@ayronforge/envil 0.6.0

package/dist/resolvers/aws.js

@@ -0,0 +1,146 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/resolvers/aws.ts
+import { Effect as Effect2 } from "effect";
+
+// src/resolvers/utils.ts
+import { Effect } from "effect";
+
+// src/resolvers/types.ts
+import { Data } from "effect";
+
+class ResolverError extends Data.TaggedError("ResolverError") {
+}
+
+// src/resolvers/utils.ts
+function toResolverError(resolver, message, cause) {
+  return new ResolverError({ resolver, message, cause });
+}
+function tryInitializeClient(resolver, message, initialize) {
+  return Effect.tryPromise({
+    try: initialize,
+    catch: (cause) => toResolverError(resolver, message, cause)
+  });
+}
+function strictOrElse(effect, options) {
+  return options.strict ? effect.pipe(Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause))) : effect.pipe(Effect.orElseSucceed(options.fallback));
+}
+function keyValueResultsToRecord(values) {
+  const result = {};
+  for (const { envKey, value } of values) {
+    result[envKey] = value;
+  }
+  return result;
+}
+function fillMissingMapValues(ids, values) {
+  for (const id of ids) {
+    if (!values.has(id)) {
+      values.set(id, undefined);
+    }
+  }
+}
+
+// src/resolvers/aws.ts
+function createSdkClient(region) {
+  return tryInitializeClient("aws", "Failed to initialize AWS Secrets Manager client", async () => {
+    const sdk = await import("@aws-sdk/client-secrets-manager");
+    const sdkClient = new sdk.SecretsManagerClient(region ? { region } : {});
+    return {
+      getSecret: async (secretId) => {
+        const response = await sdkClient.send(new sdk.GetSecretValueCommand({ SecretId: secretId }));
+        return response.SecretString ?? undefined;
+      },
+      getSecrets: async (secretIds) => {
+        const result = new Map;
+        for (let i = 0;i < secretIds.length; i += 20) {
+          const batch = secretIds.slice(i, i + 20);
+          const response = await sdkClient.send(new sdk.BatchGetSecretValueCommand({ SecretIdList: batch }));
+          for (const secretValue of response.SecretValues ?? []) {
+            if (secretValue.Name) {
+              result.set(secretValue.Name, secretValue.SecretString ?? undefined);
+            }
+          }
+          fillMissingMapValues(batch, result);
+        }
+        return result;
+      }
+    };
+  });
+}
+function fromAwsSecrets(opts) {
+  return Effect2.gen(function* () {
+    const strict = opts.strict ?? false;
+    const client = yield* createSdkClient(opts.region);
+    const secretIdToKeys = new Map;
+    for (const [envKey, ref] of Object.entries(opts.secrets)) {
+      const hashIndex = ref.indexOf("#");
+      const secretId = hashIndex >= 0 ? ref.slice(0, hashIndex) : ref;
+      const jsonKey = hashIndex >= 0 ? ref.slice(hashIndex + 1) : undefined;
+      const existing = secretIdToKeys.get(secretId) ?? [];
+      existing.push({ envKey, jsonKey });
+      secretIdToKeys.set(secretId, existing);
+    }
+    const uniqueSecretIds = [...secretIdToKeys.keys()];
+    const secretValues = new Map;
+    if (uniqueSecretIds.length === 1) {
+      const secretId = uniqueSecretIds[0];
+      const value = yield* strictOrElse(Effect2.tryPromise(() => client.getSecret(secretId)), {
+        strict,
+        resolver: "aws",
+        message: `Failed to resolve secret "${secretId}"`,
+        fallback: () => {
+          return;
+        }
+      });
+      secretValues.set(secretId, value);
+    } else {
+      const batchResult = yield* strictOrElse(Effect2.tryPromise(() => client.getSecrets(uniqueSecretIds)), {
+        strict,
+        resolver: "aws",
+        message: "Failed to resolve AWS secrets batch",
+        fallback: () => new Map
+      });
+      for (const [id, value] of batchResult) {
+        secretValues.set(id, value);
+      }
+      fillMissingMapValues(uniqueSecretIds, secretValues);
+    }
+    const result = {};
+    for (const [secretId, entries] of secretIdToKeys) {
+      const rawValue = secretValues.get(secretId);
+      for (const { envKey, jsonKey } of entries) {
+        if (rawValue === undefined) {
+          result[envKey] = undefined;
+          continue;
+        }
+        if (!jsonKey) {
+          result[envKey] = rawValue;
+          continue;
+        }
+        try {
+          const parsed = JSON.parse(rawValue);
+          result[envKey] = parsed[jsonKey] !== undefined ? String(parsed[jsonKey]) : undefined;
+        } catch (cause) {
+          if (strict) {
+            return yield* toResolverError("aws", `Failed to parse secret "${secretId}" as JSON while extracting key "${jsonKey}"`, cause);
+          }
+          result[envKey] = undefined;
+        }
+      }
+    }
+    return result;
+  });
+}
+export {
+  fromAwsSecrets,
+  ResolverError
+};
+
+//# debugId=CF166752E79C53F364756E2164756E21
+//# sourceMappingURL=aws.js.map

