@cat-factory/worker 0.6.0

package/dist/infrastructure/auth/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/middleware.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/auth/signing.d.ts

@@ -0,0 +1,3 @@
+export { HmacSigner, TOKEN_AUDIENCE } from '@cat-factory/server';
+export type { SessionPayload, SessionUser, TokenAudience } from '@cat-factory/server';
+//# sourceMappingURL=signing.d.ts.map

package/dist/infrastructure/auth/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAChE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/auth/signing.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { HmacSigner, TOKEN_AUDIENCE } from '@cat-factory/server';
+//# sourceMappingURL=signing.js.map

package/dist/infrastructure/auth/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/signing.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/config/agents.d.ts

@@ -0,0 +1,6 @@
+import { type ProviderCapabilities } from '@cat-factory/kernel';
+import type { AgentsConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { AgentsConfig };
+export declare function loadAgentsConfig(env: Env, caps: ProviderCapabilities): AgentsConfig;
+//# sourceMappingURL=agents.d.ts.map

package/dist/infrastructure/config/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/agents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,oBAAoB,EAAmB,MAAM,qBAAqB,CAAA;AAEhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAKjC,YAAY,EAAE,YAAY,EAAE,CAAA;AAgC5B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,GAAG,YAAY,CAsEnF"}

