@switchbot/openapi-cli 3.2.0 → 3.2.1

package/dist/mqtt/client.js

@@ -0,0 +1,181 @@
+import { connect } from 'mqtt';
+export class SwitchBotMqttClient {
+    client = null;
+    credential;
+    state = 'connecting';
+    credentialExpired = false;
+    reconnectAttempts = 0;
+    maxReconnectAttempts = 10;
+    disconnecting = false;
+    handlers = new Set();
+    messageHandlers = new Set();
+    credentialRefreshCallback;
+    constructor(credential, onCredentialExpired) {
+        this.credential = credential;
+        this.credentialRefreshCallback = onCredentialExpired;
+    }
+    async connect() {
+        if (this.client && this.state === 'connected')
+            return;
+        // Remove stale listeners before replacing the client instance, otherwise
+        // the old client's close event fires after the new connection is established
+        // (AWS IoT drops the old session), triggering a spurious reconnect loop.
+        if (this.client) {
+            this.client.removeAllListeners();
+            this.client.end(true);
+            this.client = null;
+        }
+        this.setState('connecting');
+        this.credentialExpired = false;
+        this.reconnectAttempts = 0;
+        try {
+            const { tls, brokerUrl, clientId } = this.credential;
+            // tls.ca/cert/keyBase64 are PEM strings despite the misleading field name
+            const options = {
+                clientId,
+                ca: tls.caBase64,
+                cert: tls.certBase64,
+                key: tls.keyBase64,
+                rejectUnauthorized: true,
+                clean: true,
+                reconnectPeriod: 0,
+                connectTimeout: 30000,
+                keepalive: 60,
+                reschedulePings: true,
+            };
+            this.client = connect(brokerUrl, options);
+            this.client.on('connect', () => {
+                this.reconnectAttempts = 0;
+                this.setState('connected');
+                this.credentialExpired = false;
+            });
+            this.client.on('message', (topic, payload) => {
+                for (const handler of this.messageHandlers) {
+                    handler(topic, payload);
+                }
+            });
+            this.client.on('error', (err) => {
+                if (err instanceof Error &&
+                    (err.message.includes('certificate') ||
+                        err.message.includes('ECONNRESET') ||
+                        err.message.includes('handshake'))) {
+                    this.credentialExpired = true;
+                }
+            });
+            this.client.on('close', () => {
+                if (this.disconnecting)
+                    return;
+                if (this.credentialExpired) {
+                    this.setState('failed');
+                }
+                else if (this.reconnectAttempts < this.maxReconnectAttempts) {
+                    this.attemptReconnect();
+                }
+                else {
+                    this.setState('failed');
+                }
+            });
+            await new Promise((resolve, reject) => {
+                const timeout = setTimeout(() => {
+                    reject(new Error('MQTT connection timeout'));
+                }, 15000);
+                const onConnect = () => {
+                    clearTimeout(timeout);
+                    this.client?.removeListener('error', onError);
+                    resolve();
+                };
+                const onError = (err) => {
+                    clearTimeout(timeout);
+                    this.client?.removeListener('connect', onConnect);
+                    reject(err);
+                };
+                if (this.client?.connected) {
+                    clearTimeout(timeout);
+                    resolve();
+                }
+                else {
+                    this.client?.once('connect', onConnect);
+                    this.client?.once('error', onError);
+                }
+            });
+        }
+        catch (err) {
+            this.setState('failed');
+            throw err;
+        }
+    }
+    async attemptReconnect() {
+        this.reconnectAttempts++;
+        this.setState('reconnecting');
+        if (this.credentialExpired && this.credentialRefreshCallback) {
+            try {
+                this.credential = await this.credentialRefreshCallback();
+                this.credentialExpired = false;
+            }
+            catch {
+                this.setState('failed');
+                return;
+            }
+        }
+        const delay = Math.min(30000, 1000 * Math.pow(2, this.reconnectAttempts - 1));
