package secrets

// CredentialRef identifies a secret through canonical metadata without exposing
// the underlying secret value.
type CredentialRef string

// SecretPurpose is a typed, non-secret description of why a credential exists.
type SecretPurpose string

const (
	SecretPurposeDatabasePassword SecretPurpose = "DATABASE_PASSWORD"
	SecretPurposeProviderAPIKey   SecretPurpose = "PROVIDER_API_KEY"
)

// RuntimeConsumer identifies a trusted runtime allowed to resolve a credential.
type RuntimeConsumer string

const (
	RuntimeConsumerCore             RuntimeConsumer = "core-runtime"
	RuntimeConsumerWorkWorker       RuntimeConsumer = "agent-worker"
	RuntimeConsumerEpistemicsWorker RuntimeConsumer = "reflection-worker"
	RuntimeConsumerCognitive        RuntimeConsumer = "cognitive-worker"
)

// SecretFileRef is bootstrap delivery metadata for the V1 protected local
// file backend. Path is a reference, not a secret value.
type SecretFileRef struct {
	CredentialRef CredentialRef
	Purpose       SecretPurpose
	Consumer      RuntimeConsumer
	Path          string
}