@probelabs/visor 0.1.147-ee → 0.1.148

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-process.env.VISOR_VERSION = '0.1.147';
-process.env.PROBE_VERSION = '0.6.0-rc262';
-process.env.VISOR_COMMIT_SHA = '986bd9df126dcf4c0564d12701994e4bad407897';
-process.env.VISOR_COMMIT_SHORT = '986bd9d';
+process.env.VISOR_VERSION = '0.1.148';
+process.env.PROBE_VERSION = '0.6.0-rc264';
+process.env.VISOR_COMMIT_SHA = '8d09da19e112d8649810da46458aa77d3f034fc6';
+process.env.VISOR_COMMIT_SHORT = '8d09da19';
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
@@ -161193,7 +161193,7 @@ async function handleDumpPolicyInput(checkId, argv) {
     let PolicyInputBuilder;
     try {
         // @ts-ignore — enterprise/ may not exist in OSS builds (caught at runtime)
-        const mod = await Promise.resolve().then(() => __importStar(__nccwpck_require__(17117)));
+        const mod = await Promise.resolve().then(() => __importStar(__nccwpck_require__(71370)));
         PolicyInputBuilder = mod.PolicyInputBuilder;
     }
     catch {
@@ -167035,1690 +167035,6 @@ class DependencyResolver {
 exports.DependencyResolver = DependencyResolver;
 
 
-/***/ }),
-
-/***/ 50069:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.LicenseValidator = void 0;
-const crypto = __importStar(__nccwpck_require__(76982));
-const fs = __importStar(__nccwpck_require__(79896));
-const path = __importStar(__nccwpck_require__(16928));
-class LicenseValidator {
-    /** Ed25519 public key for license verification (PEM format). */
-    static PUBLIC_KEY = '-----BEGIN PUBLIC KEY-----\n' +
-        'MCowBQYDK2VwAyEAI/Zd08EFmgIdrDm/HXd0l3/5GBt7R1PrdvhdmEXhJlU=\n' +
-        '-----END PUBLIC KEY-----\n';
-    cache = null;
-    static CACHE_TTL = 5 * 60 * 1000; // 5 minutes
-    static GRACE_PERIOD = 72 * 3600 * 1000; // 72 hours after expiry
-    /**
-     * Load and validate license from environment or file.
-     *
-     * Resolution order:
-     * 1. VISOR_LICENSE env var (JWT string)
-     * 2. VISOR_LICENSE_FILE env var (path to file)
-     * 3. .visor-license in project root (cwd)
-     * 4. .visor-license in ~/.config/visor/
-     */
-    async loadAndValidate() {
-        // Return cached result if still fresh
-        if (this.cache && Date.now() - this.cache.validatedAt < LicenseValidator.CACHE_TTL) {
-            return this.cache.payload;
-        }
-        const token = this.resolveToken();
-        if (!token)
-            return null;
-        const payload = this.verifyAndDecode(token);
-        if (!payload)
-            return null;
-        this.cache = { payload, validatedAt: Date.now() };
-        return payload;
-    }
-    /** Check if a specific feature is licensed */
-    hasFeature(feature) {
-        if (!this.cache)
-            return false;
-        return this.cache.payload.features.includes(feature);
-    }
-    /** Check if license is valid (with grace period) */
-    isValid() {
-        if (!this.cache)
-            return false;
-        const now = Date.now();
-        const expiryMs = this.cache.payload.exp * 1000;
-        return now < expiryMs + LicenseValidator.GRACE_PERIOD;
-    }
-    /** Check if the license is within its grace period (expired but still valid) */
-    isInGracePeriod() {
-        if (!this.cache)
-            return false;
-        const now = Date.now();
-        const expiryMs = this.cache.payload.exp * 1000;
-        return now >= expiryMs && now < expiryMs + LicenseValidator.GRACE_PERIOD;
-    }
-    resolveToken() {
-        // 1. Direct env var
-        if (process.env.VISOR_LICENSE) {
-            return process.env.VISOR_LICENSE.trim();
-        }
-        // 2. File path from env (validate against path traversal)
-        if (process.env.VISOR_LICENSE_FILE) {
-            // path.resolve() produces an absolute path with all '..' segments resolved,
-            // so a separate resolved.includes('..') check is unnecessary.
-            const resolved = path.resolve(process.env.VISOR_LICENSE_FILE);
-            const home = process.env.HOME || process.env.USERPROFILE || '';
-            const allowedPrefixes = [path.normalize(process.cwd())];
-            if (home)
-                allowedPrefixes.push(path.normalize(path.join(home, '.config', 'visor')));
-            // Resolve symlinks so an attacker cannot create a symlink inside an
-            // allowed prefix that points to an arbitrary file outside it.
-            let realPath;
-            try {
-                realPath = fs.realpathSync(resolved);
-            }
-            catch {
-                return null; // File doesn't exist or isn't accessible
-            }
-            const isSafe = allowedPrefixes.some(prefix => realPath === prefix || realPath.startsWith(prefix + path.sep));
-            if (!isSafe)
-                return null;
-            return this.readFile(realPath);
-        }
-        // 3. .visor-license in cwd
-        const cwdPath = path.join(process.cwd(), '.visor-license');
-        const cwdToken = this.readFile(cwdPath);
-        if (cwdToken)
-            return cwdToken;
-        // 4. ~/.config/visor/.visor-license
-        const home = process.env.HOME || process.env.USERPROFILE || '';
-        if (home) {
-            const configPath = path.join(home, '.config', 'visor', '.visor-license');
-            const configToken = this.readFile(configPath);
-            if (configToken)
-                return configToken;
-        }
-        return null;
-    }
-    readFile(filePath) {
-        try {
-            return fs.readFileSync(filePath, 'utf-8').trim();
-        }
-        catch {
-            return null;
-        }
-    }
-    verifyAndDecode(token) {
-        try {
-            const parts = token.split('.');
-            if (parts.length !== 3)
-                return null;
-            const [headerB64, payloadB64, signatureB64] = parts;
-            // Decode header to verify algorithm
-            const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString());
-            if (header.alg !== 'EdDSA')
-                return null;
-            // Verify signature
-            const data = `${headerB64}.${payloadB64}`;
-            const signature = Buffer.from(signatureB64, 'base64url');
-            const publicKey = crypto.createPublicKey(LicenseValidator.PUBLIC_KEY);
-            // Validate that the loaded public key is actually Ed25519 (OID 1.3.101.112).
-            // This prevents algorithm-confusion attacks if the embedded key were ever
-            // swapped to a different type.
-            if (publicKey.asymmetricKeyType !== 'ed25519') {
-                return null;
-            }
-            // Ed25519 verification: algorithm must be null because EdDSA performs its
-            // own internal hashing (SHA-512) — passing a digest algorithm here would
-            // cause Node.js to throw. The key type is validated above.
-            const isValid = crypto.verify(null, Buffer.from(data), publicKey, signature);
-            if (!isValid)
-                return null;
-            // Decode payload
-            const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
-            // Validate required fields
-            if (!payload.org ||
-                !Array.isArray(payload.features) ||
-                typeof payload.exp !== 'number' ||
-                typeof payload.iat !== 'number' ||
-                !payload.sub) {
-                return null;
-            }
-            // Check expiry (with grace period)
-            const now = Date.now();
-            const expiryMs = payload.exp * 1000;
-            if (now >= expiryMs + LicenseValidator.GRACE_PERIOD) {
-                return null;
-            }
-            return payload;
-        }
-        catch {
-            return null;
-        }
-    }
-}
-exports.LicenseValidator = LicenseValidator;
-
-
-/***/ }),
-
-/***/ 87068:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.loadEnterprisePolicyEngine = loadEnterprisePolicyEngine;
-exports.loadEnterpriseStoreBackend = loadEnterpriseStoreBackend;
-const default_engine_1 = __nccwpck_require__(93866);
-/**
- * Load the enterprise policy engine if licensed, otherwise return the default no-op engine.
- *
- * This is the sole import boundary between OSS and enterprise code. Core code
- * must only import from this module (via dynamic `await import()`), never from
- * individual enterprise submodules.
- */
-async function loadEnterprisePolicyEngine(config) {
-    try {
-        const { LicenseValidator } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(50069)));
-        const validator = new LicenseValidator();
-        const license = await validator.loadAndValidate();
-        if (!license || !validator.hasFeature('policy')) {
-            return new default_engine_1.DefaultPolicyEngine();
-        }
-        if (validator.isInGracePeriod()) {
-            // eslint-disable-next-line no-console
-            console.warn('[visor:enterprise] License has expired but is within the 72-hour grace period. ' +
-                'Please renew your license.');
-        }
-        const { OpaPolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(39530)));
-        const engine = new OpaPolicyEngine(config);
-        await engine.initialize(config);
-        return engine;
-    }
-    catch (err) {
-        // Enterprise code not available or initialization failed
-        const msg = err instanceof Error ? err.message : String(err);
-        try {
-            const { logger } = __nccwpck_require__(86999);
-            logger.warn(`[PolicyEngine] Enterprise policy init failed, falling back to default: ${msg}`);
-        }
-        catch {
-            // silent
-        }
-        return new default_engine_1.DefaultPolicyEngine();
-    }
-}
-/**
- * Load the enterprise schedule store backend if licensed.
- *
- * @param driver Database driver ('postgresql', 'mysql', or 'mssql')
- * @param storageConfig Storage configuration with connection details
- * @param haConfig Optional HA configuration
- * @throws Error if enterprise license is not available or missing 'scheduler-sql' feature
- */
-async function loadEnterpriseStoreBackend(driver, storageConfig, haConfig) {
-    const { LicenseValidator } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(50069)));
-    const validator = new LicenseValidator();
-    const license = await validator.loadAndValidate();
-    if (!license || !validator.hasFeature('scheduler-sql')) {
-        throw new Error(`The ${driver} schedule storage driver requires a Visor Enterprise license ` +
-            `with the 'scheduler-sql' feature. Please upgrade or use driver: 'sqlite' (default).`);
-    }
-    if (validator.isInGracePeriod()) {
-        // eslint-disable-next-line no-console
-        console.warn('[visor:enterprise] License has expired but is within the 72-hour grace period. ' +
-            'Please renew your license.');
-    }
-    const { KnexStoreBackend } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(63737)));
-    return new KnexStoreBackend(driver, storageConfig, haConfig);
-}
-
-
-/***/ }),
-
-/***/ 628:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.OpaCompiler = void 0;
-const fs = __importStar(__nccwpck_require__(79896));
-const path = __importStar(__nccwpck_require__(16928));
-const os = __importStar(__nccwpck_require__(70857));
-const crypto = __importStar(__nccwpck_require__(76982));
-const child_process_1 = __nccwpck_require__(35317);
-/**
- * OPA Rego Compiler - compiles .rego policy files to WASM bundles using the `opa` CLI.
- *
- * Handles:
- * - Resolving input paths to WASM bytes (direct .wasm, directory with policy.wasm, or .rego files)
- * - Compiling .rego files to WASM via `opa build`
- * - Caching compiled bundles based on content hashes
- * - Extracting policy.wasm from OPA tar.gz bundles
- *
- * Requires:
- * - `opa` CLI on PATH (only when auto-compiling .rego files)
- */
-class OpaCompiler {
-    static CACHE_DIR = path.join(os.tmpdir(), 'visor-opa-cache');
-    /**
-     * Resolve the input paths to WASM bytes.
-     *
-     * Strategy:
-     * 1. If any path is a .wasm file, read it directly
-     * 2. If a directory contains policy.wasm, read it
-     * 3. Otherwise, collect all .rego files and auto-compile via `opa build`
-     */
-    async resolveWasmBytes(paths) {
-        // Collect .rego files and check for existing .wasm
-        const regoFiles = [];
-        for (const p of paths) {
-            const resolved = path.resolve(p);
-            // Reject paths containing '..' after resolution (path traversal)
-            if (path.normalize(resolved).includes('..')) {
-                throw new Error(`Policy path contains traversal sequences: ${p}`);
-            }
-            // Direct .wasm file
-            if (resolved.endsWith('.wasm') && fs.existsSync(resolved)) {
-                return fs.readFileSync(resolved);
-            }
-            if (!fs.existsSync(resolved))
-                continue;
-            const stat = fs.statSync(resolved);
-            if (stat.isDirectory()) {
-                // Check for pre-compiled policy.wasm in directory
-                const wasmCandidate = path.join(resolved, 'policy.wasm');
-                if (fs.existsSync(wasmCandidate)) {
-                    return fs.readFileSync(wasmCandidate);
-                }
-                // Collect all .rego files from directory
-                const files = fs.readdirSync(resolved);
-                for (const f of files) {
-                    if (f.endsWith('.rego')) {
-                        regoFiles.push(path.join(resolved, f));
-                    }
-                }
-            }
-            else if (resolved.endsWith('.rego')) {
-                regoFiles.push(resolved);
-            }
-        }
-        if (regoFiles.length === 0) {
-            throw new Error(`OPA WASM evaluator: no .wasm bundle or .rego files found in: ${paths.join(', ')}`);
-        }
-        // Auto-compile .rego -> .wasm
-        return this.compileRego(regoFiles);
-    }
-    /**
-     * Auto-compile .rego files to a WASM bundle using the `opa` CLI.
-     *
-     * Caches the compiled bundle based on a content hash of all input .rego files
-     * so subsequent runs skip compilation if policies haven't changed.
-     */
-    compileRego(regoFiles) {
-        // Check that `opa` CLI is available
-        try {
-            (0, child_process_1.execFileSync)('opa', ['version'], { stdio: 'pipe' });
-        }
-        catch {
-            throw new Error('OPA CLI (`opa`) not found on PATH. Install it from https://www.openpolicyagent.org/docs/latest/#running-opa\n' +
-                'Or pre-compile your .rego files: opa build -t wasm -e visor -o bundle.tar.gz ' +
-                regoFiles.join(' '));
-        }
-        // Compute content hash for cache key
-        const hash = crypto.createHash('sha256');
-        for (const f of regoFiles.sort()) {
-            hash.update(fs.readFileSync(f));
-            hash.update(f); // include filename for disambiguation
-        }
-        const cacheKey = hash.digest('hex').slice(0, 16);
-        const cacheDir = OpaCompiler.CACHE_DIR;
-        const cachedWasm = path.join(cacheDir, `${cacheKey}.wasm`);
-        // Return cached bundle if still valid
-        if (fs.existsSync(cachedWasm)) {
-            return fs.readFileSync(cachedWasm);
-        }
-        // Compile to WASM via opa build
-        fs.mkdirSync(cacheDir, { recursive: true });
-        const bundleTar = path.join(cacheDir, `${cacheKey}-bundle.tar.gz`);
-        try {
-            const args = [
-                'build',
-                '-t',
-                'wasm',
-                '-e',
-                'visor', // entrypoint: the visor package tree
-                '-o',
-                bundleTar,
-                ...regoFiles,
-            ];
-            (0, child_process_1.execFileSync)('opa', args, {
-                stdio: 'pipe',
-                timeout: 30000,
-            });
-        }
-        catch (err) {
-            const stderr = err?.stderr?.toString() || '';
-            throw new Error(`Failed to compile .rego files to WASM:\n${stderr}\n` +
-                'Ensure your .rego files are valid and the `opa` CLI is installed.');
-        }
-        // Extract policy.wasm from the tar.gz bundle
-        // OPA bundles are tar.gz with /policy.wasm inside
-        try {
-            (0, child_process_1.execFileSync)('tar', ['-xzf', bundleTar, '-C', cacheDir, '/policy.wasm'], {
-                stdio: 'pipe',
-            });
-            const extractedWasm = path.join(cacheDir, 'policy.wasm');
-            if (fs.existsSync(extractedWasm)) {
-                // Move to cache-key named file
-                fs.renameSync(extractedWasm, cachedWasm);
-            }
-        }
-        catch {
-            // Some tar implementations don't like leading /
-            try {
-                (0, child_process_1.execFileSync)('tar', ['-xzf', bundleTar, '-C', cacheDir, 'policy.wasm'], {
-                    stdio: 'pipe',
-                });
-                const extractedWasm = path.join(cacheDir, 'policy.wasm');
-                if (fs.existsSync(extractedWasm)) {
-                    fs.renameSync(extractedWasm, cachedWasm);
-                }
-            }
-            catch (err2) {
-                throw new Error(`Failed to extract policy.wasm from OPA bundle: ${err2?.message || err2}`);
-            }
-        }
-        // Clean up tar
-        try {
-            fs.unlinkSync(bundleTar);
-        }
-        catch { }
-        if (!fs.existsSync(cachedWasm)) {
-            throw new Error('OPA build succeeded but policy.wasm was not found in the bundle');
-        }
-        return fs.readFileSync(cachedWasm);
-    }
-}
-exports.OpaCompiler = OpaCompiler;
-
-
-/***/ }),
-
-/***/ 44693:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.OpaHttpEvaluator = void 0;
-/**
- * OPA HTTP Evaluator - evaluates policies via an external OPA server's REST API.
