// Bindings + secrets for the nucleic-edge Worker. See docs/CLOUD_INFRA.md and
// cloud/nucleic-edge/README.md for how each is provisioned.

export interface Env {
  // --- Phase A: DAI (daily active installs) ---
  // Indexed by a random, anonymous install UUID, so this counts *installs*, not users — one
  // person on a Mac + an iPhone shows up as two. The relay (below) carries a real identity and
  // counts users; see NUCLEIC_RELAY_DAU.
  NUCLEIC_DAI: AnalyticsEngineDataset;

  // --- Phase B: relay ---
  ROOMS: DurableObjectNamespace;
  /**
   * Relay DAU: a true daily-active-*user* count. Indexed by `roomId`, which is derived from the
   * host identity (hash of the host static public key, docs/CLOUD_INFRA.md §2.1), so one room ≈
   * one user/account regardless of how many devices they connect.
   */
  NUCLEIC_RELAY_DAU: AnalyticsEngineDataset;
  /** Revocation list: key `revoked:<deviceId>` present ⇒ that device's tokens are dead. */
  NUCLEIC_RELAY_TOKENS: KVNamespace;
  /** `<deviceId>` → JSON `{ token, env }` — the phone's APNS token, for relay-triggered wakes. */
  NUCLEIC_PUSH_TOKENS: KVNamespace;

  // Secrets (wrangler secret put)
  /** HMAC key the Worker signs/verifies relay tokens with. */
  RELAY_TOKEN_SECRET?: string;
  /** Bearer the host presents to mint membership tokens, revoke, or trigger an out-of-band push. */
  RELAY_ADMIN_SECRET?: string;

  // --- Phase C: APNS ---
  /** PKCS#8 PEM of the APNS auth key (.p8). */
  APNS_KEY_P8?: string;
  APNS_KEY_ID?: string;
  APNS_TEAM_ID?: string;
  /** APNS topic = the iOS bundle id, `xyz.blakeslee.nucleic.remote`. */
  APNS_TOPIC?: string;
  /** `sandbox` (default) | `production`. */
  APNS_ENV?: string;
}
