credentials

type Config struct {
	Prefix        string            `json:"prefix"`
	Env           map[string]string `json:"env"`
	Files         []string          `json:"files"`
	EncryptedFile string            `json:"encryptedFile"`
	// SecretsKey is the AES master key for encryptedFile (post-interpolation).
	SecretsKey string `json:"secretsKey,omitempty"`
	// ProcessEnv enables os.Getenv lookup (static default true; integrations default false).
	ProcessEnv *bool `json:"processEnv,omitempty"`
	// ScopedEnv preloads integration secrets per scope (L1 config); enc /env add overrides same key.
	ScopedEnv map[string]map[string]string `json:"scopedEnv,omitempty"`
}

type EnvDeps struct {
	// FS reads/writes dotenv and encrypted secrets files (scope prefixes allowed).
	FS filesystem.Service `json:"fs"`
}