katalyst-taxonomy-cli 2.0.1a1__py3-none-any.whl

katalyst_taxonomy_cli/commands/config.py

@@ -0,0 +1,748 @@
+"""``kata config`` — inspect and switch resolved configuration (#212, #213).
+
+There is one configuration file, ``<user config home>/config.yaml``. Every command
+here works from any directory — none needs a repository:
+
+``kata config path``
+    The active home (its name, which rule chose it, and its config, state and cache
+    directories), where the config file is, and where each of the other (layered)
+    files lives.
+``kata config show``
+    The profile-resolved configuration.
+``kata config sources``
+    Which file every resolved key came from.
+``kata config profile ...``
+    List, create, change, delete and activate profiles and the backends each declares
+    (:mod:`.config_profile`).
+``kata config sync`` / ``kata config status``
+    Fetch and pin the profiles sourced from elsewhere, and report their pins
+    (:mod:`.config_sources`).
+
+The group deliberately sits at the top level (``kata config ...``, not
+``kata tax config ...``) because config resolution is what decides where ``tax``
+operates — it cannot live inside the thing it configures.
+
+Structure for follow-on issues: every subcommand is an independent
+``@config.command`` that calls a module-level ``build_*_payload`` helper and then
+renders. Adding ``explain`` (#214) means adding a command plus a payload builder —
+no restructuring, and the payload builders are importable, which is how the MCP
+``config_show`` tool stays byte-identical to the CLI.
+
+JSON shapes are the contract in
+``stack-tests/features/cli/31_kata_config_discovery.feature`` and
+``32_kata_config_profiles.feature``. Extend them additively.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import click
+from katalyst_taxonomy.config.profiles import UnknownProfileError
+from katalyst_taxonomy.config.resolution import ConfigResolver
+from katalyst_taxonomy.domain.config_context import ConfigContext
+from katalyst_taxonomy.domain.config_files import (
+    CONFIG_FILE,
+    ConfigFileSpec,
+    MergeStrategy,
+    config_file_specs,
+    spec_for,
+)
+from katalyst_taxonomy.domain.config_layers import MISSING, lookup_dotted
+from katalyst_taxonomy.services.layered_config import LayeredConfigService
+
+from ..output import ConsoleOutput, OutputPort
+
+__all__ = [
+    "build_explain_payload",
+    "build_path_payload",
+    "build_permissions_payload",
+    "build_show_payload",
+    "build_sources_payload",
+    "config",
+    "resolve_profile",
+]
+
+_FORMAT_CHOICE = click.Choice(["text", "json"])
+
+_PROFILE_OPTION = click.option(
+    "--profile",
+    "profile",
+    default=None,
+    help="Profile to resolve. Overrides KATALYST_PROFILE and spec.activeProfile.",
+)
+
+
+def resolve_profile(explicit: str | None) -> str | None:
+    """Resolve ``--profile`` for a ``kata config`` subcommand (#222 §3).
+
+    Falls back to the root group's ``kata --profile``, which is where #222 moved the
+    flag so that ``kata config`` — the command whose entire job is reporting which
+    configuration is in effect — can be asked about a profile at all. The
+    subcommand's own flag still wins, being the more specific statement.
+
+    Reads the live Click context rather than taking it as a parameter so that every
+    subcommand needs one call and none of them needs a ``@click.pass_context``.
+    """
+    if explicit is not None:
+        return explicit
+    from ..app import root_profile
+
+    ctx = click.get_current_context(silent=True)
+    return root_profile(ctx) if ctx is not None else None
+
+
+# ---------------------------------------------------------------------------
+# Composition
+# ---------------------------------------------------------------------------
+def _service() -> LayeredConfigService:
+    """Build the layered config service against the real filesystem."""
+    from katalyst_taxonomy.adapters.filesystem.config import FilesystemConfigAdapter
+
+    return LayeredConfigService(FilesystemConfigAdapter())
+
+
+def _resolver() -> ConfigResolver:
+    """Build the (read-only) config resolver against the real filesystem."""
+    from katalyst_taxonomy.config.backends import config_resolver
+
+    return config_resolver()
+
+
+def repository_root(backend: str | None = None) -> tuple[str | None, Path | None]:
+    """The repository whose copies of the layered files count, as ``(name, root)``.
+
+    Named by ``--backend``; otherwise the profile's only filesystem backend, else the
+    one the current directory is inside. With neither, ``(None, None)`` — config
+    commands work anywhere, and the files then layer the invocation directory.
+
+    Raises:
+        ValueError: If *backend* names no filesystem backend the profile reads.
+    """
+    from katalyst_taxonomy.config.targets import resolve_repository_for
+
+    if backend:
+        target = resolve_repository_for(backend, cwd=Path.cwd())
+        return target.name, target.root
+    try:
+        target = resolve_repository_for(None, cwd=Path.cwd())
+    except Exception:  # noqa: BLE001 - no single repository: the invocation directory
+        return None, None
+    return target.name, target.root
+
+
+def resolve_context(backend: str | None = None) -> ConfigContext:
+    """Resolve the config home and the repository the layered files are read from.
+
+    Never fails outside a repository: the configuration does not live in one.
+    """
+    return _service().context(explicit_path=repository_root(backend)[1])
+
+
+# ---------------------------------------------------------------------------
+# Payload builders — shared with the MCP config_show tool
+# ---------------------------------------------------------------------------
+def _optional_str(value: Path | None) -> str | None:
+    return str(value) if value is not None else None
+
+
+def build_path_payload(*, backend: str | None = None) -> dict[str, Any]:
+    """Build the ``kata config path`` payload.
+
+    Returns:
+        The active home (``home``: name, kind, root, the three directories and the
+        rule that chose it), the config file and whether it exists, the repository the command would work on (``repository``,
+        ``repoRoot`` — ``null`` when there is no single one), the working directory,
+        and a per-file table.
+    """
+    service = _service()
+    name, root = repository_root(backend)
+    ctx = service.context(explicit_path=root)
+    layers = service.layer_paths(ctx, specs=all_specs())
+
+    return {
+        "repository": name,
+        "repoRoot": _optional_str(root),
+        "repoRootFound": root is not None,
+        "workingDirectory": str(Path.cwd().resolve()),
+        "userConfigHome": str(ctx.user_config_home),
+        "home": ctx.home.to_dict() if ctx.home is not None else None,
+        "configFile": str(ctx.config_file),
+        "configExists": ctx.config_file.is_file(),
+        "files": [
+            {
+                "key": entry.key,
+                "strategy": entry.strategy.value,
+                "description": entry.description,
+                "repoPath": _optional_str(entry.repo_path),
+                "repoPresent": entry.repo_present,
+                "userPath": str(entry.user_path),
+                "userPresent": entry.user_present,
+            }
+            for entry in layers
+        ],
+    }
+
+
+def build_show_payload(
+    *,
+    backend: str | None = None,
+    file: str = CONFIG_FILE.key,
+    key: str | None = None,
+    profile: str | None = None,
+) -> dict[str, Any]:
+    """Build the ``kata config show`` payload.
+
+    For a deep-merged file the merged mapping is spread at the top level — so
+    ``$.spec.outputFormat`` addresses the resolved config directly. The config file
+    reports ``configFile``; a layered file reports its ``repoConfig``/``userConfig``
+    paths. For a ``by-name`` file the merged stream is under ``documents``. For a text
+    file it is ``text``.
+
+    For the ``KatalystConfig`` document, ``spec`` is the declared view with
+    ``activeProfile`` set to the profile actually in force. ``profile`` names it.
+
+    Args:
+        backend: The repository whose copies of the layered files count.
+        file: Which file to show. Defaults to the ``KatalystConfig`` document.
+        key: Optional dotted key to narrow to.
+        profile: Explicit profile (the ``--profile`` flag).
+
+    Raises:
+        ValueError: If *file* is not a layered config file, or the configuration
+            is malformed.
+        UnknownProfileError: If the profile cannot be selected.
+    """
+    spec = spec_for(file, all_specs())
+    service = _service()
+    ctx = resolve_context(backend)
+
+    payload: dict[str, Any]
+    if spec.strategy is MergeStrategy.BY_NAME:
+        named = service.resolve_named(spec, ctx)
+        payload = {"documents": [dict(doc) for doc in named.documents]}
+        repo_path, user_path = named.repo_path, named.user_path
+    elif spec.strategy is MergeStrategy.CONCATENATE:
+        text = service.resolve_text(spec, ctx)
+        payload = {"text": text.text, "origins": list(text.origins)}
+        repo_path, user_path = text.repo_path, text.user_path
+    else:
+        merged = service.resolve_mapping(spec, ctx)
+        payload = dict(merged.data)
+        repo_path, user_path = merged.repo_path, merged.user_path
+        if spec.key == CONFIG_FILE.key:
+            # Inspecting an incomplete configuration must still show it — this is the
+            # command someone runs to find out what is missing. So a document that
+            # does not resolve yet reports why, instead of failing.
+            from katalyst_taxonomy.config.resolution import NoBackendConfiguredError
+
+            try:
+                payload.update(_resolver().resolve(ctx=ctx, profile=profile).profile_view())
+                payload["configured"] = True
+            except NoBackendConfiguredError as exc:
+                payload["configured"] = False
+                payload["reason"] = str(exc)
+            # Literal credentials are never shown; `${VAR}` references are, as written.
+            from katalyst_taxonomy.config.remote import redact_config_document
+
+            payload = redact_config_document(payload)
+        if key is not None:
+            value = lookup_dotted(payload, key)
+            payload = {
+                "key": key,
+                "value": None if value is MISSING else value,
+                "present": value is not MISSING,
+            }
+
+    payload["file"] = spec.key
+    payload.update(_file_paths(spec, ctx, repo_path, user_path))
+    return payload
+
+
+def _file_paths(
+    spec: ConfigFileSpec,
+    ctx: ConfigContext,
+    repo_path: Path | None,
+    user_path: Path | None,
+) -> dict[str, Any]:
+    """Where *spec* was read from: ``configFile`` for config.yaml, both layers otherwise."""
+    if spec.key == CONFIG_FILE.key:
+        return {"configFile": str(ctx.config_file), "configExists": user_path is not None}
+    return {"repoConfig": _optional_str(repo_path), "userConfig": _optional_str(user_path)}
+
+
+def build_explain_payload(
+    address: str,
+    *,
+    profile: str | None = None,
+) -> dict[str, Any]:
+    """Build the ``kata config explain`` payload (#214).
+
+    Delegates wholesale to
+    :func:`katalyst_taxonomy.services.routing_explain.explain_payload` rather than
+    assembling anything here, which is what lets the MCP ``config_explain`` tool
+    be byte-identical without ``mcp/`` importing ``cli/``.
+
+    Raises:
+        UnknownBackendError: If a named backend is undeclared.
+        UnknownProfileError: If the profile cannot be selected.
+        ValueError: If the configuration is malformed.
+    """
+    from katalyst_taxonomy.services.routing_explain import explain_payload
+
+    return explain_payload(address, base_path=Path.cwd(), profile=profile)
+
+
+def build_permissions_payload(
+    *,
+    fqtn: str | None = None,
+    operation: str | None = None,
+    profile: str | None = None,
+) -> dict[str, Any]:
+    """Build the ``kata config permissions`` payload (#216).
+
+    Fail-closed resolution that cannot explain itself is undebuggable, and
+    most-specific-wins-then-deny-wins is not something anyone should have to
+    simulate in their head. This reports the *effective* access for the active
+    profile and **which grant produced it**, plus every declared grant with the file
+    that declared it.
