@probelabs/visor 0.1.128 → 0.1.130-ee

package/dist/enterprise/policy/opa-compiler.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+/**
+ * OPA Rego Compiler - compiles .rego policy files to WASM bundles using the `opa` CLI.
+ *
+ * Handles:
+ * - Resolving input paths to WASM bytes (direct .wasm, directory with policy.wasm, or .rego files)
+ * - Compiling .rego files to WASM via `opa build`
+ * - Caching compiled bundles based on content hashes
+ * - Extracting policy.wasm from OPA tar.gz bundles
+ *
+ * Requires:
+ * - `opa` CLI on PATH (only when auto-compiling .rego files)
+ */
+export declare class OpaCompiler {
+    private static CACHE_DIR;
+    /**
+     * Resolve the input paths to WASM bytes.
+     *
+     * Strategy:
+     * 1. If any path is a .wasm file, read it directly
+     * 2. If a directory contains policy.wasm, read it
+     * 3. Otherwise, collect all .rego files and auto-compile via `opa build`
+     */
+    resolveWasmBytes(paths: string[]): Promise<Buffer>;
+    /**
+     * Auto-compile .rego files to a WASM bundle using the `opa` CLI.
+     *
+     * Caches the compiled bundle based on a content hash of all input .rego files
+     * so subsequent runs skip compilation if policies haven't changed.
+     */
+    private compileRego;
+}
+//# sourceMappingURL=opa-compiler.d.ts.map

package/dist/enterprise/policy/opa-compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-compiler.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/policy/opa-compiler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAA6C;IAErE;;;;;;;OAOG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA+CxD;;;;;OAKG;IACH,OAAO,CAAC,WAAW;CA2FpB"}

package/dist/enterprise/policy/opa-http-evaluator.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+/**
+ * OPA HTTP Evaluator - evaluates policies via an external OPA server's REST API.
+ *
+ * Uses the built-in `fetch` API (Node 18+), so no extra dependencies are needed.
+ */
+export declare class OpaHttpEvaluator {
+    private baseUrl;
+    private timeout;
+    constructor(baseUrl: string, timeout?: number);
+    /**
+     * Check if a hostname is blocked due to SSRF concerns.
+     *
+     * Blocks:
+     * - Loopback addresses (127.x.x.x, localhost, 0.0.0.0, ::1)
+     * - Link-local addresses (169.254.x.x)
+     * - Private networks (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
+     * - IPv6 unique local addresses (fd00::/8)
+     * - Cloud metadata services (*.internal)
+     */
+    private isBlockedHostname;
+    /**
+     * Evaluate a policy rule against an input document via OPA REST API.
+     *
+     * @param input - The input document to evaluate
+     * @param rulePath - OPA rule path (e.g., 'visor/check/execute')
+     * @returns The result object from OPA, or undefined on error
+     */
+    evaluate(input: object, rulePath: string): Promise<any>;
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=opa-http-evaluator.d.ts.map

package/dist/enterprise/policy/opa-http-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-http-evaluator.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/policy/opa-http-evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,MAAa;IAyBnD;;;;;;;;;OASG;IACH,OAAO,CAAC,iBAAiB;IA6EzB;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAsCvD,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAGhC"}

