const PROVIDERS_ENV = "OM_AI_AVAILABLE_PROVIDERS";
function envProvidersVarName() {
  return PROVIDERS_ENV;
}
function envModelsVarName(providerId) {
  const envSafeProviderId = providerId.toUpperCase().replace(/[^A-Z0-9]/g, "_");
  return `OM_AI_AVAILABLE_MODELS_${envSafeProviderId}`;
}
function envSafeId(value) {
  return value.toUpperCase().replace(/[^A-Z0-9]/g, "_");
}
function agentOverrideProvidersVarName(agentId) {
  return `OM_AI_AGENT_${envSafeId(agentId)}_AVAILABLE_PROVIDERS`;
}
function agentOverrideModelsVarName(agentId, providerId) {
  return `OM_AI_AGENT_${envSafeId(agentId)}_AVAILABLE_MODELS_${envSafeId(providerId)}`;
}
function normalizeProviderId(value) {
  return value?.trim().toLowerCase().replace(/_/g, "-") ?? "";
}
function providerIdAliases(providerId) {
  const normalized = normalizeProviderId(providerId);
  if (!normalized) return [];
  return Array.from(/* @__PURE__ */ new Set([normalized, normalized.replace(/-/g, "_")]));
}
function canonicalProviderId(providerId, knownProviderIds) {
  const normalized = normalizeProviderId(providerId);
  return knownProviderIds.find((id) => normalizeProviderId(id) === normalized) ?? null;
}
function canonicalizeProviderList(providerIds, knownProviderIds) {
  if (providerIds === null) return null;
  const result = [];
  const seen = /* @__PURE__ */ new Set();
  for (const providerId of providerIds) {
    const canonical = canonicalProviderId(providerId, knownProviderIds) ?? normalizeProviderId(providerId);
    const key = normalizeProviderId(canonical);
    if (seen.has(key)) continue;
    seen.add(key);
    result.push(canonical);
  }
  return result;
}
function parseList(raw) {
  if (raw === void 0) return null;
  const trimmed = raw.trim();
  if (trimmed.length === 0) return null;
  const items = trimmed.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
  return items.length > 0 ? items : null;
}
function readAllowedProviders(env = process.env) {
  return parseList(env[PROVIDERS_ENV]);
}
function readAllowedModels(env, providerId) {
  return parseList(env[envModelsVarName(providerId)]);
}
function readAllowlistConfig(env = process.env, knownProviderIds = []) {
  const providers = readAllowedProviders(env);
  const modelsByProvider = {};
  for (const providerId of knownProviderIds) {
    const list = readAllowedModels(env, providerId);
    if (list !== null) modelsByProvider[providerId] = list;
  }
  return {
    providers,
    modelsByProvider,
    hasRestrictions: providers !== null || Object.keys(modelsByProvider).length > 0
  };
}
function isProviderAllowed(env, providerId) {
  const allowed = readAllowedProviders(env);
  if (allowed === null) return true;
  const needle = normalizeProviderId(providerId);
  return allowed.some((id) => normalizeProviderId(id) === needle);
}
function isModelAllowedForProvider(env, providerId, modelId) {
  const allowed = readAllowedModels(env, providerId);
  if (allowed === null) return true;
  return allowed.includes(modelId);
}
function isProviderModelAllowed(env, providerId, modelId) {
  return isProviderAllowed(env, providerId) && isModelAllowedForProvider(env, providerId, modelId);
}
function modelAllowlistEnvVarName(providerId) {
  return envModelsVarName(providerId);
}
function providerAllowlistEnvVarName() {
  return envProvidersVarName();
}
function agentOverrideProviderAllowlistEnvVarName(agentId) {
  return agentOverrideProvidersVarName(agentId);
}
function agentOverrideModelAllowlistEnvVarName(agentId, providerId) {
  return agentOverrideModelsVarName(agentId, providerId);
}
function hasAllowlistSnapshotRestrictions(snapshot) {
  return Boolean(
    snapshot && (snapshot.allowedProviders !== null || Object.keys(snapshot.allowedModelsByProvider ?? {}).length > 0)
  );
}
function readAgentRuntimeOverrideAllowlist(env, agentId, knownProviderIds) {
  const providers = parseList(env[agentOverrideProvidersVarName(agentId)]);
  const modelsByProvider = {};
  for (const providerId of knownProviderIds) {
    const list = parseList(env[agentOverrideModelsVarName(agentId, providerId)]);
    if (list !== null) modelsByProvider[providerId] = list;
  }
  const snapshot = {
    allowedProviders: providers,
    allowedModelsByProvider: modelsByProvider
  };
  return hasAllowlistSnapshotRestrictions(snapshot) ? snapshot : null;
}
