@probelabs/visor 0.1.187 → 0.1.188-ee

package/dist/sdk/{track-execution-CFRZXMEC.mjs → track-execution-VJJVJH6K.mjs}

@@ -16,7 +16,7 @@ import {
   getInstanceId,
   init_instance_id,
   require_package
-} from "./chunk-B2LQT6QU.mjs";
+} from "./chunk-6LQEODDA.mjs";
 import {
   init_logger,
   logger
@@ -317,4 +317,4 @@ init_track_execution();
 export {
   trackExecution
 };
-//# sourceMappingURL=track-execution-CFRZXMEC.mjs.map
+//# sourceMappingURL=track-execution-VJJVJH6K.mjs.map

package/dist/sdk/utcp-check-provider-Q4PD5EP2.mjs

@@ -0,0 +1,16 @@
+import {
+  UtcpCheckProvider,
+  init_utcp_check_provider
+} from "./chunk-TSX3YS3F.mjs";
+import "./chunk-4HIWZA6M.mjs";
+import "./chunk-25IC7KXZ.mjs";
+import "./chunk-LW3INISN.mjs";
+import "./chunk-4MHHELVZ.mjs";
+import "./chunk-6E625R3C.mjs";
+import "./chunk-B2OUZAWY.mjs";
+import "./chunk-J7LXIPZS.mjs";
+init_utcp_check_provider();
+export {
+  UtcpCheckProvider
+};
+//# sourceMappingURL=utcp-check-provider-Q4PD5EP2.mjs.map

package/dist/sdk/utcp-check-provider-Q4PD5EP2.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sdk/validator-XTZJZZJH.mjs

@@ -0,0 +1,134 @@
+import {
+  __esm
+} from "./chunk-J7LXIPZS.mjs";
+
+// src/enterprise/license/validator.ts
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as path from "path";
+var LicenseValidator;
+var init_validator = __esm({
+  "src/enterprise/license/validator.ts"() {
+    LicenseValidator = class _LicenseValidator {
+      /** Ed25519 public key for license verification (PEM format). */
+      static PUBLIC_KEY = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAI/Zd08EFmgIdrDm/HXd0l3/5GBt7R1PrdvhdmEXhJlU=\n-----END PUBLIC KEY-----\n";
+      cache = null;
+      static CACHE_TTL = 5 * 60 * 1e3;
+      // 5 minutes
+      static GRACE_PERIOD = 72 * 3600 * 1e3;
+      // 72 hours after expiry
+      /**
+       * Load and validate license from environment or file.
+       *
+       * Resolution order:
+       * 1. VISOR_LICENSE env var (JWT string)
+       * 2. VISOR_LICENSE_FILE env var (path to file)
+       * 3. .visor-license in project root (cwd)
+       * 4. .visor-license in ~/.config/visor/
+       */
+      async loadAndValidate() {
+        if (this.cache && Date.now() - this.cache.validatedAt < _LicenseValidator.CACHE_TTL) {
+          return this.cache.payload;
+        }
+        const token = this.resolveToken();
+        if (!token) return null;
+        const payload = this.verifyAndDecode(token);
+        if (!payload) return null;
+        this.cache = { payload, validatedAt: Date.now() };
+        return payload;
+      }
+      /** Check if a specific feature is licensed */
+      hasFeature(feature) {
+        if (!this.cache) return false;
+        return this.cache.payload.features.includes(feature);
+      }
+      /** Check if license is valid (with grace period) */
+      isValid() {
+        if (!this.cache) return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1e3;
+        return now < expiryMs + _LicenseValidator.GRACE_PERIOD;
+      }
+      /** Check if the license is within its grace period (expired but still valid) */
+      isInGracePeriod() {
+        if (!this.cache) return false;
+        const now = Date.now();
+        const expiryMs = this.cache.payload.exp * 1e3;
+        return now >= expiryMs && now < expiryMs + _LicenseValidator.GRACE_PERIOD;
+      }
+      resolveToken() {
+        if (process.env.VISOR_LICENSE) {
+          return process.env.VISOR_LICENSE.trim();
