Enum IpcMessage 

pub enum IpcMessage {
    GetCredential {
        domain: String,
        page_url: Option<String>,
        username: Option<String>,
    },
    GetExternalSecret {
        client_id: String,
        domain: String,
        field: ExternalSecretField,
        purpose: Option<String>,
    },
    GetExternalSecretResponse {
        value: Option<String>,
        authorized: bool,
        error: Option<String>,
        locked: Option<bool>,
    },
    GetCredentialResponse {
        username: Option<String>,
        password: Option<String>,
        title: Option<String>,
        locked: Option<bool>,
        denied_reason: Option<String>,
    },
    ListDomainCredentials {
        base_domain: String,
        page_url: Option<String>,
    },
    ListDomainCredentialsResponse {
        credentials: Vec<CredentialSummary>,
        locked: Option<bool>,
        denied_reason: Option<String>,
    },
    GetTotpCode {
        domain: String,
        page_url: Option<String>,
        username: Option<String>,
    },
    GetTotpCodeResponse {
        code: Option<String>,
        seconds_remaining: Option<u32>,
        locked: Option<bool>,
        denied_reason: Option<String>,
    },
    SaveCredential {
        domain: String,
        username: String,
        password: String,
        url: Option<String>,
        save_trigger: Option<String>,
    },
    SaveCredentialResponse {
        success: bool,
        error: Option<String>,
        locked: Option<bool>,
    },
    SaveSecret {
        client_id: String,
        domain: String,
        value: String,
        purpose: Option<String>,
    },
    SaveSecretResponse {
        success: bool,
        locked: Option<bool>,
        error: Option<String>,
    },
    DeleteSecret {
        client_id: String,
        domain: String,
    },
    DeleteSecretResponse {
        deleted: bool,
        locked: Option<bool>,
        error: Option<String>,
    },
    UnlockVault {
        master_password: String,
    },
    GrantSitePermission {
        host: String,
        allow_insecure: bool,
    },
    GrantSitePermissionResponse {
        success: bool,
        error: Option<String>,
    },
    RevokeSitePermission {
        host: String,
    },
    RevokeSitePermissionResponse {
        success: bool,
        removed: bool,
        error: Option<String>,
    },
    ListSitePermissions,
    ListSitePermissionsResponse {
        permissions: Vec<SitePermissionSummary>,
        locked: Option<bool>,
    },
    UnlockVaultBiometric {
        prompt_reason: Option<String>,
    },
    UnlockVaultResponse {
        success: bool,
        error: Option<String>,
    },
    CheckVault,
    VaultStatusResponse {
        unlocked: bool,
        key_epoch: i64,
    },
    LockVault,
    Shutdown,
    SyncNow,
    SyncNowResponse {
        success: bool,
        pushed: u64,
        pulled: u64,
        error: Option<String>,
    },
    SyncStatus,
    SyncStatusResponse {
        enabled: bool,
        device_id: Option<String>,
        device_name: Option<String>,
        relay_url: Option<String>,
        last_sync_at: Option<i64>,
        pending_changes: u64,
    },
    ServiceCall {
        op: VaultOp,
    },
    ServiceResult {
        outcome: ServiceOutcome,
    },
}

IPC message types

Variants

GetCredential

Browser-surface credential delivery (WBS-711). page_url is the full URL of the requesting page as reported by the browser (the native host forwards the validated sender URL, never a content- script-claimed value). The daemon parses it with the WHATWG parser and DEFAULT-DENIES delivery for plain-HTTP and unverifiable origins; the scheme-validated host is the lookup identity. serde(default) keeps pre-711 peers deserializing (they are then denied as origin-unverified — fail-closed).

Fields

domain: String

page_url: Option<String>

username: Option<String>

WBS-712/715 disambiguation: exact (case-insensitive) username filter applied AFTER the domain match, so a multi-credential site can request one account (popup “Pass” per row).

GetExternalSecret

Fields

client_id: String

domain: String

field: ExternalSecretField

purpose: Option<String>

GetExternalSecretResponse

Fields

value: Option<String>

authorized: bool

error: Option<String>

locked: Option<bool>

Some(true) = vault locked (distinct from not-found).