package/dist/resolvers/aws.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/resolvers/aws.ts", "../src/resolvers/utils.ts", "../src/resolvers/types.ts"],
+  "sourcesContent": [
+    "import { Effect } from \"effect\";\n\nimport { ResolverError, type ResolverResult } from \"./types.ts\";\nimport {\n  fillMissingMapValues,\n  strictOrElse,\n  toResolverError,\n  tryInitializeClient,\n} from \"./utils.ts\";\n\nexport { ResolverError } from \"./types.ts\";\n\ninterface AwsSecretsOptions<K extends string = string> {\n  secrets: Record<K, string>;\n  region?: string;\n  strict?: boolean;\n}\n\nfunction createSdkClient(region?: string): Effect.Effect<\n  {\n    getSecret: (secretId: string) => Promise<string | undefined>;\n    getSecrets: (secretIds: string[]) => Promise<Map<string, string | undefined>>;\n  },\n  ResolverError\n> {\n  return tryInitializeClient(\"aws\", \"Failed to initialize AWS Secrets Manager client\", async () => {\n    const sdk = await import(\"@aws-sdk/client-secrets-manager\");\n    const sdkClient = new sdk.SecretsManagerClient(region ? { region } : {});\n\n    return {\n      getSecret: async (secretId: string) => {\n        const response = await sdkClient.send(\n          new sdk.GetSecretValueCommand({ SecretId: secretId }),\n        );\n        return response.SecretString ?? undefined;\n      },\n      getSecrets: async (secretIds: string[]) => {\n        const result = new Map<string, string | undefined>();\n\n        for (let i = 0; i < secretIds.length; i += 20) {\n          const batch = secretIds.slice(i, i + 20);\n          const response = await sdkClient.send(\n            new sdk.BatchGetSecretValueCommand({ SecretIdList: batch }),\n          );\n\n          for (const secretValue of response.SecretValues ?? []) {\n            if (secretValue.Name) {\n              result.set(secretValue.Name, secretValue.SecretString ?? undefined);\n            }\n          }\n\n          fillMissingMapValues(batch, result);\n        }\n\n        return result;\n      },\n    };\n  });\n}\n\nexport function fromAwsSecrets<K extends string>(\n  opts: AwsSecretsOptions<K>,\n): Effect.Effect<ResolverResult<K>, ResolverError>;\nexport function fromAwsSecrets(\n  opts: AwsSecretsOptions,\n): Effect.Effect<ResolverResult, ResolverError> {\n  return Effect.gen(function* () {\n    const strict = opts.strict ?? false;\n    const client = yield* createSdkClient(opts.region);\n\n    // Group env keys by secret ID to minimize API calls.\n    const secretIdToKeys = new Map<string, { envKey: string; jsonKey?: string }[]>();\n    for (const [envKey, ref] of Object.entries(opts.secrets)) {\n      const hashIndex = ref.indexOf(\"#\");\n      const secretId = hashIndex >= 0 ? ref.slice(0, hashIndex) : ref;\n      const jsonKey = hashIndex >= 0 ? ref.slice(hashIndex + 1) : undefined;\n\n      const existing = secretIdToKeys.get(secretId) ?? [];\n      existing.push({ envKey, jsonKey });\n      secretIdToKeys.set(secretId, existing);\n    }\n\n    const uniqueSecretIds = [...secretIdToKeys.keys()];\n    const secretValues = new Map<string, string | undefined>();\n\n    if (uniqueSecretIds.length === 1) {\n      const secretId = uniqueSecretIds[0]!;\n      const value = yield* strictOrElse(\n        Effect.tryPromise(() => client.getSecret(secretId)),\n        {\n          strict,\n          resolver: \"aws\",\n          message: `Failed to resolve secret \"${secretId}\"`,\n          fallback: () => undefined,\n        },\n      );\n      secretValues.set(secretId, value);\n    } else {\n      const batchResult = yield* strictOrElse(\n        Effect.tryPromise(() => client.getSecrets(uniqueSecretIds)),\n        {\n          strict,\n          resolver: \"aws\",\n          message: \"Failed to resolve AWS secrets batch\",\n          fallback: () => new Map<string, string | undefined>(),\n        },\n      );\n\n      for (const [id, value] of batchResult) {\n        secretValues.set(id, value);\n      }\n      fillMissingMapValues(uniqueSecretIds, secretValues);\n    }\n\n    const result: Record<string, string | undefined> = {};\n    for (const [secretId, entries] of secretIdToKeys) {\n      const rawValue = secretValues.get(secretId);\n      for (const { envKey, jsonKey } of entries) {\n        if (rawValue === undefined) {\n          result[envKey] = undefined;\n          continue;\n        }\n\n        if (!jsonKey) {\n          result[envKey] = rawValue;\n          continue;\n        }\n\n        try {\n          const parsed = JSON.parse(rawValue) as Record<string, unknown>;\n          result[envKey] = parsed[jsonKey] !== undefined ? String(parsed[jsonKey]) : undefined;\n        } catch (cause) {\n          if (strict) {\n            return yield* toResolverError(\n              \"aws\",\n              `Failed to parse secret \"${secretId}\" as JSON while extracting key \"${jsonKey}\"`,\n              cause,\n            );\n          }\n\n          result[envKey] = undefined;\n        }\n      }\n    }\n\n    return result;\n  });\n}\n",
+    "import { Effect } from \"effect\";\n\nimport { ResolverError } from \"./types.ts\";\n\nexport function toResolverError(resolver: string, message: string, cause?: unknown): ResolverError {\n  return new ResolverError({ resolver, message, cause });\n}\n\nexport function tryInitializeClient<A>(\n  resolver: string,\n  message: string,\n  initialize: () => Promise<A>,\n): Effect.Effect<A, ResolverError> {\n  return Effect.tryPromise({\n    try: initialize,\n    catch: (cause) => toResolverError(resolver, message, cause),\n  });\n}\n\nexport function strictOrElse<A>(\n  effect: Effect.Effect<A, unknown>,\n  options: {\n    strict: boolean;\n    resolver: string;\n    message: string;\n    fallback: () => A;\n  },\n): Effect.Effect<A, ResolverError> {\n  return options.strict\n    ? effect.pipe(\n        Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause)),\n      )\n    : effect.pipe(Effect.orElseSucceed(options.fallback));\n}\n\nexport function keyValueResultsToRecord<K extends string>(\n  values: ReadonlyArray<{ envKey: K; value: string | undefined }>,\n): Record<K, string | undefined> {\n  const result = {} as Record<K, string | undefined>;\n  for (const { envKey, value } of values) {\n    result[envKey] = value;\n  }\n  return result;\n}\n\nexport function fillMissingMapValues(\n  ids: readonly string[],\n  values: Map<string, string | undefined>,\n): void {\n  for (const id of ids) {\n    if (!values.has(id)) {\n      values.set(id, undefined);\n    }\n  }\n}\n",
+    "import { Data } from \"effect\";\n\nexport type ResolverResult<K extends string = string> = Record<K, string | undefined>;\n\nexport class ResolverError extends Data.TaggedError(\"ResolverError\")<{\n  readonly resolver: string;\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n\nexport interface SecretClient {\n  getSecret: (secretId: string) => Promise<string | undefined>;\n  getSecrets?: (secretIds: string[]) => Promise<Map<string, string | undefined>>;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAAA,mBAAS;;;ACAT;;;ACAA;AAAA;AAIO,MAAM,sBAAsB,KAAK,YAAY,eAAe,EAIhE;AAAC;;;ADJG,SAAS,eAAe,CAAC,UAAkB,SAAiB,OAAgC;AAAA,EACjG,OAAO,IAAI,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC;AAAA;AAGhD,SAAS,mBAAsB,CACpC,UACA,SACA,YACiC;AAAA,EACjC,OAAO,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,OAAO,CAAC,UAAU,gBAAgB,UAAU,SAAS,KAAK;AAAA,EAC5D,CAAC;AAAA;AAGI,SAAS,YAAe,CAC7B,QACA,SAMiC;AAAA,EACjC,OAAO,QAAQ,SACX,OAAO,KACL,OAAO,SAAS,CAAC,UAAU,gBAAgB,QAAQ,UAAU,QAAQ,SAAS,KAAK,CAAC,CACtF,IACA,OAAO,KAAK,OAAO,cAAc,QAAQ,QAAQ,CAAC;AAAA;AAGjD,SAAS,uBAAyC,CACvD,QAC+B;AAAA,EAC/B,MAAM,SAAS,CAAC;AAAA,EAChB,aAAa,QAAQ,WAAW,QAAQ;AAAA,IACtC,OAAO,UAAU;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,oBAAoB,CAClC,KACA,QACM;AAAA,EACN,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,MACnB,OAAO,IAAI,IAAI,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA;;;ADnCF,SAAS,eAAe,CAAC,QAMvB;AAAA,EACA,OAAO,oBAAoB,OAAO,mDAAmD,YAAY;AAAA,IAC/F,MAAM,MAAM,MAAa;AAAA,IACzB,MAAM,YAAY,IAAI,IAAI,qBAAqB,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAAA,IAEvE,OAAO;AAAA,MACL,WAAW,OAAO,aAAqB;AAAA,QACrC,MAAM,WAAW,MAAM,UAAU,KAC/B,IAAI,IAAI,sBAAsB,EAAE,UAAU,SAAS,CAAC,CACtD;AAAA,QACA,OAAO,SAAS,gBAAgB;AAAA;AAAA,MAElC,YAAY,OAAO,cAAwB;AAAA,QACzC,MAAM,SAAS,IAAI;AAAA,QAEnB,SAAS,IAAI,EAAG,IAAI,UAAU,QAAQ,KAAK,IAAI;AAAA,UAC7C,MAAM,QAAQ,UAAU,MAAM,GAAG,IAAI,EAAE;AAAA,UACvC,MAAM,WAAW,MAAM,UAAU,KAC/B,IAAI,IAAI,2BAA2B,EAAE,cAAc,MAAM,CAAC,CAC5D;AAAA,UAEA,WAAW,eAAe,SAAS,gBAAgB,CAAC,GAAG;AAAA,YACrD,IAAI,YAAY,MAAM;AAAA,cACpB,OAAO,IAAI,YAAY,MAAM,YAAY,gBAAgB,SAAS;AAAA,YACpE;AAAA,UACF;AAAA,UAEA,qBAAqB,OAAO,MAAM;AAAA,QACpC;AAAA,QAEA,OAAO;AAAA;AAAA,IAEX;AAAA,GACD;AAAA;AAMI,SAAS,cAAc,CAC5B,MAC8C;AAAA,EAC9C,OAAO,QAAO,IAAI,UAAU,GAAG;AAAA,IAC7B,MAAM,SAAS,KAAK,UAAU;AAAA,IAC9B,MAAM,SAAS,OAAO,gBAAgB,KAAK,MAAM;AAAA,IAGjD,MAAM,iBAAiB,IAAI;AAAA,IAC3B,YAAY,QAAQ,QAAQ,OAAO,QAAQ,KAAK,OAAO,GAAG;AAAA,MACxD,MAAM,YAAY,IAAI,QAAQ,GAAG;AAAA,MACjC,MAAM,WAAW,aAAa,IAAI,IAAI,MAAM,GAAG,SAAS,IAAI;AAAA,MAC5D,MAAM,UAAU,aAAa,IAAI,IAAI,MAAM,YAAY,CAAC,IAAI;AAAA,MAE5D,MAAM,WAAW,eAAe,IAAI,QAAQ,KAAK,CAAC;AAAA,MAClD,SAAS,KAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,MACjC,eAAe,IAAI,UAAU,QAAQ;AAAA,IACvC;AAAA,IAEA,MAAM,kBAAkB,CAAC,GAAG,eAAe,KAAK,CAAC;AAAA,IACjD,MAAM,eAAe,IAAI;AAAA,IAEzB,IAAI,gBAAgB,WAAW,GAAG;AAAA,MAChC,MAAM,WAAW,gBAAgB;AAAA,MACjC,MAAM,QAAQ,OAAO,aACnB,QAAO,WAAW,MAAM,OAAO,UAAU,QAAQ,CAAC,GAClD;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,SAAS,6BAA6B;AAAA,QACtC,UAAU,MAAG;AAAA,UAAG;AAAA;AAAA,MAClB,CACF;AAAA,MACA,aAAa,IAAI,UAAU,KAAK;AAAA,IAClC,EAAO;AAAA,MACL,MAAM,cAAc,OAAO,aACzB,QAAO,WAAW,MAAM,OAAO,WAAW,eAAe,CAAC,GAC1D;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU,MAAM,IAAI;AAAA,MACtB,CACF;AAAA,MAEA,YAAY,IAAI,UAAU,aAAa;AAAA,QACrC,aAAa,IAAI,IAAI,KAAK;AAAA,MAC5B;AAAA,MACA,qBAAqB,iBAAiB,YAAY;AAAA;AAAA,IAGpD,MAAM,SAA6C,CAAC;AAAA,IACpD,YAAY,UAAU,YAAY,gBAAgB;AAAA,MAChD,MAAM,WAAW,aAAa,IAAI,QAAQ;AAAA,MAC1C,aAAa,QAAQ,aAAa,SAAS;AAAA,QACzC,IAAI,aAAa,WAAW;AAAA,UAC1B,OAAO,UAAU;AAAA,UACjB;AAAA,QACF;AAAA,QAEA,IAAI,CAAC,SAAS;AAAA,UACZ,OAAO,UAAU;AAAA,UACjB;AAAA,QACF;AAAA,QAEA,IAAI;AAAA,UACF,MAAM,SAAS,KAAK,MAAM,QAAQ;AAAA,UAClC,OAAO,UAAU,OAAO,aAAa,YAAY,OAAO,OAAO,QAAQ,IAAI;AAAA,UAC3E,OAAO,OAAO;AAAA,UACd,IAAI,QAAQ;AAAA,YACV,OAAO,OAAO,gBACZ,OACA,2BAA2B,2CAA2C,YACtE,KACF;AAAA,UACF;AAAA,UAEA,OAAO,UAAU;AAAA;AAAA,MAErB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;",
+  "debugId": "CF166752E79C53F364756E2164756E21",
+  "names": []
+}

