internal/

Package archive bundles a directory of static files into a single byte stream (so it can be encrypted as one blob) and extracts it back into memory.

Package blob handles the on-disk container: appending an opaque payload to a stub binary and reading it back from the running executable, plus the byte framing of the vault and warden payloads.

Package builtin embeds the build-time assets that only vaultwright needs: the BIP39 wordlist, the host's precompiled vault/warden stubs, and the SHA-256 manifest used to verify downloaded stubs.

Package cryptocore holds the cryptographic primitives for vaultwright: password hardening, the per-seal key hierarchy, the authenticated-encryption envelope, and the fresh ephemeral challenge-response handshake.

Package prompt provides the small interactive bits the vault and warden commands share: a no-echo password reader and a word-phrase reader.

Package scheme orchestrates the cryptocore primitives, blob framing, archiving, and word codec into the two high-level operations: sealing a directory into a vault+warden pair, and the unlock handshake.

Package serve exposes the decrypted, in-memory files over loopback HTTP.

Package stubs resolves a vault/warden stub for a target platform, in priority order: an explicit stub directory, the stubs embedded in vaultwright, the local cache, then an on-demand download verified against the embedded SHA-256 manifest (the trust root).

Package wordcodec encodes byte strings as BIP39 word phrases and back, with the standard BIP39 checksum.