/**
 * Core-internal auth policy for bundled auth-owning CLI backends. Membership controls
 * selected-profile resolution and raw credential forwarding during prepareExecution;
 * third-party plugins cannot declare this trust decision through Plugin SDK metadata.
 */
export type BundledCliBackendAuthPolicy = {
  /** Disable profile fallback and fail closed when the selected profile cannot materialize. */
  strictSelectedProfile: boolean;
  /** Owner responsible for refreshing selected OAuth credentials before execution. */
  oauthRefreshOwner: "core" | "cli";
  /** Retired OAuth profile identities that the native runtime owns instead. */
  nativeAuthProfileIds?: readonly string[];
};

const BUNDLED_CLI_BACKEND_AUTH_POLICIES = {
  "claude-cli": {
    strictSelectedProfile: true,
    oauthRefreshOwner: "core",
    nativeAuthProfileIds: ["anthropic:claude-cli"],
  },
  "google-gemini-cli": {
    strictSelectedProfile: false,
    oauthRefreshOwner: "cli",
  },
} satisfies Record<string, BundledCliBackendAuthPolicy>;

export function resolveBundledCliBackendAuthPolicy(
  backendId: string,
): BundledCliBackendAuthPolicy | undefined {
  return BUNDLED_CLI_BACKEND_AUTH_POLICIES[
    backendId as keyof typeof BUNDLED_CLI_BACKEND_AUTH_POLICIES
  ];
}