@transcend-io/cli 10.27.5 → 10.29.0

package/dist/{impl-PYtpY5hs2.mjs.map → impl-Cli2XRp02.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-PYtpY5hs2.mjs","names":[],"sources":["../src/commands/policy/versions/impl.ts"],"sourcesContent":["import colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { EMPTY_CELL } from '../constants.js';\nimport {\n  buildPolicyEngineClient,\n  policyEngineRequest,\n  printResult,\n  renderTable,\n  resolveBundleIdByName,\n  setPolicyEngineCliDebug,\n} from '../helpers/index.js';\nimport type { PolicyBundleVersionListResponse } from '../types.js';\n\n/** CLI flags for `transcend policy versions`. */\nexport interface VersionsCommandFlags {\n  /** Tenant-unique bundle name */\n  'bundle-name': string;\n  /** Transcend API key */\n  auth: string;\n  /** Transcend API URL */\n  'transcend-url': string;\n  /** Page size */\n  limit: number;\n  /** Cursor from a previous page's pageInfo.endCursor */\n  after?: string;\n  /** Print raw JSON response */\n  json: boolean;\n  /** Include technical error details when a command fails */\n  debug?: boolean;\n}\n\n/**\n * List versions for a policy bundle.\n *\n * @param this - CLI context\n * @param flags - Command flags\n */\nexport async function versions(\n  this: LocalContext,\n  {\n    'bundle-name': bundleName,\n    auth,\n    'transcend-url': transcendUrl,\n    limit,\n    after,\n    json,\n    debug = false,\n  }: VersionsCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n  setPolicyEngineCliDebug(debug);\n\n  const client = buildPolicyEngineClient(transcendUrl, auth);\n  const bundleId = await resolveBundleIdByName(client, bundleName);\n\n  if (!bundleId) {\n    throw new Error(`Policy bundle \"${bundleName}\" was not found for this organization.`);\n  }\n\n  this.logger.info(colors.green(`Listing versions for bundle \"${bundleName}\"...`));\n\n  const searchParams: Record<string, string | number> = { limit };\n  if (after) {\n    searchParams.after = after;\n  }\n\n  const body = await policyEngineRequest(\n    client\n      .get(`v1/policy-engine/policy-bundles/${bundleId}/versions`, {\n        searchParams,\n      })\n      .json<PolicyBundleVersionListResponse>(),\n  );\n\n  printResult(this.process.stdout, {\n    json,\n    data: body,\n    renderTable: () => {\n      if (body.nodes.length === 0) {\n        // Distinguish \"this page is empty because you paginated past the end\"\n        // from \"the bundle genuinely has no versions\" — the latter is already\n        // surfaced during version resolution upstream.\n        return after\n          ? `No more versions for bundle \"${bundleName}\" (end of results).`\n          : `No versions found for bundle \"${bundleName}\".`;\n      }\n\n      const rows = body.nodes.map((version) => [\n        version.id,\n        version.version,\n        version.createdAt,\n        version.activatedAt ?? EMPTY_CELL,\n        version.deactivatedAt ?? EMPTY_CELL,\n      ]);\n\n      let table = renderTable(['id', 'version', 'createdAt', 'activatedAt', 'deactivatedAt'], rows);\n      if (body.pageInfo.endCursor) {\n        table += `\\n\\nafter: ${body.pageInfo.endCursor}`;\n      }\n      return table;\n    },\n  });\n}\n"],"mappings":"uSAuCA,eAAsB,EAEpB,CACE,cAAe,EACf,OACA,gBAAiB,EACjB,QACA,QACA,OACA,QAAQ,IAEK,CACf,EAAoB,KAAK,QAAQ,CACjC,EAAwB,EAAM,CAE9B,IAAM,EAAS,EAAwB,EAAc,EAAK,CACpD,EAAW,MAAM,EAAsB,EAAQ,EAAW,CAEhE,GAAI,CAAC,EACH,MAAU,MAAM,kBAAkB,EAAW,wCAAwC,CAGvF,KAAK,OAAO,KAAK,EAAO,MAAM,gCAAgC,EAAW,MAAM,CAAC,CAEhF,IAAM,EAAgD,CAAE,QAAO,CAC3D,IACF,EAAa,MAAQ,GAGvB,IAAM,EAAO,MAAM,EACjB,EACG,IAAI,mCAAmC,EAAS,WAAY,CAC3D,eACD,CAAC,CACD,MAAuC,CAC3C,CAED,EAAY,KAAK,QAAQ,OAAQ,CAC/B,OACA,KAAM,EACN,gBAAmB,CACjB,GAAI,EAAK,MAAM,SAAW,EAIxB,OAAO,EACH,gCAAgC,EAAW,qBAC3C,iCAAiC,EAAW,IAWlD,IAAI,EAAQ,EAAY,CAAC,KAAM,UAAW,YAAa,cAAe,gBAAgB,CARzE,EAAK,MAAM,IAAK,GAAY,CACvC,EAAQ,GACR,EAAQ,QACR,EAAQ,UACR,EAAQ,aAAA,IACR,EAAQ,eAAA,IACT,CAE2F,CAAC,CAI7F,OAHI,EAAK,SAAS,YAChB,GAAS,cAAc,EAAK,SAAS,aAEhC,GAEV,CAAC"}
+{"version":3,"file":"impl-Cli2XRp02.mjs","names":[],"sources":["../src/commands/policy/versions/impl.ts"],"sourcesContent":["import colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { EMPTY_CELL } from '../constants.js';\nimport {\n  buildPolicyEngineClient,\n  policyEngineRequest,\n  printResult,\n  renderTable,\n  resolveBundleIdByName,\n  setPolicyEngineCliDebug,\n} from '../helpers/index.js';\nimport type { PolicyBundleVersionListResponse } from '../types.js';\n\n/** CLI flags for `transcend policy versions`. */\nexport interface VersionsCommandFlags {\n  /** Tenant-unique bundle name */\n  'bundle-name': string;\n  /** Transcend API key */\n  auth: string;\n  /** Transcend API URL */\n  'transcend-url': string;\n  /** Page size */\n  limit: number;\n  /** Cursor from a previous page's pageInfo.endCursor */\n  after?: string;\n  /** Print raw JSON response */\n  json: boolean;\n  /** Include technical error details when a command fails */\n  debug?: boolean;\n}\n\n/**\n * List versions for a policy bundle.\n *\n * @param this - CLI context\n * @param flags - Command flags\n */\nexport async function versions(\n  this: LocalContext,\n  {\n    'bundle-name': bundleName,\n    auth,\n    'transcend-url': transcendUrl,\n    limit,\n    after,\n    json,\n    debug = false,\n  }: VersionsCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n  setPolicyEngineCliDebug(debug);\n\n  const client = buildPolicyEngineClient(transcendUrl, auth);\n  const bundleId = await resolveBundleIdByName(client, bundleName);\n\n  if (!bundleId) {\n    throw new Error(`Policy bundle \"${bundleName}\" was not found for this organization.`);\n  }\n\n  this.logger.info(colors.green(`Listing versions for bundle \"${bundleName}\"...`));\n\n  const searchParams: Record<string, string | number> = { limit };\n  if (after) {\n    searchParams.after = after;\n  }\n\n  const body = await policyEngineRequest(\n    client\n      .get(`v1/policy-engine/policy-bundles/${bundleId}/versions`, {\n        searchParams,\n      })\n      .json<PolicyBundleVersionListResponse>(),\n  );\n\n  printResult(this.process.stdout, {\n    json,\n    data: body,\n    renderTable: () => {\n      if (body.nodes.length === 0) {\n        // Distinguish \"this page is empty because you paginated past the end\"\n        // from \"the bundle genuinely has no versions\" — the latter is already\n        // surfaced during version resolution upstream.\n        return after\n          ? `No more versions for bundle \"${bundleName}\" (end of results).`\n          : `No versions found for bundle \"${bundleName}\".`;\n      }\n\n      const rows = body.nodes.map((version) => [\n        version.id,\n        version.version,\n        version.createdAt,\n        version.activatedAt ?? EMPTY_CELL,\n        version.deactivatedAt ?? EMPTY_CELL,\n      ]);\n\n      let table = renderTable(['id', 'version', 'createdAt', 'activatedAt', 'deactivatedAt'], rows);\n      if (body.pageInfo.endCursor) {\n        table += `\\n\\nafter: ${body.pageInfo.endCursor}`;\n      }\n      return table;\n    },\n  });\n}\n"],"mappings":"uSAuCA,eAAsB,EAEpB,CACE,cAAe,EACf,OACA,gBAAiB,EACjB,QACA,QACA,OACA,QAAQ,IAEK,CACf,EAAoB,KAAK,QAAQ,CACjC,EAAwB,EAAM,CAE9B,IAAM,EAAS,EAAwB,EAAc,EAAK,CACpD,EAAW,MAAM,EAAsB,EAAQ,EAAW,CAEhE,GAAI,CAAC,EACH,MAAU,MAAM,kBAAkB,EAAW,wCAAwC,CAGvF,KAAK,OAAO,KAAK,EAAO,MAAM,gCAAgC,EAAW,MAAM,CAAC,CAEhF,IAAM,EAAgD,CAAE,QAAO,CAC3D,IACF,EAAa,MAAQ,GAGvB,IAAM,EAAO,MAAM,EACjB,EACG,IAAI,mCAAmC,EAAS,WAAY,CAC3D,eACD,CAAC,CACD,MAAuC,CAC3C,CAED,EAAY,KAAK,QAAQ,OAAQ,CAC/B,OACA,KAAM,EACN,gBAAmB,CACjB,GAAI,EAAK,MAAM,SAAW,EAIxB,OAAO,EACH,gCAAgC,EAAW,qBAC3C,iCAAiC,EAAW,IAWlD,IAAI,EAAQ,EAAY,CAAC,KAAM,UAAW,YAAa,cAAe,gBAAgB,CARzE,EAAK,MAAM,IAAK,GAAY,CACvC,EAAQ,GACR,EAAQ,QACR,EAAQ,UACR,EAAQ,aAAA,IACR,EAAQ,eAAA,IACT,CAE2F,CAAC,CAI7F,OAHI,EAAK,SAAS,YAChB,GAAS,cAAc,EAAK,SAAS,aAEhC,GAEV,CAAC"}

