Module bootstrap 

Bootstrap-flow driver for super::DeployerCredentials.

run_bootstrap consumes a one-shot admin credential via ZeroizedAdmin, delegates to the bound deployer handler, and persists:

1. A reviewable rules-pack under rules/<env_id>/ so the customer’s admin can apply the equivalent IaC offline (see rules_export).
2. A Credentials doc with mode = Bootstrap, admin_credential_consumed_at stamped to the call time, and — when the handler bound material directly — the env’s credentials_ref.

When the handler returns bound_credentials_ref = None (e.g. AWS C3 where the admin runs Terraform offline), the env stays uncredentialed: credentials_ref is NOT written, so a follow-up op credentials bootstrap is not locked out by AlreadyBootstrapped, and downstream op credentials requirements will correctly reject with NoCredentialsRef until the admin binds the real value via op credentials rotate.

Admin credentials posture

Admin credentials are received in a ZeroizedAdmin wrapper whose Drop zeroizes the in-process buffer. This is best-effort: the OS may have paged the buffer, the cloud SDK may hold its own copy, and ambient profile chains (e.g. ~/.aws/credentials) live outside this process. The contract is honest about that and does NOT claim process-wide memory erasure. Operators that need strong guarantees should run bootstrap on a short-lived process (CI runner, dedicated VM).

Phase A constraint

Same constraint as validate: Phase A’s secrets handler is metadata-only, so the runner cannot actually write the generated secret material to a real backend yet. The BootstrapOutcome returned by the handler is honored and stamped into the persisted Credentials doc; the secret-backend write is a Phase D follow-on. Today, deployers that have no admin escalation (local-process, C2) cleanly return BootstrapError::NotApplicable.

Structs

BootstrapInput

Input passed to super::DeployerCredentials::bootstrap.

BootstrapOutcome

Successful bootstrap output.

ZeroizedAdmin

One-shot admin credential material. Drop zeroizes the in-process buffer; see the module docstring for the limits of that guarantee.

Enums

BootstrapError

RunBootstrapError

Functions

run_bootstrap

Drive a bootstrap flow against the env’s bound deployer env-pack, inside a single transactional scope.

Type Aliases

BoundSecretSink

Sink the runner calls to persist bound secret material into the env’s secret backend. Inverted dependency: the runner owns the env flock and the write-before-persist ordering, while the caller (the CLI) owns the dev-store specifics. Receives the env root, the ref the material binds to, and the material; Ok(()) ⇒ durably stored, Err(msg) aborts the bootstrap before credentials_ref is recorded.