# Accessor Registry - Maps config paths to getters
# This eliminates 80+ duplicate getter function definitions
# Pattern: { name: { path: "config.path", default: default_value } }

export def build-accessor-registry [] {
    {
        # Core configuration accessors
        paths: { path: "paths", default: {} }
        debug: { path: "debug", default: {} }
        sops: { path: "sops", default: {} }
        validation: { path: "validation", default: {} }
        output: { path: "output", default: {} }

        # Provisioning core settings
        provisioning-name: { path: "core.name", default: "provisioning" }
        provisioning-vers: { path: "core.version", default: "2.0.0" }
        provisioning-url: { path: "core.url", default: "https://provisioning.systems" }

        # Debug settings
        debug-enabled: { path: "debug.enabled", default: false }
        no-terminal: { path: "debug.no_terminal", default: false }
        debug-check-enabled: { path: "debug.check", default: false }
        metadata-enabled: { path: "debug.metadata", default: false }
        debug-remote-enabled: { path: "debug.remote", default: false }
        ssh-debug-enabled: { path: "debug.ssh", default: false }
        provisioning-log-level: { path: "debug.log_level", default: "" }
        debug-match-cmd: { path: "debug.match_cmd", default: "" }

        # Output configuration
        work-format: { path: "output.format", default: "yaml" }
        file-viewer: { path: "output.file_viewer", default: "bat" }
        match-date: { path: "output.match_date", default: "%Y_%m_%d" }

        # Paths configuration
        workspace-path: { path: "paths.workspace", default: "" }
        providers-path: { path: "paths.providers", default: "" }
        taskservs-path: { path: "paths.taskservs", default: "" }
        clusters-path: { path: "paths.clusters", default: "" }
        templates-path: { path: "paths.templates", default: "" }
        tools-path: { path: "paths.tools", default: "" }
        extensions-path: { path: "paths.extensions", default: "" }
        infra-path: { path: "paths.infra", default: "" }
        generate-dirpath: { path: "paths.generate", default: "generate" }
        custom-providers-path: { path: "paths.custom_providers", default: "" }
        custom-taskservs-path: { path: "paths.custom_taskservs", default: "" }
        run-taskservs-path: { path: "paths.run_taskservs", default: "taskservs" }
        run-clusters-path: { path: "paths.run_clusters", default: "clusters" }

        # Path files
        defs-file: { path: "paths.files.defs", default: "defs.nu" }
        req-versions: { path: "paths.files.req_versions", default: "" }
        vars-file: { path: "paths.files.vars", default: "" }
        notify-icon: { path: "paths.files.notify_icon", default: "" }
        settings-file: { path: "paths.files.settings", default: "settings.ncl" }
        keys-file: { path: "paths.files.keys", default: ".keys.ncl" }

        # SOPS configuration
        sops-key-paths: { path: "sops.key_search_paths", default: [] }
        sops-use-sops: { path: "sops.use_sops", default: "age" }
        sops-use-kms: { path: "sops.use_kms", default: "" }
        secret-provider: { path: "sops.secret_provider", default: "sops" }

        # SSH configuration
        ssh-options: { path: "ssh.options", default: [] }
        ssh-user: { path: "ssh.user", default: "" }

        # Tools configuration
        use-nickel: { path: "tools.use_nickel", default: false }
        use-nickel-plugin: { path: "tools.use_nickel_plugin", default: false }

        # Extensions configuration
        extension-mode: { path: "extensions.mode", default: "full" }
        provisioning-profile: { path: "extensions.profile", default: "" }
        allowed-extensions: { path: "extensions.allowed", default: "" }
        blocked-extensions: { path: "extensions.blocked", default: "" }

        # AI configuration
        ai-enabled: { path: "ai.enabled", default: false }
        ai-provider: { path: "ai.provider", default: "openai" }

        # KMS Core Settings
        kms-enabled: { path: "kms.enabled", default: false }
        kms-mode: { path: "kms.mode", default: "local" }
        kms-version: { path: "kms.version", default: "1.0.0" }
        kms-server: { path: "kms.server", default: "" }
        kms-auth-method: { path: "kms.auth_method", default: "certificate" }
        kms-client-cert: { path: "kms.client_cert", default: "" }
        kms-client-key: { path: "kms.client_key", default: "" }
        kms-ca-cert: { path: "kms.ca_cert", default: "" }
        kms-api-token: { path: "kms.api_token", default: "" }
        kms-username: { path: "kms.username", default: "" }
        kms-password: { path: "kms.password", default: "" }
        kms-timeout: { path: "kms.timeout", default: "30" }
        kms-verify-ssl: { path: "kms.verify_ssl", default: "true" }

        # KMS Paths
        kms-base-path: { path: "kms.paths.base", default: "{{workspace.path}}/.kms" }
        kms-keys-dir: { path: "kms.paths.keys_dir", default: "{{kms.paths.base}}/keys" }
        kms-cache-dir: { path: "kms.paths.cache_dir", default: "{{kms.paths.base}}/cache" }
        kms-config-dir: { path: "kms.paths.config_dir", default: "{{kms.paths.base}}/config" }

        # KMS Local Settings
        kms-local-enabled: { path: "kms.local.enabled", default: true }
        kms-local-provider: { path: "kms.local.provider", default: "age" }
        kms-local-key-path: { path: "kms.local.key_path", default: "{{kms.paths.keys_dir}}/age.txt" }
        kms-local-sops-config: { path: "kms.local.sops_config", default: "{{workspace.path}}/.sops.yaml" }

