internal/

Asset: autohsm-alarm Purpose: Report a sealed Vault to a webhook so the condition is never silent.

Asset: autohsm-config Purpose: Load and strictly validate autohsm configuration, failing closed on anything ambiguous.

Asset: fingerprint Purpose: SHA-256 fingerprints so secrets can be referenced in logs without disclosure.

Asset: keysource Purpose: Interface and wrapped-blob format for retrieving unseal key shares.

Asset: secure-bytes Purpose: Best-effort zeroization for plaintext key material held in memory.

Asset: vault-seal-client Purpose: Minimal, strictly-TLS-verified client for Vault's seal-status and unseal endpoints.

Asset: autohsm-watcher Purpose: Poll Vault's seal state and submit this node's unwrapped shares when it is sealed.