+
+    Delegates the whole computation to
+    :meth:`katalyst_taxonomy.config.permissions.PermissionPolicy.report`, so the
+    report is produced by the same object the port gate enforces with. An
+    explanation resolved by a second code path is not an explanation.
+
+    Args:
+        fqtn: Optional target FQTN. Omitted, the report is store-wide.
+        operation: Optional ``r``/``w``/``x`` (or ``read``/``write``/``execute``) to
+            report a single bit's verdict under ``allowed``.
+        profile: Explicit profile (the ``--profile`` flag).
+
+    Raises:
+        ValueError: If *operation* is not a recognized operation.
+        UnknownProfileError: If the profile cannot be selected.
+    """
+    from katalyst_taxonomy.config.backends import load_permission_policy
+
+    policy = load_permission_policy(None, profile=profile)
+    from katalyst_taxonomy.services.permissions import report_target
+
+    target = report_target(None, fqtn or "", profile=profile)
+    payload = policy.report(target)
+    if operation is not None:
+        resolved = _operation(operation)
+        payload["operation"] = str(resolved)
+        payload["allowed"] = policy.allows(resolved, target)
+    return payload
+
+
+def _operation(value: str):  # noqa: ANN202 - Operation, imported lazily
+    """Parse the ``--op`` flag, accepting a single bit or the full word.
+
+    Raises:
+        ValueError: If *value* names no operation.
+    """
+    from katalyst_taxonomy.domain.permissions import Operation
+
+    aliases = {"r": Operation.READ, "w": Operation.WRITE, "x": Operation.EXECUTE}
+    lowered = value.strip().lower()
+    if lowered in aliases:
+        return aliases[lowered]
+    for operation in Operation:
+        if lowered == str(operation):
+            return operation
+    valid = ", ".join(f"{op.value} ({op.value[0]})" for op in Operation)
+    msg = f"Unknown operation {value!r}. Expected one of: {valid}."
+    raise ValueError(msg)
+
+
+def build_sources_payload(
+    *,
+    backend: str | None = None,
+    file: str = CONFIG_FILE.key,
+) -> dict[str, Any]:
+    """Build the ``kata config sources`` payload.
+
+    ``sources`` maps every resolved dotted key to the absolute path of the file
+    that set it — for config.yaml, always the one config file. ``layers`` lists the
+    participating files strongest-first with their numeric priority.
+    """
+    spec = spec_for(file, all_specs())
+    service = _service()
+    ctx = resolve_context(backend)
+
+    if spec.strategy is MergeStrategy.BY_NAME:
+        named = service.resolve_named(spec, ctx)
+        provenance = named.provenance
+        presence = named.layers
+    elif spec.strategy is MergeStrategy.CONCATENATE:
+        text = service.resolve_text(spec, ctx)
+        provenance = {f"{index}": origin for index, origin in enumerate(text.origins)}
+        presence = text.layers
+    else:
+        merged = service.resolve_mapping(spec, ctx)
+        provenance = merged.provenance
+        presence = merged.layers
+
+    return {
+        "file": spec.key,
+        "repoRoot": str(ctx.repo_root),
+        "userConfigHome": str(ctx.user_config_home),
+        "sources": dict(sorted(provenance.items())),
+        "layers": [
+            {
+                "layer": entry.layer.label,
+                "priority": entry.layer.priority,
+                "path": _optional_str(entry.path),
+                "present": entry.present,
+            }
+            for entry in presence
+        ],
+    }
+
+
+# ---------------------------------------------------------------------------
+# Command group
+# ---------------------------------------------------------------------------
+@click.group("config")
+@click.pass_context
+def config(ctx: click.Context) -> None:
+    """Inspect and edit the Katalyst configuration.
