OptionaldescriptionA description of the envelope, for error messages and UI.
Unique identifier for this envelope (e.g. 'offcrypto').
Whether these bytes are wrapped in this envelope. Must be cheap (a magic-number/header
check) and precise — a container shared with unencrypted files (e.g. CFB, which is also
legacy .xls) has to inspect enough to be sure.
Wraps plaintext bytes in the envelope.
A registration-side encryption envelope: a container that wraps a workbook's encoded bytes in an encrypted form, independent of what format those bytes are in.
Remarks
Encryption sits above the format handlers, not inside them: an envelope carries opaque bytes, so one implementation serves every registered format (and every format registered later) rather than each plugin growing its own crypto. IWorkbookIO.read detects an envelope on the acquired bytes and unwraps them before the format handler ever sees them; IWorkbookIO.write wraps the handler's output on the way out.
Registered like a format (Registry.registerEncryption) so the code ships with the plugin that implements it — a host that installs no such plugin simply reports encrypted files as unsupported instead of failing to parse them.