/**
 * Read a string-typed env var (process.env on Node, the Worker `env` binding
 * on Cloudflare) and throw a clear error if it is missing or empty.
 *
 * Use this for **identity-bearing** values (issuer, baseDomain, audience,
 * worker URL) where a guessed default silently mints wrong JWTs or bakes
 * wrong refs into persisted artifacts. The conventional `?? 'literal'`
 * fallback is the anti-pattern this exists to replace.
 *
 * In local dev these live in each domain worker's `worker/.dev.vars` (read
 * natively by `wrangler dev`), so this throw never fires in a properly-prepared
 * dev environment — only when wiring is genuinely missing.
 */
export function requireEnv(env: unknown, name: string, hint?: string): string {
  const v = (env as Record<string, unknown> | null | undefined)?.[name]
  if (typeof v === 'string' && v.length > 0) return v
  const help = hint ? ` (${hint})` : ''
  throw new Error(`Missing required env var: ${name}${help}`)
}