The library documents itself · Security & governance
stzSecret
18 own methods · 5 forms written with extensions, listed under their method
the source: base/security/stzSecret.ring(opens in a new tab) · All classes · The area reference: Security & governance
Under each method, its extensions (Q CS XT Z ZZ IB W U): bold and ticked, it exists; struck, it does not. The extensions and what they mean
No method of this class is run on this page: the class reaches files, the network, processes, the clock, chance or sound, and an example run here would only be an example of its effects. Each method carries the explanation the library gives of itself.
Method
Explanation, as the source carries it
init
(no comment in the source: the name reads as a sentence) initno extension
FromLiteral
source setters (Q-fluent: return the object AFTER acting) -------- dev/test only: the value inline. Still redacted in every output; only Reveal(effectfulActor) returns it.QCSXTZZZIBWU
FromEnv
(no comment in the source: the name reads as a sentence) from envQCSXTZZZIBWU
FromFile
(no comment in the source: the name reads as a sentence) from fileQCSXTZZZIBWU
FromVault
(no comment in the source: the name reads as a sentence) from vaultQCSXTZZZIBWU
SetKind
(no comment in the source: the name reads as a sentence) set kindQCSXTZZZIBWU
Name
SAFE reads (never leak the value)no extension
Kind
(no comment in the source: the name reads as a sentence) kindno extension
SourceKind
(no comment in the source: the name reads as a sentence) source kindno extension
SourceLocator
the POINTER to where the secret lives -- an env var NAME, a file PATH, a vault REF. Safe to show: it is not the secret. (For :literal it is "(inline)", never the value.)no extension
Descriptor
the redacted, safe representation used EVERYWHERE the secret is displayed or serialised. No value ever appears here.no extension
Masked
(no comment in the source: the name reads as a sentence) maskedno extension
Show
(no comment in the source: the name reads as a sentence) showno extension
IsRevealableBy
the GOVERNED reveal -- the ONLY path to plaintext ---------------- may this actor read the plaintext? Only an effectful, non-sandboxed actor.no extension
Reveal
resolve + return the plaintext -- GATED. An LLMActor (inference-only) is refused; a HumanActor (effectful, trusted) succeeds. A vault-sourced secret needs a resolver (see RevealVia).also written: RevealForno extension
RevealVia
resolver-aware reveal: a vault-sourced secret is fetched THROUGH a resolver, passed by reference at reveal time (after the actor gate). ANY object with a Resolve(locator) method is a valid resolver -- your vault client, or the reference stzVaultResolver. For a non-vault secret the resolver is ignored and this behaves like Reveal(actor).no extension
IsVaultSourced
(no comment in the source: the name reads as a sentence) is vault sourcedno extension
IsResolvableBy
does the secret resolve to a non-empty value? Governed. A vault-sourced secret needs a resolver, so it is not resolvable this way.no extension