// Quality Intelligence source envelope (Epic #270, Issue #277).
//
// A source envelope carries refer-by-ref metadata about a single input scope used to
// derive evidence atoms. ENVELOPES NEVER CARRY RAW CONTENT — they carry an opaque
// `localRef` string the runtime resolves against the workspace, local-knowledge
// capsule store, or other adapter. No URLs, no credentials, no large content blobs.
//
// Discriminated union over `kind`:
//   * repository-context     — refer to a repo workspace path or scope id.
//   * local-knowledge-capsule — refer to a KnowledgeCapsuleId or sub-scope.
//   * figma-evidence          — refer to a local Figma evidence cache id.
//   * human-context           — refer to a human-authored note id (Conversation Center).
//   * connector-document      — refer to an opaque connector document id.
//
// Provenance + integrity hash give the audit ledger (#274) a stable footprint without
// embedding any payload.
export const QUALITY_INTELLIGENCE_SOURCE_KINDS = [
    "repository-context",
    "local-knowledge-capsule",
    "figma-evidence",
    "human-context",
    "connector-document",
];
/**
 * Cheap structural guard: rejects envelopes that look like they may carry credentials,
 * URLs, or oversized labels in their display surface. Pure, no IO.
 *
 * The runtime that builds envelopes is responsible for ALL redaction; this helper is
 * a defence-in-depth check the audit ledger can use before persisting.
 */
export const looksLikeBrowserSafeSourceEnvelope = (envelope) => {
    const { displayLabel, provenance, localRef } = envelope;
    if (displayLabel.length === 0 || displayLabel.length > 256)
        return false;
    if (/https?:\/\//iu.test(displayLabel))
        return false;
    if (/https?:\/\//iu.test(localRef))
        return false;
    if (/^[A-Za-z0-9+/]{40,}={0,2}$/u.test(displayLabel))
        return false; // base64-ish
    if (!/^[0-9a-f]{64}$/u.test(provenance.integrityHashSha256Hex))
        return false;
    return true;
};
