Function open_bundle 

pub fn open_bundle(
    parsed: &ParsedBundle,
    methods: &MethodRegistry<'_>,
) -> Result<CredBundle, SealError>

Open a bundle and return its CredBundle.

Walks the slot table, tries each slot whose method is enabled + available, recovers the master KEK on first success, decrypts the payload, then zeroizes the KEK.

methods maps a MethodKind to a configured UnlockMethod able to recover that slot (e.g. a Bip39Method holding the operator’s phrase). A None entry (or absent kind) means that method is not available this boot.

Errors

SealError::NoSlotOpened if nothing opens (fail closed); SealError::AuthFailed if the payload AEAD fails after a slot recovered a KEK.