package/dist/resolvers/azure.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { ResolverError, type ResolverResult } from "./types.ts";
+export { ResolverError } from "./types.ts";
+interface AzureKeyVaultOptions<K extends string = string> {
+    secrets: Record<K, string>;
+    vaultUrl: string;
+    credential?: unknown;
+    strict?: boolean;
+}
+export declare function fromAzureKeyVault<K extends string>(opts: AzureKeyVaultOptions<K>): Effect.Effect<ResolverResult<K>, ResolverError>;

package/dist/resolvers/azure.js

@@ -0,0 +1,85 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/resolvers/azure.ts
+import { Effect as Effect2 } from "effect";
+
+// src/resolvers/utils.ts
+import { Effect } from "effect";
+
+// src/resolvers/types.ts
+import { Data } from "effect";
+
+class ResolverError extends Data.TaggedError("ResolverError") {
+}
+
+// src/resolvers/utils.ts
+function toResolverError(resolver, message, cause) {
+  return new ResolverError({ resolver, message, cause });
+}
+function tryInitializeClient(resolver, message, initialize) {
+  return Effect.tryPromise({
+    try: initialize,
+    catch: (cause) => toResolverError(resolver, message, cause)
+  });
+}
+function strictOrElse(effect, options) {
+  return options.strict ? effect.pipe(Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause))) : effect.pipe(Effect.orElseSucceed(options.fallback));
+}
+function keyValueResultsToRecord(values) {
+  const result = {};
+  for (const { envKey, value } of values) {
+    result[envKey] = value;
+  }
+  return result;
+}
+function fillMissingMapValues(ids, values) {
+  for (const id of ids) {
+    if (!values.has(id)) {
+      values.set(id, undefined);
+    }
+  }
+}
+
+// src/resolvers/azure.ts
+function fromAzureKeyVault(opts) {
+  return Effect2.gen(function* () {
+    const { secrets, vaultUrl, strict = false } = opts;
+    if (!vaultUrl) {
+      return yield* toResolverError("azure", "vaultUrl must be provided");
+    }
+    const client = yield* tryInitializeClient("azure", "Failed to initialize Azure Key Vault client", async () => {
+      const kvModule = await import("@azure/keyvault-secrets");
+      const idModule = await import("@azure/identity");
+      const credential = opts.credential ?? new idModule.DefaultAzureCredential;
+      const sdkClient = new kvModule.SecretClient(vaultUrl, credential);
+      return {
+        getSecret: async (name) => {
+          const secret = await sdkClient.getSecret(name);
+          return secret.value;
+        }
+      };
+    });
+    const results = yield* Effect2.forEach(Object.entries(secrets), ([envKey, secretName]) => strictOrElse(Effect2.tryPromise(() => client.getSecret(secretName)), {
+      strict,
+      resolver: "azure",
+      message: `Failed to resolve secret "${secretName}" for env key "${envKey}"`,
+      fallback: () => {
+        return;
+      }
+    }).pipe(Effect2.map((value) => ({ envKey, value }))), { concurrency: "unbounded" });
+    return keyValueResultsToRecord(results);
+  });
+}
+export {
+  fromAzureKeyVault,
+  ResolverError
+};
+
+//# debugId=67F5DBBDDFA11C8264756E2164756E21
+//# sourceMappingURL=azure.js.map

