// Peer model: CRUD on _ss_peers -- site-sync's binding of the shared peer store
// (lib/common/peerStore.js).
//
// Peer secrets are stored AES-256-GCM sealed under site-sync's own KEK
// (PEER_KEK_INFO, independent of dev-deploy's); plaintext only crosses the
// process boundary at pairing time (when the operator copies the secret to the
// other instance's UI) and at HMAC sign/verify time.

const { createPeerStore }                         = require("./common/peerStore");
const { PLUGIN_NAME, PEERS_TABLE, PEER_KEK_INFO } = require("./constants");


// Plans authored for/by the peer go with it: a deleted max peer_id is handed out
// again (MAX+1) to the next pairing, which must never inherit them (apiApply binds
// a plan to its peer_id).
module.exports = createPeerStore({
    owner:           PLUGIN_NAME,
    table:           PEERS_TABLE,
    kek:             { salt: PEER_KEK_INFO, info: PEER_KEK_INFO },
    dependentTables: ["_ss_plans"]
});