@lesliechan721/aw 0.1.0-beta.10

package/dist/src/utils/plugin-config.js

@@ -0,0 +1,1642 @@
+import crypto from 'node:crypto';
+import * as nodeFs from 'node:fs/promises';
+import path from 'node:path';
+import fs from 'fs-extra';
+import { canonicalizePluginConfigValues, formatPluginConfigIssue, matchPluginConfigPreset, redactPluginConfigValue, stablePluginConfigStringify, validatePluginConfigDocument, validatePluginConfigValue as validateCorePluginConfigValue, } from '@lesliechan721/aw-plugin-core/manifest';
+import { assertTestReadablePath, assertTestWritablePath, } from './test-path-fence.js';
+import { canonicalizePathThroughExistingAncestor, resolveAwHome, resolveRepoRootSync, } from './paths.js';
+import { assertRealFileParentWithinRoot, assertSafeFileMutationPath, atomicReplaceSafeFile, } from './safe-fs.js';
+export function codexNativeRefreshKeys(manifest) {
+    return new Set((manifest.artifacts?.targets ?? []).flatMap((target) => target.platform === 'codex'
+        && target.target === 'codex.skill'
+        && target.delivery?.mode === 'codex-native'
+        ? target.refreshKeys
+        : []));
+}
+export class PluginConfigResetError extends Error {
+    code;
+    osCode;
+    constructor(code, message, osCode) {
+        super(`${code}: ${message}`);
+        this.name = 'PluginConfigResetError';
+        this.code = code;
+        this.osCode = osCode;
+    }
+}
+export class PluginConfigSchemaResolutionError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(`${code}: ${message}`);
+        this.name = 'PluginConfigSchemaResolutionError';
+        this.code = code;
+        this.details = details;
+    }
+}
+export function isPluginConfigSchemaResolutionError(error) {
+    return error instanceof PluginConfigSchemaResolutionError;
+}
+export class PluginConfigStoreInventoryError extends Error {
+    code = 'invalidPluginConfigStore';
+    constructor(message) {
+        super(`invalidPluginConfigStore: ${message}`);
+        this.name = 'PluginConfigStoreInventoryError';
+    }
+}
+const CONFIG_DIR = 'plugin-config';
+const CONFIG_FILE = 'config.json';
+let atomicConfigBeforeRenameHookForTests;
+let atomicConfigAfterRenameHookForTests;
+export function setAtomicConfigBeforeRenameHookForTests(hook) {
+    atomicConfigBeforeRenameHookForTests = hook;
+}
+export function setAtomicConfigAfterRenameHookForTests(hook) {
+    atomicConfigAfterRenameHookForTests = hook;
+}
+function assertConfigPathBoundary(allowedRoot, candidatePath) {
+    const root = path.resolve(allowedRoot);
+    const candidate = path.resolve(candidatePath);
+    const relative = path.relative(root, candidate);
+    if (relative === ''
+        || relative === '..'
+        || relative.startsWith(`..${path.sep}`)
+        || path.isAbsolute(relative)) {
+        throw new Error(`Config path escapes its allowed root: ${candidate}`);
+    }
+    return { root, candidate };
+}
+async function lstatIfExists(targetPath) {
+    try {
+        return await fs.lstat(targetPath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function assertNoConfigSymlink(allowedRoot, candidatePath) {
+    const { root, candidate } = assertConfigPathBoundary(allowedRoot, candidatePath);
+    const paths = [root];
+    let current = root;
+    for (const segment of path.relative(root, candidate).split(path.sep)) {
+        current = path.join(current, segment);
+        paths.push(current);
+    }
+    for (const currentPath of paths) {
+        const stats = await lstatIfExists(currentPath);
+        if (stats?.isSymbolicLink()) {
+            throw new Error(`Config path cannot contain a symbolic link: ${currentPath}`);
+        }
+    }
+}
+async function inspectConfigReadTarget(allowedRoot, filePath) {
+    await assertNoConfigSymlink(allowedRoot, filePath);
+    const stats = await lstatIfExists(filePath);
+    if (!stats)
+        return null;
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+        throw new Error(`Config read target must be a regular file: ${filePath}`);
+    }
+    return stats;
+}
+async function inspectConfigInventoryStoreRoot(boundaryRoot, storeRoot) {
+    const { root, candidate } = assertConfigPathBoundary(boundaryRoot, path.join(storeRoot, CONFIG_FILE));
+    let current = root;
+    for (const segment of path.relative(root, path.dirname(candidate)).split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        const stats = await lstatIfExists(current);
+        if (!stats)
+            return false;
+        if (stats.isSymbolicLink() || !stats.isDirectory()) {
+            throw new PluginConfigStoreInventoryError(stats.isSymbolicLink()
+                ? `Config path cannot contain a symbolic link: ${current}`
+                : `Config inventory boundary must be a directory: ${current}`);
+        }
+    }
+    return true;
+}
+async function prepareConfigFileParent(filePath, allowedRoot) {
+    assertConfigPathBoundary(allowedRoot, filePath);
+    await assertNoConfigSymlink(allowedRoot, filePath);
+    await fs.ensureDir(path.dirname(filePath));
+    await assertNoConfigSymlink(allowedRoot, filePath);
+}
+export async function withConfigFileMutation(options) {
+    await prepareConfigFileParent(options.filePath, options.allowedRoot);
+    await assertNoConfigSymlink(options.allowedRoot, options.filePath);
+    return options.action();
+}
+export async function atomicReplaceConfigFile(options) {
+    await atomicReplaceSafeFile({
+        ...options,
+        label: 'Config path',
+        temporaryTag: 'tmp',
+        beforeRename: atomicConfigBeforeRenameHookForTests,
+        afterRename: async (targetPath) => {
+            await atomicConfigAfterRenameHookForTests?.(targetPath).catch(() => undefined);
+        },
+    });
+}
+export async function atomicRemoveConfigFile(options) {
+    await prepareConfigFileParent(options.filePath, options.allowedRoot);
+    await assertSafeFileMutationPath({
+        filePath: options.filePath,
+        allowedRoot: options.allowedRoot,
+        label: 'Config path',
+    });
+    await assertRealFileParentWithinRoot({
+        filePath: options.filePath,
+        allowedRoot: options.allowedRoot,
+        label: 'Config path',
+    });
+    const currentTarget = await lstatIfExists(options.filePath);
+    if (!currentTarget)
+        return false;
+    if (!currentTarget.isFile() || currentTarget.isSymbolicLink()) {
+        throw new Error(`Config target must be a regular file: ${options.filePath}`);
+    }
+    await atomicConfigBeforeRenameHookForTests?.(options.filePath, options.filePath);
+    await assertSafeFileMutationPath({
+        filePath: options.filePath,
+        allowedRoot: options.allowedRoot,
+        label: 'Config path',
+    });
+    await assertRealFileParentWithinRoot({
+        filePath: options.filePath,
+        allowedRoot: options.allowedRoot,
+        label: 'Config path',
+    });
+    const targetBeforeRemove = await lstatIfExists(options.filePath);
+    if (!targetBeforeRemove)
+        return false;
+    if (!targetBeforeRemove.isFile() || targetBeforeRemove.isSymbolicLink()) {
+        throw new Error(`Config target must be a regular file: ${options.filePath}`);
+    }
+    await nodeFs.unlink(options.filePath);
+    await atomicConfigAfterRenameHookForTests?.(options.filePath).catch(() => undefined);
+    return true;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function formatValue(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return stablePluginConfigStringify(value);
+    }
+    if (isRecord(value)) {
+        return stablePluginConfigStringify(value);
+    }
+    return JSON.stringify(value);
+}
+async function calculateConfigManifestDigest(filePath) {
+    const hash = crypto.createHash('sha256');
+    hash.update(await fs.readFile(filePath));
+    return `sha256:${hash.digest('hex')}`;
+}
+async function calculateConfigSchemaManifestDigestForPlugin(plugin) {
+    if (await lstatIfExists(plugin.manifestPath)) {