package/dist/resolvers/azure.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/resolvers/azure.ts", "../src/resolvers/utils.ts", "../src/resolvers/types.ts"],
+  "sourcesContent": [
+    "import { Effect } from \"effect\";\n\nimport { ResolverError, type ResolverResult } from \"./types.ts\";\nimport {\n  keyValueResultsToRecord,\n  strictOrElse,\n  toResolverError,\n  tryInitializeClient,\n} from \"./utils.ts\";\n\nexport { ResolverError } from \"./types.ts\";\n\ninterface AzureKeyVaultOptions<K extends string = string> {\n  secrets: Record<K, string>;\n  vaultUrl: string;\n  credential?: unknown;\n  strict?: boolean;\n}\n\nexport function fromAzureKeyVault<K extends string>(\n  opts: AzureKeyVaultOptions<K>,\n): Effect.Effect<ResolverResult<K>, ResolverError>;\nexport function fromAzureKeyVault(\n  opts: AzureKeyVaultOptions,\n): Effect.Effect<ResolverResult, ResolverError> {\n  return Effect.gen(function* () {\n    const { secrets, vaultUrl, strict = false } = opts;\n\n    if (!vaultUrl) {\n      return yield* toResolverError(\"azure\", \"vaultUrl must be provided\");\n    }\n\n    const client = yield* tryInitializeClient(\n      \"azure\",\n      \"Failed to initialize Azure Key Vault client\",\n      async () => {\n        const kvModule = await import(\"@azure/keyvault-secrets\");\n        const idModule = await import(\"@azure/identity\");\n        const credential = opts.credential ?? new idModule.DefaultAzureCredential();\n        const sdkClient = new kvModule.SecretClient(vaultUrl, credential);\n\n        return {\n          getSecret: async (name: string) => {\n            const secret = await sdkClient.getSecret(name);\n            return secret.value;\n          },\n        };\n      },\n    );\n\n    const results = yield* Effect.forEach(\n      Object.entries(secrets),\n      ([envKey, secretName]) =>\n        strictOrElse(\n          Effect.tryPromise(() => client.getSecret(secretName)),\n          {\n            strict,\n            resolver: \"azure\",\n            message: `Failed to resolve secret \"${secretName}\" for env key \"${envKey}\"`,\n            fallback: () => undefined,\n          },\n        ).pipe(Effect.map((value) => ({ envKey, value }))),\n      { concurrency: \"unbounded\" },\n    );\n\n    return keyValueResultsToRecord(results);\n  });\n}\n",
+    "import { Effect } from \"effect\";\n\nimport { ResolverError } from \"./types.ts\";\n\nexport function toResolverError(resolver: string, message: string, cause?: unknown): ResolverError {\n  return new ResolverError({ resolver, message, cause });\n}\n\nexport function tryInitializeClient<A>(\n  resolver: string,\n  message: string,\n  initialize: () => Promise<A>,\n): Effect.Effect<A, ResolverError> {\n  return Effect.tryPromise({\n    try: initialize,\n    catch: (cause) => toResolverError(resolver, message, cause),\n  });\n}\n\nexport function strictOrElse<A>(\n  effect: Effect.Effect<A, unknown>,\n  options: {\n    strict: boolean;\n    resolver: string;\n    message: string;\n    fallback: () => A;\n  },\n): Effect.Effect<A, ResolverError> {\n  return options.strict\n    ? effect.pipe(\n        Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause)),\n      )\n    : effect.pipe(Effect.orElseSucceed(options.fallback));\n}\n\nexport function keyValueResultsToRecord<K extends string>(\n  values: ReadonlyArray<{ envKey: K; value: string | undefined }>,\n): Record<K, string | undefined> {\n  const result = {} as Record<K, string | undefined>;\n  for (const { envKey, value } of values) {\n    result[envKey] = value;\n  }\n  return result;\n}\n\nexport function fillMissingMapValues(\n  ids: readonly string[],\n  values: Map<string, string | undefined>,\n): void {\n  for (const id of ids) {\n    if (!values.has(id)) {\n      values.set(id, undefined);\n    }\n  }\n}\n",
+    "import { Data } from \"effect\";\n\nexport type ResolverResult<K extends string = string> = Record<K, string | undefined>;\n\nexport class ResolverError extends Data.TaggedError(\"ResolverError\")<{\n  readonly resolver: string;\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n\nexport interface SecretClient {\n  getSecret: (secretId: string) => Promise<string | undefined>;\n  getSecrets?: (secretIds: string[]) => Promise<Map<string, string | undefined>>;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAAA,mBAAS;;;ACAT;;;ACAA;AAAA;AAIO,MAAM,sBAAsB,KAAK,YAAY,eAAe,EAIhE;AAAC;;;ADJG,SAAS,eAAe,CAAC,UAAkB,SAAiB,OAAgC;AAAA,EACjG,OAAO,IAAI,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC;AAAA;AAGhD,SAAS,mBAAsB,CACpC,UACA,SACA,YACiC;AAAA,EACjC,OAAO,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,OAAO,CAAC,UAAU,gBAAgB,UAAU,SAAS,KAAK;AAAA,EAC5D,CAAC;AAAA;AAGI,SAAS,YAAe,CAC7B,QACA,SAMiC;AAAA,EACjC,OAAO,QAAQ,SACX,OAAO,KACL,OAAO,SAAS,CAAC,UAAU,gBAAgB,QAAQ,UAAU,QAAQ,SAAS,KAAK,CAAC,CACtF,IACA,OAAO,KAAK,OAAO,cAAc,QAAQ,QAAQ,CAAC;AAAA;AAGjD,SAAS,uBAAyC,CACvD,QAC+B;AAAA,EAC/B,MAAM,SAAS,CAAC;AAAA,EAChB,aAAa,QAAQ,WAAW,QAAQ;AAAA,IACtC,OAAO,UAAU;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,oBAAoB,CAClC,KACA,QACM;AAAA,EACN,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,MACnB,OAAO,IAAI,IAAI,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA;;;AD/BK,SAAS,iBAAiB,CAC/B,MAC8C;AAAA,EAC9C,OAAO,QAAO,IAAI,UAAU,GAAG;AAAA,IAC7B,QAAQ,SAAS,UAAU,SAAS,UAAU;AAAA,IAE9C,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,OAAO,gBAAgB,SAAS,2BAA2B;AAAA,IACpE;AAAA,IAEA,MAAM,SAAS,OAAO,oBACpB,SACA,+CACA,YAAY;AAAA,MACV,MAAM,WAAW,MAAa;AAAA,MAC9B,MAAM,WAAW,MAAa;AAAA,MAC9B,MAAM,aAAa,KAAK,cAAc,IAAI,SAAS;AAAA,MACnD,MAAM,YAAY,IAAI,SAAS,aAAa,UAAU,UAAU;AAAA,MAEhE,OAAO;AAAA,QACL,WAAW,OAAO,SAAiB;AAAA,UACjC,MAAM,SAAS,MAAM,UAAU,UAAU,IAAI;AAAA,UAC7C,OAAO,OAAO;AAAA;AAAA,MAElB;AAAA,KAEJ;AAAA,IAEA,MAAM,UAAU,OAAO,QAAO,QAC5B,OAAO,QAAQ,OAAO,GACtB,EAAE,QAAQ,gBACR,aACE,QAAO,WAAW,MAAM,OAAO,UAAU,UAAU,CAAC,GACpD;AAAA,MACE;AAAA,MACA,UAAU;AAAA,MACV,SAAS,6BAA6B,4BAA4B;AAAA,MAClE,UAAU,MAAG;AAAA,QAAG;AAAA;AAAA,IAClB,CACF,EAAE,KAAK,QAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC,GACnD,EAAE,aAAa,YAAY,CAC7B;AAAA,IAEA,OAAO,wBAAwB,OAAO;AAAA,GACvC;AAAA;",
+  "debugId": "67F5DBBDDFA11C8264756E2164756E21",
+  "names": []
+}

