Module secrets 

secrets.json: the values a config refers to and never carries.

A key holds one value per environment, so production and staging differ without two config files. A {{secret:NAME}} reference resolves through SecretView, which reads the sheep’s own environment and then ALL_ENVIRONMENTS, never another named environment.

Same on-disk shape as crate::kv: a read-modify-rename under a crate::file_lock on a sibling secrets.json.lock.

Structs

ProviderCache

What provider dogs have pushed: the values, and which (namespace, environment) pairs carry a push at all.

SecretRef

One {{secret:...}} reference: a key, and the namespace it came from.

SecretView

What one environment can see: the operator’s store plus every provider dog’s, resolved against a single environment name.

Enums

Resolution

The outcome of resolving one SecretRef.

SecretError

Error type returned by this module.

Constants

ALL_ENVIRONMENTS

The environment name that covers every environment.

MAX_KEY_BYTES

Longest key, namespace or environment name this store accepts, in bytes.

MAX_VALUE_BYTES

Longest value this store accepts, in bytes.

PROVIDER_CACHE_VERSION

The secrets-cache.json format version this build reads and writes.

SECRETS_VERSION

The on-disk format’s version.

Functions

all

Every key in the store with its per-environment values, in key order.

get

The value stored under key for exactly environment, if there is one.

is_name

The grammar shared by keys, namespaces and environment names.

namespaces_of

The provider namespaces references names, derived with SecretRef::parse and kept to the namespaced half.

provider_cache_on_disk

The provider cache as secrets-cache.json currently holds it on disk, or nothing when the file is missing, will not parse, or is a version this build does not understand.

references

Every {{secret:...}} reference config names, exactly as the operator wrote it (KEY or namespace/KEY, no braces), deduplicated.

set

Stores value under key for environment, replacing any previous value in that slot and leaving every other environment alone.

unset

Removes key’s value for environment, returning whether it was there.

Type Aliases

NamespaceValues

namespace -> key -> environment -> value, every provider dog’s pushed values.

PushedPairs

namespace -> environments, the pairs a provider dog has actually pushed for.