Struct Resolver 

pub struct Resolver { /* private fields */ }

Walks a CredentialRef through its resolution chain, returning the first successful hit. The chain order is deliberately fixed:

1. env — read std::env::var(cref.env).
2. keychain — ask the injected CredentialStore.
3. literal — use the embedded value. Refused when std::env::var("CI").as_deref() == Ok("true").
4. fallback_env — read the ecosystem-default env var.

If every step misses, returns CredentialError::NotFound.

Implementations

impl Resolver

pub fn new(keychain: Arc<dyn CredentialStore>) -> Self

Construct with an injected keychain-backed CredentialStore. Tests typically pass a crate::MemoryStore here.

pub fn with_platform_default() -> Self

Convenience: build a Resolver over KeyringStore::new() — the platform-native default. Equivalent to Resolver::new(Arc::new(KeyringStore::new())).

pub async fn probe( &self, cref: &CredentialRef, ) -> Result<ResolutionOutcome, CredentialError>

Walk the chain and return the resolution source without returning the secret value. Used by rtb-cli’s v0.4 credentials list / doctor subcommands to report which precedence layer would supply each credential.

Returns:

• ResolutionOutcome::Resolved with the ResolutionSource that hit, if the underlying value was readable.
• ResolutionOutcome::LiteralRefusedInCi when only the literal layer is configured and CI=true is set.
• ResolutionOutcome::Missing when nothing resolves.

Does the same I/O as Self::resolve (including a keychain fetch when configured); the secret value is read and dropped rather than returned. Operators can run credentials list without their console scrolling secrets — at the cost of one keychain round-trip per ref.

pub async fn resolve( &self, cref: &CredentialRef, ) -> Result<SecretString, CredentialError>

Walk the chain and return the first hit.

Trait Implementations

impl Default for Resolver

fn default() -> Self

Same as Resolver::with_platform_default.