package/dist/{impl-CBC5K-IH.mjs → impl-CuDs6SsI.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./updateConsentManagerVersionToLatest-CCzWEBEj.mjs";import{t}from"./validateTranscendAuth-3guZJPKH.mjs";import{t as n}from"./done-input-validation-BFgMCQWH.mjs";import{ConsentBundleType as r}from"@transcend-io/privacy-types";import i from"colors";import{mapSeries as a}from"@transcend-io/utils";async function o({auth:o,bundleTypes:s=[r.Production,r.Test],deploy:c,transcendUrl:l}){n(this.process);let u=await t(o,this);typeof u==`string`?(await e({deploy:c,transcendUrl:l,auth:u,bundleTypes:s}),this.logger.info(i.green(`Successfully updated Consent Manager!`))):(await a(u,async t=>{this.logger.info(i.magenta(`Updating Consent Manager for organization "${t.organizationName}"...`)),await e({deploy:c,transcendUrl:l,auth:t.apiKey,bundleTypes:s}),this.logger.info(i.green(`Successfully updated Consent Manager for organization "${t.organizationName}"!`))}),this.logger.info(i.green(`Successfully updated Consent Managers!`)))}export{o as updateConsentManager};
-//# sourceMappingURL=impl-CBC5K-IH.mjs.map
+import{t as e}from"./updateConsentManagerVersionToLatest-DEFwH4Se.mjs";import{t}from"./validateTranscendAuth-D6Wr1cxY.mjs";import{t as n}from"./done-input-validation-BUz-aVC5.mjs";import{ConsentBundleType as r}from"@transcend-io/privacy-types";import i from"colors";import{mapSeries as a}from"@transcend-io/utils";async function o({auth:o,bundleTypes:s=[r.Production,r.Test],deploy:c,transcendUrl:l}){n(this.process);let u=await t(o,this);typeof u==`string`?(await e({deploy:c,transcendUrl:l,auth:u,bundleTypes:s}),this.logger.info(i.green(`Successfully updated Consent Manager!`))):(await a(u,async t=>{this.logger.info(i.magenta(`Updating Consent Manager for organization "${t.organizationName}"...`)),await e({deploy:c,transcendUrl:l,auth:t.apiKey,bundleTypes:s}),this.logger.info(i.green(`Successfully updated Consent Manager for organization "${t.organizationName}"!`))}),this.logger.info(i.green(`Successfully updated Consent Managers!`)))}export{o as updateConsentManager};
+//# sourceMappingURL=impl-CuDs6SsI.mjs.map

package/dist/{impl-CBC5K-IH.mjs.map → impl-CuDs6SsI.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-CBC5K-IH.mjs","names":[],"sources":["../src/commands/consent/update-consent-manager/impl.ts"],"sourcesContent":["import { ConsentBundleType } from '@transcend-io/privacy-types';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { validateTranscendAuth } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { updateConsentManagerVersionToLatest } from '../../../lib/consent-manager/index.js';\n\nexport interface UpdateConsentManagerCommandFlags {\n  auth: string;\n  bundleTypes: ConsentBundleType[];\n  deploy: boolean;\n  transcendUrl: string;\n}\n\nexport async function updateConsentManager(\n  this: LocalContext,\n  {\n    auth,\n    bundleTypes = [ConsentBundleType.Production, ConsentBundleType.Test],\n    deploy,\n    transcendUrl,\n  }: UpdateConsentManagerCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  // Handle single update\n  if (typeof apiKeyOrList === 'string') {\n    // Update consent manager\n    await updateConsentManagerVersionToLatest({\n      deploy,\n      transcendUrl,\n      auth: apiKeyOrList,\n      bundleTypes,\n    });\n    this.logger.info(colors.green('Successfully updated Consent Manager!'));\n  } else {\n    await mapSeries(apiKeyOrList, async (apiKey) => {\n      this.logger.info(\n        colors.magenta(`Updating Consent Manager for organization \"${apiKey.organizationName}\"...`),\n      );\n\n      await updateConsentManagerVersionToLatest({\n        deploy,\n        transcendUrl,\n        auth: apiKey.apiKey,\n        bundleTypes,\n      });\n\n      this.logger.info(\n        colors.green(\n          `Successfully updated Consent Manager for organization \"${apiKey.organizationName}\"!`,\n        ),\n      );\n    });\n    this.logger.info(colors.green('Successfully updated Consent Managers!'));\n  }\n}\n"],"mappings":"0TAgBA,eAAsB,EAEpB,CACE,OACA,cAAc,CAAC,EAAkB,WAAY,EAAkB,KAAK,CACpE,SACA,gBAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAGxD,OAAO,GAAiB,UAE1B,MAAM,EAAoC,CACxC,SACA,eACA,KAAM,EACN,cACD,CAAC,CACF,KAAK,OAAO,KAAK,EAAO,MAAM,wCAAwC,CAAC,GAEvE,MAAM,EAAU,EAAc,KAAO,IAAW,CAC9C,KAAK,OAAO,KACV,EAAO,QAAQ,8CAA8C,EAAO,iBAAiB,MAAM,CAC5F,CAED,MAAM,EAAoC,CACxC,SACA,eACA,KAAM,EAAO,OACb,cACD,CAAC,CAEF,KAAK,OAAO,KACV,EAAO,MACL,0DAA0D,EAAO,iBAAiB,IACnF,CACF,EACD,CACF,KAAK,OAAO,KAAK,EAAO,MAAM,yCAAyC,CAAC"}
+{"version":3,"file":"impl-CuDs6SsI.mjs","names":[],"sources":["../src/commands/consent/update-consent-manager/impl.ts"],"sourcesContent":["import { ConsentBundleType } from '@transcend-io/privacy-types';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { validateTranscendAuth } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { updateConsentManagerVersionToLatest } from '../../../lib/consent-manager/index.js';\n\nexport interface UpdateConsentManagerCommandFlags {\n  auth: string;\n  bundleTypes: ConsentBundleType[];\n  deploy: boolean;\n  transcendUrl: string;\n}\n\nexport async function updateConsentManager(\n  this: LocalContext,\n  {\n    auth,\n    bundleTypes = [ConsentBundleType.Production, ConsentBundleType.Test],\n    deploy,\n    transcendUrl,\n  }: UpdateConsentManagerCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  // Handle single update\n  if (typeof apiKeyOrList === 'string') {\n    // Update consent manager\n    await updateConsentManagerVersionToLatest({\n      deploy,\n      transcendUrl,\n      auth: apiKeyOrList,\n      bundleTypes,\n    });\n    this.logger.info(colors.green('Successfully updated Consent Manager!'));\n  } else {\n    await mapSeries(apiKeyOrList, async (apiKey) => {\n      this.logger.info(\n        colors.magenta(`Updating Consent Manager for organization \"${apiKey.organizationName}\"...`),\n      );\n\n      await updateConsentManagerVersionToLatest({\n        deploy,\n        transcendUrl,\n        auth: apiKey.apiKey,\n        bundleTypes,\n      });\n\n      this.logger.info(\n        colors.green(\n          `Successfully updated Consent Manager for organization \"${apiKey.organizationName}\"!`,\n        ),\n      );\n    });\n    this.logger.info(colors.green('Successfully updated Consent Managers!'));\n  }\n}\n"],"mappings":"0TAgBA,eAAsB,EAEpB,CACE,OACA,cAAc,CAAC,EAAkB,WAAY,EAAkB,KAAK,CACpE,SACA,gBAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAGxD,OAAO,GAAiB,UAE1B,MAAM,EAAoC,CACxC,SACA,eACA,KAAM,EACN,cACD,CAAC,CACF,KAAK,OAAO,KAAK,EAAO,MAAM,wCAAwC,CAAC,GAEvE,MAAM,EAAU,EAAc,KAAO,IAAW,CAC9C,KAAK,OAAO,KACV,EAAO,QAAQ,8CAA8C,EAAO,iBAAiB,MAAM,CAC5F,CAED,MAAM,EAAoC,CACxC,SACA,eACA,KAAM,EAAO,OACb,cACD,CAAC,CAEF,KAAK,OAAO,KACV,EAAO,MACL,0DAA0D,EAAO,iBAAiB,IACnF,CACF,EACD,CACF,KAAK,OAAO,KAAK,EAAO,MAAM,yCAAyC,CAAC"}

