night-orch 0.3.2 → 0.4.0

package/dist/settings/definitions/github.js

@@ -0,0 +1,267 @@
+import { z } from 'zod';
+import { AppMentionSchema, NotificationChannelSchema, WorkflowSchema, } from '../../config/schema.js';
+import { booleanSetting, jsonSetting, numberSetting, stringSetting, validateJsonSettingShape, } from '../registry.js';
+const GithubAppMentionsOverrideSchema = z.record(AppMentionSchema);
+const NotificationsChannelsOverrideSchema = z.array(NotificationChannelSchema);
+const WorkflowsOverrideSchema = z.record(WorkflowSchema);
+export function githubDefinitions() {
+    return [
+        stringSetting({
+            key: 'github.tokenEnv',
+            label: 'GitHub Token Env Var',
+            description: 'Environment variable name used for GitHub authentication.',
+            details: 'Set the env var name that stores the GitHub token. This must be a variable name, not a literal token value.',
+            defaultValue: null,
+            yamlPath: ['github', 'tokenEnv'],
+            minLength: 1,
+            validate: (value) => {
+                if (value.startsWith('ghp_') || value.startsWith('ghs_') || value.startsWith('github_pat_')) {
+                    return 'github.tokenEnv should be an environment variable name, not a literal token';
+                }
+                return null;
+            },
+        }),
+        stringSetting({
+            key: 'github.apiBaseUrl',
+            label: 'GitHub API Base URL',
+            description: 'Base URL for GitHub API requests.',
+            details: 'Override the API base URL used for GitHub repos. Useful for GitHub Enterprise deployments.',
+            defaultValue: 'https://api.github.com',
+            yamlPath: ['github', 'apiBaseUrl'],
+            minLength: 1,
+            url: true,
+        }),
+        numberSetting({
+            key: 'github.pollIntervalSeconds',
+            label: 'Poll Interval (seconds)',
+            description: 'Delay between automatic poll cycles.',
+            details: 'Controls how often night-orch checks configured repos for work. Lower values react faster but increase API traffic.',
+            defaultValue: 300,
+            yamlPath: ['github', 'pollIntervalSeconds'],
+            integer: true,
+            min: 5,
+            max: 3600,
+            step: 5,
+        }),
+        jsonSetting({
+            key: 'github.appMentions',
+            label: 'GitHub App Mentions',
+            description: 'Mention template map used for app-trigger comments.',
+            details: 'Record keyed by mention alias with enabled flag and comment template payloads.',
+            defaultValue: {},
+            yamlPath: ['github', 'appMentions'],
+            normalize: (value) => validateJsonSettingShape(value, GithubAppMentionsOverrideSchema, 'github.appMentions'),
+        }),
+        stringSetting({
+            key: 'storage.dbPath',
+            label: 'State DB Path',
+            description: 'SQLite database file path.',
+            details: 'Location of the runtime state database file. Read-only at runtime because DB opens before overrides are loaded.',
+            defaultValue: '~/.config/night-orch/state.db',
+            yamlPath: ['storage', 'dbPath'],
+            minLength: 1,
+            mutable: false,
+        }),
+        stringSetting({
+            key: 'storage.worktreeRoot',
+            label: 'Worktree Root',
+            description: 'Root directory used for issue worktrees.',
+            details: 'Base path where dedicated issue worktrees are created.',
+            defaultValue: '~/code/.night-orch/worktrees',
+            yamlPath: ['storage', 'worktreeRoot'],
+            minLength: 1,
+        }),
+        stringSetting({
+            key: 'storage.logsRoot',
+            label: 'Logs Root',
+            description: 'Root directory used for run/session logs.',
+            details: 'Base path where runtime log files are written.',
+            defaultValue: '~/code/.night-orch/logs',
+            yamlPath: ['storage', 'logsRoot'],
+            minLength: 1,
+        }),
