/**
 * Hono context variable augmentation for fuz_app.
 *
 * Cross-cutting shared vocabulary — defines the Hono `ContextVariableMap`
 * variables used by auth, http, server, and testing modules.
 *
 * Auto-loaded by `server/app_server.ts` (side-effect import) and
 * transitively by auth middleware modules that import `CREDENTIAL_TYPE_KEY`.
 * Consumers don't need a manual import unless bypassing the standard server assembly.
 *
 * @module
 */
import { z } from 'zod';
import { CREDENTIAL_TYPE_API_TOKEN, CREDENTIAL_TYPE_DAEMON_TOKEN, CREDENTIAL_TYPE_SESSION, } from './auth/credential_type_schema.js';
/**
 * The credential types that can authenticate a request — the closed set
 * of fuz_app builtins. The open registry on top
 * (`create_credential_type_schema(consumer_types)`) is consulted at
 * registry time by `create_role_schema` for `RoleSpec.required_credential_types`
 * validation; the wire-validated `CredentialType` enum here stays
 * narrow because middleware only ever sets one of the three builtins.
 */
export const CREDENTIAL_TYPES = [
    CREDENTIAL_TYPE_SESSION,
    CREDENTIAL_TYPE_API_TOKEN,
    CREDENTIAL_TYPE_DAEMON_TOKEN,
];
/** Credential type — how a request was authenticated. */
export const CredentialType = z.enum(CREDENTIAL_TYPES);
/** Hono context variable name for the credential type. */
export const CREDENTIAL_TYPE_KEY = 'credential_type';
/** Hono context variable name for the authenticated API token id. */
export const AUTH_API_TOKEN_ID_KEY = 'auth_api_token_id';
/**
 * Hono context variable name for the authenticated account id.
 *
 * Set by the auth middleware (session, bearer, or daemon token) on a valid
 * credential. `null` for unauthenticated requests. The route-spec wrapper /
 * RPC dispatcher's authorization phase reads this when resolving the acting
 * actor; account-grain auth guards (`require_auth`) and account-grain handlers
 * read it directly.
 */
export const ACCOUNT_ID_KEY = 'auth_account_id';
/**
 * Hono context variable name for the test-harness pre-baked context flag.
 *
 * Test harnesses (`create_test_app_from_specs`, `create_fake_hono_context`,
 * the WS round-trip `connect()` helper, plus per-test middleware that
 * pre-populates `REQUEST_CONTEXT_KEY`) set this to `true` so
 * `apply_authorization_phase` skips its DB-backed actor resolution and
 * trusts the supplied `RequestContext`. Production middleware never sets
 * this key — only test code does. The flag is the explicit escape hatch
 * that replaced the implicit "is `REQUEST_CONTEXT_KEY` already set?" probe,
 * so that future production code consulting `REQUEST_CONTEXT_KEY` cannot
 * silently bypass the live build.
 */
export const TEST_CONTEXT_PRESET_KEY = 'test_context_preset';
