env-difflisted

# env-diff ## Premise Find real config drift, not vibes. Every flagged key cites which file it's in (or absent from) + whether the schema marks it required. "Some env vars look off" is not a finding. NEVER print VALUES — keys only; values are secrets. A clean diff against an empty `.env.example` is suspicious — verify the example actually lists the project's real keys. A run that returns zero findings without proving the schema was loaded is a failed run. Config bugs are a top-5 cause of "it works on my machine". Surface missing / orphan / unvalidated env keys before boot. ## When to use - After pulling a branch that may have added env vars. - After editing `shared/config/env.schema.ts` (joi/zod) — verify schema, example, and live `.env` agree. - Before onboarding a new dev. - In CI as a pre-deploy gate. ## Prerequisites - `comm` and `awk` (POSIX; preinstalled on macOS/Linux). - The repo's env schema file path (commonly `shared/config/env.schema.ts`, `apps/*/src/config/env.validation.ts`). ## Procedure 1. Enumerate every env file, and pair them by app: ```bash ls -1 .env* 2>/dev/null ``` One `.env` + `.env.example` is the single-app case. A repo with several deployable apps carries a pair per app (`.env.<app>` + `.env.<app>.example`) — **derive the app names from what is on disk and from the workspace/monorepo config, never from a convention this skill assumes.** A hardcoded app list is how a scan reports "clean" on the two files it knew about a