refactor: split walletkit-sqlite from walletkit-db

[Dzejkop]

Summary

• introduce walletkit-sqlite for the low-level safe SQLite and sqlite3mc wrapper
• keep vault, blob schema, envelope, locking, and host traits in walletkit-db
• update walletkit-core to depend directly on the crate that owns each interface
• preserve existing on-disk formats and storage behavior

Validation

• nix develop --command cargo check --workspace --all-targets
• cargo test -p walletkit-sqlite -p walletkit-db
• cargo clippy -p walletkit-sqlite -p walletkit-db --all-targets -- -D warnings
• cargo clippy -p walletkit-core --lib --no-default-features -- -D warnings
• cargo fmt -- --check
• git diff --check

---

Note

Medium Risk
Layer split plus removal of walletkit-db SQLite re-exports is a breaking API change for downstream crates; storage/crypto paths are touched but behavior is intended to stay equivalent.

Overview
Introduces a new published crate walletkit-sqlite that owns the safe Rust wrapper around encrypted SQLite (sqlite3mc): connections, statements, transactions, cipher helpers, and the native build.rs / WASM sqlite-wasm-rs wiring. walletkit-db is narrowed to higher-level storage (vault, blobs, envelope, lock) and depends on walletkit-sqlite instead of embedding SQLite directly; it no longer re-exports Connection, cipher, params, etc.

walletkit-core now depends on both crates: cache SQL and credential-vault low-level SQL import walletkit_sqlite, while vault/blob/envelope APIs stay on walletkit_db.

Blob APIs classify caller mistakes (bad content_id length, now overflow) as StoreError::InvalidInput, with matching StorageError::InvalidInput mapping in core. Docs, workspace members, and release-plz.toml include the new crate; on-disk formats and vault behavior are unchanged.

^{Reviewed by Cursor Bugbot for commit 684c45d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 687ffd7. Configure here.}

[Copilot]

Pull request overview

This PR refactors the storage stack by splitting the low-level encrypted SQLite/sqlite3mc wrapper into a new walletkit-sqlite crate, while narrowing walletkit-db to higher-level storage primitives (vault, blobs, envelope, lock). walletkit-core is updated to depend directly on the crate that owns each interface, with intent to preserve existing on-disk formats and behavior.

Changes:

• Introduce walletkit-sqlite providing safe wrappers for connections/statements/transactions/values and sqlite3mc cipher operations (native + wasm).
• Refactor walletkit-db to build on walletkit-sqlite and stop re-exporting low-level SQLite types; add StoreError::InvalidInput classification.
• Update walletkit-core storage code to import SQL primitives from walletkit-sqlite and map the new invalid-input error variant; wire the new crate into the workspace.

Reviewed changes

Copilot reviewed 25 out of 31 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Document new crate split (walletkit-sqlite vs walletkit-db).
crates/walletkit-sqlite/Cargo.toml	Add new crate manifest and dependencies/build deps.
crates/walletkit-sqlite/README.md	Add crate-level documentation for the new SQLite wrapper.
crates/walletkit-sqlite/build.rs	Update build script identity for walletkit-sqlite.
crates/walletkit-sqlite/src/lib.rs	Define module layout and re-exports for the new crate.
crates/walletkit-sqlite/src/ffi.rs	Add the raw FFI layer and safe handle wrappers.
crates/walletkit-sqlite/src/error.rs	Add SQLite error types and result alias.
crates/walletkit-sqlite/src/value.rs	Add Value and params! macro for parameter binding.
crates/walletkit-sqlite/src/statement.rs	Add safe prepared-statement and row access wrapper.
crates/walletkit-sqlite/src/transaction.rs	Add safe transaction wrapper with rollback-on-drop semantics.
crates/walletkit-sqlite/src/test_utils.rs	Provide init_sqlite helper for sqlite3mc codec initialization.
crates/walletkit-sqlite/src/connection.rs	Adjust tests/imports to the new module layout.
crates/walletkit-sqlite/src/cipher.rs	Adjust tests/imports to the new module layout.
crates/walletkit-db/Cargo.toml	Depend on walletkit-sqlite; remove embedded sqlite build/wasm deps.
crates/walletkit-db/README.md	Update docs/diagram to reflect new dependency layering.
crates/walletkit-db/src/lib.rs	Remove internal sqlite module and re-exports; update docs.
crates/walletkit-db/src/vault.rs	Switch vault to use walletkit_sqlite::{Connection, cipher, DbResult}.
crates/walletkit-db/src/error.rs	Switch DB error source to walletkit_sqlite::Error; add InvalidInput.
crates/walletkit-db/src/blobs.rs	Use walletkit_sqlite primitives; reclassify caller mistakes as InvalidInput.
crates/walletkit-core/Cargo.toml	Add direct dependency on walletkit-sqlite.
crates/walletkit-core/src/storage/error.rs	Add StorageError::InvalidInput and mapping from StoreError.
crates/walletkit-core/src/storage/credential_vault/schema.rs	Use walletkit_sqlite::{Connection, DbResult} for schema helpers.
crates/walletkit-core/src/storage/credential_vault/mod.rs	Import SQL primitives from walletkit-sqlite, keep vault/blobs from walletkit-db.
crates/walletkit-core/src/storage/credential_storage.rs	Update tests to use walletkit_sqlite::Connection.
crates/walletkit-core/src/storage/cache/util.rs	Switch cache DB utilities to walletkit_sqlite types.
crates/walletkit-core/src/storage/cache/session.rs	Switch to walletkit_sqlite::Connection.
crates/walletkit-core/src/storage/cache/schema.rs	Switch to walletkit_sqlite for params/connection/result.
crates/walletkit-core/src/storage/cache/nullifiers.rs	Switch to walletkit_sqlite::Connection.
crates/walletkit-core/src/storage/cache/merkle.rs	Switch to walletkit_sqlite::Connection.
Cargo.toml	Add crates/walletkit-sqlite workspace member and dependency entry.
Cargo.lock	Record new crate and updated dependency graph.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.