Function from_environment 

pub fn from_environment(
    values: &[(String, String)],
    files: &[SecretFile],
) -> String

A Windows VM’s Secrets step when the tool that runs it hands the values over itself (Vagrant’s provisioner environment over WinRM): each of values, a secret’s name and the variable holding its value in base64 (PowerShell never expands anything in it), kept in the SYSTEM- and Administrators-only folder and the delivery marked; then the placing script written, registered and run, as step does. Nothing waits. An empty or unset variable writes an empty value the first time, and keeps the value already kept after.