+        }
+        if (process.env.VISOR_LICENSE_FILE) {
+          const resolved = path.resolve(process.env.VISOR_LICENSE_FILE);
+          const home2 = process.env.HOME || process.env.USERPROFILE || "";
+          const allowedPrefixes = [path.normalize(process.cwd())];
+          if (home2) allowedPrefixes.push(path.normalize(path.join(home2, ".config", "visor")));
+          let realPath;
+          try {
+            realPath = fs.realpathSync(resolved);
+          } catch {
+            return null;
+          }
+          const isSafe = allowedPrefixes.some(
+            (prefix) => realPath === prefix || realPath.startsWith(prefix + path.sep)
+          );
+          if (!isSafe) return null;
+          return this.readFile(realPath);
+        }
+        const cwdPath = path.join(process.cwd(), ".visor-license");
+        const cwdToken = this.readFile(cwdPath);
+        if (cwdToken) return cwdToken;
+        const home = process.env.HOME || process.env.USERPROFILE || "";
+        if (home) {
+          const configPath = path.join(home, ".config", "visor", ".visor-license");
+          const configToken = this.readFile(configPath);
+          if (configToken) return configToken;
+        }
+        return null;
+      }
+      readFile(filePath) {
+        try {
+          return fs.readFileSync(filePath, "utf-8").trim();
+        } catch {
+          return null;
+        }
+      }
+      verifyAndDecode(token) {
+        try {
+          const parts = token.split(".");
+          if (parts.length !== 3) return null;
+          const [headerB64, payloadB64, signatureB64] = parts;
+          const header = JSON.parse(Buffer.from(headerB64, "base64url").toString());
+          if (header.alg !== "EdDSA") return null;
+          const data = `${headerB64}.${payloadB64}`;
+          const signature = Buffer.from(signatureB64, "base64url");
+          const publicKey = crypto.createPublicKey(_LicenseValidator.PUBLIC_KEY);
+          if (publicKey.asymmetricKeyType !== "ed25519") {
+            return null;
+          }
+          const isValid = crypto.verify(null, Buffer.from(data), publicKey, signature);
+          if (!isValid) return null;
+          const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+          if (!payload.org || !Array.isArray(payload.features) || typeof payload.exp !== "number" || typeof payload.iat !== "number" || !payload.sub) {
+            return null;
+          }
+          const now = Date.now();
+          const expiryMs = payload.exp * 1e3;
+          if (now >= expiryMs + _LicenseValidator.GRACE_PERIOD) {
+            return null;
+          }
+          return payload;
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+});
+init_validator();
+export {
+  LicenseValidator
+};
+//# sourceMappingURL=validator-XTZJZZJH.mjs.map

package/dist/sdk/validator-XTZJZZJH.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/enterprise/license/validator.ts"],"sourcesContent":["/**\n * Copyright (c) ProbeLabs. All rights reserved.\n * Licensed under the Elastic License 2.0; you may not use this file except\n * in compliance with the Elastic License 2.0.