cli

Module: spec::cli

Contents

Structs

• CliIntegrationConfig - Deserializable configuration for a CLI secret-provider integration.
• CliIntegrationSpec - A CLI integration configuration that has passed cross-field validation.
• CommandAndMatcher - A sensitive command pattern together with its extraction and output
• CommandPattern - Command words and the rule for matching trailing positional arguments.
• FlagSpec - A command-line option that a CLI integration needs to recognize.

Enums

• CliIntegrationConfigError - Error returned when validating a [CliIntegrationConfig].
• CommandMatch - Whether a command pattern permits trailing positional arguments.

Type Aliases

• CliMatcherRule - A command-classification rule for a CLI secret provider.

---

firma_secret_provider::spec::cli::CliIntegrationConfig

Struct

Deserializable configuration for a CLI secret-provider integration.

Convert this plain representation into [CliIntegrationSpec] to validate relationships between its option policies before use.

Fields:

• binary_name: String - Executable basename used to select this integration.
• provider_id: String - Stable identifier recorded for secrets from this integration.
• credential_env_vars: Vec<String> - Environment variables forwarded to authenticate the provider CLI.
• stripped_options: Vec<FlagSpec> - Options ignored while identifying command words. Their value arity is
• forbidden_options: Vec<FlagSpec> - Options that make an otherwise permitted invocation unsafe. An
• matchers: Vec<CliMatcherRule<firma_core::SecretMatcher>> - Rules that classify invocations and configure secret extraction.

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CliIntegrationConfig) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> CliIntegrationConfig

firma_secret_provider::spec::cli::CliIntegrationConfigError

Enum

Error returned when validating a [CliIntegrationConfig].

Variants:

• EmptyOptionName - An option has no spelling.
• AttachedValueWithoutValue{ name: String } - An option permits an attached value but does not take a value.
• ConflictingOptionDefinition{ name: String } - One option spelling has conflicting arity or attachment definitions.

Traits: Eq, Error

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Display
  • fn fmt(self: &Self, __formatter: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
• Clone
  • fn clone(self: &Self) -> CliIntegrationConfigError
• PartialEq
  • fn eq(self: &Self, other: &CliIntegrationConfigError) -> bool

firma_secret_provider::spec::cli::CliIntegrationSpec

Struct

A CLI integration configuration that has passed cross-field validation.

Generic Parameters:

• Matcher

Methods:

• fn binary_name(self: &Self) -> &str - Returns the executable basename used to select this integration.
• fn provider_id(self: &Self) -> &str - Returns the stable provider identifier recorded for extracted secrets.
• fn credential_env_vars(self: &Self) -> &[String] - Returns the environment variables forwarded to authenticate the CLI.
• fn resolve_args(self: &Self, args: &[String]) -> MatchingResolution<Matcher> - Classifies an invocation as sensitive, safe to pass through, or
• fn rewrite_args(self: &Self, args: &[String]) -> Vec<String> - Normalizes a sensitive command’s output options. Forbidden options are

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CliIntegrationSpec<Matcher>) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• TryFrom
  • fn try_from(config: CliIntegrationConfig) -> Result<Self, <Self as >::Error>
• Clone
  • fn clone(self: &Self) -> CliIntegrationSpec<Matcher>

firma_secret_provider::spec::cli::CliMatcherRule

Type Alias: super::MatcherRule<CommandAndMatcher<Matcher>, CommandPattern>

A command-classification rule for a CLI secret provider.

firma_secret_provider::spec::cli::CommandAndMatcher

Struct

A sensitive command pattern together with its extraction and output normalization policy.

Generic Parameters:

• Matcher

Fields:

• command: CommandPattern - Pattern used to identify the command.
• matcher: Matcher - Matcher used to extract secrets from the normalized output.
• stripped_options: Vec<FlagSpec> - Output-shaping options skipped during matching and removed before
• append_options: Vec<String> - Options and values added to normalize output into the expected form.

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CommandAndMatcher<Matcher>
• PartialEq
  • fn eq(self: &Self, other: &CommandAndMatcher<Matcher>) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>

firma_secret_provider::spec::cli::CommandMatch

Enum

Whether a command pattern permits trailing positional arguments.

Variants:

• Exact - Only the listed command words may occur. Options may be interspersed.
• Prefix - Additional positional arguments may follow the listed command words.

Traits: Copy, Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> CommandMatch
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Default
  • fn default() -> CommandMatch
• PartialEq
  • fn eq(self: &Self, other: &CommandMatch) -> bool
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>

firma_secret_provider::spec::cli::CommandPattern

Struct

Command words and the rule for matching trailing positional arguments.

Fields:

• argv: crate::non_empty::NonEmptyVec<String> - Command words, excluding the binary name.
• match_kind: CommandMatch - Whether trailing positional arguments are accepted.

Methods:

• fn prefix(argv: NonEmptyVec<String>) -> Self - Creates a pattern that accepts trailing positional arguments.
• fn exact(argv: NonEmptyVec<String>) -> Self - Creates a pattern that accepts only the listed command words.

Traits: Eq

Trait Implementations:

• PartialEq
  • fn eq(self: &Self, other: &CommandPattern) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>
• Clone
  • fn clone(self: &Self) -> CommandPattern

firma_secret_provider::spec::cli::FlagSpec

Struct

A command-line option that a CLI integration needs to recognize.

{ name = "--format", takes_value = true }
{ name = "--offline", takes_value = false }
{ name = "-u", takes_value = true, allow_attached_value = true }

Fields:

• name: String - The option’s spelling, such as --server-url or -u.
• takes_value: bool - Whether the option consumes the following argument as its value.
• allow_attached_value: bool - Whether the spelling accepts an attached value without =, such as

Methods:

• fn value(name: &str) -> Self - Creates a specification for an option whose value is a separate
• fn valueless(name: &str) -> Self - Creates a specification for an option that takes no value.
• fn attached_value(name: &str) -> Self - Creates a specification for an option that also accepts a value

Traits: Eq

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> FlagSpec
• PartialEq
  • fn eq(self: &Self, other: &FlagSpec) -> bool
• Serialize
  • fn serialize<__S>(self: &Self, __serializer: __S) -> _serde::__private228::Result<<__S as >::Ok, <__S as >::Error>
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Deserialize
  • fn deserialize<__D>(__deserializer: __D) -> _serde::__private228::Result<Self, <__D as >::Error>