+        await new Promise((r) => setTimeout(r, delay));
+        try {
+            await this.connect();
+        }
+        catch {
+            if (this.reconnectAttempts < this.maxReconnectAttempts) {
+                await this.attemptReconnect();
+            }
+            else {
+                this.setState('failed');
+            }
+        }
+    }
+    setState(newState) {
+        if (this.state !== newState) {
+            this.state = newState;
+            for (const handler of this.handlers) {
+                handler(newState);
+            }
+        }
+    }
+    subscribe(topic) {
+        if (this.client && this.state === 'connected') {
+            this.client.subscribe(topic, (err) => {
+                if (err) {
+                    console.error(`Failed to subscribe to ${topic}:`, err);
+                }
+            });
+        }
+    }
+    onStateChange(handler) {
+        this.handlers.add(handler);
+        return () => {
+            this.handlers.delete(handler);
+        };
+    }
+    onMessage(handler) {
+        this.messageHandlers.add(handler);
+        return () => {
+            this.messageHandlers.delete(handler);
+        };
+    }
+    getState() {
+        return this.state;
+    }
+    isConnected() {
+        return this.state === 'connected' && this.client?.connected === true;
+    }
+    async disconnect() {
+        this.disconnecting = true;
+        if (this.client) {
+            await new Promise((resolve) => {
+                this.client?.end(false, () => resolve());
+            });
+            this.client = null;
+        }
+        this.disconnecting = false;
+        this.setState('failed');
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/mqtt/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/mqtt/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAO/B,MAAM,OAAO,mBAAmB;IACtB,MAAM,GAAsB,IAAI,CAAC;IACjC,UAAU,CAAiB;IAC3B,KAAK,GAAc,YAAY,CAAC;IAChC,iBAAiB,GAAG,KAAK,CAAC;IAC1B,iBAAiB,GAAG,CAAC,CAAC;IACtB,oBAAoB,GAAG,EAAE,CAAC;IAC1B,aAAa,GAAG,KAAK,CAAC;IACtB,QAAQ,GAAoC,IAAI,GAAG,EAAE,CAAC;IACtD,eAAe,GAAkD,IAAI,GAAG,EAAE,CAAC;IAC3E,yBAAyB,CAA6B;IAE9D,YAAY,UAA0B,EAAE,mBAA+C;QACrF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,yBAAyB,GAAG,mBAAmB,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO;QAEtD,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC5B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;YACrD,0EAA0E;YAC1E,MAAM,OAAO,GAAmB;gBAC9B,QAAQ;gBACR,EAAE,EAAE,GAAG,CAAC,QAAQ;gBAChB,IAAI,EAAE,GAAG,CAAC,UAAU;gBACpB,GAAG,EAAE,GAAG,CAAC,SAAS;gBAClB,kBAAkB,EAAE,IAAI;gBACxB,KAAK,EAAE,IAAI;gBACX,eAAe,EAAE,CAAC;gBAClB,cAAc,EAAE,KAAK;gBACrB,SAAS,EAAE,EAAE;gBACb,eAAe,EAAE,IAAI;aACtB,CAAC;YAEF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC7B,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC3B,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACjC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC3C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC3C,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,IACE,GAAG,YAAY,KAAK;oBACpB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;wBAClC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;wBAClC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EACpC,CAAC;oBACD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,IAAI,IAAI,CAAC,aAAa;oBAAE,OAAO;gBAC/B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;qBAAM,IAAI,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBAC/C,CAAC,EAAE,KAAK,CAAC,CAAC;gBAEV,MAAM,SAAS,GAAG,GAAG,EAAE;oBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAC9C,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC;gBAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;oBAC7B,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAClD,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,CAAC;gBAEF,IAAI,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;oBAC3B,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBACxC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAE9B,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACzD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,QAAmB;QAClC,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;YACtB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAC,KAAa;QACrB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;gBACnC,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,CAAC,KAAK,CAAC,0BAA0B,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,aAAa,CAAC,OAAmC;QAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,OAAiD;QACzD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/mqtt/credential.d.ts

