fix: optimize environment variables for Netlify deployment

- Move Stripe price IDs to centralized config (lib/stripe/pricing-config.ts)
- Add SOCIAL_URLS and FEATURE_FLAGS constants with smart defaults
- Update payment API to use centralized pricing config
- Create comprehensive deployment guide (docs/NETLIFY_ENV_VARS.md)
- Add environment variable size validation script (npm run validate:env-size)
- Update .env.example with production categorization
- Enhance netlify.toml with deployment documentation
- Reduce Lambda env vars from 88 to 27 (~2.8KB)

Resolves AWS Lambda 4KB environment variable limit issue.
All 9 Stripe price IDs maintained (including ONECENT/PENNY discount codes).
Keeps Twilio, SendGrid, and Sentry services enabled.

See docs/NETLIFY_ENV_VARS.md for complete deployment instructions.

Author: apex-ai-net

.env.example

@@ -1,16 +1,34 @@
 # MentoLoop Environment Variables Template
 # Copy this file to .env.local for development
-# Use these variable names in Netlify Dashboard for production
+# 
+# ============================================
+# PRODUCTION DEPLOYMENT NOTES
+# ============================================
+# ✅ = Required in Netlify production environment
+# ⚙️ = Optional (has defaults, can be omitted)
+# 🧪 = Development/Testing only (DO NOT set in production)
+# 📦 = Build-time only (set in Netlify Build scope, not runtime)
+#
+# See docs/NETLIFY_ENV_VARS.md for complete deployment guide
+#
+# AWS Lambda has 4KB env var limit. We've optimized by:
+#   - Moving Stripe price IDs to lib/stripe/pricing-config.ts
+#   - NEXT_PUBLIC_* vars are baked into build, not needed at runtime
+#   - Removed test/dev variables from production
+#
+# Target: ~27 runtime variables in production
 
 # ============================================
-# AUTHENTICATION (Clerk)
+# ✅ AUTHENTICATION (Clerk) - REQUIRED
 # ============================================
+CLERK_SECRET_KEY=sk_test_YOUR_CLERK_SECRET_KEY  # ✅ Runtime required
+CLERK_JWT_ISSUER_DOMAIN=https://your-clerk-issuer.example.com  # ✅ Runtime required
+CLERK_WEBHOOK_SECRET=whsec_YOUR_WEBHOOK_SECRET  # ✅ Runtime required
+
+# 📦 Build-time only (set in Netlify Build environment, not runtime)
 NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_YOUR_CLERK_PUBLISHABLE_KEY
-CLERK_SECRET_KEY=sk_test_YOUR_CLERK_SECRET_KEY
-CLERK_JWT_ISSUER_DOMAIN=https://your-clerk-issuer.example.com
-CLERK_WEBHOOK_SECRET=whsec_YOUR_WEBHOOK_SECRET
 
-# Clerk URLs
+# 📦 Clerk URLs (baked into build)
 NEXT_PUBLIC_CLERK_SIGN_IN_URL=/sign-in
 NEXT_PUBLIC_CLERK_SIGN_UP_URL=/sign-up
 NEXT_PUBLIC_CLERK_SIGN_IN_FORCE_REDIRECT_URL=/dashboard
@@ -19,126 +37,155 @@ NEXT_PUBLIC_CLERK_SIGN_IN_FALLBACK_REDIRECT_URL=/dashboard
 NEXT_PUBLIC_CLERK_SIGN_UP_FALLBACK_REDIRECT_URL=/dashboard
 
 # ============================================
-# DATABASE (Supabase)
+# ✅ DATABASE (Supabase) - REQUIRED
 # ============================================
-SUPABASE_URL=https://YOUR_SUPABASE_PROJECT.supabase.co
-SUPABASE_SERVICE_ROLE_KEY=YOUR_SUPABASE_SERVICE_ROLE_KEY
-SUPABASE_ANON_KEY=YOUR_SUPABASE_ANON_KEY
+SUPABASE_URL=https://YOUR_SUPABASE_PROJECT.supabase.co  # ✅ Runtime required
+SUPABASE_SERVICE_ROLE_KEY=YOUR_SUPABASE_SERVICE_ROLE_KEY  # ✅ Runtime required
+SUPABASE_ANON_KEY=YOUR_SUPABASE_ANON_KEY  # ✅ Runtime required
+
+# 📦 Build-time only (baked into client bundle)
 NEXT_PUBLIC_SUPABASE_URL=https://YOUR_SUPABASE_PROJECT.supabase.co
 NEXT_PUBLIC_SUPABASE_ANON_KEY=YOUR_SUPABASE_ANON_KEY
+
+# ⚙️ Optional (defaults provided)
 SUPABASE_POOL_SIZE=10
 SUPABASE_SCHEMA=public
 
