@viberaven/cli 1.6.12 → 1.7.1

package/dist/github-ci.js

@@ -0,0 +1,1645 @@
+#!/usr/bin/env node
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/github-ci/main.ts
+var main_exports = {};
+__export(main_exports, {
+  main: () => main,
+  scan: () => scan,
+  scannerEnv: () => scannerEnv
+});
+module.exports = __toCommonJS(main_exports);
+var import_node_child_process6 = require("node:child_process");
+var import_node_fs = require("node:fs");
+var import_promises3 = require("node:fs/promises");
+var import_node_os2 = require("node:os");
+var import_node_path4 = require("node:path");
+
+// src/commands/checkChange.ts
+var import_node_child_process4 = require("node:child_process");
+var import_promises2 = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path2 = require("node:path");
+var import_node_util4 = require("node:util");
+
+// ../../src/station/sifgTemplates.ts
+var BLOCKED_PRODUCT_GLOBS = ["landing/**", "services/api/**", "marketing/**"];
+var TEMPLATES = [
+  {
+    id: "template:payments:stripe:webhook-ingress",
+    label: "Stripe webhook ingress",
+    registryProvider: "stripe",
+    providerKey: "stripe-payments",
+    area: "payments",
+    sourceMatchers: [
+      { kind: "route-handler", framework: "nextjs-app-router", routePattern: "/api/**/stripe/**", method: "POST" },
+      { kind: "sdk-symbol", importName: "stripe", member: "webhooks.constructEvent" }
+    ],
+    requiredGuards: [
+      {
+        kind: "signature-verifier",
+        symbols: ["stripe.webhooks.constructEvent"],
+        requiresEnvNames: ["STRIPE_WEBHOOK_SECRET"],
+        mustPrecede: ["database-write", "entitlement-update", "provider-mutation"]
+      },
+      {
+        kind: "idempotency-guard",
+        symbols: ["event.id", "idempotencyKey", "processed_events"],
+        mustPrecede: ["entitlement-update"]
+      }
+    ],
+    forbiddenFlows: [
+      { from: "request-body", to: "database-write", unlessGuardedBy: "signature-verifier" },
+      { from: "env:STRIPE_SECRET_KEY", to: "client-bundle", severity: "critical" }
+    ],
+    repoFixPolicy: {
+      allowedFileGlobs: ["app/**/route.ts", "src/server/**", "lib/server/**"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  },
+  {
+    id: "template:auth:protected-data-access",
+    label: "Protected data access",
+    registryProvider: "clerk",
+    providerKey: "clerk-auth",
+    area: "auth",
+    sourceMatchers: [{ kind: "route-handler", routePattern: "/api/**", method: "ANY" }],
+    requiredGuards: [{ kind: "auth-guard", symbols: ["auth", "getServerSession", "currentUser"], mustPrecede: ["database-read", "database-write"] }],
+    forbiddenFlows: [{ from: "private-data", to: "response", unlessGuardedBy: "auth-guard" }],
+    repoFixPolicy: {
+      allowedFileGlobs: ["app/**/route.ts", "src/server/**", "lib/server/**", "middleware.ts", "src/middleware.ts"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  },
+  {
+    id: "template:database:supabase:service-role-boundary",
+    label: "Supabase service role boundary",
+    registryProvider: "supabase",
+    providerKey: "supabase-database",
+    area: "database",
+    sourceMatchers: [{ kind: "env-read", envName: "SUPABASE_SERVICE_ROLE_KEY" }],
+    requiredGuards: [{ kind: "server-only-boundary", symbols: ["server-only"], mustPrecede: ["database-read", "database-write"] }],
+    forbiddenFlows: [{ from: "env:SUPABASE_SERVICE_ROLE_KEY", to: "client-bundle", severity: "critical" }],
+    repoFixPolicy: {
+      allowedFileGlobs: ["src/server/**", "lib/server/**", "app/**/route.ts", "supabase/**"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  },
+  {
+    id: "template:security:public-route-abuse-guard",
+    label: "Public route abuse guard",
+    registryProvider: "rate-limit",
+    providerKey: "rate-limit-security",
+    area: "security",
+    sourceMatchers: [{ kind: "route-handler", routePattern: "/api/**", method: "ANY" }],
+    requiredGuards: [{ kind: "rate-limit-guard", symbols: ["ratelimit", "rateLimit", "upstash"], mustPrecede: ["provider-mutation", "database-write"] }],
+    forbiddenFlows: [{ from: "public-request", to: "expensive-sink", unlessGuardedBy: "rate-limit-guard" }],
+    repoFixPolicy: {
+      allowedFileGlobs: ["app/**/route.ts", "src/server/**", "lib/server/**"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  },
+  {
+    id: "template:security:secret-boundary",
+    label: "Secret boundary",
+    registryProvider: "secrets-hygiene",
+    providerKey: "secrets-hygiene-security",
+    area: "security",
+    sourceMatchers: [{ kind: "env-read", envName: "*" }],
+    requiredGuards: [{ kind: "server-only-boundary", symbols: ["server-only"], mustPrecede: ["client-bundle"] }],
+    forbiddenFlows: [{ from: "env:*", to: "client-bundle", severity: "critical" }],
+    repoFixPolicy: {
+      allowedFileGlobs: ["src/**", "lib/**", "app/**"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  },
+  {
+    id: "template:errorHandling:safe-error-response",
+    label: "Safe error response",
+    registryProvider: "sentry",
+    providerKey: "sentry-error-handling",
+    area: "errorHandling",
+    sourceMatchers: [{ kind: "throw-or-catch", routePattern: "/api/**" }],
+    requiredGuards: [{ kind: "error-capture", symbols: ["Sentry.captureException", "captureException"], mustPrecede: ["safe-response"] }],
+    forbiddenFlows: [{ from: "provider-error", to: "client-response", unlessGuardedBy: "safe-response" }],
+    repoFixPolicy: {
+      allowedFileGlobs: ["app/**/route.ts", "src/server/**", "lib/server/**"],
+      blockedFileGlobs: BLOCKED_PRODUCT_GLOBS,
+      requiresApproval: true
+    }
+  }
+];
+var SIFG_TEMPLATE_IDS = TEMPLATES.map((template) => template.id);
+function allSifgTemplates() {
+  return TEMPLATES.map((template) => ({
+    ...template,
+    sourceMatchers: template.sourceMatchers.map((matcher) => ({ ...matcher })),
+    requiredGuards: template.requiredGuards.map((guard) => ({
+      ...guard,
+      symbols: [...guard.symbols],
+      requiresEnvNames: guard.requiresEnvNames ? [...guard.requiresEnvNames] : void 0,
+      mustPrecede: [...guard.mustPrecede]
+    })),
+    forbiddenFlows: template.forbiddenFlows.map((flow) => ({ ...flow })),
+    repoFixPolicy: {
+      allowedFileGlobs: [...template.repoFixPolicy.allowedFileGlobs],
+      blockedFileGlobs: [...template.repoFixPolicy.blockedFileGlobs],
+      requiresApproval: true
+    }
+  }));
+}
+function sifgTemplatesForRegistryProviderArea(registryProvider, area) {
+  return allSifgTemplates().filter(
+    (template) => template.registryProvider === registryProvider && template.area === area
+  );
+}
+
+// ../../src/station/providerRegistry.ts
+var PROVIDERS = [
+  provider("supabase", "Supabase", ["supabase"], ["database", "landing"], ["database", "auth"], "supabase", {
+    docsUrl: "https://supabase.com/docs",
+    dashboardUrl: "https://supabase.com/dashboard",
+    mcp: {
+      label: "Supabase",
+      serverName: "supabase",
+      vscodeServer: { type: "http", url: "https://mcp.supabase.com/mcp?read_only=true" },
+      cursorServer: { url: "https://mcp.supabase.com/mcp?read_only=true" },
+      keyInstructions: "For hosted Supabase MCP, no API key goes in this file. Your IDE opens browser OAuth after you add the server. A Supabase access token is only needed for CI/manual-header setups, where it is passed as Authorization: Bearer ${SUPABASE_ACCESS_TOKEN}."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("supabase-auth", "Supabase Auth", ["supabaseauth"], ["auth"], [], "supabase", {
+    docsUrl: "https://supabase.com/docs/guides/auth",
+    dashboardUrl: "https://supabase.com/dashboard"
+  }),
+  provider("clerk", "Clerk", ["clerk"], ["auth"], ["auth"], "clerk", {
+    docsUrl: "https://clerk.com/docs",
+    dashboardUrl: "https://dashboard.clerk.com",
+    mcp: {
+      label: "Clerk",
+      serverName: "clerk",
+      vscodeServer: { type: "http", url: "https://mcp.clerk.com/mcp" },
+      cursorServer: { url: "https://mcp.clerk.com/mcp" },
+      keyInstructions: "Clerk MCP uses your Clerk credentials. If your IDE asks for a token, create one from the Clerk Dashboard developer settings."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("authjs", "Auth.js", ["authjs", "auth", "nextauth"], ["auth"], ["auth"], "authjs", {
+    docsUrl: "https://authjs.dev"
+  }),
+  provider("auth0", "Auth0", ["auth0"], ["auth"], ["auth"], "auth0", {
+    docsUrl: "https://auth0.com/docs",
+    dashboardUrl: "https://manage.auth0.com"
+  }),
+  provider("better-auth", "Better Auth", ["betterauth", "better-auth"], ["auth"], ["auth"], "better-auth", {
+    docsUrl: "https://www.better-auth.com/docs"
+  }),
+  provider("firebase", "Firebase", ["firebase", "firestore"], ["database"], ["database"], "firebase", {
+    docsUrl: "https://firebase.google.com/docs",
+    dashboardUrl: "https://console.firebase.google.com"
+  }),
+  provider("neon", "Neon", ["neon"], ["database"], ["database"], "neon", {
+    docsUrl: "https://neon.tech/docs",
+    dashboardUrl: "https://console.neon.tech",
+    mcp: {
+      label: "Neon",
+      serverName: "neon",
+      vscodeServer: { type: "http", url: "https://mcp.neon.tech/mcp" },
+      cursorServer: { url: "https://mcp.neon.tech/mcp" },
+      keyInstructions: "Neon MCP normally opens browser OAuth. Use Neon project/database credentials only when your IDE asks for them."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("planetscale", "PlanetScale", ["planetscale"], ["database"], ["database"], "planetscale", {
+    docsUrl: "https://planetscale.com/docs",
+    dashboardUrl: "https://app.planetscale.com",
+    mcp: {
+      label: "PlanetScale",
+      serverName: "planetscale",
+      vscodeServer: { type: "http", url: "https://mcp.pscale.dev/mcp/planetscale" },
+      cursorServer: { url: "https://mcp.pscale.dev/mcp/planetscale" },
+      keyInstructions: "PlanetScale MCP normally opens browser OAuth. Use a PlanetScale service token only for local/manual fallback setups."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("mongodb", "MongoDB Atlas", ["mongodb", "mongodbatlas"], ["database"], ["database"], "mongodb", {
+    docsUrl: "https://www.mongodb.com/docs",
+    dashboardUrl: "https://cloud.mongodb.com",
+    mcp: {
+      label: "MongoDB",
+      serverName: "mongodb",
+      vscodeServer: { type: "stdio", command: "npx", args: ["-y", "mongodb-mcp-server", "--connectionString", "mongodb://localhost:27017/myDatabase", "--readOnly"] },
+      cursorServer: { command: "npx", args: ["-y", "mongodb-mcp-server", "--connectionString", "mongodb://localhost:27017/myDatabase", "--readOnly"] },
+      keyInstructions: "MongoDB MCP runs locally. Replace the connection string placeholder with a local or Atlas connection string and keep readOnly until you trust the workflow."
