aacs: remove the mod.rs facade — module paths are the public API

Delete the pub-use re-export facade; consumers now import from the owning
module (aacs::content::decrypt_unit, aacs::mkb::MkbType, aacs::derive::derive_vuk,
aacs::boil::mk_from_dk, aacs::resolve::resolve_keys_v2, ...). Internal callers
repointed accordingly. Path-only change; logic hash identical (95fb9924); 2210
tests green.

src/disc/encrypt.rs

@@ -86,9 +86,9 @@ impl AacsCertUnlocker<'_> {
         // MKB generation (best-effort) — forwarded to each source's
         // `host_certs(mkb)` so a source MAY select a generation-appropriate cert
         // (the default impl ignores it). A read failure leaves it `None`.
-        let mkb_gen = aacs::read_mkb_from_drive(session.scsi_mut())
+        let mkb_gen = aacs::inf::read_mkb_from_drive(session.scsi_mut())
             .ok()
-            .and_then(|m| aacs::mkb_version(&m));
+            .and_then(|m| aacs::mkb::mkb_version(&m));
 
         // Host certs are keysource-served, never compiled in — unioned from the
         // explicit `DriveCredentials` and the key-source layer. With ZERO certs
@@ -152,10 +152,10 @@ fn unlock_error_to_error(e: &CertUnlockFailure) -> Error {
     }
 }
 
-/// Map a [`CertUnlockFailure`] to a structured [`crate::aacs::UnlockOutcome`]
+/// Map a [`CertUnlockFailure`] to a structured [`crate::aacs::trace::UnlockOutcome`]
 /// for the resolution trace (English-free).
-fn cert_unlock_outcome(e: &CertUnlockFailure) -> crate::aacs::UnlockOutcome {
-    use crate::aacs::UnlockOutcome;
+fn cert_unlock_outcome(e: &CertUnlockFailure) -> crate::aacs::trace::UnlockOutcome {
+    use crate::aacs::trace::UnlockOutcome;
     use freemkv_unlock::UnlockError;
     match e {
         CertUnlockFailure::NoHostCert { mkb } => UnlockOutcome::NoUsableHostCert { mkb: *mkb },
@@ -230,7 +230,10 @@ impl Disc {
     /// `mkb` is the disc's MKB generation when known, forwarded to each source's
     /// [`crate::KeySource::host_certs`] so a source MAY return only
     /// generation-appropriate certs (the default ignores it).
-    fn collect_host_certs(opts: &ScanOptions, mkb: Option<u32>) -> Vec<crate::aacs::HostCert> {
+    fn collect_host_certs(
+        opts: &ScanOptions,
+        mkb: Option<u32>,
+    ) -> Vec<crate::aacs::types::HostCert> {
         // Delegates to the shared cert primitive (the external freemkv-unlock-aacs
         // plugin uses the same one). Kept as a thin Disc method so the existing
         // collect_host_certs_* unit tests and call sites are unchanged.
@@ -312,14 +315,14 @@ impl Disc {
             .read_file(reader, crate::aacs::PATH_UNIT_KEY_RO)
             .or_else(|_| udf_fs.read_file(reader, crate::aacs::PATH_UNIT_KEY_RO_DUPLICATE))
             .map_err(|_| Error::AacsNoKeys)?;
-        let dh = aacs::disc_hash(&uk_ro_data);
+        let dh = aacs::inf::disc_hash(&uk_ro_data);
 
         let cc = udf_fs
             .read_file(reader, crate::aacs::PATH_CONTENT_CERT)
             .or_else(|_| udf_fs.read_file(reader, crate::aacs::PATH_CONTENT_CERT_ALT))
             .ok()
             .as_deref()
-            .and_then(aacs::parse_content_cert);
+            .and_then(aacs::inf::parse_content_cert);
         let bus_encryption = cc.as_ref().map(|c| c.bus_encryption).unwrap_or(false);
         // No-cert default = UHD (V20 stride), matching `read_aacs_version` so the
         // scanned `AacsState.version` and the out-of-band fetch agree. A wrong
@@ -328,7 +331,7 @@ impl Disc {
         let version = cc
             .as_ref()
             .map(|c| c.version.major())
-            .unwrap_or(aacs::AACS_MAJOR_UHD);
+            .unwrap_or(aacs::mkb::AACS_MAJOR_UHD);
 
