"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.CONFIG_CATALOG_BY_KEY = exports.configCatalog = exports.CONFIG_CATALOG = exports.CONFIG_CATALOG_INVENTORY_DISPLAY_MODES = exports.CONFIG_CATALOG_WRITE_SURFACES = exports.CONFIG_CATALOG_DISCOVERABILITY = exports.CONFIG_CATALOG_COMMAND_FAMILIES = exports.CONFIG_CATALOG_SENSITIVITY_CLASSES = exports.CONFIG_CATALOG_SOURCE_LAYERS = exports.CONFIG_CATALOG_MUTABILITY_SCOPES = exports.CONFIG_CATALOG_VALUE_TYPES = exports.CONFIG_CATALOG_VALUE_FAMILIES = exports.CONFIG_CATALOG_MODEL_VERSION = void 0;
exports.getConfigCatalog = getConfigCatalog;
exports.isSensitiveUnsupportedConfigKeyPath = isSensitiveUnsupportedConfigKeyPath;
const cli_constants_1 = require("./cli-constants");
const config_contract_data_1 = require("./config-contract-data");
const structural_pressure_scan_defaults_1 = require("./structural-pressure-scan-defaults");
const config_catalog_license_and_reminder_1 = require("./config-catalog-license-and-reminder");
exports.CONFIG_CATALOG_MODEL_VERSION = 1;
exports.CONFIG_CATALOG_VALUE_FAMILIES = [
    'persisted-config',
    'read-only-metadata',
    'repository-owned-path',
    'derived-runtime-state',
    'environment-input',
    'command-input',
    'local-state',
    'host-state',
    'future-candidate',
];
exports.CONFIG_CATALOG_VALUE_TYPES = [
    'string',
    'number',
    'integer',
    'boolean',
    'path',
    'directory-path',
    'file-path',
    'enum',
    'timestamp',
    'duration',
    'object',
    'array',
    'count',
    'unknown',
];
exports.CONFIG_CATALOG_MUTABILITY_SCOPES = [
    'mutable-shared-config',
    'local-only-config',
    'read-only-metadata',
    'repository-owned-path',
    'derived-runtime-state',
    'environment-only',
    'command-input-only',
    'local-state',
    'host-state',
    'future-candidate',
];
exports.CONFIG_CATALOG_SOURCE_LAYERS = [
    'defaults',
    'repository',
    'project',
    'explicit',
    'local',
    'environment',
    'command-input',
    'runtime-derived',
    'repository-state',
    'user-local-state',
    'host-state',
    'product-policy',
    'future-candidate',
];
exports.CONFIG_CATALOG_SENSITIVITY_CLASSES = [
    'public',
    'local-preference',
    'host-identifying',
    'sensitive',
    'secret',
];
exports.CONFIG_CATALOG_COMMAND_FAMILIES = [
    'config',
    'structural-pressure',
    'validation',
    'license',
    'prompt',
    'planning',
    'workflow',
    'runtime',
    'unknown',
];
exports.CONFIG_CATALOG_DISCOVERABILITY = ['inventory-visible', 'internal-only'];
exports.CONFIG_CATALOG_WRITE_SURFACES = [
    'config-set-shared',
    'config-set-local',
    'owned-command',
    'not-writable',
    'future-candidate',
];
exports.CONFIG_CATALOG_INVENTORY_DISPLAY_MODES = ['printable', 'redacted', 'omitted', 'summary-only'];
const PRINTABLE_DISPLAY = { mode: 'printable' };
const NON_WRITABLE_PERSISTED_REJECTION = 'This value is inventory-visible but is not writable through day-shift config set.';
const LICENSE_COMMAND_WRITE_REJECTION = 'License and reminder inventory values are owned by license/reminder command surfaces, not day-shift config set.';
const LICENSE_SOURCE_SUMMARY_DISPLAY = {
    mode: 'summary-only',
    summaryDescription: 'Show source provenance and non-secret status fields only.',
};
const LICENSE_PATH_SUMMARY_DISPLAY = {
    mode: 'summary-only',
    summaryDescription: 'Show path source and resolution status without printing sensitive path payloads or license contents.',
};
const LICENSE_SPEC_TRACEABILITY_DESCRIPTION = `Traceability: ${cli_constants_1.CLI_SPEC_INDEX_PATH} entries cli-user-configuration-configurable-values and integrations-commercial-licensing-reminders.`;
const POSITIVE_ORDERED_THRESHOLD_VALIDATION = {
    kind: 'positive-integer-ordered-threshold',
    description: 'Must be a positive integer, and values in each threshold family must satisfy watch <= pressure <= hotspot.',
};
const STRUCTURAL_PRESSURE_STRING_ARRAY_VALIDATION = {
    kind: 'string-array',
    description: 'Must be an array of non-empty strings with structural-pressure scan-surface constraints.',
};
const RUNTIME_EVIDENCE_PATH_POLICY_VALIDATION = {
    kind: 'repository-relative-path-array',
    description: 'Must be an array of non-empty repository-relative paths.',
