Module credstore 

Credential store abstraction — plaintext config.json as canonical store.

~/.cinch/config.json (mode 0600) is the single credential store on every platform. Service name and account formats remain lock-step with the Go CLI’s cinch/cmd/internal/credstore/store.go for the Keychain migration window:

service = “com.cinchcli” account = “<user_id>:<device_id>” // auth token account = “encryption:<user_id>” // 32-byte AES key (base64url) account = “device-privkey:<user_id>:<device_id>” // X25519 private key (base64url)

Migration. CLI builds prior to 2026-05-08 wrote credentials to the OS Keychain (service com.cinchcli, legacy com.cinch.app). The read_* helpers transparently fall back to both Keychain services on a plaintext miss and copy the value forward to config.json on first success. No writes go to the Keychain any longer.

Structs

KeyringStore

macOS Keychain / Linux Secret Service / Windows Credential Manager backend pinned to a specific service name. Used only for one-time migration reads from pre-2026-05-08 CLI builds. No new writes go here.

PlaintextStore

Plaintext store — reads/writes via client_core::auth config helpers. Only token, encryption_key, device_private_key are persisted; other account names return None.

Enums

CredstoreError

Traits

Credstore

Functions

account_key

detect

Returns the canonical credential store. Always plaintext (config.json, mode 0600). Keychain entries from prior CLI builds are read by the read_* migration helpers below, never by this function.

device_privkey_account_key

encryption_account_key

read_device_privkey

Read the base64url-encoded X25519 private key for (user_id, device_id). Returns None when the key has not yet been written for this pair.

read_encryption_key

Read the encryption key for user_id. Returns the 32-byte AES key or None.

read_token

Read the auth token for the active (user, device) pair.

wipe_keyring_for

Best-effort delete of all Keychain entries this user/device might have from prior Keychain-era CLI builds. Errors are swallowed: the goal is hygiene, not correctness — config.json is the source of truth.

write_device_privkey

Persist a base64url-encoded X25519 private key for (user_id, device_id) to config.json. Always returns "plaintext".

write_encryption_key

Persist a 32-byte AES encryption key for user_id to config.json. Always returns "plaintext".