package exec

// builtinActionRisk is the reviewed authorization/risk class for a built-in
// Exec action. It intentionally mirrors the permission class in the typed
// descriptor so a new action cannot accidentally receive a result policy while
// bypassing its authorization review.
type builtinActionRisk string

const (
	builtinRiskReadOnly            builtinActionRisk = builtinActionRisk(permissionReadOnly)
	builtinRiskAgentScopedMutation builtinActionRisk = builtinActionRisk(permissionAgentScopedMutation)
	builtinRiskExistingGate        builtinActionRisk = builtinActionRisk(permissionExistingGate)
)

// builtinResultPolicy describes what a caller should do when a complete
// success envelope cannot fit in the 64 KiB Exec success boundary. The
// boundary never returns a generic partial Data object; the policy is carried
// in the stable error hint/next fields instead.
type builtinResultPolicy string

const (
	builtinResultBounded  builtinResultPolicy = "bounded"
	builtinResultCursor   builtinResultPolicy = "cursor"
	builtinResultPage     builtinResultPolicy = "page"
	builtinResultNarrow   builtinResultPolicy = "narrow"
	builtinResultWorkflow builtinResultPolicy = "workflow"
)

// builtinActionPolicy is the production-owned risk, result, and audit-policy
// record for one registered built-in action. It is deliberately separate from
// executable handlers and generated schemas: adding a descriptor without an
// explicit decision fails catalog construction.
type builtinActionPolicy struct {
	Domain       string              `json:"domain"`
	Name         string              `json:"name"`
	Risk         builtinActionRisk   `json:"risk"`
	ResultPolicy builtinResultPolicy `json:"resultPolicy"`
	Continuation string              `json:"continuation"`
	builtinActionAuditDecision
}

// builtinActionInventory is exhaustive by construction. Keep entries in the
// same order as DefaultCatalog so the durable JSON spec is stable and review
// diffs remain easy to audit. validateBuiltinActionInventory rejects both
// missing policy rows and stale rows when a descriptor is added or removed.
var builtinActionInventory = []builtinActionPolicy{
	{Domain: "workspace", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat workspace list with a smaller limit or the next cursor"},

	{Domain: "project", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat project list with a smaller limit or the next cursor"},
	{Domain: "project", Name: "create", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one project payload"},
	{Domain: "project", Name: "delete", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one explicit project id"},

	{Domain: "agent", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat agent list with a smaller limit or the next cursor"},
	{Domain: "agent", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one agent by its stable agentId"},
	{Domain: "agent", Name: "start", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry the lifecycle request with one agentId"},
	{Domain: "agent", Name: "stop", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry the lifecycle request with one agentId"},
	{Domain: "agent", Name: "restart", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry the lifecycle request with one agentId"},
	{Domain: "agent", Name: "create", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one agent creation request"},
	{Domain: "agent", Name: "update", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one agent update request"},
	{Domain: "agent", Name: "delete", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller agentIds batch"},
	{Domain: "agent", Name: "duplicate", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one sourceAgentId and a smaller count"},

	{Domain: "team", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat Team list with a smaller limit or the next cursor"},
	{Domain: "team", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one Team by its stable teamId"},
	{Domain: "team", Name: "update", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one Team update request"},

	{Domain: "channel", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat channel list with a smaller limit or the next cursor"},
	{Domain: "channel", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one Channel by its stable channelId"},
	{Domain: "channel", Name: "members", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat channel members with a smaller limit or the next cursor"},
	{Domain: "channel", Name: "create", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one channel creation request"},
	{Domain: "channel", Name: "update", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one channel update request"},
	{Domain: "channel", Name: "agent-add", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller agents batch"},
	{Domain: "channel", Name: "agent-remove", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller agents batch"},

	{Domain: "review", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat review list with a smaller limit or the next cursor"},
	{Domain: "review", Name: "add", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one review path and thread"},
	{Domain: "review", Name: "delete", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one contextId"},

	{Domain: "role", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat role list with a smaller limit or the next cursor"},
	{Domain: "role", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one role by its stable roleId"},
	{Domain: "role", Name: "request-get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one role operation by requestId"},
	{Domain: "role", Name: "create", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one role creation request"},
	{Domain: "role", Name: "update", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one role update request"},
	{Domain: "role", Name: "delete", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one role deletion request"},
	{Domain: "role", Name: "apply", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one role apply request"},

	{Domain: "skill", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultPage, Continuation: "repeat Skill list with a smaller perPage or the next page"},
	{Domain: "skill", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one Skill by its stable skillId"},
	{Domain: "skill", Name: "create", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one Skill creation request"},
	{Domain: "skill", Name: "update", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one Skill update request"},
	{Domain: "skill", Name: "import", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultNarrow, Continuation: "import one source at a time or narrow the source"},
	{Domain: "skill", Name: "delete", Risk: builtinRiskExistingGate, ResultPolicy: builtinResultBounded, Continuation: "retry with one skillId"},

	{Domain: "profile", Name: "set-avatar", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one imagePath"},

	{Domain: "task", Name: "create", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller task batch"},
	{Domain: "task", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one task by its channel and number"},
	{Domain: "task", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat task list with a smaller limit or the next cursor"},
	{Domain: "task", Name: "update", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one task update request"},
	{Domain: "task", Name: "claim", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller numbers batch"},
	{Domain: "task", Name: "unclaim", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with a smaller numbers batch"},
	{Domain: "task", Name: "checkpoint", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one task checkpoint"},
	{Domain: "task", Name: "delete", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one task number"},

	{Domain: "scheduled-message", Name: "list", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat scheduled-message list with a smaller limit or the next cursor"},
	{Domain: "scheduled-message", Name: "get", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "request one scheduled message by id"},
	{Domain: "scheduled-message", Name: "runs", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultCursor, Continuation: "repeat scheduled-message runs with a smaller limit or the next cursor"},
	{Domain: "scheduled-message", Name: "validate", Risk: builtinRiskReadOnly, ResultPolicy: builtinResultNarrow, Continuation: "validate one smaller scheduled-message payload"},
	{Domain: "scheduled-message", Name: "create", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one scheduled-message payload"},
	{Domain: "scheduled-message", Name: "update", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one scheduled-message update"},
	{Domain: "scheduled-message", Name: "pause", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one scheduled-message id"},
	{Domain: "scheduled-message", Name: "resume", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one scheduled-message id"},
	{Domain: "scheduled-message", Name: "delete", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultBounded, Continuation: "retry with one scheduled-message id"},

	{Domain: "workflow", Name: "plan", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultWorkflow, Continuation: "use the workflow plan action's operation-specific section or pagination input"},
	{Domain: "workflow", Name: "trigger", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultWorkflow, Continuation: "use the workflow trigger action's operation-specific section or pagination input"},
	{Domain: "workflow", Name: "run", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultWorkflow, Continuation: "use the workflow run action's operation-specific section or pagination input"},
	{Domain: "workflow", Name: "step", Risk: builtinRiskAgentScopedMutation, ResultPolicy: builtinResultWorkflow, Continuation: "use the workflow step action's operation-specific section or pagination input"},
}