octoflow-core 1.0.0

package/dist/config/config.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/config/config.ts"],
+  "sourcesContent": ["import type { BackendName, ProxyOptions } from '../domain/core-client.js';\nimport type { AgentCard } from '../domain/core-task.js';\nimport { cloneValue } from '../utils/clone.js';\nimport { isSafeKey } from '../utils/safe-key.js';\nimport { loadConfig, normalizeApiKeys } from './config-load.js';\nimport type {\n  ResolvedOctoFlowConfig,\n  ResolvedOctoFlowProfile,\n} from './config-shapes.js';\nimport {\n  DEFAULT_AGENT_CARD,\n  DEFAULT_PROFILES,\n  DEFAULT_SERVER_CONFIG,\n  mergeProfile,\n} from './defaults.js';\nexport type {\n  BackendOverrides,\n  FrameworkWorkspaceConfig,\n  SerializedAgentSkillsConfig,\n  SerializedLoopConfig,\n  SerializedMcpOptions,\n  SerializedMcpServer,\n  SerializedMcpServerConfig,\n  SerializedSkillConfig,\n  SerializedTaskConfig,\n  SerializedToolConfig,\n  SerializedToolDefinition,\n} from '../domain/config-contracts.js';\nexport {\n  type ApiKeyConfig,\n  clearConfigCache,\n  loadConfig,\n  type LoadConfigOptions,\n  normalizeApiKeys,\n} from './config-load.js';\nexport type {\n  OctoFlowAgentCardVisibility,\n  OctoFlowConfig,\n  OctoFlowCredentialsConfig,\n  OctoFlowCredentialStrategy,\n  OctoFlowDefaults,\n  OctoFlowFilesystemConfig,\n  OctoFlowNetworkMode,\n  OctoFlowProfile,\n  OctoFlowProfileName,\n  OctoFlowRuntimeConfig,\n  OctoFlowRuntimeTarget,\n  OctoFlowSandboxMode,\n  OctoFlowSecurityConfig,\n  OctoFlowServerAuthConfig,\n  OctoFlowServerConfig,\n  OctoFlowServerRateLimitConfig,\n  OctoFlowServerTlsConfig,\n  OctoFlowSessionConfig,\n  ResolvedOctoFlowConfig,\n  ResolvedOctoFlowProfile,\n  ResolvedOctoFlowServerConfig,\n  SerializedRoutingConfig,\n} from './config-shapes.js';\nexport { resolveServerConfig } from './config-shapes.js';\nexport {\n  CONFIG_TEMPLATE,\n  DEFAULT_PRIORITY,\n  mergeDefaults,\n  mergeToolConfigs,\n} from './defaults.js';\n\nconst API_KEY_ENV_ALIASES: Partial<Record<BackendName, readonly string[]>> = {\n  'anthropic-api': ['ANTHROPIC_API_KEY', 'ANTHROPIC_API_HOST_KEY'],\n  'gemini-api': ['GEMINI_API_KEY', 'GOOGLE_API_KEY'],\n  'openai-api': ['OPENAI_API_KEY', 'OPENAI_API_HOST_KEY'],\n};\n\nconst HOST_ENV_ALIASES: Partial<Record<BackendName, readonly string[]>> = {\n  'anthropic-api': ['ANTHROPIC_BASE_URL', 'ANTHROPIC_HOST'],\n  'gemini-api': ['GEMINI_BASE_URL', 'GEMINI_HOST'],\n  'openai-api': ['OPENAI_BASE_URL', 'OPENAI_HOST'],\n};\n\nfunction firstEnvValue(keys: readonly string[]): string | undefined {\n  for (const key of keys) {\n    const value = process.env[key];\n    if (typeof value === 'string' && value.length > 0) return value;\n  }\n  return undefined;\n}\n\nfunction resolveEnvApiKeys(): Partial<Record<BackendName, string>> {\n  const apiKeys: Partial<Record<BackendName, string>> = {};\n  for (const [backend, keys] of Object.entries(API_KEY_ENV_ALIASES) as Array<\n    [BackendName, readonly string[]]\n  >) {\n    const value = firstEnvValue(keys);\n    if (value) apiKeys[backend] = value;\n  }\n  return apiKeys;\n}\n\nfunction resolveEnvBackendOverrides(): Partial<\n  Record<BackendName, { host: string }>\n> {\n  const backends: Partial<Record<BackendName, { host: string }>> = {};\n  for (const [backend, keys] of Object.entries(HOST_ENV_ALIASES) as Array<\n    [BackendName, readonly string[]]\n  >) {\n    const host = firstEnvValue(keys);\n    if (host) backends[backend] = { host };\n  }\n  return backends;\n}\n\nfunction mergeEnvBackendOverrides(\n  profile: ResolvedOctoFlowProfile,\n  envBackends: Partial<Record<BackendName, { host: string }>>\n): ResolvedOctoFlowProfile {\n  if (Object.keys(envBackends).length === 0) return profile;\n\n  const backends = { ...profile.backends };\n  for (const [backend, envOverride] of Object.entries(envBackends) as Array<\n    [BackendName, { host: string }]\n  >) {\n    backends[backend] = {\n      ...envOverride,\n      ...(backends[backend] ?? {}),\n    };\n  }\n\n  return { ...profile, backends };\n}\n\nexport function resolveConfig(config = loadConfig()): ResolvedOctoFlowConfig {\n  const fileConfig = config ?? null;\n  const envApiKeys = resolveEnvApiKeys();\n  const envBackends = resolveEnvBackendOverrides();\n  const defaultProfileName = fileConfig?.defaultProfile ?? 'local-trusted';\n  const profileNames = new Set<string>([\n    ...Object.keys(DEFAULT_PROFILES),\n    ...Object.keys(fileConfig?.profiles ?? {}),\n    defaultProfileName,\n  ]);\n\n  const profiles: Record<string, ResolvedOctoFlowProfile> = {};\n  for (const profileName of profileNames) {\n    if (!isSafeKey(profileName)) continue;\n    const profile = mergeProfile(\n      profileName,\n      fileConfig,\n      fileConfig?.profiles?.[profileName]\n    );\n    profiles[profileName] = mergeEnvBackendOverrides(profile, envBackends);\n  }\n\n  return {\n    defaultProfile: defaultProfileName,\n    agentSkills: fileConfig?.agentSkills\n      ? {\n          ...fileConfig.agentSkills,\n          additionalPaths: fileConfig.agentSkills.additionalPaths\n            ? [...fileConfig.agentSkills.additionalPaths]\n            : undefined,\n          disabled: fileConfig.agentSkills.disabled\n            ? [...fileConfig.agentSkills.disabled]\n            : undefined,\n        }\n      : undefined,\n    frameworkWorkspace: fileConfig?.frameworkWorkspace\n      ? { ...fileConfig.frameworkWorkspace }\n      : undefined,\n    apiKeys: { ...envApiKeys, ...normalizeApiKeys(fileConfig?.apiKeys) },\n    agentCard: { ...DEFAULT_AGENT_CARD, ...(fileConfig?.agentCard ?? {}) },\n    server: {\n      a2aVersion:\n        fileConfig?.server?.a2aVersion ?? DEFAULT_SERVER_CONFIG.a2aVersion,\n      agentCardVisibility:\n        fileConfig?.server?.agentCardVisibility ??\n        DEFAULT_SERVER_CONFIG.agentCardVisibility,\n      auth: {\n        mode: fileConfig?.server?.auth?.mode ?? DEFAULT_SERVER_CONFIG.auth.mode,\n        bearerTokens:\n          fileConfig?.server?.auth?.bearerTokens ??\n          DEFAULT_SERVER_CONFIG.auth.bearerTokens,\n        headerName:\n          fileConfig?.server?.auth?.headerName ??\n          DEFAULT_SERVER_CONFIG.auth.headerName,\n      },\n      baseUrl: fileConfig?.server?.baseUrl ?? DEFAULT_SERVER_CONFIG.baseUrl,\n      cacheControl:\n        fileConfig?.server?.cacheControl ?? DEFAULT_SERVER_CONFIG.cacheControl,\n      host: fileConfig?.server?.host ?? DEFAULT_SERVER_CONFIG.host,\n      maxBodyBytes:\n        fileConfig?.server?.maxBodyBytes ?? DEFAULT_SERVER_CONFIG.maxBodyBytes,\n      port: fileConfig?.server?.port ?? DEFAULT_SERVER_CONFIG.port,\n      rateLimit: {\n        enabled:\n          fileConfig?.server?.rateLimit?.enabled ??\n          DEFAULT_SERVER_CONFIG.rateLimit.enabled,\n        windowMs:\n          fileConfig?.server?.rateLimit?.windowMs ??\n          DEFAULT_SERVER_CONFIG.rateLimit.windowMs,\n        maxRequests:\n          fileConfig?.server?.rateLimit?.maxRequests ??