Module settings 

Settings key-value store operations.

Functions

advance_u64_setting

Monotonically advance a numeric setting in ONE statement — the stored value only ever grows. For reconcile cursors and similar floors, where a read-modify-write window would let a stale or concurrent writer regress the value.

commit_account_setup

Atomically commit the four settings written during new-account setup: the (possibly-encrypted) pkey, the encryption_enabled flag, the security_type (only when encrypted), and the (already-encrypted) seed phrase. Wrapping these in a single transaction makes the new-account flow crash-safe: either all four land or none do. The previous design wrote them through four separate set_sql_setting calls, which left a window where pkey was persisted but encryption_enabled was not — the next boot would then mis-interpret the encrypted blob as plaintext nsec and brick the account.

commit_bunker_account_setup

Atomically commit the four settings written during bunker new-account setup: the (possibly-encrypted) client keypair pkey, encryption_enabled, security_type, plus signer_type='bunker', the (possibly-encrypted) bunker_url, and the plaintext bunker_remote_pubkey. Wraps the whole commit in a transaction for the same reason as commit_account_setup — a half-written bunker account would brick login.

commit_nip55_account_setup

Atomically commit NIP-55 new-account setup: encryption_enabled, security_type, signer_type='nip55', and the two plaintext public fields. No pkey is written (nothing secret exists), and any stale key material from a prior local/bunker setup on this DB is scrubbed so login can’t mis-route through a leftover pkey/bunker row. Transactional for the same reason as the sibling commits — a half-written account bricks login.

get_bunker_remote_pubkey

Read the cached remote signer pubkey (hex). Plaintext on disk — it’s public-key material with no secrecy implications, and keeping it readable before unlock lets the UI display “Connected to ” on the locked account picker without prompting for a password.

get_bunker_url

Read the bunker:// URL, decrypting it if the account uses encryption. Returns Ok(None) for local accounts (no row), or when decryption fails against an obviously-encrypted blob (likely the user hasn’t unlocked yet).

get_nip55_signer_package

Read the paired signer app’s Android package name. Pinned on every intent + as the ContentResolver authority so a second signer app can’t intercept.

get_nip55_user_pubkey

Read the cached NIP-55 identity pubkey (hex). Plaintext on disk (public-key material); readable before unlock so the account picker can show the npub.

get_pkey

Get the stored private key (bech32 nsec).

get_seed

Get the stored seed phrase (may be encrypted).

get_signer_type

Read the active signer kind from settings. Missing rows pre-date migration 27 and are treated as "local" so pre-NIP-46 accounts behave unchanged.

get_sql_setting

Get a SQL setting by key.

remove_setting

Remove a setting by key.

set_bunker_remote_pubkey

Persist the cached remote signer pubkey (hex form). Updated after each successful bunker bootstrap — the bootstrap response carries the canonical pubkey, which may differ from any user-supplied form.

set_bunker_url

Persist the bunker:// URL, encrypting if the account uses encryption. The plaintext form is never written to disk for encrypted accounts.

set_nip55_signer_package

Persist the paired signer app’s package name. Updated on re-pair.

set_nip55_user_pubkey

Persist the NIP-55 identity pubkey (hex).

set_pkey

Set the stored private key.

set_seed

Set the seed phrase (should be encrypted before calling).

set_signer_type

Persist the signer kind. Accepts the discriminator’s as_setting_str() form (“local” or “bunker”); other values are accepted but get_signer_type will treat them as local downstream.

set_sql_setting

Set a SQL setting key-value pair.