+
+    There is one configuration file, config.yaml in the active home (kata --home or
+    KATALYST_HOME: 'default', a name under ~/.katalyst/homes, or an absolute path; see
+    'kata config home'). Each profile in it declares
+    the backends it reads; a repository is a filesystem backend of a profile. Select a
+    profile with --profile or KATALYST_PROFILE; change them with 'kata config profile'.
+    """
+    # A development install needs a home chosen (Q1), except to manage homes.
+    if ctx.invoked_subcommand != "home":
+        from ..install import refuse_default_home_for_development
+
+        refuse_default_home_for_development()
+
+
+def _output() -> OutputPort:
+    return ConsoleOutput()
+
+
+def _fail(message: str) -> None:
+    raise click.ClickException(message)
+
+
+_ORIGIN_LABELS = {"flag": "--home", "env": "KATALYST_HOME", "default": "no home selected"}
+
+
+def _home_label(home: dict[str, Any]) -> str:
+    """``dev (~/.katalyst/homes/dev)``, a path home's path, or ``default``."""
+    name = str(home.get("name") or "default")
+    if home.get("kind") == "named" and home.get("root"):
+        return f"{name} ({home['root']})"
+    return name
+
+
+@config.command("path")
+@click.option(
+    "--backend",
+    default=None,
+    help="Repository (filesystem backend) whose copies of the layered files count.",
+)
+@click.option("--format", "fmt", type=_FORMAT_CHOICE, default="text")
+def config_path(backend: str | None, fmt: str) -> None:
+    """Show where the config file is, and which repository a command would work on."""
+    out = _output()
+    try:
+        payload = build_path_payload(backend=backend)
+    except ValueError as exc:
+        _fail(str(exc))
+        return
+
+    if fmt == "json":
+        out.json_out(payload)
+        return
+
+    home: dict[str, Any] = payload["home"] or {}
+    out.key_value(
+        [
+            ("home", f"{_home_label(home)}  ({_ORIGIN_LABELS.get(str(home.get('origin')), '-')})"),
+            (
+                "config file",
+                payload["configFile"] + ("" if payload["configExists"] else "  (missing)"),
+            ),
+            ("config dir", payload["userConfigHome"]),
+            ("state dir", str(home.get("stateDir") or "-")),
+            ("cache dir", str(home.get("cacheDir") or "-")),
+            (
+                "repository",
+                f"{payload['repository']}  ({payload['repoRoot']})"
+                if payload["repoRootFound"]
+                else "(none — pass --backend NAME)",
+            ),
+        ]
+    )
+    out.heading("Layered files")
+    out.table(
+        ["file", "strategy", "repository", "user"],
+        [
+            [
+                entry["key"],
+                entry["strategy"],
+                entry["repoPath"] if entry["repoPresent"] else "-",
+                entry["userPath"] if entry["userPresent"] else "-",
+            ]
+            for entry in payload["files"]
+        ],
+    )
+
+
+@config.command("show")
+@click.option(
+    "--backend",
+    default=None,
+    help="Repository (filesystem backend) whose copies of the layered files count.",
+)
+@click.option("--file", "file_key", default=CONFIG_FILE.key, help="Layered file to show.")
+@click.option("--key", default=None, help="Dotted key to narrow to, e.g. spec.outputFormat.")
+@_PROFILE_OPTION
+@click.option("--format", "fmt", type=_FORMAT_CHOICE, default="text")
+def config_show(
+    backend: str | None,
+    file_key: str,
+    key: str | None,
+    profile: str | None,
+    fmt: str,
+) -> None:
+    """Show the profile-resolved configuration."""
