lys_core/
lib.rs

1//! `lys-core` — domain-agnostic cryptographic trust primitives.
2//!
3//! A focused library of trust primitives: certificate-authority operations,
4//! Merkle transparency-log operations, signed attestations, sealed payload
5//! transport, and Ed25519 key management. Consumers (an agent runtime, a
6//! workflow engine, an anchoring service) compose domain meaning on top — this
7//! crate knows nothing about agents, sessions, workspaces, or any higher-level
8//! concept.
9//!
10//! # Status
11//!
12//! This crate is being extracted, unchanged in behaviour, from the hardened
13//! `meridian-trust` crate. See `docs/ROADMAP.md` in the repository root for the
14//! extraction plan and the module inventory that will land here:
15//!
16//! - `keys` — [`Ed25519Identity`]: file/env-backed keypair with strict
17//!   verification, Debug redaction, and Ed25519→X25519 derivation.
18//! - `ca` — certificate authority: Ed25519-rooted X.509 issuance, custom
19//!   extensions, and validity-window-enforcing chain verification.
20//! - `merkle` — `AppendOnlyTree`: RFC 6962 transparency log with inclusion and
21//!   consistency proofs verifiable by external parties from published roots.
22//! - `attestation` — domain-separated, timestamp-authenticated signed
23//!   statements over arbitrary payloads.
24//! - `seal` — X25519 + AES-256-GCM sealed envelopes, standalone and
25//!   sender-authenticated.
26//!
27//! [`Ed25519Identity`]: https://docs.rs/lys-core
28
29#![forbid(unsafe_code)]
lys_core/lib.rs

lys_core/
lib.rs
