Bind engine secret handling to facade types

2026-09-12 16:04:31 +00:00
parent 9b4f9ac50e
commit da02a19f2c
28 changed files with 348 additions and 232 deletions
--- a/internal/engine/clone.go
+++ b/internal/engine/clone.go
@@ -128,11 +128,11 @@ func (o *valueOperation) clone(value reflect.Value, descriptor *typeDescriptor,
 		return result, nil
 	case descriptorSecret:
 		result := reflect.New(value.Type()).Elem()
-		reference := value.Interface().(Secret)
+		reference := o.schema.secrets.Read(value)
 		if o.cloneMode == cloneValidatedSecrets {
 			result.Set(value)
-		} else if reference.specified {
-			result.Set(reflect.ValueOf(SecretEnv(reference.EnvName())))
+		} else if reference.Specified {
+			result.Set(o.schema.secrets.Make(SecretState{Name: reference.Name, Specified: true}))
 		}
 		return result, nil
 	case descriptorText: