[talosmachina]

Outcome

bitkit-core stops exporting the pubky module functions that neither Bitkit app calls.

What changed

• Removed the UniFFI exports resolvePubkyUrl, fetchPubkyFile, fetchPubkyFileString, startPubkyAuth, cancelPubkyAuth, completePubkyAuth, fetchPubkyProfile, fetchPubkyContacts, derivePubkySecretKey, pubkyPublicKeyFromSecret, pubkySignUp, pubkySignIn, pubkySessionPut, pubkySessionDelete, pubkySessionList, pubkyPutWithSecretKey, and the PubkyProfile / PubkyProfileLink records, with their module code (session.rs deleted) and tests.
• Kept approvePubkyAuth, parsePubkyAuthUrl, PubkyAuthDetails, PubkyAuthKind and PubkyError (PubkyException on Android), which the Pubky Ring sign-in path in both apps still calls, and the crate-internal fetch_public_file_if_any, which pubky_swaps/delegation.rs imports.
• Dropped the now unused pubky-app-specs dependency (Cargo.lock loses it and the old pubky 0.5.4 it pulled in). Regenerated bindings/ios/bitkitcore.swift and bitkitcoreFFI.h.

How the usage was checked

Searched current master of bitkit-android (ac1796a) and bitkit-ios (fe0cc2de) for every pubky export by name. The only bitkit-core imports are approvePubkyAuth, parsePubkyAuthUrl (Android aliases it parseLegacyPubkyAuthUrl) and PubkyException (Android test). The hits on fetchPubkyProfile, pubkyPublicKeyFromSecret, derivePubkySecretKey and PubkyProfile are the apps' own wrappers and models or Paykit's functions of the same name. Open and release branches were not checked.

Evidence

• cargo test --lib modules::pubky: 53 passed, 0 failed (the 9 kept parse/approve tests plus pubky_swaps, including the delegation tests that use fetch_public_file_if_any).
• cargo test --all-targets: 765 passed, 8 failed, all in modules::blocktank::tests (test_regtest_*, test_refresh_*, test_create_and_store_order, test_cjit_entry_integration, test_get_min_zero_conf_tx_fee). Those call the live Blocktank staging API; this PR does not touch blocktank. I did not rerun them on the base commit.
• iOS bindings: on the base commit, bindgen on Linux reproduced the committed bitkitcore.swift, bitkitcoreFFI.h and modulemap byte for byte, so the regenerated files here come from the same generator. The diff only removes code. ios-bindgen's stale-bindings check is the CI proof.
• cargo clippy --all-targets: no new warnings in the pubky module.

Risk

Public binding surface (a breaking removal for any consumer of the removed functions) and a dependency manifest change. No key derivation, signing or auth logic changed in what remains.

Follow-up

approvePubkyAuth and parsePubkyAuthUrl go once both apps move Ring approval to Paykit, in separate app PRs.

Requested by @ovitrif via the talos CLI. Owner: @ovitrif.

[ovi-reviewer]

Verdict: ✅ Approve

Full review: diff, all 12 changed files.

Findings: None.

QA for 465718a:

Retained Pubky auth and swap delegation tests ✅ The targeted Rust suite passed.

Checked with cargo test --locked --lib modules::pubky: 53 passed, no failures. The pre-existing live provider integration test remains ignored by default; it was not run for this PR.

Check: current Android and iOS Pubky callers ✅ Source searches found no callers of the functions removed by this PR.

Checked Android master at 6bb0ff5 and iOS master at 1b56274. Matching profile and key functions belong to Paykit or app wrappers. Both apps still call the retained auth functions.

This was source inspection; neither app was built with this change. Open and release branches were not checked.

Check: generated mobile bindings ✅ Android and iOS binding CI passed at the reviewed head.

Reports relied on:

• Android Bindgen.
• iOS Bindgen, including the committed-interface freshness check and Swift smoke test.

No device run: no device journey is specified, and the retained user-visible behaviour is unchanged. Device QA did not exercise the export removals or dependency pruning. The broader Blocktank staging tests reported in the description were not rerun.

---

Reviewed by gpt-6.1-sol-high

[ovitrif]

utAck

[pwltr]

Superseded by #217, which keeps these removals together with the rest of the pubky module removal. Thanks @talosmachina!