export type ExecutionPolicyMode = "allow" | "deny" | "audit";

export interface PolicyResolverInput {
  actorId?: string;
  workspaceId?: string;
  defaultMode?: ExecutionPolicyMode;
}

export interface PolicyResolution {
  mode: ExecutionPolicyMode;
  reason: string;
}

/**
 * Canonical policy resolution entrypoint used by bootstrap/dispatch paths.
 */
export function resolveExecutionPolicy(input: PolicyResolverInput): PolicyResolution {
  const mode = input.defaultMode ?? "audit";
  if (mode === "deny") {
    return { mode, reason: "default-deny policy mode" };
  }

  if (!input.actorId || !input.workspaceId) {
    return { mode: "audit", reason: "missing actor/workspace context" };
  }

  return { mode, reason: "context validated" };
}