Crate codewhale_secrets 

Secret storage for CodeWhale API keys.

Provides a small abstraction (KeyringStore) plus a default file-based implementation (FileKeyringStore), an opt-in OS keyring implementation (DefaultKeyringStore), and an in-memory store for tests (InMemoryKeyringStore).

Higher-level lookup through Secrets::resolve checks the secret store first and falls back to environment variables. Config-file precedence lives in the config crate so user-facing commands can keep config -> secret store -> env explicit at the call site.

Modules

account

Shared secure-storage contract for the Codewhale account session. Shared secure-storage contract for Codewhale account sessions.

Structs

DefaultKeyringStore

OS-native keyring backend.

FileKeyringStore

JSON-on-disk secret store for headless environments.

InMemoryKeyringStore

In-memory keyring store for tests.

SecretBackendDiagnostic

Secret-safe structural description of the configured credential backend.

Secrets

High-level facade combining a KeyringStore with environment variable fallbacks.

Enums

SecretBackendDiagnosticKind

Secret-store backend selected by configuration for a structural diagnostic.

SecretBackendInspection

Scope of inspection performed for a structural secret-backend diagnostic.

SecretBackendPresence

Whether a secret-store path is present according to metadata only.

SecretSource

Identifies which layer in the resolution chain supplied a secret.

SecretsError

Errors that may arise from a KeyringStore backend.

Constants

DEFAULT_SERVICE

Default OS keychain service name. Kept as deepseek for compatibility with credentials saved before the CodeWhale rename. macOS users can verify entries with security find-generic-password -s deepseek -a <provider>.

LEGACY_SECRET_BACKEND_ENV

Legacy alias for SECRET_BACKEND_ENV.

SECRET_BACKEND_ENV

Select the secret storage backend. Supported values are file (default) and system/keyring for the OS credential store.

Traits

KeyringStore

Abstract secret store trait.

Functions

diagnose_secret_backend

Describe the configured credential backend without probing or reading it.

env_for

Map a canonical provider name to its environment variable(s), returning the first non-empty value found.