import type { PrincipalId, ProjectId } from "./ids.js";
export type PrincipalKind = "human" | "agent" | "system";
export type Capability = string & { readonly __awpCapability: true };
export interface Principal {
  readonly id: PrincipalId;
  readonly kind: PrincipalKind;
  readonly capabilities: readonly Capability[];
}
export interface AuthorityContext {
  readonly principal: Principal;
  readonly projectId?: ProjectId;
  readonly capabilities: readonly Capability[];
}
export function capability(value: string): Capability {
  if (!/^[a-z][a-z0-9.-]+$/.test(value)) throw new Error(`Invalid capability: ${value}`);
  return value as Capability;
}
export function authorityContext(
  principal: Principal,
  requested: readonly Capability[],
  projectId?: ProjectId,
): AuthorityContext {
  const ceiling = new Set(principal.capabilities);
  const broadened = requested.filter((c) => !ceiling.has(c));
  if (broadened.length) throw new Error(`Authority broadening denied: ${broadened.join(", ")}`);
  return projectId === undefined
    ? { principal, capabilities: [...requested] }
    : { principal, projectId, capabilities: [...requested] };
}