- *
- * Uses the built-in `fetch` API (Node 18+), so no extra dependencies are needed.
- */
-class OpaHttpEvaluator {
-    baseUrl;
-    timeout;
-    constructor(baseUrl, timeout = 5000) {
-        // Validate URL format and protocol
-        let parsed;
-        try {
-            parsed = new URL(baseUrl);
-        }
-        catch {
-            throw new Error(`OPA HTTP evaluator: invalid URL: ${baseUrl}`);
-        }
-        if (!['http:', 'https:'].includes(parsed.protocol)) {
-            throw new Error(`OPA HTTP evaluator: url must use http:// or https:// protocol, got: ${baseUrl}`);
-        }
-        // Block cloud metadata, loopback, link-local, and private network addresses
-        const hostname = parsed.hostname;
-        if (this.isBlockedHostname(hostname)) {
-            throw new Error(`OPA HTTP evaluator: url must not point to internal, loopback, or private network addresses`);
-        }
-        // Normalize: strip trailing slash
-        this.baseUrl = baseUrl.replace(/\/+$/, '');
-        this.timeout = timeout;
-    }
-    /**
-     * Check if a hostname is blocked due to SSRF concerns.
-     *
-     * Blocks:
-     * - Loopback addresses (127.x.x.x, localhost, 0.0.0.0, ::1)
-     * - Link-local addresses (169.254.x.x)
-     * - Private networks (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
-     * - IPv6 unique local addresses (fd00::/8)
-     * - Cloud metadata services (*.internal)
-     */
-    isBlockedHostname(hostname) {
-        if (!hostname)
-            return true; // block empty hostnames
-        // Normalize hostname: lowercase and remove brackets for IPv6
-        const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, '');
-        // Block .internal domains (cloud metadata services)
-        if (normalized === 'metadata.google.internal' || normalized.endsWith('.internal')) {
-            return true;
-        }
-        // Block localhost variants
-        if (normalized === 'localhost' || normalized === 'localhost.localdomain') {
-            return true;
-        }
-        // Block IPv6 loopback
-        if (normalized === '::1' || normalized === '0:0:0:0:0:0:0:1') {
-            return true;
-        }
-        // Check IPv4 patterns
-        const ipv4Pattern = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-        const ipv4Match = normalized.match(ipv4Pattern);
-        if (ipv4Match) {
-            const octets = ipv4Match.slice(1, 5).map(Number);
-            // Validate octets are in range [0, 255]
-            if (octets.some(octet => octet > 255)) {
-                return false;
-            }
-            const [a, b] = octets;
-            // Block loopback: 127.0.0.0/8
-            if (a === 127) {
-                return true;
-            }
-            // Block 0.0.0.0/8 (this host)
-            if (a === 0) {
-                return true;
-            }
-            // Block link-local: 169.254.0.0/16
-            if (a === 169 && b === 254) {
-                return true;
-            }
-            // Block private networks
-            // 10.0.0.0/8
-            if (a === 10) {
-                return true;
-            }
-            // 172.16.0.0/12 (172.16.x.x through 172.31.x.x)
-            if (a === 172 && b >= 16 && b <= 31) {
-                return true;
-            }
-            // 192.168.0.0/16
-            if (a === 192 && b === 168) {
-                return true;
-            }
-        }
-        // Check IPv6 patterns
-        // Block unique local addresses: fd00::/8
-        if (normalized.startsWith('fd') || normalized.startsWith('fc')) {
-            return true;
-        }
-        // Block link-local: fe80::/10
-        if (normalized.startsWith('fe80:')) {
-            return true;
-        }
-        return false;
-    }
-    /**
-     * Evaluate a policy rule against an input document via OPA REST API.
-     *
-     * @param input - The input document to evaluate
-     * @param rulePath - OPA rule path (e.g., 'visor/check/execute')
-     * @returns The result object from OPA, or undefined on error
-     */
-    async evaluate(input, rulePath) {
-        // OPA Data API: POST /v1/data/<path>
-        const encodedPath = rulePath
-            .split('/')
-            .map(s => encodeURIComponent(s))
-            .join('/');
-        const url = `${this.baseUrl}/v1/data/${encodedPath}`;
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeout);
-        try {
-            const response = await fetch(url, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ input }),
-                signal: controller.signal,
-            });
-            if (!response.ok) {
-                throw new Error(`OPA HTTP ${response.status}: ${response.statusText}`);
-            }
-            let body;
-            try {
-                body = await response.json();
-            }
-            catch (jsonErr) {
-                throw new Error(`OPA HTTP evaluator: failed to parse JSON response: ${jsonErr instanceof Error ? jsonErr.message : String(jsonErr)}`);
-            }
-            // OPA returns { result: { ... } }
-            return body?.result;
-        }
-        finally {
-            clearTimeout(timer);
-        }
-    }
-    async shutdown() {
-        // No persistent connections to close
-    }
-}
-exports.OpaHttpEvaluator = OpaHttpEvaluator;
-
-
-/***/ }),
-
-/***/ 39530:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.OpaPolicyEngine = void 0;
-const opa_wasm_evaluator_1 = __nccwpck_require__(8613);
-const opa_http_evaluator_1 = __nccwpck_require__(44693);
-const policy_input_builder_1 = __nccwpck_require__(17117);
-/**
- * Enterprise OPA Policy Engine.
- *
- * Wraps both WASM (local) and HTTP (remote) OPA evaluators behind the
- * OSS PolicyEngine interface. All OPA input building and role resolution
- * is handled internally — the OSS call sites pass only plain types.
- */
-class OpaPolicyEngine {
-    evaluator = null;
-    fallback;
-    timeout;
-    config;
-    inputBuilder = null;
-    logger = null;
-    constructor(config) {
-        this.config = config;
-        this.fallback = config.fallback || 'deny';
-        this.timeout = config.timeout || 5000;
-    }
-    async initialize(config) {
-        // Resolve logger once at initialization
-        try {
-            this.logger = (__nccwpck_require__(86999).logger);
-        }
-        catch {
-            // logger not available in this context
-        }
-        // Build actor/repo context from environment (available at engine init time)
-        const actor = {
-            authorAssociation: process.env.VISOR_AUTHOR_ASSOCIATION,
-            login: process.env.VISOR_AUTHOR_LOGIN || process.env.GITHUB_ACTOR,
-            isLocalMode: !process.env.GITHUB_ACTIONS,
-        };
-        const repo = {
-            owner: process.env.GITHUB_REPOSITORY_OWNER,
-            name: process.env.GITHUB_REPOSITORY?.split('/')[1],
-            branch: process.env.GITHUB_HEAD_REF,
-            baseBranch: process.env.GITHUB_BASE_REF,
-            event: process.env.GITHUB_EVENT_NAME,
-        };
-        const prNum = process.env.GITHUB_PR_NUMBER
-            ? parseInt(process.env.GITHUB_PR_NUMBER, 10)
-            : undefined;
-        const pullRequest = {
-            number: prNum !== undefined && Number.isFinite(prNum) ? prNum : undefined,
-        };
-        this.inputBuilder = new policy_input_builder_1.PolicyInputBuilder(config, actor, repo, pullRequest);
-        if (config.engine === 'local') {
-            if (!config.rules) {
-                throw new Error('OPA local mode requires `policy.rules` path to .wasm or .rego files');
-            }
-            const wasm = new opa_wasm_evaluator_1.OpaWasmEvaluator();
-            await wasm.initialize(config.rules);
-            if (config.data) {
-                wasm.loadData(config.data);
-            }
-            this.evaluator = wasm;
-        }
-        else if (config.engine === 'remote') {
-            if (!config.url) {
-                throw new Error('OPA remote mode requires `policy.url` pointing to OPA server');
-            }
-            this.evaluator = new opa_http_evaluator_1.OpaHttpEvaluator(config.url, this.timeout);
-        }
-        else {
-            this.evaluator = null;
-        }
-    }
-    /**
-     * Update actor/repo/PR context (e.g., after PR info becomes available).
-     * Called by the enterprise loader when engine context is enriched.
-     */
-    setActorContext(actor, repo, pullRequest) {
-        this.inputBuilder = new policy_input_builder_1.PolicyInputBuilder(this.config, actor, repo, pullRequest);
-    }
-    async evaluateCheckExecution(checkId, checkConfig) {
-        if (!this.evaluator || !this.inputBuilder)
-            return { allowed: true };
-        const cfg = checkConfig && typeof checkConfig === 'object'
-            ? checkConfig
-            : {};
-        const policyOverride = cfg.policy;
-        const input = this.inputBuilder.forCheckExecution({
-            id: checkId,
-            type: cfg.type || 'ai',
-            group: cfg.group,
-            tags: cfg.tags,
-            criticality: cfg.criticality,
-            sandbox: cfg.sandbox,
-            policy: policyOverride,
-        });
-        return this.doEvaluate(input, this.resolveRulePath('check.execute', policyOverride?.rule));
-    }
-    async evaluateToolInvocation(serverName, methodName, transport) {
-        if (!this.evaluator || !this.inputBuilder)
-            return { allowed: true };
-        const input = this.inputBuilder.forToolInvocation(serverName, methodName, transport);
-        return this.doEvaluate(input, 'visor/tool/invoke');
-    }
-    async evaluateCapabilities(checkId, capabilities) {
-        if (!this.evaluator || !this.inputBuilder)
-            return { allowed: true };
-        const input = this.inputBuilder.forCapabilityResolve(checkId, capabilities);
-        return this.doEvaluate(input, 'visor/capability/resolve');
-    }
-    async shutdown() {
-        if (this.evaluator && 'shutdown' in this.evaluator) {
-            await this.evaluator.shutdown();
-        }
-        this.evaluator = null;
-        this.inputBuilder = null;
-    }
-    resolveRulePath(defaultScope, override) {
-        if (override) {
-            return override.startsWith('visor/') ? override : `visor/${override}`;
-        }
-        return `visor/${defaultScope.replace(/\./g, '/')}`;
-    }
-    async doEvaluate(input, rulePath) {
-        try {
-            this.logger?.debug(`[PolicyEngine] Evaluating ${rulePath}`, JSON.stringify(input));
-            let timer;
-            const timeoutPromise = new Promise((_resolve, reject) => {
-                timer = setTimeout(() => reject(new Error('policy evaluation timeout')), this.timeout);
-            });
-            try {
-                const result = await Promise.race([this.rawEvaluate(input, rulePath), timeoutPromise]);
-                const decision = this.parseDecision(result);
-                // In warn mode, override denied decisions to allowed but flag as warn
-                if (!decision.allowed && this.fallback === 'warn') {
-                    decision.allowed = true;
-                    decision.warn = true;
-                    decision.reason = `audit: ${decision.reason || 'policy denied'}`;
-                }
-                this.logger?.debug(`[PolicyEngine] Decision for ${rulePath}: allowed=${decision.allowed}, warn=${decision.warn || false}, reason=${decision.reason || 'none'}`);
-                return decision;
-            }
-            finally {
-                if (timer)
-                    clearTimeout(timer);
-            }
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            this.logger?.warn(`[PolicyEngine] Evaluation failed for ${rulePath}: ${msg}`);
-            return {
-                allowed: this.fallback === 'allow' || this.fallback === 'warn',
-                warn: this.fallback === 'warn' ? true : undefined,
-                reason: `policy evaluation failed, fallback=${this.fallback}`,
-            };
-        }
-    }
-    async rawEvaluate(input, rulePath) {
-        if (this.evaluator instanceof opa_wasm_evaluator_1.OpaWasmEvaluator) {
-            const result = await this.evaluator.evaluate(input);
-            // WASM compiled with `-e visor` entrypoint returns the full visor package tree.
-            // Navigate to the specific rule subtree using rulePath segments.
-            // e.g., 'visor/check/execute' → result.check.execute
-            return this.navigateWasmResult(result, rulePath);
-        }
-        return this.evaluator.evaluate(input, rulePath);
-    }
-    /**
-     * Navigate nested OPA WASM result tree to reach the specific rule's output.
-     * The WASM entrypoint `-e visor` means the result root IS the visor package,
-     * so we strip the `visor/` prefix and walk the remaining segments.
-     */
-    navigateWasmResult(result, rulePath) {
-        if (!result || typeof result !== 'object')
-            return result;
-        // Strip the 'visor/' prefix (matches our compilation entrypoint)
-        const segments = rulePath.replace(/^visor\//, '').split('/');
-        let current = result;
-        for (const seg of segments) {
-            if (current && typeof current === 'object' && seg in current) {
-                current = current[seg];
-            }
-            else {
-                return undefined; // path not found in result tree
-            }
-        }
-        return current;
-    }
-    parseDecision(result) {
-        if (result === undefined || result === null) {
-            return {
-                allowed: this.fallback === 'allow' || this.fallback === 'warn',
-                warn: this.fallback === 'warn' ? true : undefined,
-                reason: this.fallback === 'warn' ? 'audit: no policy result' : 'no policy result',
-            };
-        }
-        const allowed = result.allowed !== false;
-        const decision = {
-            allowed,
-            reason: result.reason,
-        };
-        if (result.capabilities) {
-            decision.capabilities = result.capabilities;
-        }
-        return decision;
-    }
-}
-exports.OpaPolicyEngine = OpaPolicyEngine;
-
-
-/***/ }),
-
-/***/ 8613:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.OpaWasmEvaluator = void 0;
-const fs = __importStar(__nccwpck_require__(79896));
-const path = __importStar(__nccwpck_require__(16928));
-const opa_compiler_1 = __nccwpck_require__(628);
-/**
- * OPA WASM Evaluator - loads and evaluates OPA policies locally.
- *
- * Supports three input formats:
- * 1. Pre-compiled `.wasm` bundle — loaded directly (fastest startup)
- * 2. `.rego` files or directory — auto-compiled to WASM via `opa build` CLI
- * 3. Directory with `policy.wasm` inside — loaded directly
- *
- * Compilation and caching of .rego files is delegated to {@link OpaCompiler}.
- *
- * Requires:
- * - `@open-policy-agent/opa-wasm` npm package (optional dep)
- * - `opa` CLI on PATH (only when auto-compiling .rego files)
- */
-class OpaWasmEvaluator {
-    policy = null;
-    dataDocument = {};
-    compiler = new opa_compiler_1.OpaCompiler();
-    async initialize(rulesPath) {
-        const paths = Array.isArray(rulesPath) ? rulesPath : [rulesPath];
-        const wasmBytes = await this.compiler.resolveWasmBytes(paths);
-        try {
-            // Use createRequire to load the optional dep at runtime without ncc bundling it.
-            // `new Function('id', 'return require(id)')` fails in ncc bundles because
-            // `require` is not in the `new Function` scope. `createRequire` works correctly
-            // because it creates a real Node.js require rooted at the given path.
-            // eslint-disable-next-line @typescript-eslint/no-var-requires
-            const { createRequire } = __nccwpck_require__(73339);
-            const runtimeRequire = createRequire(__filename);
-            const opaWasm = runtimeRequire('@open-policy-agent/opa-wasm');
-            const loadPolicy = opaWasm.loadPolicy || opaWasm.default?.loadPolicy;
-            if (!loadPolicy) {
-                throw new Error('loadPolicy not found in @open-policy-agent/opa-wasm');
-            }
-            this.policy = await loadPolicy(wasmBytes);
-        }
-        catch (err) {
-            if (err?.code === 'MODULE_NOT_FOUND' || err?.code === 'ERR_MODULE_NOT_FOUND') {
-                throw new Error('OPA WASM evaluator requires @open-policy-agent/opa-wasm. ' +
-                    'Install it with: npm install @open-policy-agent/opa-wasm');
-            }
-            throw err;
-        }
-    }
-    /**
-     * Load external data from a JSON file to use as the OPA data document.
