import { buildMcpPracticeAuditMetadata, createMcpBaseToolDefinition, createMcpCoreHandler, injectRuntimeInvocationMetadata, isJsonObject, jsonSchema, } from "../../_shared/baseToolAdapter.js";
import { anthropicMcpAuthorizePractice } from "./anthropic.js";
import { deepmindMcpAuthorizePractice } from "./deepmind.js";
import { mcpAuthorizeDependencyDeclarations, } from "./dependencies.js";
import { openaiMcpAuthorizePractice } from "./openai.js";
import { executeMcpAuthorize as executeMcpAuthorizeCore, mcpAuthorizeDescriptor, planMcpAuthorize, } from "./core.js";
export * from "./core.js";
export const mcpAuthorizeProviderPractices = [
    anthropicMcpAuthorizePractice,
    openaiMcpAuthorizePractice,
    deepmindMcpAuthorizePractice,
];
export const mcpAuthorizeBestPracticeDescriptor = {
    toolId: "mcp.authorize",
    bestPractice: "storage-owned-mcp-authorize-with-runtime-owned-policy-client",
    providerOrder: ["anthropic", "openai", "deepmind"],
    dependencies: mcpAuthorizeDependencyDeclarations,
};
function orderedPractices(preferredProvider) {
    return preferredProvider === undefined
        ? mcpAuthorizeProviderPractices
        : [
            ...mcpAuthorizeProviderPractices.filter((practice) => practice.providerName === preferredProvider),
            ...mcpAuthorizeProviderPractices.filter((practice) => practice.providerName !== preferredProvider),
        ];
}
export function selectMcpAuthorizePractice(dependencies = {}) {
    for (const practice of orderedPractices(dependencies.preferredProvider)) {
        const provider = practice.createProvider(dependencies);
        if (provider !== undefined)
            return { providerName: practice.providerName, practice, provider };
    }
    return {
        providerName: "praxis-native",
        practice: {
            providerName: "praxis-native",
            source: { kind: "praxis-native", label: "Praxis dry-run fallback" },
            directCliSupport: false,
            sideEffectPolicy: "runtime-owned-client",
            notes: ["No runtime MCP authorization provider is available; dry-run remains available."],
            createProvider: () => undefined,
        },
    };
}
function practiceAuditMetadata(selection) {
    return buildMcpPracticeAuditMetadata({
        providerName: selection.providerName,
        sourceLabel: selection.practice.source.label,
        sourceKind: selection.practice.source.kind,
        sourcePath: selection.practice.source.path,
        directCliSupport: selection.practice.directCliSupport,
        sideEffectPolicy: selection.practice.sideEffectPolicy,
        notes: selection.practice.notes,
    });
}
export async function executeMcpAuthorize(request = {}) {
    const requestRecord = isJsonObject(request) ? request : {};
    const selection = selectMcpAuthorizePractice({
        executor: requestRecord.executor,
        provider: requestRecord.provider,
        preferredProvider: requestRecord.preferredProvider,
    });
    const context = isJsonObject(requestRecord.context) ? requestRecord.context : undefined;
    return executeMcpAuthorizeCore(isJsonObject(request)
        ? { ...requestRecord, context: { ...context, auditMetadata: { ...(context?.auditMetadata ?? {}), ...practiceAuditMetadata(selection) } } }
        : request, selection.provider);
}
export const mcpAuthorizeBaseToolDefinition = createMcpBaseToolDefinition({
    toolId: "mcp.authorize",
    title: "MCP Authorize",
    description: "Ask runtime to authorize a fixed MCP operation for a subject.",
    summary: "Use mcp.authorize to request a runtime-owned policy decision for MCP calls, resources, subscriptions, or cache access.",
    storageGroup: "auth",
    riskLevel: "normal",
    permissionHints: ["mcp:auth", "mcp:read"],
    dependencies: mcpAuthorizeDependencyDeclarations,
    inputSchema: jsonSchema("mcp.authorize.input", { type: "object", additionalProperties: true }),
    outputSchema: jsonSchema("mcp.authorize.output", { type: "object", additionalProperties: true }),
});
export const mcpAuthorizeHandler = createMcpCoreHandler(mcpAuthorizeBaseToolDefinition, async (request) => {
    const selection = selectMcpAuthorizePractice({
        executor: request.executor,
        provider: request.input.provider,
        preferredProvider: request.input.preferredProvider,
    });
    const inputContext = request.input.context ?? {};
    const context = {
        ...inputContext,
        runtimeId: inputContext.runtimeId ?? request.runtimeId,
        sessionId: inputContext.sessionId ?? request.sessionId,
        invocationId: inputContext.invocationId ?? request.toolCallId,
        auditMetadata: injectRuntimeInvocationMetadata({ ...practiceAuditMetadata(selection), ...(request.metadata ?? {}) }, inputContext.auditMetadata, request),
    };
    return executeMcpAuthorizeCore({ ...request.input, context }, selection.provider);
});
export { mcpAuthorizeDescriptor, planMcpAuthorize };
