Custom SecretSource

Implement a custom resolver through an Effect Service.

customSecretsAdapter reads references through the SecretSource service.

import { Effect, Option } from "effect";
import {
  SecretSource,
  configureResolver,
  createEnv,
  customSecretsAdapter,
  fromResolver,
  requiredString,
  server,
} from "@ayronforge/envil";

const sourceLayer = SecretSource.fromPromise({
  get: async (reference) => {
    const value = await readFromInternalStore(reference);
    return value === undefined ? Option.none() : Option.some(value);
  },
});

const custom = configureResolver(customSecretsAdapter, {});

const appEnv = createEnv(
  server({
    INTERNAL_TOKEN: requiredString.pipe(
      fromResolver(custom, "tenant/internal-token"),
    ),
  }),
);

const serverEnv = await Effect.runPromise(
  appEnv.server.pipe(Effect.provide(sourceLayer)),
);

SecretSource returns Option<Redacted<string>> in its Effect service contract. fromPromise accepts Option<string> and wraps present values before they enter the environment pipeline.

Custom source failures remain in the precise requirement and error channels of appEnv.server.