import { resolve } from 'node:path';
import { getGlobalWorkflowsDir, getProjectWorkflowsDir, getRepertoireDir, isBuiltinWorkflowPath, isPathSafe, } from '../paths.js';
import { getAttachedWorkflowTrustInfo, getWorkflowSourcePath } from './workflowSourceMetadata.js';
function isPathWithin(rootPath, candidatePath) {
    return isPathSafe(resolve(rootPath), resolve(candidatePath));
}
function isDistinctLookupWorkflowRoot(projectCwd, lookupCwd) {
    return resolve(getProjectWorkflowsDir(projectCwd)) !== resolve(getProjectWorkflowsDir(lookupCwd));
}
export function resolveWorkflowTrustInfo(options) {
    const { filePath, projectCwd, lookupCwd = projectCwd, source } = options;
    if (!filePath) {
        return {
            source: 'inline',
            isProjectTrustRoot: true,
            isProjectWorkflowRoot: false,
        };
    }
    if (source === 'project') {
        return {
            source,
            sourcePath: resolve(filePath),
            isProjectTrustRoot: true,
            isProjectWorkflowRoot: true,
        };
    }
    if (source === 'worktree') {
        return {
            source,
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (source === 'user' || source === 'builtin' || source === 'repertoire' || source === 'external') {
        return {
            source,
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (isDistinctLookupWorkflowRoot(projectCwd, lookupCwd)
        && isPathWithin(getProjectWorkflowsDir(lookupCwd), filePath)) {
        return {
            source: 'worktree',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (isPathWithin(getProjectWorkflowsDir(projectCwd), filePath)) {
        return {
            source: 'project',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: true,
            isProjectWorkflowRoot: true,
        };
    }
    if (isPathWithin(getGlobalWorkflowsDir(), filePath)) {
        return {
            source: 'user',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (isBuiltinWorkflowPath(filePath)) {
        return {
            source: 'builtin',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (isPathWithin(getRepertoireDir(), filePath)) {
        return {
            source: 'repertoire',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: false,
            isProjectWorkflowRoot: false,
        };
    }
    if (isPathWithin(projectCwd, filePath)) {
        return {
            source: 'project',
            sourcePath: resolve(filePath),
            isProjectTrustRoot: true,
            isProjectWorkflowRoot: false,
        };
    }
    return {
        source: 'external',
        sourcePath: resolve(filePath),
        isProjectTrustRoot: false,
        isProjectWorkflowRoot: false,
    };
}
export function getWorkflowTrustInfo(workflow, projectCwd) {
    const attached = getAttachedWorkflowTrustInfo(workflow);
    if (attached) {
        return attached;
    }
    return resolveWorkflowTrustInfo({ filePath: getWorkflowSourcePath(workflow), projectCwd });
}
export function getWorkflowPathTrustInfo(filePath, projectCwd, lookupCwd = projectCwd) {
    return resolveWorkflowTrustInfo({ filePath, projectCwd, lookupCwd });
}
//# sourceMappingURL=workflowTrustSource.js.map