// file: crates/ksp-wallet-lib/src/lib.rs
// version: 14

#![warn(missing_docs)]
#![deny(unreachable_pub)]
#![forbid(unsafe_code)]

//! Autonomous KSP Wallet foundation.
//!
//! `ksp-wallet-lib` owns the native `.kspwallet` domain, VIEW/OWNER capability model, protected metadata projection, password-secret wrappers and Wallet
//! error contract. `0.2.5-pre.003` freezes the strict V1 JSON envelope, canonical Base64url decoding, structural limits and deterministic
//! state-transcript/AEAD-AAD byte codecs. `0.2.5-pre.004` adds the in-memory Argon2id/XChaCha20-Poly1305/CSPRNG primitives and deterministic crypto
//! vectors. `0.2.5-pre.005` adds exact protected payloads, OWNER Ed25519 state authentication and async in-memory create/open flows for VIEW and OWNER.
//! `0.2.5-pre.006` adds bounded async-first filesystem reads plus same-directory synchronized no-clobber publication for new native files. `0.2.5-pre.007`
//! adds Solana message signing, protected metadata administration, password rotation and strong VIEW disable/recreate with capability-bound atomic
//! replacement. `0.2.5-pre.008` adds bounded Solana CLI JSON and canonical full-keypair Base58 import/export adapters with safe inspection and no-clobber
//! native import/export publication. `0.2.5-pre.009` adds adversarial security/compliance canaries and records the final dependency/interop audit before
//! documentation closure. `0.2.6-pre.015` defines the strict binary `.kspwallet` V2 wire and its bounded canonical codec without yet changing the public
//! persistence default or Wallet Desk dispatch. `0.2.6-pre.016` adds complete V2 create/open/administration, stable version-neutral dispatch, explicit V1/V2
//! APIs and moves the default native creation/import format to V2 without coupling that default to the latest supported version. `0.2.6-pre.017` adds
//! explicit authenticated V1 -> V2 migration with no-clobber copy and state-conflict protected in-place replacement; ordinary open remains non-migrating.
//! Public keys are consumed exclusively through the [`ksp_core_lib::Pubkey`] re-export owned by KSP Core, and behavioral
//! observability uses only
//! `ksp-logging-lib` with the explicit crate target defined in `src/constants.rs`.

mod capability;
mod constants;
mod crypto;
mod error;
mod format;
mod metadata;
mod migration;
mod owner;
mod password;
mod payload;
mod persistence;
mod runtime;
mod transcript;
mod transcript_v2;
mod transfer;
mod view;
mod wallet;
mod wallet_v2;
mod wire;
mod wire_v2;

#[cfg(test)]
#[path = "../unit_tests/security.rs"]
mod security_tests;

/// Authorized capability represented by an unlocked Wallet handle.
pub use self::capability::WalletCapability;
/// Native `.kspwallet` V1 format version.
pub use self::constants::KSPWALLET_FORMAT_VERSION_V1;
/// Native `.kspwallet` V2 binary format version.
pub use self::constants::KSPWALLET_FORMAT_VERSION_V2;
/// Exact magic string required by every native `.kspwallet` document.
pub use self::constants::KSPWALLET_MAGIC;
/// Maximum accepted `.kspwallet` document size before parsing.
pub use self::constants::KSPWALLET_MAX_FILE_BYTES;
/// Byte length of every Solana Ed25519 signature returned by OWNER.
pub use self::constants::KSPWALLET_SOLANA_SIGNATURE_BYTES;
/// Maximum accepted Base58 keypair transfer size before decoding.
pub use self::constants::KSPWALLET_TRANSFER_MAX_BASE58_BYTES;
/// Maximum accepted Solana CLI JSON transfer size before parsing.
pub use self::constants::KSPWALLET_TRANSFER_MAX_SOLANA_CLI_JSON_BYTES;
/// Byte length of the AEAD authentication tag appended to V1 ciphertexts.
