Resolve typed credentials safely

internal/app/test_environment_test.go

@@ -4,6 +4,8 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+
+	configkit "gitea.maximumdirect.net/eric/ConfigKit"
 )
 
 // restoreEnvAfterTest clears names for a test and restores both their prior
@@ -31,6 +33,11 @@ func restoreEnvAfterTest(t *testing.T, names ...string) {
 	})
 }
 
+func testSecretReference(name string) *configkit.Secret {
+	reference := configkit.SecretEnv(name)
+	return &reference
+}
+
 func mustWriteSecretFile(t *testing.T, path, value string) {
 	t.Helper()
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {