@pareto4/pp-core 1.10.0 → 1.11.0

package/pp-core/bin/lib/vault-coordinates.cjs

@@ -0,0 +1,485 @@
+"use strict";
+/**
+ * src/vault-coordinates.cts — the coordinate seam (milestone v1.11.0, Phase
+ * 31-01; org-profile layer added Phase 33-03).
+ *
+ * ADR-457 build-at-publish: this TypeScript file is the SOURCE OF TRUTH. It
+ * compiles to the git-ignored `pp-core/bin/lib/vault-coordinates.cjs`; do NOT
+ * hand-edit the compiled output. Behaviour is locked by
+ * `tests/vault-coordinates.test.cjs`.
+ *
+ * This module is the single place every vault coordinate decision in pp-core
+ * routes through — the host, repo and ref for the client tier, and the host,
+ * repo and ref for the shared tier — for both the read path (`src/vault.cts`)
+ * and the write path (`src/vault-write-back.cts`). Before this module
+ * existed, `DEFAULT_FALLBACK_REPO` was a `const` in `src/vault.cts` and four
+ * separate `'gitlab.com'` fallback chains were hand-written across the two
+ * files, two of which read `platform.host` from `.platform-bindings.json`
+ * and two of which read it from `.planning/config.json` (D-09) — the same
+ * one-value-two-owners shape that produced defect P-1 in Phase 29 for
+ * clone-target composition, and that Phase 30 closed for that concern by
+ * building `src/git-provider.cts`. This module is the equivalent owner for
+ * coordinates.
+ *
+ * It imports ONLY node builtins plus `./git-provider.cjs` and
+ * `./org-profile.cjs` — no `vault.cjs`, no `vault-write-back.cjs`, no
+ * `io.cjs`, no `shell-command-projection.cjs` — so that both `src/vault.cts`
+ * and `src/vault-write-back.cts` can import it without forming a require
+ * cycle in the CommonJS graph `require()` loads. `git-provider.cjs` and
+ * `org-profile.cjs` are both safe to import here: neither imports this
+ * module back at their own top level (org-profile.cjs's only reference back
+ * to git-provider.cjs is a call-time lazy require, never load-time), so
+ * depending on either does not risk a cycle the way depending on `vault.cjs`
+ * would.
+ *
+ * Every coordinate this module resolves now consults an org profile (D-07)
+ * strictly between the config read and the built-in default —
+ * `resolvePlatformHost` and `resolveSharedCoordinates` call
+ * `readProfileValue` directly; `resolveClientCoordinates` gains no direct
+ * call of its own because its host chain already reaches
+ * `resolvePlatformHost` transitively. This supersedes the tier-keyed
+ * `orgProfileCoordinates(cwd, tier)` stub Phase 31 froze here — see the
+ * supersession note above `resolvePlatformHost` for the full rationale.
+ *
+ * Export style: named `export function` / `export const` declarations,
+ * matching `src/git-provider.cts`'s export surface rather than
+ * `src/vault.cts`'s `export =` object. Both consumers already import
+ * `./git-provider.cjs` with a named-import block, so this module is imported
+ * the identical way and no consumer needs a different call convention for
+ * the two seams.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_OPT_OUT_REASON = exports.PLATFORM_HOST_CONFIG_KEY = exports.SHARED_HOST_CONFIG_KEY = exports.SHARED_REF_CONFIG_KEY = exports.SHARED_REPO_CONFIG_KEY = exports.DEFAULT_SHARED_REF = exports.DEFAULT_SHARED_REPO = exports.DEFAULT_HOST_FOR_PROVIDER = void 0;
+exports.defaultHostForProvider = defaultHostForProvider;
+exports.resolvePlatformHost = resolvePlatformHost;
+exports.resolveClientCoordinates = resolveClientCoordinates;
+exports.resolveSharedCoordinates = resolveSharedCoordinates;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const org_profile_cjs_1 = require("./org-profile.cjs");
+// ─── Constants ───────────────────────────────────────────────────────────────
+/**
+ * D-08: the last-resort host, derived from the resolved provider. New code,
+ * not a relocation — structured the way `PROVIDERS`/`DEFAULT_PROVIDER` are
+ * structured in `src/git-provider.cts`. Byte-identical for every gitlab
+ * install (ROADMAP SC3); correct out of the box for Azure DevOps cloud.