\n */\n\nimport * as crypto from 'crypto';\nimport * as fs from 'fs';\nimport * as path from 'path';\n\nexport interface LicensePayload {\n  org: string;\n  features: string[];\n  exp: number;\n  iat: number;\n  sub: string;\n}\n\nexport class LicenseValidator {\n  /** Ed25519 public key for license verification (PEM format). */\n  private static PUBLIC_KEY =\n    '-----BEGIN PUBLIC KEY-----\\n' +\n    'MCowBQYDK2VwAyEAI/Zd08EFmgIdrDm/HXd0l3/5GBt7R1PrdvhdmEXhJlU=\\n' +\n    '-----END PUBLIC KEY-----\\n';\n\n  private cache: { payload: LicensePayload; validatedAt: number } | null = null;\n  private static CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n  private static GRACE_PERIOD = 72 * 3600 * 1000; // 72 hours after expiry\n\n  /**\n   * Load and validate license from environment or file.\n   *\n   * Resolution order:\n   * 1. VISOR_LICENSE env var (JWT string)\n   * 2. VISOR_LICENSE_FILE env var (path to file)\n   * 3. .visor-license in project root (cwd)\n   * 4. .visor-license in ~/.config/visor/\n   */\n  async loadAndValidate(): Promise<LicensePayload | null> {\n    // Return cached result if still fresh\n    if (this.cache && Date.now() - this.cache.validatedAt < LicenseValidator.CACHE_TTL) {\n      return this.cache.payload;\n    }\n\n    const token = this.resolveToken();\n    if (!token) return null;\n\n    const payload = this.verifyAndDecode(token);\n    if (!payload) return null;\n\n    this.cache = { payload, validatedAt: Date.now() };\n    return payload;\n  }\n\n  /** Check if a specific feature is licensed */\n  hasFeature(feature: string): boolean {\n    if (!this.cache) return false;\n    return this.cache.payload.features.includes(feature);\n  }\n\n  /** Check if license is valid (with grace period) */\n  isValid(): boolean {\n    if (!this.cache) return false;\n    const now = Date.now();\n    const expiryMs = this.cache.payload.exp * 1000;\n    return now < expiryMs + LicenseValidator.GRACE_PERIOD;\n  }\n\n  /** Check if the license is within its grace period (expired but still valid) */\n  isInGracePeriod(): boolean {\n    if (!this.cache) return false;\n    const now = Date.now();\n    const expiryMs = this.cache.payload.exp * 1000;\n    return now >= expiryMs && now < expiryMs + LicenseValidator.GRACE_PERIOD;\n  }\n\n  private resolveToken(): string | null {\n    // 1. Direct env var\n    if (process.env.VISOR_LICENSE) {\n      return process.env.VISOR_LICENSE.trim();\n    }\n\n    // 2. File path from env (validate against path traversal)\n    if (process.env.VISOR_LICENSE_FILE) {\n      // path.resolve() produces an absolute path with all '..' segments resolved,\n      // so a separate resolved.includes('..') check is unnecessary.\n      const resolved = path.resolve(process.env.VISOR_LICENSE_FILE);\n      const home = process.env.HOME || process.env.USERPROFILE || '';\n      const allowedPrefixes = [path.normalize(process.cwd())];\n      if (home) allowedPrefixes.push(path.normalize(path.join(home, '.config', 'visor')));\n\n      // Resolve symlinks so an attacker cannot create a symlink inside an\n      // allowed prefix that points to an arbitrary file outside it.\n      let realPath: string;\n      try {\n        realPath = fs.realpathSync(resolved);\n      } catch {\n        return null; // File doesn't exist or isn't accessible\n      }\n\n      const isSafe = allowedPrefixes.some(\n        prefix => realPath === prefix || realPath.startsWith(prefix + path.sep)\n      );\n      if (!isSafe) return null;\n      return this.readFile(realPath);\n    }\n\n    // 3. .visor-license in cwd\n    const cwdPath = path.join(process.cwd(), '.visor-license');\n    const cwdToken = this.readFile(cwdPath);\n    if (cwdToken) return cwdToken;\n\n    // 4. ~/.config/visor/.visor-license\n    const home = process.env.HOME || process.env.USERPROFILE || '';\n    if (home) {\n      const configPath = path.join(home, '.config', 'visor', '.visor-license');\n      const configToken = this.readFile(configPath);\n      if (configToken) return configToken;\n    }\n\n    return null;\n  }\n\n  private readFile(filePath: string): string | null {\n    try {\n      return fs.readFileSync(filePath, 'utf-8').trim();\n    } catch {\n      return null;\n    }\n  }\n\n  private verifyAndDecode(token: string): LicensePayload | null {\n    try {\n      const parts = token.split('.');\n      if (parts.length !== 3) return null;\n\n      const [headerB64, payloadB64, signatureB64] = parts;\n\n      // Decode header to verify algorithm\n      const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString());\n      if (header.alg !== 'EdDSA') return null;\n\n      // Verify signature\n      const data = `${headerB64}.${payloadB64}`;\n      const signature = Buffer.from(signatureB64, 'base64url');\n\n      const publicKey = crypto.createPublicKey(LicenseValidator.PUBLIC_KEY);\n\n      // Validate that the loaded public key is actually Ed25519 (OID 1.3.101.112).\n      // This prevents algorithm-confusion attacks if the embedded key were ever\n      // swapped to a different type.\n      if (publicKey.asymmetricKeyType !== 'ed25519') {\n        return null;\n      }\n\n      // Ed25519 verification: algorithm must be null because EdDSA performs its\n      // own internal hashing (SHA-512) — passing a digest algorithm here would\n      // cause Node.js to throw. The key type is validated above.\n      const isValid = crypto.verify(null, Buffer.from(data), publicKey, signature);\n      if (!isValid) return null;\n\n      // Decode payload\n      const payload: LicensePayload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());\n\n      // Validate required fields\n      if (\n        !payload.org ||\n        !Array.isArray(payload.features) ||\n        typeof payload.exp !== 'number' ||\n        typeof payload.iat !== 'number' ||\n        !payload.sub\n      ) {\n        return null;\n      }\n\n      // Check expiry (with grace period)\n      const now = Date.now();\n      const expiryMs = payload.exp * 1000;\n      if (now >= expiryMs + LicenseValidator.GRACE_PERIOD) {\n        return null;\n      }\n\n      return payload;\n    } catch {\n      return null;\n    }\n  }\n}\n"],"mappings":";;;;;AAMA,YAAY,YAAY;AACxB,YAAY,QAAQ;AACpB,YAAY,UAAU;AARtB,IAkBa;AAlBb;AAAA;AAkBO,IAAM,mBAAN,MAAM,kBAAiB;AAAA;AAAA,MAE5B,OAAe,aACb;AAAA,MAIM,QAAiE;AAAA,MACzE,OAAe,YAAY,IAAI,KAAK;AAAA;AAAA,MACpC,OAAe,eAAe,KAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAW1C,MAAM,kBAAkD;AAEtD,YAAI,KAAK,SAAS,KAAK,IAAI,IAAI,KAAK,MAAM,cAAc,kBAAiB,WAAW;AAClF,iBAAO,KAAK,MAAM;AAAA,QACpB;AAEA,cAAM,QAAQ,KAAK,aAAa;AAChC,YAAI,CAAC,MAAO,QAAO;AAEnB,cAAM,UAAU,KAAK,gBAAgB,KAAK;AAC1C,YAAI,CAAC,QAAS,QAAO;AAErB,aAAK,QAAQ,EAAE,SAAS,aAAa,KAAK,IAAI,EAAE;AAChD,eAAO;AAAA,MACT;AAAA;AAAA,MAGA,WAAW,SAA0B;AACnC,YAAI,CAAC,KAAK,MAAO,QAAO;AACxB,eAAO,KAAK,MAAM,QAAQ,SAAS,SAAS,OAAO;AAAA,MACrD;AAAA;AAAA,MAGA,UAAmB;AACjB,YAAI,CAAC,KAAK,MAAO,QAAO;AACxB,cAAM,MAAM,KAAK,IAAI;AACrB,cAAM,WAAW,KAAK,MAAM,QAAQ,MAAM;AAC1C,eAAO,MAAM,WAAW,kBAAiB;AAAA,MAC3C;AAAA;AAAA,MAGA,kBAA2B;AACzB,YAAI,CAAC,KAAK,MAAO,QAAO;AACxB,cAAM,MAAM,KAAK,IAAI;AACrB,cAAM,WAAW,KAAK,MAAM,QAAQ,MAAM;AAC1C,eAAO,OAAO,YAAY,MAAM,WAAW,kBAAiB;AAAA,MAC9D;AAAA,MAEQ,eAA8B;AAEpC,YAAI,QAAQ,IAAI,eAAe;AAC7B,iBAAO,QAAQ,IAAI,cAAc,KAAK;AAAA,QACxC;AAGA,YAAI,QAAQ,IAAI,oBAAoB;AAGlC