import { getAgentDir } from '../../config.js';
/**
 * Central field catalog for the persisted permissioning schema.
 *
 * Slash-command UI and any future settings UIs should render from this spec
 * instead of hardcoding a second permissions model in the presentation layer.
 */
export const RUNTIME_PERMISSIONING_FIELD_SPECS = [
    {
        id: 'runtime.dangerouslySkipPermissions',
        command: 'skip-runtime-permissions',
        label: 'Skip runtime permissions',
        description: 'Disable runtime-owned filesystem and shell permission enforcement. Spreadsheet approvals are unchanged.',
        kind: 'boolean',
        trueLabel: 'Skip filesystem/runtime permissions',
        falseLabel: 'Enforce filesystem/runtime permissions'
    },
    {
        id: 'filesystem.workspaceRoots',
        command: 'workspace-roots',
        label: 'Approved workspaces',
        description: 'Broad folders where file tools can read and write by default.',
        kind: 'workspace_roots'
    },
    {
        id: 'filesystem.persistentApprovals',
        command: 'filesystem-grants',
        label: 'Approved files & folders outside workspaces',
        description: 'Narrow file or folder exceptions for file tools outside approved workspaces.',
        kind: 'filesystem_grants'
    },
    {
        id: 'spreadsheet.autoApproveDefault',
        command: 'spreadsheet-auto-approve',
        label: 'Spreadsheet auto-approve default',
        description: 'Global default for spreadsheet approval behavior in new sessions.',
        kind: 'boolean',
        trueLabel: 'Auto-approve spreadsheet changes',
        falseLabel: 'Ask before spreadsheet changes'
    }
];
export function getRuntimePermissioningFieldSpecByCommand(command) {
    return RUNTIME_PERMISSIONING_FIELD_SPECS.find((spec) => spec.command === command);
}
export function createDefaultRuntimePermissioningSettings() {
    return {
        version: 1,
        runtime: {},
        filesystem: {},
        spreadsheet: {},
        shell: {},
        subagents: {}
    };
}
export function mergeRuntimePermissioningSettings(base, overrides) {
    if (!base && !overrides) {
        return undefined;
    }
    return {
        version: overrides?.version ?? base?.version ?? 1,
        runtime: {
            ...(base?.runtime ?? {}),
            ...(overrides?.runtime ?? {})
        },
        filesystem: {
            ...(base?.filesystem ?? {}),
            ...(overrides?.filesystem ?? {})
        },
        spreadsheet: {
            ...(base?.spreadsheet ?? {}),
            ...(overrides?.spreadsheet ?? {})
        },
        shell: {
            ...(base?.shell ?? {}),
            ...(overrides?.shell ?? {})
        },
        subagents: {
            ...(base?.subagents ?? {}),
            ...(overrides?.subagents ?? {})
        }
    };
}
/**
 * Normalizes legacy permission fields into the canonical `permissioning` tree.
 *
 * The caller still owns broader settings migration. This helper only handles
 * the permissioning slice so the schema logic can stay out of SettingsManager.
 */
export function migrateRuntimePermissioningSettings(settings, scope) {
    const existingPermissioning = typeof settings.permissioning === 'object' && settings.permissioning !== null
        ? settings.permissioning
        : undefined;
    const hadLegacyPermissionFields = 'workspaces' in settings || 'filesystemApprovals' in settings || 'autoApprove' in settings;
    if (scope === 'project' && !existingPermissioning && !hadLegacyPermissionFields) {
        return { permissioning: undefined, changed: false };
    }
    const permissioning = mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), existingPermissioning);
    let changed = existingPermissioning === undefined ||
        existingPermissioning.version !== 1 ||
        typeof existingPermissioning.runtime !== 'object' ||
        existingPermissioning.runtime === null ||
        typeof existingPermissioning.shell !== 'object' ||
        existingPermissioning.shell === null ||
        typeof existingPermissioning.subagents !== 'object' ||
        existingPermissioning.subagents === null;
    if (scope === 'project') {
        if (Array.isArray(settings.workspaces) &&
            permissioning.filesystem?.workspaceRoots === undefined) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                workspaceRoots: settings.workspaces
            };
            changed = true;
        }
        if (Array.isArray(settings.filesystemApprovals) &&
            permissioning.filesystem?.persistentApprovals === undefined) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                persistentApprovals: settings.filesystemApprovals
            };
            changed = true;
        }
        if (!Array.isArray(permissioning.filesystem?.workspaceRoots)) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                workspaceRoots: []
            };
            changed = true;
        }
        if (!Array.isArray(permissioning.filesystem?.persistentApprovals)) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                persistentApprovals: []