+    },
+    verification: { supportsReadOnly: false }
+  }),
+  provider("turso", "Turso", ["turso"], ["database"], ["database"], "turso", {
+    docsUrl: "https://docs.turso.tech",
+    dashboardUrl: "https://app.turso.tech"
+  }),
+  provider("stripe", "Stripe", ["stripe"], ["payments"], ["payments"], "stripe", {
+    docsUrl: "https://docs.stripe.com",
+    dashboardUrl: "https://dashboard.stripe.com",
+    mcp: {
+      label: "Stripe",
+      serverName: "stripe",
+      vscodeServer: { type: "http", url: "https://mcp.stripe.com" },
+      cursorServer: { url: "https://mcp.stripe.com" },
+      keyInstructions: "Stripe remote MCP normally authenticates with OAuth in the IDE. For local or custom bearer-token setups, use a restricted Stripe secret key from Developers > API keys."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("paddle", "Paddle", ["paddle"], ["payments"], ["payments"], "paddle", {
+    docsUrl: "https://developer.paddle.com",
+    dashboardUrl: "https://vendors.paddle.com",
+    mcp: {
+      label: "Paddle",
+      serverName: "paddle",
+      vscodeServer: { type: "stdio", command: "npx", args: ["-y", "@paddle/paddle-mcp", "--api-key=YOUR_API_KEY", "--environment=sandbox", "--tools=non-destructive"] },
+      cursorServer: { command: "npx", args: ["-y", "@paddle/paddle-mcp", "--api-key=YOUR_API_KEY", "--environment=sandbox", "--tools=non-destructive"] },
+      keyInstructions: "Paddle MCP needs your Paddle authentication. Replace YOUR_API_KEY with a sandbox or production API key before enabling write-capable tools."
+    },
+    verification: { supportsReadOnly: false }
+  }),
+  provider("polar", "Polar", ["polar", "polarsh"], ["payments"], ["payments"], "polar", {
+    docsUrl: "https://polar.sh/docs",
+    dashboardUrl: "https://polar.sh/dashboard",
+    verification: { supportsReadOnly: false }
+  }),
+  provider("lemon-squeezy", "Lemon Squeezy", ["lemonsqueezy", "lemon-squeezy", "lemon squeezy"], ["payments"], ["payments"], "lemon-squeezy", {
+    docsUrl: "https://docs.lemonsqueezy.com",
+    dashboardUrl: "https://app.lemonsqueezy.com"
+  }),
+  provider("vercel", "Vercel", ["vercel"], ["deployment"], ["deployment"], "vercel", {
+    docsUrl: "https://vercel.com/docs",
+    dashboardUrl: "https://vercel.com/dashboard",
+    mcp: {
+      label: "Vercel",
+      serverName: "vercel",
+      vscodeServer: { type: "http", url: "https://mcp.vercel.com" },
+      cursorServer: { url: "https://mcp.vercel.com" },
+      keyInstructions: "Vercel MCP is a remote OAuth server. Finish the browser sign-in your IDE opens; only use a Vercel token for a separate CLI/local fallback."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("netlify", "Netlify", ["netlify"], ["deployment"], ["deployment"], "netlify", {
+    docsUrl: "https://docs.netlify.com",
+    dashboardUrl: "https://app.netlify.com",
+    mcp: {
+      label: "Netlify",
+      serverName: "netlify",
+      vscodeServer: { type: "stdio", command: "npx", args: ["-y", "@netlify/mcp"] },
+      cursorServer: { command: "npx", args: ["-y", "@netlify/mcp"] },
+      keyInstructions: "Netlify MCP uses Netlify authentication from the IDE or CLI. Finish the browser sign-in or token prompt it opens."
+    },
+    verification: { supportsReadOnly: false }
+  }),
+  provider("render", "Render", ["render", "rendercom"], ["deployment"], ["deployment"], "render", {
+    docsUrl: "https://render.com/docs",
+    dashboardUrl: "https://dashboard.render.com"
+  }),
+  provider("railway", "Railway", ["railway", "railwayapp"], ["deployment"], ["deployment"], "railway", {
+    docsUrl: "https://docs.railway.com",
+    dashboardUrl: "https://railway.com"
+  }),
+  provider("cloudflare", "Cloudflare", ["cloudflare", "cloudflarepages", "workers"], ["deployment"], ["deployment"], "cloudflare", {
+    docsUrl: "https://developers.cloudflare.com",
+    dashboardUrl: "https://dash.cloudflare.com",
+    mcp: {
+      label: "Cloudflare",
+      serverName: "cloudflare-api",
+      vscodeServer: { type: "http", url: "https://mcp.cloudflare.com/mcp" },
+      cursorServer: { url: "https://mcp.cloudflare.com/mcp" },
+      keyInstructions: "Cloudflare MCP uses Cloudflare account authentication. Finish browser sign-in or provide an API token only when prompted."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("aws", "AWS", ["aws"], ["deployment"], ["deployment"], "aws", {
+    docsUrl: "https://docs.aws.amazon.com",
+    dashboardUrl: "https://console.aws.amazon.com"
+  }),
+  provider("sentry", "Sentry", ["sentry"], ["monitoring", "errorHandling"], ["monitoring"], "sentry", {
+    docsUrl: "https://docs.sentry.io",
+    dashboardUrl: "https://sentry.io",
+    mcp: {
+      label: "Sentry",
+      serverName: "sentry",
+      vscodeServer: { type: "http", url: "https://mcp.sentry.dev/mcp" },
+      cursorServer: { url: "https://mcp.sentry.dev/mcp" },
+      keyInstructions: "Sentry MCP is a remote MCP server. Finish the IDE/browser authentication flow; only use a Sentry auth token for separate local or CLI fallback setups."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("posthog", "PostHog", ["posthog"], ["monitoring", "errorHandling", "landing"], ["monitoring"], "posthog", {
+    docsUrl: "https://posthog.com/docs",
+    dashboardUrl: "https://app.posthog.com",
+    mcp: {
+      label: "PostHog",
+      serverName: "posthog",
+      vscodeServer: { type: "http", url: "https://mcp.posthog.com/mcp" },
+      cursorServer: { url: "https://mcp.posthog.com/mcp" },
+      keyInstructions: "PostHog MCP opens an authentication flow. Use a PostHog personal API key only if the IDE or local fallback asks for one."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("logrocket", "LogRocket", ["logrocket"], ["monitoring"], ["monitoring"], "logrocket", {
+    docsUrl: "https://docs.logrocket.com",
+    dashboardUrl: "https://app.logrocket.com"
+  }),
+  provider("github", "GitHub Actions", ["github", "githubactions"], ["testing"], [], "github", {
+    docsUrl: "https://docs.github.com/actions",
+    dashboardUrl: "https://github.com",
+    mcp: {
+      label: "GitHub",
+      serverName: "github",
+      vscodeServer: { type: "http", url: "https://api.githubcopilot.com/mcp/" },
+      cursorServer: { url: "https://api.githubcopilot.com/mcp/" },
+      keyInstructions: "GitHub MCP should use IDE/GitHub authentication. Use read-only repository, Actions, and branch-protection queries for verification."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("playwright", "Playwright", ["playwright", "playwrighttest"], ["testing"], [], "playwright", {
+    docsUrl: "https://playwright.dev/docs/intro",
+    mcp: {
+      label: "Playwright",
+      serverName: "playwright",
+      vscodeServer: { type: "stdio", command: "npx", args: ["-y", "@playwright/mcp@latest"] },
+      cursorServer: { command: "npx", args: ["-y", "@playwright/mcp@latest"] },
+      keyInstructions: "Playwright MCP runs locally through npx and normally does not need an API key."
+    },
+    verification: { supportsReadOnly: false }
+  }),
+  provider("rate-limit", "Rate limiting", ["upstash", "upstashratelimit", "ratelimit", "ratelimiting", "expressratelimit"], ["security"], ["security"], "rate-limit", {
+    docsUrl: "https://upstash.com/docs/redis/sdks/ratelimit/overview",
+    dashboardUrl: "https://console.upstash.com",
+    mcp: {
+      label: "Upstash",
+      serverName: "upstash",
+      vscodeServer: { type: "stdio", command: "npx", args: ["-y", "@upstash/mcp-server@latest", "--email", "<UPSTASH_EMAIL>", "--api-key", "<UPSTASH_API_KEY>"] },
+      cursorServer: { command: "npx", args: ["-y", "@upstash/mcp-server@latest", "--email", "<UPSTASH_EMAIL>", "--api-key", "<UPSTASH_API_KEY>"] },
+      keyInstructions: "Upstash MCP needs your Upstash account email and API key. Replace the placeholders before enabling the server."
+    },
+    verification: { supportsReadOnly: false }
+  }),
+  provider("bot-protection", "Bot protection", ["botprotection", "cloudflareturnstile", "turnstile"], ["security"], ["security"], "bot-protection", {
+    docsUrl: "https://developers.cloudflare.com/turnstile",
+    dashboardUrl: "https://dash.cloudflare.com",
+    mcp: {
+      label: "Cloudflare",
+      serverName: "cloudflare-api",
+      vscodeServer: { type: "http", url: "https://mcp.cloudflare.com/mcp" },
+      cursorServer: { url: "https://mcp.cloudflare.com/mcp" },
+      keyInstructions: "Cloudflare MCP uses Cloudflare account authentication. Finish browser sign-in or provide an API token only when prompted."