 # ============================================
-# AI SERVICES
+# ⚙️ AI SERVICES - OPTIONAL
 # ============================================
-OPENAI_API_KEY=sk-proj-YOUR_OPENAI_API_KEY
-GEMINI_API_KEY=YOUR_GEMINI_API_KEY
+OPENAI_API_KEY=sk-proj-YOUR_OPENAI_API_KEY  # ⚙️ Optional - for AI matching
+GEMINI_API_KEY=YOUR_GEMINI_API_KEY  # ⚙️ Optional - for AI matching
 
 # ============================================
-# PAYMENT PROCESSING (Stripe)
-# SECURITY: Price IDs are SERVER-SIDE ONLY
-# NEVER expose as NEXT_PUBLIC_* variables
+# ✅ PAYMENT PROCESSING (Stripe) - REQUIRED
 # ============================================
+# SECURITY: Price IDs are SERVER-SIDE ONLY via lib/stripe/pricing-config.ts
+# NEVER expose as NEXT_PUBLIC_* variables
+
+STRIPE_SECRET_KEY=sk_test_YOUR_STRIPE_SECRET_KEY  # ✅ Runtime required
+STRIPE_WEBHOOK_SECRET=whsec_YOUR_STRIPE_WEBHOOK_SECRET  # ✅ Runtime required
+
+# 📦 Build-time only (baked into client bundle)
 NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_YOUR_STRIPE_PUBLISHABLE_KEY
-STRIPE_SECRET_KEY=sk_test_YOUR_STRIPE_SECRET_KEY
-STRIPE_WEBHOOK_SECRET=whsec_YOUR_STRIPE_WEBHOOK_SECRET
-
-# Server-side Price IDs (NEVER prefix with NEXT_PUBLIC_)
-STRIPE_PRICE_ID_STARTER=price_starter_example
-STRIPE_PRICE_ID_CORE=price_core_example
-STRIPE_PRICE_ID_ADVANCED=price_advanced_example
-STRIPE_PRICE_ID_PRO=price_pro_example
-STRIPE_PRICE_ID_ELITE=price_elite_example
-STRIPE_PRICE_ID_PREMIUM=price_premium_example
-STRIPE_PRICE_ID_ALACARTE=price_alacarte_example
-STRIPE_PRICE_ID_ONECENT=price_penny_example
-STRIPE_PRICE_ID_PENNY=price_penny_example
+
+# ✅ Server-side Price IDs (accessed via lib/stripe/pricing-config.ts)
+STRIPE_PRICE_ID_STARTER=price_starter_example  # ✅ Required
+STRIPE_PRICE_ID_CORE=price_core_example  # ✅ Required
+STRIPE_PRICE_ID_ADVANCED=price_advanced_example  # ✅ Required
+STRIPE_PRICE_ID_PRO=price_pro_example  # ✅ Required
+STRIPE_PRICE_ID_ELITE=price_elite_example  # ✅ Required
+STRIPE_PRICE_ID_PREMIUM=price_premium_example  # ✅ Required
+STRIPE_PRICE_ID_ALACARTE=price_alacarte_example  # ✅ Required
+STRIPE_PRICE_ID_ONECENT=price_penny_example  # ✅ Required (discount code)
+STRIPE_PRICE_ID_PENNY=price_penny_example  # ✅ Required (discount code)
 
 # Preceptor payout configuration
 PRECEPTOR_PAYOUT_PERCENT=0.70
 
 # ============================================
-# COMMUNICATIONS
+# ✅ COMMUNICATIONS - REQUIRED
 # ============================================
 # Twilio (SMS)
-TWILIO_ACCOUNT_SID=YOUR_TWILIO_ACCOUNT_SID
-TWILIO_AUTH_TOKEN=YOUR_TWILIO_AUTH_TOKEN
-TWILIO_PHONE_NUMBER=+1YOUR_PHONE_NUMBER
+TWILIO_ACCOUNT_SID=YOUR_TWILIO_ACCOUNT_SID  # ✅ Runtime required
+TWILIO_AUTH_TOKEN=YOUR_TWILIO_AUTH_TOKEN  # ✅ Runtime required
+TWILIO_PHONE_NUMBER=+1YOUR_PHONE_NUMBER  # ✅ Runtime required
 
