Expand description
Scoped credential resolution.
Resolves a provider API key by trying scopes in strict priority order:
Session → Agent → User → System. Returning None means “no stored
credential” — the caller keeps its existing env/config key, which is the
single-tenant (env) terminal step of the chain.
The resolved plaintext key is held in a [secrecy::SecretString] so it is
never accidentally logged or serialized.
Structs§
- Credential
Resolver - Resolves credentials across scopes, decrypting on demand.
- Resolved
Credential - A successfully resolved credential. The plaintext key is wrapped in
[
SecretString]; call [secrecy::ExposeSecret::expose_secret] only at the point of use (constructing the upstream client).