-     * The loaded data will be passed to `policy.setData()` during evaluation,
-     * making it available in Rego via `data.<key>`.
-     */
-    loadData(dataPath) {
-        const resolved = path.resolve(dataPath);
-        if (path.normalize(resolved).includes('..')) {
-            throw new Error(`Data path contains traversal sequences: ${dataPath}`);
-        }
-        if (!fs.existsSync(resolved)) {
-            throw new Error(`OPA data file not found: ${resolved}`);
-        }
-        const stat = fs.statSync(resolved);
-        if (stat.size > 10 * 1024 * 1024) {
-            throw new Error(`OPA data file exceeds 10MB limit: ${resolved} (${stat.size} bytes)`);
-        }
-        const raw = fs.readFileSync(resolved, 'utf-8');
-        try {
-            const parsed = JSON.parse(raw);
-            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
-                throw new Error('OPA data file must contain a JSON object (not an array or primitive)');
-            }
-            this.dataDocument = parsed;
-        }
-        catch (err) {
-            if (err.message.startsWith('OPA data file must')) {
-                throw err;
-            }
-            throw new Error(`Failed to parse OPA data file ${resolved}: ${err.message}`);
-        }
-    }
-    async evaluate(input) {
-        if (!this.policy) {
-            throw new Error('OPA WASM evaluator not initialized');
-        }
-        this.policy.setData(this.dataDocument);
-        const resultSet = this.policy.evaluate(input);
-        if (Array.isArray(resultSet) && resultSet.length > 0) {
-            return resultSet[0].result;
-        }
-        return undefined;
-    }
-    async shutdown() {
-        if (this.policy) {
-            // opa-wasm policy objects may have a close/free method for WASM cleanup
-            if (typeof this.policy.close === 'function') {
-                try {
-                    this.policy.close();
-                }
-                catch { }
-            }
-            else if (typeof this.policy.free === 'function') {
-                try {
-                    this.policy.free();
-                }
-                catch { }
-            }
-        }
-        this.policy = null;
-    }
-}
-exports.OpaWasmEvaluator = OpaWasmEvaluator;
-
-
-/***/ }),
-
-/***/ 17117:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.PolicyInputBuilder = void 0;
-/**
- * Builds OPA-compatible input documents from engine context.
- *
- * Resolves actor roles from the `policy.roles` config section by matching
- * the actor's authorAssociation and login against role definitions.
- */
-class PolicyInputBuilder {
-    roles;
-    actor;
-    repository;
-    pullRequest;
-    constructor(policyConfig, actor, repository, pullRequest) {
-        this.roles = policyConfig.roles || {};
-        this.actor = actor;
-        this.repository = repository;
-        this.pullRequest = pullRequest;
-    }
-    /** Resolve which roles apply to the current actor. */
-    resolveRoles() {
-        const matched = [];
-        for (const [roleName, roleConfig] of Object.entries(this.roles)) {
-            let identityMatch = false;
-            if (roleConfig.author_association &&
-                this.actor.authorAssociation &&
-                roleConfig.author_association.includes(this.actor.authorAssociation)) {
-                identityMatch = true;
-            }
-            if (!identityMatch &&
-                roleConfig.users &&
-                this.actor.login &&
-                roleConfig.users.includes(this.actor.login)) {
-                identityMatch = true;
-            }
-            // Slack user ID match
-            if (!identityMatch &&
-                roleConfig.slack_users &&
-                this.actor.slack?.userId &&
-                roleConfig.slack_users.includes(this.actor.slack.userId)) {
-                identityMatch = true;
-            }
-            // Email match (case-insensitive)
-            if (!identityMatch && roleConfig.emails && this.actor.slack?.email) {
-                const actorEmail = this.actor.slack.email.toLowerCase();
-                if (roleConfig.emails.some(e => e.toLowerCase() === actorEmail)) {
-                    identityMatch = true;
-                }
-            }
-            // Note: teams-based role resolution requires GitHub API access (read:org scope)
-            // and is not yet implemented. If configured, the role will not match via teams.
-            if (!identityMatch)
-                continue;
-            // slack_channels gate: if set, the role only applies when triggered from one of these channels
-            if (roleConfig.slack_channels && roleConfig.slack_channels.length > 0) {
-                if (!this.actor.slack?.channelId ||
-                    !roleConfig.slack_channels.includes(this.actor.slack.channelId)) {
-                    continue;
-                }
-            }
-            matched.push(roleName);
-        }
-        return matched;
-    }
-    buildActor() {
-        return {
-            authorAssociation: this.actor.authorAssociation,
-            login: this.actor.login,
-            roles: this.resolveRoles(),
-            isLocalMode: this.actor.isLocalMode,
-            ...(this.actor.slack && { slack: this.actor.slack }),
-        };
-    }
-    forCheckExecution(check) {
-        return {
-            scope: 'check.execute',
-            check: {
-                id: check.id,
-                type: check.type,
-                group: check.group,
-                tags: check.tags,
-                criticality: check.criticality,
-                sandbox: check.sandbox,
-                policy: check.policy,
-            },
-            actor: this.buildActor(),
-            repository: this.repository,
-            pullRequest: this.pullRequest,
-        };
-    }
-    forToolInvocation(serverName, methodName, transport) {
-        return {
-            scope: 'tool.invoke',
-            tool: { serverName, methodName, transport },
-            actor: this.buildActor(),
-            repository: this.repository,
-            pullRequest: this.pullRequest,
-        };
-    }
-    forCapabilityResolve(checkId, capabilities) {
-        return {
-            scope: 'capability.resolve',
-            check: { id: checkId, type: 'ai' },
-            capability: capabilities,
-            actor: this.buildActor(),
-            repository: this.repository,
-            pullRequest: this.pullRequest,
-        };
-    }
-}
-exports.PolicyInputBuilder = PolicyInputBuilder;
-
-
-/***/ }),
-
-/***/ 63737:
-/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
-
-"use strict";
-
-/**
- * Copyright (c) ProbeLabs. All rights reserved.
- * Licensed under the Elastic License 2.0; you may not use this file except
- * in compliance with the Elastic License 2.0.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.KnexStoreBackend = void 0;
-/**
- * Knex-backed schedule store for PostgreSQL, MySQL, and MSSQL (Enterprise)
- *
- * Uses Knex query builder for database-agnostic SQL. Same schema as SQLite backend
- * but with real distributed locking via row-level claims (claimed_by/claimed_at/lock_token).
- */
-const fs = __importStar(__nccwpck_require__(79896));
-const path = __importStar(__nccwpck_require__(16928));
-const uuid_1 = __nccwpck_require__(31914);
-const logger_1 = __nccwpck_require__(86999);
-function toNum(val) {
-    if (val === null || val === undefined)
-        return undefined;
-    return typeof val === 'string' ? parseInt(val, 10) : val;
-}
-function safeJsonParse(value) {
-    if (!value)
-        return undefined;
-    try {
-        return JSON.parse(value);
-    }
-    catch {
-        return undefined;
-    }
-}
-function fromDbRow(row) {
-    return {
-        id: row.id,
-        creatorId: row.creator_id,
-        creatorContext: row.creator_context ?? undefined,
-        creatorName: row.creator_name ?? undefined,
-        timezone: row.timezone,
-        schedule: row.schedule_expr,
-        runAt: toNum(row.run_at),
-        isRecurring: row.is_recurring === true || row.is_recurring === 1,
-        originalExpression: row.original_expression,
-        workflow: row.workflow ?? undefined,
-        workflowInputs: safeJsonParse(row.workflow_inputs),
-        outputContext: safeJsonParse(row.output_context),
-        status: row.status,
-        createdAt: toNum(row.created_at),
-        lastRunAt: toNum(row.last_run_at),
-        nextRunAt: toNum(row.next_run_at),
-        runCount: row.run_count,
-        failureCount: row.failure_count,
-        lastError: row.last_error ?? undefined,
-        previousResponse: row.previous_response ?? undefined,
-    };
-}
-function toInsertRow(schedule) {
-    return {
-        id: schedule.id,
-        creator_id: schedule.creatorId,
-        creator_context: schedule.creatorContext ?? null,
-        creator_name: schedule.creatorName ?? null,
-        timezone: schedule.timezone,
-        schedule_expr: schedule.schedule,
-        run_at: schedule.runAt ?? null,
-        is_recurring: schedule.isRecurring,
-        original_expression: schedule.originalExpression,
-        workflow: schedule.workflow ?? null,
-        workflow_inputs: schedule.workflowInputs ? JSON.stringify(schedule.workflowInputs) : null,
-        output_context: schedule.outputContext ? JSON.stringify(schedule.outputContext) : null,
-        status: schedule.status,
-        created_at: schedule.createdAt,
-        last_run_at: schedule.lastRunAt ?? null,
-        next_run_at: schedule.nextRunAt ?? null,
-        run_count: schedule.runCount,
-        failure_count: schedule.failureCount,
-        last_error: schedule.lastError ?? null,
-        previous_response: schedule.previousResponse ?? null,
-    };
-}
-/**
- * Enterprise Knex-backed store for PostgreSQL, MySQL, and MSSQL
- */
-class KnexStoreBackend {
-    knex = null;
-    driver;
-    connection;
-    constructor(driver, storageConfig, _haConfig) {
-        this.driver = driver;
-        this.connection = (storageConfig.connection || {});
-    }
-    async initialize() {
-        // Load knex dynamically
-        const { createRequire } = __nccwpck_require__(73339);
-        const runtimeRequire = createRequire(__filename);
-        let knexFactory;
-        try {
-            knexFactory = runtimeRequire('knex');
-        }
-        catch (err) {
-            const code = err?.code;
-            if (code === 'MODULE_NOT_FOUND' || code === 'ERR_MODULE_NOT_FOUND') {
-                throw new Error('knex is required for PostgreSQL/MySQL/MSSQL schedule storage. ' +
-                    'Install it with: npm install knex');
-            }
-            throw err;
-        }
-        const clientMap = {
-            postgresql: 'pg',
-            mysql: 'mysql2',
-            mssql: 'tedious',
-        };
-        const client = clientMap[this.driver];
-        // Build connection config
-        let connection;
-        if (this.connection.connection_string) {
-            connection = this.connection.connection_string;
-        }
-        else if (this.driver === 'mssql') {
-            connection = this.buildMssqlConnection();
-        }
-        else {
-            connection = this.buildStandardConnection();
-        }
-        this.knex = knexFactory({
-            client,
-            connection,
-            pool: {
-                min: this.connection.pool?.min ?? 0,
-                max: this.connection.pool?.max ?? 10,
-            },
-        });
-        // Run schema migration
-        await this.migrateSchema();
-        logger_1.logger.info(`[KnexStore] Initialized (${this.driver})`);
-    }
-    buildStandardConnection() {
-        return {
-            host: this.connection.host || 'localhost',
-            port: this.connection.port,
-            database: this.connection.database || 'visor',
-            user: this.connection.user,
-            password: this.connection.password,
-            ssl: this.resolveSslConfig(),
-        };
-    }
-    buildMssqlConnection() {
-        const ssl = this.connection.ssl;
-        const sslEnabled = ssl === true || (typeof ssl === 'object' && ssl.enabled !== false);
-        return {
-            server: this.connection.host || 'localhost',
-            port: this.connection.port,
-            database: this.connection.database || 'visor',
-            user: this.connection.user,
-            password: this.connection.password,
-            options: {
-                encrypt: sslEnabled,
-                trustServerCertificate: typeof ssl === 'object' ? ssl.reject_unauthorized === false : !sslEnabled,
-            },
-        };
-    }
-    resolveSslConfig() {
-        const ssl = this.connection.ssl;
-        if (ssl === false || ssl === undefined)
-            return false;
-        if (ssl === true)
-            return { rejectUnauthorized: true };
-        // Object config
-        if (ssl.enabled === false)
-            return false;
-        const result = {
-            rejectUnauthorized: ssl.reject_unauthorized !== false,
-        };
-        if (ssl.ca) {
-            const caPath = this.validateSslPath(ssl.ca, 'CA certificate');
-            result.ca = fs.readFileSync(caPath, 'utf8');
-        }
-        if (ssl.cert) {
-            const certPath = this.validateSslPath(ssl.cert, 'client certificate');
-            result.cert = fs.readFileSync(certPath, 'utf8');
-        }
-        if (ssl.key) {
-            const keyPath = this.validateSslPath(ssl.key, 'client key');
-            result.key = fs.readFileSync(keyPath, 'utf8');
-        }
-        return result;
-    }
-    validateSslPath(filePath, label) {
-        const resolved = path.resolve(filePath);
-        if (resolved !== path.normalize(resolved)) {
-            throw new Error(`SSL ${label} path contains invalid sequences: ${filePath}`);
-        }
-        if (!fs.existsSync(resolved)) {
-            throw new Error(`SSL ${label} not found: ${filePath}`);
-        }
-        return resolved;
-    }
-    async shutdown() {
-        if (this.knex) {
-            await this.knex.destroy();
-            this.knex = null;
-        }
-    }
-    async migrateSchema() {
-        const knex = this.getKnex();
-        const exists = await knex.schema.hasTable('schedules');
-        if (!exists) {
-            await knex.schema.createTable('schedules', table => {
-                table.string('id', 36).primary();
-                table.string('creator_id', 255).notNullable().index();
-                table.string('creator_context', 255);
-                table.string('creator_name', 255);
-                table.string('timezone', 64).notNullable().defaultTo('UTC');
-                table.string('schedule_expr', 255);
-                table.bigInteger('run_at');
-                table.boolean('is_recurring').notNullable();
-                table.text('original_expression');
-                table.string('workflow', 255);
-                table.text('workflow_inputs');
-                table.text('output_context');
-                table.string('status', 20).notNullable().index();
-                table.bigInteger('created_at').notNullable();
-                table.bigInteger('last_run_at');
-                table.bigInteger('next_run_at');
-                table.integer('run_count').notNullable().defaultTo(0);
-                table.integer('failure_count').notNullable().defaultTo(0);
-                table.text('last_error');
-                table.text('previous_response');
-                table.index(['status', 'next_run_at']);
-            });
-        }
-        // Create scheduler_locks table for distributed locking
-        const locksExist = await knex.schema.hasTable('scheduler_locks');
-        if (!locksExist) {
-            await knex.schema.createTable('scheduler_locks', table => {
-                table.string('lock_id', 255).primary();
-                table.string('node_id', 255).notNullable();
-                table.string('lock_token', 36).notNullable();
-                table.bigInteger('acquired_at').notNullable();
-                table.bigInteger('expires_at').notNullable();
-            });
-        }
-    }
-    getKnex() {
-        if (!this.knex) {
-            throw new Error('[KnexStore] Not initialized. Call initialize() first.');
-        }
-        return this.knex;
-    }
-    // --- CRUD ---
-    async create(schedule) {
-        const knex = this.getKnex();
-        const newSchedule = {
-            ...schedule,
-            id: (0, uuid_1.v4)(),
-            createdAt: Date.now(),
-            runCount: 0,
-            failureCount: 0,
-            status: 'active',
-        };
-        await knex('schedules').insert(toInsertRow(newSchedule));
-        logger_1.logger.info(`[KnexStore] Created schedule ${newSchedule.id} for user ${newSchedule.creatorId}`);
-        return newSchedule;
-    }
-    async importSchedule(schedule) {
-        const knex = this.getKnex();
-        const existing = await knex('schedules').where('id', schedule.id).first();
-        if (existing)
-            return; // Already imported (idempotent)
-        await knex('schedules').insert(toInsertRow(schedule));
-    }
-    async get(id) {
-        const knex = this.getKnex();
-        const row = await knex('schedules').where('id', id).first();
-        return row ? fromDbRow(row) : undefined;
-    }
-    async update(id, patch) {
-        const knex = this.getKnex();
-        const existing = await knex('schedules').where('id', id).first();
-        if (!existing)
-            return undefined;
-        const current = fromDbRow(existing);
-        const updated = { ...current, ...patch, id: current.id };
-        const row = toInsertRow(updated);
-        // Remove id from update (PK cannot change)
-        delete row.id;
