package host

import "github.com/carlosframework/platform/internal/release"

// pointerRatchet is #253's ratchet for this process (spec §4.6), the one
// SharedDigestRatchet keeps, so a fresh call per pass is the same object.
// Root writes its marks under /opt (root-owned); the agent, sandboxed out of
// /opt, writes under its data dir. Each reads both, so a mark either side
// wrote protects the whole box. CARLOS_REQUIRE_POINTER_DIGEST applies to both.
func pointerRatchet(root bool, optDir, dataDir string, getenv func(string) string) *release.DigestRatchet {
	rootDir, edgeDir := release.RootRatchetDir(optDir), release.EdgeRatchetDir(dataDir)
	require := release.RequirePointerDigest(getenv)
	if root {
		return release.SharedDigestRatchet(rootDir, []string{edgeDir}, require)
	}
	return release.SharedDigestRatchet(edgeDir, []string{rootDir}, require)
}