\n          DEFAULT_SERVER_CONFIG.rateLimit.maxRequests,\n        maxConcurrent:\n          fileConfig?.server?.rateLimit?.maxConcurrent ??\n          DEFAULT_SERVER_CONFIG.rateLimit.maxConcurrent,\n        ipv6SubnetBits:\n          fileConfig?.server?.rateLimit?.ipv6SubnetBits ??\n          DEFAULT_SERVER_CONFIG.rateLimit.ipv6SubnetBits,\n      },\n      tls: fileConfig?.server?.tls\n        ? {\n            caPath: fileConfig.server.tls.caPath,\n            certPath: fileConfig.server.tls.certPath,\n            keyPath: fileConfig.server.tls.keyPath,\n            passphrase: fileConfig.server.tls.passphrase,\n            requestCert: fileConfig.server.tls.requestCert ?? true,\n            rejectUnauthorized:\n              fileConfig.server.tls.rejectUnauthorized ?? true,\n          }\n        : DEFAULT_SERVER_CONFIG.tls,\n    },\n    profiles,\n  };\n}\n\nexport function resolveProfile(\n  profileName?: string,\n  config = resolveConfig()\n): ResolvedOctoFlowProfile {\n  const key = profileName ?? config.defaultProfile;\n  const profile =\n    config.profiles[key] ?? config.profiles[config.defaultProfile];\n  if (!profile) throw new Error(`Profile \"${key}\" not found in config`);\n  return cloneValue(profile);\n}\n\nexport function mergeWithFileConfig(opts: ProxyOptions): ProxyOptions {\n  const configInput =\n    opts.config ??\n    loadConfig({\n      ignoreFileConfig: opts.ignoreFileConfig,\n    });\n  const config = resolveConfig(configInput);\n  const profile = resolveProfile(opts.profile, config);\n  const hasResolvedApiKeys = Object.keys(config.apiKeys).length > 0;\n  const hasResolvedBackends = Object.keys(profile.backends).length > 0;\n\n  if (!configInput) {\n    if (!opts.apiKeys && !hasResolvedApiKeys && !hasResolvedBackends) {\n      return opts;\n    }\n    return {\n      ...opts,\n      apiKeys: { ...config.apiKeys, ...normalizeApiKeys(opts.apiKeys) },\n      backends:\n        opts.backends ?? (hasResolvedBackends ? profile.backends : undefined),\n    };\n  }\n\n  const mcpServers =\n    Object.keys(profile.mcpServers).length > 0 ? profile.mcpServers : undefined;\n\n  const tools =\n    profile.tools.definitions?.length ||\n    profile.tools.servers?.length ||\n    profile.tools.allowedTools?.length\n      ? profile.tools\n      : undefined;\n\n  return {\n    config: opts.config,\n    ignoreFileConfig: opts.ignoreFileConfig,\n    agentType: opts.agentType ?? profile.defaults.agentType,\n    priority: opts.priority ?? profile.priority,\n    backendType: opts.backendType ?? profile.defaults.backendType,\n    llmProvider: opts.llmProvider ?? profile.defaults.llmProvider,\n    apiKeys: { ...config.apiKeys, ...normalizeApiKeys(opts.apiKeys) },\n    profile: opts.profile ?? config.defaultProfile,\n    model: opts.model ?? profile.defaults.model,\n    systemPrompt: opts.systemPrompt ?? profile.defaults.systemPrompt,\n    cwd: opts.cwd ?? profile.defaults.cwd ?? profile.runtime.workspace,\n    timeoutMs: opts.timeoutMs ?? profile.defaults.timeoutMs,\n    retries: opts.retries ?? profile.defaults.retries,\n    worktree: opts.worktree ?? profile.defaults.worktree,\n    env: opts.env,\n    routing: opts.routing ?? configInput.routing,\n    loop:\n      opts.loop ??\n      (profile.defaults.loop as Record<string, unknown> | undefined),\n    tasks:\n      opts.tasks ??\n      (profile.defaults.tasks as Record<string, unknown> | undefined),\n    mcpConfigPath: opts.mcpConfigPath ?? profile.defaults.mcpConfigPath,\n    mcpServers: opts.mcpServers ?? mcpServers,\n    mcpOptions: opts.mcpOptions ?? configInput.mcpOptions,\n    tools: opts.tools ?? tools,\n    skills: opts.skills ?? configInput.skills,\n    backends:\n      opts.backends ??\n      (Object.keys(profile.backends).length > 0 ? profile.backends : undefined),\n  };\n}\n\nexport function resolveAgentCardConfig(\n  config = resolveConfig()\n): Partial<AgentCard> {\n  return cloneValue(config.agentCard);\n}\n"],
+  "mappings": "AAEA,SAAS,kBAAkB;AAC3B,SAAS,iBAAiB;AAC1B,SAAS,YAAY,wBAAwB;AAK7C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP;AAAA,EAEE;AAAA,EACA,cAAAA;AAAA,EAEA,oBAAAC;AAAA,OACK;AAyBP,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,sBAAuE;AAAA,EAC3E,iBAAiB,CAAC,qBAAqB,wBAAwB;AAAA,EAC/D,cAAc,CAAC,kBAAkB,gBAAgB;AAAA,EACjD,cAAc,CAAC,kBAAkB,qBAAqB;AACxD;AAEA,MAAM,mBAAoE;AAAA,EACxE,iBAAiB,CAAC,sBAAsB,gBAAgB;AAAA,EACxD,cAAc,CAAC,mBAAmB,aAAa;AAAA,EAC/C,cAAc,CAAC,mBAAmB,aAAa;AACjD;AAEA,SAAS,cAAc,MAA6C;AAClE,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,QAAQ,IAAI,GAAG;AAC7B,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,SAAS,oBAA0D;AACjE,QAAM,UAAgD,CAAC;AACvD,aAAW,CAAC,SAAS,IAAI,KAAK,OAAO,QAAQ,mBAAmB,GAE7D;AACD,UAAM,QAAQ,cAAc,IAAI;AAChC,QAAI,MAAO,SAAQ,OAAO,IAAI;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,6BAEP;AACA,QAAM,WAA2D,CAAC;AAClE,aAAW,CAAC,SAAS,IAAI,KAAK,OAAO,QAAQ,gBAAgB,GAE1D;AACD,UAAM,OAAO,cAAc,IAAI;AAC/B,QAAI,KAAM,UAAS,OAAO,IAAI,EAAE,KAAK;AAAA,EACvC;AACA,SAAO;AACT;AAEA,SAAS,yBACP,SACA,aACyB;AACzB,MAAI,OAAO,KAAK,WAAW,EAAE,WAAW,EAAG,QAAO;AAElD,QAAM,WAAW,EAAE,GAAG,QAAQ,SAAS;AACvC,aAAW,CAAC,SAAS,WAAW,KAAK,OAAO,QAAQ,WAAW,GAE5D;AACD,aAAS,OAAO,IAAI;AAAA,MAClB,GAAG;AAAA,MACH,GAAI,SAAS,OAAO,KAAK,CAAC;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO,EAAE,GAAG,SAAS,SAAS;AAChC;AAEO,SAAS,cAAc,SAAS,WAAW,GAA2B;AAC3E,QAAM,aAAa,UAAU;AAC7B,QAAM,aAAa,kBAAkB;AACrC,QAAM,cAAc,2BAA2B;AAC/C,QAAM,qBAAqB,YAAY,kBAAkB;AACzD,QAAM,eAAe,oBAAI,IAAY;AAAA,IACnC,GAAG,OAAO,KAAK,gBAAgB;AAAA,IAC/B,GAAG,OAAO,KAAK,YAAY,YAAY,CAAC,CAAC;AAAA,IACzC;AAAA,EACF,CAAC;AAED,QAAM,WAAoD,CAAC;AAC3D,aAAW,eAAe,cAAc;AACtC,QAAI,CAAC,UAAU,WAAW,EAAG;AAC7B,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,MACA,YAAY,WAAW,WAAW;AAAA,IACpC;AACA,aAAS,WAAW,IAAI,yBAAyB,SAAS,WAAW;AAAA,EACvE;AAEA,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,aAAa,YAAY,cACrB;AAAA,MACE,GAAG,WAAW;AAAA,MACd,iBAAiB,WAAW,YAAY,kBACpC,CAAC,GAAG,WAAW,YAAY,eAAe,IAC1C;AAAA,MACJ,UAAU,WAAW,YAAY,WAC7B,CAAC,GAAG,WAAW,YAAY,QAAQ,IACnC;AAAA,IACN,IACA;AAAA,IACJ,oBAAoB,YAAY,qBAC5B,EAAE,GAAG,WAAW,mBAAmB,IACnC;AAAA,IACJ,SAAS,EAAE,GAAG,YAAY,GAAG,iBAAiB,YAAY,OAAO,EAAE;AAAA,IACnE,WAAW,EAAE,GAAG,oBAAoB,GAAI,YAAY,aAAa,CAAC,EAAG;AAAA,IACrE,QAAQ;AAAA,MACN,YACE,YAAY,QAAQ,cAAc,sBAAsB;AAAA,MAC1D,qBACE,YAAY,QAAQ,uBACpB,sBAAsB;AAAA,MACxB,MAAM;AAAA,QACJ,MAAM,YAAY,QAAQ,MAAM,QAAQ,sBAAsB,KAAK;AAAA,QACnE,cACE,YAAY,QAAQ,MAAM,gBAC1B,sBAAsB,KAAK;AAAA,QAC7B,YACE,YAAY,QAAQ,MAAM,cAC1B,sBAAsB,KAAK;AAAA,MAC/B;AAAA,MACA,SAAS,YAAY,QAAQ,WAAW,sBAAsB;AAAA,MAC9D,cACE,YAAY,QAAQ,gBAAgB,sBAAsB;AAAA,MAC5D,MAAM,YAAY,QAAQ,QAAQ,sBAAsB;AAAA,MACxD,cACE,YAAY,QAAQ,gBAAgB,sBAAsB;AAAA,MAC5D,MAAM,YAAY,QAAQ,QAAQ,sBAAsB;AAAA,MACxD,WAAW;AAAA,QACT,SACE,YAAY,QAAQ,WAAW,WAC/B,sBAAsB,UAAU;AAAA,QAClC,UACE,YAAY,QAAQ,WAAW,YAC/B,sBAAsB,UAAU;AAAA,QAClC,aACE,YAAY,QAAQ,WAAW,eAC/B,sBAAsB,UAAU;AAAA,QAClC,eACE,YAAY,QAAQ,WAAW,iBAC/B,sBAAsB,UAAU;AAAA,QAClC,gBACE,YAAY,QAAQ,WAAW,kBAC/B,sBAAsB,UAAU;AAAA,MACpC;AAAA,MACA,KAAK,YAAY,QAAQ,MACrB;AAAA,QACE,QAAQ,WAAW,OAAO,IAAI;AAAA,QAC9B,UAAU,WAAW,OAAO,IAAI;AAAA,QAChC,SAAS,WAAW,OAAO,IAAI;AAAA,QAC/B,YAAY,WAAW,OAAO,IAAI;AAAA,QAClC,aAAa,WAAW,OAAO,IAAI,eAAe;AAAA,QAClD,oBACE,WAAW,OAAO,IAAI,sBAAsB;AAAA,MAChD,IACA,sBAAsB;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,eACd,aACA,SAAS,cAAc,GACE;AACzB,QAAM,MAAM,eAAe,OAAO;AAClC,QAAM,UACJ,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,OAAO,cAAc;AAC/D,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,YAAY,GAAG,uBAAuB;AACpE,SAAO,WAAW,OAAO;AAC3B;AAEO,SAAS,oBAAoB,MAAkC;AACpE,QAAM,cACJ,KAAK,UACL,WAAW;AAAA,IACT,kBAAkB,KAAK;AAAA,EACzB,CAAC;AACH,QAAM,SAAS,cAAc,WAAW;AACxC,QAAM,UAAU,eAAe,KAAK,SAAS,MAAM;AACnD,QAAM,qBAAqB,OAAO,KAAK,OAAO,OAAO,EAAE,SAAS;AAChE,QAAM,sBAAsB,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS;AAEnE,MAAI,CAAC,aAAa;AAChB,QAAI,CAAC,KAAK,WAAW,CAAC,sBAAsB,CAAC,qBAAqB;AAChE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS,EAAE,GAAG,OAAO,SAAS,GAAG,iBAAiB,KAAK,OAAO,EAAE;AAAA,MAChE,UACE,KAAK,aAAa,sBAAsB,QAAQ,WAAW;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,aACJ,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,IAAI,QAAQ,aAAa;AAEpE,QAAM,QACJ,QAAQ,MAAM,aAAa,UAC3B,QAAQ,MAAM,SAAS,UACvB,QAAQ,MAAM,cAAc,SACxB,QAAQ,QACR;AAEN,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,kBAAkB,KAAK;AAAA,IACvB,WAAW,KAAK,aAAa,QAAQ,SAAS;AAAA,IAC9C,UAAU,KAAK,YAAY,QAAQ;AAAA,IACnC,aAAa,KAAK,eAAe,QAAQ,SAAS;AAAA,IAClD,aAAa,KAAK,eAAe,QAAQ,SAAS;AAAA,IAClD,SAAS,EAAE,GAAG,OAAO,SAAS,GAAG,iBAAiB,KAAK,OAAO,EAAE;AAAA,IAChE,SAAS,KAAK,WAAW,OAAO;AAAA,IAChC,OAAO,KAAK,SAAS,QAAQ,SAAS;AAAA,IACtC,cAAc,KAAK,gBAAgB,QAAQ,SAAS;AAAA,IACpD,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,QAAQ,QAAQ;AAAA,IACzD,WAAW,KAAK,aAAa,QAAQ,SAAS;AAAA,IAC9C,SAAS,KAAK,WAAW,QAAQ,SAAS;AAAA,IAC1C,UAAU,KAAK,YAAY,QAAQ,SAAS;AAAA,IAC5C,KAAK,KAAK;AAAA,IACV,SAAS,KAAK,WAAW,YAAY;AAAA,IACrC,MACE,KAAK,QACJ,QAAQ,SAAS;AAAA,IACpB,OACE,KAAK,SACJ,QAAQ,SAAS;AAAA,IACpB,eAAe,KAAK,iBAAiB,QAAQ,SAAS;AAAA,IACtD,YAAY,KAAK,cAAc;AAAA,IAC/B,YAAY,KAAK,cAAc,YAAY;AAAA,IAC3C,OAAO,KAAK,SAAS;AAAA,IACrB,QAAQ,KAAK,UAAU,YAAY;AAAA,IACnC,UACE,KAAK,aACJ,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,IAAI,QAAQ,WAAW;AAAA,EACnE;AACF;AAEO,SAAS,uBACd,SAAS,cAAc,GACH;AACpB,SAAO,WAAW,OAAO,SAAS;AACpC;",
+  "names": ["loadConfig", "normalizeApiKeys"]
+}

package/dist/config/defaults.d.ts

@@ -0,0 +1,14 @@
+import type { BackendName } from '../domain/core-client.js';
+import type { AgentCard } from '../domain/core-task.js';
+import type { OctoFlowConfig, OctoFlowDefaults, OctoFlowProfile, OctoFlowProfileName, ResolvedOctoFlowProfile, ResolvedOctoFlowServerConfig, SerializedToolConfig } from './config.js';
+export declare const DEFAULT_PRIORITY: readonly BackendName[];
+export declare const DEFAULT_ALLOWED_ENV_VARS: string[];
+export declare const DEFAULT_DENY_ENV_VARS: string[];
+export declare const DEFAULT_SERVER_CONFIG: ResolvedOctoFlowServerConfig;
+export declare const DEFAULT_AGENT_CARD: Partial<AgentCard>;
+export declare const DEFAULT_PROFILES: Record<OctoFlowProfileName, ResolvedOctoFlowProfile>;
+export declare function mergeDefaults(base: OctoFlowDefaults, override?: OctoFlowDefaults): OctoFlowDefaults;
+export declare function mergeToolConfigs(base: SerializedToolConfig, override?: SerializedToolConfig): SerializedToolConfig;
+export declare function mergeProfile(name: string, globalConfig: OctoFlowConfig | null, override?: OctoFlowProfile): ResolvedOctoFlowProfile;
+export declare const CONFIG_TEMPLATE: OctoFlowConfig;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/config/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAErB,eAAO,MAAM,gBAAgB,EAAE,SAAS,WAAW,EAWxC,CAAC;AAGZ,eAAO,MAAM,wBAAwB,UAIpC,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAKjC,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,4BAoBnC,CAAC;AAEF,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAYjD,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CACnC,mBAAmB,EACnB,uBAAuB,CAiIxB,CAAC;AAEF,wBAAgB,aAAa,CAC3B,IAAI,EAAE,gBAAgB,EACtB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CAElB;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,CAAC,EAAE,oBAAoB,GAC9B,oBAAoB,CAuBtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,cAAc,GAAG,IAAI,EACnC,QAAQ,CAAC,EAAE,eAAe,GACzB,uBAAuB,CAiFzB;AAED,eAAO,MAAM,eAAe,EAAE,cAiF7B,CAAC"}

package/dist/config/defaults.js

@@ -0,0 +1,369 @@
+import { resolvePriorityFilters } from "../domain/backend-runtime.js";
+const DEFAULT_PRIORITY = Object.freeze([
+  "claude-code-cli",
+  "codex-cli",
+  "cursor-cli",
+  "anthropic-api",
+  "gemini-api",
+  "openai-api",
+  "vercel-ai:anthropic",
+  "vercel-ai:openai",
+  "vercel-ai:google",
+  "ollama"
+]);
+const DEFAULT_ALLOWED_ENV_VARS = [
+  "PATH",
+  "HOME",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "USER",
+  "LOGNAME",
+  "USERNAME",
+  "SYSTEMROOT",
+  "COMSPEC",
+  "PATHEXT",
+  "WINDIR"
+];
+const DEFAULT_DENY_ENV_VARS = [
+  "AWS_*",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "SSH_AUTH_SOCK"
+];
+const DEFAULT_SERVER_CONFIG = {
+  a2aVersion: "1.0",
+  agentCardVisibility: "public",
+  auth: {
+    mode: "none",
+    bearerTokens: [],
+    headerName: "authorization"
+  },
+  cacheControl: "public, max-age=300",
+  host: "127.0.0.1",
+  maxBodyBytes: 1048576,
+  port: 4400,
+  rateLimit: {
+    enabled: true,
+    windowMs: 6e4,
+    maxRequests: 120,
+    maxConcurrent: 20,
+    ipv6SubnetBits: 64
+  },
+  tls: void 0
+};
+const DEFAULT_AGENT_CARD = {
+  name: "octoflow-core",
+  description: "Standalone A2A-native bridge for local AI CLIs and provider APIs.",
+  protocolVersion: "1.0",
+  defaultInputModes: ["text/plain"],
+  defaultOutputModes: ["text/plain"],
+  capabilities: {
+    streaming: true,
+    pushNotifications: false,
+    extendedAgentCard: true
+  }
+};
+const DEFAULT_PROFILES = {
+  "local-trusted": {
+    name: "local-trusted",
+    priority: [...DEFAULT_PRIORITY],
+    defaults: {},
+    backends: {},
+    mcpServers: {},
+    tools: {},
+    session: { historyPolicy: "context", maxOpenContexts: 20 },
+    runtime: {
+      target: "local",
+      executionMode: "host-full-access",
+      workspace: process.cwd()
+    },
+    security: {
+      sandbox: "off",
+      network: "inherit",
+      approvalMode: "inherit",
+      credentials: {
+        strategy: "env-passthrough",
+        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,
+        denyEnvVars: DEFAULT_DENY_ENV_VARS
+      },
+      filesystem: {
+        readableRoots: ["${workspace}"],
+        writableRoots: ["${workspace}"],
+        denyPaths: []
+      }
+    }
+  },
+  "local-sandboxed": {
+    name: "local-sandboxed",
+    priority: [...DEFAULT_PRIORITY],
+    defaults: {},
+    backends: {},
+    mcpServers: {},
+    tools: {},
+    session: { historyPolicy: "context", maxOpenContexts: 20 },
+    runtime: {
+      target: "local",
+      executionMode: "sandbox",
+      workspace: process.cwd()
+    },
+    security: {
+      sandbox: "process",
+      network: "none",
+      approvalMode: "manual",