         // Bus-encryption gate (wrong-keys guard). A bus-encrypted disc (Content
         // Certificate bus-encryption bit set) carries bus encryption on its
@@ -394,12 +397,12 @@ impl Disc {
                 Vec::new()
             }
         };
-        let mkb_ver = aacs::mkb_version(&mkb_bytes);
+        let mkb_ver = aacs::mkb::mkb_version(&mkb_bytes);
 
         tracing::debug!(
             target: "freemkv::disc",
             phase = "scan_aacs_vid_only",
-            disc_hash = %aacs::disc_hash_hex(&dh),
+            disc_hash = %aacs::inf::disc_hash_hex(&dh),
             version,
             bus_encryption,
             has_vid = handshake.is_some(),
@@ -410,7 +413,7 @@ impl Disc {
             version,
             bus_encryption,
             mkb_version: mkb_ver,
-            disc_hash: aacs::disc_hash_hex(&dh),
+            disc_hash: aacs::inf::disc_hash_hex(&dh),
             key_source: KeyOrigin::ExternalUk,
             vuk: None,
             unit_keys: vec![],
@@ -687,14 +690,14 @@ mod tests {
         let st = Disc::resolve_vid_only(&udf, &mut disc, None).expect("state");
         assert_eq!(
             st.version,
-            aacs::AACS_MAJOR_UHD,
+            aacs::mkb::AACS_MAJOR_UHD,
             "no cert → default UHD (major 2)"
         );
         assert!(!st.bus_encryption);
     }
 
     /// disc_hash is SHA1 of the Unit_Key_RO.inf bytes, hex with 0x prefix
-    /// and uppercase (aacs::disc_hash + disc_hash_hex). The state's
+    /// and uppercase (aacs::inf::disc_hash + disc_hash_hex). The state's
     /// disc_hash must match independently computing it over the same bytes.
     #[test]
     fn resolve_vid_only_disc_hash_is_sha1_of_unit_key_ro() {
@@ -710,7 +713,7 @@ mod tests {
             }],
         );
         let st = Disc::resolve_vid_only(&udf, &mut disc, None).expect("state");
-        let expected = aacs::disc_hash_hex(&aacs::disc_hash(&uk));
+        let expected = aacs::inf::disc_hash_hex(&aacs::inf::disc_hash(&uk));
         assert_eq!(st.disc_hash, expected);
         assert!(st.disc_hash.starts_with("0x"));
         // uk_ro must be stashed verbatim for the external resolver.
@@ -746,7 +749,7 @@ mod tests {
         // Real record stream is the single 16-byte type-0x10 record.
         assert_eq!(
             st.mkb.len(),
-            aacs::mkb_content_len(&mkb),
+            aacs::mkb::mkb_content_len(&mkb),
             "MKB must be trimmed to record-stream length, not the zero-pad"
         );
         assert_eq!(st.mkb.len(), 16);
@@ -943,7 +946,7 @@ mod tests {
         // disc_hash must be computed over the DUPLICATE bytes.
         assert_eq!(
             st.disc_hash,
-            aacs::disc_hash_hex(&aacs::disc_hash(&uk)),
+            aacs::inf::disc_hash_hex(&aacs::inf::disc_hash(&uk)),
             "fallback must hash the DUPLICATE Unit_Key_RO.inf"
         );
         assert_eq!(st.uk_ro, uk);
@@ -965,8 +968,8 @@ mod tests {
     // the route fails gracefully (AacsNoHostCert), never panics.
     // ---------------------------------------------------------------
 
-    fn fake_cert(tag: u8) -> aacs::HostCert {
-        aacs::HostCert {
+    fn fake_cert(tag: u8) -> aacs::types::HostCert {
+        aacs::types::HostCert {
             private_key: [tag; 20],
             certificate: vec![tag; 92],
             private_key_v2: None,
@@ -975,15 +978,15 @@ mod tests {
     }
 