GetCredentialResponse

Fields

username: Option<String>

password: Option<String>

title: Option<String>

locked: Option<bool>

denied_reason: Option<String>

WBS-711: set when delivery was refused by the autofill origin gate (origin-unverified / insecure-http) — distinct from a plain no-match, which stays all-None.

ListDomainCredentials

Fields

base_domain: String

page_url: Option<String>

ListDomainCredentialsResponse

Fields

credentials: Vec<CredentialSummary>

locked: Option<bool>

denied_reason: Option<String>

GetTotpCode

Fields

domain: String

page_url: Option<String>

username: Option<String>

WBS-715 review fix F4: exact-username disambiguator so the TOTP belongs to the SAME account whose password was filled.

GetTotpCodeResponse

Fields

code: Option<String>

seconds_remaining: Option<u32>

locked: Option<bool>

denied_reason: Option<String>

SaveCredential

Fields

domain: String

username: String

password: String

url: Option<String>

save_trigger: Option<String>

Extension-computed save provenance (‘inline_prompt_button’, ‘notification_button’, ‘password_change’, …), logged by the daemon. serde default keeps pre-714 hosts wire-compatible.

SaveCredentialResponse

Fields

success: bool

error: Option<String>

locked: Option<bool>

SaveSecret

External tool writes (upserts) one secret value for one scope. Requires a token-enforced grant with allow_write.

Fields

client_id: String

domain: String

value: String

purpose: Option<String>

SaveSecretResponse

Fields

success: bool

locked: Option<bool>

error: Option<String>

DeleteSecret

Defined for protocol completeness; the daemon currently rejects deletion because third-party-created entries have no ownership tracking yet (schema v5 shipped registry ownership groundwork; the delete decision itself stays deliberately rejected per ADR-001 D1).

Fields

client_id: String

domain: String

DeleteSecretResponse

Fields

deleted: bool

locked: Option<bool>

error: Option<String>

UnlockVault

Fields

master_password: String

GrantSitePermission

Grant (or re-confirm) plain-HTTP autofill for one host. The host is normalized daemon-side; the grant is EXACT-host (no suffix matching). Browser-surface gated: only the native host may manage grants.

Fields

host: String

allow_insecure: bool

GrantSitePermissionResponse

Fields

success: bool

error: Option<String>

RevokeSitePermission

Revoke any grant for host (deletes the entry immediately).

Fields

host: String

RevokeSitePermissionResponse

Fields

success: bool

removed: bool

error: Option<String>

ListSitePermissions

List all per-site grants (popup settings view).

ListSitePermissionsResponse

Fields

permissions: Vec<SitePermissionSummary>

locked: Option<bool>

UnlockVaultBiometric

Fields

prompt_reason: Option<String>

UnlockVaultResponse

Fields

success: bool

error: Option<String>

CheckVault

VaultStatusResponse

Fields

unlocked: bool

key_epoch: i64

Master-password rotation generation of the vault (ADR-002). serde default keeps pre-epoch clients deserializing; 0 means the responder could not read metadata.

LockVault

Shutdown

SyncNow

Trigger a sync cycle now (push + pull).

SyncNowResponse

Response to SyncNow.

Fields

success: bool

pushed: u64

pulled: u64

error: Option<String>

SyncStatus

Get sync status.

SyncStatusResponse

Sync status response.

Fields

enabled: bool

device_id: Option<String>

device_name: Option<String>

relay_url: Option<String>

last_sync_at: Option<i64>

pending_changes: u64

ServiceCall

One vault application-service call — the single shape UI, CLI, and the native host use for vault operations (see crate::service).

Fields

op: VaultOp

ServiceResult

Outcome of a IpcMessage::ServiceCall.

Fields

outcome: ServiceOutcome

Trait Implementations

impl Clone for IpcMessage

fn clone(&self) -> IpcMessage

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IpcMessage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for IpcMessage

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for IpcMessage

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.