[package]
name = "car-secrets"
version.workspace = true
edition.workspace = true
license.workspace = true
repository.workspace = true
description = "Cross-platform secret store for Common Agent Runtime"

[dependencies]
serde.workspace = true
serde_json.workspace = true
thiserror.workspace = true
tracing.workspace = true

# Cross-platform: unifies macOS Keychain, Windows Credential Manager, and
# Linux Secret Service (GNOME Keyring / KWallet / KeePassXC) under one API.
# - apple-native: uses Security.framework directly on macOS
# - windows-native: uses wincred on Windows
# - sync-secret-service: libsecret-based on Linux; requires an available
#   Secret Service daemon at runtime
# - crypto-rust: pure-Rust crypto (avoids linking OpenSSL on Linux)
keyring = { version = "3", features = [
    "apple-native",
    "windows-native",
    "sync-secret-service",
    "crypto-rust",
] }

# macOS-only direct binding so reads can search the full default-search-list
# of keychains, not just the User-domain default keychain. keyring v3's
# `Entry::get_password` calls `find_generic_password(Some(&[user_domain_default]))`,
# which misses items written when `security default-keychain -s` points
# elsewhere — issue #142.
[target.'cfg(target_os = "macos")'.dependencies]
security-framework = "3"

[dev-dependencies]
tempfile = "3"
# Used only by the file-backend test to CAPTURE and assert the one-time
# "PLAINTEXT ON DISK" warning actually fires (S2).
tracing-subscriber.workspace = true
