Module storage 

Credential storage primitives for World ID v4.

Credential Store

On-device, consistent, encrypted storage for World ID credentials.

The storage layer handles structured storage of all credentials and their associated data (only storage, the semantics of the associated data is the Issuer’s responsibility). In addition the storage layer handles encryption and clean up after expiration.

Components

crate::storage::CredentialStore is the facade exposed to hosts (via UniFFI). It owns the account key envelope and two databases:

1. Vault database (account.vault.sqlite) — authoritative storage for credentials, associated data blobs, issuer subject blinding factors, and the account leaf index. Corruption is a hard failure. See crate::storage::CredentialVault.
2. Cache database (account.cache.sqlite) — non-authoritative, regenerable entries: Merkle inclusion proof cache, per-account session seed, and nullifier replay guards. Subject to TTL pruning and can be rebuilt at any time without correctness loss. See crate::storage::CacheDb.

The encrypted-storage primitives beneath these — the sealed key envelope, the K_device → K_intermediate key hierarchy, sqlite3mc encryption, the cross-process lock, content-addressed blobs, and the threat model are owned by the walletkit-db crate.

Keys

Both databases are opened with the single K_intermediate managed by walletkit-db.

On-disk layout

The vault, cache, and lock live under <root>/worldid/ — see crate::storage::StoragePaths. The account key envelope (account_keys.bin) is written separately through the host’s crate::storage::AtomicBlobStore and its location is host-determined (not necessarily under worldid/); backup and deletion must include it.

Security and privacy properties

Encryption, the sealed-envelope threat model, and integrity checks are covered by the walletkit-db README.

Re-exports

pub use cache::CacheDb;

pub use credential_storage::CredentialStore;

pub use credential_vault::CredentialVault;

pub use error::StorageError;

pub use error::StorageResult;

pub use keys::StorageKeys;

pub use paths::StoragePaths;

pub use traits::ActivityChangedListener;

pub use traits::AtomicBlobStore;

pub use traits::DeviceKeystore;

pub use traits::StorageProvider;

pub use traits::VaultChangedListener;

pub use types::ActivityEntry;

pub use types::ActivityFailureReason;

pub use types::ActivityMetadata;

pub use types::ActivityOutcome;

pub use types::ActivityQuery;

pub use types::BlobKind;

pub use types::CredentialRecord;

pub use types::Nullifier;

pub use types::ProtocolVersion;

pub use types::ReplayGuardKind;

pub use types::ReplayGuardResult;

pub use types::RequestId;

Modules

cache

Encrypted cache database for credential storage.

credential_storage

Storage facade implementing the credential storage API.

credential_vault

Encrypted vault database for credential storage.

error

Error types for credential storage components.

keys

Key management for credential storage.

paths

Storage path helpers.

traits

Platform interfaces for credential storage.

types

Public types for credential storage.

Structs

StorageLock

File-backed cross-process exclusive lock. See the module docs for what it’s for (and what it isn’t).

StorageLockGuard

Guard that holds an exclusive lock for its lifetime.

Type Aliases

ContentId

32-byte content identifier for a stored blob.