firefox-main/__GENERATED__/dist/xpcrs/rt/nsILockstore.rs

Generated file

Copy as Markdown

Other Tools

//
// DO NOT EDIT. THIS FILE IS GENERATED FROM $SRCDIR/security/lockstore/nsILockstore.idl
//
/// `interface nsILockstore : nsISupports`
///
/// ```text
/// /**
/// * Scriptable wrapper over the Lockstore keystore. A single instance per
/// * process is opened against the current profile's keystore file
/// * (lockstore.keys.sqlite).
/// *
/// * KEK references are opaque strings of the form
/// * `lockstore::kek::<type>:<base64url(random_id)>`, minted by
/// * `createKek`. Each DEK (data encryption key) is named by a `dekName` -- an
/// * arbitrary namespace -- and is wrapped by one or more KEKs;
/// * see `createDek`.
/// *
/// * Methods that touch SQLite or run PBKDF2 return a `Promise` and
/// * execute on a private background queue so they do not block the main
/// * thread. The cheap in-memory state check (`isKekUnlocked`) remains
/// * synchronous; `lockKek` and `lock` are also cheap but return a Promise
/// * so the API shape is uniform.
/// */
/// ```
///
// The actual type definition for the interface. This struct has methods
// declared on it which will call through its vtable. You never want to pass
// this type around by value, always pass it behind a reference.
#[repr(C)]
pub struct nsILockstore {
vtable: &'static nsILockstoreVTable,
/// This field is a phantomdata to ensure that the VTable type and any
/// struct containing it is not safe to send across threads by default, as
/// XPCOM is generally not threadsafe.
///
/// If this type is marked as [rust_sync], there will be explicit `Send` and
/// `Sync` implementations on this type, which will override the inherited
/// negative impls from `Rc`.
__nosync: ::std::marker::PhantomData<::std::rc::Rc<u8>>,
// Make the rust compiler aware that there might be interior mutability
// in what actually implements the interface. This works around UB
// that a rust lint would make blatantly obvious, but doesn't exist.
// This prevents optimizations, but those optimizations weren't available
// before rustc switched to LLVM 16, and they now cause problems because
// of the UB.
// Until there's a lint available to find all our UB, it's simpler to
// avoid the UB in the first place, at the cost of preventing optimizations
// in places that don't cause UB. But again, those optimizations weren't
// available before.
__maybe_interior_mutability: ::std::cell::UnsafeCell<[u8; 0]>,
}
// Implementing XpCom for an interface exposes its IID, which allows for easy
// use of the `.query_interface<T>` helper method. This also defines that
// method for nsILockstore.
unsafe impl XpCom for nsILockstore {
const IID: nsIID = nsID(0xa83f5d62, 0x7b1c, 0x4d2e,
[0x9f, 0x0a, 0x3c, 0x5e, 0x8b, 0x6a, 0x1d, 0x4e]);
}
// We need to implement the RefCounted trait so we can be used with `RefPtr`.
// This trait teaches `RefPtr` how to manage our memory.
unsafe impl RefCounted for nsILockstore {
#[inline]
unsafe fn addref(&self) {
self.AddRef();
}
#[inline]
unsafe fn release(&self) {
self.Release();
}
}
// This trait is implemented on all types which can be coerced to from nsILockstore.
// It is used in the implementation of `fn coerce<T>`. We hide it from the
// documentation, because it clutters it up a lot.
#[doc(hidden)]
pub trait nsILockstoreCoerce {
/// Cheaply cast a value of this type from a `nsILockstore`.
fn coerce_from(v: &nsILockstore) -> &Self;
}
// The trivial implementation: We can obviously coerce ourselves to ourselves.
impl nsILockstoreCoerce for nsILockstore {
#[inline]
fn coerce_from(v: &nsILockstore) -> &Self {
v
}
}
impl nsILockstore {
/// Cast this `nsILockstore` to one of its base interfaces.
