factory-ai 1.0.0

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "factory-ai",
+  "version": "1.0.0",
+  "description": "Deploy a private autonomous coding-agent factory on Azure: isolated builders, testers, security reviewers, durable orchestration, multi-model routing, memory, cost controls, and gated GitHub pull requests.",
+  "private": false,
+  "license": "MIT",
+  "author": "Vedant Kumar",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/itsvedantkumar/factory-ai.git"
+  },
+  "homepage": "https://github.com/itsvedantkumar/factory-ai#readme",
+  "bugs": {
+    "url": "https://github.com/itsvedantkumar/factory-ai/issues"
+  },
+  "keywords": [
+    "ai-agents",
+    "coding-agent",
+    "multi-agent",
+    "azure",
+    "bedrock",
+    "mcp",
+    "automation",
+    "devtools"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=20 <21"
+  },
+  "bin": {
+    "factory": "bin/factory",
+    "factory-ui": "src/tui.js",
+    "agent-factory-ceo": "src/ceo.js",
+    "agent-factory-control": "src/control-service.js",
+    "agent-factory-dashboard": "src/dashboard.js",
+    "agent-factory-reporter": "src/reporter.js",
+    "agent-factory-release": "src/release-service.js",
+    "agent-factory-task": "src/task-entry.js",
+    "factory-ai-telegram": "src/telegram-service.js",
+    "agent-factory-worker": "src/worker.js"
+  },
+  "files": [
+    "bin/",
+    "bootstrap/",
+    "capabilities/",
+    "config/",
+    "infra/",
+    "src/",
+    "templates/",
+    "*.md",
+    "Dockerfile.worker"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "lint": "eslint .",
+    "check": "node --check src/*.js"
+  },
+  "dependencies": {
+    "@aws-sdk/client-bedrock-runtime": "3.1085.0",
+    "@azure/identity": "4.13.1",
+    "@azure/keyvault-secrets": "4.10.0",
+    "@azure/service-bus": "7.9.5",
+    "@inquirer/prompts": "8.5.2",
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/server-memory": "2026.7.4",
+    "@playwright/mcp": "0.0.78",
+    "@upstash/context7-mcp": "3.2.3",
+    "neo-blessed": "0.2.0",
+    "zod": "3.25.76"
+  },
+  "devDependencies": {
+    "eslint": "9.32.0",
+    "globals": "16.3.0"
+  }
+}

package/src/agent-executor.js

@@ -0,0 +1,52 @@
+import { parseTaskResult } from "./validation.js";
+
+export class AgentExecutor {
+  constructor({ workspaces, agentRunner, scannerSuite, sendControl }) {
+    this.workspaces = workspaces;
+    this.agentRunner = agentRunner;
+    this.scannerSuite = scannerSuite;
+    this.sendControl = sendControl;
+  }
+
+  async process(message) {
+    if (message?.type === "planning_task") return this.processPlanning(message);
+    if (message?.type === "agent_task") return this.processTask(message);
+    throw new Error(`Unsupported agent message type: ${message?.type}`);
+  }
+
+  async processPlanning(message) {
+    const directory = await this.workspaces.ensureObjective(message.objective);
+    const delivery = await this.agentRunner.plan(message.objective, directory, message.context ?? []);
+    await this.sendControl({ type: "planning_result", objectiveId: message.objectiveId, delivery });
+  }
+
+  async processTask(message) {
+    const directory = await this.workspaces.prepareTask(
+      message.objective,
+      message.task,
+      message.dependencyCommits ?? [],
+    );
+    const scannerEvidence = message.task.role === "security" && this.scannerSuite
+      ? await this.scannerSuite.scan(directory)
+      : [];
+    const prompt = [
+      "Execute only this assigned task, verify it, and report factual outcomes.",
+      ...(scannerEvidence.length ? [`TRUSTED SCANNER EVIDENCE (mechanical output; do not claim checks beyond this evidence):\n${JSON.stringify(scannerEvidence)}`] : []),
+    ].join("\n\n");
+    const result = parseTaskResult(await this.agentRunner.invoke({
+      objective: message.objective,
+      task: message.task,
+      directory,
+      prompt,
+    }));
+    const checkpoint = await this.workspaces.checkpoint(directory, message.objective, message.task);
+    await this.sendControl({
+      type: "result",
+      objectiveId: message.objectiveId,
+      taskId: message.task.id,
+      status: "succeeded",
+      ...result,
+      ...checkpoint,
+    });
+  }
+}

