Defines 128-bit object IDs and two hex path encodings (legacy and clean). The legacy encoding strips interior zero bytes for compatibility with existing filesystem entries while clean strips only leading zeros, and both include thorough unit tests. This is a self-contained, extractable utility for mapping random 128-bit IDs to filesystem-safe filenames in an embedded no_std context.

Generic implementation of AEAD key generation, encrypt/decrypt, and key wrap/unwrap over RustCrypto traits, parameterized by cipher and key-plus-nonce storage size. It supports two key layouts (plain symmetric key and key-with-persistent-nonce), increments a stored nonce monotonically to avoid reuse, and returns plaintext only on successful authentication. The trait-based design is reusable for any AEAD cipher fitting AeadCore and AeadMutInPlace.

Client-namespaced filesystem wrapper over three littlefs2 filesystems. It rejects paths containing '..' or starting with '/' to prevent namespace escape, translates between client-visible and real paths, and implements resumable directory iteration with ReadDirState and ReadDirFilesState, including optional user-attribute filtering. This solves recurring embedded storage isolation problems and is a strong pattern for sandboxing applications in a shared filesystem.

Procedural macro that generates an ExtensionDispatch implementation from annotated struct fields, mapping backend IDs and extension IDs to backend implementations, including delegation to another backend and 'no_core' options. It reduces boilerplate for adding custom syscall extensions to Trussed runners and demonstrates clean code generation with syn/quote. The routing pattern itself is reusable for any service with named backends and extension IDs.