+ */
+exports.DEFAULT_HOST_FOR_PROVIDER = Object.freeze({
+    gitlab: 'gitlab.com',
+    azure: 'dev.azure.com',
+});
+/** The values moving out of `src/vault.cts`'s `DEFAULT_FALLBACK_REPO`/`DEFAULT_FALLBACK_REF`. */
+exports.DEFAULT_SHARED_REPO = 'pareto4/pareto-vault';
+exports.DEFAULT_SHARED_REF = 'main';
+/** Dotted `.planning/config.json` keys, named so no consumer hand-writes a key string. */
+exports.SHARED_REPO_CONFIG_KEY = 'vault.fallback_repo';
+exports.SHARED_REF_CONFIG_KEY = 'vault.fallback_ref';
+exports.SHARED_HOST_CONFIG_KEY = 'vault.fallback_host';
+exports.PLATFORM_HOST_CONFIG_KEY = 'platform.host';
+/**
+ * D-13/WR-01: the `suppressedReason` for an `explicit-opt-out`. Worded so an
+ * operator reading a degraded manifest recognises their OWN decision in it —
+ * names the key and states the tier was disabled on purpose — rather than
+ * being told to act on something they already did. Exported so
+ * `tests/vault-coordinates.test.cjs` asserts the shipped sentence itself
+ * (read from this module) instead of a restated literal that could drift
+ * from it.
+ */
+exports.SHARED_OPT_OUT_REASON = `the shared vault tier was intentionally disabled (${exports.SHARED_REPO_CONFIG_KEY} is set to an empty string)`;
+// ─── Private readers ─────────────────────────────────────────────────────────
+/**
+ * Read a dotted config key from `.planning/config.json`, returning `fallback`
+ * on any miss/unreadable-file/parse-error/non-object. Never throws.
+ *
+ * This is a byte-for-byte mirror of `cfgGet` in `src/git-provider.cts` (lines
+ * 78-89), which itself mirrors the canonical original at `src/vault.cts`
+ * (lines 124-135). It is written inline rather than imported: `src/vault.cts`
+ * will import THIS module, so importing a reader back out of `vault.cjs`
+ * would be the require cycle this whole leaf-module shape exists to avoid.
+ *
+ * Importing the reader from `git-provider.cjs` instead was also considered
+ * and rejected — not because of a require cycle (this module already
+ * depends on the provider seam, and the seam imports nothing back, so
+ * exporting a value from it would be safe), but because the reader is not
+ * the provider seam's responsibility to publish. Exporting it would make a
+ * private implementation detail of one seam part of another seam's public
+ * contract, so a future change to either module's reader would become a
+ * cross-module API change instead of a local one. What actually prevents
+ * drift is that all copies are byte-identical and each carries a comment
+ * naming the canonical original — that is the property to preserve, not a
+ * shared import.
+ */
+function cfgGet(cwd, key, fallback) {
+    try {
+        const cfg = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(cwd, '.planning', 'config.json'), 'utf-8'));
+        const v = key.split('.').reduce((o, k) => (o && typeof o === 'object' ? o[k] : undefined), cfg);
+        return v === undefined ? fallback : v;
+    }
+    catch {
+        return fallback;
+    }
+}
+function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * Read `.platform-bindings.json` at the project root. Mirrors `readBindings`
+ * in `src/vault.cts` (lines 141-150) exactly: any problem
+ * (absent/malformed/non-object) → `{}`. Written inline for the same
+ * require-cycle reason `cfgGet` above is inline.
