@sentinel-atl/hardening 0.3.0 → 0.4.0

package/dist/env-validation.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Environment variable schema validation — fail fast on misconfiguration.
+ *
+ * Validates required env vars exist and optional ones have correct formats
+ * at startup, before the server begins accepting connections.
+ */
+export interface EnvVarDef {
+    /** Environment variable name */
+    name: string;
+    /** Whether this variable is required */
+    required?: boolean;
+    /** Default value if not set */
+    default?: string;
+    /** Validation: 'string' | 'number' | 'boolean' | 'url' | 'port' */
+    type?: 'string' | 'number' | 'boolean' | 'url' | 'port';
+    /** Human-readable description (for error messages) */
+    description?: string;
+}
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+    resolved: Record<string, string>;
+}
+/**
+ * Validate and resolve environment variables from a schema definition.
+ * Returns resolved values (with defaults applied) or throws on error.
+ */
+export declare function validateEnv(schema: EnvVarDef[]): ValidationResult;
+/**
+ * Validate and throw if any errors — call at server startup.
+ */
+export declare function requireValidEnv(schema: EnvVarDef[]): Record<string, string>;
+/**
+ * Standard Sentinel env vars for the STP server.
+ */
+export declare const SENTINEL_ENV_SCHEMA: EnvVarDef[];
+//# sourceMappingURL=env-validation.d.ts.map

package/dist/env-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-validation.d.ts","sourceRoot":"","sources":["../src/env-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,SAAS;IACxB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAC;IACxD,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAID;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAuDjE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO3E;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,EAU1C,CAAC"}

package/dist/env-validation.js

@@ -0,0 +1,89 @@
+/**
+ * Environment variable schema validation — fail fast on misconfiguration.
+ *
+ * Validates required env vars exist and optional ones have correct formats
+ * at startup, before the server begins accepting connections.
+ */
+// ─── Validator ───────────────────────────────────────────────────────
+/**
+ * Validate and resolve environment variables from a schema definition.
+ * Returns resolved values (with defaults applied) or throws on error.
+ */
+export function validateEnv(schema) {
+    const errors = [];
+    const resolved = {};
+    for (const def of schema) {
+        const raw = process.env[def.name];
+        const value = raw ?? def.default;
+        if (def.required && !value) {
+            errors.push(`Missing required env var: ${def.name}${def.description ? ` (${def.description})` : ''}`);
+            continue;
+        }
+        if (!value)
+            continue;
+        // Type validation
+        switch (def.type) {
+            case 'number': {
+                const num = Number(value);
+                if (isNaN(num)) {
+                    errors.push(`${def.name}: expected a number, got "${value}"`);
+                    continue;
+                }
+                break;
+            }
+            case 'port': {
+                const port = Number(value);
+                if (isNaN(port) || port < 1 || port > 65535) {
+                    errors.push(`${def.name}: expected a port (1-65535), got "${value}"`);
+                    continue;
+                }
+                break;
+            }
+            case 'boolean': {
+                if (!['true', 'false', '1', '0'].includes(value.toLowerCase())) {
+                    errors.push(`${def.name}: expected true/false, got "${value}"`);
+                    continue;
+                }
+                break;
+            }
+            case 'url': {
+                try {
+                    new URL(value);
+                }
+                catch {
+                    errors.push(`${def.name}: expected a valid URL, got "${value}"`);
+                    continue;
+                }
+                break;
+            }
+        }
+        resolved[def.name] = value;
+    }
+    return { valid: errors.length === 0, errors, resolved };
+}
+/**
+ * Validate and throw if any errors — call at server startup.
+ */
+export function requireValidEnv(schema) {
+    const result = validateEnv(schema);
+    if (!result.valid) {
+        const msg = `Configuration errors:\n  ${result.errors.join('\n  ')}`;
+        throw new Error(msg);
+    }
+    return result.resolved;
+}
+/**
+ * Standard Sentinel env vars for the STP server.
+ */
+export const SENTINEL_ENV_SCHEMA = [
+    { name: 'SENTINEL_PORT', type: 'port', default: '3000', description: 'HTTP port' },
+    { name: 'SENTINEL_HOST', type: 'string', default: '0.0.0.0', description: 'Bind address' },
+    { name: 'SENTINEL_DATA_DIR', type: 'string', default: './data', description: 'Data directory' },
+    { name: 'SENTINEL_API_KEYS', type: 'string', description: 'API keys (key1:scope1,scope2;key2:admin)' },
+    { name: 'SENTINEL_CORS_ORIGINS', type: 'string', description: 'Comma-separated allowed origins' },
+    { name: 'SENTINEL_TLS_CERT', type: 'string', description: 'TLS certificate path' },
+    { name: 'SENTINEL_TLS_KEY', type: 'string', description: 'TLS private key path' },
+    { name: 'REDIS_URL', type: 'url', description: 'Redis connection URL' },
+    { name: 'NODE_ENV', type: 'string', default: 'production' },
+];
+//# sourceMappingURL=env-validation.js.map

