Enum CredentialSourceSpec 

pub enum CredentialSourceSpec {
    InlineSecret {
        secret: String,
    },
    ManagedStore,
    Env {
        env: String,
        fallback: Vec<String>,
    },
    ExternalResolver {
        handle: String,
    },
    PlatformDefault,
    Command {
        program: PathBuf,
        args: Vec<String>,
        cwd: Option<PathBuf>,
        env: BTreeMap<String, String>,
        timeout_ms: u64,
        refresh_interval_ms: Option<u64>,
    },
    FileDescriptor {
        fd: i32,
        scope_override: Option<String>,
    },
}

Where credentials come from.

Variants

InlineSecret

Fields

secret: String

ManagedStore

Binding-scoped credential material stored in the configured TokenStore. The storage key is the resolved typed binding identity (realm, binding), not a second free-form profile string.

Env

Fields

env: String

fallback: Vec<String>

Ordered fallback env var names consulted when env is unset. Used for providers with multiple well-known names (e.g. Gemini falls back to GOOGLE_API_KEY when GEMINI_API_KEY is absent). The resolver’s RKAT_*-prefix precedence applies to each name in turn.

ExternalResolver

Fields

handle: String

PlatformDefault

Command

External command that prints a bearer token on stdout. Reference: Codex external_bearer.rs:17-157. The runner lives in meerkat-client/src/auth_store/command.rs.

Fields

program: PathBuf

args: Vec<String>

cwd: Option<PathBuf>

env: BTreeMap<String, String>

timeout_ms: u64

Timeout for the subprocess in milliseconds.

refresh_interval_ms: Option<u64>

Optional cached-token lifetime. None disables caching.

FileDescriptor

Read credentials from an inherited file descriptor (Claude Code pattern for sandboxed host-injected tokens).

Fields

fd: i32

scope_override: Option<String>

Implementations

impl CredentialSourceSpec

pub const ALL_KIND_LABELS: &'static [&'static str]

pub const fn kind_label(&self) -> &'static str

Trait Implementations

impl Clone for CredentialSourceSpec

fn clone(&self) -> CredentialSourceSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialSourceSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CredentialSourceSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for CredentialSourceSpec

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for CredentialSourceSpec

fn eq(&self, other: &CredentialSourceSpec) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for CredentialSourceSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for CredentialSourceSpec

impl StructuralPartialEq for CredentialSourceSpec