Module secret_mediation 

Action-scoped secret mediation and confidential output routing.

Secrets are resolved only for the currently approved action identity through the composed external secret executable. Store/delete are planned sink actions with the same binding contract. Confidential provider outputs are held only in the run scope and routed to a declared sink or dependent action.

Structs

ConfidentialOutputDecl

ConfidentialRunScope

Run-scoped confidential values. Dropped when the apply run completes.

Constants

SECRET_SINK_ROUTE

Functions

apply_secret_sink_action

inspect_binding

Inspect whether a logical binding exists without resolving or returning its confidential value. Identity planning uses this metadata to distinguish a first create from steady-state publication.

inspect_recipient_policy

is_secret_sink_action

parse_confidential_declarations

public_artifact_store_action

resolve_action_secrets

Resolve secrets declared on an approved action for immediate provider apply.

resolve_action_secrets_with_values

resolve_binding

resolve_binding_optional

Resolve a binding for ensure/create planning.

resolve_public_artifact_optional

route_action_outputs

Route the exact declared confidential and public outputs into the bounded action run scope. Public identity artifacts are kept separate on the wire so a provider cannot disguise private bytes as public output.

route_confidential_outputs

Route declared confidential outputs after a provider action succeeds.

secret_sink_recipient_policy_action

secret_sink_store_action