OptionalsecretOptionalrequiredmust be present (after defaults) — else parse() throws and health = "missing".
Optionaldefaultfallback value when absent.
Optionalsurfaceswhich surfaces need this var (default: every surface). Drives the deploy/vscode projections.
OptionaldescriptionOptionalexampleOptionalpatternthe value, when present, must match this regex (source string or RegExp).
Optionalminthe value, when present, must be at least this long (a too-short secret is a real misconfiguration).
Optionalrequiredrequired ONLY when validating for one of these surfaces (in addition to required, which is always).
Optionalforbidvalue patterns that are FORBIDDEN on specific surfaces — e.g. a sk_test_ key on cloudflare. Default
severity "warning" (a gated nudge); set "error" to fail closed.
a secret — its value must be ENCRYPTED at rest in the committed .env (plaintext is flagged).