Struct Config 

pub struct Config {

    pub import: Vec<String>,
    pub root: bool,
    pub leases: IndexMap<String, LeaseBackendConfig>,
    pub providers: IndexMap<String, ProviderConfig>,
    pub secrets: IndexMap<String, SecretConfig>,
    pub profiles: IndexMap<String, ProfileConfig>,
    pub age_key_file: Option<PathBuf>,
    pub if_missing: Option<IfMissing>,
    pub prompt_auth: Option<bool>,
    pub mcp: Option<McpConfig>,
    pub provider_sources: HashMap<String, PathBuf>,
    pub secret_sources: HashMap<String, PathBuf>,
    pub default_provider_source: Option<PathBuf>,
    pub project_dir: Option<PathBuf>,
    /* private fields */
}

Fields

import: Vec<String>

Import paths to other config files

root: bool

Root configuration - stops recursion at this level

leases: IndexMap<String, LeaseBackendConfig>

Lease backend configurations (for default profile)

providers: IndexMap<String, ProviderConfig>

Provider configurations (for default profile)

secrets: IndexMap<String, SecretConfig>

Default profile secrets (top level)

profiles: IndexMap<String, ProfileConfig>

Named profiles

age_key_file: Option<PathBuf>

Age encryption key file path (optional, can also be set via env var or CLI flag)

if_missing: Option<IfMissing>

Default if_missing behavior for all secrets in this config

prompt_auth: Option<bool>

Whether to prompt for authentication when provider auth fails (default: true in TTY)

mcp: Option<McpConfig>

MCP server configuration

provider_sources: HashMap<String, PathBuf>

Track which config file each provider came from (not serialized)

secret_sources: HashMap<String, PathBuf>

Track which config file each secret came from (not serialized)

default_provider_source: Option<PathBuf>

Track which config file the default_provider came from (not serialized)

project_dir: Option<PathBuf>

The project root directory — the nearest directory to cwd that contains a config file. Used for scoping the lease ledger per-project.

Implementations

impl Config

pub fn load_smart<P: AsRef<Path>>(path: P) -> Result<Self>

Load configuration using the appropriate strategy

pub fn load<P: AsRef<Path>>(path: P) -> Result<Self>

Load configuration from a file

pub fn global_config_path() -> PathBuf

Get the path to the global config file

pub fn save<P: AsRef<Path>>(&self, path: P) -> Result<()>

Save configuration to a file Uses toml_edit to preserve insertion order from IndexMap and format secrets as inline tables

pub fn save_secret_to_source( &self, secret_name: &str, secret_config: &SecretConfig, profile: &str, default_target: &Path, ) -> Result<()>

Save a single secret update back to its source file Always saves to the default_target (local config file), creating a local override if the secret exists in a parent config. This aligns with the hierarchical config model where child configs override parent configs.

This method preserves comments and formatting in the TOML file by directly manipulating the document AST rather than re-serializing.

pub fn remove_secret_from_source( secret_name: &str, profile: &str, target_file: &Path, ) -> Result<bool>

Remove a single secret from a config file, preserving comments and formatting.

This method directly manipulates the TOML document AST rather than re-serializing, so all comments, whitespace, and formatting are preserved.

pub fn save_secrets_to_source( secrets: &IndexMap<String, SecretConfig>, profile: &str, target_file: &Path, ) -> Result<()>

Save multiple secrets to a config file, preserving comments and formatting.

This is the batch equivalent of save_secret_to_source, used by fnox import.

pub fn new() -> Self

Create a new default configuration

pub fn get_profile(profile_flag: Option<&str>) -> String

Get the profile to use (from flag or env var, defaulting to “default”)

pub fn should_prompt_auth(&self) -> bool

Determine if we should prompt for authentication when provider auth fails. Priority: env var > config > default (true) Returns true only if prompting is enabled AND we’re in a TTY.

pub fn get_default_secrets_mut(&mut self) -> &mut IndexMap<String, SecretConfig>

Get secrets for the default profile (mutable)

pub fn get_profile_secrets_mut( &mut self, profile: &str, ) -> &mut IndexMap<String, SecretConfig>

Get secrets for a specific profile (mutable)

pub fn get_secrets( &self, profile: &str, ) -> Result<IndexMap<String, SecretConfig>>

Get effective secrets (default or profile) For non-default profiles, this merges top-level secrets with profile-specific secrets, with profile secrets taking precedence.

Note: If a profile doesn’t exist in [profiles], it’s treated as “default”. This allows fnox.$FNOX_PROFILE.toml files to work without requiring a [profiles] section.

pub fn get_secret(&self, profile: &str, key: &str) -> Option<&SecretConfig>

Look up a single secret by key without cloning the secrets map.

Mirrors the precedence used by Self::get_secrets: profile-specific secrets take precedence, falling back to top-level secrets unless no_defaults is set.

pub fn get_secrets_mut( &mut self, profile: &str, ) -> &mut IndexMap<String, SecretConfig>

Get effective secrets (default or profile, mutable)

pub fn get_leases(&self, profile: &str) -> IndexMap<String, LeaseBackendConfig>

Get effective lease backends for a profile

pub fn get_providers(&self, profile: &str) -> IndexMap<String, ProviderConfig>

Get effective providers for a profile

pub fn get_default_provider(&self, profile: &str) -> Result<Option<String>>

Get the default provider for a profile Returns the configured default_provider, or auto-selects if there’s only one provider

pub fn validate(&self) -> Result<()>

Validate the configuration Collects all validation issues and returns them together using #[related]

pub fn default_provider(&self) -> Option<&str>

Get the default provider name, if set.

pub fn default_provider_span(&self) -> Option<Range<usize>>

Get the default provider’s source span (byte range in the config file). Returns None if the default_provider wasn’t set or was created programmatically.

pub fn set_default_provider(&mut self, provider: Option<String>)

Set the default provider name (without span information).

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Config

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Config

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Config

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for Config

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.