pub use self::constants::KSPWALLET_V1_AEAD_TAG_BYTES;
/// Argon2 version serialized by `.kspwallet` V1 key slots.
pub use self::constants::KSPWALLET_V1_ARGON2_VERSION;
/// Default Argon2id iteration count for newly created V1 slots.
pub use self::constants::KSPWALLET_V1_DEFAULT_ARGON2_ITERATIONS;
/// Default Argon2id memory cost for newly created V1 slots.
pub use self::constants::KSPWALLET_V1_DEFAULT_ARGON2_MEMORY_KIB;
/// Default Argon2id parallelism for newly created V1 slots.
pub use self::constants::KSPWALLET_V1_DEFAULT_ARGON2_PARALLELISM;
/// Default KDF salt size generated for newly created V1 slots.
pub use self::constants::KSPWALLET_V1_DEFAULT_KDF_SALT_BYTES;
/// Byte length of the Ed25519 format-authority public key.
pub use self::constants::KSPWALLET_V1_ED25519_PUBLIC_KEY_BYTES;
/// Byte length of the Ed25519 detached state signature.
pub use self::constants::KSPWALLET_V1_ED25519_SIGNATURE_BYTES;
/// Initial per-compartment protected payload version.
pub use self::constants::KSPWALLET_V1_INITIAL_PAYLOAD_VERSION;
/// Maximum alias size in protected metadata V1.
pub use self::constants::KSPWALLET_V1_MAX_ALIAS_BYTES;
/// Maximum structural Argon2 iteration count accepted by the V1 parser.
pub use self::constants::KSPWALLET_V1_MAX_ARGON2_ITERATIONS;
/// Maximum structural Argon2 memory cost accepted by the V1 parser.
pub use self::constants::KSPWALLET_V1_MAX_ARGON2_MEMORY_KIB;
/// Maximum structural Argon2 parallelism accepted by the V1 parser.
pub use self::constants::KSPWALLET_V1_MAX_ARGON2_PARALLELISM;
/// Maximum Argon2 salt size accepted by V1.
pub use self::constants::KSPWALLET_V1_MAX_KDF_SALT_BYTES;
/// Maximum number of OWNER/VIEW slots accepted by format V1.
pub use self::constants::KSPWALLET_V1_MAX_KEY_SLOTS;
/// Maximum wrapped-key ciphertext size accepted by V1.
pub use self::constants::KSPWALLET_V1_MAX_KEY_WRAP_CIPHERTEXT_BYTES;
/// Maximum protected metadata ciphertext size accepted by V1.
pub use self::constants::KSPWALLET_V1_MAX_METADATA_CIPHERTEXT_BYTES;
/// Maximum protected metadata plaintext size defined by V1.
pub use self::constants::KSPWALLET_V1_MAX_METADATA_PLAINTEXT_BYTES;
/// Maximum protected note text size defined by metadata V1.
pub use self::constants::KSPWALLET_V1_MAX_NOTE_TEXT_BYTES;
/// Maximum number of protected notes defined by metadata V1.
pub use self::constants::KSPWALLET_V1_MAX_NOTES;
/// Maximum OWNER-control ciphertext size accepted by V1.
pub use self::constants::KSPWALLET_V1_MAX_OWNER_CONTROL_CIPHERTEXT_BYTES;
/// Maximum password size in exact UTF-8 bytes defined by V1.
pub use self::constants::KSPWALLET_V1_MAX_PASSWORD_BYTES;
/// Maximum OWNER-only secret ciphertext size accepted by V1.
pub use self::constants::KSPWALLET_V1_MAX_SECRET_CIPHERTEXT_BYTES;
/// Domain separator for metadata-compartment AEAD AAD.
pub use self::constants::KSPWALLET_V1_METADATA_AAD_DOMAIN;
/// Minimum Argon2 salt size accepted by V1.
