Module credentials 

OS-keyring storage for provider API keys (mermaid login).

Environment variables keep ABSOLUTE precedence — the keyring only fills the gap when no env var resolves (see utils::auth::resolve_provider_key). Keys are stored under service "mermaid", account <provider>. Backends: macOS Keychain, Windows Credential Manager, and the freedesktop Secret Service over blocking dbus on Linux. Kernel keyutils was deliberately rejected: kernel keyrings are session-scoped and vanish on reboot — the wrong semantics for API keys.

On a headless Linux box without a Secret Service every operation fails; that is treated as “no stored key” with ONE rate-limited warning, never a fatal error. MERMAID_NO_KEYRING=1 disables the keyring entirely (broken dbus setups).

Structs

KeyringStore

The real OS keyring, service "mermaid".

NoopStore

The MERMAID_NO_KEYRING=1 escape hatch: reads yield nothing, writes are a clear error instead of a silent no-op.

Traits

CredentialStore

Abstract credential storage so resolution logic tests against an in-memory fake instead of the real OS keyring.

Functions

default_store

The process-wide store: the OS keyring, or the no-op store when MERMAID_NO_KEYRING is set (non-empty). Resolved once — env is process-static.