prismalens 0.0.1

package/dist/src/config/loader.js

@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Sumit Patel
+/**
+ * Config loader (ADR-0010/0014).
+ *
+ * Resolution order (later overrides earlier — deep-merge; arrays replace):
+ *  1. Built-in defaults (Zod `.default()`)
+ *  2. User layer:    ~/.config/prismalens/config.yaml   (the XDG config dir; BYO-key
+ *     creds live in env per ADR-0006, never here)
+ *  3. Project layer: the explicit `--config` path, else the nearest
+ *     `prismalens.config.yaml` found by walking UP from cwd to the root
+ *  4. Project-local: `prismalens.config.local.yaml` beside the project config — a
+ *     gitignored per-checkout override
+ *  5. CLI flag overrides
+ *
+ * `${VAR}` patterns in string values are interpolated from the environment (throws
+ * on an unset var), then the merged object is validated by the schema.
+ *
+ * Deferred ADR-0014 layers (pulled in with their consumers, not speculatively):
+ *  - a curated env-overlay layer — today `${VAR}` interpolation already covers env
+ *    access from within the config;
+ *  - the reserved managed layer — there is no managed config source in the
+ *    local-first OSS build (it belongs to the cloud tier);
+ *  - the permission allow/deny list UNION (deny-wins) — coupled to the tool-seam
+ *    that enforces it (its own slice), so it lands there, not in the merge.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { dirname, join, parse as parsePath, resolve } from "node:path";
+import envPaths from "env-paths";
+import { parse as parseYaml } from "yaml";
+import { PlConfigSchema } from "./schema.js";
+const PROJECT_CONFIG_FILENAME = "prismalens.config.yaml";
+const PROJECT_LOCAL_CONFIG_FILENAME = "prismalens.config.local.yaml";
+const USER_CONFIG_FILENAME = "config.yaml";
+/** Find the nearest project config by walking up from `cwd` to the filesystem root. */
+export function findConfigFile(cwd = process.cwd()) {
+    let dir = resolve(cwd);
+    const { root } = parsePath(dir);
+    for (;;) {
+        const candidate = join(dir, PROJECT_CONFIG_FILENAME);
+        if (existsSync(candidate))
+            return candidate;
+        if (dir === root)
+            return undefined;
+        dir = dirname(dir);
+    }
+}
+/** The user-global config in the XDG config dir (~/.config/prismalens/config.yaml). */
+function userConfigFile() {
+    const candidate = join(envPaths("prismalens", { suffix: "" }).config, USER_CONFIG_FILENAME);
+    return existsSync(candidate) ? candidate : undefined;
+}
+/** The gitignored project-local override beside the project config (else in cwd). */
+function projectLocalConfigFile(projectFile, cwd) {
+    const dir = projectFile ? dirname(projectFile) : resolve(cwd);
+    const candidate = join(dir, PROJECT_LOCAL_CONFIG_FILENAME);
+    return existsSync(candidate) ? candidate : undefined;
+}
+async function readYamlFile(filePath) {
+    try {
+        const content = await readFile(filePath, "utf-8");
+        return parseYaml(content) ?? {};
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw err;
+    }
+}
+const ENV_VAR_PATTERN = /\$\{([^}]+)\}/g;
+/** Replace `${VAR}` in every string value (recursively). Throws on an unset var. */
+function interpolateDeep(value) {
+    if (typeof value === "string") {
+        return value.replace(ENV_VAR_PATTERN, (_, name) => {
+            const v = process.env[name];
+            if (v === undefined) {
+                throw new Error(`Config references unset environment variable "${name}" (as \${${name}})`);
+            }
+            return v;
+        });
+    }
+    if (Array.isArray(value))
+        return value.map(interpolateDeep);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[k] = interpolateDeep(v);
+        return out;
+    }
+    return value;
+}
+function isObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Deep-merge `source` over `target`. Arrays replace; objects merge recursively. */
+function deepMerge(target, source) {
+    const out = { ...target };
+    for (const [k, sv] of Object.entries(source)) {
+        const tv = out[k];
+        out[k] = isObject(sv) && isObject(tv) ? deepMerge(tv, sv) : sv;
+    }
+    return out;
+}
+function applyCliOverrides(config, o) {
+    const patch = {};
+    const agent = {};
+    if (o.agent !== undefined)
+        agent.default = o.agent;
+    if (o.model !== undefined)
+        agent.model = o.model;
+    if (Object.keys(agent).length > 0)
+        patch.agent = agent;
+    const telemetry = {};
+    if (o.prometheusUrl !== undefined)
+        telemetry.prometheusUrl = o.prometheusUrl;
+    if (o.alertmanagerUrl !== undefined)
+        telemetry.alertmanagerUrl = o.alertmanagerUrl;
+    if (o.apiUrl !== undefined)
+        telemetry.apiUrl = o.apiUrl;
+    if (Object.keys(telemetry).length > 0)
+        patch.telemetry = telemetry;
+    return deepMerge(config, patch);
+}
+/** Load, merge, interpolate, and validate the config. Result is frozen. */
+export async function loadConfig(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const userFile = userConfigFile();
+    const projectFile = options.configPath
+        ? resolve(options.configPath)
+        : findConfigFile(cwd);
+    const projectLocalFile = projectLocalConfigFile(projectFile, cwd);
+    let merged = {};
+    if (userFile)
+        merged = deepMerge(merged, await readYamlFile(userFile));
+    if (projectFile)
+        merged = deepMerge(merged, await readYamlFile(projectFile));
+    if (projectLocalFile && projectLocalFile !== projectFile) {
+        merged = deepMerge(merged, await readYamlFile(projectLocalFile));
+    }
+    if (options.cliOverrides) {
+        merged = applyCliOverrides(merged, options.cliOverrides);
+    }
+    const interpolated = interpolateDeep(merged);
+    let config;
+    try {
+        config = PlConfigSchema.parse(interpolated);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid PrismaLens configuration: ${detail}`);
+    }
+    return Object.freeze(config);
+}
+//# sourceMappingURL=loader.js.map

package/dist/src/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/config/loader.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6BAA6B;AAE7B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAiB,cAAc,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AACzD,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AACrE,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAoB3C,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAC7B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,SAAS,CAAC;QACT,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc;IACtB,MAAM,SAAS,GAAG,IAAI,CACrB,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAC7C,oBAAoB,CACpB,CAAC;IACF,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,qFAAqF;AACrF,SAAS,sBAAsB,CAC9B,WAA+B,EAC/B,GAAW;IAEX,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,QAAgB;IAEhB,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,OAAQ,SAAS,CAAC,OAAO,CAA6B,IAAI,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEzC,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;YACzD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACd,iDAAiD,IAAI,YAAY,IAAI,IAAI,CACzE,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC;QACV,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC3B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,oFAAoF;AACpF,SAAS,SAAS,CACjB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CACzB,MAA+B,EAC/B,CAAe;IAEf,MAAM,KAAK,GAA4B,EAAE,CAAC;IAE1C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAEvD,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;QAAE,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;IAC7E,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS;QAClC,SAAS,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAEnE,OAAO,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,UAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEzC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU;QACrC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAElE,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,QAAQ;QAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,WAAW;QAAE,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;QAC1D,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAA4B,CAAC;IAExE,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/src/config/schema.d.ts

@@ -0,0 +1,336 @@
+import { z } from "zod";
+/**
+ * The single posture dial (ADR-0017) — prismalens does not build a permission
+ * policy engine; it exposes this one dial and translates it to each harness's
+ * native config. Defaults to the safest posture, `read-only`.
+ */
+export declare const PermissionConfigSchema: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<["read-only", "supervised", "auto", "dangerous"]>>;
+}, "strip", z.ZodTypeAny, {
+    mode: "read-only" | "supervised" | "auto" | "dangerous";
+}, {
+    mode?: "read-only" | "supervised" | "auto" | "dangerous" | undefined;
+}>;
+/**
+ * Arbitrary harness-native passthrough (ADR-0017) — e.g. Agent SDK query options
+ * for `claude-code`, or `args` (extra CLI args) for `deepagents`. Kept untyped
+ * here (per-harness runners narrow it); prismalens does not validate the shape,
+ * it defers to the harness.