package/dist/infrastructure/config/agents.js

@@ -0,0 +1,100 @@
+import { resolveModelRef } from '@cat-factory/kernel';
+import { num } from './utils';
+function parseModelOverrides(raw) {
+    if (!raw || raw.trim() === '')
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('AGENT_MODELS is not valid JSON');
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return {};
+    const out = {};
+    for (const [kind, value] of Object.entries(parsed)) {
+        const provider = value.provider;
+        const model = value.model;
+        if (typeof provider !== 'string' || typeof model !== 'string') {
+            throw new Error(`AGENT_MODELS.${kind} requires string "provider" and "model"`);
+        }
+        out[kind] = {
+            ref: { provider, model },
+            temperature: typeof value.temperature === 'number' ? value.temperature : undefined,
+            maxOutputTokens: typeof value.maxOutputTokens === 'number' ? value.maxOutputTokens : undefined,
+            system: typeof value.system === 'string' ? value.system : undefined,
+        };
+    }
+    return out;
+}
+export function loadAgentsConfig(env, caps) {
+    // Default unpinned agents/blocks to the Qwen model (its active flavour: the
+    // Cloudflare Workers AI variant when the Cloudflare lib is enabled, upgraded to
+    // direct DashScope per-workspace by the executor when a Qwen key is configured).
+    // An operator can still pin a specific provider/model via the env vars.
+    const qwenDefault = resolveModelRef('qwen', caps);
+    const defaultConfig = {
+        ref: {
+            provider: env.AGENT_DEFAULT_PROVIDER ?? qwenDefault?.provider ?? 'workers-ai',
+            model: env.AGENT_DEFAULT_MODEL ?? qwenDefault?.model ?? '@cf/qwen/qwen3-30b-a3b-fp8',
+        },
+        temperature: num(env.AGENT_DEFAULT_TEMPERATURE) ?? 0.4,
+        // 5000, not 512: the default model is a *reasoning* model whose `<think>`
+        // tokens count against this cap, so a tight limit truncates the answer mid
+        // reasoning (finish_reason: length). Operators can still override via env or
+        // pin a leaner cap per kind in AGENT_MODELS.
+        maxOutputTokens: num(env.AGENT_MAX_OUTPUT_TOKENS) ?? 5000,
+    };
+    // The agentic phases — design (bootstrap/architect), build (coder) and review
+    // (reviewer) — drive long multi-step tool loops, so they default to a strong
+    // agentic-coding model rather than the small default MoE (qwen3-30b-a3b), which
+    // is too weak to sustain that loop and tends to spin without committing changes.
+    // The cheap default still handles the lighter kinds (e.g. tester, fragment
+    // selection, doc planning). An operator's AGENT_MODELS env entry overrides any
+    // of these per kind.
+    const agenticDefault = {
+        ref: { provider: 'workers-ai', model: '@cf/zai-org/glm-5.2' },
+        temperature: num(env.AGENT_DEFAULT_TEMPERATURE) ?? 0.3,
+        maxOutputTokens: num(env.AGENT_MAX_OUTPUT_TOKENS) ?? 5000,
+    };
+    // The coder (implementer) runs the longest, most tool-heavy loop, where GLM-5.2
+    // on Workers AI was observed emitting malformed tool calls (e.g. `write` with no
+    // `path`) and looping until the harness no-progress guard aborted. Kimi K2.7 (a
+    // 1T-param model with structured outputs for agentic workloads, native on Workers
+    // AI) holds up better on that sustained tool loop, so the build phase defaults to
+    // it while design/review stay on GLM-5.2.
+    const coderDefault = {
+        ref: { provider: 'workers-ai', model: '@cf/moonshotai/kimi-k2.7-code' },
+        temperature: num(env.AGENT_DEFAULT_TEMPERATURE) ?? 0.3,
+        maxOutputTokens: num(env.AGENT_MAX_OUTPUT_TOKENS) ?? 5000,
+    };
+    // Companions (reviewer / spec-companion / architect-companion) return their whole
+    // verdict — rating + summary + per-item comments — as ONE inline JSON reply. On a
+    // reasoning model the <think> tokens share the output budget, so the 5000 cap can
+    // truncate the JSON mid-comment, leaving it unparseable (the run then can't read the
+    // review). Give companions a larger budget so the verdict fits. Strong agentic model,
+    // like the reviewer was already on.
+    const companionDefault = {
+        ref: { provider: 'workers-ai', model: '@cf/zai-org/glm-5.2' },
+        temperature: num(env.AGENT_DEFAULT_TEMPERATURE) ?? 0.3,
+        maxOutputTokens: num(env.AGENT_MAX_OUTPUT_TOKENS) ?? 12000,
+    };
+    const byKind = {
+        architect: agenticDefault,
+        reviewer: companionDefault,
+        'spec-companion': companionDefault,
+        'architect-companion': companionDefault,
+        coder: coderDefault,
+    };
+    // Env overrides win over the built-in agentic defaults.
+    Object.assign(byKind, parseModelOverrides(env.AGENT_MODELS));
+    return {
+        routing: {
+            default: defaultConfig,
+            byKind,
+        },
+        resolveBlockModel: (modelId) => resolveModelRef(modelId, caps),
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/infrastructure/config/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../src/infrastructure/config/agents.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAIhF,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAM7B,SAAS,mBAAmB,CAC1B,GAAuB;IAEvB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IACxC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAE5D,MAAM,GAAG,GAAiD,EAAE,CAAA;IAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiD,CAAC,EAAE,CAAC;QAC9F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;QACzB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,yCAAyC,CAAC,CAAA;QAChF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxB,WAAW,EAAE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAClF,eAAe,EACb,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC/E,MAAM,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SACpE,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAA0B;IACnE,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,wEAAwE;IACxE,MAAM,WAAW,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACjD,MAAM,aAAa,GAAqB;QACtC,GAAG,EAAE;YACH,QAAQ,EAAE,GAAG,CAAC,sBAAsB,IAAI,WAAW,EAAE,QAAQ,IAAI,YAAY;YAC7E,KAAK,EAAE,GAAG,CAAC,mBAAmB,IAAI,WAAW,EAAE,KAAK,IAAI,4BAA4B;SACrF;QACD,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,GAAG;QACtD,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6CAA6C;QAC7C,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI;KAC1D,CAAA;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,gFAAgF;IAChF,iFAAiF;IACjF,2EAA2E;IAC3E,+EAA+E;IAC/E,qBAAqB;IACrB,MAAM,cAAc,GAAqB;QACvC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE;QAC7D,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,GAAG;QACtD,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI;KAC1D,CAAA;IACD,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,kFAAkF;IAClF,0CAA0C;IAC1C,MAAM,YAAY,GAAqB;QACrC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,+BAA+B,EAAE;QACvE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,GAAG;QACtD,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI;KAC1D,CAAA;IACD,kFAAkF;IAClF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,sFAAsF;IACtF,oCAAoC;IACpC,MAAM,gBAAgB,GAAqB;QACzC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE;QAC7D,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,GAAG;QACtD,eAAe,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,KAAK;KAC3D,CAAA;IACD,MAAM,MAAM,GAAiD;QAC3D,SAAS,EAAE,cAAc;QACzB,QAAQ,EAAE,gBAAgB;QAC1B,gBAAgB,EAAE,gBAAgB;QAClC,qBAAqB,EAAE,gBAAgB;QACvC,KAAK,EAAE,YAAY;KACpB,CAAA;IACD,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE5D,OAAO;QACL,OAAO,EAAE;YACP,OAAO,EAAE,aAAa;YACtB,MAAM;SACP;QACD,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC;KAC/D,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/auth.d.ts