package/dist/{impl-DiyWNLJq.mjs → impl-CvLI_Jig.mjs}

@@ -1,2 +1,2 @@
-import{i as e}from"./enums-OiLcZ26O.mjs";import{r as t}from"./constants-CdgK1myP.mjs";import{n,t as r}from"./command-DKNKpgUB.mjs";import{o as i}from"./readTranscendYaml-DtJz9mor.mjs";import{n as a}from"./pullTranscendConfiguration-NcFjHE8k.mjs";import{t as o}from"./validateTranscendAuth-3guZJPKH.mjs";import{t as s}from"./done-input-validation-BFgMCQWH.mjs";import c from"node:path";import l from"colors";import{buildTranscendGraphQLClient as u}from"@transcend-io/sdk";import{mapSeries as d}from"@transcend-io/utils";async function f({auth:f,resources:p=n,file:m,transcendUrl:h,dataSiloIds:g=[],integrationNames:_=[],trackerStatuses:v=r,pageSize:y,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,debug:C}){s(this.process);let w=await o(f,this),T=p.includes(`all`)?Object.values(e):p;if(typeof w==`string`){try{let e=await a(u(h,w),{dataSiloIds:g,integrationNames:_,resources:T,pageSize:y,debug:C,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,trackerStatuses:v});this.logger.info(l.magenta(`Writing configuration to file "${m}"...`)),this.fs.writeFileSync(m,i(e))}catch(e){this.logger.error(l.red(`An error occurred syncing the schema: ${C?e.stack:e.message}`)),this.process.exit(1)}this.logger.info(l.green(`Successfully synced yaml file to disk at ${m}! View at ${t}`))}else{if(!this.fs.lstatSync(m).isDirectory())throw Error(`File is expected to be a folder when passing in a list of API keys to pull from. e.g. --file=./working/`);let e=[];await d(w,async(t,n)=>{let r=`[${n+1}/${w.length}][${t.organizationName}] `;this.logger.info(l.magenta(`~~~\n\n${r}Attempting to pull configuration...\n\n~~~`));let o=u(h,t.apiKey);try{let e=await a(o,{dataSiloIds:g,integrationNames:_,resources:T,pageSize:y,debug:C,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,trackerStatuses:v}),n=c.join(m,`${t.organizationName}.yml`);this.logger.info(l.magenta(`Writing configuration to file "${n}"...`)),this.fs.writeFileSync(n,i(e)),this.logger.info(l.green(`${r}Successfully pulled configuration!`))}catch(n){this.logger.error(l.red(`${r}Failed to sync configuration. - ${n.message}`)),e.push(t.organizationName)}}),e.length>0&&(this.logger.info(l.red(`Sync encountered errors for "${e.join(`,`)}". View output above for more information, or check out ${t}`)),this.process.exit(1))}}export{f as pull};
-//# sourceMappingURL=impl-DiyWNLJq.mjs.map
+import{i as e}from"./enums-OiLcZ26O.mjs";import{r as t}from"./constants-jjHIzHGm.mjs";import{n,t as r}from"./command-CIv9yk86.mjs";import{o as i}from"./readTranscendYaml-BNn6-Ofi.mjs";import{n as a}from"./pullTranscendConfiguration-B63M3ild.mjs";import{t as o}from"./validateTranscendAuth-D6Wr1cxY.mjs";import{t as s}from"./done-input-validation-BUz-aVC5.mjs";import c from"node:path";import l from"colors";import{buildTranscendGraphQLClient as u}from"@transcend-io/sdk";import{mapSeries as d}from"@transcend-io/utils";async function f({auth:f,resources:p=n,file:m,transcendUrl:h,dataSiloIds:g=[],integrationNames:_=[],trackerStatuses:v=r,pageSize:y,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,debug:C}){s(this.process);let w=await o(f,this),T=p.includes(`all`)?Object.values(e):p;if(typeof w==`string`){try{let e=await a(u(h,w),{dataSiloIds:g,integrationNames:_,resources:T,pageSize:y,debug:C,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,trackerStatuses:v});this.logger.info(l.magenta(`Writing configuration to file "${m}"...`)),this.fs.writeFileSync(m,i(e))}catch(e){this.logger.error(l.red(`An error occurred syncing the schema: ${C?e.stack:e.message}`)),this.process.exit(1)}this.logger.info(l.green(`Successfully synced yaml file to disk at ${m}! View at ${t}`))}else{if(!this.fs.lstatSync(m).isDirectory())throw Error(`File is expected to be a folder when passing in a list of API keys to pull from. e.g. --file=./working/`);let e=[];await d(w,async(t,n)=>{let r=`[${n+1}/${w.length}][${t.organizationName}] `;this.logger.info(l.magenta(`~~~\n\n${r}Attempting to pull configuration...\n\n~~~`));let o=u(h,t.apiKey);try{let e=await a(o,{dataSiloIds:g,integrationNames:_,resources:T,pageSize:y,debug:C,skipDatapoints:b,skipSubDatapoints:x,includeGuessedCategories:S,trackerStatuses:v}),n=c.join(m,`${t.organizationName}.yml`);this.logger.info(l.magenta(`Writing configuration to file "${n}"...`)),this.fs.writeFileSync(n,i(e)),this.logger.info(l.green(`${r}Successfully pulled configuration!`))}catch(n){this.logger.error(l.red(`${r}Failed to sync configuration. - ${n.message}`)),e.push(t.organizationName)}}),e.length>0&&(this.logger.info(l.red(`Sync encountered errors for "${e.join(`,`)}". View output above for more information, or check out ${t}`)),this.process.exit(1))}}export{f as pull};
+//# sourceMappingURL=impl-CvLI_Jig.mjs.map

