMPLETION_API_KEY",
];

/**
 * Keys supplied directly by Docker Compose or reserved for local tests, so
 * they must not be copied into the generated self-hosted Docker env file.
 */
const DOCKER_EXCLUDED_API_ENV_KEYS = new Set([
  "DATABASE_URL",
  "REDIS_URL",
  "SOLANA_MOCK",
  "RUN_INTEGRATION_TESTS",
]);

/**
 * Keys the self-hosted docker env file ships (project-secrets.mjs `docker`).
 * Connection URLs are composed by the stack itself, while test-only switches
 * remain local.
 */
export const DOCKER_ENV_KEYS = API_LOCAL_ENV_KEYS.filter(
  (key) => !DOCKER_EXCLUDED_API_ENV_KEYS.has(key)
);