};
const CONTRACT_REVISION_IMPACT_BUDGET_VALIDATION = {
    kind: 'non-negative-safe-integer',
    description: 'Must be a non-negative safe integer at every configured precedence layer.',
};
const REPOSITORY_RELATIVE_PATH_VALIDATION = {
    kind: 'repository-relative-path',
    description: 'Must be a repository-relative path when supplied by repository config.',
};
const STRING_VALIDATION = {
    kind: 'string',
    description: 'Must be a string value.',
};
const INTEGER_VALIDATION = {
    kind: 'integer',
    description: 'Must be an integer value.',
};
const BOOLEAN_VALIDATION = {
    kind: 'boolean',
    description: 'Must be a boolean value.',
};
const PATH_VALIDATION = {
    kind: 'path',
    description: 'Must be a filesystem path supplied by the owning source.',
};
const STATE_VALIDATION = {
    kind: 'owned-state',
    description: 'State is read, written, or summarized only by the command family that owns it.',
};
const NON_CONFIG_INPUT_VALIDATION = {
    kind: 'runtime-input',
    description: 'May be supplied for the current invocation but is not accepted as repository or local TOML config.',
};
const FUTURE_CANDIDATE_VALIDATION = {
    kind: 'future-candidate',
    description: 'Inventory-visible for planning and discovery, but not accepted by current config write behavior.',
};
const PERSISTED_CONFIG_CATALOG_DESCRIPTORS = {
    planning_root: {
        valueFamily: 'repository-owned-path',
        valueType: 'directory-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned planning artifact root.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    spec_root: {
        valueFamily: 'repository-owned-path',
        valueType: 'directory-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned specification root.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    spec_index: {
        valueFamily: 'repository-owned-path',
        valueType: 'file-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned specification index path.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    agent_entrypoint: {
        valueFamily: 'repository-owned-path',
        valueType: 'file-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned agent entrypoint path.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    default_readiness: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Default readiness token used when planning artifacts are initialized.',
        validationRule: STRING_VALIDATION,
    },
    config_schema_version: {
        valueFamily: 'read-only-metadata',
        valueType: 'integer',
        mutability: 'read-only-metadata',
        sensitivity: 'public',
        description: 'Read-only schema version for Day Shift config files.',
        validationRule: INTEGER_VALIDATION,
    },
    spec_index_schema_version: {
        valueFamily: 'read-only-metadata',
        valueType: 'integer',
        mutability: 'read-only-metadata',
        sensitivity: 'public',
        description: 'Read-only schema version for the specification index.',
        validationRule: INTEGER_VALIDATION,
    },
    template_version: {
        valueFamily: 'read-only-metadata',
        valueType: 'integer',
        mutability: 'read-only-metadata',
        sensitivity: 'public',
        description: 'Read-only template metadata version used by generated artifacts.',
        validationRule: INTEGER_VALIDATION,
    },
    prompt_version: {
        valueFamily: 'read-only-metadata',
        valueType: 'integer',
        mutability: 'read-only-metadata',
        sensitivity: 'public',
        description: 'Read-only prompt metadata version used by prompt artifacts.',
        validationRule: INTEGER_VALIDATION,
    },
    prompt_root: {
        valueFamily: 'repository-owned-path',
        valueType: 'directory-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned prompt root.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    prompt_latest_root: {
        valueFamily: 'repository-owned-path',
        valueType: 'directory-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned latest-prompt root.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    prompt_user_root: {
        valueFamily: 'repository-owned-path',
        valueType: 'directory-path',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Repository-owned user-prompt override root.',
