feat: add secret store foundation

crates/crank-registry/src/model.rs

@@ -1,8 +1,8 @@
 use crank_core::{
     Agent, AgentId, AgentOperationBinding, AgentStatus, AgentVersion, AuthProfile, DescriptorId,
     ExportMode, InvitationToken, InvocationLevel, InvocationLog, InvocationSource, MembershipRole,
-    Operation, OperationId, OperationStatus, PlatformApiKey, Protocol, SampleId, UsagePeriod,
-    UsageRollup, User, UserSessionId, Workspace, WorkspaceId,
+    Operation, OperationId, OperationStatus, PlatformApiKey, Protocol, SampleId, Secret, SecretId,
+    SecretVersion, UsagePeriod, UsageRollup, User, UserSessionId, Workspace, WorkspaceId,
 };
 use crank_mapping::MappingSet;
 use crank_schema::Schema;
@@ -85,6 +85,16 @@ pub struct PlatformApiKeyRecord {
     pub api_key: PlatformApiKey,
 }
 
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SecretRecord {
+    pub secret: Secret,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct SecretVersionRecord {
+    pub secret_version: SecretVersion,
+}
+
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct InvocationLogRecord {
     pub log: InvocationLog,
@@ -403,6 +413,25 @@ pub struct CreatePlatformApiKeyRequest<'a> {
     pub secret_hash: &'a str,
 }
 
+#[derive(Clone, Debug, PartialEq)]
+pub struct CreateSecretRequest<'a> {
+    pub secret: &'a Secret,
+    pub ciphertext: &'a str,
+    pub key_version: &'a str,
+    pub created_by: Option<&'a crank_core::UserId>,
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub struct RotateSecretRequest<'a> {
+    pub workspace_id: &'a WorkspaceId,
+    pub secret_id: &'a SecretId,
+    pub ciphertext: &'a str,
+    pub key_version: &'a str,
+    pub created_at: &'a str,
+    pub updated_at: &'a str,
+    pub created_by: Option<&'a crank_core::UserId>,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct SaveSampleMetadataRequest<'a> {
     pub sample: &'a OperationSampleMetadata,