+        booleanSetting({
+            key: 'storage.autoCleanup.enabled',
+            label: 'Auto Cleanup Enabled',
+            description: 'Enable periodic cleanup jobs.',
+            details: 'When enabled, stale worktrees and old logs are cleaned up automatically on schedule.',
+            defaultValue: true,
+            yamlPath: ['storage', 'autoCleanup', 'enabled'],
+        }),
+        numberSetting({
+            key: 'storage.autoCleanup.intervalMinutes',
+            label: 'Auto Cleanup Interval (minutes)',
+            description: 'How often automatic cleanup runs.',
+            details: 'Interval between automatic cleanup runs.',
+            defaultValue: 60,
+            yamlPath: ['storage', 'autoCleanup', 'intervalMinutes'],
+            integer: true,
+            min: 1,
+            step: 5,
+        }),
+        numberSetting({
+            key: 'storage.retention.worktreeAgeDays',
+            label: 'Worktree Retention (days)',
+            description: 'Retention window for stale worktrees.',
+            details: 'Completed/error worktrees older than this threshold may be removed during cleanup.',
+            defaultValue: 7,
+            yamlPath: ['storage', 'retention', 'worktreeAgeDays'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'storage.retention.detailDays',
+            label: 'Detail Retention (days)',
+            description: 'Retention window for detailed run data.',
+            details: 'Detailed run artifacts are retained for this many days before archival/cleanup.',
+            defaultValue: 30,
+            yamlPath: ['storage', 'retention', 'detailDays'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'storage.retention.archiveDays',
+            label: 'Archive Retention (days)',
+            description: 'Retention window for archived run data.',
+            details: 'Archived records older than this threshold can be removed.',
+            defaultValue: 90,
+            yamlPath: ['storage', 'retention', 'archiveDays'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        jsonSetting({
+            key: 'notifications.channels',
+            label: 'Notification Channels',
+            description: 'Configured notification channel list.',
+            details: 'Array of notification channel definitions (console/webhook/discord/smtp).',
+            defaultValue: [{ type: 'console' }],
+            yamlPath: ['notifications', 'channels'],
+            normalize: (value) => validateJsonSettingShape(value, NotificationsChannelsOverrideSchema, 'notifications.channels'),
+        }),
+        booleanSetting({
+            key: 'notifications.events.onRunStarted',
+            label: 'Notify: Run Started',
+            description: 'Send notifications when runs start.',
+            details: 'Controls whether run-started notifications are dispatched.',
+            defaultValue: false,
+            yamlPath: ['notifications', 'events', 'onRunStarted'],
+        }),
+        booleanSetting({
+            key: 'notifications.events.onBlocked',
+            label: 'Notify: Blocked',
+            description: 'Send notifications when runs become blocked.',
+            details: 'Controls whether blocked-run notifications are dispatched.',
+            defaultValue: true,
+            yamlPath: ['notifications', 'events', 'onBlocked'],
+        }),
+        booleanSetting({
+            key: 'notifications.events.onPrReady',
+            label: 'Notify: PR Ready',
+            description: 'Send notifications when PRs are ready.',
+            details: 'Controls whether ready-for-review PR notifications are dispatched.',
+            defaultValue: true,
+            yamlPath: ['notifications', 'events', 'onPrReady'],
+        }),
+        booleanSetting({
+            key: 'notifications.events.onPrUpdated',
+            label: 'Notify: PR Updated',
+            description: 'Send notifications when PRs are updated.',
+            details: 'Controls whether PR update notifications are dispatched.',
+            defaultValue: true,
