/**
 * Bounded public contract for the remote-command lifecycle audit projection
 * (GAP 3). The command.* ledger records a finite, sanitized vocabulary — command
 * id, event kind, category, device id, outcome, reason code, timestamp. Raw RCA
 * params, file paths, tokens, and signatures are NEVER part of this surface: the
 * projection maps from a fixed allowlist of metadata keys and drops everything
 * else, and the response still flows through the publicResponse leak scan.
 */
import { isUnsafePublicString } from "../runs/runProjectionContract.js";
export const REMOTE_COMMAND_AUDIT_CONTRACT_VERSION = "v1";
/** The six command.* lifecycle event types, as finite projection kinds. */
export const REMOTE_COMMAND_AUDIT_KINDS = [
    "received",
    "denied",
    "authorized",
    "confirm_required",
    "executed",
    "result",
];
const KIND_BY_EVENT_TYPE = {
    "command.received": "received",
    "command.denied": "denied",
    "command.authorized": "authorized",
    "command.confirm_required": "confirm_required",
    "command.executed": "executed",
    "command.result": "result",
};
export const REMOTE_COMMAND_AUDIT_OUTCOMES = ["success", "failure"];
export const REMOTE_COMMAND_AUDIT_MODES = ["silent", "confirmed"];
export function readAuditKind(eventType) {
    return KIND_BY_EVENT_TYPE[eventType] ?? null;
}
/**
 * Reads a bounded identifier-like string from metadata, dropping anything that
 * trips the unsafe-public-string guard (absolute paths, secret prefixes, etc.)
 * or exceeds a conservative length. Returns null when absent or unsafe.
 */
export function readBoundedAuditString(value) {
    if (typeof value !== "string")
        return null;
    const trimmed = value.trim();
    if (trimmed.length === 0 || trimmed.length > 200)
        return null;
    if (isUnsafePublicString(trimmed))
        return null;
    return trimmed;
}
export function readAuditOutcome(value) {
    return value === "success" || value === "failure" ? value : null;
}
export function readAuditMode(value) {
    return value === "silent" || value === "confirmed" ? value : null;
}