+ */
+function readBindings(cwd) {
+    try {
+        const p = node_path_1.default.join(cwd, '.platform-bindings.json');
+        if (!node_fs_1.default.existsSync(p))
+            return {};
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(p, 'utf-8'));
+        return isObject(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Bound a rejected config value before it is echoed into a warning.
+ * Byte-for-byte mirror of `sanitizeForWarning` in `src/git-provider.cts`
+ * (lines 98-100): strip CR/LF, collapse internal whitespace, trim, truncate
+ * to 40 characters. Every echoed config value in this module goes through
+ * it — no second, weaker bounding rule is written (T-31-05).
+ */
+function sanitizeForWarning(value) {
+    return value.replace(/[\r\n]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 40);
+}
+/**
+ * Append only strings not already present in `target`, mirroring the
+ * exact-string de-duplication `src/vault.cts` already performs when folding
+ * two resolutions' warnings (lines 436-439). `resolveSharedCoordinates` can
+ * consult the org profile up to three times per call and `resolvePlatformHost`
+ * a fourth time within it — D-09 promises one bounded warning per rejected
+ * thing, not four copies of the same string.
+ */
+function pushDeduped(target, incoming) {
+    for (const w of incoming) {
+        if (!target.includes(w))
+            target.push(w);
+    }
+}
+// ─── defaultHostForProvider ──────────────────────────────────────────────────
+/** Read the D-08 host table for `provider`. */
+function defaultHostForProvider(provider) {
+    return exports.DEFAULT_HOST_FOR_PROVIDER[provider];
+}
+// ─── D-07 supersession: the tier-keyed stub is gone ──────────────────────────
+//
+// Phase 31 froze `orgProfileCoordinates(cwd, tier)` — a stub taking a TIER
+// (`'client' | 'shared'`) as the contract Phase 33 would fill. Phase 33
+// (D-07) supersedes that shape rather than filling it: D-06's allowlist is a
+// set of config KEYS (`vault.provider`, `vault.fallback_repo`,
+// `vault.fallback_ref`, `vault.fallback_host`, `platform.host`), not tiers,
+// and neither `vault.provider` nor `platform.host` fits a per-tier return at
+// all. One key-keyed function — `readProfileValue(cwd, key)` in
+// `src/org-profile.cts` — now serves all three consuming resolvers
+// (`resolveProvider` in `src/git-provider.cts`, plus `resolvePlatformHost`
+// and `resolveSharedCoordinates` below), where the tier-keyed shape could
+// only ever have served two of them.
+//
+// Nothing is lost by this supersession: the client tier needs no direct call
+// of its own, because its host chain already runs
+// `client.vaultHost → resolvePlatformHost → defaultHostForProvider`, so a
+// profile-supplied `platform.host` reaches it transitively through
+// `resolvePlatformHost` below.
+// ─── resolvePlatformHost (D-09, D-07) ────────────────────────────────────────
+/**
+ * Resolve `platform.host` for the project at `cwd`, in four steps (widened
+ * from three by D-07): `.platform-bindings.json` → `.planning/config.json` →
+ * the org profile → `none`. `.platform-bindings.json` stays authoritative
+ * (Phase 31 D-09) — an org profile is below config, never above it (D-05).
+ *
+ * Read `.platform-bindings.json` first: when its `platform` block carries a
+ * string `host` whose trimmed value is non-empty, return that trimmed value
+ * with source `bindings` and no warnings — bindings win, and the org profile
+ * is never consulted on this branch. Otherwise read `platform.host` from
+ * `.planning/config.json`: when that trimmed value is non-empty, return it
+ * with source `config` and exactly one warning; the org profile is not
+ * consulted on this branch either — an explicit config value is the
+ * operator's, even from an older layer, and outranks a profile precisely
+ * because D-05 never lets a profile outrank anything explicitly set. The
+ * warning states that `platform.host` was read from `.planning/config.json`,
+ * that `.platform-bindings.json` is authoritative, and that the value should
+ * be moved there; it does not echo the host value at all, so this warning
+ * carries no injected-content surface. The whole warning is capped at 200
+ * characters.
