@revfleet/hscli 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## 0.7.0 - 2026-04-21
+
+**Trust plane.** New `hscli policy` + `hscli audit` command groups give
+hscli the same operational-trust posture as Salesforce Agent Fabric —
+policy-as-code + audit-over-trace — but in open JSONL + JSON instead
+of a vendor-locked UI. Direct counter to the enterprise moat pillar.
+
+### New: hscli policy command group
+
+- `hscli policy list` — parse + summarize the active policy file.
+- `hscli policy show-matching <method> <path>` — which rule fires for a
+  given request? Use before shipping to verify intent.
+- `hscli policy validate [file]` — syntax + semantic check (invalid
+  enums, malformed windows, unnamed rules, etc.).
+- `hscli policy templates list|show|extract` — 5 built-in templates:
+  - `read-only` — denies all writes (default action: deny + allow-all-
+    reads rule).
+  - `business-hours` — writes only 9-17 Mon-Fri in a given timezone.
+  - `change-ticket-required` — every write needs `--change-ticket <id>`.
+  - `no-deletes` — POST/PATCH/PUT allowed, DELETE always denied.
+  - `compliance-strict` — combines the above (business hours + change
+    ticket + no deletes + GDPR endpoints require approval).
+
+### Enhanced policy schema (v2)
+
+Legacy v1 policy files still work. v2 adds:
+- **Glob path matching** — `"path": "**/gdpr-delete**"` matches anywhere.
+  `*` matches within a segment, `**` across segments.
+- **Time windows** — `"window": { "tz": "US/Eastern", "hours": "09-17",
+  "days": "mon-fri" }`. Enforced in the portal's declared timezone.
+- **`defaultAction`** — `"allow"` (current behavior) or `"deny"` (no-
+  rule-match → block). Enables zero-trust policy files.
+- **`requireApproval`** — marks paths as needing out-of-band approval.
+  Currently emits `POLICY_APPROVAL_REQUIRED` error; webhook/Slack
+  fulfillment lands in v0.7.1.
+- **Rate limit hooks** — `"rateLimit": { "maxPerHour": 10 }` schema
+  reserved. Enforcement lands in v0.7.1 alongside approvals.
+
+### New: hscli audit command group
+
+Reads any trace JSONL (single file or all `~/.revfleet/trace-*.jsonl`)
+and aggregates:
+- `hscli audit timeline` — chronological events, `--since 24h`,
+  `--writes-only`, `--limit N`.
+- `hscli audit who <profile>` — breakdown of what a profile did
+  (byMethod, byStatus, byPathRoot, last 10).
+- `hscli audit what <path-pattern>` — who touched an endpoint
+  (byProfile, byTool — MCP tool names — byMethod, recent writes).
+- `hscli audit writes [--since]` — all write ops, most security-relevant
+  view.
+- `hscli audit by-tool` — MCP tool breakdown: calls, writes, errors,
+  error rate, avg + max latency. Answers "which agent is chatty/buggy".
+
+### Package publishes `docs/policy-templates/`
+
+Templates are bundled in the npm tarball so `hscli policy templates
+list` works for any user with just `npm install @revfleet/hscli`.
+
+### Validation
+
+- 162 tests pass
+- 0 npm audit vulnerabilities
+- Policy enforcement verified end-to-end: `read-only` template
+  correctly blocks POST with `POLICY_DEFAULT_DENY` error.
+- Glob matching works (`**/gdpr-delete**`, `/crm/v3/objects/*`).
+- Time-window enforcement works via Intl.DateTimeFormat.
+- Audit timeline/who/what tested on live 3-event trace.
+
+---
+
 ## 0.6.0 - 2026-04-21
 
 **Session tracing + replay.** New `hscli trace` command group brings

package/dist/cli.js

@@ -15,6 +15,8 @@ import { registerService } from "./commands/service/index.js";
 import { registerWebhooks } from "./commands/webhooks/index.js";
 import { registerSeed } from "./commands/seed/index.js";
 import { registerTrace } from "./commands/trace/index.js";
+import { registerPolicy } from "./commands/policy/index.js";
+import { registerAudit } from "./commands/audit/index.js";
 import { registerLists } from "./commands/lists/index.js";
 import { registerSales } from "./commands/sales/index.js";
 import { registerReporting } from "./commands/reporting/index.js";
@@ -90,6 +92,8 @@ export function createProgram() {
     registerApi(program, () => ctx);
     registerSeed(program, () => ctx);
     registerTrace(program, () => ctx);
+    registerPolicy(program, () => ctx);
+    registerAudit(program, () => ctx);
     registerLists(program, () => ctx);
     registerSales(program, () => ctx);
     registerReporting(program, () => ctx);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAmB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnI,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAE3B,OAAO;SACJ,IAAI,CAAC,OAAO,CAAC;SACb,WAAW,CAAC,mCAAmC,CAAC;SAChD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACpB,MAAM,CAAC,kBAAkB,EAAE,cAAc,EAAE,SAAS,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC;SACtC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;SAC7C,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,sBAAsB,EAAE,kDAAkD,CAAC;SAClF,MAAM,CAAC,sBAAsB,EAAE,4CAA4C,CAAC;SAC5E,MAAM,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SACxF,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,GAAG,GAAG;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACxE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9E,KAAK;YACL,aAAa;SACd,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,KAAK,CAAC;QACrC,IAAI,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,aAAa,CAAC;IACtE,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACnC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gCAAgC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACnC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9C,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,6BAA6B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClD,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5C,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,6BAA6B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClD,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5C,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;QACtB,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IAC5C,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAe;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACxE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SAClF,CAAC;QACF,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,KAAK,GAAG,EAAE,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,QAAiB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,KAA2C,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAmB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAExD,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnI,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAE3B,OAAO;SACJ,IAAI,CAAC,OAAO,CAAC;SACb,WAAW,CAAC,mCAAmC,CAAC;SAChD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;SACpB,MAAM,CAAC,kBAAkB,EAAE,cAAc,EAAE,SAAS,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC;SACtC,MAAM,CAAC,SAAS,EAAE,0BAA0B,CAAC;SAC7C,MAAM,CAAC,uBAAuB,EAAE,sDAAsD,CAAC;SACvF,MAAM,CAAC,sBAAsB,EAAE,kDAAkD,CAAC;SAClF,MAAM,CAAC,sBAAsB,EAAE,4CAA4C,CAAC;SAC5E,MAAM,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;SACxF,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,GAAG,GAAG;YACJ,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACxE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9E,KAAK;YACL,aAAa;SACd,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,KAAK,CAAC;QACrC,IAAI,aAAa;YAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,aAAa,CAAC;IACtE,CAAC,CAAC,CAAC;IAEL,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACnC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACjC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACnC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gCAAgC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrD,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACnC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,yBAAyB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9C,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,6BAA6B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClD,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAChC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5C,oBAAoB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACzC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACxC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACpC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,6BAA6B,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAClD,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5C,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACtC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1C,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7C,WAAW,CAAC,OAAO,CAAC,CAAC;IAErB,OAAO,CAAC,eAAe,CAAC;QACtB,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,UAAU,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IAC3C,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IAC5C,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAe;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;YACpD,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YACxE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;YACnC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;SAClF,CAAC;QACF,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,KAAK,GAAG,EAAE,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,QAAiB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,KAA2C,CAAC;AAC1E,CAAC"}

