1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
//! Delegate secrets-at-rest storage.
//!
//! Split into focused submodules; this file is the module root and re-exports
//! the complete public API so every external `use super::secrets_store::…`
//! path continues to resolve unchanged.
//!
//! # Submodule layout
//!
//! - `user`: [`UserId`], [`SecretScope`], [`UserSecretContext`], token
//! derivation helpers (`user_id`, `user_dek_secret`),
//! `DEFAULT_LAST_SEEN_DEBOUNCE_SECS`
//! - `quota`: per-user byte quota tracking (`QuotaTracker`,
//! `USER_QUOTA_TRACKER`, `apply_signed_delta`, `QuotaCommit`),
//! quota consts, `#[cfg(test)]` quota test helpers
//! - `sweep`: filesystem permission helpers (`create_owner_only`,
//! `ensure_owner_only_dir`), inactive-user TTL reclaim
//! (`stamp_user_last_seen`, `reclaim_inactive_users`,
//! `should_spawn_inactive_user_sweep`, `spawn_inactive_user_sweep`,
//! `SweepOutcome`)
//! - `store`: [`SecretStoreError`], [`SecretsStore`] struct + impl,
//! [`ExportSecretEntry`], [`ExportScopeError`],
//! `decrypt_secret_blob`, `log_legacy_decrypt`, and the
//! `#[cfg(test)]` test module
// ── Public re-exports ─────────────────────────────────────────────────────────
// Keep every path that existed before the split resolving identically.
// Intentional public re-exports of the full API surface. Some items are only
// used from external callers or tests; the allow suppresses spurious
// unused-import warnings that the compiler emits for re-exported items with no
// direct use site in this compilation unit.
pub use ;
pub use ;
pub use ;
pub use ;
// ── pub(super) re-exports ─────────────────────────────────────────────────────
// `secret_snapshots` and other wasm_runtime siblings import these.
pub use ;