@runa-ai/runa-cli 0.5.31 → 0.5.33

package/dist/commands/db/commands/db-rollback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-rollback.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoNpC;;GAEG;AACH,eAAO,MAAM,eAAe,SAoBxB,CAAC"}
+{"version":3,"file":"db-rollback.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-rollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsNpC;;GAEG;AACH,eAAO,MAAM,eAAe,SAoBxB,CAAC"}

package/dist/commands/db/commands/db-seed-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-seed-verify.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-seed-verify.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8EpC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,SA6C3B,CAAC"}
+{"version":3,"file":"db-seed-verify.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/commands/db-seed-verify.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgFpC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,SA6C3B,CAAC"}

package/dist/commands/db/utils/db-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-target.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/db-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAMH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;AAyBpE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,CAoDjE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAUhF"}
+{"version":3,"file":"db-target.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/db-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;AAyBpE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,CAqDjE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAUhF"}

package/dist/commands/db/utils/schema-detector.d.ts

@@ -23,8 +23,12 @@ export declare function detectAppSchemas(schemasDir: string, verbose: boolean):
  *
  * @param schemas Array of schema names
  * @returns Formatted string for SQL: "'public', 'accounts', 'repos'"
+ * @throws Error if any schema name fails validation
+ *
+ * SECURITY (Issue #535): Defense-in-depth for SQL injection prevention:
+ * 1. Validates each schema is a safe PostgreSQL identifier
+ * 2. Escapes single quotes (even though valid identifiers won't have them)
  *
- * Note: Escapes single quotes for SQL injection defense.
  * While schema names from detectAppSchemas() are already safe (regex \w+),
  * this provides defense-in-depth for future code paths.
  */

package/dist/commands/db/utils/schema-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-detector.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-detector.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAsB3B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAoC/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAE7D"}
+{"version":3,"file":"schema-detector.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-detector.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;GAEG;AACH,eAAO,MAAM,gBAAgB,aAsB3B,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAoC/E;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAW7D"}

package/dist/commands/db/utils/schema-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-sync.ts"],"names":[],"mappings":"AA6FA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAErC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,MAAsB,GAClC,OAAO,CAAC;IACT,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC5C,CAAC,CAoCD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,CAAC,CAmDD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,GAAG,QAAQ,CAuCX"}
+{"version":3,"file":"schema-sync.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/schema-sync.ts"],"names":[],"mappings":"AA0KA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAErC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAAC;CACJ;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,WAAW,GAAE,MAAsB,GAClC,OAAO,CAAC;IACT,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC5C,CAAC,CAoCD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAAC;IACT,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,CAAC,CAoDD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE;IACjC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC,GAAG,QAAQ,CAuCX"}

package/dist/commands/db/utils/table-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table-registry.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/table-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAMV,UAAU,EACV,cAAc,EAEf,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiBlG;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC,CAmDvB;AA4PD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,UAAU,EAAE,EACvB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC,CAYD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,EAAE,GACnB,OAAO,CAAC,UAAU,EAAE,CAAC,CA0HvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAuCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,cAAc,CAAC,CA6GzB;AA+FD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAa7E;AAMD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"table-registry.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/utils/table-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAMV,UAAU,EACV,cAAc,EAEf,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA4ElG;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC,CAmDvB;AA4PD;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,UAAU,EAAE,EACvB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC,CAYD;AAMD;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,UAAU,EAAE,GACnB,OAAO,CAAC,UAAU,EAAE,CAAC,CA2HvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAuCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,cAAc,CAAC,CA6GzB;AA+FD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAa7E;AAMD,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/commands/env/commands/env-encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-encrypt.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8MpC,eAAO,MAAM,cAAc,SAqBvB,CAAC"}
+{"version":3,"file":"env-encrypt.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiOpC,eAAO,MAAM,cAAc,SAqBvB,CAAC"}

package/dist/commands/env/commands/env-pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-pull.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAYH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAq5BpC,eAAO,MAAM,WAAW,SAkCpB,CAAC"}
+{"version":3,"file":"env-pull.d.ts","sourceRoot":"","sources":["../../../../src/commands/env/commands/env-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAaH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA88BpC,eAAO,MAAM,WAAW,SA+BpB,CAAC"}