     /// A minimal in-test KeySource that yields no keys but a fixed cert list.
-    struct CertSource(Vec<aacs::HostCert>);
+    struct CertSource(Vec<aacs::types::HostCert>);
     impl crate::KeySource for CertSource {
         fn get_uk(
             &self,
             _ctx: &dyn crate::keysource::ResolveCtx,
-        ) -> Result<Vec<crate::aacs::UnitKey>> {
+        ) -> Result<Vec<crate::aacs::boil::UnitKey>> {
             Ok(Vec::new())
         }
-        fn host_certs(&self, _mkb: Option<u32>) -> Vec<aacs::HostCert> {
+        fn host_certs(&self, _mkb: Option<u32>) -> Vec<aacs::types::HostCert> {
             self.0.clone()
         }
     }
@@ -1077,7 +1080,7 @@ mod tests {
 
     #[test]
     fn cert_unlock_outcome_maps_to_structured_trace_step() {
-        use crate::aacs::UnlockOutcome;
+        use crate::aacs::trace::UnlockOutcome;
         use freemkv_unlock::UnlockError;
         // The libfreemkv-side no-cert case carries the MKB generation.
         assert_eq!(

src/disc/extract.rs

@@ -1083,13 +1083,13 @@ mod tests {
     }
 
     /// Build a clear 6144-byte AACS unit (TS syncs at the 192-byte BD-TS
-    /// stride) then encrypt it under `unit_key` so `aacs::decrypt_unit`
+    /// stride) then encrypt it under `unit_key` so `aacs::content::decrypt_unit`
     /// recovers it cleanly (zero decrypt loss). Mirrors the encrypt helper in
     /// `sector/decrypting.rs` tests. `tag` distinguishes two units' payloads.
     fn encrypt_aacs_unit(unit_key: &[u8; 16], tag: u8) -> Vec<u8> {
         use aes::Aes128;
         use aes::cipher::{BlockEncrypt, KeyInit, generic_array::GenericArray};
-        let mut unit = vec![0u8; crate::aacs::ALIGNED_UNIT_LEN];
+        let mut unit = vec![0u8; crate::aacs::content::ALIGNED_UNIT_LEN];
         let mut off = 4;
         while off < unit.len() {
             unit[off] = 0x47; // TS sync
@@ -1108,7 +1108,7 @@ mod tests {
         }
         let cipher = Aes128::new(GenericArray::from_slice(&k));
         let mut prev = crate::aacs::crypto::AACS_IV;
-        let blocks = (crate::aacs::ALIGNED_UNIT_LEN - 16) / 16;
+        let blocks = (crate::aacs::content::ALIGNED_UNIT_LEN - 16) / 16;
         for i in 0..blocks {
             let o = 16 + i * 16;
             for j in 0..16 {
@@ -1124,7 +1124,7 @@ mod tests {
 
     /// The plaintext that `encrypt_aacs_unit(_, tag)` decrypts back to.
     fn clear_aacs_unit(tag: u8) -> Vec<u8> {
-        let mut unit = vec![0u8; crate::aacs::ALIGNED_UNIT_LEN];
+        let mut unit = vec![0u8; crate::aacs::content::ALIGNED_UNIT_LEN];
         let mut off = 4;
         while off < unit.len() {
             unit[off] = 0x47;
@@ -1600,10 +1600,10 @@ mod tests {
     /// own batch starts are always unit-aligned; anchoring a later extent
     /// against the FIRST extent's base mis-aligns whenever the extents' starts
     /// differ by a non-multiple of 3 sectors. This is the exact arithmetic the
-    /// decrypt-on-read gate (`aacs::is_unit_aligned`) performs.
+    /// decrypt-on-read gate (`aacs::content::is_unit_aligned`) performs.
     #[test]
     fn per_extent_base_is_aligned_first_extent_base_is_not() {
-        use crate::aacs::is_unit_aligned;
+        use crate::aacs::content::is_unit_aligned;
         let ext_a_start = 7000u32; // first extent abs LBA
         let ext_b_start = 7004u32; // second extent abs LBA (Δ4 — not mult of 3)
 

src/disc/mod.rs

@@ -1413,7 +1413,7 @@ impl KeyOrigin {
 #[derive(Default, Clone)]
 pub struct DriveCredentials {
     /// Host certificate(s) + private key(s) for the SCSI AACS handshake.
-    pub host_certs: Vec<crate::aacs::HostCert>,
+    pub host_certs: Vec<crate::aacs::types::HostCert>,
 }
 
