OptionaldiagnosticsNon-secret diagnostics for critical logs after sink failures.
Idempotency metadata for replay protection.
Projection used when inline mode deliberately returns the secret.
Pure projection used when a file sink stores the secret out of band.
OptionalrecoverOptional provider-side cleanup when sink storage fails after creation.
Secret-bearing provider result.
Active sink configuration.
MCP tool name producing the durable secret.
Response projection hooks for durable-secret-producing operations.