auth

type FileProvider struct {
	// contains filtered or unexported fields
}

type FileProviderConfig struct {
	// Path to the wallet file. Required.
	Path string

	// Passkey, when non-empty, encrypts the wallet at rest with
	// AES-256-GCM keyed by PBKDF2-HMAC-SHA256 (600k iterations,
	// 16-byte salt). Leave empty for a plain-text wallet.
	Passkey string

	// Mnemonic, when non-empty, seeds wallet creation with an existing
	// BIP-39 phrase instead of generating a fresh one — the restore /
	// second-device path (the device key is still freshly generated).
	// When the wallet file already exists the stored phrase must match,
	// otherwise NewFileProvider returns ErrMnemonicMismatch.
	Mnemonic string

	// Index is the account derivation index applied when the wallet is
	// created — both for a supplied Mnemonic and for a freshly
	// generated one. Ignored when the wallet file already exists (the
	// stored index wins). Zero means index 0, the anytype-compatible
	// account; `any` accounts use DefaultAccountIndex.
	Index uint32
}

type MnemonicConfig struct {
	// Mnemonic is the BIP-39 phrase (typically 12 or 24 words).
	Mnemonic string
	// Index is the account index. Defaults to 0.
	Index uint32
	// DeviceKey is the persisted device private key in raw Ed25519
	// form (64 bytes). Callers own device-key lifecycle: generate on
	// first run with GenerateDeviceKey, store securely, pass back
	// every init.
	DeviceKey []byte
}

type Provider interface {
	AccountKey(ctx context.Context) ([]byte, error)
	DeviceKey(ctx context.Context) ([]byte, error)
}