{"record":{"id":"4f0596cceccc38e6","repo":"zeroclaw-labs/zeroclaw","slug":"unknown-credential-class-class-expected-encry","errorCode":null,"errorMessage":"unknown credential_class `{class}`; expected encrypted_secret, path_only_reference, public_value, external_auth_store, legacy_env_path, or requires_follow_up","messagePattern":"unknown credential_class `(.+?)`; expected encrypted_secret, path_only_reference, public_value, external_auth_store, legacy_env_path, or requires_follow_up","errorType":"validation","errorClass":"syn::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-macros/src/lib.rs","lineNumber":2667,"sourceCode":"        return Some(lit_str.value());\n    }\n    None\n}\n\nfn extract_credential_class(attrs: &[syn::Attribute]) -> syn::Result<proc_macro2::TokenStream> {\n    let Some(class) = extract_string_attr(attrs, \"credential_class\") else {\n        return Ok(quote! { None });\n    };\n\n    let variant = match class.as_str() {\n        \"encrypted_secret\" => quote! { EncryptedSecret },\n        \"path_only_reference\" => quote! { PathOnlyReference },\n        \"public_value\" => quote! { PublicValue },\n        \"external_auth_store\" => quote! { ExternalAuthStore },\n        \"legacy_env_path\" => quote! { LegacyEnvPath },\n        \"requires_follow_up\" => quote! { RequiresFollowUp },\n        _ => {\n            return Err(syn::Error::new(\n                proc_macro2::Span::call_site(),\n                format!(\n                    \"unknown credential_class `{class}`; expected encrypted_secret, \\\n                     path_only_reference, public_value, external_auth_store, \\\n                     legacy_env_path, or requires_follow_up\"\n                ),\n            ));\n        }\n    };\n\n    Ok(quote! {\n        Some(crate::config::CredentialSurfaceClass::#variant)\n    })\n}\n\n/// Shared `set_prop` delegation gate for nested sites whose dotted namespace\n/// is (or may be) shared with sibling candidates: serde-flatten fields,\n/// `Option<T>` nested fields, and the two-level dotted-key candidate loop.","sourceCodeStart":2649,"sourceCodeEnd":2685,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-macros/src/lib.rs#L2649-L2685","documentation":"The Configurable derive macro accepts a credential_class attribute whose value must be one of a closed vocabulary that maps to credential-handling variants (encrypted_secret, path_only_reference, public_value, external_auth_store, legacy_env_path, requires_follow_up). extract_credential_class emits a syn::Error at the attribute's span for any other string, so the build fails at compile time with the allowed list printed.","triggerScenarios":"Writing #[configurable(credential_class = \"secret\")] (or any non-listed value) on a struct deriving Configurable; the proc macro parses the literal, falls through the match, and returns the compile error.","commonSituations":"Typos in the attribute literal, docs written for a newer zeroclaw-macros with an added class compiled against an older crate, copy-pasting attribute blocks between projects, guessing the value instead of checking the list.","solutions":["Change the value to exactly one of the six listed classes, matching how the field's secret is actually stored.","Pick encrypted_secret for values the runtime encrypts at rest, path_only_reference for fields that only name a file path, public_value for non-secret data, external_auth_store, legacy_env_path, or requires_follow_up accordingly.","If you expected a newer class name, upgrade zeroclaw-macros to the version whose derive supports it.","Check the derive macro's README/tests for the canonical usage example of the class you want."],"exampleFix":"// before\n#[derive(Configurable)]\n#[credential_class = \"secret\"]\npub struct ApiConfig { pub api_key: String }\n\n// after\n#[derive(Configurable)]\n#[credential_class = \"encrypted_secret\"]\npub struct ApiConfig { pub api_key: String }","handlingStrategy":"validation","validationCode":null,"typeGuard":"const VALID_CREDENTIAL_CLASSES: &[&str] = &[\"encrypted_secret\",\"path_only_reference\",\"public_value\",\"external_auth_store\",\"legacy_env_path\",\"requires_follow_up\"];\n\nfn credential_class_valid(v: &str) -> bool {\n    VALID_CREDENTIAL_CLASSES.contains(&v)\n}","tryCatchPattern":null,"preventionTips":["Copy the attribute block from the derive macro's own tests or docs instead of typing the class name.","Keep zeroclaw-macros and the crates using it on the same release line so the vocabulary matches.","Treat any 'unknown credential_class' compile error as a one-line fix: pick from the six listed values."],"tags":["proc-macro","compile-error","credentials","configuration"],"backgroundTag":"derive-macro-invalid-attribute-value","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}