+        return calculateConfigManifestDigest(plugin.manifestPath);
+    }
+    const hash = crypto.createHash('sha256');
+    hash.update(JSON.stringify(plugin.manifest));
+    return `sha256:${hash.digest('hex')}`;
+}
+function createConfigSchemaEvidenceFromCurrentCatalog(plugin, manifestDigest) {
+    return {
+        source: 'currentCatalog',
+        identity: createPluginConfigSchemaIdentity(plugin.manifest),
+        pluginVersion: plugin.manifest.version,
+        manifestDigest,
+    };
+}
+function getStoreEntries(values) {
+    return Object.fromEntries(Object.entries(values));
+}
+export function assertSafePluginConfigSegment(pluginName) {
+    if (typeof pluginName !== 'string' || pluginName.trim() === '') {
+        throw new Error('Invalid plugin config segment: expected a non-empty plugin name.');
+    }
+    if (pluginName !== pluginName.trim() ||
+        pluginName === '.' ||
+        pluginName === '..' ||
+        pluginName.includes('/') ||
+        pluginName.includes('\\') ||
+        path.posix.isAbsolute(pluginName) ||
+        path.win32.isAbsolute(pluginName) ||
+        /^[A-Za-z][A-Za-z0-9+.-]*:/.test(pluginName)) {
+        throw new Error(`Invalid plugin config segment "${pluginName}".`);
+    }
+    return pluginName;
+}
+export function resolveAwProjectRoot(cwd) {
+    return path.resolve(resolveRepoRootSync(cwd));
+}
+function resolvePluginConfigAllowedRoot(options) {
+    return options.scope === 'user'
+        ? resolveAwHome(options.env)
+        : path.join(resolveAwProjectRoot(options.cwd), '.agent-workflows');
+}
+export function resolvePluginConfigStorePath(options) {
+    const pluginName = assertSafePluginConfigSegment(options.pluginName);
+    const sourceId = options.sourceId === undefined
+        ? undefined
+        : assertSafePluginConfigSegment(options.sourceId);
+    const root = options.scope === 'user'
+        ? resolveAwHome(options.env)
+        : path.join(resolveAwProjectRoot(options.cwd), '.agent-workflows');
+    const filePath = path.join(root, CONFIG_DIR, ...(sourceId ? [sourceId] : []), pluginName, CONFIG_FILE);
+    if (options.scope !== 'project') {
+        return filePath;
+    }
+    if (options.access === 'read') {
+        return assertTestReadablePath(filePath, 'project plugin config store (.agent-workflows/plugin-config)', '用 registerReadonlyFixtureRoot() 或 runWithRepositoryCwdAsReadOnly() 登记只读 project fixture 根；需要写入时改用 withSafeTestCwd() 或 registerWritableStateRoot()。');
+    }
+    if (options.access === 'write') {
+        return assertTestWritablePath(filePath, 'project plugin config store (.agent-workflows/plugin-config)', '用 withSafeTestCwd() 切到测试可写 cwd，或通过 registerWritableStateRoot() 登记 project fixture 根。');
+    }
+    return filePath;
+}
+export function resolvePluginConfigStoreTargets(options) {
+    if (options.scope === 'user') {
+        return [{
+                storeKind: 'user',
+                path: resolvePluginConfigStorePath(options),
+            }];
+    }
+    return [{
+            storeKind: 'project',
+            path: resolvePluginConfigStorePath(options),
+        }];
+}
+function isPluginConfigValue(value) {
+    if (typeof value === 'string' || typeof value === 'boolean')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (!isRecord(value))
+        return false;
+    return Object.values(value).every((child) => typeof child === 'string'
+        || typeof child === 'boolean'
+        || (typeof child === 'number' && Number.isFinite(child)));
+}
+function invalidStore(filePath, code, message, rawDigest) {
+    return {
+        path: filePath,
+        exists: true,
+        state: 'invalid',
+        values: {},
+        ...(rawDigest ? { rawDigest } : {}),
+        invalidCode: code,
+        issues: [message],
+    };
+}
+function readyStore(filePath, values, rawDigest) {
+    return {
+        path: filePath,
+        exists: true,
+        state: 'ready',
+        values: canonicalizePluginConfigValues(values),
+        ...(rawDigest ? { rawDigest } : {}),
+        issues: [],
+    };
+}
+export function assertReadyPluginConfigStore(store) {
+    if (store.state !== 'invalid')
+        return;
+    throw new Error(`${store.invalidCode}: Invalid plugin config store "${store.path}". ${store.issues.join(' ')}`);
+}
+async function parseStoreJson(filePath) {
+    const content = await fs.readFile(filePath);
+    const rawDigest = `sha256:${crypto.createHash('sha256').update(content).digest('hex')}`;
+    try {
+        return {
+            state: 'parsed',
+            value: JSON.parse(content.toString('utf8')),
+            rawDigest,
+        };
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            return {
+                state: 'invalidJson',
+                store: invalidStore(filePath, 'invalidJson', 'The store is not valid JSON.', rawDigest),
+            };
+        }
+        throw error;
+    }
+}
+function validateStoreValues(options) {
+    if (!isRecord(options.values)) {
+        return invalidStore(options.filePath, 'invalidValues', 'The values field must be an object.', options.rawDigest);
+    }
+    const values = Object.create(null);
+    const issues = [];
+    for (const [key, value] of Object.entries(options.values)) {
+        if (!isPluginConfigValue(value)) {
+            issues.push(`Config "${key}" is not a supported config value.`);
+            continue;
+        }
+        values[key] = value;
+    }
+    return issues.length > 0
+        ? invalidStore(options.filePath, 'invalidValues', issues.join(' '), options.rawDigest)
+        : readyStore(options.filePath, values, options.rawDigest);
+}
+async function readStoreFile(filePath) {
+    const parsed = await parseStoreJson(filePath);
+    if (parsed.state === 'invalidJson')
+        return parsed.store;
+    return validateStoreValues({ filePath, values: parsed.value, rawDigest: parsed.rawDigest });
+}
+async function readNamespacedStoreFile(options) {
+    const parsed = await parseStoreJson(options.filePath);
+    if (parsed.state === 'invalidJson')
+        return parsed.store;
+    const raw = parsed.value;
+    if (!isRecord(raw) || raw.schemaVersion !== 3) {
+        return invalidStore(options.filePath, 'schemaVersionUnsupported', 'Only plugin config store schemaVersion 3 is supported.', parsed.rawDigest);
+    }
+    if (raw.sourceId !== options.sourceId
+        || raw.pluginName !== options.pluginName
+        || raw.sourceIdentity !== options.sourceIdentity) {
+        return invalidStore(options.filePath, 'identityMismatch', 'The store identity does not match its source and namespaced path.', parsed.rawDigest);
+    }
+    return validateStoreValues({
+        filePath: options.filePath,
+        values: raw.values,
+        rawDigest: parsed.rawDigest,
+    });
+}
+function namespacedConfigContent(options) {
+    const values = canonicalizePluginConfigValues(options.values);
+    if (!options.sourceId)
+        return `${JSON.stringify(values, null, 2)}\n`;
+    if (!options.sourceIdentity) {
+        throw new Error('sourceChanged: namespaced plugin config requires a source identity.');
+    }
+    const envelope = {
+        schemaVersion: 3,
+        sourceId: options.sourceId,
+        sourceIdentity: options.sourceIdentity,
+        pluginName: options.pluginName,
+        values,
+    };
+    return `${JSON.stringify(envelope, null, 2)}\n`;
+}
+async function assertNoLegacyConfigCoexistence(options) {
+    if (!options.sourceId)
+        return;
+    const legacyPath = resolvePluginConfigStorePath({
+        pluginName: options.pluginName,
+        scope: options.scope,
+        cwd: options.cwd,
+        env: options.env,
+        ...(options.scope === 'project' ? { access: 'read' } : {}),
+    });
+    if (await lstatIfExists(legacyPath)) {
+        throw new Error('legacyStateUnsupported: legacy and namespaced plugin config stores cannot coexist.');
+    }
+}
+export async function readPluginConfigStore(options) {