+            yamlPath: ['notifications', 'events', 'onPrUpdated'],
+        }),
+        booleanSetting({
+            key: 'notifications.events.onError',
+            label: 'Notify: Error',
+            description: 'Send notifications on orchestration errors.',
+            details: 'Controls whether error notifications are dispatched.',
+            defaultValue: true,
+            yamlPath: ['notifications', 'events', 'onError'],
+        }),
+        booleanSetting({
+            key: 'notifications.events.onRetryExhausted',
+            label: 'Notify: Retry Exhausted',
+            description: 'Send notifications when retries are exhausted.',
+            details: 'Controls whether retry-exhausted notifications are dispatched.',
+            defaultValue: true,
+            yamlPath: ['notifications', 'events', 'onRetryExhausted'],
+        }),
+        booleanSetting({
+            key: 'mcp.enabled',
+            label: 'MCP Enabled',
+            description: 'Enable MCP server exposure.',
+            details: 'Turns MCP server availability on or off for applicable commands/modes.',
+            defaultValue: false,
+            yamlPath: ['mcp', 'enabled'],
+        }),
+        stringSetting({
+            key: 'mcp.transport',
+            label: 'MCP Transport',
+            description: 'Transport protocol used by MCP server.',
+            details: 'Currently only stdio transport is supported.',
+            defaultValue: 'stdio',
+            yamlPath: ['mcp', 'transport'],
+            options: ['stdio'],
+        }),
+        stringSetting({
+            key: 'mcp.authTokenEnv',
+            label: 'MCP Auth Token Env Var',
+            description: 'Optional env var name containing MCP mutation auth token.',
+            details: 'Set to null (or clear in YAML) to disable MCP mutation token checks.',
+            defaultValue: null,
+            yamlPath: ['mcp', 'authTokenEnv'],
+            allowNull: true,
+            minLength: 1,
+        }),
+        numberSetting({
+            key: 'mcp.httpPort',
+            label: 'MCP HTTP Port',
+            description: 'TCP port for embedded MCP HTTP transport.',
+            details: 'Port used when running embedded MCP HTTP/SSE mode.',
+            defaultValue: 3100,
+            yamlPath: ['mcp', 'httpPort'],
+            integer: true,
+            min: 1,
+            max: 65535,
+            step: 1,
+        }),
+        stringSetting({
+            key: 'mcp.httpHost',
+            label: 'MCP HTTP Host',
+            description: 'Bind address for embedded MCP HTTP transport.',
+            details: 'Network interface/address used for MCP HTTP endpoint binding.',
+            defaultValue: '127.0.0.1',
+            yamlPath: ['mcp', 'httpHost'],
+            minLength: 1,
+        }),
+        booleanSetting({
+            key: 'commentCommands.enabled',
+            label: 'Comment Commands Enabled',
+            description: 'Enable issue comment command processing.',
+            details: 'If enabled, `/orch` comment commands are parsed and processed.',
+            defaultValue: true,
+            yamlPath: ['commentCommands', 'enabled'],
+        }),
+        booleanSetting({
+            key: 'commentCommands.requireCollaborator',
+            label: 'Require Collaborator For Commands',
+            description: 'Require collaborator permission for comment commands.',
+            details: 'When enabled, only collaborators can run issue comment commands.',
+            defaultValue: true,
+            yamlPath: ['commentCommands', 'requireCollaborator'],
+        }),
+        jsonSetting({
+            key: 'workflows',
+            label: 'Workflow Definitions',
+            description: 'Named workflow definitions.',
+            details: 'Record of named workflow graphs (steps/roles/agents) used by workflow selection.',
+            defaultValue: {},
+            yamlPath: ['workflows'],
+            normalize: (value) => validateJsonSettingShape(value, WorkflowsOverrideSchema, 'workflows'),
+        }),
+    ];
+}
+//# sourceMappingURL=github.js.map

