@agent-relay/factory 0.1.50 → 0.1.51

package/dist/config/schema.d.ts

@@ -99,11 +99,12 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
             repo: string;
         }[];
         clonePaths: Record<string, string>;
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
     }, {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -113,7 +114,6 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     }>;
@@ -197,6 +197,91 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         batchSize?: number | undefined;
         requestTimeoutMs?: number | undefined;
     }>>;
+    preview: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodLiteral<"tailscale-serve">>;
+        access: z.ZodDefault<z.ZodLiteral<"tailnet">>;
+        services: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+            /** Local HTTP port the repository's development server listens on. */
+            port: z.ZodNumber;
+            /** Consecutive node-local ports Factory may allocate for concurrent issues. */
+            portSpan: z.ZodOptional<z.ZodNumber>;
+            /** Optional stable tailnet HTTPS port; otherwise Factory allocates one. */
+            httpsPort: z.ZodOptional<z.ZodNumber>;
+            /** Foreground command Factory supervises for the issue-lifetime preview. */
+            startCommand: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>>>;
+        tailscaleBinary: z.ZodDefault<z.ZodString>;
+        registryPath: z.ZodDefault<z.ZodString>;
+        httpsPortRange: z.ZodDefault<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
+    }, "strip", z.ZodTypeAny, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>>;
     github: z.ZodDefault<z.ZodObject<{
         identity: z.ZodDefault<z.ZodEnum<["app", "user", "auto"]>>;
     }, "strip", z.ZodTypeAny, {
@@ -204,6 +289,29 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
     }, {
         identity?: "app" | "user" | "auto" | undefined;
     }>>;
+    verification: z.ZodDefault<z.ZodObject<{
+        /** Default-on: an auto-merge must have a green live-stack verification verdict. */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        descriptorPath: z.ZodDefault<z.ZodString>;
+        maxConcurrentEnvironments: z.ZodDefault<z.ZodNumber>;
+        maxRunTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxEnvironmentTtlMs: z.ZodDefault<z.ZodNumber>;
+        maxTeardownTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    }, {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    }>>;
     terminalState: z.ZodDefault<z.ZodEnum<["done", "human-review"]>>;
     linear: z.ZodDefault<z.ZodObject<{
         states: z.ZodDefault<z.ZodDefault<z.ZodObject<{
@@ -310,6 +418,427 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     }>>;
+    environments: z.ZodDefault<z.ZodObject<{
+        kubernetes: z.ZodOptional<z.ZodDefault<z.ZodEffects<z.ZodObject<{
+            connections: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+                id: z.ZodString;
+                target: z.ZodDefault<z.ZodEnum<["byoc", "managed"]>>;
+                customers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                repositories: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                credential: z.ZodObject<{
+                    kind: z.ZodEnum<["kubeconfig", "irsa"]>;
+                    secretRef: z.ZodEffects<z.ZodString, string, string>;
+                }, "strict", z.ZodTypeAny, {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                }, {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                }>;
+                context: z.ZodOptional<z.ZodString>;
+                protectedNamespaces: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allowClusterScopedResources: z.ZodDefault<z.ZodBoolean>;
+                allowedClusterScopedKinds: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                nodeSelector: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                tolerations: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    key: z.ZodOptional<z.ZodString>;
+                    operator: z.ZodOptional<z.ZodEnum<["Exists", "Equal"]>>;
+                    value: z.ZodOptional<z.ZodString>;
+                    effect: z.ZodOptional<z.ZodEnum<["NoSchedule", "PreferNoSchedule", "NoExecute"]>>;
+                    tolerationSeconds: z.ZodOptional<z.ZodNumber>;
+                }, "strict", z.ZodTypeAny, {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }, {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }>, "many">>;
+                fidelityCaveat: z.ZodOptional<z.ZodString>;
+            }, "strict", z.ZodTypeAny, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, "many">>;
+            defaults: z.ZodDefault<z.ZodObject<{
+                ttlMs: z.ZodDefault<z.ZodNumber>;
+                readinessTimeoutMs: z.ZodDefault<z.ZodNumber>;
+                resourceQuota: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                limitRange: z.ZodDefault<z.ZodObject<{
+                    default: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    defaultRequest: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    max: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                }, "strip", z.ZodTypeAny, {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                }, {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                }>>;
