Module knowledge_vault 

Zero-knowledge Personal-Cloud knowledge vault (GL #467) — the E2E envelope for /api/sync/knowledge.

Same construction as the hosted index bundles (XChaCha20-Poly1305, HKDF-SHA256 from the stable account API key) but with domain-separated key material (knowledge-vault-v1 HKDF info): a leaked index-bundle key can never open a knowledge vault and vice versa.

The vault is a whole-account snapshot, last-writer-wins — knowledge stores are small (≤ a few thousand entries) and device-generated, so blob-level replacement is the same consistency model the index bundles already use. Contract: docs/contracts/personal-cloud-encryption-v1.md.

Structs

VaultEnvelope

Plaintext payload of a sealed vault.

Constants

VAULT_VERSION

Envelope version inside the ciphertext.

Functions

derive_gotcha_vault_key

The gotcha vault key — same construction, own HKDF domain (gotcha-vault-v1): a leaked knowledge-vault key can never open the gotcha vault and vice versa.

derive_vault_key

Derive the vault key from the account API key. Distinct HKDF info keeps this key domain-separated from index_bundle::derive_key.

open

Decrypt + parse a vault blob back into its entries.

seal

Serialize + encrypt the entries into a vault blob (nonce || ciphertext).