package/dist/index.js

@@ -5,10 +5,10 @@ import path10__default, { join, dirname, resolve, relative, basename, sep, isAbs
 import { fileURLToPath } from 'url';
 import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import * as fs6 from 'fs';
-import fs6__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, promises, lstatSync, chmodSync, accessSync, constants, unlinkSync } from 'fs';
+import fs6__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, promises, lstatSync, accessSync, constants, chmodSync, unlinkSync } from 'fs';
 import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, SUPABASE_SYSTEM_SCHEMAS, loadRunaConfigOrThrow, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, DATABASE_PACKAGE_CANDIDATES, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
-import fs10, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir } from 'fs/promises';
+import fs10, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir, lstat } from 'fs/promises';
 import { promisify } from 'util';
 import { glob } from 'glob';
 import { Project, Node, SyntaxKind } from 'ts-morph';
@@ -925,7 +925,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.31";
+    CLI_VERSION = "0.5.33";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -3030,8 +3030,50 @@ var init_typescript_analyzer = __esm({
     };
   }
 });
+function containsPathTraversal4(inputPath) {
+  const normalized = path10__default.normalize(inputPath);
+  if (normalized.includes("..")) return true;
+  if (inputPath.includes("\0")) return true;
+  return false;
+}
+function isPathWithinBoundary(filePath, boundaryDir) {
+  try {
+    const resolvedFile = path10__default.resolve(filePath);
+    const resolvedBoundary = path10__default.resolve(boundaryDir);
+    const relative8 = path10__default.relative(resolvedBoundary, resolvedFile);
+    return !relative8.startsWith("..") && !path10__default.isAbsolute(relative8);
+  } catch {
+    return false;
+  }
+}
+function resolvePathWithinBoundary(inputPath, boundaryDir) {
+  if (containsPathTraversal4(inputPath)) {
+    throw new Error(`Path contains traversal patterns: ${inputPath}`);
+  }
+  const resolvedPath = path10__default.isAbsolute(inputPath) ? inputPath : path10__default.resolve(boundaryDir, inputPath);
+  if (!isPathWithinBoundary(resolvedPath, boundaryDir)) {
+    throw new Error(`Path is outside allowed boundary: ${inputPath}`);
+  }
+  return resolvedPath;
+}
+function filterPathsWithinBoundary(files, boundaryDir) {
+  const resolvedBoundary = path10__default.resolve(boundaryDir);
+  return files.filter((file) => isPathWithinBoundary(file, resolvedBoundary));
+}
+function validateGlobPatterns(patterns) {
+  for (const pattern of patterns) {
+    if (containsPathTraversal4(pattern)) {
+      throw new Error(`Glob pattern contains path traversal: ${pattern}`);
+    }
+  }
+}
+var init_path_validation = __esm({
+  "src/internal/vuln-checker/security/path-validation.ts"() {
+    init_esm_shims();
+  }
+});
 async function loadConfig(configPath, rootDir) {
-  const fullPath = path10__default.isAbsolute(configPath) ? configPath : path10__default.join(rootDir, configPath);
+  const fullPath = resolvePathWithinBoundary(configPath, rootDir);
   try {
     const content = await fs10.readFile(fullPath, "utf-8");
     if (fullPath.endsWith(".yml") || fullPath.endsWith(".yaml")) {
@@ -3046,7 +3088,7 @@ async function loadConfig(configPath, rootDir) {
   }
 }
 async function loadIgnores(ignorePath, rootDir) {
-  const fullPath = path10__default.isAbsolute(ignorePath) ? ignorePath : path10__default.join(rootDir, ignorePath);
+  const fullPath = resolvePathWithinBoundary(ignorePath, rootDir);
   try {
     const content = await fs10.readFile(fullPath, "utf-8");
     let parsed;
@@ -3072,6 +3114,7 @@ async function loadIgnores(ignorePath, rootDir) {
 var init_loader = __esm({
   "src/internal/vuln-checker/config/loader.ts"() {
     init_esm_shims();
+    init_path_validation();
   }
 });
 function normalizePath(filePath) {
@@ -3661,6 +3704,7 @@ var init_vuln_checker = __esm({
     init_json_reporter();
     init_markdown_reporter();
     init_sarif_reporter();
+    init_path_validation();
     init_types2();
     SEVERITY_ORDER2 = {
       critical: 5,
@@ -3748,11 +3792,16 @@ var init_vuln_checker = __esm({
         return result;
       }
       async getFiles() {
-        return glob(this.options.include, {
+        validateGlobPatterns(this.options.include);
+        if (this.options.exclude) {
+          validateGlobPatterns(this.options.exclude);
+        }
+        const files = await glob(this.options.include, {
           cwd: this.options.rootDir,
           ignore: this.options.exclude,
           absolute: true
         });
+        return filterPathsWithinBoundary(files, this.options.rootDir);
       }
       async runAnalyzers(inlineAnnotations) {
         const findings = [];
@@ -5343,6 +5392,26 @@ function isExecutable(filePath) {
     return false;
   }
 }
+function resolveAndValidateSymlink(filePath) {
+  try {