pub use self::constants::KSPWALLET_V1_MIN_KDF_SALT_BYTES;
/// Byte length of every protected metadata note identifier.
pub use self::constants::KSPWALLET_V1_NOTE_ID_BYTES;
/// Domain separator for OWNER-control compartment AEAD AAD.
pub use self::constants::KSPWALLET_V1_OWNER_CONTROL_AAD_DOMAIN;
/// Exact OWNER-control plaintext size fixed by V1.
pub use self::constants::KSPWALLET_V1_OWNER_CONTROL_PLAINTEXT_BYTES;
/// Domain separator for OWNER key-slot wrapping AAD.
pub use self::constants::KSPWALLET_V1_OWNER_SLOT_AAD_DOMAIN;
/// Domain separator for OWNER-only secret compartment AEAD AAD.
pub use self::constants::KSPWALLET_V1_SECRET_AAD_DOMAIN;
/// Exact Solana keypair plaintext size fixed by V1.
pub use self::constants::KSPWALLET_V1_SECRET_PLAINTEXT_BYTES;
/// Byte length of every V1 key-slot identifier.
pub use self::constants::KSPWALLET_V1_SLOT_ID_BYTES;
/// Domain separator for the OWNER state-signature transcript.
pub use self::constants::KSPWALLET_V1_STATE_TRANSCRIPT_DOMAIN;
/// Domain separator for VIEW key-slot wrapping AAD.
pub use self::constants::KSPWALLET_V1_VIEW_SLOT_AAD_DOMAIN;
/// Byte length of an XChaCha20-Poly1305 nonce.
pub use self::constants::KSPWALLET_V1_XCHACHA_NONCE_BYTES;
/// Byte length of the AEAD authentication tag appended to V2 ciphertexts.
pub use self::constants::KSPWALLET_V2_AEAD_TAG_BYTES;
/// Argon2 version serialized by `.kspwallet` V2 key slots.
pub use self::constants::KSPWALLET_V2_ARGON2_VERSION;
/// Default Argon2id iteration count for newly created V2 slots.
pub use self::constants::KSPWALLET_V2_DEFAULT_ARGON2_ITERATIONS;
/// Default Argon2id memory cost for newly created V2 slots.
pub use self::constants::KSPWALLET_V2_DEFAULT_ARGON2_MEMORY_KIB;
/// Default Argon2id parallelism for newly created V2 slots.
pub use self::constants::KSPWALLET_V2_DEFAULT_ARGON2_PARALLELISM;
/// Default KDF salt size generated for newly created V2 slots.
pub use self::constants::KSPWALLET_V2_DEFAULT_KDF_SALT_BYTES;
/// Byte length of the V2 Ed25519 format-authority public key.
pub use self::constants::KSPWALLET_V2_ED25519_PUBLIC_KEY_BYTES;
/// Byte length of the V2 Ed25519 detached state signature.
pub use self::constants::KSPWALLET_V2_ED25519_SIGNATURE_BYTES;
/// Initial per-compartment protected payload version for V2.
pub use self::constants::KSPWALLET_V2_INITIAL_PAYLOAD_VERSION;
/// Maximum structural Argon2 iteration count accepted by the V2 parser.
pub use self::constants::KSPWALLET_V2_MAX_ARGON2_ITERATIONS;
/// Maximum structural Argon2 memory cost accepted by the V2 parser.
pub use self::constants::KSPWALLET_V2_MAX_ARGON2_MEMORY_KIB;
/// Maximum structural Argon2 parallelism accepted by the V2 parser.
pub use self::constants::KSPWALLET_V2_MAX_ARGON2_PARALLELISM;
/// Maximum Argon2 salt size accepted by V2.
pub use self::constants::KSPWALLET_V2_MAX_KDF_SALT_BYTES;
/// Maximum wrapped-key ciphertext size accepted by V2.
pub use self::constants::KSPWALLET_V2_MAX_KEY_WRAP_CIPHERTEXT_BYTES;
/// Maximum protected metadata ciphertext size accepted by V2.