,gBAAM,WAAgB,aAAQ,QAAQ,IAAI,kBAAkB;AAC5D,gBAAMA,QAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,gBAAM,kBAAkB,CAAM,eAAU,QAAQ,IAAI,CAAC,CAAC;AACtD,cAAIA,MAAM,iBAAgB,KAAU,eAAe,UAAKA,OAAM,WAAW,OAAO,CAAC,CAAC;AAIlF,cAAI;AACJ,cAAI;AACF,uBAAc,gBAAa,QAAQ;AAAA,UACrC,QAAQ;AACN,mBAAO;AAAA,UACT;AAEA,gBAAM,SAAS,gBAAgB;AAAA,YAC7B,YAAU,aAAa,UAAU,SAAS,WAAW,SAAc,QAAG;AAAA,UACxE;AACA,cAAI,CAAC,OAAQ,QAAO;AACpB,iBAAO,KAAK,SAAS,QAAQ;AAAA,QAC/B;AAGA,cAAM,UAAe,UAAK,QAAQ,IAAI,GAAG,gBAAgB;AACzD,cAAM,WAAW,KAAK,SAAS,OAAO;AACtC,YAAI,SAAU,QAAO;AAGrB,cAAM,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AAC5D,YAAI,MAAM;AACR,gBAAM,aAAkB,UAAK,MAAM,WAAW,SAAS,gBAAgB;AACvE,gBAAM,cAAc,KAAK,SAAS,UAAU;AAC5C,cAAI,YAAa,QAAO;AAAA,QAC1B;AAEA,eAAO;AAAA,MACT;AAAA,MAEQ,SAAS,UAAiC;AAChD,YAAI;AACF,iBAAU,gBAAa,UAAU,OAAO,EAAE,KAAK;AAAA,QACjD,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,MAEQ,gBAAgB,OAAsC;AAC5D,YAAI;AACF,gBAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,cAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,gBAAM,CAAC,WAAW,YAAY,YAAY,IAAI;AAG9C,gBAAM,SAAS,KAAK,MAAM,OAAO,KAAK,WAAW,WAAW,EAAE,SAAS,CAAC;AACxE,cAAI,OAAO,QAAQ,QAAS,QAAO;AAGnC,gBAAM,OAAO,GAAG,SAAS,IAAI,UAAU;AACvC,gBAAM,YAAY,OAAO,KAAK,cAAc,WAAW;AAEvD,gBAAM,YAAmB,uBAAgB,kBAAiB,UAAU;AAKpE,cAAI,UAAU,sBAAsB,WAAW;AAC7C,mBAAO;AAAA,UACT;AAKA,gBAAM,UAAiB,cAAO,MAAM,OAAO,KAAK,IAAI,GAAG,WAAW,SAAS;AAC3E,cAAI,CAAC,QAAS,QAAO;AAGrB,gBAAM,UAA0B,KAAK,MAAM,OAAO,KAAK,YAAY,WAAW,EAAE,SAAS,CAAC;AAG1F,cACE,CAAC,QAAQ,OACT,CAAC,MAAM,QAAQ,QAAQ,QAAQ,KAC/B,OAAO,QAAQ,QAAQ,YACvB,OAAO,QAAQ,QAAQ,YACvB,CAAC,QAAQ,KACT;AACA,mBAAO;AAAA,UACT;AAGA,gBAAM,MAAM,KAAK,IAAI;AACrB,gBAAM,WAAW,QAAQ,MAAM;AAC/B,cAAI,OAAO,WAAW,kBAAiB,cAAc;AACnD,mBAAO;AAAA,UACT;AAEA,iBAAO;AAAA,QACT,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA;AAAA;","names":["home"]}

package/dist/sdk/whatsapp-frontend-72XEIUIR.mjs

@@ -0,0 +1,438 @@
+import {
+  __esm
+} from "./chunk-J7LXIPZS.mjs";
+
+// src/whatsapp/markdown.ts
+function markdownToWhatsApp(text) {
+  if (!text || typeof text !== "string") return "";
+  const lines = text.split(/\r?\n/);
+  const result = [];
+  let inCodeBlock = false;
+  let codeLines = [];
+  for (let i = 0; i < lines.length; i++) {
+    const trimmed = lines[i].trimStart();
+    if (/^```/.test(trimmed)) {
+      if (!inCodeBlock) {
+        inCodeBlock = true;
+        codeLines = [];
+      } else {
+        result.push("```" + codeLines.join("\n") + "```");
+        inCodeBlock = false;
+        codeLines = [];
+      }
+      continue;
+    }
+    if (inCodeBlock) {
+      codeLines.push(lines[i]);
+      continue;
+    }
+    const line = lines[i];
+    const headerMatch = /^(#{1,6})\s+(.+)$/.exec(line.trimStart());
+    if (headerMatch) {
+      result.push(`*${convertInline(headerMatch[2].trim())}*`);
+      continue;
+    }
+    if (/^[-*_]{3,}\s*$/.test(trimmed)) {
+      result.push("---");
+      continue;
+    }
+    const bulletMatch = /^(\s*)([-*])\s+(.+)$/.exec(line);
+    if (bulletMatch) {
+      result.push(`${bulletMatch[1]}- ${convertInline(bulletMatch[3])}`);
+      continue;
+    }
+    const numMatch = /^(\s*)(\d+\.)\s+(.+)$/.exec(line);
+    if (numMatch) {
+      result.push(`${numMatch[1]}${numMatch[2]} ${convertInline(numMatch[3])}`);
+      continue;
+    }
+    const bqMatch = /^>\s?(.*)$/.exec(trimmed);
+    if (bqMatch) {
+      result.push(`> ${convertInline(bqMatch[1])}`);
+      continue;
+    }
+    result.push(convertInline(line));
+  }
+  if (inCodeBlock && codeLines.length > 0) {
