Add durable credential registry and secret lifecycle

crates/remora-credentials/src/lib.rs

@@ -0,0 +1,29 @@
+//! Source credential registry and grant-bound secret resolution.
+//!
+//! Durable metadata and authorization state live in PostgreSQL. Secret material
+//! is stored in Vault KV v2 behind server-allocated paths and immutable versions.
+//! Submission pins the current authorized version into an execution grant; the
+//! trusted resolver accepts only an ActiveCredentialGrant capability formed
+//! after durable grant activity is verified.
+
+mod authz;
+mod error;
+mod ids;
+mod migrate;
+mod registry;
+mod resolve;
+mod types;
+mod vault;
+
+pub use authz::{CredentialCaller, may_manage, require_manage};
+pub use error::CredentialError;
+pub use migrate::{migrate, migrator};
+pub use registry::CredentialRegistry;
+pub use resolve::GrantBoundResolver;
+pub use types::{
+    CreateCredential, CredentialGrantVersion, SecretMaterial, SourceCredential,
+    SourceCredentialKind, SourceCredentialPage, SourceCredentialStatus, SourceCredentialVersion,
+};
+pub use vault::{LiveVaultVersion, VaultClient, VaultConfig, split_vault_path};
+
+pub use remora_domain::ports::ActiveCredentialGrant;