"use strict";
/**
 * Human-Input Compliance Gate — Trust Score component #5.
 *
 * When a human-in-the-loop sends input TO an agent, evaluate that input against
 * the agent's bound COMPLIANCE packs and return a WARN/BLOCK advisory. This
 * catches a human operator INNOCENTLY requesting a rule-breaking action — e.g.
 * "email the full patient record to dr.smith@external.com" — which contains no
 * adversarial pattern but violates a HIPAA PHI-exfiltration rule.
 *
 * This is ORTHOGONAL to adversarial prompt-injection detection
 * (src/security/prompt-injection-detector.ts): that catches attacks; this
 * catches honest human compliance errors. Both gates coexist on the inbound path.
 *
 * Reuses the existing PackDrivenClassifier — no new classification logic. The
 * classifier already maps text + bound packs → a 5-action GovernanceAction.
 *
 * Locked Invariant 3 (graceful degradation): this function NEVER throws. Any
 * internal error fails OPEN (advisory 'ALLOW') so the gate never blocks an agent
 * because of its own fault. The CALLER decides whether to enforce a BLOCK/
 * REQUIRE_APPROVAL advisory (the SDK's existing GovernanceViolation /
 * GovernancePendingApproval contract) — the gate itself is purely advisory.
 *
 * @connexum/ai-governance  F-NEW-TRUST-SCORE-5
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.evaluateHumanInputCompliance = evaluateHumanInputCompliance;
const pack_driven_classifier_js_1 = require("../classification/pack-driven-classifier.js");
function allow(reason) {
    return { advisory: 'ALLOW', matched: [], decisionId: null, flagged: false, reason };
}
/**
 * Evaluate human-in-the-loop input against the agent's bound compliance packs.
 *
 * @param inputText      The human/operator input (e.g. concatenated user messages).
 * @param activePackIds  The agent's bound compliance pack ids (filters evaluation).
 * @param config         Optional injectable classifier + enable flag.
 * @returns              A never-throwing advisory result; fails OPEN to ALLOW on error.
 */
function evaluateHumanInputCompliance(inputText, activePackIds, config = {}) {
    try {
        if (config.enabled === false)
            return allow('gate disabled');
        if (!inputText || inputText.trim().length === 0)
            return allow('empty input');
        if (activePackIds.length === 0)
            return allow('no bound compliance packs');
        const classifier = config.classifier ?? (0, pack_driven_classifier_js_1.getGlobalClassifier)();
        const decision = classifier.evaluate(inputText, { activePackIds: [...activePackIds] });
        const flagged = decision.matched.length > 0 && decision.action !== 'ALLOW' && decision.action !== 'LOG';
        if (!flagged) {
            return {
                advisory: decision.action,
                matched: decision.matched,
                decisionId: decision.decisionId,
                flagged: false,
                reason: decision.matched.length === 0
                    ? 'no compliance rule matched the human input'
                    : `matched ${decision.matched.length} rule(s) at advisory action '${decision.action}'`,
            };
        }
        const rules = decision.matched
            .map((m) => `${m.packId}/${m.categoryId}`)
            .join(', ');
        return {
            advisory: decision.action,
            matched: decision.matched,
            decisionId: decision.decisionId,
            flagged: true,
            reason: `human input matched ${decision.matched.length} bound compliance rule(s) [${rules}] → ${decision.action}`,
        };
    }
    catch {
        // Invariant 3: never throw, never block the agent on our own fault.
        return allow('gate evaluation error (fail-open)');
    }
}
//# sourceMappingURL=human-input-compliance-gate.js.map