@@ -0,0 +1,16 @@
+export interface MqttCredential {
+    brokerUrl: string;
+    region: string;
+    clientId: string;
+    topics: {
+        status: string;
+    };
+    qos: number;
+    tls: {
+        enabled: boolean;
+        caBase64: string;
+        certBase64: string;
+        keyBase64: string;
+    };
+}
+export declare function fetchMqttCredential(token: string, secret: string): Promise<MqttCredential>;

package/dist/mqtt/credential.js

@@ -0,0 +1,31 @@
+import crypto from 'node:crypto';
+import { buildAuthHeaders } from '../auth.js';
+const CREDENTIAL_ENDPOINT = 'https://api.switchbot.net/v1.1/iot/credential';
+export async function fetchMqttCredential(token, secret) {
+    // Use a random instanceId so each CLI session gets its own clientId, avoiding
+    // conflicts with the SwitchBot cloud service that shares the same account credentials.
+    const instanceId = crypto.randomUUID().replace(/-/g, '').slice(0, 16);
+    const headers = buildAuthHeaders(token, secret);
+    const res = await fetch(CREDENTIAL_ENDPOINT, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ instanceId }),
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok) {
+        throw new Error(`MQTT credential request failed: HTTP ${res.status} ${res.statusText}`);
+    }
+    const json = (await res.json());
+    if (json.statusCode !== 100) {
+        throw new Error(`MQTT credential API error: statusCode ${json.statusCode}`);
+    }
+    // Response shape: { statusCode, body: { body: { channels: { mqtt: ... } } } }
+    const outer = json.body;
+    const inner = (outer.body ?? outer);
+    const channels = inner.channels;
+    if (!channels?.mqtt) {
+        throw new Error('Unexpected MQTT credential response — channels.mqtt missing');
+    }
+    return channels.mqtt;
+}
+//# sourceMappingURL=credential.js.map

package/dist/mqtt/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/mqtt/credential.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAkB9C,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACrE,8EAA8E;IAC9E,uFAAuF;IACvF,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEtE,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;IAEzE,IAAI,IAAI,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,8EAA8E;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,IAA+B,CAAC;IACnD,MAAM,KAAK,GAAG,CAAE,KAAK,CAAC,IAA4C,IAAI,KAAK,CAA4B,CAAC;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAgD,CAAC;IAExE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/policy/add-rule.d.ts

@@ -0,0 +1,21 @@
+export interface AddRuleOptions {
+    ruleYaml: string;
+    policyPath: string;
+    enableAutomation?: boolean;
+    force?: boolean;
+}
+export interface AddRuleResult {
+    ruleName: string;
+    diff: string;
+    nextSource: string;
+}
+export declare class AddRuleError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare function addRuleToPolicySource(opts: AddRuleOptions): AddRuleResult;
+export declare function addRuleToPolicyFile(opts: AddRuleOptions & {
+    dryRun?: boolean;
+}): AddRuleResult & {
+    written: boolean;
+};