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'read' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    if (options.sourceId) {
+        const legacyPath = resolvePluginConfigStorePath({
+            pluginName: options.pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+            ...(options.scope === 'project' ? { access: 'read' } : {}),
+        });
+        if (await inspectConfigReadTarget(allowedRoot, legacyPath)) {
+            throw new Error('legacyStateUnsupported: legacy and namespaced plugin config stores cannot coexist.');
+        }
+    }
+    if (!await inspectConfigReadTarget(allowedRoot, filePath)) {
+        return {
+            path: filePath,
+            exists: false,
+            state: 'missing',
+            values: {},
+            issues: [],
+        };
+    }
+    return options.sourceId
+        ? readNamespacedStoreFile({
+            filePath,
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginName: options.pluginName,
+        })
+        : readStoreFile(filePath);
+}
+export async function readNamespacedPluginConfigStoreIdentity(options) {
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'read' } : {}),
+    });
+    if (!await inspectConfigReadTarget(resolvePluginConfigAllowedRoot(options), filePath))
+        return null;
+    const parsed = await parseStoreJson(filePath);
+    if (parsed.state === 'invalidJson') {
+        throw new Error(`${parsed.store.invalidCode}: invalid namespaced plugin config store.`);
+    }
+    const raw = parsed.value;
+    if (!isRecord(raw) || raw.schemaVersion !== 3 || !isRecord(raw.values)
+        || raw.sourceId !== options.sourceId || raw.pluginName !== options.pluginName
+        || typeof raw.sourceIdentity !== 'string') {
+        throw new Error('schemaVersionUnsupported: invalid namespaced plugin config store.');
+    }
+    const store = validateStoreValues({ filePath, values: raw.values });
+    assertReadyPluginConfigStore(store);
+    return {
+        sourceIdentity: raw.sourceIdentity,
+        store,
+    };
+}
+async function listConfigStoreDirectoryPluginNames(storeRoot) {
+    if (!await lstatIfExists(storeRoot)) {
+        return [];
+    }
+    const entries = await fs.readdir(storeRoot, { withFileTypes: true });
+    const pluginNames = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory()) {
+            throw new PluginConfigStoreInventoryError(`Config plugin namespace must be a directory: ${path.join(storeRoot, entry.name)}`);
+        }
+        let pluginName;
+        try {
+            pluginName = assertSafePluginConfigSegment(entry.name);
+        }
+        catch {
+            continue;
+        }
+        if (await lstatIfExists(path.join(storeRoot, pluginName, CONFIG_FILE))) {
+            pluginNames.push(pluginName);
+        }
+    }
+    return pluginNames;
+}
+export async function listPluginConfigStorePluginNames(options) {
+    const projectRoot = resolveAwProjectRoot(options.cwd);
+    const storeRoots = options.scope === 'user'
+        ? [path.join(resolveAwHome(options.env), CONFIG_DIR)]
+        : options.scope === 'project'
+            ? [path.join(projectRoot, '.agent-workflows', CONFIG_DIR)]
+            : [
+                path.join(resolveAwHome(options.env), CONFIG_DIR),
+                path.join(projectRoot, '.agent-workflows', CONFIG_DIR),
+            ];
+    const pluginNames = (await Promise.all(storeRoots.map((storeRoot) => listConfigStoreDirectoryPluginNames(storeRoot)))).flat();
+    return [...new Set(pluginNames)].sort((left, right) => left.localeCompare(right));
+}
+export async function listNamespacedPluginConfigStores(options) {
+    const boundaryRoot = options.scope === 'user'
+        ? resolveAwHome(options.env)
+        : resolveAwProjectRoot(options.cwd);
+    if (options.scope === 'user') {
+        await canonicalizePathThroughExistingAncestor(boundaryRoot);
+    }
+    else {
+        await fs.realpath(boundaryRoot);
+    }
+    const storeRoot = path.join(boundaryRoot, ...(options.scope === 'project' ? ['.agent-workflows'] : []), CONFIG_DIR);
+    const output = [];
+    if (!await inspectConfigInventoryStoreRoot(boundaryRoot, storeRoot))
+        return output;
+    for (const sourceEntry of await fs.readdir(storeRoot, { withFileTypes: true })) {
+        if (!sourceEntry.isDirectory()) {
+            throw new PluginConfigStoreInventoryError(sourceEntry.isSymbolicLink()
+                ? `Config path cannot contain a symbolic link: ${path.join(storeRoot, sourceEntry.name)}`
+                : `Config source namespace must be a directory: ${path.join(storeRoot, sourceEntry.name)}`);
+        }
+        const sourceId = assertSafePluginConfigSegment(sourceEntry.name);
+        const sourceRoot = path.join(storeRoot, sourceId);
+        for (const pluginEntry of await fs.readdir(sourceRoot, { withFileTypes: true })) {
+            if (!pluginEntry.isDirectory()) {
+                throw new PluginConfigStoreInventoryError(pluginEntry.isSymbolicLink()
+                    ? `Config path cannot contain a symbolic link: ${path.join(sourceRoot, pluginEntry.name)}`
+                    : `Config plugin namespace must be a directory: ${path.join(sourceRoot, pluginEntry.name)}`);
+            }
+            const pluginName = assertSafePluginConfigSegment(pluginEntry.name);
+            const filePath = path.join(storeRoot, sourceId, pluginName, CONFIG_FILE);
+            if (!await inspectConfigReadTarget(storeRoot, filePath))
+                continue;
+            const parsed = await parseStoreJson(filePath);
+            if (parsed.state === 'invalidJson') {
+                throw new Error(`${parsed.store.invalidCode}: invalid namespaced plugin config store "${filePath}".`);
+            }
+            const raw = parsed.value;
+            if (!isRecord(raw) || raw.schemaVersion !== 3 || !isRecord(raw.values)
+                || raw.sourceId !== sourceId || raw.pluginName !== pluginName
+                || typeof raw.sourceIdentity !== 'string') {
+                throw new Error(`schemaVersionUnsupported: invalid namespaced plugin config store "${filePath}".`);
+            }
+            const store = validateStoreValues({ filePath, values: raw.values });
+            assertReadyPluginConfigStore(store);
+            output.push({
+                sourceId,
+                sourceIdentity: raw.sourceIdentity,
+                pluginName,
+                pluginId: `${sourceId}/${pluginName}`,
+                values: store.values,
+            });
+        }
+    }
+    return output.sort((left, right) => left.pluginId.localeCompare(right.pluginId));
+}
+export async function writePluginConfigStore(options) {
+    await assertNoLegacyConfigCoexistence(options);
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'write' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    const validated = validateStoreValues({ filePath, values: options.values });
+    assertReadyPluginConfigStore(validated);
+    await withConfigFileMutation({
+        filePath,
+        allowedRoot,
+        action: async () => Object.keys(validated.values).length === 0
+            ? atomicRemoveConfigFile({ filePath, allowedRoot })
+            : atomicReplaceConfigFile({
+                filePath,
+                allowedRoot,
+                content: namespacedConfigContent({ ...options, values: validated.values }),
+                mode: 0o600,
+            }),
+    });
+    return {
+        pluginName: options.pluginName,
+        scope: options.scope,
+        path: filePath,
+    };
+}
+export async function patchPluginConfigStore(options) {
+    await assertNoLegacyConfigCoexistence(options);
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'write' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    const removedKeys = options.removeKeys ?? [];
+    await withConfigFileMutation({
+        filePath,
+        allowedRoot,
+        action: async () => {
+            await options.reviewPreflight?.();
+            const current = (await lstatIfExists(filePath))
