confium 0.6.1 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d42dc62222d0c92dfa68876099cbac875766094cd9220c4ec10d5b6f605cd09
-  data.tar.gz: 940eae5a8b8e090a5a1638885dc3bc3b4c9663deaa084dfed0852064432ee141
+  metadata.gz: '0739c3bc2fd3d3d347fd283d19bb70b9bd1611cd262c4d6229b80828d67b441c'
+  data.tar.gz: ae757155d9a5312662d44ac21d740c68228b2e8ad011c178e168969b2563d068
 SHA512:
-  metadata.gz: 04b73aaa3d4adf174c0c36af482de3b64d0e8ecaca91793a7996c04a50f78e8778189958697e4dc9a813f82d65c39ed36465871972584f03b509e3129c9242ef
-  data.tar.gz: 0f2ee3e4d4d51958e278733bd3c7ee8160b9fea55d2073ca23ec88c321923c768469be5517d690b94d9308f8a85301389310c7591fbed934ee66d4a893c22f2c
+  metadata.gz: d17228e2f724d28a2481bd6c115cdec90f8955b346c7f72a22b0217d78f5365bbcb61930d08662562c1f9e4ec8b05eeb8dc73c63b30f902dbe27ede051fa9408
+  data.tar.gz: 7780ff8ceff7791de1bca7e5dc7e15215db6886eec4cd6d01dbc75b0fa8d04c7d0350234bd33f8d5dfd94587b532c088246c59a28e7edd99ad3fb077ed7d8d34

data/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.6.2] — 2026-08-26
+
+### Added
+
+- `Confium::Store::Keystore` — Ruby surface for the store layer and
+  the sign-with-handle contract: `.new(backend, options)`,
+  `#sign(key_id, algorithm, message)` returning binary signature
+  bytes, plus `Confium::Store.backends`. Local backends raise a
+  typed `Confium::Error` for `#sign`; remote-holding backends (cloud
+  KMS) come via source builds that opt into their cargo features
+  (confium-store 0.5.8). `Confium::Error` now also accepts the
+  positional details-Hash form every typed subclass already accepts,
+  so native-constructed base errors carry `details` too.
+
 ## [0.6.1] — 2026-08-25
 
 ### Changed

data/Cargo.lock

@@ -79,6 +79,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.23.1"
@@ -245,6 +251,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "confium-api"
 version = "0.3.0"
@@ -273,7 +285,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "317ed25adf9a1aad00722a215c3397dea694fcdf90730542e82acdea559644aa"
 dependencies = [
  "ed25519-dalek",
- "p256",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -290,15 +302,15 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
- "confium-tc-core",
+ "confium-store 0.3.0",
+ "confium-tc-core 0.3.0",
  "data-encoding",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "inventory",
  "num-bigint",
  "num-traits",
- "p256",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -330,11 +342,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19bea8bcb5a76b88ccca2471352176ea234e86c1360982f4a1d7357c2f89ab73"
 dependencies = [
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "num-bigint",
  "num-integer",
  "num-traits",
- "p256",
+ "p256 0.13.2",
  "rand",
  "rand_core 0.6.4",
  "serde",
@@ -351,10 +363,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f65c763c1e55aee550db1ba49ba0b97fbfd8373766e4ca48d9ca742897c82f34"
 dependencies = [
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "num-bigint",
  "num-traits",
- "p256",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -409,7 +421,7 @@ checksum = "767f898b6437a5cc67d403140bcf8cd1dbffa35a450afe28c64147e3175ee091"
 dependencies = [
  "chrono",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -440,10 +452,10 @@ checksum = "6dcbe8f16e42291a63bcc480745653aa1ad993982fb708531778270de9677dd9"
 dependencies = [
  "chrono",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "num-bigint",
  "num-traits",
- "p256",
+ "p256 0.13.2",
  "rand",
  "rand_core 0.6.4",
  "serde",
@@ -463,6 +475,16 @@ dependencies = [
  "snafu 0.8.9",
 ]
 