        validationRule: REPOSITORY_RELATIVE_PATH_VALIDATION,
    },
    cli_command: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Canonical CLI command recorded for the current workspace after verification.',
        validationRule: STRING_VALIDATION,
    },
    cli_resolution: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Workspace CLI resolution state such as installed or repository-development.',
        validationRule: STRING_VALIDATION,
    },
    cli_verified: {
        valueFamily: 'persisted-config',
        valueType: 'boolean',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Whether the recorded workspace CLI command has been verified.',
        validationRule: BOOLEAN_VALIDATION,
    },
    cli_verified_via: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Recorded verification command or evidence string for the workspace CLI resolution.',
        validationRule: STRING_VALIDATION,
    },
    monorepo_projects: {
        valueFamily: 'persisted-config',
        valueType: 'array',
        mutability: 'repository-owned-path',
        sensitivity: 'public',
        description: 'Validated repository-owned monorepo project identities, roots, and optional workflow defaults.',
        validationRule: {
            kind: 'monorepo-projects',
            description: 'Must be an array of project tables with unique machine-safe ids, non-overlapping repository-relative roots, and optional basic, structured, or governed defaults.',
        },
    },
    version: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'mutable-shared-config',
        sensitivity: 'public',
        description: 'Repository or local Day Shift version selector used by the version manager.',
        validationRule: STRING_VALIDATION,
    },
    editor: {
        valueFamily: 'persisted-config',
        valueType: 'string',
        mutability: 'local-only-config',
        sensitivity: 'local-preference',
        description: 'Local-only editor preference.',
        validationRule: STRING_VALIDATION,
    },
};
const DERIVED_CONFIG_FIELD_DESCRIPTIONS = {
    repositoryRoot: 'Absolute repository root resolved for the current invocation.',
    dayShiftDirectoryPath: 'Absolute path to the repository .day-shift directory.',
    sharedConfigPath: 'Absolute path to .day-shift/config.toml.',
    localConfigPath: 'Absolute path to .day-shift/local.toml.',
    planningRootPath: 'Absolute path derived from the resolved planning_root value.',
    specRootPath: 'Absolute path derived from the resolved spec_root value.',
    specIndexPath: 'Absolute path derived from the resolved spec_index value.',
    agentEntrypointPath: 'Absolute path derived from the resolved agent_entrypoint value.',
    promptRootPath: 'Absolute path derived from the resolved prompt_root value.',
    promptLatestRootPath: 'Absolute path derived from the resolved prompt_latest_root value.',
    promptUserRootPath: 'Absolute path derived from the resolved prompt_user_root value.',
};
const DERIVED_CONFIG_FIELD_VALUE_TYPES = {
    repositoryRoot: 'directory-path',
    dayShiftDirectoryPath: 'directory-path',
    sharedConfigPath: 'file-path',
    localConfigPath: 'file-path',
    planningRootPath: 'directory-path',
    specRootPath: 'directory-path',
    specIndexPath: 'file-path',
    agentEntrypointPath: 'file-path',
    promptRootPath: 'directory-path',
    promptLatestRootPath: 'directory-path',
    promptUserRootPath: 'directory-path',
};
function defineEntry(entry) {
    return {
        discoverability: 'inventory-visible',
        ...entry,
    };
}
function licenseSpecDescription(description) {
    return `${description} ${LICENSE_SPEC_TRACEABILITY_DESCRIPTION}`;
}
function persistedConfigEntry(key) {
    const contract = config_contract_data_1.CONFIG_FIELD_CONTRACTS[key];
    const descriptor = PERSISTED_CONFIG_CATALOG_DESCRIPTORS[key];
    const defaultValue = config_contract_data_1.BUILT_IN_CONFIG_DEFAULTS[key];
    return defineEntry({
        key,
        valueFamily: descriptor.valueFamily,
        valueType: descriptor.valueType,
        defaultValueDescription: defaultValue === undefined
            ? 'No built-in default; value is present only when supplied by .day-shift/local.toml.'