package/dist/policy/add-rule.js

@@ -0,0 +1,125 @@
+import { parseDocument, isMap, isSeq, isScalar, LineCounter } from 'yaml';
+import { parse as yamlParse } from 'yaml';
+import { loadPolicyFile } from './load.js';
+import { validateLoadedPolicy } from './validate.js';
+import fs from 'node:fs';
+export class AddRuleError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'AddRuleError';
+    }
+}
+function buildDiff(before, after) {
+    const beforeLines = before.split('\n');
+    const afterLines = after.split('\n');
+    const lines = ['--- before', '+++ after'];
+    let i = 0;
+    let j = 0;
+    while (i < beforeLines.length || j < afterLines.length) {
+        const b = beforeLines[i];
+        const a = afterLines[j];
+        if (i < beforeLines.length && j < afterLines.length && b === a) {
+            lines.push(` ${b}`);
+            i++;
+            j++;
+        }
+        else if (j < afterLines.length && (i >= beforeLines.length || b !== a)) {
+            lines.push(`+${a}`);
+            j++;
+        }
+        else {
+            lines.push(`-${b}`);
+            i++;
+        }
+    }
+    return lines.join('\n');
+}
+function isNullNode(node) {
+    return isScalar(node) && node.value === null;
+}
+export function addRuleToPolicySource(opts) {
+    const loaded = loadPolicyFile(opts.policyPath);
+    const beforeSource = loaded.source;
+    // Parse the incoming rule
+    let ruleObj;
+    try {
+        ruleObj = yamlParse(opts.ruleYaml);
+    }
+    catch (err) {
+        throw new AddRuleError(`Could not parse rule YAML: ${err.message}`, 'invalid-rule-yaml');
+    }
+    if (!ruleObj || typeof ruleObj !== 'object' || Array.isArray(ruleObj)) {
+        throw new AddRuleError('Rule YAML must be a single mapping object', 'invalid-rule-shape');
+    }
+    const ruleName = ruleObj['name'];
+    if (typeof ruleName !== 'string' || !ruleName) {
+        throw new AddRuleError('Rule must have a non-empty "name" field', 'missing-rule-name');
+    }
+    // Clone the document using source round-trip (preserves comments)
+    const clone = parseDocument(beforeSource, { keepSourceTokens: true });
+    if (!isMap(clone.contents)) {
+        throw new AddRuleError('Policy root must be a YAML mapping', 'invalid-policy-shape');
+    }
+    // Ensure automation block exists
+    let automationNode = clone.contents.get('automation', true);
+    if (!automationNode || isNullNode(automationNode)) {
+        clone.setIn(['automation'], clone.createNode({ enabled: false, rules: [] }));
+        automationNode = clone.contents.get('automation', true);
+    }
+    // Ensure automation.rules exists and is a sequence
+    const rulesNode = clone.getIn(['automation', 'rules'], true);
+    if (!rulesNode || isNullNode(rulesNode)) {
+        clone.setIn(['automation', 'rules'], clone.createNode([]));
+    }
+    else if (!isSeq(rulesNode)) {
+        throw new AddRuleError('automation.rules exists but is not a sequence; cannot append', 'invalid-rules-shape');
+    }
+    // Duplicate name check — use JS conversion for simplicity
+    const policyJs = clone.toJS({ maxAliasCount: 100 });
+    const existingRulesJs = policyJs['automation']?.['rules'];
+    const existingRulesArr = Array.isArray(existingRulesJs) ? existingRulesJs : [];
+    const duplicateIdx = existingRulesArr.findIndex((r) => r?.['name'] === ruleName);
+    if (duplicateIdx !== -1 && !opts.force) {
+        throw new AddRuleError(`Rule named "${ruleName}" already exists. Use --force to overwrite.`, 'duplicate-rule-name');
+    }
+    if (duplicateIdx !== -1 && opts.force) {
+        const rulesSeq = clone.getIn(['automation', 'rules'], true);
+        rulesSeq.items.splice(duplicateIdx, 1);
+    }
+    // Enable automation if requested
+    if (opts.enableAutomation) {
+        clone.setIn(['automation', 'enabled'], true);
+    }
+    // Append the rule
+    const ruleNode = clone.createNode(ruleObj);
+    const rulesSeq = clone.getIn(['automation', 'rules'], true);
+    rulesSeq.items.push(ruleNode);
+    const nextSource = String(clone);
+    // Validate the resulting policy
+    const reLC = new LineCounter();
+    const reDoc = parseDocument(nextSource, { lineCounter: reLC, keepSourceTokens: true });
+    const validation = validateLoadedPolicy({
+        path: opts.policyPath,
+        source: nextSource,
+        doc: reDoc,
+        lineCounter: reLC,
+        data: reDoc.toJS({ maxAliasCount: 100 }),
+    });
+    if (!validation.valid) {
+        const msgs = validation.errors.map((e) => `  line ${e.line}: ${e.message}`).join('\n');
+        throw new AddRuleError(`Policy would be invalid after adding the rule:\n${msgs}`, 'validation-failed');
+    }
+    const diff = buildDiff(beforeSource, nextSource);
+    return { ruleName, diff, nextSource };
+}
+export function addRuleToPolicyFile(opts) {
+    const result = addRuleToPolicySource(opts);
+    if (!opts.dryRun) {
+        fs.writeFileSync(opts.policyPath, result.nextSource, 'utf8');
+        return { ...result, written: true };
+    }
+    return { ...result, written: false };
+}
+//# sourceMappingURL=add-rule.js.map

