creds

type Kind string

type Profile struct {
	Type string `toml:"type"`

	// Hosts pins this credential to the hosts it may be sent to. .blip.toml is
	// committed and can come from anywhere, so without this a cloned repo picks
	// both the destination and which of your secrets travels to it.
	Hosts []string `toml:"hosts"`

	Token        string `toml:"token"`
	TokenCommand string `toml:"token_command"`

	Header       string `toml:"header"`
	Value        string `toml:"value"`
	ValueCommand string `toml:"value_command"`

	Username        string `toml:"username"`
	Password        string `toml:"password"`
	PasswordCommand string `toml:"password_command"`

	TokenURL            string `toml:"token_url"`
	ClientID            string `toml:"client_id"`
	ClientSecret        string `toml:"client_secret"`
	ClientSecretCommand string `toml:"client_secret_command"`
	Scope               string `toml:"scope"`
	Audience            string `toml:"audience"`
}

type Resolved struct {
	Name     string
	Kind     Kind
	Hosts    []string
	Token    string
	Header   string
	Value    string
	Username string
	Password string

	TokenURL     string
	ClientID     string
	ClientSecret string
	Scope        string
	Audience     string
}

type Resolver struct {
	Run Runner
}

type Runner func(ctx context.Context, command string) (string, error)

type Store struct {
	Path     string
	Profiles map[string]Profile
}