Module secret 

Secret storage backends for shine env secret encrypt/decrypt.

Two external backends exist: GPG (the original, still the default) and age, added for multi-recipient encryption with Apple Touch ID support via age-plugin-se Secure Enclave identities. Ciphertext carries a backend tag (age:<base64>); untagged base64 continues to route to GPG so secrets encrypted before age existed keep decrypting unmodified. The versioned hybrid: envelope wraps one data key with both tools (ADR 0084).

Encryption always needs a resolved recipient list (EncryptRecipients); decryption is purely tag-based and never consults secret_backend, so changing the default encrypt backend can never break existing secrets.

Enums

BackendKind

Which external tool a piece of ciphertext (or an encrypt request) belongs to.

EncryptRecipients

A resolved recipient list for encryption, tagged by backend.

Functions

decrypt_secret

Decrypt stored ciphertext, routing purely on its tag. age_identities is consulted for age ciphertext and the age branch of a hybrid envelope.

decrypt_with_config

encrypt_secret

Encrypt plaintext for the given recipients, returning storage-ready ciphertext (tagged for age, untagged for GPG).

parse_tagged_ciphertext

Split stored ciphertext into its backend and undecorated payload. Untagged ciphertext is treated as GPG for backward compatibility with secrets encrypted before the age backend existed.