v0.4.0 — Encrypted Wallet Persistence

What's new in v0.4.0

Encrypted Wallet Persistence

Wallet files are now encrypted at rest using XChaCha20-Poly1305 with Argon2id key derivation (OWASP-recommended parameters: m=65536, t=3, p=1).

• File format: ZMPENC1 magic header + 32-byte salt + 24-byte nonce + authenticated ciphertext
• Wrong passphrase is rejected with a clear error — no silent corruption
• Re-saves always generate fresh salt + nonce (no IV reuse)
• zingolib's background save_task is bypassed for encrypted wallets to prevent plaintext leaks

Passphrase via Environment Variable

Set ZIMPPY_PASSPHRASE to enable encryption — no secrets in config files.

ZIMPPY_PASSPHRASE=my-secret zimppy --wallet ~/.zimppy/my-wallet wallet create
ZIMPPY_PASSPHRASE=my-secret zimppy --wallet ~/.zimppy/my-wallet wallet sync

Multi-Account Support

ZIP-32 multi-account wallets with per-account address derivation.

Full Surface Coverage

Encryption passphrase is exposed across all interfaces:

• Rust library (WalletConfig.passphrase)
• Rust CLI (--passphrase flag)
• NAPI bindings (open, create, restore)
• Node.js CLI (ZIMPPY_PASSPHRASE env var)
• zimppy-ts SDK (ZIMPPY_PASSPHRASE env var)

Agent Usage (NAPI)

import { open } from '@zimppy/core-napi'

const wallet = await open(dataDir, { passphrase: process.env.ZIMPPY_PASSPHRASE })