runtime: Move unseal out of runtime into its own crate

We need `runtime` to depend on `dekaf`, and they both need `unseal`, so it needed to be moved somewhere, and there didn't seem to be anywhere good to put it other than its own crate.

crates/dekaf/Cargo.toml

@@ -21,6 +21,7 @@ models = { path = "../models" }
 ops = { path = "../ops" }
 proto-flow = { path = "../proto-flow" }
 proto-gazette = { path = "../proto-gazette" }
+unseal = { path = "../unseal" }
 simd-doc = { path = "../simd-doc" }
 
 aes-siv = { workspace = true }

crates/runtime/Cargo.toml

@@ -35,6 +35,7 @@ proto-grpc = { path = "../proto-grpc", features = [
 ] }
 simd-doc = { path = "../simd-doc" }
 tuple = { path = "../tuple" }
+unseal = { path = "../unseal" }
 
 anyhow = { workspace = true }
 bytes = { workspace = true }

crates/runtime/src/capture/connector.rs

@@ -1,10 +1,11 @@
-use crate::{unseal, verify, LogHandler, Runtime};
+use crate::{verify, LogHandler, Runtime};
 use anyhow::Context;
 use futures::{channel::mpsc, stream::BoxStream, FutureExt, StreamExt};
 use proto_flow::{
     capture::{Request, Response},
     flow::capture_spec::ConnectorType,
 };
+use unseal;
 
 // Start a capture connector as indicated by the `initial` Request.
 // Returns a pair of Streams for sending Requests and receiving Responses.

crates/runtime/src/derive/connector.rs

@@ -1,10 +1,11 @@
-use crate::{unseal, LogHandler, Runtime};
+use crate::{LogHandler, Runtime};
 use anyhow::Context;
 use futures::{channel::mpsc, stream::BoxStream, FutureExt, StreamExt};
 use proto_flow::{
     derive::{Request, Response},
     flow::collection_spec::derivation::ConnectorType,
 };
+use unseal;
 
 // Start a derivation connector as indicated by the `initial` Request.
 // Returns a pair of Streams for sending Requests and receiving Responses.

crates/runtime/src/lib.rs

@@ -14,7 +14,6 @@ mod rocksdb;
 mod task_service;
 mod tokio_context;
 mod unary;
-mod unseal;
 pub mod uuid;
 
 pub use container::flow_runtime_protocol;

crates/runtime/src/materialize/connector.rs

@@ -1,10 +1,11 @@
-use crate::{unseal, LogHandler, Runtime};
+use crate::{LogHandler, Runtime};
 use anyhow::{bail, Context};
 use futures::{channel::mpsc, stream::BoxStream, FutureExt, StreamExt};
 use proto_flow::{
     flow::materialization_spec::ConnectorType,
     materialize::{Request, Response},
 };
+use unseal;
 
 // Start a materialization connector as indicated by the `initial` Request.
 // Returns a pair of Streams for sending Requests and receiving Responses.

crates/unseal/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "unseal"
+version.workspace = true
+rust-version.workspace = true
+edition.workspace = true
+authors.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+async-process = { path = "../async-process" }
+models = { path = "../models" }
+locate-bin = { path = "../locate-bin" }
+
+anyhow = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+zeroize = { workspace = true }
+futures = { workspace = true }
+tokio = { workspace = true }
+insta = { workspace = true }