pub type BoundSecretSink<'a> = dyn Fn(&Path, &SecretRef, &str) -> Result<(), String> + 'a;Expand description
Sink the runner calls to persist bound secret material into the env’s
secret backend. Inverted dependency: the runner owns the env flock and
the write-before-persist ordering, while the caller (the CLI) owns the
dev-store specifics. Receives the env root, the ref the material binds
to, and the material; Ok(()) ⇒ durably stored, Err(msg) aborts the
bootstrap before credentials_ref is recorded.