fix(site): use astro:env for server-only environment variables

[decepulis]

Summary

• Migrate server-only secrets (OAuth, session cookie, Mux) from import.meta.env to astro:env/server
• Add type-safe env schema to astro.config.mjs with all server secrets declared as optional
• Remove the process.env || import.meta.env dual pattern from mux.ts — astro:env reads from the runtime environment natively

Why

import.meta.env is statically replaced by Vite at build time. Server-only secrets that aren't present during the Netlify CI build get inlined as undefined, breaking auth and Mux integration at runtime. astro:env/server reads secrets from the runtime environment instead.

Files changed

File	Change
site/astro.config.mjs	Added env.schema with envField declarations
site/src/utils/auth.ts	import.meta.env destructure → astro:env/server import
site/src/actions/auth.ts	Same migration + inline import.meta.env.PROD
site/src/actions/mux.ts	Removed process.env fallback pattern, use astro:env/server
site/src/pages/api/auth/callback.ts	Moved env vars from handler-scoped destructure to top-level import

Test plan

• pnpm astro sync — types generate successfully
• pnpm build:site — builds without errors
• Verify auth login flow works on Netlify deploy preview
• Verify Mux health endpoint returns { ok: true }

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
vjs-10-demo-react	Ignored	Preview	Feb 19, 2026 3:23pm

[netlify]

✅ Deploy Preview for vjs10-site ready!

Name	Link
🔨 Latest commit	e4e5db7
🔍 Latest deploy log	https://app.netlify.com/projects/vjs10-site/deploys/69972ae26998d60008b16521
😎 Deploy Preview	https://deploy-preview-574--vjs10-site.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

📦 Bundle Size Report

Package	Size	Diff		%
@videojs/core	5.67 kB	0 B	░░░░░░░░	0%	✅
@videojs/element	1.60 kB	0 B	░░░░░░░░	0%	✅
@videojs/html	8.63 kB	0 B	░░░░░░░░	0%	✅
@videojs/icons	3.46 kB	0 B	░░░░░░░░	0%	✅
@videojs/react	12.82 kB	0 B	░░░░░░░░	0%	✅
@videojs/store	1.94 kB	0 B	░░░░░░░░	0%	✅
@videojs/utils	2.47 kB	0 B	░░░░░░░░	0%	✅

Total: 36.60 kB · 0 B · 0%

---

Entry Breakdown

Subpath sizes are the additional bytes on top of the root entry point, measured by bundling root + subpath together and subtracting the root-only size.

@videojs/core

Entry	Base	PR	Diff	%
.	3.09 kB	3.09 kB	0 B	0%	✅
./dom	2.58 kB	2.58 kB	0 B	0%	✅
total	5.67 kB	5.67 kB	0 B	0%

@videojs/element

Entry	Base	PR	Diff	%
.	817 B	817 B	0 B	0%	✅
./context	823 B	823 B	0 B	0%	✅
total	1.60 kB	1.60 kB	0 B	0%

@videojs/icons

Entry	Base	PR	Diff	%
./react	2.10 kB	2.10 kB	0 B	0%	✅
./html	1.37 kB	1.37 kB	0 B	0%	✅
total	3.46 kB	3.46 kB	0 B	0%

@videojs/react

Entry	Base	PR	Diff	%
.	7.69 kB	7.69 kB	0 B	0%	✅
./audio	266 B	266 B	0 B	0%	✅
./background	35 B	35 B	0 B	0%	✅
./video	4.84 kB	4.84 kB	0 B	0%	✅
total	12.82 kB	12.82 kB	0 B	0%

@videojs/store

Entry	Base	PR	Diff	%
.	1.29 kB	1.29 kB	0 B	0%	✅
./html	468 B	468 B	0 B	0%	✅
./react	199 B	199 B	0 B	0%	✅
total	1.94 kB	1.94 kB	0 B	0%

@videojs/utils

Entry	Base	PR	Diff	%
./array	104 B	104 B	0 B	0%	✅
./dom	684 B	684 B	0 B	0%	✅
./events	227 B	227 B	0 B	0%	✅
./function	197 B	197 B	0 B	0%	✅
./object	119 B	119 B	0 B	0%	✅
./predicate	265 B	265 B	0 B	0%	✅
./string	110 B	110 B	0 B	0%	✅
./style	185 B	185 B	0 B	0%	✅
./time	478 B	478 B	0 B	0%	✅
./number	158 B	158 B	0 B	0%	✅
total	2.47 kB	2.47 kB	0 B	0%

---

ℹ️ How to interpret

Sizes are minified + brotli, measured with esbuild.
Package totals are computed as root size + marginal subpath costs.
Subpath marginal cost = (root + subpath bundled together) − root alone.

Icon	Meaning
✅	No change
🔺	Increased ≤ 10%
🔴	Increased > 10%
🔽	Decreased
🆕	New (no baseline)

Run pnpm size locally to check current sizes.