+            }, "strict", z.ZodTypeAny, {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            }, {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            }>>;
+        }, "strict", z.ZodTypeAny, {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        }, {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        }>, {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        }, {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        }>>>;
+    }, "strict", z.ZodTypeAny, {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    }, {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     triage: {
         maxImplementers: number;
@@ -350,9 +879,9 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
             repo: string;
         }[];
         clonePaths: Record<string, string>;
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
     };
     models: {
@@ -394,6 +923,14 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         instanceName?: string | undefined;
         outboxPath?: string | undefined;
     };
+    verification: {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    };
     terminalState: "done" | "human-review";
     stateIds: {
         readyForAgent?: string | undefined;
@@ -407,6 +944,43 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel: string;
         requireTeamKey: string;
     };
+    environments: {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    };
     workspaceId?: string | undefined;
     slack?: {
         channel: string;
@@ -417,8 +991,22 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         conversationCoalesceMs: number;
     } | undefined;
     issueSource?: "linear" | "github" | undefined;
+    preview?: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
 }, {
     repos: {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -428,7 +1016,6 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     };
@@ -511,6 +1098,27 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         batchSize?: number | undefined;
         requestTimeoutMs?: number | undefined;
     } | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
+    verification?: {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    } | undefined;
     terminalState?: "done" | "human-review" | undefined;
     stateIds?: {
         readyForAgent?: string | undefined;
@@ -524,6 +1132,43 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     } | undefined;
+    environments?: {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
 }>, {
     subscription: {
         labels: string[];
@@ -531,6 +1176,19 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         projects: string[];
         assignees: string[];
     };
+    preview: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
     repos: {
         default?: string | undefined;
         byLabel: {
@@ -608,6 +1266,14 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         instanceName?: string | undefined;
         outboxPath?: string | undefined;
     };
+    verification: {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    };
     terminalState: "done" | "human-review";
     stateIds: {
         readyForAgent?: string | undefined;
@@ -621,6 +1287,43 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel: string;
         requireTeamKey: string;
     };
+    environments: {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    };
     workspaceId?: string | undefined;
     slack?: {
         channel: string;
@@ -633,6 +1336,7 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
     issueSource?: "linear" | "github" | undefined;
 }, {
     repos: {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -642,7 +1346,6 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     };
@@ -725,6 +1428,27 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         batchSize?: number | undefined;
         requestTimeoutMs?: number | undefined;
     } | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
+    verification?: {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    } | undefined;
     terminalState?: "done" | "human-review" | undefined;
     stateIds?: {
         readyForAgent?: string | undefined;
@@ -738,6 +1462,43 @@ export declare const WorkspaceConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     } | undefined;
+    environments?: {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
 }>;
 export declare const NodeConfigSchema: z.ZodEffects<z.ZodObject<{
     workspaceId: z.ZodOptional<z.ZodString>;
@@ -747,18 +1508,129 @@ export declare const NodeConfigSchema: z.ZodEffects<z.ZodObject<{
     dryRun: z.ZodDefault<z.ZodBoolean>;
     factoryLoopHeartbeatPath: z.ZodOptional<z.ZodString>;
     factoryLoopRegistryPath: z.ZodOptional<z.ZodString>;
+    preview: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodLiteral<"tailscale-serve">>;
+        access: z.ZodDefault<z.ZodLiteral<"tailnet">>;
+        services: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+            /** Local HTTP port the repository's development server listens on. */
+            port: z.ZodNumber;
+            /** Consecutive node-local ports Factory may allocate for concurrent issues. */
+            portSpan: z.ZodOptional<z.ZodNumber>;
+            /** Optional stable tailnet HTTPS port; otherwise Factory allocates one. */
+            httpsPort: z.ZodOptional<z.ZodNumber>;
+            /** Foreground command Factory supervises for the issue-lifetime preview. */
+            startCommand: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>>>;
+        tailscaleBinary: z.ZodDefault<z.ZodString>;
