/**
 * Read-only projection routes for runs and audit activity.
 *
 * GET /workspaces/{wsId}/projections/runs       — list seeded+live runs
 * GET /workspaces/{wsId}/projections/runs/{runId} — single run + timeline + evidence
 * GET /workspaces/{wsId}/projections/audit       — audit activity feed
 *
 * Behind the default bridge:read scope. Workspace authorization is enforced
 * through the shared authorizeWorkspace guard. Response payloads flow through
 * the redacted projection contracts; the publicResponse scan layer still
 * verifies that no unsafe identifiers leak.
 */
import { RunProjectionService } from "../runs/runProjectionService.js";
import { AuditProjectionService } from "../audit/auditProjectionService.js";
import { authorizeWorkspace } from "./authGuards.js";
import { writeJson, PUBLIC_IDENTIFIER_SCAN_OPTIONS } from "./publicResponse.js";
import { firstCapture, matchPath } from "./routeMatching.js";
export async function handleProjectionRoutes(context) {
    const { app, auth, request, response, url } = context;
    if (request.method !== "GET")
        return false;
    const runsListMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/projections\/runs$/);
    if (runsListMatch) {
        const workspaceId = firstCapture(runsListMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        const service = new RunProjectionService(app.localStore);
        writeJson(response, 200, service.listForWorkspace(workspaceId), {
            surface: "workspace.projections.runs",
            scanOptions: PUBLIC_IDENTIFIER_SCAN_OPTIONS,
        });
        return true;
    }
    const runsDetailMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/projections\/runs\/([^/]+)$/);
    if (runsDetailMatch) {
        const workspaceId = firstCapture(runsDetailMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        const runId = runsDetailMatch[1] ?? "";
        const service = new RunProjectionService(app.localStore);
        const detail = service.detail(runId);
        if (!detail) {
            writeJson(response, 404, {
                error: "not_found",
                message: "Run projection not found.",
            });
            return true;
        }
        if (detail.run.workspaceId !== workspaceId) {
            writeJson(response, 404, {
                error: "not_found",
                message: "Run projection not found.",
            });
            return true;
        }
        writeJson(response, 200, detail, {
            surface: "workspace.projections.runs.detail",
            scanOptions: PUBLIC_IDENTIFIER_SCAN_OPTIONS,
        });
        return true;
    }
    const auditMatch = matchPath(url.pathname, /^\/workspaces\/([^/]+)\/projections\/audit$/);
    if (auditMatch) {
        const workspaceId = firstCapture(auditMatch);
        if (!authorizeWorkspace(response, auth, workspaceId))
            return true;
        const service = new AuditProjectionService(app.localStore);
        writeJson(response, 200, service.listForWorkspace(workspaceId), {
            surface: "workspace.projections.audit",
            scanOptions: PUBLIC_IDENTIFIER_SCAN_OPTIONS,
        });
        return true;
    }
    return false;
}