+ *
+ * Only when BOTH bindings and config are silent is the org profile
+ * consulted, via `readProfileValue(cwd, PLATFORM_HOST_CONFIG_KEY)`. When its
+ * value is defined, return `{ host: value, source: 'profile', warnings }`;
+ * otherwise return `{ host: null, source: 'none', warnings }`. Both of these
+ * final returns carry the SAME profile warnings, so a broken profile is
+ * reported whether or not it happened to supply this particular key.
+ */
+function resolvePlatformHost(cwd) {
+    const bindings = readBindings(cwd);
+    const platform = isObject(bindings.platform) ? bindings.platform : null;
+    const bindingsHostRaw = platform && typeof platform.host === 'string' ? platform.host.trim() : '';
+    if (bindingsHostRaw) {
+        return { host: bindingsHostRaw, source: 'bindings', warnings: [] };
+    }
+    const configHostRaw = cfgGet(cwd, exports.PLATFORM_HOST_CONFIG_KEY, undefined);
+    const configHost = typeof configHostRaw === 'string' ? configHostRaw.trim() : '';
+    if (configHost) {
+        const warning = `${exports.PLATFORM_HOST_CONFIG_KEY} was read from .planning/config.json — .platform-bindings.json is authoritative for ${exports.PLATFORM_HOST_CONFIG_KEY}; move the value there.`.slice(0, 200);
+        return { host: configHost, source: 'config', warnings: [warning] };
+    }
+    const profile = (0, org_profile_cjs_1.readProfileValue)(cwd, exports.PLATFORM_HOST_CONFIG_KEY);
+    if (profile.value !== undefined) {
+        return { host: profile.value, source: 'profile', warnings: profile.warnings };
+    }
+    return { host: null, source: 'none', warnings: profile.warnings };
+}
+// ─── resolveClientCoordinates ────────────────────────────────────────────────
+/**
+ * Resolve the client-tier coordinates for `provider` at `cwd`.
+ *
+ * `repo` is `client.vaultRepo` when it is a string, else `null`, passed
+ * through with no trimming and no rewriting — the raw value is what the
+ * T-29-26 flag-shaped refusal and `isLiteralCloneTarget` inspect downstream,
+ * so this function must not touch it. `ref` is `client.vaultRef` trimmed
+ * when it is a non-blank string, else `'main'`. `host` is, in order:
+ * `client.vaultHost` trimmed when non-blank; else `resolvePlatformHost(cwd)`;
+ * else `defaultHostForProvider(provider)`. `resolvePlatformHost`'s warnings
+ * are folded into the returned `warnings` only when it is actually
+ * consulted (i.e. when no client-supplied host wins), so a project with an
+ * explicit `client.vaultHost` never surfaces a D-09 warning it has no
+ * bearing on.
+ *
+ * Trimming `host` and `ref` is the one deliberate unification in this
+ * function — the write path trimmed these values and the read path did not,
+ * so the two paths disagreed for a whitespace-padded value. For any value
+ * with no surrounding whitespace, which is every real install, the result is
+ * byte-identical to both paths' previous behaviour.
+ *
+ * This function deliberately gains no direct org-profile call (D-07): its
+ * host chain already runs `client.vaultHost → resolvePlatformHost →
+ * defaultHostForProvider`, so a profile-supplied `platform.host` reaches it
+ * transitively through `resolvePlatformHost` above. A future reader should
+ * not "fix" this apparent omission by adding a direct `readProfileValue`
+ * call here — that would consult the profile twice for the same key on a
+ * project that also resolves the shared tier in the same request.
