param([Parameter(Mandatory=$true)][ValidateSet('staging','production')][string]$Environment)
$ErrorActionPreference='Stop'
$required=@('IMAGE_TAG','DATABASE_URL','SESSION_TOKEN_PEPPER','AUDIT_IP_HASH_KEY','FIELD_ENCRYPTION_KEY','ADMIN_WEB_ORIGIN')
foreach($name in $required){if(-not [Environment]::GetEnvironmentVariable($name)){throw "Missing required environment variable: $name"}}
if($env:IMAGE_TAG -eq 'latest'){throw 'IMAGE_TAG must be immutable and cannot be latest'}
if($Environment -eq 'production' -and $env:ADMIN_COOKIE_SECURE -ne 'true'){throw 'production requires ADMIN_COOKIE_SECURE=true'}
docker compose -f compose.yaml -f "infra/deploy/compose.$Environment.yaml" config --quiet
if($LASTEXITCODE -ne 0){throw 'compose validation failed'}
Write-Output "Preflight passed for $Environment"