Environment, DevTools and Debugging Learn frontend environment-variable boundaries, browser/terminal evidence, and a systematic Next.js debugging loop.
Environment Variables, DevTools and Next.js Debugging Frontend bugs often sit at a boundary: server versus browser, build time versus runtime, route versus component, or workspace root versus package directory. Phase 03 teaches how to locate the failing layer before editing code.
Environment variable boundary By default, environment variables are server-only. A variable exposed to browser JavaScript requires the NEXT_PUBLIC_ prefix. That prefix is a publication decision, not a naming style.
Example Browser-visible? Use
API_INTERNAL_SECRET No Never place secrets in frontend browser code
DATABASE_URL No Later belongs to API/backend environment, not apps/web
NEXT_PUBLIC_API_URL Yes Later tells browser where public API is
NEXT_PUBLIC_APP_NAME Yes Harmless public configuration if needed
Security rule If a value must remain secret, it must never depend on NEXT_PUBLIC_ protection. Anything delivered to browser JavaScript is inspectable by the user.
Where errors appear Symptom First place to look
A layered debugging loop 1. Reproduce the failure. 2. Identify the environment: terminal/server or browser/client. 3. Read the first useful error, not only the last stack frame. 4. Confirm the current route and file path. 5. Reduce the failing component or change. 6. Make the smallest correction. 7. Re-run the same verification. 8. Run lint/type/build before declaring victory.
Common error: hook in Server Component Symptom: useState/useEffect or event-handler related error in a Server Component. Diagnosis: the component needs browser interactivity. Correction: move only the interactive portion into a Client Component; do not automatically convert the root layout.
Common error: module not found Check the import alias, file casing, relative path, and whether the dependency belongs to apps/web. On Windows, case mistakes may remain hidden locally and fail on a case-sensitive production filesystem.
Common error: command ran in wrong place
Get-Location
Get-Content .\package.json
pnpm --filter web devIf you are inside apps/web, pnpm dev is fine. If you are at taskflow root, filter to the package. Make the location explicit rather than guessing.
Common error: port 3000 already used Do not kill random processes. Identify which process owns the port, determine whether another dev server is already running, and either reuse/stop it intentionally or choose a different port.
Production build is a different verification Fast Refresh success does not prove the application is production-buildable. At the phase exit, run the web package build from the workspace and fix type/lint/build failures before continuing.
Browser DevTools habits • Elements: inspect actual DOM and computed styles. • Console: client errors and logs. • Network: later inspect API requests, status codes and timing. • Application/Storage: later inspect browser-managed storage only when the feature actually uses it. • Accessibility tree where available: verify semantic output instead of visual appearance alone. Debug by locating the failing boundary first
Symptom locate Which environment? inspect Collect evidence hypothesis Small fix
test
Checkpoint • You can explain why NEXT_PUBLIC_ means browser-visible. • You know whether to inspect terminal or browser first for a given symptom. • You can diagnose Server/Client boundary errors without widening use client unnecessarily. • You use the production build as a phase gate.
Next.js is useful only when you can explain what runs on the server, what crosses into the browser, and which route owns a user-visible state.
Restate the goal of “Environment DevTools and Debugging” as one observable behavior. Write the success signal before touching code.
Trace the boundary map: route → Server Component → client boundary → request/data source → rendered UI. Mark the one boundary this lesson changes.
Inspect the current repository state and record the exact files, route, table, or runtime involved. Avoid creating an abstraction before you can name the existing owner.
Implement the smallest vertical slice. Add one coherent change, run the narrowest verification command, and read the output before continuing.
Connect the slice to TaskFlow’s phase artifact: A navigable TaskFlow web shell with route groups/layouts, server-first composition, selective client interactivity, and verified environment handling.. Verify behavior from the outside as a user or API client would.
Create one controlled failure that is safe to reproduce. Predict the symptom first, capture evidence, locate the earliest broken boundary, then fix only that cause.
Close the reference and rebuild or explain the core change from memory. Record what you would monitor or test before trusting the same change in production.
// app/tasks/page.tsx
import { TaskList } from "./task-list";
export default async function TasksPage() {
const tasks = await loadTasks();
return <TaskList initialTasks={tasks} />;
}Do not copy this as a finished answer. Predict what each boundary does, type the smallest useful slice, run it, then compare the result with your prediction.
Locate the first browser-only API or stateful hook and move the client boundary to the smallest component that needs it.
Verify route params, fetch location, cache behavior, and the exact server response before changing JSX.
Without copying the final source, create a second small scenario that applies “Environment DevTools and Debugging” to a different TaskFlow resource or input. Write the acceptance criteria first, implement it, and provide the evidence that each criterion is satisfied.
Use browser DevTools and terminal logs to distinguish server rendering from client execution.
Use the smallest change that demonstrates this lesson. Stop after it works and capture evidence.Accessing browser APIs from Server Components
Predict the symptom before causing the failure. Then locate the earliest boundary where reality diverges from expectation.Why does this responsibility live here, what input does it trust, what output proves success, and what would go wrong if another layer owned it?
If your explanation is vague, repeat the boundary trace before moving on.Close the reference. Reproduce the core idea from memory or explain the exact request/data flow aloud. Then check your diff or notes for accidental shortcuts that bypass validation, authorization, error handling, or verification earned in earlier phases.