+    const lstats = lstatSync(filePath);
+    if (lstats.isSymbolicLink()) {
+      const realPath = realpathSync(filePath);
+      const realDir = dirname(realPath);
+      if (!isTrustedDirectory(realDir)) {
+        return null;
+      }
+      const realStats = statSync(realPath);
+      if (!realStats.isFile()) {
+        return null;
+      }
+      return realPath;
+    }
+    return filePath;
+  } catch {
+    return null;
+  }
+}
 function isTrustedDirectory(dir) {
   const normalizedDir = normalize(dir).replace(/[/\\]$/, "");
   if (process.platform === "win32") {
@@ -5350,7 +5419,7 @@ function isTrustedDirectory(dir) {
   }
   for (const trusted of TRUSTED_DIRECTORIES_UNIX) {
     const normalizedTrusted = normalize(trusted).replace(/[/\\]$/, "");
-    if (normalizedDir === normalizedTrusted || normalizedDir.startsWith(normalizedTrusted + "/")) {
+    if (normalizedDir === normalizedTrusted || normalizedDir.startsWith(`${normalizedTrusted}/`)) {
       return true;
     }
   }
@@ -5396,8 +5465,9 @@ function resolveBinaryPath(binaryName) {
     const isExpired = now - cached.resolvedAt >= CACHE_TTL_MS;
     const pathChanged = cached.pathFingerprint !== currentPathFingerprint;
     if (!isExpired && !pathChanged) {
-      if (isExecutable(cached.path)) {
-        return cached.path;
+      const validatedPath = resolveAndValidateSymlink(cached.path);
+      if (validatedPath && isExecutable(validatedPath)) {
+        return validatedPath;
       }
       binaryPathCache.delete(binaryName);
     } else {
@@ -5410,19 +5480,31 @@ function resolveBinaryPath(binaryName) {
       `Binary '${binaryName}' not found in trusted PATH directories. Ensure ${binaryName} is installed in a system directory.`
     );
   }
-  if (!isExecutable(resolvedPath)) {
-    throw new Error(`Binary '${binaryName}' at '${resolvedPath}' is not executable.`);
+  const realPath = resolveAndValidateSymlink(resolvedPath);
+  if (!realPath) {
+    throw new Error(
+      `Security: Binary '${binaryName}' at '${resolvedPath}' is a symlink pointing outside trusted directories. This is not allowed for security reasons.`
+    );
+  }
+  if (!isExecutable(realPath)) {
+    throw new Error(`Binary '${binaryName}' at '${realPath}' is not executable.`);
   }
   binaryPathCache.set(binaryName, {
-    path: resolvedPath,
+    path: realPath,
     resolvedAt: now,
     pathFingerprint: currentPathFingerprint
   });
-  return resolvedPath;
+  return realPath;
 }
 function secureExeca(binaryName, args = [], options) {
   const resolvedPath = resolveBinaryPath(binaryName);
-  return execa(resolvedPath, args, { ...options, shell: false });
+  const finalPath = resolveAndValidateSymlink(resolvedPath);
+  if (!finalPath || !isExecutable(finalPath)) {
+    throw new Error(
+      `Security: Binary '${binaryName}' validation failed just before execution. The file may have been modified.`
+    );
+  }
+  return execa(finalPath, args, { ...options, shell: false });
 }
 function securePnpm(args = [], options) {
   return secureExeca("pnpm", args, options);
@@ -7115,9 +7197,9 @@ function printSummary(logger15, output3) {
 }
 function findRepoRoot(startDir) {
   const { existsSync: existsSync49, readFileSync: readFileSync27 } = __require("fs");
-  const { join: join22, dirname: dirname4 } = __require("path");
+  const { join: join22, dirname: dirname5 } = __require("path");
   let current = startDir;
-  while (current !== dirname4(current)) {
+  while (current !== dirname5(current)) {
     if (existsSync49(join22(current, "turbo.json"))) {
       return current;
     }
@@ -7131,7 +7213,7 @@ function findRepoRoot(startDir) {
       } catch {
       }
     }
-    current = dirname4(current);
+    current = dirname5(current);
   }
   return startDir;
 }
@@ -9279,8 +9361,14 @@ function detectAppSchemas(schemasDir, verbose) {
   }
   return result;
 }
+var VALID_PG_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
 function formatSchemasForSql(schemas) {
-  return schemas.map((s) => `'${s.replace(/'/g, "''")}'`).join(", ");
+  return schemas.map((s) => {
+    if (!VALID_PG_IDENTIFIER.test(s)) {
+      throw new Error(`Invalid schema name "${s}": must be a valid PostgreSQL identifier`);
+    }
+    return `'${s.replace(/'/g, "''")}'`;
+  }).join(", ");
 }
 async function detectStack(repoRoot, tmpDir, productionDbUrlAdmin) {
   const res = await runLogged({
@@ -16722,7 +16810,8 @@ function resolveDatabaseUrl(environment) {
       if (!isLocalDatabaseUrl(url)) {
         throw new CLIError("Local database URL appears to be a remote URL", "LOCAL_DB_URL_REMOTE", [
           "Local operations should use the local Supabase instance",
-          `Current URL: ${url.substring(0, 50)}...`,
+          // SECURITY (Issue #513): Redact credentials from database URL in error message
+          `Current URL: ${redactSecrets(url)}`,
           "If you need to connect to a remote DB, use --env preview or --env production"
         ]);
       }
@@ -19344,6 +19433,34 @@ init_config_loader();
 