            : JSON.stringify(defaultValue),
        mutability: descriptor.mutability,
        allowedSourceLayers: contract.allowedLayers,
        sensitivity: descriptor.sensitivity,
        owningCommandFamily: 'config',
        validationRule: descriptor.validationRule,
        description: descriptor.description,
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: persistedWritePolicy(contract),
        persistedConfigContract: contract,
    });
}
function persistedWritePolicy(contract) {
    if (contract.writableThroughConfigSet) {
        return {
            supported: true,
            surface: contract.mutability === 'local-only' ? 'config-set-local' : 'config-set-shared',
            persistedConfigKey: contract.key,
        };
    }
    return {
        supported: false,
        surface: 'not-writable',
        rejectionReason: NON_WRITABLE_PERSISTED_REJECTION,
        persistedConfigKey: contract.key,
    };
}
function notWritable(rejectionReason) {
    return {
        supported: false,
        surface: 'not-writable',
        rejectionReason,
    };
}
function futureCandidate(rejectionReason) {
    return {
        supported: false,
        surface: 'future-candidate',
        rejectionReason,
    };
}
function commandOwned() {
    return {
        supported: true,
        surface: 'owned-command',
    };
}
function derivedConfigEntry(field) {
    return defineEntry({
        key: `derived.${field}`,
        valueFamily: 'derived-runtime-state',
        valueType: DERIVED_CONFIG_FIELD_VALUE_TYPES[field],
        derivedValueDescription: DERIVED_CONFIG_FIELD_DESCRIPTIONS[field],
        mutability: 'derived-runtime-state',
        allowedSourceLayers: ['runtime-derived'],
        sensitivity: 'public',
        owningCommandFamily: 'runtime',
        validationRule: {
            kind: 'derived-path',
            description: 'Derived from the repository root and resolved config values at runtime.',
        },
        description: DERIVED_CONFIG_FIELD_DESCRIPTIONS[field],
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Derived runtime values are computed and are not config set targets.'),
    });
}
function thresholdEntry(fileKind, threshold, defaultValue) {
    const key = `structural_pressure.${fileKind}.${threshold}`;
    return defineEntry({
        key,
        valueFamily: 'persisted-config',
        valueType: 'integer',
        defaultValueDescription: String(defaultValue),
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'structural-pressure',
        validationRule: POSITIVE_ORDERED_THRESHOLD_VALIDATION,
        description: `Planned ${fileKind} file ${threshold} line-count threshold stored under nested TOML table [structural_pressure.${fileKind}].`,
        migrationNote: 'Writable through day-shift config set as shared repository TOML only.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: {
            supported: true,
            surface: 'config-set-shared',
            persistedConfigKey: key,
        },
    });
}
function structuralPressureExcludedExtensionsEntry() {
    const key = 'structural_pressure.excluded_extensions';
    return defineEntry({
        key,
        valueFamily: 'persisted-config',
        valueType: 'array',
        defaultValueDescription: JSON.stringify(structural_pressure_scan_defaults_1.STRUCTURAL_PRESSURE_DEFAULT_EXCLUDED_EXTENSIONS),
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'structural-pressure',
        validationRule: STRUCTURAL_PRESSURE_STRING_ARRAY_VALIDATION,
        description: 'Planned structural-pressure excluded file extensions stored under [structural_pressure].',
        migrationNote: 'Writable through day-shift config set as shared repository TOML only.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: {
            supported: true,
            surface: 'config-set-shared',
            persistedConfigKey: key,
        },
    });
}
function structuralPressureBlockedSegmentsEntry() {
    const key = 'structural_pressure.blocked_segments';
    return defineEntry({
        key,
        valueFamily: 'persisted-config',
        valueType: 'array',
        defaultValueDescription: JSON.stringify(structural_pressure_scan_defaults_1.STRUCTURAL_PRESSURE_DEFAULT_BLOCKED_SCAN_SEGMENTS),
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'structural-pressure',
        validationRule: STRUCTURAL_PRESSURE_STRING_ARRAY_VALIDATION,
        description: 'Planned structural-pressure blocked scan path segments stored under [structural_pressure].',
        migrationNote: 'Writable through day-shift config set as shared repository TOML only.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: {
