Module store 

Storage for per-scope encrypted provider credentials.

Mirrors the api_keys storage pattern: an #[async_trait] CredentialStore trait, an always-available InMemoryCredentialStore, and a SurrealDB-backed SurrealCredentialStore that compiles in the default (surreal) build.

Stored API keys are AES-256-GCM ciphertext (api_key_encrypted). Plaintext is never persisted and never returned by the store.

Structs

CredentialMetadata

Safe, plaintext-free view of a credential for API responses.

CredentialRecord

A stored credential row. api_key_encrypted is AES-256-GCM ciphertext.

InMemoryCredentialStore

In-memory credential store (used as the wired default and in tests), matching the InMemoryApiKeyStorage precedent.

SurrealCredentialStore

SurrealDB-backed credential store. Compiles in the default (surreal) build.

Enums

CredentialScope

The scope a credential is bound to. Resolution tries scopes in priority order: Session → Agent → User → System (see super::resolver).

Traits

CredentialStore

Backend-agnostic credential storage.

Type Aliases

SharedCredentialStore

Convenience alias for a shared store handle.