check-env

Audit environment variable usage in $ARGUMENTS for client/server boundary violations.

Scan all files for process.env usage and classify each one:

SERVER-SAFE — Used only in:

• Server Components (files without 'use client' that are in the app/ directory)
• Route Handlers (app/api/**/route.ts)
• Server Actions (files with 'use server' or functions marked with 'use server')
• next.config.js / next.config.ts
• Utility files that are only ever imported by server-side code

CLIENT-EXPOSED (requires NEXT_PUBLIC_ prefix) — Used in:

• Files with 'use client' directive
• Client-side event handlers
• Browser-only code paths

VIOLATION — Flag these immediately:

1. A non-NEXT_PUBLIC_ variable used in a Client Component → will be undefined at runtime, potential silent failure
2. A secret-looking variable (contains SECRET, KEY, TOKEN, PASSWORD, PRIVATE) with NEXT_PUBLIC_ prefix → exposes secrets to the browser
3. A process.env variable used in a component where it's unclear if it's server or client — needs explicit classification

Output for each violation:

• File path and line number
• The variable name
• Why it's a violation
• The fix: either move the usage to a server context, or add/remove NEXT_PUBLIC_ prefix as appropriate

Also output a summary table:

Variable	Used In	Server Safe?	Action Required
process.env.DATABASE_URL	lib/db.ts	✅ Yes	None
process.env.NEXT_PUBLIC_API_URL	components/Map.tsx	✅ Yes	None
process.env.STRIPE_SECRET_KEY	components/Checkout.tsx	❌ No	Move to server action

If no path provided in $ARGUMENTS, scan the entire project.