+      credentials: {
+        strategy: "secret-ref",
+        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,
+        denyEnvVars: [
+          ...DEFAULT_DENY_ENV_VARS,
+          "OPENAI_API_KEY",
+          "ANTHROPIC_API_KEY",
+          "GEMINI_API_KEY"
+        ]
+      },
+      filesystem: {
+        readableRoots: ["${workspace}"],
+        writableRoots: ["${workspace}"],
+        denyPaths: ["${home}/.ssh", "${home}/.gnupg", "${home}/.aws"]
+      }
+    }
+  },
+  "remote-service": {
+    name: "remote-service",
+    priority: [...DEFAULT_PRIORITY],
+    defaults: {},
+    backends: {},
+    mcpServers: {},
+    tools: {},
+    session: { historyPolicy: "context", maxOpenContexts: 200 },
+    runtime: {
+      target: "remote",
+      executionMode: "remote-sandbox",
+      workspace: process.cwd()
+    },
+    security: {
+      sandbox: "container",
+      network: "none",
+      approvalMode: "manual",
+      credentials: {
+        strategy: "secret-ref",
+        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,
+        denyEnvVars: [
+          ...DEFAULT_DENY_ENV_VARS,
+          "OPENAI_API_KEY",
+          "ANTHROPIC_API_KEY",
+          "GEMINI_API_KEY"
+        ]
+      },
+      filesystem: {
+        readableRoots: ["${workspace}"],
+        writableRoots: ["${workspace}"],
+        denyPaths: ["${home}/.ssh", "${home}/.gnupg", "${home}/.aws"]
+      }
+    }
+  },
+  "remote-ssh": {
+    name: "remote-ssh",
+    priority: [...DEFAULT_PRIORITY],
+    defaults: {},
+    backends: {},
+    mcpServers: {},
+    tools: {},
+    session: { historyPolicy: "context", maxOpenContexts: 20 },
+    runtime: {
+      target: "remote",
+      executionMode: "remote-sandbox",
+      workspace: process.cwd()
+    },
+    security: {
+      sandbox: "process",
+      network: "inherit",
+      approvalMode: "manual",
+      credentials: {
+        strategy: "secret-ref",
+        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,
+        denyEnvVars: [
+          ...DEFAULT_DENY_ENV_VARS,
+          "OPENAI_API_KEY",
+          "ANTHROPIC_API_KEY",
+          "GEMINI_API_KEY"
+        ]
+      },
+      filesystem: { readableRoots: [], writableRoots: [], denyPaths: [] }
+    }
+  }
+};
+function mergeDefaults(base, override) {
+  return { ...base, ...override ?? {} };
+}
+function mergeToolConfigs(base, override) {
+  if (!override) return base;
+  const overrideDefNames = new Set(
+    (override.definitions ?? []).map((d) => d.name)
+  );
+  const mergedDefs = [
+    ...(base.definitions ?? []).filter((d) => !overrideDefNames.has(d.name)),
+    ...override.definitions ?? []
+  ];
+  const overrideServerNames = new Set(
+    (override.servers ?? []).map((s) => s.name)
+  );
+  const mergedServers = [
+    ...(base.servers ?? []).filter((s) => !overrideServerNames.has(s.name)),
+    ...override.servers ?? []
+  ];
+  return {
+    ...mergedDefs.length > 0 ? { definitions: mergedDefs } : {},
+    ...mergedServers.length > 0 ? { servers: mergedServers } : {},
+    ...override.allowedTools ?? base.allowedTools ? { allowedTools: override.allowedTools ?? base.allowedTools } : {}
+  };
+}
+function mergeProfile(name, globalConfig, override) {
+  const defaultProfile = DEFAULT_PROFILES[name] ?? DEFAULT_PROFILES["local-trusted"];
+  const workspace = override?.runtime?.workspace ?? globalConfig?.defaults?.cwd ?? defaultProfile.runtime.workspace ?? process.cwd();
+  const globalMcpServers = globalConfig?.mcpServers ?? {};
+  const profileMcpServers = override?.mcpServers ?? {};
+  const globalTools = globalConfig?.tools ?? {};
+  const profileTools = override?.tools;
+  const mergedTools = mergeToolConfigs(globalTools, profileTools);
+  const defaults = mergeDefaults(
+    mergeDefaults(defaultProfile.defaults, globalConfig?.defaults),
+    override?.defaults
+  );
+  const configuredPriority = override?.priority ?? globalConfig?.priority;
+  return {
+    name,
+    priority: configuredPriority ?? resolvePriorityFilters({
+      backendType: defaults.backendType,
+      llmProvider: defaults.llmProvider,
+      order: defaultProfile.priority
+    }) ?? defaultProfile.priority,
+    defaults,
+    backends: override?.backends ?? {},
+    mcpServers: { ...globalMcpServers, ...profileMcpServers },
+    tools: mergedTools,
+    session: {
+      historyPolicy: override?.session?.historyPolicy ?? defaultProfile.session.historyPolicy,
+      maxOpenContexts: override?.session?.maxOpenContexts ?? defaultProfile.session.maxOpenContexts
+    },
+    runtime: {
+      target: override?.runtime?.target ?? defaultProfile.runtime.target,
+      executionMode: override?.runtime?.executionMode ?? defaultProfile.runtime.executionMode,
+      workspace
+    },
+    security: {
+      sandbox: override?.security?.sandbox ?? defaultProfile.security.sandbox,
+      network: override?.security?.network ?? defaultProfile.security.network,
+      approvalMode: override?.security?.approvalMode ?? defaultProfile.security.approvalMode,
+      credentials: {
+        strategy: override?.security?.credentials?.strategy ?? defaultProfile.security.credentials.strategy,
+        allowedEnvVars: override?.security?.credentials?.allowedEnvVars ?? defaultProfile.security.credentials.allowedEnvVars,
+        denyEnvVars: override?.security?.credentials?.denyEnvVars ?? defaultProfile.security.credentials.denyEnvVars
+      },
+      filesystem: {
+        readableRoots: override?.security?.filesystem?.readableRoots ?? defaultProfile.security.filesystem.readableRoots,
+        writableRoots: override?.security?.filesystem?.writableRoots ?? defaultProfile.security.filesystem.writableRoots,
+        denyPaths: override?.security?.filesystem?.denyPaths ?? defaultProfile.security.filesystem.denyPaths
+      }
+    }
+  };
+}
+const CONFIG_TEMPLATE = {
+  defaultProfile: "local-trusted",
+  priority: [...DEFAULT_PRIORITY],
+  defaults: { timeoutMs: 6e5, retries: 0, mcpConfigPath: "./.mcp.json" },
+  frameworkWorkspace: { dir: ".octoflow", outDir: ".octoflow/dist" },
+  agentSkills: { enabled: true, additionalPaths: ["./.octoflow/skills"] },
+  apiKeys: { anthropic: "", openai: "" },
+  brain: {
+    enabled: false,
+    remoteBrain: {
+      enabled: false,
+      baseUrl: "https://brain.internal.example",
+      authTokenEnv: "OCTOFLOW_REMOTE_BRAIN_TOKEN",
+      timeoutMs: 1e4,
+      retries: 2,
+      retryDelayMs: 100
+    },
+    defaultScope: "tenant",
+    scopeIdSource: "tenant",
+    autoRecall: false,
+    autoRemember: false,
+    maintenance: false
+  },
+  mcpServers: {
+    filesystem: {
+      command: "npx",
+      args: ["-y", "@modelcontextprotocol/server-filesystem", "/workspace"]
+    }
+  },
+  mcpOptions: {
+    prefixToolNameWithServerName: true,
+    throwOnLoadError: false,
+    timeoutMs: 3e4,
+    envMode: "allowlist"
+  },
+  tools: {
+    servers: [
+      { name: "custom-mcp", command: "node", args: ["./mcp-server.js"] }
+    ],
