Module unlock 

Startup unlock: build the method registry from flags, check bundle perms, open the sealed bundle, and exchange AppRole creds for a short-lived token.

Every step is fallible-by-Result and fails closed (clean non-zero exit, no panic, §1.3 / §5 of designs/unlock-and-bundle.html).

Structs

UnlockArgs

Unlock-method selection flags.

Functions

approle_login

Exchange an AppRole role_id + secret_id for a short-lived token at the bao AppRole login endpoint (§5 step 6). Returns the client token.

open_bundle_at_startup

Read + check perms of the bundle file, then unlock it into a CredBundle.