+[[package]]
+name = "confium-store"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5559e7f26bcf9f6dd3a76cf7eb0cf0684966c504cf662efef14f69ade8103e26"
+dependencies = [
+ "inventory",
+ "snafu 0.9.2",
+]
+
 [[package]]
 name = "confium-tc"
 version = "0.3.1"
@@ -473,17 +495,17 @@ dependencies = [
  "confium-api",
  "confium-coordinator",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "confium-tc-keys",
  "data-encoding",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "inventory",
  "num-bigint",
  "num-integer",
  "num-prime",
  "num-traits",
- "p256",
+ "p256 0.13.2",
  "rand",
  "rand_core 0.6.4",
  "serde",
@@ -497,24 +519,42 @@ dependencies = [
 ]
 
 [[package]]
-name = "confium-tc-cmp20"
-version = "0.3.1"
+name = "confium-tc"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f28758121e44a86beefdf54a63428ab9bd9ec7a3797f7c065351b876518815c"
+checksum = "940d14f99d311c76e38500126059e2f1f027628657d0615d5bc78422618c83ee"
 dependencies = [
- "confium-tc",
- "confium-tc-core",
- "crypto-bigint",
- "elliptic-curve",
- "hex",
+ "chrono",
+ "confium-tc-core 0.4.7",
+ "hmac 0.12.1",
  "inventory",
  "num-bigint",
  "num-integer",
  "num-traits",
- "p256",
- "rand",
+ "rand_core 0.6.4",
+ "serde",
+ "serde_json",
  "sha2 0.10.9",
  "snafu 0.8.9",
+ "thiserror 1.0.69",
+ "zeroize",
+]
+
+[[package]]
+name = "confium-tc-cmp20"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58d95093a36282370c3920cc0453f080d3e567afaa340063f44b3dbe1a60bca5"
+dependencies = [
+ "confium-tc 0.4.7",
+ "crypto-bigint 0.7.5",
+ "elliptic-curve 0.14.1",
+ "getrandom 0.4.3",
+ "inventory",
+ "num-bigint",
+ "p256 0.14.0",
+ "rand",
+ "sha2 0.10.9",
  "zeroize",
 ]
 
@@ -527,12 +567,12 @@ dependencies = [
  "chrono",
  "confium-api",
  "confium-net",
- "confium-store",
+ "confium-store 0.3.0",
  "data-encoding",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "inventory",
- "p256",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -545,48 +585,80 @@ dependencies = [
 ]
 
 [[package]]
-name = "confium-tc-elgamal-p256"
-version = "0.3.0"
+name = "confium-tc-core"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "113058b4f2c468c2b3e8c218e88bd43aa282af99c121936ae0bb73d9051371a8"
+checksum = "0b09f89b929f19bef0267ea94520cdf86a57f2eb71bf409171d71f6f6e2f98f9"
 dependencies = [
- "elliptic-curve",
- "p256",
+ "chrono",
+ "getrandom 0.4.3",
+ "hex",
+ "hmac 0.12.1",
+ "inventory",
+ "p256 0.14.0",
+ "rand_core 0.6.4",
  "serde",
+ "serde_json",
  "sha2 0.10.9",
+ "snafu 0.8.9",
+ "subtle",
  "thiserror 1.0.69",
+ "zeroize",
 ]
 
 [[package]]
-name = "confium-tc-frost-p256"
-version = "0.3.0"
+name = "confium-tc-elgamal-p256"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7da5dc941047eb374b15ee3a31e78df1a07036a95aab48b134ee2c3d86b621d"
+checksum = "fec4a5bdef07e17ae0ae0098fd761166c8bb1586f22117bb64e7ea09c1883559"
 dependencies = [
- "elliptic-curve",
- "hex",
- "p256",
- "rand_core 0.6.4",
+ "getrandom 0.4.3",
+ "p256 0.14.0",
  "serde",
+ "thiserror 1.0.69",
+ "zeroize",
+]
+
+[[package]]
+name = "confium-tc-frost-ed25519"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58987257f0358c9689b90ea63f4dad4c7902e6a446e3fbcb531fa2d9f69f0eef"
+dependencies = [
+ "confium-tc 0.4.7",
+ "curve25519-dalek",
+ "inventory",
+ "rand_core 0.6.4",
  "sha2 0.10.9",
+ "snafu 0.8.9",
+]
+
+[[package]]
+name = "confium-tc-frost-p256"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bddf1ab23eb1cfd9d8d6823c5e473a9392a30b6e12cf4889c44612508f865d9"
+dependencies = [
+ "elliptic-curve 0.14.1",
+ "getrandom 0.4.3",
+ "p256 0.14.0",
  "thiserror 1.0.69",
+ "zeroize",
 ]
 