pub use self::constants::KSPWALLET_V2_MAX_METADATA_CIPHERTEXT_BYTES;
/// Maximum OWNER-control ciphertext size accepted by V2.
pub use self::constants::KSPWALLET_V2_MAX_OWNER_CONTROL_CIPHERTEXT_BYTES;
/// Maximum OWNER-only secret ciphertext size accepted by V2.
pub use self::constants::KSPWALLET_V2_MAX_SECRET_CIPHERTEXT_BYTES;
/// Domain separator for V2 metadata-compartment AEAD AAD.
pub use self::constants::KSPWALLET_V2_METADATA_AAD_DOMAIN;
/// Minimum Argon2 salt size accepted by V2.
pub use self::constants::KSPWALLET_V2_MIN_KDF_SALT_BYTES;
/// Domain separator for V2 OWNER-control compartment AEAD AAD.
pub use self::constants::KSPWALLET_V2_OWNER_CONTROL_AAD_DOMAIN;
/// Domain separator for V2 OWNER key-slot wrapping AAD.
pub use self::constants::KSPWALLET_V2_OWNER_SLOT_AAD_DOMAIN;
/// Domain separator for V2 OWNER-only secret compartment AEAD AAD.
pub use self::constants::KSPWALLET_V2_SECRET_AAD_DOMAIN;
/// Exact Solana keypair plaintext size retained by the initial V2 secret payload profile.
pub use self::constants::KSPWALLET_V2_SECRET_PLAINTEXT_BYTES;
/// Byte length of every V2 key-slot identifier.
pub use self::constants::KSPWALLET_V2_SLOT_ID_BYTES;
/// Domain separator for the V2 OWNER state-signature transcript.
pub use self::constants::KSPWALLET_V2_STATE_TRANSCRIPT_DOMAIN;
/// Domain separator for V2 VIEW key-slot wrapping AAD.
pub use self::constants::KSPWALLET_V2_VIEW_SLOT_AAD_DOMAIN;
/// Byte length of an XChaCha20-Poly1305 nonce in V2.
pub use self::constants::KSPWALLET_V2_XCHACHA_NONCE_BYTES;
/// Error code used when an atomic Wallet persistence operation cannot publish a valid replacement.
pub use self::error::ERROR_CODE_ATOMIC_PERSISTENCE_FAILED;
/// Error code used when an authenticated Wallet structure cannot be verified.
pub use self::error::ERROR_CODE_AUTHENTICATION_FAILED;
/// Error code used when an operation requires a capability that the caller does not own.
pub use self::error::ERROR_CODE_CAPABILITY_INSUFFICIENT;
/// Error code used when a blocking cryptographic task cannot complete.
pub use self::error::ERROR_CODE_CRYPTO_OPERATION_FAILED;
/// Error code used when serialized cryptographic parameters are invalid or unsupported.
pub use self::error::ERROR_CODE_CRYPTO_PARAMETERS_INVALID;
/// Error code used when a no-clobber create or import destination already exists.
pub use self::error::ERROR_CODE_DESTINATION_EXISTS;
/// Error code used when a native Wallet structure is invalid.
pub use self::error::ERROR_CODE_FORMAT_INVALID;
/// Error code used when a native Wallet format version is unsupported.
pub use self::error::ERROR_CODE_FORMAT_VERSION_UNSUPPORTED;
/// Error code used when Wallet filesystem I/O fails.
pub use self::error::ERROR_CODE_IO_FAILED;
/// Error code used when imported or decoded key material is invalid.
pub use self::error::ERROR_CODE_KEY_MATERIAL_INVALID;
/// Error code used when an explicit Wallet migration request is inconsistent with migration policy.
pub use self::error::ERROR_CODE_MIGRATION_INVALID;
/// Error code used when a protected Wallet note identifier is absent.
