//! Stable bash permission prefixes.
//!
//! Ported from OpenCode's `BashArity` module. The table maps a command prefix
//! to the number of leading tokens that identify the human-understandable
//! command for reusable permission patterns.

pub fn prefix(tokens: &[String]) -> Vec<String> {
    for len in (1..=tokens.len()).rev() {
        let candidate = tokens[..len].join(" ");
        if let Some(arity) = arity(&candidate) {
            return tokens[..tokens.len().min(arity)].to_vec();
        }
    }

    tokens.first().cloned().into_iter().collect()
}

fn arity(command: &str) -> Option<usize> {
    Some(match command {
        "cat" => 1,
        "cd" => 1,
        "chmod" => 1,
        "chown" => 1,
        "cp" => 1,
        "echo" => 1,
        "env" => 1,
        "export" => 1,
        "grep" => 1,
        "kill" => 1,
        "killall" => 1,
        "ln" => 1,
        "ls" => 1,
        "mkdir" => 1,
        "mv" => 1,
        "ps" => 1,
        "pwd" => 1,
        "rm" => 1,
        "rmdir" => 1,
        "sleep" => 1,
        "source" => 1,
        "tail" => 1,
        "touch" => 1,
        "unset" => 1,
        "which" => 1,
        "aws" => 3,
        "az" => 3,
        "bazel" => 2,
        "brew" => 2,
        "bun" => 2,
        "bun run" => 3,
        "bun x" => 3,
        "cargo" => 2,
        "cargo add" => 3,
        "cargo run" => 3,
        "cdk" => 2,
        "cf" => 2,
        "cmake" => 2,
        "composer" => 2,
        "consul" => 2,
        "consul kv" => 3,
        "crictl" => 2,
        "deno" => 2,
        "deno task" => 3,
        "doctl" => 3,
        "docker" => 2,
        "docker builder" => 3,
        "docker compose" => 3,
        "docker container" => 3,
        "docker image" => 3,
        "docker network" => 3,
        "docker volume" => 3,
        "eksctl" => 2,
        "eksctl create" => 3,
        "firebase" => 2,
        "flyctl" => 2,
        "gcloud" => 3,
        "gh" => 3,
        "git" => 2,
        "git config" => 3,
        "git remote" => 3,
        "git stash" => 3,
        "go" => 2,
        "gradle" => 2,
        "helm" => 2,
        "heroku" => 2,
        "hugo" => 2,
        "ip" => 2,
        "ip addr" => 3,
        "ip link" => 3,
        "ip netns" => 3,
        "ip route" => 3,
        "kind" => 2,
        "kind create" => 3,
        "kubectl" => 2,
        "kubectl kustomize" => 3,
        "kubectl rollout" => 3,
        "kustomize" => 2,
        "make" => 2,
        "mc" => 2,
        "mc admin" => 3,
        "minikube" => 2,
        "mongosh" => 2,
        "mysql" => 2,
        "mvn" => 2,
        "ng" => 2,
        "npm" => 2,
        "npm exec" => 3,
        "npm init" => 3,
        "npm run" => 3,
        "npm view" => 3,
        "nvm" => 2,
        "nx" => 2,
        "openssl" => 2,
        "openssl req" => 3,
        "openssl x509" => 3,
        "pip" => 2,
        "pipenv" => 2,
        "pnpm" => 2,
        "pnpm dlx" => 3,
        "pnpm exec" => 3,
        "pnpm run" => 3,
        "poetry" => 2,
        "podman" => 2,
        "podman container" => 3,
        "podman image" => 3,
        "psql" => 2,
        "pulumi" => 2,
        "pulumi stack" => 3,
        "pyenv" => 2,
        "python" => 2,
        "rake" => 2,
        "rbenv" => 2,
        "redis-cli" => 2,
        "rustup" => 2,
        "serverless" => 2,
        "sfdx" => 3,
        "skaffold" => 2,
        "sls" => 2,
        "sst" => 2,
        "swift" => 2,
        "systemctl" => 2,
        "terraform" => 2,
        "terraform workspace" => 3,
        "tmux" => 2,
        "turbo" => 2,
        "ufw" => 2,
        "vault" => 2,
        "vault auth" => 3,
        "vault kv" => 3,
        "vercel" => 2,
        "volta" => 2,
        "wp" => 2,
        "yarn" => 2,
        "yarn dlx" => 3,
        "yarn run" => 3,
        _ => return None,
    })
}