 [[package]]
 name = "confium-tc-gg18"
-version = "0.3.1"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5e3522da6c2352ff26f1a0719781e8f392cdfb7c264c681c87d0f0207540384"
+checksum = "45894d305019521a9960dfda5a8ba9d4f7b2b10d9a874905780d75e3d14d264f"
 dependencies = [
- "confium-tc",
- "confium-tc-core",
- "crypto-bigint",
- "elliptic-curve",
- "hex",
+ "confium-tc 0.4.7",
+ "crypto-bigint 0.7.5",
+ "elliptic-curve 0.14.1",
+ "getrandom 0.4.3",
  "inventory",
- "p256",
+ "p256 0.14.0",
  "sha2 0.10.9",
- "snafu 0.8.9",
  "zeroize",
 ]
 
@@ -597,10 +669,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "476fce2efcefa4d7a48cfe5accecd1bc3f39959b5ea719fdedac9cfcbfeeb710"
 dependencies = [
  "chrono",
- "confium-tc-core",
+ "confium-tc-core 0.3.0",
  "hex",
- "hmac",
- "p256",
+ "hmac 0.12.1",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "serde",
  "serde_json",
@@ -638,17 +710,20 @@ dependencies = [
  "confium-observability",
  "confium-pki",
  "confium-privacy",
- "confium-tc",
+ "confium-store 0.5.8",
+ "confium-tc 0.3.1",
  "confium-tc-cmp20",
- "confium-tc-core",
+ "confium-tc-core 0.3.0",
+ "confium-tc-core 0.4.7",
  "confium-tc-elgamal-p256",
+ "confium-tc-frost-ed25519",
  "confium-tc-frost-p256",
  "confium-tc-gg18",
  "confium-transparency",
  "ed25519-dalek",
  "hex",
  "magnus",
- "p256",
+ "p256 0.13.2",
  "rand_core 0.6.4",
  "rb-sys",
  "rnp-rs",
@@ -675,6 +750,12 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -729,6 +810,22 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -746,7 +843,9 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -758,6 +857,16 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+ "subtle",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -769,6 +878,7 @@ dependencies = [
  "curve25519-dalek-derive",
  "digest 0.10.7",
  "fiat-crypto",
+ "rand_core 0.6.4",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -847,6 +957,7 @@ dependencies = [
  "block-buffer 0.12.1",
  "const-oid 0.10.2",
  "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -868,20 +979,35 @@ checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der 0.7.10",
  "digest 0.10.7",
- "elliptic-curve",
- "rfc6979",
- "serdect",
+ "elliptic-curve 0.13.8",
+ "rfc6979 0.4.0",
  "signature 2.2.0",
  "spki 0.7.3",
 ]
 
+[[package]]
+name = "ecdsa"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
+dependencies = [
+ "der 0.8.1",
+ "digest 0.11.3",
+ "elliptic-curve 0.14.1",
+ "rfc6979 0.6.0",
+ "serdect",
+ "signature 3.0.0",
+ "spki 0.8.0",
+ "zeroize",
+]
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
+ "pkcs8 0.10.2",
  "signature 2.2.0",
 ]
 
@@ -912,16 +1038,37 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
- "crypto-bigint",
+ "base16ct 0.2.0",
+ "crypto-bigint 0.5.5",
  "digest 0.10.7",
- "ff",
+ "ff 0.13.1",
  "generic-array",
- "group",
+ "group 0.13.0",
  "pem-rfc7468 0.7.0",
- "pkcs8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "sec1",
+ "sec1 0.7.3",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
+dependencies = [
+ "base16ct 1.0.0",
+ "crypto-bigint 0.7.5",
+ "crypto-common 0.2.2",
+ "digest 0.11.3",
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+ "pem-rfc7468 1.0.0",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
+ "sec1 0.8.1",
  "serdect",
  "subtle",
  "zeroize",
@@ -953,6 +1100,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "ff"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
@@ -1058,6 +1215,18 @@ dependencies = [
  "wasi",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ghash"
 version = "0.5.1"
@@ -1080,11 +1249,22 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff",
+ "ff 0.13.1",
  "rand_core 0.6.4",
  "subtle",
 ]
 