package/dist/enterprise/policy/opa-policy-engine.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+import type { PolicyEngine, PolicyConfig, PolicyDecision } from '../../policy/types';
+import { type ActorContext, type RepositoryContext, type PullRequestContext } from './policy-input-builder';
+/**
+ * Enterprise OPA Policy Engine.
+ *
+ * Wraps both WASM (local) and HTTP (remote) OPA evaluators behind the
+ * OSS PolicyEngine interface. All OPA input building and role resolution
+ * is handled internally — the OSS call sites pass only plain types.
+ */
+export declare class OpaPolicyEngine implements PolicyEngine {
+    private evaluator;
+    private fallback;
+    private timeout;
+    private config;
+    private inputBuilder;
+    private logger;
+    constructor(config: PolicyConfig);
+    initialize(config: PolicyConfig): Promise<void>;
+    /**
+     * Update actor/repo/PR context (e.g., after PR info becomes available).
+     * Called by the enterprise loader when engine context is enriched.
+     */
+    setActorContext(actor: ActorContext, repo?: RepositoryContext, pullRequest?: PullRequestContext): void;
+    evaluateCheckExecution(checkId: string, checkConfig: unknown): Promise<PolicyDecision>;
+    evaluateToolInvocation(serverName: string, methodName: string, transport?: string): Promise<PolicyDecision>;
+    evaluateCapabilities(checkId: string, capabilities: {
+        allowEdit?: boolean;
+        allowBash?: boolean;
+        allowedTools?: string[];
+    }): Promise<PolicyDecision>;
+    shutdown(): Promise<void>;
+    private resolveRulePath;
+    private doEvaluate;
+    private rawEvaluate;
+    /**
+     * Navigate nested OPA WASM result tree to reach the specific rule's output.
+     * The WASM entrypoint `-e visor` means the result root IS the visor package,
+     * so we strip the `visor/` prefix and walk the remaining segments.
+     */
+    private navigateWasmResult;
+    private parseDecision;
+}
+//# sourceMappingURL=opa-policy-engine.d.ts.map

package/dist/enterprise/policy/opa-policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-policy-engine.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/policy/opa-policy-engine.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACZ,cAAc,EAEf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,YAAY;IAClD,OAAO,CAAC,SAAS,CAAoD;IACrE,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,YAAY,CAAmC;IACvD,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,EAAE,YAAY;IAM1B,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDrD;;;OAGG;IACH,eAAe,CACb,KAAK,EAAE,YAAY,EACnB,IAAI,CAAC,EAAE,iBAAiB,EACxB,WAAW,CAAC,EAAE,kBAAkB,GAC/B,IAAI;IAID,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC;IAmBtF,sBAAsB,CAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC;IAMpB,oBAAoB,CACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE;QACZ,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,GACA,OAAO,CAAC,cAAc,CAAC;IAMpB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ/B,OAAO,CAAC,eAAe;YAOT,UAAU;YAkCV,WAAW;IAWzB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,aAAa;CAqBtB"}

package/dist/enterprise/policy/opa-wasm-evaluator.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+/**
+ * OPA WASM Evaluator - loads and evaluates OPA policies locally.
+ *
+ * Supports three input formats:
+ * 1. Pre-compiled `.wasm` bundle — loaded directly (fastest startup)
+ * 2. `.rego` files or directory — auto-compiled to WASM via `opa build` CLI
+ * 3. Directory with `policy.wasm` inside — loaded directly
+ *
+ * Compilation and caching of .rego files is delegated to {@link OpaCompiler}.
+ *
+ * Requires:
+ * - `@open-policy-agent/opa-wasm` npm package (optional dep)
+ * - `opa` CLI on PATH (only when auto-compiling .rego files)
+ */
+export declare class OpaWasmEvaluator {
+    private policy;
+    private dataDocument;
+    private compiler;
+    initialize(rulesPath: string | string[]): Promise<void>;
+    /**
+     * Load external data from a JSON file to use as the OPA data document.
+     * The loaded data will be passed to `policy.setData()` during evaluation,
+     * making it available in Rego via `data.<key>`.
+     */
+    loadData(dataPath: string): void;
+    evaluate(input: object): Promise<any>;
+    shutdown(): Promise<void>;
+}
+//# sourceMappingURL=opa-wasm-evaluator.d.ts.map

package/dist/enterprise/policy/opa-wasm-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-wasm-evaluator.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/policy/opa-wasm-evaluator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,YAAY,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAkC;IAE5C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B7D;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IA2B1B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAcrC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAehC"}