+    allowedTools: []
+  },
+  skills: [
+    { name: "code-review", actionNames: ["tmux_exec"], condition: "always" }
+  ],
+  profiles: {
+    "local-trusted": {
+      defaults: { model: "sonnet", systemPrompt: "Be concise and practical." },
+      runtime: { target: "local", executionMode: "host-full-access" },
+      security: { sandbox: "off", approvalMode: "inherit" },
+      backends: {
+        "claude-code-cli": { model: "sonnet" },
+        "openai-api": { model: "gpt-4o" }
+      }
+    },
+    "remote-service": {
+      runtime: { target: "remote", executionMode: "remote-sandbox" },
+      security: {
+        sandbox: "container",
+        approvalMode: "manual",
+        network: "none"
+      }
+    }
+  },
+  server: {
+    a2aVersion: "1.0",
+    rateLimit: {
+      enabled: true,
+      windowMs: 6e4,
+      maxRequests: 120,
+      maxConcurrent: 20,
+      ipv6SubnetBits: 64
+    },
+    auth: { mode: "bearer", bearerTokens: ["replace-me"] },
+    tls: {
+      keyPath: "/path/to/server-key.pem",
+      certPath: "/path/to/server-cert.pem",
+      caPath: "/path/to/ca-cert.pem",
+      requestCert: true,
+      rejectUnauthorized: true
+    }
+  }
+};
+export {
+  CONFIG_TEMPLATE,
+  DEFAULT_AGENT_CARD,
+  DEFAULT_ALLOWED_ENV_VARS,
+  DEFAULT_DENY_ENV_VARS,
+  DEFAULT_PRIORITY,
+  DEFAULT_PROFILES,
+  DEFAULT_SERVER_CONFIG,
+  mergeDefaults,
+  mergeProfile,
+  mergeToolConfigs
+};
+//# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/config/defaults.ts"],
+  "sourcesContent": ["import { resolvePriorityFilters } from '../domain/backend-runtime.js';\nimport type { BackendName } from '../domain/core-client.js';\nimport type { AgentCard } from '../domain/core-task.js';\nimport type {\n  OctoFlowConfig,\n  OctoFlowDefaults,\n  OctoFlowProfile,\n  OctoFlowProfileName,\n  ResolvedOctoFlowProfile,\n  ResolvedOctoFlowServerConfig,\n  SerializedToolConfig,\n} from './config.js';\n\nexport const DEFAULT_PRIORITY: readonly BackendName[] = Object.freeze([\n  'claude-code-cli',\n  'codex-cli',\n  'cursor-cli',\n  'anthropic-api',\n  'gemini-api',\n  'openai-api',\n  'vercel-ai:anthropic',\n  'vercel-ai:openai',\n  'vercel-ai:google',\n  'ollama',\n] as const);\n\n// prettier-ignore\nexport const DEFAULT_ALLOWED_ENV_VARS = [\n  'PATH', 'HOME', 'SHELL', 'TERM', 'LANG', 'LC_ALL', 'TMPDIR', 'TMP',\n  'TEMP', 'USER', 'LOGNAME', 'USERNAME', 'SYSTEMROOT', 'COMSPEC',\n  'PATHEXT', 'WINDIR',\n];\n\nexport const DEFAULT_DENY_ENV_VARS = [\n  'AWS_*',\n  'GITHUB_TOKEN',\n  'GH_TOKEN',\n  'SSH_AUTH_SOCK',\n];\n\nexport const DEFAULT_SERVER_CONFIG: ResolvedOctoFlowServerConfig = {\n  a2aVersion: '1.0',\n  agentCardVisibility: 'public',\n  auth: {\n    mode: 'none',\n    bearerTokens: [],\n    headerName: 'authorization',\n  },\n  cacheControl: 'public, max-age=300',\n  host: '127.0.0.1',\n  maxBodyBytes: 1_048_576,\n  port: 4400,\n  rateLimit: {\n    enabled: true,\n    windowMs: 60_000,\n    maxRequests: 120,\n    maxConcurrent: 20,\n    ipv6SubnetBits: 64,\n  },\n  tls: undefined,\n};\n\nexport const DEFAULT_AGENT_CARD: Partial<AgentCard> = {\n  name: 'octoflow-core',\n  description:\n    'Standalone A2A-native bridge for local AI CLIs and provider APIs.',\n  protocolVersion: '1.0',\n  defaultInputModes: ['text/plain'],\n  defaultOutputModes: ['text/plain'],\n  capabilities: {\n    streaming: true,\n    pushNotifications: false,\n    extendedAgentCard: true,\n  },\n};\n\nexport const DEFAULT_PROFILES: Record<\n  OctoFlowProfileName,\n  ResolvedOctoFlowProfile\n> = {\n  'local-trusted': {\n    name: 'local-trusted',\n    priority: [...DEFAULT_PRIORITY],\n    defaults: {},\n    backends: {},\n    mcpServers: {},\n    tools: {},\n    session: { historyPolicy: 'context', maxOpenContexts: 20 },\n    runtime: {\n      target: 'local',\n      executionMode: 'host-full-access',\n      workspace: process.cwd(),\n    },\n    security: {\n      sandbox: 'off',\n      network: 'inherit',\n      approvalMode: 'inherit',\n      credentials: {\n        strategy: 'env-passthrough',\n        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,\n        denyEnvVars: DEFAULT_DENY_ENV_VARS,\n      },\n      filesystem: {\n        readableRoots: ['${workspace}'],\n        writableRoots: ['${workspace}'],\n        denyPaths: [],\n      },\n    },\n  },\n  'local-sandboxed': {\n    name: 'local-sandboxed',\n    priority: [...DEFAULT_PRIORITY],\n    defaults: {},\n    backends: {},\n    mcpServers: {},\n    tools: {},\n    session: { historyPolicy: 'context', maxOpenContexts: 20 },\n    runtime: {\n      target: 'local',\n      executionMode: 'sandbox',\n      workspace: process.cwd(),\n    },\n    security: {\n      sandbox: 'process',\n      network: 'none',\n      approvalMode: 'manual',\n      credentials: {\n        strategy: 'secret-ref',\n        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,\n        denyEnvVars: [\n          ...DEFAULT_DENY_ENV_VARS,\n          'OPENAI_API_KEY',\n          'ANTHROPIC_API_KEY',\n          'GEMINI_API_KEY',\n        ],\n      },\n      filesystem: {\n        readableRoots: ['${workspace}'],\n        writableRoots: ['${workspace}'],\n        denyPaths: ['${home}/.ssh', '${home}/.gnupg', '${home}/.aws'],\n      },\n    },\n  },\n  'remote-service': {\n    name: 'remote-service',\n    priority: [...DEFAULT_PRIORITY],\n    defaults: {},\n    backends: {},\n    mcpServers: {},\n    tools: {},\n    session: { historyPolicy: 'context', maxOpenContexts: 200 },\n    runtime: {\n      target: 'remote',\n      executionMode: 'remote-sandbox',\n      workspace: process.cwd(),\n    },\n    security: {\n      sandbox: 'container',\n      network: 'none',\n      approvalMode: 'manual',\n      credentials: {\n        strategy: 'secret-ref',\n        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,\n        denyEnvVars: [\n          ...DEFAULT_DENY_ENV_VARS,\n          'OPENAI_API_KEY',\n          'ANTHROPIC_API_KEY',\n          'GEMINI_API_KEY',\n        ],\n      },\n      filesystem: {\n        readableRoots: ['${workspace}'],\n        writableRoots: ['${workspace}'],\n        denyPaths: ['${home}/.ssh', '${home}/.gnupg', '${home}/.aws'],\n      },\n    },\n  },\n  'remote-ssh': {\n    name: 'remote-ssh',\n    priority: [...DEFAULT_PRIORITY],\n    defaults: {},\n    backends: {},\n    mcpServers: {},\n    tools: {},\n    session: { historyPolicy: 'context', maxOpenContexts: 20 },\n    runtime: {\n      target: 'remote',\n      executionMode: 'remote-sandbox',\n      workspace: process.cwd(),\n    },\n    security: {\n      sandbox: 'process',\n      network: 'inherit',\n      approvalMode: 'manual',\n      credentials: {\n        strategy: 'secret-ref',\n        allowedEnvVars: DEFAULT_ALLOWED_ENV_VARS,\n        denyEnvVars: [\n          ...DEFAULT_DENY_ENV_VARS,\n          'OPENAI_API_KEY',\n          'ANTHROPIC_API_KEY',\n          'GEMINI_API_KEY',\n        ],\n      },\n      filesystem: { readableRoots: [], writableRoots: [], denyPaths: [] },\n    },\n  },\n};\n\nexport function mergeDefaults(\n  base: OctoFlowDefaults,\n  override?: OctoFlowDefaults\n): OctoFlowDefaults {\n  return { ...base, ...