@konfig.ts/env 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026-present David Stahl-Gruber
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,100 @@
+# @konfig.ts/env
+
+Yieldable environment entries — the shared definition layer between
+konfig manifest emission and the pod's runtime Effect application.
+
+## Why
+
+A pod's environment variables live in two places today:
+
+- The konfig manifest (`secretEnv({ name: "DATABASE_URL", ... })`,
+  `valueEnv`, `configMapEnv`).
+- The pod's runtime code (`Config.redacted("DATABASE_URL")`).
+
+The env-var name `"DATABASE_URL"` is duplicated. This package collapses
+both ends into one declaration:
+
+```ts
+// shared/secrets.ts — imported by both sides
+import { defineEnvironment, defineLiteral, defineSecret } from "@konfig.ts/env"
+
+export const dbCreds = defineSecret({
+  name: "db-creds",
+  namespace: "prod",
+  env: {
+    url: "DATABASE_URL",
+    password: "DATABASE_PASSWORD"
+  }
+})
+
+export const port = defineLiteral({ envName: "PORT", value: 8080 })
+
+export const apiEnv = defineEnvironment({ db: dbCreds, port })
+```
+
+## Entries and environments
+
+Every `defineSecret` / `defineLiteral` / `defineDownward` call returns
+an **entry** — a yieldable Effect `Config<...>` intersected with the
+pure binding metadata (`name`, `namespace`, `env`/`envName`). Each
+entry is its own state-management-style atom: pull it standalone, or
+group it.
+
+`defineEnvironment({...})` is a **bundle** — also a yieldable Config,
+with `.members` re-exposing each named entry.
+
+```ts
+// runtime pod code
+import { Effect, Redacted } from "effect"
+import { apiEnv, dbCreds } from "./secrets"
+
+const program = Effect.gen(function*() {
+  const env = yield* apiEnv // { db: { url: Redacted, password: Redacted }, port: number }
+  const db = yield* dbCreds // { url: Redacted, password: Redacted }
+  const url = yield* dbCreds.fields.url // Redacted<string>
+})
+```
+
+## Bound on the konfig side
+
+`@konfig.ts/k8s` provides `Secret.bind({secret})` and
+`Environment.bind({env})` for the manifest-side wiring. They consume
+the same shared entries and produce ready-to-spread `envVars` for the
+container:
+
+```ts
+// konfig-side infra code
+import { Environment, Secret, Workload } from "@konfig.ts/k8s"
+
+const apiEnvK8s = Environment.bind({ env: apiEnv })
+
+Workload.web({
+  /* ... */
+  deployment: {
+    containers: [{ name: "api", image: "...", env: apiEnvK8s.envVars }]
+  }
+})
+```
+
+## Status
+
+Phase 1 of the secret refactor — see `.docs/secret-refactoring/plan.md`.
+Entries, bundles, env-var wiring only. Backends (ExternalSecrets,
+SealedSecrets, Sops) and the `source` / `values` accessors land in
+later phases.
+
+## Requirements
+
+konfig.ts builds on [Effect](https://effect.website/), which is still in
+beta. Until Effect ships a stable 4.x, you must install the exact beta
+konfig is developed against:
+
+- **`effect@4.0.0-beta.70`** — required.
+- **`@effect/platform-node@4.0.0-beta.70`** — required only for `render()`
+  (the Node filesystem/subprocess entrypoint); manifest-only consumers can
+  omit it.
+
+The peer dependency is pinned to the exact version on purpose: Effect's beta
+line makes breaking changes between builds, so a looser range would surface
+as `ERESOLVE` install conflicts rather than a working install. This pin will
+relax to a caret range once Effect reaches a stable 4.x.

package/dist/_unstable.d.ts

@@ -0,0 +1,2 @@
+export { ChildProcess } from "effect/unstable/process";
+export { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";

package/dist/downward.d.ts

@@ -0,0 +1,19 @@
+import { Config } from "effect";
+import { type EntryMarker, type HasEnvClaims } from "./entry";
+export interface DownwardEntry<EnvName extends string> extends Config.Config<string>, EntryMarker<"Downward">, HasEnvClaims {
+    readonly envName: EnvName;
+    readonly fieldPath: string;
+}
+export interface DefineDownwardInput<EnvName extends string> {
+    readonly envName: EnvName;
+    readonly fieldPath: string;
+}
+export type AnyDownwardEntry = DownwardEntry<string>;
+/**
+ * `Downward` value namespace.
+ *
+ *   const podName = Downward.define({ envName: "POD_NAME", fieldPath: "metadata.name" });
+ */
+export declare const Downward: {
+    define: <const EnvName extends string>(input: DefineDownwardInput<EnvName>) => DownwardEntry<EnvName>;
+};

package/dist/entry.d.ts

@@ -0,0 +1,27 @@
+import type { Config } from "effect";
+export type EntryKind = "Secret" | "Literal" | "Downward" | "Environment";
+export interface EntryMarker<K extends EntryKind> {
+    readonly _kind: K;
+}
+declare const EnvNameCollision_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "EnvNameCollision";
+} & Readonly<A>;
+export declare class EnvNameCollision extends EnvNameCollision_base<{
+    readonly envName: string;
+    readonly claims: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+export interface EnvClaim {
+    readonly envName: string;
+    readonly label: string;
+}
+export interface HasEnvClaims {
+    readonly envClaims: ReadonlyArray<EnvClaim>;
+}
+export interface MakeEntryInput<C extends Config.Config<unknown>, M extends object> {
+    readonly config: C;
+    readonly metadata: M;
+}
+export declare const _makeEntry: <C extends Config.Config<unknown>, M extends object>(input: MakeEntryInput<C, M>) => C & M;
+export {};

