Module secrets 

Secrets-manager interpolation for the config layer (#125).

Resolution runs as the final config-load stage (after env/file and vars/templates), over the parsed config tree. See the design spec.

Modules

registry

Process-global registry of resolved secret values + a redaction scrubber.

Structs

ResolverSet

Map of scheme → resolver, built from compiled-in features (or injected in tests).

Constants

SECRET_SCHEMES

The four secret-manager schemes this layer recognises.

Traits

SecretResolver

Functions

collect_refs

Collect all unique secret references reachable from a config Value.

ensure_no_secret_directives

Error with SecretsRequireAsyncLoad if any secret directive is present. Called by the synchronous from_path so secrets never silently survive.

resolve_secrets

Production entry point: resolve all secret directives in cfg in place. Builds resolvers only for the schemes actually referenced.

resolve_secrets_with

Resolve all secret directives using a caller-supplied resolver set (the seam used by tests to inject fakes).

scan_path_refs

Parse path (tolerating secret directives) and return its unique secret refs.

scan_path_refs_with

scan_path_refs with caller-supplied crate::config::RunInputs (#444).

substitute

Substitute every secret directive in a Value from cache. Non-secret directives (${users.id}) pass through verbatim.

Type Aliases

SecretRef

A (scheme, reference) pair, e.g. ("vault", "secret/data/app#token").