+                ? options.sourceId
+                    ? await readNamespacedStoreFile({
+                        filePath,
+                        sourceId: options.sourceId,
+                        sourceIdentity: options.sourceIdentity,
+                        pluginName: options.pluginName,
+                    })
+                    : await readStoreFile(filePath)
+                : readyStore(filePath, {});
+            assertReadyPluginConfigStore(current);
+            if (options.requireExistingRemoveKeys) {
+                const missingKey = removedKeys.find((key) => !Object.hasOwn(current.values, key));
+                if (missingKey)
+                    throw new Error(`Unknown config key "${missingKey}".`);
+            }
+            const next = { ...current.values };
+            for (const key of removedKeys) {
+                delete next[key];
+            }
+            for (const [key, value] of Object.entries(options.updates)) {
+                next[key] = value;
+            }
+            if (Object.keys(next).length === 0) {
+                await atomicRemoveConfigFile({ filePath, allowedRoot });
+            }
+            else {
+                await atomicReplaceConfigFile({
+                    filePath,
+                    allowedRoot,
+                    content: namespacedConfigContent({ ...options, values: next }),
+                    mode: 0o600,
+                });
+            }
+        },
+    });
+    return {
+        pluginName: options.pluginName,
+        scope: options.scope,
+        path: filePath,
+        updatedKeys: Object.keys(options.updates),
+        removedKeys,
+    };
+}
+export async function resetPluginConfigStore(options) {
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'write' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    const publicTarget = `${options.scope}/plugin-config/${[
+        options.sourceId,
+        options.pluginName,
+        CONFIG_FILE,
+    ].filter(Boolean).join('/')}`;
+    const { root, candidate } = assertConfigPathBoundary(allowedRoot, filePath);
+    let current = root;
+    try {
+        for (const segment of path.relative(root, path.dirname(candidate)).split(path.sep).filter(Boolean)) {
+            const stats = await lstatIfExists(current);
+            if (!stats) {
+                return {
+                    pluginName: options.pluginName,
+                    scope: options.scope,
+                    storeKind: options.scope,
+                    path: filePath,
+                    existed: false,
+                    deleted: false,
+                    resetDisposition: 'absent',
+                };
+            }
+            if (stats.isSymbolicLink() || !stats.isDirectory()) {
+                throw new PluginConfigResetError('configResetTargetUnsupported', `${publicTarget} has an unsafe ancestor. Repair it manually, then retry config reset.`);
+            }
+            current = path.join(current, segment);
+        }
+        const parentStats = await lstatIfExists(current);
+        if (!parentStats) {
+            return {
+                pluginName: options.pluginName,
+                scope: options.scope,
+                storeKind: options.scope,
+                path: filePath,
+                existed: false,
+                deleted: false,
+                resetDisposition: 'absent',
+            };
+        }
+        if (parentStats.isSymbolicLink() || !parentStats.isDirectory()) {
+            throw new PluginConfigResetError('configResetTargetUnsupported', `${publicTarget} has an unsafe ancestor. Repair it manually, then retry config reset.`);
+        }
+        await options.reviewPreflight?.();
+        const target = await lstatIfExists(filePath);
+        if (!target) {
+            return {
+                pluginName: options.pluginName,
+                scope: options.scope,
+                storeKind: options.scope,
+                path: filePath,
+                existed: false,
+                deleted: false,
+                resetDisposition: 'absent',
+            };
+        }
+        if (target.isFile() || target.isSymbolicLink()) {
+            await assertNoConfigSymlink(allowedRoot, path.dirname(filePath));
+            await nodeFs.unlink(filePath);
+            return {
+                pluginName: options.pluginName,
+                scope: options.scope,
+                storeKind: options.scope,
+                path: filePath,
+                existed: true,
+                deleted: true,
+                resetDisposition: target.isSymbolicLink() ? 'unlinkedSymlink' : 'deletedFile',
+            };
+        }
+        if (target.isDirectory()) {
+            const timestamp = new Date().toISOString().replace(/[-:]/gu, '').replace(/\..*$/u, '');
+            const quarantineBasename = `config.broken-${timestamp}-${crypto.randomUUID()}.json`;
+            await assertNoConfigSymlink(allowedRoot, path.dirname(filePath));
+            await nodeFs.rename(filePath, path.join(path.dirname(filePath), quarantineBasename));
+            return {
+                pluginName: options.pluginName,
+                scope: options.scope,
+                storeKind: options.scope,
+                path: filePath,
+                existed: true,
+                deleted: true,
+                resetDisposition: 'quarantinedDirectory',
+                quarantineBasename,
+            };
+        }
+        throw new PluginConfigResetError('configResetTargetUnsupported', `${publicTarget} is a special filesystem node. Move it manually, then retry config reset.`);
+    }
+    catch (error) {
+        if (error instanceof PluginConfigResetError)
+            throw error;
+        const osCode = error.code;
+        throw new PluginConfigResetError('configResetFailed', `Cannot reset ${publicTarget}${osCode ? ` (${osCode})` : ''}. Fix filesystem access, then retry config reset.`, osCode);
+    }
+}
+export async function inspectPluginConfigResetTarget(options) {
+    const filePath = resolvePluginConfigStorePath({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'write' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    const publicTarget = `${options.scope}/plugin-config/${[
+        options.sourceId,
+        options.pluginName,
+        CONFIG_FILE,
+    ].filter(Boolean).join('/')}`;
+    const { root, candidate } = assertConfigPathBoundary(allowedRoot, filePath);
+    let current = root;
+    for (const segment of path.relative(root, path.dirname(candidate)).split(path.sep).filter(Boolean)) {
+        const stats = await lstatIfExists(current);
+        if (!stats)
+            return resetTargetInspection('absent');
+        if (stats.isSymbolicLink() || !stats.isDirectory()) {
+            throw new PluginConfigResetError('configResetTargetUnsupported', `${publicTarget} has an unsafe ancestor. Repair it manually, then retry config reset.`);
+        }
+        current = path.join(current, segment);
+    }
+    const parentStats = await lstatIfExists(current);
+    if (!parentStats)
+        return resetTargetInspection('absent');
+    if (parentStats.isSymbolicLink() || !parentStats.isDirectory()) {
+        throw new PluginConfigResetError('configResetTargetUnsupported', `${publicTarget} has an unsafe ancestor. Repair it manually, then retry config reset.`);
+    }
+    const target = await lstatIfExists(filePath);
+    if (!target)
+        return resetTargetInspection('absent');
+    const kind = target.isSymbolicLink() ? 'symbolicLink'
+        : target.isFile() ? 'regularFile'
+            : target.isDirectory() ? 'directory'
+                : 'special';
+    return resetTargetInspection(kind, target);
+}
+function resetTargetInspection(kind, stats) {
+    const fingerprint = `sha256:${crypto.createHash('sha256').update(JSON.stringify({
+        kind,
+        ...(stats ? {
+            dev: stats.dev,
+            ino: stats.ino,
