import { createLogger } from '@4runr/shared';
const logger = createLogger('Gateway:Shield');
export function buildShieldConfigFromEnv(shieldMode) {
    return {
        enabled: shieldMode !== 'off',
        mode: shieldMode,
    };
}
export function applyShieldConfigFromEnv(shield, shieldMode) {
    const partial = buildShieldConfigFromEnv(shieldMode);
    shield.updateConfig(partial);
    return shield.getConfig();
}
export function getShieldMisconfigurationWarnings(config, openAiApiKey) {
    const warnings = [];
    if (config.enabled && config.mode === 'off') {
        warnings.push('Shield enabled flag true but mode is off');
    }
    if (config.mode === 'enforce' &&
        config.hallucination.enabled &&
        config.hallucination.action === 'rewrite' &&
        config.rewrite?.enabled !== false &&
        !openAiApiKey?.trim()) {
        warnings.push('Hallucination rewrite enabled but OPENAI_API_KEY not set');
    }
    return warnings;
}
export function validateShieldProductionConfig(config, options) {
    const warnings = [];
    const isProduction = options.nodeEnv === 'production';
    if (!config.enabled || config.mode === 'off') {
        if (isProduction) {
            warnings.push('Shield is disabled (SENTINEL_SHIELD_MODE=off): run input/output are not filtered on the queue path');
        }
        return { warnings };
    }
    if (isProduction && config.mode === 'monitor') {
        warnings.push('SENTINEL_SHIELD_MODE=monitor in production: injection/PII/hallucination are logged (flag) but not blocked or masked on the run path');
    }
    const misconfigWarnings = getShieldMisconfigurationWarnings(config, options.openAiApiKey);
    warnings.push(...misconfigWarnings.map(w => w === 'Hallucination rewrite enabled but OPENAI_API_KEY not set'
        ? 'Shield hallucination rewrite is enabled but OPENAI_API_KEY is unset: rewrite will fail and runs will keep the original agent output'
        : w));
    return { warnings };
}
export function logShieldConfigValidation(shield, shieldMode, nodeEnv) {
    const config = shield.getConfig();
    const openAiApiKey = process.env['OPENAI_API_KEY'];
    const { warnings } = validateShieldProductionConfig(config, {
        nodeEnv,
        ...(openAiApiKey && { openAiApiKey }),
    });
    logger.info('Shield configuration applied', {
        shieldMode,
        enabled: shield.isEnabled(),
        mode: config.mode,
        detectors: {
            pii: config.pii.enabled,
            injection: config.injection.enabled,
            hallucination: config.hallucination.enabled,
        },
        injectionAction: config.injection.action,
        hallucinationAction: config.hallucination.action,
        rewriteEnabled: config.rewrite?.enabled ?? false,
    });
    if (warnings.length > 0) {
        logger.warn('Shield configuration warnings', { warnings });
    }
}
//# sourceMappingURL=shield-config.js.map