// Task 350 + Task 448 — Refuse agent-origin *creates* of a second
// `:LocalBusiness`. The installer's seed-neo4j.sh writes the single root node
// via raw cypher (createdBy.agent === 'system' by convention); third-party
// companies must go to `:Organization` per schema-base.md. Without this gate
// an agent mislabel either silently corrupts the operator's root via MERGE
// or trips the UNIQUE constraint on LocalBusiness.accountId.
//
// Scope is creates only (`memory-write`). Property updates against the
// existing root (`memory-update`, elementId-resolved + accountId-scoped)
// cannot create a new node, so the gate does not apply there — they are
// guarded by checkLabelWriteGate + checkGraphWriteGate + property restriction.
const RESERVED_LABEL = "LocalBusiness";
const SYSTEM_AGENT = "system";
export const RESERVED_LABEL_REFUSAL = `Creating a second ${RESERVED_LABEL} is refused — it is the per-account root ` +
    `seeded by the installer. Use Organization for third-party companies — see ` +
    `platform/plugins/memory/references/schema-base.md. ` +
    `To edit the existing root, use memory-update against its elementId.`;
export function checkLabelOriginGate(args) {
    const { labels, createdBy, accountId, tool } = args;
    if (!labels.includes(RESERVED_LABEL)) {
        return { ok: true };
    }
    if ((createdBy.agent ?? "") === SYSTEM_AGENT) {
        return { ok: true };
    }
    const acctPrefix = accountId ? accountId.slice(0, 8) : "<none>";
    const agent = createdBy.agent ?? "<unset>";
    console.error(`[label-origin-gate] reject accountId=${acctPrefix} label=${RESERVED_LABEL} agent=${agent} tool=${tool}`);
    return {
        ok: false,
        reason: "reserved-label",
        message: RESERVED_LABEL_REFUSAL,
    };
}
//# sourceMappingURL=label-origin-gate.js.map