-        await knex('schedules').where('id', id).update(row);
-        return updated;
-    }
-    async delete(id) {
-        const knex = this.getKnex();
-        const deleted = await knex('schedules').where('id', id).del();
-        if (deleted > 0) {
-            logger_1.logger.info(`[KnexStore] Deleted schedule ${id}`);
-            return true;
-        }
-        return false;
-    }
-    // --- Queries ---
-    async getByCreator(creatorId) {
-        const knex = this.getKnex();
-        const rows = await knex('schedules').where('creator_id', creatorId);
-        return rows.map((r) => fromDbRow(r));
-    }
-    async getActiveSchedules() {
-        const knex = this.getKnex();
-        const rows = await knex('schedules').where('status', 'active');
-        return rows.map((r) => fromDbRow(r));
-    }
-    async getDueSchedules(now) {
-        const ts = now ?? Date.now();
-        const knex = this.getKnex();
-        // MSSQL uses 1/0 for booleans
-        const bFalse = this.driver === 'mssql' ? 0 : false;
-        const bTrue = this.driver === 'mssql' ? 1 : true;
-        const rows = await knex('schedules')
-            .where('status', 'active')
-            .andWhere(function () {
-            this.where(function () {
-                this.where('is_recurring', bFalse)
-                    .whereNotNull('run_at')
-                    .where('run_at', '<=', ts);
-            }).orWhere(function () {
-                this.where('is_recurring', bTrue)
-                    .whereNotNull('next_run_at')
-                    .where('next_run_at', '<=', ts);
-            });
-        });
-        return rows.map((r) => fromDbRow(r));
-    }
-    async findByWorkflow(creatorId, workflowName) {
-        const knex = this.getKnex();
-        const escaped = workflowName.toLowerCase().replace(/[%_\\]/g, '\\$&');
-        const pattern = `%${escaped}%`;
-        const rows = await knex('schedules')
-            .where('creator_id', creatorId)
-            .where('status', 'active')
-            .whereRaw("LOWER(workflow) LIKE ? ESCAPE '\\'", [pattern]);
-        return rows.map((r) => fromDbRow(r));
-    }
-    async getAll() {
-        const knex = this.getKnex();
-        const rows = await knex('schedules');
-        return rows.map((r) => fromDbRow(r));
-    }
-    async getStats() {
-        const knex = this.getKnex();
-        // MSSQL uses 1/0 for booleans; PostgreSQL/MySQL accept both true/1
-        const boolTrue = this.driver === 'mssql' ? '1' : 'true';
-        const boolFalse = this.driver === 'mssql' ? '0' : 'false';
-        const result = await knex('schedules')
-            .select(knex.raw('COUNT(*) as total'), knex.raw("SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active"), knex.raw("SUM(CASE WHEN status = 'paused' THEN 1 ELSE 0 END) as paused"), knex.raw("SUM(CASE WHEN status = 'completed' THEN 1 ELSE 0 END) as completed"), knex.raw("SUM(CASE WHEN status = 'failed' THEN 1 ELSE 0 END) as failed"), knex.raw(`SUM(CASE WHEN is_recurring = ${boolTrue} THEN 1 ELSE 0 END) as recurring`), knex.raw(`SUM(CASE WHEN is_recurring = ${boolFalse} THEN 1 ELSE 0 END) as one_time`))
-            .first();
-        return {
-            total: Number(result.total) || 0,
-            active: Number(result.active) || 0,
-            paused: Number(result.paused) || 0,
-            completed: Number(result.completed) || 0,
-            failed: Number(result.failed) || 0,
-            recurring: Number(result.recurring) || 0,
-            oneTime: Number(result.one_time) || 0,
-        };
-    }
-    async validateLimits(creatorId, isRecurring, limits) {
-        const knex = this.getKnex();
-        if (limits.maxGlobal) {
-            const result = await knex('schedules').count('* as cnt').first();
-            if (Number(result?.cnt) >= limits.maxGlobal) {
-                throw new Error(`Global schedule limit reached (${limits.maxGlobal})`);
-            }
-        }
-        if (limits.maxPerUser) {
-            const result = await knex('schedules')
-                .where('creator_id', creatorId)
-                .count('* as cnt')
-                .first();
-            if (Number(result?.cnt) >= limits.maxPerUser) {
-                throw new Error(`You have reached the maximum number of schedules (${limits.maxPerUser})`);
-            }
-        }
-        if (isRecurring && limits.maxRecurringPerUser) {
-            const bTrue = this.driver === 'mssql' ? 1 : true;
-            const result = await knex('schedules')
-                .where('creator_id', creatorId)
-                .where('is_recurring', bTrue)
-                .count('* as cnt')
-                .first();
-            if (Number(result?.cnt) >= limits.maxRecurringPerUser) {
-                throw new Error(`You have reached the maximum number of recurring schedules (${limits.maxRecurringPerUser})`);
-            }
-        }
-    }
-    // --- HA Distributed Locking (via scheduler_locks table) ---
-    async tryAcquireLock(lockId, nodeId, ttlSeconds) {
-        const knex = this.getKnex();
-        const now = Date.now();
-        const expiresAt = now + ttlSeconds * 1000;
-        const token = (0, uuid_1.v4)();
-        // Step 1: Try to claim an existing expired lock
-        const updated = await knex('scheduler_locks')
-            .where('lock_id', lockId)
-            .where('expires_at', '<', now)
-            .update({
-            node_id: nodeId,
-            lock_token: token,
-            acquired_at: now,
-            expires_at: expiresAt,
-        });
-        if (updated > 0)
-            return token;
-        // Step 2: Try to INSERT a new lock row
-        try {
-            await knex('scheduler_locks').insert({
-                lock_id: lockId,
-                node_id: nodeId,
-                lock_token: token,
-                acquired_at: now,
-                expires_at: expiresAt,
-            });
-            return token;
-        }
-        catch {
-            // Unique constraint violation — another node holds the lock
-            return null;
-        }
-    }
-    async releaseLock(lockId, lockToken) {
-        const knex = this.getKnex();
-        await knex('scheduler_locks').where('lock_id', lockId).where('lock_token', lockToken).del();
-    }
-    async renewLock(lockId, lockToken, ttlSeconds) {
-        const knex = this.getKnex();
-        const now = Date.now();
-        const expiresAt = now + ttlSeconds * 1000;
-        const updated = await knex('scheduler_locks')
-            .where('lock_id', lockId)
-            .where('lock_token', lockToken)
-            .update({ acquired_at: now, expires_at: expiresAt });
-        return updated > 0;
-    }
-    async flush() {
-        // No-op for server-based backends
-    }
-}
-exports.KnexStoreBackend = KnexStoreBackend;
-
-
 /***/ }),
 
 /***/ 83864:
@@ -169587,6 +167903,7 @@ class GitHubFrontend {
     minUpdateDelayMs = 1000; // Minimum delay between updates (public for testing)
     // Cache of created GitHub comment IDs per group to handle API eventual consistency
     createdCommentGithubIds = new Map();
+    _stopped = false;
     start(ctx) {
         const log = ctx.logger;
         const bus = ctx.eventBus;
@@ -169714,10 +168031,23 @@ class GitHubFrontend {
             }
         }));
     }
-    stop() {
+    async stop() {
+        this._stopped = true;
         for (const s of this.subs)
             s.unsubscribe();
         this.subs = [];
+        if (this._timer) {
+            clearTimeout(this._timer);
+            this._timer = null;
+        }
+        this._pendingIds.clear();
+        // Drain any in-flight updateGroupedComment operations so callers that
+        // await stop() (e.g. FrontendsHost.stopAll) are guaranteed no async
+        // work leaks after stop resolves.
+        const pending = Array.from(this.updateLocks.values());
+        if (pending.length > 0) {
+            await Promise.allSettled(pending);
+        }
     }
     async buildFullBody(ctx, group) {
         const header = this.renderThreadHeader(ctx, group);
@@ -169808,6 +168138,8 @@ ${end}`);
      */
     async performGroupedCommentUpdate(ctx, comments, group, changedIds) {
         try {
+            if (this._stopped)
+                return;
             if (!ctx.run.repo || !ctx.run.pr)
                 return;
             // Check if PR comments are enabled (default to true if not specified)
@@ -179538,35 +177870,6 @@ class OutputFormatters {
 exports.OutputFormatters = OutputFormatters;
 
 
-/***/ }),
-
-/***/ 93866:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.DefaultPolicyEngine = void 0;
-/**
- * Default (no-op) policy engine — always allows everything.
- * Used when no enterprise license is present or policy is disabled.
- */
-class DefaultPolicyEngine {
-    async initialize(_config) { }
-    async evaluateCheckExecution(_checkId, _checkConfig) {
-        return { allowed: true };
-    }
-    async evaluateToolInvocation(_serverName, _methodName, _transport) {
-        return { allowed: true };
-    }
-    async evaluateCapabilities(_checkId, _capabilities) {
-        return { allowed: true };
-    }
-    async shutdown() { }
-}
-exports.DefaultPolicyEngine = DefaultPolicyEngine;
-
-
 /***/ }),
 
 /***/ 96611:
@@ -181187,12 +179490,53 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
                 if (Object.keys(dynamicServers).length > 0) {
                     Object.assign(mcpServers, dynamicServers);
                 }
+                // Emit telemetry for tool setup diagnostics
+                try {
+                    const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+                    if (span) {
+                        span.addEvent('tool_setup.mcp_servers_js', {
+                            'tool_setup.server_count': Object.keys(dynamicServers).length,
+                            'tool_setup.server_names': Object.keys(dynamicServers).join(','),
+                            'tool_setup.workflow_entries': Object.entries(dynamicServers)
+                                .filter(([, cfg]) => cfg?.workflow)
+                                .map(([name, cfg]) => `${name}→${cfg.workflow}`)
+                                .join(','),
+                        });
+                    }
+                }
+                catch { }
             }
             catch (error) {
-                logger_1.logger.error(`[AICheckProvider] Failed to evaluate ai_mcp_servers_js: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                const errMsg = error instanceof Error ? error.message : 'Unknown error';
+                logger_1.logger.error(`[AICheckProvider] Failed to evaluate ai_mcp_servers_js: ${errMsg}`);
+                // Emit telemetry for the failure
+                try {
+                    const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+                    if (span) {
+                        span.addEvent('tool_setup.mcp_servers_js_error', {
+                            'tool_setup.error': errMsg,
+                        });
+                    }
+                }
+                catch { }
                 // Continue without dynamic servers
             }
         }
+        else if (mcpServersJsExpr && !_dependencyResults) {
+            // Expression exists but no dependency results — this means the check has no dependencies
+            // or the dependency results map was empty/undefined
+            try {
+                const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+                if (span) {
+                    span.addEvent('tool_setup.mcp_servers_js_skipped', {
+                        'tool_setup.reason': 'no_dependency_results',
+                        'tool_setup.has_expr': true,
+                        'tool_setup.has_deps': false,
+                    });
+                }
+            }
+            catch { }
+        }
         // 5. Resolve environment variable placeholders in MCP server env configs
         // Supports ${VAR} and ${{ env.VAR }} syntax
         for (const serverConfig of Object.values(mcpServers)) {
@@ -181345,6 +179689,28 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
             try {
                 // Load custom tools from global config (supports workflows and custom tools)
                 const customTools = this.loadCustomTools(customToolsToLoad, config);
+                // Emit telemetry for tool resolution results
+                try {
+                    const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+                    if (span) {
+                        const requestedNames = customToolsToLoad.map(item => typeof item === 'string'
+                            ? item
+                            : `${item.name || item.workflow}(wf:${item.workflow})`);
+                        span.addEvent('tool_setup.resolution', {
+                            'tool_setup.requested_count': customToolsToLoad.length,
+                            'tool_setup.requested_names': requestedNames.join(','),
+                            'tool_setup.resolved_count': customTools.size,
+                            'tool_setup.resolved_names': Array.from(customTools.keys()).join(','),
+                            'tool_setup.missing_count': customToolsToLoad.length - customTools.size,
+                        });
+                    }
+                }
+                catch { }
+                if (customToolsToLoad.length > 0 && customTools.size === 0) {
+                    logger_1.logger.warn(`[AICheckProvider] All ${customToolsToLoad.length} custom tools failed to resolve! ` +
+                        `Requested: ${customToolsToLoad.map(item => (typeof item === 'string' ? item : item.workflow)).join(', ')}. ` +
+                        `AI will have no workflow tools available.`);
+                }
                 // Add schedule tool if enabled (via ai_mcp_servers { tool: 'schedule' } or enable_scheduler)
                 if (scheduleToolEnabled) {
                     const scheduleTool = (0, schedule_tool_1.getScheduleToolDefinition)();
@@ -181382,10 +179748,36 @@ class AICheckProvider extends check_provider_interface_1.CheckProvider {
                 }
             }
             catch (error) {
-                logger_1.logger.error(`[AICheckProvider] Failed to start custom tools SSE server '${customToolsServerName}': ${error instanceof Error ? error.message : 'Unknown error'}`);
+                const errMsg = error instanceof Error ? error.message : 'Unknown error';
+                logger_1.logger.error(`[AICheckProvider] Failed to start custom tools SSE server '${customToolsServerName}': ${errMsg}`);
+                // Emit telemetry for SSE server failure
+                try {
+                    const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+                    if (span) {
+                        span.addEvent('tool_setup.sse_server_error', {
+                            'tool_setup.error': errMsg,
+                            'tool_setup.server_name': customToolsServerName || '',
+                        });
+                    }
+                }
+                catch { }
                 // Continue without custom tools
             }
         }
+        // Emit final tool setup summary telemetry
+        try {
+            const span = lazy_otel_1.trace.getSpan(lazy_otel_1.context.active());
+            if (span) {
+                const finalServerNames = Object.keys(mcpServers);
+                span.addEvent('tool_setup.final', {
+                    'tool_setup.final_server_count': finalServerNames.length,
+                    'tool_setup.final_server_names': finalServerNames.join(','),
+                    'tool_setup.has_custom_tools_server': !!customToolsServer,
+                    'tool_setup.tools_disabled': !!config.ai?.disableTools,
+                });
+            }
+        }
+        catch { }
         // Pass MCP server config directly to AI service (unless tools are disabled)
         if (Object.keys(mcpServers).length > 0 && !config.ai?.disableTools) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -193932,6 +192324,11 @@ async function handleCancel(positional, flags) {
         process.exit(1);
     }
     await store.deleteAsync(schedule.id);
+    // Also cancel the in-memory job (cron or timeout) so it doesn't fire
+    const scheduler = (0, scheduler_1.getScheduler)();
+    if (scheduler) {
+        scheduler.cancelSchedule(schedule.id);
+    }
     console.log('Schedule cancelled successfully!');
     console.log();
     console.log(`  ID:       ${schedule.id.substring(0, 8)}`);
@@ -194839,6 +193236,7 @@ exports.isScheduleTool = isScheduleTool;
 exports.buildScheduleToolContext = buildScheduleToolContext;
 const schedule_store_1 = __nccwpck_require__(27336);
 const schedule_parser_1 = __nccwpck_require__(48478);
+const scheduler_1 = __nccwpck_require__(28404);
 const logger_1 = __nccwpck_require__(86999);
 /**
  * Simple glob-style pattern matching for workflow names
@@ -195259,8 +193657,13 @@ async function handleCancel(args, context, store) {
             error: 'You can only cancel your own schedules.',
         };
     }
-    // Delete the schedule
+    // Delete the schedule from DB
     await store.deleteAsync(schedule.id);
+    // Also cancel the in-memory job (cron or timeout) so it doesn't fire
+    const scheduler = (0, scheduler_1.getScheduler)();
+    if (scheduler) {
+        scheduler.cancelSchedule(schedule.id);
+    }
     logger_1.logger.info(`[ScheduleTool] Cancelled schedule ${schedule.id} for user ${context.userId}`);
     return {
         success: true,
@@ -195718,6 +194121,27 @@ class Scheduler {
     getStore() {
         return this.store;
     }
+    /**
+     * Cancel a schedule's in-memory job (cron or timeout).