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
@@ -1123,6 +1303,15 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -1145,7 +1334,9 @@ version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
 dependencies = [
+ "subtle",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -1518,13 +1709,26 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "serdect",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
+dependencies = [
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.1",
+ "primefield",
+ "primeorder 0.14.0",
+ "serdect",
+ "sha2 0.11.0",
+]
+
 [[package]]
 name = "pem-rfc7468"
 version = "0.7.0"
@@ -1565,6 +1769,16 @@ dependencies = [
  "spki 0.7.3",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.1",
+ "spki 0.8.0",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.34"
@@ -1611,14 +1825,40 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "primefield"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
+dependencies = [
+ "crypto-bigint 0.7.5",
+ "crypto-common 0.2.2",
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
+dependencies = [
+ "elliptic-curve 0.14.1",
+ "once_cell",
+ "primefield",
  "serdect",
+ "wnaf",
 ]
 
 [[package]]
@@ -1639,6 +1879,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "radium"
 version = "0.7.0"
@@ -1672,7 +1918,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
@@ -1746,10 +1992,20 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
  "subtle",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
+dependencies = [
+ "crypto-bigint 0.7.5",
+ "hmac 0.13.0",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -1758,7 +2014,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -1864,10 +2120,24 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "der 0.7.10",
  "generic-array",
- "pkcs8",
+ "pkcs8 0.10.2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct 1.0.0",
+ "ctutils",
+ "der 0.8.1",
+ "hybrid-array",
  "serdect",
  "subtle",
  "zeroize",
@@ -1939,11 +2209,11 @@ dependencies = [
 
 [[package]]
 name = "serdect"
-version = "0.2.0"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
 dependencies = [
- "base16ct",
+ "base16ct 1.0.0",
  "serde",
 ]
 
@@ -2014,6 +2284,7 @@ version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 dependencies = [
+ "digest 0.11.3",
  "rand_core 0.10.1",
 ]
 
@@ -2599,6 +2870,17 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "wnaf"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab12e7090f27e2ffd9322651492942d50c2926094af30601e1964337db39daf1"
+dependencies = [
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+]
+
 [[package]]
 name = "writeable"
 version = "0.6.3"

data/ext/confium_native/Cargo.toml

@@ -37,12 +37,18 @@ confium-transparency = "0.4"
 confium-composite = "0.3.1"
 confium-attributes = "0.3.1"
 confium-pki = "0.5.6"
+confium-store = "0.5.8"
 confium-deployment = "0.3"
 confium-tc = "0.3.1"
-confium-tc-frost-p256 = "0.3"
-confium-tc-elgamal-p256 = "0.3"
-confium-tc-cmp20 = "0.3.1"
-confium-tc-gg18 = "0.3.1"
+confium-tc-frost-p256 = "0.4"
+confium-tc-elgamal-p256 = "0.4"
+confium-tc-cmp20 = "0.4"
+confium-tc-gg18 = "0.4"
+
+# Per-party session protocol: the tc-core 0.4 registry line. The 0.3-era
+# in-process drivers above keep their own registry harmlessly.
+confium-tc-session = { package = "confium-tc-core", version = "0.4.7" }
+confium-tc-frost-ed25519 = "0.4.7"
 
 # Newly published shared crypto crates (confium product restructuring).
 confium-tc-core = "0.3"

data/ext/confium_native/src/lib.rs

@@ -12,7 +12,9 @@ mod ers;
 mod openpgp_verify;
 mod path;
 mod pki;
+mod store;
 mod tc;
+mod tc_session;
 mod transparency;
 mod util;
 