package/dist/environment.d.ts

@@ -0,0 +1,67 @@
+import { Config } from "effect";
+import type { AnyDownwardEntry, DownwardEntry } from "./downward";
+import { type EntryMarker, type HasEnvClaims } from "./entry";
+import type { AnyLiteralEntry, LiteralEntry } from "./literal";
+import type { AnySecretEntry, SecretEntry } from "./secret";
+/**
+ * Union of every kind that can be a member of a `Environment`.
+ *
+ * Nesting: `Environment` itself is a valid `EnvMember`, so bundles can
+ * group related secrets / literals / downward fields into sub-records.
+ * The yielded record matches the nesting structure — e.g. `env.db.host`,
+ * `env.db.password` for a bundle `{db: Environment.define({host, password})}`.
+ * `Environment.bind` walks nested groups recursively when emitting
+ * envVars + secret manifests, and `SecretMembersOpts` / `LiteralMembersOpts`
+ * accept matching nested override shapes.
+ */
+export type EnvMember = AnySecretEntry | AnyLiteralEntry | AnyDownwardEntry | AnyEnvironment;
+export type MemberValue<A> = A extends Config.Config<infer T> ? T : never;
+export interface Environment<M extends Readonly<Record<string, EnvMember>>> extends Config.Config<{
+    readonly [K in keyof M]: MemberValue<M[K]>;
+}>, EntryMarker<"Environment">, HasEnvClaims {
+    readonly members: M;
+}
+export type AnyEnvironment = Environment<Readonly<Record<string, any>>>;
+/**
+ * Compile-time envName collision check (best-effort, complements the
+ * runtime throw).
+ *
+ * Each member exposes a union of the envNames it claims. For every
+ * key K in M, we compare K's envName union against the union claimed
+ * by all *other* members; a non-empty intersection means a collision.
+ * The check stops at the top-level members of M — nested `Environment`
+ * members are not walked into here. The runtime `_collectClaims`
+ * catches every collision, including cross-nesting ones; the type
+ * check is just the early-warning layer.
+ */
+type _EnvNamesOfMember<E> = E extends SecretEntry<infer _N, infer _K, infer Envs> ? Envs extends Readonly<Record<string, infer V extends string>> ? V : never : E extends LiteralEntry<infer EnvName, infer _T> ? EnvName : E extends DownwardEntry<infer EnvName> ? EnvName : never;
+type _OthersEnvNames<M extends Readonly<Record<string, EnvMember>>, K extends keyof M> = {
+    [Other in keyof M]: Other extends K ? never : _EnvNamesOfMember<M[Other]>;
+}[keyof M];
+type _CollisionForKey<M extends Readonly<Record<string, EnvMember>>, K extends keyof M> = Extract<_EnvNamesOfMember<M[K]>, _OthersEnvNames<M, K>>;
+type _AnyCollision<M extends Readonly<Record<string, EnvMember>>> = {
+    [K in keyof M]: _CollisionForKey<M, K>;
+}[keyof M];
+type _EnvNameCollisionError<Name extends string> = {
+    readonly _konfig_error: `Environment: envName "${Name}" is claimed by multiple members`;
+};
+type _CheckCollisions<M extends Readonly<Record<string, EnvMember>>> = [
+    _AnyCollision<M>
+] extends [never] ? M : _EnvNameCollisionError<Extract<_AnyCollision<M>, string>>;
+/**
+ * `Environment` value namespace (env-contracts package).
+ *
+ *   const apiEnv = Environment.define({
+ *     db: Secret.define({ ... }),
+ *     port: Literal.define({ ... }),
+ *     pod: Downward.define({ ... }),
+ *   });
+ *
+ * The k8s package re-exports this merged with its own `Environment.bind`
+ * / `Environment.runtime`, so importing `Environment` from `@konfig.ts/k8s`
+ * exposes `define` alongside the binder + runtime decoder.
+ */
+export declare const Environment: {
+    define: <const M extends Readonly<Record<string, EnvMember>>>(members: M & _CheckCollisions<M>) => Environment<M>;
+};
+export {};

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { type AnyEnvironment, type EnvMember, Environment, type MemberValue, } from "./environment";
+export { type AnyDownwardEntry, type DefineDownwardInput, Downward, type DownwardEntry, } from "./downward";
+export { type AnyLiteralEntry, type DefineLiteralInput, Literal, type LiteralEntry, } from "./literal";
+export { type AnySecretEntry, type DefineSecretInput, Secret, type SecretEntry, } from "./secret";
+export { type EnvClaim, type EntryKind, type EntryMarker, type HasEnvClaims, EnvNameCollision, } from "./entry";
+export { type FromCommandInput, type FromCommandSpec, type FromConfigInput, type LiteralInput, type ResolvedSecretValues, SecretSource, SecretSourceError, } from "./source";
+export { type EnvironmentShape, environmentLayer } from "./layer";
+export { runtime } from "./runtime";