+ */
+export declare const HarnessNativeConfigSchema: z.ZodObject<{
+    native: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    native?: Record<string, unknown> | undefined;
+}, {
+    native?: Record<string, unknown> | undefined;
+}>;
+/**
+ * Best-effort resource caps for the sandboxed harness run (ADR-0020: "resource
+ * limits are part of the contract"). All optional with NO defaults — an unset knob
+ * means "no cap", never a value that would lie about being enforced. What actually
+ * takes effect is provider-dependent (the `process` floor enforces only
+ * `wall_clock_ms`; `srt` adds memory/cpu when `systemd-run` is present).
+ */
+export declare const AgentLimitsConfigSchema: z.ZodObject<{
+    /** Wall-clock deadline (ms) — enforced by every sandbox provider. */
+    wall_clock_ms: z.ZodOptional<z.ZodNumber>;
+    /** Memory ceiling (MB) — best-effort (srt+systemd-run only). */
+    memory_mb: z.ZodOptional<z.ZodNumber>;
+    /** CPU quota (whole/fractional cores) — best-effort (srt+systemd-run only). */
+    cpu_cores: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    wall_clock_ms?: number | undefined;
+    memory_mb?: number | undefined;
+    cpu_cores?: number | undefined;
+}, {
+    wall_clock_ms?: number | undefined;
+    memory_mb?: number | undefined;
+    cpu_cores?: number | undefined;
+}>;
+/** Tier-2 harness backend the supervisor rents (ADR-0008). */
+export declare const AgentConfigSchema: z.ZodObject<{
+    default: z.ZodDefault<z.ZodEnum<["deepagents", "claude-code", "codex"]>>;
+    /**
+     * BARE model id (e.g. "gpt-oss:120b") — the chosen harness applies its own
+     * provider prefix (ADR-0017: deepagents prepends "openai:"; Claude Code takes it
+     * bare). Also reused as the Tier-1 reduce model id. Omit to let the harness pick
+     * its own default.
+     */
+    model: z.ZodOptional<z.ZodString>;
+    /** The posture dial (ADR-0017). Defaults to `read-only`. */
+    permissions: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        mode: "read-only" | "supervised" | "auto" | "dangerous";
+    }, Record<string, unknown> | undefined>;
+    /**
+     * The isolation boundary the harness runs in (ADR-0020): `process` (the always-on
+     * cooperative floor), `srt` (enforced OS boundary), or `auto` (srt WHEN its egress
+     * bridge is healthy — the self-check, B.1.1 — else the floor; the degrade is honest,
+     * never silent). Defaults to `auto`: honest precisely BECAUSE of the self-check, which
+     * is what makes it safe to prefer the enforced boundary by default.
+     */
+    sandbox: z.ZodDefault<z.ZodEnum<["auto", "process", "srt", "e2b"]>>;
+    /**
+     * Best-effort resource caps for the sandboxed harness (ADR-0020). Optional; an
+     * omitted section means "no caps" (the object defaults to `{}` after parse).
+     */
+    limits: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        wall_clock_ms?: number | undefined;
+        memory_mb?: number | undefined;
+        cpu_cores?: number | undefined;
+    }, Record<string, unknown> | undefined>;
+    /**
+     * Per-alert fan-out cap (ADR-0016 decision 2): the max branches the supervisor
+     * runs when a context carries multiple alerts. Optional — omitted ⇒ the engine
+     * default (3). A single-alert run always uses one branch regardless.
+     */
+    max_branches: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    default: "deepagents" | "claude-code" | "codex";
+    permissions: {
+        mode: "read-only" | "supervised" | "auto" | "dangerous";
+    };
+    sandbox: "auto" | "process" | "srt" | "e2b";
+    limits: {
+        wall_clock_ms?: number | undefined;
+        memory_mb?: number | undefined;
+        cpu_cores?: number | undefined;
+    };
+    model?: string | undefined;
+    max_branches?: number | undefined;
+}, {
+    default?: "deepagents" | "claude-code" | "codex" | undefined;
+    model?: string | undefined;
+    permissions?: Record<string, unknown> | undefined;
+    sandbox?: "auto" | "process" | "srt" | "e2b" | undefined;
+    limits?: Record<string, unknown> | undefined;
+    max_branches?: number | undefined;
+}>;
+export declare const WorkspaceConfigSchema: z.ZodObject<{
+    base_dir: z.ZodDefault<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    base_dir: string;
+}, {
+    base_dir?: string | undefined;
+}>;
+/**
+ * Read-only telemetry + app endpoints the harness may query. Mirrors the engine's
+ * TelemetryEndpoints (camelCase) so a loaded config can be handed straight to
+ * `InvestigateOptions.telemetry`. All optional here — resolved/overridden per run.