 // src/commands/db/utils/schema-sync.ts
 init_esm_shims();
+var VALID_PG_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
+function validatePgIdentifier(name, context) {
+  if (!name || typeof name !== "string") {
+    throw new Error(`Invalid ${context}: empty or not a string`);
+  }
+  if (!VALID_PG_IDENTIFIER_PATTERN.test(name)) {
+    throw new Error(
+      `Invalid ${context} "${name}": must start with letter/underscore and contain only alphanumeric/underscore characters`
+    );
+  }
+}
+function escapePgStringLiteral(value) {
+  if (typeof value !== "string") {
+    throw new Error("Value must be a string");
+  }
+  return value.replace(/\\/g, "\\\\").replace(/'/g, "''");
+}
+function buildSafeSchemaInClause(schemas) {
+  if (schemas.length === 0) {
+    throw new Error("No schemas provided for IN clause");
+  }
+  const safeSchemas = [];
+  for (const schema of schemas) {
+    validatePgIdentifier(schema, "schema name");
+    safeSchemas.push(`'${escapePgStringLiteral(schema)}'`);
+  }
+  return safeSchemas.join(",");
+}
 var ERROR_MESSAGES2 = {
   PATH_TRAVERSAL: "Schema path validation failed",
   SCHEMA_NOT_FOUND: "Schema file not found"
@@ -19419,7 +19536,7 @@ async function fetchDbTablesAndEnums(databaseUrl, options) {
     ...options?.additionalSystemSchemas ?? []
   ]);
   const filteredManagedSchemas = managedSchemas.filter((s) => !systemSchemas.has(s));
-  const schemaList = filteredManagedSchemas.map((s) => `'${s}'`).join(",");
+  const schemaList = buildSafeSchemaInClause(filteredManagedSchemas);
   const tablesSql = `
 SELECT schemaname || '.' || tablename
 FROM pg_tables
@@ -23091,7 +23208,7 @@ async function runRollbackAction(environment, options) {
   logger15.section("Schema Rollback");
   logger15.info(`Environment: ${environment}`);
   logger15.info(`Snapshot: ${snapshotFile}`);
-  logger15.info(`Database: ${databaseUrl.slice(0, 50)}...`);
+  logger15.info(`Database: ${redactSecrets(databaseUrl)}`);
   if (options.dryRun) {
     logger15.info("\n[DRY RUN] Would restore from snapshot");
     logger15.info("Re-run without --dry-run to apply");
@@ -23825,7 +23942,7 @@ function renderSeedVerifyText(params) {
   const { logger: logger15, env: env2, dbUrl, result } = params;
   logger15.section("Seed Data Verification");
   logger15.info(`Environment: ${env2}`);
-  logger15.info(`Database: ${dbUrl.substring(0, 50)}...`);
+  logger15.info(`Database: ${redactSecrets(dbUrl)}`);
   logger15.info("");
   logger15.step("Checking data counts", 1);
   for (const r of result.results) {
@@ -25069,7 +25186,12 @@ var VERCEL_ENVIRONMENTS = ["development", "preview", "production"];
 function isAlreadyEncrypted(filePath) {
   if (!existsSync(filePath)) return false;
   const content = readFileSync(filePath, "utf-8");
-  return content.includes("DOTENV_PUBLIC_KEY");
+  const hasPublicKeyDeclaration = /^DOTENV_PUBLIC_KEY_\w+\s*=\s*["']?[A-Za-z0-9+/=]+/m.test(
+    content
+  );
+  if (!hasPublicKeyDeclaration) return false;
+  const hasEncryptedValue = /^[A-Z_][A-Z0-9_]*\s*=\s*["']?encrypted:/m.test(content);
+  return hasEncryptedValue;
 }
 async function encryptFile(workDir, environment, logger15, options) {
   const fileName = `.env.${environment}`;
@@ -25423,6 +25545,31 @@ var ERROR_MESSAGES3 = {
   PATH_TRAVERSAL: "Working directory path validation failed",
   APP_NOT_FOUND: "App directory not found"
 };
+function sanitizeErrorMessage(message) {
+  if (!message || typeof message !== "string") {
+    return "Unknown error";
+  }
+  let sanitized = message;
+  sanitized = sanitized.replace(
+    /\b(vercel_|vc_|VERCEL_TOKEN[=:]\s*)[a-zA-Z0-9_-]{20,}/gi,
+    "$1[REDACTED]"
+  );
+  sanitized = sanitized.replace(/\b(Bearer\s+)[a-zA-Z0-9._-]{20,}/gi, "$1[REDACTED]");
+  sanitized = sanitized.replace(
+    /\b(token[=:]\s*["']?)[a-zA-Z0-9._-]{20,}(["']?)/gi,
+    "$1[REDACTED]$2"
+  );
+  sanitized = sanitized.replace(
+    /\b(api[_-]?key[=:]\s*["']?)[a-zA-Z0-9._-]{20,}(["']?)/gi,
+    "$1[REDACTED]$2"
+  );
+  sanitized = sanitized.replace(
+    /\b(Authorization[=:]\s*["']?)[a-zA-Z0-9\s._-]{20,}(["']?)/gi,
+    "$1[REDACTED]$2"
+  );
+  sanitized = sanitized.replace(/:\/\/[^@\s]+@/g, "://[CREDENTIALS]@");
+  return sanitized;
+}
 function containsPathTraversal3(inputPath) {
   const normalized = path10__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
@@ -25606,6 +25753,7 @@ function extractAndSavePrivateKeys(workDir, envFiles, logger15) {
   ].join("\n");
   const keysFile = resolve(workDir, ".env.keys");
   writeFileSync(keysFile, keysContent, "utf-8");
+  chmodSync(keysFile, 384);
   logger15.success(`  \u{1F511} Extracted ${Object.keys(privateKeys).length} keys \u2192 .env.keys`);
   return true;
 }
@@ -25687,7 +25835,7 @@ async function encryptFile2(workDir, filePath, logger15) {
     return true;
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
-    logger15.warn(`  \u26A0\uFE0F  Encryption failed: ${message}`);
+    logger15.warn(`  \u26A0\uFE0F  Encryption failed: ${sanitizeErrorMessage(message)}`);
     return false;
   }
 }
@@ -25701,6 +25849,7 @@ function buildVercelCmdEnv(auth) {
   return cmdEnv;
 }
 function mapVercelError(message, environment, outputPath, logger15) {
+  const safeMessage = sanitizeErrorMessage(message);
   if (message.includes("not linked")) {
     logger15.error(`  \u2717 ${environment}: Project not linked to Vercel`);
     return {
@@ -25728,8 +25877,8 @@ function mapVercelError(message, environment, outputPath, logger15) {
       error: "Invalid VERCEL_TOKEN. Check your token is valid."
     };
   }
-  logger15.error(`  \u2717 ${environment}: ${message}`);
-  return { environment, outputPath, success: false, error: message };
+  logger15.error(`  \u2717 ${environment}: ${safeMessage}`);
+  return { environment, outputPath, success: false, error: safeMessage };
 }
 async function pullEnvironment(workDir, environment, auth, logger15, options = {}) {
   const outputPath = getOutputPath(workDir, environment);
@@ -25942,16 +26091,12 @@ var pullCommand = new Command("pull").description("Pull all environments from Ve
     await runEnvPullAction(options);
   } catch (error) {
     if (error instanceof CLIError) throw error;
-    throw new CLIError(
-      error instanceof Error ? error.message : "Environment pull failed",
-      "ENV_PULL_FAILED",
-      [
-        "Check Vercel CLI is installed: vercel --version",
-        "Ensure project is linked: vercel link",
-        "Check network connectivity"
-      ],
-      error instanceof Error ? error : void 0
-    );
+    const rawMessage = error instanceof Error ? error.message : "Environment pull failed";
+    throw new CLIError(sanitizeErrorMessage(rawMessage), "ENV_PULL_FAILED", [
+      "Check Vercel CLI is installed: vercel --version",
+      "Ensure project is linked: vercel link",
+      "Check network connectivity"
+    ]);
   }
 });
 
