"""百工能力种子（内置能力幂等登记；旧枢治理种子随 M8 退役）。"""

from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession

from app.domains.baigong.models import Capability
from app.domains.baigong.service import PLATFORM_SCOPE

_BUILTIN_CAPABILITIES = [
    # name, 描述, 执行类型, 执行器, 四维风险, 数据范围, 目的地, consent
    (
        "builtin.echo",
        "回显输入（无副作用演示能力）",
        "builtin",
        "echo",
        {"capability": "L0", "data": "L0", "consequence": "L0", "context": "L0"},
        "",
        "",
        "allow",
    ),
    (
        "builtin.datetime",
        "读取当前时间",
        "builtin",
        "datetime.now",
        {"capability": "L0", "data": "L0", "consequence": "L0", "context": "L0"},
        "",
        "",
        "allow",
    ),
    (
        "qiankun.shell",
        "在乾坤沙箱中执行命令（隔离执行，HMAC 授契）",
        "qiankun",
        "",
        {"capability": "L2", "data": "L1", "consequence": "L3", "context": "L1"},
        "沙箱工作目录",
        "本机沙箱进程",
        "ask",
    ),
    (
        "web.fetch",
        "抓取指定 URL 内容（受限出站）",
        "http",
        "",
        {"capability": "L1", "data": "L1", "consequence": "L2", "context": "L1"},
        "目标 URL 响应体",
        "目标站点",
        "allow",
    ),
]


async def _seed_capabilities(session: AsyncSession) -> None:
    """内置能力按 (owner, name) 幂等登记（source=builtin，四维风险标注随代码演进）。"""
    import json as _json

    from sqlalchemy import select

    existing = set(
        (
            await session.execute(
                select(Capability.name).where(Capability.source == "builtin")
            )
        )
        .scalars()
        .all()
    )
    for name, desc, executor_type, ref, dims, scope, dests, consent in _BUILTIN_CAPABILITIES:
        if name in existing:
            continue
        session.add(
            Capability(
                name=name,
                owner_scope=PLATFORM_SCOPE,
                description=desc,
                executor_type=executor_type,
                executor_ref=ref,
                risk_dims_json=_json.dumps(dims),
                data_scope=scope,
                destinations=dests,
                consent_mode=consent,
                source="builtin",
            )
        )




async def ensure_governance_seed(session: AsyncSession) -> None:
    """启动幂等登记内置能力。"""
    await _seed_capabilities(session)
    await session.commit()