Module secrets 

bynk.Secrets read-name checking (v0.173, ADR 0196 D1).

Secrets.get takes an ordinary String expression, so a computed name is invisible to any pass. Where one is seen, this module warns (bynk.secrets.computed_name) — a non-failing diagnostic (ADR 0117): the program is correct, bynk deploy simply cannot know which secret the context reads, and cannot list it in the deploy plan.

P5.5 (design/tracks/semantics-in-the-checker.md §6, §9): relocated here from bynk-emit/src/emitter/secrets.rs — a real, CompileError::new- constructed diagnostic, previously raised only from bynk-emit::project’s run_checks, and (per that call site’s own now-stale comment) never reachable from crate::analysis::analyse_project at all, since bynk-check cannot depend on bynk-emit. §9 named this an open risk rather than a scoped relocation; this module closes it, per R3.5. The manifest-only half — declared_secrets/emit_secrets_manifest/render, which describe bynk-secrets.json rather than diagnose anything — stays in bynk-emit, an emission concern this crate must not depend on. Its caller there now reaches secret_reads_of here, qualified, rather than duplicating the walk (the same dual-use pattern P5.4 used for bynk-check::test_suites).

Structs

SecretReads

What a context’s handlers read through bynk.Secrets.

Functions

secret_reads_of

The literal bynk.Secrets names this context’s handlers read, and whether that list is everything.