@@ -49,9 +51,11 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     composite::init(ruby, confium)?;
     attributes::init(ruby, confium)?;
     pki::init(ruby, confium)?;
+    store::init(ruby, confium)?;
     path::init(ruby, confium)?;
     deployment::init(ruby, confium)?;
     tc::init(ruby, confium)?;
+    tc_session::init(ruby, confium)?;
     audit::init(ruby, confium)?;
     ers::init(ruby, confium)?;
     Ok(())

data/ext/confium_native/src/store.rs

@@ -0,0 +1,108 @@
+//! Confium::Store — Ruby surface for `confium_store`.
+//!
+//! `Confium::Store::Keystore` opens a keystore by backend wire name
+//! (`"memory"`, plus the remote-holding backends when the extension is
+//! built with their features) and exposes the remote-sign path added
+//! by the sign-with-handle contract:
+//!
+//!   ks = Confium::Store::Keystore.new("memory")
+//!   ks.sign(key_id, algorithm, message)  # => binary String
+//!
+//! Local backends raise for `#sign` — remote signing is implemented by
+//! the cloud KMS backends (`aws-kms`, `gcp-kms`, `azure-keyvault`),
+//! which source builds opt into via cargo features.
+
+use confium_store::Keystore as RustKeystore;
+use magnus::{
+    function, method, prelude::*, DataTypeFunctions, Error, Module, RHash, Ruby, TryConvert,
+    TypedData, Value,
+};
+
+use crate::util::{bytes_from_value, bytes_to_rstring, confium_error, new_details};
+
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::Store::Keystore", size)]
+pub struct Keystore {
+    inner: std::cell::RefCell<RustKeystore>,
+}
+
+fn store_error(e: confium_store::error::Error, operation: &str) -> Error {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return Error::new(magnus::exception::runtime_error(), e.to_string()),
+    };
+    let details = new_details(&ruby);
+    let _ = details.aset("operation", operation);
+    match &e {
+        confium_store::error::Error::NotImplemented { what } => {
+            let _ = details.aset("what", *what);
+        }
+        confium_store::error::Error::UnknownBackend { name } => {
+            let _ = details.aset("backend", name.as_str());
+        }
+        _ => {}
+    }
+    confium_error(e.to_string(), "Error", details)
+}
+
+impl Keystore {
+    fn initialize(ruby: &Ruby, args: &[Value]) -> Result<Self, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String,), (Option<RHash>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let backend = scanned.required.0;
+        let mut options = confium_store::backend::Options::new();
+        if let Some(hash) = scanned.optional.0 {
+            hash.foreach(|k: Value, v: Value| {
+                let key: String = <String as TryConvert>::try_convert(k)?;
+                let value: String = <String as TryConvert>::try_convert(v)?;
+                options.insert(key, value);
+                Ok(magnus::r_hash::ForEach::Continue)
+            })?;
+        }
+        let inner =
+            RustKeystore::new(&backend, &options).map_err(|e| store_error(e, "Keystore.new"))?;
+        let _ = ruby;
+        Ok(Self {
+            inner: std::cell::RefCell::new(inner),
+        })
+    }
+
+    /// Sign `message` with the remotely-held key `key_id` under the
+    /// provider algorithm name. Returns binary String signature bytes.
+    fn sign(&self, args: &[Value]) -> Result<magnus::RString, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String, String), (Option<Value>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let (key_id, algorithm) = scanned.required;
+        let message = scanned
+            .optional
+            .0
+            .ok_or_else(|| crate::util::arg_error("Keystore#sign: message is required"))?;
+        let bytes = bytes_from_value(message)?;
+        let signature = self
+            .inner
+            .borrow()
+            .sign("confium", "ruby", &key_id, &algorithm, &bytes)
+            .map_err(|e| store_error(e, "Keystore#sign"))?;
+        Ok(bytes_to_rstring(
+            &Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?,
+            &signature,
+        ))
+    }
+}
+
+/// The backend wire names registered at link time
+/// (`Confium::Store.backends`).
+fn backends() -> Result<Vec<String>, Error> {
+    Ok(confium_store::backend::iter()
+        .map(|b| b.name().to_string())
+        .collect())
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let store = parent.define_module("Store")?;
+    let class = store.define_class("Keystore", ruby.class_object())?;
+    class.define_singleton_method("new", function!(Keystore::initialize, -1))?;
+    class.define_method("sign", method!(Keystore::sign, -1))?;
+    store.define_module_function("backends", function!(backends, 0))?;
+    Ok(())
+}