package/src/agent-runner.js

@@ -0,0 +1,110 @@
+import { readFile } from "node:fs/promises";
+import { AzureResponsesHarness } from "./azure-harness.js";
+import { selectCapabilities } from "./capabilities.js";
+import { modelForTask } from "./routing.js";
+import { createWorkspaceTools } from "./workspace-tools.js";
+import { connectMcpTools } from "./mcp-tools.js";
+import { BedrockHarness } from "./bedrock-harness.js";
+
+function parseJson(text) {
+  const fenced = text.match(/```json\s*([\s\S]*?)```/i)?.[1];
+  if (fenced) return JSON.parse(fenced);
+  const start = text.indexOf("{");
+  const end = text.lastIndexOf("}");
+  if (start < 0 || end <= start) throw new Error("Agent response did not contain a JSON object");
+  return JSON.parse(text.slice(start, end + 1));
+}
+
+function endpointForRoute(route, role, environment) {
+  const [provider, model] = route.split("/");
+  const lightweight = provider === "azureai-responses";
+  const baseUrl = lightweight ? environment.AZURE_OPENAI_BASE_URL : environment.TEXTVED_AZURE_BASE_URL;
+  const apiKey = lightweight ? environment.AZURE_OPENAI_API_KEY : environment.TEXTVED_AZURE_API_KEY;
+  if (!baseUrl || !apiKey) throw new Error(`Azure credentials are unavailable for ${role}`);
+  return { baseUrl, apiKey, model };
+}
+
+export class AzureAgentRunner {
+  constructor(config, registry, {
+    environment = process.env,
+    createHarness = (options) => new AzureResponsesHarness(options),
+    createBedrockHarness = (options) => new BedrockHarness(options),
+  } = {}) {
+    this.config = config;
+    this.registry = registry;
+    this.environment = environment;
+    this.createHarness = createHarness;
+    this.createBedrockHarness = createBedrockHarness;
+  }
+
+  async promptForTask(objective, task, prompt, capabilities) {
+    const skills = await Promise.all(capabilities.filter((item) => item.type === "skill").map(async (item) => (
+      `ALLOWLISTED SKILL ${item.name}@${item.version}:\n${await readFile(item.path, "utf8")}`
+    )));
+    return [
+      `You are the isolated ${task.role} subagent for CEO objective: ${objective.objective}`,
+      task.instructions,
+      "Work only in the assigned repository. Never inspect credentials, push Git refs, deploy, or install global tools.",
+      "Use tools for evidence. Make the smallest correct change and verify every completion claim.",
+      prompt,
+      ...skills,
+      'Return only JSON: {"summary":"concise outcome","checks":["command/result"],"risks":["remaining risk"],"approval":"approved|changes_requested|not_applicable"}.',
+    ].join("\n\n");
+  }
+
+  harness(task, directory, additionalTools = {}) {
+    const role = task.role;
+    const route = modelForTask(task, this.environment);
+    const tools = { ...createWorkspaceTools(directory), ...additionalTools };
+    const maxSteps = role === "scout" ? 20 : 40;
+    if (route.startsWith("bedrock/")) {
+      return this.createBedrockHarness({
+        region: this.environment.AWS_REGION ?? "us-east-1",
+        model: route.slice("bedrock/".length),
+        tools,
+        maxSteps,
+      });
+    }
+    return this.createHarness({ ...endpointForRoute(route, role, this.environment), tools, timeoutMs: this.config.timeoutMs, maxSteps });
+  }
+
+  async invoke({ objective, task, directory, prompt }) {
+    const capabilities = selectCapabilities(this.registry, task.role, task.capabilities);
+    const mcp = await connectMcpTools(capabilities);
+    try {
+      const response = await this.harness(task, directory, mcp.tools).run(
+        await this.promptForTask(objective, task, prompt, capabilities),
+      );
+      return parseJson(response.text);
+    } finally {
+      await mcp.close();
+    }
+  }
+
+  async plan(objective, directory, projectContext = []) {
+    const plannerCapabilities = selectCapabilities(this.registry, "planner", []);
+    const plannerSkills = await Promise.all(plannerCapabilities.filter((item) => item.type === "skill").map(async (item) => (
+      `PLANNER SKILL ${item.name}@${item.version}:\n${await readFile(item.path, "utf8")}`
+    )));
+    const registrySummary = Object.fromEntries([
+      ...Object.entries(this.registry.skills ?? {}),
+      ...Object.entries(this.registry.mcp ?? {}),
+    ].map(([name, item]) => [name, { version: item.version, roles: item.roles }]));
+    const prompt = `You are a planner subagent. Decompose the objective into a small executable DAG.
+Objective: ${objective.objective}
+Verified prior project context: ${JSON.stringify(projectContext)}
+Allowed roles: scout, builder, tester, debugger, reviewer, security, release.
+Allowed capabilities: ${JSON.stringify(registrySummary)}
+Include tester, reviewer, and security ancestors of exactly one terminal release task.
+Return only JSON: {"executiveIntent":"...","tasks":[{"id":"...","role":"...","title":"...","instructions":"...","dependsOn":[],"capabilities":[],"complexity":"simple|complex"}]}
+
+${plannerSkills.join("\n\n")}`;
+    const mcp = await connectMcpTools(plannerCapabilities);
+    try {
+      const response = await this.harness({ role: "planner", complexity: "complex" }, directory, mcp.tools).run(prompt);
+      return parseJson(response.text);
+    } finally {
+      await mcp.close();
+    }
+  }
+}

