"use strict";
/**
 * ProviderCompliance boot-hook -- operator-visible configuration verification.
 *
 * C-2 (2026-04-21, fail-open remediation): flipping strictMode default to
 * true in the constructor is necessary but not sufficient. An operator can
 * still explicitly pass `strictMode: false` and silently degrade the
 * compliance posture. This boot-hook surfaces that configuration at process
 * start with explicit errors and warnings so it cannot hide in production.
 *
 * Call this from the server boot sequence (e.g. packages/governance-server
 * index) BEFORE accepting traffic. When `ok` is false, refuse to boot.
 *
 * IMPORTANT (2026-04-21): hook ready; wire into packages/governance-server
 * src/index.ts after P1C-03 fix lands. A concurrent agent owns that file in
 * this cycle, so the wiring commit is deferred to a follow-up.
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.verifyProviderComplianceConfig = verifyProviderComplianceConfig;
const log_1 = require("../util/log");
const log = (0, log_1.createLogger)('provider-compliance-boot');
/**
 * Verify the instantiated ProviderCompliance enforcer is in a safe
 * production posture. Returns a structured result; the caller decides
 * whether to refuse boot, though `ok: false` is strong signal to abort.
 *
 * Error conditions:
 *   - `strictMode: false` AND any `expectedProviders` entry resolves to
 *     an unknown provider (would have been silently approved under the
 *     old buggy default). Rejects boot.
 *   - Any `expectedProviders` entry that is rejected by the enforcer
 *     (unknown or pack-blocked under strict mode). Rejects boot.
 *
 * Warning conditions:
 *   - `strictMode: false` with no unknown expected providers. Boot is
 *     still permitted but permissive mode is logged at WARN.
 */
function verifyProviderComplianceConfig(enforcer, options = {}) {
    const expectedProviders = options.expectedProviders ?? [];
    const rejectPermissivePlusUnknown = options.rejectPermissivePlusUnknown ?? true;
    const strict = enforcer.isStrictMode();
    const activePacks = enforcer.getActivePacks();
    const warnings = [];
    const errors = [];
    // 1. strictMode disabled is a warning in isolation.
    if (!strict) {
        warnings.push('[provider-compliance-boot] strictMode is DISABLED. Known providers with missing capabilities will be allowed with warnings. This configuration should NOT be used in production.');
    }
    // 2. Check every expected provider against the enforcer.
    const unknownExpected = [];
    const blockedExpected = [];
    for (const providerId of expectedProviders) {
        const check = enforcer.check(providerId);
        const isUnknownReason = check.reasons.some(r => r.includes('[PROVIDER_UNKNOWN]'));
        if (isUnknownReason) {
            unknownExpected.push(providerId);
        }
        if (!check.allowed) {
            blockedExpected.push({ provider: providerId, reasons: check.reasons });
        }
    }
    if (blockedExpected.length > 0) {
        for (const b of blockedExpected) {
            errors.push(`[provider-compliance-boot] expected provider '${b.provider}' is not allowed by the enforcer: ${b.reasons.join('; ')}`);
        }
    }
    // 3. The critical combination: permissive mode PLUS unknown expected
    // providers is the exact failure mode C-2 documented. Refuse boot.
    if (!strict && unknownExpected.length > 0 && rejectPermissivePlusUnknown) {
        errors.push(`[provider-compliance-boot] strictMode is disabled AND expected providers include unknown entries (${unknownExpected.join(', ')}). This is the C-2 fail-open configuration; boot refused.`);
    }
    const ok = errors.length === 0;
    const result = {
        ok,
        warnings,
        errors,
        snapshot: {
            strictMode: strict,
            activePacks,
            expectedProviders: [...expectedProviders],
        },
    };
    if (!ok) {
        log.error('provider-compliance boot verification FAILED', {
            errors,
            warnings,
            snapshot: result.snapshot,
        });
    }
    else if (warnings.length > 0) {
        log.warn('provider-compliance boot verification passed with warnings', {
            warnings,
            snapshot: result.snapshot,
        });
    }
    else {
        log.info('provider-compliance boot verification passed', {
            snapshot: result.snapshot,
        });
    }
    return result;
}
//# sourceMappingURL=provider-compliance-boot.js.map