            supported: true,
            surface: 'config-set-shared',
            persistedConfigKey: key,
        },
    });
}
function structuralPressureExcludedBasenamesEntry() {
    const key = 'structural_pressure.excluded_basenames';
    return defineEntry({
        key,
        valueFamily: 'persisted-config',
        valueType: 'array',
        defaultValueDescription: JSON.stringify(structural_pressure_scan_defaults_1.STRUCTURAL_PRESSURE_DEFAULT_EXCLUDED_BASENAMES),
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'structural-pressure',
        validationRule: STRUCTURAL_PRESSURE_STRING_ARRAY_VALIDATION,
        description: 'Planned structural-pressure excluded file basenames stored under [structural_pressure].',
        migrationNote: 'Writable through day-shift config set as shared repository TOML only.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: {
            supported: true,
            surface: 'config-set-shared',
            persistedConfigKey: key,
        },
    });
}
const PERSISTED_CONFIG_CATALOG = Object.keys(config_contract_data_1.CONFIG_FIELD_CONTRACTS).map(persistedConfigEntry);
const DERIVED_RUNTIME_CATALOG = config_contract_data_1.DERIVED_CONFIG_FIELDS.map(derivedConfigEntry);
const STRUCTURAL_PRESSURE_THRESHOLD_CATALOG = [
    structuralPressureExcludedExtensionsEntry(),
    structuralPressureBlockedSegmentsEntry(),
    structuralPressureExcludedBasenamesEntry(),
    thresholdEntry('source', 'watch', 300),
    thresholdEntry('source', 'pressure', 600),
    thresholdEntry('source', 'hotspot', 1000),
    thresholdEntry('test', 'watch', 600),
    thresholdEntry('test', 'pressure', 1200),
    thresholdEntry('test', 'hotspot', 2000),
];
const RUNTIME_EVIDENCE_PATH_POLICY_CATALOG = [
    defineEntry({
        key: 'runtime_evidence.path_policy.documentation_only_paths',
        valueFamily: 'persisted-config',
        valueType: 'array',
        defaultValueDescription: '[]',
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'validation',
        validationRule: RUNTIME_EVIDENCE_PATH_POLICY_VALIDATION,
        description: 'Repository-specific documentation-only path additions stored under [runtime_evidence.path_policy].',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Runtime-evidence path policy is repository-owned TOML and is not writable through config set in this milestone.'),
    }),
    defineEntry({
        key: 'runtime_evidence.path_policy.runtime_eligible_paths',
        valueFamily: 'persisted-config',
        valueType: 'array',
        defaultValueDescription: '[]',
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository'],
        sensitivity: 'public',
        owningCommandFamily: 'validation',
        validationRule: RUNTIME_EVIDENCE_PATH_POLICY_VALIDATION,
        description: 'Repository-specific runtime-eligible path prefixes, including scaffold target roots, stored under [runtime_evidence.path_policy].',
        migrationNote: 'Writable through day-shift config set as shared repository TOML only.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: {
            supported: true,
            surface: 'config-set-shared',
            persistedConfigKey: 'runtime_evidence.path_policy.runtime_eligible_paths',
        },
    }),
];
const CONTRACT_REVISION_IMPACT_BUDGET_CATALOG = [
    defineEntry({
        key: 'lifecycle.contract_revision.impact_budget.max_invalidated_entries',
        valueFamily: 'persisted-config',
        valueType: 'count',
        defaultValueDescription: '100',
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository', 'project', 'explicit'],
        sensitivity: 'public',
        owningCommandFamily: 'runtime',
        validationRule: CONTRACT_REVISION_IMPACT_BUDGET_VALIDATION,
        description: 'Maximum manifest entries one contract revision may invalidate without an exact impact acknowledgement.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Contract-revision impact budgets are repository/project policy or explicit invocation inputs, not config set targets.'),
    }),
    defineEntry({
        key: 'lifecycle.contract_revision.impact_budget.max_evidence_bytes',
        valueFamily: 'persisted-config',
        valueType: 'count',
        defaultValueDescription: String(10 * 1024 * 1024),
        mutability: 'mutable-shared-config',
        allowedSourceLayers: ['defaults', 'repository', 'project', 'explicit'],
        sensitivity: 'public',
        owningCommandFamily: 'runtime',
        validationRule: CONTRACT_REVISION_IMPACT_BUDGET_VALIDATION,
