[Codeinx]

Problem

src/config/env.ts calls schema.parse(process.env) at module load. On failure this throws a raw ZodError — a wall of JSON at import time, before the logger exists, with no indication of which variable is wrong or what was expected.

What this does

• parseEnv now uses safeParse and, on failure, throws a formatted Error instead: one line per invalid variable ( - VARNAME: reason), never the raw ZodError dump. It still throws synchronously (existing callers/tests that assert on parseEnv rejecting a bad env are unaffected), just with a readable message instead of a JSON blob.
• Never echoes the offending value. Every Zod issue code this schema actually produces (invalid_type, invalid_string, our own custom issues) already keeps its default message value-free — the one exception is invalid_enum_value, whose default message embeds the bad value verbatim ("received 'x'"), so that one gets a synthesized message ("must be one of: ...") instead.
• The module-level load (loadEnv) catches that error, logs it via console.error, and calls process.exit(1) — a clear message and a non-zero exit, instead of an uncaught-exception stack trace.
• redactedConfig() logs the resolved effective configuration at boot (skipped under NODE_ENV=test, since every test in this repo imports this module) so an operator can confirm what the process actually loaded. Only SIGNING_ENV_SECRET_KEY — the one field that's genuine secret material — is redacted; SIGNING_KMS_KEY_ID is a reference to a key, not the key itself, so it's logged as-is.

Testing

src/config/env.exit.test.ts exercises the actual subprocess exit behavior (loadEnv()'s process.exit(1) can't be triggered in-process without killing the test runner): a valid environment exits 0 and logs the resolved config with the secret redacted; an invalid one exits non-zero with a readable per-variable message and no raw ZodError/JSON dump; and a deliberately "secret-shaped" bad enum value is confirmed never to appear in the output.

npx tsc --noEmit, npm run build, npm test (69/69), and npm audit --audit-level=high are all clean.

Scope note

Touches only src/config/env.ts (plus the new test file). No other currently-open PR touches this file.

Closes #3.

[joelpeace48-cell]

Nice work @Codeinx