Enum KeyCustody 

pub enum KeyCustody {
    Keyring,
    Passphrase(Passphrase),
    InMemory(MasterKeyring),
    Custom(Arc<dyn MasterKeyCustody>),
}

How a store’s master key is protected. The builder accepts this and never sees a cipher again — coven resolves the selection into a MasterKeyCustody and builds every cipher from what it supplies.

Variants

Keyring

The OS keyring — the default, byte-for-byte today’s behavior.

Passphrase(Passphrase)

Argon2id over a memorized passphrase wraps the keyring; the wrapped blob lives in a file in the store directory.

InMemory(MasterKeyring)

Supplied for this session, never persisted by coven.

Custom(Arc<dyn MasterKeyCustody>)

A host-supplied custody implementation.

Implementations

impl KeyCustody

pub fn resolve( self, store_id: &str, store_dir: &StoreDir, ) -> Arc<dyn MasterKeyCustody>

Resolve the selected policy into the trait object coven drives the sync engine through, injecting what each preset needs from the store’s identity: store_id for KeyCustody::Keyring (the keyring account name), store_dir for KeyCustody::Passphrase (the wrapped-file path).