aeat.adapters.persistence.storage.master_key package

Master-key substrate: providers, sessions, and BIP-39 recovery.

Public surface for at-rest key custody. Re-exports the provider family (MasterKeyProvider, KeyringMasterKeyProvider, FileFallbackMasterKeyProvider, UnsecuredMasterKeyProvider, and EphemeralMasterKeyProvider), the get_master_key_provider() resolver, and the activate_master_key_provider() / activate_session() context managers that bind unlocked key material to the active bucket session. NoActiveBucketSessionError and suspend_active_session() expose the same session boundary to tests and bootstrap flows.

KDF and file-custody helpers are exported through KdfParams, derive_kek_with_params(), the Argon2id cost constants, the unsecured-provider safety guard (refuse_unsecured_with_real_nif() and looks_like_real_tax_id()), and atomic_write_secure_bytes().

Recovery exports include the low-level BIP-39 primitives (RecoveryKey, WrappedMasterKey, generate_recovery_key(), encode_mnemonic(), decode_mnemonic(), wrap_master_key(), unwrap_master_key(), save_wrapped_master_key(), and load_wrapped_master_key()) plus the typed recovery-envelope facade (MintedRecovery, RecoveryRecord, mint_recovery_envelope(), load_recovery_envelope(), save_recovery_envelope(), unwrap_recovery_envelope(), verify_recovery_mnemonic(), and open_session_from_recovery()). Importing this package does not resolve providers, acquire keys, unwrap recovery material, or write custody files; callers must invoke the exported operations explicitly.

Submodules