+     * Called after deleting from DB to ensure the job doesn't fire again.
+     */
+    cancelSchedule(scheduleId) {
+        // Stop cron job if it exists
+        const cronJob = this.cronJobs.get(scheduleId);
+        if (cronJob) {
+            cronJob.stop();
+            this.cronJobs.delete(scheduleId);
+            logger_1.logger.debug(`[Scheduler] Cancelled cron job for schedule ${scheduleId}`);
+            return;
+        }
+        // Clear timeout if it exists
+        const timeout = this.oneTimeTimeouts.get(scheduleId);
+        if (timeout) {
+            clearTimeout(timeout);
+            this.oneTimeTimeouts.delete(scheduleId);
+            logger_1.logger.debug(`[Scheduler] Cancelled timeout for schedule ${scheduleId}`);
+        }
+    }
     /**
      * Start the scheduler
      */
@@ -196098,6 +194522,26 @@ class Scheduler {
      * Execute a scheduled workflow
      */
     async executeSchedule(schedule) {
+        // DB freshness check: verify the schedule still exists and is active.
+        // This prevents execution of cancelled or paused schedules when the
+        // in-memory job fires after a DB-only cancellation.
+        // Note: This is a single indexed primary-key lookup (<1ms for SQLite),
+        // and only runs for user-created schedules (static cron jobs use
+        // executeStaticCronJob instead), so the overhead is negligible
+        // compared to the workflow execution that follows.
+        try {
+            const fresh = await this.store.getAsync(schedule.id);
+            if (!fresh || fresh.status !== 'active') {
+                logger_1.logger.info(`[Scheduler] Schedule ${schedule.id} is no longer active (${fresh ? fresh.status : 'deleted'}), skipping execution`);
+                // Clean up the in-memory job since the schedule is gone/inactive
+                this.cancelSchedule(schedule.id);
+                return;
+            }
+        }
+        catch {
+            // If we can't check the DB, log and proceed (don't block execution on DB errors)
+            logger_1.logger.warn(`[Scheduler] Could not verify schedule ${schedule.id} freshness, proceeding with execution`);
+        }
         const description = schedule.workflow || 'reminder';
         logger_1.logger.info(`[Scheduler] Executing schedule ${schedule.id}: ${description}`);
         const startTime = Date.now();
@@ -200234,7 +198678,7 @@ class StateMachineExecutionEngine {
             try {
                 logger_1.logger.debug(`[PolicyEngine] Loading enterprise policy engine (engine=${configWithTagFilter.policy.engine})`);
                 // @ts-ignore — enterprise/ may not exist in OSS builds (caught at runtime)
-                const { loadEnterprisePolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(87068)));
+                const { loadEnterprisePolicyEngine } = await Promise.resolve().then(() => __importStar(__nccwpck_require__(7065)));
                 context.policyEngine = await loadEnterprisePolicyEngine(configWithTagFilter.policy);
                 logger_1.logger.debug(`[PolicyEngine] Initialized: ${context.policyEngine?.constructor?.name || 'unknown'}`);
             }
@@ -201330,6 +199774,13 @@ async function initializeWorkspace(context) {
             process.env.VISOR_WORKSPACE_MAIN_PROJECT = info.mainProjectPath;
             process.env.VISOR_WORKSPACE_MAIN_PROJECT_NAME = info.mainProjectName;
             process.env.VISOR_ORIGINAL_WORKDIR = originalPath;
+            // Prevent git from walking above the workspace base path.
+            // Without this, git commands in workspace subdirectories can discover
+            // a rogue .git in a parent directory (e.g. /tmp/.git) and leak
+            // operations across all workspaces.
+            const basePath = workspaceConfig?.base_path || process.env.VISOR_WORKSPACE_PATH || '/tmp/visor-workspaces';
+            const existing = process.env.GIT_CEILING_DIRECTORIES;
+            process.env.GIT_CEILING_DIRECTORIES = existing ? `${existing}:${basePath}` : basePath;
         }
         catch { }
         logger_1.logger.info(`[Workspace] Initialized workspace: ${info.workspacePath}`);
@@ -210498,7 +208949,7 @@ async function initTelemetry(opts = {}) {
                 const path = __nccwpck_require__(16928);
                 const outDir = opts.file?.dir ||
                     process.env.VISOR_TRACE_DIR ||
-                    path.join(process.cwd(), 'output', 'traces');
+                    __nccwpck_require__.ab + "traces";
                 fs.mkdirSync(outDir, { recursive: true });
                 const ts = new Date().toISOString().replace(/[:.]/g, '-');
                 process.env.VISOR_FALLBACK_TRACE_FILE = path.join(outDir, `run-${ts}.ndjson`);
@@ -210703,7 +209154,7 @@ async function shutdownTelemetry() {
             if (process.env.VISOR_TRACE_REPORT === 'true') {
                 const fs = __nccwpck_require__(79896);
                 const path = __nccwpck_require__(16928);
-                const outDir = process.env.VISOR_TRACE_DIR || path.join(process.cwd(), 'output', 'traces');
+                const outDir = process.env.VISOR_TRACE_DIR || __nccwpck_require__.ab + "traces";
                 if (!fs.existsSync(outDir))
                     fs.mkdirSync(outDir, { recursive: true });
                 const ts = new Date().toISOString().replace(/[:.]/g, '-');
@@ -211202,7 +209653,7 @@ function __getOrCreateNdjsonPath() {
                 fs.mkdirSync(dir, { recursive: true });
             return __ndjsonPath;
         }
-        const outDir = process.env.VISOR_TRACE_DIR || path.join(process.cwd(), 'output', 'traces');
+        const outDir = process.env.VISOR_TRACE_DIR || __nccwpck_require__.ab + "traces";
         if (!fs.existsSync(outDir))
             fs.mkdirSync(outDir, { recursive: true });
         if (!__ndjsonPath) {
@@ -222335,6 +220786,7 @@ function buildProviderTemplateContext(prInfo, dependencyResults, memoryStore, ou
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.resolveTools = resolveTools;
 const workflow_tool_executor_1 = __nccwpck_require__(30236);
+const workflow_registry_1 = __nccwpck_require__(82824);
 const logger_1 = __nccwpck_require__(86999);
 /**
  * Resolve tool items to CustomToolDefinition instances.
@@ -222345,6 +220797,13 @@ const logger_1 = __nccwpck_require__(86999);
  */
 function resolveTools(toolItems, globalTools, logPrefix = '[ToolResolver]') {
     const tools = new Map();
+    // Log registry state once for debugging workflow resolution failures
+    const registry = workflow_registry_1.WorkflowRegistry.getInstance();
+    const registeredWorkflows = registry.list().map(w => w.id);
+    if (toolItems.some(item => typeof item !== 'string' && (0, workflow_tool_executor_1.isWorkflowToolReference)(item))) {
+        logger_1.logger.info(`${logPrefix} Resolving ${toolItems.length} tool items. ` +
+            `WorkflowRegistry has ${registeredWorkflows.length} workflows: [${registeredWorkflows.join(', ')}]`);
+    }
     for (const item of toolItems) {
         // First, try to resolve as a workflow tool
         const workflowTool = (0, workflow_tool_executor_1.resolveWorkflowToolFromItem)(item);
@@ -222364,7 +220823,8 @@ function resolveTools(toolItems, globalTools, logPrefix = '[ToolResolver]') {
             logger_1.logger.warn(`${logPrefix} Tool '${item}' not found in global tools or workflow registry`);
         }
         else if ((0, workflow_tool_executor_1.isWorkflowToolReference)(item)) {
-            logger_1.logger.warn(`${logPrefix} Workflow '${item.workflow}' referenced but not found in registry`);
+            logger_1.logger.warn(`${logPrefix} Workflow '${item.workflow}' referenced but not found in registry. ` +
+                `Available: [${registeredWorkflows.join(', ')}]`);
         }
     }
     if (tools.size === 0 && toolItems.length > 0 && !globalTools) {
@@ -222741,6 +221201,10 @@ class WorkspaceManager {
                     catch { }
                     await this.createMainProjectWorktree(mainProjectPath);
                 }
+                else {
+                    // Worktree exists and is valid — update to latest upstream and clean
+                    await this.refreshWorktreeToUpstream(mainProjectPath);
+                }
             }
             else {
                 await this.createMainProjectWorktree(mainProjectPath);
@@ -222956,32 +221420,129 @@ class WorkspaceManager {
         return cleaned;
     }
     /**
-     * Create worktree for the main project
-     *
-     * visor-disable: architecture - Not using WorktreeManager here because:
-     * 1. WorktreeManager expects remote URLs and clones to bare repos first
-     * 2. This operates on the LOCAL repo we're already in (no cloning needed)
-     * 3. Adding a "local mode" to WorktreeManager would add complexity for minimal benefit
-     * The git commands here are simpler (just rev-parse + worktree add) vs WorktreeManager's
-     * full clone/bare-repo/fetch/worktree pipeline.
+     * visor-disable: architecture - The helpers below (resolveUpstreamRef,
+     * fetchAndResolveUpstream, resetAndCleanWorktree, refreshWorktreeToUpstream)
+     * are NOT duplicates of WorktreeManager's fetchRef/getCommitShaForRef/cleanWorktree.
+     * WorktreeManager operates on BARE repo caches cloned from remote URLs, while
+     * WorkspaceManager operates on the LOCAL working repo the user already has checked out.
+     * The git commands differ (e.g. `fetch origin --prune` vs `fetch origin <ref>:<ref>`)
+     * and sharing code would require adding a "local mode" to WorktreeManager for no benefit.
      */
-    async createMainProjectWorktree(targetPath) {
-        logger_1.logger.debug(`Creating main project worktree: ${targetPath}`);
-        // Get current HEAD
-        const headResult = await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(this.originalPath)} rev-parse HEAD`, {
-            timeout: 10000,
-        });
+    /**
+     * Resolve the upstream default branch ref.
+     * Tries origin/HEAD (symbolic), then origin/main, then origin/master.
+     * Falls back to local HEAD if no remote is configured.
+     */
+    async resolveUpstreamRef() {
+        const esc = shellEscape(this.originalPath);
+        // First, try to resolve origin/HEAD (follows the remote's default branch)
+        const symbolicResult = await command_executor_1.commandExecutor.execute(`git -C ${esc} symbolic-ref refs/remotes/origin/HEAD 2>/dev/null`, { timeout: 10000 });
+        if (symbolicResult.exitCode === 0 && symbolicResult.stdout.trim()) {
+            // Returns something like "refs/remotes/origin/main"
+            const ref = symbolicResult.stdout.trim().replace('refs/remotes/', '');
+            logger_1.logger.debug(`[Workspace] Resolved upstream default branch via origin/HEAD: ${ref}`);
+            return ref;
+        }
+        // Try origin/main
+        const mainResult = await command_executor_1.commandExecutor.execute(`git -C ${esc} rev-parse --verify origin/main 2>/dev/null`, { timeout: 10000 });
+        if (mainResult.exitCode === 0) {
+            logger_1.logger.debug(`[Workspace] Using origin/main as upstream ref`);
+            return 'origin/main';
+        }
+        // Try origin/master
+        const masterResult = await command_executor_1.commandExecutor.execute(`git -C ${esc} rev-parse --verify origin/master 2>/dev/null`, { timeout: 10000 });
+        if (masterResult.exitCode === 0) {
+            logger_1.logger.debug(`[Workspace] Using origin/master as upstream ref`);
+            return 'origin/master';
+        }
+        // Fallback: no remote configured, use local HEAD
+        logger_1.logger.warn(`[Workspace] No upstream remote found, falling back to local HEAD`);
+        return 'HEAD';
+    }
+    /**
+     * Fetch latest from origin, resolve the upstream default branch, and return
+     * both the ref name and the resolved commit SHA.
+     */
+    async fetchAndResolveUpstream() {
+        // Fetch latest from origin
+        logger_1.logger.debug(`[Workspace] Fetching latest from origin`);
+        const fetchResult = await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(this.originalPath)} fetch origin --prune 2>&1`, { timeout: 120000 });
+        if (fetchResult.exitCode !== 0) {
+            logger_1.logger.warn(`[Workspace] fetch origin failed (will use cached refs): ${fetchResult.stderr}`);
+        }
+        // Resolve the upstream ref
+        const upstreamRef = await this.resolveUpstreamRef();
+        // Get the commit SHA for the upstream ref
+        const shaResult = await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(this.originalPath)} rev-parse ${shellEscape(upstreamRef)}`, { timeout: 10000 });
+        if (shaResult.exitCode === 0) {
+            return { upstreamRef, targetSha: shaResult.stdout.trim() };
+        }
+        // Upstream ref unresolvable — fall back to local HEAD
+        logger_1.logger.warn(`[Workspace] Could not resolve ${upstreamRef} (${shaResult.stderr.trim()}), falling back to HEAD`);
+        const headResult = await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(this.originalPath)} rev-parse HEAD`, { timeout: 10000 });
         if (headResult.exitCode !== 0) {
-            throw new Error(`Failed to get HEAD: ${headResult.stderr}`);
+            throw new Error(`Repository has no commits — cannot create worktree: ${headResult.stderr}`);
+        }
+        return { upstreamRef: 'HEAD', targetSha: headResult.stdout.trim() };
+    }
+    /**
+     * Reset a worktree to a specific commit and clean all modifications.
+     */
+    async resetAndCleanWorktree(worktreePath, targetSha) {
+        const escapedPath = shellEscape(worktreePath);
+        const escapedSha = shellEscape(targetSha);
+        const resetResult = await command_executor_1.commandExecutor.execute(`git -C ${escapedPath} reset --hard ${escapedSha}`, { timeout: 10000 });
+        if (resetResult.exitCode !== 0) {
+            logger_1.logger.warn(`[Workspace] reset --hard failed: ${resetResult.stderr}`);
+        }
+        const cleanResult = await command_executor_1.commandExecutor.execute(`git -C ${escapedPath} clean -fdx`, {
+            timeout: 30000,
+        });
+        if (cleanResult.exitCode !== 0) {
+            logger_1.logger.warn(`[Workspace] clean -fdx failed: ${cleanResult.stderr}`);
+        }
+    }
+    /**
+     * Refresh an existing worktree to the latest upstream default branch
+     * and ensure it has no modified or untracked files.
+     */
+    async refreshWorktreeToUpstream(worktreePath) {
+        logger_1.logger.info(`[Workspace] Refreshing worktree to latest upstream: ${worktreePath}`);
+        try {
+            const { upstreamRef, targetSha } = await this.fetchAndResolveUpstream();
+            // Point worktree to the upstream commit
+            const checkoutResult = await command_executor_1.commandExecutor.execute(`git -C ${shellEscape(worktreePath)} checkout --detach ${shellEscape(targetSha)}`, { timeout: 30000 });
+            if (checkoutResult.exitCode !== 0) {
+                logger_1.logger.warn(`[Workspace] checkout --detach failed (worktree stays at current commit): ${checkoutResult.stderr}`);
+                // Still clean even if checkout failed — the worktree is valid, just at old commit
+                await this.resetAndCleanWorktree(worktreePath, 'HEAD');
+                return;
+            }
+            // Reset and clean
+            await this.resetAndCleanWorktree(worktreePath, targetSha);
+            logger_1.logger.info(`[Workspace] Worktree updated to ${upstreamRef} (${targetSha.slice(0, 8)})`);
+        }
+        catch (error) {
+            // Best-effort: a stale worktree is better than failing initialization entirely
+            logger_1.logger.warn(`[Workspace] Failed to refresh worktree (continuing with stale state): ${error}`);
         }
-        const headRef = headResult.stdout.trim();
-        // Create worktree using detached HEAD to avoid branch conflicts
-        const createCmd = `git -C ${shellEscape(this.originalPath)} worktree add --detach ${shellEscape(targetPath)} ${shellEscape(headRef)}`;
+    }
+    /**
+     * Create worktree for the main project.
+     * See visor-disable comment above resolveUpstreamRef for why this doesn't use WorktreeManager.