@@ -0,0 +1,13 @@
+import type { AuthConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { AuthConfig };
+/**
+ * Minimum length for AUTH_SESSION_SECRET. The same secret keys the HMAC over
+ * every session, OAuth-state, container-proxy and WS-ticket token; a short
+ * secret is offline-brute-forceable, which would let an attacker forge a session.
+ * A secret below this length is treated as misconfigured (auth disabled → the
+ * gate fails closed with 503) rather than silently accepted.
+ */
+export declare const MIN_SESSION_SECRET_LENGTH = 32;
+export declare function loadAuthConfig(env: Env): AuthConfig;
+//# sourceMappingURL=auth.d.ts.map

package/dist/infrastructure/config/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAGjC,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAK3C,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,UAAU,CAkEnD"}

package/dist/infrastructure/config/auth.js

@@ -0,0 +1,80 @@
+import { num } from './utils';
+/**
+ * Minimum length for AUTH_SESSION_SECRET. The same secret keys the HMAC over
+ * every session, OAuth-state, container-proxy and WS-ticket token; a short
+ * secret is offline-brute-forceable, which would let an attacker forge a session.
+ * A secret below this length is treated as misconfigured (auth disabled → the
+ * gate fails closed with 503) rather than silently accepted.
+ */
+export const MIN_SESSION_SECRET_LENGTH = 32;
+/** Deployment environments where the AUTH_DEV_OPEN escape hatch is refused. */
+const PRODUCTION_ENVIRONMENTS = new Set(['production', 'prod', 'staging']);
+export function loadAuthConfig(env) {
+    // Enabled when the OAuth credentials and a sufficiently strong session secret
+    // are all present, mirroring the GitHub-integration default-off convention.
+    const clientId = env.GITHUB_OAUTH_CLIENT_ID?.trim() ?? '';
+    const clientSecret = env.GITHUB_OAUTH_CLIENT_SECRET?.trim() ?? '';
+    const sessionSecret = env.AUTH_SESSION_SECRET?.trim() ?? '';
+    const ttlHours = num(env.AUTH_SESSION_TTL_HOURS);
+    // The local-dev escape hatch is honoured ONLY outside a production-like
+    // deployment, so leaving AUTH_DEV_OPEN=true set on a deployed worker can no
+    // longer silently re-open the API. Operators should set ENVIRONMENT=production.
+    const environment = env.ENVIRONMENT?.trim().toLowerCase() ?? '';
+    const devOpen = env.AUTH_DEV_OPEN?.trim() === 'true' && !PRODUCTION_ENVIRONMENTS.has(environment);
+    const strongSecret = sessionSecret.length >= MIN_SESSION_SECRET_LENGTH;
+    const githubEnabled = clientId !== '' && clientSecret !== '' && strongSecret;
+    // Google OAuth is offered only when its client id/secret are both present.
+    const googleClientId = env.GOOGLE_OAUTH_CLIENT_ID?.trim() ?? '';
+    const googleClientSecret = env.GOOGLE_OAUTH_CLIENT_SECRET?.trim() ?? '';
+    const googleEnabled = googleClientId !== '' && googleClientSecret !== '' && strongSecret;
+    const passwordEnabled = env.AUTH_PASSWORD_ENABLED?.trim() === 'true' && strongSecret;
+    return {
+        // Enabled when ANY provider is configured (with a strong session secret).
+        enabled: githubEnabled || googleEnabled || passwordEnabled,
+        devOpen,
+        githubEnabled,
+        clientId,
+        clientSecret,
+        sessionSecret,
+        apiBase: env.GITHUB_API_BASE?.trim() || 'https://api.github.com',
+        oauthBase: env.GITHUB_OAUTH_BASE?.trim() || 'https://github.com',
+        sessionTtlMs: (ttlHours !== undefined && ttlHours > 0 ? ttlHours : 168) * 60 * 60 * 1000,
+        successRedirectUrl: env.AUTH_SUCCESS_REDIRECT_URL?.trim() || '',
+        callbackUrl: env.AUTH_CALLBACK_URL?.trim() || '',
+        passwordEnabled,
+        ...(googleEnabled
+            ? {
+                google: {
+                    clientId: googleClientId,
+                    clientSecret: googleClientSecret,
+                    redirectUrl: env.GOOGLE_OAUTH_REDIRECT_URL?.trim() || '',
+                },
+            }
+            : {}),
+        allowedEmailDomains: (env.AUTH_ALLOWED_EMAIL_DOMAINS ?? '')
+            .split(',')
+            .map((d) => d.trim().toLowerCase())
+            .filter(Boolean),
+        allowedLogins: (env.AUTH_ALLOWED_LOGINS ?? '')
+            .split(',')
+            .map((login) => login.trim().toLowerCase())
+            .filter(Boolean),
+        allowedOrgs: (env.AUTH_ALLOWED_ORGS ?? '')
+            .split(',')
+            .map((org) => org.trim().toLowerCase())
+            .filter(Boolean),
+        allowedRedirectOrigins: (env.AUTH_ALLOWED_REDIRECT_ORIGINS ?? '')
+            .split(',')
+            .map((origin) => origin.trim())
+            .filter(Boolean)
+            .map((origin) => {
+            try {
+                return new URL(origin).origin;
+            }
+            catch {
+                return origin;
+            }
+        }),
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/infrastructure/config/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/infrastructure/config/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAI7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAE3C,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAE1E,MAAM,UAAU,cAAc,CAAC,GAAQ;IACrC,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACzD,MAAM,YAAY,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjE,MAAM,aAAa,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAChD,wEAAwE;IACxE,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACjG,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,IAAI,yBAAyB,CAAA;IACtE,MAAM,aAAa,GAAG,QAAQ,KAAK,EAAE,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,CAAA;IAC5E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC/D,MAAM,kBAAkB,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvE,MAAM,aAAa,GAAG,cAAc,KAAK,EAAE,IAAI,kBAAkB,KAAK,EAAE,IAAI,YAAY,CAAA;IACxF,MAAM,eAAe,GAAG,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,KAAK,MAAM,IAAI,YAAY,CAAA;IACpF,OAAO;QACL,0EAA0E;QAC1E,OAAO,EAAE,aAAa,IAAI,aAAa,IAAI,eAAe;QAC1D,OAAO;QACP,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB;QAChE,SAAS,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,oBAAoB;QAChE,YAAY,EAAE,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACxF,kBAAkB,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE;QAC/D,WAAW,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;QAChD,eAAe;QACf,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,QAAQ,EAAE,cAAc;oBACxB,YAAY,EAAE,kBAAkB;oBAChC,WAAW,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE;iBACzD;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB,EAAE,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;aACxD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAClC,MAAM,CAAC,OAAO,CAAC;QAClB,aAAa,EAAE,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,OAAO,CAAC;QAClB,WAAW,EAAE,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACvC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACtC,MAAM,CAAC,OAAO,CAAC;QAClB,sBAAsB,EAAE,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC;aAC9D,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACd,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,MAAM,CAAA;YACf,CAAC;QACH,CAAC,CAAC;KACL,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/cors.d.ts

