@probelabs/visor 0.1.129 → 0.1.130

package/dist/sdk/sdk.d.ts

@@ -121,6 +121,45 @@ interface SandboxConfig {
     cache?: SandboxCacheConfig;
 }
 
+interface PolicyConfig {
+    /** Policy engine mode */
+    engine: 'local' | 'remote' | 'disabled';
+    /** Path to .rego files or .wasm bundle (local mode) */
+    rules?: string | string[];
+    /** Path to a JSON file to load as OPA data document */
+    data?: string;
+    /** OPA server URL (remote mode) */
+    url?: string;
+    /** Default decision when policy evaluation fails */
+    fallback?: 'allow' | 'deny' | 'warn';
+    /** Evaluation timeout in ms (default: 5000) */
+    timeout?: number;
+    /** Role definitions: map role names to conditions */
+    roles?: Record<string, PolicyRoleConfig>;
+}
+interface PolicyRoleConfig {
+    /** GitHub author associations that map to this role */
+    author_association?: string[];
+    /** GitHub team slugs (requires GitHub API) */
+    teams?: string[];
+    /** Explicit GitHub usernames */
+    users?: string[];
+    /** Slack user IDs (e.g., ["U0123ABC"]) */
+    slack_users?: string[];
+    /** Email addresses for identity matching (e.g., ["alice@co.com"]) */
+    emails?: string[];
+    /** Slack channel IDs — role only applies when triggered from these channels */
+    slack_channels?: string[];
+}
+interface StepPolicyOverride {
+    /** Required role(s) - any of these roles suffices */
+    require?: string | string[];
+    /** Explicit deny for roles */
+    deny?: string[];
+    /** Custom OPA rule path for this step */
+    rule?: string;
+}
+
 /**
  * Failure condition severity levels
  */
@@ -682,6 +721,8 @@ interface CheckConfig {
     persist_worktree?: boolean;
     /** Sandbox name to use for this check (overrides workspace-level default) */
     sandbox?: string;
+    /** Per-step policy override (enterprise) */
+    policy?: StepPolicyOverride;
 }
 /**
  * Backoff policy for retries
@@ -724,12 +765,16 @@ interface OnFailConfig {
      */
     transitions?: TransitionRule[];
 }
+/**
+ * Success routing run item - can be step name, step with args, or workflow with args
+ */
+type OnSuccessRunItem = string | OnInitStepInvocation | OnInitWorkflowInvocation;
 /**
  * Success routing configuration per check
  */
 interface OnSuccessConfig {
-    /** Post-success steps to run */
-    run?: string[];
+    /** Post-success steps to run - can be step names or rich invocations with arguments */
+    run?: OnSuccessRunItem[];
     /** Optional jump back to ancestor step (by id) */
     goto?: string;
     /** Simulate a different event when performing goto (e.g., 'pr_updated') */
@@ -1141,6 +1186,60 @@ interface SchedulerPermissionsConfig {
     /** List of denied workflow patterns */
     denied_workflows?: string[];
 }
+/**
+ * SSL/TLS configuration for scheduler database connections
+ */
+interface SchedulerSslConfig {
+    /** Enable SSL (default: true when SslConfig object is provided) */
+    enabled?: boolean;
+    /** Reject unauthorized certificates (default: true) */
+    reject_unauthorized?: boolean;
+    /** Path to CA certificate PEM file */
+    ca?: string;
+    /** Path to client certificate PEM file */
+    cert?: string;
+    /** Path to client key PEM file */
+    key?: string;
+}
+/**
+ * Scheduler storage connection configuration
+ */
+interface SchedulerStorageConnectionConfig {
+    /** SQLite database file path (default: '.visor/schedules.db') */
+    filename?: string;
+    /** Database host (PostgreSQL/MySQL/MSSQL) */
+    host?: string;
+    /** Database port (PostgreSQL/MySQL/MSSQL) */
+    port?: number;
+    /** Database name (PostgreSQL/MySQL/MSSQL) */
+    database?: string;
