// Error: Hardcoded credentials exposed in source
const badWalletConfig = {
  type: "seed",
  mnemonic: "abandon abandon abandon..." // Exposed in code (DON'T DO THIS)
};

// Error: Environment file committed to git
// .env
MNEMONIC="abandon abandon abandon..." # Gets committed to git

// Error: Secrets leaked to logs
console.log(process.env.PRIVATE_KEY);
logger.debug({ mnemonic: process.env.MNEMONIC });

// Error: Keys bundled to client
const badConfig = {
  wallet: {
    type: "private-key",
    bech32PrivateKey: process.env.PRIVATE_KEY! // Bundled to client (DON'T DO THIS)
  }
};

// Error: Shared wallet across all users
const globalWalletConfig = { type: "seed", mnemonic: process.env.MNEMONIC! };

// Avoid creating a single global wallet instance that signs on behalf of all users.
// Instead, create per-request or per-user signing flows and store keys in a vault.

// Load wallet config from environment (do not create client here in wallet docs)
const walletConfig = {
  type: "seed",
  mnemonic: process.env.MNEMONIC!
};

// Retrieve from vault securely
import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

async function getPrivateKey(): Promise<string> {
  const client = new SecretsManagerClient({ region: "us-east-1" });
  const response = await client.send(
    new GetSecretValueCommand({ SecretId: "evolution-wallet-key" })
  );
  return response.SecretString!;
}

// Backend: read-only wallet config (no private keys)
const readOnlyWalletConfig = {
  type: "read-only",
  address: userAddress
};

// Combine this with your provider in the clients docs when building
// a backend client capable of constructing transactions.

// Frontend: user wallet manages keys via CIP-30
declare const cardano: any;
const walletApi = await cardano.eternl.enable();

// Use `walletApi` directly for signing and user interactions.

# .env.development
MNEMONIC="develop develop develop..."

# .env.staging
MNEMONIC="staging staging staging..."

# .env.production (managed by vault)
AWS_SECRET_ARN="arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-wallet"

# .gitignore
.env
.env.*
!.env.example

# .env.example
MNEMONIC="your 24 word mnemonic here"
PRIVATE_KEY="ed25519e_sk1..."
BLOCKFROST_PROJECT_ID="your_project_id"

import * as dotenv from "dotenv";
dotenv.config();

// Validate required variables
if (!process.env.MNEMONIC) {
  throw new Error("MNEMONIC not set in environment");
}

const walletConfig = { type: "seed", mnemonic: process.env.MNEMONIC };

# .env.development
NETWORK=preprod
MNEMONIC="develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop develop art"
BLOCKFROST_PROJECT_ID=preprodxxxxxxxxxxxx

// Example server-side provider + wallet configs. Instantiate the client in your
// backend code (see /docs/clients for client creation examples).

const providerConfig = {
  network: process.env.NETWORK as "preprod" | "mainnet",
  provider: {
    type: "blockfrost",
    baseUrl: process.env.NETWORK === "preprod"
      ? "https://cardano-preprod.blockfrost.io/api/v0"
      : "https://cardano-mainnet.blockfrost.io/api/v0",
    projectId: process.env.BLOCKFROST_PROJECT_ID!
  }
};

const walletConfig = { type: "seed", mnemonic: process.env.MNEMONIC! };

# .env.staging
NETWORK=mainnet
MNEMONIC="staging staging staging..."
BLOCKFROST_PROJECT_ID=mainnetxxxxxxxxxxxx

import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

async function loadMnemonicFromVault() {
  const secretsClient = new SecretsManagerClient({ region: "us-east-1" });

  // Retrieve from vault
  const response = await secretsClient.send(
    new GetSecretValueCommand({ SecretId: "evolution-prod-mnemonic" })
  );
  const mnemonic = response.SecretString!;

  // Return wallet configuration; combine with provider in the clients docs
  return { type: "seed", mnemonic } as const;
}

// Error: API keys exposed to browser
const badProviderConfig = { type: "blockfrost", projectId: "mainnetxxxxxxxxxxxx" };

// Do not include provider configs or keys in frontend bundles.

// Frontend: no provider (use walletApi directly for signing)
// Backend: create a read-only wallet config and combine with provider in clients docs
const backendProviderConfig = { type: "blockfrost", projectId: process.env.BLOCKFROST_PROJECT_ID! };
const readOnlyWalletConfig = { type: "read-only", address: userAddress };

// Frontend - will fail without provider if you attempt to build. Use backend
// to build unsigned transactions and return CBOR to frontend for signing.

// Backend builds: create a provider config + read-only wallet config, then
// instantiate a client in your backend (see /docs/clients for the client API).

// Frontend signs using the walletApi obtained via CIP-30.

# Error: Same mnemonic used everywhere
MNEMONIC="abandon abandon abandon..." # Used in dev, staging, AND production

# .env.development
MNEMONIC="develop develop develop..."

# .env.staging  
MNEMONIC="staging staging staging..."

# Production (in vault, not .env)
# AWS Secrets Manager: evolution-prod-mnemonic

// Error: Always uses same address
const address = await client.address();
// Use for everything - bad for privacy

// Account configs
const mainAccount = { type: "seed", mnemonic: process.env.MNEMONIC!, accountIndex: 0 };
const payoutAccount = { type: "seed", mnemonic: process.env.MNEMONIC!, accountIndex: 1 };

// Pass these wallet configs to your client factory in the clients docs.