package/dist/resolvers/gcp.d.ts

@@ -0,0 +1,10 @@
+import { Effect } from "effect";
+import { ResolverError, type ResolverResult } from "./types.ts";
+export { ResolverError } from "./types.ts";
+interface GcpSecretsOptions<K extends string = string> {
+    secrets: Record<K, string>;
+    projectId?: string;
+    version?: string;
+    strict?: boolean;
+}
+export declare function fromGcpSecrets<K extends string>(opts: GcpSecretsOptions<K>): Effect.Effect<ResolverResult<K>, ResolverError>;

package/dist/resolvers/gcp.js

@@ -0,0 +1,88 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/resolvers/gcp.ts
+import { Effect as Effect2 } from "effect";
+
+// src/resolvers/utils.ts
+import { Effect } from "effect";
+
+// src/resolvers/types.ts
+import { Data } from "effect";
+
+class ResolverError extends Data.TaggedError("ResolverError") {
+}
+
+// src/resolvers/utils.ts
+function toResolverError(resolver, message, cause) {
+  return new ResolverError({ resolver, message, cause });
+}
+function tryInitializeClient(resolver, message, initialize) {
+  return Effect.tryPromise({
+    try: initialize,
+    catch: (cause) => toResolverError(resolver, message, cause)
+  });
+}
+function strictOrElse(effect, options) {
+  return options.strict ? effect.pipe(Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause))) : effect.pipe(Effect.orElseSucceed(options.fallback));
+}
+function keyValueResultsToRecord(values) {
+  const result = {};
+  for (const { envKey, value } of values) {
+    result[envKey] = value;
+  }
+  return result;
+}
+function fillMissingMapValues(ids, values) {
+  for (const id of ids) {
+    if (!values.has(id)) {
+      values.set(id, undefined);
+    }
+  }
+}
+
+// src/resolvers/gcp.ts
+function fromGcpSecrets(opts) {
+  return Effect2.gen(function* () {
+    const { secrets, projectId, version = "latest", strict = false } = opts;
+    const usesShortSecretName = Object.values(secrets).some((secretName) => !secretName.startsWith("projects/"));
+    if (usesShortSecretName && !projectId) {
+      return yield* toResolverError("gcp", "projectId must be provided when using short secret names");
+    }
+    const client = yield* tryInitializeClient("gcp", "Failed to initialize GCP Secret Manager client", async () => {
+      const sdk = await import("@google-cloud/secret-manager");
+      const sdkClient = new sdk.SecretManagerServiceClient;
+      return {
+        getSecret: async (name) => {
+          const [response] = await sdkClient.accessSecretVersion({ name });
+          const data = response.payload?.data;
+          return data instanceof Uint8Array ? new TextDecoder().decode(data) : data ?? undefined;
+        }
+      };
+    });
+    const results = yield* Effect2.forEach(Object.entries(secrets), ([envKey, secretName]) => {
+      const name = secretName.startsWith("projects/") ? secretName : `projects/${projectId}/secrets/${secretName}/versions/${version}`;
+      return strictOrElse(Effect2.tryPromise(() => client.getSecret(name)), {
+        strict,
+        resolver: "gcp",
+        message: `Failed to resolve secret "${secretName}" for env key "${envKey}"`,
+        fallback: () => {
+          return;
+        }
+      }).pipe(Effect2.map((value) => ({ envKey, value })));
+    }, { concurrency: "unbounded" });
+    return keyValueResultsToRecord(results);
+  });
+}
+export {
+  fromGcpSecrets,
+  ResolverError
+};
+
+//# debugId=801784A885D1CD3064756E2164756E21
+//# sourceMappingURL=gcp.js.map

