import { defineEnvVars } from '@sveltejs/kit/hooks';

// Default when the env var isn't set, so a missing value never crashes startup.
const withDefault = (value: string) =>
	({
		'~standard': {
			version: 1,
			vendor: 'famchamp',
			validate: (v: unknown) => ({ value: typeof v === 'string' && v ? v : value })
		}
	}) as const;

export const variables = defineEnvVars({
	SERVER_IP: { public: true, schema: withDefault('192.168.1.225') },
	// PB superuser creds (server-only).
	PB_EMAIL: { public: false, schema: withDefault('debug@famchamp.dev') },
	PB_PASSWORD: { public: false, schema: withDefault('debug123') },
	// Server-only secret used to derive a child member's PB password from
	// (famSlug + username). Never expose client-side. OTP is the access gate.
	MEMBER_SECRET: { public: false, schema: withDefault('famchamp-member-secret') },
	// Stripe (server-only). Keys left blank until a real account is connected.
	STRIPE_SECRET_KEY: { public: false, schema: withDefault('') },
	// Stripe webhook signing secret (prod/dashboard endpoint).
	STRIPE_WEBHOOK_SECRET: { public: false, schema: withDefault('') },
	// Stripe CLI webhook signing secret (local dev only — overrides the
	// dashboard secret when set, so `stripe listen` works without touching prod).
	STRIPE_CLI_WEBHOOK_SECRET: { public: false, schema: withDefault('') },
	STRIPE_PRICE_TRIAL: { public: false, schema: withDefault('') },
	STRIPE_PRICE_MONTHLY: { public: false, schema: withDefault('') },
	STRIPE_PRICE_YEARLY: { public: false, schema: withDefault('') },
	// Stripe publishable key (client-side for Checkout redirect).
	PUBLIC_STRIPE_PUBLISHABLE_KEY: { public: true, schema: withDefault('') },
	RESEND_API: { public: false, schema: withDefault('') }
});