package/dist/commands/audit/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+import type { CliContext } from "../../core/output.js";
+export declare function registerAudit(program: Command, getCtx: () => CliContext): void;

package/dist/commands/audit/index.js

@@ -0,0 +1,226 @@
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { CliError, printResult } from "../../core/output.js";
+function getRevfleetHome() {
+    return process.env.HSCLI_HOME?.trim() || join(homedir(), ".revfleet");
+}
+/**
+ * Read all *.jsonl trace files from a given path (file or directory).
+ * If no path given, default to scanning ~/.revfleet/ for any trace-*.jsonl.
+ */
+function readAllTraces(fileOrDir) {
+    const target = fileOrDir || getRevfleetHome();
+    if (!existsSync(target)) {
+        throw new CliError("AUDIT_NO_TRACES", `No trace file(s) found at: ${target}. Use \`hscli trace start\` to begin recording.`);
+    }
+    const stat = statSync(target);
+    const files = [];
+    if (stat.isDirectory()) {
+        for (const f of readdirSync(target)) {
+            if (f.startsWith("trace-") && f.endsWith(".jsonl"))
+                files.push(join(target, f));
+        }
+    }
+    else {
+        files.push(target);
+    }
+    const events = [];
+    for (const f of files) {
+        for (const line of readFileSync(f, "utf8").split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                events.push(JSON.parse(trimmed));
+            }
+            catch { /* skip */ }
+        }
+    }
+    return events;
+}
+function isWriteEvent(ev) {
+    return Boolean(ev.method && ["POST", "PUT", "PATCH", "DELETE"].includes(ev.method));
+}
+function parseSince(spec) {
+    // "24h", "7d", "30m" — returns ms before now
+    const match = /^(\d+)([mhd])$/.exec(spec.trim());
+    if (!match)
+        return 0;
+    const n = Number(match[1]);
+    const unit = match[2];
+    const ms = unit === "m" ? 60_000 : unit === "h" ? 3_600_000 : 86_400_000;
+    return n * ms;
+}
+function filterBySince(events, since) {
+    if (!since)
+        return events;
+    const cutoffMs = Date.now() - parseSince(since);
+    return events.filter(e => {
+        if (!e.ts)
+            return false;
+        return new Date(e.ts).getTime() >= cutoffMs;
+    });
+}
+export function registerAudit(program, getCtx) {
+    const audit = program.command("audit").description("Operational audit over trace JSONL files. Answers 'who did what when' across every hscli / MCP request. Reads from a specific file or auto-scans ~/.revfleet/ for all recorded sessions.");
+    audit
+        .command("timeline")
+        .description("Chronological event list across traces. Default: last 100 events from ~/.revfleet/*.jsonl.")
+        .argument("[file-or-dir]", "Path to a trace file or directory (default: ~/.revfleet/)")
+        .option("--since <spec>", "Only events in the last window: 15m, 24h, 7d")
+        .option("--limit <n>", "Max events to show", "100")
+        .option("--writes-only", "Only POST/PUT/PATCH/DELETE events")
+        .action(async (fileOrDir, opts) => {
+        const ctx = getCtx();
+        const all = readAllTraces(fileOrDir);
+        let events = filterBySince(all, opts.since);
+        if (opts.writesOnly)
+            events = events.filter(isWriteEvent);
+        events.sort((a, b) => (a.ts ?? "").localeCompare(b.ts ?? ""));
+        const limit = Number(opts.limit) || 100;
+        printResult(ctx, {
+            totalLoaded: all.length,
+            afterFilters: events.length,
+            showing: Math.min(events.length, limit),
+            filters: {
+                since: opts.since ?? "(none)",
+                writesOnly: Boolean(opts.writesOnly),
+            },
+            events: events.slice(-limit),
+        });
+    });
+    audit
+        .command("who")
+        .description("What has a given profile done? Reads across all traces and breaks down by method/path/status.")
+        .argument("<profile>", "Profile name to audit")
+        .option("--since <spec>", "Window: 15m, 24h, 7d")
+        .option("--file <path>", "Single trace file (default: scan ~/.revfleet/)")
+        .action(async (profile, opts) => {
+        const ctx = getCtx();
+        const events = filterBySince(readAllTraces(opts.file), opts.since).filter(e => e.profile === profile);
+        const byMethod = {};
+        const byStatus = {};
+        const byPathRoot = {};
+        for (const e of events) {
+            byMethod[e.method ?? "?"] = (byMethod[e.method ?? "?"] || 0) + 1;
+            byStatus[String(e.status ?? "err")] = (byStatus[String(e.status ?? "err")] || 0) + 1;
+            const root = (e.path ?? "").split("/").filter(Boolean)[0] || "?";
+            byPathRoot[root] = (byPathRoot[root] || 0) + 1;
+        }
+        const writes = events.filter(isWriteEvent);
+        printResult(ctx, {
+            profile,
+            since: opts.since ?? "(all time)",
+            totalEvents: events.length,
+            reads: events.length - writes.length,
+            writes: writes.length,
+            byMethod,
+            byStatus,
+            byPathRoot,
+            lastTen: events.slice(-10).map(e => ({ ts: e.ts, method: e.method, path: e.path, status: e.status })),
+        });
+    });
+    audit
+        .command("what")
+        .description("Who touched a given path? Reads across traces, buckets by profile + toolName.")
+        .argument("<path-pattern>", "Substring or full path (e.g. '/crm/v3/objects/contacts')")
+        .option("--since <spec>", "Window: 15m, 24h, 7d")
+        .option("--file <path>", "Single trace file")
+        .action(async (pathPattern, opts) => {
+        const ctx = getCtx();
+        const events = filterBySince(readAllTraces(opts.file), opts.since)
+            .filter(e => (e.path ?? "").includes(pathPattern));
+        const byProfile = {};
+        const byTool = {};
+        const byMethod = {};
+        for (const e of events) {
+            byProfile[e.profile ?? "?"] = (byProfile[e.profile ?? "?"] || 0) + 1;
+            if (e.toolName)
+                byTool[e.toolName] = (byTool[e.toolName] || 0) + 1;
+            byMethod[e.method ?? "?"] = (byMethod[e.method ?? "?"] || 0) + 1;
+        }
+        const writes = events.filter(isWriteEvent);
+        printResult(ctx, {
+            pathPattern,
+            since: opts.since ?? "(all time)",
+            totalHits: events.length,
+            reads: events.length - writes.length,
+            writes: writes.length,
+            byProfile,
+            byTool,
+            byMethod,
+            recentWrites: writes.slice(-10).map(e => ({ ts: e.ts, profile: e.profile, toolName: e.toolName, method: e.method, path: e.path, status: e.status })),