package/src/azure-harness.js

@@ -0,0 +1,118 @@
+const TRANSIENT_STATUS = new Set([408, 409, 429, 500, 502, 503, 504]);
+
+function outputText(response) {
+  if (typeof response.output_text === "string") return response.output_text;
+  return (response.output ?? [])
+    .filter((item) => item.type === "message")
+    .flatMap((item) => item.content ?? [])
+    .filter((item) => item.type === "output_text")
+    .map((item) => item.text)
+    .join("\n");
+}
+
+function toolDefinitions(tools) {
+  return Object.entries(tools).map(([name, tool]) => ({
+    type: "function",
+    name,
+    description: tool.description,
+    parameters: tool.parameters,
+  }));
+}
+
+export class AzureResponsesHarness {
+  constructor({
+    baseUrl,
+    apiKey,
+    model,
+    tools,
+    fetch = globalThis.fetch,
+    maxSteps = 40,
+    retries = 4,
+    timeoutMs = 180_000,
+    sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  }) {
+    this.endpoint = `${baseUrl.replace(/\/$/, "")}/responses`;
+    this.apiKey = apiKey;
+    this.model = model;
+    this.tools = tools;
+    this.fetch = fetch;
+    this.maxSteps = maxSteps;
+    this.retries = retries;
+    this.timeoutMs = timeoutMs;
+    this.sleep = sleep;
+  }
+
+  async request(body) {
+    for (let attempt = 0; attempt <= this.retries; attempt += 1) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      timer.unref?.();
+      try {
+        const response = await this.fetch(this.endpoint, {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "api-key": this.apiKey,
+            authorization: `Bearer ${this.apiKey}`,
+          },
+          body: JSON.stringify(body),
+          signal: controller.signal,
+        });
+        const payload = await response.json().catch(() => ({}));
+        if (response.ok) return payload;
+        if (!TRANSIENT_STATUS.has(response.status) || attempt === this.retries) {
+          throw new Error(`Azure Responses HTTP ${response.status}: ${payload.error?.code ?? "request_failed"}`);
+        }
+      } catch (error) {
+        const transientNetworkError = error.name === "AbortError" || error instanceof TypeError;
+        if (!transientNetworkError || attempt === this.retries) throw error;
+      } finally {
+        clearTimeout(timer);
+      }
+      const delay = Math.min(10_000, 500 * (2 ** attempt)) + Math.floor(Math.random() * 250);
+      await this.sleep(delay);
+    }
+    throw new Error("Azure Responses retry loop exhausted");
+  }
+
+  async run(prompt) {
+    let input = prompt;
+    let previousResponseId;
+    const definitions = toolDefinitions(this.tools);
+    for (let step = 0; step < this.maxSteps; step += 1) {
+      const response = await this.request({
+        model: this.model,
+        input,
+        ...(previousResponseId ? { previous_response_id: previousResponseId } : {}),
+        tools: definitions,
+      });
+      const calls = (response.output ?? []).filter((item) => item.type === "function_call");
+      if (calls.length === 0) return { text: outputText(response), responseId: response.id, steps: step + 1 };
+      const outputs = [];
+      for (const call of calls) {
+        const tool = this.tools[call.name];
+        if (!tool) throw new Error(`Tool not allowed: ${call.name}`);
+        let argumentsValue;
+        try {
+          argumentsValue = JSON.parse(call.arguments || "{}");
+        } catch {
+          throw new Error(`Invalid arguments for tool: ${call.name}`);
+        }
+        let value;
+        try {
+          value = await tool.execute(argumentsValue);
+        } catch (error) {
+          value = `ERROR: ${String(error.message ?? error).slice(0, 4000)}`;
+        }
+        outputs.push({
+          type: "function_call_output",
+          call_id: call.call_id,
+          output: typeof value === "string" ? value : JSON.stringify(value),
+        });
+      }
+      previousResponseId = response.id;
+      input = outputs;
+    }
+    throw new Error(`Agent exceeded step limit of ${this.maxSteps}`);
+  }
+}