package/dist/index.mjs

@@ -0,0 +1,235 @@
+import { runProcessString, unsafeCoerce } from "@konfig.ts/core";
+import { Config, Data, Effect, Layer, Redacted } from "effect";
+import { ChildProcess } from "effect/unstable/process";
+import "effect/unstable/process/ChildProcessSpawner";
+//#region src/entry.ts
+var EnvNameCollision = class extends Data.TaggedError("EnvNameCollision") {
+	get message() {
+		return `environment variable name "${this.envName}" is claimed by multiple entries: ${this.claims.map((c) => `"${c}"`).join(", ")}`;
+	}
+};
+const _makeEntry = (input) => unsafeCoerce(Object.assign(input.config, input.metadata), "Object.assign mutates and returns config carrying metadata's own properties, widening it to the intersection C & M");
+//#endregion
+//#region src/environment.ts
+const _collectClaims = (members) => {
+	const byEnvName = /* @__PURE__ */ new Map();
+	const out = [];
+	for (const [, entry] of Object.entries(members)) for (const claim of entry.envClaims) {
+		const prior = byEnvName.get(claim.envName);
+		if (prior === void 0) byEnvName.set(claim.envName, [claim.label]);
+		else prior.push(claim.label);
+		out.push(claim);
+	}
+	for (const [envName, labels] of byEnvName) if (labels.length > 1) throw new EnvNameCollision({
+		envName,
+		claims: labels
+	});
+	return out;
+};
+const _define$3 = (members) => {
+	const envClaims = _collectClaims(members);
+	return _makeEntry({
+		config: unsafeCoerce(Config.all(members), "Config.all over the members record yields a Config of the mapped record whose values are each member's MemberValue"),
+		metadata: {
+			_kind: "Environment",
+			members,
+			envClaims
+		}
+	});
+};
+/**
+* `Environment` value namespace (env-contracts package).
+*
+*   const apiEnv = Environment.define({
+*     db: Secret.define({ ... }),
+*     port: Literal.define({ ... }),
+*     pod: Downward.define({ ... }),
+*   });
+*
+* The k8s package re-exports this merged with its own `Environment.bind`
+* / `Environment.runtime`, so importing `Environment` from `@konfig.ts/k8s`
+* exposes `define` alongside the binder + runtime decoder.
+*/
+const Environment = { define: _define$3 };
+//#endregion
+//#region src/downward.ts
+const _define$2 = (input) => {
+	const parser = Config.string(input.envName);
+	const envClaims = [{
+		envName: input.envName,
+		label: `Downward(${input.envName})`
+	}];
+	return _makeEntry({
+		config: parser,
+		metadata: {
+			_kind: "Downward",
+			envName: input.envName,
+			fieldPath: input.fieldPath,
+			envClaims
+		}
+	});
+};
+/**
+* `Downward` value namespace.
+*
+*   const podName = Downward.define({ envName: "POD_NAME", fieldPath: "metadata.name" });
+*/
+const Downward = { define: _define$2 };
+//#endregion
+//#region src/literal.ts
+const _define$1 = (input) => {
+	const userSerialize = input.serialize ?? ((v) => String(v));
+	const serialize = (value) => userSerialize(unsafeCoerce(value, "stored serialize erases its param to unknown for variance; the user-facing Literal signature guarantees the value is a T"));
+	const serialized = userSerialize(input.value);
+	const parser = input.schema !== void 0 ? input.schema : unsafeCoerce(Config.succeed(input.value), "Config.succeed of the T-typed input.value is a constant Config<T>");
+	const envClaims = [{
+		envName: input.envName,
+		label: `Literal(${input.envName})`
+	}];
+	return _makeEntry({
+		config: parser,
+		metadata: {
+			_kind: "Literal",
+			envName: input.envName,
+			value: input.value,
+			serialized,
+			serialize,
+			envClaims
+		}
+	});
+};
+/**
+* `Literal` value namespace.
+*
+*   const port = Literal.define({
+*     envName: "PORT", value: 8080,
+*     schema: Config.number("PORT").pipe(Config.withDefault(8080)),
+*   });
+*/
+const Literal = { define: _define$1 };
+//#endregion
+//#region src/secret.ts
+const _define = (input) => {
+	const keys = unsafeCoerce(Object.keys(input.env), "Object.keys of E returns the string keys of E, i.e. Array<keyof E & string>");
+	const fields = {};
+	for (const key of keys) fields[key] = Config.redacted(input.env[key]);
+	const root = unsafeCoerce(Config.all(fields), "Config.all over the per-key redacted fields yields a Config of the mapped record keyed by keyof E & string");
+	const envClaims = keys.map((key) => ({
+		envName: input.env[key],
+		label: `Secret(${input.name}).${key}`
+	}));
+	return _makeEntry({
+		config: root,
+		metadata: {
+			_kind: "Secret",
+			name: input.name,
+			namespace: input.namespace,
+			env: input.env,
+			keys,
+			fields: unsafeCoerce(fields, "fields record was populated for every key in keys, matching the mapped type keyed by keyof E & string"),
+			envClaims
+		}
+	});
+};
+/**
+* `Secret` value namespace (env-contracts package).
+*
+*   const dbCreds = Secret.define({
+*     name: "db-creds",
+*     namespace: "app",
+*     env: { url: "DATABASE_URL", password: "DATABASE_PASSWORD" },
+*   });
+*
+* The k8s package re-exports this merged with its own `Secret.make` /
+* `Secret.bind`, so importing `Secret` from `@konfig.ts/k8s` exposes
+* `define` alongside the manifest/binder constructors.
+*/
+const Secret = { define: _define };
+//#endregion
+//#region src/source.ts
+var SecretSourceError = class extends Data.TaggedError("SecretSourceError") {};
+const _fromConfig = (input) => {
+	const envName = input.envName ?? ((k) => k);
+	const resolve = Effect.gen(function* () {
+		const out = {};
+		for (const key of input.keys) out[key] = yield* Config.redacted(envName(key)).pipe(Effect.mapError((cause) => new SecretSourceError({
+			source: "fromConfig",
+			key,
+			cause
+		})));
+		return unsafeCoerce(out, "per-key redacted record built from input.keys is the mapped type ResolvedSecretValues<K>");
+	});
+	return {
+		_tag: "SecretSource",
+		keys: input.keys,
+		resolve
+	};
+};
+const _literal = (input) => {
+	const keys = unsafeCoerce(Object.keys(input.data), "Object.keys of D returns the string keys of D, i.e. Array<keyof D & string>");
+	return {
+		_tag: "SecretSource",
+		keys,
+		resolve: Effect.sync(() => {
+			const out = {};
+			for (const k of keys) out[k] = Redacted.make(input.data[k]);
+			return unsafeCoerce(out, "per-key redacted record built from keys is the mapped type ResolvedSecretValues<keyof D & string>");
+		})
+	};
+};
+const _fromCommand = (input) => {
+	const resolve = Effect.gen(function* () {
+		const out = {};
+		for (const key of input.keys) {
+			const spec = input.run(key);
+			const value = (yield* runProcessString(ChildProcess.make(spec.cmd, [...spec.args]), { allowEmptyStdout: false }).pipe(Effect.mapError((cause) => new SecretSourceError({
+				source: "fromCommand",
+				key,
+				cause
+			})))).replace(/\n+$/u, "");
+			if (value.length === 0) return yield* Effect.fail(new SecretSourceError({
+				source: "fromCommand",
+				key,
+				cause: "secret command produced empty output"
+			}));
+			out[key] = Redacted.make(value);
+		}
+		return unsafeCoerce(out, "per-key redacted record built from input.keys is the mapped type ResolvedSecretValues<K>");
+	}).pipe(Effect.scoped);
+	return {
+		_tag: "SecretSource",
+		keys: input.keys,
+		resolve
+	};
+};
+const SecretSource = {
+	fromConfig: _fromConfig,
+	literal: _literal,
+	fromCommand: _fromCommand
+};
+//#endregion
+//#region src/layer.ts
+const environmentLayer = (input) => Layer.effect(input.tag, unsafeCoerce(input.env, "Environment<M> extends Config<EnvironmentShape<M>>, and Config is structurally a no-deps Effect — Layer.effect accepts it"));
+//#endregion
+//#region src/runtime.ts
+/**
+* Read every member of an `Environment<M>` from the active
+* `ConfigProvider` and return the decoded record.
+*
+* This is the runtime half of an env contract — the same `apiEnv`
+* bundle that drives `Environment.bind` in the konfig modules drives
+* this decode in the running app. Add a new `Literal` /
+* `Secret` to the bundle and the runtime call surfaces it
+* automatically; remove one and the runtime call no longer reads it.
+*
+*   const config = yield* Environment.runtime(apiEnv);
+*   const port = config.http.port;
+*   const password = Redacted.value(config.db.password);
+*/
+const runtime = (env) => Effect.gen(function* () {