#[inline]
pub fn coerce<T: nsILockstoreCoerce>(&self) -> &T {
T::coerce_from(self)
}
}
// Every interface struct type implements `Deref` to its base interface. This
// causes methods on the base interfaces to be directly avaliable on the
// object. For example, you can call `.AddRef` or `.QueryInterface` directly
// on any interface which inherits from `nsISupports`.
impl ::std::ops::Deref for nsILockstore {
type Target = nsISupports;
#[inline]
fn deref(&self) -> &nsISupports {
unsafe {
::std::mem::transmute(self)
}
}
}
// Ensure we can use .coerce() to cast to our base types as well. Any type which
// our base interface can coerce from should be coercable from us as well.
impl<T: nsISupportsCoerce> nsILockstoreCoerce for T {
#[inline]
fn coerce_from(v: &nsILockstore) -> &Self {
T::coerce_from(v)
}
}
// This struct represents the interface's VTable. A pointer to a statically
// allocated version of this struct is at the beginning of every nsILockstore
// object. It contains one pointer field for each method in the interface. In
// the case where we can't generate a binding for a method, we include a void
// pointer.
#[doc(hidden)]
#[repr(C)]
pub struct nsILockstoreVTable {
/// We need to include the members from the base interface's vtable at the start
/// of the VTable definition.
pub __base: nsISupportsVTable,
/* [implicit_jscontext] Promise unlockKek (in AUTF8String kekRef, in ACString secret, in uint64_t timeoutMs); */
/// Unable to generate binding because `jscontext is unsupported`
pub UnlockKek: *const ::libc::c_void,
/* [implicit_jscontext] Promise lockKek (in AUTF8String kekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub LockKek: *const ::libc::c_void,
/* boolean isKekUnlocked (in AUTF8String kekRef); */
pub IsKekUnlocked: unsafe extern "system" fn (this: *const nsILockstore, kekRef: *const ::nsstring::nsACString, _retval: *mut bool) -> ::nserror::nsresult,
/* [implicit_jscontext] Promise kekExists (in AUTF8String kekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub KekExists: *const ::libc::c_void,
/* [implicit_jscontext] Promise lock (); */
/// Unable to generate binding because `jscontext is unsupported`
pub Lock: *const ::libc::c_void,
/* [implicit_jscontext] Promise createDek (in AUTF8String dekName, in AUTF8String kekRef, in boolean extractable, in unsigned long keySize); */
/// Unable to generate binding because `jscontext is unsupported`
pub CreateDek: *const ::libc::c_void,
/* [implicit_jscontext] Promise importDek (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> dekBytes, in boolean extractable); */
/// Unable to generate binding because `jscontext is unsupported`
pub ImportDek: *const ::libc::c_void,
/* [implicit_jscontext] Promise isDekExtractable (in AUTF8String dekName); */
/// Unable to generate binding because `jscontext is unsupported`
pub IsDekExtractable: *const ::libc::c_void,
/* [implicit_jscontext] Promise dekExists (in AUTF8String dekName); */
/// Unable to generate binding because `jscontext is unsupported`
pub DekExists: *const ::libc::c_void,
/* [implicit_jscontext] Promise deleteDek (in AUTF8String dekName); */
/// Unable to generate binding because `jscontext is unsupported`
pub DeleteDek: *const ::libc::c_void,
/* [implicit_jscontext] Promise listDeks (); */
/// Unable to generate binding because `jscontext is unsupported`
pub ListDeks: *const ::libc::c_void,
/* [implicit_jscontext] Promise listKeks (in AUTF8String dekName); */
/// Unable to generate binding because `jscontext is unsupported`
pub ListKeks: *const ::libc::c_void,
/* [implicit_jscontext] Promise addKek (in AUTF8String dekName, in AUTF8String fromKekRef, in AUTF8String toKekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub AddKek: *const ::libc::c_void,
