import { createEnv } from "@t3-oss/env-nextjs"
import { z } from "zod"

/**
 * Single source of truth for typed, validated environment variables.
 *
 * Validation runs at module-import time. Failures throw with a readable error
 * listing the offending keys, so Next.js fails the build fast instead of
 * starting a half-broken runtime. Force-evaluated by importing this file
 * from `next.config.mjs`.
 *
 * Adoption: KAR-522 Source 15 (@t3-oss/env-nextjs) + Source 1 (12-Factor III).
 * Existing per-domain loaders (e.g. `lib/supabase/privileged-env.ts`) keep
 * their stricter contracts; this schema covers the cross-cutting baseline.
 */
export const env = createEnv({
  server: {
    // Single-tenant: CONTROL_PLANE_SUPABASE_URL, CONTROL_PLANE_READONLY_KEY,
    // SUPABASE_MANAGEMENT_API_KEY, SUPABASE_ORGANIZATION_ID, VERCEL_API_TOKEN,
    // VERCEL_TEAM_ID, and OWNER_AUTO_PROVISION removed (2026-05-26).
    SUPABASE_SERVICE_ROLE_KEY: z.string().min(20),
    SENTRY_DSN: z.string().url().optional(),
    SENTRY_TRACES_SAMPLE_RATE: z
      .string()
      .regex(/^\d+(\.\d+)?$/)
      .optional(),
    UPSTASH_REDIS_REST_URL: z.string().url().optional(),
    UPSTASH_REDIS_REST_TOKEN: z.string().optional(),
    CSRF_ENABLED: z
      .union([z.literal("true"), z.literal("false")])
      .default("false"),
    DEMO_MODE_ENABLED: z
      .union([z.literal("true"), z.literal("false")])
      .default("false"),
  },
  client: {
    NEXT_PUBLIC_APP_ENV: z
      .enum(["development", "staging", "production"])
      .default("development"),
    NEXT_PUBLIC_SUPABASE_URL: z.string().url(),
    NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: z.string().min(20),
  },
  runtimeEnv: {
    SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY,
    SENTRY_DSN: process.env.SENTRY_DSN,
    SENTRY_TRACES_SAMPLE_RATE: process.env.SENTRY_TRACES_SAMPLE_RATE,
    UPSTASH_REDIS_REST_URL: process.env.UPSTASH_REDIS_REST_URL,
    UPSTASH_REDIS_REST_TOKEN: process.env.UPSTASH_REDIS_REST_TOKEN,
    CSRF_ENABLED: process.env.CSRF_ENABLED,
    DEMO_MODE_ENABLED: process.env.DEMO_MODE_ENABLED,
    NEXT_PUBLIC_APP_ENV: process.env.NEXT_PUBLIC_APP_ENV,
    NEXT_PUBLIC_SUPABASE_URL: process.env.NEXT_PUBLIC_SUPABASE_URL,
    NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY:
      process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY,
  },
  skipValidation:
    !!process.env.SKIP_ENV_VALIDATION ||
    process.env.npm_lifecycle_event === "lint" ||
    process.env.npm_lifecycle_event === "format",
  emptyStringAsUndefined: true,
})