Enum EnvelopeSpec 

pub enum EnvelopeSpec {
    None,
    Local {
        kek_file: PathBuf,
    },
    Vault {
        addr: String,
        key: String,
        token: String,
    },
}

A resolved secrets-at-rest envelope choice (the caller maps its config to this, resolving any Vault token from the environment — never from a file).

Variants

None

No wrapping — secrets stored cleartext (single-node dev / opt-out).

Local

Machine-local AES-256-GCM KEK at kek_file.

Fields

kek_file: PathBuf

Vault

Vault Transit key at addr, authenticated by token.

Fields

addr: String

key: String

token: String