pub use self::error::ERROR_CODE_NOTE_NOT_FOUND;
/// Error code used when an OWNER unlock attempt fails without exposing a finer cryptographic oracle.
pub use self::error::ERROR_CODE_OWNER_UNLOCK_FAILED;
/// Error code used when the operating-system cryptographic random source cannot provide bytes.
pub use self::error::ERROR_CODE_RANDOMNESS_FAILED;
/// Error code used when a Wallet signing operation fails.
pub use self::error::ERROR_CODE_SIGNATURE_FAILED;
/// Error code used when an administrative replacement sees a different or stale Wallet state.
pub use self::error::ERROR_CODE_STATE_CONFLICT;
/// Error code used when an import/export transfer format is unsupported.
pub use self::error::ERROR_CODE_TRANSFER_FORMAT_UNSUPPORTED;
/// Error code used when a VIEW unlock attempt fails without exposing a finer cryptographic oracle.
pub use self::error::ERROR_CODE_VIEW_UNLOCK_FAILED;
/// Default native Wallet format selected by non-versioned create/import APIs.
pub use self::format::DEFAULT_WALLET_FORMAT;
/// Highest native Wallet format supported by this release.
pub use self::format::LATEST_SUPPORTED_WALLET_FORMAT;
/// Explicit native Wallet wire-format selector.
pub use self::format::WalletFormat;
/// Creates a new in-memory native Wallet using the explicit default format.
pub use self::format::create_wallet;
/// Detects V1 JSON versus V2 binary framing before strict parser dispatch.
pub use self::format::detect_wallet_format;
/// Inspects any supported in-memory native Wallet document.
pub use self::format::inspect_locked_wallet;
/// Opens OWNER from any supported in-memory native Wallet document.
pub use self::format::open_wallet_owner;
/// Opens VIEW from any supported in-memory native Wallet document.
pub use self::format::open_wallet_view;
/// Minimal non-secret information available while a native Wallet remains locked.
pub use self::metadata::LockedWalletInfo;
/// Protected initial metadata supplied to version-neutral native Wallet creation.
pub type WalletCreateMetadata = self::metadata::WalletCreateMetadataV1;
/// Protected initial metadata payload profile retained for explicit V1 compatibility.
pub use self::metadata::WalletCreateMetadataV1;
/// Safe metadata projection produced after VIEW or OWNER authorization.
pub use self::metadata::WalletInfo;
/// One protected Wallet note exposed only after authorization.
pub use self::metadata::WalletNote;
/// Migrates one V1 file into a new no-clobber V2 destination while preserving the source.
pub use self::migration::migrate_wallet_file_v1_to_v2;
/// Atomically replaces one authenticated current V1 file with its V2 migration.
pub use self::migration::migrate_wallet_file_v1_to_v2_in_place;
/// Converts one authenticated V1 document snapshot into a fresh V2 Wallet in memory.
pub use self::migration::migrate_wallet_v1_to_v2;
/// Authorized OWNER capability handle.
pub use self::owner::WalletOwner;
/// Owned OWNER password material with redacted diagnostics and drop-time zeroization.
pub use self::password::OwnerPassword;
/// Owned VIEW password material with redacted diagnostics and drop-time zeroization.
pub use self::password::ViewPassword;
/// Creates and no-clobber persists a native Wallet using the explicit default format.
pub use self::persistence::create_wallet_file;
/// Creates and no-clobber persists a new native `.kspwallet` V1 file.
pub use self::persistence::create_wallet_file_v1;
/// Creates and no-clobber persists a new native `.kspwallet` V2 binary file.
pub use self::persistence::create_wallet_file_v2;
/// Reads and verifies a locked native Wallet using V1/V2 auto-detection.
pub use self::persistence::inspect_locked_wallet_file;
/// Reads and verifies a locked native `.kspwallet` V1 file.
pub use self::persistence::inspect_locked_wallet_file_v1;
/// Reads and verifies a locked native `.kspwallet` V2 binary file.
