Module credentials 

Keychain-backed credential resolver + legacy one-time importer.

The Keychain is the only durable credential authority under the Foundation host. The KeychainCredentialResolver looks up a profile’s { service, account } locator and returns either the resolved value (typed) or a typed error. The Debug / Display surface never reveals the value.

The legacy importer reads ~/.oxicode/auth.json, asks the user for explicit acknowledgement, writes the Keychain entry, and optionally archives the legacy file outside the active credential path. It is the only code path that reads ~/.oxicode/auth.json under the Foundation host.

Structs

InMemoryKeychain

In-memory Keychain backend for tests. The Debug impl masks stored values.

KeychainCredentialResolver

Resolves profile credentials. The resolver is the only thing the rest of the code talks to.

LegacyImportOutcome

Result of a successful legacy import.

LegacyImporter

One-time legacy importer. Reads ~/.oxicode/auth.json, asks the user for acknowledgement, writes the Keychain entry, then (optionally) archives the legacy file outside the active credential path.

MutexKeychain

Mutable variant of the in-memory Keychain. Used for tests that exercise the legacy importer. Clones share the same underlying store via Arc.

SystemKeychain

Production implementation. Uses the keyring crate (v3) with per-platform native backends configured in Cargo.toml.

Enums

Credential

Result of resolving a credential locator. The Debug impl masks the secret value so the type can appear in tracing and anyhow::Error chains without leaking the resolved key material.

CredentialError

Typed keychain error. Display carries the locator (account name is public), not the value.

Traits

KeychainBackend

keyring crate abstraction. Real production code uses the keyring crate; the trait is what the rest of the code depends on so tests can swap in a fake without touching the OS keychain.

Functions

source_class