package/dist/env-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-validation.js","sourceRoot":"","sources":["../src/env-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuBH,wEAAwE;AAExE;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC;QAEjC,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,kBAAkB;QAClB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,6BAA6B,KAAK,GAAG,CAAC,CAAC;oBAC9D,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,qCAAqC,KAAK,GAAG,CAAC,CAAC;oBACtE,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAC/D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,+BAA+B,KAAK,GAAG,CAAC,CAAC;oBAChE,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,gCAAgC,KAAK,GAAG,CAAC,CAAC;oBACjE,SAAS;gBACX,CAAC;gBACD,MAAM;YACR,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,4BAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC9C,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE;IAClF,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE;IAC1F,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAC/F,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0CAA0C,EAAE;IACtG,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACjG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;IAClF,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACjF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE;IACvE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;CAC5D,CAAC"}

package/dist/index.d.ts

@@ -16,4 +16,5 @@ export { RateLimiter, setRateLimitHeaders, sendRateLimited, parseRateLimit, type
 export { NonceStore, type NonceStoreConfig, } from './nonce-store.js';
 export { rotateIfNeeded, cleanupRotatedFiles, totalLogSize, type RotationConfig, } from './audit-rotation.js';
 export { applySecurityHeaders, securityHeadersConfigFromEnv, type SecurityHeadersConfig, } from './security-headers.js';
+export { validateEnv, requireValidEnv, SENTINEL_ENV_SCHEMA, type EnvVarDef, type ValidationResult, } from './env-validation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,GAChB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,KAAK,aAAa,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,KAAK,cAAc,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -16,4 +16,5 @@ export { RateLimiter, setRateLimitHeaders, sendRateLimited, parseRateLimit, } fr
 export { NonceStore, } from './nonce-store.js';
 export { rotateIfNeeded, cleanupRotatedFiles, totalLogSize, } from './audit-rotation.js';
 export { applySecurityHeaders, securityHeadersConfigFromEnv, } from './security-headers.js';
+export { validateEnv, requireValidEnv, SENTINEL_ENV_SCHEMA, } from './env-validation.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAKlB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAKlB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAE7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,WAAW,EACX,eAAe,EACf,mBAAmB,GAGpB,MAAM,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentinel-atl/hardening",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Production hardening middleware — API key auth, CORS, TLS, rate-limit headers, nonce persistence, audit rotation",
   "type": "module",
   "main": "dist/index.js",
@@ -18,7 +18,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@sentinel-atl/store": "*"
+    "@sentinel-atl/store": "workspace:*"
   },
   "devDependencies": {
     "vitest": "^3.2.4",

