Unlock an existing vault with a recovery key. Follows the same ceremony as [`unlock_vault`] but uses a recovery slot instead of a password slot, and

Delete an entry by ID. Permanently removes the entry from the database. Confirmation is handled at the IPC caller level (frontend), not here. # Erro

Derive a 256-bit wrapping key from a hardware security token via HKDF-SHA256. The token is typically a random 32-byte secret stored in a hardware sec

Flush microtasks + small delay for crypto.subtle to resolve.

Resolve the application data directory. This is the root directory that contains all VERROU runtime files. # Platform paths - macOS: `~/Library/App

Build the `EntryData` variant from the entry type and secret string. Validates that the secret format is appropriate for the entry type: - TOTP/HOTP:

Find an input element by its associated label text

Build a minimal valid plaintext Aegis vault JSON.

Generate a random 32-byte key from `OsRng`.

Build a test-friendly `CalibratedPresets` with minimal memory.

Add a biometric slot to an existing vault. Creates a biometric `KeySlot` wrapping the master key with a key derived from the biometric token via HKDF

Decode a human-readable recovery key string back to raw entropy bytes. Accepts: - Uppercase or lowercase input - With or without dashes - Leading/tra

Parse a Google Authenticator migration URI. URI format: `otpauth-migration://offline?data=<url-encoded-base64>` # Errors Returns `ImportError::Inva

Open the re-auth prompt, enter a password and submit it (drives a real reveal).

Create a test header with 3 slots (one per type).

Validate and preview a `.verrou` import file. Decrypts the file (envelope or legacy raw format), checks format version compatibility, and detects dup

Resolve the path to the vault header file (`vault.verrou`). This file contains the encrypted master-key slots and KDF parameters. Its existence is us

* Run a body inside a Solid reactive root and dispose afterwards, returning the * disposer so tests can assert cleanup behavior explicitly.

Build a protobuf payload from OTP parameters.

Derive an entry-specific AES-256-GCM key for attachment encryption. Uses BLAKE3 in KDF mode with the master key as input keying material and a contex

Export the entire vault as an encrypted `.verrou` file wrapped in a post-quantum (`PQ-B`) envelope. # Flow 1. Re-authenticate by verifying the passw

Generate a passphrase from the EFF large diceware wordlist. # Arguments `word_count` — Number of words (clamped to [`MIN_WORD_COUNT`]..=[`MAX_WORD_C

Generate a UUIDv4-like string using `OsRng`. Format: `xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx` where x is random hex and y is one of `{8, 9, a, b}`.

Parse an encrypted 2FAS JSON backup export. Decrypts using the 2FAS encryption scheme: 1. PBKDF2-HMAC-SHA256 to derive key from password (10,000 iter

* Drive the re-auth gate: wait for the prompt, enter a password, submit. * The export content (URI + QR) only appears after this succeeds.

Update an existing entry. Only fields present in `updates` are changed. If `updates.data` is `Some`, the entry data is re-encrypted. The `updated_at`

Encrypt a data chunk for QR transfer. Wire format of the output: ```text [2B chunk_index BE] [2B total_chunks BE] [12B nonce] [NB ciphertext] [16B ta

Extract all CSS custom property declarations (--name: value) from text

* Find a button by its text content (partial match).

Find an input element by its associated label text

Recursively extract all leaf keys from a nested object.

Helper: show backup list, select first item, click restore button, then return the modal confirm button

Parse a single `OtpParameters` into a categorized result.

Generate a random 32-byte key from `OsRng`.

Simulate the toggle logic: if index is in `used`, remove it; otherwise add it.

Unlock an existing vault with a biometric token. Follows the same ceremony as [`unlock_vault`] but: - Uses a biometric slot instead of a password slo

Calibrate Argon2id parameters against the current hardware. Delegates to [`kdf::calibrate`] and returns the result. The caller presents all 3 presets

Cancel the currently scheduled auto-clear timer, if any.

Split payload data into chunks of at most `max_chunk_size` bytes. Each chunk is a standalone `Vec<u8>` suitable for individual encryption via [`encry

Combine two 32-byte shared secrets via HKDF-SHA256 with domain separation. Input: `x25519_ss (32 bytes) || ml_kem_ss (32 bytes)` = 64 bytes IKM. Salt

Constant-time comparison for key material. Prevents timing side-channels when verifying recovered keys. The early return on length mismatch is accept

Extract a display name from a 2FAS service entry. Priority: `otp.account` → `name` → "(unnamed)".

* Find an input element by placeholder.

Import entries from a transfer payload. Deserializes the JSON payload, verifies the BLAKE3 checksum, resolves (or creates) folders by name, and inser

List all folders with their entry counts. Returns folders sorted by `sort_order`, then name. # Errors Returns [`VaultError::Database`] if the query