Module secure_file 

Cross-platform file / directory permission tightening for secret-bearing paths (bootstrap seeds, keystores, export bundles).

The implementation is homed in vti_common::secure_file so it can be shared by every consumer (CLIs, services, and the vti-secrets crate’s plaintext backend) without duplication. This module re-exports it for backwards-compatible vta_cli_common::secure_file::* call sites, and adds the CLI-facing helpers the export commands share.

Functions

check_export_path

Fail early when an explicit export path already exists and force is not set.

did_filename_slug

A file-name-safe slug from the last :-separated segment of did.

restrict_dir_to_owner

Restrict path (a directory) so only the owner can traverse / read / write. On Unix: 0700. On Windows: inheritance removed and DACL replaced with full control to the current user only.

restrict_file_to_owner

Restrict path (a file) so only the owner can read / write.

write_secret_export

Write a secret-bearing export (such as a backup envelope) to path, owner read/write only.

write_secret_file

Write bytes to a new file at path that only the owner can read.