(override ?? {}) };\n}\n\nexport function mergeToolConfigs(\n  base: SerializedToolConfig,\n  override?: SerializedToolConfig\n): SerializedToolConfig {\n  if (!override) return base;\n  const overrideDefNames = new Set(\n    (override.definitions ?? []).map((d) => d.name)\n  );\n  const mergedDefs = [\n    ...(base.definitions ?? []).filter((d) => !overrideDefNames.has(d.name)),\n    ...(override.definitions ?? []),\n  ];\n  const overrideServerNames = new Set(\n    (override.servers ?? []).map((s) => s.name)\n  );\n  const mergedServers = [\n    ...(base.servers ?? []).filter((s) => !overrideServerNames.has(s.name)),\n    ...(override.servers ?? []),\n  ];\n  return {\n    ...(mergedDefs.length > 0 ? { definitions: mergedDefs } : {}),\n    ...(mergedServers.length > 0 ? { servers: mergedServers } : {}),\n    ...((override.allowedTools ?? base.allowedTools)\n      ? { allowedTools: override.allowedTools ?? base.allowedTools }\n      : {}),\n  };\n}\n\nexport function mergeProfile(\n  name: string,\n  globalConfig: OctoFlowConfig | null,\n  override?: OctoFlowProfile\n): ResolvedOctoFlowProfile {\n  const defaultProfile =\n    DEFAULT_PROFILES[name as OctoFlowProfileName] ??\n    DEFAULT_PROFILES['local-trusted'];\n  const workspace =\n    override?.runtime?.workspace ??\n    globalConfig?.defaults?.cwd ??\n    defaultProfile.runtime.workspace ??\n    process.cwd();\n\n  const globalMcpServers = globalConfig?.mcpServers ?? {};\n  const profileMcpServers = override?.mcpServers ?? {};\n\n  const globalTools = globalConfig?.tools ?? {};\n  const profileTools = override?.tools;\n  const mergedTools = mergeToolConfigs(globalTools, profileTools);\n  const defaults = mergeDefaults(\n    mergeDefaults(defaultProfile.defaults, globalConfig?.defaults),\n    override?.defaults\n  );\n  const configuredPriority = override?.priority ?? globalConfig?.priority;\n\n  return {\n    name,\n    priority:\n      configuredPriority ??\n      resolvePriorityFilters({\n        backendType: defaults.backendType,\n        llmProvider: defaults.llmProvider,\n        order: defaultProfile.priority,\n      }) ??\n      defaultProfile.priority,\n    defaults,\n    backends: override?.backends ?? {},\n    mcpServers: { ...globalMcpServers, ...profileMcpServers },\n    tools: mergedTools,\n    session: {\n      historyPolicy:\n        override?.session?.historyPolicy ??\n        defaultProfile.session.historyPolicy,\n      maxOpenContexts:\n        override?.session?.maxOpenContexts ??\n        defaultProfile.session.maxOpenContexts,\n    },\n    runtime: {\n      target: override?.runtime?.target ?? defaultProfile.runtime.target,\n      executionMode:\n        override?.runtime?.executionMode ??\n        defaultProfile.runtime.executionMode,\n      workspace,\n    },\n    security: {\n      sandbox: override?.security?.sandbox ?? defaultProfile.security.sandbox,\n      network: override?.security?.network ?? defaultProfile.security.network,\n      approvalMode:\n        override?.security?.approvalMode ??\n        defaultProfile.security.approvalMode,\n      credentials: {\n        strategy:\n          override?.security?.credentials?.strategy ??\n          defaultProfile.security.credentials.strategy,\n        allowedEnvVars:\n          override?.security?.credentials?.allowedEnvVars ??\n          defaultProfile.security.credentials.allowedEnvVars,\n        denyEnvVars:\n          override?.security?.credentials?.denyEnvVars ??\n          defaultProfile.security.credentials.denyEnvVars,\n      },\n      filesystem: {\n        readableRoots:\n          override?.security?.filesystem?.readableRoots ??\n          defaultProfile.security.filesystem.readableRoots,\n        writableRoots:\n          override?.security?.filesystem?.writableRoots ??\n          defaultProfile.security.filesystem.writableRoots,\n        denyPaths:\n          override?.security?.filesystem?.denyPaths ??\n          defaultProfile.security.filesystem.denyPaths,\n      },\n    },\n  };\n}\n\nexport const CONFIG_TEMPLATE: OctoFlowConfig = {\n  defaultProfile: 'local-trusted',\n  priority: [...DEFAULT_PRIORITY],\n  defaults: { timeoutMs: 600000, retries: 0, mcpConfigPath: './.mcp.json' },\n  frameworkWorkspace: { dir: '.octoflow', outDir: '.octoflow/dist' },\n  agentSkills: { enabled: true, additionalPaths: ['./.octoflow/skills'] },\n  apiKeys: { anthropic: '', openai: '' },\n  brain: {\n    enabled: false,\n    remoteBrain: {\n      enabled: false,\n      baseUrl: 'https://brain.internal.example',\n      authTokenEnv: 'OCTOFLOW_REMOTE_BRAIN_TOKEN',\n      timeoutMs: 10000,\n      retries: 2,\n      retryDelayMs: 100,\n    },\n    defaultScope: 'tenant',\n    scopeIdSource: 'tenant',\n    autoRecall: false,\n    autoRemember: false,\n    maintenance: false,\n  },\n  mcpServers: {\n    filesystem: {\n      command: 'npx',\n      args: ['-y', '@modelcontextprotocol/server-filesystem', '/workspace'],\n    },\n  },\n  mcpOptions: {\n    prefixToolNameWithServerName: true,\n    throwOnLoadError: false,\n    timeoutMs: 30000,\n    envMode: 'allowlist',\n  },\n  tools: {\n    servers: [\n      { name: 'custom-mcp', command: 'node', args: ['./mcp-server.js'] },\n    ],\n    allowedTools: [],\n  },\n  skills: [\n    { name: 'code-review', actionNames: ['tmux_exec'], condition: 'always' },\n  ],\n  profiles: {\n    'local-trusted': {\n      defaults: { model: 'sonnet', systemPrompt: 'Be concise and practical.' },\n      runtime: { target: 'local', executionMode: 'host-full-access' },\n      security: { sandbox: 'off', approvalMode: 'inherit' },\n      backends: {\n        'claude-code-cli': { model: 'sonnet' },\n        'openai-api': { model: 'gpt-4o' },\n      },\n    },\n    'remote-service': {\n      runtime: { target: 'remote', executionMode: 'remote-sandbox' },\n      security: {\n        sandbox: 'container',\n        approvalMode: 'manual',\n        network: 'none',\n      },\n    },\n  },\n  server: {\n    a2aVersion: '1.0',\n    rateLimit: {\n      enabled: true,\n      windowMs: 60000,\n      maxRequests: 120,\n      maxConcurrent: 20,\n      ipv6SubnetBits: 64,\n    },\n    auth: { mode: 'bearer', bearerTokens: ['replace-me'] },\n    tls: {\n      keyPath: '/path/to/server-key.pem',\n      certPath: '/path/to/server-cert.pem',\n      caPath: '/path/to/ca-cert.pem',\n      requestCert: true,\n      rejectUnauthorized: true,\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAahC,MAAM,mBAA2C,OAAO,OAAO;AAAA,EACpE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAGH,MAAM,2BAA2B;AAAA,EACtC;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAU;AAAA,EAC7D;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAY;AAAA,EAAc;AAAA,EACrD;AAAA,EAAW;AACb;AAEO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,wBAAsD;AAAA,EACjE,YAAY;AAAA,EACZ,qBAAqB;AAAA,EACrB,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,cAAc,CAAC;AAAA,IACf,YAAY;AAAA,EACd;AAAA,EACA,cAAc;AAAA,EACd,MAAM;AAAA,EACN,cAAc;AAAA,EACd,MAAM;AAAA,EACN,WAAW;AAAA,IACT,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AAAA,EACA,KAAK;AACP;AAEO,MAAM,qBAAyC;AAAA,EACpD,MAAM;AAAA,EACN,aACE;AAAA,EACF,iBAAiB;AAAA,EACjB,mBAAmB,CAAC,YAAY;AAAA,EAChC,oBAAoB,CAAC,YAAY;AAAA,EACjC,cAAc;AAAA,IACZ,WAAW;AAAA,IACX,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AACF;AAEO,MAAM,mBAGT;AAAA,EACF,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,UAAU,CAAC,GAAG,gBAAgB;AAAA,IAC9B,UAAU,CAAC;AAAA,IACX,UAAU,CAAC;AAAA,IACX,YAAY,CAAC;AAAA,IACb,OAAO,CAAC;AAAA,IACR,SAAS,EAAE,eAAe,WAAW,iBAAiB,GAAG;AAAA,IACzD,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc;AAAA,MACd,aAAa;AAAA,QACX,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,MACf;AAAA,MACA,YAAY;AAAA,QACV,eAAe,CAAC,cAAc;AAAA,QAC9B,eAAe,CAAC,cAAc;AAAA,QAC9B,WAAW,CAAC;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EACA,mBAAmB;AAAA,IACjB,MAAM;AAAA,IACN,UAAU,CAAC,GAAG,gBAAgB;AAAA,IAC9B,UAAU,CAAC;AAAA,IACX,UAAU,CAAC;AAAA,IACX,YAAY,CAAC;AAAA,IACb,OAAO,CAAC;AAAA,IACR,SAAS,EAAE,eAAe,WAAW,iBAAiB,GAAG;AAAA,IACzD,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc;AAAA,MACd,aAAa;AAAA,QACX,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,UACX,GAAG;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV,eAAe,CAAC,cAAc;AAAA,QAC9B,eAAe,CAAC,cAAc;AAAA,QAC9B,WAAW,CAAC,gBAAgB,kBAAkB,cAAc;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,UAAU,CAAC,GAAG,gBAAgB;AAAA,IAC9B,UAAU,CAAC;AAAA,IACX,UAAU,CAAC;AAAA,IACX,YAAY,CAAC;AAAA,IACb,OAAO,CAAC;AAAA,IACR,SAAS,EAAE,eAAe,WAAW,iBAAiB,IAAI;AAAA,IAC1D,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc;AAAA,MACd,aAAa;AAAA,QACX,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,UACX,GAAG;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV,eAAe,CAAC,cAAc;AAAA,QAC9B,eAAe,CAAC,cAAc;AAAA,QAC9B,WAAW,CAAC,gBAAgB,kBAAkB,cAAc;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,UAAU,CAAC,GAAG,gBAAgB;AAAA,IAC9B,UAAU,CAAC;AAAA,IACX,UAAU,CAAC;AAAA,IACX,YAAY,CAAC;AAAA,IACb,OAAO,CAAC;AAAA,IACR,SAAS,EAAE,eAAe,WAAW,iBAAiB,GAAG;AAAA,IACzD,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,eAAe;AAAA,MACf,WAAW,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,UAAU;AAAA,MACR,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc;AAAA,MACd,aAAa;AAAA,QACX,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB,aAAa;AAAA,UACX,GAAG;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,MACA,YAAY,EAAE,eAAe,CAAC,GAAG,eAAe,CAAC,GAAG,WAAW,CAAC,EAAE;AAAA,IACpE;AAAA,EACF;AACF;AAEO,SAAS,cACd,MACA,UACkB;AAClB,SAAO,EAAE,GAAG,MAAM,GAAI,YAAY,CAAC,EAAG;AACxC;AAEO,SAAS,iBACd,MACA,UACsB;AACtB,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,mBAAmB,IAAI;AAAA,KAC1B,SAAS,eAAe,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EAChD;AACA,QAAM,aAAa;AAAA,IACjB,IAAI,KAAK,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,IAAI,CAAC;AAAA,IACvE,GAAI,SAAS,eAAe,CAAC;AAAA,EAC/B;AACA,QAAM,sBAAsB,IAAI;AAAA,KAC7B,SAAS,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EAC5C;AACA,QAAM,gBAAgB;AAAA,IACpB,IAAI,KAAK,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,IAAI,CAAC;AAAA,IACtE,GAAI,SAAS,WAAW,CAAC;AAAA,EAC3B;AACA,SAAO;AAAA,IACL,GAAI,WAAW,SAAS,IAAI,EAAE,aAAa,WAAW,IAAI,CAAC;AAAA,IAC3D,GAAI,cAAc,SAAS,IAAI,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,IAC7D,GAAK,SAAS,gBAAgB,KAAK,eAC/B,EAAE,cAAc,SAAS,gBAAgB,KAAK,aAAa,IAC3D,CAAC;AAAA,EACP;AACF;AAEO,SAAS,aACd,MACA,cACA,UACyB;AACzB,QAAM,iBACJ,iBAAiB,IAA2B,KAC5C,iBAAiB,eAAe;AAClC,QAAM,YACJ,UAAU,SAAS,aACnB,cAAc,UAAU,OACxB,eAAe,QAAQ,aACvB,QAAQ,IAAI;AAEd,QAAM,mBAAmB,cAAc,cAAc,CAAC;AACtD,QAAM,oBAAoB,UAAU,cAAc,CAAC;AAEnD,QAAM,cAAc,cAAc,SAAS,CAAC;AAC5C,QAAM,eAAe,UAAU;AAC/B,QAAM,cAAc,iBAAiB,aAAa,YAAY;AAC9D,QAAM,WAAW;AAAA,IACf,cAAc,eAAe,UAAU,cAAc,QAAQ;AAAA,IAC7D,UAAU;AAAA,EACZ;AACA,QAAM,qBAAqB,UAAU,YAAY,cAAc;AAE/D,SAAO;AAAA,IACL;AAAA,IACA,UACE,sBACA,uBAAuB;AAAA,MACrB,aAAa,SAAS;AAAA,MACtB,aAAa,SAAS;AAAA,MACtB,OAAO,eAAe;AAAA,IACxB,CAAC,KACD,eAAe;AAAA,IACjB;AAAA,IACA,UAAU,UAAU,YAAY,CAAC;AAAA,IACjC,YAAY,EAAE,GAAG,kBAAkB,GAAG,kBAAkB;AAAA,IACxD,OAAO;AAAA,IACP,SAAS;AAAA,MACP,eACE,UAAU,SAAS,iBACnB,eAAe,QAAQ;AAAA,MACzB,iBACE,UAAU,SAAS,mBACnB,eAAe,QAAQ;AAAA,IAC3B;AAAA,IACA,SAAS;AAAA,MACP,QAAQ,UAAU,SAAS,UAAU,eAAe,QAAQ;AAAA,MAC5D,eACE,UAAU,SAAS,iBACnB,eAAe,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,SAAS,UAAU,UAAU,WAAW,eAAe,SAAS;AAAA,MAChE,SAAS,UAAU,UAAU,WAAW,eAAe,SAAS;AAAA,MAChE,cACE,UAAU,UAAU,gBACpB,eAAe,SAAS;AAAA,MAC1B,aAAa;AAAA,QACX,UACE,UAAU,UAAU,aAAa,YACjC,eAAe,SAAS,YAAY;AAAA,QACtC,gBACE,UAAU,UAAU,aAAa,kBACjC,eAAe,SAAS,YAAY;AAAA,QACtC,aACE,UAAU,UAAU,aAAa,eACjC,eAAe,SAAS,YAAY;AAAA,MACxC;AAAA,MACA,YAAY;AAAA,QACV,eACE,UAAU,UAAU,YAAY,iBAChC,eAAe,SAAS,WAAW;AAAA,QACrC,eACE,UAAU,UAAU,YAAY,iBAChC,eAAe,SAAS,WAAW;AAAA,QACrC,WACE,UAAU,UAAU,YAAY,aAChC,eAAe,SAAS,WAAW;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,kBAAkC;AAAA,EAC7C,gBAAgB;AAAA,EAChB,UAAU,CAAC,GAAG,gBAAgB;AAAA,EAC9B,UAAU,EAAE,WAAW,KAAQ,SAAS,GAAG,eAAe,cAAc;AAAA,EACxE,oBAAoB,EAAE,KAAK,aAAa,QAAQ,iBAAiB;AAAA,EACjE,aAAa,EAAE,SAAS,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACtE,SAAS,EAAE,WAAW,IAAI,QAAQ,GAAG;AAAA,EACrC,OAAO;AAAA,IACL,SAAS;AAAA,IACT,aAAa;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,cAAc;AAAA,MACd,WAAW;AAAA,MACX,SAAS;AAAA,MACT,cAAc;AAAA,IAChB;AAAA,IACA,cAAc;AAAA,IACd,eAAe;AAAA,IACf,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,EACf;AAAA,EACA,YAAY;AAAA,IACV,YAAY;AAAA,MACV,SAAS;AAAA,MACT,MAAM,CAAC,MAAM,2CAA2C,YAAY;AAAA,IACtE;AAAA,EACF;AAAA,EACA,YAAY;AAAA,IACV,8BAA8B;AAAA,IAC9B,kBAAkB;AAAA,IAClB,WAAW;AAAA,IACX,SAAS;AAAA,EACX;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA,MACP,EAAE,MAAM,cAAc,SAAS,QAAQ,MAAM,CAAC,iBAAiB,EAAE;AAAA,IACnE;AAAA,IACA,cAAc,CAAC;AAAA,EACjB;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,MAAM,eAAe,aAAa,CAAC,WAAW,GAAG,WAAW,SAAS;AAAA,EACzE;AAAA,EACA,UAAU;AAAA,IACR,iBAAiB;AAAA,MACf,UAAU,EAAE,OAAO,UAAU,cAAc,4BAA4B;AAAA,MACvE,SAAS,EAAE,QAAQ,SAAS,eAAe,mBAAmB;AAAA,MAC9D,UAAU,EAAE,SAAS,OAAO,cAAc,UAAU;AAAA,MACpD,UAAU;AAAA,QACR,mBAAmB,EAAE,OAAO,SAAS;AAAA,QACrC,cAAc,EAAE,OAAO,SAAS;AAAA,MAClC;AAAA,IACF;AAAA,IACA,kBAAkB;AAAA,MAChB,SAAS,EAAE,QAAQ,UAAU,eAAe,iBAAiB;AAAA,MAC7D,UAAU;AAAA,QACR,SAAS;AAAA,QACT,cAAc;AAAA,QACd,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,YAAY;AAAA,IACZ,WAAW;AAAA,MACT,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe;AAAA,MACf,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,EAAE,MAAM,UAAU,cAAc,CAAC,YAAY,EAAE;AAAA,IACrD,KAAK;AAAA,MACH,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/config/env-priority.d.ts

@@ -0,0 +1,20 @@
+import type { BackendName } from '../domain/core-task.js';
+/**
+ * Parses a comma-separated list of backend names (typically from
+ * `OCTOFLOW_BACKENDS`). Unknown entries are silently dropped. Falls back
+ * to {@link DEFAULT_PRIORITY} when `raw` is empty, undefined, or contains no
+ * recognized names.