+    result.push("```" + codeLines.join("\n") + "```");
+  }
+  return result.join("\n");
+}
+function convertInline(line) {
+  const codeSpans = [];
+  let processed = line.replace(/`([^`]+)`/g, (_m, code) => {
+    const idx = codeSpans.length;
+    codeSpans.push("```" + code + "```");
+    return `\0CODE${idx}\0`;
+  });
+  processed = processed.replace(
+    /!\[([^\]]*)\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g,
+    (_m, alt, url) => `${alt || "image"} (${url})`
+  );
+  processed = processed.replace(
+    /\[([^\]]+)\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g,
+    (_m, label, url) => `${label} (${url})`
+  );
+  const boldSpans = [];
+  processed = processed.replace(/\*\*([^*]+)\*\*/g, (_m, content) => {
+    const idx = boldSpans.length;
+    boldSpans.push(`*${content}*`);
+    return `\0BOLD${idx}\0`;
+  });
+  processed = processed.replace(/__([^_]+)__/g, (_m, content) => {
+    const idx = boldSpans.length;
+    boldSpans.push(`*${content}*`);
+    return `\0BOLD${idx}\0`;
+  });
+  processed = processed.replace(/(?<!\*)\*([^*]+)\*(?!\*)/g, "_$1_");
+  processed = processed.replace(/~~([^~]+)~~/g, "~$1~");
+  processed = processed.replace(
+    /\x00BOLD(\d+)\x00/g,
+    (_m, idx) => boldSpans[parseInt(idx)]
+  );
+  processed = processed.replace(
+    /\x00CODE(\d+)\x00/g,
+    (_m, idx) => codeSpans[parseInt(idx)]
+  );
+  return processed;
+}
+function chunkText(text, limit = 4096) {
+  if (text.length <= limit) return [text];
+  const chunks = [];
+  const lines = text.split("\n");
+  let current = "";
+  for (const line of lines) {
+    const candidate = current ? current + "\n" + line : line;
+    if (candidate.length > limit) {
+      if (current) {
+        chunks.push(current);
+        current = line;
+      } else {
+        let remaining = line;
+        while (remaining.length > limit) {
+          chunks.push(remaining.slice(0, limit));
+          remaining = remaining.slice(limit);
+        }
+        current = remaining;
+      }
+    } else {
+      current = candidate;
+    }
+  }
+  if (current) chunks.push(current);
+  return chunks;
+}
+function formatWhatsAppText(text) {
+  return markdownToWhatsApp(text);
+}
+var init_markdown = __esm({
+  "src/whatsapp/markdown.ts"() {
+    "use strict";
+  }
+});
+
+// src/whatsapp/client.ts
+import { createHmac } from "crypto";
+var WhatsAppClient;
+var init_client = __esm({
+  "src/whatsapp/client.ts"() {
+    "use strict";
+    init_markdown();
+    WhatsAppClient = class {
+      accessToken;
+      phoneNumberId;
+      appSecret;
+      verifyToken;
+      baseUrl;
+      constructor(opts) {
+        if (!opts.accessToken || typeof opts.accessToken !== "string") {
+          throw new Error("WhatsAppClient: accessToken is required");
+        }
+        if (!opts.phoneNumberId || typeof opts.phoneNumberId !== "string") {
+          throw new Error("WhatsAppClient: phoneNumberId is required");
+        }
+        this.accessToken = opts.accessToken;
+        this.phoneNumberId = opts.phoneNumberId;
+        this.appSecret = opts.appSecret;
+        this.verifyToken = opts.verifyToken;
+        const version = opts.apiVersion || "v21.0";
+        this.baseUrl = `https://graph.facebook.com/${version}/${this.phoneNumberId}`;
+      }
+      /** Get the Phone Number ID */
+      getPhoneNumberId() {
+        return this.phoneNumberId;
+      }
+      /**
+       * Send a text message. Auto-chunks at 4096 characters.