+    out = _output()
+    try:
+        payload = build_show_payload(
+            backend=backend,
+            file=file_key,
+            key=key,
+            profile=resolve_profile(profile),
+        )
+    except (UnknownProfileError, ValueError) as exc:
+        _fail(str(exc))
+        return
+
+    if fmt == "json":
+        out.json_out(payload)
+        return
+
+    import yaml
+
+    out.echo(yaml.safe_dump(payload, sort_keys=False, default_flow_style=False).rstrip())
+
+
+@config.command("sources")
+@click.option(
+    "--backend",
+    default=None,
+    help="Repository (filesystem backend) whose copies of the layered files count.",
+)
+@click.option("--file", "file_key", default=CONFIG_FILE.key, help="Layered file to inspect.")
+@click.option("--format", "fmt", type=_FORMAT_CHOICE, default="text")
+def config_sources(backend: str | None, file_key: str, fmt: str) -> None:
+    """Show which file each resolved key came from, in precedence order."""
+    out = _output()
+    try:
+        payload = build_sources_payload(backend=backend, file=file_key)
+    except ValueError as exc:
+        _fail(str(exc))
+        return
+
+    if fmt == "json":
+        out.json_out(payload)
+        return
+
+    sources: dict[str, str] = payload["sources"]
+    if not sources:
+        out.info(f"No configuration resolved for {payload['file']!r}.")
+    else:
+        out.table(["key", "source"], [[key, value] for key, value in sources.items()])
+
+    out.heading("Layers (strongest first)")
+    out.table(
+        ["layer", "priority", "path", "present"],
+        [
+            [
+                entry["layer"],
+                str(entry["priority"]),
+                entry["path"] or "-",
+                "yes" if entry["present"] else "no",
+            ]
+            for entry in payload["layers"]
+        ],
+    )
+
+
+def all_specs() -> tuple[ConfigFileSpec, ...]:
+    """Every layered config file: the runtime's own and each installed plugin's."""
+    from katalyst_taxonomy.plugins.loader import plugin_context
+
+    return config_file_specs(plugin_context().config_files)
+
+
+# ---------------------------------------------------------------------------
+# Addressing
+# ---------------------------------------------------------------------------
+@config.command("explain")
+@click.argument("address")
+@_PROFILE_OPTION
+@click.option("--format", "fmt", type=_FORMAT_CHOICE, default="text")
+def config_explain(address: str, profile: str | None, fmt: str) -> None:
+    """Explain what ADDRESS names, and whether it is there.
+
+    ADDRESS may carry a ``#kind`` selector — ``filesystem:payments.backend#stack`` — for a
+    path two kinds both claim; without one, such a path fails naming the selectors.
+
+    ADDRESS is ``backend:fqtn``. Reports whether that backend is one the profile reads,
+    and whether it holds a node there and of what kind. An unprefixed address is refused
+    with the backends that do hold the name.
+
+    Pure resolution — it reads the repository's own documents to learn each node's
+    kind and wing, and never opens a connection to a remote store. An unknown
+    backend name fails and lists the declared ones; it is never a silent fallback.
+    """
+    out = _output()
+    try:
+        payload = build_explain_payload(address, profile=resolve_profile(profile))
+    except (UnknownProfileError, ValueError) as exc:
+        _fail(str(exc))
+        return
+
+    if fmt == "json":
+        out.json_out(payload)
+        return
+
+    out.key_value(
+        [
+            ("address", payload["address"]),
+            ("backend", payload["backend"]),
+            ("fqtn", payload["fqtn"]),
+            ("exists", "yes" if payload["exists"] else "no"),
+            ("kind", payload["kind"] or "(unknown)"),
+            ("tier", payload["tier"]),
+            ("profile reads", ", ".join(payload["backends"]) or "-"),
+            ("profile", payload["profile"] or "(none)"),
+        ]
+    )
+
+
+# ---------------------------------------------------------------------------
+# Permissions (#216)
+# ---------------------------------------------------------------------------
+@config.command("permissions")
+@click.option("--fqtn", default=None, help="Target FQTN. Omitted, the report is store-wide.")
+@click.option("--op", "operation", default=None, help="Operation to check: r, w, x.")