data/ext/confium_native/src/tc_session.rs

@@ -0,0 +1,268 @@
+//! Confium::TC::Session — per-party threshold protocol sessions.
+//!
+//! Binds `confium_tc_core::Session`: each signer process runs ONE
+//! session for its own party, feeding it the messages received from
+//! the peers and sending on what `round_step` produces. The scheme
+//! never leaves the process — this is the per-party half of the
+//! multi-host signing story (the NetworkCoordinator is the transport
+//! half).
+//!
+//!   session = Confium::TC::Session.new("FROST-ed25519-dkg",
+//!                                      parties: ["p0", "p1", "p2"],
+//!                                      threshold: 2,
+//!                                      this_party_idx: 0)
+//!   loop do
+//!     result = session.round_step(incoming)
+//!     break if result["complete"]
+//!     incoming = broadcast(result["outgoing"])
+//!   end
+//!   session.result
+//!
+//! Messages are Hashes with string keys: `"from"`, `"to"` (nil for
+//! broadcast), `"round"`, `"payload"` (binary String).
+
+use magnus::{prelude::*, DataTypeFunctions, Error, Module, RArray, RHash, Ruby, TryConvert, TypedData, Value};
+
+// Force the frost-ed25519 crate (and its `inventory::submit!` calls for
+// FrostEd25519 + FrostEd25519Dkg) to be linked into the cdylib even
+// though the binding itself never names a symbol from it — otherwise
+// the linker drops the registration statics and `Session::create`
+// reports the scheme as unknown.
+extern crate confium_tc_frost_ed25519 as _frost_ed25519_link;
+
+use confium_tc_session::{
+    session::{Session as RustSession, SessionParams}, share::Share, Error as TcError, Message,
+    Party, PartyList,
+};
+// (confium-tc-session is the renamed confium-tc-core 0.4.7 dependency.)
+
+fn typed_session_error(e: TcError, operation: &str) -> Error {
+    let ruby = match Ruby::get() {
+        Ok(r) => r,
+        Err(_) => return Error::new(magnus::exception::runtime_error(), e.to_string()),
+    };
+    let details = crate::util::new_details(&ruby);
+    let _ = details.aset("operation", operation);
+    crate::util::confium_error(e.to_string(), "Error", details)
+}
+
+/// Confium::TC::Session — see the module docs.
+#[derive(TypedData, DataTypeFunctions)]
+#[magnus(class = "Confium::TC::Session", size)]
+pub struct Session {
+    inner: std::cell::RefCell<RustSession>,
+}
+
+fn bytes_arg(v: Value, name: &str) -> Result<Vec<u8>, Error> {
+    crate::util::bytes_from_value(v)
+        .map_err(|e| crate::util::arg_error(format!("Session: {name}: {e}")))
+}
+
+impl Session {
+    fn initialize(ruby: &Ruby, args: &[Value]) -> Result<Self, Error> {
+        let scanned = magnus::scan_args::scan_args::<(String,), (Option<RHash>,), (), (), (), ()>(args)
+            .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let scheme = scanned.required.0;
+        let raw_opts = scanned
+            .optional
+            .0
+            .ok_or_else(|| crate::util::arg_error("Session.new: options Hash is required"))?;
+        // Ruby callers pass keywords (`parties: [...]`), which arrive as
+        // symbol keys; accept both symbol and string keys.
+        let opts = ruby.hash_new();
+        raw_opts.foreach(|k: Value, v: Value| {
+            let key: String = if k.is_kind_of(ruby.class_symbol()) {
+                k.funcall("to_s", ())?
+            } else {
+                <String as TryConvert>::try_convert(k)?
+            };
+            opts.aset(key, v)?;
+            Ok(magnus::r_hash::ForEach::Continue)
+        })?;
+
+        let required = |key: &str| -> Result<Value, Error> {
+            opts.fetch(key).map_err(|_| {
+                crate::util::arg_error(format!("Session.new: :{key} is required"))
+            })
+        };
+        let parties_val = required("parties")?;
+        let ids: Vec<String> = <Vec<String> as TryConvert>::try_convert(parties_val).map_err(|_| {
+            crate::util::arg_error("Session.new: :parties must be an Array of String ids")
+        })?;
+        if ids.len() < 2 {
+            return Err(crate::util::arg_error(
+                "Session.new: at least two parties are required",
+            ));
+        }
+        let mut parties = PartyList::new();
+        for id in &ids {
+            parties.push(Party::new(id.clone(), None::<String>));
+        }
+
+        let threshold: u32 = <u32 as TryConvert>::try_convert(required("threshold")?)
+            .map_err(|_| crate::util::arg_error("Session.new: :threshold must be an Integer"))?;
+        let this_party_idx: usize = <usize as TryConvert>::try_convert(required("this_party_idx")?)
+            .map_err(|_| {
+                crate::util::arg_error("Session.new: :this_party_idx must be an Integer")
+            })?;
+
+        let local_share_v: Value = opts
+            .get("local_share")
+            .unwrap_or_else(|| ruby.qnil().as_value());
+        let local_share: Option<Share> = if local_share_v.is_nil() {
+            None
+        } else {
+            Some(Share::new(
+                scheme.clone(),
+                bytes_arg(local_share_v, "local_share")?,
+            ))
+        };
+        let message_v: Value = opts
+            .get("message")
+            .unwrap_or_else(|| ruby.qnil().as_value());
+        let message: Option<Vec<u8>> = if message_v.is_nil() {
+            None
+        } else {
+            Some(bytes_arg(message_v, "message")?)
