"use strict";
/**
 * Build a ToolContext from the envelope's pre-resolved principal.
 *
 * Pure data transformation — no DB calls. The principal was resolved
 * at the front door (API route, cron, escalation re-run) and travels
 * with the envelope.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.buildToolContextFromEnvelope = buildToolContextFromEnvelope;
const delegation_1 = require("../auth/delegation");
function buildToolContextFromEnvelope(envelope, workflowId, traceId, spanId) {
    const principal = envelope?.lt?.principal;
    if (!principal)
        return null;
    const scopes = envelope.lt?.scopes ?? ['mcp:tool:call'];
    const delegationToken = (0, delegation_1.createDelegationToken)(principal.id, scopes, 300, { workflowId });
    return {
        principal,
        ...(envelope.lt?.initiatingPrincipal
            ? { initiatingPrincipal: envelope.lt.initiatingPrincipal }
            : {}),
        credentials: { delegationToken, scopes },
        trace: {
            originId: envelope.lt?.originId,
            parentId: envelope.lt?.parentId,
            workflowId,
            traceId,
            spanId,
        },
    };
}