+    /** Database user (PostgreSQL/MySQL/MSSQL) */
+    user?: string;
+    /** Database password (PostgreSQL/MySQL/MSSQL) */
+    password?: string;
+    /** SSL/TLS configuration (PostgreSQL/MySQL/MSSQL) */
+    ssl?: boolean | SchedulerSslConfig;
+    /** Connection string URL (e.g., postgresql://user:pass@host/db) */
+    connection_string?: string;
+    /** Connection pool configuration */
+    pool?: {
+        min?: number;
+        max?: number;
+    };
+}
+/**
+ * Scheduler high-availability configuration
+ */
+interface SchedulerHAConfig {
+    /** Enable distributed locking for multi-node deployments (default: false) */
+    enabled?: boolean;
+    /** Unique node identifier (default: hostname-pid) */
+    node_id?: string;
+    /** Lock time-to-live in seconds (default: 60) */
+    lock_ttl?: number;
+    /** Heartbeat interval for lock renewal in seconds (default: 15) */
+    heartbeat_interval?: number;
+}
 /**
  * Scheduler configuration for workflow scheduling
  */
@@ -1149,9 +1248,15 @@ interface SchedulerConfig {
     enabled?: boolean;
     /** Storage configuration */
     storage?: {
-        /** Path to schedules JSON file (default: .visor/schedules.json) */
+        /** Path to schedules JSON file (legacy, triggers auto-migration) */
         path?: string;
+        /** Database driver (default: 'sqlite') */
+        driver?: 'sqlite' | 'postgresql' | 'mysql' | 'mssql';
+        /** Database connection configuration */
+        connection?: SchedulerStorageConnectionConfig;
     };
+    /** High-availability configuration for multi-node deployments */
+    ha?: SchedulerHAConfig;
     /** Limits for dynamic schedules */
     limits?: SchedulerLimitsConfig;
     /** Default timezone (IANA format, e.g., "America/New_York") */
@@ -1234,6 +1339,8 @@ interface VisorConfig {
     slack?: SlackConfig;
     /** Scheduler configuration for scheduled workflow execution */
     scheduler?: SchedulerConfig;
+    /** Enterprise policy engine configuration */
+    policy?: PolicyConfig;
 }
 /**
  * Workspace isolation configuration
@@ -1286,7 +1393,7 @@ interface CheckExecutionStats {
     failedRuns: number;
     skippedRuns: number;
     skipped: boolean;
-    skipReason?: 'if_condition' | 'fail_fast' | 'dependency_failed' | 'forEach_empty' | 'assume';
+    skipReason?: 'if_condition' | 'fail_fast' | 'dependency_failed' | 'forEach_empty' | 'assume' | 'policy_denied';
     skipCondition?: string;
     totalDuration: number;
     providerDurationMs?: number;
@@ -1395,6 +1502,27 @@ declare class EventBus {
     emit(event: AnyEvent | EventEnvelope): Promise<void>;
 }
 
+/** Bot transport types (trimmed for Slack v1) */
+type BotTransportType = 'slack' | string;
+interface NormalizedMessage {
+    role: 'user' | 'bot';
+    text: string;
+    timestamp: string;
+    origin?: string;
+    /** Optional user identifier (e.g., Slack user id, GitHub login) */
+    user?: string;
+}
+interface ConversationContext {
+    transport: BotTransportType;
+    thread: {
+        id: string;
+        url?: string;
+    };
+    messages: NormalizedMessage[];
+    current: NormalizedMessage;
+    attributes: Record<string, string>;
+}
+
 /**
  * Execution context passed to check providers
  */
@@ -1404,6 +1532,8 @@ interface ExecutionContext {
     reuseSession?: boolean;
     /** CLI message value (from --message argument) */
     cliMessage?: string;
+    /** Conversation context - unified access to user message across transports (CLI, Slack, etc.) */
+    conversation?: ConversationContext;
     /**
      * Stage-local baseline of output history lengths per check name.
      * When present, providers should expose an `outputs_history_stage` object in