package/src/bedrock-harness.js

@@ -0,0 +1,52 @@
+import { BedrockRuntimeClient, ConverseCommand } from "@aws-sdk/client-bedrock-runtime";
+
+function definitions(tools) {
+  return Object.entries(tools).map(([name, tool]) => ({
+    toolSpec: {
+      name,
+      description: tool.description,
+      inputSchema: { json: tool.parameters },
+    },
+  }));
+}
+
+export class BedrockHarness {
+  constructor({ client, region = process.env.AWS_REGION ?? "us-east-1", model, tools, maxSteps = 40 }) {
+    this.client = client ?? new BedrockRuntimeClient({ region });
+    this.model = model;
+    this.tools = tools;
+    this.maxSteps = maxSteps;
+  }
+
+  async run(prompt) {
+    const messages = [{ role: "user", content: [{ text: prompt }] }];
+    const usage = { inputTokens: 0, outputTokens: 0 };
+    for (let step = 0; step < this.maxSteps; step += 1) {
+      const response = await this.client.send(new ConverseCommand({
+        modelId: this.model,
+        messages,
+        ...(Object.keys(this.tools).length ? { toolConfig: { tools: definitions(this.tools) } } : {}),
+      }));
+      usage.inputTokens += response.usage?.inputTokens ?? 0;
+      usage.outputTokens += response.usage?.outputTokens ?? 0;
+      const message = response.output?.message;
+      const calls = (message?.content ?? []).flatMap((item) => item.toolUse ? [item.toolUse] : []);
+      if (calls.length === 0) {
+        const text = (message?.content ?? []).flatMap((item) => typeof item.text === "string" ? [item.text] : []).join("\n");
+        return { text, steps: step + 1, usage };
+      }
+      messages.push(message);
+      const results = [];
+      for (const call of calls) {
+        const tool = this.tools[call.name];
+        if (!tool) throw new Error(`Tool not allowed: ${call.name}`);
+        let value;
+        let status = "success";
+        try { value = await tool.execute(call.input ?? {}); } catch (error) { value = `ERROR: ${String(error.message ?? error).slice(0, 4000)}`; status = "error"; }
+        results.push({ toolResult: { toolUseId: call.toolUseId, content: [{ text: typeof value === "string" ? value : JSON.stringify(value) }], status } });
+      }
+      messages.push({ role: "user", content: results });
+    }
+    throw new Error(`Agent exceeded step limit of ${this.maxSteps}`);
+  }
+}

package/src/bus.js

@@ -0,0 +1,20 @@
+import { DefaultAzureCredential } from "@azure/identity";
+import { ServiceBusClient } from "@azure/service-bus";
+
+export function createBus(config, receiveQueue, sendQueue) {
+  const client = new ServiceBusClient(config.serviceBusFqdn, new DefaultAzureCredential());
+  const sender = client.createSender(sendQueue);
+  const receiver = client.createReceiver(receiveQueue, { receiveMode: "peekLock" });
+  return { client, sender, receiver };
+}
+
+export async function sendMessage(sender, body, messageId, correlationId = messageId) {
+  await sender.sendMessages({
+    body,
+    messageId,
+    correlationId,
+    contentType: "application/json",
+    subject: body.type,
+    applicationProperties: { schemaVersion: 1 },
+  });
+}