+        });
+    });
+    audit
+        .command("writes")
+        .description("All write operations across traces — the most security-relevant audit view.")
+        .option("--since <spec>", "Window: 15m, 24h, 7d")
+        .option("--file <path>", "Single trace file")
+        .option("--limit <n>", "Max writes to show", "100")
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const events = filterBySince(readAllTraces(opts.file), opts.since).filter(isWriteEvent);
+        events.sort((a, b) => (a.ts ?? "").localeCompare(b.ts ?? ""));
+        const limit = Number(opts.limit) || 100;
+        const failed = events.filter(e => e.error || (e.status !== undefined && e.status >= 400));
+        printResult(ctx, {
+            since: opts.since ?? "(all time)",
+            totalWrites: events.length,
+            successfulWrites: events.length - failed.length,
+            failedWrites: failed.length,
+            showing: Math.min(events.length, limit),
+            writes: events.slice(-limit).map(e => ({
+                ts: e.ts,
+                profile: e.profile,
+                toolName: e.toolName,
+                method: e.method,
+                path: e.path,
+                status: e.status,
+                durationMs: e.durationMs,
+            })),
+        });
+    });
+    audit
+        .command("by-tool")
+        .description("Breakdown per MCP tool: which tool wrote how much, error rate, avg latency. Answers 'which agent is chatty/buggy'.")
+        .option("--since <spec>", "Window: 15m, 24h, 7d")
+        .option("--file <path>", "Single trace file")
+        .action(async (opts) => {
+        const ctx = getCtx();
+        const events = filterBySince(readAllTraces(opts.file), opts.since).filter(e => e.toolName);
+        const byTool = new Map();
+        for (const e of events) {
+            const k = e.toolName;
+            if (!byTool.has(k))
+                byTool.set(k, { calls: 0, writes: 0, errors: 0, totalMs: 0, maxMs: 0 });
+            const stats = byTool.get(k);
+            stats.calls++;
+            if (isWriteEvent(e))
+                stats.writes++;
+            if (e.error || (e.status !== undefined && e.status >= 400))
+                stats.errors++;
+            stats.totalMs += e.durationMs ?? 0;
+            stats.maxMs = Math.max(stats.maxMs, e.durationMs ?? 0);
+        }
+        const breakdown = [...byTool.entries()]
+            .map(([tool, s]) => ({
+            tool,
+            calls: s.calls,
+            writes: s.writes,
+            errors: s.errors,
+            errorRate: s.calls > 0 ? Math.round((s.errors / s.calls) * 1000) / 10 + "%" : "0%",
+            avgMs: Math.round(s.totalMs / s.calls),
+            maxMs: s.maxMs,
+        }))
+            .sort((a, b) => b.calls - a.calls);
+        printResult(ctx, {
+            since: opts.since ?? "(all time)",
+            totalMcpCalls: events.length,
+            uniqueTools: breakdown.length,
+            breakdown,
+        });
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAc7D,SAAS,eAAe;IACtB,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,SAAkB;IACvC,MAAM,MAAM,GAAG,SAAS,IAAI,eAAe,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,8BAA8B,MAAM,iDAAiD,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,EAAc;IAClC,OAAO,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,6CAA6C;IAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACzE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,MAAoB,EAAE,KAAc;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACvB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,MAAwB;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,0LAA0L,CAAC,CAAC;IAE/O,KAAK;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4FAA4F,CAAC;SACzG,QAAQ,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACtF,MAAM,CAAC,gBAAgB,EAAE,8CAA8C,CAAC;SACxE,MAAM,CAAC,aAAa,EAAE,oBAAoB,EAAE,KAAK,CAAC;SAClD,MAAM,CAAC,eAAe,EAAE,mCAAmC,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACxC,WAAW,CAAC,GAAG,EAAE;YACf,WAAW,EAAE,GAAG,CAAC,MAAM;YACvB,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YACvC,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ;gBAC7B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;aACrC;YACD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,+FAA+F,CAAC;SAC5G,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;SAC9C,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,gDAAgD,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAEtG,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YACjE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,WAAW,CAAC,GAAG,EAAE;YACf,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;YACjC,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACtG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+EAA+E,CAAC;SAC5F,QAAQ,CAAC,gBAAgB,EAAE,0DAA0D,CAAC;SACtF,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;aAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAErD,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,QAAQ;gBAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,WAAW,CAAC,GAAG,EAAE;YACf,WAAW;YACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,MAAM;YACxB,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;YACT,MAAM;YACN,QAAQ;YACR,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SACrJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6EAA6E,CAAC;SAC1F,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC5C,MAAM,CAAC,aAAa,EAAE,oBAAoB,EAAE,KAAK,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1F,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;YACjC,WAAW,EAAE,MAAM,CAAC,MAAM;YAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YAC/C,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oHAAoH,CAAC;SACjI,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,GAAG,EAMlB,CAAC;QACL,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAS,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,YAAY,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;gBAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3E,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnB,IAAI;YACJ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAClF,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC;YACtC,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,MAAM;YAC5B,WAAW,EAAE,SAAS,CAAC,MAAM;YAC7B,SAAS;SACV,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/policy/index.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+import type { CliContext } from "../../core/output.js";
+export declare function registerPolicy(program: Command, getCtx: () => CliContext): void;

