import { BestAgentError } from "@best-agent/foundation";
export async function authorizePreparedToolExecution(input) {
    const { authorizationTurn, options, persistTerminalToolFailure, prepared, preparedToolResumeContext, profile, runtime, shellDebugBase, toolCallId, toolDefinition, toolName, turn, } = input;
    const toolCapabilityRequest = toolDefinition.source === "plugin"
        ? { group: "tool", kind: "plugin-hook", toolName }
        : { group: "tool", toolName };
    if (shellDebugBase) {
        runtime.tracing.logShellToolDebug(runtime.cwd, "shell.authorization.tool.start", {
            ...shellDebugBase,
            callId: toolCallId,
            request: runtime.tracing.describeCapabilityRequestForDebugLog(toolCapabilityRequest),
        });
    }
    const toolAuthorization = await runtime.approvals.authorizeCapability(authorizationTurn, profile, toolCapabilityRequest, toolCallId, options.resumeCheckpoint?.kind === "approval" ? options.resumeCheckpoint : undefined, {
        ...preparedToolResumeContext,
        toolCallId,
    }, turn);
    if (shellDebugBase) {
        runtime.tracing.logShellToolDebug(runtime.cwd, "shell.authorization.tool.done", {
            ...shellDebugBase,
            callId: toolCallId,
            result: runtime.tracing.describeAuthorizationResultForDebugLog(toolAuthorization),
        });
    }
    if (toolAuthorization !== "allow") {
        const termination = runtime.interruptions.createTurnTerminatedError(toolAuthorization);
        await persistTerminalToolFailure(toolCallId, prepared.normalizedInput, undefined, termination);
        throw termination;
    }
    let executionSandboxProfile;
    for (const request of prepared.capabilityRequests) {
        const normalizedRequest = toolDefinition.source === "plugin" && !request.kind
            ? { ...request, kind: "plugin-hook" }
            : request;
        if (shellDebugBase) {
            runtime.tracing.logShellToolDebug(runtime.cwd, "shell.authorization.capability.start", {
                ...shellDebugBase,
                callId: toolCallId,
                request: runtime.tracing.describeCapabilityRequestForDebugLog(normalizedRequest),
            });
        }
        const deterministicDenial = runtime.capability.getDeterministicCapabilityDenial(profile, normalizedRequest);
        if (deterministicDenial) {
            const failureOutput = await persistTerminalToolFailure(toolCallId, prepared.normalizedInput, {
                ...preparedToolResumeContext,
                toolCallId,
            }, new BestAgentError("TOOL_CAPABILITY_DENIED", deterministicDenial));
            if (failureOutput !== undefined) {
                return { failureOutput };
            }
            throw new BestAgentError("TOOL_CAPABILITY_DENIED", deterministicDenial);
        }
        const authorization = await runtime.approvals.authorizeCapability(authorizationTurn, profile, normalizedRequest, toolCallId, options.resumeCheckpoint?.kind === "approval" ? options.resumeCheckpoint : undefined, {
            ...preparedToolResumeContext,
            toolCallId,
        }, turn);
        if (shellDebugBase) {
            runtime.tracing.logShellToolDebug(runtime.cwd, "shell.authorization.capability.done", {
                ...shellDebugBase,
                callId: toolCallId,
                request: runtime.tracing.describeCapabilityRequestForDebugLog(normalizedRequest),
                result: runtime.tracing.describeAuthorizationResultForDebugLog(authorization),
            });
        }
        if (authorization !== "allow") {
            const termination = runtime.interruptions.createTurnTerminatedError(authorization);
            await persistTerminalToolFailure(toolCallId, prepared.normalizedInput, undefined, termination);
            throw termination;
        }
        executionSandboxProfile = runtime.capability.mergeSandboxProfiles(executionSandboxProfile, runtime.capability.policyForProfile(profile).evaluate(normalizedRequest).sandboxProfile);
    }
    return { executionSandboxProfile };
}
//# sourceMappingURL=tool-capability-evaluation.js.map