package/dist/enterprise/policy/policy-input-builder.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+import type { PolicyConfig, StepPolicyOverride } from '../../policy/types';
+/**
+ * OPA input document shape (internal to enterprise code).
+ * This mirrors what OPA .rego rules expect — OSS code never sees this type.
+ */
+export interface OpaInput {
+    scope: string;
+    check?: {
+        id: string;
+        type: string;
+        group?: string;
+        tags?: string[];
+        criticality?: string;
+        sandbox?: string;
+        policy?: StepPolicyOverride;
+    };
+    tool?: {
+        serverName: string;
+        methodName: string;
+        transport?: string;
+    };
+    capability?: {
+        allowEdit?: boolean;
+        allowBash?: boolean;
+        allowedTools?: string[];
+        enableDelegate?: boolean;
+        sandbox?: string;
+    };
+    actor: {
+        authorAssociation?: string;
+        login?: string;
+        roles: string[];
+        isLocalMode: boolean;
+        slack?: {
+            userId?: string;
+            email?: string;
+            channelId?: string;
+            channelType?: 'channel' | 'dm' | 'group';
+        };
+    };
+    repository?: {
+        owner?: string;
+        name?: string;
+        branch?: string;
+        baseBranch?: string;
+        event?: string;
+        action?: string;
+    };
+    pullRequest?: {
+        number?: number;
+        labels?: string[];
+        draft?: boolean;
+        changedFiles?: number;
+    };
+}
+export interface ActorContext {
+    authorAssociation?: string;
+    login?: string;
+    isLocalMode: boolean;
+    slack?: {
+        userId?: string;
+        email?: string;
+        channelId?: string;
+        channelType?: 'channel' | 'dm' | 'group';
+    };
+}
+export interface RepositoryContext {
+    owner?: string;
+    name?: string;
+    branch?: string;
+    baseBranch?: string;
+    event?: string;
+    action?: string;
+}
+export interface PullRequestContext {
+    number?: number;
+    labels?: string[];
+    draft?: boolean;
+    changedFiles?: number;
+}
+export interface CheckContext {
+    id: string;
+    type: string;
+    group?: string;
+    tags?: string[];
+    criticality?: string;
+    sandbox?: string;
+    policy?: StepPolicyOverride;
+}
+/**
+ * Builds OPA-compatible input documents from engine context.
+ *
+ * Resolves actor roles from the `policy.roles` config section by matching
+ * the actor's authorAssociation and login against role definitions.
+ */
+export declare class PolicyInputBuilder {
+    private roles;
+    private actor;
+    private repository?;
+    private pullRequest?;
+    constructor(policyConfig: PolicyConfig, actor: ActorContext, repository?: RepositoryContext, pullRequest?: PullRequestContext);
+    /** Resolve which roles apply to the current actor. */
+    resolveRoles(): string[];
+    private buildActor;
+    forCheckExecution(check: CheckContext): OpaInput;
+    forToolInvocation(serverName: string, methodName: string, transport?: string): OpaInput;
+    forCapabilityResolve(checkId: string, capabilities: {
+        allowEdit?: boolean;
+        allowBash?: boolean;
+        allowedTools?: string[];
+        enableDelegate?: boolean;
+        sandbox?: string;
+    }): OpaInput;
+}
+//# sourceMappingURL=policy-input-builder.d.ts.map

package/dist/enterprise/policy/policy-input-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-input-builder.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/policy/policy-input-builder.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7F;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,kBAAkB,CAAC;KAC7B,CAAC;IACF,IAAI,CAAC,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,KAAK,EAAE;QACL,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,EAAE,OAAO,CAAC;QACrB,KAAK,CAAC,EAAE;YACN,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,WAAW,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC;SAC1C,CAAC;KACH,CAAC;IACF,UAAU,CAAC,EAAE;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC;KAC1C,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,UAAU,CAAC,CAAoB;IACvC,OAAO,CAAC,WAAW,CAAC,CAAqB;gBAGvC,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,YAAY,EACnB,UAAU,CAAC,EAAE,iBAAiB,EAC9B,WAAW,CAAC,EAAE,kBAAkB;IAQlC,sDAAsD;IACtD,YAAY,IAAI,MAAM,EAAE;IA8DxB,OAAO,CAAC,UAAU;IAUlB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ;IAkBhD,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ;IAUvF,oBAAoB,CAClB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE;QACZ,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GACA,QAAQ;CAUZ"}

