validate VALUES (presence incl. requiredInSurface, minLength, pattern, forbidInSurface) → a graded issue list.
Optionalsource: Record<string, string | undefined>Optionalopts: AssertOptionsFAIL-CLOSED gate: throw on any error-severity issue (warnings go to onWarn); else return the parsed config. Call at startup so a misconfigured/short/test secret in prod stops the process instead of shipping.
Optionalsource: Record<string, string | undefined>Optionalopts: AssertOptionsconfig health, computed from the RAW .env record (raw = parseEnv(fileContent), so secret values are still encrypted tokens). Pass the runtime env too if you want presence to also count vars set outside the file.
Optionalraw: Record<string, string | undefined>Optionalruntime: Record<string, string | undefined>
validate a source (process.env or a parsed .env), apply defaults, throw on a missing required var.