// Bindings + secrets for the nucleic-edge Worker. See docs/CLOUD_INFRA.md and
// cloud/nucleic-edge/README.md for how each is provisioned.

export interface Env {
  // --- Phase A: DAI (daily active installs) ---
  // Indexed by a random, anonymous install UUID, so this counts *installs*, not users — one
  // person on a Mac + an iPhone shows up as two. The relay (below) carries a real identity and
  // counts users; see NUCLEIC_RELAY_DAU.
  NUCLEIC_DAI: AnalyticsEngineDataset;

  // --- Phase B: relay ---
  ROOMS: DurableObjectNamespace;
  /**
   * Relay DAU: a true daily-active-*user* count. Indexed by `roomId`, which is derived from the
   * host identity (hash of the host static public key, docs/CLOUD_INFRA.md §2.1), so one room ≈
   * one user/account regardless of how many devices they connect.
   */
  NUCLEIC_RELAY_DAU: AnalyticsEngineDataset;
  /** Revocation list: key `revoked:<deviceId>` present ⇒ that device's tokens are dead. */
  NUCLEIC_RELAY_TOKENS: KVNamespace;
  /** `<deviceId>` → JSON `{ token, env }` — the phone's APNS token, for relay-triggered wakes. */
  NUCLEIC_PUSH_TOKENS: KVNamespace;

  // --- Trusted Tester program ---
  /** Applications + dedupe index + rate-limit counters (`app:<id>`, `email:<addr>`, `rl:<ip>`). */
  NUCLEIC_TESTER_APPS: KVNamespace;
  /** send_email binding pinned to the owner address — notifies on each new application. */
  OWNER_EMAIL: SendEmail;
  /** HMAC key for the one-click Approve/Reject links in the owner notification. */
  TESTER_APP_SECRET?: string;
  /** Cloudflare Turnstile secret; when set, the apply form must pass a challenge. */
  TURNSTILE_SECRET?: string;
  /** From address for the owner notification (must be on a Cloudflare Email-enabled domain). */
  TESTER_FROM_ADDRESS?: string;

  // --- Covalence runner wake hook (docs/COVALENCE_RUNNER.md §3) ---
  /** The runner control plane's wake endpoint (e.g.
   * `https://runner.nucleic.blakeslee.xyz/v1/hook/wake`). When set (with the secret below), a
   * client connecting to a room with **no host present** nudges the runner Worker, which wakes
   * the pool whose runner owns that room — relay presence → pool wake. Unset ⇒ no hook fires
   * (rooms for ordinary Macs lose nothing; the runner Worker 404s an unknown room). */
  RUNNER_WAKE_URL?: string;

  // Secrets (wrangler secret put)
  /** HMAC key the Worker signs/verifies relay tokens with. */
  RELAY_TOKEN_SECRET?: string;
  /** Bearer the host presents to mint membership tokens, revoke, or trigger an out-of-band push. */
  RELAY_ADMIN_SECRET?: string;
  /** Shared secret presented to the runner wake hook — same value as the runner Worker's
   * RUNNER_WAKE_SECRET. */
  RUNNER_WAKE_SECRET?: string;

  // --- Phase C: APNS ---
  /** PKCS#8 PEM of the APNS auth key (.p8). */
  APNS_KEY_P8?: string;
  APNS_KEY_ID?: string;
  APNS_TEAM_ID?: string;
  /** Fallback APNS topic = the base iOS bundle id, `xyz.blakeslee.nucleic-remote`. Each device
   * record carries its own topic (its build's bundle id — per-channel builds are suffixed), so
   * this only backstops records that predate per-channel topics. */
  APNS_TOPIC?: string;
  /** `sandbox` (default) | `production`. */
  APNS_ENV?: string;
}