+    },
+    verification: { supportsReadOnly: true }
+  }),
+  provider("secrets-hygiene", "Secrets hygiene", ["secretshygiene", "envhygiene"], ["security"], ["security"], "secrets-hygiene"),
+  provider("figma", "Figma", ["figma"], ["appFlow"], [], "figma", { docsUrl: "https://help.figma.com" }),
+  provider("storybook", "Storybook", ["storybook"], ["appFlow"], [], "storybook", { docsUrl: "https://storybook.js.org/docs" }),
+  provider("product-spec", "Product Spec", ["productspec", "prd"], ["appFlow"], [], "product-spec"),
+  provider("route-map", "Route Map", ["routemap", "routes"], ["appFlow"], [], "route-map"),
+  provider("react", "React", ["react", "reactjs"], ["frontend"], [], "react", { docsUrl: "https://react.dev" }),
+  provider("vue", "Vue", ["vue", "vuejs"], ["frontend"], [], "vue", { docsUrl: "https://vuejs.org/guide" }),
+  provider("svelte", "Svelte", ["svelte", "sveltekit"], ["frontend"], [], "svelte", { docsUrl: "https://svelte.dev/docs" }),
+  provider("angular", "Angular", ["angular"], ["frontend"], [], "angular", { docsUrl: "https://angular.dev" }),
+  provider("node", "Node.js", ["node", "nodejs", "node.js"], ["backend"], [], "nodejs", { docsUrl: "https://nodejs.org/docs/latest/api" }),
+  provider("python", "Python / FastAPI", ["python", "pythonfastapi", "fastapi"], ["backend"], [], "python", { docsUrl: "https://fastapi.tiangolo.com" }),
+  provider("rails", "Rails", ["rails", "rubyonrails"], ["backend"], [], "rails", { docsUrl: "https://guides.rubyonrails.org" }),
+  provider("go", "Go", ["go", "golang"], ["backend"], [], "go", { docsUrl: "https://go.dev/doc" }),
+  provider("vitest", "Vitest", ["vitest"], ["testing"], [], "vitest", { docsUrl: "https://vitest.dev" })
+];
+var PROVIDERS_BY_KEY = new Map(PROVIDERS.map((entry) => [entry.provider, entry]));
+var PROVIDERS_BY_ALIAS = /* @__PURE__ */ new Map();
+for (const entry of PROVIDERS) {
+  PROVIDERS_BY_ALIAS.set(normalizeProviderToken(entry.provider), entry);
+  for (const alias of entry.aliases) {
+    PROVIDERS_BY_ALIAS.set(normalizeProviderToken(alias), entry);
+  }
+}
+function productionProviders() {
+  return PROVIDERS.filter(isProductionProviderSeed).map((entry) => entry.provider);
+}
+function productionProvidersByArea() {
+  return {
+    database: providersForProductionArea("database"),
+    auth: providersForProductionArea("auth"),
+    payments: providersForProductionArea("payments"),
+    deployment: providersForProductionArea("deployment"),
+    monitoring: providersForProductionArea("monitoring"),
+    security: providersForProductionArea("security")
+  };
+}
+function provider(providerKey, label, aliases, areas, productionAreas, iconKey, extras = {}) {
+  const sifgTemplateIds = areas.flatMap((area) => sifgTemplatesForRegistryProviderArea(providerKey, area)).map((template) => template.id);
+  return {
+    provider: providerKey,
+    label,
+    aliases,
+    areas,
+    productionAreas,
+    iconKey,
+    verifiedAt: "2026-05-18",
+    ...sifgTemplateIds.length > 0 ? { sifgTemplateIds } : {},
+    ...extras
+  };
+}
+function providersForProductionArea(area) {
+  return PROVIDERS.filter(isProductionProviderSeed).filter((entry) => entry.productionAreas.includes(area)).map((entry) => entry.provider);
+}
+function isProductionProviderSeed(entry) {
+  return entry.productionAreas.length > 0;
+}
+function normalizeProviderToken(provider2) {
+  return provider2.toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "");
+}
+
+// ../../src/station/productionConnections.ts
+var PROVIDERS2 = productionProviders();
+var PROVIDERS_BY_AREA = productionProvidersByArea();
+var PROVIDER_RULES = freezeProviderRules([
+  {
+    area: "database",
+    provider: "supabase",
+    label: "Supabase",
+    packages: [/@supabase\//],
+    env: ["VITE_SUPABASE_URL", "NEXT_PUBLIC_SUPABASE_URL", "SUPABASE_URL", "SUPABASE_SERVICE_ROLE_KEY"],
+    paths: [/supabase\/config\.toml$/, /(^|\/)(lib|utils)\/supabase\.[jt]s$/],
+    imports: ["@supabase/supabase-js", "@supabase/ssr"],
+    docs: ["supabase"]
+  },
+  {
+    area: "database",
+    provider: "firebase",
+    label: "Firebase",
+    packages: [/^firebase$/, /^firebase-admin$/, /@firebase\//],
+    env: ["FIREBASE_PROJECT_ID", "NEXT_PUBLIC_FIREBASE_PROJECT_ID", "VITE_FIREBASE_PROJECT_ID", "GOOGLE_APPLICATION_CREDENTIALS"],
+    paths: [/firebase/, /firestore/],
+    imports: ["firebase/app", "firebase/firestore", "firebase-admin"],
+    content: [{ pattern: /getFirestore\s*\(|collection\s*\(|firebase-admin/i, signal: "code: Firebase/Firestore usage" }],
+    docs: ["firebase", "firestore"]
+  },
+  {
+    area: "database",
+    provider: "neon",
+    label: "Neon",
+    packages: [/@neondatabase\//],
+    env: ["NEON_DATABASE_URL"],
+    imports: ["@neondatabase/serverless"],
+    docs: ["neon"]
+  },
+  {
+    area: "database",
+    provider: "planetscale",
+    label: "PlanetScale",
+    packages: [/@planetscale\/database/],
+    env: ["PLANETSCALE_DATABASE_URL"],
+    imports: ["@planetscale/database"],
+    docs: ["planetscale"]
+  },
+  {
+    area: "database",
+    provider: "mongodb",
+    label: "MongoDB",
+    packages: [/^mongodb$/, /^mongoose$/],
+    env: ["MONGODB_URI", "MONGODB_URL", "MONGODB_ATLAS_URI"],
+    imports: ["mongodb", "mongoose"],
+    docs: ["mongodb", "mongo atlas"]
+  },
+  {
+    area: "database",
+    provider: "turso",
+    label: "Turso",
+    packages: [/@libsql\/client/],
+    env: ["TURSO_DATABASE_URL", "TURSO_AUTH_TOKEN"],
+    imports: ["@libsql/client"],
+    docs: ["turso"]
+  },
+  {
+    area: "auth",
+    provider: "clerk",
+    label: "Clerk",
+    packages: [/@clerk\//],
+    env: ["CLERK_SECRET_KEY", "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY"],
+    paths: [/middleware\.[jt]sx?$/],
+    imports: ["@clerk/nextjs", "@clerk/clerk-react", "@clerk/express"],
+    docs: ["clerk"]
+  },
+  {
+    area: "auth",
+    provider: "authjs",
+    label: "Auth.js",
+    packages: [/^next-auth$/, /^@auth\//],
+    env: ["AUTH_SECRET", "NEXTAUTH_SECRET", "NEXTAUTH_URL"],
+    paths: [/api\/auth\//],
+    imports: ["next-auth", "@auth/core", "@auth/nextjs"],
+    content: [{ pattern: /NextAuth\s*\(|getServerSession|useSession\s*\(/i, signal: "code: Auth.js session or route handler" }],
+    docs: ["auth.js", "nextauth", "next-auth"]
+  },
+  {
+    area: "auth",
+    provider: "auth0",
+    label: "Auth0",
+    packages: [/@auth0\//],
+    env: ["AUTH0_SECRET", "AUTH0_ISSUER_BASE_URL", "AUTH0_CLIENT_ID", "AUTH0_CLIENT_SECRET", "AUTH0_DOMAIN"],
+    paths: [/api\/auth/, /auth0/],
+    imports: ["@auth0/nextjs-auth0", "@auth0/auth0-react", "express-openid-connect"],
+    content: [{ pattern: /handleAuth|withPageAuthRequired|withApiAuthRequired|getSession/i, signal: "code: Auth0 session or route protection" }],
+    docs: ["auth0"]
+  },
+  {
+    area: "auth",
+    provider: "better-auth",
+    label: "Better Auth",
+    packages: [/^better-auth$/],
+    env: ["BETTER_AUTH_SECRET", "BETTER_AUTH_URL", "AUTH_SECRET", "DATABASE_URL"],
+    paths: [/better-auth/, /auth\.[jt]s$/],
+    imports: ["better-auth"],
+    content: [{ pattern: /betterAuth\s*\(|auth\.api|auth\.handler/i, signal: "code: Better Auth config" }],
+    docs: ["better auth", "better-auth"]
+  },
+  {
+    area: "payments",
+    provider: "stripe",
+    label: "Stripe",
+    packages: [/^stripe$/, /@stripe\//],
+    env: ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY"],
+    paths: [/stripe.*webhook/, /webhook.*stripe/, /stripe.*checkout/, /checkout.*stripe/],
+    imports: ["stripe", "@stripe/stripe-js"],
+    docs: ["stripe"]
+  },
+  {
+    area: "payments",
+    provider: "paddle",
+    label: "Paddle",
+    packages: [/@paddle\//],
+    env: ["PADDLE_API_KEY", "PADDLE_WEBHOOK_SECRET", "NEXT_PUBLIC_PADDLE_CLIENT_TOKEN"],
+    paths: [/paddle.*webhook/, /webhook.*paddle/, /paddle.*checkout/, /checkout.*paddle/],
+    imports: ["@paddle/paddle-js", "@paddle/paddle-node-sdk"],
+    docs: ["paddle"]
+  },
+  {
+    area: "payments",
+    provider: "polar",
+    label: "Polar",
+    packages: [/@polar-sh\//],
+    env: ["POLAR_ACCESS_TOKEN", "POLAR_WEBHOOK_SECRET", "POLAR_PRODUCT_ID", "POLAR_PRO_PRODUCT_ID"],
+    paths: [/polar.*webhook/, /webhook.*polar/, /polar.*checkout/, /checkout.*polar/],
+    imports: ["@polar-sh/sdk"],
+    content: [{ pattern: /api\.polar\.sh|polar.*checkout|createCheckoutSession/i, signal: "code: Polar checkout or API usage" }],
+    docs: ["polar"]
+  },
+  {
+    area: "payments",
+    provider: "lemon-squeezy",
+    label: "Lemon Squeezy",
+    packages: [/@lemonsqueezy\//, /^lemonsqueezy\.ts$/],
+    env: ["LEMON_SQUEEZY_API_KEY", "LEMONSQUEEZY_API_KEY", "LEMON_SQUEEZY_WEBHOOK_SECRET", "LEMON_SQUEEZY_STORE_ID", "LEMON_SQUEEZY_VARIANT_ID"],
+    paths: [/lemon.*webhook/, /webhook.*lemon/, /lemon.*checkout/, /checkout.*lemon/, /lemonsqueezy/],
+    imports: ["@lemonsqueezy/lemonsqueezy.js", "lemonsqueezy.ts"],
+    content: [{ pattern: /api\.lemonsqueezy\.com|lemon.*checkout|checkout_url|variant_id/i, signal: "code: Lemon Squeezy checkout or API usage" }],
+    docs: ["lemon squeezy", "lemonsqueezy"]
+  },
+  {
+    area: "deployment",
+    provider: "vercel",
+    label: "Vercel",
+    packages: [/@vercel\//],
+    env: ["VERCEL_TOKEN", "VERCEL_PROJECT_ID", "VERCEL_ORG_ID"],
+    paths: [/vercel\.json$/],
+    docs: ["vercel"]
+  },
+  {
+    area: "deployment",
+    provider: "netlify",
+    label: "Netlify",
