crypt_guard/api/
mod.rs

1//! Safe public API over the Phase 3 CGv2 envelope protocol.
2//!
3//! This module exposes the small safe surface from the redesign plan:
4//! typed `Encryptor` / `Decryptor` entry points with staged builders and no
5//! manual nonce handling in the default flow.
6//!
7//! It additionally exposes the HPKE-style (RFC 9180) single-shot [`seal`] /
8//! [`open`] functions (see [`hpke`]), which mirror `SealBase` / `OpenBase` over
9//! the same envelope path while binding caller-supplied `info` and `aad`.
10
11pub mod hpke;
12mod open;
13mod seal;
14
15use crate::markers::{AesGcmSiv, XChaCha20Poly1305};
16
17pub use open::{Decryptor, DecryptorBuilder, MissingSecretKey, WithSecretKey};
18pub use seal::{
19    Encryptor, EncryptorBuilder, MissingPlaintext, MissingRecipient, WithPlaintext, WithRecipient,
20};
21
22// HPKE-style single-shot entry points. `src/lib.rs` is owned by another agent;
23// once it adds `pub use api::{seal as hpke_seal, open as hpke_open};` these
24// become crate-root accessible. Until then they are reachable as
25// `crypt_guard::api::{seal, open}` and `crypt_guard::api::hpke::{seal, open}`.
26pub use hpke::{open, seal};
27
28mod private {
29    pub trait Sealed {}
30}
31
32/// Marker trait for algorithms allowed in the safe default API.
33///
34/// Only authenticated AEAD markers are supported here. Non-AEAD and legacy cipher
35/// markers remain available through the lower-level APIs.
36pub trait AuthenticatedAead: private::Sealed {}
37
38impl private::Sealed for XChaCha20Poly1305 {}
39impl AuthenticatedAead for XChaCha20Poly1305 {}
40
41impl private::Sealed for AesGcmSiv {}
42impl AuthenticatedAead for AesGcmSiv {}
crypt_guard/api/mod.rs

crypt_guard/api/
mod.rs
