Module credentials 

Multi-tenant provider credential subsystem.

Provides encryption-at-rest (encryption) for per-user provider API keys. Storage (store), scoped resolution (resolver), and the wiring ProviderService are layered on top in subsequent steps.

Single-tenant deployments do not need any of this: when no ProviderService is configured, credential resolution is skipped and the existing env/config key is used unchanged.

Re-exports

pub use encryption::CredentialEncryption;

pub use resolver::CredentialResolver;

pub use resolver::ResolvedCredential;

pub use store::SurrealCredentialStore;

pub use store::CredentialMetadata;

pub use store::CredentialRecord;

pub use store::CredentialScope;

pub use store::CredentialStore;

pub use store::InMemoryCredentialStore;

pub use store::SharedCredentialStore;

Modules

encryption

AES-256-GCM encryption for provider API keys stored at rest.

resolver

Scoped credential resolution.

store

Storage for per-scope encrypted provider credentials.

Structs

ProviderService

Wiring object that owns the credential store + encryption and hands out a CredentialResolver. Attached to AppState/RunManager as Option<Arc<ProviderService>>; None ⇒ single-tenant (env/config only).