config

type Masker struct {
	// contains filtered or unexported fields
}

type MaskerOption func(*Masker)

type MigrateOptions struct {
	// DryRun prints the planned changes but does not write the
	// config or call the keychain backend.
	DryRun bool

	// Target selects the destination storage mode. Defaults to
	// [credentials.ModeEnvVar] if unset.
	Target credentials.Mode

	// AssumeYes skips every interactive prompt. Env-var names fall
	// back to the upstream-standard defaults; keychain account names
	// follow the wizard convention. Intended for CI pipelines and
	// scripted migrations.
	AssumeYes bool

	// EnvVarOverrides maps source config key → chosen env var name.
	// Lets non-interactive callers pin a specific env var per
	// credential (e.g. `--env-var anthropic.api.key=MYTOOL_ANTHROPIC`).
	// Overrides both defaults and interactive prompts.
	EnvVarOverrides map[string]string

	// KeychainService overrides the keychain service (the first half
	// of the <service>/<account> reference). Defaults to the tool's
	// name (`props.Tool.Name`), matching the setup wizards.
	KeychainService string

	// SkipVerify disables the post-export verification step in
	// interactive env-var mode. Useful for headless automation
	// where the user sets env vars via /etc/profile or systemd
	// drop-ins rather than an interactive shell.
	SkipVerify bool
}

type MigrateResult struct {
	// Actions is the set of candidate migrations found in config,
	// with status filled in. Useful for machine-readable output.
	Actions []MigrationAction

	// WroteConfig is true when the config file on disk was rewritten.
	// Always false in DryRun mode.
	WroteConfig bool
}

type MigrationAction struct {
	// SourceKey is the config key currently holding the literal
	// credential (e.g. `anthropic.api.key`, `github.auth.value`).
	// For dual credentials this is the "primary" half (username).
	SourceKey string

	// PartnerKey is set for dual-credential pairs where both halves
	// migrate together (only `bitbucket.username` + `bitbucket.app_password`
	// today). Empty for single-value credentials.
	PartnerKey string

	// Target is the mode this credential was migrated to.
	Target credentials.Mode

	// DestKey is the config key written after migration. For
	// env-var targets: `<prefix>.env`. For keychain: `<prefix>.keychain`.
	// For Bitbucket dual-cred keychain target, only one key is
	// written (the shared `bitbucket.keychain`); PartnerKey is still
	// set so the report lists both removed literals.
	DestKey string

	// DestValue is the written value — an env var name (env-var
	// target) or a `<service>/<account>` reference (keychain
	// target). The source credential value is NEVER included here.
	DestValue string

	// Skipped is true when the credential was already migrated or
	// could not be migrated (e.g. keychain target with no backend
	// registered). Reason explains why.
	Skipped bool
	Reason  string
}