+	return unsafeCoerce(yield* env, "Environment<M> extends Config<{ [K in keyof M]: MemberValue<M[K]> }>, structurally equal to EnvironmentShape<M> by definition");
+});
+//#endregion
+export { Downward, EnvNameCollision, Environment, Literal, Secret, SecretSource, SecretSourceError, environmentLayer, runtime };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":["_define","_define","_define"],"sources":["../src/entry.ts","../src/environment.ts","../src/downward.ts","../src/literal.ts","../src/secret.ts","../src/source.ts","../src/layer.ts","../src/runtime.ts"],"sourcesContent":["import { unsafeCoerce } from \"@konfig.ts/core\"\nimport type { Config } from \"effect\"\nimport { Data } from \"effect\"\n\nexport type EntryKind = \"Secret\" | \"Literal\" | \"Downward\" | \"Environment\"\n\nexport interface EntryMarker<K extends EntryKind> {\n  readonly _kind: K\n}\n\nexport class EnvNameCollision extends Data.TaggedError(\"EnvNameCollision\")<{\n  readonly envName: string\n  readonly claims: ReadonlyArray<string>\n}> {\n  get message(): string {\n    return `environment variable name \"${this.envName}\" is claimed by multiple entries: ${\n      this.claims\n        .map((c) => `\"${c}\"`)\n        .join(\", \")\n    }`\n  }\n}\n\nexport interface EnvClaim {\n  readonly envName: string\n  readonly label: string\n}\n\nexport interface HasEnvClaims {\n  readonly envClaims: ReadonlyArray<EnvClaim>\n}\n\nexport interface MakeEntryInput<C extends Config.Config<unknown>, M extends object> {\n  readonly config: C\n  readonly metadata: M\n}\n\n// Each Secret/Literal/Downward produces a yieldable\n// Config (an \"atom\" in state-management terms) intersected with its pure\n// metadata. _makeEntry is the internal helper that does the merge.\nexport const _makeEntry = <C extends Config.Config<unknown>, M extends object>(\n  input: MakeEntryInput<C, M>\n): C & M =>\n  unsafeCoerce<C & M>(\n    Object.assign(input.config, input.metadata),\n    \"Object.assign mutates and returns config carrying metadata's own properties, widening it to the intersection C & M\"\n  )\n","import { unsafeCoerce } from \"@konfig.ts/core\"\nimport { Config } from \"effect\"\nimport type { AnyDownwardEntry, DownwardEntry } from \"./downward\"\nimport { _makeEntry, type EntryMarker, type EnvClaim, EnvNameCollision, type HasEnvClaims } from \"./entry\"\nimport type { AnyLiteralEntry, LiteralEntry } from \"./literal\"\nimport type { AnySecretEntry, SecretEntry } from \"./secret\"\n\n/**\n * Union of every kind that can be a member of a `Environment`.\n *\n * Nesting: `Environment` itself is a valid `EnvMember`, so bundles can\n * group related secrets / literals / downward fields into sub-records.\n * The yielded record matches the nesting structure — e.g. `env.db.host`,\n * `env.db.password` for a bundle `{db: Environment.define({host, password})}`.\n * `Environment.bind` walks nested groups recursively when emitting\n * envVars + secret manifests, and `SecretMembersOpts` / `LiteralMembersOpts`\n * accept matching nested override shapes.\n */\nexport type EnvMember =\n  | AnySecretEntry\n  | AnyLiteralEntry\n  | AnyDownwardEntry\n  | AnyEnvironment\n\nexport type MemberValue<A> = A extends Config.Config<infer T> ? T : never\n\nexport interface Environment<M extends Readonly<Record<string, EnvMember>>>\n  extends Config.Config<{ readonly [K in keyof M]: MemberValue<M[K]> }>, EntryMarker<\"Environment\">, HasEnvClaims\n{\n  readonly members: M\n}\n\n// oxlint-disable-next-line app/no-explicit-any\nexport type AnyEnvironment = Environment<Readonly<Record<string, any>>>\n\nconst _collectClaims = (\n  members: Readonly<Record<string, EnvMember>>\n): ReadonlyArray<EnvClaim> => {\n  const byEnvName = new Map<string, string[]>()\n  const out: EnvClaim[] = []\n  for (const [, entry] of Object.entries(members)) {\n    for (const claim of entry.envClaims) {\n      const prior = byEnvName.get(claim.envName)\n      if (prior === undefined) {\n        byEnvName.set(claim.envName, [claim.label])\n      } else {\n        prior.push(claim.label)\n      }\n      out.push(claim)\n    }\n  }\n  for (const [envName, labels] of byEnvName) {\n    if (labels.length > 1) {\n      throw new EnvNameCollision({ envName, claims: labels })\n    }\n  }\n  return out\n}\n\n/**\n * Compile-time envName collision check (best-effort, complements the\n * runtime throw).\n *\n * Each member exposes a union of the envNames it claims. For every\n * key K in M, we compare K's envName union against the union claimed\n * by all *other* members; a non-empty intersection means a collision.\n * The check stops at the top-level members of M — nested `Environment`\n * members are not walked into here. The runtime `_collectClaims`\n * catches every collision, including cross-nesting ones; the type\n * check is just the early-warning layer.\n */\ntype _EnvNamesOfMember<E> = E extends SecretEntry<\n  infer _N,\n  infer _K,\n  infer Envs\n> ? Envs extends Readonly<Record<string, infer V extends string>> ? V\n  : never\n  : E extends LiteralEntry<infer EnvName, infer _T> ? EnvName\n  : E extends DownwardEntry<infer EnvName> ? EnvName\n  : never\n\ntype _OthersEnvNames<\n  M extends Readonly<Record<string, EnvMember>>,\n  K extends keyof M\n> = {\n  [Other in keyof M]: Other extends K ? never : _EnvNamesOfMember<M[Other]>\n}[keyof M]\n\ntype _CollisionForKey<\n  M extends Readonly<Record<string, EnvMember>>,\n  K extends keyof M\n> = Extract<_EnvNamesOfMember<M[K]>, _OthersEnvNames<M, K>>\n\ntype _AnyCollision<M extends Readonly<Record<string, EnvMember>>> = {\n  [K in keyof M]: _CollisionForKey<M, K>\n}[keyof M]\n\ntype _EnvNameCollisionError<Name extends string> = {\n  readonly _konfig_error: `Environment: envName \"${Name}\" is claimed by multiple members`\n}\n\ntype _CheckCollisions<M extends Readonly<Record<string, EnvMember>>> = [\n  _AnyCollision<M>\n] extends [never] ? M\n  : _EnvNameCollisionError<Extract<_AnyCollision<M>, string>>\n\nconst _define = <const M extends Readonly<Record<string, EnvMember>>>(\n  members: M & _CheckCollisions<M>\n): Environment<M> => {\n  const envClaims = _collectClaims(members)\n\n  const root = unsafeCoerce<\n    Config.Config<\n      {\n        readonly [K in keyof M]: MemberValue<M[K]>\n      }\n    >\n  >(\n    Config.all(members),\n    \"Config.all over the members record yields a Config of the mapped record whose values are each member's MemberValue\"\n  )\n\n  return _makeEntry({\n    config: root,\n    metadata: {\n      _kind: \"Environment\" as const,\n      members,\n      envClaims\n    }\n  })\n}\n\n/**\n * `Environment` value namespace (env-contracts package).\n *\n *   const apiEnv = Environment.define({\n *     db: Secret.define({ ... }),\n *     port: Literal.define({ ... }),\n *     pod: Downward.define({ ... }),\n *   });\n *\n * The k8s package re-exports this merged with its own `Environment.bind`\n * / `Environment.runtime`, so importing `Environment` from `@konfig.ts/k8s`\n * exposes `define` alongside the binder + runtime decoder.\n */\nexport const Environment = {\n  define: _define\n}\n","import { Config } from \"effect\";\nimport {\n\ttype EnvClaim,\n\ttype EntryMarker,\n\ttype HasEnvClaims,\n\t_makeEntry,\n} from \"./entry\";\n\nexport interface DownwardEntry<EnvName extends string>\n\textends Config.Config<string>,\n\t\tEntryMarker<\"Downward\">,\n\t\tHasEnvClaims {\n\treadonly envName: EnvName;\n\treadonly fieldPath: string;\n}\n\nexport interface DefineDownwardInput<EnvName extends string> {\n\treadonly envName: EnvName;\n\treadonly fieldPath: string;\n}\n\nconst _define = <const EnvName extends string>(\n\tinput: DefineDownwardInput<EnvName>,\n): DownwardEntry<EnvName> => {\n\tconst parser = Config.string(input.envName);\n\n\tconst envClaims: ReadonlyArray<EnvClaim> = [\n\t\t{ envName: input.envName, label: `Downward(${input.envName})` },\n\t];\n\n\treturn _makeEntry({\n\t\tconfig: parser,\n\t\tmetadata: {\n\t\t\t_kind: \"Downward\" as const,\n\t\t\tenvName: input.envName,\n\t\t\tfieldPath: input.fieldPath,\n\t\t\tenvClaims,\n\t\t},\n\t});\n};\n\nexport type AnyDownwardEntry = DownwardEntry<string>;\n\n/**\n * `Downward` value namespace.