+    packages: [/@netlify\//],
+    env: ["NETLIFY_AUTH_TOKEN", "NETLIFY_SITE_ID"],
+    paths: [/netlify\.toml$/, /\.netlify\//, /(^|\/)_redirects$/],
+    imports: ["@netlify/functions"],
+    docs: ["netlify"]
+  },
+  {
+    area: "deployment",
+    provider: "render",
+    label: "Render",
+    env: ["RENDER_API_KEY", "RENDER_SERVICE_ID"],
+    paths: [/render\.ya?ml$/, /(^|\/)\.render\//],
+    content: [{ pattern: /render\.yaml|render\.yml|render deploy|render service/i, signal: "code: Render deployment config" }],
+    docs: ["render.com", "render deployment"]
+  },
+  {
+    area: "deployment",
+    provider: "railway",
+    label: "Railway",
+    env: ["RAILWAY_TOKEN", "RAILWAY_PROJECT_ID", "RAILWAY_SERVICE_ID"],
+    paths: [/railway\.json$/, /nixpacks\.toml$/, /(^|\/)Procfile$/],
+    content: [{ pattern: /railway up|railway deploy|nixpacks|railway\.json/i, signal: "code: Railway deployment config" }],
+    docs: ["railway"]
+  },
+  {
+    area: "deployment",
+    provider: "cloudflare",
+    label: "Cloudflare",
+    packages: [/^wrangler$/, /@cloudflare\//],
+    env: ["CLOUDFLARE_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID", "CF_PAGES"],
+    paths: [/wrangler\.toml$/, /wrangler\.json$/, /(^|\/)_headers$/, /(^|\/)_redirects$/],
+    imports: ["@cloudflare/workers-types"],
+    content: [{ pattern: /compatibility_date|pages_build_output_dir|cloudflare pages|cloudflare workers/i, signal: "code: Cloudflare Pages/Workers config" }],
+    docs: ["cloudflare", "workers", "pages"]
+  },
+  {
+    area: "deployment",
+    provider: "aws",
+    label: "AWS",
+    packages: [/@aws-sdk\//, /^aws-cdk-lib$/, /^serverless$/],
+    env: ["AWS_REGION", "AWS_ACCESS_KEY_ID"],
+    paths: [/serverless\.ya?ml$/, /template\.ya?ml$/, /cdk\.json$/, /amplify\//],
+    imports: ["aws-sdk", "@aws-sdk/client"],
+    docs: ["aws", "amplify", "serverless"]
+  },
+  {
+    area: "monitoring",
+    provider: "sentry",
+    label: "Sentry",
+    packages: [/@sentry\//],
+    env: ["SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN", "SENTRY_AUTH_TOKEN"],
+    paths: [/sentry\.(client|server)\.config\.[jt]s$/, /instrumentation\.[jt]s$/],
+    imports: ["@sentry/nextjs", "@sentry/node", "@sentry/react"],
+    content: [{ pattern: /sentry\.init\s*\(/i, signal: "init: Sentry.init" }],
+    docs: ["sentry"]
+  },
+  {
+    area: "monitoring",
+    provider: "posthog",
+    label: "PostHog",
+    packages: [/^posthog-js$/, /^posthog-node$/],
+    env: ["POSTHOG_KEY", "NEXT_PUBLIC_POSTHOG_KEY", "NEXT_PUBLIC_POSTHOG_HOST"],
+    imports: ["posthog-js", "posthog-node"],
+    content: [{ pattern: /posthog\.init\s*\(/i, signal: "init: posthog.init" }],
+    docs: ["posthog"]
+  },
+  {
+    area: "monitoring",
+    provider: "logrocket",
+    label: "LogRocket",
+    packages: [/^logrocket$/],
+    env: ["LOGROCKET_APP_ID", "NEXT_PUBLIC_LOGROCKET_APP_ID"],
+    imports: ["logrocket"],
+    content: [{ pattern: /logrocket\.init\s*\(/i, signal: "init: LogRocket.init" }],
+    docs: ["logrocket"]
+  },
+  {
+    area: "security",
+    provider: "rate-limit",
+    label: "Upstash rate limit",
+    packages: [/@upstash\/ratelimit/, /express-rate-limit/, /rate-limiter-flexible/, /@fastify\/rate-limit/],
+    env: ["UPSTASH_REDIS_REST_URL", "UPSTASH_REDIS_REST_TOKEN"],
+    paths: [/rate-?limit/, /ratelimit/],
+    imports: ["@upstash/ratelimit", "express-rate-limit", "rate-limiter-flexible", "@fastify/rate-limit"],
+    content: [{ pattern: /\brateLimit\b|\bRatelimit\b|\bToo many requests\b/i, signal: "code: rate limit guard" }],
+    docs: ["upstash", "rate limit"]
+  },
+  {
+    area: "security",
+    provider: "bot-protection",
+    label: "Cloudflare Turnstile",
+    packages: [/turnstile/],
+    env: ["NEXT_PUBLIC_TURNSTILE_SITE_KEY", "TURNSTILE_SECRET_KEY", "TURNSTILE_SITE_KEY"],
+    paths: [/turnstile/, /bot.?protection/],
+    imports: ["@marsidev/react-turnstile", "react-turnstile"],
+    content: [{ pattern: /\bturnstile\b|\bcf-turnstile\b|\brecaptcha\b|\bhcaptcha\b/i, signal: "code: bot protection guard" }],
+    docs: ["turnstile", "cloudflare turnstile", "bot protection"]
+  }
+]);
+function freezeProviderRules(rules) {
+  for (const rule of rules) {
+    Object.freeze(rule.packages ?? []);
+    Object.freeze(rule.env ?? []);
+    Object.freeze(rule.paths ?? []);
+    Object.freeze(rule.imports ?? []);
+    Object.freeze(rule.docs ?? []);
+    if (rule.content) {
+      for (const item of rule.content) {
+        Object.freeze(item);
+      }
+      Object.freeze(rule.content);
+    }
+    Object.freeze(rule);
+  }
+  return Object.freeze(rules);
+}
+
+// src/localStation.ts
+var import_node_child_process3 = require("node:child_process");
+var import_node_util3 = require("node:util");
+
+// src/sanitizeArtifact.ts
+var SENSITIVE_KEY = "DATABASE_URL|ACCESS_TOKEN|AUTHORIZATION|API_KEY|SECRET|SECRET_KEY|SERVICE_ROLE_KEY|TOKEN|PASSWORD|PRIVATE_KEY|CREDENTIALS?";
+var SENSITIVE_ASSIGNMENT = new RegExp(
+  `\\b([A-Za-z0-9_]*(?:${SENSITIVE_KEY})[A-Za-z0-9_]*)\\s*=\\s*["']?[^"'\\s;,]+["']?`,
+  "gi"
+);
+var SENSITIVE_COLON_ASSIGNMENT = new RegExp(
+  `(["']?)\\b([A-Za-z0-9_]*(?:${SENSITIVE_KEY})[A-Za-z0-9_]*)\\1\\s*:\\s*(?:"([^"]*)"|'([^']*)'|([^\\s,;}\\]]+))`,
+  "gi"
+);
+
+// src/commands/audit.ts
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".next", "dist", "build", "coverage"]);
+var SOURCE_SKIP_DIRS = /* @__PURE__ */ new Set([
+  ...SKIP_DIRS,
+  ".viberaven",
+  ".vercel",
+  ".turbo",
+  ".svelte-kit",
+  ".nuxt",
+  ".output",
+  ".expo",
+  ".cache",
+  ".idea",
+  ".vscode",
+  "out",
+  "vendor",
+  "ios",
+  "android"
+]);
+var SOURCE_LIMITS = {
+  /** Directory entries listed, across the whole walk. */
+  entries: 2e5,
+  depth: 25,
+  /** Files kept in memory. */
+  files: 5e3,
+  /** A code file up to this size is read to test for Supabase text; bigger ones are reported unread. */
+  fileBytes: 32e6,
+  /** Total size of the files kept. */
+  totalBytes: 64e6
+};
+
+// src/databaseEvidence.ts
+var import_node_child_process2 = require("node:child_process");
+var import_node_util2 = require("node:util");
+
+// src/safeGit.ts
+var import_node_child_process = require("node:child_process");
+var import_promises = require("node:fs/promises");
+var import_node_path = require("node:path");
+var import_node_util = require("node:util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
+var NULL_DEVICE = process.platform === "win32" ? "NUL" : "/dev/null";
+var HARDENING_CONFIG = [
+  ["core.fsmonitor", "false"],
+  ["core.untrackedCache", "false"],
+  ["core.hooksPath", NULL_DEVICE],
+  ["log.showSignature", "false"],
+  ["submodule.recurse", "false"]
+];
+var ENV_CONFIG_SINCE = [2, 31];
+var SHOW_SCOPE_SINCE = [2, 26];
+var WORKTREE_COMMANDS = /* @__PURE__ */ new Set(["status", "checkout", "switch", "restore", "reset", "stash", "add", "diff"]);
+var WRITE_COMMANDS = /* @__PURE__ */ new Set(["checkout", "switch", "restore", "reset", "stash", "add"]);
+var TREE_DIFF_OPTIONS = /* @__PURE__ */ new Set(["--no-color", "--shortstat", "--stat", "--numstat", "--name-only", "--name-status", "--patch", "-p", "--no-ext-diff", "--no-textconv"]);
+var DIFF_COMMANDS = /* @__PURE__ */ new Set(["diff", "log", "show"]);
+var TRUSTED_SCOPES = /* @__PURE__ */ new Set(["system", "global"]);
+var QUERY_TIMEOUT_MS = 1500;
+var SafeGitRefusal = class extends Error {
+  name = "SafeGitRefusal";
+};
+var listConfigWithGit = async (cwd, args, env) => (await execFileAsync("git", args, { cwd, env, timeout: QUERY_TIMEOUT_MS, windowsHide: true, encoding: "utf8" })).stdout;
+var versionOverride;
+var versionLookup;
+var configLister = listConfigWithGit;
+function atLeast(version, minimum) {
+  return version[0] !== minimum[0] ? version[0] > minimum[0] : version[1] >= minimum[1];
+}
+async function gitVersion() {
+  if (versionOverride) return versionOverride;
+  versionLookup ??= execFileAsync("git", ["--version"], { timeout: QUERY_TIMEOUT_MS * 2, windowsHide: true, encoding: "utf8" }).then(
+    ({ stdout }) => {
+      const match = /(\d+)\.(\d+)/.exec(stdout);
+      if (!match) throw new Error(`Unrecognised git version: ${stdout.trim()}`);
+      return [Number(match[1]), Number(match[2])];
+    }
+  );
+  const lookup = versionLookup;
+  lookup.catch(() => {
+    if (versionLookup === lookup) versionLookup = void 0;
+  });
+  return lookup;
+}
+function baseEnv(touchesWorktree) {
+  return {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_OPTIONAL_LOCKS: "0",
+    ...touchesWorktree ? {} : { GIT_CONFIG_NOSYSTEM: "1" }
+  };
+}
+function withEnvConfig(env, entries) {
+  const existing = Number.parseInt(env.GIT_CONFIG_COUNT ?? "0", 10);
+  let index = Number.isInteger(existing) && existing > 0 ? existing : 0;
+  const out = { ...env };
+  for (const [key, value] of entries) {
+    out[`GIT_CONFIG_KEY_${index}`] = key;
+    out[`GIT_CONFIG_VALUE_${index}`] = value;
+    index += 1;
+  }
+  out.GIT_CONFIG_COUNT = String(index);
+  return out;
+}
+function deliver(version, entries, env) {
+  if (atLeast(version, ENV_CONFIG_SINCE)) return { args: [], env: withEnvConfig(env, entries) };
+  return { args: entries.flatMap(([key, value]) => ["-c", `${key}=${value}`]), env };
+}
+function subcommandFlags(command) {
+  const flags = [];
+  if (DIFF_COMMANDS.has(command)) flags.push("--no-ext-diff", "--no-textconv");
+  if (command === "status") flags.push("--ignore-submodules=all");