package/dist/policy/add-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-rule.js","sourceRoot":"","sources":["../../src/policy/add-rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAC1E,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,cAAc,EAA8C,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,MAAM,SAAS,CAAC;AAezB,MAAM,OAAO,YAAa,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,IAAY;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,SAAI,GAAJ,IAAI,CAAQ;QAEvD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEpD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAEnC,0BAA0B;IAC1B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CACpB,8BAA+B,GAAa,CAAC,OAAO,EAAE,EACtD,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC,2CAA2C,EAAE,oBAAoB,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,QAAQ,GAAI,OAAmC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,YAAY,CAAC,yCAAyC,EAAE,mBAAmB,CAAC,CAAC;IACzF,CAAC;IAED,kEAAkE;IAClE,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,sBAAsB,CAAC,CAAC;IACvF,CAAC;IAED,iCAAiC;IACjC,IAAI,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7E,cAAc,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,mDAAmD;IACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,8DAA8D,EAC9D,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAA4B,CAAC;IAC/E,MAAM,eAAe,GAAI,QAAQ,CAAC,YAAY,CAA6B,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC;IAEjF,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,eAAe,QAAQ,6CAA6C,EACpE,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,CAA2B,CAAC;QACtF,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,iCAAiC;IACjC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,kBAAkB;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,IAAI,CAA2B,CAAC;IACtF,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,gCAAgC;IAChC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,UAAU;QACrB,MAAM,EAAE,UAAU;QAClB,GAAG,EAAE,KAAuC;QAC5C,WAAW,EAAE,IAAI;QACjB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;KACzC,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,YAAY,CACpB,mDAAmD,IAAI,EAAE,EACzD,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACjD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAA2C;IAC7E,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}

package/dist/policy/diff.d.ts

@@ -0,0 +1,21 @@
+export type DiffKind = 'added' | 'removed' | 'changed';
+export interface PolicyDiffChange {
+    path: string;
+    kind: DiffKind;
+    before?: unknown;
+    after?: unknown;
+}
+export interface PolicyDiffResult {
+    equal: boolean;
+    changeCount: number;
+    truncated: boolean;
+    stats: {
+        added: number;
+        removed: number;
+        changed: number;
+    };
+    changes: PolicyDiffChange[];
+    diff: string;
+}
+export declare const MAX_POLICY_DIFF_CHANGES = 200;
+export declare function diffPolicyValues(leftDoc: unknown, rightDoc: unknown, leftSource: string, rightSource: string, maxChanges?: number): PolicyDiffResult;

