credentials

const (
	// ServiceName is the credential-ref service segment owned by cr.
	ServiceName = "codereview"

	// BackendSourceSecretsProfile is retained for old callers that still use
	// the previous secrets-profile naming.
	BackendSourceSecretsProfile credstore.Source = "secrets_profile"
	// BackendSourceCredentialStore records that an explicit credential-store
	// destination selected the active credential backend.
	// #nosec G101 -- this is a backend source label, not a secret value.
	BackendSourceCredentialStore credstore.Source = "credential_store"

	// GitTokenKey stores the Git host access token for PAT auth.
	GitTokenKey = "git_token"
	// GitHubAppIDKey is a removed legacy key name. App IDs now belong to
	// non-secret config, not credential bundles.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	GitHubAppIDKey = "github_app_id"
	// GitHubAppPrivateKeyKey stores the GitHub App PEM private key.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	GitHubAppPrivateKeyKey = "github_app_private_key"
	// GitHubAppInstallationIDKey is a removed legacy key name. Installation
	// routing now belongs to review profile config, not credential bundles.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	GitHubAppInstallationIDKey = "github_app_installation_id"
	// AnthropicAPIKeyKey stores the key name for Anthropic direct API adapters.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	AnthropicAPIKeyKey = "anthropic_api_key"
	// OpenAIAPIKeyKey stores the key name for OpenAI direct API adapters.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	OpenAIAPIKeyKey = "openai_api_key"
	// LegacyLLMAPIKeyKey is the pre-matrix generic key. It is intentionally
	// not in the v1 allowlist.
	// #nosec G101 -- this is a keyring item name, not a secret value.
	LegacyLLMAPIKeyKey = "llm_api_key"
)