# API
`kcode-credential-vault` owns one versioned encrypted file containing sorted
named credentials. The public surface is:
```rust
pub struct CredentialVault;
impl CredentialVault {
pub fn empty() -> Self;
pub fn unlock(path: &Path, passphrase: SecretString) -> Result<Self>;
pub fn save(&self, path: &Path, passphrase: &SecretString) -> Result<()>;
pub fn set(&mut self, name: &str, value: String) -> Result<()>;
pub fn remove(&mut self, name: &str) -> Result<bool>;
pub fn secret(&self, name: &str) -> Result<Option<SecretString>>;
pub fn names(&self) -> impl Iterator<Item = &str>;
}
```
The crate re-exports `SecretString` and `ExposeSecret` from the `age` secrecy
boundary. `Error::kind()` classifies invalid input, decryption failure, invalid
payloads, unsupported versions, and storage failures without exposing
credential values. `Debug` for the vault reports only a redacted credential
count.
Names contain 1-128 ASCII letters, numbers, dots, dashes, or underscores.
Values are nonempty. Names are returned in lexical order. Replacing, removing,
or dropping values zeroizes their owned plaintext storage.
`save` encrypts a complete snapshot with an age scrypt recipient, writes a
private same-directory temporary file, synchronizes it, atomically renames it,
and synchronizes the containing directory on Unix. A successful save is
durable. Symlink and non-file destinations are rejected.
The caller owns the vault path, human passphrase prompting, application secret
names, feature policy, process exclusion, and backup policy. This crate never
logs, prints, transports, or discovers credentials and performs no network
operations.