package/dist/{impl-DiyWNLJq.mjs.map → impl-CvLI_Jig.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DiyWNLJq.mjs","names":[],"sources":["../src/commands/inventory/pull/impl.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient } from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { ADMIN_DASH_INTEGRATIONS } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { TranscendPullResource } from '../../../enums.js';\nimport { validateTranscendAuth } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { pullTranscendConfiguration } from '../../../lib/graphql/index.js';\nimport { serializeTranscendYaml } from '../../../lib/readTranscendYaml.js';\nimport { DEFAULT_CONSENT_TRACKER_STATUSES, DEFAULT_TRANSCEND_PULL_RESOURCES } from './command.js';\n\nexport interface PullCommandFlags {\n  auth: string;\n  resources?: (TranscendPullResource | 'all')[];\n  file: string;\n  transcendUrl: string;\n  dataSiloIds?: string[];\n  integrationNames?: string[];\n  trackerStatuses?: ConsentTrackerStatus[];\n  pageSize: number;\n  skipDatapoints: boolean;\n  skipSubDatapoints: boolean;\n  includeGuessedCategories: boolean;\n  debug: boolean;\n}\n\nexport async function pull(\n  this: LocalContext,\n  {\n    auth,\n    resources = DEFAULT_TRANSCEND_PULL_RESOURCES,\n    file,\n    transcendUrl,\n    dataSiloIds = [],\n    integrationNames = [],\n    trackerStatuses = DEFAULT_CONSENT_TRACKER_STATUSES,\n    pageSize,\n    skipDatapoints,\n    skipSubDatapoints,\n    includeGuessedCategories,\n    debug,\n  }: PullCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  const resourcesToPull: TranscendPullResource[] = resources.includes('all')\n    ? Object.values(TranscendPullResource)\n    : (resources as TranscendPullResource[]);\n\n  // Sync to Disk\n  if (typeof apiKeyOrList === 'string') {\n    try {\n      // Create a GraphQL client\n      const client = buildTranscendGraphQLClient(transcendUrl, apiKeyOrList);\n\n      const configuration = await pullTranscendConfiguration(client, {\n        dataSiloIds,\n        integrationNames,\n        resources: resourcesToPull,\n        pageSize,\n        debug,\n        skipDatapoints,\n        skipSubDatapoints,\n        includeGuessedCategories,\n        trackerStatuses,\n      });\n\n      this.logger.info(colors.magenta(`Writing configuration to file \"${file}\"...`));\n      this.fs.writeFileSync(file, serializeTranscendYaml(configuration));\n    } catch (err) {\n      this.logger.error(\n        colors.red(`An error occurred syncing the schema: ${debug ? err.stack : err.message}`),\n      );\n      this.process.exit(1);\n    }\n\n    // Indicate success\n    this.logger.info(\n      colors.green(\n        `Successfully synced yaml file to disk at ${file}! View at ${ADMIN_DASH_INTEGRATIONS}`,\n      ),\n    );\n  } else {\n    if (!this.fs.lstatSync(file).isDirectory()) {\n      throw new Error(\n        'File is expected to be a folder when passing in a list of API keys to pull from. e.g. --file=./working/',\n      );\n    }\n\n    const encounteredErrors: string[] = [];\n    await mapSeries(apiKeyOrList, async (apiKey, ind) => {\n      const prefix = `[${ind + 1}/${apiKeyOrList.length}][${apiKey.organizationName}] `;\n      this.logger.info(\n        colors.magenta(`~~~\\n\\n${prefix}Attempting to pull configuration...\\n\\n~~~`),\n      );\n\n      // Create a GraphQL client\n      const client = buildTranscendGraphQLClient(transcendUrl, apiKey.apiKey);\n\n      try {\n        const configuration = await pullTranscendConfiguration(client, {\n          dataSiloIds,\n          integrationNames,\n          resources: resourcesToPull,\n          pageSize,\n          debug,\n          skipDatapoints,\n          skipSubDatapoints,\n          includeGuessedCategories,\n          trackerStatuses,\n        });\n\n        const filePath = path.join(file, `${apiKey.organizationName}.yml`);\n        this.logger.info(colors.magenta(`Writing configuration to file \"${filePath}\"...`));\n        this.fs.writeFileSync(filePath, serializeTranscendYaml(configuration));\n\n        this.logger.info(colors.green(`${prefix}Successfully pulled configuration!`));\n      } catch (err) {\n        this.logger.error(colors.red(`${prefix}Failed to sync configuration. - ${err.message}`));\n        encounteredErrors.push(apiKey.organizationName);\n      }\n    });\n\n    if (encounteredErrors.length > 0) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors for \"${encounteredErrors.join(\n            ',',\n          )}\". View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  }\n}\n"],"mappings":"ugBA+BA,eAAsB,EAEpB,CACE,OACA,YAAY,EACZ,OACA,eACA,cAAc,EAAE,CAChB,mBAAmB,EAAE,CACrB,kBAAkB,EAClB,WACA,iBACA,oBACA,2BACA,SAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAEtD,EAA2C,EAAU,SAAS,MAAM,CACtE,OAAO,OAAO,EAAsB,CACnC,EAGL,GAAI,OAAO,GAAiB,SAAU,CACpC,GAAI,CAIF,IAAM,EAAgB,MAAM,EAFb,EAA4B,EAAc,EAEI,CAAE,CAC7D,cACA,mBACA,UAAW,EACX,WACA,QACA,iBACA,oBACA,2BACA,kBACD,CAAC,CAEF,KAAK,OAAO,KAAK,EAAO,QAAQ,kCAAkC,EAAK,MAAM,CAAC,CAC9E,KAAK,GAAG,cAAc,EAAM,EAAuB,EAAc,CAAC,OAC3D,EAAK,CACZ,KAAK,OAAO,MACV,EAAO,IAAI,yCAAyC,EAAQ,EAAI,MAAQ,EAAI,UAAU,CACvF,CACD,KAAK,QAAQ,KAAK,EAAE,CAItB,KAAK,OAAO,KACV,EAAO,MACL,4CAA4C,EAAK,YAAY,IAC9D,CACF,KACI,CACL,GAAI,CAAC,KAAK,GAAG,UAAU,EAAK,CAAC,aAAa,CACxC,MAAU,MACR,0GACD,CAGH,IAAM,EAA8B,EAAE,CACtC,MAAM,EAAU,EAAc,MAAO,EAAQ,IAAQ,CACnD,IAAM,EAAS,IAAI,EAAM,EAAE,GAAG,EAAa,OAAO,IAAI,EAAO,iBAAiB,IAC9E,KAAK,OAAO,KACV,EAAO,QAAQ,UAAU,EAAO,4CAA4C,CAC7E,CAGD,IAAM,EAAS,EAA4B,EAAc,EAAO,OAAO,CAEvE,GAAI,CACF,IAAM,EAAgB,MAAM,EAA2B,EAAQ,CAC7D,cACA,mBACA,UAAW,EACX,WACA,QACA,iBACA,oBACA,2BACA,kBACD,CAAC,CAEI,EAAW,EAAK,KAAK,EAAM,GAAG,EAAO,iBAAiB,MAAM,CAClE,KAAK,OAAO,KAAK,EAAO,QAAQ,kCAAkC,EAAS,MAAM,CAAC,CAClF,KAAK,GAAG,cAAc,EAAU,EAAuB,EAAc,CAAC,CAEtE,KAAK,OAAO,KAAK,EAAO,MAAM,GAAG,EAAO,oCAAoC,CAAC,OACtE,EAAK,CACZ,KAAK,OAAO,MAAM,EAAO,IAAI,GAAG,EAAO,kCAAkC,EAAI,UAAU,CAAC,CACxF,EAAkB,KAAK,EAAO,iBAAiB,GAEjD,CAEE,EAAkB,OAAS,IAC7B,KAAK,OAAO,KACV,EAAO,IACL,gCAAgC,EAAkB,KAChD,IACD,CAAC,0DAA0D,IAC7D,CACF,CAED,KAAK,QAAQ,KAAK,EAAE"}
+{"version":3,"file":"impl-CvLI_Jig.mjs","names":[],"sources":["../src/commands/inventory/pull/impl.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient } from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { ADMIN_DASH_INTEGRATIONS } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { TranscendPullResource } from '../../../enums.js';\nimport { validateTranscendAuth } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { pullTranscendConfiguration } from '../../../lib/graphql/index.js';\nimport { serializeTranscendYaml } from '../../../lib/readTranscendYaml.js';\nimport { DEFAULT_CONSENT_TRACKER_STATUSES, DEFAULT_TRANSCEND_PULL_RESOURCES } from './command.js';\n\nexport interface PullCommandFlags {\n  auth: string;\n  resources?: (TranscendPullResource | 'all')[];\n  file: string;\n  transcendUrl: string;\n  dataSiloIds?: string[];\n  integrationNames?: string[];\n  trackerStatuses?: ConsentTrackerStatus[];\n  pageSize: number;\n  skipDatapoints: boolean;\n  skipSubDatapoints: boolean;\n  includeGuessedCategories: boolean;\n  debug: boolean;\n}\n\nexport async function pull(\n  this: LocalContext,\n  {\n    auth,\n    resources = DEFAULT_TRANSCEND_PULL_RESOURCES,\n    file,\n    transcendUrl,\n    dataSiloIds = [],\n    integrationNames = [],\n    trackerStatuses = DEFAULT_CONSENT_TRACKER_STATUSES,\n    pageSize,\n    skipDatapoints,\n    skipSubDatapoints,\n    includeGuessedCategories,\n    debug,\n  }: PullCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  const resourcesToPull: TranscendPullResource[] = resources.includes('all')\n    ? Object.values(TranscendPullResource)\n    : (resources as TranscendPullResource[]);\n\n  // Sync to Disk\n  if (typeof apiKeyOrList === 'string') {\n    try {\n      // Create a GraphQL client\n      const client = buildTranscendGraphQLClient(transcendUrl, apiKeyOrList);\n\n      const configuration = await pullTranscendConfiguration(client, {\n        dataSiloIds,\n        integrationNames,\n        resources: resourcesToPull,\n        pageSize,\n        debug,\n        skipDatapoints,\n        skipSubDatapoints,\n        includeGuessedCategories,\n        trackerStatuses,\n      });\n\n      this.logger.info(colors.magenta(`Writing configuration to file \"${file}\"...`));\n      this.fs.writeFileSync(file, serializeTranscendYaml(configuration));\n    } catch (err) {\n      this.logger.error(\n        colors.red(`An error occurred syncing the schema: ${debug ? err.stack : err.message}`),\n      );\n      this.process.exit(1);\n    }\n\n    // Indicate success\n    this.logger.info(\n      colors.green(\n        `Successfully synced yaml file to disk at ${file}! View at ${ADMIN_DASH_INTEGRATIONS}`,\n      ),\n    );\n  } else {\n    if (!this.fs.lstatSync(file).isDirectory()) {\n      throw new Error(\n        'File is expected to be a folder when passing in a list of API keys to pull from. e.g. --file=./working/',\n      );\n    }\n\n    const encounteredErrors: string[] = [];\n    await mapSeries(apiKeyOrList, async (apiKey, ind) => {\n      const prefix = `[${ind + 1}/${apiKeyOrList.length}][${apiKey.organizationName}] `;\n      this.logger.info(\n        colors.magenta(`~~~\\n\\n${prefix}Attempting to pull configuration...\\n\\n~~~`),\n      );\n\n      // Create a GraphQL client\n      const client = buildTranscendGraphQLClient(transcendUrl, apiKey.apiKey);\n\n      try {\n        const configuration = await pullTranscendConfiguration(client, {\n          dataSiloIds,\n          integrationNames,\n          resources: resourcesToPull,\n          pageSize,\n          debug,\n          skipDatapoints,\n          skipSubDatapoints,\n          includeGuessedCategories,\n          trackerStatuses,\n        });\n\n        const filePath = path.join(file, `${apiKey.organizationName}.yml`);\n        this.logger.info(colors.magenta(`Writing configuration to file \"${filePath}\"...`));\n        this.fs.writeFileSync(filePath, serializeTranscendYaml(configuration));\n\n        this.logger.info(colors.green(`${prefix}Successfully pulled configuration!`));\n      } catch (err) {\n        this.logger.error(colors.red(`${prefix}Failed to sync configuration. - ${err.message}`));\n        encounteredErrors.push(apiKey.organizationName);\n      }\n    });\n\n    if (encounteredErrors.length > 0) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors for \"${encounteredErrors.join(\n            ',',\n          )}\". View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  }\n}\n"],"mappings":"ugBA+BA,eAAsB,EAEpB,CACE,OACA,YAAY,EACZ,OACA,eACA,cAAc,EAAE,CAChB,mBAAmB,EAAE,CACrB,kBAAkB,EAClB,WACA,iBACA,oBACA,2BACA,SAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAEtD,EAA2C,EAAU,SAAS,MAAM,CACtE,OAAO,OAAO,EAAsB,CACnC,EAGL,GAAI,OAAO,GAAiB,SAAU,CACpC,GAAI,CAIF,IAAM,EAAgB,MAAM,EAFb,EAA4B,EAAc,EAEI,CAAE,CAC7D,cACA,mBACA,UAAW,EACX,WACA,QACA,iBACA,oBACA,2BACA,kBACD,CAAC,CAEF,KAAK,OAAO,KAAK,EAAO,QAAQ,kCAAkC,EAAK,MAAM,CAAC,CAC9E,KAAK,GAAG,cAAc,EAAM,EAAuB,EAAc,CAAC,OAC3D,EAAK,CACZ,KAAK,OAAO,MACV,EAAO,IAAI,yCAAyC,EAAQ,EAAI,MAAQ,EAAI,UAAU,CACvF,CACD,KAAK,QAAQ,KAAK,EAAE,CAItB,KAAK,OAAO,KACV,EAAO,MACL,4CAA4C,EAAK,YAAY,IAC9D,CACF,KACI,CACL,GAAI,CAAC,KAAK,GAAG,UAAU,EAAK,CAAC,aAAa,CACxC,MAAU,MACR,0GACD,CAGH,IAAM,EAA8B,EAAE,CACtC,MAAM,EAAU,EAAc,MAAO,EAAQ,IAAQ,CACnD,IAAM,EAAS,IAAI,EAAM,EAAE,GAAG,EAAa,OAAO,IAAI,EAAO,iBAAiB,IAC9E,KAAK,OAAO,KACV,EAAO,QAAQ,UAAU,EAAO,4CAA4C,CAC7E,CAGD,IAAM,EAAS,EAA4B,EAAc,EAAO,OAAO,CAEvE,GAAI,CACF,IAAM,EAAgB,MAAM,EAA2B,EAAQ,CAC7D,cACA,mBACA,UAAW,EACX,WACA,QACA,iBACA,oBACA,2BACA,kBACD,CAAC,CAEI,EAAW,EAAK,KAAK,EAAM,GAAG,EAAO,iBAAiB,MAAM,CAClE,KAAK,OAAO,KAAK,EAAO,QAAQ,kCAAkC,EAAS,MAAM,CAAC,CAClF,KAAK,GAAG,cAAc,EAAU,EAAuB,EAAc,CAAC,CAEtE,KAAK,OAAO,KAAK,EAAO,MAAM,GAAG,EAAO,oCAAoC,CAAC,OACtE,EAAK,CACZ,KAAK,OAAO,MAAM,EAAO,IAAI,GAAG,EAAO,kCAAkC,EAAI,UAAU,CAAC,CACxF,EAAkB,KAAK,EAAO,iBAAiB,GAEjD,CAEE,EAAkB,OAAS,IAC7B,KAAK,OAAO,KACV,EAAO,IACL,gCAAgC,EAAkB,KAChD,IACD,CAAC,0DAA0D,IAC7D,CACF,CAED,KAAK,QAAQ,KAAK,EAAE"}

package/dist/{impl-CbijbA-M2.mjs → impl-CwKYKBYb.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./downloadPrivacyRequestFiles-Dn3VexN2.mjs";import{t}from"./done-input-validation-BFgMCQWH.mjs";import{RequestStatus as n}from"@transcend-io/privacy-types";async function r({auth:r,transcendUrl:i,folderPath:a,requestIds:o,statuses:s=[n.Approving,n.Downloadable],concurrency:c,createdAtBefore:l,createdAtAfter:u,updatedAtBefore:d,updatedAtAfter:f,approveAfterDownload:p}){t(this.process),await e({transcendUrl:i,auth:r,folderPath:a,requestIds:o,statuses:s,concurrency:c,createdAtBefore:l,createdAtAfter:u,updatedAtBefore:d,updatedAtAfter:f,approveAfterDownload:p})}export{r as downloadFiles};
-//# sourceMappingURL=impl-CbijbA-M2.mjs.map
+import{t as e}from"./downloadPrivacyRequestFiles-B_BVxW5Z.mjs";import{t}from"./done-input-validation-BUz-aVC5.mjs";import{RequestStatus as n}from"@transcend-io/privacy-types";async function r({auth:r,transcendUrl:i,folderPath:a,requestIds:o,statuses:s=[n.Approving,n.Downloadable],concurrency:c,createdAtBefore:l,createdAtAfter:u,updatedAtBefore:d,updatedAtAfter:f,approveAfterDownload:p}){t(this.process),await e({transcendUrl:i,auth:r,folderPath:a,requestIds:o,statuses:s,concurrency:c,createdAtBefore:l,createdAtAfter:u,updatedAtBefore:d,updatedAtAfter:f,approveAfterDownload:p})}export{r as downloadFiles};
+//# sourceMappingURL=impl-CwKYKBYb.mjs.map

