/**
 * T14 · Audit-alert wiring. Turns the INV1 tripwire into a RUNTIME detector: a
 * `cross-tenant-attempt` audit event fires an operator alert immediately (EXPLORE §4e HIGH). Alert
 * payload carries metadata only (no terminal bytes, INV10).
 */
import type { AuditEvent } from '../types.js'

export type AlertKind = 'cross-tenant' | 'revocation' | 'auth-anomaly'

export interface Alerter {
  fire(kind: AlertKind, e: AuditEvent): Promise<void>
}

/** Fires a `cross-tenant` alert on `action === 'cross-tenant-attempt'`; no-op otherwise. */
export async function onAuditEvent(e: AuditEvent, alerter: Alerter): Promise<void> {
  if (e.action === 'cross-tenant-attempt') {
    await alerter.fire('cross-tenant', e)
  }
}