Add durable credential registry and secret lifecycle

web/src/domain/ports.ts

@@ -23,8 +23,22 @@ export interface IdentityProvider<Principal> {
   authenticate(bearerToken: string): Promise<Principal>
 }
 
+/**
+ * Resolve handle for one execution grant. Carries only grant identity; resolvers
+ * re-validate durable grant activity on every resolve.
+ */
+export interface ActiveCredentialGrant {
+  readonly grantId: OpaqueId
+}
+
+export function activeCredentialGrantForExecutionGrant(
+  grantId: OpaqueId,
+): ActiveCredentialGrant {
+  return { grantId }
+}
+
 export interface CredentialResolver<Secret> {
-  resolve(credentialId: OpaqueId, versionId: OpaqueId): Promise<Secret>
+  resolve(access: ActiveCredentialGrant): Promise<Secret>
 }
 
 export interface SourceAdapter<Request, ResolvedSource> {