package/dist/settings/definitions/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/settings/definitions/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,cAAc,GACf,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AAEvB,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;AAClE,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAA;AAC9E,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;AAExD,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,aAAa,CAAC;YACZ,GAAG,EAAE,iBAAiB;YACtB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2DAA2D;YACxE,OAAO,EAAE,6GAA6G;YACtH,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;YAChC,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;gBAClB,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC5F,OAAO,6EAA6E,CAAA;gBACtF,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;SACF,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,mBAAmB;YACxB,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,4FAA4F;YACrG,YAAY,EAAE,wBAAwB;YACtC,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;YAClC,SAAS,EAAE,CAAC;YACZ,GAAG,EAAE,IAAI;SACV,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,sCAAsC;YACnD,OAAO,EAAE,qHAAqH;YAC9H,YAAY,EAAE,GAAG;YACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,qBAAqB,CAAC;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAC;SACR,CAAC;QACF,WAAW,CAAC;YACV,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,qDAAqD;YAClE,OAAO,EAAE,gFAAgF;YACzF,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC;YACnC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,+BAA+B,EAAE,oBAAoB,CAAC;SAC7G,CAAC;QAEF,aAAa,CAAC;YACZ,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,4BAA4B;YACzC,OAAO,EAAE,iHAAiH;YAC1H,YAAY,EAAE,+BAA+B;YAC7C,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC/B,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK;SACf,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,wDAAwD;YACjE,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC;YACrC,SAAS,EAAE,CAAC;SACb,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,kBAAkB;YACvB,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE,gDAAgD;YACzD,YAAY,EAAE,yBAAyB;YACvC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;YACjC,SAAS,EAAE,CAAC;SACb,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,sFAAsF;YAC/F,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC;SAChD,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,qCAAqC;YAC1C,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,0CAA0C;YACnD,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,CAAC;YACvD,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,mCAAmC;YACxC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,oFAAoF;YAC7F,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC;YACrD,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,8BAA8B;YACnC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,iFAAiF;YAC1F,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC;YAChD,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,+BAA+B;YACpC,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,4DAA4D;YACrE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC;YACjD,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QAEF,WAAW,CAAC;YACV,GAAG,EAAE,wBAAwB;YAC7B,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,2EAA2E;YACpF,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACnC,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;YACvC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,mCAAmC,EAAE,wBAAwB,CAAC;SACrH,CAAC;QAEF,cAAc,CAAC;YACb,GAAG,EAAE,mCAAmC;YACxC,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,qCAAqC;YAClD,OAAO,EAAE,4DAA4D;YACrE,YAAY,EAAE,KAAK;YACnB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,cAAc,CAAC;SACtD,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,gCAAgC;YACrC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE,4DAA4D;YACrE,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,WAAW,CAAC;SACnD,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,gCAAgC;YACrC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,wCAAwC;YACrD,OAAO,EAAE,oEAAoE;YAC7E,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,WAAW,CAAC;SACnD,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,kCAAkC;YACvC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,0DAA0D;YACnE,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,aAAa,CAAC;SACrD,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,8BAA8B;YACnC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,6CAA6C;YAC1D,OAAO,EAAE,sDAAsD;YAC/D,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,CAAC;SACjD,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,uCAAuC;YAC5C,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,gDAAgD;YAC7D,OAAO,EAAE,gEAAgE;YACzE,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,kBAAkB,CAAC;SAC1D,CAAC;QAEF,cAAc,CAAC;YACb,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,wEAAwE;YACjF,YAAY,EAAE,KAAK;YACnB,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;SAC7B,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,eAAe;YACpB,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,wCAAwC;YACrD,OAAO,EAAE,8CAA8C;YACvD,YAAY,EAAE,OAAO;YACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC;YAC9B,OAAO,EAAE,CAAC,OAAO,CAAC;SACnB,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,kBAAkB;YACvB,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EAAE,2DAA2D;YACxE,OAAO,EAAE,sEAAsE;YAC/E,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC;YACjC,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,CAAC;SACb,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE,oDAAoD;YAC7D,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;YAC7B,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,+CAA+C;YAC5D,OAAO,EAAE,+DAA+D;YACxE,YAAY,EAAE,WAAW;YACzB,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;YAC7B,SAAS,EAAE,CAAC;SACb,CAAC;QAEF,cAAc,CAAC;YACb,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,gEAAgE;YACzE,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,iBAAiB,EAAE,SAAS,CAAC;SACzC,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,qCAAqC;YAC1C,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,kEAAkE;YAC3E,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SACrD,CAAC;QACF,WAAW,CAAC;YACV,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,6BAA6B;YAC1C,OAAO,EAAE,kFAAkF;YAC3F,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,EAAE,WAAW,CAAC;SAC5F,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/settings/definitions/loop.d.ts

