Validation

Validation is an explicit command. ramenv run does not invoke it. Newly added or imported variables receive required string rules.

Edit the schema

Rules live in the [validation] sections of .ramenv.vault.toml. Edit those sections directly:

[validation.DATABASE_URL]
type = "uri"
required = true

[validation.PORT]
type = "port"
required = true

[validation.LOG_LEVEL]
type = "regex"
pattern = "^(debug|info|warn|error)$"
required = false

[validation.WORKERS]
type = "integer"
min_value = 1
max_value = 32
required = false

These rules apply to all environments in the current vault. Each service vault has its own rules.

required defaults to true. An optional field may be absent; when present, its value is still checked. Extra variables without declared rules are not rejected.

Supported types

Type	Checks and constraints
string	Optional min_len and max_len, measured in bytes.
integer	Integer parsing; optional min_value and max_value.
float	Finite floating-point values; optional min_value and max_value.
boolean	true or false.
port	Integer from 1 through 65535.
uri	A URI/URL accepted by the URL parser.
ip	IPv4 or IPv6 address.
email	Basic @ presence and position checks, not full address validation.
regex	Match against pattern; anchor it for a whole-value match.

A string’s byte length may differ from its character count. Use ^ and $ to match the whole value with a regex rule.

Validate one or all environments

ramenv validate development
ramenv validate

The first command checks one environment in the current vault. The second checks all environments in that vault. Encrypted values are decrypted in memory for validation. Failure returns a nonzero exit code.

In a monorepo, run validation from each service directory you need to check; the command does not fan out automatically to sibling vaults.

Gate application startup

In a POSIX shell:

ramenv validate production && ramenv run production -- ./my-server

The application starts only if validation succeeds. Use your CI system’s equivalent fail-on-error behavior rather than assuming run will reject schema violations.

Review rule changes

The vault’s HMAC excludes validation rules. You can edit them without re-signing the vault, and the integrity check will not detect changes to them.

Review schema changes in code review. Use CLI commands to change environment data or encrypted values, which the integrity check covers. See security.