"""``apiprobe explain`` — inspect the active configuration (OP-05), secrets redacted.

Shows the effective :class:`ApiprobeSettings` — each field's value plus whether it came from
the environment (``APIPROBE_*``) or the typed default — passing the dump through the federation
:class:`Redactor` first so no secret material reaches stdout (OP-05 / LG-04).
"""

from __future__ import annotations

from mgf.common.observability import Redactor

from mgf.apiprobe.config import ApiprobeSettings


def handle_explain() -> int:
    """Print the effective configuration, marking env-overridden vs default."""
    settings = ApiprobeSettings()
    payload = settings.model_dump()
    Redactor().redact(payload)  # in-place; no-op today but correct discipline (LG-04)

    print("apiprobe — active configuration (APIPROBE_* env / typed defaults; secrets redacted):")
    for name, field in type(settings).model_fields.items():
        value = payload.get(name)
        source = "default" if value == field.default else "env/override"
        print(f"  {name} = {value!r}  [{source}]")
    return 0