        description: 'Maximum indexed evidence bytes one contract revision may invalidate without an exact impact acknowledgement.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Contract-revision impact budgets are repository/project policy or explicit invocation inputs, not config set targets.'),
    }),
];
const WORKFLOW_POLICY_CATALOG = [
    defineEntry({
        key: 'workflow.level',
        valueFamily: 'read-only-metadata',
        valueType: 'enum',
        defaultValueDescription: JSON.stringify('structured'),
        mutability: 'read-only-metadata',
        allowedSourceLayers: ['product-policy'],
        sensitivity: 'public',
        owningCommandFamily: 'workflow',
        validationRule: {
            kind: 'workflow-level',
            description: 'Must be basic, structured, or governed when supplied to a workflow resolver.',
        },
        description: 'Effective built-in workflow level used when no higher-precedence level source wins.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Workflow level selection is resolved by workflow commands and is not a config set target.'),
    }),
    defineEntry({
        key: 'workflow.agent_mode',
        valueFamily: 'read-only-metadata',
        valueType: 'enum',
        defaultValueDescription: JSON.stringify('guided'),
        mutability: 'read-only-metadata',
        allowedSourceLayers: ['product-policy'],
        sensitivity: 'public',
        owningCommandFamily: 'workflow',
        validationRule: {
            kind: 'agent-mode',
            description: 'Must be autonomous, guided, or interactive when supplied to an agent-mode resolver.',
        },
        description: 'Effective built-in agent mode used when no current instruction, session, task, parent, project, or repository value wins.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Effective agent mode is resolved by workflow policy and is not a config set target.'),
    }),
    defineEntry({
        key: 'workflow.evidence_profile',
        valueFamily: 'read-only-metadata',
        valueType: 'enum',
        defaultValueDescription: JSON.stringify('runtime'),
        mutability: 'read-only-metadata',
        allowedSourceLayers: ['product-policy'],
        sensitivity: 'public',
        owningCommandFamily: 'workflow',
        validationRule: {
            kind: 'evidence-profile',
            description: 'Must be runtime, contract, or hybrid when supplied to an evidence-profile resolver.',
        },
        description: 'Effective built-in evidence profile used when no task, parent, project, or repository value wins.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Effective evidence profile is resolved by workflow policy and is not a config set target.'),
    }),
    defineEntry({
        key: 'workflow.project_context',
        valueFamily: 'read-only-metadata',
        valueType: 'string',
        defaultValueDescription: JSON.stringify('repository'),
        mutability: 'read-only-metadata',
        allowedSourceLayers: ['repository-state'],
        sensitivity: 'public',
        owningCommandFamily: 'workflow',
        validationRule: {
            kind: 'project-context-label',
            description: 'Reports only a coarse repository-scoped context label, never an absolute or user-local path.',
        },
        description: 'Privacy-safe project context for the current repository invocation.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: notWritable('Project context is derived from repository state and is not a config set target.'),
    }),
];
const ENVIRONMENT_INPUT_CATALOG = [
    defineEntry({
        key: 'DAY_SHIFT_LICENSE_FILE',
        valueFamily: 'environment-input',
        valueType: 'file-path',
        derivedValueDescription: 'License file path supplied by environment for the current process.',
        mutability: 'environment-only',
        allowedSourceLayers: ['environment'],
        sensitivity: 'sensitive',
        owningCommandFamily: 'license',
        validationRule: PATH_VALIDATION,
        description: licenseSpecDescription('Environment-only license file override used for license resolution without writing repository or local config.'),
        inventoryDisplay: {
            mode: 'summary-only',
            summaryDescription: 'Show whether the variable is set and path provenance only.',
        },
        writePolicy: notWritable('Environment variables are supplied at runtime and are not config set targets.'),
    }),
    defineEntry({
        key: 'DAY_SHIFT_HOST_LABEL',
        valueFamily: 'environment-input',
        valueType: 'string',
