Add a new entry to the vault. Generates a UUID, encrypts the entry data (Layer 2), and inserts into the `entries` table. Returns the full `Entry` wit

Derive a 256-bit key from a password and salt using Argon2id. Returns a [`SecretBuffer`] containing 32 bytes. The intermediate buffer is zeroized aft

Unwrap a [`KeySlot`] to recover the master key. The wrapping key and slot type's AAD tag must match what was used in [`create_slot`]. The returned [`

Parse a plaintext 2FAS JSON backup export. # Errors Returns `ImportError::InvalidFormat` if the JSON structure is invalid. Returns `ImportError::Uns

Create a vault in a temp directory with the given password and preset.

Serialize a vault into the `.verrou` binary format. Produces: magic + header-len + header-json + sealed-len + sealed-json + random-padding. The outpu

Wrap a master key into a new [`KeySlot`]. The master key is encrypted with AES-256-GCM using the wrapping key and the slot type's AAD tag for domain

Encrypt plaintext using AES-256-GCM with a random 96-bit nonce. Returns a [`SealedData`] containing the nonce, ciphertext, and authentication tag. Th

Parse a plaintext Aegis JSON vault export. # Errors Returns `ImportError::InvalidFormat` if the JSON structure is invalid. Returns `ImportError::Uns

Map vault errors to user-friendly IPC error strings.

Unlock an existing vault with a master password. Performs the full unlock ceremony: 1. Read `.verrou` file and parse header (no decryption needed) 2.

Parse the vault header from `.verrou` file bytes without decrypting the payload. This is used during unlock to read KDF params, slot info, and brute-

Decrypt AES-256-GCM authenticated ciphertext. Returns the plaintext as a [`SecretBuffer`] (zeroized on drop). The intermediate decryption buffer is z

Create and unlock a vault, returning the DB connection and master key.

Get a single entry by ID, decrypting its data. # Errors - [`VaultError::EntryNotFound`] if no entry matches the ID - [`VaultError::Crypto`] if decry

List all entries (metadata only — no decryption). Returns [`EntryListItem`] structs with only plaintext columns. This is efficient for 500+ entries (

Deserialize a `.verrou` binary back into header + payload. Validates magic bytes, format version, and decrypts the payload. Padding bytes are silentl

Encapsulate a shared secret for the recipient's hybrid public key. Generates a fresh ephemeral X25519 key pair, performs ECDH with the recipient's X2

Create and unlock a vault, returning the DB connection and master key.

Produce a hybrid Ed25519 + ML-DSA-65 signature over a message. The Ed25519 key pair is reconstructed from the stored seed. ML-DSA-65 signs with fresh

Verify a hybrid Ed25519 + ML-DSA-65 signature. Both Ed25519 and ML-DSA-65 signatures must be valid for verification to succeed. Ed25519 is checked fi

Deterministically derive a hybrid X25519 + ML-KEM-1024 key pair from input key material. Unlike [`generate_keypair`] (which draws fresh CSPRNG random

Build a minimal valid plaintext 2FAS backup JSON.

Validate a BIP39 mnemonic phrase: word count, word membership, and checksum. # Arguments `words` — slice of words in the mnemonic (12, 15, 18, 21, o

Helper: create a vault and add a recovery slot, returning the result along with the master key for further verification.

Deterministically derive a hybrid Ed25519 + ML-DSA-65 signing key pair from input key material. Unlike [`generate_signing_keypair`] (which draws fres

Generate a hybrid X25519 + ML-KEM-1024 key pair. Both private key components are stored in [`SecretBuffer`] (mlocked, zeroized on drop). The ML-KEM k

Create a minimal test header with no slots.

Render Header inside a MemoryRouter so useNavigate() works.

Create a new top-level folder. # Errors Returns [`VaultError::Database`] if the SQL INSERT fails.

Generate a hybrid Ed25519 + ML-DSA-65 signing key pair. The Ed25519 key pair is created from a random 32-byte seed via `ring::signature::Ed25519KeyPa

Recover the shared secret using the recipient's hybrid private key. Performs X25519 ECDH with the sender's ephemeral public key and ML-KEM-1024 decap

Derive a transfer key from a verification phrase. Uses HKDF-SHA256 with a fixed salt (`verrou-qr-transfer-v1`) and info (`aes-key`) to produce a dete

Export a vault and return the raw .verrou bytes.

Import entries into the vault within a single transaction. Entries at indices in `skip_indices` are excluded (e.g., user-confirmed duplicates to skip

Build a minimal valid plaintext Aegis vault JSON.

Parse a raw protobuf migration payload. This is the lower-level entry point — use `parse_migration_uri` for full URI handling. # Errors Returns `Im

Derive a 256-bit wrapping key from a biometric token via HKDF-SHA256. The token is typically a random 32-byte secret stored in the OS keychain with b

Recover the master key from a vault using the password and header data. Uses the salt stored in `slot_salts[0]` and `session_params` from the header

Create a new vault with a master password. Performs the full key hierarchy ceremony: 1. Check for existing vault files (refuse if already present) 2.

Create a fresh `VaultDb` in a temp directory with a random key.

Build a minimal valid plaintext 2FAS backup JSON.

Build a JSON-encoded error string matching `UnlockErrorResponse`.

Parse an envelope's structure **without** verifying the signature or decrypting anything. The caller is responsible for verifying [`ParsedEnvelope::s

Check for duplicates against existing vault entries. Matches by lowercase (issuer + name) pair. Returns info about each duplicate found. # Errors R

Generate a random password of the given `length` using the specified charsets. At least one character from each enabled charset is guaranteed. The re

Import entries, folders, and attachments from a `.verrou` file. # Flow 1. Re-decrypt the import file (stateless re-parse) 2. Create a backup of the

Build a TOTP entry JSON value.

Build a single TOTP service JSON value.

Return the current UTC time as an ISO 8601 string. Uses `std::time::SystemTime` to avoid pulling in `chrono`.