# tail-fin-credentials

Shared credential-storage primitives for tail-fin adapters.

This crate holds site-agnostic building blocks:

- `CredCookie` — single cookie-jar entry, JSON-serializable
- `write_owner_only` — file write with 0o600 permissions on unix
- `decode_jwt_sub` — extract the `sub` / `user_id` claim from a JWT

Per-site adapter crates (`tail-fin-nansen`, etc.) compose these into their
own typed credential bundles. This crate has no heavy dependencies — pure
serde + base64 + path IO. Safe to depend on from a library context that
just wants to read with pre-existing cookies.

For credential acquisition (Chromium auto-launch, CDP cookie export, etc.)
see the `tail-fin-bootstrap` crate.