+  return flags;
+}
+function parseFilterNames(stdout, scoped) {
+  const fields = stdout.split("\0");
+  const names = /* @__PURE__ */ new Set();
+  for (let i = 0; i < fields.length; i += scoped ? 2 : 1) {
+    const scope = scoped ? fields[i] : "";
+    const key = scoped ? fields[i + 1] : fields[i];
+    if (!key || scoped && TRUSTED_SCOPES.has(scope)) continue;
+    const match = /^filter\.([\s\S]+)\.[^.]+$/i.exec(key);
+    if (match) names.add(match[1]);
+  }
+  return [...names];
+}
+async function untrustedFilterNames(cwd, version) {
+  const scoped = atLeast(version, SHOW_SCOPE_SINCE);
+  const hardened = deliver(version, HARDENING_CONFIG, baseEnv(true));
+  const args = [...hardened.args, "config", "-z", ...scoped ? ["--show-scope"] : [], "--name-only", "--get-regexp", "^filter\\."];
+  let stdout;
+  try {
+    stdout = await configLister(cwd, args, hardened.env);
+  } catch (error) {
+    if (error.code !== 1) throw error;
+    stdout = "";
+  }
+  return parseFilterNames(stdout, scoped);
+}
+function comparablePath(path2, platform = process.platform) {
+  const unified = path2.replace(/\\/g, "/").replace(/\/+$/, "");
+  return platform === "win32" ? unified.toLowerCase() : unified;
+}
+function samePath(a, b, platform = process.platform) {
+  return comparablePath(a, platform) === comparablePath(b, platform);
+}
+async function discoveredRoot(cwd) {
+  let dir = await (0, import_promises.realpath)(cwd);
+  for (; ; ) {
+    try {
+      await (0, import_promises.stat)((0, import_node_path.join)(dir, ".git"));
+      return dir;
+    } catch {
+      const parent = (0, import_node_path.dirname)(dir);
+      if (parent === dir) return void 0;
+      dir = parent;
+    }
+  }
+}
+async function assertWorkTreeIsHere(cwd, command, version) {
+  const root = await discoveredRoot(cwd);
+  if (!root) throw new SafeGitRefusal(`"git ${command}" was not run: no .git was found at or above ${cwd}.`);
+  const hardened = deliver(version, HARDENING_CONFIG, baseEnv(true));
+  const { stdout } = await execFileAsync("git", [...hardened.args, "rev-parse", "--show-toplevel"], {
+    cwd,
+    env: hardened.env,
+    timeout: QUERY_TIMEOUT_MS,
+    windowsHide: true,
+    encoding: "utf8"
+  });
+  const reported = stdout.trim();
+  const top = reported ? await (0, import_promises.realpath)(reported).catch(() => reported) : "";
+  if (!samePath(top, root)) {
+    throw new SafeGitRefusal(
+      `"git ${command}" was not run: this repo's git settings put its working tree at ${top || "an unknown folder"}, not ${root}.`
+    );
+  }
+  return root;
+}
+async function realOrResolved(path2) {
+  return (0, import_promises.realpath)(path2).catch(() => path2);
+}
+async function assertRepositoryBelongsHere(root, command) {
+  const dotGit = (0, import_node_path.join)(root, ".git");
+  const entry = await (0, import_promises.lstat)(dotGit);
+  if (entry.isDirectory()) return;
+  let gitDir;
+  if (entry.isSymbolicLink()) {
+    gitDir = await realOrResolved(dotGit);
+  } else {
+    const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(await (0, import_promises.readFile)(dotGit, "utf8"));
+    if (!pointer) throw new SafeGitRefusal(`"git ${command}" was not run: ${dotGit} is a file without a gitdir line.`);
+    gitDir = await realOrResolved((0, import_node_path.resolve)(root, pointer[1]));
+  }
+  if (comparablePath(gitDir).includes("/.git/modules/")) return;
+  try {
+    await (0, import_promises.stat)((0, import_node_path.join)(gitDir, "commondir"));
+    const back = (await (0, import_promises.readFile)((0, import_node_path.join)(gitDir, "gitdir"), "utf8")).trim();
+    if (samePath(await realOrResolved((0, import_node_path.resolve)(gitDir, back)), await realOrResolved(dotGit))) return;
+  } catch {
+  }
+  throw new SafeGitRefusal(
+    `"git ${command}" was not run: .git here points to ${gitDir}, which is not a linked worktree or submodule of this folder, so it would change that other repository.`
+  );
+}
+function isTreeToTreeDiff(rest) {
+  const end = rest.indexOf("--");
+  const before = end === -1 ? rest : rest.slice(0, end);
+  if (before.some((arg) => arg.startsWith("-") && !TREE_DIFF_OPTIONS.has(arg))) return false;
+  const revisions = before.filter((arg) => !arg.startsWith("-"));
+  return revisions.length === 2 || revisions.length === 1 && revisions[0].includes("..");
+}
+function readsWorkingTree(command, rest) {
+  if (command === "diff") return !isTreeToTreeDiff(rest);
+  return WORKTREE_COMMANDS.has(command);
+}
+function asRefusal(error, command) {
+  if (error instanceof SafeGitRefusal) return error;
+  const detail = (error instanceof Error ? error.message : String(error)).split(/\r?\n/).find((line) => line.trim()) ?? "unknown error";
+  return new SafeGitRefusal(`"git ${command}" was not run: git could not check this repo's settings (${detail.trim()}).`, { cause: error });
+}
+function filterOverrides(names) {
+  return names.flatMap((name) => [
+    [`filter.${name}.clean`, ""],
+    [`filter.${name}.smudge`, ""],
+    [`filter.${name}.process`, ""],
+    [`filter.${name}.required`, "false"]
+  ]);
+}
+async function safeGitInvocation(cwd, args) {
+  const [command = "", ...rest] = args;
+  const version = await gitVersion();
+  const touchesWorktree = readsWorkingTree(command, rest);
+  let entries = HARDENING_CONFIG;
+  if (touchesWorktree) {
+    let names;
+    try {
+      const root = await assertWorkTreeIsHere(cwd, command, version);
+      if (WRITE_COMMANDS.has(command)) await assertRepositoryBelongsHere(root, command);
+      names = await untrustedFilterNames(cwd, version);
+    } catch (error) {
+      throw asRefusal(error, command);
+    }
+    if (!atLeast(version, ENV_CONFIG_SINCE)) {
+      const unsafe = names.find((name) => /[=\u0000-\u001f\u007f]/.test(name));
+      if (unsafe !== void 0) {
+        throw new SafeGitRefusal(
+          `"git ${command}" was not run: this repo defines a git filter named ${JSON.stringify(unsafe)}, which git ${version.join(".")} cannot be told to switch off. Update git to 2.31 or newer.`
+        );
+      }
+    }
+    entries = [...HARDENING_CONFIG, ...filterOverrides(names)];
+  }
+  const delivered = deliver(version, entries, baseEnv(touchesWorktree));
+  return {
+    args: [...delivered.args, command, ...subcommandFlags(command), ...rest],
+    env: delivered.env
+  };
+}
+
+// src/databaseEvidence.ts
+var DATABASE_CODE_PATTERNS = {
+  js: /['"](?:@supabase\/[\w-]+|pg|postgres|slonik|@electric-sql\/pglite|@neondatabase\/serverless|@vercel\/postgres|@prisma\/client|drizzle-orm(?:\/[\w-]+)?|mongoose|mongodb)['"]|@supabase\/supabase-js|\bsupabase\.createClient\(/,
+  deno: /deno\.land\/x\/postgres|\bnpm:(?:postgres|pg)\b|\bjsr:@supabase\//,
+  dart: /\bpackage:(?:supabase_flutter|supabase|postgres)\//,
+  python: /^\s*(?:from|import)\s+(?:supabase|psycopg2?|sqlalchemy|sqlmodel|asyncpg|alembic)\b/m,
+  go: /github\.com\/(?:lib\/pq|jackc\/pgx|go-sql-driver\/mysql)/,
+  php: /['"](?:pgsql|mysql):(?:host|dbname|unix_socket)=/,
+  connectionUrl: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\//,
+  envName: /\b[A-Z_]*SUPABASE_[A-Z_]+\b|\b[A-Z_]*(?:DATABASE|DB|POSTGRES|NEON)_(?:URL|URI|HOST)\b|\bMONGODB_URI\b/
+};
+var DATABASE_CODE_PATTERN_LIST = Object.values(DATABASE_CODE_PATTERNS);
+var execFileAsync2 = (0, import_node_util2.promisify)(import_node_child_process2.execFile);
+
+// src/localStation.ts
+var execFileAsync3 = (0, import_node_util3.promisify)(import_node_child_process3.execFile);
+var ENV_NAME = "[A-Z][A-Z0-9_]{2,}";
+var ENV_REFERENCES = [
+  new RegExp(`process\\.env\\??\\.(${ENV_NAME})\\b`, "g"),
+  new RegExp(`process\\.env\\??\\.?\\[\\s*['"\`](${ENV_NAME})['"\`]\\s*\\]`, "g"),
+  new RegExp(`import\\.meta\\.env\\??\\.(${ENV_NAME})\\b`, "g"),
+  new RegExp(`import\\.meta\\.env\\??\\.?\\[\\s*['"\`](${ENV_NAME})['"\`]\\s*\\]`, "g"),
+  new RegExp(`Deno\\.env\\.get\\(\\s*['"\`](${ENV_NAME})['"\`]\\s*\\)`, "g"),
+  new RegExp(`Bun\\.env\\.(${ENV_NAME})\\b`, "g"),
+  // Hono and Cloudflare Workers bindings: c.env.X
+  new RegExp(`\\b(?:c|ctx|context)\\.env\\.(${ENV_NAME})\\b`, "g")
+];
+
+// src/commands/checkChange.ts
+var execFileAsync4 = (0, import_node_util4.promisify)(import_node_child_process4.execFile);
+var MAX_BLOB_BYTES = SOURCE_LIMITS.fileBytes;
+var MAX_SNAPSHOT_BYTES = 128e6;
+var SKIP_SEGMENTS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", ".turbo", ".vercel", ".output", "dist", "build", "coverage"]);
+async function git(cwd, args) {
+  const call = await safeGitInvocation(cwd, args);
+  const { stdout } = await execFileAsync4("git", call.args, { cwd, env: call.env, windowsHide: true, maxBuffer: 64 * 1024 * 1024 });
+  return stdout;
+}
+function parseTree(output2) {
+  const entries = [];
+  for (const record2 of output2.split("\0")) {
+    if (!record2) continue;
+    const tab = record2.indexOf("	");
+    const [mode, type, sha2, size] = record2.slice(0, tab).trim().split(/\s+/);
+    entries.push({ mode, type, sha: sha2, size: Number.parseInt(size, 10) || 0, path: record2.slice(tab + 1) });
+  }
+  return entries;
+}
+function wanted(entry) {
+  if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") return false;
+  return !entry.path.split("/").some((segment) => SKIP_SEGMENTS.has(segment));
+}
+async function readBlobs(cwd, shas) {
+  const blobs = /* @__PURE__ */ new Map();
+  if (!shas.length) return blobs;