\n *\n *   const podName = Downward.define({ envName: \"POD_NAME\", fieldPath: \"metadata.name\" });\n */\nexport const Downward = {\n\tdefine: _define,\n};\n","import { unsafeCoerce } from \"@konfig.ts/core\"\nimport { Config } from \"effect\"\nimport { _makeEntry, type EntryMarker, type EnvClaim, type HasEnvClaims } from \"./entry\"\n\nexport interface LiteralEntry<EnvName extends string, T>\n  extends Config.Config<T>, EntryMarker<\"Literal\">, HasEnvClaims\n{\n  readonly envName: EnvName\n  readonly value: T\n  readonly serialized: string\n  /**\n   * Stored so bind-time value overrides can re-serialize with the same\n   * fn. Typed as `(unknown) => string` so that `LiteralEntry<…, T>`\n   * stays assignable to `LiteralEntry<string, unknown>` in the\n   * `EnvMember` union (function params are contravariant — a more\n   * specific T would block the narrowing). The override site supplies\n   * a value typed against `T` via `LiteralMembersOpts<M>`.\n   */\n  readonly serialize: (value: unknown) => string\n}\n\nexport interface DefineLiteralInput<EnvName extends string, T> {\n  readonly envName: EnvName\n  readonly value: T\n  readonly schema?: Config.Config<T>\n  readonly serialize?: (value: T) => string\n}\n\nconst _define = <const EnvName extends string, T = string>(\n  input: DefineLiteralInput<EnvName, T>\n): LiteralEntry<EnvName, T> => {\n  const userSerialize = input.serialize ?? ((v: T) => String(v))\n  // Erase the parameter type to `unknown` for the stored function — see\n  // the LiteralEntry doc for the variance rationale. Literal's\n  // own type signature still enforces `T` at the user-facing call site.\n  const serialize = (value: unknown): string =>\n    userSerialize(\n      unsafeCoerce<T>(\n        value,\n        \"stored serialize erases its param to unknown for variance; the user-facing Literal signature guarantees the value is a T\"\n      )\n    )\n  const serialized = userSerialize(input.value)\n\n  const parser = input.schema !== undefined\n    ? input.schema\n    : unsafeCoerce<Config.Config<T>>(\n      Config.succeed(input.value),\n      \"Config.succeed of the T-typed input.value is a constant Config<T>\"\n    )\n\n  const envClaims: ReadonlyArray<EnvClaim> = [\n    { envName: input.envName, label: `Literal(${input.envName})` }\n  ]\n\n  return _makeEntry({\n    config: parser,\n    metadata: {\n      _kind: \"Literal\" as const,\n      envName: input.envName,\n      value: input.value,\n      serialized,\n      serialize,\n      envClaims\n    }\n  })\n}\n\nexport type AnyLiteralEntry = LiteralEntry<string, unknown>\n\n/**\n * `Literal` value namespace.\n *\n *   const port = Literal.define({\n *     envName: \"PORT\", value: 8080,\n *     schema: Config.number(\"PORT\").pipe(Config.withDefault(8080)),\n *   });\n */\nexport const Literal = {\n  define: _define\n}\n","import { unsafeCoerce } from \"@konfig.ts/core\"\nimport { Config, type Redacted } from \"effect\"\nimport { _makeEntry, type EntryMarker, type EnvClaim, type HasEnvClaims } from \"./entry\"\n\nexport interface SecretEntry<\n  N extends string,\n  K extends string,\n  E extends Readonly<Record<K, string>>\n> extends Config.Config<{ readonly [P in K]: Redacted.Redacted<string> }>, EntryMarker<\"Secret\">, HasEnvClaims {\n  readonly name: N\n  readonly namespace: string\n  readonly env: E\n  readonly keys: ReadonlyArray<K>\n  readonly fields: { readonly [P in K]: Config.Config<Redacted.Redacted<string>> }\n}\n\nexport interface DefineSecretInput<\n  N extends string,\n  E extends Readonly<Record<string, string>>\n> {\n  readonly name: N\n  readonly namespace: string\n  readonly env: E\n}\n\nconst _define = <\n  const N extends string,\n  const E extends Readonly<Record<string, string>>\n>(\n  input: DefineSecretInput<N, E>\n): SecretEntry<N, keyof E & string, E> => {\n  const keys = unsafeCoerce<Array<keyof E & string>>(\n    Object.keys(input.env),\n    \"Object.keys of E returns the string keys of E, i.e. Array<keyof E & string>\"\n  )\n\n  const fields: Record<string, Config.Config<Redacted.Redacted<string>>> = {}\n  for (const key of keys) {\n    fields[key] = Config.redacted(input.env[key])\n  }\n\n  const root = unsafeCoerce<\n    Config.Config<\n      {\n        readonly [P in keyof E & string]: Redacted.Redacted<string>\n      }\n    >\n  >(\n    Config.all(fields),\n    \"Config.all over the per-key redacted fields yields a Config of the mapped record keyed by keyof E & string\"\n  )\n\n  const envClaims: ReadonlyArray<EnvClaim> = keys.map((key) => ({\n    envName: input.env[key],\n    label: `Secret(${input.name}).${key}`\n  }))\n\n  return _makeEntry({\n    config: root,\n    metadata: {\n      _kind: \"Secret\" as const,\n      name: input.name,\n      namespace: input.namespace,\n      env: input.env,\n      keys,\n      fields: unsafeCoerce<\n        {\n          readonly [P in keyof E & string]: Config.Config<Redacted.Redacted<string>>\n        }\n      >(\n        fields,\n        \"fields record was populated for every key in keys, matching the mapped type keyed by keyof E & string\"\n      ),\n      envClaims\n    }\n  })\n}\n\nexport type AnySecretEntry = SecretEntry<string, string, Readonly<Record<string, string>>>\n\n/**\n * `Secret` value namespace (env-contracts package).\n *\n *   const dbCreds = Secret.define({\n *     name: \"db-creds\",\n *     namespace: \"app\",\n *     env: { url: \"DATABASE_URL\", password: \"DATABASE_PASSWORD\" },\n *   });\n *\n * The k8s package re-exports this merged with its own `Secret.make` /\n * `Secret.bind`, so importing `Secret` from `@konfig.ts/k8s` exposes\n * `define` alongside the manifest/binder constructors.\n */\nexport const Secret = {\n  define: _define\n}\n","import { runProcessString, unsafeCoerce } from \"@konfig.ts/core\"\nimport { Config, Data, Effect, Redacted, type Scope } from \"effect\"\nimport { ChildProcess, ChildProcessSpawner } from \"./_unstable\"\n\nexport class SecretSourceError extends Data.TaggedError(\"SecretSourceError\")<{\n  readonly source: string\n  readonly key: string\n  readonly cause: unknown\n}> {}\n\nexport type ResolvedSecretValues<K extends string> = {\n  readonly [P in K]: Redacted.Redacted<string>\n}\n\nexport interface SecretSource<K extends string, R = never> {\n  readonly _tag: \"SecretSource\"\n  readonly keys: ReadonlyArray<K>\n  readonly resolve: Effect.Effect<ResolvedSecretValues<K>, SecretSourceError, R>\n}\n\nexport interface FromConfigInput<K extends string> {\n  readonly keys: ReadonlyArray<K>\n  readonly envName?: (key: K) => string\n}\n\nconst _fromConfig = <const K extends string>(input: FromConfigInput<K>): SecretSource<K> => {\n  const envName = input.envName ?? ((k: K) => k)\n  const resolve = Effect.gen(function*() {\n    const out: Record<string, Redacted.Redacted<string>> = {}\n    for (const key of input.keys) {\n      const v = yield* Config.redacted(envName(key)).pipe(\n        Effect.mapError(\n          (cause) => new SecretSourceError({ source: \"fromConfig\", key, cause })\n        )\n      )\n      out[key] = v\n    }\n    return unsafeCoerce<ResolvedSecretValues<K>>(\n      out,\n      \"per-key redacted record built from input.keys is the mapped type ResolvedSecretValues<K>\"\n    )\n  })\n  return { _tag: \"SecretSource\", keys: input.keys, resolve }\n}\n\nexport interface LiteralInput<D extends Readonly<Record<string, string>>> {\n  readonly data: D\n}\n\nconst _literal = <const D extends Readonly<Record<string, string>>>(\n  input: LiteralInput<D>\n): SecretSource<keyof D & string> => {\n  const keys = unsafeCoerce<Array<keyof D & string>>(\n    Object.keys(input.data),\n    \"Object.keys of D returns the string keys of D, i.e. Array<keyof D & string>\"\n  )\n  const resolve = Effect.sync(() => {\n    const out: Record<string, Redacted.Redacted<string>> = {}\n    for (const k of keys) {\n      out[k] = Redacted.make(input.data[k])\n    }\n    return unsafeCoerce<ResolvedSecretValues<keyof D & string>>(\n      out,\n      \"per-key redacted record built from keys is the mapped type ResolvedSecretValues<keyof D & string>\"\n    )\n  })\n  return { _tag: \"SecretSource\", keys, resolve }\n}\n\nexport interface FromCommandSpec {\n  readonly cmd: string\n  readonly args: ReadonlyArray<string>\n}\n\nexport interface FromCommandInput<K extends string> {\n  readonly keys: ReadonlyArray<K>\n  readonly run: (key: K) => FromCommandSpec\n}\n\nconst _fromCommand = <const K extends string>(\n  input: FromCommandInput<K>\n): SecretSource<K, ChildProcessSpawner | Scope.Scope> => {\n  const resolve = Effect.gen(function*() {\n    const out: Record<string, Redacted.Redacted<string>> = {}\n    for (const key of input.keys) {\n      const spec = input.run(key)\n      const proc = ChildProcess.make(spec.cmd, [...spec.args])\n      const stdout = yield* runProcessString(proc, { allowEmptyStdout: false }).pipe(\n        Effect.mapError(\n          (cause) => new SecretSourceError({ source: \"fromCommand\", key, cause })\n        )\n      )\n      const value = stdout.replace(/\\n+$/u, \"\")\n      if (value.length === 0) {\n        return yield* Effect.fail(\n          new SecretSourceError({\n            source: \"fromCommand\",\n            key,\n            cause: \"secret command produced empty output\"\n          })\n        )\n      }\n      out[key] = Redacted.make(value)\n    }\n    return unsafeCoerce<ResolvedSecretValues<K>>(\n      out,\n      \"per-key redacted record built from input.keys is the mapped type ResolvedSecretValues<K>\"\n    )\n  }).pipe(Effect.scoped)\n  return { _tag: \"SecretSource\", keys: input.keys, resolve }\n}\n\nexport const SecretSource = {\n  fromConfig: _fromConfig,\n  literal: _literal,\n  fromCommand: _fromCommand\n}\n","import type { Context, Effect } from \"effect\";\nimport { Layer } from \"effect\";\nimport type { EnvMember, Environment, MemberValue } from \"./environment\";\n\n/**\n * Type of the value an `Environment<M>` yields when consumed — the same\n * record type produced by `yield* env`.\n */\nexport type EnvironmentShape<M extends Readonly<Record<string, EnvMember>>> = {\n\treadonly [K in keyof M]: MemberValue<M[K]>;\n};\n\nimport { unsafeCoerce } from \"@konfig.ts/core\";\n\n/**\n * Lift an `Environment` bundle into a service `Layer` so the app's\n * graph can depend on the yielded record once and DI it everywhere.\n *\n * The bundle is a yieldable `Config`; lifting it into a `Layer.effect`\n * bound to a `Context.Service` tag means the bundle is resolved once at\n * Layer construction time, and every downstream service that yields the\n * tag reads from the resolved record — no `Effect.runSync` at module\n * scope, no per-service `Config.string` reads.\n *\n *   class AppEnv extends Context.Service<AppEnv, EnvironmentShape<typeof bundleEnv.members>>()(\"AppEnv\") {}\n *   export const AppEnvLive = environmentLayer({ tag: AppEnv, env: bundleEnv });\n *\n *   // downstream:\n *   const env = yield* AppEnv;\n *   const password = Redacted.value(env.postgres.password);\n */\nexport interface EnvironmentLayerInput<Self, M extends Readonly<Record<string, EnvMember>>> {\n\treadonly tag: Context.Service<Self, EnvironmentShape<M>>;\n\treadonly env: Environment<M>;\n}\n\nexport const environmentLayer = <Self, M extends Readonly<Record<string, EnvMember>>>(\n\tinput: EnvironmentLayerInput<Self, M>,\n): Layer.Layer<Self> =>\n\tLayer.effect(\n\t\tinput.tag,\n\t\tunsafeCoerce<Effect.Effect<EnvironmentShape<M>>>(\n\t\t\tinput.env,\n\t\t\t\"Environment<M> extends Config<EnvironmentShape<M>>, and Config is structurally a no-deps Effect — Layer.effect accepts it\",\n\t\t),\n\t);\n","import { unsafeCoerce } from \"@konfig.ts/core\";\nimport { type Config, Effect } from \"effect\";\nimport type { EnvMember, Environment } from \"./environment\";\nimport type { EnvironmentShape } from \"./layer\";\n\n/**\n * Read every member of an `Environment<M>` from the active\n * `ConfigProvider` and return the decoded record.\n *\n * This is the runtime half of an env contract — the same `apiEnv`\n * bundle that drives `Environment.bind` in the konfig modules drives\n * this decode in the running app. Add a new `Literal` /\n * `Secret` to the bundle and the runtime call surfaces it\n * automatically; remove one and the runtime call no longer reads it.\n *\n *   const config = yield* Environment.runtime(apiEnv);\n *   const port = config.http.port;\n *   const password = Redacted.value(config.db.password);\n */\nexport const runtime = <M extends Readonly<Record<string, EnvMember>>>(\n\tenv: Environment<M>,\n): Effect.Effect<EnvironmentShape<M>, Config.ConfigError> =>\n\tEffect.gen(function* () {\n\t\tconst decoded = yield* env;\n\t\treturn unsafeCoerce<EnvironmentShape<M>>(\n\t\t\tdecoded,\n\t\t\t\"Environment<M> extends Config<{ [K in keyof M]: MemberValue<M[K]> }>, structurally equal to EnvironmentShape<M> by definition\",\n\t\t);\n\t});\n"],"mappings":";;;;;AAUA,IAAa,mBAAb,cAAsC,KAAK,YAAY,mBAAmB,CAGvE;CACD,IAAI,UAAkB;EACpB,OAAO,8BAA8B,KAAK,QAAQ,oCAChD,KAAK,OACF,KAAK,MAAM,IAAI,EAAE,GAAG,CACpB,KAAK,KAAK;;;AAsBnB,MAAa,cACX,UAEA,aACE,OAAO,OAAO,MAAM,QAAQ,MAAM,SAAS,EAC3C,qHACD;;;ACXH,MAAM,kBACJ,YAC4B;CAC5B,MAAM,4BAAY,IAAI,KAAuB;CAC7C,MAAM,MAAkB,EAAE;CAC1B,KAAK,MAAM,GAAG,UAAU,OAAO,QAAQ,QAAQ,EAC7C,KAAK,MAAM,SAAS,MAAM,WAAW;EACnC,MAAM,QAAQ,UAAU,IAAI,MAAM,QAAQ;EAC1C,IAAI,UAAU,KAAA,GACZ,UAAU,IAAI,MAAM,SAAS,CAAC,MAAM,MAAM,CAAC;OAE3C,MAAM,KAAK,MAAM,MAAM;EAEzB,IAAI,KAAK,MAAM;;CAGnB,KAAK,MAAM,CAAC,SAAS,WAAW,WAC9B,IAAI,OAAO,SAAS,GAClB,MAAM,IAAI,iBAAiB;EAAE;EAAS,QAAQ;EAAQ,CAAC;CAG3D,OAAO;;AAkDT,MAAMA,aACJ,YACmB;CACnB,MAAM,YAAY,eAAe,QAAQ;CAazC,OAAO,WAAW;EAChB,QAZW,aAOX,OAAO,IAAI,QAAQ,EACnB,qHAIY;EACZ,UAAU;GACR,OAAO;GACP;GACA;GACD;EACF,CAAC;;;;;;;;;;;;;;;AAgBJ,MAAa,cAAc,EACzB,QAAQA,WACT;;;AC9HD,MAAMC,aACL,UAC4B;CAC5B,MAAM,SAAS,OAAO,OAAO,MAAM,QAAQ;CAE3C,MAAM,YAAqC,CAC1C;EAAE,SAAS,MAAM;EAAS,OAAO,YAAY,MAAM,QAAQ;EAAI,CAC/D;CAED,OAAO,WAAW;EACjB,QAAQ;EACR,UAAU;GACT,OAAO;GACP,SAAS,MAAM;GACf,WAAW,MAAM;GACjB;GACA;EACD,CAAC;;;;;;;AAUH,MAAa,WAAW,EACvB,QAAQA,WACR;;;ACtBD,MAAMC,aACJ,UAC6B;CAC7B,MAAM,gBAAgB,MAAM,eAAe,MAAS,OAAO,EAAE;CAI7D,MAAM,aAAa,UACjB,cACE,aACE,OACA,2HACD,CACF;CACH,MAAM,aAAa,cAAc,MAAM,MAAM;CAE7C,MAAM,SAAS,MAAM,WAAW,KAAA,IAC5B,MAAM,SACN,aACA,OAAO,QAAQ,MAAM,MAAM,EAC3B,oEACD;CAEH,MAAM,YAAqC,CACzC;EAAE,SAAS,MAAM;EAAS,OAAO,WAAW,MAAM,QAAQ;EAAI,CAC/D;CAED,OAAO,WAAW;EAChB,QAAQ;EACR,UAAU;GACR,OAAO;GACP,SAAS,MAAM;GACf,OAAO,MAAM;GACb;GACA;GACA;GACD;EACF,CAAC;;;;;;;;;;AAaJ,MAAa,UAAU,EACrB,QAAQA,WACT;;;ACvDD,MAAM,WAIJ,UACwC;CACxC,MAAM,OAAO,aACX,OAAO,KAAK,MAAM,IAAI,EACtB,8EACD;CAED,MAAM,SAAmE,EAAE;CAC3E,KAAK,MAAM,OAAO,MAChB,OAAO,OAAO,OAAO,SAAS,MAAM,IAAI,KAAK;CAG/C,MAAM,OAAO,aAOX,OAAO,IAAI,OAAO,EAClB,6GACD;CAED,MAAM,YAAqC,KAAK,KAAK,SAAS;EAC5D,SAAS,MAAM,IAAI;EACnB,OAAO,UAAU,MAAM,KAAK,IAAI;EACjC,EAAE;CAEH,OAAO,WAAW;EAChB,QAAQ;EACR,UAAU;GACR,OAAO;GACP,MAAM,MAAM;GACZ,WAAW,MAAM;GACjB,KAAK,MAAM;GACX;GACA,QAAQ,aAKN,QACA,wGACD;GACD;GACD;EACF,CAAC;;;;;;;;;;;;;;;AAkBJ,MAAa,SAAS,EACpB,QAAQ,SACT;;;AC3FD,IAAa,oBAAb,cAAuC,KAAK,YAAY,oBAAoB,CAIzE;AAiBH,MAAM,eAAuC,UAA+C;CAC1F,MAAM,UAAU,MAAM,aAAa,MAAS;CAC5C,MAAM,UAAU,OAAO,IAAI,aAAY;EACrC,MAAM,MAAiD,EAAE;EACzD,KAAK,MAAM,OAAO,MAAM,MAMtB,IAAI,OAAO,OALM,OAAO,SAAS,QAAQ,IAAI,CAAC,CAAC,KAC7C,OAAO,UACJ,UAAU,IAAI,kBAAkB;GAAE,QAAQ;GAAc;GAAK;GAAO,CAAC,CACvE,CACF;EAGH,OAAO,aACL,KACA,2FACD;GACD;CACF,OAAO;EAAE,MAAM;EAAgB,MAAM,MAAM;EAAM;EAAS;;AAO5D,MAAM,YACJ,UACmC;CACnC,MAAM,OAAO,aACX,OAAO,KAAK,MAAM,KAAK,EACvB,8EACD;CAWD,OAAO;EAAE,MAAM;EAAgB;EAAM,SAVrB,OAAO,WAAW;GAChC,MAAM,MAAiD,EAAE;GACzD,KAAK,MAAM,KAAK,MACd,IAAI,KAAK,SAAS,KAAK,MAAM,KAAK,GAAG;GAEvC,OAAO,aACL,KACA,oGACD;IAEyC;EAAE;;AAahD,MAAM,gBACJ,UACuD;CACvD,MAAM,UAAU,OAAO,IAAI,aAAY;EACrC,MAAM,MAAiD,EAAE;EACzD,KAAK,MAAM,OAAO,MAAM,MAAM;GAC5B,MAAM,OAAO,MAAM,IAAI,IAAI;GAO3B,MAAM,SAAQ,OALQ,iBADT,aAAa,KAAK,KAAK,KAAK,CAAC,GAAG,KAAK,KAAK,CACZ,EAAE,EAAE,kBAAkB,OAAO,CAAC,CAAC,KACxE,OAAO,UACJ,UAAU,IAAI,kBAAkB;IAAE,QAAQ;IAAe;IAAK;IAAO,CAAC,CACxE,CACF,EACoB,QAAQ,SAAS,GAAG;GACzC,IAAI,MAAM,WAAW,GACnB,OAAO,OAAO,OAAO,KACnB,IAAI,kBAAkB;IACpB,QAAQ;IACR;IACA,OAAO;IACR,CAAC,CACH;GAEH,IAAI,OAAO,SAAS,KAAK,MAAM;;EAEjC,OAAO,aACL,KACA,2FACD;GACD,CAAC,KAAK,OAAO,OAAO;CACtB,OAAO;EAAE,MAAM;EAAgB,MAAM,MAAM;EAAM;EAAS;;AAG5D,MAAa,eAAe;CAC1B,YAAY;CACZ,SAAS;CACT,aAAa;CACd;;;AChFD,MAAa,oBACZ,UAEA,MAAM,OACL,MAAM,KACN,aACC,MAAM,KACN,4HACA,CACD;;;;;;;;;;;;;;;;;AC1BF,MAAa,WACZ,QAEA,OAAO,IAAI,aAAa;CAEvB,OAAO,aACN,OAFsB,KAGtB,gIACA;EACA"}