 /// Options for disc scanning.
@@ -1781,8 +1781,8 @@ impl Disc {
         Ok((inf, mkb, version))
     }
 
-    /// AACS major version ([`crate::aacs::AACS_MAJOR_BD`] /
-    /// [`crate::aacs::AACS_MAJOR_UHD`]) from the content certificate. Drives the
+    /// AACS major version ([`crate::aacs::mkb::AACS_MAJOR_BD`] /
+    /// [`crate::aacs::mkb::AACS_MAJOR_UHD`]) from the content certificate. Drives the
     /// `Unit_Key_RO.inf` parse stride (48-byte V10 vs 64-byte V20/V21), so the
     /// out-of-band key-fetch path parses `enc_title_keys` at the right stride (a
     /// server VUK then derives the correct unit keys).
@@ -1798,7 +1798,7 @@ impl Disc {
             .or_else(|_| udf_fs.read_file(reader, crate::aacs::PATH_CONTENT_CERT_ALT))
             .ok()
             .as_deref()
-            .and_then(crate::aacs::parse_content_cert)
+            .and_then(crate::aacs::inf::parse_content_cert)
         {
             Some(c) => c.version.major(),
             None => {
@@ -1808,7 +1808,7 @@ impl Disc {
                     "no readable AACS content certificate; defaulting to the V20/UHD \
                      Unit_Key_RO stride (a VUK-from-server path would otherwise mis-stride)"
                 );
-                crate::aacs::AACS_MAJOR_UHD
+                crate::aacs::mkb::AACS_MAJOR_UHD
             }
         }
     }
@@ -1817,7 +1817,7 @@ impl Disc {
     ///
     /// `MKB_RO.inf` / `MKB_RW.inf` are allocated to a fixed ~128 MiB and
     /// zero-padded; the actual record stream is a few MiB. We read a bounded
-    /// prefix, find the record-stream length via [`crate::aacs::mkb_content_len`]
+    /// prefix, find the record-stream length via [`crate::aacs::mkb::mkb_content_len`]
     /// and return exactly that, growing the prefix if the records run past it.
     /// This avoids reading 100+ MiB of padding on every scan AND avoids the
     /// `read_file` `MAX_FILE_BYTES` cap that (since 0.31.0) rejected the padded
@@ -1833,13 +1833,13 @@ impl Disc {
                 .read_file_prefix(reader, crate::aacs::PATH_MKB_RO, want)
                 .or_else(|_| udf_fs.read_file_prefix(reader, crate::aacs::PATH_MKB_RW, want))
                 .map_err(|_| Error::AacsNoKeys)?;
-            let n = crate::aacs::mkb_content_len(&buf);
+            let n = crate::aacs::mkb::mkb_content_len(&buf);
             // `n` strictly inside `buf` => the record walk reached the padding
             // boundary (full content captured). `buf` shorter than `want` =>
             // the whole file is already read. Otherwise the records may run
             // past the prefix — grow and retry, bounded by MAX_BYTES.
             if (n > 0 && n < buf.len()) || buf.len() < want || want >= MAX_BYTES {
-                return Ok(crate::aacs::trim_mkb(buf));
+                return Ok(crate::aacs::mkb::trim_mkb(buf));
             }
             want = (want * 2).min(MAX_BYTES);
         }
@@ -2274,7 +2274,7 @@ impl Disc {
     /// else (UDF filesystem, BDMV nav, PLAYLIST/CLIPINF) is always clear.
     ///
     /// The in-read decrypt-verify gate (`DecryptingSectorSource`) uses this so it
-    /// never consults [`ts_sync_destroyed`](crate::aacs::ts_sync_destroyed) about
+    /// never consults [`ts_sync_destroyed`](crate::aacs::content::ts_sync_destroyed) about
     /// non-content bytes — filesystem data has no TS sync and would otherwise be
     /// mistaken for ciphertext (the first-2-GB false-positive this fixes).
     ///
@@ -2567,9 +2567,9 @@ impl Disc {
         } else if self.encrypted && self.css.is_none() {
             self.aacs = Some(AacsState {
                 version: if self.format == DiscFormat::Uhd {
-                    crate::aacs::AACS_MAJOR_UHD
+                    crate::aacs::mkb::AACS_MAJOR_UHD
                 } else {
-                    crate::aacs::AACS_MAJOR_BD
+                    crate::aacs::mkb::AACS_MAJOR_BD
                 },
                 bus_encryption: self.format == DiscFormat::Uhd,
                 mkb_version: None,
@@ -2667,7 +2667,7 @@ impl Disc {
                 Key::Processing(pks) => supplied.processing_keys = pks,
                 Key::Media(mks) => supplied.media_keys = mks,
                 Key::Volume(vuk) => {
-                    supplied.disc_entry = Some(crate::aacs::DiscEntry {
+                    supplied.disc_entry = Some(crate::aacs::types::DiscEntry {
                         disc_hash: aacs.disc_hash.clone(),
                         title: String::new(),
                         media_key: None,
@@ -2685,8 +2685,8 @@ impl Disc {
             let uk_ro = aacs.uk_ro.clone();
             let version_u8 = aacs.version;
 
