"use strict";
/**
 * RED-GREEN tests for F-NEW-PRODUCT-INFO-ACTION-SEPARATION (W1.6 of
 * F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
 *
 * Customer-path probe:
 *   1. Customer authors a company pack with `isolation: 'sourced-only'`.
 *   2. Bridge.applyPackPolicy() reads the pack and configures the isolator.
 *   3. Agent records an info-gathering action with sourceIds.
 *   4. Agent attempts a consequential action whose targetIds overlap with the
 *      sourced data -> gateConsequential returns DENY.
 *   5. Agent attempts a consequential action on independent data -> ALLOW.
 *
 * RED proof: a fresh bridge without applyPackPolicy / pack with isolation:'none'
 * never blocks. GREEN: with applyPackPolicy(pack with 'sourced-only'), the
 * overlapping target gets blocked.
 *
 * @connexum/ai-governance  F-NEW-PRODUCT-INFO-ACTION-SEPARATION
 */
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
const node_test_1 = require("node:test");
const assert = __importStar(require("node:assert/strict"));
const info_action_separation_1 = require("./info-action-separation");
const company_pack_builder_1 = require("./company-pack-builder");
const capability_classes_1 = require("./capability-classes");
function freshBridge(violationOutcome = 'DENY') {
    const operatorMap = new Map([['admin-alice', 'ADMIN']]);
    return new info_action_separation_1.InfoActionSeparationBridge({ testOperatorMap: operatorMap, violationOutcome });
}
(0, node_test_1.describe)('F-NEW-PRODUCT-INFO-ACTION-SEPARATION — bridge over AutonomousActionIsolator', () => {
    (0, node_test_1.it)('deriveIsolationMode picks the strictest across packs', () => {
        const pSourced = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p1',
            name: 'sourced-only pack',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'sourced-only',
        });
        const pStrict = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p2',
            name: 'strict pack',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
            isolation: 'strict',
        });
        const pNone = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p3',
            name: 'none pack',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.MCP, action: 'LOG' }],
            isolation: 'none',
        });
        const r1 = (0, info_action_separation_1.deriveIsolationMode)([pNone]);
        assert.equal(r1.mode, 'none');
        assert.deepEqual(r1.contributingPackIds, []);
        const r2 = (0, info_action_separation_1.deriveIsolationMode)([pSourced, pStrict, pNone]);
        assert.equal(r2.mode, 'strict');
        assert.deepEqual(r2.contributingPackIds, ['p2']);
        const r3 = (0, info_action_separation_1.deriveIsolationMode)([pSourced]);
        assert.equal(r3.mode, 'sourced-only');
        assert.deepEqual(r3.contributingPackIds, ['p1']);
    });
    (0, node_test_1.it)('STRICT mode: any info-gathering blocks ALL same-cycle consequential actions', async () => {
        const bridge = freshBridge();
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-strict',
            name: 'strict',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'strict',
        });
        const applied = bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        assert.equal(applied.mode, 'strict');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-1', ['url-hash-1'], ['p-strict']);
        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-1', { class: 'production-write', mutates: true, targetIds: ['file-99'] }, ['p-strict']);
        assert.equal(verdict.verdict, 'DENY');
        assert.equal(verdict.mode, 'strict');
    });
    (0, node_test_1.it)('SOURCED-ONLY mode: consequential ALLOWED on independent target (no source overlap)', async () => {
        const bridge = freshBridge();
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-sourced',
            name: 'sourced',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'sourced-only',
        });
        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-2', ['url-hash-1'], ['p-sourced']);
        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-2', { class: 'production-write', mutates: true, targetIds: ['unrelated-target'] }, ['p-sourced']);
        assert.equal(verdict.verdict, 'ALLOW');
    });
    (0, node_test_1.it)('SOURCED-ONLY mode: consequential DENIED when target overlaps with sourced data', async () => {
        const bridge = freshBridge();
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-sourced-2',
            name: 'sourced-2',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'sourced-only',
        });
        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-3', ['hostile-content-hash'], ['p-sourced-2']);
        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-3', { class: 'production-write', mutates: true, targetIds: ['hostile-content-hash'] }, ['p-sourced-2']);
        assert.equal(verdict.verdict, 'DENY');
    });
    (0, node_test_1.it)('NONE mode: never blocks (pure pass-through)', async () => {
        const bridge = freshBridge();
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-none',
            name: 'none',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.MCP, action: 'LOG' }],
            isolation: 'none',
        });
        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-4', ['anything'], ['p-none']);
        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-4', { class: 'production-write', mutates: true, targetIds: ['anything'] }, ['p-none']);
        assert.equal(verdict.verdict, 'ALLOW');
    });
    (0, node_test_1.it)('violationOutcome PENDING routes violations to PENDING instead of DENY', async () => {
        const bridge = freshBridge('PENDING');
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-pending',
            name: 'pending',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'strict',
        });
        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-5', ['x'], ['p-pending']);
        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-5', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-pending']);
        assert.equal(verdict.verdict, 'PENDING');
    });
    (0, node_test_1.it)('clearCycle resets the per-cycle source log', async () => {
        const bridge = freshBridge();
        const pack = (0, company_pack_builder_1.buildCompanyPack)({
            id: 'p-clear',
            name: 'clear',
            orgId: 'org-x',
            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
            isolation: 'strict',
        });
        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-6', ['x'], ['p-clear']);
        const v1 = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-6', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-clear']);
        assert.equal(v1.verdict, 'DENY');
        bridge.clearCycle('org-x', 'agent-1', 'cycle-6');
        const v2 = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-6', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-clear']);
        assert.equal(v2.verdict, 'ALLOW');
    });
    (0, node_test_1.it)('applyPackPolicy rejects empty pack list (fail-closed)', () => {
        const bridge = freshBridge();
        assert.throws(() => bridge.applyPackPolicy('org-x', 'agent-1', [], 'admin-alice'), /non-empty/);
    });
});
//# sourceMappingURL=info-action-separation.test.js.map