/**
 * Repo-wide crypto primitive selector.
 *
 * For every registered `PrimitiveId`, choose the impl flavour that builds
 * will route to. Values MUST be one of `'noble'` (vendor-reviewed JS
 * reference), `'native'` (our in-house JS re-implementation), or a future
 * `'wasm'` / `'webcrypto'` flavour as they land.
 *
 * Flipping a value here triggers the codegen (`scripts/gen-crypto-selects.ts`)
 * to overwrite the corresponding `<id>.select.ts` file. The CI guard
 * `scripts/check-crypto-selects.ts` fails the build if the generated
 * selects are out of date or have been hand-edited.
 *
 * Policy for flipping to `'native'`:
 *   - Tier-safe primitives (hmac / hkdf / pbkdf2): after gates 1–3
 *     (KAT + fuzz + timing) only.
 *   - Hash compressions (sha256 / sha384 / sha512): after gates 1–3 and a
 *     benchmark within 2× of noble.
 *   - Dangerous tier (curves, AEADs, argon2id): audit required per primitive.
 *     Staying on `'noble'` indefinitely is a legitimate terminal state.
 */
import type { PrimitiveId } from "@suaveplan/crypto-utils/primitive-id";

export type PrimitiveFlavour = "noble" | "native";

export const cryptoConfig: Readonly<Record<PrimitiveId, PrimitiveFlavour>> = {
    // hash
    sha256: "noble",
    sha384: "noble",
    sha512: "noble",
    hmac: "noble",
    hkdf: "noble",
    pbkdf2: "noble",
    argon2id: "noble",
    // curve
    secp256k1: "noble",
    ed25519: "noble",
    x25519: "noble",
    p256: "noble",
    // cipher
    "aes-256-gcm": "noble",
    "chacha20-poly1305": "noble",
    "xchacha20-poly1305": "noble",
};