v0.2.5-pre.008

crates/ksp-wallet-lib/src/owner.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-wallet-lib/src/owner.rs
-// version: 3
+// version: 4
 
 /// Authorized OWNER capability handle.
 ///
@@ -51,6 +51,51 @@ impl WalletOwner {
         return &self.info;
     }
 
+    /// Exports the immutable Solana keypair through one explicitly selected transfer adapter.
+    ///
+    /// The returned bytes contain secret key material and are owned by the caller. Callers should minimize their lifetime and zeroize the buffer after use.
+    /// VIEW has no corresponding export API.
+    pub fn export_transfer(&self, format: crate::WalletTransferFormat) -> ksp_core_lib::Result<std::vec::Vec<u8>> {
+        let encoded = self.state.export_transfer(format);
+        if let std::result::Result::Ok(value) = encoded.as_ref() {
+            ksp_logging_lib::debug!(
+                target: crate::TRACING_TARGET,
+                operation = "wallet_export_transfer",
+                capability = "owner",
+                transfer_format = format.code(),
+                transfer_bytes = value.len(),
+                "wallet secret encoded through explicit OWNER transfer adapter"
+            );
+        }
+        return encoded;
+    }
+
+    /// Exports the immutable Solana keypair to a new no-clobber transfer file.
+    ///
+    /// The destination parent must already exist. On Unix, Wallet attempts `0600` permissions as filesystem hygiene, but OS ACLs are not part of the
+    /// `.kspwallet` cryptographic security guarantee. Existing destinations are never overwritten.
+    pub async fn export_transfer_file(
+        &self,
+        destination: impl std::convert::AsRef<std::path::Path>,
+        format: crate::WalletTransferFormat,
+    ) -> ksp_core_lib::Result<()> {
+        let encoded = match self.state.export_transfer(format) {
+            std::result::Result::Ok(value) => value,
+            std::result::Result::Err(error) => return std::result::Result::Err(error),
+        };
+        let result = crate::write_wallet_transfer_file_v1(destination.as_ref().to_path_buf(), encoded, format).await;
+        if result.is_ok() {
+            ksp_logging_lib::debug!(
+                target: crate::TRACING_TARGET,
+                operation = "wallet_export_transfer_file",
+                capability = "owner",
+                transfer_format = format.code(),
+                "wallet secret exported through explicit OWNER transfer adapter"
+            );
+        }
+        return result;
+    }
+
     /// Signs one caller-provided message with the Wallet's immutable Solana keypair.
     ///
     /// The returned bytes are the 64-byte Ed25519 signature. The Solana secret key is never returned or logged.