-            let provider_refs: [&dyn crate::aacs::KeyProvider; 1] = [&supplied];
-            let ctx = crate::aacs::ResolveContext {
+            let provider_refs: [&dyn crate::aacs::provider::KeyProvider; 1] = [&supplied];
+            let ctx = crate::aacs::resolve::ResolveContext {
                 unit_key_ro: &uk_ro,
                 content_cert: None,
                 volume_id: &volume_id,
@@ -2700,7 +2700,7 @@ impl Disc {
             // reason-preserving wrapper threads the no-key cause out so the
             // decrypt gate can report E7017 (had derivation material but no VID)
             // vs E7022 (no usable material) instead of a flat AacsKeyRejected.
-            let resolved = crate::aacs::resolve_keys_with_reason(&ctx, version_u8)
+            let resolved = crate::aacs::resolve::resolve_keys_with_reason(&ctx, version_u8)
                 .map_err(|_reason| crate::error::Error::AacsKeyRejected)?;
 
             if resolved.unit_keys.is_empty() {
@@ -3203,7 +3203,7 @@ impl Disc {
         // decrypts and is AACS-keyed. Region read-starts are aligned DOWN to a
         // unit boundary in the loop below; a fresh sweep starts at LBA 0 (already
         // aligned), so alignment only bites on resume NonTried regions.
-        const UNIT_SECTORS: u16 = (crate::aacs::ALIGNED_UNIT_LEN / 2048) as u16; // 3
+        const UNIT_SECTORS: u16 = (crate::aacs::content::ALIGNED_UNIT_LEN / 2048) as u16; // 3
         if decrypt_is_aacs && batch % UNIT_SECTORS != 0 {
             batch = batch.saturating_add(UNIT_SECTORS - (batch % UNIT_SECTORS));
         }
@@ -3285,7 +3285,7 @@ impl Disc {
             // sweep's NonTried region starts at 0, already unit-aligned; this only
             // shifts resume regions that begin mid-unit.
             let mut pos = if decrypt_is_aacs {
-                let unit_bytes = crate::aacs::ALIGNED_UNIT_LEN as u64;
+                let unit_bytes = crate::aacs::content::ALIGNED_UNIT_LEN as u64;
                 region_pos - (region_pos % unit_bytes)
             } else {
                 region_pos
@@ -4240,8 +4240,8 @@ mod tests {
     /// `sector::decrypting::tests::aacs_unaligned_start_lba_rejected`.
     #[test]
     fn aacs_sweep_batch_and_region_are_unit_aligned() {
-        const UNIT_SECTORS: u16 = (crate::aacs::ALIGNED_UNIT_LEN / 2048) as u16; // 3
-        let unit_bytes = crate::aacs::ALIGNED_UNIT_LEN as u64; // 6144
+        const UNIT_SECTORS: u16 = (crate::aacs::content::ALIGNED_UNIT_LEN / 2048) as u16; // 3
+        let unit_bytes = crate::aacs::content::ALIGNED_UNIT_LEN as u64; // 6144
 