@@ -0,0 +1,3 @@
+import type { SettingDefinition } from '../registry.js';
+export declare function loopDefinitions(): SettingDefinition[];
+//# sourceMappingURL=loop.d.ts.map

package/dist/settings/definitions/loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loop.d.ts","sourceRoot":"","sources":["../../../src/settings/definitions/loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGvD,wBAAgB,eAAe,IAAI,iBAAiB,EAAE,CA8GrD"}

package/dist/settings/definitions/loop.js

@@ -0,0 +1,113 @@
+import { booleanSetting, numberSetting, stringSetting } from '../registry.js';
+export function loopDefinitions() {
+    return [
+        numberSetting({
+            key: 'loop.maxReviewIterations',
+            label: 'Max Review Iterations',
+            description: 'Maximum review correction loops per run.',
+            details: 'Limits how many review-fix-review cycles a run can execute before stopping.',
+            defaultValue: 4,
+            yamlPath: ['loop', 'maxReviewIterations'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'loop.maxTotalAgentPasses',
+            label: 'Max Total Agent Passes',
+            description: 'Hard cap on planner/coder/reviewer passes in one run.',
+            details: 'Caps total planner/coder/reviewer passes across the full run.',
+            defaultValue: 10,
+            yamlPath: ['loop', 'maxTotalAgentPasses'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        booleanSetting({
+            key: 'loop.stopOnPlannerFailure',
+            label: 'Stop On Planner Failure',
+            description: 'Stop run when planner output fails validation.',
+            details: 'If enabled, planner failure ends the run early instead of proceeding.',
+            defaultValue: true,
+            yamlPath: ['loop', 'stopOnPlannerFailure'],
+        }),
+        booleanSetting({
+            key: 'loop.requireVerificationPass',
+            label: 'Require Verification Pass',
+            description: 'Require verify commands to pass before completion.',
+            details: 'If enabled, failed verification blocks completion.',
+            defaultValue: true,
+            yamlPath: ['loop', 'requireVerificationPass'],
+        }),
+        stringSetting({
+            key: 'loop.reviewApprovalKeyword',
+            label: 'Review Approval Keyword',
+            description: 'Reviewer keyword interpreted as approval.',
+            details: 'Expected keyword emitted by reviewer agent for approval.',
+            defaultValue: 'APPROVED',
+            yamlPath: ['loop', 'reviewApprovalKeyword'],
+            minLength: 1,
+        }),
+        stringSetting({
+            key: 'loop.reviewNeedsChangesKeyword',
+            label: 'Review Needs-Changes Keyword',
+            description: 'Reviewer keyword interpreted as changes required.',
+            details: 'Expected keyword emitted by reviewer agent for change requests.',
+            defaultValue: 'CHANGES_REQUIRED',
+            yamlPath: ['loop', 'reviewNeedsChangesKeyword'],
+            minLength: 1,
+        }),
+        booleanSetting({
+            key: 'loop.blockOnAmbiguousReview',
+            label: 'Block On Ambiguous Review',
+            description: 'Block run if review output is ambiguous.',
+            details: 'If enabled, unparseable reviewer output results in blocked status.',
+            defaultValue: true,
+            yamlPath: ['loop', 'blockOnAmbiguousReview'],
+        }),
+        numberSetting({
+            key: 'loop.maxAutoRetries',
+            label: 'Max Auto Retries',
+            description: 'Automatic retry attempts for infrastructure failures.',
+            details: 'Maximum number of automatic retries after transient failures.',
+            defaultValue: 3,
+            yamlPath: ['loop', 'maxAutoRetries'],
+            integer: true,
+            min: 0,
+            step: 1,
+        }),
+        booleanSetting({
+            key: 'loop.decompose',
+            label: 'Enable Decomposition',
+            description: 'Allow issue decomposition into sub-tasks.',
+            details: 'If enabled, eligible issues can be split into dependent sub-tasks.',
+            defaultValue: false,
+            yamlPath: ['loop', 'decompose'],
+        }),
+        numberSetting({
+            key: 'loop.maxSubtasks',
+            label: 'Max Subtasks',
+            description: 'Maximum sub-tasks per decomposition.',
+            details: 'Upper bound for generated decomposition sub-tasks.',
+            defaultValue: 5,
+            yamlPath: ['loop', 'maxSubtasks'],
+            integer: true,
+            min: 1,
+            max: 10,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'loop.maxConcurrentSubtasks',
+            label: 'Max Concurrent Subtasks',
+            description: 'Maximum parallel sub-task executions.',
+            details: 'Upper bound for concurrently running sub-task worktrees.',
+            defaultValue: 3,
+            yamlPath: ['loop', 'maxConcurrentSubtasks'],
+            integer: true,
+            min: 1,
+            max: 10,
+            step: 1,
+        }),
+    ];
+}
+//# sourceMappingURL=loop.js.map

package/dist/settings/definitions/loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loop.js","sourceRoot":"","sources":["../../../src/settings/definitions/loop.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,aAAa,CAAC;YACZ,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,6EAA6E;YACtF,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,+DAA+D;YACxE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,gDAAgD;YAC7D,OAAO,EAAE,uEAAuE;YAChF,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,MAAM,EAAE,sBAAsB,CAAC;SAC3C,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,8BAA8B;YACnC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,oDAAoD;YACjE,OAAO,EAAE,oDAAoD;YAC7D,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,MAAM,EAAE,yBAAyB,CAAC;SAC9C,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE,0DAA0D;YACnE,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC;YAC3C,SAAS,EAAE,CAAC;SACb,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,gCAAgC;YACrC,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,iEAAiE;YAC1E,YAAY,EAAE,kBAAkB;YAChC,QAAQ,EAAE,CAAC,MAAM,EAAE,2BAA2B,CAAC;YAC/C,SAAS,EAAE,CAAC;SACb,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,6BAA6B;YAClC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,0CAA0C;YACvD,OAAO,EAAE,oEAAoE;YAC7E,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,CAAC;SAC7C,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,qBAAqB;YAC1B,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,uDAAuD;YACpE,OAAO,EAAE,+DAA+D;YACxE,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACpC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE,oEAAoE;YAC7E,YAAY,EAAE,KAAK;YACnB,QAAQ,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;SAChC,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,kBAAkB;YACvB,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,sCAAsC;YACnD,OAAO,EAAE,oDAAoD;YAC7D,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,4BAA4B;YACjC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,uCAAuC;YACpD,OAAO,EAAE,0DAA0D;YACnE,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,EAAE;YACP,IAAI,EAAE,CAAC;SACR,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/settings/definitions/observability.d.ts