@@ -29361,6 +29506,29 @@ async function installTemplates(tempDir, authToken, verbose) {
     ]);
   }
 }
+async function verifyNoSymlinks(dir, baseDir) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path10__default.join(dir, entry.name);
+    const stats = await lstat(fullPath);
+    if (stats.isSymbolicLink()) {
+      const relativePath = path10__default.relative(baseDir, fullPath);
+      throw new CLIError(
+        "Security: Symlink detected in template package.",
+        "SYMLINK_ATTACK_DETECTED",
+        [
+          `Symlink found: ${relativePath}`,
+          "This could be an attempt to access files outside the template directory.",
+          "The template package may be malicious or corrupted.",
+          "Please report this issue if you believe this is a false positive."
+        ]
+      );
+    }
+    if (stats.isDirectory()) {
+      await verifyNoSymlinks(fullPath, baseDir);
+    }
+  }
+}
 async function copyToCache(tempDir, cacheDir) {
   const sourceTemplates = path10__default.join(tempDir, "node_modules", TEMPLATES_PACKAGE_NAME, "templates");
   if (!fs6__default.existsSync(sourceTemplates)) {
@@ -29370,9 +29538,13 @@ async function copyToCache(tempDir, cacheDir) {
       "Try running with --fresh to re-download."
     ]);
   }
+  await verifyNoSymlinks(sourceTemplates, sourceTemplates);
   await mkdir(cacheDir, { recursive: true });
   const targetTemplates = path10__default.join(cacheDir, "templates");
-  await cp(sourceTemplates, targetTemplates, { recursive: true });
+  await cp(sourceTemplates, targetTemplates, {
+    recursive: true,
+    dereference: false
+  });
 }
 async function fetchTemplates(options = {}) {
   const version = options.version ?? COMPATIBLE_TEMPLATES_VERSION;
@@ -33431,9 +33603,9 @@ function printActionsNeeded(logger15, actions) {
 }
 function findRepoRoot3(startDir) {
   const { existsSync: existsSync49, readFileSync: readFileSync27 } = __require("fs");
-  const { join: join22, dirname: dirname4 } = __require("path");
+  const { join: join22, dirname: dirname5 } = __require("path");
   let current = startDir;
-  while (current !== dirname4(current)) {
+  while (current !== dirname5(current)) {
     if (existsSync49(join22(current, "turbo.json"))) {
       return current;
     }
@@ -33447,7 +33619,7 @@ function findRepoRoot3(startDir) {
       } catch {
       }
     }
-    current = dirname4(current);
+    current = dirname5(current);
   }
   return startDir;
 }
@@ -37146,8 +37318,8 @@ async function checkLicense() {
   }
   const result = await resolveGitHubOwner();
   if (!result?.owner) {
-    logger14.debug("[license] Could not determine owner, skipping check");
-    return { allowed: true, reason: "error" };
+    logger14.warn("[license] Could not determine repository owner, denying access");
+    return { allowed: false, reason: "owner-resolution-failed" };
   }
   const owner = result.owner;
   if (isTrustedOrg(owner)) {

