//! The credentials manager (P2, plan §4.4): items, grants, requests and audit in the host,
//! outside the world. Programs in the world never see secret values.
//!
//! `Cred::open` loads `cred.sqlite` and the host master key. Read methods return public snapshots.
//! `Caller` carries a binary path and the nearest-first conversation ancestry.
//! `types::Subject` binds grants to a conversation subtree or a binary path.
//! `file_request` normalizes item identities and replays keyed requests. Edit requests carry public diffs.
//! `approve` and `deny` trust the route layer's verified approver identity.
//! That identity can be `None` during bootstrap, before any passkey registration.
//! Each decision commits one SQLite transaction. `subscribe` reports committed decisions across threads.
//! Subscribers must read SQLite after a lag or restart. The durable task layer calls `expire_requests`.
//! `inject` transforms one request's URL and headers. The body stays outside this library.
//! An unmatched request forwards unchanged. An unauthorized match names the item and its filed request.
//! `audit_sign` records signature metadata without the signed payload.
pub mod entry;
pub mod webauthn;
pub mod store;
pub mod schema;
pub mod seal;
pub mod items;
pub mod types;
pub mod grants;
pub mod requests;
pub mod edits;
pub mod summary;
pub mod audit;
pub mod inject;
pub mod error;
pub use store::Cred;
pub use error::{Error, Result};
pub use types::Caller;
pub mod script;
pub mod keys;
pub mod sign;
pub mod oauth2;
pub mod quickjs;