35 lines
1.2 KiB
Go
35 lines
1.2 KiB
Go
package secrets
|
|
|
|
// CredentialRef identifies a secret through canonical metadata without exposing
|
|
// the underlying secret value.
|
|
type CredentialRef string
|
|
|
|
// SecretPurpose is a typed, non-secret description of why a credential exists.
|
|
type SecretPurpose string
|
|
|
|
const (
|
|
SecretPurposeDatabasePassword SecretPurpose = "DATABASE_PASSWORD"
|
|
SecretPurposeProviderAPIKey SecretPurpose = "PROVIDER_API_KEY"
|
|
SecretPurposeServiceAuthentication SecretPurpose = "SERVICE_AUTHENTICATION"
|
|
)
|
|
|
|
// RuntimeConsumer identifies a trusted runtime allowed to resolve a credential.
|
|
type RuntimeConsumer string
|
|
|
|
const (
|
|
RuntimeConsumerCore RuntimeConsumer = "core-runtime"
|
|
RuntimeConsumerCommit RuntimeConsumer = "commit-runtime"
|
|
RuntimeConsumerWorkWorker RuntimeConsumer = "agent-worker"
|
|
RuntimeConsumerEpistemicsWorker RuntimeConsumer = "reflection-worker"
|
|
RuntimeConsumerCognitive RuntimeConsumer = "cognitive-worker"
|
|
)
|
|
|
|
// SecretFileRef is bootstrap delivery metadata for the V1 protected local
|
|
// file backend. Path is a reference, not a secret value.
|
|
type SecretFileRef struct {
|
|
CredentialRef CredentialRef
|
|
Purpose SecretPurpose
|
|
Consumer RuntimeConsumer
|
|
Path string
|
|
}
|