package/dist/internal/vuln-checker/config/loader.d.ts

@@ -3,14 +3,24 @@
  *
  * Purpose: Load and parse configuration files
  * Supports: YAML and JSON formats
+ *
+ * Security:
+ * - Path validation to prevent path traversal attacks (Issue #537)
+ * - Config/ignore files must be within rootDir boundary
  */
 import type { IgnoreRule, VulnCheckerConfig } from '../types.js';
 /**
  * Load configuration file
+ *
+ * SECURITY (Issue #537): Validates that configPath is within rootDir boundary
+ * to prevent path traversal attacks.
  */
 export declare function loadConfig(configPath: string, rootDir: string): Promise<VulnCheckerConfig>;
 /**
  * Load ignore file
+ *
+ * SECURITY (Issue #537): Validates that ignorePath is within rootDir boundary
+ * to prevent path traversal attacks.
  */
 export declare function loadIgnores(ignorePath: string, rootDir: string): Promise<IgnoreRule[]>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/internal/vuln-checker/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE;;GAEG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmBhG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA8B5F"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoBhG;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CA+B5F"}

package/dist/internal/vuln-checker/index.d.ts

@@ -3,6 +3,10 @@
  *
  * Purpose: Comprehensive security scanning for TypeScript/PostgreSQL projects
  * Philosophy: AST-based analysis + pattern matching + false positive management
+ *
+ * Security:
+ * - Path validation to prevent path traversal attacks (Issue #537)
+ * - Glob patterns and file lists are validated to stay within rootDir
  */
 import type { Category, ScanResult, Severity } from './types.js';
 export * from './types.js';

package/dist/internal/vuln-checker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/vuln-checker/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,KAAK,EAGV,QAAQ,EAKR,UAAU,EACV,QAAQ,EAET,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AA6ED,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,MAAM,CAAmD;gBAErD,OAAO,EAAE,kBAAkB;IA6CjC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IASrB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;YA6BnB,QAAQ;YAQR,YAAY;IA2B1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IAQxB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ5B,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAK5B,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,GAAE,QAAiB,GAAG,MAAM;IAWlE,+CAA+C;IAC/C,SAAS,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAGzD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/internal/vuln-checker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAcH,OAAO,KAAK,EAGV,QAAQ,EAKR,UAAU,EACV,QAAQ,EAET,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AA6ED,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,MAAM,CAAmD;gBAErD,OAAO,EAAE,kBAAkB;IA6CjC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IASrB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;YA6BnB,QAAQ;YAkBR,YAAY;IA2B1B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IAQxB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ5B,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAK5B,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,GAAE,QAAiB,GAAG,MAAM;IAWlE,+CAA+C;IAC/C,SAAS,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CAGzD"}