+ */
+function resolveClientCoordinates(cwd, provider) {
+    const bindings = readBindings(cwd);
+    const client = isObject(bindings.client) ? bindings.client : null;
+    const repo = client && typeof client.vaultRepo === 'string' ? client.vaultRepo : null;
+    const rawRef = client && typeof client.vaultRef === 'string' ? client.vaultRef.trim() : '';
+    const ref = rawRef || 'main';
+    const rawClientHost = client && typeof client.vaultHost === 'string' ? client.vaultHost.trim() : '';
+    let host;
+    let warnings = [];
+    if (rawClientHost) {
+        host = rawClientHost;
+    }
+    else {
+        const platformRes = resolvePlatformHost(cwd);
+        if (platformRes.host !== null) {
+            host = platformRes.host;
+            warnings = warnings.concat(platformRes.warnings);
+        }
+        else {
+            host = defaultHostForProvider(provider);
+        }
+    }
+    return { repo, ref, host, warnings };
+}
+// ─── resolveSharedCoordinates ────────────────────────────────────────────────
+/**
+ * Resolve the shared-tier coordinates for `provider` at `cwd`.
+ *
+ * `ref`: `vault.fallback_ref` trimmed when a non-blank string; else (D-07) the
+ * org profile's `vault.fallback_ref`; else `DEFAULT_SHARED_REF`.
+ *
+ * `host`, in D-03's order, widened by D-07: `vault.fallback_host` trimmed
+ * when a non-blank string; else the org profile's `vault.fallback_host`; else
+ * `resolvePlatformHost(cwd)`; else `defaultHostForProvider(provider)`. When
+ * `vault.fallback_host` is present but is not a usable string (a number, an
+ * array, an object, or a blank string), it is skipped and exactly one bounded
+ * warning is added naming `vault.fallback_host` and the bounded echo of the
+ * rejected value, in the same sentence shape `resolveProvider`
+ * (`src/git-provider.cts`) uses for an unrecognized provider. A usable
+ * operator-supplied host is never rewritten or "fixed" — passed through as
+ * written, warned about only if something is worth saying. That is the same
+ * rule `composeCloneTarget` follows for an operator-supplied `.git` suffix
+ * (T-30-08). Ordering matters and is not arbitrary: a profile's
+ * `vault.fallback_host` is a statement about the shared tier specifically, so
+ * it outranks the more general `platform.host` for this tier exactly the way
+ * `vault.fallback_host` config outranks it.
+ *
+ * `repo`, in the config-then-org-profile-then-built-in-default order D-06
+ * fixes, now reporting suppression through the D-13/WR-01 `suppressedKind`
+ * discriminator rather than a single always-derivable boolean:
+ *
+ *   - `vault.fallback_repo` present as a string and non-empty: that value
+ *     wins, returned as written with no trimming. `suppressed: false`,
+ *     `suppressedKind: null`, `suppressedReason: null`. The org profile is
+ *     not consulted on this branch at all (D-05).
+ *   - `vault.fallback_repo` present as the EXACT empty string `''`: an
+ *     explicit, deliberate "shared tier disabled" — a decision, not an
+ *     absence. Returns `repo: null`, `suppressed: TRUE`,
+ *     `suppressedKind: 'explicit-opt-out'`, `suppressedReason:
+ *     SHARED_OPT_OUT_REASON`. True on both providers and both values of
+ *     `applyBuiltInDefault`; no warning is added (there is nothing wrong to
+ *     report — the operator did this on purpose). The org profile is NOT
+ *     consulted on this branch either, for the same D-05 reason as the
+ *     non-empty case: an explicit `''` IS a set value, not an absence a
+ *     profile may fill.
+ *   - `vault.fallback_repo` present but not a string: treated as absent,
+ *     falling through with one bounded warning naming the key and the
+ *     bounded echo of the rejected value.