/* [implicit_jscontext] Promise removeKek (in AUTF8String dekName, in AUTF8String kekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub RemoveKek: *const ::libc::c_void,
/* [implicit_jscontext] Promise switchKek (in AUTF8String dekName, in AUTF8String oldKekRef, in AUTF8String newKekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub SwitchKek: *const ::libc::c_void,
/* [implicit_jscontext] Promise migrateDeks (in AUTF8String fromKekRef, in AUTF8String toKekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub MigrateDeks: *const ::libc::c_void,
/* [implicit_jscontext] Promise encrypt (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> plaintext); */
/// Unable to generate binding because `jscontext is unsupported`
pub Encrypt: *const ::libc::c_void,
/* [implicit_jscontext] Promise decrypt (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> ciphertext); */
/// Unable to generate binding because `jscontext is unsupported`
pub Decrypt: *const ::libc::c_void,
/* [implicit_jscontext] Promise getDek (in AUTF8String dekName, in AUTF8String kekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub GetDek: *const ::libc::c_void,
/* [implicit_jscontext] Promise getDekAutomatic (in AUTF8String dekName); */
/// Unable to generate binding because `jscontext is unsupported`
pub GetDekAutomatic: *const ::libc::c_void,
/* [implicit_jscontext] Promise createKek (in ACString kekType, in ACString identifier, in ACString secret, in uint64_t cacheTimeoutMs); */
/// Unable to generate binding because `jscontext is unsupported`
pub CreateKek: *const ::libc::c_void,
/* [implicit_jscontext] Promise changeKekPassword (in AUTF8String kekRef, in ACString oldSecret, in ACString newSecret); */
/// Unable to generate binding because `jscontext is unsupported`
pub ChangeKekPassword: *const ::libc::c_void,
/* [implicit_jscontext] Promise deleteKek (in AUTF8String kekRef); */
/// Unable to generate binding because `jscontext is unsupported`
pub DeleteKek: *const ::libc::c_void,
}
// The implementations of the function wrappers which are exposed to rust code.
// Call these methods rather than manually calling through the VTable struct.
impl nsILockstore {
/// ```text
/// /**
/// * Unlock `kekRef` so subsequent DEK accesses under it succeed for at
/// * most `timeoutMs` milliseconds. `timeoutMs` is a 64-bit count of
/// * milliseconds: a `uint32_t` would cap the window at ~49 days, so the
/// * boundary is widened to `uint64_t`; the core clamps absurdly large
/// * values to a generous maximum to keep the deadline arithmetic safe.
/// *
/// * The returned Promise resolves with `undefined` on success and rejects
/// * with:
/// * - NS_ERROR_ABORT on wrong secret / PIN.
/// * - NS_ERROR_NOT_INITIALIZED if the KEK requires initialisation that
/// * hasn't been performed yet (e.g. no Password kek_ref minted).
/// * - NS_ERROR_INVALID_ARG on an unrecognised `kekRef`.
/// */
/// ```
///
/// `[implicit_jscontext] Promise unlockKek (in AUTF8String kekRef, in ACString secret, in uint64_t timeoutMs);`
const _UnlockKek: () = ();
/// `[implicit_jscontext] Promise lockKek (in AUTF8String kekRef);`
const _LockKek: () = ();
/// `boolean isKekUnlocked (in AUTF8String kekRef);`
#[inline]
pub unsafe fn IsKekUnlocked(&self, kekRef: *const ::nsstring::nsACString, _retval: *mut bool) -> ::nserror::nsresult {
((*self.vtable).IsKekUnlocked)(self, kekRef, _retval)
}
/// `[implicit_jscontext] Promise kekExists (in AUTF8String kekRef);`
const _KekExists: () = ();
/// `[implicit_jscontext] Promise lock ();`
const _Lock: () = ();
/// ```text
/// /**
/// * Create a new DEK for `dekName`, wrapped under `kekRef`. The
/// * returned Promise rejects with NS_ERROR_FAILURE if `dekName`
/// * already has a DEK.
