export function createRuntimeSandboxProfile(options) {
    const mode = options.mode ?? "read-only";
    const enforcement = options.enforcement ?? "env-only";
    return {
        mode,
        enforcement,
        cwd: options.cwd,
        writableRoots: options.writableRoots ?? defaultWritableRoots(mode, enforcement, options.cwd),
        readableRoots: options.readableRoots ?? [options.cwd],
        network: options.network ?? "unspecified",
        secretEnvPolicy: options.secretEnvPolicy ?? "drop-by-default",
        notes: options.notes ?? defaultSandboxNotes(enforcement),
    };
}
function defaultWritableRoots(mode, enforcement, cwd) {
    if (mode === "workspace-write" && enforcement === "provider-native")
        return [cwd];
    return [];
}
function defaultSandboxNotes(enforcement) {
    if (enforcement === "provider-native") {
        return [
            "OMK sanitizes child env.",
            "Runtime receives provider-native sandbox flags.",
            "OMK does not yet enforce OS-level filesystem or network isolation.",
        ];
    }
    if (enforcement === "env-only") {
        return [
            "Child runtime env is sanitized.",
            "OS-level sandboxing is future work.",
        ];
    }
    return ["OS-level sandbox enforcement is not configured."];
}
