Create and unlock a vault, returning the DB connection and master key.

Reassemble decrypted chunks into the original payload. Chunks are provided as `(chunk_index, plaintext)` pairs and are sorted by index. Returns the c

Benchmark the current hardware and return achievable Argon2id presets. First finds the achievable memory ceiling (512 MB → 256 MB → 128 MB) by trial

Change the master password from the Settings screen. The vault must be unlocked. The user re-authenticates with their current password (using `sensit

Decode a hex-encoded string to bytes.

Extract an issuer from a 2FAS service entry. Priority: `otp.issuer` → `name` (if different from extracted name) → None.

Flush microtasks + delay for getEntry() mock delay + crypto.subtle to resolve.

Generate a transfer key and verification phrase. Returns `(TransferKey, phrase)` where `phrase` is 4 space-separated EFF diceware words (~51 bits of

Return a reference to the session's hybrid KEM keypair. The keypair is deterministically derived from the master key and can be used for encapsulatio

List available vault backups, sorted newest first. Scans `{vault_dir}/backups/` for `.verrou` files matching the `vault-{timestamp}.verrou` pattern a

Parse an encrypted Aegis JSON vault export. Decrypts using the Aegis encryption scheme: 1. scrypt KDF to derive slot key from password 2. AES-256-GCM

Persist an updated header to the `.verrou` file.

Read a CSS file relative to src/styles/

Persist preferences to `{data_dir}/preferences.json`. Uses an atomic write pattern (write to `.tmp`, then rename) to prevent corruption from partial

Create + unlock a vault in `dir`, returning the open database.

Return a reference to the session's hybrid signing keypair. The keypair is deterministically derived from the master key and can be used for signing

Simulate the `update_recovery_codes` index adjustment algorithm. Removes codes at given indexes (highest-first), adjusts used indexes.

Update the tray icon, menu, and tooltip to reflect vault lock state. Called after vault lock/unlock operations to keep the tray in sync.

Build an encrypted 2FAS backup with known content for testing.

Build an encrypted Aegis vault with known content for testing.

Build a full, signed envelope around a given inner blob using a master-key-derived KEM + signing keypair (mirrors the real export flow).

Check if brute-force cooldown is active. Returns `Some(remaining_ms)` if the user must wait, or `None` if they can proceed.

Create a timestamped backup of both `.verrou` and `.db` files. Copies `vault.verrou` → `backups/vault-{timestamp}.verrou` and `vault.db` → `backups/v

Create a new folder, optionally nested under `parent_id`. The folder is appended after its existing siblings (sort order = current sibling max + 1),

Decrypt a QR transfer chunk. Parses the wire format, verifies the authentication tag, and returns `(chunk_index, total_chunks, plaintext)`. # Errors

Extract an issuer from an Aegis entry.

Extract a display name from an Aegis entry.

Generate a random biometric enrollment token. During enrollment, a random 32-byte secret is generated and stored in the OS keychain with biometric ac

The gate logic used inside `get_entry`: `SeedPhrase` and `RecoveryCode` entries must return an empty secret; all other types must still return the sec

Get the entry type for an entry without decrypting its data. Lightweight query for when only the type discriminator is needed (e.g., to construct the

Extract the inner `vault_format` blob from a PQ export envelope. Export now wraps the raw `vault_format` blob in a `VRENV1` envelope; tests that insp

Current cursor offset (used to delimit the signed portion).

Read a u32 from `data` at `cursor` in little-endian order, advancing `cursor`.

Recover the master key from export .verrou bytes using a password.

Serialize selected entries for transfer. Fetches and decrypts each entry, resolves folder IDs to names, builds a `TransferPayload` with a BLAKE3 chec

Generate a recovery key and add a recovery slot to the vault. Performs: 1. Generate 128-bit random entropy (CSPRNG) 2. Encode as human-readable strin

Build the **signed portion** of the envelope: `MAGIC | VERSION | fields | inner`. This is the exact byte sequence that must be signed and, at import

Signal the background thread to stop.

Clear the clipboard. # Errors Returns an error string if the clipboard clear fails.

Create a temporary vault and return the directory path.

Get the current time as seconds since Unix epoch.

Flush microtasks + small delay for crypto.subtle (live TOTP) to resolve.

Helper: compute HKDF-SHA256(ikm, empty salt, info).

Validate 4 space-separated words.

List attachment metadata for an entry (no encrypted content). Returns metadata only — the BLOB column is not read. # Errors Returns [`VaultError::D