export enum EnvEnum {
  PROD = 'prod',
  DEMO = 'demo',
  STAGING = 'staging',
  DEV = 'dev',
  CI = 'ci',
  LOCAL = 'local'
}

/**
 * Deployment model for the running process.
 *
 * WARNING — opposing defaults by context: `parseDeploymentType` in
 * `@superblocksteam/telemetry/common/deployment-type` (server-side) defaults a MISSING OR
 * EMPTY value to `CLOUD` (fail-open — the server is trusted internal infrastructure) and
 * THROWS on unrecognized values. `isBrowserTelemetryEnabled` in this module (browser-side)
 * fails CLOSED — missing, empty, and unrecognized values all disable telemetry. Both are
 * correct in their contexts (the browser reads values from an untrusted env-var pipeline),
 * but the asymmetry is easy to miss. When adding new deployment-type-gated policies, pick
 * the fail direction deliberately and document it.
 */
export enum DeploymentTypeEnum {
  CLOUD = 'cloud',
  CLOUD_PREM = 'cloud-prem'
}

/**
 * Returns whether browser telemetry (Datadog RUM, browser-logs) may be initialized.
 * Allowlist-on-CLOUD: any non-CLOUD value — CLOUD_PREM, undefined, empty string,
 * typos ('cloud_prem', 'CLOUD-PREM'), or future deployment types — disables telemetry.
 * Cloud-prem deployments must not emit to Superblocks' public intake (customer network egress);
 * fail-closed on ambiguity is the correct default for a privacy gate.
 *
 * Parameter widened to `string | undefined` because call sites pull from env.get() with an
 * `as DeploymentTypeEnum` cast — any string can actually arrive (empty, typo, whitespace,
 * unexpected value). The strict equality still narrows correctly; the wider type makes the
 * runtime truth explicit at the boundary.
 */
export const isBrowserTelemetryEnabled = (deploymentType: string | undefined): boolean => {
  return deploymentType === DeploymentTypeEnum.CLOUD;
};