bootstrap

type Options struct {
	// DBPath is the SQLite database path (default: ~/.lango/lango.db).
	DBPath string
	// KeyfilePath is the path to the passphrase keyfile (default: ~/.lango/keyfile).
	KeyfilePath string
	// ForceProfile overrides the active profile selection.
	ForceProfile string
	// KeepKeyfile prevents the keyfile from being shredded after crypto initialization.
	// Default (false) shreds the keyfile for security.
	KeepKeyfile bool
	// DBEncryption configures SQLCipher transparent database encryption.
	DBEncryption config.DBEncryptionConfig
	// SkipSecureDetection disables secure hardware provider detection (biometric/TPM).
	// When true, the bootstrap falls back to keyfile or interactive prompt only.
	// Useful for testing and headless environments.
	SkipSecureDetection bool
}

type Phase struct {
	Name    string
	Run     func(ctx context.Context, state *State) error
	Cleanup func(state *State) // called in reverse order if a later phase fails
}

type Pipeline struct {
	// contains filtered or unexported fields
}

type Result struct {
	// Config is the decrypted, active configuration.
	Config *config.Config
	// DBClient is the shared ent.Client for the application database.
	DBClient *ent.Client
	// RawDB is the underlying *sql.DB for direct SQL operations (e.g., sqlite-vec).
	RawDB *sql.DB
	// Crypto is the initialized CryptoProvider for the session.
	Crypto security.CryptoProvider
	// ConfigStore provides encrypted profile CRUD operations.
	ConfigStore *configstore.Store
	// ProfileName is the name of the loaded profile.
	ProfileName string
}

type State struct {
	Options Options
	Result  Result

	// Internal state passed between phases.
	Home     string
	LangoDir string

	// Encryption detection.
	DBEncrypted bool
	NeedsDBKey  bool

	// Passphrase acquisition.
	Passphrase     string
	PassSource     passphrase.Source
	SecureProvider keyring.Provider
	SecurityTier   keyring.SecurityTier
	FirstRunGuess  bool

	// Database handles (set by phaseOpenDatabase).
	Client *ent.Client
	RawDB  *sql.DB

	// Security state from DB.
	Salt     []byte
	Checksum []byte
	FirstRun bool

	// Crypto.
	DBKey  string
	Crypto security.CryptoProvider
}