@@ -0,0 +1,2 @@
+export { parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
+//# sourceMappingURL=cors.d.ts.map

package/dist/infrastructure/config/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/config/cors.js

@@ -0,0 +1,3 @@
+// Moved to the shared @cat-factory/server package; re-exported for existing imports.
+export { parseAllowedOrigins, resolveCorsOrigin } from '@cat-factory/server';
+//# sourceMappingURL=cors.js.map

package/dist/infrastructure/config/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../../src/infrastructure/config/cors.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/infrastructure/config/datadog.d.ts

@@ -0,0 +1,6 @@
+import type { DatadogConfig, IncidentEnrichmentConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { DatadogConfig, IncidentEnrichmentConfig };
+export declare function loadDatadogConfig(env: Env): DatadogConfig;
+export declare function loadIncidentEnrichmentConfig(env: Env): IncidentEnrichmentConfig;
+//# sourceMappingURL=datadog.d.ts.map

package/dist/infrastructure/config/datadog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/datadog.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAClF,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,aAAa,EAAE,wBAAwB,EAAE,CAAA;AAEvD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,aAAa,CASzD;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,wBAAwB,CAU/E"}

package/dist/infrastructure/config/datadog.js

@@ -0,0 +1,22 @@
+export function loadDatadogConfig(env) {
+    // Opt-in via the enable flag; the per-workspace API/app keys are sealed with the shared
+    // ENCRYPTION_KEY (under a datadog-scoped HKDF info). Off → the post-release-health gate
+    // is a pass-through.
+    const encryptionKey = env.ENCRYPTION_KEY?.trim();
+    return {
+        enabled: env.DATADOG_ENABLED === 'true' && !!encryptionKey,
+        encryptionKey,
+    };
+}
+export function loadIncidentEnrichmentConfig(env) {
+    // Optional, additive: annotate (never re-alert) an incident PagerDuty / incident.io
+    // already opened from the same monitors/SLOs. Deployment-level credentials.
+    const pdToken = env.PAGERDUTY_API_TOKEN?.trim();
+    const pdFrom = env.PAGERDUTY_FROM_EMAIL?.trim();
+    const ioKey = env.INCIDENTIO_API_KEY?.trim();
+    return {
+        ...(pdToken && pdFrom ? { pagerDuty: { apiToken: pdToken, fromEmail: pdFrom } } : {}),
+        ...(ioKey ? { incidentIo: { apiKey: ioKey } } : {}),
+    };
+}
+//# sourceMappingURL=datadog.js.map

package/dist/infrastructure/config/datadog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadog.js","sourceRoot":"","sources":["../../../src/infrastructure/config/datadog.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,wFAAwF;IACxF,wFAAwF;IACxF,qBAAqB;IACrB,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAChD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa;QAC1D,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,oFAAoF;IACpF,4EAA4E;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAA;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC5C,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/documents.d.ts

