//! Source credential registry and grant-bound secret resolution.
//!
//! Durable metadata and authorization state live in PostgreSQL. Secret material
//! is stored in Vault KV v2 behind server-allocated paths and immutable versions.
//! Submission pins the current authorized version into an execution grant; the
//! trusted resolver accepts only an ActiveCredentialGrant capability formed
//! after durable grant activity is verified.

mod authz;
mod error;
mod ids;
mod migrate;
mod registry;
mod resolve;
mod types;
mod vault;

pub use authz::{CredentialCaller, may_manage, require_manage};
pub use error::CredentialError;
pub use migrate::{migrate, migrator};
pub use registry::{
    CredentialRegistry, PreparedCredentialCreate, PreparedCredentialRotate, RotateTxOutcome,
};
pub use resolve::GrantBoundResolver;
pub use types::{
    CreateCredential, CredentialGrantVersion, SecretMaterial, SourceCredential,
    SourceCredentialKind, SourceCredentialPage, SourceCredentialStatus, SourceCredentialVersion,
};
pub use vault::{LiveVaultVersion, VaultClient, VaultConfig, split_vault_path};

pub use remora_domain::ports::ActiveCredentialGrant;