Module credential 

Shared cloud credential resolution (§4): env var → resolved secrets → scoped key file. Each cloud substrate names its own env var and key file and maps the neutral CredentialMissing to its own fault, so per-provider error codes and remediation stay distinct (ARCHITECTURE.md §2).

Structs

CredentialMissing

No credential in any source. The provider maps this to its own ApiKeyMissing-style fault (whose remediation names the provider).

Functions

resolve

Resolve a credential from the environment, the resolved secrets, or a scoped key file next to the definition. The env var wins so CI can inject without a file; the secrets map is the project’s canonical store; the file is a scoped fallback.