Enum UnlockSecret 

pub enum UnlockSecret<'a> {
    Password(&'a str),
    RawPrivateKey(SecretBox<Vec<u8>>),
}

Caller’s choice for how to unlock the encrypted private key.

Borrowing here lets the caller keep ownership of the password string / raw-key buffer. The lifetime of the underlying secret is the caller’s concern; CoreAgent::from_encrypted_material only reads from it during construction.

Variants

Password(&'a str)

Run the password through the envelope decryptor. The password itself is borrowed — it is never copied into the resulting CoreAgent, only the decrypted private key bytes are (and those are wrapped + zeroized).

RawPrivateKey(SecretBox<Vec<u8>>)

Skip decryption. The provided bytes are interpreted directly as the algorithm-specific raw private key (Ed25519 PKCS#8 or raw 32-byte scalar; pq2025 ML-DSA-87 4896-byte private key). Used by CoreAgent::ephemeral and by callers who already hold the decrypted bytes (for example after running a custom key store).