Module vault 

Local vault, keyring, and session-agent API.

Structs

AccessSlotLabel

Local-only label for one access slot in a remembered lockbox.

AgentSession

Explicit controller for the optional session agent. It caches selected content keys only when asked and never represents persistent Vault data.

AgentSleepSupport

Platform sleep/suspend capabilities used by the lockbox session agent.

CachedLockbox

Metadata describing a lockbox whose content key is cached by the agent.

KnownLockbox

Lockbox path remembered by the local vault for diagnostics and bulk access refresh operations.

NoopStore

Content-key store that never retains keys.

PlatformSecretStoreStatus

Current platform secret-store state for the default local vault.

ProfileGeneration

One generation of a vault profile.

ProfileHistory

Versioned profile history for one vault profile.

ReadOnlyVault

Read-only view of a persistent Vault.

SecretActivityGuard

Registration guard for a command that may hold decrypted secrets in memory.

SecretString

UTF-8 secret stored in guarded, zeroizing memory.

SecretVec

Variable-length byte sequence stored in guarded, zeroizing memory.

StoredContact

Contact entry stored in a VaultDirectory.

Vault

Persistent encrypted local store for profiles, keys, contacts, and remembered lockbox metadata.

VaultBackupManifest

Metadata stored in an encrypted vault backup archive.

Enums

AutoOpenScope

Scope controlled by the session auto-open setting.

KeyFormat

Supported contact key serialization formats.

ProfileGenerationStatus

Lifecycle state of one profile key generation.

SecretActivityKind

Category of an operation that temporarily requires secret access.

Constants

CURRENT_VAULT_STRUCTURE_VERSION

Current on-disk structure version for records stored inside the local vault.

FINGERPRINT_CODE_96_LEN

Number of bytes encoded by the short, human-comparable fingerprint code.

Traits

ContentKeyStore

Storage backend for opened Lockbox content keys.

Functions

backup_default_vault

Writes a consistent encrypted backup archive for the default local vault.

decode_fingerprint_crockford_96

Decodes a 96-bit lower/upper-case Crockford fingerprint code.

decode_fingerprint_hex

Decodes a public-key fingerprint written as hex, with optional separators.

default_vault_dir

Returns the default directory for the local vault.

default_vault_path

Returns the default path to the local vault file.

disable_platform_secret_store

Disables platform secret-store lookup for the default local vault.

enable_platform_secret_store

Enables platform secret-store lookup for the default local vault.

encode_hex

Encodes bytes as lowercase hexadecimal text.

export_private_key

Exports a contact private key in the requested format.

export_public_key

Exports a contact public key in the requested format.

forget

Removes one content key from the platform agent.

forget_all

Removes all content keys from the platform agent.

forget_platform_vault_password

Removes the default local vault password from the platform secret store.

forget_vault_unlock_key

Removes the cached vault unlock secret for one vault.

format_fingerprint_crockford_96

Formats the first 96 bits of a fingerprint as lower-case Crockford Base32.

format_fingerprint_crockford_96_reading

Returns a lower-case word reading for a Crockford fingerprint code.

format_fingerprint_hex_pairs

Formats fingerprint bytes as lowercase space-separated hexadecimal pairs.

get

Reads a cached content key from the platform agent.

get_platform_vault_password

Loads the default local vault password from the platform secret store.

get_vault_unlock_key

Reads the cached vault unlock secret for a specific vault profile.

import_private_key

Imports a contact private key from PEM, JWK, JWKS-compatible JWK, or hex.

import_private_key_file

Reads and imports a contact private key from a file.

import_public_key

Imports a contact public key from Lockbox PEM, JWK, JWKS, or raw hex.

is_running

Returns true when the platform agent transport is currently reachable.

list

Lists cached lockboxes known to the platform agent.

platform_secret_store_disabled

Returns true when platform secret-store lookup should not be attempted.

platform_secret_store_status

Returns the platform secret-store status for the default local vault.

public_key_fingerprint

Returns the stable fingerprint for a contact public key.

put

Stores a content key in the platform agent.

put_platform_vault_password

Stores the default local vault password in the platform secret store.

put_vault_unlock_key

Caches a vault unlock secret obtained through the normal vault flow.

restore_default_vault

Restores the default local vault from an encrypted backup archive.

serve_agent

Runs the platform content-key agent in the current process.

set_auto_open_scope

Persists the automatic-open scope for the default local vault.

start

Starts the session agent if it is not already running.

stop

Stops the platform agent after clearing all cached content keys.

verify_agent_transport_security

Verifies that the current platform agent transport is configured securely.