         // (a) Batch rounding: ecc_sectors() for UHD/BD is 32, not a multiple of 3.
         // The decrypting-AACS path rounds it up to the next multiple of 3 (33).
@@ -4700,7 +4700,7 @@ mod tests {
         // The resolver classifies a device-keys-but-zero-VID context as
         // `VidUnavailable`; that reason rides on `aacs_error`.
         let supplied = crate::aacs::provider::SuppliedKey {
-            device_keys: vec![crate::aacs::DeviceKey {
+            device_keys: vec![crate::aacs::types::DeviceKey {
                 key: [0x11; 16],
                 node: 1,
                 uv: 1,
@@ -4710,14 +4710,14 @@ mod tests {
             media_keys: Vec::new(),
             disc_entry: None,
         };
-        let provider_refs: [&dyn crate::aacs::KeyProvider; 1] = [&supplied];
+        let provider_refs: [&dyn crate::aacs::provider::KeyProvider; 1] = [&supplied];
         // A minimal but parseable Unit_Key_RO.inf (uk_pos=32, zero unit keys)
         // so resolution proceeds to the path-try logic and fails for lack of a
         // VID — not because the .inf failed to parse.
         let mut uk_ro = vec![0u8; 40];
         uk_ro[0..4].copy_from_slice(&32u32.to_be_bytes()); // uk_pos = 32
         // num_unit_keys = 0 (BE16) at uk_pos -> parses to an empty key file.
-        let ctx = crate::aacs::ResolveContext {
+        let ctx = crate::aacs::resolve::ResolveContext {
             unit_key_ro: &uk_ro,
             content_cert: None,
             volume_id: &[0u8; 16], // the "no VID" sentinel
@@ -4725,8 +4725,8 @@ mod tests {
             mkb: None,
         };
         assert_eq!(
-            crate::aacs::resolve_keys_with_reason(&ctx, 2).err(),
-            Some(crate::aacs::ResolveFailure::VidUnavailable),
+            crate::aacs::resolve::resolve_keys_with_reason(&ctx, 2).err(),
+            Some(crate::aacs::resolve::ResolveFailure::VidUnavailable),
             "device keys + zero VID must classify as VidUnavailable"
         );
 
@@ -4750,8 +4750,8 @@ mod tests {
             media_keys: Vec::new(),
             disc_entry: None,
         };
-        let provider_refs_none: [&dyn crate::aacs::KeyProvider; 1] = [&supplied_none];
-        let ctx_none = crate::aacs::ResolveContext {
+        let provider_refs_none: [&dyn crate::aacs::provider::KeyProvider; 1] = [&supplied_none];
+        let ctx_none = crate::aacs::resolve::ResolveContext {
             unit_key_ro: &uk_ro,
             content_cert: None,
             volume_id: &[0u8; 16],
@@ -4759,8 +4759,8 @@ mod tests {
             mkb: None,
         };
         assert_eq!(
-            crate::aacs::resolve_keys_with_reason(&ctx_none, 2).err(),
-            Some(crate::aacs::ResolveFailure::NoMaterial),
+            crate::aacs::resolve::resolve_keys_with_reason(&ctx_none, 2).err(),
+            Some(crate::aacs::resolve::ResolveFailure::NoMaterial),
             "no key material must classify as NoMaterial"
         );
 