/// *
/// * `extractable` controls whether the raw DEK bytes can later be
/// * exported via `getDek`. Use the default (`false`) unless an
/// * external cipher demands raw key material (e.g. mozStorage's
/// * ObfuscatingVFS, which needs a 32-byte key for SQLite page
/// * encryption); `encrypt`/`decrypt` work regardless of `extractable`.
/// *
/// * `keySize` is the DEK length in bytes the caller wants minted
/// * (1..=1024). It is decoupled from the wrapping cipher's key size:
/// * lockstore wraps the DEK under the KEK using its own internal
/// * cipher, but the DEK itself can be any byte length the consumer
/// * declares. A 32-byte DEK matches the obfsvfs page cipher
/// * (ChaCha20-Poly1305).
/// */
/// ```
///
/// `[implicit_jscontext] Promise createDek (in AUTF8String dekName, in AUTF8String kekRef, in boolean extractable, in unsigned long keySize);`
const _CreateDek: () = ();
/// ```text
/// /**
/// * Install caller-supplied `dekBytes` as the DEK for `dekName`,
/// * wrapped under the existing `kekRef`. Used for migrating data
/// * already encrypted under a known external DEK into the keystore-
/// * managed model without re-encrypting at rest.
/// *
/// * `dekBytes` must be 32 bytes (AES-256-GCM default cipher suite).
/// * The Promise rejects with:
/// * - NS_ERROR_INVALID_ARG on wrong length, or empty `dekName`
/// * / `kekRef`
/// * - NS_ERROR_NOT_AVAILABLE if `kekRef` doesn't exist or is locked
/// * - NS_ERROR_FAILURE if `dekName` already has a DEK
/// *
/// * Note: imported DEKs are inherently extractable by the caller (the
/// * bytes are already in their hands). The `extractable` flag controls
/// * only whether future `getDek` calls succeed on this DEK.
/// */
/// ```
///
/// `[implicit_jscontext] Promise importDek (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> dekBytes, in boolean extractable);`
const _ImportDek: () = ();
/// ```text
/// /**
/// * Resolves with `true` iff the DEK for `dekName` was created
/// * with `extractable = true`. Touches SQLite (loads the DEK metadata
/// * row), hence async — distinct from `isKekUnlocked`, which is an
/// * in-memory cache check.
/// *
/// * Rejects with NS_ERROR_NOT_AVAILABLE if `dekName` doesn't exist.
/// */
/// ```
///
/// `[implicit_jscontext] Promise isDekExtractable (in AUTF8String dekName);`
const _IsDekExtractable: () = ();
/// ```text
/// /**
/// * Resolves with `true` iff a DEK record exists for `dekName`. A
/// * missing DEK resolves with `false` rather than rejecting, and no
/// * wrapping KEK needs to be unlocked — so this distinguishes "no key
/// * has ever been created here" from "a key exists but every KEK
/// * wrapping it is locked", which `getDek` / `getDekAutomatic` both
/// * report as NS_ERROR_NOT_AVAILABLE. Callers that must not overwrite
/// * existing ciphertext should gate on this before creating a DEK.
/// *
/// * Touches SQLite (loads the DEK metadata row), hence async. An empty
/// * `dekName` rejects with NS_ERROR_INVALID_ARG.
/// */
/// ```
///
/// `[implicit_jscontext] Promise dekExists (in AUTF8String dekName);`
const _DekExists: () = ();
/// ```text
/// /**
/// * Delete the DEK for `dekName`. Rejects with
/// * NS_ERROR_NOT_AVAILABLE if no DEK exists. The keystore does not
/// * track any associated datastore; callers are responsible for
/// * disposing of ciphertext under this DEK by other means.