package/dist/policy/diff.js

@@ -0,0 +1,92 @@
+export const MAX_POLICY_DIFF_CHANGES = 200;
+function isPlainObject(v) {
+    return !!v && typeof v === 'object' && !Array.isArray(v);
+}
+function collectPolicyDiff(left, right, at, out, limit) {
+    if (out.length >= limit)
+        return;
+    if (Array.isArray(left) && Array.isArray(right)) {
+        const maxLen = Math.max(left.length, right.length);
+        for (let i = 0; i < maxLen; i++) {
+            if (out.length >= limit)
+                return;
+            const path = `${at}[${i}]`;
+            if (i >= left.length) {
+                out.push({ path, kind: 'added', after: right[i] });
+            }
+            else if (i >= right.length) {
+                out.push({ path, kind: 'removed', before: left[i] });
+            }
+            else {
+                collectPolicyDiff(left[i], right[i], path, out, limit);
+            }
+        }
+        return;
+    }
+    if (isPlainObject(left) && isPlainObject(right)) {
+        const keys = new Set([...Object.keys(left), ...Object.keys(right)]);
+        for (const key of [...keys].sort()) {
+            if (out.length >= limit)
+                return;
+            const path = at === '$' ? `$.${key}` : `${at}.${key}`;
+            const leftHas = Object.prototype.hasOwnProperty.call(left, key);
+            const rightHas = Object.prototype.hasOwnProperty.call(right, key);
+            if (!leftHas && rightHas) {
+                out.push({ path, kind: 'added', after: right[key] });
+            }
+            else if (leftHas && !rightHas) {
+                out.push({ path, kind: 'removed', before: left[key] });
+            }
+            else {
+                collectPolicyDiff(left[key], right[key], path, out, limit);
+            }
+        }
+        return;
+    }
+    if (!Object.is(left, right)) {
+        out.push({ path: at, kind: 'changed', before: left, after: right });
+    }
+}
+function buildLineDiff(before, after) {
+    const beforeLines = before.split('\n');
+    const afterLines = after.split('\n');
+    const lines = ['--- before', '+++ after'];
+    let i = 0;
+    let j = 0;
+    while (i < beforeLines.length || j < afterLines.length) {
+        const b = beforeLines[i];
+        const a = afterLines[j];
+        if (i < beforeLines.length && j < afterLines.length && b === a) {
+            lines.push(` ${b}`);
+            i++;
+            j++;
+        }
+        else if (j < afterLines.length && (i >= beforeLines.length || b !== a)) {
+            lines.push(`+${a}`);
+            j++;
+        }
+        else {
+            lines.push(`-${b}`);
+            i++;
+        }
+    }
+    return lines.join('\n');
+}
+export function diffPolicyValues(leftDoc, rightDoc, leftSource, rightSource, maxChanges = MAX_POLICY_DIFF_CHANGES) {
+    const changes = [];
+    collectPolicyDiff(leftDoc, rightDoc, '$', changes, maxChanges);
+    const equal = changes.length === 0;
+    return {
+        equal,
+        changeCount: changes.length,
+        truncated: changes.length >= maxChanges,
+        stats: {
+            added: changes.filter((c) => c.kind === 'added').length,
+            removed: changes.filter((c) => c.kind === 'removed').length,
+            changed: changes.filter((c) => c.kind === 'changed').length,
+        },
+        changes,
+        diff: buildLineDiff(leftSource, rightSource),
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/policy/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/policy/diff.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAa,EACb,KAAc,EACd,EAAU,EACV,GAAuB,EACvB,KAAa;IAEb,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO;IAEhC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO;YAChC,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;YAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,MAAM,IAAI,KAAK;gBAAE,OAAO;YAChC,MAAM,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClE,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,KAAa;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IAEpD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgB,EAChB,QAAiB,EACjB,UAAkB,EAClB,WAAmB,EACnB,UAAU,GAAG,uBAAuB;IAEpC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IACnC,OAAO;QACL,KAAK;QACL,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;QACvC,KAAK,EAAE;YACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;YACvD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM;YAC3D,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM;SAC5D;QACD,OAAO;QACP,IAAI,EAAE,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/policy/format.d.ts

@@ -0,0 +1,6 @@
+import type { PolicyValidationResult } from './validate.js';
+export interface FormatOptions {
+    color?: boolean;
+    noSnippet?: boolean;
+}
+export declare function formatValidationResult(result: PolicyValidationResult, source: string, opts?: FormatOptions): string;