+            mode: stats.mode,
+            size: stats.size,
+            mtimeMs: stats.mtimeMs,
+            ctimeMs: stats.ctimeMs,
+        } : {}),
+    })).digest('hex')}`;
+    return {
+        exists: kind !== 'absent',
+        kind,
+        resettable: kind !== 'special',
+        fingerprint,
+    };
+}
+export async function resetPluginConfigStores(options) {
+    await assertNoLegacyConfigCoexistence(options);
+    const targets = resolvePluginConfigStoreTargets({
+        ...options,
+        ...(options.scope === 'project' ? { access: 'write' } : {}),
+    });
+    const allowedRoot = resolvePluginConfigAllowedRoot(options);
+    const receipts = [];
+    const existing = [];
+    for (const target of targets) {
+        await prepareConfigFileParent(target.path, allowedRoot);
+        await assertNoConfigSymlink(allowedRoot, target.path);
+        const stats = await lstatIfExists(target.path);
+        existing.push(stats !== null);
+        if (!stats)
+            continue;
+        if (!stats.isFile() || stats.isSymbolicLink()) {
+            throw new Error(`Config target must be a regular file: ${target.path}`);
+        }
+    }
+    for (const [index, target] of targets.entries()) {
+        const deleted = await atomicRemoveConfigFile({
+            filePath: target.path,
+            allowedRoot,
+        });
+        receipts.push({
+            pluginName: options.pluginName,
+            scope: options.scope,
+            storeKind: target.storeKind,
+            path: target.path,
+            existed: existing[index],
+            deleted,
+            resetDisposition: deleted ? 'deletedFile' : 'absent',
+        });
+    }
+    return receipts;
+}
+function coerceConfigValue(key, field, value) {
+    let coerced = value;
+    if (field.type === 'number' && typeof value === 'string' && value.trim() !== '') {
+        coerced = Number(value);
+    }
+    else if (field.type === 'boolean' && typeof value === 'string') {
+        const normalized = value.trim().toLowerCase();
+        if (['true', '1', 'yes', 'y'].includes(normalized))
+            coerced = true;
+        if (['false', '0', 'no', 'n'].includes(normalized))
+            coerced = false;
+    }
+    const issues = validateCorePluginConfigValue(field, coerced, key);
+    if (issues.length > 0) {
+        throw new Error(formatPluginConfigIssue(issues[0]));
+    }
+    return coerced;
+}
+export async function coercePluginConfigValue(options) {
+    return coerceConfigValue(options.key, options.field, options.value);
+}
+function redactValue(field, value) {
+    return redactPluginConfigValue(field, value);
+}
+function sourceForStoreLayer(scope) {
+    return scope === 'user' ? 'user' : 'project';
+}
+async function applyConfigLayer(options) {
+    for (const [key, field] of Object.entries(options.schema)) {
+        if (!Object.hasOwn(options.entries, key)) {
+            continue;
+        }
+        const value = options.entries[key];
+        const validationIssues = validateCorePluginConfigValue(field, value, key);
+        if (validationIssues.length === 0) {
+            const redactedValue = redactValue(field, value);
+            options.values[key] = value;
+            options.redactedValues[key] = redactedValue;
+            options.sources[key] = options.source;
+            options.fieldStates[key] = {
+                effective: { value, redactedValue, source: options.source },
+            };
+        }
+        else {
+            const fallback = options.fieldStates[key]?.effective;
+            delete options.values[key];
+            delete options.redactedValues[key];
+            options.sources[key] = options.source;
+            const issues = validationIssues.map((issue) => ({
+                type: 'invalid-config',
+                key,
+                source: options.source,
+                message: formatPluginConfigIssue(issue),
+            }));
+            options.fieldStates[key] = {
+                invalidOverride: { source: options.source, issues },
+                ...(fallback ? { fallback } : {}),
+            };
+        }
+    }
+}
+export async function resolveEffectivePluginConfig(options) {
+    const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.manifest.name);
+    const schema = options.manifest.config?.fields;
+    if (!schema) {
+        throw new Error(`Plugin "${pluginName}" does not declare an AW config schema.`);
+    }
+    const projectRoot = resolveAwProjectRoot(options.cwd);
+    const userStore = await readPluginConfigStore({
+        sourceId: options.sourceId,
+        sourceIdentity: options.sourceIdentity,
+        pluginName,
+        scope: 'user',
+        cwd: options.cwd,
+        env: options.env,
+    });
+    const projectStore = options.targetScope === 'user'
+        ? undefined
+        : await readPluginConfigStore({
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginName,
+            scope: 'project',
+            cwd: options.cwd,
+            env: options.env,
+        });
+    assertReadyPluginConfigStore(userStore);
+    if (projectStore)
+        assertReadyPluginConfigStore(projectStore);
+    const values = {};
+    const redactedValues = {};
+    const sources = {};
+    const fieldStates = {};
+    const ignoredUnknownKeys = [];
+    const dangerousKeyIssues = [];
+    const schemaKeys = new Set(Object.keys(schema));
+    for (const key of schemaKeys) {
+        sources[key] = 'missing';
+    }
+    for (const [key, field] of Object.entries(schema)) {
+        if (field.default === undefined) {
+            continue;
+        }
+        await applyConfigLayer({
+            values,
+            redactedValues,
+            sources,
+            fieldStates,
+            schema: { [key]: field },
+            entries: { [key]: field.default },
+            source: 'default',
+        });
+    }
+    const layers = options.targetScope === 'user'
+        ? [['user', userStore]]
+        : [
+            ['user', userStore],
+            ['project', projectStore],
+        ];
+    for (const [scope, store] of layers) {
+        const plainEntries = getStoreEntries(store.values);
+        const source = sourceForStoreLayer(scope);
+        const dangerousIssues = new Map(validatePluginConfigDocument({ fields: schema }, plainEntries).filter((issue) => issue.code === 'dangerousKey')
+            .map((issue) => [issue.path.field, issue]));
+        for (const key of Object.keys(plainEntries)) {
+            if (!schemaKeys.has(key)) {
+                const dangerousIssue = dangerousIssues.get(key);
+                if (dangerousIssue) {
+                    dangerousKeyIssues.push({
+                        type: 'invalid-config',
+                        code: dangerousIssue.code,
+                        key,
+                        source,
+                        message: formatPluginConfigIssue(dangerousIssue),
+                    });
+                }
+                else {
+                    ignoredUnknownKeys.push({ scope, source, key });
+                }
+            }
+        }
+        await applyConfigLayer({
+            values,
+            redactedValues,
+            sources,
+            fieldStates,
+            schema,
+            entries: plainEntries,
+            source,
+        });
+    }
+    const issues = [
+        ...Object.values(fieldStates).flatMap((state) => state.invalidOverride?.issues ?? []),
+        ...dangerousKeyIssues,
+    ];
+    for (const [key, field] of Object.entries(schema)) {
+        if (field.required && values[key] === undefined && !fieldStates[key]?.invalidOverride) {
+            issues.push({
+                type: 'missing-required',
+                key,
+                source: sources[key],
+                message: `Config "${key}" is required.`,
+            });
+        }
+    }
+    return {
+        pluginName,
+        projectRoot,
+        values,
+        redactedValues,
+        sources,
+        fieldStates,
