"use strict";
/**
 * ToolsetRegistry — per-profile toolset allow/deny enforcement.
 *
 * Story 5.3 — OpenLife v1.3 Agent OS Integration.
 *
 * Reads the active Profile (via ProfileManager) and decides whether a
 * given toolset is in scope. Callers ask via `isAllowed(toolset)` before
 * dispatching tool use.
 *
 * Profile.toolsetAllowed:
 *   - ['*']  → all 15 categories allowed (backwards-compatible default)
 *   - ['file', 'web', 'memory']  → only these three allowed
 *   - []    → nothing allowed (locked-down profile)
 *
 * v1.3 also persists the registry's last decision per session for audit;
 * v1.4 will wire this to the executor sandbox.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.ToolsetRegistry = void 0;
const ProfileManager_1 = require("../../cli/ProfileManager");
const ToolsetSchema_1 = require("./ToolsetSchema");
class ToolsetRegistry {
    profileManager;
    constructor(opts = {}) {
        this.profileManager = opts.profileManager || new ProfileManager_1.ProfileManager();
    }
    /** Return the set of toolsets allowed by the active profile, or all when no profile set. */
    allowedForActiveProfile() {
        const { profile } = this.profileManager.active();
        return this.computeAllowed(profile);
    }
    allowedForProfile(profileId) {
        const profile = this.profileManager.show(profileId);
        return this.computeAllowed(profile);
    }
    computeAllowed(profile) {
        if (!profile)
            return new Set(ToolsetSchema_1.ALL_TOOLSETS);
        if (!profile.toolsetAllowed || profile.toolsetAllowed.length === 0)
            return new Set();
        if (profile.toolsetAllowed.includes('*'))
            return new Set(ToolsetSchema_1.ALL_TOOLSETS);
        const out = new Set();
        for (const item of profile.toolsetAllowed) {
            if (ToolsetSchema_1.ALL_TOOLSETS.includes(item)) {
                out.add(item);
            }
        }
        return out;
    }
    isAllowed(toolset, profileId) {
        const allowed = profileId
            ? this.allowedForProfile(profileId)
            : this.allowedForActiveProfile();
        if (allowed.has(toolset)) {
            return { allowed: true, reason: 'in_profile_allowlist', toolset };
        }
        return { allowed: false, reason: 'not_in_profile_allowlist', toolset };
    }
    list() {
        return ToolsetSchema_1.ALL_TOOLSETS;
    }
}
exports.ToolsetRegistry = ToolsetRegistry;