package/dist/impl-CwKYKBYb.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"impl-CwKYKBYb.mjs","names":[],"sources":["../src/commands/request/download-files/impl.ts"],"sourcesContent":["import { RequestStatus } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { downloadPrivacyRequestFiles } from '../../../lib/requests/index.js';\n\nexport interface DownloadFilesCommandFlags {\n  auth: string;\n  sombraAuth?: string;\n  concurrency: number;\n  requestIds?: string[];\n  statuses?: RequestStatus[];\n  folderPath: string;\n  createdAtBefore?: Date;\n  createdAtAfter?: Date;\n  updatedAtBefore?: Date;\n  updatedAtAfter?: Date;\n  approveAfterDownload: boolean;\n  transcendUrl: string;\n}\n\nexport async function downloadFiles(\n  this: LocalContext,\n  {\n    auth,\n    transcendUrl,\n    folderPath,\n    requestIds,\n    statuses = [RequestStatus.Approving, RequestStatus.Downloadable],\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  }: DownloadFilesCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await downloadPrivacyRequestFiles({\n    transcendUrl,\n    auth,\n    folderPath,\n    requestIds,\n    statuses,\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  });\n}\n"],"mappings":"+KAqBA,eAAsB,EAEpB,CACE,OACA,eACA,aACA,aACA,WAAW,CAAC,EAAc,UAAW,EAAc,aAAa,CAChE,cACA,kBACA,iBACA,kBACA,iBACA,wBAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAA4B,CAChC,eACA,OACA,aACA,aACA,WACA,cACA,kBACA,iBACA,kBACA,iBACA,uBACD,CAAC"}

package/dist/{impl-CMYYX3Kz.mjs → impl-CwXp3Tbr.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./readCsv-CmRYYFJc.mjs";import{r as t}from"./uploadConsents-CDqFNWX_.mjs";import{t as n}from"./done-input-validation-BFgMCQWH.mjs";import*as r from"io-ts";const i=r.intersection([r.type({userId:r.string,timestamp:r.string}),r.partial({confirmed:r.union([r.literal(`true`),r.literal(`false`)]),updated:r.union([r.literal(`true`),r.literal(`false`)]),prompted:r.union([r.literal(`true`),r.literal(`false`)]),metadata:r.string,usp:r.union([r.string,r.null]),gpp:r.union([r.string,r.null]),purposes:r.string})]);async function a({base64EncryptionKey:r,base64SigningKey:a,partition:o,file:s,consentUrl:c,concurrency:l}){n(this.process),await t({base64EncryptionKey:r,base64SigningKey:a,preferences:e(this.fs.readFileSync(s,`utf8`),i),partition:o,concurrency:l,transcendUrl:c})}export{a as uploadConsentPreferences};
-//# sourceMappingURL=impl-CMYYX3Kz.mjs.map
+import{t as e}from"./readCsv-DLg8pwjd.mjs";import{r as t}from"./uploadConsents-ChmFIw_j.mjs";import{t as n}from"./done-input-validation-BUz-aVC5.mjs";import*as r from"io-ts";const i=r.intersection([r.type({userId:r.string,timestamp:r.string}),r.partial({confirmed:r.union([r.literal(`true`),r.literal(`false`)]),updated:r.union([r.literal(`true`),r.literal(`false`)]),prompted:r.union([r.literal(`true`),r.literal(`false`)]),metadata:r.string,usp:r.union([r.string,r.null]),gpp:r.union([r.string,r.null]),purposes:r.string})]);async function a({base64EncryptionKey:r,base64SigningKey:a,partition:o,file:s,consentUrl:c,concurrency:l}){n(this.process),await t({base64EncryptionKey:r,base64SigningKey:a,preferences:e(this.fs.readFileSync(s,`utf8`),i),partition:o,concurrency:l,transcendUrl:c})}export{a as uploadConsentPreferences};
+//# sourceMappingURL=impl-CwXp3Tbr.mjs.map

package/dist/{impl-CMYYX3Kz.mjs.map → impl-CwXp3Tbr.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-CMYYX3Kz.mjs","names":[],"sources":["../src/lib/consent-manager/types.ts","../src/commands/consent/upload-consent-preferences/impl.ts"],"sourcesContent":["import * as t from 'io-ts';\n\nexport const ConsentPreferenceUpload = t.intersection([\n  t.type({\n    /** User ID */\n    userId: t.string,\n    /** Has the consent been updated (including no-change confirmation) since default resolution */\n    timestamp: t.string,\n  }),\n  t.partial({\n    /** Was tracking consent confirmed by the user? If this is false, the consent was resolved from defaults & is not yet confirmed */\n    confirmed: t.union([t.literal('true'), t.literal('false')]),\n    /**\n     * Has the consent been updated (including no-change confirmation) since default resolution\n     */\n    updated: t.union([t.literal('true'), t.literal('false')]),\n    /**\n     * Whether or not the UI has been shown to the end-user (undefined in older versions of airgap.js)\n     */\n    prompted: t.union([t.literal('true'), t.literal('false')]),\n    /** Consent metadata */\n    metadata: t.string,\n    /** US Privacy (USP) String */\n    usp: t.union([t.string, t.null]),\n    /** IAB GPP String */\n    gpp: t.union([t.string, t.null]),\n    /**\n     * Purpose map\n     * This is a stringified JSON object with keys as purpose names and values as booleans or 'Auto'\n     */\n    purposes: t.string,\n  }),\n]);\n\n/** Type override */\nexport type ConsentPreferenceUpload = t.TypeOf<typeof ConsentPreferenceUpload>;\n","import type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { ConsentPreferenceUpload } from '../../../lib/consent-manager/types.js';\nimport { uploadConsents } from '../../../lib/consent-manager/uploadConsents.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadConsentPreferencesCommandFlags {\n  base64EncryptionKey: string;\n  base64SigningKey: string;\n  partition: string;\n  file: string;\n  consentUrl: string;\n  concurrency: number;\n}\n\nexport async function uploadConsentPreferences(\n  this: LocalContext,\n  {\n    base64EncryptionKey,\n    base64SigningKey,\n    partition,\n    file,\n    consentUrl,\n    concurrency,\n  }: UploadConsentPreferencesCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Load in preferences from csv\n  const preferences = parseCsv(this.fs.readFileSync(file, 'utf8'), ConsentPreferenceUpload);\n\n  // Upload cookies\n  await uploadConsents({\n    base64EncryptionKey,\n    base64SigningKey,\n    preferences,\n    partition,\n    concurrency,\n    transcendUrl: consentUrl,\n  });\n}\n"],"mappings":"8KAEA,MAAa,EAA0B,EAAE,aAAa,CACpD,EAAE,KAAK,CAEL,OAAQ,EAAE,OAEV,UAAW,EAAE,OACd,CAAC,CACF,EAAE,QAAQ,CAER,UAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAI3D,QAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAIzD,SAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAE1D,SAAU,EAAE,OAEZ,IAAK,EAAE,MAAM,CAAC,EAAE,OAAQ,EAAE,KAAK,CAAC,CAEhC,IAAK,EAAE,MAAM,CAAC,EAAE,OAAQ,EAAE,KAAK,CAAC,CAKhC,SAAU,EAAE,OACb,CAAC,CACH,CAAC,CCjBF,eAAsB,EAEpB,CACE,sBACA,mBACA,YACA,OACA,aACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAMjC,MAAM,EAAe,CACnB,sBACA,mBACA,YANkB,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EAMpD,CACX,YACA,cACA,aAAc,EACf,CAAC"}
+{"version":3,"file":"impl-CwXp3Tbr.mjs","names":[],"sources":["../src/lib/consent-manager/types.ts","../src/commands/consent/upload-consent-preferences/impl.ts"],"sourcesContent":["import * as t from 'io-ts';\n\nexport const ConsentPreferenceUpload = t.intersection([\n  t.type({\n    /** User ID */\n    userId: t.string,\n    /** Has the consent been updated (including no-change confirmation) since default resolution */\n    timestamp: t.string,\n  }),\n  t.partial({\n    /** Was tracking consent confirmed by the user? If this is false, the consent was resolved from defaults & is not yet confirmed */\n    confirmed: t.union([t.literal('true'), t.literal('false')]),\n    /**\n     * Has the consent been updated (including no-change confirmation) since default resolution\n     */\n    updated: t.union([t.literal('true'), t.literal('false')]),\n    /**\n     * Whether or not the UI has been shown to the end-user (undefined in older versions of airgap.js)\n     */\n    prompted: t.union([t.literal('true'), t.literal('false')]),\n    /** Consent metadata */\n    metadata: t.string,\n    /** US Privacy (USP) String */\n    usp: t.union([t.string, t.null]),\n    /** IAB GPP String */\n    gpp: t.union([t.string, t.null]),\n    /**\n     * Purpose map\n     * This is a stringified JSON object with keys as purpose names and values as booleans or 'Auto'\n     */\n    purposes: t.string,\n  }),\n]);\n\n/** Type override */\nexport type ConsentPreferenceUpload = t.TypeOf<typeof ConsentPreferenceUpload>;\n","import type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { ConsentPreferenceUpload } from '../../../lib/consent-manager/types.js';\nimport { uploadConsents } from '../../../lib/consent-manager/uploadConsents.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadConsentPreferencesCommandFlags {\n  base64EncryptionKey: string;\n  base64SigningKey: string;\n  partition: string;\n  file: string;\n  consentUrl: string;\n  concurrency: number;\n}\n\nexport async function uploadConsentPreferences(\n  this: LocalContext,\n  {\n    base64EncryptionKey,\n    base64SigningKey,\n    partition,\n    file,\n    consentUrl,\n    concurrency,\n  }: UploadConsentPreferencesCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Load in preferences from csv\n  const preferences = parseCsv(this.fs.readFileSync(file, 'utf8'), ConsentPreferenceUpload);\n\n  // Upload cookies\n  await uploadConsents({\n    base64EncryptionKey,\n    base64SigningKey,\n    preferences,\n    partition,\n    concurrency,\n    transcendUrl: consentUrl,\n  });\n}\n"],"mappings":"8KAEA,MAAa,EAA0B,EAAE,aAAa,CACpD,EAAE,KAAK,CAEL,OAAQ,EAAE,OAEV,UAAW,EAAE,OACd,CAAC,CACF,EAAE,QAAQ,CAER,UAAW,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAI3D,QAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAIzD,SAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,OAAO,CAAE,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAE1D,SAAU,EAAE,OAEZ,IAAK,EAAE,MAAM,CAAC,EAAE,OAAQ,EAAE,KAAK,CAAC,CAEhC,IAAK,EAAE,MAAM,CAAC,EAAE,OAAQ,EAAE,KAAK,CAAC,CAKhC,SAAU,EAAE,OACb,CAAC,CACH,CAAC,CCjBF,eAAsB,EAEpB,CACE,sBACA,mBACA,YACA,OACA,aACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAMjC,MAAM,EAAe,CACnB,sBACA,mBACA,YANkB,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EAMpD,CACX,YACA,cACA,aAAc,EACf,CAAC"}