package/dist/resolvers/gcp.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/resolvers/gcp.ts", "../src/resolvers/utils.ts", "../src/resolvers/types.ts"],
+  "sourcesContent": [
+    "import { Effect } from \"effect\";\n\nimport { ResolverError, type ResolverResult } from \"./types.ts\";\nimport {\n  keyValueResultsToRecord,\n  strictOrElse,\n  toResolverError,\n  tryInitializeClient,\n} from \"./utils.ts\";\n\nexport { ResolverError } from \"./types.ts\";\n\ninterface GcpSecretsOptions<K extends string = string> {\n  secrets: Record<K, string>;\n  projectId?: string;\n  version?: string;\n  strict?: boolean;\n}\n\nexport function fromGcpSecrets<K extends string>(\n  opts: GcpSecretsOptions<K>,\n): Effect.Effect<ResolverResult<K>, ResolverError>;\nexport function fromGcpSecrets(\n  opts: GcpSecretsOptions,\n): Effect.Effect<ResolverResult, ResolverError> {\n  return Effect.gen(function* () {\n    const { secrets, projectId, version = \"latest\", strict = false } = opts;\n    const usesShortSecretName = Object.values(secrets).some(\n      (secretName) => !secretName.startsWith(\"projects/\"),\n    );\n\n    if (usesShortSecretName && !projectId) {\n      return yield* toResolverError(\n        \"gcp\",\n        \"projectId must be provided when using short secret names\",\n      );\n    }\n\n    const client = yield* tryInitializeClient(\n      \"gcp\",\n      \"Failed to initialize GCP Secret Manager client\",\n      async () => {\n        const sdk = await import(\"@google-cloud/secret-manager\");\n        const sdkClient = new sdk.SecretManagerServiceClient();\n        return {\n          getSecret: async (name: string) => {\n            const [response] = await sdkClient.accessSecretVersion({ name });\n            const data = response.payload?.data;\n            return data instanceof Uint8Array\n              ? new TextDecoder().decode(data)\n              : (data ?? undefined);\n          },\n        };\n      },\n    );\n\n    const results = yield* Effect.forEach(\n      Object.entries(secrets),\n      ([envKey, secretName]) => {\n        const name = secretName.startsWith(\"projects/\")\n          ? secretName\n          : `projects/${projectId}/secrets/${secretName}/versions/${version}`;\n\n        return strictOrElse(\n          Effect.tryPromise(() => client.getSecret(name)),\n          {\n            strict,\n            resolver: \"gcp\",\n            message: `Failed to resolve secret \"${secretName}\" for env key \"${envKey}\"`,\n            fallback: () => undefined,\n          },\n        ).pipe(Effect.map((value) => ({ envKey, value })));\n      },\n      { concurrency: \"unbounded\" },\n    );\n\n    return keyValueResultsToRecord(results);\n  });\n}\n",
+    "import { Effect } from \"effect\";\n\nimport { ResolverError } from \"./types.ts\";\n\nexport function toResolverError(resolver: string, message: string, cause?: unknown): ResolverError {\n  return new ResolverError({ resolver, message, cause });\n}\n\nexport function tryInitializeClient<A>(\n  resolver: string,\n  message: string,\n  initialize: () => Promise<A>,\n): Effect.Effect<A, ResolverError> {\n  return Effect.tryPromise({\n    try: initialize,\n    catch: (cause) => toResolverError(resolver, message, cause),\n  });\n}\n\nexport function strictOrElse<A>(\n  effect: Effect.Effect<A, unknown>,\n  options: {\n    strict: boolean;\n    resolver: string;\n    message: string;\n    fallback: () => A;\n  },\n): Effect.Effect<A, ResolverError> {\n  return options.strict\n    ? effect.pipe(\n        Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause)),\n      )\n    : effect.pipe(Effect.orElseSucceed(options.fallback));\n}\n\nexport function keyValueResultsToRecord<K extends string>(\n  values: ReadonlyArray<{ envKey: K; value: string | undefined }>,\n): Record<K, string | undefined> {\n  const result = {} as Record<K, string | undefined>;\n  for (const { envKey, value } of values) {\n    result[envKey] = value;\n  }\n  return result;\n}\n\nexport function fillMissingMapValues(\n  ids: readonly string[],\n  values: Map<string, string | undefined>,\n): void {\n  for (const id of ids) {\n    if (!values.has(id)) {\n      values.set(id, undefined);\n    }\n  }\n}\n",
+    "import { Data } from \"effect\";\n\nexport type ResolverResult<K extends string = string> = Record<K, string | undefined>;\n\nexport class ResolverError extends Data.TaggedError(\"ResolverError\")<{\n  readonly resolver: string;\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n\nexport interface SecretClient {\n  getSecret: (secretId: string) => Promise<string | undefined>;\n  getSecrets?: (secretIds: string[]) => Promise<Map<string, string | undefined>>;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAAA,mBAAS;;;ACAT;;;ACAA;AAAA;AAIO,MAAM,sBAAsB,KAAK,YAAY,eAAe,EAIhE;AAAC;;;ADJG,SAAS,eAAe,CAAC,UAAkB,SAAiB,OAAgC;AAAA,EACjG,OAAO,IAAI,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC;AAAA;AAGhD,SAAS,mBAAsB,CACpC,UACA,SACA,YACiC;AAAA,EACjC,OAAO,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,OAAO,CAAC,UAAU,gBAAgB,UAAU,SAAS,KAAK;AAAA,EAC5D,CAAC;AAAA;AAGI,SAAS,YAAe,CAC7B,QACA,SAMiC;AAAA,EACjC,OAAO,QAAQ,SACX,OAAO,KACL,OAAO,SAAS,CAAC,UAAU,gBAAgB,QAAQ,UAAU,QAAQ,SAAS,KAAK,CAAC,CACtF,IACA,OAAO,KAAK,OAAO,cAAc,QAAQ,QAAQ,CAAC;AAAA;AAGjD,SAAS,uBAAyC,CACvD,QAC+B;AAAA,EAC/B,MAAM,SAAS,CAAC;AAAA,EAChB,aAAa,QAAQ,WAAW,QAAQ;AAAA,IACtC,OAAO,UAAU;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,oBAAoB,CAClC,KACA,QACM;AAAA,EACN,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,MACnB,OAAO,IAAI,IAAI,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA;;;AD/BK,SAAS,cAAc,CAC5B,MAC8C;AAAA,EAC9C,OAAO,QAAO,IAAI,UAAU,GAAG;AAAA,IAC7B,QAAQ,SAAS,WAAW,UAAU,UAAU,SAAS,UAAU;AAAA,IACnE,MAAM,sBAAsB,OAAO,OAAO,OAAO,EAAE,KACjD,CAAC,eAAe,CAAC,WAAW,WAAW,WAAW,CACpD;AAAA,IAEA,IAAI,uBAAuB,CAAC,WAAW;AAAA,MACrC,OAAO,OAAO,gBACZ,OACA,0DACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,OAAO,oBACpB,OACA,kDACA,YAAY;AAAA,MACV,MAAM,MAAM,MAAa;AAAA,MACzB,MAAM,YAAY,IAAI,IAAI;AAAA,MAC1B,OAAO;AAAA,QACL,WAAW,OAAO,SAAiB;AAAA,UACjC,OAAO,YAAY,MAAM,UAAU,oBAAoB,EAAE,KAAK,CAAC;AAAA,UAC/D,MAAM,OAAO,SAAS,SAAS;AAAA,UAC/B,OAAO,gBAAgB,aACnB,IAAI,YAAY,EAAE,OAAO,IAAI,IAC5B,QAAQ;AAAA;AAAA,MAEjB;AAAA,KAEJ;AAAA,IAEA,MAAM,UAAU,OAAO,QAAO,QAC5B,OAAO,QAAQ,OAAO,GACtB,EAAE,QAAQ,gBAAgB;AAAA,MACxB,MAAM,OAAO,WAAW,WAAW,WAAW,IAC1C,aACA,YAAY,qBAAqB,uBAAuB;AAAA,MAE5D,OAAO,aACL,QAAO,WAAW,MAAM,OAAO,UAAU,IAAI,CAAC,GAC9C;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,SAAS,6BAA6B,4BAA4B;AAAA,QAClE,UAAU,MAAG;AAAA,UAAG;AAAA;AAAA,MAClB,CACF,EAAE,KAAK,QAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,MAAM,EAAE,CAAC;AAAA,OAEnD,EAAE,aAAa,YAAY,CAC7B;AAAA,IAEA,OAAO,wBAAwB,OAAO;AAAA,GACvC;AAAA;",
+  "debugId": "801784A885D1CD3064756E2164756E21",
+  "names": []
+}

package/dist/resolvers/onepassword.d.ts

@@ -0,0 +1,9 @@
+import { Effect } from "effect";
+import { ResolverError, type ResolverResult } from "./types.ts";
+export { ResolverError } from "./types.ts";
+interface OnePasswordOptions<K extends string = string> {
+    secrets: Record<K, string>;
+    serviceAccountToken?: string;
+    strict?: boolean;
+}
+export declare function fromOnePassword<K extends string>(opts: OnePasswordOptions<K>): Effect.Effect<ResolverResult<K>, ResolverError>;

