//! The secret broker (spec §15): credentials live encrypted at rest and are
//! only ever used INSIDE the broker process — capability calls go in,
//! results come out, plaintext never crosses the socket. Gated capability
//! invocations independently consume the single-use execution grant against
//! Postgres before any credential is touched (defense in depth: a
//! compromised runtime cannot replay an approved action).

mod client;
mod crypto;
mod protocol;
mod server;
mod store;

pub use client::BrokerClient;
pub use crypto::{FileKey, Sealed};
pub use server::BrokerServer;
pub use store::SecretStore;

#[derive(Debug, thiserror::Error)]
pub enum BrokerError {
    #[error("execution grant refused")]
    GrantRefused,
    #[error("invalid request: {0}")]
    Invalid(String),
    #[error("not found")]
    NotFound,
    #[error("crypto failure: {0}")]
    Crypto(String),
    #[error("io failure: {0}")]
    Io(String),
}