94681289e6
OpenPay (1 crate, ~2287 LOC, 15 tests)
op-dispute-evidence Chargeback lifecycle + evidence packaging across Visa
VCR (10.x/11.x/12.x/13.x), Mastercard Mastercom
(4837/4853/1240/1442), Amex SafeKey + DRR, Discover DRR,
PayPal. CE3.0 compelling-evidence qualifier (120-365d
window, ≥2 qualifiers, ≥2 linking matches, 10.4-only).
Phase state machine + ReasonCodeCatalog + sealed
EvidencePackageBuilder + win-rate scoring.
Smart Byte (1 crate, ~2479 LOC, 44 tests)
smart-byte-edv Encrypted Data Vaults (DIF v0.10).
JWE ECDH-ES P-256 + HKDF-SHA256-Concat-KDF + AES-256-GCM,
multi-recipient; HMAC-SHA-256 encrypted index with
AND-equality queries; full ZCAP-LD chain validation;
chunked AES-256-GCM streaming with per-chunk AAD;
Vault trait + InMemoryVault + one-way pull replication.
EOC (1 crate, ~2065 LOC, 29 tests)
eoc-agent Agentic loops with per-step joule accounting.
ReAct, Reflexion (PASS/FAIL judge + episodic memory),
Tree of Thoughts (BFS/DFS + self-scoring), LATS
(MCTS-UCT select/expand/simulate/backprop),
Plan-and-Execute, CodeAct (fenced-block + pluggable
runtime). Budget enforcement (tokens/joules/tool-calls),
trace spans, JouleCounter integration.
Three other batch-5 deferrals (op-ewallets-asia, smart-byte-zk, eoc-rag)
will land in wave A3.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
64 lines
2.5 KiB
Rust
64 lines
2.5 KiB
Rust
//! Encrypted Data Vaults for Smart Byte.
|
|
//!
|
|
//! This crate ingests the DIF Encrypted Data Vaults (EDV) specification
|
|
//! v0.10 — <https://identity.foundation/edv-spec/> — and provides a
|
|
//! pure-Rust reference implementation. An EDV is a *zero-knowledge*
|
|
//! storage substrate: the vault operator holds ciphertext only and
|
|
//! cannot read the documents it stores, yet can still serve equality
|
|
//! lookups (via HMAC-blinded indexes) and enforce delegated access (via
|
|
//! ZCAP-LD capability chains).
|
|
//!
|
|
//! ## Modules
|
|
//!
|
|
//! * [`spec`] — DIF EDV v0.10 wire types (`EncryptedDocument`, `Config`,
|
|
//! `Provider`, `Hmac`, `Stream`).
|
|
//! * [`jwe`] — JWE wrap/unwrap. Key agreement: **ECDH-ES** over **P-256**
|
|
//! (RFC 7518 § 4.6) with HKDF-SHA-256 Concat-KDF. Content encryption:
|
|
//! **AES-256-GCM** (RFC 7518 § 5.3).
|
|
//! * [`vault`] — [`vault::Vault`] async trait plus
|
|
//! [`vault::InMemoryVault`], the in-memory reference implementation.
|
|
//! * [`index`] — HMAC-over-value encrypted indexes (DIF EDV v0.10 § 4.4),
|
|
//! so the vault can answer equality queries on attribute values it
|
|
//! cannot read.
|
|
//! * [`zcap`] — ZCAP-LD capability chains, the delegation model EDV uses
|
|
//! for authorisation.
|
|
//! * [`stream`] — chunked stream encryption for payloads too large to
|
|
//! seal in a single AEAD call.
|
|
//! * [`replication`] — one-way pull replication between two vaults.
|
|
//! * [`error`] — typed errors.
|
|
//!
|
|
//! ## Cryptographic profile
|
|
//!
|
|
//! | Layer | Primitive | Crate |
|
|
//! |-------|-----------|-------|
|
|
//! | Content encryption | AES-256-GCM | `aes-gcm` |
|
|
//! | Key agreement | ECDH-ES over P-256 | `p256` |
|
|
//! | Key derivation | HKDF-SHA-256 (Concat-KDF framing) | `hkdf`, `sha2` |
|
|
//! | Index HMAC | HMAC-SHA-256 | `hmac`, `sha2` |
|
|
//!
|
|
//! All cryptography is pure Rust; no `unsafe` and no platform crypto
|
|
//! dependencies.
|
|
|
|
#![forbid(unsafe_code)]
|
|
#![deny(missing_docs)]
|
|
|
|
pub mod error;
|
|
pub mod index;
|
|
pub mod jwe;
|
|
pub mod replication;
|
|
pub mod spec;
|
|
pub mod stream;
|
|
pub mod vault;
|
|
pub mod zcap;
|
|
|
|
pub use error::EdvError;
|
|
pub use index::{IndexKey, Query, search};
|
|
pub use jwe::{Jwe, KeyPair, PrivateKey, Recipient, unwrap, wrap};
|
|
pub use replication::{PullReplicator, ReplicationReport, Replicator, sync};
|
|
pub use spec::{
|
|
Config, EncryptedDocument, Hmac, IndexedAttribute, IndexedEntry,
|
|
KeyDescriptor, Provider, Stream,
|
|
};
|
|
pub use stream::{StreamChunk, StreamManifest, open as stream_open, seal as stream_seal};
|
|
pub use vault::{DocumentRef, InMemoryVault, Vault};
|
|
pub use zcap::{Capability, Invocation, verify_chain};
|