package/dist/resolvers/onepassword.js

@@ -0,0 +1,91 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined")
+    return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/resolvers/onepassword.ts
+import { Effect as Effect2 } from "effect";
+
+// src/resolvers/utils.ts
+import { Effect } from "effect";
+
+// src/resolvers/types.ts
+import { Data } from "effect";
+
+class ResolverError extends Data.TaggedError("ResolverError") {
+}
+
+// src/resolvers/utils.ts
+function toResolverError(resolver, message, cause) {
+  return new ResolverError({ resolver, message, cause });
+}
+function tryInitializeClient(resolver, message, initialize) {
+  return Effect.tryPromise({
+    try: initialize,
+    catch: (cause) => toResolverError(resolver, message, cause)
+  });
+}
+function strictOrElse(effect, options) {
+  return options.strict ? effect.pipe(Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause))) : effect.pipe(Effect.orElseSucceed(options.fallback));
+}
+function keyValueResultsToRecord(values) {
+  const result = {};
+  for (const { envKey, value } of values) {
+    result[envKey] = value;
+  }
+  return result;
+}
+function fillMissingMapValues(ids, values) {
+  for (const id of ids) {
+    if (!values.has(id)) {
+      values.set(id, undefined);
+    }
+  }
+}
+
+// src/resolvers/onepassword.ts
+function fromOnePassword(opts) {
+  return Effect2.gen(function* () {
+    const { secrets, strict = false } = opts;
+    const token = opts.serviceAccountToken ?? process.env.OP_SERVICE_ACCOUNT_TOKEN;
+    if (!token) {
+      return yield* toResolverError("1password", "serviceAccountToken (or OP_SERVICE_ACCOUNT_TOKEN env var) must be provided");
+    }
+    const client = yield* tryInitializeClient("1password", "Failed to initialize 1Password client", async () => {
+      const sdk = await import("@1password/sdk");
+      const sdkClient = await sdk.createClient({
+        auth: token,
+        integrationName: "envil",
+        integrationVersion: "1.0.0"
+      });
+      return {
+        resolveAll: async (refs2) => sdkClient.secrets.resolveAll(refs2)
+      };
+    });
+    const entries = Object.entries(secrets);
+    const refs = entries.map(([, ref]) => ref);
+    const resolved = yield* strictOrElse(Effect2.tryPromise(() => client.resolveAll(refs)).pipe(Effect2.map((values) => values)), {
+      strict,
+      resolver: "1password",
+      message: "Failed to resolve 1Password secrets",
+      fallback: () => null
+    });
+    if (!resolved) {
+      return keyValueResultsToRecord(entries.map(([envKey]) => ({ envKey, value: undefined })));
+    }
+    return keyValueResultsToRecord(entries.map(([envKey], index) => ({
+      envKey,
+      value: resolved[index]
+    })));
+  });
+}
+export {
+  fromOnePassword,
+  ResolverError
+};
+
+//# debugId=52E64B21781AEF3864756E2164756E21
+//# sourceMappingURL=onepassword.js.map

package/dist/resolvers/onepassword.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/resolvers/onepassword.ts", "../src/resolvers/utils.ts", "../src/resolvers/types.ts"],
+  "sourcesContent": [
+    "import { Effect } from \"effect\";\n\nimport { ResolverError, type ResolverResult } from \"./types.ts\";\nimport {\n  keyValueResultsToRecord,\n  strictOrElse,\n  toResolverError,\n  tryInitializeClient,\n} from \"./utils.ts\";\n\nexport { ResolverError } from \"./types.ts\";\n\ninterface OnePasswordOptions<K extends string = string> {\n  secrets: Record<K, string>;\n  serviceAccountToken?: string;\n  strict?: boolean;\n}\n\nexport function fromOnePassword<K extends string>(\n  opts: OnePasswordOptions<K>,\n): Effect.Effect<ResolverResult<K>, ResolverError>;\nexport function fromOnePassword(\n  opts: OnePasswordOptions,\n): Effect.Effect<ResolverResult, ResolverError> {\n  return Effect.gen(function* () {\n    const { secrets, strict = false } = opts;\n\n    const token = opts.serviceAccountToken ?? process.env.OP_SERVICE_ACCOUNT_TOKEN;\n    if (!token) {\n      return yield* toResolverError(\n        \"1password\",\n        \"serviceAccountToken (or OP_SERVICE_ACCOUNT_TOKEN env var) must be provided\",\n      );\n    }\n\n    const client = yield* tryInitializeClient(\n      \"1password\",\n      \"Failed to initialize 1Password client\",\n      async () => {\n        const sdk = await import(\"@1password/sdk\");\n        const sdkClient = await sdk.createClient({\n          auth: token,\n          integrationName: \"envil\",\n          integrationVersion: \"1.0.0\",\n        });\n\n        return {\n          resolveAll: async (refs: string[]) => sdkClient.secrets.resolveAll(refs),\n        };\n      },\n    );\n\n    const entries = Object.entries(secrets);\n    const refs = entries.map(([, ref]) => ref);\n\n    const resolved = yield* strictOrElse(\n      Effect.tryPromise(() => client.resolveAll(refs)).pipe(\n        Effect.map((values) => values as string[] | null),\n      ),\n      {\n        strict,\n        resolver: \"1password\",\n        message: \"Failed to resolve 1Password secrets\",\n        fallback: () => null,\n      },\n    );\n\n    if (!resolved) {\n      return keyValueResultsToRecord(entries.map(([envKey]) => ({ envKey, value: undefined })));\n    }\n\n    return keyValueResultsToRecord(\n      entries.map(([envKey], index) => ({\n        envKey,\n        value: resolved[index],\n      })),\n    );\n  });\n}\n",
+    "import { Effect } from \"effect\";\n\nimport { ResolverError } from \"./types.ts\";\n\nexport function toResolverError(resolver: string, message: string, cause?: unknown): ResolverError {\n  return new ResolverError({ resolver, message, cause });\n}\n\nexport function tryInitializeClient<A>(\n  resolver: string,\n  message: string,\n  initialize: () => Promise<A>,\n): Effect.Effect<A, ResolverError> {\n  return Effect.tryPromise({\n    try: initialize,\n    catch: (cause) => toResolverError(resolver, message, cause),\n  });\n}\n\nexport function strictOrElse<A>(\n  effect: Effect.Effect<A, unknown>,\n  options: {\n    strict: boolean;\n    resolver: string;\n    message: string;\n    fallback: () => A;\n  },\n): Effect.Effect<A, ResolverError> {\n  return options.strict\n    ? effect.pipe(\n        Effect.mapError((cause) => toResolverError(options.resolver, options.message, cause)),\n      )\n    : effect.pipe(Effect.orElseSucceed(options.fallback));\n}\n\nexport function keyValueResultsToRecord<K extends string>(\n  values: ReadonlyArray<{ envKey: K; value: string | undefined }>,\n): Record<K, string | undefined> {\n  const result = {} as Record<K, string | undefined>;\n  for (const { envKey, value } of values) {\n    result[envKey] = value;\n  }\n  return result;\n}\n\nexport function fillMissingMapValues(\n  ids: readonly string[],\n  values: Map<string, string | undefined>,\n): void {\n  for (const id of ids) {\n    if (!values.has(id)) {\n      values.set(id, undefined);\n    }\n  }\n}\n",
+    "import { Data } from \"effect\";\n\nexport type ResolverResult<K extends string = string> = Record<K, string | undefined>;\n\nexport class ResolverError extends Data.TaggedError(\"ResolverError\")<{\n  readonly resolver: string;\n  readonly message: string;\n  readonly cause?: unknown;\n}> {}\n\nexport interface SecretClient {\n  getSecret: (secretId: string) => Promise<string | undefined>;\n  getSecrets?: (secretIds: string[]) => Promise<Map<string, string | undefined>>;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAAA,mBAAS;;;ACAT;;;ACAA;AAAA;AAIO,MAAM,sBAAsB,KAAK,YAAY,eAAe,EAIhE;AAAC;;;ADJG,SAAS,eAAe,CAAC,UAAkB,SAAiB,OAAgC;AAAA,EACjG,OAAO,IAAI,cAAc,EAAE,UAAU,SAAS,MAAM,CAAC;AAAA;AAGhD,SAAS,mBAAsB,CACpC,UACA,SACA,YACiC;AAAA,EACjC,OAAO,OAAO,WAAW;AAAA,IACvB,KAAK;AAAA,IACL,OAAO,CAAC,UAAU,gBAAgB,UAAU,SAAS,KAAK;AAAA,EAC5D,CAAC;AAAA;AAGI,SAAS,YAAe,CAC7B,QACA,SAMiC;AAAA,EACjC,OAAO,QAAQ,SACX,OAAO,KACL,OAAO,SAAS,CAAC,UAAU,gBAAgB,QAAQ,UAAU,QAAQ,SAAS,KAAK,CAAC,CACtF,IACA,OAAO,KAAK,OAAO,cAAc,QAAQ,QAAQ,CAAC;AAAA;AAGjD,SAAS,uBAAyC,CACvD,QAC+B;AAAA,EAC/B,MAAM,SAAS,CAAC;AAAA,EAChB,aAAa,QAAQ,WAAW,QAAQ;AAAA,IACtC,OAAO,UAAU;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,oBAAoB,CAClC,KACA,QACM;AAAA,EACN,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,MACnB,OAAO,IAAI,IAAI,SAAS;AAAA,IAC1B;AAAA,EACF;AAAA;;;ADhCK,SAAS,eAAe,CAC7B,MAC8C;AAAA,EAC9C,OAAO,QAAO,IAAI,UAAU,GAAG;AAAA,IAC7B,QAAQ,SAAS,SAAS,UAAU;AAAA,IAEpC,MAAM,QAAQ,KAAK,uBAAuB,QAAQ,IAAI;AAAA,IACtD,IAAI,CAAC,OAAO;AAAA,MACV,OAAO,OAAO,gBACZ,aACA,4EACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,OAAO,oBACpB,aACA,yCACA,YAAY;AAAA,MACV,MAAM,MAAM,MAAa;AAAA,MACzB,MAAM,YAAY,MAAM,IAAI,aAAa;AAAA,QACvC,MAAM;AAAA,QACN,iBAAiB;AAAA,QACjB,oBAAoB;AAAA,MACtB,CAAC;AAAA,MAED,OAAO;AAAA,QACL,YAAY,OAAO,UAAmB,UAAU,QAAQ,WAAW,KAAI;AAAA,MACzE;AAAA,KAEJ;AAAA,IAEA,MAAM,UAAU,OAAO,QAAQ,OAAO;AAAA,IACtC,MAAM,OAAO,QAAQ,IAAI,IAAI,SAAS,GAAG;AAAA,IAEzC,MAAM,WAAW,OAAO,aACtB,QAAO,WAAW,MAAM,OAAO,WAAW,IAAI,CAAC,EAAE,KAC/C,QAAO,IAAI,CAAC,WAAW,MAAyB,CAClD,GACA;AAAA,MACE;AAAA,MACA,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU,MAAM;AAAA,IAClB,CACF;AAAA,IAEA,IAAI,CAAC,UAAU;AAAA,MACb,OAAO,wBAAwB,QAAQ,IAAI,EAAE,aAAa,EAAE,QAAQ,OAAO,UAAU,EAAE,CAAC;AAAA,IAC1F;AAAA,IAEA,OAAO,wBACL,QAAQ,IAAI,EAAE,SAAS,WAAW;AAAA,MAChC;AAAA,MACA,OAAO,SAAS;AAAA,IAClB,EAAE,CACJ;AAAA,GACD;AAAA;",
+  "debugId": "52E64B21781AEF3864756E2164756E21",
+  "names": []
+}