/// */
/// ```
///
/// `[implicit_jscontext] Promise deleteDek (in AUTF8String dekName);`
const _DeleteDek: () = ();
/// `[implicit_jscontext] Promise listDeks ();`
const _ListDeks: () = ();
/// `[implicit_jscontext] Promise listKeks (in AUTF8String dekName);`
const _ListKeks: () = ();
/// `[implicit_jscontext] Promise addKek (in AUTF8String dekName, in AUTF8String fromKekRef, in AUTF8String toKekRef);`
const _AddKek: () = ();
/// `[implicit_jscontext] Promise removeKek (in AUTF8String dekName, in AUTF8String kekRef);`
const _RemoveKek: () = ();
/// ```text
/// /**
/// * Atomically rewrap the DEK for `dekName` from `oldKekRef` to
/// * `newKekRef`. The DEK bytes are unchanged, so ciphertexts at rest
/// * under this DEK remain valid. Equivalent in effect to
/// * `addKek(dekName, oldKekRef, newKekRef)` followed by
/// * `removeKek(dekName, oldKekRef)` but atomic at the kvstore-row
/// * level — a crash mid-operation leaves the keystore in the old
/// * state or the new state, never a transient half-state.
/// *
/// * `oldKekRef` must currently wrap the DEK and be unlocked.
/// * The Promise rejects with:
/// * - NS_ERROR_INVALID_ARG if `oldKekRef` == `newKekRef`, or either
/// * is empty
/// * - NS_ERROR_NOT_AVAILABLE if `dekName` or its `oldKekRef`
/// * wrapping doesn't exist
/// * - NS_ERROR_FAILURE if `newKekRef` already wraps this DEK
/// * - NS_ERROR_NOT_AVAILABLE (`Locked`) if `oldKekRef` is locked
/// */
/// ```
///
/// `[implicit_jscontext] Promise switchKek (in AUTF8String dekName, in AUTF8String oldKekRef, in AUTF8String newKekRef);`
const _SwitchKek: () = ();
/// ```text
/// /**
/// * Re-wrap every collection currently wrapped under `fromKekRef` to
/// * `toKekRef`. The whole migration runs under a single keystore connection
/// * so no other DEK operation interleaves. On the first per-collection
/// * failure, the collections already switched in this call are rolled back
/// * to `fromKekRef` (best effort) and the Promise rejects with the original
/// * error, leaving `toKekRef` intact for the caller to clean up.
/// *
/// * Neither KEK record is deleted. Once the migration succeeds nothing wraps
/// * under `fromKekRef`, so the caller is expected to `deleteKek` it; leaving
/// * it behind keeps a record that can no longer be used for anything.
/// *
/// * Both KEKs must already exist and be unlocked. The Promise rejects with
/// * NS_ERROR_INVALID_ARG if either kekRef is empty.
/// */
/// ```
///
/// `[implicit_jscontext] Promise migrateDeks (in AUTF8String fromKekRef, in AUTF8String toKekRef);`
const _MigrateDeks: () = ();
/// ```text
/// /**
/// * Encrypt `plaintext` with the DEK for `(dekName, kekRef)`. The work
/// * runs off the main thread. The returned Promise resolves with a byte
/// * array (Array<octet>) containing a self-describing blob:
/// * [cipher_suite_id(1)] || [nonce] || [ciphertext+tag]
/// * and rejects with an nsresult on failure. The DEK need not be
/// * extractable.
/// */
/// ```
///
/// `[implicit_jscontext] Promise encrypt (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> plaintext);`
const _Encrypt: () = ();
/// ```text
/// /**
/// * Decrypt a blob produced by `encrypt`. Cipher suite is inferred from
/// * the blob's leading byte. Runs off the main thread; the Promise
/// * resolves with the plaintext bytes.
