Struct Vault 

pub struct Vault { /* private fields */ }

A handle to an on-disk encrypted vault.

Operations follow an explicit lock/unlock protocol: Vault::unlock derives the master key into zeroizing memory, every content operation requires the unlocked state, and Vault::lock (plus Drop) scrubs it.

Example

use krypton::Vault;
use std::path::Path;

let mut vault = Vault::new("myvault".into());

// First run: create the vault (fails if it already exists).
if !vault.exists() {
    vault.init("correct horse battery staple")?;
}
vault.unlock("correct horse battery staple")?;

// Store a file and a whole directory tree.
vault.add(Path::new("report.pdf"), None)?;          // stored as "report.pdf"
vault.add(Path::new("photos"), Some("pictures"))?;  // tree renamed to "pictures"

for entry in vault.list()? {
    println!("{} — {} bytes, dir: {}", entry.name, entry.size, entry.is_directory);
}

// Restore later; returns where the data was written.
let where_ = vault.extract("report.pdf", Path::new("./out"))?;

// Rotate the password without touching encrypted data.
vault.change_password("correct horse battery staple", "new secret")?;

vault.lock();

Implementations

impl Vault

pub fn new(path: PathBuf) -> Self

Creates an unattached handle for the vault at path.

pub fn exists(&self) -> bool

Whether this path looks like an initialized vault.

pub fn path(&self) -> &Path

The vault’s base directory.

pub fn is_unlocked(&self) -> bool

Whether the master key is currently held in memory.

pub fn init(&mut self, password: &str) -> Result<()>

Initializes a new vault protected by password.

Fails if the vault already exists. Created directories get owner-only permissions on Unix; the config is written atomically.

let mut vault = krypton::Vault::new("secrets".into());
vault.init("correct horse")?;

pub fn unlock(&mut self, password: &str) -> Result<()>

Unlocks the vault with password.

Authentication failure reports Error::Authentication without distinguishing wrong password from tampered config.

pub fn lock(&mut self)

Scrubs the master key from memory.

pub fn add(&mut self, source: &Path, name: Option<&str>) -> Result<()>

Adds a file or directory tree to the vault.

• source - filesystem path to add (symlinks inside trees are skipped).
• name - explicit vault name; defaults to the source basename. Must not contain path separators or ...

Adding a directory stores every child recursively; each child gets its own independently authenticated blob. An entry with the same name must not already exist (remove it first to replace). The manifest is committed last and atomically, so a crash can leave orphaned blobs but never a dangling index.

let mut vault = krypton::Vault::new("secrets".into());
vault.unlock("correct horse")?;

vault.add(std::path::Path::new("notes.txt"), None)?;
vault.add(std::path::Path::new("~/docs"), Some("docs"))?; // whole tree

pub fn remove(&mut self, name: &str) -> Result<()>

Removes an entry (and, for directories, its whole subtree).

Both the ciphertext blobs and their manifest records are deleted.

pub fn list(&self) -> Result<Vec<EntryInfo>>

Lists top-level entries. Children of directories are addressed by their full parent/child path in other operations.

pub fn extract(&self, name: &str, dest: &Path) -> Result<PathBuf>

Extracts an entry.

• Files are written to dest (temp file + rename).
• Directories are recreated under dest with their full subtree.

Returns the output location actually used. Child names recovered from the vault are sanitized before being joined onto dest; any traversal attempt aborts the operation.

let vault = krypton::Vault::new("secrets".into());
let written = vault.extract("docs", std::path::Path::new("./restored"))?;
println!("restored to {}", written.display());

pub fn change_password( &mut self, old_password: &str, new_password: &str, ) -> Result<()>

Changes the vault password after verifying old_password.

Only the wrapped master key is re-encrypted; stored data is untouched. Works regardless of lock state and leaves the lock state unchanged.

let mut vault = krypton::Vault::new("secrets".into());
vault.change_password("old horse", "new horse")?;

pub fn verify(&mut self, password: &str) -> Result<IntegrityReport>

Verifies every entry’s blob by fully decrypting it (authenticating all chunk tags), reporting missing or corrupted items.

Restores the prior lock state when done.

let mut vault = krypton::Vault::new("secrets".into());
let report = vault.verify("correct horse")?;
if report.missing.is_empty() && report.corrupted.is_empty() {
    println!("all {} entries authenticated", report.total_entries);
} else {
    eprintln!("missing: {:?}, corrupted: {:?}", report.missing, report.corrupted);
}

Trait Implementations

impl Debug for Vault

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for Vault

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.