@@ -0,0 +1,3 @@
+import type { SettingDefinition } from '../registry.js';
+export declare function observabilityDefinitions(): SettingDefinition[];
+//# sourceMappingURL=observability.d.ts.map

package/dist/settings/definitions/observability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../../../src/settings/definitions/observability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGvD,wBAAgB,wBAAwB,IAAI,iBAAiB,EAAE,CAwE9D"}

package/dist/settings/definitions/observability.js

@@ -0,0 +1,74 @@
+import { booleanSetting, numberSetting, stringSetting } from '../registry.js';
+export function observabilityDefinitions() {
+    return [
+        booleanSetting({
+            key: 'metrics.enabled',
+            label: 'Metrics Enabled',
+            description: 'Enable Prometheus metrics export.',
+            details: 'Turns `/metrics` export on or off.',
+            defaultValue: true,
+            yamlPath: ['metrics', 'enabled'],
+        }),
+        numberSetting({
+            key: 'metrics.port',
+            label: 'Metrics Port',
+            description: 'TCP port for Prometheus metrics endpoint.',
+            details: 'Port used when metrics exporter is enabled.',
+            defaultValue: 9090,
+            yamlPath: ['metrics', 'port'],
+            integer: true,
+            min: 1,
+            max: 65535,
+            step: 1,
+        }),
+        stringSetting({
+            key: 'metrics.host',
+            label: 'Metrics Host',
+            description: 'Bind address for Prometheus metrics endpoint.',
+            details: 'Network interface/address used by metrics exporter.',
+            defaultValue: '0.0.0.0',
+            yamlPath: ['metrics', 'host'],
+            minLength: 1,
+        }),
+        booleanSetting({
+            key: 'observability.agentStreaming',
+            label: 'Agent Streaming',
+            description: 'Enable in-flight agent event streaming to TUI/Web.',
+            details: 'Turns live agent event streaming on or off for terminal and web views.',
+            defaultValue: true,
+            yamlPath: ['observability', 'agentStreaming'],
+        }),
+        numberSetting({
+            key: 'observability.eventRetention',
+            label: 'Event Retention',
+            description: 'Maximum in-memory event backlog per run/session.',
+            details: 'Controls event retention window for stream history.',
+            defaultValue: 1000,
+            yamlPath: ['observability', 'eventRetention'],
+            integer: true,
+            min: 100,
+            max: 10000,
+            step: 100,
+        }),
+        booleanSetting({
+            key: 'observability.sessionLogs',
+            label: 'Session Logs Enabled',
+            description: 'Persist interactive agent session logs to disk.',
+            details: 'If enabled, interactive session logs are written and retained.',
+            defaultValue: true,
+            yamlPath: ['observability', 'sessionLogs'],
+        }),
+        numberSetting({
+            key: 'observability.sessionLogRetention',
+            label: 'Session Log Retention (days)',
+            description: 'Retention period for interactive session logs.',
+            details: 'Session logs older than this many days may be deleted by cleanup.',
+            defaultValue: 7,
+            yamlPath: ['observability', 'sessionLogRetention'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+    ];
+}
+//# sourceMappingURL=observability.js.map

package/dist/settings/definitions/observability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../../../src/settings/definitions/observability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE7E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,cAAc,CAAC;YACb,GAAG,EAAE,iBAAiB;YACtB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,mCAAmC;YAChD,OAAO,EAAE,oCAAoC;YAC7C,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;SACjC,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,2CAA2C;YACxD,OAAO,EAAE,6CAA6C;YACtD,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC7B,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,+CAA+C;YAC5D,OAAO,EAAE,qDAAqD;YAC9D,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC7B,SAAS,EAAE,CAAC;SACb,CAAC;QAEF,cAAc,CAAC;YACb,GAAG,EAAE,8BAA8B;YACnC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,oDAAoD;YACjE,OAAO,EAAE,wEAAwE;YACjF,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;SAC9C,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,8BAA8B;YACnC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,kDAAkD;YAC/D,OAAO,EAAE,qDAAqD;YAC9D,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;YAC7C,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,GAAG;SACV,CAAC;QACF,cAAc,CAAC;YACb,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,iDAAiD;YAC9D,OAAO,EAAE,gEAAgE;YACzE,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,eAAe,EAAE,aAAa,CAAC;SAC3C,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,mCAAmC;YACxC,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,gDAAgD;YAC7D,OAAO,EAAE,mEAAmE;YAC5E,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,CAAC,eAAe,EAAE,qBAAqB,CAAC;YAClD,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;KACH,CAAA;AACH,CAAC"}