pub use self::persistence::inspect_locked_wallet_file_v2;
/// Opens a native Wallet with OWNER capability using V1/V2 auto-detection.
pub use self::persistence::open_wallet_owner_file;
/// Opens a native `.kspwallet` V1 file with OWNER capability.
pub use self::persistence::open_wallet_owner_file_v1;
/// Opens a native `.kspwallet` V2 binary file with OWNER capability.
pub use self::persistence::open_wallet_owner_file_v2;
/// Opens a native Wallet with VIEW capability using V1/V2 auto-detection.
pub use self::persistence::open_wallet_view_file;
/// Opens a native `.kspwallet` V1 file with VIEW capability.
pub use self::persistence::open_wallet_view_file_v1;
/// Opens a native `.kspwallet` V2 binary file with VIEW capability.
pub use self::persistence::open_wallet_view_file_v2;
/// Explicit secret-transfer format supported by Wallet.
pub use self::transfer::WalletTransferFormat;
/// Safe public identity projection of one validated secret-transfer source.
pub use self::transfer::WalletTransferInspection;
/// Imports one in-memory transfer payload into a new no-clobber native Wallet using the explicit default format.
pub use self::transfer::import_wallet_transfer;
/// Imports one bounded external transfer file into a new no-clobber native Wallet using the explicit default format.
pub use self::transfer::import_wallet_transfer_file;
/// Imports one bounded external transfer file into a new no-clobber native Wallet V1.
pub use self::transfer::import_wallet_transfer_file_v1;
/// Imports one bounded external transfer file into a new no-clobber native Wallet V2.
pub use self::transfer::import_wallet_transfer_file_v2;
/// Imports one in-memory transfer payload into a new no-clobber native Wallet V1.
pub use self::transfer::import_wallet_transfer_v1;
/// Imports one in-memory transfer payload into a new no-clobber native Wallet V2.
pub use self::transfer::import_wallet_transfer_v2;
/// Validates one in-memory transfer payload and exposes only its derived public identity.
pub use self::transfer::inspect_wallet_transfer;
/// Validates one bounded external transfer file and exposes only its derived public identity.
pub use self::transfer::inspect_wallet_transfer_file;
/// Authorized VIEW capability handle.
pub use self::view::WalletView;
/// Creates a new in-memory native Wallet V1.
pub use self::wallet::create_wallet_v1;
/// Parses and verifies locked native Wallet state without unlocking protected metadata.
pub use self::wallet::inspect_locked_wallet_v1;
/// Opens the OWNER capability from a native Wallet V1 document.
pub use self::wallet::open_wallet_owner_v1;
/// Opens the VIEW capability from a native Wallet V1 document.
pub use self::wallet::open_wallet_view_v1;
/// Creates a new in-memory native Wallet V2.
pub use self::wallet_v2::create_wallet_v2;
/// Parses and verifies locked native Wallet V2 state without unlocking protected metadata.
pub use self::wallet_v2::inspect_locked_wallet_v2;
/// Opens the OWNER capability from a native Wallet V2 document.
pub use self::wallet_v2::open_wallet_owner_v2;
/// Opens the VIEW capability from a native Wallet V2 document.
pub use self::wallet_v2::open_wallet_view_v2;
/// Strict semantic representation of one parsed native `.kspwallet` V1 envelope.
pub use self::wire::KspWalletEnvelopeV1;
/// Authenticated-encryption algorithm fixed by native Wallet V1.
pub use self::wire::WalletAeadAlgorithmV1;
/// Protected compartment kind fixed by native Wallet V1.
pub use self::wire::WalletCompartmentKindV1;
/// One validated encrypted V1 compartment.
pub use self::wire::WalletEncryptedCompartmentV1;
/// Password KDF fixed by native Wallet V1.
pub use self::wire::WalletKdfAlgorithmV1;
/// Parsed Argon2id parameters from one V1 key slot.
