feat: add secret store foundation

crates/crank-core/src/ids.rs

@@ -47,3 +47,4 @@ define_id!(AgentId);
 define_id!(InvitationId);
 define_id!(PlatformApiKeyId);
 define_id!(InvocationLogId);
+define_id!(SecretId);

crates/crank-core/src/lib.rs

@@ -5,6 +5,7 @@ pub mod ids;
 pub mod observability;
 pub mod operation;
 pub mod protocol;
+pub mod secret;
 pub mod workspace;
 
 pub use access::{
@@ -18,7 +19,7 @@ pub use auth::{
 };
 pub use ids::{
     AgentId, AuthProfileId, DescriptorId, InvitationId, InvocationLogId, OperationId,
-    PlatformApiKeyId, SampleId, ToolId, UserId, UserSessionId, WorkspaceId,
+    PlatformApiKeyId, SampleId, SecretId, ToolId, UserId, UserSessionId, WorkspaceId,
 };
 pub use observability::{
     InvocationLevel, InvocationLog, InvocationSource, InvocationStatus, UsagePeriod, UsageRollup,
@@ -29,4 +30,5 @@ pub use operation::{
     RetryPolicy, Samples, Target, ToolDescription, ToolExample,
 };
 pub use protocol::{AuthKind, ExportMode, GraphqlOperationType, HttpMethod, Protocol};
+pub use secret::{Secret, SecretKind, SecretStatus, SecretVersion};
 pub use workspace::{Workspace, WorkspaceStatus};

crates/crank-core/src/secret.rs

@@ -0,0 +1,42 @@
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{SecretId, UserId, WorkspaceId};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SecretKind {
+    Token,
+    UsernamePassword,
+    Header,
+    Generic,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SecretStatus {
+    Active,
+    Disabled,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Secret {
+    pub id: SecretId,
+    pub workspace_id: WorkspaceId,
+    pub name: String,
+    pub kind: SecretKind,
+    pub status: SecretStatus,
+    pub current_version: u32,
+    pub created_at: String,
+    pub updated_at: String,
+    pub last_used_at: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct SecretVersion {
+    pub secret_id: SecretId,
+    pub version: u32,
+    pub ciphertext: String,
+    pub key_version: String,
+    pub created_at: String,
+    pub created_by: Option<UserId>,
+}