package/dist/resolvers/remote.d.ts

@@ -0,0 +1,9 @@
+import { Effect } from "effect";
+import { ResolverError, type ResolverResult, type SecretClient } from "./types.ts";
+export { ResolverError } from "./types.ts";
+interface RemoteSecretsOptions<K extends string = string> {
+    secrets: Record<K, string>;
+    client: SecretClient;
+    strict?: boolean;
+}
+export declare function fromRemoteSecrets<K extends string>(opts: RemoteSecretsOptions<K>): Effect.Effect<ResolverResult<K>, ResolverError>;

package/dist/resolvers/types.d.ts

@@ -0,0 +1,15 @@
+export type ResolverResult<K extends string = string> = Record<K, string | undefined>;
+declare const ResolverError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").Equals<A, {}> extends true ? void : { readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ResolverError";
+} & Readonly<A>;
+export declare class ResolverError extends ResolverError_base<{
+    readonly resolver: string;
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface SecretClient {
+    getSecret: (secretId: string) => Promise<string | undefined>;
+    getSecrets?: (secretIds: string[]) => Promise<Map<string, string | undefined>>;
+}
+export {};

package/dist/resolvers/utils.d.ts

@@ -0,0 +1,15 @@
+import { Effect } from "effect";
+import { ResolverError } from "./types.ts";
+export declare function toResolverError(resolver: string, message: string, cause?: unknown): ResolverError;
+export declare function tryInitializeClient<A>(resolver: string, message: string, initialize: () => Promise<A>): Effect.Effect<A, ResolverError>;
+export declare function strictOrElse<A>(effect: Effect.Effect<A, unknown>, options: {
+    strict: boolean;
+    resolver: string;
+    message: string;
+    fallback: () => A;
+}): Effect.Effect<A, ResolverError>;
+export declare function keyValueResultsToRecord<K extends string>(values: ReadonlyArray<{
+    envKey: K;
+    value: string | undefined;
+}>): Record<K, string | undefined>;
+export declare function fillMissingMapValues(ids: readonly string[], values: Map<string, string | undefined>): void;

package/dist/safe-env.d.ts

@@ -0,0 +1,23 @@
+import { Effect } from "effect";
+import { EnvValidationError } from "./errors.ts";
+import type { ResolverError, ResolverResult } from "./resolvers/types.ts";
+import type { AnyEnv, EnvOptions, EnvResult, EnvResultAutoRedacted, ExtractResolverKeys, PrefixMap, PrefixStr, SchemaDict } from "./types.ts";
+export type SafeCreateEnvSuccess<T> = Readonly<{
+    success: true;
+    data: T;
+}>;
+export type SafeCreateEnvFailure<E> = Readonly<{
+    success: false;
+    error: E;
+}>;
+export type SafeCreateEnvResult<T, E> = SafeCreateEnvSuccess<T> | SafeCreateEnvFailure<E>;
+export declare function safeCreateEnv<TServer extends SchemaDict = {}, TClient extends SchemaDict = {}, TShared extends SchemaDict = {}, const TExtends extends readonly AnyEnv[] = readonly [], const TResolvers extends readonly Effect.Effect<ResolverResult<any>, ResolverError>[] = readonly []>(opts: EnvOptions<TServer, TClient, TShared, TExtends> & {
+    resolvers: TResolvers;
+    autoRedactResolver: false;
+}): Effect.Effect<SafeCreateEnvResult<EnvResult<TExtends, TServer, TClient, TShared>, ResolverError | EnvValidationError>, never>;
+export declare function safeCreateEnv<TServer extends SchemaDict = {}, TClient extends SchemaDict = {}, TShared extends SchemaDict = {}, const TExtends extends readonly AnyEnv[] = readonly [], const TResolvers extends readonly Effect.Effect<ResolverResult<any>, ResolverError>[] = readonly [], const TPrefix extends string | PrefixMap | undefined = undefined>(opts: EnvOptions<TServer, TClient, TShared, TExtends> & {
+    resolvers: TResolvers;
+    autoRedactResolver?: true;
+    prefix?: TPrefix;
+}): Effect.Effect<SafeCreateEnvResult<EnvResultAutoRedacted<TExtends, TServer, TClient, TShared, ExtractResolverKeys<TResolvers>, PrefixStr<TPrefix>>, ResolverError | EnvValidationError>, never>;
+export declare function safeCreateEnv<TServer extends SchemaDict = {}, TClient extends SchemaDict = {}, TShared extends SchemaDict = {}, const TExtends extends readonly AnyEnv[] = readonly []>(opts: EnvOptions<TServer, TClient, TShared, TExtends>): SafeCreateEnvResult<EnvResult<TExtends, TServer, TClient, TShared>, EnvValidationError>;