svelte-env-vars-check

SvelteKit Env Vars Check

Audit SvelteKit environment variable usage for PUBLIC/PRIVATE pattern compliance and process.env violations, then optionally migrate to correct patterns.

SvelteKit Env Var Rules

Pattern	Module	Who can use it
PUBLIC_* vars	$env/static/public or $env/dynamic/public	Client and server
Non-public vars	$env/static/private or $env/dynamic/private	Server only
process.env.*	—	Never — not supported by SvelteKit

Violations:

1. Client-side using PRIVATE — a client file imports from $env/static/private or $env/dynamic/private
2. Server-side not using PRIVATE — a server file accesses env vars through process.env instead of $env/static/private or $env/dynamic/private
3. process.env anywhere — any file using process.env.* instead of SvelteKit env modules

---

Phase 1: Discover Files

1.1 Identify client-side files

Client-side files are those that run in the browser. In SvelteKit:

• src/**/*.svelte (all Svelte components and pages)
• src/**/+page.ts and src/**/+layout.ts (universal loaders — run on both client and server)
• src/lib/**/*.ts and src/lib/**/*.js not inside a server/ subdirectory

Run:

find src -type f \( -name "*.svelte" -o -name "+page.ts" -o -name "+layout.ts" \) | sort
find src/lib -type f \( -name "*.ts" -o -name "*.js" \) | grep -v '/server/' | sort

1.2 Identify server-side files

Server-side files only run on the server. In SvelteKit:

• src/**/+page.server.ts and src/**/+layout.server.ts
• src/**/+server.ts (API routes / form actions)
• src/lib/server/**/* (server-only library code)

Run:

find src -type f \( -name "+page.server.ts" -o -name "+layout.server.ts" -o -name "+server.ts" \) | sort
find src/lib/server -type f 2>/dev/null | sort

---

Phase 2: Scan for Violations

2.1 Scan for process.env usage (any file)

grep -rn "process\.env\." src/ --include="*.ts" --include="*.js" --include="*.svelte"