Documentation
¶
Overview ¶
Package envref owns the vocabulary Agent Layer uses to tell a *reference* to a secret from a *literal* one in configuration.
That vocabulary has two halves. The `${NAME}` placeholder syntax names a value in `.agent-layer/.env`, and a set of query-parameter key shapes marks a URL value as credential-bearing. Both are shared by MCP server configuration and Git-backed skill imports, and by both the substitution path that resolves a placeholder and the validation paths that must recognize one without resolving it.
They live in one leaf package so no caller can drift into a second, weaker definition of what counts as a secret.
Index ¶
- Constants
- Variables
- func BearerPlaceholder(value string) (string, bool)
- func ExactPlaceholder(value string) (string, bool)
- func IsAgentLayerName(name string) bool
- func IsEntirelyPlaceholders(input string) bool
- func IsSecretQueryKey(key string) bool
- func LiteralSecretQueryKey(rawURL string) (string, bool)
- func Names(input string) []string
- func Redact(text string, placeholders map[string]string) string
Constants ¶
const AgentLayerPrefix = "AL_"
AgentLayerPrefix is the namespace `.agent-layer/.env` is filtered to, so it is also the only namespace a placeholder can resolve from.
Variables ¶
var Pattern = regexp.MustCompile(`\$\{([A-Z0-9_]+)\}`)
Pattern matches one `${NAME}` placeholder and captures NAME.
Functions ¶
func BearerPlaceholder ¶ added in v1.1.0
BearerPlaceholder reports the variable name when value is a case-insensitive "Bearer " prefix followed exactly by one `${NAME}` placeholder, with no other whitespace or text.
func ExactPlaceholder ¶ added in v1.1.0
ExactPlaceholder reports the variable name when value is exactly one `${NAME}` placeholder with no surrounding text.
func IsAgentLayerName ¶
IsAgentLayerName reports whether a placeholder name can resolve from `.agent-layer/.env`, which is filtered to the AL_ namespace.
func IsEntirelyPlaceholders ¶
IsEntirelyPlaceholders reports whether input is built only from placeholders, with no literal text between or around them. An empty input qualifies, because it carries no literal value either.
Callers use it to tell a referenced secret from a literal one without resolving anything.
func IsSecretQueryKey ¶
IsSecretQueryKey reports whether a URL query parameter name marks its value as a credential.
func LiteralSecretQueryKey ¶
LiteralSecretQueryKey reports the first query parameter in rawURL whose key marks a credential and whose value is literal text rather than a placeholder.
It scans the raw string rather than parsing a URL, so it applies equally to a reference whose scheme or host is itself a placeholder. Keys are percent- decoded so an encoded key cannot slip past the vocabulary above.
func Names ¶
Names returns the variable names referenced by input, in scan order. Repeated references are returned once per occurrence.
func Redact ¶ added in v0.24.0
Redact replaces every occurrence of each resolved value in text with the placeholder text that named it, so a diagnostic that echoes a resolved value shows `${AL_TOKEN}` rather than the secret. placeholders maps a resolved value to its placeholder; empty values are ignored.
Longer values are replaced first so a value that contains another cannot be left partly exposed by an earlier replacement.
Types ¶
This section is empty.
Source Files