@@ -0,0 +1,5 @@
+import type { DocumentsConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { DocumentsConfig };
+export declare function loadDocumentsConfig(env: Env): DocumentsConfig;
+//# sourceMappingURL=documents.d.ts.map

package/dist/infrastructure/config/documents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/documents.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,eAAe,EAAE,CAAA;AAe/B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAwB7D"}

package/dist/infrastructure/config/documents.js

@@ -0,0 +1,36 @@
+const ALL_SOURCES = ['confluence', 'notion', 'github'];
+/** Parse the comma-separated `DOCUMENT_SOURCES` allow-list, defaulting to all. */
+function parseSources(raw) {
+    if (!raw?.trim())
+        return [...ALL_SOURCES];
+    const requested = raw
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    const selected = ALL_SOURCES.filter((s) => requested.includes(s));
+    return selected.length > 0 ? selected : [...ALL_SOURCES];
+}
+export function loadDocumentsConfig(env) {
+    // The document-source integration (Notion/Confluence/GitHub docs) is always on:
+    // tenants connect their own sources interactively through the UI, so there is no
+    // service-level enable flag to forget. The one hard requirement is a master key
+    // for encrypting those per-workspace credentials at rest — without it we would be
+    // persisting tokens in plaintext, so we fail loudly at config load rather than
+    // silently disabling the feature (which is how it used to vanish from the UI).
+    // The planner defaults to LLM mode; the worker only wires a model provider when a
+    // provider credential is present, so absent that the planner still degrades to its
+    // deterministic heading parser.
+    const encryptionKey = env.ENCRYPTION_KEY?.trim();
+    if (!encryptionKey) {
+        throw new Error('ENCRYPTION_KEY is required: the document-source integration (Notion, Confluence, …) ' +
+            'encrypts per-workspace source credentials at rest. Set it to a base64-encoded key of ' +
+            'at least 32 bytes.');
+    }
+    return {
+        enabled: true,
+        sources: parseSources(env.DOCUMENT_SOURCES),
+        planner: env.DOCUMENT_PLANNER?.trim() === 'headings' ? 'headings' : 'llm',
+        encryptionKey,
+    };
+}
+//# sourceMappingURL=documents.js.map

package/dist/infrastructure/config/documents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documents.js","sourceRoot":"","sources":["../../../src/infrastructure/config/documents.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,GAAkC,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAErF,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,WAAW,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,GAAG;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,+EAA+E;IAC/E,kFAAkF;IAClF,mFAAmF;IACnF,gCAAgC;IAChC,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAChD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,sFAAsF;YACpF,uFAAuF;YACvF,oBAAoB,CACvB,CAAA;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;QACzE,aAAa;KACd,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/email.d.ts

@@ -0,0 +1,5 @@
+import type { EmailConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { EmailConfig };
+export declare function loadEmailConfig(env: Env): EmailConfig;
+//# sourceMappingURL=email.d.ts.map

package/dist/infrastructure/config/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/email.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,WAAW,CAUrD"}

package/dist/infrastructure/config/email.js

@@ -0,0 +1,12 @@
+export function loadEmailConfig(env) {
+    // Opt-in via EMAIL_ENABLED; the per-account provider API key is sealed with the
+    // shared ENCRYPTION_KEY. The provider + key + From address are onboarded per-account
+    // in the UI (stored in the DB), NOT read from env.
+    const encryptionKey = env.EMAIL_ENCRYPTION_KEY?.trim() || env.ENCRYPTION_KEY?.trim();
+    return {
+        enabled: env.EMAIL_ENABLED === 'true' && !!encryptionKey,
+        encryptionKey,
+        appBaseUrl: env.APP_BASE_URL?.trim() || env.AUTH_SUCCESS_REDIRECT_URL?.trim() || '',
+    };
+}
+//# sourceMappingURL=email.js.map

package/dist/infrastructure/config/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/infrastructure/config/email.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,gFAAgF;IAChF,qFAAqF;IACrF,mDAAmD;IACnD,MAAM,aAAa,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IACpF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa;QACxD,aAAa;QACb,UAAU,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE;KACpF,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/environments.d.ts

@@ -0,0 +1,5 @@
+import type { EnvironmentsConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { EnvironmentsConfig };
+export declare function loadEnvironmentsConfig(env: Env): EnvironmentsConfig;
+//# sourceMappingURL=environments.d.ts.map

package/dist/infrastructure/config/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/environments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAGjC,YAAY,EAAE,kBAAkB,EAAE,CAAA;AAElC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,kBAAkB,CAYnE"}