+        registryPath: z.ZodDefault<z.ZodString>;
+        httpsPortRange: z.ZodDefault<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
+    }, "strip", z.ZodTypeAny, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     clonePaths: Record<string, string>;
     capabilities: string[];
     dryRun: boolean;
     cloneRoot?: string | undefined;
     workspaceId?: string | undefined;
+    preview?: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
     factoryLoopRegistryPath?: string | undefined;
 }, {
     cloneRoot?: string | undefined;
     clonePaths?: Record<string, string> | undefined;
     workspaceId?: string | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
     capabilities?: string[] | undefined;
     dryRun?: boolean | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
@@ -768,6 +1640,19 @@ export declare const NodeConfigSchema: z.ZodEffects<z.ZodObject<{
     clonePaths: Record<string, string>;
     factoryLoopHeartbeatPath: string | undefined;
     factoryLoopRegistryPath: string | undefined;
+    preview: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
     capabilities: string[];
     dryRun: boolean;
     workspaceId?: string | undefined;
@@ -775,6 +1660,19 @@ export declare const NodeConfigSchema: z.ZodEffects<z.ZodObject<{
     cloneRoot?: string | undefined;
     clonePaths?: Record<string, string> | undefined;
     workspaceId?: string | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
     capabilities?: string[] | undefined;
     dryRun?: boolean | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
@@ -877,11 +1775,12 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
             repo: string;
         }[];
         clonePaths: Record<string, string>;
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
     }, {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -891,7 +1790,6 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     }>;
@@ -982,6 +1880,29 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
     }, {
         identity?: "app" | "user" | "auto" | undefined;
     }>>;
+    verification: z.ZodDefault<z.ZodObject<{
+        /** Default-on: an auto-merge must have a green live-stack verification verdict. */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        descriptorPath: z.ZodDefault<z.ZodString>;
+        maxConcurrentEnvironments: z.ZodDefault<z.ZodNumber>;
+        maxRunTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxEnvironmentTtlMs: z.ZodDefault<z.ZodNumber>;
+        maxTeardownTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    }, {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    }>>;
     terminalState: z.ZodDefault<z.ZodEnum<["done", "human-review"]>>;
     linear: z.ZodDefault<z.ZodObject<{
         states: z.ZodDefault<z.ZodDefault<z.ZodObject<{
@@ -1088,6 +2009,427 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     }>>;
+    environments: z.ZodDefault<z.ZodObject<{
+        kubernetes: z.ZodOptional<z.ZodDefault<z.ZodEffects<z.ZodObject<{
+            connections: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodEffects<z.ZodObject<{
+                id: z.ZodString;
+                target: z.ZodDefault<z.ZodEnum<["byoc", "managed"]>>;
+                customers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                repositories: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                credential: z.ZodObject<{
+                    kind: z.ZodEnum<["kubeconfig", "irsa"]>;
+                    secretRef: z.ZodEffects<z.ZodString, string, string>;
+                }, "strict", z.ZodTypeAny, {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                }, {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                }>;
+                context: z.ZodOptional<z.ZodString>;
+                protectedNamespaces: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                allowClusterScopedResources: z.ZodDefault<z.ZodBoolean>;
+                allowedClusterScopedKinds: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+                nodeSelector: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                tolerations: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    key: z.ZodOptional<z.ZodString>;
+                    operator: z.ZodOptional<z.ZodEnum<["Exists", "Equal"]>>;
+                    value: z.ZodOptional<z.ZodString>;
+                    effect: z.ZodOptional<z.ZodEnum<["NoSchedule", "PreferNoSchedule", "NoExecute"]>>;
+                    tolerationSeconds: z.ZodOptional<z.ZodNumber>;
+                }, "strict", z.ZodTypeAny, {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }, {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }>, "many">>;
+                fidelityCaveat: z.ZodOptional<z.ZodString>;
+            }, "strict", z.ZodTypeAny, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }, {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }>, "many">>;
+            defaults: z.ZodDefault<z.ZodObject<{
+                ttlMs: z.ZodDefault<z.ZodNumber>;
+                readinessTimeoutMs: z.ZodDefault<z.ZodNumber>;
+                resourceQuota: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                limitRange: z.ZodDefault<z.ZodObject<{
+                    default: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    defaultRequest: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    max: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                }, "strip", z.ZodTypeAny, {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                }, {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                }>>;