/// */
/// ```
///
/// `[implicit_jscontext] Promise decrypt (in AUTF8String dekName, in AUTF8String kekRef, in Array<octet> ciphertext);`
const _Decrypt: () = ();
/// ```text
/// /**
/// * Return the raw DEK bytes for `(dekName, kekRef)` as an
/// * `Array<octet>` (32 bytes for the default AES-256-GCM /
/// * ChaCha20-Poly1305 suites). The DEK must have been created with
/// * `extractable = true`; otherwise the Promise rejects with
/// * `NS_ERROR_NOT_AVAILABLE`.
/// *
/// * The returned bytes are sensitive: any caller is now in possession
/// * of the symmetric key that can decrypt every ciphertext stored
/// * under this DEK. Prefer `encrypt`/`decrypt` unless an external
/// * cipher (e.g. mozStorage's ObfuscatingVFS, which needs a 32-byte
/// * key for SQLite page encryption) requires raw key material.
/// *
/// * The Promise also rejects with `NS_ERROR_NOT_AVAILABLE` if no DEK
/// * exists for `(dekName, kekRef)`, and with `NS_ERROR_INVALID_ARG`
/// * if either argument is empty.
/// */
/// ```
///
/// `[implicit_jscontext] Promise getDek (in AUTF8String dekName, in AUTF8String kekRef);`
const _GetDek: () = ();
/// ```text
/// /**
/// * Return the raw DEK bytes for `dekName` by automatically selecting
/// * a KEK. Iterates all KEKs that wrap the DEK for `dekName` and
/// * picks the first one that is currently unlocked. The DEK must have
/// * been created with `extractable = true`.
/// *
/// * The Promise resolves with an `Array<octet>` (same format as `getDek`)
/// * and rejects with:
/// * - NS_ERROR_NOT_AVAILABLE if no KEK wrapping this DEK is currently
/// * unlocked, or if no DEK exists for `dekName`.
/// * - NS_ERROR_INVALID_ARG if `dekName` is empty.
/// */
/// ```
///
/// `[implicit_jscontext] Promise getDekAutomatic (in AUTF8String dekName);`
const _GetDekAutomatic: () = ();
/// ```text
/// /**
/// * Generic KEK-creation entry point. Always mints a fresh kek_ref of
/// * the form `lockstore::kek::<type>:<base64url(random_id)>`; a profile
/// * can host any number of KEKs per `KekType`. Dispatches on `kekType`:
/// *
/// * "local"
/// * Generates a fresh AES-256 KEK and persists it (verbatim) in
/// * a `LocalKekRecord`. LocalKey has no unlock ceremony — its
/// * confidentiality at rest is provided by the underlying SQLite
/// * encryption layer. `secret` and `cacheTimeoutMs` are ignored.
/// *
/// * "password"
/// * Wraps a fresh AES-256 KEK under PBKDF2-HMAC-SHA256 of
/// * `secret` (must be non-empty). Each kek_ref carries an
/// * independent salt + iteration count + ciphertext, so multiple
/// * password KEKs coexist without shared state. Rotation is
/// * `createKek("password", new)` + `switchKek(oldKekRef, newKekRef)`
/// * + `removeKek(oldKekRef)`. If `cacheTimeoutMs` is non-zero the
/// * just-derived KEK is also inserted into the auth cache with
/// * that expiry, so callers can use the returned kek_ref without
/// * an immediate `unlockKek`.
/// *
/// * "pkcs11"
/// * Provisions a fresh PKCS#11-backed KEK against the slot
/// * named by the PKCS#11 URI in `secret`. The slot is
/// * authenticated via NSS's registered password callback (PSM
/// * in Firefox); Lockstore then finds-or-creates a long-lived
/// * AES wrapping key on the slot, generates a fresh software
/// * KEK, wraps it under the wrapping key, and persists a
/// * record. `cacheTimeoutMs` is ignored — PKCS#11 unlock is
/// * mediated by NSS, not by the Lockstore cache.
