const required = ["DATABASE_URL", "NEXT_PUBLIC_APP_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "S3_ENDPOINT", "S3_PUBLIC_ENDPOINT", "S3_BUCKET", "S3_ACCESS_KEY", "S3_SECRET_KEY", "EMAIL_FROM", "RESEND_API_KEY", "RESEND_WEBHOOK_SECRET"];
for (const name of required) if (!process.env[name]?.trim()) throw new Error(`Missing production setting: ${name}`);
for (const name of ["NEXT_PUBLIC_APP_URL","BETTER_AUTH_URL","S3_PUBLIC_ENDPOINT"]) if (new URL(process.env[name]!).protocol !== "https:") throw new Error(`${name} must use HTTPS`);
if (process.env.NEXT_PUBLIC_APP_URL !== process.env.BETTER_AUTH_URL) throw new Error("Public and auth URLs must match");
if (process.env.BETTER_AUTH_SECRET!.length < 32 || process.env.BETTER_AUTH_SECRET!.includes("development")) throw new Error("Use a strong random production auth secret");
if (process.env.EMAIL_PROVIDER !== "resend") throw new Error("Production Compose requires Resend");