"""mgf-secrets — the Foundation credential plane (Phase 2: + encrypted store).

The public surface: the registry model + loader (declared truth, fails closed), the
read-only doctor (declared == deployed == consumed), per-kind probes, the CLI, and —
new in Phase 2 — the age-encrypted store with the ``resolve(id)`` in-process value
API. No secret value ever enters this package's *outputs* (AG-18): entries are
metadata; ``resolve`` returns a value in-process for sibling tools and MUST NEVER be
logged (see its docstring).
"""

from __future__ import annotations

from .acknowledgements import Acknowledgement, Acknowledgements, load_acknowledgements
from .doctor import Doctor, DoctorReport, Finding
from .errors import CredentialError, SecretsError, UsageError
from .model import (
    EVENTS,
    FAMILIES,
    KINDS,
    STATES,
    SURFACE_TYPES,
    Entry,
    Policy,
    Surface,
)
from .probes import PROBES, ProbeResult, run_probe
from .registry import Registry, RegistryError, load
from .store import resolve

__version__ = "0.4.1"

__all__ = [
    "EVENTS",
    "FAMILIES",
    "KINDS",
    "PROBES",
    "STATES",
    "SURFACE_TYPES",
    "Acknowledgement",
    "Acknowledgements",
    "CredentialError",
    "Doctor",
    "DoctorReport",
    "Entry",
    "Finding",
    "Policy",
    "ProbeResult",
    "Registry",
    "RegistryError",
    "SecretsError",
    "Surface",
    "UsageError",
    "__version__",
    "load",
    "load_acknowledgements",
    "resolve",
    "run_probe",
]