/// *
/// * `identifier` selects the kek_ref `<id>` suffix: empty (the usual
/// * case) mints a fresh random id; a non-empty base64url
/// * (`[A-Za-z0-9_-]`) identifier is used verbatim, making the call a
/// * deterministic get-or-create -- a later `createKek` with the same
/// * `kekType` + `identifier` returns the existing KEK untouched.
/// *
/// * `cacheTimeoutMs` is the duration (in milliseconds) that the
/// * just-derived KEK is kept in the in-memory auth cache. Only
/// * meaningful for the `"password"` tier; ignored elsewhere. It is a
/// * 64-bit millisecond count (a `uint32_t` would cap the window at
/// * ~49 days); the core clamps absurdly large values to a generous
/// * maximum.
/// *
/// * Lockstore copies the secret bytes into its own buffer, consumes
/// * them, and zeroises the buffer before resolving the Promise; the
/// * caller's `ACString` is never mutated.
/// *
/// * The returned Promise resolves with the freshly-minted `kek_ref`
/// * the caller should hand to subsequent `createDek` / `encrypt`
/// * calls, and rejects with:
/// * - NS_ERROR_INVALID_ARG on an unknown `kekType`, a non-base64url
/// * `identifier`, an empty Password `secret`, or a malformed
/// * PKCS#11 URI.
/// * - NS_ERROR_ABORT if a PKCS#11 token unlock prompt is cancelled.
/// * - NS_ERROR_FAILURE on any other failure (SQLite write error,
/// * crypto-layer error).
/// */
/// ```
///
/// `[implicit_jscontext] Promise createKek (in ACString kekType, in ACString identifier, in ACString secret, in uint64_t cacheTimeoutMs);`
const _CreateKek: () = ();
/// ```text
/// /**
/// * Re-wrap the Password KEK at `kekRef` under `newSecret`, authorising
/// * the change with `oldSecret`. The KEK material is preserved, so every
/// * DEK (and ciphertext at rest) wrapped under `kekRef` stays valid.
/// * Only meaningful for `"password"` KEKs.
/// *
/// * The returned Promise rejects with:
/// * - NS_ERROR_INVALID_ARG if `kekRef` is empty, not a Password KEK,
/// * names no existing record, or `newSecret` is empty.
/// * - NS_ERROR_ABORT if `oldSecret` does not match the current
/// * password.
/// * - NS_ERROR_FAILURE on any other failure (SQLite write error,
/// * crypto-layer error).
/// */
/// ```
///
/// `[implicit_jscontext] Promise changeKekPassword (in AUTF8String kekRef, in ACString oldSecret, in ACString newSecret);`
const _ChangeKekPassword: () = ();
/// ```text
/// /**
/// * Destroy the KEK referenced by `kekRef`. The persisted row is
/// * dropped along with the per-`kekRef` unlock-cache entry — the
/// * authenticated KEK bytes derived from a password / PIN that
/// * `unlockKek` cached and that `lockKek` would otherwise clear. No
/// * DEK material is touched: every DEK wrapping under `kekRef` must
/// * already be gone (via `removeKek` / `switchKek`) before this call
/// * succeeds. For a PKCS#11 KEK the slot is logged out via the same
/// * `PK11_Logout` path used by `lockKek`.
/// *
/// * Deletion is always explicit. `removeKek` and `deleteDek` drop
/// * wrappings only; the per-`kekRef` KEK record stays on disk until
/// * `deleteKek` is called for it.
/// *
/// * The returned Promise resolves with `undefined` on success and
/// * rejects with:
/// * - NS_ERROR_INVALID_ARG on an empty `kekRef`.
/// * - NS_ERROR_NOT_AVAILABLE if no record exists at `kekRef`.
/// * - NS_ERROR_FAILURE if any DEK still wraps under `kekRef`, or
/// * on SQLite / crypto-layer errors.
/// */
/// ```
///
/// `[implicit_jscontext] Promise deleteKek (in AUTF8String kekRef);`
const _DeleteKek: () = ();
}