secrets

type LocalStore struct {
	// contains filtered or unexported fields
}

type Store interface {
	// Put encrypts plaintext and returns a value the caller persists
	// alongside the owning resource row. The returned value is opaque to
	// callers — its format depends on the implementation.
	Put(ctx context.Context, ref, plaintext string) (string, error)

	// Get returns the plaintext for a value returned by Put.
	Get(ctx context.Context, ref, stored string) (string, error)

	// Rewrap returns stored in the ref-bound envelope under the current key.
	// Callers persist the result only during an explicit stop-all migration.
	Rewrap(ctx context.Context, ref, stored string) (rewrapped string, changed bool, err error)

	// Seal encrypts plaintext bound to aad and returns an opaque sealed
	// value. Open returns the plaintext only when given the identical aad —
	// the binding lets the agent persist the sealed value in its own storage
	// while a caller under a different aad cannot decrypt it. (For LocalStore
	// the aad is the GCM additional-authenticated-data; a future KMS store
	// maps it to the encryption context.)
	Seal(ctx context.Context, aad, plaintext string) (string, error)

	// Open reverses Seal. Returns an error if aad doesn't match the value
	// sealed under.
	Open(ctx context.Context, aad, sealed string) (string, error)
}