Documentation
¶
Overview ¶
Package envref owns the vocabulary Agent Layer uses to tell a *reference* to a secret from a *literal* one in configuration.
That vocabulary has two halves. The `${NAME}` placeholder syntax names a value in `.agent-layer/.env`, and a set of query-parameter key shapes marks a URL value as credential-bearing. Both are shared by MCP server configuration and Git-backed skill imports, and by both the substitution path that resolves a placeholder and the validation paths that must recognize one without resolving it.
They live in one leaf package so no caller can drift into a second, weaker definition of what counts as a secret.
Index ¶
Constants ¶
const AgentLayerPrefix = "AL_"
AgentLayerPrefix is the namespace `.agent-layer/.env` is filtered to, so it is also the only namespace a placeholder can resolve from.
Variables ¶
var Pattern = regexp.MustCompile(`\$\{([A-Z0-9_]+)\}`)
Pattern matches one `${NAME}` placeholder and captures NAME.
Functions ¶
func IsAgentLayerName ¶
IsAgentLayerName reports whether a placeholder name can resolve from `.agent-layer/.env`, which is filtered to the AL_ namespace.
func IsEntirelyPlaceholders ¶
IsEntirelyPlaceholders reports whether input is built only from placeholders, with no literal text between or around them. An empty input qualifies, because it carries no literal value either.
Callers use it to tell a referenced secret from a literal one without resolving anything.
func IsSecretQueryKey ¶
IsSecretQueryKey reports whether a URL query parameter name marks its value as a credential.
func LiteralSecretQueryKey ¶
LiteralSecretQueryKey reports the first query parameter in rawURL whose key marks a credential and whose value is literal text rather than a placeholder.
It scans the raw string rather than parsing a URL, so it applies equally to a reference whose scheme or host is itself a placeholder. Keys are percent- decoded so an encoded key cannot slip past the vocabulary above.
Types ¶
This section is empty.
Source Files