Module scripting 

Rotation through an operator-supplied script, run directly or through a PowerShell host.

CustomScriptIntegration runs the target’s script once per Operation, passing the operation name as its only argument and a JSON payload on stdin. Each run has four steps:

1. Resolve (command): the SCRIPT credential becomes a canonical path, confined to the script root when one is configured. SCRIPT_TYPE, or else the file extension, picks the ScriptType.
2. Build (command): the script and its type become a CommandSpec, a plain value naming the program, its arguments and its complete environment. A PowerShell script runs as an argument to a discovered or configured host.
3. Run (runner): a ScriptRunner spawns the process, writes the payload and waits for it to exit, killing it at the timeout. Tests substitute a recording runner, so nothing is spawned.
4. Classify (outcome): the exit code, signal or invocation error becomes success or an IntegrationError.

A configuration problem in the first two steps fails with credentials_unresolved before anything runs, so the target is reported unchanged.

Secrets

The new password and the target’s credentials reach the script only through the stdin payload. Argv carries just the operation name. A directly executed script starts with an empty environment, and a PowerShell host gets only a fixed allowlist of system variables. The script’s stdout and stderr go to the null device, since either could echo what it was given. The payload omits newPassword for terminate, and never includes SCRIPT or SCRIPT_TYPE, which configure the connector rather than the target.

Target effect

Exit codes 1 to 4 report what happened to the target. When the script ends without one of them (an exit code outside the contract, a signal, a broken pipe, or the timeout), the effect is inferred from the operation: only rotate can have changed the credential, so it reports TargetEffect::Unknown and the others report TargetEffect::NotApplied. The exception is a verify that times out, which reports TargetEffect::Applied: it only runs after a successful rotate. See Operation::effect_if_interrupted and Operation::effect_on_timeout.

The operator-facing contract (argv, stdin payload, exit codes, timeouts, PowerShell launching) is documented in the crate README under ## Custom-script integration and ## PowerShell scripts.

Modules

command 🔒

Script resolution and the process each script type runs as.

outcome 🔒

Translation of a script run into the rotation outcome the vault is told about.

runner 🔒

Process execution behind a trait, so the driver can be tested without spawning anything.

Structs

CustomScriptIntegration 🔒

Runs an operator-supplied script for each rotation operation.

PowershellConfig 🔒

How PowerShell scripts are launched.

ScriptPayload 🔒

The JSON document written to the script’s stdin.

Enums

Operation 🔒

The operation a script is asked to perform.

Functions

misconfigured 🔒

A failure caused by missing or invalid operator configuration; nothing ran, so the target is untouched.

payload_json 🔒

Serializes the stdin payload for operation.