import type { Skill } from "./registry"

export type TrustLevel = "local" | "community" | "verified" | "signed"

export interface TrustPolicy {
  allowedTools: string[]
  canExecuteBash: boolean
  canWriteFiles: boolean
}

const POLICIES: Record<TrustLevel, TrustPolicy> = {
  local: {
    allowedTools: ["read", "write", "edit", "bash", "glob", "grep"],
    canExecuteBash: true,
    canWriteFiles: true,
  },
  community: {
    allowedTools: ["read", "glob", "grep"],
    canExecuteBash: false,
    canWriteFiles: false,
  },
  verified: {
    allowedTools: ["read", "write", "edit", "bash", "glob", "grep"],
    canExecuteBash: true,
    canWriteFiles: true,
  },
  signed: {
    allowedTools: ["read", "write", "edit", "bash", "glob", "grep"],
    canExecuteBash: true,
    canWriteFiles: true,
  },
}

export function getTrustPolicy(level: TrustLevel): TrustPolicy {
  return POLICIES[level]
}

export function resolveTrustLevel(skill: Skill): TrustLevel {
  if (skill.loadedFrom === "project" || skill.loadedFrom === "user") return "local"
  if (skill.trustLevel) return skill.trustLevel
  return "community"
}

export function isToolAllowedForSkill(
  toolName: string,
  trustLevel: TrustLevel
): boolean {
  const policy = POLICIES[trustLevel]
  return policy.allowedTools.includes(toolName.toLowerCase())
}