// ../core/src/permissions/teamSharedIndex.ts
function safeSegment(value) {
  const cleaned = value.replace(/[^A-Za-z0-9._-]+/g, "_").replace(/\.\.+/g, "_").replace(/^[._]+/, "").slice(0, 200);
  return cleaned.length > 0 ? cleaned : "_";
}
function joinPath(base, segment) {
  return `${base.replace(/\/+$/, "")}/${segment}`;
}
function resolveTeamIndexLayout(input) {
  const orgId = input.orgId?.trim();
  if (!orgId)
    throw new Error("resolveTeamIndexLayout requires a non-empty orgId");
  const catalogRoot = joinPath(input.baseRoot, safeSegment(orgId));
  const repoId = input.repoId?.trim();
  return {
    orgId,
    catalogRoot,
    ...repoId ? { shardRoot: joinPath(catalogRoot, safeSegment(repoId)) } : {}
  };
}
function authorizeTeamIndexAccess(input) {
  if (!input.capabilities.capabilities.teamSharedIndex) {
    return { ok: false, reason: "team_shared_index_not_entitled" };
  }
  const callerOrg = input.capabilities.orgId?.trim();
  if (!callerOrg) {
    return { ok: false, reason: "team_shared_index_missing_org" };
  }
  if (callerOrg !== input.indexOrgId.trim()) {
    return { ok: false, reason: "team_shared_index_org_mismatch" };
  }
  return { ok: true, reason: "team_shared_index_authorized" };
}
export {
  resolveTeamIndexLayout,
  authorizeTeamIndexAccess
};