package/dist/commands/policy/index.js

@@ -0,0 +1,217 @@
+import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliError, printResult } from "../../core/output.js";
+import { readPolicyFile, findMatchingRule } from "../../core/policy.js";
+function getTemplatesDir() {
+    // Templates ship alongside the built dist/. When running via `hscli` binary,
+    // we need to walk up from the module's dist location to find the docs/ dir.
+    // This only matters for installed npm package — in dev mode tsc outputs
+    // into dist/ and the docs/ dir is at the repo root.
+    const thisFile = fileURLToPath(import.meta.url);
+    // dist/commands/policy/index.js → repo root
+    const candidates = [
+        resolve(dirname(thisFile), "../../../docs/policy-templates"),
+        resolve(dirname(thisFile), "../../../../docs/policy-templates"),
+        resolve(dirname(thisFile), "../../docs/policy-templates"),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    // Last resort — this will only fail at runtime if templates are missing
+    return resolve(dirname(thisFile), "../../../docs/policy-templates");
+}
+function getPolicyPath(ctx) {
+    return ctx.policyFile?.trim() || process.env.HSCLI_POLICY_FILE?.trim();
+}
+export function registerPolicy(program, getCtx) {
+    const policy = program.command("policy").description("Manage policy-as-code: audit the active policy, list/extract built-in templates, validate your own files.");
+    policy
+        .command("list")
+        .description("Show the active policy (from --policy-file or HSCLI_POLICY_FILE). Parses + summarizes all rules by profile.")
+        .action(async () => {
+        const ctx = getCtx();
+        const path = getPolicyPath(ctx);
+        if (!path) {
+            printResult(ctx, {
+                active: false,
+                message: "No policy file set. Pass --policy-file <path> or set HSCLI_POLICY_FILE env var.",
+                suggestions: [
+                    "hscli policy templates         # list built-in templates",
+                    "hscli policy templates extract read-only --to ./policy.json",
+                ],
+            });
+            return;
+        }
+        const config = readPolicyFile(path);
+        const summary = {
+            active: true,
+            file: path,
+            version: config.version ?? 1,
+            profiles: Object.fromEntries(Object.entries(config.profiles ?? {}).map(([name, cfg]) => [
+                name,
+                {
+                    defaultAction: cfg.defaultAction ?? "allow",
+                    ruleCount: cfg.rules?.length ?? 0,
+                    ruleNames: (cfg.rules ?? []).map(r => r.name || "(unnamed)"),
+                    legacyFlags: {
+                        allowWrite: cfg.allowWrite,
+                        allowDelete: cfg.allowDelete,
+                        requireChangeTicket: cfg.requireChangeTicket,
+                    },
+                },
+            ])),
+            hasDefaults: Boolean(config.defaults),
+            blockedPrefixes: config.blockedMethodPathPrefixes,
+        };
+        printResult(ctx, summary);
+    });
+    policy
+        .command("show-matching")
+        .description("Print which policy rule (if any) would be applied to a hypothetical request. Useful for verifying rules before shipping.")
+        .argument("<method>", "HTTP method: GET, POST, PATCH, PUT, DELETE")
+        .argument("<path>", "Request path (e.g. /crm/v3/objects/contacts/123)")
+        .option("--profile <name>", "Profile to evaluate against (defaults to the current --profile)")
+        .action(async (method, requestPath, opts) => {
+        const ctx = getCtx();
+        const policyPath = getPolicyPath(ctx);
+        if (!policyPath) {
+            throw new CliError("NO_POLICY_FILE", "No policy file configured. Pass --policy-file or set HSCLI_POLICY_FILE.");
+        }
+        const config = readPolicyFile(policyPath);
+        const profile = opts.profile || ctx.profile;
+        const profileConfig = config.profiles?.[profile] ?? config.defaults ?? {};
+        const matched = findMatchingRule(profileConfig, method, requestPath);
+        if (matched) {
+            printResult(ctx, {
+                profile,
+                request: { method, path: requestPath },
+                matchedRule: matched,
+                effectiveAction: matched.action ?? "allow",
+            });
+        }
+        else {
+            printResult(ctx, {
+                profile,
+                request: { method, path: requestPath },
+                matchedRule: null,
+                effectiveAction: profileConfig.defaultAction ?? "allow",
+                note: "No rule matched. Falling back to the profile's defaultAction.",
+            });
+        }
+    });
+    policy
+        .command("validate")
+        .description("Parse + semantic-check a policy file without enforcing it.")
+        .argument("[file]", "Policy file path (default: the active --policy-file / HSCLI_POLICY_FILE)")
+        .action(async (fileArg) => {
+        const ctx = getCtx();
+        const path = fileArg || getPolicyPath(ctx);
+        if (!path) {
+            throw new CliError("NO_POLICY_FILE", "No file passed and no active policy configured.");
+        }
+        try {
+            const config = readPolicyFile(path);
+            const issues = [];
+            const warnings = [];
+            for (const [profileName, cfg] of Object.entries(config.profiles ?? {})) {
+                for (const rule of cfg.rules ?? []) {
+                    if (!rule.match)
+                        warnings.push(`[${profileName}] rule '${rule.name ?? "(unnamed)"}' has no match criteria — will match everything`);
+                    if (rule.action && rule.action !== "allow" && rule.action !== "deny")
+                        issues.push(`[${profileName}] rule '${rule.name ?? "(unnamed)"}' has invalid action '${rule.action}' (must be 'allow' or 'deny')`);
+                    if (rule.window?.days && !/^[a-z]{3}(-[a-z]{3}|(,[a-z]{3})*)$/i.test(rule.window.days.trim())) {
+                        warnings.push(`[${profileName}] rule '${rule.name ?? "(unnamed)"}' has non-standard window.days syntax: '${rule.window.days}'`);
+                    }
+                    if (rule.window?.hours && !/^\d{1,2}-\d{1,2}$/.test(rule.window.hours)) {
+                        issues.push(`[${profileName}] rule '${rule.name ?? "(unnamed)"}' has invalid window.hours: '${rule.window.hours}' (must be 'HH-HH' 24h format)`);
+                    }
+                }
+            }
+            printResult(ctx, {
+                valid: issues.length === 0,
+                file: path,
+                version: config.version ?? 1,
+                profileCount: Object.keys(config.profiles ?? {}).length,
+                totalRules: Object.values(config.profiles ?? {}).reduce((s, c) => s + (c.rules?.length ?? 0), 0),
+                issues,
+                warnings,
+            });
+        }
+        catch (err) {
+            if (err instanceof CliError)
+                throw err;
+            throw new CliError("POLICY_PARSE_ERROR", err instanceof Error ? err.message : String(err));
+        }
+    });
+    const templates = policy.command("templates").description("Built-in policy templates for common trust scenarios");
+    templates
+        .command("list")
+        .description("List available built-in policy templates")
+        .action(async () => {
+        const ctx = getCtx();
+        const dir = getTemplatesDir();
+        if (!existsSync(dir)) {
+            throw new CliError("TEMPLATES_DIR_MISSING", `Template directory not found: ${dir}`);
