Struct SecretBuilder 

pub struct SecretBuilder { /* private fields */ }

Fluent builder for a single SecretEntry.

SecretBuilder::new()
    .env("OPENAI_API_KEY")
    .value(api_key)
    .allow_host("api.openai.com")
    .build()

Implementations

impl SecretBuilder

pub fn new() -> Self

Start building a secret.

pub fn env(self, var: impl Into<String>) -> Self

Set the environment variable to expose the placeholder as (required).

Names must be non-empty and must not contain = or NUL. They are not restricted to shell-identifier syntax.

pub fn value(self, value: impl Into<String>) -> Self

Set the secret value inline (mutually exclusive with source).

Prefer source for durable configs: an inline value is persisted verbatim in the sandbox spec, whereas a source reference is resolved host-side at spawn time and never stored at rest.

pub fn source(self, source: SecretSource) -> Self

Resolve the value from a host-side source reference at spawn time (mutually exclusive with value).

The durable config records only the reference; the plaintext is read from the host environment when the sandbox starts, so it never lands in the database.

pub fn placeholder(self, placeholder: impl Into<String>) -> Self

Set a custom placeholder string.

Placeholders must be non-empty, at most 1024 bytes, and must not contain NUL, CR, or LF. If not set, auto-generated as $MSB_<env_var>.

pub fn allow_host(self, host: impl Into<String>) -> Self

Add an allowed host (exact match).

pub fn allow_host_pattern(self, pattern: impl Into<String>) -> Self

Add an allowed host with wildcard pattern (e.g., *.openai.com).

pub fn allow_any_host_dangerous(self, i_understand_the_risk: bool) -> Self

Allow for any host. Dangerous: secret can be exfiltrated to any destination. Requires explicit acknowledgment.

pub fn on_violation( self, f: impl FnOnce(ViolationActionBuilder) -> ViolationActionBuilder, ) -> Self

Set the violation action for this secret.

pub fn require_tls_identity(self, enabled: bool) -> Self

Require verified TLS identity before substituting (default: true).

pub fn inject_headers(self, enabled: bool) -> Self

Configure header injection (default: true).

pub fn inject_basic_auth(self, enabled: bool) -> Self

Configure Basic Auth injection (default: true).

pub fn inject_query(self, enabled: bool) -> Self

Configure query parameter injection (default: false).

pub fn inject_body(self, enabled: bool) -> Self

Configure HTTP/1 body injection (default: false).

Fixed-length bodies up to 16 MiB update Content-Length; larger fixed-length bodies are blocked. Chunked bodies are decoded and re-encoded with fresh chunk sizes. Encoded bodies pass through unchanged.

pub fn build(self) -> SecretEntry

Consume the builder and return a SecretEntry.

Exactly one of value or source must be set. A source-backed entry carries an empty durable value; it is resolved host-side at spawn time.

Panics

Panics if env or at least one allowed host was not set, or if neither (or both) of value/source was set.

Trait Implementations

impl Default for SecretBuilder

fn default() -> Self

Returns the “default value” for a type.