+ *   - Key absent (or fell through): the org profile is consulted for
+ *     `vault.fallback_repo` (D-07's successor to the frozen
+ *     `orgProfileCoordinates(cwd, 'shared')` stub — see the supersession note
+ *     above `resolvePlatformHost`). When it supplies a value, that value wins
+ *     with `suppressed: false`, `suppressedKind: null`, `suppressedReason:
+ *     null`, and the whole `applyBuiltInDefault` ladder below is skipped —
+ *     `applyBuiltInDefault` withholds only the BUILT-IN default, never a
+ *     configured profile value, so a project with a profile-supplied shared
+ *     repo now performs a shared-shadow lookup on the write path where an
+ *     unconfigured project still performs none. That is correct (the profile
+ *     is a configured value, not a built-in) and cannot affect any existing
+ *     install, because an install with no profile takes an unchanged path.
+ *   - Nothing resolved, `provider` is `gitlab`: `DEFAULT_SHARED_REPO` when
+ *     `applyBuiltInDefault` is true, else `null` — but `suppressed: false`
+ *     and `suppressedKind: null` under BOTH flag values. Nothing was
+ *     suppressed either way: with the flag true the built-in default
+ *     applied, and with it false the caller asked for no default and got
+ *     none. This must stay `false` under both flag values — making it `true`
+ *     would put a suppression note on every GitLab project's promotion
+ *     preview, exactly the regression ROADMAP SC3 exists to prevent.
+ *   - Nothing resolved, `provider` is anything other than `gitlab`:
+ *     `repo: null`, `suppressed: TRUE`, `suppressedKind:
+ *     'provider-default-unavailable'`, `suppressedReason` reading exactly
+ *     `no shared vault configured for provider "<provider>"` — regardless of
+ *     `applyBuiltInDefault`. This is the WR-01 fix itself: withholding the
+ *     built-in default is why the write path could not previously see this
+ *     state, and the fix is for the resolver to describe the state rather
+ *     than describe what it did about it. The existing gitlab-only WARNING
+ *     stays gated on `applyBuiltInDefault` exactly as before — the read
+ *     path's warning list is byte-identical and the write path (which passes
+ *     `applyBuiltInDefault: false`) gains no new warning.
+ *
+ * Two callers deliberately pass different values for `applyBuiltInDefault`,
+ * and this is not a divergence to unify: the read-path ladder and
+ * `assertVaultWriteTarget` both apply the built-in default because both do
+ * so today, while the write path's shared-shadow lookup does not because it
+ * never has (it reads the key with an empty-string default) — making it
+ * start applying the default would give existing gitlab installs a shared
+ * clone they do not perform today, breaking ROADMAP SC3.
+ */
+function resolveSharedCoordinates(cwd, provider, opts) {
+    const applyBuiltInDefault = opts?.applyBuiltInDefault ?? true;
+    const warnings = [];
+    // ─ ref ─
+    const rawRefCfg = cfgGet(cwd, exports.SHARED_REF_CONFIG_KEY, undefined);
+    let ref;
+    if (typeof rawRefCfg === 'string' && rawRefCfg.trim()) {
+        ref = rawRefCfg.trim();
+    }
+    else {
+        const refProfile = (0, org_profile_cjs_1.readProfileValue)(cwd, exports.SHARED_REF_CONFIG_KEY);
+        pushDeduped(warnings, refProfile.warnings);
+        ref = refProfile.value !== undefined ? refProfile.value : exports.DEFAULT_SHARED_REF;
+    }
+    // ─ host (D-03 order, widened by D-07) ─
+    const rawHostCfg = cfgGet(cwd, exports.SHARED_HOST_CONFIG_KEY, undefined);
+    let host;
+    if (typeof rawHostCfg === 'string' && rawHostCfg.trim()) {
+        host = rawHostCfg.trim();
+    }
+    else {
+        if (rawHostCfg !== undefined) {
+            const rawStr = typeof rawHostCfg === 'string' ? rawHostCfg : JSON.stringify(rawHostCfg);
+            const echoed = sanitizeForWarning(rawStr ?? '');
+            warnings.push(`Unrecognized ${exports.SHARED_HOST_CONFIG_KEY} value "${echoed}" — expected a non-blank string. Falling back to ${exports.PLATFORM_HOST_CONFIG_KEY} or the provider default.`.slice(0, 200));
+        }