package/src/capabilities.js

@@ -0,0 +1,43 @@
+function entries(registry) {
+  return [
+    ...Object.entries(registry.skills ?? {}).map(([name, definition]) => ({ name, type: "skill", ...definition })),
+    ...Object.entries(registry.mcp ?? {}).map(([name, definition]) => ({ name, type: "mcp", ...definition })),
+  ];
+}
+
+export function validateRegistry(registry) {
+  for (const item of entries(registry)) {
+    if (!item.version || !/^\d+\.\d+\.\d+$/.test(item.version)) {
+      throw new Error(`Capability ${item.name} is not pinned to a semantic version`);
+    }
+    if (!Array.isArray(item.roles) || item.roles.length === 0) {
+      throw new Error(`Capability ${item.name} has no allowed roles`);
+    }
+    if (item.type === "skill" && !item.path?.startsWith("/")) {
+      throw new Error(`Skill ${item.name} must use an absolute path`);
+    }
+    if (item.type === "mcp" && (!Array.isArray(item.command) || !item.command[0]?.startsWith("/"))) {
+      throw new Error(`MCP ${item.name} must use an absolute executable`);
+    }
+  }
+  for (const [role, names] of Object.entries(registry.defaults ?? {})) {
+    if (!Array.isArray(names)) throw new Error(`Default capabilities for ${role} must be an array`);
+    const available = new Map(entries(registry).map((item) => [item.name, item]));
+    for (const name of names) {
+      const item = available.get(name);
+      if (!item || !item.roles.includes(role)) throw new Error(`Invalid default capability ${name} for ${role}`);
+    }
+  }
+  return registry;
+}
+
+export function selectCapabilities(registry, role, requested) {
+  validateRegistry(registry);
+  const available = new Map(entries(registry).map((item) => [item.name, item]));
+  return [...new Set([...(registry.defaults?.[role] ?? []), ...requested])].map((name) => {
+    const item = available.get(name);
+    if (!item) throw new Error(`Unknown capability: ${name}`);
+    if (!item.roles.includes(role)) throw new Error(`Capability ${name} is not allowed for role ${role}`);
+    return item;
+  });
+}

package/src/ceo.js

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { loadConfig } from "./config.js";
+import { createBus, sendMessage } from "./bus.js";
+import { parseObjective } from "./validation.js";
+
+function argumentsFrom(argv) {
+  const options = { baseBranch: "main", wait: false, timeoutMs: 3_600_000, words: [] };
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === "--repo") options.repository = argv[++index];
+    else if (value === "--base") options.baseBranch = argv[++index];
+    else if (value === "--wait") options.wait = true;
+    else if (value === "--timeout-ms") options.timeoutMs = Number(argv[++index]);
+    else if (value.startsWith("--")) throw new Error(`Unknown option: ${value}`);
+    else options.words.push(value);
+  }
+  if (!options.repository || options.words.length === 0) {
+    throw new Error('Usage: agent-factory-ceo --repo <https-url> [--base main] [--wait] "objective"');
+  }
+  if (!Number.isInteger(options.timeoutMs) || options.timeoutMs < 1000 || options.timeoutMs > 86_400_000) {
+    throw new Error("--timeout-ms must be between 1000 and 86400000");
+  }
+  return options;
+}
+
+async function waitForResult(file, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      return JSON.parse(await readFile(file, "utf8"));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+  }
+  throw new Error(`Timed out waiting for result after ${timeoutMs}ms`);
+}
+
+try {
+  const options = argumentsFrom(process.argv.slice(2));
+  const config = loadConfig();
+  const objective = parseObjective({
+    id: randomUUID(),
+    type: "objective",
+    objective: options.words.join(" "),
+    repository: options.repository,
+    baseBranch: options.baseBranch,
+    createdAt: new Date().toISOString(),
+  });
+  const bus = createBus(config, config.controlQueue, config.controlQueue);
+  await sendMessage(bus.sender, objective, objective.id);
+  await bus.sender.close();
+  await bus.receiver.close();
+  await bus.client.close();
+  if (options.wait) {
+    const result = await waitForResult(path.join(config.stateDir, objective.id, "result.json"), options.timeoutMs);
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } else {
+    process.stdout.write(`${JSON.stringify({ objectiveId: objective.id, status: "queued" })}\n`);
+  }
+} catch (error) {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+}

