/**
 * Builds the effective runtime-owned permission policy for the active tool set.
 *
 * The compiler is intentionally deterministic and conservative: mode presets
 * define the broad behavior, and declared capabilities only widen the surfaces
 * that are actually available in the current registry.
 */
import { getAgentDir } from '../../config.js';
import { RUNTIME_CAPABILITY } from '../../core/permission-policy.js';
import { getDeclaredCapabilityIds, hasCapability } from './capability-catalog.js';
export function buildEffectivePermissionPolicy(input) {
    const declaredToolNames = [...new Set(input.toolNames)];
    const workspaceRoots = [...new Set([...(input.workspaceRoots ?? []), getAgentDir()])];
    const declaredCapabilityIds = getDeclaredCapabilityIds(declaredToolNames);
    const dangerouslySkipRuntimePermissions = input.dangerouslySkipRuntimePermissions === true;
    const dangerouslySkipSpreadsheetPermissions = input.dangerouslySkipSpreadsheetPermissions === true;
    const hasFilesystemRead = hasCapability(declaredCapabilityIds, RUNTIME_CAPABILITY.FILESYSTEM_READ);
    const hasFilesystemWrite = hasCapability(declaredCapabilityIds, RUNTIME_CAPABILITY.FILESYSTEM_WRITE);
    const hasShell = hasCapability(declaredCapabilityIds, RUNTIME_CAPABILITY.SHELL_EXECUTE);
    const hasSpreadsheet = hasCapability(declaredCapabilityIds, RUNTIME_CAPABILITY.SPREADSHEET_MUTATE);
    const hasSubagents = hasCapability(declaredCapabilityIds, RUNTIME_CAPABILITY.SUBAGENT_SPAWN);
    return {
        modeName: input.modeName,
        dangerouslySkipRuntimePermissions,
        declaredToolNames,
        declaredCapabilityIds,
        filesystem: {
            workspaceRoots,
            persistentApprovals: [...(input.persistentApprovals ?? [])],
            defaultReadScope: !hasFilesystemRead
                ? 'none'
                : dangerouslySkipRuntimePermissions
                    ? 'unrestricted'
                    : 'workspace',
            defaultWriteScope: !hasFilesystemWrite
                ? 'none'
                : dangerouslySkipRuntimePermissions
                    ? 'unrestricted'
                    : 'workspace',
            requireApprovalOutsideWorkspace: !dangerouslySkipRuntimePermissions
        },
        shell: {
            enabled: hasShell,
            mutationBehavior: !hasShell
                ? 'deny'
                : dangerouslySkipRuntimePermissions
                    ? 'allow'
                    : 'require_approval'
        },
        spreadsheet: {
            enabled: hasSpreadsheet,
            mutationBehavior: !hasSpreadsheet ? 'deny' : 'require_approval',
            allowHeadlessApproval: dangerouslySkipSpreadsheetPermissions
        },
        subagents: {
            enabled: hasSubagents,
            inheritParentPolicy: true
        },
        approvals: {
            runtimeOwned: true,
            allowHeadlessApproval: false
        }
    };
}
export function createDefaultPermissionPolicy() {
    return buildEffectivePermissionPolicy({ toolNames: [] });
}
//# sourceMappingURL=compiler.js.map