            };
            changed = true;
        }
        if (typeof settings.autoApprove === 'boolean' &&
            permissioning.spreadsheet?.autoApproveDefault === undefined) {
            permissioning.spreadsheet = {
                ...(permissioning.spreadsheet ?? {}),
                autoApproveDefault: settings.autoApprove
            };
            changed = true;
        }
    }
    else {
        if (typeof permissioning.runtime?.dangerouslySkipPermissions !== 'boolean') {
            permissioning.runtime = {
                ...(permissioning.runtime ?? {}),
                dangerouslySkipPermissions: false
            };
            changed = true;
        }
        if (!Array.isArray(permissioning.filesystem?.workspaceRoots)) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                workspaceRoots: []
            };
            changed = true;
        }
        if (!Array.isArray(permissioning.filesystem?.persistentApprovals)) {
            permissioning.filesystem = {
                ...(permissioning.filesystem ?? {}),
                persistentApprovals: []
            };
            changed = true;
        }
        if (typeof settings.autoApprove === 'boolean' &&
            permissioning.spreadsheet?.autoApproveDefault === undefined) {
            permissioning.spreadsheet = {
                ...(permissioning.spreadsheet ?? {}),
                autoApproveDefault: settings.autoApprove
            };
            changed = true;
        }
        if (typeof permissioning.spreadsheet?.autoApproveDefault !== 'boolean') {
            permissioning.spreadsheet = {
                ...(permissioning.spreadsheet ?? {}),
                autoApproveDefault: false
            };
            changed = true;
        }
    }
    settings.permissioning = permissioning;
    delete settings.workspaces;
    delete settings.filesystemApprovals;
    delete settings.autoApprove;
    return {
        permissioning,
        changed: changed || hadLegacyPermissionFields
    };
}
export function getWorkspaceRootsFromPermissioning(permissioning) {
    const configured = permissioning?.filesystem?.workspaceRoots?.filter((root) => root.trim().length > 0) ?? [];
    const agentDir = getAgentDir();
    return [...new Set([...configured, agentDir])];
}
export function getDangerouslySkipRuntimePermissionsFromPermissioning(permissioning) {
    return permissioning?.runtime?.dangerouslySkipPermissions ?? false;
}
export function setPermissioningWorkspaceRoots(permissioning, workspaceRoots) {
    const agentDir = getAgentDir();
    const persistedWorkspaceRoots = workspaceRoots.filter((root) => root.trim().length > 0 && root !== agentDir);
    return {
        ...mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning),
        filesystem: {
            ...(permissioning?.filesystem ?? {}),
            workspaceRoots: [...new Set(persistedWorkspaceRoots)]
        }
    };
}
export function addPermissioningFilesystemApproval(permissioning, grant) {
    const current = permissioning?.filesystem?.persistentApprovals ?? [];
    const alreadyExists = current.some((entry) => entry.path === grant.path && entry.access === grant.access && entry.scope === grant.scope);
    if (alreadyExists) {
        return (mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning) ?? createDefaultRuntimePermissioningSettings());
    }
    return {
        ...mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning),
        filesystem: {
            ...(permissioning?.filesystem ?? {}),
            persistentApprovals: [...current, grant]
        }
    };
}
export function removePermissioningFilesystemApproval(permissioning, grant) {
    const current = permissioning?.filesystem?.persistentApprovals ?? [];
    const next = current.filter((entry) => !(entry.path === grant.path && entry.access === grant.access && entry.scope === grant.scope));
    if (next.length === current.length) {
        return (mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning) ?? createDefaultRuntimePermissioningSettings());
    }
    return {
        ...mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning),
        filesystem: {
            ...(permissioning?.filesystem ?? {}),
            persistentApprovals: next
        }
    };
}
export function setPermissioningSpreadsheetAutoApproveDefault(permissioning, autoApproveDefault) {
    return {
        ...mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning),
        spreadsheet: {
            ...(permissioning?.spreadsheet ?? {}),
            autoApproveDefault
        }
    };
}
export function setPermissioningDangerouslySkipRuntimePermissions(permissioning, dangerouslySkipPermissions) {
    return {
        ...mergeRuntimePermissioningSettings(createDefaultRuntimePermissioningSettings(), permissioning),
        runtime: {
            ...(permissioning?.runtime ?? {}),
            dangerouslySkipPermissions
        }
    };
}
//# sourceMappingURL=settings.js.map