v0.2.5-pre.009

crates/ksp-wallet-lib/src/lib.rs

@@ -1,5 +1,6 @@
 // file: crates/ksp-wallet-lib/src/lib.rs
-// version: 8
+// version: 10
+
 #![warn(missing_docs)]
 #![deny(unreachable_pub)]
 #![forbid(unsafe_code)]
@@ -13,7 +14,8 @@
 //! `0.2.5-pre.006` adds bounded async-first filesystem reads plus same-directory synchronized no-clobber publication for new native files. `0.2.5-pre.007`
 //! adds Solana message signing, protected metadata administration, password rotation and strong VIEW disable/recreate with capability-bound atomic
 //! replacement. `0.2.5-pre.008` adds bounded Solana CLI JSON and canonical full-keypair Base58 import/export adapters with safe inspection and no-clobber
-//! native import/export publication. Public keys are consumed exclusively through the [`ksp_core_lib::Pubkey`] re-export owned by KSP Core, and behavioral
+//! native import/export publication. `0.2.5-pre.009` adds adversarial security/compliance canaries and records the final dependency/interop audit before
+//! documentation closure. Public keys are consumed exclusively through the [`ksp_core_lib::Pubkey`] re-export owned by KSP Core, and behavioral
 //! observability uses only
 //! `ksp-logging-lib` with the explicit crate target defined in `src/constants.rs`.
 
@@ -32,6 +34,10 @@ mod view;
 mod wallet;
 mod wire;
 
+#[cfg(test)]
+#[path = "../unit_tests/security.rs"]
+mod security_tests;
+
 /// Authorized capability represented by an unlocked Wallet handle.
 pub use self::capability::WalletCapability;
 /// Native `.kspwallet` V1 format version.
@@ -221,6 +227,26 @@ pub use self::wire::WalletViewDescriptorV1;
 
 /// Wallet-owned tracing target used by the KSP logging facade.
 pub(crate) use self::constants::TRACING_TARGET;
+/// Exact V1 content-key and password-derived-key size in bytes.
+pub(crate) use self::crypto::SECRET_KEY_BYTES;
+/// Owned 32-byte secret key with redacted diagnostics and drop-time zeroization.
+pub(crate) use self::crypto::SecretKeyV1;
+/// Decrypts authenticated ciphertext bytes and returns a generic authentication error on tag failure.
+pub(crate) use self::crypto::decrypt_bytes;
+/// Derives one V1 password wrapping key from serialized Argon2id parameters.
+pub(crate) use self::crypto::derive_password_key;
+/// Encrypts bounded plaintext bytes with XChaCha20-Poly1305 and caller-provided domain-separated AAD.
+pub(crate) use self::crypto::encrypt_bytes;
+/// Generates a fresh fixed-size byte array from the operating-system CSPRNG.
+pub(crate) use self::crypto::random_bytes;
+/// Generates a fresh XChaCha20-Poly1305 nonce from the operating-system CSPRNG.
+pub(crate) use self::crypto::random_nonce;
+/// Unwraps one 32-byte content key and maps every AEAD authentication failure to the generic Wallet authentication error.
+pub(crate) use self::crypto::unwrap_key;
+/// Wraps one 32-byte content key with XChaCha20-Poly1305 and caller-provided domain-separated AAD.
+pub(crate) use self::crypto::wrap_key;
+pub(crate) use self::payload::MetadataPayloadV1;
+pub(crate) use self::payload::decode_metadata_payload;
 /// Internal no-clobber native persistence path shared by transfer adapters.
 pub(crate) use self::persistence::persist_new_wallet_content_v1;
 /// Internal deterministic compartment-AAD codec shared by Wallet crypto layers.