package/src/env-validation.ts

@@ -0,0 +1,117 @@
+/**
+ * Environment variable schema validation — fail fast on misconfiguration.
+ *
+ * Validates required env vars exist and optional ones have correct formats
+ * at startup, before the server begins accepting connections.
+ */
+
+// ─── Types ───────────────────────────────────────────────────────────
+
+export interface EnvVarDef {
+  /** Environment variable name */
+  name: string;
+  /** Whether this variable is required */
+  required?: boolean;
+  /** Default value if not set */
+  default?: string;
+  /** Validation: 'string' | 'number' | 'boolean' | 'url' | 'port' */
+  type?: 'string' | 'number' | 'boolean' | 'url' | 'port';
+  /** Human-readable description (for error messages) */
+  description?: string;
+}
+
+export interface ValidationResult {
+  valid: boolean;
+  errors: string[];
+  resolved: Record<string, string>;
+}
+
+// ─── Validator ───────────────────────────────────────────────────────
+
+/**
+ * Validate and resolve environment variables from a schema definition.
+ * Returns resolved values (with defaults applied) or throws on error.
+ */
+export function validateEnv(schema: EnvVarDef[]): ValidationResult {
+  const errors: string[] = [];
+  const resolved: Record<string, string> = {};
+
+  for (const def of schema) {
+    const raw = process.env[def.name];
+    const value = raw ?? def.default;
+
+    if (def.required && !value) {
+      errors.push(`Missing required env var: ${def.name}${def.description ? ` (${def.description})` : ''}`);
+      continue;
+    }
+
+    if (!value) continue;
+
+    // Type validation
+    switch (def.type) {
+      case 'number': {
+        const num = Number(value);
+        if (isNaN(num)) {
+          errors.push(`${def.name}: expected a number, got "${value}"`);
+          continue;
+        }
+        break;
+      }
+      case 'port': {
+        const port = Number(value);
+        if (isNaN(port) || port < 1 || port > 65535) {
+          errors.push(`${def.name}: expected a port (1-65535), got "${value}"`);
+          continue;
+        }
+        break;
+      }
+      case 'boolean': {
+        if (!['true', 'false', '1', '0'].includes(value.toLowerCase())) {
+          errors.push(`${def.name}: expected true/false, got "${value}"`);
+          continue;
+        }
+        break;
+      }
+      case 'url': {
+        try {
+          new URL(value);
+        } catch {
+          errors.push(`${def.name}: expected a valid URL, got "${value}"`);
+          continue;
+        }
+        break;
+      }
+    }
+
+    resolved[def.name] = value;
+  }
+
+  return { valid: errors.length === 0, errors, resolved };
+}
+
+/**
+ * Validate and throw if any errors — call at server startup.
+ */
+export function requireValidEnv(schema: EnvVarDef[]): Record<string, string> {
+  const result = validateEnv(schema);
+  if (!result.valid) {
+    const msg = `Configuration errors:\n  ${result.errors.join('\n  ')}`;
+    throw new Error(msg);
+  }
+  return result.resolved;
+}
+
+/**
+ * Standard Sentinel env vars for the STP server.
+ */
+export const SENTINEL_ENV_SCHEMA: EnvVarDef[] = [
+  { name: 'SENTINEL_PORT', type: 'port', default: '3000', description: 'HTTP port' },
+  { name: 'SENTINEL_HOST', type: 'string', default: '0.0.0.0', description: 'Bind address' },
+  { name: 'SENTINEL_DATA_DIR', type: 'string', default: './data', description: 'Data directory' },
+  { name: 'SENTINEL_API_KEYS', type: 'string', description: 'API keys (key1:scope1,scope2;key2:admin)' },
+  { name: 'SENTINEL_CORS_ORIGINS', type: 'string', description: 'Comma-separated allowed origins' },
+  { name: 'SENTINEL_TLS_CERT', type: 'string', description: 'TLS certificate path' },
+  { name: 'SENTINEL_TLS_KEY', type: 'string', description: 'TLS private key path' },
+  { name: 'REDIS_URL', type: 'url', description: 'Redis connection URL' },
+  { name: 'NODE_ENV', type: 'string', default: 'production' },
+];

package/src/index.ts

@@ -60,3 +60,11 @@ export {
   securityHeadersConfigFromEnv,
   type SecurityHeadersConfig,
 } from './security-headers.js';
+
+export {
+  validateEnv,
+  requireValidEnv,
+  SENTINEL_ENV_SCHEMA,
+  type EnvVarDef,
+  type ValidationResult,
+} from './env-validation.js';