+ *
+ * Previously inlined across 50+ templates; promoted to the SDK per
+ * `.md`
+ */
+export declare function parseBackendPriority(raw: string | undefined): BackendName[];
+/**
+ * Same truthy vocabulary templates have historically used for boolean env
+ * vars: `1` / `true` / `yes` / `on` (case-insensitive). Returns `false` when
+ * the var is unset or empty.
+ */
+export declare function readEnvBool(name: string, env?: NodeJS.ProcessEnv): boolean;
+/** Like {@link readEnvBool} but returns `undefined` when the var is unset. */
+export declare function readOptionalEnvBool(name: string, env?: NodeJS.ProcessEnv): boolean | undefined;
+//# sourceMappingURL=env-priority.d.ts.map

package/dist/config/env-priority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-priority.d.ts","sourceRoot":"","sources":["../../src/config/env-priority.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI1D;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,EAAE,CAO3E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAGT;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,GAAG,SAAS,CAErB"}

package/dist/config/env-priority.js

@@ -0,0 +1,20 @@
+import { isBackendName } from "../domain/core-task.js";
+import { DEFAULT_PRIORITY } from "./defaults.js";
+function parseBackendPriority(raw) {
+  if (!raw) return [...DEFAULT_PRIORITY];
+  const parsed = raw.split(",").map((item) => item.trim()).filter(isBackendName);
+  return parsed.length > 0 ? parsed : [...DEFAULT_PRIORITY];
+}
+function readEnvBool(name, env = process.env) {
+  const value = env[name]?.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes" || value === "on";
+}
+function readOptionalEnvBool(name, env = process.env) {
+  return env[name] == null ? void 0 : readEnvBool(name, env);
+}
+export {
+  parseBackendPriority,
+  readEnvBool,
+  readOptionalEnvBool
+};
+//# sourceMappingURL=env-priority.js.map

package/dist/config/env-priority.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/config/env-priority.ts"],
+  "sourcesContent": ["import type { BackendName } from '../domain/core-task.js';\nimport { isBackendName } from '../domain/core-task.js';\nimport { DEFAULT_PRIORITY } from './defaults.js';\n\n/**\n * Parses a comma-separated list of backend names (typically from\n * `OCTOFLOW_BACKENDS`). Unknown entries are silently dropped. Falls back\n * to {@link DEFAULT_PRIORITY} when `raw` is empty, undefined, or contains no\n * recognized names.\n *\n * Previously inlined across 50+ templates; promoted to the SDK per\n * `.md`\n */\nexport function parseBackendPriority(raw: string | undefined): BackendName[] {\n  if (!raw) return [...DEFAULT_PRIORITY];\n  const parsed = raw\n    .split(',')\n    .map((item) => item.trim())\n    .filter(isBackendName);\n  return parsed.length > 0 ? parsed : [...DEFAULT_PRIORITY];\n}\n\n/**\n * Same truthy vocabulary templates have historically used for boolean env\n * vars: `1` / `true` / `yes` / `on` (case-insensitive). Returns `false` when\n * the var is unset or empty.\n */\nexport function readEnvBool(\n  name: string,\n  env: NodeJS.ProcessEnv = process.env\n): boolean {\n  const value = env[name]?.trim().toLowerCase();\n  return value === '1' || value === 'true' || value === 'yes' || value === 'on';\n}\n\n/** Like {@link readEnvBool} but returns `undefined` when the var is unset. */\nexport function readOptionalEnvBool(\n  name: string,\n  env: NodeJS.ProcessEnv = process.env\n): boolean | undefined {\n  return env[name] == null ? undefined : readEnvBool(name, env);\n}\n"],
+  "mappings": "AACA,SAAS,qBAAqB;AAC9B,SAAS,wBAAwB;AAW1B,SAAS,qBAAqB,KAAwC;AAC3E,MAAI,CAAC,IAAK,QAAO,CAAC,GAAG,gBAAgB;AACrC,QAAM,SAAS,IACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,aAAa;AACvB,SAAO,OAAO,SAAS,IAAI,SAAS,CAAC,GAAG,gBAAgB;AAC1D;AAOO,SAAS,YACd,MACA,MAAyB,QAAQ,KACxB;AACT,QAAM,QAAQ,IAAI,IAAI,GAAG,KAAK,EAAE,YAAY;AAC5C,SAAO,UAAU,OAAO,UAAU,UAAU,UAAU,SAAS,UAAU;AAC3E;AAGO,SAAS,oBACd,MACA,MAAyB,QAAQ,KACZ;AACrB,SAAO,IAAI,IAAI,KAAK,OAAO,SAAY,YAAY,MAAM,GAAG;AAC9D;",
+  "names": []
+}

package/dist/config/env-registry.d.ts

@@ -0,0 +1,26 @@
+import type { BackendName } from '../domain/core-client.js';
+export type EnvVarCategory = 'api-key' | 'host' | 'model' | 'runtime' | 'config' | 'metadata';
+export interface EnvVarDescriptor {
+    key: string;
+    backends: BackendName[];
+    category: EnvVarCategory;
+    required: boolean;
+    description: string;
+    deprecated?: boolean;
+}
+export interface DiscoveredEnvVar extends EnvVarDescriptor {
+    value: string | null;
+    source: 'process.env' | 'unset';
+}
+export declare const ENV_REGISTRY: Record<string, EnvVarDescriptor>;
+/**
+ * Discover all recognized env vars and their current values from the host process.
+ */
+export declare function discoverEnv(baseEnv?: NodeJS.ProcessEnv): DiscoveredEnvVar[];
+/**
+ * Provider API key env var names that receive special stripping treatment.
+ * Keys in this list are removed from inherited process.env unless explicitly
+ * provided in the execution plan's env (tiers 1-4).
+ */
+export declare const PROVIDER_ENV_KEYS: readonly ["OPENAI_API_KEY", "OPENAI_API_HOST_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_API_HOST_KEY", "GEMINI_API_KEY", "OLLAMA_API_KEY"];
+//# sourceMappingURL=env-registry.d.ts.map

package/dist/config/env-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-registry.d.ts","sourceRoot":"","sources":["../../src/config/env-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,MAAM,GACN,OAAO,GACP,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AAEf,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;CACjC;AAED,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAiJzD,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,MAAM,CAAC,UAAwB,GACvC,gBAAgB,EAAE,CASpB;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uIAOpB,CAAC"}