import { HashAlgorithm } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
import { KeystoneReplenishStrategy } from "./keystone-types.mjs";
export const KEYSTONE_ATOM = "keystone";
export const KEYSTONE_POOL_ID_REGEXP = /^\w[\w\-.]*$/;
export const KEYSTONE_SALT_REGEXP = /^[a-zA-Z0-9\-_]{1,64}$/;
export const KEYSTONE_USERNAME_REGEXP = /^[a-zA-Z0-9_\-.]{1,63}$/;
export const KEYSTONE_DESCRIPTION_REGEXP = /^[a-zA-Z0-9\s.,!?:;'"\-()[\]_+=@#$%&*\/]{0,128}$/;
/**
 * arbitrary right now. don't want an easy DoS. this may still be too high.
 */
export const KEYSTONE_HASH_MAX_ROUNDS = 1_000;
/**
 * @see {@link KeystoneVerb.REVOKE}
 */
export const KEYSTONE_VERB_REVOKE = "revoke";
/**
 * @see {@link KeystoneVerb.MANAGE}
 */
export const KEYSTONE_VERB_MANAGE = "manage";
/**
 * @see {@link KeystoneVerb.SIGN}
 */
export const KEYSTONE_VERB_SIGN = "sign";
/**
 * Used when a senderIdentity keystone authorizes a session keystone for a sync
 * operation. The senderIdentity is evolved with a claim whose verb is `sync`,
 * pointing to the session keystone genesis address.
 *
 * @see {@link KeystoneVerb.SYNC}
 */
export const KEYSTONE_VERB_SYNC = "sync";
/**
 * Used by the session keystone's `connect` pool to authorize the transport
 * connect (e.g. WebSocket challenge/response). Consumed exactly once per
 * sync session during `peer.connect()`.
 *
 * @see {@link KeystoneVerb.CONNECT}
 */
export const KEYSTONE_VERB_CONNECT = "connect";
/**
 * Verbs that describe actions that can be authorized by a Keystone.
 */
export const KeystoneVerb = {
    /**
     * The specific ibGib address for the 'revoke' verb.
     * Used in Claims to indicate the Keystone should be considered dead.
     */
    REVOKE: KEYSTONE_VERB_REVOKE,
    /**
     * The meta-verb used to authorize structural changes to the Keystone,
     * specifically adding or removing challenge pools.
     *
     * "Root access" to the identity.
     *
     * Basically, this is the verb for the "admin" pool.
     *
     * todo: add a separate "add pool" verb
     * todo: add a one-time mechanism that limits pool use per verb.
     */
    MANAGE: KEYSTONE_VERB_MANAGE,
    /**
     * This is the least of all privileges that can actually evolve a keystone.
     */
    SIGN: KEYSTONE_VERB_SIGN,
    /**
     * Used when a senderIdentity keystone authorizes a session keystone.
     * The senderIdentity is evolved with a `sync` claim targeting S^Stjp.
     */
    SYNC: KEYSTONE_VERB_SYNC,
    /**
     * Used by the session keystone's `connect` pool for the transport
     * connect (proof-of-possession). Consumed once per session.
     */
    CONNECT: KEYSTONE_VERB_CONNECT,
};
export const KEYSTONE_VERB_VALID_VALUES = Object.values(KeystoneVerb);
export function isKeystoneVerb(value) {
    return KEYSTONE_VERB_VALID_VALUES.includes(value);
}
// #endregion KeystoneVerb enum
/**
 * Some standard pool IDs can be conventionally named after their primary verb,
 * but this is not a requirement.
 */
export const POOL_ID_REVOKE = KEYSTONE_VERB_REVOKE;
export const POOL_ID_MANAGE = KEYSTONE_VERB_MANAGE;
export const POOL_ID_DEFAULT = "default";
export const POOL_ID_DELEGATE = "delegate";
/**
 * Pool ID for the session keystone's transport connect pool.
 * Paired with {@link KEYSTONE_VERB_CONNECT}. Consumed once per sync session
 * during `peer.connect()`.
 */
export const POOL_ID_CONNECT = KEYSTONE_VERB_CONNECT;
/**
 * Pool ID for the session keystone's per-turn signing pool.
 * Paired with {@link KEYSTONE_VERB_SYNC}. Consumed once per outgoing sync
 * context frame (Init, Delta, Commit, etc.).
 */
export const POOL_ID_SYNC = KEYSTONE_VERB_SYNC;
/**
 * **THESE SHOULD ONLY BE USED IN TEMPORARY/SESSION KEYSTONES.**
 * _this is because a receiver could intercept the stone, DoS participants and
 * then take over a stone._
 *
 * transition pools are used as a temporary mechanism to create one-time management pools for delegates to create their own pools.
 */
export const POOL_ID_TRANSITION = "transition";
export const KEYSTONE_CONFIG_DEFAULT_SIZE = 200;
export const KEYSTONE_CONFIG_DEFAULT_SEQUENTIAL = 2;
export const KEYSTONE_CONFIG_DEFAULT_RANDOM = 2;
export const KEYSTONE_CONFIG_DEFAULT_BINDING = 5;
export const KEYSTONE_CONFIG_DEFAULT_REPLENISH_STRATEGY = KeystoneReplenishStrategy.topUp;
export const KEYSTONE_CONFIG_DEFAULT_HASH_ALGORITHM = HashAlgorithm.sha_256;
export const KEYSTONE_CONFIG_DEFAULT_HASH_ROUNDS = 1;
export const KEYSTONE_CONFIG_DEFAULT_SIZE_HIGHSECURITY = 2000;
export const KEYSTONE_CONFIG_DEFAULT_SEQUENTIAL_HIGHSECURITY = 5;
export const KEYSTONE_CONFIG_DEFAULT_RANDOM_HIGHSECURITY = 5;
export const KEYSTONE_CONFIG_DEFAULT_BINDING_HIGHSECURITY = 16;
export const KEYSTONE_CONFIG_DEFAULT_REPLENISH_STRATEGY_HIGHSECURITY = KeystoneReplenishStrategy.replaceAll;
export const KEYSTONE_CONFIG_DEFAULT_HASH_ALGORITHM_HIGHSECURITY = HashAlgorithm.sha_512;
export const KEYSTONE_CONFIG_DEFAULT_HASH_ROUNDS_HIGHSECURITY = 10;
/**
 * the checkpointing mechanism will do a checkpoint every [this number] of
 * keystone frame evolutions.
 */
export const KEYSTONE_CHECKPOINT_FREQUENCY = 50;
//# sourceMappingURL=keystone-constants.mjs.map