package/dist/enterprise/scheduler/knex-store.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Copyright (c) ProbeLabs. All rights reserved.
+ * Licensed under the Elastic License 2.0; you may not use this file except
+ * in compliance with the Elastic License 2.0.
+ */
+import type { Schedule, ScheduleLimits } from '../../scheduler/schedule-store';
+import type { ScheduleStoreBackend, ScheduleStoreStats, StorageConfig, HAConfig } from '../../scheduler/store/types';
+/**
+ * Enterprise Knex-backed store for PostgreSQL, MySQL, and MSSQL
+ */
+export declare class KnexStoreBackend implements ScheduleStoreBackend {
+    private knex;
+    private driver;
+    private connection;
+    constructor(driver: 'postgresql' | 'mysql' | 'mssql', storageConfig: StorageConfig, _haConfig?: HAConfig);
+    initialize(): Promise<void>;
+    private buildStandardConnection;
+    private buildMssqlConnection;
+    private resolveSslConfig;
+    private validateSslPath;
+    shutdown(): Promise<void>;
+    private migrateSchema;
+    private getKnex;
+    create(schedule: Omit<Schedule, 'id' | 'createdAt' | 'runCount' | 'failureCount' | 'status'>): Promise<Schedule>;
+    importSchedule(schedule: Schedule): Promise<void>;
+    get(id: string): Promise<Schedule | undefined>;
+    update(id: string, patch: Partial<Schedule>): Promise<Schedule | undefined>;
+    delete(id: string): Promise<boolean>;
+    getByCreator(creatorId: string): Promise<Schedule[]>;
+    getActiveSchedules(): Promise<Schedule[]>;
+    getDueSchedules(now?: number): Promise<Schedule[]>;
+    findByWorkflow(creatorId: string, workflowName: string): Promise<Schedule[]>;
+    getAll(): Promise<Schedule[]>;
+    getStats(): Promise<ScheduleStoreStats>;
+    validateLimits(creatorId: string, isRecurring: boolean, limits: ScheduleLimits): Promise<void>;
+    tryAcquireLock(lockId: string, nodeId: string, ttlSeconds: number): Promise<string | null>;
+    releaseLock(lockId: string, lockToken: string): Promise<void>;
+    renewLock(lockId: string, lockToken: string, ttlSeconds: number): Promise<boolean>;
+    flush(): Promise<void>;
+}
+//# sourceMappingURL=knex-store.d.ts.map

package/dist/enterprise/scheduler/knex-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-store.d.ts","sourceRoot":"","sources":["file:///home/runner/work/visor/visor/src/enterprise/scheduler/knex-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,QAAQ,EAET,MAAM,6BAA6B,CAAC;AA+FrC;;GAEG;AACH,qBAAa,gBAAiB,YAAW,oBAAoB;IAC3D,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,UAAU,CAAyB;gBAGzC,MAAM,EAAE,YAAY,GAAG,OAAO,GAAG,OAAO,EACxC,aAAa,EAAE,aAAa,EAC5B,SAAS,CAAC,EAAE,QAAQ;IAMhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkDjC,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,oBAAoB;IAkB5B,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,eAAe;IAWjB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAOjB,aAAa;IA4C3B,OAAO,CAAC,OAAO;IAST,MAAM,CACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC,GACpF,OAAO,CAAC,QAAQ,CAAC;IAkBd,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAM9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAgB3E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMpD,kBAAkB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAMzC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAsBlD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAW5E,MAAM,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IAM7B,QAAQ,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA4BvC,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,OAAO,EACpB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC;IAqCV,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAmC1F,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAalF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/examples/README.md

@@ -126,6 +126,17 @@ Example configurations demonstrating various Visor features and use cases.
 - **`failure-conditions-github-style.yaml`** - GitHub-style failure conditions
 - **`failure-conditions-migration.yaml`** - Migration patterns for failure conditions
 
+### Sandbox Examples
+- **`sandbox-basic.yaml`** - Basic Docker sandbox with image mode
+- **`sandbox-cache.yaml`** - Sandbox with cache volume mounts
+- **`sandbox-dockerfile-inline.yaml`** - Sandbox with inline Dockerfile
+- **`sandbox-env-passthrough.yaml`** - Sandbox environment variable passthrough
+- **`sandbox-multi-env.yaml`** - Multiple sandbox environments per check
+- **`sandbox-read-only.yaml`** - Read-only sandbox with network isolation
+
+### Enterprise Policy Examples (EE)
+- **`enterprise-policy/`** - OPA policy engine with role-based access control **(Enterprise Edition -- requires license, contact hello@probelabs.com)**
+
 ### Integration Examples
 - **`jira-simple-example.yaml`** - Simple JIRA integration
 - **`jira-single-issue-workflow.yaml`** - Single JIRA issue workflow
@@ -406,6 +417,28 @@ visor --config examples/bedrock-config.yaml --provider bedrock
 visor --config examples/claude-code-config.yaml
 ```
 
+## 🐳 Sandbox Examples
+
+```bash
+# Basic Docker sandbox
+visor --config examples/sandbox-basic.yaml
+
+# Sandbox with cache volumes
+visor --config examples/sandbox-cache.yaml
+
+# Inline Dockerfile sandbox
+visor --config examples/sandbox-dockerfile-inline.yaml
+
+# Environment variable passthrough
+visor --config examples/sandbox-env-passthrough.yaml
+
+# Multiple sandbox environments
+visor --config examples/sandbox-multi-env.yaml
+
+# Read-only sandbox with network isolation
+visor --config examples/sandbox-read-only.yaml
+```
+
 ## 🔧 MCP & Tools Examples
 
 ```bash
@@ -434,6 +467,26 @@ visor --config examples/workflows/quick-pr-check.yaml --input "pr_type=feature"
 visor --config examples/workflows/workflow-composition-example.yaml
 ```
 
+## Enterprise Policy Engine (EE)
+
+> **Enterprise Edition feature.** Requires a Visor EE license.
+> Contact **hello@probelabs.com** for licensing.
+
+Role-based access control for checks, MCP tools, and AI capabilities using OPA (Open Policy Agent) policies:
+
+```bash
+# Install EE build
+npm install @probelabs/visor@ee
+
+# Set license
+export VISOR_LICENSE="<your-jwt-token>"
+
+# Run with policy enforcement
+visor --config examples/enterprise-policy/visor.yaml
+```
+
+See [`examples/enterprise-policy/README.md`](enterprise-policy/README.md) for full documentation, configuration reference, and Rego policy examples.
+
 ## 📚 Further Reading
 
 - [Main README](../README.md) - Complete Visor documentation

package/dist/examples/calculator-config.yaml

@@ -38,7 +38,7 @@ checks:
     operation: set
     namespace: calculator
     key: number1
-    value_js: "parseFloat(outputs['get-number1'])"
+    value_js: "parseFloat(outputs['get-number1'].text)"
 
   # Step 3: Get second number
   get-number2:
@@ -55,7 +55,7 @@ checks:
     operation: set
     namespace: calculator
     key: number2
-    value_js: "parseFloat(outputs['get-number2'])"
+    value_js: "parseFloat(outputs['get-number2'].text)"
 
   # Step 5: Get operation
   get-operation:
@@ -72,7 +72,7 @@ checks:
     operation: set
     namespace: calculator
     key: operation
-    value_js: "outputs['get-operation'].trim()"
+    value_js: "outputs['get-operation'].text.trim()"
 
   # Step 7: Perform calculation using memory and JavaScript
   calculate:
@@ -122,7 +122,7 @@ checks:
       ║          CALCULATION RESULT            ║
       ╠════════════════════════════════════════╣
       ║                                        ║
-      ║  {{ outputs['get-number1'] }} {{ outputs['get-operation'] }} {{ outputs['get-number2'] }} = {{ outputs['calculate'] }}
+      ║  {{ outputs['get-number1'].text }} {{ outputs['get-operation'].text }} {{ outputs['get-number2'].text }} = {{ outputs['calculate'] }}
       ║                                        ║
       ╚════════════════════════════════════════╝