import { isRuntimePreparePreset } from '../../../core/models/workflow-types.js';
export function resolveWorkflowRuntimePreparePolicy(globalPolicy, projectPolicy) {
    const policy = {};
    if (globalPolicy?.customScripts !== undefined)
        policy.customScripts = globalPolicy.customScripts;
    if (projectPolicy?.customScripts !== undefined)
        policy.customScripts = projectPolicy.customScripts;
    return Object.keys(policy).length > 0 ? policy : undefined;
}
export function resolveWorkflowCommandGatesPolicy(globalPolicy, projectPolicy) {
    const policy = {};
    if (globalPolicy?.customScripts !== undefined)
        policy.customScripts = globalPolicy.customScripts;
    if (projectPolicy?.customScripts !== undefined)
        policy.customScripts = projectPolicy.customScripts;
    return Object.keys(policy).length > 0 ? policy : undefined;
}
export function validateWorkflowRuntimePrepare(runtime, policy) {
    for (const entry of runtime?.prepare ?? []) {
        if (isRuntimePreparePreset(entry))
            continue;
        if (policy?.customScripts === true)
            continue;
        throw new Error(`Workflow runtime.prepare custom script "${entry}" is disabled by default. `
            + 'Configure workflow_runtime_prepare.custom_scripts in project/global config to allow it.');
    }
}
export function validateWorkflowCommandGates(steps, policy) {
    for (const step of steps) {
        validateStepCommandGates(step, step.name, policy);
        for (const subStep of step.parallel ?? []) {
            validateStepCommandGates(subStep, `${step.name}.${subStep.name}`, policy);
        }
    }
}
function validateStepCommandGates(step, stepName, policy) {
    for (const gate of step.quality_gates ?? []) {
        if (typeof gate === 'string')
            continue;
        if (gate.type !== 'command')
            continue;
        if (policy?.customScripts === true)
            continue;
        throw new Error(`Step "${stepName}" uses command quality gate "${gate.command}", which is disabled by default for workflows. `
            + 'Configure workflow_command_gates.custom_scripts in project/global config to allow it.');
    }
}
export function resolveWorkflowArpeggioPolicy(globalPolicy, projectPolicy) {
    const policy = {};
    if (globalPolicy?.customDataSourceModules !== undefined)
        policy.customDataSourceModules = globalPolicy.customDataSourceModules;
    if (globalPolicy?.customMergeInlineJs !== undefined)
        policy.customMergeInlineJs = globalPolicy.customMergeInlineJs;
    if (globalPolicy?.customMergeFiles !== undefined)
        policy.customMergeFiles = globalPolicy.customMergeFiles;
    if (projectPolicy?.customDataSourceModules !== undefined)
        policy.customDataSourceModules = projectPolicy.customDataSourceModules;
    if (projectPolicy?.customMergeInlineJs !== undefined)
        policy.customMergeInlineJs = projectPolicy.customMergeInlineJs;
    if (projectPolicy?.customMergeFiles !== undefined)
        policy.customMergeFiles = projectPolicy.customMergeFiles;
    return Object.keys(policy).length > 0 ? policy : undefined;
}
export function validateWorkflowArpeggio(stepName, raw, policy) {
    if (!raw)
        return;
    if (raw.source !== 'csv' && policy?.customDataSourceModules !== true) {
        throw new Error(`Step "${stepName}" uses Arpeggio source "${raw.source}", which is disabled by default for workflows. `
            + 'Configure workflow_arpeggio.custom_data_source_modules in project/global config to allow it.');
    }
    if (raw.merge?.inline_js && policy?.customMergeInlineJs !== true) {
        throw new Error(`Step "${stepName}" uses Arpeggio inline_js, which is disabled by default for workflows. `
            + 'Configure workflow_arpeggio.custom_merge_inline_js in project/global config to allow it.');
    }
    if (raw.merge?.file && policy?.customMergeFiles !== true) {
        throw new Error(`Step "${stepName}" uses Arpeggio merge.file, which is disabled by default for workflows. `
            + 'Configure workflow_arpeggio.custom_merge_files in project/global config to allow it.');
    }
}
export function resolveWorkflowMcpServersPolicy(globalPolicy, projectPolicy) {
    const policy = {};
    if (globalPolicy?.stdio !== undefined)
        policy.stdio = globalPolicy.stdio;
    if (globalPolicy?.sse !== undefined)
        policy.sse = globalPolicy.sse;
    if (globalPolicy?.http !== undefined)
        policy.http = globalPolicy.http;
    if (projectPolicy?.stdio !== undefined)
        policy.stdio = projectPolicy.stdio;
    if (projectPolicy?.sse !== undefined)
        policy.sse = projectPolicy.sse;
    if (projectPolicy?.http !== undefined)
        policy.http = projectPolicy.http;
    return Object.keys(policy).length > 0 ? policy : undefined;
}
export function validateWorkflowMcpServers(stepName, mcpServers, policy) {
    if (!mcpServers)
        return;
    for (const [serverName, config] of Object.entries(mcpServers)) {
        const transport = config.type ?? 'stdio';
        const allowed = transport === 'stdio'
            ? (policy?.stdio ?? false)
            : transport === 'sse'
                ? (policy?.sse ?? false)
                : (policy?.http ?? false);
        if (allowed)
            continue;
        throw new Error(`Step "${stepName}" uses MCP server "${serverName}" with transport "${transport}", `
            + 'which is disabled by default for workflows. '
            + 'Configure workflow_mcp_servers in project/global config to allow it.');
    }
}
//# sourceMappingURL=workflowNormalizationPolicies.js.map