security/lockstore

	Name	Description	Size	Coverage
	components.conf		534	-
	gtest			100 %
	lockstore_ffi			96 %
	lockstore_rs			74 %
	LockstoreService.cpp		26885	91 %
	LockstoreService.h		6734	-
	moz.build		1376	-
	nsILockstore.idl	Scriptable wrapper over the Lockstore keystore. A single instance per process is opened against the current profile's keystore file (lockstore.keys.sqlite). KEK references are opaque strings of the form `lockstore::kek::<type>:<base64url(random_id)>`, minted by `createKek`. Each DEK (data encryption key) is named by a `dekName` -- an arbitrary namespace -- and is wrapped by one or more KEKs; see `createDek`. Methods that touch SQLite or run PBKDF2 return a `Promise` and execute on a private background queue so they do not block the main thread. The cheap in-memory state check (`isKekUnlocked`) remains synchronous; `lockKek` and `lock` are also cheap but return a Promise so the API shape is uniform.	19277	-
	ProfileKek.cpp	cache_timeout_ms	10929	15 %
	ProfileKek.h	Decide what startup has to do to keep the profile KEK in step with the primary password, given the observed state. Nothing means the two already agree. Only consulted while security.lockstore.unlock.enabled is set. aKekExists whether a password profile KEK is on disk aKekUnlocked whether the KEK is unlocked, which at this point in startup means someone else opened it and owns it aTokenHasPassword queried only when the outcome turns on it, since instantiating the internal key token is not free	2720	-
<1%	tests			97 %