Add resource secret epoch metadata

crates/geth-control/Cargo.toml

@@ -15,5 +15,6 @@ geth-document = { path = "../geth-document" }
 geth-keychain = { path = "../geth-keychain" }
 geth-kv = { path = "../geth-kv" }
 geth-resource = { path = "../geth-resource" }
+geth-secrets = { path = "../geth-secrets" }
 geth-ssh-identity = { path = "../geth-ssh-identity" }
 geth-types = { path = "../geth-types" }

crates/geth-control/src/lib.rs

@@ -4,6 +4,7 @@ use geth_document::DocumentResource;
 use geth_keychain::KeychainOp;
 use geth_kv::{KvEntry, KvResource};
 use geth_resource::ResourceDescriptor;
+use geth_secrets::ResourceMasterSecret;
 use geth_ssh_identity::{
     SshCertApproval, SshCertRequest, SshCertificateRecord, SshRevocationEntry,
 };
@@ -48,6 +49,13 @@ pub enum ControlRequest {
         admin_key_path: Option<PathBuf>,
     },
     KeychainStatus,
+    SecretStatus,
+    SecretCreate {
+        resource: String,
+    },
+    SecretRotate {
+        resource: String,
+    },
     AuthExplain {
         subject: String,
         resource: String,
@@ -167,6 +175,12 @@ pub enum ControlResponse {
     KeychainInitialized {
         ops: Vec<KeychainOp>,
     },
+    SecretStatus {
+        secrets: Vec<ResourceMasterSecret>,
+    },
+    SecretCreated {
+        secret: ResourceMasterSecret,
+    },
     AuthExplain(AuthExplanation),
     AuthOpRecorded {
         op: AuthOp,