# Production Deployment Checklist

## Environment Variables (Required)
- [x] DATABASE_URL
- [x] R2_ACCOUNT_ID
- [x] R2_ACCESS_KEY_ID
- [x] R2_SECRET_ACCESS_KEY
- [x] R2_BUCKET_NAME
- [x] R2_PUBLIC_URL
- [x] BLOB_READ_WRITE_TOKEN

## Database
- [ ] Run analytics table migration: `scripts/create-analytics-table.sql`
- [ ] Verify indexes created successfully
- [ ] Test database connection pool

## Storage
- [ ] Verify R2 bucket accessible
- [ ] Test direct file upload to R2
- [ ] Verify Blob fallback works
- [ ] Confirm public URLs resolve

## API Routes
- [ ] Test `/api/stream/[trackId]` with Range requests
- [ ] Test `/api/upload/sign` generates valid URLs
- [ ] Test `/api/analytics/track` records events
- [ ] Verify all routes return JSON with `{success, data, error}`

## Load Testing
- [ ] Run `k6 run tests/load/api.js`
- [ ] Run `k6 run tests/load/stream.js`
- [ ] Run `k6 run tests/load/upload.js`
- [ ] Verify error rate < 10%
- [ ] Verify p95 response time < 500ms (API), < 2s (stream)

## Caching & Performance
- [ ] Verify Cache-Control headers on streaming
- [ ] Test Range request support (HTTP 206)
- [ ] Confirm immutable assets cached properly

## Security
- [ ] Signed URLs expire in 5 minutes
- [ ] File size limits enforced (100MB max)
- [ ] Content-Type validation working
- [ ] No direct R2 credentials exposed to client

## Monitoring
- [ ] Analytics recording stream events
- [ ] Database queries use safe wrappers
- [ ] All errors logged server-side
- [ ] No client-side console errors

## Final Checks
- [ ] All API responses return standardized format
- [ ] Graceful degradation on all failures
- [ ] No crashes on missing env vars
- [ ] Load test passes at 100 concurrent users