+        }
+        const files = readdirSync(dir).filter(f => f.endsWith(".json"));
+        const templatesWithMeta = files.map(f => {
+            try {
+                const content = JSON.parse(readFileSync(join(dir, f), "utf8"));
+                return { name: f.replace(/\.json$/, ""), version: content.version, description: content.description ?? "(no description)" };
+            }
+            catch {
+                return { name: f.replace(/\.json$/, ""), version: undefined, description: "(failed to parse)" };
+            }
+        });
+        printResult(ctx, {
+            count: templatesWithMeta.length,
+            templates: templatesWithMeta,
+            note: "Use `hscli policy templates show <name>` to view; `hscli policy templates extract <name> --to <file>` to copy.",
+        });
+    });
+    templates
+        .command("show")
+        .description("Print a template's content")
+        .argument("<name>", "Template name (from `hscli policy templates list`)")
+        .action(async (name) => {
+        const ctx = getCtx();
+        const path = join(getTemplatesDir(), `${name}.json`);
+        if (!existsSync(path)) {
+            throw new CliError("TEMPLATE_NOT_FOUND", `Template '${name}' not found. Available: ${readdirSync(getTemplatesDir()).filter(f => f.endsWith(".json")).map(f => f.replace(/\.json$/, "")).join(", ")}`);
+        }
+        const content = JSON.parse(readFileSync(path, "utf8"));
+        printResult(ctx, content);
+    });
+    templates
+        .command("extract")
+        .description("Copy a built-in template to a local file for editing")
+        .argument("<name>", "Template name")
+        .requiredOption("--to <file>", "Destination file path")
+        .action(async (name, opts) => {
+        const ctx = getCtx();
+        const srcPath = join(getTemplatesDir(), `${name}.json`);
+        if (!existsSync(srcPath)) {
+            throw new CliError("TEMPLATE_NOT_FOUND", `Template '${name}' not found.`);
+        }
+        const dest = String(opts.to);
+        if (existsSync(dest)) {
+            throw new CliError("DEST_FILE_EXISTS", `Destination file already exists: ${dest}. Delete it first or choose another path.`);
+        }
+        mkdirSync(dirname(dest), { recursive: true });
+        const content = readFileSync(srcPath, "utf8");
+        writeFileSync(dest, content, { encoding: "utf8", mode: 0o644 });
+        printResult(ctx, {
+            extracted: true,
+            from: srcPath,
+            to: dest,
+            nextSteps: [
+                `hscli policy validate ${dest}`,
+                `hscli --policy-file ${dest} crm contacts list`,
+                `export HSCLI_POLICY_FILE=${dest}`,
+            ],
+        });
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/policy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExE,SAAS,eAAe;IACtB,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,4CAA4C;IAC5C,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,gCAAgC,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,mCAAmC,CAAC;QAC/D,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,6BAA6B,CAAC;KAC1D,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,wEAAwE;IACxE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,GAAe;IACpC,OAAO,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAwB;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2GAA2G,CAAC,CAAC;IAElK,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6GAA6G,CAAC;SAC1H,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,CAAC,GAAG,EAAE;gBACf,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,iFAAiF;gBAC1F,WAAW,EAAE;oBACX,0DAA0D;oBAC1D,6DAA6D;iBAC9D;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;YAC5B,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBACzD,IAAI;gBACJ;oBACE,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,OAAO;oBAC3C,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;oBACjC,SAAS,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC;oBAC5D,WAAW,EAAE;wBACX,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;qBAC7C;iBACF;aACF,CAAC,CACH;YACD,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,eAAe,EAAE,MAAM,CAAC,yBAAyB;SAClD,CAAC;QACF,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,0HAA0H,CAAC;SACvI,QAAQ,CAAC,UAAU,EAAE,4CAA4C,CAAC;SAClE,QAAQ,CAAC,QAAQ,EAAE,kDAAkD,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,iEAAiE,CAAC;SAC7F,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,yEAAyE,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;QAC5C,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,CAAC,GAAG,EAAE;gBACf,OAAO;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;gBACtC,WAAW,EAAE,OAAO;gBACpB,eAAe,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;aAC3C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,EAAE;gBACf,OAAO;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;gBACtC,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,aAAa,CAAC,aAAa,IAAI,OAAO;gBACvD,IAAI,EAAE,+DAA+D;aACtE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,4DAA4D,CAAC;SACzE,QAAQ,CAAC,QAAQ,EAAE,0EAA0E,CAAC;SAC9F,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;YAE9B,KAAK,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,KAAK;wBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,WAAW,IAAI,CAAC,IAAI,IAAI,WAAW,iDAAiD,CAAC,CAAC;oBACpI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,WAAW,IAAI,CAAC,IAAI,IAAI,WAAW,yBAAyB,IAAI,CAAC,MAAM,+BAA+B,CAAC,CAAC;oBACzM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;wBAC9F,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,WAAW,IAAI,CAAC,IAAI,IAAI,WAAW,2CAA2C,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;oBAClI,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvE,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,WAAW,IAAI,CAAC,IAAI,IAAI,WAAW,gCAAgC,IAAI,CAAC,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC;oBACnJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,WAAW,CAAC,GAAG,EAAE;gBACf,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBAC1B,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;gBAC5B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM;gBACvD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChG,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ;gBAAE,MAAM,GAAG,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAElH,SAAS;SACN,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAA+C,CAAC;gBAC7G,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC;YAC9H,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;YAClG,CAAC;QACH,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,iBAAiB,CAAC,MAAM;YAC/B,SAAS,EAAE,iBAAiB;YAC5B,IAAI,EAAE,gHAAgH;SACvH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,SAAS;SACN,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4BAA4B,CAAC;SACzC,QAAQ,CAAC,QAAQ,EAAE,oDAAoD,CAAC;SACxE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,aAAa,IAAI,2BAA2B,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxM,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEL,SAAS;SACN,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sDAAsD,CAAC;SACnE,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;SACnC,cAAc,CAAC,aAAa,EAAE,uBAAuB,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,oBAAoB,EAAE,aAAa,IAAI,cAAc,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,oCAAoC,IAAI,2CAA2C,CAAC,CAAC;QAC9H,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,WAAW,CAAC,GAAG,EAAE;YACf,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,IAAI;YACR,SAAS,EAAE;gBACT,yBAAyB,IAAI,EAAE;gBAC/B,uBAAuB,IAAI,oBAAoB;gBAC/C,4BAA4B,IAAI,EAAE;aACnC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/core/policy.d.ts