package/src/config.js

@@ -0,0 +1,65 @@
+import path from "node:path";
+import { z } from "zod";
+
+const environmentSchema = z.object({
+  SERVICE_BUS_NAMESPACE: z.string().min(3),
+  CONTROL_QUEUE: z.string().min(1).default("control-events"),
+  AGENT_QUEUE: z.string().min(1).default("agent-tasks"),
+  RELEASE_QUEUE: z.string().min(1).default("release-tasks"),
+  KEY_VAULT_NAME: z.string().min(3),
+  AZURE_SUBSCRIPTION_ID: z.string().optional(),
+  FACTORY_RESOURCE_GROUP: z.string().default("factory-ai-rg"),
+  FACTORY_STATE_DIR: z.string().default("/opt/agent-factory/state"),
+  FACTORY_WORKSPACE_DIR: z.string().default("/opt/agent-factory/workspaces"),
+  FACTORY_REGISTRY: z.string().default("/opt/agent-factory/app/config/capabilities.json"),
+  FACTORY_WORKER_IMAGE: z.string().min(1).default("agent-factory-worker:development"),
+  MAX_CONCURRENCY: z.coerce.number().int().min(1).max(3).default(3),
+  TASK_TIMEOUT_MS: z.coerce.number().int().min(60_000).max(3_600_000).default(1_800_000),
+  MAX_DELIVERY_COUNT: z.coerce.number().int().min(2).max(20).default(8),
+  AZURE_PRIMARY_API_KEY_SECRET: z.string().min(1).default("azure-primary-api-key"),
+  AZURE_PRIMARY_BASE_URL_SECRET: z.string().min(1).default("azure-primary-base-url"),
+  AZURE_SMALL_API_KEY_SECRET: z.string().min(1).default("azure-small-api-key"),
+  AZURE_SMALL_BASE_URL_SECRET: z.string().min(1).default("azure-small-base-url"),
+  GITHUB_TOKEN_SECRET: z.string().min(1).default("github-token"),
+  AWS_ACCESS_KEY_ID_SECRET: z.string().min(1).default("aws-access-key-id"),
+  AWS_SECRET_ACCESS_KEY_SECRET: z.string().min(1).default("aws-secret-access-key"),
+  AWS_SESSION_TOKEN_SECRET: z.string().min(1).default("aws-session-token"),
+  TELEGRAM_BOT_TOKEN_SECRET: z.string().min(1).default("telegram-bot-token"),
+  TELEGRAM_ALLOWED_CHAT_IDS_SECRET: z.string().min(1).default("telegram-allowed-chat-ids"),
+}).passthrough();
+
+export function loadConfig(environment = process.env) {
+  const env = environmentSchema.parse(environment);
+  if (env.CONTROL_QUEUE === env.AGENT_QUEUE) throw new Error("Control and agent queues must be different");
+  return {
+    serviceBusFqdn: env.SERVICE_BUS_NAMESPACE.includes(".")
+      ? env.SERVICE_BUS_NAMESPACE
+      : `${env.SERVICE_BUS_NAMESPACE}.servicebus.windows.net`,
+    controlQueue: env.CONTROL_QUEUE,
+    agentQueue: env.AGENT_QUEUE,
+    releaseQueue: env.RELEASE_QUEUE,
+    keyVaultUrl: `https://${env.KEY_VAULT_NAME}.vault.azure.net`,
+    subscriptionId: env.AZURE_SUBSCRIPTION_ID,
+    resourceGroup: env.FACTORY_RESOURCE_GROUP,
+    secretNames: {
+      TEXTVED_AZURE_API_KEY: env.AZURE_PRIMARY_API_KEY_SECRET,
+      TEXTVED_AZURE_BASE_URL: env.AZURE_PRIMARY_BASE_URL_SECRET,
+      AZURE_OPENAI_API_KEY: env.AZURE_SMALL_API_KEY_SECRET,
+      AZURE_OPENAI_BASE_URL: env.AZURE_SMALL_BASE_URL_SECRET,
+      GH_TOKEN: env.GITHUB_TOKEN_SECRET,
+      AWS_ACCESS_KEY_ID: env.AWS_ACCESS_KEY_ID_SECRET,
+      AWS_SECRET_ACCESS_KEY: env.AWS_SECRET_ACCESS_KEY_SECRET,
+      AWS_SESSION_TOKEN: env.AWS_SESSION_TOKEN_SECRET,
+      TELEGRAM_BOT_TOKEN: env.TELEGRAM_BOT_TOKEN_SECRET,
+      TELEGRAM_ALLOWED_CHAT_IDS: env.TELEGRAM_ALLOWED_CHAT_IDS_SECRET,
+    },
+    stateDir: path.resolve(env.FACTORY_STATE_DIR),
+    memoryDir: path.resolve(env.FACTORY_STATE_DIR, "memory"),
+    workspaceDir: path.resolve(env.FACTORY_WORKSPACE_DIR),
+    registryPath: path.resolve(env.FACTORY_REGISTRY),
+    workerImage: env.FACTORY_WORKER_IMAGE,
+    concurrency: env.MAX_CONCURRENCY,
+    timeoutMs: env.TASK_TIMEOUT_MS,
+    maxDeliveryCount: env.MAX_DELIVERY_COUNT,
+  };
+}