Struct Meta 

pub struct Meta {
    pub recipients: HashMap<String, String>,
    pub mac: String,
    pub signers: BTreeMap<String, String>,
    pub sig: Option<VaultSignature>,
    pub mac_key: Option<String>,
    pub github_pins: HashMap<String, Vec<String>>,
    pub groups: BTreeMap<String, Vec<String>>,
    pub grants: BTreeMap<String, GrantEntry>,
}

Fields

recipients: HashMap<String, String>

Maps pubkey → display name. The only place names are stored.

mac: String

Integrity MAC over secrets + schema.

signers: BTreeMap<String, String>

Registered Ed25519 verifying keys: recipient pubkey → base64 verifying key. A signer’s key must be listed here for its signature to verify. Populated when a signing-capable identity saves. Empty for vaults only ever written by SSH/hardware identities. Integrity of this map is anchored by the local TOFU pin and signed git history (see crate::signing).

sig: Option<VaultSignature>

Ed25519 signature over the vault’s canonical content. Absent when the last writer had no signing-capable identity; a present signature must verify or load fails as tampering.

mac_key: Option<String>

BLAKE3 keyed MAC key (hex-encoded, 32 bytes). Generated at init, stored encrypted.

github_pins: HashMap<String, Vec<String>>

Pinned GitHub key fingerprints: username → [SHA256:…]. Used for TOFU (Trust On First Use) verification on authorize github:user.

groups: BTreeMap<String, Vec<String>>

Named recipient groups: group name → member pubkeys. Stored here (not in the plaintext header) so org structure — who is in which group — does not leak. Members are a subset of Vault::recipients. Covered by the keyed MAC (blake3v4:) so membership cannot be tampered with undetected.

grants: BTreeMap<String, GrantEntry>

Short-lived agent grants: grant name → metadata. Stored here (encrypted) so an agent’s existence and scope do not leak. Covered by the keyed MAC (blake3v5:) so TTL/scope/issuer are tamper-evident.

Trait Implementations

impl Clone for Meta

fn clone(&self) -> Meta

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Meta

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Meta

fn default() -> Meta

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Meta

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Meta

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.