/*
 * Copyright: 2026 Contrast Security, Inc
 * Contact: support@contrastsecurity.com
 * License: Commercial

 * NOTICE: This Software and the patented inventions embodied within may only be
 * used as part of Contrast Security’s commercial offerings. Even though it is
 * made available through public repositories, use of this Software is subject to
 * the applicable End User Licensing Agreement found at
 * https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed
 * between Contrast Security and the End User. The Software may not be reverse
 * engineered, modified, repackaged, sold, redistributed or otherwise used in a
 * way not consistent with the End User License Agreement.
 */

import { ProtectRuleMode, Rule } from '@contrast/common';
export { ConfigSource } from './common';

export interface EffectiveEntry<T> {
  canonical_name: string;
  name: string;
  value: T;
  source: string;
}

export type Level =
  | 'error'
  | 'warn'
  | 'info'
  | 'debug'
  | 'trace';

export type SyslogLevel =
  | 'alert'
  | 'critical'
  | 'error'
  | 'warning'
  | 'notice'
  | 'info'
  | 'debug';

export interface ConfigOption<T = any> {
  name: string;
  desc: string;
  arg: string;
  env?: string;
  enum?: T[];
  default?: T;
  fn?: (arg: any, cfg: Config, source: string) => T;
}

export interface Config {
  _filepaths: string[];
  _effectiveMap: Map<string, EffectiveEntry<any>>;
  _errors: Error[];
  _status: string,
  _logs: {
    level: import('pino').LevelWithSilentOrString;
    obj?: any;
    msg: string;
    args?: any[];
  }[];

  installation_tool: string;
  preinstrument: boolean,

  api: {
    /** Default: `true` */
    enable: boolean;
    /** Default: `'https://app.contrastsecurity.com/Contrast'` */
    url: string;
    /** No default value but required when `api.enable` is `true` */
    api_key: string;
    /** No default value but required when `api.enable` is `true` */
    service_key: string;
    /** No default value but required when `api.enable` is `true` */
    user_name: string;

    certificate: {
      /** If set to `false`, the agent will ignore the certificate configuration in this section. Default: `true` */
      enable: boolean;
      /** Set the absolute or relative path to a CA for communication with the Contrast UI using a self-signed certificate. */
      ca_file?: string;
      /** Set the absolute or relative path to the Certificate PEM file for communication with the Contrast UI. */
      cert_file?: string;
      /** Set the absolute or relative path to the Key PEM file for communication with the Contrast UI. */
      key_file?: string;
      /** When set to `true`, the agent ignores certificate verification errors when the agent communicates with the Contrast UI. Default: `false` */
      ignore_cert_errors: boolean;
    };

    proxy: {
      /** Default: `false` */
      enable: boolean;
      /** No default value but required when `api.proxy.enable` is `true` */
      url: string;
    };
  };

  agent: {
    /**
     * Limit for stack trace size (larger limits will improve accuracy but
     * increase memory usage). Default: `10`
     */
    stack_trace_limit: number;

    /**
     * List of patterns to ignore within stack traces.
     * Default: `['agent-', '@contrast', 'node-agent']
     */
    stack_trace_filters: string[];

    diagnostics: {
      /** Default: `true` */
      enable: boolean;
      /** Default: `false` */
      quiet: boolean
      report_path?: string;
    };

    route_coverage: {
      /** Default: `true` */
      enable: boolean;
    };

    reporters: {
      /** Path indicating where to report all agent findings. */
      file?: string | number;
    };

    polling: {
      /** Default: `30000` */
      app_activity_ms: number;
      /** Default: `30000` */
      app_settings_ms: number;
      /** Default: `30000` */
      app_update_ms: number;
      /** Default: `30000` */
      server_settings_ms: number;
    };

    logger: {
      /** Default: `'./contrast.log'` */
      path: string;

      /**
       * Minimum log level. 'silent' disables logging entirely.
       * Default: `'info'`
       */
      level: LevelWithSilent;

      /**
       * When false, create a new log file on startup instead of appending and
       * rolling daily. Default: `true`
       */
      append: boolean;

      /** Suppress output when `false`. Default: `true` */
      stdout: boolean;
    };

    security_logger: {
      /** Default: `'./security.log'` */
      path: string;
      /** Default: `'error'` */
      level: Level;
      /** Default: `false` */
      stdout: boolean;
      syslog: {
        /** Default: `false` */
        enable: boolean;
        /** Default: `'127.0.0.1'` */
        ip: string;
        /** Default: `514` */
        port: number;

        /**
         * The facility code of the messages the agent sends to Syslog.
         * Values: 0-23, inclusive.
         * Default: `19`
         */
        facility: number;