+@_PROFILE_OPTION
+@click.option("--format", "fmt", type=_FORMAT_CHOICE, default="text")
+def config_permissions(
+    fqtn: str | None,
+    operation: str | None,
+    profile: str | None,
+    fmt: str,
+) -> None:
+    """Report the effective access for a target, and which backend grant decided.
+
+    Rules live on backends: the target's backend's grants decide, in every profile.
+    Resolution is most-specific-wins — any ``fqtn`` match outranks a ``kind`` or
+    ``wing`` match, and more literal dot-segments outrank fewer — with the more
+    restrictive grant winning at equal specificity. An unmatched target falls
+    through to the backend's ``permissions.default``, and a ``permissions`` block that
+    declares no ``default`` denies.
+
+    A backend with no ``permissions`` block reports ``rwx`` from no grant
+    (``decidedBy: unrestricted``): that is the back-compat guarantee, not an omission.
+    """
+    out = _output()
+    try:
+        payload = build_permissions_payload(
+            fqtn=fqtn,
+            operation=operation,
+            profile=resolve_profile(profile),
+        )
+    except (UnknownProfileError, ValueError) as exc:
+        _fail(str(exc))
+        return
+
+    if fmt == "json":
+        out.json_out(payload)
+        return
+
+    rows = [
+        ("profile", payload["profile"] or "(none)"),
+        ("fqtn", payload["fqtn"] or "(store-wide)"),
+        ("backend", payload["backend"] or "-"),
+        ("access", payload["access"]),
+        ("decided by", payload["decidedBy"]),
+        ("grant", payload["grant"] or "-"),
+        ("default", payload["default"] or "(none declared)"),
+        ("source", payload["source"] or "-"),
+    ]
+    if "operation" in payload:
+        rows.append((payload["operation"], "allowed" if payload["allowed"] else "DENIED"))
+    out.key_value(rows)
+
+    backends: list[dict[str, Any]] = payload["backendRules"]
+    if not backends:
+        out.info("No backend declares permission rules; every writable backend is rwx.")
+        return
+    out.heading("Backend grants")
+    out.table(
+        ["backend", "grant", "access", "match", "source"],
+        [
+            [
+                rules["backend"],
+                entry["name"] or "-",
+                entry["access"],
+                ", ".join(f"{key}={value}" for key, value in entry["match"].items()) or "*",
+                entry["source"] or "-",
+            ]
+            for rules in backends
+            for entry in rules["grants"]
+        ]
+        + [
+            [rules["backend"], "(default)", rules["default"], "*", rules["source"] or "-"]
+            for rules in backends
+            if rules["default"] is not None
+        ],
+    )
+
+
+# ---------------------------------------------------------------------------
+# Subcommands contributed by sibling modules
+# ---------------------------------------------------------------------------
+# `schemas` lives in its own module so that the command's name and payload
+# builder stay in one place (see #218). Attaching here, at import time, keeps
+# `kata config` the single discovery point for every subcommand.
+from .config_schemas import attach as _attach_schemas  # noqa: E402
+
+_attach_schemas(config)
+
+from .config_plugins import attach as _attach_plugins  # noqa: E402
+
+_attach_plugins(config)
+
+# `filter` (#217) follows the same pattern: its own module, one line here. It
+# reports whether a node is visible under the active profile's include/exclude
+# clauses and which clause decided.
+from .config_filters import attach as _attach_filters  # noqa: E402
+
+_attach_filters(config)
+
+# `profile` — creating and changing profiles and their backends.
+from .config_profile import attach as _attach_profile  # noqa: E402
+
+_attach_profile(config)
+
+# `sync` and `status` — profiles sourced from elsewhere, fetched and pinned.
+from .config_sources import attach as _attach_sources  # noqa: E402
+
+_attach_sources(config)
+
+# `home` — the named homes `kata --home` selects (#257).
+from .config_home import attach as _attach_home  # noqa: E402
+
+_attach_home(config)