Struct BatchSecrets 

pub struct BatchSecrets { /* private fields */ }

Batch of resolved secrets with per-batch lifetime.

Secrets are automatically zeroed when this struct is dropped. This provides secure handling for secrets resolved ahead of task execution.

Lifetime

This struct is designed for per-batch use:

1. Resolve all secrets needed for a batch of tasks
2. Use the secrets during task execution
3. Drop the BatchSecrets when the batch completes
4. Memory is automatically zeroed on drop

Example

let mut batch = BatchSecrets::new();
batch.insert("API_KEY".to_string(), SecureSecret::new("secret".to_string()), None);

// Use during task execution
if let Some(secret) = batch.get("API_KEY") {
    std::env::set_var("API_KEY", secret.expose());
}

// When batch goes out of scope, all secrets are zeroed

Implementations

impl BatchSecrets

pub fn new() -> Self

Create an empty batch.

pub fn with_capacity(capacity: usize) -> Self

Create a batch with pre-allocated capacity.

pub fn insert( &mut self, name: String, value: SecureSecret, fingerprint: Option<String>, )

Insert a secret into the batch.

Arguments

• name - The secret name/key
• value - The secure secret value
• fingerprint - Optional HMAC fingerprint for cache key inclusion

pub fn get(&self, name: &str) -> Option<&SecureSecret>

Get a secret by name.

pub fn contains(&self, name: &str) -> bool

Check if the batch contains a secret.

pub fn is_empty(&self) -> bool

Check if the batch is empty.

pub fn len(&self) -> usize

Get the number of secrets in the batch.

pub const fn fingerprints(&self) -> &HashMap<String, String>

Get the fingerprints map.

pub fn fingerprint(&self, name: &str) -> Option<&str>

Get the fingerprint for a specific secret.

pub fn names(&self) -> impl Iterator<Item = &String>

Iterate over secret names.

pub fn into_env_map(self) -> HashMap<String, String>

Convert to environment variable map for process injection.

Warning

This exposes all secret values. Use carefully and ensure the resulting map is not logged or persisted.

pub fn into_resolved_secrets(self) -> ResolvedSecrets

Convert to ResolvedSecrets for backward compatibility.

This consumes the batch and converts it to the legacy format.

pub fn merge(&mut self, other: Self)

Merge another batch into this one.

Secrets from other will overwrite existing secrets with the same name.

Trait Implementations

impl Debug for BatchSecrets

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for BatchSecrets

fn default() -> BatchSecrets

Returns the “default value” for a type.