+ */
+export declare const TelemetryConfigSchema: z.ZodObject<{
+    prometheusUrl: z.ZodOptional<z.ZodString>;
+    alertmanagerUrl: z.ZodOptional<z.ZodString>;
+    apiUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    prometheusUrl?: string | undefined;
+    alertmanagerUrl?: string | undefined;
+    apiUrl?: string | undefined;
+}, {
+    prometheusUrl?: string | undefined;
+    alertmanagerUrl?: string | undefined;
+    apiUrl?: string | undefined;
+}>;
+/**
+ * A service in the catalog (ADR-0015). The CLI maps the matched entry into the
+ * investigation context's `service` field so a single-alert run carries the affected
+ * service's repo/tier/deps, not just the bare alert.
+ */
+export declare const ServiceConfigSchema: z.ZodObject<{
+    tier: z.ZodOptional<z.ZodString>;
+    /** owner/name slug or a local path the harness reads. */
+    repo: z.ZodOptional<z.ZodString>;
+    /** Direct dependency service names (blast-radius seed). */
+    depends_on: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    depends_on: string[];
+    tier?: string | undefined;
+    repo?: string | undefined;
+}, {
+    tier?: string | undefined;
+    repo?: string | undefined;
+    depends_on?: string[] | undefined;
+}>;
+/** A read-only log-query system the harness may curl (Loki/Elasticsearch/…). */
+export declare const LogSourceConfigSchema: z.ZodObject<{
+    kind: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    kind?: string | undefined;
+    url?: string | undefined;
+}, {
+    kind?: string | undefined;
+    url?: string | undefined;
+}>;
+/** Free-form `{ source: { key: value } }` connection hints for alert ingestion. */
+export declare const AlertSourceConfigSchema: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>;
+export declare const RepoConfigSchema: z.ZodObject<{
+    repo: z.ZodString;
+    local_path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    alert_sources: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+}, "strip", z.ZodTypeAny, {
+    repo: string;
+    local_path: string | null;
+    alert_sources?: Record<string, Record<string, string>> | undefined;
+}, {
+    repo: string;
+    local_path?: string | null | undefined;
+    alert_sources?: Record<string, Record<string, string>> | undefined;
+}>;
+export declare const PlConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    /** Convenience single-repo default (owner/name); `repos` is the multi-repo map. */
+    repo: z.ZodOptional<z.ZodString>;
+    repos: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        repo: z.ZodString;
+        local_path: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        alert_sources: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    }, "strip", z.ZodTypeAny, {
+        repo: string;
+        local_path: string | null;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }, {
+        repo: string;
+        local_path?: string | null | undefined;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }>>>, Record<string, {
+        repo: string;
+        local_path: string | null;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }>, Record<string, {
+        repo: string;
+        local_path?: string | null | undefined;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }> | undefined>;
+    /** Service catalog (ADR-0015) — keyed by service name; maps into the context. */
+    services: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        tier: z.ZodOptional<z.ZodString>;
+        /** owner/name slug or a local path the harness reads. */
+        repo: z.ZodOptional<z.ZodString>;
+        /** Direct dependency service names (blast-radius seed). */
+        depends_on: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        depends_on: string[];
+        tier?: string | undefined;
+        repo?: string | undefined;
+    }, {
+        tier?: string | undefined;
+        repo?: string | undefined;
+        depends_on?: string[] | undefined;
+    }>>>, Record<string, {
+        depends_on: string[];
+        tier?: string | undefined;
+        repo?: string | undefined;
+    }>, Record<string, {
+        tier?: string | undefined;
+        repo?: string | undefined;
+        depends_on?: string[] | undefined;
+    }> | undefined>;
+    /** Read-only log-query system the harness may query. */
+    logs: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        kind?: string | undefined;
+        url?: string | undefined;
+    }, Record<string, unknown> | undefined>;
+    agent: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        default: "deepagents" | "claude-code" | "codex";
+        permissions: {
+            mode: "read-only" | "supervised" | "auto" | "dangerous";
+        };
+        sandbox: "auto" | "process" | "srt" | "e2b";
+        limits: {
+            wall_clock_ms?: number | undefined;
+            memory_mb?: number | undefined;
+            cpu_cores?: number | undefined;
