Crate tenzro_keystore_unlock 

Platform-agnostic keystore-unlock abstraction.

The Tenzro wallet keystore (tenzro-wallet) encrypts FROST key shares at rest with a password (Argon2id). For wallets to persist across restarts, the node must be able to reproduce that password on every launch. WHERE the password comes from is deployment-specific:

• Desktop apps derive it from a hardware-backed device key gated by biometrics (macOS Secure Enclave + Touch ID — see tenzro-device-key).
• Headless / server nodes read it from an environment variable, a file, or a KMS.

This crate defines only the KeystoreUnlocker trait plus two trivial, always-available implementations (StaticUnlocker, EnvUnlocker). It deliberately has NO platform dependencies so it compiles everywhere and can sit in the public API of tenzro-wallet/tenzro-node without dragging in security-framework. The biometric implementation lives in the separate, macOS-flavored tenzro-device-key crate.

Structs

EnvUnlocker

Reads the keystore password from an environment variable. Intended for headless/server deployments where the operator injects the secret via the process environment or an orchestrator secret mount.

StaticUnlocker

A fixed, in-memory password. Useful for tests, ephemeral nodes, or callers that manage the secret themselves. NOT secure at rest (the password lives in process memory and wherever the caller sourced it).

Enums

UnlockError

Errors a KeystoreUnlocker can surface.

Traits

KeystoreUnlocker

Supplies the keystore password used to encrypt/decrypt wallet key shares.

Type Aliases

Result

Result alias for unlock operations.