package/dist/policy/format.js

@@ -0,0 +1,58 @@
+import chalk, { Chalk } from 'chalk';
+const noColorChalk = new Chalk({ level: 0 });
+function colorize(enabled) {
+    return enabled ? chalk : noColorChalk;
+}
+function snippet(source, line, col, length, c) {
+    const lines = source.split(/\r?\n/);
+    if (line < 1 || line > lines.length)
+        return '';
+    const lineText = lines[line - 1];
+    const gutter = `  ${line} | `;
+    const pad = ' '.repeat(gutter.length);
+    const caretStart = Math.max(0, col - 1);
+    const caretLen = Math.max(1, length);
+    const caret = `${' '.repeat(caretStart)}${c.red('^'.repeat(caretLen))}`;
+    return `${c.dim(gutter)}${lineText}\n${c.dim(pad)}${caret}`;
+}
+function estimateTokenLength(source, line, col) {
+    const lines = source.split(/\r?\n/);
+    if (line < 1 || line > lines.length)
+        return 1;
+    const lineText = lines[line - 1];
+    const start = Math.max(0, col - 1);
+    if (start >= lineText.length)
+        return 1;
+    const rest = lineText.slice(start);
+    const quoted = rest.match(/^(['"]).*?\1/);
+    if (quoted)
+        return quoted[0].length;
+    const token = rest.match(/^[^\s,\[\]{}]+/);
+    return token ? token[0].length : 1;
+}
+function formatError(err, policyPath, source, opts) {
+    const c = colorize(opts.color ?? true);
+    const loc = err.line !== undefined && err.col !== undefined ? `${err.line}:${err.col}` : '(unknown)';
+    const header = `${c.cyan(policyPath)}:${c.yellow(loc)}`;
+    const body = [`${c.red.bold('error')}: ${err.message}`];
+    if (err.line !== undefined && err.col !== undefined && !opts.noSnippet) {
+        const len = estimateTokenLength(source, err.line, err.col);
+        const snip = snippet(source, err.line, err.col, len, c);
+        if (snip)
+            body.unshift(snip);
+    }
+    if (err.hint)
+        body.push(`${c.green.bold('hint')}:  ${err.hint}`);
+    return [header, ...body].join('\n');
+}
+export function formatValidationResult(result, source, opts = {}) {
+    const c = colorize(opts.color ?? true);
+    if (result.valid) {
+        return `${c.green.bold('✓')} ${result.policyPath} is valid (schema v${result.schemaVersion})`;
+    }
+    const blocks = result.errors.map((e) => formatError(e, result.policyPath, source, opts));
+    const count = result.errors.length;
+    const footer = `${c.red.bold(`✗ ${count} ${count === 1 ? 'error' : 'errors'}`)} in ${result.policyPath} (schema v${result.schemaVersion})`;
+    return [...blocks, '', footer].join('\n\n').replace(/\n{3,}/g, '\n\n');
+}
+//# sourceMappingURL=format.js.map

package/dist/policy/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../src/policy/format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAQrC,MAAM,YAAY,GAAG,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAE7C,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;AACxC,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,IAAY,EAAE,GAAW,EAAE,MAAc,EAAE,CAAe;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAExE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,QAAQ,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY,EAAE,GAAW;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IACnC,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAClB,GAA0B,EAC1B,UAAkB,EAClB,MAAc,EACd,IAAmB;IAEnB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IACrG,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAEjE,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,MAAc,EACd,OAAsB,EAAE;IAExB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,sBAAsB,MAAM,CAAC,aAAa,GAAG,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,aAAa,GAAG,CAAC;IAC3I,OAAO,CAAC,GAAG,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC"}

package/dist/policy/load.d.ts

@@ -0,0 +1,32 @@
+import { LineCounter, type Document } from 'yaml';
+export declare const DEFAULT_POLICY_PATH: string;
+export interface ResolvePolicyPathOptions {
+    flag?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export declare function resolvePolicyPath(options?: ResolvePolicyPathOptions): string;
+export interface LoadedPolicy {
+    path: string;
+    source: string;
+    doc: Document.Parsed;
+    lineCounter: LineCounter;
+    data: unknown;
+}
+export declare class PolicyFileNotFoundError extends Error {
+    readonly policyPath: string;
+    constructor(policyPath: string);
+}
+export declare class PolicyYamlParseError extends Error {
+    readonly policyPath: string;
+    readonly yamlErrors: ReadonlyArray<{
+        line?: number;
+        col?: number;
+        message: string;
+    }>;
+    constructor(message: string, policyPath: string, yamlErrors: ReadonlyArray<{
+        line?: number;
+        col?: number;
+        message: string;
+    }>);
+}
+export declare function loadPolicyFile(policyPath: string): LoadedPolicy;