OptionalrevisionPositive integer revision of the secret (default 1).
Revision 1 — the initial secret — is byte-identical to the
pre-revision derivation. Revision N ≥ 2 derives a secret that is
cryptographically independent of revision 1 for the same context:
the sanctioned rotation path when a credential leaks, without
changing the context string.
Canonical by construction: NFKC normalization applies to the string
context only. Integers have no Unicode representation, so no
normalization is needed or performed on revision.
OptionalbyteLength of the derived raw bytes in [1, 8160] (default 16 —
≈ 22 base64url chars). Upper bound is the RFC 5869 HKDF-SHA256
limit (255 × 32); note the output is prefix-stable, so the first
n bytes of a longer derivation equal the n-byte derivation.
Options for Handle.derivePassword.
All fields are optional; the defaults reproduce the frozen v1.0 derivation exactly (specs/v1.0.md §3).