        derivedValueDescription: 'Automation host label supplied by environment for the current process.',
        mutability: 'environment-only',
        allowedSourceLayers: ['environment'],
        sensitivity: 'host-identifying',
        owningCommandFamily: 'license',
        validationRule: STRING_VALIDATION,
        description: licenseSpecDescription('Environment-only host label override used for automation-host license provenance.'),
        inventoryDisplay: {
            mode: 'summary-only',
            summaryDescription: 'Show supplied status and effective host-label provenance.',
        },
        writePolicy: notWritable('Environment variables are supplied at runtime and are not config set targets.'),
    }),
    defineEntry({
        key: 'DAY_SHIFT_STATE_DIR',
        valueFamily: 'environment-input',
        valueType: 'directory-path',
        derivedValueDescription: 'Future CI/test override for the Day Shift local state directory that affects reminder and license state resolution.',
        mutability: 'environment-only',
        allowedSourceLayers: ['environment', 'future-candidate'],
        sensitivity: 'local-preference',
        owningCommandFamily: 'runtime',
        validationRule: PATH_VALIDATION,
        description: licenseSpecDescription('Future environment-only Day Shift state-directory override; not a repository or local TOML config key.'),
        migrationNote: 'The exact command behavior is deferred; keep this value supplied-at-runtime only.',
        inventoryDisplay: {
            mode: 'summary-only',
            summaryDescription: 'Show whether an override is active without implying persisted config support.',
        },
        writePolicy: futureCandidate('State-directory override support is future runtime input, not config set behavior.'),
    }),
];
const COMMAND_INPUT_CATALOG = [
    defineEntry({
        key: 'command.license_file',
        valueFamily: 'command-input',
        valueType: 'file-path',
        derivedValueDescription: 'Explicit license file path supplied with --license-file <path>.',
        mutability: 'command-input-only',
        allowedSourceLayers: ['command-input'],
        sensitivity: 'sensitive',
        owningCommandFamily: 'license',
        validationRule: PATH_VALIDATION,
        description: licenseSpecDescription('Per-invocation license file path input that participates in license resolution ahead of environment and installed-license locations.'),
        inventoryDisplay: {
            mode: 'summary-only',
            summaryDescription: 'Show command-input provenance without printing sensitive payloads.',
        },
        writePolicy: notWritable('Command options are supplied per invocation and are not config set targets.'),
    }),
    defineEntry({
        key: 'command.license_status.request',
        valueFamily: 'command-input',
        valueType: 'object',
        derivedValueDescription: 'Explicit license/status command inputs used to request status evaluation without persisting license or reminder state in config.',
        mutability: 'command-input-only',
        allowedSourceLayers: ['command-input'],
        sensitivity: 'sensitive',
        owningCommandFamily: 'license',
        validationRule: NON_CONFIG_INPUT_VALIDATION,
        description: licenseSpecDescription('Inventory placeholder for explicit license status command inputs described by the source spec.'),
        inventoryDisplay: {
            mode: 'summary-only',
            summaryDescription: 'Show request provenance and safe status fields only.',
        },
        writePolicy: notWritable('License/status command inputs are not repository or local TOML config keys.'),
    }),
];
const LICENSE_AND_REMINDER_CATALOG = (0, config_catalog_license_and_reminder_1.buildLicenseAndReminderCatalog)({
    defineEntry,
    licenseSpecDescription,
    notWritable,
    commandOwned,
    printableDisplay: PRINTABLE_DISPLAY,
    licenseCommandWriteRejection: LICENSE_COMMAND_WRITE_REJECTION,
    licenseSourceSummaryDisplay: LICENSE_SOURCE_SUMMARY_DISPLAY,
    licensePathSummaryDisplay: LICENSE_PATH_SUMMARY_DISPLAY,
    stringValidation: STRING_VALIDATION,
    integerValidation: INTEGER_VALIDATION,
    booleanValidation: BOOLEAN_VALIDATION,
    pathValidation: PATH_VALIDATION,
    stateValidation: STATE_VALIDATION,
    nonConfigInputValidation: NON_CONFIG_INPUT_VALIDATION,
});
const FUTURE_CANDIDATE_CATALOG = [
    defineEntry({
        key: 'output.default_format',
        valueFamily: 'future-candidate',
        valueType: 'enum',
