fix(env): throw instead of silently falling back to localhost in production

[floraispretty]

The bug, confirmed

Exactly as described: src/lib/api.ts has

const API_URL = process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:3000';

If NEXT_PUBLIC_API_URL is forgotten in a production build, every visitor's browser silently tries to call its own localhost instead of the real backend — the failure then looks like a backend outage, not a config mistake, since nothing ever throws or logs pointing at the actual cause.

Fix

New src/lib/env.ts, exactly as suggested in the issue: resolveEnv(name, value, devFallback) returns the dev fallback outside production as before, but throws a clear Missing required environment variable: <name> error when NODE_ENV === 'production' and the value is empty/unset. NODE_ENV=production is Next.js's own signal for a real next build, so no extra build-time flag is needed.

It's a plain exported function rather than env.ts computing values itself at module load, so the throwing behavior is directly unit-testable without needing to re-evaluate module-level process.env reads.

Wired into the two places the issue named:

• api.ts — API_URL (the case in the issue).
• wallet.ts — NETWORK_PASSPHRASE (NEXT_PUBLIC_STELLAR_NETWORK_PASSPHRASE), same bug shape, arguably higher-stakes: this is the Stellar network identity used to sign transactions. Forgetting it in production would previously silently sign against the testnet passphrase instead of failing loudly at startup — surfacing later as a confusing signature/network-mismatch error mid-transaction instead of an obvious missing-config error up front.

Both keep their existing dev/test fallback values unchanged — only the production behavior changes.

Found but out of scope

While checking for the same pattern elsewhere, I also found NEXT_PUBLIC_APP_URL falling back to http://localhost:3001 in app/sitemap.ts and app/layout.tsx — same silent-fallback shape, lower stakes (wrong canonical/OG URLs and sitemap entries rather than a broken API or wallet). Left out of this PR to keep it scoped to what #37 asked for (api.ts + wallet.ts); happy to follow up separately if wanted.

Verification

• npx vitest run — 78/78 passing, full suite, no regressions. Includes 5 new env.test.ts cases (value-present short-circuits regardless of env, dev/test fallback, production-missing throws with the var name, empty string treated as missing) using vi.stubEnv per this repo's existing vitest 4.x convention.
• npx tsc --noEmit reports pre-existing errors, but they're entirely confined to app/my-tickets/page.tsx (unbalanced JSX already broken on main) — confirmed via git status that this PR touches only src/lib/env.ts, src/lib/env.test.ts, src/lib/api.ts, and src/lib/wallet.ts, none of which that file imports from in a way that would be affected.

Commits

1. fix(env): add resolveEnv() that throws in production when unset (#37) — the utility + its tests
2. fix(env): use resolveEnv() for API_URL and NETWORK_PASSPHRASE (#37) — wiring it into api.ts/wallet.ts, plus the scope note on NEXT_PUBLIC_APP_URL
   Closes API_URL silently falls back to http://localhost:3000 in production builds #37
   Closes Add typecheck, test:watch and lint:fix npm scripts and use them in CONTRIBUTING #38
   Closes Add Prettier with a shared config and a format script #39
   Closes Add an npm audit job to CI #40

[drips-wave]

@floraispretty Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[netlify]

❌ Deploy Preview for stellartickets failed.

Name	Link
🔨 Latest commit	df15379
🔍 Latest deploy log	https://app.netlify.com/projects/stellartickets/deploys/6ab8194c32937d0008d1217f