+        issues,
+        ignoredUnknownKeys,
+        schema,
+        stores: {
+            user: userStore,
+            ...(projectStore ? { project: projectStore } : {}),
+        },
+    };
+}
+export async function coercePluginConfigUpdates(options) {
+    const output = {};
+    for (const [key, value] of Object.entries(options.updates)) {
+        const field = options.schema[key];
+        if (!field) {
+            throw new Error(`Unknown config key "${key}".`);
+        }
+        const coerced = await coercePluginConfigValue({
+            key,
+            field,
+            value,
+        });
+        output[key] = coerced;
+    }
+    return output;
+}
+export async function resolveProjectArtifactRenderConfig(options) {
+    if (!options.manifest.config?.fields) {
+        const pluginName = assertSafePluginConfigSegment(options.pluginName ?? options.manifest.name);
+        const [userStore, projectStore] = await Promise.all([
+            readPluginConfigStore({
+                sourceId: options.sourceId,
+                sourceIdentity: options.sourceIdentity,
+                pluginName,
+                scope: 'user',
+                cwd: options.cwd,
+                env: options.env,
+            }),
+            readPluginConfigStore({
+                sourceId: options.sourceId,
+                sourceIdentity: options.sourceIdentity,
+                pluginName,
+                scope: 'project',
+                cwd: options.cwd,
+                env: options.env,
+            }),
+        ]);
+        assertReadyPluginConfigStore(userStore);
+        assertReadyPluginConfigStore(projectStore);
+        return {
+            pluginName,
+            projectRoot: resolveAwProjectRoot(options.cwd),
+            values: {},
+            sources: {},
+            issues: [],
+            ignoredUnknownKeys: [],
+            schema: {},
+            stores: { user: userStore, project: projectStore },
+        };
+    }
+    const effective = await resolveEffectivePluginConfig({
+        ...options,
+        targetScope: 'project',
+    });
+    return {
+        pluginName: effective.pluginName,
+        projectRoot: effective.projectRoot,
+        values: effective.values,
+        sources: effective.sources,
+        issues: effective.issues,
+        ignoredUnknownKeys: effective.ignoredUnknownKeys,
+        schema: effective.schema,
+        stores: {
+            user: effective.stores.user,
+            project: effective.stores.project,
+        },
+    };
+}
+async function resolveRedactedLayerValue(options) {
+    try {
+        const coerced = await coercePluginConfigValue({
+            key: options.key,
+            field: options.field,
+            value: options.value,
+        });
+        return {
+            value: redactValue(options.field, coerced),
+        };
+    }
+    catch (error) {
+        return {
+            issue: {
+                type: 'invalid-config',
+                key: options.key,
+                source: options.source,
+                message: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+}
+export async function resolveProjectScopedPluginConfigView(options) {
+    const effective = await resolveEffectivePluginConfig(options);
+    const entries = {};
+    for (const [key, field] of Object.entries(effective.schema)) {
+        const entry = {
+            key,
+            effectiveValue: effective.redactedValues[key],
+            effectiveSource: effective.sources[key] ?? 'missing',
+        };
+        if (field.default !== undefined) {
+            const resolvedDefault = await resolveRedactedLayerValue({
+                key,
+                field,
+                source: 'default',
+                value: field.default,
+            });
+            if (resolvedDefault.value !== undefined) {
+                entry.defaultValue = resolvedDefault.value;
+            }
+        }
+        const userPlainEntries = getStoreEntries(effective.stores.user.values);
+        if (Object.hasOwn(userPlainEntries, key)) {
+            const resolvedUser = await resolveRedactedLayerValue({
+                key,
+                field,
+                source: 'user',
+                value: userPlainEntries[key],
+            });
+            if (resolvedUser.value !== undefined) {
+                entry.userValue = resolvedUser.value;
+            }
+        }
+        const projectPlainEntries = getStoreEntries(effective.stores.project.values);
+        if (Object.hasOwn(projectPlainEntries, key)) {
+            const resolvedProject = await resolveRedactedLayerValue({
+                key,
+                field,
+                source: 'project',
+                value: projectPlainEntries[key],
+            });
+            if (resolvedProject.value !== undefined) {
+                entry.projectValue = resolvedProject.value;
+            }
+        }
+        entries[key] = entry;
+    }
+    return {
+        pluginName: effective.pluginName,
+        projectRoot: effective.projectRoot,
+        schema: effective.schema,
+        stores: {
+            user: effective.stores.user,
+            project: effective.stores.project,
+        },
+        redactedValues: effective.redactedValues,
+        sources: effective.sources,
+        entries,
+        issues: effective.issues,
+        ignoredUnknownKeys: effective.ignoredUnknownKeys,
+    };
+}
+function toConfigSourceLayer(source) {
+    if (source === 'default') {
+        return 'default';
+    }
+    if (source === 'user') {
+        return 'user';
+    }
+    if (source === 'project') {
+        return 'project';
+    }
+    return null;
+}
+function configFieldProjection(options) {
+    const source = options.source ?? 'missing';
+    const issues = options.issues ?? [];
+    const presetSensitive = options.field.sensitive === true
+        || (options.field.type === 'object'
+            && (Object.values(options.field.properties ?? {}).some((child) => child.sensitive === true)
+                || (options.field.additionalProperties !== false
+                    && options.field.additionalProperties?.sensitive === true)));
+    return {
+        value: options.value === undefined ? null : redactValue(options.field, options.value),
+        source,
+        matchedPreset: options.value === undefined || presetSensitive
+            ? null
+            : matchPluginConfigPreset(options.field, options.value)?.id ?? null,
+        valid: issues.length === 0,
+        issues,
+    };
+}
+async function buildManifestFieldEntries(options) {
+    const schema = options.plugin.manifest.config?.fields;
+    if (!schema) {
+        return [];
+    }
+    const userStore = await readPluginConfigStore({
+        sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity,
+        pluginName: options.plugin.manifest.name,
+        scope: 'user',
+        cwd: options.cwd,
+        env: options.env,
+        schema,
+    });
+    const projectStore = options.scope === 'user'
+        ? undefined
+        : await readPluginConfigStore({
+            sourceId: options.plugin.sourceId,
+            sourceIdentity: options.plugin.sourceIdentity,
+            pluginName: options.plugin.manifest.name,
+            scope: 'project',
+            cwd: options.cwd,
+            env: options.env,
+            schema,
+        });
+    assertReadyPluginConfigStore(userStore);
+    if (projectStore)
+        assertReadyPluginConfigStore(projectStore);
+    const userPlainEntries = getStoreEntries(userStore.values);
+    const projectPlainEntries = projectStore ? getStoreEntries(projectStore.values) : {};
+    const effective = await resolveEffectivePluginConfig({
+        sourceId: options.plugin.sourceId,
+        sourceIdentity: options.plugin.sourceIdentity,
+        pluginName: options.plugin.manifest.name,
+        manifest: options.plugin.manifest,
+        targetScope: options.scope === 'user' ? 'user' : 'project',