+        };
+
+        let params = SessionParams {
+            scheme: scheme.clone(),
+            parties,
+            threshold,
+            this_party_idx,
+            local_share,
+            message,
+        };
+        let inner = RustSession::create(&params)
+            .map_err(|e| typed_session_error(e, "Session.new"))?;
+        let _ = ruby;
+        Ok(Self {
+            inner: std::cell::RefCell::new(inner),
+        })
+    }
+
+    fn scheme_name(&self) -> String {
+        self.inner.borrow().scheme_name().to_string()
+    }
+
+    fn threshold(&self) -> u32 {
+        self.inner.borrow().threshold()
+    }
+
+    fn party_count(&self) -> usize {
+        self.inner.borrow().party_count()
+    }
+
+    fn this_party_idx(&self) -> usize {
+        self.inner.borrow().this_party_idx()
+    }
+
+    fn round(&self) -> u8 {
+        self.inner.borrow().round()
+    }
+
+    fn complete(&self) -> bool {
+        self.inner.borrow().is_complete()
+    }
+
+    fn round_step(&self, args: &[Value]) -> Result<RHash, Error> {
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
+        let scanned =
+            magnus::scan_args::scan_args::<(), (Option<Value>,), (), (), (), ()>(args)
+                .map_err(|e| crate::util::arg_error(e.to_string()))?;
+        let incoming = match scanned.optional.0 {
+            Some(v) if !v.is_nil() => parse_messages(&ruby, v)?,
+            _ => Vec::new(),
+        };
+
+        let result = self
+            .inner
+            .borrow_mut()
+            .round_step(&incoming)
+            .map_err(|e| typed_session_error(e, "Session#round_step"))?;
+
+        let out = ruby.hash_new();
+        let arr = ruby.ary_new();
+        for m in &result.outgoing {
+            let h = ruby.hash_new();
+            let _ = h.aset("from", m.from_party_id.as_str());
+            let to: Value = match &m.to_party_id {
+                Some(t) => ruby.str_new(t).as_value(),
+                None => ruby.qnil().as_value(),
+            };
+            let _ = h.aset("to", to);
+            let _ = h.aset("round", m.round as i64);
+            let _ = h.aset(
+                "payload",
+                crate::util::bytes_to_rstring(&ruby, &m.payload),
+            );
+            arr.push(h)?;
+        }
+        let _ = out.aset("outgoing", arr);
+        let _ = out.aset("complete", result.complete);
+        Ok(out)
+    }
+
+    fn result(&self) -> Result<magnus::RString, Error> {
+        let ruby = Ruby::get().map_err(|e| crate::util::runtime(e.to_string()))?;
+        let bytes = self
+            .inner
+            .borrow()
+            .result()
+            .map_err(|e| typed_session_error(e, "Session#result"))?;
+        Ok(crate::util::bytes_to_rstring(&ruby, &bytes))
+    }
+}
+
+fn parse_messages(ruby: &Ruby, value: Value) -> Result<Vec<Message>, Error> {
+    let arr: RArray = <RArray as TryConvert>::try_convert(value)
+        .map_err(|_| crate::util::arg_error("Session#round_step: incoming must be an Array"))?;
+    let mut out = Vec::with_capacity(arr.len());
+    for item in arr.into_iter() {
+        let h: RHash = <RHash as TryConvert>::try_convert(item).map_err(|_| {
+            crate::util::arg_error("Session#round_step: each message must be a Hash")
+        })?;
+        let fetch = |key: &str| -> Result<Value, Error> {
+            h.fetch(key)
+                .map_err(|_| crate::util::arg_error(format!("message: '{key}' is required")))
+        };
+        let from: String = <String as TryConvert>::try_convert(fetch("from")?)
+            .map_err(|_| crate::util::arg_error("message: 'from' must be a String"))?;
+        let to_v: Value = fetch("to")?;
+        let to: Option<String> = if to_v.is_nil() {
+            None
+        } else {
+            Some(
+                <String as TryConvert>::try_convert(to_v)
+                    .map_err(|_| crate::util::arg_error("message: 'to' must be a String"))?,
+            )
+        };
+        let round: u8 = <u8 as TryConvert>::try_convert(fetch("round")?)
+            .map_err(|_| crate::util::arg_error("message: 'round' must be an Integer"))?;
+        let payload: Value = fetch("payload")?;
+        let payload = crate::util::bytes_from_value(payload)?;
+        let msg = match to {
+            Some(t) => Message::directed(from, t, round, payload),
+            None => Message::broadcast(from, round, payload),
+        };
+        out.push(msg);
+        let _ = ruby;
+    }
+    Ok(out)
+}
+
+pub fn init(ruby: &Ruby, parent: magnus::RModule) -> Result<(), Error> {
+    let tc = parent.define_module("TC")?;
+    let class = tc.define_class("Session", ruby.class_object())?;
+    class.define_singleton_method("new", magnus::function!(Session::initialize, -1))?;
+    class.define_method("scheme_name", magnus::method!(Session::scheme_name, 0))?;
+    class.define_method("threshold", magnus::method!(Session::threshold, 0))?;
+    class.define_method("party_count", magnus::method!(Session::party_count, 0))?;
+    class.define_method("this_party_idx", magnus::method!(Session::this_party_idx, 0))?;
+    class.define_method("round", magnus::method!(Session::round, 0))?;
+    class.define_method("complete?", magnus::method!(Session::complete, 0))?;
+    class.define_method("round_step", magnus::method!(Session::round_step, -1))?;
+    class.define_method("result", magnus::method!(Session::result, 0))?;
+    Ok(())
+}