package/dist/infrastructure/config/environments.js

@@ -0,0 +1,15 @@
+import { csv } from './utils';
+export function loadEnvironmentsConfig(env) {
+    // Opt-in via the enable flag; credentials are sealed with the shared ENCRYPTION_KEY
+    // (under an environments-scoped HKDF info).
+    const encryptionKey = env.ENCRYPTION_KEY?.trim();
+    return {
+        enabled: env.ENVIRONMENTS_ENABLED === 'true' && !!encryptionKey,
+        encryptionKey,
+        // Trusted-adapter escape hatch: permit an in-house env platform on an internal/VPN
+        // host (otherwise the strict public-https guard rejects it).
+        allowUrlHosts: csv(env.ENVIRONMENTS_ALLOW_URL_HOSTS),
+        allowHttpUrls: env.ENVIRONMENTS_ALLOW_HTTP_URLS === 'true',
+    };
+}
+//# sourceMappingURL=environments.js.map

package/dist/infrastructure/config/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../../src/infrastructure/config/environments.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAI7B,MAAM,UAAU,sBAAsB,CAAC,GAAQ;IAC7C,oFAAoF;IACpF,4CAA4C;IAC5C,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAA;IAChD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,oBAAoB,KAAK,MAAM,IAAI,CAAC,CAAC,aAAa;QAC/D,aAAa;QACb,mFAAmF;QACnF,6DAA6D;QAC7D,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC;QACpD,aAAa,EAAE,GAAG,CAAC,4BAA4B,KAAK,MAAM;KAC3D,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/execution.d.ts

@@ -0,0 +1,5 @@
+import type { ExecutionConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { ExecutionConfig };
+export declare function loadExecutionConfig(env: Env): ExecutionConfig;
+//# sourceMappingURL=execution.d.ts.map

package/dist/infrastructure/config/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/execution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,eAAe,EAAE,CAAA;AAO/B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,eAAe,CAe7D"}

package/dist/infrastructure/config/execution.js

@@ -0,0 +1,21 @@
+function intEnv(value, fallback) {
+    const n = value ? Number(value) : NaN;
+    return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+export function loadExecutionConfig(env) {
+    return {
+        // NOT a hard deadline: a parked run waits for a human indefinitely and is never failed
+        // for waiting. This is just the chunk length for each `waitForEvent` wait — on expiry the
+        // driver re-loops (re-checking storage, then re-arming) rather than killing the run.
+        decisionTimeout: env.DECISION_TIMEOUT?.trim() || '24 hours',
+        jobPollInterval: env.JOB_POLL_INTERVAL?.trim() || '15 seconds',
+        jobMaxPolls: intEnv(env.JOB_MAX_POLLS, 280),
+        jobPollFailureTolerance: intEnv(env.JOB_POLL_FAILURE_TOLERANCE, 6),
+        ciPollInterval: env.CI_POLL_INTERVAL?.trim() || '30 seconds',
+        ciMaxPolls: intEnv(env.CI_MAX_POLLS, 120),
+        // Hard floor of 75 min: a misconfigured low value must never reap live work
+        // (the longest legitimate container lifetime is ≈70 min of driver polling).
+        containerMaxAgeMs: Math.max(75, intEnv(env.CONTAINER_MAX_AGE_MINUTES, 90)) * 60_000,
+    };
+}
+//# sourceMappingURL=execution.js.map

package/dist/infrastructure/config/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../../src/infrastructure/config/execution.ts"],"names":[],"mappings":"AAKA,SAAS,MAAM,CAAC,KAAyB,EAAE,QAAgB;IACzD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,OAAO;QACL,uFAAuF;QACvF,0FAA0F;QAC1F,qFAAqF;QACrF,eAAe,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,UAAU;QAC3D,eAAe,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,YAAY;QAC9D,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC;QAC3C,uBAAuB,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,IAAI,YAAY;QAC5D,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC;QACzC,4EAA4E;QAC5E,4EAA4E;QAC5E,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM;KACpF,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/fragmentLibrary.d.ts

@@ -0,0 +1,5 @@
+import type { FragmentLibraryConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { FragmentLibraryConfig };
+export declare function loadFragmentLibraryConfig(env: Env): FragmentLibraryConfig;
+//# sourceMappingURL=fragmentLibrary.d.ts.map

package/dist/infrastructure/config/fragmentLibrary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragmentLibrary.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/fragmentLibrary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAErC,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,qBAAqB,CAKzE"}

package/dist/infrastructure/config/fragmentLibrary.js

@@ -0,0 +1,7 @@
+export function loadFragmentLibraryConfig(env) {
+    return {
+        enabled: env.PROMPT_LIBRARY_ENABLED === 'true',
+        selector: env.PROMPT_LIBRARY_SELECTOR?.trim() === 'llm' ? 'llm' : 'deterministic',
+    };
+}
+//# sourceMappingURL=fragmentLibrary.js.map

package/dist/infrastructure/config/fragmentLibrary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fragmentLibrary.js","sourceRoot":"","sources":["../../../src/infrastructure/config/fragmentLibrary.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,yBAAyB,CAAC,GAAQ;IAChD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAC9C,QAAQ,EAAE,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;KAClF,CAAA;AACH,CAAC"}