pub use self::wire::WalletKdfParametersV1;
/// Role of one native V1 key slot.
pub use self::wire::WalletKeySlotRoleV1;
/// One validated OWNER or VIEW V1 key slot.
pub use self::wire::WalletKeySlotV1;
/// Parsed AEAD wrapped-key payload from one V1 key slot.
pub use self::wire::WalletKeyWrapV1;
/// State-signature algorithm fixed by native Wallet V1.
pub use self::wire::WalletStateSignatureAlgorithmV1;
/// Detached OWNER state signature embedded in a V1 envelope.
pub use self::wire::WalletStateSignatureV1;
/// OWNER-signed stable descriptor of the optional VIEW slot.
pub use self::wire::WalletViewDescriptorV1;
/// Strict semantic representation of one parsed native `.kspwallet` V2 binary envelope.
pub use self::wire_v2::KspWalletEnvelopeV2;
/// Authenticated-encryption algorithm fixed by native Wallet V2.
pub use self::wire_v2::WalletAeadAlgorithmV2;
/// Protected compartment kind fixed by native Wallet V2.
pub use self::wire_v2::WalletCompartmentKindV2;
/// One validated encrypted V2 compartment.
pub use self::wire_v2::WalletEncryptedCompartmentV2;
/// Password KDF fixed by native Wallet V2.
pub use self::wire_v2::WalletKdfAlgorithmV2;
/// Parsed Argon2id parameters from one V2 key slot.
pub use self::wire_v2::WalletKdfParametersV2;
/// Role of one native V2 key slot.
pub use self::wire_v2::WalletKeySlotRoleV2;
/// One validated OWNER or VIEW V2 key slot.
pub use self::wire_v2::WalletKeySlotV2;
/// Parsed AEAD wrapped-key payload from one V2 key slot.
pub use self::wire_v2::WalletKeyWrapV2;
/// State-signature algorithm fixed by native Wallet V2.
pub use self::wire_v2::WalletStateSignatureAlgorithmV2;
/// Detached OWNER state signature embedded in a V2 envelope.
pub use self::wire_v2::WalletStateSignatureV2;
/// OWNER-signed stable descriptor of the optional VIEW slot in V2.
pub use self::wire_v2::WalletViewDescriptorV2;

/// Wallet-owned tracing target used by the KSP logging facade.
pub(crate) use self::constants::TRACING_TARGET;
/// Exact V1 content-key and password-derived-key size in bytes.
pub(crate) use self::crypto::SECRET_KEY_BYTES;
/// Owned 32-byte secret key with redacted diagnostics and drop-time zeroization.
pub(crate) use self::crypto::SecretKeyV1;
/// Decrypts authenticated ciphertext bytes and returns a generic authentication error on tag failure.
pub(crate) use self::crypto::decrypt_bytes;
/// Derives one V1 password wrapping key from serialized Argon2id parameters.
pub(crate) use self::crypto::derive_password_key;
/// Derives one V2 password wrapping key from serialized Argon2id parameters.
pub(crate) use self::crypto::derive_password_key_v2;
/// Encrypts bounded plaintext bytes with XChaCha20-Poly1305 and caller-provided domain-separated AAD.
pub(crate) use self::crypto::encrypt_bytes;
/// Generates a fresh fixed-size byte array from the operating-system CSPRNG.
pub(crate) use self::crypto::random_bytes;
/// Generates a fresh XChaCha20-Poly1305 nonce from the operating-system CSPRNG.
pub(crate) use self::crypto::random_nonce;
/// Unwraps one 32-byte content key and maps every AEAD authentication failure to the generic Wallet authentication error.
pub(crate) use self::crypto::unwrap_key;
/// Wraps one 32-byte content key with XChaCha20-Poly1305 and caller-provided domain-separated AAD.
pub(crate) use self::crypto::wrap_key;
/// Crate-internal `MetadataPayloadV1` state shared across the owning crate.
