pastilhasandClaude Opus 5 b442084618 document the wallet key custody model
covers both encryption layers, what each one does and does not protect
against, the watch-only-while-locked property and the unlock session
rules. records the known limits: the heap cannot be reliably wiped, the
storage key is derived with a plain sha-256 rather than a kdf, and
rotating VAULT_STORE_KEY has no migration path.

also corrects the changePassphrase doc comment, which claimed rotation
never touches the dek. it mints a fresh salt, dek and ivs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-31 07:09:03 +00:00
2026-07-31 07:09:03 +00:00
2026-02-16 19:34:35 +00:00
2026-02-16 19:34:35 +00:00
2026-07-31 06:48:06 +00:00
2026-02-16 19:34:35 +00:00
2026-07-30 20:34:55 +00:00
2026-02-16 19:34:35 +00:00
2026-02-16 19:34:35 +00:00
2026-02-16 19:34:35 +00:00
2026-02-22 03:35:26 +00:00
2026-02-16 19:34:35 +00:00
2026-02-20 12:35:47 +00:00
2026-02-20 12:35:47 +00:00
2026-02-16 19:34:35 +00:00
2026-02-25 16:04:11 +00:00
2026-02-16 19:34:35 +00:00
2026-07-30 17:09:19 +00:00
S
Description
No description provided
42 MiB
Languages
TypeScript 90.9%
Shell 4.7%
JavaScript 4.1%
CSS 0.2%
HTML 0.1%