package/dist/infrastructure/config/github.d.ts

@@ -0,0 +1,5 @@
+import type { GitHubConfig, PrivilegedAppConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+export type { GitHubConfig, PrivilegedAppConfig };
+export declare function loadGitHubConfig(env: Env): GitHubConfig;
+//# sourceMappingURL=github.d.ts.map

package/dist/infrastructure/config/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AAEjC,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAA;AAEjD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,GAAG,YAAY,CAcvD"}

package/dist/infrastructure/config/github.js

@@ -0,0 +1,25 @@
+export function loadGitHubConfig(env) {
+    // Enabled when the App id and both secrets are present; the integration is
+    // entirely opt-in (a default-off convention shared by the optional integrations).
+    const appId = env.GITHUB_APP_ID?.trim() ?? '';
+    const enabled = appId !== '' && !!env.GITHUB_APP_PRIVATE_KEY && !!env.GITHUB_WEBHOOK_SECRET;
+    return {
+        enabled,
+        appId,
+        appSlug: env.GITHUB_APP_SLUG?.trim() ?? '',
+        apiBase: env.GITHUB_API_BASE?.trim() || 'https://api.github.com',
+        setupRedirectUrl: env.GITHUB_SETUP_REDIRECT_URL?.trim() || '/',
+        webhookSecret: env.GITHUB_WEBHOOK_SECRET ?? '',
+        privilegedApp: loadPrivilegedApp(env),
+    };
+}
+// The privileged tier only activates when both its id and key are present;
+// either alone is treated as unconfigured so a half-set env never silently
+// authenticates as a misconfigured App.
+function loadPrivilegedApp(env) {
+    const appId = env.GITHUB_PRIVILEGED_APP_ID?.trim() ?? '';
+    if (appId === '' || !env.GITHUB_PRIVILEGED_APP_PRIVATE_KEY)
+        return undefined;
+    return { appId };
+}
+//# sourceMappingURL=github.js.map

package/dist/infrastructure/config/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/infrastructure/config/github.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,gBAAgB,CAAC,GAAQ;IACvC,2EAA2E;IAC3E,kFAAkF;IAClF,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC7C,MAAM,OAAO,GAAG,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAA;IAC3F,OAAO;QACL,OAAO;QACP,KAAK;QACL,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE;QAC1C,OAAO,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,wBAAwB;QAChE,gBAAgB,EAAE,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,IAAI,GAAG;QAC9D,aAAa,EAAE,GAAG,CAAC,qBAAqB,IAAI,EAAE;QAC9C,aAAa,EAAE,iBAAiB,CAAC,GAAG,CAAC;KACtC,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,wCAAwC;AACxC,SAAS,iBAAiB,CAAC,GAAQ;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,iCAAiC;QAAE,OAAO,SAAS,CAAA;IAC5E,OAAO,EAAE,KAAK,EAAE,CAAA;AAClB,CAAC"}

package/dist/infrastructure/config/index.d.ts

@@ -0,0 +1,20 @@
+import type { AppConfig } from '@cat-factory/server';
+import type { Env } from '../env';
+import { type AgentsConfig } from './agents';
+import { type ExecutionConfig } from './execution';
+import { type GitHubConfig } from './github';
+import { type AuthConfig } from './auth';
+import { type DocumentsConfig } from './documents';
+import { type TasksConfig } from './tasks';
+import { type EnvironmentsConfig } from './environments';
+import { type RunnerPoolConfig } from './runners';
+import { type SlackConfig } from './slack';
+import { type DatadogConfig, type IncidentEnrichmentConfig } from './datadog';
+import { type EmailConfig } from './email';
+import { type RetentionConfig } from './retention';
+import { type FragmentLibraryConfig } from './fragmentLibrary';
+import { type ObservabilityConfig } from './observability';
+import { type LangfuseConfig } from './langfuse';
+export type { AgentsConfig, AppConfig, ExecutionConfig, GitHubConfig, AuthConfig, DocumentsConfig, TasksConfig, EnvironmentsConfig, RunnerPoolConfig, SlackConfig, DatadogConfig, IncidentEnrichmentConfig, EmailConfig, RetentionConfig, FragmentLibraryConfig, ObservabilityConfig, LangfuseConfig, };
+export declare function loadConfig(env: Env): AppConfig;
+//# sourceMappingURL=index.d.ts.map