package/dist/{impl-D33Zr0vh2.mjs → impl-CyQRmuM72.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./cancelPrivacyRequests-BKibbagv.mjs";import{t}from"./done-input-validation-BFgMCQWH.mjs";async function n({auth:n,actions:r,statuses:i=[],requestIds:a,silentModeBefore:o,createdAtBefore:s,createdAtAfter:c,updatedAtBefore:l,updatedAtAfter:u,cancellationTitle:d,transcendUrl:f,concurrency:p}){t(this.process),await e({transcendUrl:f,requestActions:r,auth:n,cancellationTitle:d,requestIds:a,statuses:i,concurrency:p,silentModeBefore:o?new Date(o):void 0,createdAtBefore:s?new Date(s):void 0,createdAtAfter:c?new Date(c):void 0,updatedAtBefore:l?new Date(l):void 0,updatedAtAfter:u?new Date(u):void 0})}export{n as cancel};
-//# sourceMappingURL=impl-D33Zr0vh2.mjs.map
+import{t as e}from"./cancelPrivacyRequests-D0zNUNdS.mjs";import{t}from"./done-input-validation-BUz-aVC5.mjs";async function n({auth:n,actions:r,statuses:i=[],requestIds:a,silentModeBefore:o,createdAtBefore:s,createdAtAfter:c,updatedAtBefore:l,updatedAtAfter:u,cancellationTitle:d,transcendUrl:f,concurrency:p}){t(this.process),await e({transcendUrl:f,requestActions:r,auth:n,cancellationTitle:d,requestIds:a,statuses:i,concurrency:p,silentModeBefore:o?new Date(o):void 0,createdAtBefore:s?new Date(s):void 0,createdAtAfter:c?new Date(c):void 0,updatedAtBefore:l?new Date(l):void 0,updatedAtAfter:u?new Date(u):void 0})}export{n as cancel};
+//# sourceMappingURL=impl-CyQRmuM72.mjs.map

package/dist/{impl-D33Zr0vh2.mjs.map → impl-CyQRmuM72.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-D33Zr0vh2.mjs","names":[],"sources":["../src/commands/request/cancel/impl.ts"],"sourcesContent":["import { RequestAction, RequestStatus } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { cancelPrivacyRequests } from '../../../lib/requests/index.js';\n\nexport interface CancelCommandFlags {\n  auth: string;\n  actions: RequestAction[];\n  statuses?: RequestStatus[];\n  requestIds?: string[];\n  silentModeBefore?: Date;\n  createdAtBefore?: Date;\n  createdAtAfter?: Date;\n  updatedAtBefore?: Date;\n  updatedAtAfter?: Date;\n  cancellationTitle: string;\n  transcendUrl: string;\n  concurrency: number;\n}\n\nexport async function cancel(\n  this: LocalContext,\n  {\n    auth,\n    actions,\n    statuses = [],\n    requestIds,\n    silentModeBefore,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    cancellationTitle,\n    transcendUrl,\n    concurrency,\n  }: CancelCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await cancelPrivacyRequests({\n    transcendUrl,\n    requestActions: actions,\n    auth,\n    cancellationTitle,\n    requestIds,\n    statuses,\n    concurrency,\n    silentModeBefore: silentModeBefore ? new Date(silentModeBefore) : undefined,\n    createdAtBefore: createdAtBefore ? new Date(createdAtBefore) : undefined,\n    createdAtAfter: createdAtAfter ? new Date(createdAtAfter) : undefined,\n    updatedAtBefore: updatedAtBefore ? new Date(updatedAtBefore) : undefined,\n    updatedAtAfter: updatedAtAfter ? new Date(updatedAtAfter) : undefined,\n  });\n}\n"],"mappings":"6GAqBA,eAAsB,EAEpB,CACE,OACA,UACA,WAAW,EAAE,CACb,aACA,mBACA,kBACA,iBACA,kBACA,iBACA,oBACA,eACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAsB,CAC1B,eACA,eAAgB,EAChB,OACA,oBACA,aACA,WACA,cACA,iBAAkB,EAAmB,IAAI,KAAK,EAAiB,CAAG,IAAA,GAClE,gBAAiB,EAAkB,IAAI,KAAK,EAAgB,CAAG,IAAA,GAC/D,eAAgB,EAAiB,IAAI,KAAK,EAAe,CAAG,IAAA,GAC5D,gBAAiB,EAAkB,IAAI,KAAK,EAAgB,CAAG,IAAA,GAC/D,eAAgB,EAAiB,IAAI,KAAK,EAAe,CAAG,IAAA,GAC7D,CAAC"}
+{"version":3,"file":"impl-CyQRmuM72.mjs","names":[],"sources":["../src/commands/request/cancel/impl.ts"],"sourcesContent":["import { RequestAction, RequestStatus } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { cancelPrivacyRequests } from '../../../lib/requests/index.js';\n\nexport interface CancelCommandFlags {\n  auth: string;\n  actions: RequestAction[];\n  statuses?: RequestStatus[];\n  requestIds?: string[];\n  silentModeBefore?: Date;\n  createdAtBefore?: Date;\n  createdAtAfter?: Date;\n  updatedAtBefore?: Date;\n  updatedAtAfter?: Date;\n  cancellationTitle: string;\n  transcendUrl: string;\n  concurrency: number;\n}\n\nexport async function cancel(\n  this: LocalContext,\n  {\n    auth,\n    actions,\n    statuses = [],\n    requestIds,\n    silentModeBefore,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    cancellationTitle,\n    transcendUrl,\n    concurrency,\n  }: CancelCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await cancelPrivacyRequests({\n    transcendUrl,\n    requestActions: actions,\n    auth,\n    cancellationTitle,\n    requestIds,\n    statuses,\n    concurrency,\n    silentModeBefore: silentModeBefore ? new Date(silentModeBefore) : undefined,\n    createdAtBefore: createdAtBefore ? new Date(createdAtBefore) : undefined,\n    createdAtAfter: createdAtAfter ? new Date(createdAtAfter) : undefined,\n    updatedAtBefore: updatedAtBefore ? new Date(updatedAtBefore) : undefined,\n    updatedAtAfter: updatedAtAfter ? new Date(updatedAtAfter) : undefined,\n  });\n}\n"],"mappings":"6GAqBA,eAAsB,EAEpB,CACE,OACA,UACA,WAAW,EAAE,CACb,aACA,mBACA,kBACA,iBACA,kBACA,iBACA,oBACA,eACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAsB,CAC1B,eACA,eAAgB,EAChB,OACA,oBACA,aACA,WACA,cACA,iBAAkB,EAAmB,IAAI,KAAK,EAAiB,CAAG,IAAA,GAClE,gBAAiB,EAAkB,IAAI,KAAK,EAAgB,CAAG,IAAA,GAC/D,eAAgB,EAAiB,IAAI,KAAK,EAAe,CAAG,IAAA,GAC5D,gBAAiB,EAAkB,IAAI,KAAK,EAAgB,CAAG,IAAA,GAC/D,eAAgB,EAAiB,IAAI,KAAK,EAAe,CAAG,IAAA,GAC7D,CAAC"}

