Documentation
¶
Overview ¶
Package secrets carries opaque references across durable boundaries. Only a live runner session may replace them with plaintext.
Index ¶
- Constants
- func Candidates(v any) []string
- func Contains(v any) bool
- func ExpandSchema(schema map[string]any) (map[string]any, error)
- func HasAnnotation(value any) bool
- func InvocationNames(t reflect.Type, input any) ([]string, error)
- func MaterializeInput(s *Session, t reflect.Type, input any) (any, error)
- func Names(v any) ([]string, error)
- func Placeholder(v any) (any, error)
- func Transform(v any, f func(Reference) (any, error)) (any, error)
- func ValidateSchema(schema map[string]any, v any, materialized bool) error
- func ValidateType(t reflect.Type, v any) error
- func WithSession(ctx context.Context, s *Session) context.Context
- type Reference
- type Resolver
- type Session
- func (s *Session) CheckOutput(v any) error
- func (s *Session) Close()
- func (s *Session) Error(err error) error
- func (*Session) GoString() string
- func (*Session) MarshalJSON() ([]byte, error)
- func (s *Session) Materialize(v any) (any, error)
- func (s *Session) Prepare(ctx context.Context, required, candidates []string, resolve Resolver) error
- func (s *Session) Ready(names []string) bool
- func (s *Session) Redact(text string) string
- func (*Session) String() string
- type Sessions
Constants ¶
const WireKey = "$c2j_secret"
Variables ¶
This section is empty.
Functions ¶
func Candidates ¶
Candidates only scans data already loaded by the compiler. It performs no expression evaluation, include resolution, or extension retrieval.
func ExpandSchema ¶
ExpandSchema admits a reference as the deferred representation of a secret string. ValidateSchema separately enforces that submission uses references.
func HasAnnotation ¶
func InvocationNames ¶
Forwarding fields carry references to a child job and never materialize them in the parent. The child validates its own recipe schema before executing.
func Placeholder ¶
Placeholder is for type validation only and is never used for execution.
func ValidateSchema ¶
Schema annotations apply to string leaves. Unsupported schema constructs cannot implicitly grant permission to a reference.
func ValidateType ¶
ValidateType permits native ops to opt in with secret:"true" on string inputs, or secret:"env" on a map of environment variables. Extension payloads use secret:"schema" and are checked against their manifest before invocation.
Types ¶
type Reference ¶
type Reference struct {
Name string `json:"$c2j_secret" yaml:"$c2j_secret"`
}
func Expression ¶
type Session ¶
type Session struct {
// contains filtered or unexported fields
}
Session belongs to one local invocation of a job, including its task retries. It is deliberately neither serializable nor a process-wide credential cache.
func FromContext ¶
func NewSession ¶
func NewSession() *Session
func (*Session) CheckOutput ¶
func (*Session) Error ¶
Errors with secret-bearing messages lose their unwrap chain: retaining it would let error-chain diagnostics serialize the original plaintext.
func (*Session) MarshalJSON ¶
func (*Session) Prepare ¶
func (s *Session) Prepare(ctx context.Context, required, candidates []string, resolve Resolver) error
Prepare serializes fills so concurrent callers reuse an in-flight batch. The small fixed batch also bounds request size for JobDB's default limits. Provider response limits remain authoritative; speculative failures fall back to the current task's names. Missing future names are never negatively cached.
type Sessions ¶
type Sessions struct {
// contains filtered or unexported fields
}
Sessions connects a WorkSet's job and task workers, without putting a cache ID or value into a chapter. A second local execution cannot borrow the first's cache; overlapping executions of the same key fail closed.
func NewSessions ¶
func NewSessions() *Sessions
Source Files