package/dist/settings/definitions/security.d.ts

@@ -0,0 +1,3 @@
+import type { SettingDefinition } from '../registry.js';
+export declare function securityDefinitions(): SettingDefinition[];
+//# sourceMappingURL=security.d.ts.map

package/dist/settings/definitions/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/settings/definitions/security.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAa,iBAAiB,EAAgB,MAAM,gBAAgB,CAAA;AAYhF,wBAAgB,mBAAmB,IAAI,iBAAiB,EAAE,CAwGzD"}

package/dist/settings/definitions/security.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+import { CostPricingModelSchema, SubscriptionMeteredSchema, WorkerProfileSchema, } from '../../config/schema.js';
+import { jsonSetting, numberSetting, stringSetting, validateJsonSettingShape, } from '../registry.js';
+const CostPricingModelsOverrideSchema = z.record(CostPricingModelSchema);
+const SubscriptionMeteredOverrideSchema = SubscriptionMeteredSchema;
+const WorkerProfilesOverrideSchema = z.record(WorkerProfileSchema);
+export function securityDefinitions() {
+    return [
+        numberSetting({
+            key: 'security.maxChangedFiles',
+            label: 'Max Changed Files',
+            description: 'Diff guard threshold for changed files.',
+            details: 'Runs are blocked when changed-file count exceeds this threshold.',
+            defaultValue: 50,
+            yamlPath: ['security', 'maxChangedFiles'],
+            integer: true,
+            min: 1,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'security.maxChangedLines',
+            label: 'Max Changed Lines',
+            description: 'Diff guard threshold for changed lines.',
+            details: 'Runs are blocked when changed-line count exceeds this threshold.',
+            defaultValue: 5000,
+            yamlPath: ['security', 'maxChangedLines'],
+            integer: true,
+            min: 1,
+            step: 50,
+        }),
+        numberSetting({
+            key: 'security.maxDailyCostUsd',
+            label: 'Daily Cost Budget (USD)',
+            description: 'Maximum allowed spend per UTC day before new runs are blocked.',
+            details: 'Sets the global daily spend cap for pay-per-use mode.',
+            defaultValue: 50,
+            yamlPath: ['security', 'maxDailyCostUsd'],
+            integer: false,
+            min: 0.01,
+            step: 1,
+        }),
+        numberSetting({
+            key: 'security.maxCostPerRunUsd',
+            label: 'Per-Run Cost Budget (USD)',
+            description: 'Maximum allowed spend for a single run before it is blocked.',
+            details: 'Sets the per-issue run cost ceiling for pay-per-use mode.',
+            defaultValue: 10,
+            yamlPath: ['security', 'maxCostPerRunUsd'],
+            integer: false,
+            min: 0.01,
+            step: 0.5,
+        }),
+        stringSetting({
+            key: 'cost.model',
+            label: 'Cost Model',
+            description: 'Cost enforcement model.',
+            details: 'pay-per-use enforces spend caps; subscription is advisory-only; subscription-metered tracks advisory spend with optional enforcement.',
+            defaultValue: 'pay-per-use',
+            yamlPath: ['cost', 'model'],
+            options: ['pay-per-use', 'subscription', 'subscription-metered'],
+        }),
+        jsonSetting({
+            key: 'cost.subscriptionMetered',
+            label: 'Subscription Metered Options',
+            description: 'Warning and optional enforcement controls for subscription-metered mode.',
+            details: 'advisoryThresholdUsd logs warnings; enforcePerRunLimit/enforceDailyLimit turn security caps into hard blocks.',
+            defaultValue: {
+                advisoryThresholdUsd: null,
+                enforcePerRunLimit: false,
+                enforceDailyLimit: false,
+            },
+            yamlPath: ['cost', 'subscriptionMetered'],
+            normalize: (value) => validateJsonSettingShape(value, SubscriptionMeteredOverrideSchema, 'cost.subscriptionMetered'),
+        }),
+        stringSetting({
+            key: 'cost.pricing.defaultModel',
+            label: 'Default Pricing Model',
+            description: 'Fallback model key for pricing lookups.',
+            details: 'Used when a worker profile does not specify a pricing model.',
+            defaultValue: 'default',
+            yamlPath: ['cost', 'pricing', 'defaultModel'],
+            minLength: 1,
+        }),
+        jsonSetting({
+            key: 'cost.pricing.models',
+            label: 'Pricing Models Map',
+            description: 'Model-specific pricing table.',
+            details: 'Record keyed by model name with token/minute pricing values.',
+            defaultValue: {},
+            yamlPath: ['cost', 'pricing', 'models'],
+            normalize: (value) => validateJsonSettingShape(value, CostPricingModelsOverrideSchema, 'cost.pricing.models'),
+        }),
+        jsonSetting({
+            key: 'workerProfiles',
+            label: 'Worker Profiles',
+            description: 'Global worker profile definitions.',
+            details: 'Record of worker profile definitions keyed by profile name.',
+            defaultValue: {},
+            yamlPath: ['workerProfiles'],
+            sensitive: true,
+            normalize: (value) => validateJsonSettingShape(value, WorkerProfilesOverrideSchema, 'workerProfiles'),
+            sanitizeForDisplay: (value) => redactWorkerProfiles(value),
+        }),
+    ];
+}
+function redactWorkerProfiles(value) {
+    if (!isRecord(value)) {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([profileName, profile]) => {
+        if (!isRecord(profile) || !isRecord(profile['env'])) {
+            return [profileName, profile];
+        }
+        const redactedEnv = Object.fromEntries(Object.keys(profile['env']).map((envKey) => [envKey, '[redacted]']));
+        return [profileName, { ...profile, env: redactedEnv }];
+    }));
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=security.js.map

