
//#region src/permissions.ts
/**
* Scope hierarchy - higher scopes include lower ones
*/
const SCOPE_HIERARCHY = {
	"org:read": new Set(["org:read"]),
	"org:write": new Set(["org:read", "org:write"]),
	"org:admin": new Set([
		"org:read",
		"org:write",
		"org:admin"
	]),
	"project:read": new Set(["project:read"]),
	"project:write": new Set(["project:read", "project:write"]),
	"project:admin": new Set([
		"project:read",
		"project:write",
		"project:admin"
	]),
	"team:read": new Set(["team:read"]),
	"team:write": new Set(["team:read", "team:write"]),
	"team:admin": new Set([
		"team:read",
		"team:write",
		"team:admin"
	]),
	"member:read": new Set(["member:read"]),
	"member:write": new Set(["member:read", "member:write"]),
	"member:admin": new Set([
		"member:read",
		"member:write",
		"member:admin"
	]),
	"event:read": new Set(["event:read"]),
	"event:write": new Set(["event:read", "event:write"]),
	"event:admin": new Set([
		"event:read",
		"event:write",
		"event:admin"
	]),
	"project:releases": new Set(["project:releases"]),
	seer: new Set(["seer"])
};
/**
* All available scopes as a readonly list
*/
function getAvailableScopes() {
	return Object.keys(SCOPE_HIERARCHY);
}
/**
* All scopes available in the server, generated from the permission hierarchy.
* Exported here to keep scope consumers lightweight and avoid importing other
* unrelated constants.
*/
const ALL_SCOPES = getAvailableScopes();
const ALL_SCOPES_SET = new Set(ALL_SCOPES);
/**
* Expand a set of granted scopes to include all implied scopes
*/
function expandScopes(grantedScopes) {
	const expandedScopes = /* @__PURE__ */ new Set();
	for (const scope of grantedScopes) {
		const implied = SCOPE_HIERARCHY[scope];
		for (const s of implied) expandedScopes.add(s);
	}
	return expandedScopes;
}
/**
* Human-readable descriptions of scopes
*/
const SCOPE_DESCRIPTIONS = {
	"org:read": "View organization details",
	"org:write": "Modify organization details",
	"org:admin": "Delete organizations",
	"project:read": "View project information",
	"project:write": "Create and modify projects",
	"project:admin": "Delete projects",
	"team:read": "View team information",
	"team:write": "Create and modify teams",
	"team:admin": "Delete teams",
	"member:read": "View member information",
	"member:write": "Create and modify members",
	"member:admin": "Delete members",
	"event:read": "View events and issues",
	"event:write": "Update and manage issues",
	"event:admin": "Delete issues",
	"project:releases": "Access release information",
	seer: "Use Seer for issue analysis (may incur costs)"
};
/**
* Check if a set of scopes satisfies the required scopes
*/
function hasRequiredScopes(grantedScopes, requiredScopes) {
	const expandedScopes = expandScopes(grantedScopes);
	return requiredScopes.every((scope) => expandedScopes.has(scope));
}
/**
* Check if a tool is allowed based on granted scopes
*/
function isToolAllowed(requiredScopes, grantedScopes) {
	if (!requiredScopes || requiredScopes.length === 0) return true;
	return hasRequiredScopes(grantedScopes, requiredScopes);
}
/**
* Parse scopes from a comma-separated string
*/
/**
* Parse scopes from a comma-separated string.
* - Filters out invalid entries
* - Logs a console.warn listing any invalid values
*/
/**
* Parse scopes from an array of strings.
* - Filters out invalid entries
* - Logs a console.warn listing any invalid values
*/
/**
* Generic scope parser: accepts a comma-separated string or an array.
* Returns both valid and invalid tokens. No logging.
*/
function parseScopes(input) {
	let tokens = [];
	if (typeof input === "string") tokens = input.split(",");
	else if (Array.isArray(input)) tokens = input.map((v) => typeof v === "string" ? v : "");
	const valid = /* @__PURE__ */ new Set();
	const invalid = [];
	for (const raw of tokens.map((s) => s.trim()).filter(Boolean)) if (ALL_SCOPES_SET.has(raw)) valid.add(raw);
	else invalid.push(raw);
	return {
		valid,
		invalid
	};
}
/**
* Strict validation helper for scope strings supplied via flags/env.
* Returns both valid and invalid entries without side effects.
*/
/**
* Resolve final scopes from optional override/additive sets and provided defaults.
* - If override is provided, it replaces defaults and is expanded
* - Else if add is provided, it unions with defaults and is expanded
* - Else returns undefined to indicate default handling upstream
*/
function resolveScopes(options) {
	const { override, add, defaults } = options;
	if (override) return expandScopes(override);
	if (add) {
		const base = new Set(defaults);
		for (const s of add) base.add(s);
		return expandScopes(base);
	}
	return void 0;
}

//#endregion
Object.defineProperty(exports, 'ALL_SCOPES', {
  enumerable: true,
  get: function () {
    return ALL_SCOPES;
  }
});
Object.defineProperty(exports, 'ALL_SCOPES_SET', {
  enumerable: true,
  get: function () {
    return ALL_SCOPES_SET;
  }
});
Object.defineProperty(exports, 'SCOPE_DESCRIPTIONS', {
  enumerable: true,
  get: function () {
    return SCOPE_DESCRIPTIONS;
  }
});
Object.defineProperty(exports, 'expandScopes', {
  enumerable: true,
  get: function () {
    return expandScopes;
  }
});
Object.defineProperty(exports, 'getAvailableScopes', {
  enumerable: true,
  get: function () {
    return getAvailableScopes;
  }
});
Object.defineProperty(exports, 'hasRequiredScopes', {
  enumerable: true,
  get: function () {
    return hasRequiredScopes;
  }
});
Object.defineProperty(exports, 'isToolAllowed', {
  enumerable: true,
  get: function () {
    return isToolAllowed;
  }
});
Object.defineProperty(exports, 'parseScopes', {
  enumerable: true,
  get: function () {
    return parseScopes;
  }
});
Object.defineProperty(exports, 'resolveScopes', {
  enumerable: true,
  get: function () {
    return resolveScopes;
  }
});
//# sourceMappingURL=permissions-CpuEzSxz.cjs.map