+        };
+        model?: string | undefined;
+        max_branches?: number | undefined;
+    }, Record<string, unknown> | undefined>;
+    workspace: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        base_dir: string;
+    }, Record<string, unknown> | undefined>;
+    telemetry: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>, {
+        prometheusUrl?: string | undefined;
+        alertmanagerUrl?: string | undefined;
+        apiUrl?: string | undefined;
+    }, Record<string, unknown> | undefined>;
+    alert_sources: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>, Record<string, Record<string, string>>, Record<string, Record<string, string>> | undefined>;
+    /** Per-harness native passthrough (ADR-0017), keyed by harness id. */
+    harnesses: z.ZodEffects<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        native: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        native?: Record<string, unknown> | undefined;
+    }, {
+        native?: Record<string, unknown> | undefined;
+    }>>>, Record<string, {
+        native?: Record<string, unknown> | undefined;
+    }>, Record<string, {
+        native?: Record<string, unknown> | undefined;
+    }> | undefined>;
+}, "strip", z.ZodTypeAny, {
+    alert_sources: Record<string, Record<string, string>>;
+    repos: Record<string, {
+        repo: string;
+        local_path: string | null;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }>;
+    services: Record<string, {
+        depends_on: string[];
+        tier?: string | undefined;
+        repo?: string | undefined;
+    }>;
+    logs: {
+        kind?: string | undefined;
+        url?: string | undefined;
+    };
+    agent: {
+        default: "deepagents" | "claude-code" | "codex";
+        permissions: {
+            mode: "read-only" | "supervised" | "auto" | "dangerous";
+        };
+        sandbox: "auto" | "process" | "srt" | "e2b";
+        limits: {
+            wall_clock_ms?: number | undefined;
+            memory_mb?: number | undefined;
+            cpu_cores?: number | undefined;
+        };
+        model?: string | undefined;
+        max_branches?: number | undefined;
+    };
+    workspace: {
+        base_dir: string;
+    };
+    telemetry: {
+        prometheusUrl?: string | undefined;
+        alertmanagerUrl?: string | undefined;
+        apiUrl?: string | undefined;
+    };
+    harnesses: Record<string, {
+        native?: Record<string, unknown> | undefined;
+    }>;
+    repo?: string | undefined;
+    $schema?: string | undefined;
+}, {
+    repo?: string | undefined;
+    alert_sources?: Record<string, Record<string, string>> | undefined;
+    $schema?: string | undefined;
+    repos?: Record<string, {
+        repo: string;
+        local_path?: string | null | undefined;
+        alert_sources?: Record<string, Record<string, string>> | undefined;
+    }> | undefined;
+    services?: Record<string, {
+        tier?: string | undefined;
+        repo?: string | undefined;
+        depends_on?: string[] | undefined;
+    }> | undefined;
+    logs?: Record<string, unknown> | undefined;
+    agent?: Record<string, unknown> | undefined;
+    workspace?: Record<string, unknown> | undefined;
+    telemetry?: Record<string, unknown> | undefined;
+    harnesses?: Record<string, {
+        native?: Record<string, unknown> | undefined;
+    }> | undefined;
+}>;
+export type PlConfigInput = z.input<typeof PlConfigSchema>;
+/** The validated, defaults-applied config consumed by the CLI commands. */
+export type PlConfig = z.output<typeof PlConfigSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/src/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/config/schema.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;IACnC,qEAAqE;;IAErE,gEAAgE;;IAEhE,+EAA+E;;;;;;;;;;EAE9E,CAAC;AAEH,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB;;IAE7B;;;;;OAKG;;IAEH,4DAA4D;;;;IAE5D;;;;;;OAMG;;IAEH;;;OAGG;;;;;;IAEH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;EAEF,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAIhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;IAE/B,yDAAyD;;IAEzD,2DAA2D;;;;;;;;;;EAE1D,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,uBAAuB,iEAGnC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAI3B,CAAC;AAcH,eAAO,MAAM,cAAc;;IAE1B,mFAAmF;;;;;;;;;;;;;;;;;;;;;;;IAMnF,iFAAiF;;;QA5CjF,yDAAyD;;QAEzD,2DAA2D;;;;;;;;;;;;;;;;;;;IA+C3D,wDAAwD;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQxD,sEAAsE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKrE,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC3D,2EAA2E;AAC3E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/src/config/schema.js

@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Sumit Patel
+/**
+ * prismalens.config.yaml schema (ADR-0010 engine-as-CLI), adapted from the retired
+ * pl orchestrator's config to the two-tier engine (ADR-0008).
