/**
 * @file identity-constants.mts
 * @description Constants for the ibgib identity layer: pool IDs, verbs, KDF salts,
 * IndexedDB store names, and default pool configuration presets.
 *
 * @see docs/identity/KEYSTONES.md
 * @see docs/identity/TODO.md#02-identity-constants--verbs
 */

// ===========================================================================
// IDENTITY VERBS
// These extend the base KeystoneVerb set with identity-tier-specific actions.
// Used as values in KeystoneClaim.verb and KeystonePoolConfig.allowedVerbs.
// ===========================================================================

/** Evolve META: add a LOCAL keystone to the trusted list. */
export const IDENTITY_VERB_ADD_DEVICE = 'identity-add-device';
/** Evolve META: remove a LOCAL keystone from the trusted list. */
export const IDENTITY_VERB_REMOVE_DEVICE = 'identity-remove-device';
/** Evolve META: transfer custodianship (custodial → sovereign). */
export const IDENTITY_VERB_CUSTODY_TRANSFER = 'identity-custody-transfer';

/** Evolve LOCAL: register a new APP-LOCAL keystone. */
export const IDENTITY_VERB_ADD_APP = 'identity-add-app';
/** Evolve LOCAL: deregister an APP-LOCAL keystone. */
export const IDENTITY_VERB_REMOVE_APP = 'identity-remove-app';

/** Evolve APP-LOCAL: establish a SESSION keystone genesis. */
export const IDENTITY_VERB_ESTABLISH_SESSION = 'identity-establish-session';
/** Evolve APP-LOCAL: authorize an app-level action. */
export const IDENTITY_VERB_AUTHORIZE = 'identity-authorize';
/**
 * Evolve APP-LOCAL (final frame of old epoch): transition to a new epoch keystone.
 * Uses `consume` replenish strategy — self-contained, no parent evolution needed.
 * @see docs/identity/PARADIGM.md#epoch-rotation-handling-keystone-growth
 */
export const IDENTITY_VERB_EPOCH_TRANSITION = 'identity-epoch-transition';

// ===========================================================================
// POOL IDs
// Conventional pool identifiers for each identity tier's pools.
// ===========================================================================

/** META keystone: structural changes (add/remove device). */
export const IDENTITY_POOL_ID_ADD_DEVICE = 'identity-add-device';
/** META keystone: structural changes (remove device). Separate pool allows tighter policy. */
export const IDENTITY_POOL_ID_REMOVE_DEVICE = 'identity-remove-device';
/** META keystone: custody transfer (consume strategy — limited uses). */
export const IDENTITY_POOL_ID_CUSTODY_TRANSFER = 'identity-custody-transfer';

/** LOCAL keystone: register/deregister app-local keystones. */
export const IDENTITY_POOL_ID_ADD_APP = 'identity-add-app';
/** LOCAL keystone: deregister app-local keystones. */
export const IDENTITY_POOL_ID_REMOVE_APP = 'identity-remove-app';

/** APP-LOCAL keystone: establish session keystones. */
export const IDENTITY_POOL_ID_APP_SESSION = 'identity-app-session';
/** APP-LOCAL keystone: general app-level authorization. */
export const IDENTITY_POOL_ID_APP_AUTHORIZE = 'identity-app-authorize';
/**
 * APP-LOCAL keystone: epoch transition pool.
 * Strategy: consume — self-authenticates epoch rotation without parent evolution.
 */
export const IDENTITY_POOL_ID_APP_EPOCH = 'identity-app-epoch';

// ===========================================================================
// KDF SALTS
// Used to derive tier-specific MasterSecrets from a root password.
// Different salt per tier ensures independent secrets even with same password.
// ===========================================================================

export const IDENTITY_KDF_SALT_META = 'ibgib-identity-meta-v1';
export const IDENTITY_KDF_SALT_LOCAL = 'ibgib-identity-local-v1';
/**
 * APP-LOCAL salt base. Full derivation:
 * `KDF(MasterSecret_local, IDENTITY_KDF_SALT_APP_LOCAL + appId + deviceSalt)`
 */
export const IDENTITY_KDF_SALT_APP_LOCAL = 'ibgib-identity-app-local-v1';
export const IDENTITY_KDF_SALT_SESSION = 'ibgib-identity-session-v1';

// ===========================================================================
// INDEXEDDB STORE NAMES
// ===========================================================================

/** Stores `LocalIdentityContext` — one record per browser profile. */
export const IDENTITY_IDB_STORE_LOCAL_CONTEXT = 'identity-local-context';
/** Stores `AppLocalIdentityContext` — one record per appId per browser profile. */
export const IDENTITY_IDB_STORE_APP_LOCAL_CONTEXT = 'identity-app-local-context';
/** Cached META keystone chain — periodically refreshed from identity service. */
export const IDENTITY_IDB_STORE_META_CACHE = 'identity-meta-cache';
/** LOCAL keystone frames — genesis through current tip. */
export const IDENTITY_IDB_STORE_LOCAL_CHAIN = 'identity-local-chain';
/** APP-LOCAL keystone frames — current epoch genesis through tip. */
export const IDENTITY_IDB_STORE_APP_LOCAL_CHAIN = 'identity-app-local-chain';

// ===========================================================================
// STALENESS POLICY DEFAULTS (milliseconds)
// App-level policy: how old can a cached META chain be before re-fetch?
// @see docs/identity/PARADIGM.md#staleness-policy
// ===========================================================================

/** Default max age for cached META chain for routine verification. */
export const IDENTITY_META_CACHE_TTL_NORMAL_MS = 60 * 60 * 1000; // 1 hour
/** For session establishment: always fetch fresh. */
export const IDENTITY_META_CACHE_TTL_SESSION_MS = 0;
/** For offline operation: no TTL (accept whatever is cached). */
export const IDENTITY_META_CACHE_TTL_OFFLINE_MS = Infinity;