@@ -1,2 +1,77 @@
 import type { CliContext } from "./output.js";
+/**
+ * Policy-as-code for HSCLI writes.
+ *
+ * Two supported policy formats:
+ *
+ * 1. LEGACY (v0.1-v0.6) — flat JSON with `defaults`, `profiles`, and
+ *    `blockedMethodPathPrefixes`. Still supported for backward compat.
+ *
+ * 2. v0.7+ — structured rules with glob patterns, time windows, and
+ *    approval requirements. Shape:
+ *
+ *    {
+ *      "version": 2,
+ *      "profiles": {
+ *        "<profile-name>": {
+ *          "defaultAction": "allow" | "deny",
+ *          "rules": [
+ *            {
+ *              "match": { "method": "DELETE", "path": "/crm/v3/objects/*" },
+ *              "action": "allow" | "deny",
+ *              "requireChangeTicket": true,
+ *              "requireApproval": "webhook:<url>" | "manual" | null,
+ *              "rateLimit": { "maxPerHour": 10 },
+ *              "window": { "tz": "US/Eastern", "hours": "09-17", "days": "mon-fri" }
+ *            }
+ *          ]
+ *        }
+ *      }
+ *    }
+ *
+ * Rule evaluation: first match wins. If no rule matches, use `defaultAction`
+ * (or fall back to the legacy flat field `allowWrite` for v1 files).
+ */
+export interface PolicyRuleMatch {
+    method?: "POST" | "PATCH" | "PUT" | "DELETE" | "*";
+    path?: string;
+}
+export interface PolicyWindow {
+    tz?: string;
+    hours?: string;
+    days?: string;
+}
+export interface PolicyRateLimit {
+    maxPerHour?: number;
+}
+export interface PolicyRule {
+    name?: string;
+    match?: PolicyRuleMatch;
+    action?: "allow" | "deny";
+    requireChangeTicket?: boolean;
+    requireApproval?: string | null;
+    rateLimit?: PolicyRateLimit;
+    window?: PolicyWindow;
+    allowWrite?: boolean;
+    allowDelete?: boolean;
+}
+export interface PolicyProfileConfig {
+    defaultAction?: "allow" | "deny";
+    rules?: PolicyRule[];
+    allowWrite?: boolean;
+    allowDelete?: boolean;
+    requireChangeTicket?: boolean;
+}
+export interface PolicyConfig {
+    version?: 1 | 2;
+    defaults?: PolicyProfileConfig;
+    profiles?: Record<string, PolicyProfileConfig>;
+    blockedMethodPathPrefixes?: Record<string, string[]>;
+}
+export declare function readPolicyFile(path: string): PolicyConfig;
+/**
+ * Find the first matching rule for a (method, path) pair in a profile config.
+ * Returns null if no rule matches. Supports both v1 and v2 shapes.
+ */
+export declare function findMatchingRule(profileConfig: PolicyProfileConfig, method: string, path: string): PolicyRule | null;
 export declare function enforceWritePolicy(ctx: CliContext, method: "POST" | "PATCH" | "PUT" | "DELETE", path: string): void;

