Type Alias: TokenKind

TokenKind = "software" | "hardware"

Defined in: packages/key-custodian/src/policy.ts:40

Whether a token keeps its keys in software or in hardware, as far as classifyToken can tell. Decided from what the token reports about itself, never from configuration, so a deployment cannot declare its SoftHSM to be hardware. But hardware only means "not a software token we recognise": it is a denylist verdict, which is why production also requires assertTokenExpected.