+        cwd: options.cwd,
+        env: options.env,
+    });
+    const userOnlyKeys = codexNativeRefreshKeys(options.plugin.manifest);
+    const effectiveFieldState = (key) => {
+        const source = effective.sources[key];
+        const sourceLayer = toConfigSourceLayer(source);
+        const field = schema[key];
+        const fieldIssues = effective.issues.filter((entry) => entry.key === key);
+        const fieldState = effective.fieldStates[key];
+        if (source === undefined || source === 'missing') {
+            return {
+                valueState: fieldIssues.length > 0 ? 'invalid' : 'default',
+                effectiveValue: null,
+                sourceLayer: null,
+                ...configFieldProjection({ field, source: 'missing', issues: fieldIssues }),
+            };
+        }
+        const issue = fieldIssues.find((entry) => entry.source === source);
+        return {
+            valueState: issue ? 'invalid' : source === 'default' ? 'default' : 'configured',
+            effectiveValue: issue ? null : effective.redactedValues[key] ?? null,
+            sourceLayer,
+            ...(fieldState?.invalidOverride ? {
+                invalidOverride: {
+                    sourceLayer: fieldState.invalidOverride.source,
+                    issues: fieldState.invalidOverride.issues,
+                },
+            } : {}),
+            ...(fieldState?.fallback ? {
+                fallback: {
+                    effectiveValue: fieldState.fallback.redactedValue,
+                    sourceLayer: fieldState.fallback.source,
+                },
+            } : {}),
+            ...configFieldProjection({
+                field,
+                value: issue ? undefined : effective.values[key],
+                source,
+                issues: fieldIssues,
+            }),
+        };
+    };
+    const fields = [];
+    for (const [key, field] of Object.entries(schema)) {
+        const base = {
+            key,
+            title: field.title ?? key,
+            kind: 'manifest',
+            reserved: false,
+            writable: options.scope !== 'project' || !userOnlyKeys.has(key),
+            valueState: 'default',
+            effectiveValue: null,
+            sourceLayer: null,
+            ...configFieldProjection({ field }),
+        };
+        if (options.scope === 'user') {
+            if (Object.hasOwn(userPlainEntries, key)) {
+                try {
+                    const value = await coercePluginConfigValue({
+                        key,
+                        field,
+                        value: userPlainEntries[key],
+                    });
+                    fields.push({
+                        ...base,
+                        valueState: 'configured',
+                        effectiveValue: redactValue(field, value),
+                        sourceLayer: 'user',
+                        storedValue: redactValue(field, value),
+                        storedSourceLayer: 'user',
+                        ...configFieldProjection({ field, value, source: 'user' }),
+                    });
+                }
+                catch {
+                    fields.push({
+                        ...base,
+                        valueState: 'invalid',
+                        sourceLayer: 'user',
+                        storedSourceLayer: 'user',
+                        valid: false,
+                        issues: [{ type: 'invalid-config', key, source: 'user' }],
+                    });
+                }
+                continue;
+            }
+            if (field.default !== undefined) {
+                try {
+                    const value = await coercePluginConfigValue({
+                        key,
+                        field,
+                        value: field.default,
+                    });
+                    fields.push({
+                        ...base,
+                        effectiveValue: redactValue(field, value),
+                        sourceLayer: 'default',
+                        ...configFieldProjection({ field, value, source: 'default' }),
+                    });
+                }
+                catch {
+                    fields.push({
+                        ...base,
+                        valueState: 'invalid',
+                        sourceLayer: 'default',
+                        source: 'default',
+                        valid: false,
+                        issues: [{ type: 'invalid-config', key, source: 'default' }],
+                    });
+                }
+                continue;
+            }
+            fields.push(base);
+            continue;
+        }
+        let storedProjectValue;
+        if (options.scope === 'project' && Object.hasOwn(projectPlainEntries, key)) {
+            try {
+                const value = await coercePluginConfigValue({
+                    key,
+                    field,
+                    value: projectPlainEntries[key],
+                });
+                storedProjectValue = {
+                    storedValue: redactValue(field, value),
+                    storedSourceLayer: 'project',
+                };
+            }
+            catch {
+                storedProjectValue = { storedSourceLayer: 'project' };
+            }
+        }
+        fields.push({ ...base, ...effectiveFieldState(key), ...storedProjectValue });
+    }
+    return fields;
+}
+async function buildLegacyStoreFieldEntries(options) {
+    const locations = options.scope === 'effective'
+        ? [
+            { scope: 'user', sourceLayer: 'user' },
+            { scope: 'project', sourceLayer: 'project' },
+        ]
+        : [{
+                scope: options.scope,
+                sourceLayer: options.scope === 'user' ? 'user' : 'project',
+            }];
+    const fields = new Map();
+    for (const location of locations) {
+        const store = await readPluginConfigStore({
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginName: options.pluginName,
+            scope: location.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+        for (const key of Object.keys(store.values)) {
+            fields.set(key, {
+                key,
+                title: key,
+                kind: 'manifest',
+                reserved: false,
+                writable: false,
+                valueState: 'configured',
+                effectiveValue: '[redacted]',
+                sourceLayer: location.sourceLayer,
+                value: '[redacted]',
+                source: location.sourceLayer,
+                matchedPreset: null,
+                valid: true,
+                issues: [],
+            });
+        }
+    }
+    return [...fields.values()].sort((left, right) => left.key.localeCompare(right.key));
+}
+export async function resolvePluginConfigSchemaAccess(options) {
+    const pluginName = assertSafePluginConfigSegment(options.pluginName);
+    if (options.currentPluginError) {
+        throw options.currentPluginError;
+    }
+    if (!options.currentPlugin) {
+        return {
+            pluginName,
+            plugin: null,
+        };
+    }
+    return {
+        pluginName,
+        plugin: options.currentPlugin,
+        schema: createConfigSchemaEvidenceFromCurrentCatalog(options.currentPlugin, await calculateConfigSchemaManifestDigestForPlugin(options.currentPlugin)),
+    };
+}
+export async function resolveConfigRead(options) {
+    const pluginName = assertSafePluginConfigSegment(options.pluginName);
+    const schemaAccess = await resolvePluginConfigSchemaAccess({
+        pluginName,
+        currentPlugin: options.plugin,
+        currentPluginError: options.pluginError,
+        scope: options.scope,
+        cwd: options.cwd,
+        env: options.env,
+    });
+    const manifestFields = schemaAccess.plugin
+        ? await buildManifestFieldEntries({
+            plugin: schemaAccess.plugin,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        })
