import { kbxAiAuthorizationPolicy, kbxPermissionCatalog, kbxSensitiveDataPolicies, type KbxAiCapability } from '@kbx/contracts'
const byId = new Map(kbxPermissionCatalog.map(x => [x.id, x]))
export function getKbxPermission(id:string){ return byId.get(id) }
export function canKbx(granted:readonly string[], permission:string){ return granted.includes(permission) }
export function kbxAiCapabilities(granted:readonly string[], screenAllowed:readonly KbxAiCapability[]=['explain','suggest','draft']):KbxAiCapability[]{
  if(!canKbx(granted,kbxAiAuthorizationPolicy.usePermission)) return []
  const result=screenAllowed.filter(x=>x!=='execute')
  if(screenAllowed.includes('execute') && canKbx(granted,kbxAiAuthorizationPolicy.executePermission)) result.push('execute')
  return result
}
export function getSensitivePolicyForField(fieldKey:string){ return kbxSensitiveDataPolicies.find(p=>p.fields.includes(fieldKey as never)) }