@@ -5030,8 +5030,8 @@ mod tests {
         let vuk = [0x5au8; 16];
         let enc0 = [0x12u8; 16];
         let enc1 = [0x34u8; 16];
-        let exp0 = crate::aacs::decrypt_unit_key(&vuk, &enc0);
-        let exp1 = crate::aacs::decrypt_unit_key(&vuk, &enc1);
+        let exp0 = crate::aacs::derive::decrypt_unit_key(&vuk, &enc0);
+        let exp1 = crate::aacs::derive::decrypt_unit_key(&vuk, &enc1);
 
         let mut disc = make_test_disc(1000, "UHD");
         disc.encrypted = true;

src/disc/verify.rs

@@ -7,7 +7,7 @@
 //! grid (clips can start off the 6144 grid and fragment across UDF extents). So
 //! this gate BUFFERS the disc-absolute read stream and re-ALIGNS it into
 //! clip-file units, then applies the standards-correct
-//! [`crate::aacs::unit_is_clean_ts`] gate (libaacs `_verify_ts`, all-32 syncs).
+//! [`crate::aacs::content::unit_is_clean_ts`] gate (libaacs `_verify_ts`, all-32 syncs).
 //!
 //! FAIL-SAFE CONTRACT (this sits in the middle of every read, so it must never
 //! break a good read): the gate can ONLY downgrade a unit it is *confident* is
@@ -25,7 +25,8 @@
 
 use std::collections::{HashMap, VecDeque};
 
-use crate::aacs::{self, ALIGNED_UNIT_LEN};
+use crate::aacs::content::ALIGNED_UNIT_LEN;
+use crate::aacs::{self};
 use crate::consts::SECTOR_BYTES_U64;
 use crate::decrypt::DecryptKeys;
 use crate::sector::KeyFetch;
@@ -57,7 +58,7 @@ pub enum ContainerKind {
     Ts,
     /// HD-DVD `.evo` — MPEG-2 program stream (pack-start `00 00 01 BA`).
     /// NOT yet enabled by enumeration; present so adding HD-DVD is a one-mapping
-    /// change. See [`crate::aacs::unit_is_clean_ps`] for the (unvalidated) check.
+    /// change. See [`crate::aacs::content::unit_is_clean_ps`] for the (unvalidated) check.
     Ps,
 }
 
@@ -187,8 +188,8 @@ impl UnitVerifier {
     /// The post-decrypt structural check for a clip's container.
     fn accept_for(&self, clip: u32) -> fn(&[u8]) -> bool {
         match self.containers[clip as usize] {
-            ContainerKind::Ts => aacs::unit_is_clean_ts,
-            ContainerKind::Ps => aacs::unit_is_clean_ps,
+            ContainerKind::Ts => aacs::content::unit_is_clean_ts,
+            ContainerKind::Ps => aacs::content::unit_is_clean_ps,
         }
     }
 
@@ -301,8 +302,8 @@ impl UnitVerifier {
     }
 
     /// Can this fully-assembled unit be decrypted + verified? `accept` is the
-    /// container's strict structural check ([`aacs::unit_is_clean_ts`] for TS,
-    /// [`aacs::unit_is_clean_ps`] for PS) — the only format-specific part; the
+    /// container's strict structural check ([`aacs::content::unit_is_clean_ts`] for TS,
+    /// [`aacs::content::unit_is_clean_ps`] for PS) — the only format-specific part; the
     /// AACS crypto is container-agnostic. Returns the 3-state [`Decryptability`].
     fn decryptability(
         &mut self,
@@ -318,7 +319,7 @@ impl UnitVerifier {
         // ENCRYPTED units that no key opens are ever flagged. (A real bad READ of
         // clear content is still caught by the normal SCSI read-error path; this
         // gate just won't false-flag it.)
-        if !aacs::aacs_unit_encrypted(raw) {
+        if !aacs::content::aacs_unit_encrypted(raw) {
             return if accept(raw) {
                 Decryptability::Decryptable
             } else {
@@ -363,7 +364,7 @@ impl UnitVerifier {
     fn try_keys(&self, raw: &[u8; ALIGNED_UNIT_LEN], accept: fn(&[u8]) -> bool) -> bool {
         for k in &self.keys {
             let mut scratch = *raw;
-            if aacs::decrypt_unit_checked(&mut scratch, k, accept) {
+            if aacs::content::decrypt_unit_checked(&mut scratch, k, accept) {
                 return true;
             }
         }