/**
 * config.ts — Centralized security configuration.
 *
 * Reads from env vars at startup, cached for the process lifetime.
 * Test helpers follow the embeddingProvider.ts pattern.
 */
import * as path from "node:path";
const DEFAULT_CONFIG = {
    mode: "strict",
    allowedRoots: [process.cwd()],
    maxExecTimeoutMs: 60_000,
    auditEnabled: true,
    extraExecAllowList: [],
};
let _config = null;
export function getSecurityConfig() {
    if (_config)
        return _config;
    const mode = process.env.NODEBENCH_SECURITY_MODE ?? "strict";
    const rootsEnv = process.env.NODEBENCH_ALLOWED_ROOTS;
    const allowedRoots = rootsEnv
        ? rootsEnv.split(",").map((r) => path.resolve(r.trim()))
        : [process.cwd()];
    const timeoutEnv = process.env.NODEBENCH_EXEC_TIMEOUT_MS;
    const maxExecTimeoutMs = timeoutEnv
        ? Math.min(parseInt(timeoutEnv, 10) || 60_000, 60_000)
        : 60_000;
    const auditEnabled = process.env.NODEBENCH_AUDIT_ENABLED !== "false";
    const extraEnv = process.env.NODEBENCH_EXEC_ALLOWLIST;
    const extraExecAllowList = extraEnv
        ? extraEnv.split(",").map((s) => s.trim())
        : [];
    _config = { mode, allowedRoots, maxExecTimeoutMs, auditEnabled, extraExecAllowList };
    return _config;
}
export function setSecurityConfig(partial) {
    _config = { ...getSecurityConfig(), ...partial };
}
/** Test helper — reset to defaults */
export function _resetSecurityConfigForTesting() {
    _config = null;
}
//# sourceMappingURL=config.js.map