package/dist/core/policy.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { CliError } from "./output.js";
-function readPolicyFile(path) {
+export function readPolicyFile(path) {
     if (!existsSync(path)) {
         throw new CliError("POLICY_FILE_NOT_FOUND", `Policy file not found: ${path}`);
     }
@@ -11,23 +11,141 @@ function readPolicyFile(path) {
         throw new CliError("POLICY_INVALID_JSON", `Invalid policy JSON: ${path}`);
     }
 }
+/** Convert a glob pattern to a regex. `*` matches path segment (no `/`), `**` matches across segments. */
+function globToRegex(pattern) {
+    // Escape regex special chars except * and /
+    let re = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    // ** matches any (including /)
+    re = re.replace(/\*\*/g, "__GLOBSTAR__");
+    // * matches anything except /
+    re = re.replace(/\*/g, "[^/]*");
+    re = re.replace(/__GLOBSTAR__/g, ".*");
+    return new RegExp("^" + re + "$");
+}
+function methodMatches(ruleMethod, requestMethod) {
+    if (!ruleMethod || ruleMethod === "*")
+        return true;
+    return ruleMethod.toUpperCase() === requestMethod.toUpperCase();
+}
+function pathMatches(rulePath, requestPath) {
+    if (!rulePath || rulePath === "*" || rulePath === "**")
+        return true;
+    return globToRegex(rulePath).test(requestPath);
+}
+function isWithinWindow(window) {
+    if (!window)
+        return true;
+    const now = new Date();
+    // Days
+    if (window.days) {
+        const dayNames = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+        const today = dayNames[now.getUTCDay()];
+        const allowed = parseDays(window.days);
+        if (!allowed.includes(today))
+            return false;
+    }
+    // Hours (interpret in window.tz if given, else local)
+    if (window.hours) {
+        const [fromStr, toStr] = window.hours.split("-");
+        const fromHour = Number(fromStr);
+        const toHour = Number(toStr);
+        const tz = window.tz;
+        let currentHour;
+        if (tz) {
+            try {
+                const fmt = new Intl.DateTimeFormat("en-US", { timeZone: tz, hour: "2-digit", hour12: false });
+                currentHour = Number(fmt.format(now).replace(/\D/g, "").slice(0, 2));
+            }
+            catch {
+                currentHour = now.getUTCHours();
+            }
+        }
+        else {
+            currentHour = now.getUTCHours();
+        }
+        if (currentHour < fromHour || currentHour >= toHour)
+            return false;
+    }
+    return true;
+}
+function parseDays(spec) {
+    const map = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+    // "mon-fri"
+    if (/^[a-z]{3}-[a-z]{3}$/i.test(spec)) {
+        const [from, to] = spec.toLowerCase().split("-");
+        const fi = map.indexOf(from);
+        const ti = map.indexOf(to);
+        if (fi === -1 || ti === -1)
+            return [];
+        const out = [];
+        for (let i = fi; i !== ti; i = (i + 1) % 7)
+            out.push(map[i]);
+        out.push(map[ti]);
+        return out;
+    }
+    // "mon,wed,fri"
+    return spec.toLowerCase().split(",").map(s => s.trim()).filter(Boolean);
+}
+/**
+ * Find the first matching rule for a (method, path) pair in a profile config.
+ * Returns null if no rule matches. Supports both v1 and v2 shapes.
+ */
+export function findMatchingRule(profileConfig, method, path) {
+    if (profileConfig.rules && profileConfig.rules.length > 0) {
+        for (const rule of profileConfig.rules) {
+            if (methodMatches(rule.match?.method, method) && pathMatches(rule.match?.path, path)) {
+                return rule;
+            }
+        }
+    }
+    return null;
+}
 export function enforceWritePolicy(ctx, method, path) {
     const policyPath = ctx.policyFile?.trim() || process.env.HSCLI_POLICY_FILE?.trim();
     if (!policyPath)
         return;
     const config = readPolicyFile(policyPath);
-    const profileRule = config.profiles?.[ctx.profile] ?? {};
+    const profileConfig = config.profiles?.[ctx.profile] ?? config.defaults ?? {};
     const defaults = config.defaults ?? {};
-    const allowWrite = profileRule.allowWrite ?? defaults.allowWrite ?? true;
-    const allowDelete = profileRule.allowDelete ?? defaults.allowDelete ?? false;
-    const requireChangeTicket = profileRule.requireChangeTicket ?? defaults.requireChangeTicket ?? false;
+    // v2 style: find matching rule, apply its action
+    const matched = findMatchingRule(profileConfig, method, path) ?? findMatchingRule(defaults, method, path);
+    if (matched) {
+        // Time window check first — outside window always denies
+        if (!isWithinWindow(matched.window)) {
+            throw new CliError("POLICY_OUT_OF_WINDOW", `Policy rule '${matched.name ?? "(unnamed)"}' is outside its allowed time window (${matched.window?.days ?? "any"} ${matched.window?.hours ?? "any"} ${matched.window?.tz ?? "UTC"}).`);
+        }
+        if (matched.action === "deny") {
+            throw new CliError("POLICY_RULE_DENY", `Policy rule '${matched.name ?? "(unnamed)"}' denies ${method} ${path}.`);
+        }
+        if (matched.requireChangeTicket && !ctx.changeTicket?.trim()) {
+            throw new CliError("POLICY_CHANGE_TICKET_REQUIRED", `Policy rule '${matched.name ?? "(unnamed)"}' requires --change-ticket for ${method} ${path}.`);
+        }
+        if (matched.requireApproval) {
+            // v0.7.0: approval flow is not yet implemented. Log + deny with
+            // actionable error. Approvals land in v0.7.1 (webhook/Slack).
+            throw new CliError("POLICY_APPROVAL_REQUIRED", `Policy rule '${matched.name ?? "(unnamed)"}' requires approval (${matched.requireApproval}). Approval workflow lands in v0.7.1.`);
+        }
+        // action === "allow" (or undefined → allow by default when matched)
+    }
+    else {
+        // No rule matched → use defaultAction
+        const defaultAction = profileConfig.defaultAction ?? defaults.defaultAction;
+        if (defaultAction === "deny") {
+            throw new CliError("POLICY_DEFAULT_DENY", `No policy rule matched ${method} ${path} and profile default action is 'deny'.`);
+        }
+    }
+    // v1 legacy flat fields — still honored for backward compat
+    const profileFlat = profileConfig;
+    const allowWrite = profileFlat.allowWrite ?? defaults.allowWrite ?? true;
+    const allowDelete = profileFlat.allowDelete ?? defaults.allowDelete ?? true;
+    const requireChangeTicketLegacy = profileFlat.requireChangeTicket ?? defaults.requireChangeTicket ?? false;
     if (!allowWrite) {
         throw new CliError("POLICY_WRITE_BLOCKED", `Policy blocks write operations for profile '${ctx.profile}'.`);
     }
     if (method === "DELETE" && !allowDelete) {
         throw new CliError("POLICY_DELETE_BLOCKED", `Policy blocks delete operations for profile '${ctx.profile}'.`);
     }
-    if (requireChangeTicket && !ctx.changeTicket?.trim()) {
+    if (requireChangeTicketLegacy && !ctx.changeTicket?.trim()) {
         throw new CliError("POLICY_CHANGE_TICKET_REQUIRED", `Profile '${ctx.profile}' requires --change-ticket for write operations.`);
     }
     const blockedPrefixes = config.blockedMethodPathPrefixes?.[method] ?? [];