data/lib/confium/errors.rb

@@ -12,8 +12,17 @@ module Confium
   class Error < StandardError
     attr_reader :details
 
-    def initialize(message = nil, details: {})
-      @details = details.transform_keys(&:to_sym)
+    # The native extension constructs errors positionally
+    # (message, details_hash) — the same shape every typed subclass
+    # accepts via Errors::Coerce. Accepting it here keeps the whole
+    # family uniform; the keyword form still works.
+    def initialize(message = nil, details_hash = nil, details: {})
+      base = if details_hash.is_a?(Hash) && !details_hash.empty?
+               details_hash
+             else
+               details
+             end
+      @details = base.transform_keys(&:to_sym)
       super(message)
     end
 

data/lib/confium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confium
-  VERSION = '0.6.1'
+  VERSION = '0.6.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confium
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.3
 platform: ruby
 authors:
 - Ribose Open
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-25 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rb_sys
@@ -124,7 +124,9 @@ files:
 - ext/confium_native/src/openpgp_verify.rs
 - ext/confium_native/src/path.rs
 - ext/confium_native/src/pki.rs
+- ext/confium_native/src/store.rs
 - ext/confium_native/src/tc.rs
+- ext/confium_native/src/tc_session.rs
 - ext/confium_native/src/transparency.rs
 - ext/confium_native/src/util.rs
 - lib/confium.rb