Crate nook_vault 

Structs

DataKey

DecryptedObject

EncryptedObject

Manifest

Node

ObjectHeader

VaultKey

WrappedKey

Enums

NodeType

NookError

ObjectType

Constants

DEFAULT_CHUNK_SIZE

PASSPHRASE_SALT_LEN

Length in bytes of the random salt used for derive_passphrase_key.

PROTOCOL_VERSION

Functions

body_sha256

SHA-256 digest of a full, in-memory body. For streamed request bodies (server-side, where holding the whole body in memory to re-hash it would defeat the point of streaming), compute the digest incrementally instead and pass its bytes to sign_with_body_hash/verify_with_body_hash.

decrypt_chunk

decrypt_object

derive_head_object_id

derive_passphrase_key

Derives a 32-byte wrapping key from a user passphrase via Argon2id, for encrypting the Vault Master Key at rest when no OS keychain is available. Uses a conservative interactive profile (19 MiB memory, 2 iterations, 1 lane), per OWASP password-hashing guidance.

deserialize_encrypted_object

encrypt_chunk

encrypt_object

encrypted_size_for_chunks

generate_data_key

generate_vault_key

is_valid_hex_id

Shared shape for vault_id/namespace_id/object_id: opaque, random, 256-bit values, hex-encoded (64 lowercase hex characters). Used to validate all three path segments identically before they ever touch a filesystem path or SQL query.

namespace_objects_path

The namespace-scoped object listing path (SPEC-005), used both to build request URLs and as the PATH component of the signed canonical string.

object_path

The vault/namespace/object-addressed path used both to build request URLs and as the PATH component of the signed canonical string.

serialize_encrypted_object

sign_request

Computes the hex-encoded HMAC-SHA256 signature for a request, given the full body available in memory (the common case for the client, which already reads whole files into memory before encrypting them).

sign_with_body_hash

Same as sign_request, but takes an already-computed body digest — for signing/verifying a streamed body without buffering it.

unwrap_data_key

verify_request

Verifies a hex-encoded signature against the expected credential, using the constant-time comparison built into Mac::verify_slice.

verify_with_body_hash

Same as verify_request, but takes an already-computed body digest — for verifying a streamed body without buffering it.

wrap_data_key

Type Aliases

Result