package exec

import (
	"fmt"
	"regexp"
)

// permission mirrors the shared safety permission classes used across the
// Exec security chain. Each Exec action declares exactly one.
type permission string

const (
	permissionReadOnly            permission = "read_only"
	permissionAgentScopedMutation permission = "agent_scoped_mutation"
	permissionExistingGate        permission = "existing_permission_gate"
)

var kebabRE = regexp.MustCompile(`^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$`)

// validateName enforces the kebab-case single-token rule used for both domain
// and action names.
func validateName(s string) error {
	if !kebabRE.MatchString(s) {
		return fmt.Errorf("exec: invalid name %q (kebab-case single token required)", s)
	}
	return nil
}