+     */
+    async createMainProjectWorktree(targetPath) {
+        logger_1.logger.debug(`Creating main project worktree: ${targetPath}`);
+        const { upstreamRef, targetSha } = await this.fetchAndResolveUpstream();
+        // Create worktree using detached HEAD at the upstream commit
+        const createCmd = `git -C ${shellEscape(this.originalPath)} worktree add --detach ${shellEscape(targetPath)} ${shellEscape(targetSha)}`;
         const result = await command_executor_1.commandExecutor.execute(createCmd, { timeout: 60000 });
         if (result.exitCode !== 0) {
             throw new Error(`Failed to create main project worktree: ${result.stderr}`);
         }
-        logger_1.logger.debug(`Created main project worktree at ${targetPath}`);
+        // Clean (shouldn't be needed in a fresh worktree, but defense in depth)
+        await this.resetAndCleanWorktree(targetPath, targetSha);
+        logger_1.logger.info(`Created main project worktree at ${targetPath} (${upstreamRef} -> ${targetSha.slice(0, 8)})`);
     }
     /**
      * Remove main project worktree
@@ -223663,27 +222224,52 @@ class WorktreeManager {
                 fs.rmSync(worktree_path, { recursive: true, force: true });
             }
         }
+        // Clean up sibling metadata file
+        const metadataPath = this.getMetadataPath(worktree_path);
+        try {
+            if (fs.existsSync(metadataPath)) {
+                fs.unlinkSync(metadataPath);
+            }
+        }
+        catch {
+            // best-effort cleanup
+        }
         // Remove from active list
         this.activeWorktrees.delete(worktreeId);
         logger_1.logger.info(`Successfully removed worktree: ${worktreeId}`);
     }
+    /**
+     * Get the metadata file path for a worktree.
+     * Stored as a sibling file OUTSIDE the worktree to avoid being committed
+     * when agents run `git add .` inside the checked-out repo.
+     */
+    getMetadataPath(worktreePath) {
+        return worktreePath.replace(/\/?$/, '') + '.metadata.json';
+    }
     /**
      * Save worktree metadata
      */
     async saveMetadata(worktreePath, metadata) {
-        const metadataPath = path.join(worktreePath, '.visor-metadata.json');
+        const metadataPath = this.getMetadataPath(worktreePath);
         fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf8');
     }
     /**
      * Load worktree metadata
      */
     async loadMetadata(worktreePath) {
-        const metadataPath = path.join(worktreePath, '.visor-metadata.json');
-        if (!fs.existsSync(metadataPath)) {
+        const metadataPath = this.getMetadataPath(worktreePath);
+        // Also check legacy location (inside worktree) for backwards compatibility
+        const legacyPath = path.join(worktreePath, '.visor-metadata.json');
+        const pathToRead = fs.existsSync(metadataPath)
+            ? metadataPath
+            : fs.existsSync(legacyPath)
+                ? legacyPath
+                : null;
+        if (!pathToRead) {
             return null;
         }
         try {
-            const content = fs.readFileSync(metadataPath, 'utf8');
+            const content = fs.readFileSync(pathToRead, 'utf8');
             return JSON.parse(content);
         }
         catch (error) {
@@ -224755,6 +223341,22 @@ class WorkflowRegistry {
 exports.WorkflowRegistry = WorkflowRegistry;
 
 
+/***/ }),
+
+/***/ 7065:
+/***/ ((module) => {
+
+module.exports = eval("require")("./enterprise/loader");
+
+
+/***/ }),
+
+/***/ 71370:
+/***/ ((module) => {
+
+module.exports = eval("require")("./enterprise/policy/policy-input-builder");
+
+
 /***/ }),
 
 /***/ 18327:
@@ -266426,7 +265028,7 @@ var require_package2 = __commonJS({
     module2.exports = {
       name: "@aws-sdk/client-bedrock-runtime",
       description: "AWS SDK for JavaScript Bedrock Runtime Client for Node.js, Browser and React Native",
-      version: "3.999.0",
+      version: "3.1000.0",
       scripts: {
         build: "concurrently 'yarn:build:types' 'yarn:build:es' && yarn build:cjs",
         "build:cjs": "node ../../scripts/compilation/inline client-bedrock-runtime",
@@ -266437,7 +265039,11 @@ var require_package2 = __commonJS({
         clean: "premove dist-cjs dist-es dist-types tsconfig.cjs.tsbuildinfo tsconfig.es.tsbuildinfo tsconfig.types.tsbuildinfo",
         "extract:docs": "api-extractor run --local",
         "generate:client": "node ../../scripts/generate-clients/single-service --solo bedrock-runtime",
-        "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs"
+        test: "yarn g:vitest run --passWithNoTests",
+        "test:index": "tsc --noEmit ./test/index-types.ts && node ./test/index-objects.spec.mjs",
+        "test:integration": "yarn g:vitest run --passWithNoTests -c vitest.config.integ.mts",
+        "test:integration:watch": "yarn g:vitest run --passWithNoTests -c vitest.config.integ.mts",
+        "test:watch": "yarn g:vitest watch --passWithNoTests"
       },
       main: "./dist-cjs/index.js",
       types: "./dist-types/index.d.ts",
@@ -266456,7 +265062,7 @@ var require_package2 = __commonJS({
         "@aws-sdk/middleware-user-agent": "^3.972.15",
         "@aws-sdk/middleware-websocket": "^3.972.10",
         "@aws-sdk/region-config-resolver": "^3.972.6",
-        "@aws-sdk/token-providers": "3.999.0",
+        "@aws-sdk/token-providers": "3.1000.0",
         "@aws-sdk/types": "^3.973.4",
         "@aws-sdk/util-endpoints": "^3.996.3",
         "@aws-sdk/util-user-agent-browser": "^3.972.6",
@@ -266493,12 +265099,14 @@ var require_package2 = __commonJS({
         tslib: "^2.6.2"
       },
       devDependencies: {
+        "@smithy/snapshot-testing": "^1.0.7",
         "@tsconfig/node20": "20.1.8",
         "@types/node": "^20.14.8",
         concurrently: "7.0.0",
         "downlevel-dts": "0.10.1",
         premove: "4.0.0",
-        typescript: "~5.8.3"
+        typescript: "~5.8.3",
+        vitest: "^4.0.17"
       },
       engines: {
         node: ">=20.0.0"
@@ -268500,9 +267108,9 @@ var init_sso_oidc = __esm({
   }
 });
 
-// node_modules/@aws-sdk/token-providers/dist-cjs/index.js
+// node_modules/@aws-sdk/credential-provider-sso/node_modules/@aws-sdk/token-providers/dist-cjs/index.js
 var require_dist_cjs56 = __commonJS({
-  "node_modules/@aws-sdk/token-providers/dist-cjs/index.js"(exports2) {
+  "node_modules/@aws-sdk/credential-provider-sso/node_modules/@aws-sdk/token-providers/dist-cjs/index.js"(exports2) {
     "use strict";
     var client = (init_client(), __toCommonJS(client_exports));
     var httpAuthSchemes = (init_httpAuthSchemes2(), __toCommonJS(httpAuthSchemes_exports));
@@ -272335,8 +270943,155 @@ var require_dist_cjs63 = __commonJS({
   }
 });
 
-// node_modules/@smithy/eventstream-serde-node/dist-cjs/index.js
+// node_modules/@aws-sdk/token-providers/dist-cjs/index.js
 var require_dist_cjs64 = __commonJS({
+  "node_modules/@aws-sdk/token-providers/dist-cjs/index.js"(exports2) {
+    "use strict";
+    var client = (init_client(), __toCommonJS(client_exports));
+    var httpAuthSchemes = (init_httpAuthSchemes2(), __toCommonJS(httpAuthSchemes_exports));
+    var propertyProvider = require_dist_cjs24();
+    var sharedIniFileLoader = require_dist_cjs42();
+    var node_fs = __nccwpck_require__(73024);
+    var fromEnvSigningName = ({ logger: logger2, signingName } = {}) => async () => {
+      logger2?.debug?.("@aws-sdk/token-providers - fromEnvSigningName");
+      if (!signingName) {
+        throw new propertyProvider.TokenProviderError("Please pass 'signingName' to compute environment variable key", { logger: logger2 });
+      }
+      const bearerTokenKey = httpAuthSchemes.getBearerTokenEnvKey(signingName);
+      if (!(bearerTokenKey in process.env)) {
+        throw new propertyProvider.TokenProviderError(`Token not present in '${bearerTokenKey}' environment variable`, { logger: logger2 });
+      }
+      const token = { token: process.env[bearerTokenKey] };
+      client.setTokenFeature(token, "BEARER_SERVICE_ENV_VARS", "3");
+      return token;
+    };
+    var EXPIRE_WINDOW_MS = 5 * 60 * 1e3;
+    var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;
+    var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
+      const { SSOOIDCClient: SSOOIDCClient2 } = await Promise.resolve().then(() => (init_sso_oidc(), sso_oidc_exports));
+      const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
+      const ssoOidcClient = new SSOOIDCClient2(Object.assign({}, init.clientConfig ?? {}, {
+        region: ssoRegion ?? init.clientConfig?.region,
+        logger: coalesce("logger"),
+        userAgentAppId: coalesce("userAgentAppId")
+      }));
+      return ssoOidcClient;
+    };
+    var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
+      const { CreateTokenCommand: CreateTokenCommand2 } = await Promise.resolve().then(() => (init_sso_oidc(), sso_oidc_exports));
+      const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
+      return ssoOidcClient.send(new CreateTokenCommand2({
+        clientId: ssoToken.clientId,
+        clientSecret: ssoToken.clientSecret,
+        refreshToken: ssoToken.refreshToken,
+        grantType: "refresh_token"
+      }));
+    };
+    var validateTokenExpiry = (token) => {
+      if (token.expiration && token.expiration.getTime() < Date.now()) {
+        throw new propertyProvider.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+      }
+    };
+    var validateTokenKey = (key, value, forRefresh = false) => {
+      if (typeof value === "undefined") {
+        throw new propertyProvider.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+      }
+    };
+    var { writeFile: writeFile2 } = node_fs.promises;
+    var writeSSOTokenToFile = (id, ssoToken) => {
+      const tokenFilepath = sharedIniFileLoader.getSSOTokenFilepath(id);
+      const tokenString = JSON.stringify(ssoToken, null, 2);
+      return writeFile2(tokenFilepath, tokenString);
+    };
+    var lastRefreshAttemptTime = /* @__PURE__ */ new Date(0);
+    var fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+      init.logger?.debug("@aws-sdk/token-providers - fromSso");
+      const profiles = await sharedIniFileLoader.parseKnownFiles(init);
+      const profileName = sharedIniFileLoader.getProfileName({
+        profile: init.profile ?? callerClientConfig?.profile
+      });
+      const profile = profiles[profileName];
+      if (!profile) {
+        throw new propertyProvider.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+      } else if (!profile["sso_session"]) {
+        throw new propertyProvider.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+      }
+      const ssoSessionName = profile["sso_session"];
+      const ssoSessions = await sharedIniFileLoader.loadSsoSessionData(init);
+      const ssoSession = ssoSessions[ssoSessionName];
+      if (!ssoSession) {
+        throw new propertyProvider.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+      }
+      for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
+        if (!ssoSession[ssoSessionRequiredKey]) {
+          throw new propertyProvider.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+        }
+      }
+      ssoSession["sso_start_url"];
+      const ssoRegion = ssoSession["sso_region"];
+      let ssoToken;
+      try {
+        ssoToken = await sharedIniFileLoader.getSSOTokenFromFile(ssoSessionName);
+      } catch (e5) {
+        throw new propertyProvider.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+      }
+      validateTokenKey("accessToken", ssoToken.accessToken);
+      validateTokenKey("expiresAt", ssoToken.expiresAt);
+      const { accessToken, expiresAt } = ssoToken;
+      const existingToken = { token: accessToken, expiration: new Date(expiresAt) };
+      if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
+        return existingToken;
+      }
+      if (Date.now() - lastRefreshAttemptTime.getTime() < 30 * 1e3) {
+        validateTokenExpiry(existingToken);
+        return existingToken;
+      }
+      validateTokenKey("clientId", ssoToken.clientId, true);
+      validateTokenKey("clientSecret", ssoToken.clientSecret, true);
+      validateTokenKey("refreshToken", ssoToken.refreshToken, true);
+      try {
+        lastRefreshAttemptTime.setTime(Date.now());
+        const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init, callerClientConfig);
+        validateTokenKey("accessToken", newSsoOidcToken.accessToken);
+        validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
+        const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1e3);
+        try {
+          await writeSSOTokenToFile(ssoSessionName, {
+            ...ssoToken,
+            accessToken: newSsoOidcToken.accessToken,
+            expiresAt: newTokenExpiration.toISOString(),
+            refreshToken: newSsoOidcToken.refreshToken
+          });
+        } catch (error2) {
+        }
+        return {
+          token: newSsoOidcToken.accessToken,
+          expiration: newTokenExpiration
+        };
+      } catch (error2) {
+        validateTokenExpiry(existingToken);
+        return existingToken;
+      }
+    };
+    var fromStatic = ({ token, logger: logger2 }) => async () => {
+      logger2?.debug("@aws-sdk/token-providers - fromStatic");
+      if (!token || !token.token) {
+        throw new propertyProvider.TokenProviderError(`Please pass a valid token to fromStatic`, false);
+      }
+      return token;
+    };
+    var nodeProvider = (init = {}) => propertyProvider.memoize(propertyProvider.chain(fromSso(init), async () => {
+      throw new propertyProvider.TokenProviderError("Could not load token from any providers", false);
+    }), (token) => token.expiration !== void 0 && token.expiration.getTime() - Date.now() < 3e5, (token) => token.expiration !== void 0);
+    exports2.fromEnvSigningName = fromEnvSigningName;
+    exports2.fromSso = fromSso;
+    exports2.fromStatic = fromStatic;
+    exports2.nodeProvider = nodeProvider;
+  }
+});
+
+// node_modules/@smithy/eventstream-serde-node/dist-cjs/index.js
+var require_dist_cjs65 = __commonJS({
   "node_modules/@smithy/eventstream-serde-node/dist-cjs/index.js"(exports2) {
     "use strict";
     var eventstreamSerdeUniversal = require_dist_cjs35();
@@ -275018,11 +273773,11 @@ var require_runtimeConfig = __commonJS({
     var core_1 = (init_dist_es2(), __toCommonJS(dist_es_exports2));
     var credential_provider_node_1 = require_dist_cjs62();
     var eventstream_handler_node_1 = require_dist_cjs63();
-    var token_providers_1 = require_dist_cjs56();
+    var token_providers_1 = require_dist_cjs64();
     var util_user_agent_node_1 = require_dist_cjs51();
     var config_resolver_1 = require_dist_cjs39();
     var core_2 = (init_dist_es(), __toCommonJS(dist_es_exports));
-    var eventstream_serde_node_1 = require_dist_cjs64();
+    var eventstream_serde_node_1 = require_dist_cjs65();
     var hash_node_1 = require_dist_cjs52();
     var middleware_retry_1 = require_dist_cjs47();
     var node_config_provider_1 = require_dist_cjs43();
@@ -275094,7 +273849,7 @@ var require_runtimeConfig = __commonJS({
 });
 
 // node_modules/@aws-sdk/client-bedrock-runtime/dist-cjs/index.js
-var require_dist_cjs65 = __commonJS({
+var require_dist_cjs66 = __commonJS({
   "node_modules/@aws-sdk/client-bedrock-runtime/dist-cjs/index.js"(exports2) {
     "use strict";
     var middlewareEventstream = require_dist_cjs3();
@@ -275939,13 +274694,13 @@ var import_client_bedrock_runtime, import_client_bedrock_runtime2, import_client
 var init_dist3 = __esm({