+ *
+ * What changed vs. the old pl config:
+ *  - `agent.default` enum is the harness BACKEND the supervisor rents
+ *    ("deepagents" | "claude-code" | "codex"), not the old "deepagents-cli" et al.
+ *  - `agent.model` is now OPTIONAL — each harness has its own default (deepagents:
+ *    "openai:gpt-oss:120b"; Claude Code: the CLI/subscription default).
+ *  - ADDED `telemetry` — the engine's TelemetryEndpoints (read-only surfaces the
+ *    rented harness queries).
+ *  - DROPPED the gatherer/analyst/verifier role taxonomy: `harness.roles` +
+ *    `harness.tool_access`, the `sub_agents` role section, `investigation`, and
+ *    `convergence.confidence_threshold` (ADR-0002: no numeric confidence). In the
+ *    two-tier engine decompose is N=1 (one alert → one rented branch → reduce), so
+ *    the role machinery is gone.
+ */
+import { HARNESS_IDS, PERMISSION_MODES } from "@prismalens/config/harness";
+import { SANDBOX_MODES } from "@prismalens/engine";
+import { z } from "zod";
+/**
+ * The single posture dial (ADR-0017) — prismalens does not build a permission
+ * policy engine; it exposes this one dial and translates it to each harness's
+ * native config. Defaults to the safest posture, `read-only`.
+ */
+export const PermissionConfigSchema = z.object({
+    mode: z.enum(PERMISSION_MODES).default("read-only"),
+});
+/**
+ * Arbitrary harness-native passthrough (ADR-0017) — e.g. Agent SDK query options
+ * for `claude-code`, or `args` (extra CLI args) for `deepagents`. Kept untyped
+ * here (per-harness runners narrow it); prismalens does not validate the shape,
+ * it defers to the harness.
+ */
+export const HarnessNativeConfigSchema = z.object({
+    native: z.record(z.string(), z.unknown()).optional(),
+});
+/**
+ * Best-effort resource caps for the sandboxed harness run (ADR-0020: "resource
+ * limits are part of the contract"). All optional with NO defaults — an unset knob
+ * means "no cap", never a value that would lie about being enforced. What actually
+ * takes effect is provider-dependent (the `process` floor enforces only
+ * `wall_clock_ms`; `srt` adds memory/cpu when `systemd-run` is present).
+ */
+export const AgentLimitsConfigSchema = z.object({
+    /** Wall-clock deadline (ms) — enforced by every sandbox provider. */
+    wall_clock_ms: z.number().int().positive().optional(),
+    /** Memory ceiling (MB) — best-effort (srt+systemd-run only). */
+    memory_mb: z.number().int().positive().optional(),
+    /** CPU quota (whole/fractional cores) — best-effort (srt+systemd-run only). */
+    cpu_cores: z.number().positive().optional(),
+});
+/** Tier-2 harness backend the supervisor rents (ADR-0008). */
+export const AgentConfigSchema = z.object({
+    default: z.enum(HARNESS_IDS).default("deepagents"),
+    /**
+     * BARE model id (e.g. "gpt-oss:120b") — the chosen harness applies its own
+     * provider prefix (ADR-0017: deepagents prepends "openai:"; Claude Code takes it
+     * bare). Also reused as the Tier-1 reduce model id. Omit to let the harness pick
+     * its own default.
+     */
+    model: z.string().optional(),
+    /** The posture dial (ADR-0017). Defaults to `read-only`. */
+    permissions: optionalWithDefaults(PermissionConfigSchema),
+    /**
+     * The isolation boundary the harness runs in (ADR-0020): `process` (the always-on
+     * cooperative floor), `srt` (enforced OS boundary), or `auto` (srt WHEN its egress
+     * bridge is healthy — the self-check, B.1.1 — else the floor; the degrade is honest,
+     * never silent). Defaults to `auto`: honest precisely BECAUSE of the self-check, which
+     * is what makes it safe to prefer the enforced boundary by default.
