import httpx

async def validate_tool_calls(proxy_id: str, tool_calls: list) -> dict:
    """Validate tool calls with Bastio before execution."""

    async with httpx.AsyncClient() as client:
        response = await client.post(
            f"https://api.bastio.com/v1/guard/{proxy_id}/agent/validate",
            headers={
                "Authorization": f"Bearer {API_KEY}",
                "Content-Type": "application/json"
            },
            json={
                "session_id": "session_123",
                "tool_calls": tool_calls
            }
        )

        result = response.json()

        if not result["allowed"]:
            # Check individual tool results
            for tool_result in result["tool_results"]:
                if not tool_result["allowed"]:
                    raise SecurityError(tool_result["reason"])

        if result.get("requires_approval"):
            # Wait for approval
            return await wait_for_approval(result["approval_id"])

        return result

# Usage - unified format (arguments as object, not JSON string)
tool_calls = [
    {
        "id": "call_abc123",
        "name": "execute_shell",
        "type": "function",
        "arguments": {"command": "ls -la"}  # Object, not string!
    }
]

result = await validate_tool_calls("proxy_xyz", tool_calls)
if result["allowed"]:
    # Safe to execute
    execute_tools(tool_calls)

interface ToolResult {
  tool_id: string;
  allowed: boolean;
  action: 'allowed' | 'blocked' | 'sanitized' | 'warned';
  risk_score: number;
  threats: string[];
  reason?: string;
}

interface ValidationResult {
  allowed: boolean;
  tool_results: ToolResult[];
  blocked_count: number;
  risk_score: number;
  request_id: string;
  requires_approval?: boolean;
  approval_id?: string;
}

async function validateToolCalls(
  proxyId: string,
  toolCalls: Array<{
    id: string;
    name: string;
    type: string;
    arguments: Record<string, unknown>;
  }>
): Promise<ValidationResult> {
  const response = await fetch(
    `https://api.bastio.com/v1/guard/${proxyId}/agent/validate`,
    {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${API_KEY}`,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({
        session_id: 'session_123',
        tool_calls: toolCalls,
      }),
    }
  );

  const result: ValidationResult = await response.json();

  if (!result.allowed) {
    const blocked = result.tool_results.filter(r => !r.allowed);
    throw new Error(`Tools blocked: ${blocked.map(b => b.reason).join(', ')}`);
  }

  if (result.requires_approval) {
    return await waitForApproval(result.approval_id!);
  }

  return result;
}

// Usage - unified format (arguments as object)
const toolCalls = [
  {
    id: 'call_abc123',
    name: 'execute_shell',
    type: 'function',
    arguments: { command: 'ls -la' },  // Object, not JSON string!
  },
];

const result = await validateToolCalls('proxy_xyz', toolCalls);
if (result.allowed) {
  await executeToolCalls(toolCalls);
}

# Validate tool calls (unified format)
curl -X POST https://api.bastio.com/v1/guard/proxy_xyz/agent/validate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "session_123",
    "tool_calls": [
      {
        "id": "call_abc",
        "name": "execute_shell",
        "type": "function",
        "arguments": {"command": "ls -la"}
      }
    ]
  }'

# Response
{
  "allowed": true,
  "tool_results": [
    {
      "tool_id": "call_abc",
      "allowed": true,
      "action": "allowed",
      "risk_score": 0.15,
      "threats": []
    }
  ],
  "blocked_count": 0,
  "risk_score": 0.15,
  "request_id": "req_xyz789"
}

{
  "session_id": "session_abc123",
  "tool_use": [
    {
      "type": "tool_use",
      "id": "toolu_01abc",
      "name": "execute_shell",
      "input": {
        "command": "ls -la /home/user"
      }
    }
  ]
}

{
  "session_id": "session_abc123",
  "tool_calls": [
    {
      "id": "call_abc123",
      "type": "function",
      "function": {
        "name": "execute_shell",
        "arguments": "{\"command\": \"ls -la /home/user\"}"
      }
    }
  ]
}