+            }, "strict", z.ZodTypeAny, {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            }, {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            }>>;
+        }, "strict", z.ZodTypeAny, {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        }, {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        }>, {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        }, {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        }>>>;
+    }, "strict", z.ZodTypeAny, {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    }, {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    }>>;
 } & {
     workspaceId: z.ZodOptional<z.ZodString>;
     capabilities: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
@@ -1096,6 +2438,91 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
     dryRun: z.ZodDefault<z.ZodBoolean>;
     factoryLoopHeartbeatPath: z.ZodOptional<z.ZodString>;
     factoryLoopRegistryPath: z.ZodOptional<z.ZodString>;
+    preview: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodLiteral<"tailscale-serve">>;
+        access: z.ZodDefault<z.ZodLiteral<"tailnet">>;
+        services: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+            /** Local HTTP port the repository's development server listens on. */
+            port: z.ZodNumber;
+            /** Consecutive node-local ports Factory may allocate for concurrent issues. */
+            portSpan: z.ZodOptional<z.ZodNumber>;
+            /** Optional stable tailnet HTTPS port; otherwise Factory allocates one. */
+            httpsPort: z.ZodOptional<z.ZodNumber>;
+            /** Foreground command Factory supervises for the issue-lifetime preview. */
+            startCommand: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>>>;
+        tailscaleBinary: z.ZodDefault<z.ZodString>;
+        registryPath: z.ZodDefault<z.ZodString>;
+        httpsPortRange: z.ZodDefault<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
+    }, "strip", z.ZodTypeAny, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>, {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    }, {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     clonePaths: Record<string, string>;
     triage: {
@@ -1137,9 +2564,9 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
             repo: string;
         }[];
         clonePaths: Record<string, string>;
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
     };
     models: {
@@ -1181,6 +2608,14 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         instanceName?: string | undefined;
         outboxPath?: string | undefined;
     };
+    verification: {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    };
     terminalState: "done" | "human-review";
     stateIds: {
         readyForAgent?: string | undefined;
@@ -1194,6 +2629,43 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel: string;
         requireTeamKey: string;
     };
+    environments: {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    };
     capabilities: string[];
     dryRun: boolean;
     cloneRoot?: string | undefined;
@@ -1207,10 +2679,24 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         conversationCoalesceMs: number;
     } | undefined;
     issueSource?: "linear" | "github" | undefined;
+    preview?: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
     factoryLoopRegistryPath?: string | undefined;
 }, {
     repos: {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -1220,7 +2706,6 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     };
@@ -1305,6 +2790,27 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         batchSize?: number | undefined;
         requestTimeoutMs?: number | undefined;
     } | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
+    verification?: {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    } | undefined;
     terminalState?: "done" | "human-review" | undefined;
     stateIds?: {
         readyForAgent?: string | undefined;
@@ -1318,6 +2824,43 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     } | undefined;
+    environments?: {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
     capabilities?: string[] | undefined;
     dryRun?: boolean | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
@@ -1342,6 +2885,19 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         maxConsecutiveFailures: number;
         heartbeatStaleMs: number;
     };
+    preview: {
+        registryPath: string;
+        provider: "tailscale-serve";
+        access: "tailnet";
+        services: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }>;
+        tailscaleBinary: string;
+        httpsPortRange: [number, number];
+    } | undefined;
     repos: {
         default?: string | undefined;
         byLabel: {
@@ -1414,6 +2970,14 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         instanceName?: string | undefined;
         outboxPath?: string | undefined;
     };
+    verification: {
+        enabled: boolean;
+        descriptorPath: string;
+        maxConcurrentEnvironments: number;
+        maxRunTimeoutMs: number;
+        maxEnvironmentTtlMs: number;
+        maxTeardownTimeoutMs: number;
+    };
     terminalState: "done" | "human-review";
     stateIds: {
         readyForAgent?: string | undefined;
@@ -1427,6 +2991,43 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel: string;
