WrapperConfig

@Serializable

Configuration for a single wrapper (recovery method).

Types

@Serializable

@SerialName(value = "all_passkeys")

Use all PRF-capable passkeys from credential registry.

@Serializable

Guardian-Gated Escrow Wrap hierarchy. KEK is escrowed to backend vault with optional authentication gates.

@Serializable

@SerialName(value = "none")

No encryption - DEV/TEST ONLY.

@Serializable

@SerialName(value = "password")

data class Password(val password: String) : WrapperConfig

Password-based wrapper (PBKDF2).

@Serializable

@SerialName(value = "pin")

data class Pin(val pin: String) : WrapperConfig

PIN-based wrapper (PBKDF2).

@Serializable

@SerialName(value = "specific_passkey")

Use a specific passkey by credential ID.