 # SendGrid (Email)
-SENDGRID_API_KEY=SG.YOUR_SENDGRID_API_KEY
-SENDGRID_FROM_EMAIL=support@mentoloop.com
-EMAIL_DOMAIN=mentoloop.com
+SENDGRID_API_KEY=SG.YOUR_SENDGRID_API_KEY  # ✅ Runtime required
+SENDGRID_FROM_EMAIL=support@mentoloop.com  # ✅ Runtime required
+EMAIL_DOMAIN=mentoloop.com  # ⚙️ Optional (defaults to mentoloop.com)
 
 # ============================================
-# APPLICATION SETTINGS
+# ✅ APPLICATION SETTINGS
 # ============================================
-NODE_ENV=production
+NODE_ENV=production  # ✅ Runtime required (set to 'production' in Netlify)
+
+# 📦 Build-time only (baked into client bundle)
 NEXT_PUBLIC_APP_URL=https://YOUR_DOMAIN.com
 NEXT_PUBLIC_API_URL=https://YOUR_DOMAIN.com/api
 NEXT_PUBLIC_EMAIL_DOMAIN=mentoloop.com
 NEXT_PUBLIC_ANALYTICS_ENDPOINT=https://YOUR_DOMAIN.com/api/analytics
 NEXT_PUBLIC_DATA_LAYER=supabase
 
 # ============================================
-# SECURITY SETTINGS
+# ✅ SECURITY SETTINGS
 # ============================================
-# CSRF Protection - Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-CSRF_SECRET_KEY=YOUR_64_CHARACTER_HEX_STRING_HERE
+# CSRF Protection - Generate with: openssl rand -base64 32
+CSRF_SECRET_KEY=YOUR_64_CHARACTER_HEX_STRING_HERE  # ✅ Runtime required (min 32 chars)
 
-# Rate Limiting (Upstash Redis)
+# ⚙️ Rate Limiting (Upstash Redis) - Optional, falls back to in-memory
 # Get credentials from: https://console.upstash.com/
-UPSTASH_REDIS_REST_URL=https://YOUR_UPSTASH_ENDPOINT.upstash.io
-UPSTASH_REDIS_REST_TOKEN=YOUR_UPSTASH_REST_TOKEN
+UPSTASH_REDIS_REST_URL=https://YOUR_UPSTASH_ENDPOINT.upstash.io  # ⚙️ Optional
+UPSTASH_REDIS_REST_TOKEN=YOUR_UPSTASH_REST_TOKEN  # ⚙️ Optional
 
-# Other Security Settings (Optional)
-ADMIN_SECRET=admin-secret-key
-ENABLE_SECURITY_HEADERS=true
+# ⚙️ Other Security Settings - Optional (defaults provided)
+ADMIN_SECRET=admin-secret-key  # ⚙️ Optional
+ENABLE_SECURITY_HEADERS=true  # ⚙️ Optional (defaults to true)
 
 # ============================================
-# FEATURE FLAGS (Optional)
+# ⚙️ FEATURE FLAGS - OPTIONAL (all default to true)
 # ============================================
-ENABLE_AI_MATCHING=true
-ENABLE_SMS_NOTIFICATIONS=true
-ENABLE_EMAIL_NOTIFICATIONS=true
-ENABLE_PAYMENT_PROCESSING=true
+# Only set these to 'false' to disable features
+ENABLE_AI_MATCHING=true  # ⚙️ Optional (defaults to true)
+ENABLE_SMS_NOTIFICATIONS=true  # ⚙️ Optional (defaults to true)
+ENABLE_EMAIL_NOTIFICATIONS=true  # ⚙️ Optional (defaults to true)
+ENABLE_PAYMENT_PROCESSING=true  # ⚙️ Optional (defaults to true)
 
 # ============================================
-# MONITORING (Optional)
+# ⚙️ MONITORING - OPTIONAL
 # ============================================
-SENTRY_DSN=YOUR_SENTRY_DSN
-NEXT_PUBLIC_SENTRY_DSN=YOUR_SENTRY_PUBLIC_DSN
-GOOGLE_ANALYTICS_ID=YOUR_GA_ID
-CI=false
+SENTRY_DSN=YOUR_SENTRY_DSN  # ✅ Recommended for production (error tracking)
+GOOGLE_ANALYTICS_ID=YOUR_GA_ID  # ⚙️ Optional
+
+# 📦 Build-time only
+NEXT_PUBLIC_SENTRY_DSN=YOUR_SENTRY_PUBLIC_DSN  # 📦 Optional (exposed to client)
 
