// SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
// Same module identity/schema, with an explicit allowlist of rights and cleanup work.
import type { ModuleManifest } from "@conusai-kit/core"
import { accountData } from "@conusai-kit/tenancy"

const CLEANUP_JOBS: Readonly<Record<string, readonly string[]>> = {
  agent: ["agent.runs.expire"],
  assistant: ["assistant.conversations.expire"],
  knowledge: ["knowledge.remove"],
}
export function custodyModule(source: ModuleManifest): ModuleManifest {
  const jobs = Object.fromEntries(
    Object.entries(source.jobs ?? {}).filter(([key]) => CLEANUP_JOBS[source.id]?.includes(key)),
  )
  const declared = source.schedules
  const schedules = typeof declared === "function" ? declared : () => declared ?? []
  return {
    id: source.id,
    version: source.version,
    kit: source.kit,
    ...(source.requires ? { requires: source.requires } : {}),
    ...(source.profiles ? { profiles: source.profiles } : {}),
    ...(source.repositories ? { repositories: source.repositories } : {}),
    ...(source.migrations ? { migrations: source.migrations } : {}),
    extends: (source.extends ?? []).filter((entry) => entry.point.id === accountData.id),
    jobs,
    schedules: (env) => schedules(env).filter((schedule) => Object.hasOwn(jobs, schedule.job)),
    // Source-removal and removal-request subscribers only: no indexing/model/run admission.
    ...(source.id === "knowledge"
      ? {
          events: {
            publishes: (source.events?.publishes ?? []).filter(
              (event) => event.name === "knowledge.documentRemoveRequested",
            ),
            subscribes: (source.events?.subscribes ?? []).filter(
              (entry) =>
                entry.event.name === "files.FileDeleted" || entry.event.name === "knowledge.documentRemoveRequested",
            ),
          },
        }
      : {}),
  }
}