package/dist/internal/vuln-checker/security/path-validation.d.ts

@@ -0,0 +1,66 @@
+/**
+ * AI HINT: Path Validation Security for Vulnerability Checker
+ *
+ * Purpose: Prevent path traversal attacks in vulnerability checker
+ * Features:
+ * - Validates paths are within allowed boundaries
+ * - Detects path traversal patterns (../, etc.)
+ * - Provides reusable validation functions
+ *
+ * @see Issue #537 - Path traversal in vulnerability checker
+ */
+/**
+ * SECURITY (Issue #537): Validate that a path doesn't contain traversal patterns.
+ *
+ * Checks for patterns that could escape the intended directory:
+ * - .. (parent directory)
+ * - Null bytes (\0)
+ *
+ * @param inputPath - Path to validate
+ * @returns true if path contains traversal patterns
+ */
+export declare function containsPathTraversal(inputPath: string): boolean;
+/**
+ * SECURITY (Issue #537): Validate that a resolved path is within the allowed boundary.
+ *
+ * @param filePath - Path to validate (absolute or relative)
+ * @param boundaryDir - Boundary directory (e.g., rootDir)
+ * @returns true if the path is within the boundary
+ */
+export declare function isPathWithinBoundary(filePath: string, boundaryDir: string): boolean;
+/**
+ * SECURITY (Issue #537): Validate and resolve a path safely within boundary.
+ *
+ * @param inputPath - User-provided path (may be relative or absolute)
+ * @param boundaryDir - Boundary directory that path must be within
+ * @returns Resolved absolute path
+ * @throws Error if path is outside boundary or invalid
+ */
+export declare function resolvePathWithinBoundary(inputPath: string, boundaryDir: string): string;
+/**
+ * SECURITY (Issue #537): Validate and resolve a path with symlink resolution.
+ *
+ * This is more secure as it resolves symlinks to detect symlink-based escapes.
+ *
+ * @param inputPath - User-provided path
+ * @param boundaryDir - Boundary directory
+ * @returns Resolved real path
+ * @throws Error if path is outside boundary, invalid, or doesn't exist
+ */
+export declare function resolveRealPathWithinBoundary(inputPath: string, boundaryDir: string): string;
+/**
+ * SECURITY (Issue #537): Filter file list to only include paths within boundary.
+ *
+ * @param files - Array of file paths (from glob or similar)
+ * @param boundaryDir - Boundary directory
+ * @returns Array of files that are within the boundary
+ */
+export declare function filterPathsWithinBoundary(files: string[], boundaryDir: string): string[];
+/**
+ * SECURITY (Issue #537): Validate glob patterns don't contain traversal.
+ *
+ * @param patterns - Array of glob patterns
+ * @throws Error if any pattern contains traversal
+ */
+export declare function validateGlobPatterns(patterns: string[]): void;
+//# sourceMappingURL=path-validation.d.ts.map

package/dist/internal/vuln-checker/security/path-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-validation.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/security/path-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAWhE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAgBnF;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAiBxF;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAsB5F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAGxF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAM7D"}

package/dist/utils/license/index.d.ts

@@ -7,15 +7,17 @@
  * Design decisions:
  * - r06-dev: Instant allow, NO API call, NO log (zero-impact)
  * - External org: API check via allowlist with last-known-good fallback
- * - Fail-open strategy:
+ * - Fail-closed strategy (Issue #542):
+ *   - Owner resolution failure: Deny access (prevents bypass via manipulation)
  *   - API available: Use live response
  *   - API error + cached: Use last-known-good (24h window)
- *   - API error + no cache: Fail closed (new orgs blocked during outage)
- * - Escape hatch: RUNA_SKIP_LICENSE_CHECK=1 bypasses all checks
+ *   - API error + no cache: Deny access (new orgs blocked during outage)
+ * - Escape hatch: RUNA_SKIP_LICENSE_CHECK=1 bypasses all checks (local only)
  *
  * Security model:
+ * - Fail-closed: Any resolution/validation error denies access
  * - Known orgs protected during outages (last-known-good)
- * - Unknown orgs cannot bypass by causing outages (fail closed)
+ * - Unknown orgs cannot bypass by causing errors (fail closed)
  */
 import type { LicenseCheckResult } from './types.js';
 /**

package/dist/utils/license/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAerD;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAoDhE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAMxD;AAGD,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAerD;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAqDhE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAMxD;AAGD,YAAY,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/utils/license/types.d.ts