        # KMS Age Settings
        kms-age-generate-on-init: { path: "kms.local.age.generate_key_on_init", default: false }
        kms-age-key-format: { path: "kms.local.age.key_format", default: "age" }
        kms-age-key-permissions: { path: "kms.local.age.key_permissions", default: "0600" }

        # KMS SOPS Settings
        kms-sops-config-path: { path: "kms.local.sops.config_path", default: "{{workspace.path}}/.sops.yaml" }
        kms-sops-age-recipients: { path: "kms.local.sops.age_recipients", default: [] }

        # KMS Vault Settings
        kms-vault-address: { path: "kms.local.vault.address", default: "http://127.0.0.1:8200" }
        kms-vault-token-path: { path: "kms.local.vault.token_path", default: "{{kms.paths.config_dir}}/vault-token" }
        kms-vault-transit-path: { path: "kms.local.vault.transit_path", default: "transit" }
        kms-vault-key-name: { path: "kms.local.vault.key_name", default: "provisioning" }

        # KMS Remote Settings
        kms-remote-enabled: { path: "kms.remote.enabled", default: false }
        kms-remote-endpoint: { path: "kms.remote.endpoint", default: "" }
        kms-remote-api-version: { path: "kms.remote.api_version", default: "v1" }
        kms-remote-timeout: { path: "kms.remote.timeout_seconds", default: 30 }
        kms-remote-retry-attempts: { path: "kms.remote.retry_attempts", default: 3 }
        kms-remote-retry-delay: { path: "kms.remote.retry_delay_seconds", default: 2 }

        # KMS Remote Auth
        kms-remote-auth-method: { path: "kms.remote.auth.method", default: "token" }
        kms-remote-token-path: { path: "kms.remote.auth.token_path", default: "{{kms.paths.config_dir}}/token" }
        kms-remote-refresh-token: { path: "kms.remote.auth.refresh_token", default: true }
        kms-remote-token-expiry: { path: "kms.remote.auth.token_expiry_seconds", default: 3600 }

        # KMS Remote TLS
        kms-remote-tls-enabled: { path: "kms.remote.tls.enabled", default: true }
        kms-remote-tls-verify: { path: "kms.remote.tls.verify", default: true }
        kms-remote-ca-cert-path: { path: "kms.remote.tls.ca_cert_path", default: "" }
        kms-remote-client-cert-path: { path: "kms.remote.tls.client_cert_path", default: "" }
        kms-remote-client-key-path: { path: "kms.remote.tls.client_key_path", default: "" }
        kms-remote-tls-min-version: { path: "kms.remote.tls.min_version", default: "1.3" }

        # KMS Remote Cache
        kms-remote-cache-enabled: { path: "kms.remote.cache.enabled", default: true }
        kms-remote-cache-ttl: { path: "kms.remote.cache.ttl_seconds", default: 300 }
        kms-remote-cache-max-size: { path: "kms.remote.cache.max_size_mb", default: 50 }

        # KMS Hybrid Mode
        kms-hybrid-enabled: { path: "kms.hybrid.enabled", default: false }
        kms-hybrid-fallback-to-local: { path: "kms.hybrid.fallback_to_local", default: true }
        kms-hybrid-sync-keys: { path: "kms.hybrid.sync_keys", default: false }

        # KMS Policies
        kms-auto-rotate: { path: "kms.policies.auto_rotate", default: false }
        kms-rotation-days: { path: "kms.policies.rotation_days", default: 90 }
        kms-backup-enabled: { path: "kms.policies.backup_enabled", default: true }
        kms-backup-path: { path: "kms.policies.backup_path", default: "{{kms.paths.base}}/backups" }
        kms-audit-log-enabled: { path: "kms.policies.audit_log_enabled", default: false }
        kms-audit-log-path: { path: "kms.policies.audit_log_path", default: "{{kms.paths.base}}/audit.log" }

        # KMS Encryption
        kms-encryption-algorithm: { path: "kms.encryption.algorithm", default: "ChaCha20-Poly1305" }
        kms-key-derivation: { path: "kms.encryption.key_derivation", default: "scrypt" }

        # KMS Security
        kms-enforce-key-permissions: { path: "kms.security.enforce_key_permissions", default: true }
        kms-disallow-plaintext-secrets: { path: "kms.security.disallow_plaintext_secrets", default: true }
        kms-secret-scanning-enabled: { path: "kms.security.secret_scanning_enabled", default: false }
        kms-min-key-size-bits: { path: "kms.security.min_key_size_bits", default: 256 }

        # KMS Operations
        kms-verbose: { path: "kms.operations.verbose", default: false }
        kms-debug: { path: "kms.operations.debug", default: false }
        kms-dry-run: { path: "kms.operations.dry_run", default: false }
        kms-max-file-size-mb: { path: "kms.operations.max_file_size_mb", default: 100 }

        # Provider settings
        default-provider: { path: "providers.default", default: "local" }
    }
}

# Get value using registry lookup
export def get-by-registry [name: string, config: record] {
    let registry = (build-accessor-registry)

    if not ($name in ($registry | columns)) {
        error make { msg: $"Unknown accessor: ($name)" }
    }

    let accessor_def = ($registry | get $name)

    let config_data = if ($config | is-empty) {
        {}
    } else {
        $config
    }

    # Import and use get-config-value from loader module
    use loader.nu get-config-value
    get-config-value $config_data $accessor_def.path $accessor_def.default
}