package/dist/settings/definitions/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/settings/definitions/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAE/B,OAAO,EACL,WAAW,EACX,aAAa,EACb,aAAa,EACb,wBAAwB,GACzB,MAAM,gBAAgB,CAAA;AAEvB,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;AACxE,MAAM,iCAAiC,GAAG,yBAAyB,CAAA;AACnE,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAElE,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,aAAa,CAAC;YACZ,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,kEAAkE;YAC3E,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,kEAAkE;YAC3E,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,CAAC;YACN,IAAI,EAAE,EAAE;SACT,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,gEAAgE;YAC7E,OAAO,EAAE,uDAAuD;YAChE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,UAAU,EAAE,iBAAiB,CAAC;YACzC,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,CAAC;SACR,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,8DAA8D;YAC3E,OAAO,EAAE,2DAA2D;YACpE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC;YAC1C,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,GAAG;SACV,CAAC;QAEF,aAAa,CAAC;YACZ,GAAG,EAAE,YAAY;YACjB,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,uIAAuI;YAChJ,YAAY,EAAE,aAAa;YAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,OAAO,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,sBAAsB,CAAC;SACjE,CAAC;QACF,WAAW,CAAC;YACV,GAAG,EAAE,0BAA0B;YAC/B,KAAK,EAAE,8BAA8B;YACrC,WAAW,EAAE,0EAA0E;YACvF,OAAO,EAAE,+GAA+G;YACxH,YAAY,EAAE;gBACZ,oBAAoB,EAAE,IAAI;gBAC1B,kBAAkB,EAAE,KAAK;gBACzB,iBAAiB,EAAE,KAAK;aACzB;YACD,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;YACzC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAC5C,KAAK,EACL,iCAAiC,EACjC,0BAA0B,CAC3B;SACF,CAAC;QACF,aAAa,CAAC;YACZ,GAAG,EAAE,2BAA2B;YAChC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,yCAAyC;YACtD,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,SAAS;YACvB,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC;YAC7C,SAAS,EAAE,CAAC;SACb,CAAC;QACF,WAAW,CAAC;YACV,GAAG,EAAE,qBAAqB;YAC1B,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;YACvC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,+BAA+B,EAAE,qBAAqB,CAAC;SAC9G,CAAC;QAEF,WAAW,CAAC;YACV,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,oCAAoC;YACjD,OAAO,EAAE,6DAA6D;YACtE,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;YAC5B,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,4BAA4B,EAAE,gBAAgB,CAAC;YACrG,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC;SAC3D,CAAC;KACH,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgB;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE;QACnD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC/B,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CACpE,CAAA;QACD,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACxD,CAAC,CAAC,CACH,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC"}