@@ -37,6 +37,8 @@ export interface LicenseCheckResult {
 }
 /**
  * Reasons for license check decisions
+ *
+ * SECURITY (Issue #542): Fail-closed design - errors result in denial
  */
-export type LicenseCheckReason = 'not-ci' | 'trusted-org' | 'allowlist' | 'not-found' | 'error' | 'skip-flag';
+export type LicenseCheckReason = 'not-ci' | 'trusted-org' | 'allowlist' | 'not-found' | 'error' | 'owner-resolution-failed' | 'skip-flag';
 //# sourceMappingURL=types.d.ts.map

package/dist/utils/license/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/utils/license/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC;CACrE;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,aAAa,GACb,WAAW,GACX,WAAW,GACX,OAAO,GACP,WAAW,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/utils/license/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC;CACrE;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,aAAa,GACb,WAAW,GACX,WAAW,GACX,OAAO,GACP,yBAAyB,GACzB,WAAW,CAAC"}

package/dist/utils/secure-exec.d.ts

@@ -40,6 +40,11 @@ export declare function clearBinaryPathCache(): void;
  * - Caches results with TTL and PATH fingerprint for invalidation
  * - Re-validates cached paths are still executable
  *
+ * SECURITY (Issue #541):
+ * - Resolves symlinks and validates target is in trusted directory
+ * - Returns the real path (after symlink resolution), not the symlink
+ * - Prevents TOCTOU attacks via symlink replacement
+ *
  * @throws Error if binary is not trusted or not found
  */
 export declare function resolveBinaryPath(binaryName: string): string;
@@ -56,6 +61,10 @@ export declare function isBinaryAvailable(binaryName: string): boolean;
  * 3. Validates the path is executable
  * 4. Passes the absolute path to execa with shell: false
  *
+ * SECURITY (Issue #541): This function also:
+ * 5. Resolves symlinks and validates target is in trusted directory
+ * 6. Performs final validation right before execution to minimize TOCTOU window
+ *
  * @param binaryName - Name of the trusted binary to execute
  * @param args - Arguments to pass to the binary
  * @param options - execa options
@@ -70,6 +79,10 @@ export declare function secureExeca(binaryName: TrustedBinary, args?: readonly s
  * - Only executes from the project's node_modules/.bin directory
  * - Validates the binary name to prevent path traversal
  * - Uses shell: false
+ *
+ * SECURITY (Issue #541):
+ * - Resolves symlinks and validates target is within project
+ * - Performs final validation before execution
  */
 export declare function secureExecaLocal(binaryName: string, args?: readonly string[], options?: ExecaOptions & {
     cwd?: string;

package/dist/utils/secure-exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-exec.d.ts","sourceRoot":"","sources":["../../src/utils/secure-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,KAAK,OAAO,IAAI,YAAY,EAAE,KAAK,aAAa,EAAS,MAAM,OAAO,CAAC;AAMhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gIAenB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA8D9D;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AA0GD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAyD5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAO7D;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,aAAa,EACzB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAIf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,aAAa,CAsBf;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE7F;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE5F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAEf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F"}
+{"version":3,"file":"secure-exec.d.ts","sourceRoot":"","sources":["../../src/utils/secure-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAE,KAAK,OAAO,IAAI,YAAY,EAAE,KAAK,aAAa,EAAS,MAAM,OAAO,CAAC;AAMhF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,gIAenB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AA8D9D;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAsJD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoE5D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAO7D;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,aAAa,EACzB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,aAAa,CAwDf;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE7F;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE5F;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,GAAE,SAAS,MAAM,EAAO,EAC5B,OAAO,CAAC,EAAE,YAAY,GACrB,aAAa,CAEf;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAEhG;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,aAAa,CAE9F"}

package/dist/utils/template-fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-fetcher.d.ts","sourceRoot":"","sources":["../../src/utils/template-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAkEH,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAC;CACjB;AA0OD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAgF/B;AAmGD;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAKzD"}
+{"version":3,"file":"template-fetcher.d.ts","sourceRoot":"","sources":["../../src/utils/template-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAkEH,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,MAAM,EAAE,OAAO,CAAC;CACjB;AA+RD;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAgF/B;AAmGD;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAKzD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -26,8 +26,6 @@
   },
   "dependencies": {
     "@dotenvx/dotenvx": "1.51.4",
-    "@runa-ai/runa": "^0.5.31",
-    "@runa-ai/runa-xstate-test-plugin": "^0.5.28",
     "@types/node": "22.19.3",
     "boxen": "7.1.1",
     "chalk": "5.6.2",
@@ -53,7 +51,9 @@
     "tsup": "8.5.1",
     "typescript": "5.9.3",
     "xstate": "5.25.0",
-    "zod": "4.3.5"
+    "zod": "4.3.5",
+    "@runa-ai/runa": "0.5.33",
+    "@runa-ai/runa-xstate-test-plugin": "0.5.28"
   },
   "engines": {
     "node": ">=20.0.0"