feat: add env.mjs for centralized env validation (t3-env)

Validates all required env vars at runtime with zod schemas.
Skips validation during build via SKIP_ENV_VALIDATION flag.
Replaces scattered process.env access with typed env imports.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/editor/env.mjs

@@ -0,0 +1,58 @@
+/**
+ * Environment variable validation for the editor app.
+ *
+ * This file validates that required environment variables are set at runtime.
+ * Variables are defined in the root .env file.
+ *
+ * @see https://env.t3.gg/docs/nextjs
+ */
+import { createEnv } from '@t3-oss/env-nextjs'
+import { z } from 'zod'
+
+export const env = createEnv({
+  /**
+   * Server-side environment variables (not exposed to client)
+   */
+  server: {
+    // Database
+    POSTGRES_URL: z.string().min(1),
+    SUPABASE_SERVICE_ROLE_KEY: z.string().min(1),
+
+    // Auth
+    BETTER_AUTH_SECRET: z.string().min(1),
+    GOOGLE_CLIENT_ID: z.string().optional(),
+    GOOGLE_CLIENT_SECRET: z.string().optional(),
+
+    // Email
+    RESEND_API_KEY: z.string().optional(),
+  },
+
+  /**
+   * Client-side environment variables (exposed to browser via NEXT_PUBLIC_)
+   */
+  client: {
+    NEXT_PUBLIC_SUPABASE_URL: z.string().min(1),
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: z.string().optional(),
+  },
+
+  /**
+   * Runtime values - pulls from process.env
+   */
+  runtimeEnv: {
+    // Server
+    POSTGRES_URL: process.env.POSTGRES_URL,
+    SUPABASE_SERVICE_ROLE_KEY: process.env.SUPABASE_SERVICE_ROLE_KEY,
+    BETTER_AUTH_SECRET: process.env.BETTER_AUTH_SECRET,
+    GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID,
+    GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET,
+    RESEND_API_KEY: process.env.RESEND_API_KEY,
+    // Client
+    NEXT_PUBLIC_SUPABASE_URL: process.env.NEXT_PUBLIC_SUPABASE_URL,
+    NEXT_PUBLIC_SUPABASE_ANON_KEY: process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+  },
+
+  /**
+   * Skip validation during build (env vars come from Vercel at runtime)
+   */
+  skipValidation: !!process.env.SKIP_ENV_VALIDATION,
+})

apps/editor/lib/auth.ts

@@ -1,19 +1,19 @@
 import { createAuth } from '@pascal-app/auth/server'
 import { db } from '@pascal-app/db'
 import { Resend } from 'resend'
+import { env } from '@/env.mjs'
 import { BASE_URL } from './utils'
 
 // Initialize Resend only if API key is available
-const resendApiKey = process.env.RESEND_API_KEY
-const resend = resendApiKey && resendApiKey.trim() !== '' ? new Resend(resendApiKey) : null
+const resend = env.RESEND_API_KEY ? new Resend(env.RESEND_API_KEY) : null
 
 export const auth = createAuth({
   db,
   appName: 'Pascal Editor',
   baseURL: BASE_URL,
-  secret: process.env.BETTER_AUTH_SECRET || 'build-placeholder-not-used-at-runtime',
-  googleClientId: process.env.GOOGLE_CLIENT_ID,
-  googleClientSecret: process.env.GOOGLE_CLIENT_SECRET,
+  secret: env.BETTER_AUTH_SECRET,
+  googleClientId: env.GOOGLE_CLIENT_ID,
+  googleClientSecret: env.GOOGLE_CLIENT_SECRET,
   sendMagicLink: async ({ email, url }) => {
     if (!resend) {
       console.log(`[DEV] Magic link for ${email}: ${url}`)

apps/editor/lib/supabase/server.ts

@@ -1,8 +1,6 @@
 import { createClient } from '@supabase/supabase-js'
 import type { SupabaseDatabase } from '@pascal-app/db'
-
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'https://placeholder.supabase.co'
-const supabaseServiceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || 'placeholder'
+import { env } from '@/env.mjs'
 
 /**
  * Supabase client for server-side use with service role key
@@ -10,8 +8,8 @@ const supabaseServiceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || 'placeho
  * Always filter by user_id to enforce permissions
  */
 export const supabaseAdmin = createClient<SupabaseDatabase>(
-  supabaseUrl,
-  supabaseServiceRoleKey,
+  env.NEXT_PUBLIC_SUPABASE_URL,
+  env.SUPABASE_SERVICE_ROLE_KEY,
   {
     auth: {
       persistSession: false,

apps/editor/package.json

@@ -31,6 +31,7 @@
     "@react-three/uikit-lucide": "^1.0.60",
     "@repo/ui": "*",
     "@supabase/supabase-js": "^2.95.3",
+    "@t3-oss/env-nextjs": "^0.13.10",
     "@tailwindcss/postcss": "^4.1.18",
     "@types/three": "^0.182.0",
     "@vercel/analytics": "^1.6.1",
@@ -48,7 +49,8 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "tailwind-merge": "^3.4.0",
-    "tailwindcss": "^4.1.18"
+    "tailwindcss": "^4.1.18",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@repo/typescript-config": "*",