package/dist/infrastructure/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAOpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAA;AACjC,OAAO,EAAE,KAAK,YAAY,EAAoB,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,aAAa,CAAA;AAEvE,OAAO,EAAE,KAAK,YAAY,EAAoB,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAkB,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAE,KAAK,gBAAgB,EAAwB,MAAM,WAAW,CAAA;AACvE,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,SAAS,CAAA;AAC3D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAG9B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,KAAK,eAAe,EAAuB,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,KAAK,qBAAqB,EAA6B,MAAM,mBAAmB,CAAA;AACzF,OAAO,EAAE,KAAK,mBAAmB,EAA2B,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,YAAY,CAAA;AAUpE,YAAY,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,YAAY,EACZ,UAAU,EACV,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,CAAA;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAgC9C"}

package/dist/infrastructure/config/index.js

@@ -0,0 +1,52 @@
+import { ALL_SUBSCRIPTION_VENDORS, effectiveCatalog, } from '@cat-factory/kernel';
+import { modelCostResolver } from '@cat-factory/spend';
+import { loadAgentsConfig } from './agents';
+import { loadExecutionConfig } from './execution';
+import { loadSpendPricing } from './spending';
+import { loadGitHubConfig } from './github';
+import { loadAuthConfig } from './auth';
+import { loadDocumentsConfig } from './documents';
+import { loadTasksConfig } from './tasks';
+import { loadEnvironmentsConfig } from './environments';
+import { loadRunnerPoolConfig } from './runners';
+import { loadSlackConfig } from './slack';
+import { loadDatadogConfig, loadIncidentEnrichmentConfig, } from './datadog';
+import { loadEmailConfig } from './email';
+import { loadRetentionConfig } from './retention';
+import { loadFragmentLibraryConfig } from './fragmentLibrary';
+import { loadObservabilityConfig } from './observability';
+import { loadLangfuseConfig } from './langfuse';
+export function loadConfig(env) {
+    // Deployment-level capabilities: direct keys are now per-workspace (resolved at run
+    // time from the DB pool), so none are known here; Cloudflare Workers AI is opt-in
+    // (the `AI` binding). The per-workspace `/models` endpoint recomputes selectability
+    // against each workspace's configured keys + subscriptions.
+    const caps = {
+        directProviders: new Set(),
+        subscriptionVendors: new Set(ALL_SUBSCRIPTION_VENDORS),
+        cloudflareEnabled: !!env.AI,
+    };
+    const spend = loadSpendPricing(env);
+    return {
+        agents: loadAgentsConfig(env, caps),
+        // Surface each model's informational list cost in the picker (from spend pricing).
+        models: effectiveCatalog(caps, modelCostResolver(spend)),
+        execution: loadExecutionConfig(env),
+        spend,
+        github: loadGitHubConfig(env),
+        auth: loadAuthConfig(env),
+        documents: loadDocumentsConfig(env),
+        tasks: loadTasksConfig(env),
+        environments: loadEnvironmentsConfig(env),
+        runners: loadRunnerPoolConfig(env),
+        slack: loadSlackConfig(env),
+        datadog: loadDatadogConfig(env),
+        incidentEnrichment: loadIncidentEnrichmentConfig(env),
+        email: loadEmailConfig(env),
+        retention: loadRetentionConfig(env),
+        fragmentLibrary: loadFragmentLibraryConfig(env),
+        observability: loadObservabilityConfig(env),
+        langfuse: loadLangfuseConfig(env),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/infrastructure/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infrastructure/config/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EAExB,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,OAAO,EAAqB,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAwB,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAqB,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAmB,cAAc,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EAAwB,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAoB,eAAe,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAA2B,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAChF,OAAO,EAAyB,oBAAoB,EAAE,MAAM,WAAW,CAAA;AACvE,OAAO,EAAoB,eAAe,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAGL,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAoB,eAAe,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAwB,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAA8B,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AACzF,OAAO,EAA4B,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACnF,OAAO,EAAuB,kBAAkB,EAAE,MAAM,YAAY,CAAA;AA8BpE,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,oFAAoF;IACpF,kFAAkF;IAClF,oFAAoF;IACpF,4DAA4D;IAC5D,MAAM,IAAI,GAAyB;QACjC,eAAe,EAAE,IAAI,GAAG,EAAE;QAC1B,mBAAmB,EAAE,IAAI,GAAG,CAAC,wBAAwB,CAAC;QACtD,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE;KAC5B,CAAA;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACnC,OAAO;QACL,MAAM,EAAE,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;QACnC,mFAAmF;QACnF,MAAM,EAAE,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxD,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACnC,KAAK;QACL,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;QAC7B,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;QACzB,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACnC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,YAAY,EAAE,sBAAsB,CAAC,GAAG,CAAC;QACzC,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC;QAClC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC;QAC/B,kBAAkB,EAAE,4BAA4B,CAAC,GAAG,CAAC;QACrD,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC;QAC3B,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC;QACnC,eAAe,EAAE,yBAAyB,CAAC,GAAG,CAAC;QAC/C,aAAa,EAAE,uBAAuB,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAClC,CAAA;AACH,CAAC"}