+       */
+      async sendMessage(opts) {
+        const chunks = chunkText(opts.text, 4096);
+        let lastResult = { ok: false, error: "No chunks to send" };
+        for (const chunk of chunks) {
+          const body = {
+            messaging_product: "whatsapp",
+            to: opts.to,
+            type: "text",
+            text: { body: chunk }
+          };
+          if (opts.replyToMessageId) {
+            body.context = { message_id: opts.replyToMessageId };
+          }
+          try {
+            const resp = await fetch(`${this.baseUrl}/messages`, {
+              method: "POST",
+              headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this.accessToken}`
+              },
+              body: JSON.stringify(body)
+            });
+            const data = await resp.json();
+            if (!resp.ok) {
+              const errMsg = data?.error?.message || `HTTP ${resp.status}`;
+              return { ok: false, error: errMsg };
+            }
+            const msgId = data?.messages?.[0]?.id;
+            lastResult = { ok: true, messageId: msgId };
+          } catch (err) {
+            return {
+              ok: false,
+              error: err instanceof Error ? err.message : String(err)
+            };
+          }
+        }
+        return lastResult;
+      }
+      /**
+       * Mark a message as read (send read receipt).
+       */
+      async markAsRead(messageId) {
+        try {
+          const resp = await fetch(`${this.baseUrl}/messages`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Authorization: `Bearer ${this.accessToken}`
+            },
+            body: JSON.stringify({
+              messaging_product: "whatsapp",
+              status: "read",
+              message_id: messageId
+            })
+          });
+          if (!resp.ok) {
+            const data = await resp.json();
+            return {
+              ok: false,
+              error: data?.error?.message || `HTTP ${resp.status}`
+            };
+          }
+          return { ok: true };
+        } catch (err) {
+          return {
+            ok: false,
+            error: err instanceof Error ? err.message : String(err)
+          };
+        }
+      }
+      /**
+       * Verify webhook signature (HMAC-SHA256 with X-Hub-Signature-256).
+       * Returns true if valid or if no appSecret is configured (skip verification).
+       */
+      verifyWebhookSignature(rawBody, signatureHeader) {
+        if (!this.appSecret) return true;
+        if (!signatureHeader) return false;
+        const expected = "sha256=" + createHmac("sha256", this.appSecret).update(rawBody).digest("hex");
+        return signatureHeader === expected;
+      }
+      /**
+       * Verify GET challenge-response for webhook subscription.
+       */
+      verifyChallenge(params) {
+        const mode = params["hub.mode"];
+        const token = params["hub.verify_token"];
+        const challenge = params["hub.challenge"];
+        if (mode === "subscribe" && token === this.verifyToken) {
+          return { ok: true, challenge };
+        }
+        return { ok: false };
+      }
+    };
+  }
+});
+
+// src/frontends/whatsapp-frontend.ts
+var WhatsAppFrontend;
+var init_whatsapp_frontend = __esm({
+  "src/frontends/whatsapp-frontend.ts"() {
+    init_client();
+    init_markdown();
+    WhatsAppFrontend = class {
+      name = "whatsapp";
+      subs = [];
+      cfg;
+      errorNotified = false;
+      constructor(config) {
+        this.cfg = config || {};
+      }
+      start(ctx) {
+        const bus = ctx.eventBus;
+        try {
+          ctx.logger.info(`[whatsapp-frontend] started`);
+        } catch {
+        }
+        this.subs.push(
+          bus.on("CheckCompleted", async (env) => {
+            const ev = env && env.payload || env;
+            await this.maybePostDirectReply(ctx, ev.checkId, ev.result).catch(() => {
+            });
+          })
+        );
+        this.subs.push(
+          bus.on("CheckErrored", async (env) => {
+            const ev = env && env.payload || env;
+            const message = ev?.error?.message || "Execution error";
+            await this.maybePostError(ctx, "Check failed", message, ev?.checkId).catch(() => {
+            });
+          })
+        );
+        this.subs.push(
+          bus.on("Shutdown", async (env) => {
+            const ev = env && env.payload || env;
+            const message = ev?.error?.message || "Fatal error";
+            await this.maybePostError(ctx, "Run failed", message).catch(() => {
+            });
+          })
+        );
+      }
+      stop() {
+        for (const s of this.subs) s.unsubscribe();
+        this.subs = [];
+      }
+      getWhatsApp(ctx) {
