reVault for Rust

reVault is an encrypted Lockbox archive and persistent Vault for files, credentials, keys, and typed records. This source-native crate re-exports the reviewed Lockbox, Vault, and AgentSession facade over the native core; it does not use the C ABI and never discovers a shared library through an environment variable. See the reVault manual.

[dependencies]
revault-api = "0.3.12"

The complete method-example index and source-native conformance example are maintained in the source repository.

use revault_api::{Lockbox, Revault, Vault};
use revault_api::lockbox::{LockboxPath, SecretString, VariableName};

let _runtime = Revault::load();
let key = [0_u8; 32]; // load a real content key securely
let mut box_ = Lockbox::create(&key)?;
box_.add_file(&LockboxPath::new("/hello.txt")?, b"hello\n", false)?;
box_.set_variable(&VariableName::new("owner")?, "alice")?;
let token = SecretString::try_from_slice(b"secret")?;
box_.set_secret_variable(&VariableName::new("token")?, &token)?;
box_.commit()?;
# Ok::<(), Box<dyn std::error::Error>>(())

Vault is the persistent encrypted store; a directory is only its storage detail. ProfileSigningKeyPair and ProfileSigningPublicKey name profile identity keys. A key has the owner role only after it is assigned to a Lockbox. The optional session-agent operations remain under revault_api::vault and are explicit; ordinary Lockbox operations do not contact an agent.

Secret types zero their owned storage. Avoid exposing secret values through debug output, ordinary strings, or unnecessarily long-lived byte buffers.