# kestrove-core

Rust workspace that holds **all** Kestrove crypto and vault logic. Apple,
Android and desktop apps call it through UniFFI. The server uses only `kv-proto`.

| Crate | Status | Purpose |
|---|---|---|
| `kv-proto` | ✅ M0 | Wire types (Envelope, KDF params, API bodies). No secrets. |
| `kv-crypto` | ✅ M0 | 2SKD (Argon2id + Secret Key), XChaCha20-Poly1305 envelopes, HPKE vault-key sealing, keyset, Ed25519, Secret Key format |
| `kv-model` | ✅ M0 | Items, URL matching (PSL), TOTP (RFC 6238), password generator |
| `kv-ffi` | ✅ M0 (in-memory) | The exported API (`VaultCore`, `totp_code`, `match_url`, `generate_password`) |
| `kv-store` | 🔜 M1 | SQLite replica (ciphertext only) |
| `kv-sync` | 🔜 M1 | OPAQUE login, RFC 9421 signing, pull/push/merge, signed manifest |

Spec: `../kestrove-spec/docs/02-cryptography.md` and `03-sync-protocol.md`.

## Setup

```bash
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh   # once
cargo test --workspace
```

## Bindings

```bash
./scripts/build-apple.sh     # → ../kestrove-apple/Packages/KestroveCore (XCFramework + Swift)
./scripts/build-android.sh   # → ../kestrove-android/core-ffi (jniLibs + Kotlin); needs cargo-ndk
```

The desktop (Tauri) app depends on `kv-ffi` directly as a Rust crate.

## Rules
* No `unsafe` outside generated FFI glue.
* Secrets live in `Zeroizing<_>`. Never log, `Debug`-print or `format!` a secret.
* Any change to formats needs a spec change first and new vectors in `kestrove-spec/vectors`.
* `cargo deny check` must pass. There are no GPL dependencies (App Store).