+        : await buildLegacyStoreFieldEntries({
+            sourceId: options.sourceId,
+            sourceIdentity: options.sourceIdentity,
+            pluginName,
+            scope: options.scope,
+            cwd: options.cwd,
+            env: options.env,
+        });
+    return {
+        pluginName,
+        scope: options.scope,
+        ...(schemaAccess.schema ? { schema: schemaAccess.schema } : {}),
+        fields: manifestFields,
+    };
+}
+export function findConfigFieldEntry(fields, key) {
+    return fields.find((field) => field.key === key) ?? null;
+}
+export function hasConfigReadContent(result) {
+    return result.fields.length > 0;
+}
+export function summarizeEffectivePluginConfig(config) {
+    return {
+        values: config.redactedValues,
+        sources: config.sources,
+        fieldStates: Object.fromEntries(Object.entries(config.fieldStates).map(([key, state]) => [key, {
+                ...(state.effective ? {
+                    effective: { value: state.effective.redactedValue, source: state.effective.source },
+                } : {}),
+                ...(state.invalidOverride ? { invalidOverride: state.invalidOverride } : {}),
+                ...(state.fallback ? {
+                    fallback: { value: state.fallback.redactedValue, source: state.fallback.source },
+                } : {}),
+            }])),
+        issues: config.issues,
+        ignoredUnknownKeys: config.ignoredUnknownKeys,
+    };
+}
+export function createPluginConfigSchemaIdentity(manifest) {
+    const hash = crypto
+        .createHash('sha256')
+        .update(JSON.stringify({
+        name: manifest.name,
+        version: manifest.version,
+        config: manifest.config ?? null,
+    }))
+        .digest('hex');
+    return `${manifest.name}:${hash}`;
+}
+function cliConfigPromptEnumValues(field) {
+    if (!field.choices)
+        return undefined;
+    const values = field.choices.presets
+        .map((preset) => preset.value);
+    if (field.type !== 'boolean') {
+        return field.choices.allowCustom ? undefined : values;
+    }
+    if (field.choices.allowCustom) {
+        for (const value of [true, false]) {
+            if (!values.includes(value))
+                values.push(value);
+        }
+    }
+    return values;
+}
+export function toCliConfigPromptSchema(schema) {
+    const promptSchema = {};
+    for (const [key, field] of Object.entries(schema)) {
+        if (field.type === 'object')
+            continue;
+        promptSchema[key] = {
+            type: field.type,
+            label: field.title ?? key,
+            description: field.description,
+            required: field.required,
+            sensitive: field.sensitive,
+            default: field.default,
+            enum: cliConfigPromptEnumValues(field),
+            min: field.type === 'number' ? field.validation?.minimum : undefined,
+            max: field.type === 'number' ? field.validation?.maximum : undefined,
+        };
+    }
+    return promptSchema;
+}
+export function createPluginConfigFormModel(options) {
+    const schema = options.manifest.config?.fields;
+    if (!schema) {
+        throw new Error(`Plugin "${options.pluginName ?? options.manifest.name}" does not declare an AW config schema.`);
+    }
+    const requiredKeys = [...new Set(options.effective.issues
+            .filter((issue) => issue.type === 'missing-required' || issue.type === 'invalid-config')
+            .map((issue) => issue.key))];
+    const fields = Object.entries(schema).flatMap(([key, field]) => {
+        if (field.type === 'object')
+            return [];
+        return [{
+                key,
+                type: field.type,
+                label: field.title ?? key,
+                description: field.description,
+                required: field.required === true,
+                sensitive: field.sensitive === true,
+                defaultValue: field.default,
+                enumValues: cliConfigPromptEnumValues(field),
+                min: field.type === 'number' ? field.validation?.minimum : undefined,
+                max: field.type === 'number' ? field.validation?.maximum : undefined,
+                configured: options.effective.values[key] !== undefined,
+                currentValue: field.sensitive
+                    ? undefined
+                    : options.effective.values[key],
+            }];
+    });
+    return {
+        pluginName: options.pluginName ?? options.manifest.name,
+        allowedScopes: options.allowedScopes ?? ['user', 'project'],
+        initialScope: options.initialScope,
+        requiredKeys,
+        fields,
+    };
+}
+export function toCliConfigPromptOptions(model) {
+    const currentValues = {};
+    const configuredKeys = [];
+    for (const field of model.fields) {
+        if (field.configured) {
+            configuredKeys.push(field.key);
+        }
+        if (field.currentValue !== undefined) {
+            currentValues[field.key] = field.currentValue;
+        }
+    }
+    return {
+        pluginName: model.pluginName,
+        schema: Object.fromEntries(model.fields.map((field) => [
+            field.key,
+            {
+                type: field.type,
+                label: field.label,
+                description: field.description,
+                required: field.required,
+                sensitive: field.sensitive,
+                default: field.defaultValue,
+                enum: field.enumValues,
+                min: field.min,
+                max: field.max,
+            },
+        ])),
+        initialScope: model.initialScope,
+        allowedScopes: [...model.allowedScopes],
+        currentValues,
+        configuredKeys,
+        requiredKeys: [...model.requiredKeys],
+    };
+}
+function formatRequiredConfigSetCommands(pluginName, issues, defaultScope) {
+    const commands = new Set();
+    for (const issue of issues) {
+        const scope = issue.source === 'user' || issue.source === 'project'
+            ? issue.source
+            : defaultScope;
+        commands.add(`aw config set ${pluginName} ${issue.key} --scope ${scope} --value-json '<json>'`);
+    }
+    return [...commands].map((command) => `\`${command}\``).join(' 或 ');
+}
+export async function preflightRequiredPluginConfigs(options) {
+    const visited = new Set();
+    const result = {
+        checked: 0,
+        prompted: 0,
+        written: [],
+    };
+    for (const target of options.targets) {
+        const pluginName = target.pluginName ?? target.manifest.name;
+        const identity = target.schemaSourceIdentity ?? createPluginConfigSchemaIdentity(target.manifest);
+        const dedupeKey = `${pluginName}\0${identity}`;
+        if (visited.has(dedupeKey)) {
+            continue;
+        }
+        visited.add(dedupeKey);
+        result.checked += 1;
+        if (!target.manifest.config?.fields) {
+            continue;
+        }
+        let effective = await resolveEffectivePluginConfig({
+            sourceId: target.sourceId,
+            sourceIdentity: target.sourceIdentity,
+            pluginName,
+            manifest: target.manifest,
+            cwd: options.cwd,
+            env: options.context.env,
+        });
+        const blockingIssues = effective.issues.filter((issue) => issue.type === 'missing-required' || issue.type === 'invalid-config');
+        if (blockingIssues.length === 0) {
+            continue;
+        }
+        const details = blockingIssues.map((issue) => issue.key).join(', ');
+        const setCommands = formatRequiredConfigSetCommands(pluginName, blockingIssues, options.defaultScope);
+        throw new Error(`${pluginName} requires valid AW config before install/upgrade: ${details}. ` +
+            `Run ${setCommands}, or open \`aw\` to complete setup.`);
+    }
+    return result;
+}
+export function renderPluginConfigValueForDisplay(value) {
+    return formatValue(value);
+}
+//# sourceMappingURL=plugin-config.js.map