// Task 443 — Refuse agent-origin deletes targeting the per-account root
// `:LocalBusiness`. Mirrors the write-side gate in `label-origin-gate.ts`
// (Task 350): the installer's seed-neo4j.sh writes the single root via raw
// cypher (system origin); resets that need to remove + re-seed call the
// memory-delete primitive with `origin: "system"`. Without this gate an
// agent or specialist can soft-delete the immutable per-account root via
// `memory-delete`, and a subsequent `memory-empty-trash` will DETACH DELETE
// it from the graph.
const RESERVED_LABEL = "LocalBusiness";
const SYSTEM_ORIGIN = "system";
export const RESERVED_LABEL_DELETE_REFUSAL = `Delete blocked (reserved-label): ${RESERVED_LABEL} is the per-account root ` +
    `seeded by the installer and held immutable. ` +
    `See platform/plugins/memory/references/schema-base.md.`;
export function checkLabelDeleteGate(args) {
    const { labels, origin, accountId, elementId, tool } = args;
    if (!labels.includes(RESERVED_LABEL)) {
        return { ok: true };
    }
    if ((origin ?? "") === SYSTEM_ORIGIN) {
        return { ok: true };
    }
    const acctPrefix = accountId ? accountId.slice(0, 8) : "<none>";
    const eidPrefix = elementId ? elementId.slice(0, 16) : "<none>";
    process.stderr.write(`[label-delete-gate] reject accountId=${acctPrefix} elementId=${eidPrefix} label=${RESERVED_LABEL} tool=${tool}\n`);
    return {
        ok: false,
        reason: "reserved-label",
        message: RESERVED_LABEL_DELETE_REFUSAL,
    };
}
//# sourceMappingURL=label-delete-gate.js.map