-# Optional Social URLs (shown in footer if set)
-NEXT_PUBLIC_TWITTER_URL=
-NEXT_PUBLIC_LINKEDIN_URL=
-NEXT_PUBLIC_FACEBOOK_URL=
-NEXT_PUBLIC_TIKTOK_URL=
-NEXT_PUBLIC_THREADS_URL=
+# ⚙️ Social Media URLs (shown in footer if set, accessed via SOCIAL_URLS constant)
+NEXT_PUBLIC_TWITTER_URL=  # ⚙️ Optional (empty = not shown)
+NEXT_PUBLIC_LINKEDIN_URL=  # ⚙️ Optional (empty = not shown)
+NEXT_PUBLIC_FACEBOOK_URL=  # ⚙️ Optional (empty = not shown)
+NEXT_PUBLIC_TIKTOK_URL=  # ⚙️ Optional (empty = not shown)
+NEXT_PUBLIC_THREADS_URL=  # ⚙️ Optional (empty = not shown)
+NEXT_PUBLIC_INSTAGRAM_URL=  # ⚙️ Optional (empty = not shown)
 
 # ============================================
-# TESTING (Development/CI only)
+# 🧪 TESTING - DEVELOPMENT/CI ONLY (DO NOT SET IN PRODUCTION)
 # ============================================
-NEXT_RUNTIME=nodejs
-CLERK_TEST_MODE=false
-E2E_TEST=false
-TEST_ADMIN_EMAIL=admin@example.com
-TEST_ADMIN_PASSWORD=changeme
-TEST_PRECEPTOR_EMAIL=preceptor@example.com
-TEST_PRECEPTOR_PASSWORD=changeme
-TEST_STUDENT_EMAIL=student@example.com
-TEST_STUDENT_PASSWORD=changeme
-TEST_PASSWORD=changeme
+NEXT_RUNTIME=nodejs  # 🧪 Dev only
+CLERK_TEST_MODE=false  # 🧪 Dev only
+E2E_TEST=false  # 🧪 Dev only
+TEST_ADMIN_EMAIL=admin@example.com  # 🧪 Dev only
+TEST_ADMIN_PASSWORD=changeme  # 🧪 Dev only
+TEST_PRECEPTOR_EMAIL=preceptor@example.com  # 🧪 Dev only
+TEST_PRECEPTOR_PASSWORD=changeme  # 🧪 Dev only
+TEST_STUDENT_EMAIL=student@example.com  # 🧪 Dev only
+TEST_STUDENT_PASSWORD=changeme  # 🧪 Dev only
+TEST_PASSWORD=changeme  # 🧪 Dev only
+
+# 🧪 CI Variables (DO NOT SET IN PRODUCTION)
+CI=false  # 🧪 CI only
+BUILD_TIMEOUT=600  # 🧪 CI only
+CACHE_MAX_AGE=3600  # 🧪 CI only
+NODE_OPTIONS=--max-old-space-size=4096  # 🧪 Build only
+SECRETS_SCAN_ENABLED=false  # 🧪 CI only
 
 # ============================================
-# SECURITY NOTES FOR DEPLOYMENT
+# 🚀 PRODUCTION DEPLOYMENT CHECKLIST
 # ============================================
+# ✅ Set ~27 runtime variables in Netlify (see docs/NETLIFY_ENV_VARS.md)
+# ✅ Remove all NEXT_PUBLIC_* from production runtime (keep in build scope)
+# ✅ Remove all TEST_*, CI, BUILD_* variables from production
+# ✅ Use production keys (pk_live_, sk_live_) for live deployment
+# ✅ Generate strong CSRF_SECRET_KEY: openssl rand -base64 32
+# ✅ Verify all 9 Stripe price IDs are set correctly
+# ✅ Test deployment: npm run validate:env-size
+#
+# SECURITY NOTES:
 # 1. NEVER expose Price IDs as NEXT_PUBLIC_* variables
-# 2. Price IDs are handled server-side via /api/create-checkout
+# 2. Price IDs accessed server-side via lib/stripe/pricing-config.ts
 # 3. All Stripe operations use server-side validation
-# 4. Use production keys for live deployment (pk_live_, sk_live_)
-# 5. Use test keys for staging/development (pk_test_, sk_test_)
-# 6. Never commit actual API keys to your repository
+# 4. NEXT_PUBLIC_* vars are PUBLIC - visible in browser
+# 5. Never commit actual API keys to your repository
+#
+# See docs/NETLIFY_ENV_VARS.md for complete deployment guide