+     */
+    sandbox: z.enum(SANDBOX_MODES).default("auto"),
+    /**
+     * Best-effort resource caps for the sandboxed harness (ADR-0020). Optional; an
+     * omitted section means "no caps" (the object defaults to `{}` after parse).
+     */
+    limits: optionalWithDefaults(AgentLimitsConfigSchema),
+    /**
+     * Per-alert fan-out cap (ADR-0016 decision 2): the max branches the supervisor
+     * runs when a context carries multiple alerts. Optional — omitted ⇒ the engine
+     * default (3). A single-alert run always uses one branch regardless.
+     */
+    max_branches: z.number().int().positive().optional(),
+});
+export const WorkspaceConfigSchema = z.object({
+    base_dir: z.string().default("~/.prismalens"),
+});
+/**
+ * Read-only telemetry + app endpoints the harness may query. Mirrors the engine's
+ * TelemetryEndpoints (camelCase) so a loaded config can be handed straight to
+ * `InvestigateOptions.telemetry`. All optional here — resolved/overridden per run.
+ */
+export const TelemetryConfigSchema = z.object({
+    prometheusUrl: z.string().optional(),
+    alertmanagerUrl: z.string().optional(),
+    apiUrl: z.string().optional(),
+});
+/**
+ * A service in the catalog (ADR-0015). The CLI maps the matched entry into the
+ * investigation context's `service` field so a single-alert run carries the affected
+ * service's repo/tier/deps, not just the bare alert.
+ */
+export const ServiceConfigSchema = z.object({
+    tier: z.string().optional(),
+    /** owner/name slug or a local path the harness reads. */
+    repo: z.string().optional(),
+    /** Direct dependency service names (blast-radius seed). */
+    depends_on: z.array(z.string()).default([]),
+});
+/** A read-only log-query system the harness may curl (Loki/Elasticsearch/…). */
+export const LogSourceConfigSchema = z.object({
+    kind: z.string().optional(),
+    url: z.string().optional(),
+});
+/** Free-form `{ source: { key: value } }` connection hints for alert ingestion. */
+export const AlertSourceConfigSchema = z.record(z.string(), z.record(z.string(), z.string()));
+export const RepoConfigSchema = z.object({
+    repo: z.string(),
+    local_path: z.string().nullable().default(null),
+    alert_sources: AlertSourceConfigSchema.optional(),
+});
+/**
+ * Make a sub-section optional in YAML but always present (with defaults) after
+ * parse. The transform's return is annotated `z.output<T>` so the resolved
+ * `PlConfig` keeps each sub-object's precise field types (e.g. `agent.default` is
+ * the harness-id union, not `any`) instead of collapsing to `any`.
+ */
+function optionalWithDefaults(schema) {
+    return z
+        .optional(z.record(z.string(), z.unknown()))
+        .transform((val) => schema.parse(val ?? {}));
+}
+export const PlConfigSchema = z.object({
+    $schema: z.string().optional(),
+    /** Convenience single-repo default (owner/name); `repos` is the multi-repo map. */
+    repo: z.string().optional(),
+    repos: z
+        .record(z.string(), RepoConfigSchema)
+        .optional()
+        .transform((val) => val ?? {}),
+    /** Service catalog (ADR-0015) — keyed by service name; maps into the context. */
+    services: z
+        .record(z.string(), ServiceConfigSchema)
+        .optional()
+        .transform((val) => val ?? {}),
+    /** Read-only log-query system the harness may query. */
+    logs: optionalWithDefaults(LogSourceConfigSchema),
+    agent: optionalWithDefaults(AgentConfigSchema),
+    workspace: optionalWithDefaults(WorkspaceConfigSchema),
+    telemetry: optionalWithDefaults(TelemetryConfigSchema),
+    alert_sources: AlertSourceConfigSchema.optional().transform((val) => val ?? {}),
+    /** Per-harness native passthrough (ADR-0017), keyed by harness id. */
+    harnesses: z
+        .record(z.string(), HarnessNativeConfigSchema)
+        .optional()
+        .transform((val) => val ?? {}),
+});
+//# sourceMappingURL=schema.js.map