+        const injected = ctx.whatsapp || ctx.whatsappClient;
+        if (injected) return injected;
+        try {
+          const token = this.cfg.accessToken || process.env.WHATSAPP_ACCESS_TOKEN;
+          const phoneId = this.cfg.phoneNumberId || process.env.WHATSAPP_PHONE_NUMBER_ID;
+          if (typeof token === "string" && token.trim() && typeof phoneId === "string" && phoneId.trim()) {
+            return new WhatsAppClient({
+              accessToken: token.trim(),
+              phoneNumberId: phoneId.trim()
+            });
+          }
+        } catch {
+        }
+        return void 0;
+      }
+      getInboundWhatsAppPayload(ctx) {
+        try {
+          const endpoint = "/bots/whatsapp/message";
+          return ctx.webhookContext?.webhookData?.get(endpoint) || null;
+        } catch {
+          return null;
+        }
+      }
+      async maybePostError(ctx, title, message, checkId) {
+        if (this.errorNotified) return;
+        const whatsapp = this.getWhatsApp(ctx);
+        if (!whatsapp) return;
+        const payload = this.getInboundWhatsAppPayload(ctx);
+        const ev = payload?.event;
+        const from = ev?.from;
+        if (!from) return;
+        let text = `${title}`;
+        if (checkId) text += `
+Check: ${checkId}`;
+        if (message) text += `
+${message}`;
+        await whatsapp.sendMessage({
+          to: from,
+          text,
+          replyToMessageId: ev?.message_id
+        });
+        this.errorNotified = true;
+      }
+      async maybePostDirectReply(ctx, checkId, result) {
+        try {
+          const cfg = ctx.config || {};
+          const checkCfg = cfg.checks?.[checkId];
+          if (!checkCfg) return;
+          const providerType = checkCfg.type || "";
+          const isAi = providerType === "ai";
+          const isLogChat = providerType === "log" && checkCfg.group === "chat";
+          const isWorkflow = providerType === "workflow";
+          if (!isAi && !isLogChat && !isWorkflow) return;
+          if (checkCfg.criticality === "internal") return;
+          if (isAi) {
+            const schema = checkCfg.schema;
+            if (typeof schema === "string") {
+              const simpleSchemas = ["code-review", "markdown", "text", "plain"];
+              if (!simpleSchemas.includes(schema)) return;
+            }
+          }
+          const whatsapp = this.getWhatsApp(ctx);
+          if (!whatsapp) return;
+          const payload = this.getInboundWhatsAppPayload(ctx);
+          const ev = payload?.event;
+          const from = ev?.from;
+          if (!from) {
+            ctx.logger.warn(
+              `[whatsapp-frontend] skip posting reply for ${checkId}: missing from number`
+            );
+            return;
+          }
+          const out = result?.output;
+          let text;
+          if (out && typeof out.text === "string" && out.text.trim().length > 0) {
+            text = out.text.trim();
+          } else if (isAi && typeof checkCfg.schema === "string") {
+            if (typeof result?.content === "string" && result.content.trim().length > 0) {
+              text = result.content.trim();
+            }
+          } else if (isLogChat && typeof result?.logOutput === "string") {
+            const raw = result.logOutput;
+            if (raw.trim().length > 0) text = raw.trim();
+          }
+          if (out && typeof out._rawOutput === "string" && out._rawOutput.trim().length > 0) {
+            text = (text || "") + "\n\n" + out._rawOutput.trim();
+          }
+          if (!text) {
+            ctx.logger.info(
+              `[whatsapp-frontend] skip posting reply for ${checkId}: no renderable text`
+            );
+            return;
+          }
+          text = text.replace(/\\n/g, "\n");
+          const formattedText = formatWhatsAppText(text);
+          const postResult = await whatsapp.sendMessage({
+            to: from,
+            text: formattedText,
+            replyToMessageId: ev?.message_id
+          });
+          if (!postResult.ok) {
+            ctx.logger.warn(
+              `[whatsapp-frontend] failed to post reply for ${checkId}: ${postResult.error}`
+            );
+            return;
+          }
+          ctx.logger.info(
+            `[whatsapp-frontend] posted reply for ${checkId} to ${from} (messageId=${postResult.messageId})`
+          );
+        } catch (err) {
+          try {
+            ctx.logger.warn(
+              `[whatsapp-frontend] maybePostDirectReply failed for ${checkId}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          } catch {
+          }
+        }
+      }
+    };
+  }
+});
+init_whatsapp_frontend();
+export {
+  WhatsAppFrontend
+};
+//# sourceMappingURL=whatsapp-frontend-72XEIUIR.mjs.map