+  const call = await safeGitInvocation(cwd, ["cat-file", "--batch"]);
+  const output2 = await new Promise((resolveOutput, reject) => {
+    const child = (0, import_node_child_process4.spawn)("git", call.args, { cwd, env: call.env, windowsHide: true });
+    const chunks = [];
+    let stderr = "";
+    child.stdout.on("data", (chunk) => chunks.push(chunk));
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolveOutput(Buffer.concat(chunks)) : reject(new Error(stderr.trim() || `git cat-file exited with ${code}`)));
+    child.stdin.end(`${shas.join("\n")}
+`);
+  });
+  let offset = 0;
+  while (offset < output2.length) {
+    const newline = output2.indexOf(10, offset);
+    if (newline === -1) break;
+    const [sha2, type, sizeText] = output2.subarray(offset, newline).toString().split(" ");
+    offset = newline + 1;
+    if (type === "missing" || sizeText === void 0) continue;
+    const size = Number.parseInt(sizeText, 10);
+    blobs.set(sha2, output2.subarray(offset, offset + size));
+    offset += size + 1;
+  }
+  return blobs;
+}
+async function exportCommit(cwd, commit) {
+  const entries = parseTree(await git(cwd, ["ls-tree", "-r", "-z", "-l", "--full-tree", commit])).filter(wanted);
+  if (entries.some((entry) => entry.size > MAX_BLOB_BYTES) || entries.reduce((sum, entry) => sum + entry.size, 0) > MAX_SNAPSHOT_BYTES) {
+    throw new Error("Git snapshot exceeds the supported size limit (32 MB per file, 128 MB total). The comparison is incomplete.");
+  }
+  const blobs = await readBlobs(cwd, [...new Set(entries.map((entry) => entry.sha))]);
+  const root = await (0, import_promises2.mkdtemp)((0, import_node_path2.join)((0, import_node_os.tmpdir)(), "viberaven-base-"));
+  try {
+    for (const entry of entries) {
+      const target = (0, import_node_path2.resolve)(root, ...entry.path.split("/"));
+      if (!target.startsWith(root + import_node_path2.sep)) throw new Error("Invalid Git snapshot path");
+      const content = blobs.get(entry.sha);
+      if (!content || content.length !== entry.size) throw new Error("Git snapshot blob is missing or truncated");
+      await (0, import_promises2.mkdir)((0, import_node_path2.dirname)(target), { recursive: true });
+      await (0, import_promises2.writeFile)(target, content);
+    }
+    return root;
+  } catch (error) {
+    await (0, import_promises2.rm)(root, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }).catch(() => void 0);
+    throw error;
+  }
+}
+
+// src/version.ts
+var VERSION = "1.7.1";
+
+// src/github-ci/api.ts
+var import_node_zlib = require("node:zlib");
+
+// src/github-ci/report.ts
+var MAX_REPORT_BYTES = 65536;
+var MARKER = "<!-- viberaven-pr-feedback:v1 -->";
+var RULE_LABELS = Object.fromEntries([
+  "no_release_tags",
+  "scan_incomplete_service_role",
+  "secrets_in_repo",
+  "rls_disabled",
+  "rls_no_policies",
+  "rls_policy_allows_all_read",
+  "rls_policy_allows_all_write",
+  "security_definer_function_executable",
+  "data_api_grant_without_rls",
+  "data_api_grant_missing",
+  "service_role_key_in_client_env",
+  "service_role_key_in_client_code",
+  "service_role_boundary",
+  "pooler_port_unchecked",
+  "pooler_port_mismatch",
+  "auth_secret_missing",
+  "database_url_missing",
+  "missing_rate_limit",
+  "missing_csp_header",
+  "missing_error_boundary",
+  "missing_health_route",
+  "missing_loading_state",
+  "missing_404_page",
+  "unverified_stripe_webhook",
+  "missing_stripe_webhook",
+  "env_var_drift",
+  "unbounded_query",
+  "missing_image_optimization",
+  "missing_monitoring",
+  "openai_key_in_browser"
+].map((id) => [id, id === "rls_disabled" ? "Row level security disabled" : id.replace(/_/g, " ")]));
+var sha = (value) => typeof value === "string" && /^[a-f0-9]{40}$/.test(value);
+var positive = (value) => Number.isSafeInteger(value) && value > 0;
+var repositoryName = (value) => typeof value === "string" && /^[A-Za-z0-9_.-]{1,100}\/[A-Za-z0-9_.-]{1,100}$/.test(value);
+function record(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Expected object");
+  return value;
+}
+function exact(value, fields) {
+  if (Object.keys(value).some((k) => !fields.includes(k))) throw new Error("Unexpected field");
+}
+function findings(value, strict = false) {
+  if (!Array.isArray(value) || value.length > 100) throw new Error("Invalid findings");
+  return value.map((item) => {
+    const f = record(item);
+    if (strict) exact(f, ["id", "severity"]);
+    if (!Object.hasOwn(RULE_LABELS, f.id) || !["critical", "warning", "info"].includes(f.severity)) throw new Error("Unknown finding");
+    return { id: f.id, severity: f.severity };
+  });
+}
+function checkIdentity(i) {
+  if (!repositoryName(i.repository) || !repositoryName(i.headRepository) || !positive(i.repositoryId) || !positive(i.pr) || !sha(i.head) || !sha(i.base) || !positive(i.runId) || !positive(i.attempt) || i.version !== VERSION || i.validationRunId !== void 0 && !positive(i.validationRunId) || i.validationAttempt !== void 0 && !positive(i.validationAttempt)) throw new Error("Invalid identity");
+}
+function adaptCheckResult(identity, stdout, exitCode, durationMs) {
+  checkIdentity(identity);
+  const report = {
+    ...identity,
+    schema: 1,
+    status: "incomplete",
+    durationMs: Math.min(36e5, Math.max(0, Math.round(durationMs))),
+    mergeBase: null,
+    introduced: [],
+    resolved: [],
+    unchanged: [],
+    usageKey: `${identity.repositoryId}:${identity.pr}:${identity.head}`,
+    executionKey: `${identity.runId}:${identity.attempt}:${identity.validationRunId ?? identity.runId}:${identity.validationAttempt ?? identity.attempt}`
+  };
+  try {
+    if (Buffer.byteLength(stdout) > 4e6 || exitCode !== 0 && exitCode !== 1) return report;
+    const change = record(record(JSON.parse(stdout)).change);
+    if (change.base !== identity.base || !sha(change.baseCommit)) return report;
+    const detail = record(change.findings);
+    const introduced = findings(detail.introduced), resolved = findings(detail.resolved), unchanged = findings(detail.unchanged);
+    for (const [key, list] of Object.entries({ introduced, resolved, unchanged })) {
+      if (JSON.stringify(change[key]) !== JSON.stringify(list.map((f) => f.id))) return report;
+    }
+    if ((introduced.some((f) => f.severity === "critical") ? 1 : 0) !== exitCode) return report;
+    if ([...introduced, ...resolved, ...unchanged].some((f) => f.id.startsWith("scan_incomplete_"))) return report;
+    return { ...report, status: "complete", mergeBase: change.baseCommit, introduced, resolved, unchanged };
+  } catch {
+    return report;
+  }
+}
+function validateReport(raw) {
+  if (Buffer.byteLength(raw) > MAX_REPORT_BYTES) throw new Error("Report too large");
+  const r = record(JSON.parse(raw));
+  exact(r, ["repository", "repositoryId", "pr", "headRepository", "head", "base", "runId", "attempt", "version", "validationRunId", "validationAttempt", "schema", "status", "durationMs", "mergeBase", "introduced", "resolved", "unchanged", "usageKey", "executionKey"]);
+  checkIdentity(r);
+  if (r.schema !== 1 || !["complete", "incomplete"].includes(r.status) || !Number.isInteger(r.durationMs) || r.durationMs < 0 || r.durationMs > 36e5) throw new Error("Invalid report");
+  for (const k of ["introduced", "resolved", "unchanged"]) findings(r[k], true);
+  if (r.status === "complete" ? !sha(r.mergeBase) : r.mergeBase !== null || r.introduced.length || r.resolved.length || r.unchanged.length) throw new Error("Invalid completion");
+  if (r.status === "complete" && [...r.introduced, ...r.resolved, ...r.unchanged].some((f) => f.id.startsWith("scan_incomplete_"))) throw new Error("Incomplete comparison evidence");
+  const expected = adaptCheckResult(r, "", null, r.durationMs);
+  if (r.usageKey !== expected.usageKey || r.executionKey !== expected.executionKey) throw new Error("Invalid measurement keys");
+  return r;
+}
+function renderComment(report) {
+  const r = validateReport(JSON.stringify(report));
+  const blockers = r.introduced.filter((f) => f.severity === "critical").length;
+  const lines = [
+    MARKER,
+    `<!-- viberaven-run:${r.runId}:${r.attempt}:${r.validationRunId ?? r.runId}:${r.validationAttempt ?? r.attempt} -->`,
+    `### VibeRaven: ${r.status === "incomplete" ? "Check incomplete" : blockers ? `${blockers} new blocker(s)` : r.introduced.length ? `${r.introduced.length} new finding(s)` : "No new findings"}`,
+    "",
+    `Head: \`${r.head}\`  
+Base: \`${r.base}\``,
+    ""
+  ];
+  if (r.status === "complete") {
+    lines.push(`Compared with merge base \`${r.mergeBase}\`.`, "");
+    for (const [label, list] of [["Introduced", r.introduced], ["Resolved", r.resolved]]) {
+      if (list.length) lines.push(`**${label}:**`, "", ...list.map((f) => `- ${f.severity}: ${RULE_LABELS[f.id]} (\`${f.id}\`)`), "");
+    }
+    lines.push(`${r.unchanged.length} finding(s) already present.`, "");
+  } else lines.push("The comparison did not finish or its evidence could not be validated. No clean verdict is available.", "");
+  lines.push(
+    `[Source run](https://github.com/${r.repository}/actions/runs/${r.runId}) \xB7 [Trusted recheck](https://github.com/${r.repository}/actions/runs/${r.validationRunId ?? r.runId}) \xB7 CLI ${r.version} \xB7 ${r.durationMs} ms`,
+    "",
+    "Repository evidence only. This does not verify live provider settings and is not a security audit. Bounded finding metadata is retained in GitHub Actions for one day."
