phasekit

type Config struct {
	// ServiceToken is the Phase service token. Required.
	// Typically read from os.Getenv("PHASE_SERVICE_TOKEN") by the caller.
	// Required only when the phase CLI is available.
	ServiceToken string

	// App is the application name in Phase. Required.
	App string

	// Env is the environment name in Phase, for example "Production". Required.
	Env string

	// Path is the exact path within the app/env. Optional.
	// Defaults to "/" (root path only). Ignored when AllPaths is true.
	Path string

	// AllPaths fetches secrets from all paths by passing --path "" to the
	// Phase CLI. Defaults to false.
	AllPaths bool

	// RequiredKeys makes Hydrate fail if any listed key is missing from the
	// Phase response. RequiredKeys are not enforced when the phase CLI is
	// missing and phasekit falls back to the existing process environment.
	RequiredKeys []string

	// OverwriteExisting allows Phase values to replace variables already present
	// in the process environment. Defaults to false.
	OverwriteExisting bool

	// AllowRedacted allows literal "[REDACTED]" values returned by the Phase CLI.
	// Defaults to false because redacted secrets should fail startup.
	AllowRedacted bool

	// BinaryPath is the path to the phase binary. Defaults to exec.LookPath("phase").
	BinaryPath string

	// Host is the Phase API host. Defaults to "https://console.phase.dev".
	Host string

	// Timeout is the maximum duration for the phase CLI subprocess. Defaults to 10s.
	Timeout time.Duration
}

type Result struct {
	// Set lists keys hydrated into the process environment.
	Set []string

	// Skipped lists keys preserved because OverwriteExisting is false.
	Skipped []string

	// Source identifies the hydration source.
	// It is either SourcePhaseCLI or SourceEnvFallback.
	Source string
}