supercode_interchange/ontology/
secret.rs

1//! Secret references. A credential is named, never held: the model carries
2//! WHERE a value lives (`docs/ORCHESTRATOR-IR.md` §1 rule 3), and a vault
3//! resolves it at the moment of use.
4
5use schemars::JsonSchema;
6use serde::{Deserialize, Serialize};
7
8/// Where a secret value lives. Wire form: `{"env": NAME}` or `{"dotenv": KEY}`.
9#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
10#[serde(rename_all = "snake_case")]
11pub enum SecretRef {
12    /// An environment variable of the process that resolves it.
13    Env(String),
14    /// A key in the home's own `.env` file.
15    Dotenv(String),
16}
17
18impl SecretRef {
19    /// The name the reference points at, whichever store holds it.
20    pub fn name(&self) -> &str {
21        match self {
22            Self::Env(n) | Self::Dotenv(n) => n,
23        }
24    }
25}
26
27/// Resolves references at use; never part of a serialized model.
28pub trait Vault {
29    /// The value behind `reference`, or `None` when the store has no such name.
30    fn resolve(&self, reference: &SecretRef) -> Option<String>;
31}
supercode_interchange/ontology/secret.rs

supercode_interchange/ontology/
secret.rs
