credentials

type EnvPairResolver ¶ added in v0.3.27

type EnvPairResolver interface {
	EnvPairs(ctx context.Context, scope string, opts EnvPairsOptions) ([]string, error)
}

EnvPairResolver is implemented by credentials/integrations. It resolves scoped secrets to KEY=value strings (opts.Keys, manifest allowlist, or stored keys for scope).

type EnvPairsOptions ¶ added in v0.3.27

type EnvPairsOptions struct {
	Keys []string
}

EnvPairsOptions selects env var names for scoped subprocess injection. When Keys is non-empty it overrides manifest allowlist and scoped key enumeration.

type Secret ¶

type Secret struct {
	Value string
	Ref   string
}

type Store ¶

type Store interface {
	Resolve(ctx context.Context, scope string, ref string) (Secret, error)
}

Store resolves secret refs. When scope is GlobalScope, plugins use the global lookup chain (context override, process env, config env, encrypted file, dotenv). When scope is non-empty, integrations require each env: ref to be allowlisted for fallback unless a scoped value exists (L1 scopedEnv, /env add, or encrypted SCOPE::KEY).