        defaultValueDescription: 'Current command-specific default output format.',
        mutability: 'future-candidate',
        allowedSourceLayers: ['product-policy', 'future-candidate'],
        sensitivity: 'public',
        owningCommandFamily: 'runtime',
        validationRule: FUTURE_CANDIDATE_VALIDATION,
        description: 'Future candidate for default command output format.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: futureCandidate('Output format defaults are inventory-visible only for MVP.'),
    }),
    defineEntry({
        key: 'validation.default_scope',
        valueFamily: 'future-candidate',
        valueType: 'enum',
        defaultValueDescription: 'Current validation commands choose scope from command arguments or command defaults.',
        mutability: 'future-candidate',
        allowedSourceLayers: ['product-policy', 'future-candidate'],
        sensitivity: 'public',
        owningCommandFamily: 'validation',
        validationRule: FUTURE_CANDIDATE_VALIDATION,
        description: 'Future candidate for validation command scope defaults.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: futureCandidate('Validation scope defaults are inventory-visible only for MVP.'),
    }),
    defineEntry({
        key: 'validation.smoke_checkpoint_retention',
        valueFamily: 'future-candidate',
        valueType: 'count',
        defaultValueDescription: 'Current smoke/checkpoint retention behavior is command-owned.',
        mutability: 'future-candidate',
        allowedSourceLayers: ['product-policy', 'future-candidate'],
        sensitivity: 'public',
        owningCommandFamily: 'validation',
        validationRule: FUTURE_CANDIDATE_VALIDATION,
        description: 'Future candidate for smoke/checkpoint retention limits.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: futureCandidate('Smoke/checkpoint retention limits are not configurable for MVP.'),
    }),
    defineEntry({
        key: 'validation.smoke_checkpoint_path',
        valueFamily: 'future-candidate',
        valueType: 'file-path',
        defaultValueDescription: 'Current checkpoint paths are owned by validation commands.',
        mutability: 'future-candidate',
        allowedSourceLayers: ['product-policy', 'future-candidate'],
        sensitivity: 'public',
        owningCommandFamily: 'validation',
        validationRule: FUTURE_CANDIDATE_VALIDATION,
        description: 'Future candidate for smoke/checkpoint retention paths.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: futureCandidate('Smoke/checkpoint retention paths are not configurable for MVP.'),
    }),
    defineEntry({
        key: 'report.default_path',
        valueFamily: 'future-candidate',
        valueType: 'file-path',
        defaultValueDescription: 'Current report paths are command-specific when supported.',
        mutability: 'future-candidate',
        allowedSourceLayers: ['product-policy', 'future-candidate'],
        sensitivity: 'public',
        owningCommandFamily: 'runtime',
        validationRule: FUTURE_CANDIDATE_VALIDATION,
        description: 'Future candidate for user-facing report path defaults.',
        inventoryDisplay: PRINTABLE_DISPLAY,
        writePolicy: futureCandidate('Report path defaults are inventory-visible only for MVP.'),
    }),
];
exports.CONFIG_CATALOG = [
    ...PERSISTED_CONFIG_CATALOG,
    ...DERIVED_RUNTIME_CATALOG,
    ...STRUCTURAL_PRESSURE_THRESHOLD_CATALOG,
    ...RUNTIME_EVIDENCE_PATH_POLICY_CATALOG,
    ...CONTRACT_REVISION_IMPACT_BUDGET_CATALOG,
    ...WORKFLOW_POLICY_CATALOG,
    ...ENVIRONMENT_INPUT_CATALOG,
    ...COMMAND_INPUT_CATALOG,
    ...LICENSE_AND_REMINDER_CATALOG,
    ...FUTURE_CANDIDATE_CATALOG,
];
exports.configCatalog = exports.CONFIG_CATALOG;
function getConfigCatalog() {
    return exports.CONFIG_CATALOG;
}
exports.CONFIG_CATALOG_BY_KEY = Object.freeze(Object.fromEntries(exports.CONFIG_CATALOG.map((entry) => [entry.key, entry])));
function isSensitiveUnsupportedConfigKeyPath(keyPath) {
    const normalized = keyPath.replace(/[_-]+/g, '.').toLowerCase();
    return (/(^|\.)(license|reminder)(\.|$)/.test(normalized) ||
        /(secret|signature|signed|payload|private|entitlement|purchase|license\.id|cadence|reminder)/.test(normalized) ||
        /(license|reminder|commercial).*policy/.test(normalized) ||
        /policy.*(license|reminder|commercial)/.test(normalized) ||
        /managed.*region/.test(normalized) ||
        /region.*managed/.test(normalized) ||
        /generated.*artifact/.test(normalized) ||
        /artifact.*reminder/.test(normalized) ||
        /fallback.*reminder/.test(normalized));
}
