e2ee

type Options struct {
	// Pepper @notice Required, at least 32 bytes, and stable for the life of the deployment.
	//
	// @dev No default, and deliberately not generated when missing: a per-replica or per-restart
	// pepper moves the salt under the user's feet, and every wrapped key in the deployment becomes
	// garbage with a working login and no error. It is not protecting the salt — salts are not
	// secrets — it is what stops an attacker who knows the derivation, which is everyone, from
	// distinguishing the decoy salt of an unknown address from a real one.
	Pepper []byte

	// Default @notice Handed to new accounts and to addresses with no vault. Zero fields take
	// Argon2id at 64 MiB, 3 passes — roughly a second on a mid-range phone.
	Default Params

	// Floor @notice The minimum accepted on write. Zero fields take OWASP's m=19 MiB, t=2.
	//
	// @dev In Go rather than a check constraint, because a floor that is expected to rise over
	// time should not be a migration. Only `parallelism = 1` lives in the DB.
	Floor Params

	// MaxBlob @notice Byte ceiling on each stored blob. Zero means 8192.
	MaxBlob int

	// Schema @notice Optional Postgres schema holding the auth_* tables.
	Schema string

	// AllowNoRecovery @notice Lets a vault be written with no recovery wrapping. Off by default.
	//
	// @dev Named for the opt-out so that false is the safe posture. With recovery required, a user
	// who forgets their password has one route back; without it they have none, and the support
	// queue that produces cannot be answered by anyone, including the operator.
	AllowNoRecovery bool
}

type Params struct {
	KDF        string
	Salt       []byte // 16 bytes, minted at first Put and never rotated
	Memory     uint32 // KiB; meaningless for pbkdf2, still recorded
	Iterations uint32
	// Parallelism @notice Always 1, on write and on read.
	//
	// @dev Argon2's p changes the output, so a browser that picks it from the thread pool derives
	// a different key on a laptop than on a phone and the second device reports a corrupt vault
	// (gotcha 66). The column carries a check constraint saying the same thing.
	Parallelism uint8
}

type Vault struct {
	WrappedKey         []byte
	RecoveryWrappedKey []byte
	// Params @notice The client KDF this wrapping was produced under. Salt is ignored on write —
	// kal mints it, because a client-chosen salt would break the decoy indistinguishability that
	// Params depends on.
	Params Params
	// KeyVersion @notice The version this write expects to replace. Zero means "no row yet".
	KeyVersion int
	// Stale @notice The account's password moved since this key was wrapped, so the key derived
	// from the current password cannot open it.
	//
	// @dev Read-only; ignored on write. Without it the client receives a key it has no possible
	// way to open and fails somewhere far from the cause (gotcha 74).
	Stale bool
}

type Vaults struct {
	// contains filtered or unexported fields
}