# `WardrikVault.Sealed`

A credential as the vault writes it. Only a key can unseal it.

# `t`

```elixir
@type t() :: %WardrikVault.Sealed{
  ciphertext: binary(),
  kind: :secret | :grant,
  nonce: binary(),
  tag: binary(),
  version: pos_integer()
}
```

A sealed secret or grant.

# `decode_keys`

```elixir
@spec decode_keys([String.t()]) :: [binary()]
```

Decodes base64 keys. Drops any that don't hold 32 bytes.

# `generate_key`

```elixir
@spec generate_key() :: String.t()
```

Returns a new key, base64-encoded.

# `seal`

```elixir
@spec seal(binary(), String.t(), :secret | :grant, binary()) :: t()
```

Seals `value` with `key`. Binds it to `path` and `kind`, so it can't be moved or relabelled.

# `unseal`

```elixir
@spec unseal(t(), [binary()], String.t()) :: {:ok, binary()} | {:error, term()}
```

Unseals with the first of `keys` that opens it.

Returns `{:error, :undecipherable}` if none does, and `{:error, {:unknown_version, version}}`
for a version this release can't read.

---

*Consult [api-reference.md](api-reference.md) for complete listing*