pub(crate) use self::payload::MetadataPayloadV1;
/// Decodes metadata payload.
pub(crate) use self::payload::decode_metadata_payload;
/// Decodes owner control payload.
pub(crate) use self::payload::decode_owner_control_payload;
/// Encodes initial metadata payload.
pub(crate) use self::payload::encode_initial_metadata_payload;
/// Encodes owner control payload.
pub(crate) use self::payload::encode_owner_control_payload;
/// Internal no-clobber native persistence path shared by version-neutral transfer adapters.
pub(crate) use self::persistence::persist_new_wallet_content;
/// Internal V1 no-clobber native persistence path retained for explicit compatibility adapters.
pub(crate) use self::persistence::persist_new_wallet_content_v1;
/// Persists new wallet fault before publish.
#[cfg(test)]
pub(crate) use self::persistence::persist_new_wallet_fault_before_publish;
/// Persists new wallet for test.
#[cfg(test)]
pub(crate) use self::persistence::persist_new_wallet_for_test;
/// Bounded native Wallet reader shared with authenticated migration.
pub(crate) use self::persistence::read_wallet_file_async;
/// Replaces wallet fault before publish.
#[cfg(test)]
pub(crate) use self::persistence::replace_wallet_fault_before_publish;
/// Replaces wallet file v1.
pub(crate) use self::persistence::replace_wallet_file_v1;
/// Replaces wallet file v2.
pub(crate) use self::persistence::replace_wallet_file_v2;
/// Replaces wallet for test.
#[cfg(test)]
pub(crate) use self::persistence::replace_wallet_for_test;
/// Version-neutral OWNER runtime state shared by public Wallet handles.
pub(crate) use self::runtime::OwnerState;
/// Version-neutral VIEW runtime state shared by public Wallet handles.
pub(crate) use self::runtime::ViewState;
/// Internal deterministic compartment-AAD codec shared by Wallet crypto layers.
pub(crate) use self::transcript::compartment_aad;
/// Internal deterministic key-slot-AAD codec shared by Wallet crypto layers.
pub(crate) use self::transcript::slot_aad;
/// Internal deterministic OWNER-state transcript codec shared by Wallet crypto layers.
pub(crate) use self::transcript::state_transcript;
/// Internal deterministic V2 compartment-AAD codec shared by Wallet crypto layers.
pub(crate) use self::transcript_v2::compartment_aad_v2;
/// Internal deterministic V2 key-slot-AAD codec shared by Wallet crypto layers.
pub(crate) use self::transcript_v2::slot_aad_v2;
/// Internal deterministic V2 OWNER-state transcript codec shared by Wallet crypto layers.
pub(crate) use self::transcript_v2::state_transcript_v2;
/// Internal no-clobber transfer-file writer used only by OWNER export.
pub(crate) use self::transfer::write_wallet_transfer_file;
/// Crate-internal `OwnerStateV1` state shared across the owning crate.
pub(crate) use self::wallet::OwnerStateV1;
/// Crate-internal `ViewStateV1` state shared across the owning crate.
pub(crate) use self::wallet::ViewStateV1;
/// Internal imported-keypair V1 creation path shared by transfer adapters.
pub(crate) use self::wallet::create_wallet_v1_from_keypair;
/// Verifies V1 state signature.
pub(crate) use self::wallet::verify_state_signature;
/// Crate-internal `OwnerStateV2` state shared across the owning crate.
pub(crate) use self::wallet_v2::OwnerStateV2;
/// Crate-internal `ViewStateV2` state shared across the owning crate.
pub(crate) use self::wallet_v2::ViewStateV2;
/// Internal imported-keypair V2 creation path shared by transfer adapters.
pub(crate) use self::wallet_v2::create_wallet_v2_from_keypair;
/// Verifies V2 state signature.
pub(crate) use self::wallet_v2::verify_state_signature_v2;