Serverless and explicit loading

envless_env.edge is the explicit loader, the Python twin of @goenvless/env/edge. Everything it needs arrives as an argument, apart from the API base URL, which falls back to ENVLESS_API_ENDPOINT when you pass no endpoint, and it returns a plain dict[str, str] of decrypted values. It reads no .envless file and no CLI config, writes no cache, leaves os.environ and env untouched, and memoises nothing, so every call fetches and decrypts again.

import os

from envless_env.edge import load

values = load(
    token=os.environ['ENVLESS_TOKEN'],
    project='checkout-api',
    environment='production',
    key=os.environ['ENVLESS_KEY'],
)


def handler(event: dict[str, object], context: object) -> dict[str, object]:
    return {'statusCode': 200, 'body': values['PUBLIC_GREETING']}

Loading at module level, as above, pays the fetch once per cold start, and every invocation of a warm function reuses the dict. In asyncio code, await aload(...) takes the same arguments and runs in a worker thread.

Each missing input raises LoadError naming what to pass:

Pass a machine key as token. An edge runtime has no .envless file and no config to read one from.
Pass project and environment. An edge runtime has no .envless file to resolve them from.
Pass passphrase or key. Without one the values cannot be decrypted.
The workspace could not be resolved, so the passphrase cannot be turned into a key. Pass workspace_id explicitly.

A value that will not decrypt fails naming it, Could not decrypt STRIPE_SECRET, and an API failure raises with the API's own message. The record holds every variable with no visibility filter and no coercion, so treat all of it as server secrets.