//! el-secrets — Secrets management for el-ui applications.
//!
//! Secrets are NEVER in code. They are:
//! - `EnvVarSource` — environment variables (`EL_SECRET_JWT_KEY=...`)
//! - `VaultSource` — HashiCorp Vault (stub, ready for HTTP client integration)
//! - `AwsSecretsSource` — AWS Secrets Manager (stub)
//! - `InMemorySource` — for testing only
//!
//! All secrets are wrapped in `Secret<T>` which:
//! - Displays as `[REDACTED]` in all logs and debug output
//! - Serializes as `"[REDACTED]"` in JSON — never the actual value
//! - Requires explicit `.expose()` to read
//!
//! ## Quick start
//!
//! ```
//! use el_secrets::prelude::*;
//!
//! // Load secrets at startup — fails early if anything is missing
//! let mut src = InMemorySource::new();
//! src.insert("jwt.key", "test-key-for-testing-only");
//!
//! let secrets = SecretsResolver::new()
//!     .source(Box::new(src))
//!     .require("jwt.key")
//!     .resolve()
//!     .expect("required secrets must be present at startup");
//!
//! let jwt_key = secrets.require("jwt.key");
//! // jwt_key displays as [REDACTED]
//! // jwt_key.expose() gives the actual value
//! assert_eq!(jwt_key.expose(), "test-key-for-testing-only");
//! ```

#![deny(warnings)]

pub mod error;
pub mod resolver;
pub mod secret;
pub mod source;

pub mod prelude {
    pub use crate::error::SecretsError;
    pub use crate::resolver::{ResolvedSecrets, SecretsResolver};
    pub use crate::secret::{Secret, SecretGuard};
    pub use crate::source::{
        AwsSecretsSource, EnvVarSource, InMemorySource, SecretsSource, VaultSource,
    };
}

pub use prelude::*;