Crate rtb_credentials 

OS-keychain-backed credential store, with precedence-aware resolution via Resolver.

Precedence

Downstream tools declare credentials via CredentialRef and call Resolver::resolve to fetch the underlying secret. The canonical chain is env > keychain > literal > fallback_env:

1. Environment variable — cref.env points at the var name.
2. OS keychain — cref.keychain holds service/account.
3. Literal — cref.literal is the secret itself. Rejected under CI=true to avoid secrets landing in CI logs.
4. Fallback env — cref.fallback_env is an ecosystem-default (ANTHROPIC_API_KEY, etc.).

Secrets never cross untyped boundaries

Every public function that touches a secret uses secrecy::SecretString: Debug renders [REDACTED]; memory is zeroed on drop.

Backends

KeyringStore uses the platform’s own credential store, chosen at compile time for the target:

Platform	Backend	Persistence
macOS	Keychain	Cross-session
Windows	Credential Manager	Cross-session
Linux and other Unix	freedesktop Secret Service (D-Bus)	Cross-session

The Secret Service needs a D-Bus session bus and a running provider such as GNOME Keyring or KDE Wallet; without them every keychain call returns CredentialError::Keychain. The client library, libdbus, is compiled from source and linked statically, so the build host needs a C compiler for the target but no D-Bus packages. The linux-persistent feature is retained for compatibility and has no effect.

See the rtb-credentials v0.1 spec for the authoritative contract.

Re-exports

pub use bearing::CredentialBearing;

pub use error::CredentialError;

pub use reference::CredentialRef;

pub use reference::KeychainRef;

pub use resolver::ResolutionOutcome;

pub use resolver::ResolutionSource;

pub use resolver::Resolver;

pub use store::CredentialStore;

pub use store::EnvStore;

pub use store::KeyringStore;

pub use store::LiteralStore;

pub use store::MemoryStore;

Modules

bearing

CredentialBearing — the introspection seam used by rtb-cli’s credentials subtree to enumerate the CredentialRefs a downstream tool’s config knows about.

error

Typed errors for the credentials subsystem.

reference

Config-serialisable reference to a credential.

resolver

The Resolver — walks a CredentialRef through the precedence chain defined by the framework spec.

store

The CredentialStore trait and its built-in implementations.

Traits

ExposeSecret

Expose a reference to an inner secret

Type Aliases

SecretString

Secret string type.