package/dist/core/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAcvC,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,MAA2C,EAAE,IAAY;IAC3G,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAe,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAe,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC;IAC7E,MAAM,mBAAmB,GAAG,WAAW,CAAC,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,IAAI,KAAK,CAAC;IAErG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,+CAA+C,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,gDAAgD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,mBAAmB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,YAAY,GAAG,CAAC,OAAO,kDAAkD,CAAC,CAAC;IACjI,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,iBAAiB,MAAM,aAAa,IAAI,IAAI,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/core/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAoFvC,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiB,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,OAAe;IAClC,4CAA4C;IAC5C,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IACvD,+BAA+B;IAC/B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACzC,8BAA8B;IAC9B,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,UAA8B,EAAE,aAAqB;IAC1E,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,UAAU,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,QAA4B,EAAE,WAAmB;IACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,MAAgC;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,OAAO;IACP,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IAED,sDAAsD;IACtD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACrB,IAAI,WAAmB,CAAC;QACxB,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/F,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,WAAW,GAAG,QAAQ,IAAI,WAAW,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,YAAY;IACZ,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,gBAAgB;IAChB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,aAAkC,EAClC,MAAc,EACd,IAAY;IAEZ,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe,EAAE,MAA2C,EAAE,IAAY;IAC3G,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACnF,IAAI,CAAC,UAAU;QAAE,OAAO;IAExB,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAwB,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACnG,MAAM,QAAQ,GAAwB,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE5D,iDAAiD;IACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1G,IAAI,OAAO,EAAE,CAAC;QACZ,yDAAyD;QACzD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,gBAAgB,OAAO,CAAC,IAAI,IAAI,WAAW,yCAAyC,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,IAAI,CACvL,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,gBAAgB,OAAO,CAAC,IAAI,IAAI,WAAW,YAAY,MAAM,IAAI,IAAI,GAAG,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,QAAQ,CAChB,+BAA+B,EAC/B,gBAAgB,OAAO,CAAC,IAAI,IAAI,WAAW,kCAAkC,MAAM,IAAI,IAAI,GAAG,CAC/F,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,gEAAgE;YAChE,8DAA8D;YAC9D,MAAM,IAAI,QAAQ,CAChB,0BAA0B,EAC1B,gBAAgB,OAAO,CAAC,IAAI,IAAI,WAAW,wBAAwB,OAAO,CAAC,eAAe,uCAAuC,CAClI,CAAC;QACJ,CAAC;QAED,oEAAoE;IACtE,CAAC;SAAM,CAAC;QACN,sCAAsC;QACtC,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC;QAC5E,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAChB,qBAAqB,EACrB,0BAA0B,MAAM,IAAI,IAAI,wCAAwC,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,WAAW,GAAwB,aAAa,CAAC;IACvD,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC;IACzE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;IAC5E,MAAM,yBAAyB,GAAG,WAAW,CAAC,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,IAAI,KAAK,CAAC;IAE3G,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,+CAA+C,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,gDAAgD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,yBAAyB,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,+BAA+B,EAAE,YAAY,GAAG,CAAC,OAAO,kDAAkD,CAAC,CAAC;IACjI,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,iBAAiB,MAAM,aAAa,IAAI,IAAI,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/docs/policy-templates/business-hours.json

@@ -0,0 +1,21 @@
+{
+  "version": 2,
+  "description": "Allow writes only during business hours (9am-5pm, Mon-Fri) in US/Eastern timezone. Outside the window, POST/PATCH/PUT/DELETE are denied. Adjust 'tz' to match your portal.",
+  "profiles": {
+    "default": {
+      "defaultAction": "allow",
+      "rules": [
+        {
+          "name": "block-writes-outside-business-hours",
+          "match": { "method": "*", "path": "**" },
+          "action": "allow",
+          "window": {
+            "tz": "US/Eastern",
+            "hours": "09-17",
+            "days": "mon-fri"
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policy-templates/change-ticket-required.json

@@ -0,0 +1,35 @@
+{
+  "version": 2,
+  "description": "Every POST/PATCH/PUT/DELETE must reference a change ticket via --change-ticket <id>. Reads are always allowed.",
+  "profiles": {
+    "default": {
+      "defaultAction": "allow",
+      "rules": [
+        {
+          "name": "writes-require-change-ticket",
+          "match": { "method": "POST", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true
+        },
+        {
+          "name": "patches-require-change-ticket",
+          "match": { "method": "PATCH", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true
+        },
+        {
+          "name": "puts-require-change-ticket",
+          "match": { "method": "PUT", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true
+        },
+        {
+          "name": "deletes-require-change-ticket",
+          "match": { "method": "DELETE", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true
+        }
+      ]
+    }
+  }
+}

package/docs/policy-templates/compliance-strict.json

@@ -0,0 +1,36 @@
+{
+  "version": 2,
+  "description": "Strict compliance profile: writes only in business hours, every write requires a change ticket, all DELETEs blocked, GDPR endpoints require extra approval flow.",
+  "profiles": {
+    "default": {
+      "defaultAction": "allow",
+      "rules": [
+        {
+          "name": "gdpr-endpoints-need-approval",
+          "match": { "method": "*", "path": "**/gdpr-delete**" },
+          "action": "allow",
+          "requireApproval": "manual"
+        },
+        {
+          "name": "block-all-deletes",
+          "match": { "method": "DELETE", "path": "**" },
+          "action": "deny"
+        },
+        {
+          "name": "writes-require-change-ticket-and-hours",
+          "match": { "method": "POST", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true,
+          "window": { "tz": "US/Eastern", "hours": "09-17", "days": "mon-fri" }
+        },
+        {
+          "name": "patches-require-change-ticket-and-hours",
+          "match": { "method": "PATCH", "path": "**" },
+          "action": "allow",
+          "requireChangeTicket": true,
+          "window": { "tz": "US/Eastern", "hours": "09-17", "days": "mon-fri" }
+        }
+      ]
+    }
+  }
+}

package/docs/policy-templates/no-deletes.json

@@ -0,0 +1,17 @@
+{
+  "version": 2,
+  "description": "Allow POST/PATCH/PUT but block all DELETE operations. Good for environments where accidental deletion is expensive and archiving is preferred.",
+  "profiles": {
+    "default": {
+      "defaultAction": "allow",
+      "rules": [
+        {
+          "name": "block-all-deletes",
+          "match": { "method": "DELETE", "path": "**" },
+          "action": "deny"
+        }
+      ],
+      "allowDelete": false
+    }
+  }
+}

package/docs/policy-templates/read-only.json

@@ -0,0 +1,17 @@
+{
+  "version": 2,
+  "description": "Block all writes on the 'default' profile. For ops/support engineers exploring a portal without risking accidental mutation.",
+  "profiles": {
+    "default": {
+      "defaultAction": "deny",
+      "rules": [
+        {
+          "name": "allow-all-reads",
+          "match": { "method": "GET", "path": "**" },
+          "action": "allow"
+        }
+      ],
+      "allowWrite": false
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revfleet/hscli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Headless HubSpot CLI + MCP server. 100% public API coverage (1180 endpoints, 55+ command domains) — full portal, no UI dependency. Enterprise safety rails, self-hosted.",
   "type": "module",
   "bin": {
@@ -56,6 +56,7 @@
   },
   "files": [
     "dist",
+    "docs/policy-templates",
     "README.md",
     "LICENSE",
     "SECURITY.md",