Module keys 

Cypher key material a host process was started with — the file one environment variable names, or the document another one holds inline.

The document is the cypher sub-object of the open() options document, parsed by crate::options::parse_cypher and nothing else, so a key file reads exactly the same here, in hayson-browser and in a open({ cypher }) call from JS.

Validation happens at load, not at the first sealed record: a key file that does not parse, or material that is not 32 bytes, is a startup failure with a message naming the variable it came from. The alternative — a process running with silently no keys — turns one bad path into a read that refuses hours later, somewhere else entirely.

Structs

CypherKeyVars

The pair of environment variables one host reads its keys from — <FILE> naming a JSON file, <INLINE> holding the same document as text. By convention HAYSON_<APP>_CYPHER_KEY_FILE and HAYSON_<APP>_CYPHER_KEYS.

CypherKeyring

Key material a process holds, and where it came from. The ids are readable back; the material is not — a host printing what it loaded prints CypherKeyring::key_ids and never more.

KeyringError

Functions

ambient

The keys vars names, or None when neither variable is set to anything. The file wins over the inline document, so a host can override a baked-in environment by pointing at a file.

from_file

The keys the JSON file at path holds. named_by is the flag or variable that pointed here, so a refusal says how the process was asked for this file rather than only which file it was.

from_json_text

Reads a cypher document out of JSON text, naming source in every refusal.