Struct SecretModificationPatch 

pub struct SecretModificationPatch {
    pub name: String,
    pub source: Option<SecretSource>,
    pub value: Zeroizing<String>,
    pub placeholder: Option<String>,
    pub allowed_hosts: Vec<String>,
}

A desired secret spec inside a modification patch.

The spec is declarative: it states the target state for one secret (source or value, placeholder, allowed hosts) and the planner infers the concrete change — added, rotated, hosts updated, placeholder updated — by diffing the spec against the existing config. Removal is explicit through SandboxModificationPatch::secrets_remove.

Only value may carry secret material, and only in-process: it is Zeroizing-wrapped, redacted from Debug output, skipped by serde when empty, and never copied into the plan.

Fields

name: String

Stable secret identity, usually the environment variable name.

source: Option<SecretSource>

Host-side source reference to resolve the value from. Mutually exclusive with value.

value: Zeroizing<String>

Raw secret value supplied by the caller, for embedders that hold only a value (e.g. from their own vault). Mutually exclusive with source. A value-based apply persists the value into the durable config until a later source-based rotate migrates the entry to a reference.

placeholder: Option<String>

Guest-visible placeholder/reference, if explicitly requested.

allowed_hosts: Vec<String>

Desired allowed host patterns. Empty means “leave unchanged” for an existing secret; a new secret needs at least one.

Trait Implementations

impl Clone for SecretModificationPatch

fn clone(&self) -> SecretModificationPatch

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretModificationPatch

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecretModificationPatch

fn default() -> SecretModificationPatch

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecretModificationPatch

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecretModificationPatch

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.