// ---------------------------------------------------------------------------
// Platform security check — queries external SAST scan results (best-effort)
// ---------------------------------------------------------------------------
const BASE_URL = "https://verified-skill.com";
// ---------------------------------------------------------------------------
// Runtime validation helpers
// ---------------------------------------------------------------------------
const VALID_STATUSES = new Set(["PASS", "FAIL", "PENDING", "TIMED_OUT"]);
const VALID_VERDICTS = new Set(["PASS", "FAIL", "CONCERNS", "PENDING"]);
const VALID_OVERALL = new Set(["PASS", "FAIL", "PENDING", "TIMED_OUT", "CERTIFIED"]);
function sanitizeLogValue(v) {
    return String(v).replace(/[\x00-\x1f\x7f]/g, "").slice(0, 50);
}
function validateEnum(value, allowed, fallback) {
    const upper = value.toUpperCase();
    if (allowed.has(upper))
        return upper;
    console.warn(`[platform-security] invalid enum value "${sanitizeLogValue(value)}", using fallback "${fallback}"`);
    return fallback;
}
function safeNumber(value, fallback) {
    if (value === "") {
        console.warn(`[platform-security] empty string coerced to ${fallback}`);
        return fallback;
    }
    const n = Number(value ?? fallback);
    if (isNaN(n)) {
        console.warn(`[platform-security] non-numeric value coerced to ${fallback}: ${sanitizeLogValue(value)}`);
        return fallback;
    }
    return n;
}
/**
 * Check external SAST scan results from the platform API.
 * Returns null on any network/API error (best-effort, non-fatal).
 */
export async function checkPlatformSecurity(skillName) {
    try {
        const url = `${BASE_URL}/api/v1/skills/${skillName.split("/").map(encodeURIComponent).join("/")}/security`;
        const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
        if (!res.ok) {
            console.warn(`[platform-security] HTTP ${res.status} for ${sanitizeLogValue(skillName)}`);
            return null;
        }
        const data = (await res.json());
        const providers = (data.providers || []).map((p) => ({
            provider: String(p.provider || ""),
            status: validateEnum(String(p.status || "PENDING"), VALID_STATUSES, "PENDING"),
            verdict: p.verdict == null ? null : validateEnum(String(p.verdict), VALID_VERDICTS, "PENDING"),
            criticalCount: safeNumber(p.criticalCount, 0),
        }));
        // Empty providers = no scan data available — report as PENDING, not all-clear
        const overallVerdict = providers.length === 0
            ? "PENDING"
            : validateEnum(String(data.overallVerdict || "PENDING"), VALID_OVERALL, "PENDING");
        const hasCritical = providers.some((p) => p.status === "FAIL" && p.criticalCount > 0);
        return {
            hasCritical,
            overallVerdict,
            providers,
            reportUrl: String(data.reportUrl || ""),
        };
    }
    catch (err) {
        console.warn(`[platform-security] check failed for ${sanitizeLogValue(skillName)}: ${err instanceof Error ? err.message : String(err)}`);
        return null;
    }
}
//# sourceMappingURL=platform-security.js.map