Crate alkvault 

alkvault

Local key vault: BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption for securing provider keys, credentials, and identity material.

This crate is the only component that holds the master seed phrase. The CLI binary unlocks the vault at startup and injects derived/decrypted material into operation contexts. Other crates never access the vault directly — they receive keys through their operation context or via the call protocol.

Crate Independence

alkvault does not depend on alknet-core or any other alknet crate. It is fully independent and usable in contexts where QUIC networking doesn’t exist (CLI tools, test harnesses, WASM key derivation).

Security Model

The seed phrase is never persisted to disk. It is entered at startup or via Unlock and held only in Zeroize-protected RAM (ADR-038). Lock purges the seed and all cached derived keys.

Module Organization

• mnemonic — BIP39 mnemonic generation, validation, and seed derivation
• derivation — SLIP-0010 Ed25519 HD key derivation and path constants
• encryption — AES-256-GCM encrypt/decrypt and EncryptedData type
• protocol — DerivedKey and KeyType (return types from vault methods)
• service — VaultServiceHandle runtime API with Unlock/Lock lifecycle
• [ethereum] — BIP-0032 secp256k1 HD key derivation (behind secp256k1 feature)

Re-exports

pub use cache::CacheConfig;

pub use derivation::DerivationError;

pub use derivation::ExtendedPrivKey;

pub use derivation::PATHS;

pub use encryption::CURRENT_KEY_VERSION;

pub use encryption::EncryptedData;

pub use encryption::EncryptionError;

pub use encryption::EncryptionKey;

pub use mnemonic::Language;

pub use mnemonic::Mnemonic;

pub use mnemonic::Seed;

pub use protocol::DerivedKey;

pub use protocol::KeyType;

pub use service::VaultServiceError;

pub use service::VaultServiceHandle;

Modules

cache

TTL-based key cache with LRU eviction for VaultService.

derivation

SLIP-0010 Ed25519 HD key derivation and path constants.

encryption

AES-256-GCM encryption and decryption for external credentials.

mnemonic

BIP39 mnemonic generation, validation, and seed derivation.

protocol

Vault key types: DerivedKey and KeyType.

service

VaultServiceHandle — the sole runtime API for the vault.