        /** Log level of 'Exploited' attacks. Default: `'alert'` */
        severity_exploited: SyslogLevel;
        /** Log level of 'Blocked' attacks. Default: `'notice'` */
        severity_blocked: SyslogLevel;
        /** Log level of 'Blocked at Perimeter' attacks. Default: `'notice'` */
        severity_blocked_perimeter: SyslogLevel;
        /** Log level of 'Probed' attacks. Default: `'warning'` */
        severity_probed: SyslogLevel;
        /** Log level of suspcious but not blocked attacks. Default: `'warning'` */
        severity_suspicious: SyslogLevel;
      };
    };

    node: {
      /** Location to look for the app's package.json. Default: `process.cwd()` */
      app_root: string;
      rewrite: {
        /** Default: `true` */
        enable: boolean;
        cache: {
          /** Default: `true` */
          enable: boolean;
          /** Default: `./.contrast` */
          path: string;
        }
        /** Default: `true` */
        minify: boolean;
      };
      source_maps: {
        /** Default: `true` */
        enable: boolean;
        /** Default: `false` */
        inline: boolean;
      };
      library_usage: {
        reporting: {
          /** Default: `true` */
          enable: boolean;
          /** Default: `100` */
          interval_ms: number;
        };
      };
      metrics: {
        /** Default: `true` */
        enable: boolean;
        /** 'Set the response duration (in milliseconds) after which we will warn that a request has been hanging.' Default: `5000` */
        warn_ms: number;
      };
      /** Set the full path of the npm executable, used for library analysis. Default: `'npm'` */
      npm_path: string;
    };
  };

  entitlements: {
    assess: {
      /** Default: `true` */
      allow: boolean
    },
    inventory: {
      /** Default: `true` */
      allow: boolean,
      /** Default: `true` */
      allow_sca: boolean
    },
    observe: {
      /** Default: `true` */
      allow: boolean
    },
    profile: {
      /** Default: `true` */
      allow: boolean
    },
    protect: {
      /** Default: `true` */
      allow: boolean,
      /** Default: `true` */
      allow_block: boolean
    },
    shield: {
      /** Default: `true` */
      allow: boolean,
      /** Default: `true` */
      allow_block: boolean
    },

  },

  inventory: {
    /** Default: `true` */
    analyze_libraries: boolean;
    gather_metadata_via: 'AWS' | 'Azure' | 'GCP' | undefined;
  };

  assess: {
    /** Default: `false` */
    enable: boolean;
    tags?: string;
    /** Default: `'ALL'` */
    stacktraces: string;
    /** Default: `150` */
    max_context_source_events: number;
    /** Default: `500` */
    max_propagation_events: number;

    safe_positives: {
      /** Default: `false` */
      enable: boolean;
    };

    /** Defualt: `false` */
    trust_custom_validators: boolean;

    // effective based on local config and 'assess.sampling' TS DTM
    probabilistic_sampling: {
      /** Defualt: `false` */
      enable: boolean,
      route_monitor: {
        /** Defualt: `3600000` */
        ttl_ms: number,
      }
    }
  };

  protect: {
    /** Default: `false` */
    enable: boolean;

    probe_analysis: {
      /** Default: `true` */
      enable: boolean;
    }

    rules: {
      /**
       * List of rule ids to disable.
       * Default: `[]`
       */
      disabled_rules: string[];
    } & Record<Omit<Rule, Rule.BOT_BLOCKER | Rule.IP_DENYLIST | Rule.VIRTUAL_PATCH>, { mode: ProtectRuleMode }>;
  };

  observe: {
    crypto_usage: {
      /** Default: `false` */
      enable: boolean;
      /** Default: `60_000` */
      periodic_export_interval_ms: number;

      crypto_usage: {
        /** Default: `false` */
        enable: boolean;
      }
    }
  }

  profile: {
    /** Default: `true` */
    enable: boolean;
  }

  application: {
    /** Override the reported application name. */
    name?: string;
    /** Override the reported application path. Default: `'/'` */
    path: string;
    /** Add the name of the application group with which this application should be associated in the Contrast UI. */
    group?: string;
    /** Add the application code this application should use in the Contrast UI. */
    code?: string;
    /** Override the reported application version. */
    version?: string;
    /** Apply labels to an application. Labels must be formatted as a comma-delimited list. Example - `label1,label2,label3` */
    tags?: string;
    /** Comma-separated list of key=value pairs that are applied to each application reported by the agent. */
    metadata?: string;
    /** Provide the ID of a session existing within Contrast UI. Exclusive with `session_metadata` */
    session_id?: string;
    /** Provide metadata used to create a new session within Contrast UI. Exclusive with `session_id` */
    session_metadata?: string;
    sensitive_data_masking_policy: {
      /** Set to `true` to mask the entire HTTP body. Default: `false` */
      mask_http_body: boolean;
    };
  };

  /** Reported server information overrides */
  server: {
    /** Default: `os.hostname()` */
    name: string;
    environment?: 'QA' | 'PRODUCTION' | 'DEVELOPMENT';
    tags?: string;
    version?: string;
    /** Default: `true` */
    discover_cloud_resource: boolean;
  };
  getEffectiveSource(cannonicalName: string): string;
  getEffectiveValue<T = any>(cannonicalName: string): T;
  getReport(opts?: { redact?: boolean, stringify?: boolean }): any;
  setValue<T = any>(name: string, value: T, source: string): void;
}

declare function init(core: { config?: Config }): Config;

export = init;