import { readFileSync } from "node:fs";
import type { SavedWorkflowDefinition } from "./workflow-saved.js";

export const FOUNDATION_UI_COMPLIANCE_NAME = "foundation_ui_compliance";

// The canonical fail-closed template ships from src/ (package-owned) so the
// shipped command and the lock/catalog record can be updated together without
// crossing the docs/ file fence. A project or user saved-workflow definition
// with the same name may override it, but the package execution-policy floor
// below cannot be weakened (see workflow-saved.ts).
const templateUrl = new URL("./templates/foundation_ui_compliance.workflow.mjs", import.meta.url);

/**
 * The canonical execution policy for the Foundation UI compliance workflow.
 * Defines package-owned safety minimums that cannot be weakened by a
 * project/user override when carrying the same canonical name.
 */
const FOUNDATION_EXECUTION_POLICY: NonNullable<SavedWorkflowDefinition["executionPolicy"]> = {
  worktreeRequired: true,
  authorizedHostCapabilities: ["foundationGate", "validateEditScope"],
  policyVersion: 1,
};

/** Load the canonical package template as an overridable bundled saved workflow. */
export function createBundledFoundationUiComplianceWorkflow(): SavedWorkflowDefinition {
  return {
    name: FOUNDATION_UI_COMPLIANCE_NAME,
    description:
      "Foundation UI compliance: pass one JSON args object; see docs/workflows/foundation-ui-compliance.md. Delivery defaults to false.",
    script: readFileSync(templateUrl, "utf8"),
    executionPolicy: FOUNDATION_EXECUTION_POLICY,
  };
}