package/dist/impl-DEJpYLPB.mjs

@@ -0,0 +1,2 @@
+import{t as e}from"./buildExamples-7KXBjl-b.mjs";import{r as t}from"./policyEngineCliError-DY8V-qkK.mjs";import{r as n,t as r}from"./runOpa-CswzJxIs.mjs";import{t as i}from"./policy-bundle-manifest-D6dkbjNi.mjs";import{a,i as o,n as s,o as c,t as l}from"./printResult-CHe3nRN4.mjs";import{t as u}from"./formatPolicyBundleVersionSummary-CJmMCLtJ.mjs";import{n as d}from"./resolveBundleIdByName-qXZBrUz_.mjs";import{n as f}from"./inquirer-BeaBetMO.mjs";import{t as p}from"./done-input-validation-BUz-aVC5.mjs";import{spawnSync as m}from"node:child_process";import h from"node:fs";import g from"node:os";import _ from"node:path";import{gunzipSync as v}from"node:zlib";import y from"fast-glob";import b from"colors";function x(e){let t=y.sync(`**/*.rego`,{cwd:e,onlyFiles:!0,dot:!1}).sort(),n=_.join(e,`manifest.json`),{publishableRegoPaths:r}=i(h.existsSync(n)?h.readFileSync(n,`utf8`):void 0,t.map(t=>({path:t,contents:h.readFileSync(_.join(e,t),`utf8`)})));return{entries:[`manifest.json`,...r]}}async function S(e){let t=_.join(g.tmpdir(),`transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`);try{let{code:n,stderr:i}=await r([`build`,`--v0-compatible`,`--ignore`,`*_test.rego`,`-o`,t,`.`],{cwd:e});if(n!==0)throw Error(i.trim()||`opa build failed with exit code ${n}`)}finally{h.existsSync(t)&&h.unlinkSync(t)}}function C(e){if(e<1024)return`${e} B`;let t=e/1024;if(t<1024)return`${t%1==0?t.toFixed(0):t.toFixed(1)} KiB`;let n=t/1024;return`${n%1==0?n.toFixed(0):n.toFixed(1)} MiB`}async function w(e){n();let t=_.resolve(e);if(!h.existsSync(t)||!h.statSync(t).isDirectory())throw Error(`Policy directory does not exist or is not a directory: ${t}`);let{entries:i}=x(t),{code:o,stderr:s}=await r([`check`,`--strict`,`--v0-compatible`,t]);if(o!==0)throw Error(s.trim()||`opa check failed with exit code ${o}`);await S(t);let l=_.join(g.tmpdir(),`transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`),u=m(`tar`,[`-czf`,l,`-C`,t,...i],{env:{...process.env,COPYFILE_DISABLE:`1`},encoding:`utf8`});if(u.status!==0)throw Error(`Failed to create policy bundle archive: ${u.stderr.trim()||`tar failed`}`);let d=h.readFileSync(l);if(d.byteLength>5120)throw h.unlinkSync(l),Error(`Policy bundle exceeds the ${C(a)} compressed upload limit (bundle is ${C(d.byteLength)}). The server also rejects decompressed bundles larger than ${C(c)}.`);let f=v(d);if(f.byteLength>51200)throw h.unlinkSync(l),Error(`Policy bundle exceeds the ${C(c)} decompressed upload limit (bundle is ${C(f.byteLength)} decompressed).`);return l}function T(e){let t=h.readFileSync(e.bundlePath),n=new FormData;return n.append(`bundle`,new Blob([t],{type:`application/gzip`}),_.basename(e.bundlePath)),n.append(`version`,e.version),e.description&&n.append(`description`,e.description),e.bundleName&&n.append(`bundleName`,e.bundleName),n}function E(e){return e.toISOString().slice(0,19).replace(/[T:]/g,`-`)}function D(e,t=new Date){return`${e}-${E(t)}`}async function O({dir:n,"bundle-name":r,auth:i,"transcend-url":a,version:c,description:m,json:h,yes:g,debug:v=!1}){p(this.process),t(v);let y=_.resolve(n),x=c??D(r),S=o(a,i),C;try{this.logger.info(b.green(`Building policy bundle from ${y}...`)),C=await w(y);let t=await d(S,r),n;if(t){this.logger.info(b.green(`Uploading new version for bundle "${r}"...`));let e=T({bundlePath:C,version:x,description:m});n=await s(S.post(`v1/policy-engine/policy-bundles/${t}/versions`,{body:e}).json())}else{if(!this.process.stdin.isTTY&&!g){this.logger.error(b.red(`Cannot create a new bundle in a non-interactive environment; pass --yes to confirm.`)),this.process.exit(1);return}if(!g&&(this.logger.warn(b.yellow(`No policy bundle named "${r}" exists for this organization.`)),!await f({message:`No policy bundle named "${r}" exists. Create a new bundle and upload its first version?`}))){this.logger.info(b.yellow(`Publish cancelled.`));return}this.logger.info(b.green(`Creating bundle "${r}" and uploading first version...`));let e=T({bundlePath:C,version:x,description:m,bundleName:r});n=await s(S.post(`v1/policy-engine/policy-bundles`,{body:e}).json())}l(this.process.stdout,{json:h,data:n,renderTable:()=>u(n.version)}),this.logger.info(b.green(`Policy bundle version uploaded successfully.`));let i=e([`policy`,`activate`],{version:n.version.version,"bundle-name":r});this.logger.info(b.yellow(`Publishing a policy does not activate it. To activate this version, run:\n  ${i}`))}finally{C&&this.fs.existsSync(C)&&this.fs.unlinkSync(C)}}export{O as publish};
+//# sourceMappingURL=impl-DEJpYLPB.mjs.map