+  );
+  return lines.join("\n") + "\n";
+}
+
+// src/github-ci/api.ts
+var MAX_ARCHIVE_BYTES = 1e5;
+function crc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc ^= byte;
+    for (let i = 0; i < 8; i++) crc = crc >>> 1 ^ (crc & 1 ? 3988292384 : 0);
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function readReportZip(zip) {
+  if (zip.length > MAX_ARCHIVE_BYTES || zip.length < 100) throw new Error("Invalid archive size");
+  const end = zip.length - 22;
+  if (zip.readUInt32LE(end) !== 101010256 || zip.readUInt16LE(end + 4) !== 0 || zip.readUInt16LE(end + 6) !== 0 || zip.readUInt16LE(end + 8) !== 1 || zip.readUInt16LE(end + 10) !== 1 || zip.readUInt16LE(end + 20) !== 0) throw new Error("Archive must contain exactly one file");
+  const central = zip.readUInt32LE(end + 16), centralSize = zip.readUInt32LE(end + 12);
+  if (central + centralSize !== end || centralSize < 46 || central > end - 46 || zip.readUInt32LE(central) !== 33639248) throw new Error("Invalid directory");
+  const flags = zip.readUInt16LE(central + 8), method = zip.readUInt16LE(central + 10);
+  const compressed = zip.readUInt32LE(central + 20), size = zip.readUInt32LE(central + 24);
+  const nameLength = zip.readUInt16LE(central + 28), extraLength = zip.readUInt16LE(central + 30), commentLength = zip.readUInt16LE(central + 32);
+  const mode = zip.readUInt32LE(central + 38) >>> 16 & 61440;
+  if ((flags & ~(8 | 2048)) !== 0 || ![0, 8].includes(method) || !size || size > MAX_REPORT_BYTES || compressed > MAX_ARCHIVE_BYTES || ![0, 32768].includes(mode) || zip.readUInt16LE(central + 34) !== 0 || zip.readUInt32LE(central + 42) !== 0 || centralSize !== 46 + nameLength + extraLength + commentLength || zip.subarray(central + 46, central + 46 + nameLength).toString("utf8") !== "report.json") throw new Error("Unsafe report entry");
+  if (zip.readUInt32LE(0) !== 67324752 || zip.readUInt16LE(6) !== flags || zip.readUInt16LE(8) !== method) throw new Error("Invalid local entry");
+  const localName = zip.readUInt16LE(26), localExtra = zip.readUInt16LE(28), start = 30 + localName + localExtra;
+  if (zip.subarray(30, 30 + localName).toString("utf8") !== "report.json" || start + compressed > central) throw new Error("Invalid local file");
+  const tail = central - start - compressed;
+  if (flags & 8 ? ![12, 16].includes(tail) : tail !== 0) throw new Error("Unexpected archive entries");
+  const expectedCrc = zip.readUInt32LE(central + 16);
+  if (!(flags & 8) && (zip.readUInt32LE(14) !== expectedCrc || zip.readUInt32LE(18) !== compressed || zip.readUInt32LE(22) !== size)) throw new Error("Conflicting local metadata");
+  if (flags & 8) {
+    const descriptor = start + compressed + (tail === 16 ? 4 : 0);
+    if (tail === 16 && zip.readUInt32LE(start + compressed) !== 134695760 || zip.readUInt32LE(descriptor) !== expectedCrc || zip.readUInt32LE(descriptor + 4) !== compressed || zip.readUInt32LE(descriptor + 8) !== size) throw new Error("Invalid data descriptor");
+  }
+  const data = method === 8 ? (0, import_node_zlib.inflateRawSync)(zip.subarray(start, start + compressed), { maxOutputLength: MAX_REPORT_BYTES }) : zip.subarray(start, start + compressed);
+  if (data.length !== size || crc32(data) !== expectedCrc) throw new Error("Corrupt report");
+  return new TextDecoder("utf-8", { fatal: true }).decode(data);
+}
+async function bounded(response, limit) {
+  if (Number(response.headers.get("content-length")) > limit || !response.body) throw new Error("Response too large or missing");
+  const reader = response.body.getReader(), chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      size += next.value.length;
+      if (size > limit) throw new Error("Response too large");
+      chunks.push(next.value);
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+  }
+  return Buffer.concat(chunks);
+}
+function githubApi(token, fetcher = fetch) {
+  if (!token || /[\r\n]/.test(token)) throw new Error("Missing GitHub token");
+  async function request(path2, method = "GET", body, redirect = "error") {
+    if (!/^\/repos\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\//.test(path2) || path2.includes("..") || path2.includes("#")) throw new Error("Invalid API path");
+    const response = await fetcher(`https://api.github.com${path2}`, {
+      method,
+      redirect,
+      signal: AbortSignal.timeout(3e4),
+      headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28", "user-agent": "viberaven-ci", ...body ? { "content-type": "application/json" } : {} },
+      ...body ? { body: JSON.stringify(body) } : {}
+    });
+    if (!response.ok && !(redirect === "manual" && response.status === 302)) throw new Error(`GitHub API ${response.status}`);
+    return response;
+  }
+  return {
+    async get(path2) {
+      return JSON.parse((await bounded(await request(path2), 2e6)).toString("utf8"));
+    },
+    async write(method, path2, body) {
+      await request(path2, method, body);
+    },
+    async artifact(repository, id) {
+      if (!repositoryName(repository) || !positive(id)) throw new Error("Invalid artifact identity");
+      const redirect = await request(`/repos/${repository}/actions/artifacts/${id}/zip`, "GET", void 0, "manual");
+      if (redirect.status !== 302) throw new Error("Expected GitHub artifact redirect");
+      const location = new URL(redirect.headers.get("location") ?? "");
+      if (location.protocol !== "https:" || location.username || location.password || location.port || !(/\.blob\.core\.windows\.net$/.test(location.hostname) || /\.actions\.githubusercontent\.com$/.test(location.hostname))) throw new Error("Unexpected artifact host");
+      const response = await fetcher(location, { redirect: "error", signal: AbortSignal.timeout(3e4) });
+      if (!response.ok) throw new Error("Artifact download failed");
+      return readReportZip(await bounded(response, MAX_ARCHIVE_BYTES));
+    }
+  };
+}
+
+// src/commands/initGithub.ts
+var import_node_child_process5 = require("node:child_process");
+var import_node_path3 = require("node:path");
+var import_node_util5 = require("node:util");
+var execFileAsync5 = (0, import_node_util5.promisify)(import_node_child_process5.execFile);
+var WORKFLOW_PATH = (0, import_node_path3.join)(".github", "workflows", "viberaven.yml");
+var PUBLISHER_PATH = (0, import_node_path3.join)(".github", "workflows", "viberaven-comment.yml");
+var SCAN_NAME = "VibeRaven";
+var PUBLISHER_NAME = "VibeRaven feedback";
+var NODE = "949feb2413d6458794dcd2491c4babbbce0c15c1";
+var UPLOAD = "cf430e030ddbb5b0abf93d22962f4752f3646cd9";
+function install(version) {
+  if (!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?$/.test(version)) throw new Error("Invalid package version");
+  return [
+    `      - uses: actions/setup-node@${NODE} # v7.1.0`,
+    "        with:",
+    "          node-version: 24",
+    "          package-manager-cache: false",
+    "      - name: Install pinned VibeRaven outside the repository",
+    "        working-directory: ${{ runner.temp }}",
+    "        run: |",
+    '          tool_dir=$(mktemp -d "$RUNNER_TEMP/viberaven-tool.XXXXXX")',
+    '          cd "$tool_dir"',
+    "          export NPM_CONFIG_USERCONFIG=/dev/null NPM_CONFIG_GLOBALCONFIG=/dev/null",
+    `          npm install --ignore-scripts --no-audit --no-fund --package-lock=false --registry=https://registry.npmjs.org @viberaven/cli@${version}`,
+    '          echo "VR_HELPER=$tool_dir/node_modules/@viberaven/cli/dist/github-ci.js" >> "$GITHUB_ENV"'
+  ];
+}
+function artifact(name) {
+  return [
+    `      - uses: actions/upload-artifact@${UPLOAD} # v7.0.2`,
+    "        if: always()",
+    "        with:",
+    `          name: ${name}`,
+    "          path: ${{ runner.temp }}/viberaven-report/report.json",
+    "          if-no-files-found: error",
+    "          retention-days: 1",
+    "          archive: true"
+  ];
+}
+function renderPublisherWorkflow(version = VERSION) {
+  return [
+    "# This workflow runs from the default branch. It never trusts the PR workflow artifact.",
+    "# Recheck uses a read-only token and exports regular Git blobs without running repository scripts.",
+    `name: ${PUBLISHER_NAME}`,
+    "on:",
+    "  workflow_run:",
+    `    workflows: [${SCAN_NAME}]`,
+    "    types: [completed]",
+    "permissions: {}",
+    "concurrency:",
+    "  group: viberaven-feedback-${{ github.repository_id }}-${{ github.event.workflow_run.head_repository.id }}-${{ github.event.workflow_run.head_branch }}",
+    "  cancel-in-progress: false",
+    "jobs:",
+    "  recheck:",
+    "    runs-on: ubuntu-latest",
+    "    timeout-minutes: 12",
+    "    permissions:",
+    "      contents: read",
+    "      actions: read",
+    "      pull-requests: read",
+    "    steps:",
+    ...install(version),
+    "      - name: Independently check immutable PR commits",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    "          VR_REPORT_DIR: ${{ runner.temp }}/viberaven-report",
+    '        run: node "$VR_HELPER" recheck',
+    ...artifact("viberaven-validated-${{ github.run_id }}-${{ github.run_attempt }}"),
+    "  publish:",
+    "    needs: recheck",
+    "    if: always()",
+    "    runs-on: ubuntu-latest",
+    "    timeout-minutes: 5",
+    "    permissions:",
+    "      contents: read",
+    "      actions: read",
+    "      pull-requests: write",
+    "    steps:",
+    ...install(version),
+    "      - name: Publish validated feedback",
+    "        env:",
+    "          GH_TOKEN: ${{ github.token }}",
+    '        run: node "$VR_HELPER" publish',
+    ""
+  ].join("\n");
+}
+
+// src/github-ci/publisher.ts
+var path = (repository) => `/repos/${repository}`;
+function sameRepo(repo, name, id) {
+  return repo?.full_name === name && positive(repo?.id) && (id === void 0 || repo.id === id);
+}
+async function pages(api, url) {
+  const result = [];
+  for (let page = 1; page <= 20; page++) {
+    const data = await api.get(`${url}${url.includes("?") ? "&" : "?"}per_page=100&page=${page}`);
+    if (!Array.isArray(data)) throw new Error("Invalid paginated response");
+    result.push(...data);
+    if (data.length < 100) return result;
+  }
+  throw new Error("Pagination limit reached");
+}
+async function resolveSource(api, repository, repositoryId, sourceId) {
+  if (!repositoryName(repository) || !positive(repositoryId) || !positive(sourceId)) throw new Error("Invalid run identity");
+  const run = record(await api.get(`${path(repository)}/actions/runs/${sourceId}`));
+  if (run.id !== sourceId || run.status !== "completed" || run.event !== "pull_request" || run.path !== ".github/workflows/viberaven.yml" || !sameRepo(run.repository, repository, repositoryId) || !repositoryName(run.head_repository?.full_name) || !positive(run.head_repository?.id) || !sha(run.head_sha) || !positive(run.run_attempt) || !positive(run.workflow_id) || typeof run.head_branch !== "string") throw new Error("Untrusted source run");
+  const workflow = await api.get(`${path(repository)}/actions/workflows/${run.workflow_id}`);
+  if (workflow.id !== run.workflow_id || workflow.path !== run.path) throw new Error("Unexpected source workflow");
