[ChristianPavilonis]

Summary

• Let typed applications compile active credential lookups without retaining scalar secret-reference leaves.
• Apply the same lookups and application-native rendering in typed config validate, push and diff. Applications that do not opt in keep the existing behavior.
• Share existing deployment resolution and secure Fastly create/replace operations with application CLIs.

Companion prerequisite for IABTechLab/trusted-server#1037. This does not implement or prove that project's runtime secret-scoping guarantee.

Changes

Crate / file	Change
edgezero-core/app_config	Default-compatible implicit lookup and native renderer hooks. Renderer receives effective adapter manifest defaults plus parent environment.
edgezero-cli/config	Both typed walkers consume the compiled plan, validate descriptor/path/store/key metadata and declarations, deduplicate identical requests, and reject native collisions. Public effective_manifest_environment helper.
edgezero-adapter / Axum / Spin	Optional exact native names retain adapter-native validation instead of validating obsolete raw labels. Existing Spin component resolver is public and reexported by edgezero-cli.
edgezero-adapter-fastly	Read-only service/store resolution using existing checked selectors and complete inventories; presence-only metadata listing; explicit POST create / PATCH replace using existing stdin-only curl transport. Raw bytes are Base64-encoded in memory.
edgezero-cli/fastly_secrets	Shared context_from_manifest builder and narrow host helper reexports.
tests	Real typed validate/push/diff, feature-only serialization, defaults, inactive cleanup, missing metadata/stores, repeated requests, native collisions, manifest environment parity, fictional provider operations and secure subprocess transport.

No deploy descriptors, registry, raw-key fallback, release tags, merging, or production provider calls.

API

AppConfigMeta::implicit_secret_lookups(&self) -> Result<Option<Vec<ImplicitSecretLookup>>, String>

Each lookup has descriptor_id, field_path, store_id, and key. None retains the old leaf walk; Some(vec![]) means no active credentials. The application compiler owns activation and complete descriptor coverage.

AppConfigMeta::render_implicit_secret_name(&self, adapter, lookup, environment: &EnvConfig) -> Result<String, String>

The application supplies its runtime bridge's native name, not EdgeZero's generic mapping. Plans are public metadata, not resolved credentials or authorization.

Host helpers are under edgezero_cli::fastly_secrets: context_from_manifest, resolve_resources, secret_exists, write_secret, injectable _with_transport variants, comparable resource metadata, and FASTLY_SECRET_MAX_BYTES. Explicit create/replace methods preserve the reviewed action on races. Errors do not expose provider response bodies or stderr, writes are not retried, and unconfirmed writes report uncertainty.

Test plan

Rust 1.95.0 on Linux x86_64. Independent target directory, two Cargo jobs, dev/test debug info disabled.

Workspace gates below passed at 5ad74df2. The final 4f645b1e changes only the implicit Fastly physical-store collision check and its regression. The affected CLI all-target tests passed again, including 227 library tests, and its all-features/all-target clippy passed. Other tested inputs remain unchanged.

• cargo test --workspace --all-targets -- --test-threads=1
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• cargo check --workspace --all-targets --features "fastly cloudflare spin"
• Focused implicit CLI tests, fictional Fastly provider tests, and existing Spin component-selection regressions.
• WASM builds and deployed native-provider rehearsals
• Separate app-demo workspace and docs build

Unverified and blocked

The provider API documentation specifies POST create, PATCH replacement and 64 KiB raw value limits. Host tests verify request construction and subprocess argv/stdin handling with fictional inputs, not real provider acceptance, replacement propagation, read-through-runtime byte preservation, native declaration limits, or config-writer/secret-writer IAM separation. No real credentials or provider mutations were used.

The consuming application's actual renderer/CLI integration and four-adapter runtime proof belong to the companion change. Successful storage never implies a deploy, resource link, activation, retained-state refresh or immediate fleet-wide rotation.

Checklist

• No Tokio dependencies added
• Existing default behavior preserved and exercised
• New behavior has executable host tests
• No credentials committed
• Draft only; no merging or releases