   "node_modules/@ai-sdk/amazon-bedrock/dist/index.mjs"() {
     init_dist2();
-    import_client_bedrock_runtime = __toESM(require_dist_cjs65(), 1);
+    import_client_bedrock_runtime = __toESM(require_dist_cjs66(), 1);
     init_dist();
-    import_client_bedrock_runtime2 = __toESM(require_dist_cjs65(), 1);
+    import_client_bedrock_runtime2 = __toESM(require_dist_cjs66(), 1);
     init_dist();
     init_dist();
     init_dist2();
-    import_client_bedrock_runtime3 = __toESM(require_dist_cjs65(), 1);
+    import_client_bedrock_runtime3 = __toESM(require_dist_cjs66(), 1);
     generateFileId = createIdGenerator({ prefix: "file", size: 16 });
     BedrockChatLanguageModel = class {
       constructor(modelId, settings, config) {
@@ -299113,7 +297868,6 @@ var init_reg_exp = __esm({
 // node_modules/chevrotain/lib/src/scan/lexer.js
 function analyzeTokenTypes(tokenTypes, options) {
   options = defaults_default(options, {
-    useSticky: SUPPORT_STICKY,
     debug: false,
     safeMode: false,
     positionTracking: "full",
@@ -299162,7 +297916,7 @@ function analyzeTokenTypes(tokenTypes, options) {
         ], regExpSource[1])) {
           return regExpSource[1];
         } else {
-          return options.useSticky ? addStickyFlag(currPattern) : addStartOfInput(currPattern);
+          return addStickyFlag(currPattern);
         }
       } else if (isFunction_default(currPattern)) {
         hasCustom = true;
@@ -299176,7 +297930,7 @@ function analyzeTokenTypes(tokenTypes, options) {
         } else {
           const escapedRegExpString = currPattern.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
           const wrappedRegExp = new RegExp(escapedRegExpString);
-          return options.useSticky ? addStickyFlag(wrappedRegExp) : addStartOfInput(wrappedRegExp);
+          return addStickyFlag(wrappedRegExp);
         }
       } else {
         throw Error("non exhaustive match");
@@ -299580,10 +298334,6 @@ function noMetaChar(regExp) {
 function usesLookAheadOrBehind(regExp) {
   return /(\(\?=)|(\(\?!)|(\(\?<=)|(\(\?<!)/.test(regExp.source);
 }
-function addStartOfInput(pattern) {
-  const flags = pattern.ignoreCase ? "i" : "";
-  return new RegExp(`^(?:${pattern.source})`, flags);
-}
 function addStickyFlag(pattern) {
   const flags = pattern.ignoreCase ? "iy" : "y";
   return new RegExp(`${pattern.source}`, flags);
@@ -299772,7 +298522,7 @@ function initCharCodeToOptimizedIndexMap() {
     }
   }
 }
-var PATTERN, DEFAULT_MODE, MODES, SUPPORT_STICKY, end_of_input, start_of_input, LineTerminatorOptimizedTester, minOptimizationVal, charCodeToOptimizedIdxMap;
+var PATTERN, DEFAULT_MODE, MODES, end_of_input, start_of_input, LineTerminatorOptimizedTester, minOptimizationVal, charCodeToOptimizedIdxMap;
 var init_lexer = __esm({
   "node_modules/chevrotain/lib/src/scan/lexer.js"() {
     init_api3();
@@ -299784,7 +298534,6 @@ var init_lexer = __esm({
     PATTERN = "PATTERN";
     DEFAULT_MODE = "defaultMode";
     MODES = "modes";
-    SUPPORT_STICKY = typeof new RegExp("(?:)").sticky === "boolean";
     end_of_input = /[^\\][$]/;
     start_of_input = /[^\\[][\^]|^\^/;
     LineTerminatorOptimizedTester = {
@@ -300100,13 +298849,6 @@ var init_lexer_public = __esm({
             PRINT_WARNING(warningDescriptor.message);
           });
           this.TRACE_INIT("Choosing sub-methods implementations", () => {
-            if (SUPPORT_STICKY) {
-              this.chopInput = identity_default;
-              this.match = this.matchWithTest;
-            } else {
-              this.updateLastIndex = noop_default;
-              this.match = this.matchWithExec;
-            }
             if (hasOnlySingleMode) {
               this.handleModes = noop_default;
             }
@@ -300169,7 +298911,7 @@ var init_lexer_public = __esm({
       // this method also used quite a bit of `!` none null assertions because it is too optimized
       // for `tsc` to always understand it is "safe"
       tokenizeInternal(text, initialMode) {
-        let i5, j5, k5, matchAltImage, longerAlt, matchedImage, payload2, altPayload, imageLength, group, tokType, newToken, errLength, droppedChar, msg, match2;
+        let i5, j5, k5, matchAltImage, longerAlt, matchedImage, payload2, altPayload, imageLength, group, tokType, newToken, errLength, msg, match2;
         const orgText = text;
         const orgLength = orgText.length;
         let offset2 = 0;
@@ -300188,19 +298930,7 @@ var init_lexer_public = __esm({
         const modeStack = [];
         const emptyArray = [];
         Object.freeze(emptyArray);
-        let getPossiblePatterns;
-        function getPossiblePatternsSlow() {
-          return patternIdxToConfig;
-        }
-        function getPossiblePatternsOptimized(charCode) {
-          const optimizedCharIdx = charCodeToOptimizedIndex(charCode);
-          const possiblePatterns = currCharCodeToPatternIdxToConfig[optimizedCharIdx];
-          if (possiblePatterns === void 0) {
-            return emptyArray;
-          } else {
-            return possiblePatterns;
-          }
-        }
+        let isOptimizedMode = false;
         const pop_mode = (popToken) => {
           if (modeStack.length === 1 && // if we have both a POP_MODE and a PUSH_MODE this is in-fact a "transition"
           // So no error should occur.
@@ -300221,9 +298951,9 @@ var init_lexer_public = __esm({
             currModePatternsLength = patternIdxToConfig.length;
             const modeCanBeOptimized = this.canModeBeOptimized[newMode] && this.config.safeMode === false;
             if (currCharCodeToPatternIdxToConfig && modeCanBeOptimized) {
-              getPossiblePatterns = getPossiblePatternsOptimized;
+              isOptimizedMode = true;
             } else {
-              getPossiblePatterns = getPossiblePatternsSlow;
+              isOptimizedMode = false;
             }
           }
         };
@@ -300235,9 +298965,9 @@ var init_lexer_public = __esm({
           currModePatternsLength = patternIdxToConfig.length;
           const modeCanBeOptimized = this.canModeBeOptimized[newMode] && this.config.safeMode === false;
           if (currCharCodeToPatternIdxToConfig && modeCanBeOptimized) {
-            getPossiblePatterns = getPossiblePatternsOptimized;
+            isOptimizedMode = true;
           } else {
-            getPossiblePatterns = getPossiblePatternsSlow;
+            isOptimizedMode = false;
           }
         }
         push_mode.call(this, initialMode);
@@ -300245,8 +298975,16 @@ var init_lexer_public = __esm({
         const recoveryEnabled = this.config.recoveryEnabled;
         while (offset2 < orgLength) {
           matchedImage = null;
+          imageLength = -1;
           const nextCharCode = orgText.charCodeAt(offset2);
-          const chosenPatternIdxToConfig = getPossiblePatterns(nextCharCode);
+          let chosenPatternIdxToConfig;
+          if (isOptimizedMode) {
+            const optimizedCharIdx = charCodeToOptimizedIndex(nextCharCode);
+            const possiblePatterns = currCharCodeToPatternIdxToConfig[optimizedCharIdx];
+            chosenPatternIdxToConfig = possiblePatterns !== void 0 ? possiblePatterns : emptyArray;
+          } else {
+            chosenPatternIdxToConfig = patternIdxToConfig;
+          }
           const chosenPatternsLength = chosenPatternIdxToConfig.length;
           for (i5 = 0; i5 < chosenPatternsLength; i5++) {
             currConfig = chosenPatternIdxToConfig[i5];
@@ -300255,12 +298993,14 @@ var init_lexer_public = __esm({
             const singleCharCode = currConfig.short;
             if (singleCharCode !== false) {
               if (nextCharCode === singleCharCode) {
+                imageLength = 1;
                 matchedImage = currPattern;
               }
             } else if (currConfig.isCustom === true) {
               match2 = currPattern.exec(orgText, offset2, matchedTokens, groups);
               if (match2 !== null) {
                 matchedImage = match2[0];
+                imageLength = matchedImage.length;
                 if (match2.payload !== void 0) {
                   payload2 = match2.payload;
                 }
@@ -300268,12 +299008,13 @@ var init_lexer_public = __esm({
                 matchedImage = null;
               }
             } else {
-              this.updateLastIndex(currPattern, offset2);
-              matchedImage = this.match(currPattern, text, offset2);
+              currPattern.lastIndex = offset2;
+              imageLength = this.matchLength(currPattern, text, offset2);
             }
-            if (matchedImage !== null) {
+            if (imageLength !== -1) {
               longerAlt = currConfig.longerAlt;
               if (longerAlt !== void 0) {
+                matchedImage = text.substring(offset2, offset2 + imageLength);
                 const longerAltLength = longerAlt.length;
                 for (k5 = 0; k5 < longerAltLength; k5++) {
                   const longerAltConfig = patternIdxToConfig[longerAlt[k5]];
@@ -300290,11 +299031,12 @@ var init_lexer_public = __esm({
                       matchAltImage = null;
                     }
                   } else {
-                    this.updateLastIndex(longerAltPattern, offset2);
+                    longerAltPattern.lastIndex = offset2;
                     matchAltImage = this.match(longerAltPattern, text, offset2);
                   }
                   if (matchAltImage && matchAltImage.length > matchedImage.length) {
                     matchedImage = matchAltImage;
+                    imageLength = matchAltImage.length;
                     payload2 = altPayload;
                     currConfig = longerAltConfig;
                     break;
@@ -300304,10 +299046,10 @@ var init_lexer_public = __esm({
               break;
             }
           }
-          if (matchedImage !== null) {
-            imageLength = matchedImage.length;
+          if (imageLength !== -1) {
             group = currConfig.group;
             if (group !== void 0) {
+              matchedImage = matchedImage !== null ? matchedImage : text.substring(offset2, offset2 + imageLength);
               tokType = currConfig.tokenTypeIdx;
               newToken = this.createTokenInstance(matchedImage, offset2, tokType, currConfig.tokenType, line, column, imageLength);
               this.handlePayload(newToken, payload2);
@@ -300317,15 +299059,13 @@ var init_lexer_public = __esm({
                 groups[group].push(newToken);
               }
             }
-            text = this.chopInput(text, imageLength);
-            offset2 = offset2 + imageLength;
-            column = this.computeNewColumn(column, imageLength);
             if (trackLines === true && currConfig.canLineTerminator === true) {
               let numOfLTsInMatch = 0;
               let foundTerminator;
               let lastLTEndOffset;
               lineTerminatorPattern.lastIndex = 0;
               do {
+                matchedImage = matchedImage !== null ? matchedImage : text.substring(offset2, offset2 + imageLength);
                 foundTerminator = lineTerminatorPattern.test(matchedImage);
                 if (foundTerminator === true) {
                   lastLTEndOffset = lineTerminatorPattern.lastIndex - 1;
@@ -300336,8 +299076,13 @@ var init_lexer_public = __esm({
                 line = line + numOfLTsInMatch;
                 column = imageLength - lastLTEndOffset;
                 this.updateTokenEndLineColumnLocation(newToken, group, lastLTEndOffset, numOfLTsInMatch, line, column, imageLength);
+              } else {
+                column = this.computeNewColumn(column, imageLength);
               }
+            } else {
+              column = this.computeNewColumn(column, imageLength);
             }
+            offset2 = offset2 + imageLength;
             this.handleModes(currConfig, pop_mode, push_mode, newToken);
           } else {
             const errorStartOffset = offset2;
@@ -300345,7 +299090,6 @@ var init_lexer_public = __esm({
             const errorColumn = column;
             let foundResyncPoint = recoveryEnabled === false;
             while (foundResyncPoint === false && offset2 < orgLength) {
-              text = this.chopInput(text, 1);
               offset2++;
               for (j5 = 0; j5 < currModePatternsLength; j5++) {
                 const currConfig2 = patternIdxToConfig[j5];
@@ -300358,7 +299102,7 @@ var init_lexer_public = __esm({
                 } else if (currConfig2.isCustom === true) {
                   foundResyncPoint = currPattern.exec(orgText, offset2, matchedTokens, groups) !== null;
                 } else {
-                  this.updateLastIndex(currPattern, offset2);
+                  currPattern.lastIndex = offset2;
                   foundResyncPoint = currPattern.exec(text) !== null;
                 }
                 if (foundResyncPoint === true) {
@@ -300401,12 +299145,6 @@ var init_lexer_public = __esm({
           push_mode.call(this, config.push);
         }
       }
-      chopInput(text, length) {
-        return text.substring(length);
-      }
-      updateLastIndex(regExp, newLastIndex) {
-        regExp.lastIndex = newLastIndex;
-      }
       // TODO: decrease this under 600 characters? inspect stripping comments option in TSC compiler
       updateTokenEndLineColumnLocation(newToken, group, lastLTIdx, numOfLTsInMatch, line, column, imageLength) {
         let lastCharIsLT, fixForEndingInLT;
@@ -300469,16 +299207,19 @@ var init_lexer_public = __esm({
           token.payload = payload2;
         }
       }
-      matchWithTest(pattern, text, offset2) {
+      match(pattern, text, offset2) {
         const found = pattern.test(text);
         if (found === true) {
           return text.substring(offset2, pattern.lastIndex);
         }
         return null;
       }
-      matchWithExec(pattern, text) {
-        const regExpArray = pattern.exec(text);
-        return regExpArray !== null ? regExpArray[0] : null;
+      matchLength(pattern, text, offset2) {
+        const found = pattern.test(text);
+        if (found === true) {
+          return pattern.lastIndex - offset2;
+        }
+        return -1;
       }
     };
     Lexer.SKIPPED = "This marks a skipped Token pattern, this means each token identified by it will be consumed and then thrown into oblivion, this can be used to for example to completely ignore whitespace.";
@@ -300670,12 +299411,20 @@ For Further details.`;
         return errMsg;
       },
       buildAlternationAmbiguityError(options) {
-        const pathMsg = map_default(options.prefixPath, (currtok) => tokenLabel2(currtok)).join(", ");
         const occurrence = options.alternation.idx === 0 ? "" : options.alternation.idx;
+        const isEmptyPath = options.prefixPath.length === 0;
         let currMessage = `Ambiguous Alternatives Detected: <${options.ambiguityIndices.join(" ,")}> in <OR${occurrence}> inside <${options.topLevelRule.name}> Rule,
-<${pathMsg}> may appears as a prefix path in all these alternatives.
 `;
-        currMessage = currMessage + `See: https://chevrotain.io/docs/guide/resolving_grammar_errors.html#AMBIGUOUS_ALTERNATIVES
+        if (isEmptyPath) {
+          currMessage += `These alternatives are all empty (match no tokens), making them indistinguishable.
+Only the last alternative may be empty.
+`;
+        } else {
+          const pathMsg = map_default(options.prefixPath, (currtok) => tokenLabel2(currtok)).join(", ");
+          currMessage += `<${pathMsg}> may appears as a prefix path in all these alternatives.