+  let candidates = Array.isArray(run.pull_requests) ? run.pull_requests : [];
+  if (!candidates.length) candidates = await pages(api, `${path(repository)}/commits/${run.head_sha}/pulls`);
+  if (!candidates.length) {
+    const owner = run.head_repository.full_name.split("/")[0];
+    candidates = await pages(api, `${path(repository)}/pulls?state=open&head=${encodeURIComponent(`${owner}:${run.head_branch}`)}`);
+  }
+  const matches = [];
+  for (const number of [...new Set(candidates.map((p) => p.number))]) {
+    if (!positive(number)) throw new Error("Invalid PR association");
+    const pr2 = await api.get(`${path(repository)}/pulls/${number}`);
+    if (pr2.number === number && pr2.state === "open" && pr2.head?.sha === run.head_sha && pr2.head?.ref === run.head_branch && sameRepo(pr2.head?.repo, run.head_repository.full_name, run.head_repository.id) && sameRepo(pr2.base?.repo, repository, repositoryId) && sha(pr2.base?.sha)) matches.push(pr2);
+  }
+  if (matches.length !== 1) throw new Error("No unique current open PR for source run");
+  const pr = matches[0];
+  return { pr, identity: {
+    repository,
+    repositoryId,
+    pr: pr.number,
+    headRepository: pr.head.repo.full_name,
+    head: pr.head.sha,
+    base: pr.base.sha,
+    runId: sourceId,
+    attempt: run.run_attempt,
+    version: VERSION
+  } };
+}
+async function validateTrustedRun(api, repository, repositoryId, runId, attempt) {
+  if (!positive(runId) || !positive(attempt)) throw new Error("Invalid trusted run identity");
+  const run = await api.get(`${path(repository)}/actions/runs/${runId}`);
+  if (run.id !== runId || run.run_attempt !== attempt || run.event !== "workflow_run" || !sameRepo(run.repository, repository, repositoryId) || run.path !== ".github/workflows/viberaven-comment.yml" || !sha(run.head_sha) || !positive(run.workflow_id)) throw new Error("Invalid trusted workflow");
+  const workflow = await api.get(`${path(repository)}/actions/workflows/${run.workflow_id}`);
+  if (workflow.id !== run.workflow_id || workflow.path !== run.path) throw new Error("Unexpected publisher workflow");
+  const file = await api.get(`${path(repository)}/contents/${run.path}?ref=${run.head_sha}`);
+  if (file.encoding !== "base64" || typeof file.content !== "string" || file.content.length > 4e4 || Buffer.from(file.content, "base64").toString("utf8").replace(/\r\n/g, "\n") !== renderPublisherWorkflow()) throw new Error("Publisher workflow differs from canonical template");
+}
+function equalIdentity(report, expected) {
+  for (const [key, value] of Object.entries(expected)) if (report[key] !== value) throw new Error("Report identity mismatch");
+}
+function owned(comment) {
+  return positive(comment?.id) && comment.user?.id === 41898282 && comment.user?.login === "github-actions[bot]" && comment.user?.type === "Bot" && typeof comment.body === "string" && comment.body.split("\n")[0] === MARKER;
+}
+function later(body, expected) {
+  const match = /^<!-- viberaven-run:(\d+):(\d+):(\d+):(\d+) -->$/m.exec(body);
+  if (!match) return false;
+  const old = match.slice(1).map(Number), now = [expected.runId, expected.attempt, expected.validationRunId, expected.validationAttempt];
+  for (let i = 0; i < old.length; i++) {
+    if (old[i] > now[i]) return true;
+    if (old[i] < now[i]) return false;
+  }
+  return false;
+}
+async function publish(api, repository, repositoryId, sourceId, trustedId, trustedAttempt) {
+  await validateTrustedRun(api, repository, repositoryId, trustedId, trustedAttempt);
+  const { identity, pr } = await resolveSource(api, repository, repositoryId, sourceId);
+  const expected = { ...identity, validationRunId: trustedId, validationAttempt: trustedAttempt };
+  let report = adaptCheckResult(expected, "", null, 0);
+  try {
+    const artifacts = await api.get(`${path(repository)}/actions/runs/${trustedId}/artifacts?per_page=100&page=1`);
+    if (!Array.isArray(artifacts.artifacts) || artifacts.total_count > 100) throw new Error("Invalid artifact list");
+    const matches = artifacts.artifacts.filter((a) => a.name === `viberaven-validated-${trustedId}-${trustedAttempt}`);
+    if (matches.length !== 1) throw new Error("Missing unique trusted report");
+    const artifact2 = matches[0];
+    if (!positive(artifact2.id) || artifact2.expired !== false || artifact2.workflow_run?.id !== trustedId || !positive(artifact2.size_in_bytes) || artifact2.size_in_bytes > 1e5) throw new Error("Invalid artifact metadata");
+    const candidate = validateReport(await api.artifact(repository, artifact2.id));
+    equalIdentity(candidate, expected);
+    report = candidate;
+  } catch {
+  }
+  const comments = (await pages(api, `${path(repository)}/issues/${pr.number}/comments`)).filter(owned);
+  if (comments.some((c) => later(c.body, expected))) return null;
+  const body = renderComment(report);
+  const current = await api.get(`${path(repository)}/pulls/${pr.number}`);
+  if (current.state !== "open" || current.head?.sha !== identity.head || current.base?.sha !== identity.base || !sameRepo(current.head?.repo, identity.headRepository, pr.head.repo.id) || !sameRepo(current.base?.repo, repository, repositoryId)) throw new Error("PR changed before comment write");
+  const existing = comments.sort((a, b) => a.id - b.id)[0];
+  if (existing) await api.write("PATCH", `${path(repository)}/issues/comments/${existing.id}`, { body });
+  else await api.write("POST", `${path(repository)}/issues/${pr.number}/comments`, { body });
+  return report;
+}
+
+// src/github-ci/main.ts
+function scannerEnv(env) {
+  const result = {};
+  for (const key of ["PATH", "Path", "HOME", "USERPROFILE", "SystemRoot", "TEMP", "TMP", "TMPDIR", "LANG"]) if (env[key]) result[key] = env[key];
+  result.GIT_CONFIG_NOSYSTEM = "1";
+  result.GIT_CONFIG_GLOBAL = process.platform === "win32" ? "NUL" : "/dev/null";
+  result.GIT_TERMINAL_PROMPT = "0";
+  return result;
+}
+function scan(identity, cwd) {
+  const start = Date.now();
+  const env = scannerEnv(process.env);
+  try {
+    const head = (0, import_node_child_process6.execFileSync)("git", ["-c", "core.hooksPath=/dev/null", "rev-parse", "--verify", "HEAD"], { cwd, env, encoding: "utf8", timeout: 1e4, windowsHide: true }).trim();
+    if (head !== identity.head) throw new Error("Unexpected checked out head");
+    const result = (0, import_node_child_process6.spawnSync)(process.execPath, [(0, import_node_path4.resolve)(__dirname, "cli.js"), "check", "--base", identity.base, "--json"], {
+      cwd,
+      env,
+      encoding: "utf8",
+      timeout: 3e5,
+      maxBuffer: 4e6,
+      windowsHide: true
+    });
+    return adaptCheckResult(identity, result.stdout ?? "", result.error ? null : result.status, Date.now() - start);
+  } catch {
+    return adaptCheckResult(identity, "", null, Date.now() - start);
+  }
+}
+async function snapshot(identity, token) {
+  const repo = await (0, import_promises3.mkdtemp)((0, import_node_path4.join)((0, import_node_os2.tmpdir)(), "viberaven-ci-git-"));
+  let tree;
+  const env = scannerEnv(process.env);
+  env.GIT_CONFIG_COUNT = "1";
+  env.GIT_CONFIG_KEY_0 = "http.https://github.com/.extraheader";
+  env.GIT_CONFIG_VALUE_0 = `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+  const git2 = (...args) => (0, import_node_child_process6.execFileSync)("git", ["-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=never", ...args], { cwd: repo, env, timeout: 12e4, maxBuffer: 4e6, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+  try {
+    git2("init", "--quiet", "--template=");
+    git2("fetch", "--no-tags", "--no-recurse-submodules", `https://github.com/${identity.repository}.git`, identity.base);
+    git2("fetch", "--no-tags", "--no-recurse-submodules", `https://github.com/${identity.headRepository}.git`, identity.head);
+    git2("update-ref", "HEAD", identity.head);
+    tree = await exportCommit(repo, identity.head);
+    await (0, import_promises3.rename)((0, import_node_path4.join)(repo, ".git"), (0, import_node_path4.join)(tree, ".git"));
+    return tree;
+  } catch (error) {
+    if (tree) await (0, import_promises3.rm)(tree, { recursive: true, force: true });
+    throw error;
+  } finally {
+    await (0, import_promises3.rm)(repo, { recursive: true, force: true });
+  }
+}
+function output(report, env) {
+  if (!env.VR_REPORT_DIR) throw new Error("Missing report directory");
+  (0, import_node_fs.mkdirSync)(env.VR_REPORT_DIR, { recursive: true });
+  (0, import_node_fs.writeFileSync)((0, import_node_path4.join)(env.VR_REPORT_DIR, "report.json"), JSON.stringify(report) + "\n", "utf8");
+  if (env.GITHUB_STEP_SUMMARY) (0, import_node_fs.appendFileSync)(env.GITHUB_STEP_SUMMARY, renderComment(report), "utf8");
+  console.log(`VibeRaven: ${report.status}; ${report.introduced.length} introduced, ${report.resolved.length} resolved.`);
+}
+async function main(command, env = process.env) {
+  const event = record(JSON.parse((0, import_node_fs.readFileSync)(env.GITHUB_EVENT_PATH ?? "", "utf8")));
+  const repository = env.GITHUB_REPOSITORY ?? "", repositoryId = Number(env.GITHUB_REPOSITORY_ID), runId = Number(env.GITHUB_RUN_ID), attempt = Number(env.GITHUB_RUN_ATTEMPT);
+  if (!repositoryName(repository) || !positive(repositoryId) || !positive(runId) || !positive(attempt)) throw new Error("Invalid GitHub environment");
+  if (command === "scan") {
+    const pr = record(event.pull_request);
+    const identity2 = { repository, repositoryId, pr: pr.number, headRepository: pr.head?.repo?.full_name, head: pr.head?.sha, base: pr.base?.sha, runId, attempt, version: VERSION };
+    const report2 = scan(identity2, process.cwd());
+    output(report2, env);
+    return report2.status === "complete" ? 0 : 2;
+  }
+  const api = githubApi(env.GH_TOKEN ?? "");
+  const sourceId = event.workflow_run?.id;
+  if (!positive(sourceId)) throw new Error("Missing source run");
+  if (command === "publish") {
+    const report2 = await publish(api, repository, repositoryId, sourceId, runId, attempt);
+    if (report2 && env.GITHUB_STEP_SUMMARY) (0, import_node_fs.appendFileSync)(env.GITHUB_STEP_SUMMARY, renderComment(report2), "utf8");
+    return report2?.status === "incomplete" ? 2 : 0;
+  }
+  if (command !== "recheck") throw new Error("Unknown CI command");
+  const { identity } = await resolveSource(api, repository, repositoryId, sourceId);
+  const expected = { ...identity, validationRunId: runId, validationAttempt: attempt };
+  let report = adaptCheckResult(expected, "", null, 0), tree;
+  const started = Date.now();
+  try {
+    tree = await snapshot(expected, env.GH_TOKEN);
+    report = scan(expected, tree);
+  } catch {
+    report.durationMs = Math.min(Date.now() - started, 36e5);
+  } finally {
+    if (tree) await (0, import_promises3.rm)(tree, { recursive: true, force: true });
+  }
+  output(report, env);
+  return report.status === "complete" ? 0 : 2;
+}
+if (require.main === module) main(process.argv[2]).then((code) => {
+  process.exitCode = code;
+}).catch(() => {
+  console.error("VibeRaven CI could not validate this run. No clean verdict was produced.");
+  process.exitCode = 2;
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  main,
+  scan,
+  scannerEnv
+});