confium_store/lib.rs
1//! Confium Store: compartmentalized key/secret persistence.
2//!
3//! Two compartments per `(module_id, app_id)` pair:
4//!
5//! - **Public** — distributed, identity-indexed, signed
6//! - **Private** — per-device, key-id-indexed, optionally hardware-backed
7//!
8//! Backends ship in-tree and register at link time via
9//! [`register_backend!`]:
10//!
11//! - `memory` — in-process HashMap (dev / test)
12//! - `filesystem` — RFC 9580 keyring files (stub, pending `keyfmt`)
13//! - `pkcs11`, `tpm`, `cloud-kms` — future, separate plugin repos
14//!
15//! See `TODO.finalize/12-keystore-interface.md` for the FFI design and
16//! `TODO.roadmap/01-architecture-overview.md` for the pillar context.
17
18// FFI entry points accept raw pointers and null-check them before
19// dereferencing; they are not `unsafe` from the C caller's perspective.
20#![allow(clippy::not_unsafe_ptr_arg_deref)]
21#![allow(rustdoc::broken_intra_doc_links)]
22#![allow(rustdoc::bare_urls)]
23#![allow(rustdoc::redundant_explicit_links)]
24#![allow(rustdoc::private_intra_doc_links)]
25#![allow(rustdoc::invalid_html_tags)]
26
27pub mod backend;
28pub mod backends;
29pub mod error;
30pub mod ffi;
31pub mod identity;
32pub mod keystore;
33
34pub use backend::{Compartment, Options, StoreBackend, StoreInstance};
35pub use error::{Error, ErrorCode, Result};
36pub use identity::Identity;
37pub use keystore::Keystore;