+`;
+        }
+        currMessage += `See: https://chevrotain.io/docs/guide/resolving_grammar_errors.html#AMBIGUOUS_ALTERNATIVES
 For Further details.`;
         return currMessage;
       },
@@ -329914,12 +328663,31 @@ function cleanSchemaResponse(response) {
     const closeChar = openChar === "{" ? "}" : "]";
     let bracketCount = 1;
     let endIndex = startIndex + 1;
+    let inString = false;
+    let escapeNext = false;
     while (endIndex < trimmed.length && bracketCount > 0) {
       const char = trimmed[endIndex];
-      if (char === openChar) {
-        bracketCount++;
-      } else if (char === closeChar) {
-        bracketCount--;
+      if (escapeNext) {
+        escapeNext = false;
+        endIndex++;
+        continue;
+      }
+      if (char === "\\" && inString) {
+        escapeNext = true;
+        endIndex++;
+        continue;
+      }
+      if (char === '"') {
+        inString = !inString;
+        endIndex++;
+        continue;
+      }
+      if (!inString) {
+        if (char === openChar) {
+          bracketCount++;
+        } else if (char === closeChar) {
+          bracketCount--;
+        }
       }
       endIndex++;
     }
@@ -352300,6 +351068,122 @@ var init_bashPermissions = __esm({
 });
 
 // src/agent/bashExecutor.js
+function splitCommandComponents(command) {
+  const parts = [];
+  let current2 = "";
+  let inQuote = false;
+  let quoteChar = "";
+  for (let i5 = 0; i5 < command.length; i5++) {
+    const c5 = command[i5];
+    const next = command[i5 + 1] || "";
+    if (c5 === "\\" && !inQuote) {
+      current2 += c5 + next;
+      i5++;
+      continue;
+    }
+    if (inQuote && quoteChar === '"' && c5 === "\\" && next) {
+      current2 += c5 + next;
+      i5++;
+      continue;
+    }
+    if (!inQuote && (c5 === '"' || c5 === "'")) {
+      inQuote = true;
+      quoteChar = c5;
+      current2 += c5;
+      continue;
+    }
+    if (inQuote && c5 === quoteChar) {
+      inQuote = false;
+      current2 += c5;
+      continue;
+    }
+    if (!inQuote) {
+      if (c5 === "&" && next === "&" || c5 === "|" && next === "|") {
+        if (current2.trim()) parts.push(current2.trim());
+        current2 = "";
+        i5++;
+        continue;
+      }
+      if (c5 === "|" || c5 === ";") {
+        if (current2.trim()) parts.push(current2.trim());
+        current2 = "";
+        continue;
+      }
+    }
+    current2 += c5;
+  }
+  if (current2.trim()) parts.push(current2.trim());
+  return parts;
+}
+function checkSingleCommandInteractive(command) {
+  let effective = command.trim();
+  while (/^\w+=\S*\s/.test(effective)) {
+    effective = effective.replace(/^\w+=\S*\s+/, "");
+  }
+  const parts = effective.split(/\s+/);
+  const base2 = parts[0];
+  const args = parts.slice(1);
+  if (["vi", "vim", "nvim", "nano", "emacs", "pico", "joe", "mcedit"].includes(base2)) {
+    return `'${base2}' is an interactive editor and cannot run without a terminal. Use non-interactive file manipulation commands instead.`;
+  }
+  if (["less", "more"].includes(base2)) {
+    return `'${base2}' is an interactive pager. Use 'cat', 'head', or 'tail' instead.`;
+  }
+  if (base2 === "git") {
+    const sub = args[0];
+    if (sub === "commit") {
+      const hasNonInteractiveFlag = args.some(
+        (a5) => a5 === "-m" || a5.startsWith("--message") || a5 === "-C" || a5 === "-c" || a5.startsWith("--fixup") || a5.startsWith("--squash") || a5 === "--allow-empty-message" || a5 === "--no-edit"
+      );
+      if (!hasNonInteractiveFlag) {
+        return `Interactive command: 'git commit' opens an editor for the commit message. Use 'git commit -m "your message"' instead.`;
+      }
+    }
+    if (sub === "rebase" && (args.includes("--continue") || args.includes("--skip"))) {
+      return "Interactive command: 'git rebase --continue' opens an editor. Set environment variable GIT_EDITOR=true to accept default messages, e.g. pass env: {GIT_EDITOR: 'true'} or prepend GIT_EDITOR=true to the command.";
+    }
+    if (sub === "rebase" && (args.includes("-i") || args.includes("--interactive"))) {
+      return "Interactive command: 'git rebase -i' requires an interactive editor. Interactive rebase cannot run without a terminal.";
+    }
+    if (sub === "merge" && !args.includes("--no-edit") && !args.includes("--no-commit") && !args.includes("--ff-only")) {
+      return "Interactive command: 'git merge' may open an editor for the merge commit message. Add '--no-edit' to accept the default message.";
+    }
+    if (sub === "cherry-pick" && !args.includes("--no-edit")) {
+      return "Interactive command: 'git cherry-pick' may open an editor. Add '--no-edit' to accept the default message.";
+    }
+    if (sub === "revert" && !args.includes("--no-edit")) {
+      return "Interactive command: 'git revert' opens an editor. Add '--no-edit' to accept the default message.";
+    }
+    if (sub === "tag" && args.includes("-a") && !args.some((a5) => a5 === "-m" || a5.startsWith("--message"))) {
+      return `Interactive command: 'git tag -a' opens an editor for the tag message. Use 'git tag -a <name> -m "message"' instead.`;
+    }
+    if (sub === "add" && (args.includes("-i") || args.includes("--interactive") || args.includes("-p") || args.includes("--patch"))) {
+      return "Interactive command: 'git add -i/-p' requires interactive input. Use 'git add <files>' to stage specific files instead.";
+    }
+  }
+  if (["python", "python3", "node", "irb", "ghci", "lua", "R", "ruby"].includes(base2) && args.length === 0) {
+    return `Interactive command: '${base2}' without arguments starts an interactive REPL. Provide a script file or use '-c'/'--eval' for inline code.`;
+  }
+  if (base2 === "mysql" && !args.some((a5) => a5 === "-e" || a5.startsWith("--execute"))) {
+    return `Interactive command: 'mysql' without -e flag starts an interactive session. Use 'mysql -e "SQL QUERY"' instead.`;
+  }
+  if (base2 === "psql" && !args.some((a5) => a5 === "-c" || a5.startsWith("--command") || a5 === "-f" || a5.startsWith("--file"))) {
+    return `Interactive command: 'psql' without -c flag starts an interactive session. Use 'psql -c "SQL QUERY"' instead.`;
+  }
+  if (["top", "htop", "btop", "nmon"].includes(base2)) {
+    return `Interactive command: '${base2}' is an interactive TUI tool. Use 'ps aux' or 'top -b -n 1' for non-interactive process listing.`;
+  }
+  return null;
+}
+function checkInteractiveCommand(command) {
+  if (!command || typeof command !== "string") return null;
+  const components = splitCommandComponents(command.trim());
+  for (const component of components) {
+    const result = checkSingleCommandInteractive(component);
+    if (result) return result;
+  }
+  return null;
+}
 async function executeBashCommand(command, options = {}) {
   const {
     workingDirectory = process.cwd(),
@@ -352329,6 +351213,24 @@ async function executeBashCommand(command, options = {}) {
     };
   }
   const startTime = Date.now();
+  const interactiveError = checkInteractiveCommand(command);
+  if (interactiveError) {
+    if (debug) {
+      console.log(`[BashExecutor] Blocked interactive command: "${command}"`);
+      console.log(`[BashExecutor] Reason: ${interactiveError}`);
+    }
+    return {
+      success: false,
+      error: interactiveError,
+      stdout: "",
+      stderr: interactiveError,
+      exitCode: 1,
+      command,
+      workingDirectory: cwd,
+      duration: 0,
+      interactive: true
+    };
+  }
   if (debug) {
     console.log(`[BashExecutor] Executing command: "${command}"`);
     console.log(`[BashExecutor] Working directory: "${cwd}"`);
@@ -352339,6 +351241,8 @@ async function executeBashCommand(command, options = {}) {
       ...process.env,
       ...env
     };
+    if (!processEnv.GIT_EDITOR) processEnv.GIT_EDITOR = "true";
+    if (!processEnv.GIT_TERMINAL_PROMPT) processEnv.GIT_TERMINAL_PROMPT = "0";
     const isComplex = isComplexCommand(command);
     let cmd, cmdArgs, useShell;
     if (isComplex) {
@@ -352373,20 +351277,32 @@ async function executeBashCommand(command, options = {}) {
       // stdin ignored, capture stdout/stderr
       shell: useShell,
       // false for security
+      detached: true,
+      // new session — no controlling terminal
       windowsHide: true
     });
     let stdout = "";
     let stderr = "";
     let killed = false;
     let timeoutHandle;
+    const killProcessGroup = (signal) => {
+      try {
+        if (child.pid) process.kill(-child.pid, signal);
+      } catch {
+        try {
+          child.kill(signal);
+        } catch {
+        }
+      }
+    };
     if (timeout > 0) {
       timeoutHandle = setTimeout(() => {
         if (!killed) {
           killed = true;
-          child.kill("SIGTERM");
+          killProcessGroup("SIGTERM");
           setTimeout(() => {
             if (child.exitCode === null) {
-              child.kill("SIGKILL");
+              killProcessGroup("SIGKILL");
             }
           }, 5e3);
         }
@@ -352399,7 +351315,7 @@ async function executeBashCommand(command, options = {}) {
       } else {
         if (!killed) {
           killed = true;
-          child.kill("SIGTERM");
+          killProcessGroup("SIGTERM");
         }
       }
     });
@@ -352410,7 +351326,7 @@ async function executeBashCommand(command, options = {}) {
       } else {
         if (!killed) {
           killed = true;
-          child.kill("SIGTERM");
+          killProcessGroup("SIGTERM");
         }
       }
     });
@@ -396950,7 +395866,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"100":"Continue","101":"Switching Pro
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.42","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc262","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@probelabs/visor","version":"0.1.148","main":"dist/index.js","bin":{"visor":"./dist/index.js"},"exports":{".":{"require":"./dist/index.js","import":"./dist/index.js"},"./sdk":{"types":"./dist/sdk/sdk.d.ts","import":"./dist/sdk/sdk.mjs","require":"./dist/sdk/sdk.js"},"./cli":{"require":"./dist/index.js"}},"files":["dist/","defaults/","action.yml","README.md","LICENSE"],"publishConfig":{"access":"public","registry":"https://registry.npmjs.org/"},"scripts":{"build:cli":"ncc build src/index.ts -o dist && cp -r defaults dist/ && cp -r output dist/ && cp -r docs dist/ && cp -r examples dist/ && cp -r src/debug-visualizer/ui dist/debug-visualizer/ && node scripts/inject-version.js && echo \'#!/usr/bin/env node\' | cat - dist/index.js > temp && mv temp dist/index.js && chmod +x dist/index.js","build:sdk":"tsup src/sdk.ts --dts --sourcemap --format esm,cjs --out-dir dist/sdk","build":"./scripts/build-oss.sh","build:ee":"npm run build:cli && npm run build:sdk","test":"jest && npm run test:yaml","test:unit":"jest","prepublishOnly":"npm run build","test:watch":"jest --watch","test:coverage":"jest --coverage","test:ee":"jest --testPathPatterns=\'tests/ee\' --testPathIgnorePatterns=\'/node_modules/\' --no-coverage","test:manual:bash":"RUN_MANUAL_TESTS=true jest tests/manual/bash-config-manual.test.ts","lint":"eslint src tests --ext .ts","lint:fix":"eslint src tests --ext .ts --fix","format":"prettier --write src tests","format:check":"prettier --check src tests","clean":"","clean:traces":"node scripts/clean-traces.js","prebuild":"npm run clean && node scripts/generate-config-schema.js","pretest":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","pretest:unit":"npm run clean:traces && node scripts/generate-config-schema.js && npm run build:cli","test:with-build":"npm run build:cli && jest","test:yaml":"node dist/index.js test --progress compact","test:yaml:parallel":"node dist/index.js test --progress compact --max-parallel 4","prepare":"husky","pre-commit":"lint-staged","deploy:site":"cd site && npx wrangler pages deploy . --project-name=visor-site --commit-dirty=true","deploy:worker":"npx wrangler deploy","deploy":"npm run deploy:site && npm run deploy:worker","publish:ee":"./scripts/publish-ee.sh","release":"./scripts/release.sh","release:patch":"./scripts/release.sh patch","release:minor":"./scripts/release.sh minor","release:major":"./scripts/release.sh major","release:prerelease":"./scripts/release.sh prerelease","docs:validate":"node scripts/validate-readme-links.js","workshop:setup":"npm install -D reveal-md@6.1.2","workshop:serve":"cd workshop && reveal-md slides.md -w","workshop:export":"reveal-md workshop/slides.md --static workshop/build","workshop:pdf":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter","workshop:pdf:ci":"reveal-md workshop/slides.md --print workshop/Visor-Workshop.pdf --print-size letter --puppeteer-launch-args=\\"--no-sandbox --disable-dev-shm-usage\\"","workshop:pdf:a4":"reveal-md workshop/slides.md --print workshop/Visor-Workshop-A4.pdf --print-size A4","workshop:build":"npm run workshop:export && npm run workshop:pdf","simulate:issue":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issues --action opened --debug","simulate:comment":"TS_NODE_TRANSPILE_ONLY=1 ts-node scripts/simulate-gh-run.ts --event issue_comment --action created --debug"},"keywords":["code-review","ai","github-action","cli","pr-review","visor"],"author":"Probe Labs","license":"MIT","description":"AI workflow engine for code review, assistants, and automation — orchestrate checks, MCP tools, and AI providers with YAML-driven pipelines","repository":{"type":"git","url":"git+https://github.com/probelabs/visor.git"},"bugs":{"url":"https://github.com/probelabs/visor/issues"},"homepage":"https://github.com/probelabs/visor#readme","dependencies":{"@actions/core":"^1.11.1","@apidevtools/swagger-parser":"^12.1.0","@modelcontextprotocol/sdk":"^1.25.3","@nyariv/sandboxjs":"github:probelabs/SandboxJS#f1c13b8eee98734a8ea024061eada4aa9a9ff2e9","@octokit/action":"^8.0.2","@octokit/auth-app":"^8.1.0","@octokit/core":"^7.0.3","@octokit/rest":"^22.0.0","@opentelemetry/api":"^1.9.0","@opentelemetry/core":"^1.30.1","@opentelemetry/exporter-trace-otlp-grpc":"^0.203.0","@opentelemetry/exporter-trace-otlp-http":"^0.203.0","@opentelemetry/instrumentation":"^0.203.0","@opentelemetry/resources":"^1.30.1","@opentelemetry/sdk-metrics":"^1.30.1","@opentelemetry/sdk-node":"^0.203.0","@opentelemetry/sdk-trace-base":"^1.30.1","@opentelemetry/semantic-conventions":"^1.30.1","@probelabs/probe":"^0.6.0-rc264","@types/commander":"^2.12.0","@types/uuid":"^10.0.0","acorn":"^8.16.0","acorn-walk":"^8.3.5","ajv":"^8.17.1","ajv-formats":"^3.0.1","better-sqlite3":"^11.0.0","blessed":"^0.1.81","cli-table3":"^0.6.5","commander":"^14.0.0","deepmerge":"^4.3.1","dotenv":"^17.2.3","ignore":"^7.0.5","js-yaml":"^4.1.0","jsonpath-plus":"^10.4.0","liquidjs":"^10.21.1","minimatch":"^10.2.2","node-cron":"^3.0.3","open":"^9.1.0","simple-git":"^3.28.0","uuid":"^11.1.0","ws":"^8.18.3"},"optionalDependencies":{"@anthropic/claude-code-sdk":"npm:null@*","@open-policy-agent/opa-wasm":"^1.10.0","knex":"^3.1.0","mysql2":"^3.11.0","pg":"^8.13.0","tedious":"^19.0.0"},"devDependencies":{"@eslint/js":"^9.34.0","@kie/act-js":"^2.6.2","@kie/mock-github":"^2.0.1","@swc/core":"^1.13.2","@swc/jest":"^0.2.37","@types/better-sqlite3":"^7.6.0","@types/blessed":"^0.1.27","@types/jest":"^30.0.0","@types/js-yaml":"^4.0.9","@types/node":"^24.3.0","@types/node-cron":"^3.0.11","@types/ws":"^8.18.1","@typescript-eslint/eslint-plugin":"^8.42.0","@typescript-eslint/parser":"^8.42.0","@vercel/ncc":"^0.38.4","eslint":"^9.34.0","eslint-config-prettier":"^10.1.8","eslint-plugin-prettier":"^5.5.4","husky":"^9.1.7","jest":"^30.1.3","lint-staged":"^16.1.6","prettier":"^3.6.2","reveal-md":"^6.1.2","ts-json-schema-generator":"^1.5.1","ts-node":"^10.9.2","tsup":"^8.5.0","typescript":"^5.9.2","wrangler":"^3.0.0"},"peerDependenciesMeta":{"@anthropic/claude-code-sdk":{"optional":true}},"directories":{"test":"tests"},"lint-staged":{"src/**/*.{ts,js}":["eslint --fix","prettier --write"],"tests/**/*.{ts,js}":["eslint --fix","prettier --write"],"*.{json,md,yml,yaml}":["prettier --write"]}}');
 
 /***/ })