package/dist/layer.d.ts

@@ -0,0 +1,32 @@
+import type { Context } from "effect";
+import { Layer } from "effect";
+import type { EnvMember, Environment, MemberValue } from "./environment";
+/**
+ * Type of the value an `Environment<M>` yields when consumed — the same
+ * record type produced by `yield* env`.
+ */
+export type EnvironmentShape<M extends Readonly<Record<string, EnvMember>>> = {
+    readonly [K in keyof M]: MemberValue<M[K]>;
+};
+/**
+ * Lift an `Environment` bundle into a service `Layer` so the app's
+ * graph can depend on the yielded record once and DI it everywhere.
+ *
+ * The bundle is a yieldable `Config`; lifting it into a `Layer.effect`
+ * bound to a `Context.Service` tag means the bundle is resolved once at
+ * Layer construction time, and every downstream service that yields the
+ * tag reads from the resolved record — no `Effect.runSync` at module
+ * scope, no per-service `Config.string` reads.
+ *
+ *   class AppEnv extends Context.Service<AppEnv, EnvironmentShape<typeof bundleEnv.members>>()("AppEnv") {}
+ *   export const AppEnvLive = environmentLayer({ tag: AppEnv, env: bundleEnv });
+ *
+ *   // downstream:
+ *   const env = yield* AppEnv;
+ *   const password = Redacted.value(env.postgres.password);
+ */
+export interface EnvironmentLayerInput<Self, M extends Readonly<Record<string, EnvMember>>> {
+    readonly tag: Context.Service<Self, EnvironmentShape<M>>;
+    readonly env: Environment<M>;
+}
+export declare const environmentLayer: <Self, M extends Readonly<Record<string, EnvMember>>>(input: EnvironmentLayerInput<Self, M>) => Layer.Layer<Self>;

