"use strict";
/**
 * ToolsetGuard — thin enforcement point for executor sandboxes.
 *
 * Story 10.1 + 10.2 — OpenLife v1.4.
 *
 * Wraps `ToolsetRegistry.isAllowed()` with an env-flag gate so v1.4 can
 * land enforcement at all 5 critical execution sites without breaking
 * existing flows. Default: OFF.
 *
 * Locked decision 1 of v1.4 plan: `OPENLIFE_TOOLSET_ENFORCEMENT=on` is
 * opt-in for v1.4; flips to default-on in v1.5 after soak.
 *
 * Stable error code: `toolset_blocked:<category>`.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.ToolsetBlockedError = void 0;
exports.isToolsetAllowed = isToolsetAllowed;
exports.assertToolsetAllowed = assertToolsetAllowed;
exports._resetToolsetGuardCache = _resetToolsetGuardCache;
const ToolsetRegistry_1 = require("./ToolsetRegistry");
let _registryCache = null;
class ToolsetBlockedError extends Error {
    code;
    toolset;
    constructor(toolset, reason) {
        super(`toolset_blocked:${toolset} (${reason})`);
        this.name = 'ToolsetBlockedError';
        this.code = `toolset_blocked:${toolset}`;
        this.toolset = toolset;
    }
}
exports.ToolsetBlockedError = ToolsetBlockedError;
/**
 * Check whether a toolset category is allowed for the current process.
 *
 * - When `OPENLIFE_TOOLSET_ENFORCEMENT` is anything other than 'on',
 *   returns true unconditionally (enforcement disabled).
 * - When enabled, consults the active Profile via ToolsetRegistry.
 *
 * Never throws — callers wanting to throw use `assertAllowed`.
 */
function isToolsetAllowed(toolset) {
    if ((process.env.OPENLIFE_TOOLSET_ENFORCEMENT || '').toLowerCase() !== 'on') {
        return true;
    }
    if (!_registryCache)
        _registryCache = new ToolsetRegistry_1.ToolsetRegistry();
    return _registryCache.isAllowed(toolset).allowed;
}
/**
 * Throw `ToolsetBlockedError` if the toolset is not allowed. Use at
 * hook points before spawning processes, writing files, or making
 * network calls.
 */
function assertToolsetAllowed(toolset, hint) {
    if ((process.env.OPENLIFE_TOOLSET_ENFORCEMENT || '').toLowerCase() !== 'on')
        return;
    if (!_registryCache)
        _registryCache = new ToolsetRegistry_1.ToolsetRegistry();
    const decision = _registryCache.isAllowed(toolset);
    if (!decision.allowed) {
        throw new ToolsetBlockedError(toolset, hint || decision.reason);
    }
}
/** Test seam — reset the cache so a test can swap profiles. */
function _resetToolsetGuardCache() {
    _registryCache = null;
}