function intersectIdLists(outer, inner, caseInsensitive) {
  if (outer === null && inner === null) return null;
  if (outer === null) return inner;
  if (inner === null) return outer;
  const outerSet = new Set(
    caseInsensitive ? outer.map((id) => normalizeProviderId(id)) : outer
  );
  const result = [];
  for (const id of inner) {
    const needle = caseInsensitive ? normalizeProviderId(id) : id;
    if (outerSet.has(needle)) result.push(id);
  }
  return result;
}
function intersectAllowlists(env, knownProviderIds, tenant) {
  const envProviders = canonicalizeProviderList(readAllowedProviders(env), knownProviderIds);
  const envModelsByProvider = {};
  for (const providerId of knownProviderIds) {
    const list = readAllowedModels(env, providerId);
    if (list !== null) envModelsByProvider[providerId] = list;
  }
  const tenantProviders = canonicalizeProviderList(tenant?.allowedProviders ?? null, knownProviderIds);
  const tenantModelsByProvider = tenant?.allowedModelsByProvider ?? {};
  const providers = intersectIdLists(envProviders, tenantProviders, true);
  const modelsByProvider = { ...envModelsByProvider };
  for (const rawProviderId of Object.keys(tenantModelsByProvider)) {
    const providerId = canonicalProviderId(rawProviderId, knownProviderIds) ?? normalizeProviderId(rawProviderId);
    const tenantList = tenantModelsByProvider[rawProviderId] ?? [];
    const envList = modelsByProvider[providerId] ?? null;
    const intersection = intersectIdLists(envList, tenantList, false);
    if (intersection !== null) {
      modelsByProvider[providerId] = intersection;
    }
  }
  const tenantOverridesActive = tenantProviders !== null || Object.keys(tenantModelsByProvider).length > 0;
  return {
    providers,
    modelsByProvider,
    hasRestrictions: providers !== null || Object.keys(modelsByProvider).length > 0,
    tenantOverridesActive
  };
}
function intersectEffectiveAllowlistWithSnapshot(outer, knownProviderIds, inner) {
  if (!hasAllowlistSnapshotRestrictions(inner)) return outer;
  const innerProviders = canonicalizeProviderList(inner?.allowedProviders ?? null, knownProviderIds);
  const providers = intersectIdLists(outer.providers, innerProviders, true);
  const modelsByProvider = { ...outer.modelsByProvider };
  for (const rawProviderId of Object.keys(inner?.allowedModelsByProvider ?? {})) {
    const providerId = canonicalProviderId(rawProviderId, knownProviderIds) ?? normalizeProviderId(rawProviderId);
    const innerList = inner?.allowedModelsByProvider[rawProviderId] ?? [];
    const outerList = modelsByProvider[providerId] ?? null;
    const intersection = intersectIdLists(outerList, innerList, false);
    if (intersection !== null) {
      modelsByProvider[providerId] = intersection;
    }
  }
  return {
    providers,
    modelsByProvider,
    hasRestrictions: true,
    tenantOverridesActive: outer.tenantOverridesActive || hasAllowlistSnapshotRestrictions(inner)
  };
}
function isProviderAllowedInEffective(effective, providerId) {
  if (effective.providers === null) return true;
  const needle = normalizeProviderId(providerId);
  return effective.providers.some((id) => normalizeProviderId(id) === needle);
}
function isModelAllowedForProviderInEffective(effective, providerId, modelId) {
  const list = effective.modelsByProvider[providerId] ?? effective.modelsByProvider[normalizeProviderId(providerId)];
  if (list === void 0) return true;
  return list.includes(modelId);
}
function isProviderModelAllowedInEffective(effective, providerId, modelId) {
  return isProviderAllowedInEffective(effective, providerId) && isModelAllowedForProviderInEffective(effective, providerId, modelId);
}
export {
  agentOverrideModelAllowlistEnvVarName,
  agentOverrideProviderAllowlistEnvVarName,
  canonicalProviderId,
  hasAllowlistSnapshotRestrictions,
  intersectAllowlists,
  intersectEffectiveAllowlistWithSnapshot,
  isModelAllowedForProvider,
  isModelAllowedForProviderInEffective,
  isProviderAllowed,
  isProviderAllowedInEffective,
  isProviderModelAllowed,
  isProviderModelAllowedInEffective,
  modelAllowlistEnvVarName,
  normalizeProviderId,
  providerAllowlistEnvVarName,
  providerIdAliases,
  readAgentRuntimeOverrideAllowlist,
  readAllowedModels,
  readAllowedProviders,
  readAllowlistConfig
};
//# sourceMappingURL=model-allowlist.js.map
