/**
 * Auth domain configuration. The b2 endpoints are live (swagger snapshot published), so
 * the real client is selected by default; flip USE_AUTH_MOCK to develop the login flow
 * offline behind the AuthApi seam (see dev/shared-working-context/reports/mocks-registry.md).
 */
export const USE_AUTH_MOCK = false;

/** Versioned API base — every auth route is `api/v1/...` per the published swagger. */
export const AUTH_API_BASE = '/api/v1';

/** `/me` is stable within a session; revisiting a screen shouldn't refetch it. */
export const AUTH_ME_STALE_TIME = 60_000;

/**
 * OTP length. The contract's RequestOtpResult exposes no `code_length`, and the live verify
 * example uses a 6-digit code, so we default to 6 (a request to surface the length is filed in
 * frontend/requests/for-backend.md). The wireframe's 4 boxes predate the real 6-digit code.
 */
export const OTP_CODE_LENGTH = 6;

/** Fallback resend cooldown (seconds) when a request hasn't yet returned the server value. */
export const OTP_RESEND_FALLBACK_SECONDS = 120;

/**
 * `ApiError.code` the mock returns after too many wrong codes so the OTP screen can show the
 * lockout state. The live server sends a 400 with a safe message but no machine-readable code
 * yet (also filed in for-backend.md) — the screen degrades to the generic invalid-code state.
 */
export const OTP_LOCKED_CODE = 'otp_locked';