package/dist/literal.d.ts

@@ -0,0 +1,34 @@
+import { Config } from "effect";
+import { type EntryMarker, type HasEnvClaims } from "./entry";
+export interface LiteralEntry<EnvName extends string, T> extends Config.Config<T>, EntryMarker<"Literal">, HasEnvClaims {
+    readonly envName: EnvName;
+    readonly value: T;
+    readonly serialized: string;
+    /**
+     * Stored so bind-time value overrides can re-serialize with the same
+     * fn. Typed as `(unknown) => string` so that `LiteralEntry<…, T>`
+     * stays assignable to `LiteralEntry<string, unknown>` in the
+     * `EnvMember` union (function params are contravariant — a more
+     * specific T would block the narrowing). The override site supplies
+     * a value typed against `T` via `LiteralMembersOpts<M>`.
+     */
+    readonly serialize: (value: unknown) => string;
+}
+export interface DefineLiteralInput<EnvName extends string, T> {
+    readonly envName: EnvName;
+    readonly value: T;
+    readonly schema?: Config.Config<T>;
+    readonly serialize?: (value: T) => string;
+}
+export type AnyLiteralEntry = LiteralEntry<string, unknown>;
+/**
+ * `Literal` value namespace.
+ *
+ *   const port = Literal.define({
+ *     envName: "PORT", value: 8080,
+ *     schema: Config.number("PORT").pipe(Config.withDefault(8080)),
+ *   });
+ */
+export declare const Literal: {
+    define: <const EnvName extends string, T = string>(input: DefineLiteralInput<EnvName, T>) => LiteralEntry<EnvName, T>;
+};

package/dist/runtime.d.ts

@@ -0,0 +1,18 @@
+import { type Config, Effect } from "effect";
+import type { EnvMember, Environment } from "./environment";
+import type { EnvironmentShape } from "./layer";
+/**
+ * Read every member of an `Environment<M>` from the active
+ * `ConfigProvider` and return the decoded record.
+ *
+ * This is the runtime half of an env contract — the same `apiEnv`
+ * bundle that drives `Environment.bind` in the konfig modules drives
+ * this decode in the running app. Add a new `Literal` /
+ * `Secret` to the bundle and the runtime call surfaces it
+ * automatically; remove one and the runtime call no longer reads it.
+ *
+ *   const config = yield* Environment.runtime(apiEnv);
+ *   const port = config.http.port;
+ *   const password = Redacted.value(config.db.password);
+ */
+export declare const runtime: <M extends Readonly<Record<string, EnvMember>>>(env: Environment<M>) => Effect.Effect<EnvironmentShape<M>, Config.ConfigError>;

package/dist/secret.d.ts

@@ -0,0 +1,35 @@
+import { Config, type Redacted } from "effect";
+import { type EntryMarker, type HasEnvClaims } from "./entry";
+export interface SecretEntry<N extends string, K extends string, E extends Readonly<Record<K, string>>> extends Config.Config<{
+    readonly [P in K]: Redacted.Redacted<string>;
+}>, EntryMarker<"Secret">, HasEnvClaims {
+    readonly name: N;
+    readonly namespace: string;
+    readonly env: E;
+    readonly keys: ReadonlyArray<K>;
+    readonly fields: {
+        readonly [P in K]: Config.Config<Redacted.Redacted<string>>;
+    };
+}
+export interface DefineSecretInput<N extends string, E extends Readonly<Record<string, string>>> {
+    readonly name: N;
+    readonly namespace: string;
+    readonly env: E;
+}
+export type AnySecretEntry = SecretEntry<string, string, Readonly<Record<string, string>>>;
+/**
+ * `Secret` value namespace (env-contracts package).
+ *
+ *   const dbCreds = Secret.define({
+ *     name: "db-creds",
+ *     namespace: "app",
+ *     env: { url: "DATABASE_URL", password: "DATABASE_PASSWORD" },
+ *   });
+ *
+ * The k8s package re-exports this merged with its own `Secret.make` /
+ * `Secret.bind`, so importing `Secret` from `@konfig.ts/k8s` exposes
+ * `define` alongside the manifest/binder constructors.
+ */
+export declare const Secret: {
+    define: <const N extends string, const E extends Readonly<Record<string, string>>>(input: DefineSecretInput<N, E>) => SecretEntry<N, keyof E & string, E>;
+};

package/dist/source.d.ts

@@ -0,0 +1,40 @@
+import { Effect, Redacted, type Scope } from "effect";
+import { ChildProcessSpawner } from "./_unstable";
+declare const SecretSourceError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "SecretSourceError";
+} & Readonly<A>;
+export declare class SecretSourceError extends SecretSourceError_base<{
+    readonly source: string;
+    readonly key: string;
+    readonly cause: unknown;
+}> {
+}
+export type ResolvedSecretValues<K extends string> = {
+    readonly [P in K]: Redacted.Redacted<string>;
+};
+export interface SecretSource<K extends string, R = never> {
+    readonly _tag: "SecretSource";
+    readonly keys: ReadonlyArray<K>;
+    readonly resolve: Effect.Effect<ResolvedSecretValues<K>, SecretSourceError, R>;
+}
+export interface FromConfigInput<K extends string> {
+    readonly keys: ReadonlyArray<K>;
+    readonly envName?: (key: K) => string;
+}
+export interface LiteralInput<D extends Readonly<Record<string, string>>> {
+    readonly data: D;
+}
+export interface FromCommandSpec {
+    readonly cmd: string;
+    readonly args: ReadonlyArray<string>;
+}
+export interface FromCommandInput<K extends string> {
+    readonly keys: ReadonlyArray<K>;
+    readonly run: (key: K) => FromCommandSpec;
+}
+export declare const SecretSource: {
+    fromConfig: <const K extends string>(input: FromConfigInput<K>) => SecretSource<K>;
+    literal: <const D extends Readonly<Record<string, string>>>(input: LiteralInput<D>) => SecretSource<keyof D & string>;
+    fromCommand: <const K extends string>(input: FromCommandInput<K>) => SecretSource<K, ChildProcessSpawner | Scope.Scope>;
+};
+export {};

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@konfig.ts/env",
+  "version": "0.0.1",
+  "description": "Yieldable environment atoms (defineSecret, defineLiteral, defineDownward, defineEnvironment) shared between konfig manifest emission and the runtime pod application.",
+  "license": "MIT",
+  "author": "David Stahl-Gruber",
+  "homepage": "https://github.com/DwieDave/konfig.ts#readme",
+  "bugs": "https://github.com/DwieDave/konfig.ts/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DwieDave/konfig.ts.git",
+    "directory": "packages/env"
+  },
+  "keywords": [
+    "kubernetes",
+    "k8s",
+    "config",
+    "secret",
+    "effect",
+    "typescript"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown ./src/index.ts --format=esm --target=node20 --sourcemap --clean --no-dts && tsc -p tsconfig.build.json",
+    "check": "tsc -p tsconfig.check.json --noEmit",
+    "test": "vitest run",
+    "lint": "oxlint",
+    "lint:apply": "oxlint --fix",
+    "prepublishOnly": "bun run build",
+    "prepack": "node ../../scripts/prepack-exports.mjs strip",
+    "postpack": "node ../../scripts/prepack-exports.mjs restore"
+  },
+  "dependencies": {
+    "@konfig.ts/core": "0.0.1"
+  },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.70"
+  },
+  "devDependencies": {
+    "@effect/vitest": "catalog:",
+    "@types/bun": "catalog:",
+    "effect": "catalog:",
+    "fast-check": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}