+        const hostProfile = (0, org_profile_cjs_1.readProfileValue)(cwd, exports.SHARED_HOST_CONFIG_KEY);
+        pushDeduped(warnings, hostProfile.warnings);
+        if (hostProfile.value !== undefined) {
+            host = hostProfile.value;
+        }
+        else {
+            const platformRes = resolvePlatformHost(cwd);
+            if (platformRes.host !== null) {
+                host = platformRes.host;
+                pushDeduped(warnings, platformRes.warnings);
+            }
+            else {
+                host = defaultHostForProvider(provider);
+            }
+        }
+    }
+    // ─ repo (D-06 order, D-13/WR-01 suppression kinds) ─
+    let repo;
+    let suppressed = false;
+    let suppressedKind = null;
+    let suppressedReason = null;
+    const rawRepoCfg = cfgGet(cwd, exports.SHARED_REPO_CONFIG_KEY, undefined);
+    if (typeof rawRepoCfg === 'string') {
+        if (rawRepoCfg === '') {
+            // D-13/WR-01: an explicit empty string is a DECISION, not an absence —
+            // the org profile must NOT be consulted here (D-05 never lets a
+            // profile outrank an explicitly set value, and an explicit '' is a set
+            // value). No warning: there is nothing wrong to report.
+            repo = null;
+            suppressed = true;
+            suppressedKind = 'explicit-opt-out';
+            suppressedReason = exports.SHARED_OPT_OUT_REASON;
+        }
+        else {
+            repo = rawRepoCfg;
+        }
+    }
+    else {
+        if (rawRepoCfg !== undefined) {
+            const echoed = sanitizeForWarning(JSON.stringify(rawRepoCfg) ?? '');
+            warnings.push(`Unrecognized ${exports.SHARED_REPO_CONFIG_KEY} value "${echoed}" — expected a string. Falling through to the org profile / built-in default.`.slice(0, 200));
+        }
+        // D-07: the org profile fills the key when config left it absent — this
+        // is the real consultation that supersedes the frozen stub call.
+        const repoProfile = (0, org_profile_cjs_1.readProfileValue)(cwd, exports.SHARED_REPO_CONFIG_KEY);
+        pushDeduped(warnings, repoProfile.warnings);
+        if (repoProfile.value !== undefined) {
+            repo = repoProfile.value;
+            // suppressed/suppressedKind/suppressedReason stay at their
+            // false/null/null defaults: applyBuiltInDefault withholds only the
+            // BUILT-IN default, never a configured profile value.
+        }
+        else if (provider === 'gitlab') {
+            // Nothing was suppressed either way: with the flag true the built-in
+            // default applied, and with it false the caller asked for no default
+            // and got none. This MUST stay false under both flag values — making
+            // it true would put a suppression note on every GitLab project's
+            // promotion preview, precisely the regression ROADMAP SC3 exists to
+            // prevent.
+            repo = applyBuiltInDefault ? exports.DEFAULT_SHARED_REPO : null;
+        }
+        else {
+            // D-13/WR-01 fix: withholding the built-in default is why the write
+            // path could not previously see this state — the resolver now
+            // describes the state itself, regardless of applyBuiltInDefault,
+            // rather than describing what it did about it. The WARNING stays
+            // gated on applyBuiltInDefault exactly as before, so the read path's
+            // warning list is byte-identical and the write path (which passes
+            // applyBuiltInDefault: false) gains no new warning.
+            repo = null;
+            suppressed = true;
+            suppressedKind = 'provider-default-unavailable';
+            suppressedReason = `no shared vault configured for provider "${provider}"`;
+            if (applyBuiltInDefault) {
+                warnings.push(`The built-in shared vault default applies only to the gitlab provider — set ${exports.SHARED_REPO_CONFIG_KEY} explicitly to use a shared vault on this provider.`.slice(0, 200));
+            }
+        }
+    }
+    return { repo, ref, host, warnings, suppressed, suppressedKind, suppressedReason };
+}