         requireTeamKey: string;
     };
+    environments: {
+        kubernetes?: {
+            connections: {
+                id: string;
+                target: "byoc" | "managed";
+                customers: string[];
+                repositories: string[];
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                protectedNamespaces: string[];
+                allowClusterScopedResources: boolean;
+                allowedClusterScopedKinds: string[];
+                nodeSelector: Record<string, string>;
+                tolerations: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[];
+                context?: string | undefined;
+                fidelityCaveat?: string | undefined;
+            }[];
+            defaults: {
+                ttlMs: number;
+                readinessTimeoutMs: number;
+                resourceQuota: Record<string, string>;
+                limitRange: {
+                    default: Record<string, string>;
+                    max: Record<string, string>;
+                    defaultRequest: Record<string, string>;
+                };
+            };
+        } | undefined;
+    };
     capabilities: string[];
     dryRun: boolean;
     workspaceId?: string | undefined;
@@ -1441,6 +3042,7 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
     issueSource?: "linear" | "github" | undefined;
 }, {
     repos: {
+        default?: string | undefined;
         org?: string | undefined;
         names?: string[] | undefined;
         overrides?: Record<string, string> | undefined;
@@ -1450,7 +3052,6 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
             pattern: string;
             repo: string;
         }[] | undefined;
-        default?: string | undefined;
         cloneRoot?: string | undefined;
         clonePaths?: Record<string, string> | undefined;
     };
@@ -1535,6 +3136,27 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         batchSize?: number | undefined;
         requestTimeoutMs?: number | undefined;
     } | undefined;
+    preview?: {
+        registryPath?: string | undefined;
+        provider?: "tailscale-serve" | undefined;
+        access?: "tailnet" | undefined;
+        services?: Record<string, {
+            port: number;
+            startCommand: string;
+            portSpan?: number | undefined;
+            httpsPort?: number | undefined;
+        }> | undefined;
+        tailscaleBinary?: string | undefined;
+        httpsPortRange?: [number, number] | undefined;
+    } | undefined;
+    verification?: {
+        enabled?: boolean | undefined;
+        descriptorPath?: string | undefined;
+        maxConcurrentEnvironments?: number | undefined;
+        maxRunTimeoutMs?: number | undefined;
+        maxEnvironmentTtlMs?: number | undefined;
+        maxTeardownTimeoutMs?: number | undefined;
+    } | undefined;
     terminalState?: "done" | "human-review" | undefined;
     stateIds?: {
         readyForAgent?: string | undefined;
@@ -1548,6 +3170,43 @@ export declare const FactoryConfigSchema: z.ZodEffects<z.ZodObject<{
         requireLabel?: string | undefined;
         requireTeamKey?: string | undefined;
     } | undefined;
+    environments?: {
+        kubernetes?: {
+            connections?: {
+                id: string;
+                credential: {
+                    kind: "kubeconfig" | "irsa";
+                    secretRef: string;
+                };
+                target?: "byoc" | "managed" | undefined;
+                customers?: string[] | undefined;
+                repositories?: string[] | undefined;
+                context?: string | undefined;
+                protectedNamespaces?: string[] | undefined;
+                allowClusterScopedResources?: boolean | undefined;
+                allowedClusterScopedKinds?: string[] | undefined;
+                nodeSelector?: Record<string, string> | undefined;
+                tolerations?: {
+                    key?: string | undefined;
+                    operator?: "Exists" | "Equal" | undefined;
+                    value?: string | undefined;
+                    effect?: "NoSchedule" | "PreferNoSchedule" | "NoExecute" | undefined;
+                    tolerationSeconds?: number | undefined;
+                }[] | undefined;
+                fidelityCaveat?: string | undefined;
+            }[] | undefined;
+            defaults?: {
+                ttlMs?: number | undefined;
+                readinessTimeoutMs?: number | undefined;
+                resourceQuota?: Record<string, string> | undefined;
+                limitRange?: {
+                    default?: Record<string, string> | undefined;
+                    max?: Record<string, string> | undefined;
+                    defaultRequest?: Record<string, string> | undefined;
+                } | undefined;
+            } | undefined;
+        } | undefined;
+    } | undefined;
     capabilities?: string[] | undefined;
     dryRun?: boolean | undefined;
     factoryLoopHeartbeatPath?: string | undefined;
@@ -1564,4 +3223,6 @@ export declare function loadFactoryConfig(input: unknown): LoadedFactoryConfig;
 export type WorkspaceConfig = z.infer<typeof WorkspaceConfigSchema>;
 export type NodeConfig = z.infer<typeof NodeConfigSchema>;
 export type FactoryConfig = z.infer<typeof FactoryConfigSchema>;
+export type PreviewConfig = NonNullable<FactoryConfig['preview']>;
+export type PreviewServiceConfig = PreviewConfig['services'][string];
 //# sourceMappingURL=schema.d.ts.map