"""Fase A fence: PinScope identifiers that must be read, never written.

JWT issue uses JWT_ISSUER. Decode also accepts LEGACY_JWT_ISSUERS.
project.json may still contain pinscope_version; new writes use periscope_version.

See docs/development/PINSCOPE_FENCE.md. Do not import this from validate.py
or the finding engine — identity only.
"""

JWT_ISSUER = "periscope-local"
LEGACY_JWT_ISSUERS: tuple[str, ...] = ("pinscope-local",)
READ_JWT_ISSUERS: tuple[str, ...] = (JWT_ISSUER, *LEGACY_JWT_ISSUERS)

PROJECT_VERSION_FIELD = "periscope_version"
LEGACY_PROJECT_VERSION_FIELD = "pinscope_version"