package/dist/impl-DEJpYLPB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"impl-DEJpYLPB.mjs","names":["fg"],"sources":["../src/commands/policy/helpers/buildOpaBundleTarball.ts","../src/commands/policy/helpers/buildPolicyBundleFormData.ts","../src/commands/policy/helpers/defaultPolicyVersionLabel.ts","../src/commands/policy/publish/impl.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { gunzipSync } from 'node:zlib';\n\nimport fg from 'fast-glob';\n\nimport { validatePolicyBundleContents } from '../../../lib/policy/policy-bundle-manifest.js';\nimport { MAX_BUNDLE_COMPRESSED_BYTES, MAX_BUNDLE_DECOMPRESSED_BYTES } from '../constants.js';\nimport { assertOpaInstalled } from './assertOpaInstalled.js';\nimport { runOPACapture } from './runOpa.js';\n\n/** Result of collecting publishable entries from a policy bundle directory. */\ninterface PolicyBundleArchiveContents {\n  /** Relative paths to include in the upload tarball (manifest first, then rego) */\n  entries: string[];\n}\n\n/**\n * Collects `manifest.json` and publishable `.rego` files from a policy directory.\n *\n * @param dir - Absolute path to the policy bundle directory\n * @returns Validated archive entries\n */\nfunction collectPolicyBundleArchiveEntries(dir: string): PolicyBundleArchiveContents {\n  const regoFiles = fg\n    .sync('**/*.rego', {\n      cwd: dir,\n      onlyFiles: true,\n      dot: false,\n    })\n    .sort();\n  const manifestPath = path.join(dir, 'manifest.json');\n  const { publishableRegoPaths } = validatePolicyBundleContents(\n    fs.existsSync(manifestPath) ? fs.readFileSync(manifestPath, 'utf8') : undefined,\n    regoFiles.map((relativePath) => ({\n      path: relativePath,\n      contents: fs.readFileSync(path.join(dir, relativePath), 'utf8'),\n    })),\n  );\n\n  return {\n    entries: ['manifest.json', ...publishableRegoPaths],\n  };\n}\n\n/**\n * Verifies that a policy directory compiles end-to-end with `opa build`.\n *\n * The compiled output is discarded — the server receives the `manifest.json` +\n * `.rego` archive produced by {@link buildOpaBundleTarball}, not the OPA bundle\n * — but a successful build guarantees the policies compile and link, surfacing\n * errors (syntax, missing imports, undefined references, etc.) before upload.\n *\n * @param dir - Absolute path to the policy bundle directory\n */\nasync function assertBundleCompiles(dir: string): Promise<void> {\n  const buildOutputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n  try {\n    // Run with `cwd` set to the bundle directory and pass `.` so `opa build`\n    // resolves the bundle root correctly. `*_test.rego` files are local-only.\n    const { code, stderr } = await runOPACapture(\n      ['build', '--v0-compatible', '--ignore', '*_test.rego', '-o', buildOutputPath, '.'],\n      { cwd: dir },\n    );\n    if (code !== 0) {\n      throw new Error(stderr.trim() || `opa build failed with exit code ${code}`);\n    }\n  } finally {\n    if (fs.existsSync(buildOutputPath)) {\n      fs.unlinkSync(buildOutputPath);\n    }\n  }\n}\n\n/**\n * Formats a byte count as a human-readable size with binary units.\n *\n * @param bytes - Number of bytes\n * @returns Human-readable size, e.g. `14 MiB` or `4 KiB`\n */\nfunction formatBytes(bytes: number): string {\n  if (bytes < 1024) {\n    return `${bytes} B`;\n  }\n  const kib = bytes / 1024;\n  if (kib < 1024) {\n    return `${kib % 1 === 0 ? kib.toFixed(0) : kib.toFixed(1)} KiB`;\n  }\n  const mib = kib / 1024;\n  return `${mib % 1 === 0 ? mib.toFixed(0) : mib.toFixed(1)} MiB`;\n}\n\n/**\n * Builds a gzip-compressed policy bundle tarball for upload to Transcend.\n *\n * The Policy Engine API expects a plain archive containing `manifest.json` and\n * one or more `.rego` files. This differs from `opa build` output, which embeds\n * `.manifest`, `data.json`, and other OPA bundle metadata that the server\n * rejects. Before packaging, the manifest is validated (shape + root coverage)\n * and the bundle is validated with `opa check` (strict Rego linting) and\n * `opa build` (full compilation) so failures surface client-side rather than\n * after upload.\n *\n * @param dir - Directory containing `manifest.json` and `.rego` policy files\n * @returns Absolute path to the generated `.tar.gz` bundle\n */\nexport async function buildOpaBundleTarball(dir: string): Promise<string> {\n  assertOpaInstalled();\n\n  const resolvedDir = path.resolve(dir);\n  if (!fs.existsSync(resolvedDir) || !fs.statSync(resolvedDir).isDirectory()) {\n    throw new Error(`Policy directory does not exist or is not a directory: ${resolvedDir}`);\n  }\n\n  // Validate the manifest shape and that roots cover every Rego package before\n  // invoking OPA, so invalid manifests surface a clear error instead of an\n  // opaque `opa build failed with exit code 1`.\n  const { entries: archiveEntries } = collectPolicyBundleArchiveEntries(resolvedDir);\n\n  // Match the Rego v1 validation the Policy Engine API runs on upload.\n  const { code: checkCode, stderr: checkStderr } = await runOPACapture([\n    'check',\n    '--strict',\n    '--v0-compatible',\n    resolvedDir,\n  ]);\n  if (checkCode !== 0) {\n    throw new Error(checkStderr.trim() || `opa check failed with exit code ${checkCode}`);\n  }\n\n  // Ensure the bundle compiles end-to-end before packaging for upload.\n  await assertBundleCompiles(resolvedDir);\n\n  const outputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n\n  const tarResult = spawnSync('tar', ['-czf', outputPath, '-C', resolvedDir, ...archiveEntries], {\n    env: { ...process.env, COPYFILE_DISABLE: '1' },\n    encoding: 'utf8',\n  });\n  if (tarResult.status !== 0) {\n    throw new Error(\n      `Failed to create policy bundle archive: ${tarResult.stderr.trim() || 'tar failed'}`,\n    );\n  }\n\n  const compressedBytes = fs.readFileSync(outputPath);\n  if (compressedBytes.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_COMPRESSED_BYTES)} compressed upload limit ` +\n        `(bundle is ${formatBytes(compressedBytes.byteLength)}). ` +\n        `The server also rejects decompressed bundles larger than ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)}.`,\n    );\n  }\n\n  const decompressedBytes = gunzipSync(compressedBytes);\n  if (decompressedBytes.byteLength > MAX_BUNDLE_DECOMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)} decompressed upload limit ` +\n        `(bundle is ${formatBytes(decompressedBytes.byteLength)} decompressed).`,\n    );\n  }\n\n  return outputPath;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\n/** Fields for building a policy bundle upload form. */\nexport interface BuildPolicyBundleFormDataOptions {\n  /** Absolute path to the bundle tarball */\n  bundlePath: string;\n  /** Version label */\n  version: string;\n  /** Optional description */\n  description?: string;\n  /** Bundle name (only for create) */\n  bundleName?: string;\n}\n\n/**\n * Builds multipart form data for a policy bundle upload.\n *\n * @param options - Upload fields\n * @returns FormData ready for POST\n */\nexport function buildPolicyBundleFormData(options: BuildPolicyBundleFormDataOptions): FormData {\n  const bundleBytes = fs.readFileSync(options.bundlePath);\n  const form = new FormData();\n  form.append(\n    'bundle',\n    new Blob([bundleBytes], { type: 'application/gzip' }),\n    path.basename(options.bundlePath),\n  );\n  form.append('version', options.version);\n  if (options.description) {\n    form.append('description', options.description);\n  }\n  if (options.bundleName) {\n    form.append('bundleName', options.bundleName);\n  }\n  return form;\n}\n","/**\n * Formats a date as `yyyy-mm-dd-hh-mm-ss` in UTC.\n *\n * @param date - Date to format\n * @returns Timestamp label\n */\nfunction formatPolicyVersionTimestamp(date: Date): string {\n  return date.toISOString().slice(0, 19).replace(/[T:]/g, '-');\n}\n\n/**\n * Returns a default version label from the bundle name and current UTC timestamp.\n *\n * @param bundleName - Tenant-unique policy bundle name\n * @param now - Current time (for testing)\n * @returns Version label in `{bundleName}-yyyy-mm-dd-hh-mm-ss` form\n */\nexport function defaultPolicyVersionLabel(bundleName: string, now: Date = new Date()): string {\n  return `${bundleName}-${formatPolicyVersionTimestamp(now)}`;\n}\n","import path from 'node:path';\n\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { buildExampleCommand } from '../../../lib/docgen/buildExamples.js';\nimport { inquirerConfirmBoolean } from '../../../lib/helpers/inquirer.js';\nimport type { ActivateCommandFlags } from '../activate/impl.js';\nimport {\n  buildPolicyBundleFormData,\n  buildPolicyEngineClient,\n  buildOpaBundleTarball,\n  defaultPolicyVersionLabel,\n  formatPolicyBundleVersionSummary,\n  policyEngineRequest,\n  printResult,\n  resolveBundleIdByName,\n  setPolicyEngineCliDebug,\n} from '../helpers/index.js';\nimport type { CreatePolicyBundleResponse, CreatePolicyBundleVersionResponse } from '../types.js';\n\n/** CLI flags for `transcend policy publish`. */\nexport interface PublishCommandFlags {\n  /** Directory containing Rego policy files */\n  dir: string;\n  /** Tenant-unique bundle name */\n  'bundle-name': string;\n  /** Transcend API key */\n  auth: string;\n  /** Transcend API URL */\n  'transcend-url': string;\n  /** Version label (defaults to `{bundleName}-yyyy-mm-dd-hh-mm-ss`) */\n  version?: string;\n  /** Optional version description */\n  description?: string;\n  /** Print raw JSON response */\n  json: boolean;\n  /** Skip the \"create new bundle\" confirmation */\n  yes: boolean;\n  /** Include technical error details when a command fails */\n  debug?: boolean;\n}\n\n/**\n * Build and upload a new immutable policy bundle version.\n *\n * @param this - CLI context\n * @param flags - Command flags\n */\nexport async function publish(\n  this: LocalContext,\n  {\n    dir,\n    'bundle-name': bundleName,\n    auth,\n    'transcend-url': transcendUrl,\n    version,\n    description,\n    json,\n    yes,\n    debug = false,\n  }: PublishCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n  setPolicyEngineCliDebug(debug);\n\n  const resolvedDir = path.resolve(dir);\n  const versionLabel = version ?? defaultPolicyVersionLabel(bundleName);\n  const client = buildPolicyEngineClient(transcendUrl, auth);\n\n  let bundlePath: string | undefined;\n  try {\n    this.logger.info(colors.green(`Building policy bundle from ${resolvedDir}...`));\n    bundlePath = await buildOpaBundleTarball(resolvedDir);\n\n    const existingBundleId = await resolveBundleIdByName(client, bundleName);\n\n    let responseBody: CreatePolicyBundleResponse | CreatePolicyBundleVersionResponse;\n\n    if (existingBundleId) {\n      this.logger.info(colors.green(`Uploading new version for bundle \"${bundleName}\"...`));\n      const form = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post(`v1/policy-engine/policy-bundles/${existingBundleId}/versions`, { body: form })\n          .json<CreatePolicyBundleVersionResponse>(),\n      );\n    } else {\n      if (!this.process.stdin.isTTY && !yes) {\n        this.logger.error(\n          colors.red(\n            'Cannot create a new bundle in a non-interactive environment; pass --yes to confirm.',\n          ),\n        );\n        this.process.exit(1);\n        return;\n      }\n\n      if (!yes) {\n        this.logger.warn(\n          colors.yellow(`No policy bundle named \"${bundleName}\" exists for this organization.`),\n        );\n        const shouldCreate = await inquirerConfirmBoolean({\n          message: `No policy bundle named \"${bundleName}\" exists. Create a new bundle and upload its first version?`,\n        });\n        if (!shouldCreate) {\n          this.logger.info(colors.yellow('Publish cancelled.'));\n          return;\n        }\n      }\n\n      this.logger.info(\n        colors.green(`Creating bundle \"${bundleName}\" and uploading first version...`),\n      );\n      const createForm = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n        bundleName,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post('v1/policy-engine/policy-bundles', {\n            body: createForm,\n          })\n          .json<CreatePolicyBundleResponse>(),\n      );\n    }\n\n    printResult(this.process.stdout, {\n      json,\n      data: responseBody,\n      renderTable: () => formatPolicyBundleVersionSummary(responseBody.version),\n    });\n\n    this.logger.info(colors.green('Policy bundle version uploaded successfully.'));\n\n    const activateCommand = buildExampleCommand<ActivateCommandFlags>(['policy', 'activate'], {\n      version: responseBody.version.version,\n      'bundle-name': bundleName,\n    });\n    this.logger.info(\n      colors.yellow(\n        `Publishing a policy does not activate it. To activate this version, run:\\n  ${activateCommand}`,\n      ),\n    );\n  } finally {\n    if (bundlePath && this.fs.existsSync(bundlePath)) {\n      this.fs.unlinkSync(bundlePath);\n    }\n  }\n}\n"],"mappings":"wsBAyBA,SAAS,EAAkC,EAA0C,CACnF,IAAM,EAAYA,EACf,KAAK,YAAa,CACjB,IAAK,EACL,UAAW,GACX,IAAK,GACN,CAAC,CACD,MAAM,CACH,EAAe,EAAK,KAAK,EAAK,gBAAgB,CAC9C,CAAE,wBAAyB,EAC/B,EAAG,WAAW,EAAa,CAAG,EAAG,aAAa,EAAc,OAAO,CAAG,IAAA,GACtE,EAAU,IAAK,IAAkB,CAC/B,KAAM,EACN,SAAU,EAAG,aAAa,EAAK,KAAK,EAAK,EAAa,CAAE,OAAO,CAChE,EAAE,CACJ,CAED,MAAO,CACL,QAAS,CAAC,gBAAiB,GAAG,EAAqB,CACpD,CAaH,eAAe,EAAqB,EAA4B,CAC9D,IAAM,EAAkB,EAAK,KAC3B,EAAG,QAAQ,CACX,iCAAiC,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SACpF,CACD,GAAI,CAGF,GAAM,CAAE,OAAM,UAAW,MAAM,EAC7B,CAAC,QAAS,kBAAmB,WAAY,cAAe,KAAM,EAAiB,IAAI,CACnF,CAAE,IAAK,EAAK,CACb,CACD,GAAI,IAAS,EACX,MAAU,MAAM,EAAO,MAAM,EAAI,mCAAmC,IAAO,QAErE,CACJ,EAAG,WAAW,EAAgB,EAChC,EAAG,WAAW,EAAgB,EAWpC,SAAS,EAAY,EAAuB,CAC1C,GAAI,EAAQ,KACV,MAAO,GAAG,EAAM,IAElB,IAAM,EAAM,EAAQ,KACpB,GAAI,EAAM,KACR,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAE5D,IAAM,EAAM,EAAM,KAClB,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAiB5D,eAAsB,EAAsB,EAA8B,CACxE,GAAoB,CAEpB,IAAM,EAAc,EAAK,QAAQ,EAAI,CACrC,GAAI,CAAC,EAAG,WAAW,EAAY,EAAI,CAAC,EAAG,SAAS,EAAY,CAAC,aAAa,CACxE,MAAU,MAAM,0DAA0D,IAAc,CAM1F,GAAM,CAAE,QAAS,GAAmB,EAAkC,EAAY,CAG5E,CAAE,KAAM,EAAW,OAAQ,GAAgB,MAAM,EAAc,CACnE,QACA,WACA,kBACA,EACD,CAAC,CACF,GAAI,IAAc,EAChB,MAAU,MAAM,EAAY,MAAM,EAAI,mCAAmC,IAAY,CAIvF,MAAM,EAAqB,EAAY,CAEvC,IAAM,EAAa,EAAK,KACtB,EAAG,QAAQ,CACX,2BAA2B,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SAC9E,CAEK,EAAY,EAAU,MAAO,CAAC,OAAQ,EAAY,KAAM,EAAa,GAAG,EAAe,CAAE,CAC7F,IAAK,CAAE,GAAG,QAAQ,IAAK,iBAAkB,IAAK,CAC9C,SAAU,OACX,CAAC,CACF,GAAI,EAAU,SAAW,EACvB,MAAU,MACR,2CAA2C,EAAU,OAAO,MAAM,EAAI,eACvE,CAGH,IAAM,EAAkB,EAAG,aAAa,EAAW,CACnD,GAAI,EAAgB,WAAA,KAElB,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA4B,CAAC,sCACtD,EAAY,EAAgB,WAAW,CAAC,8DACM,EAAY,EAA8B,CAAC,GAC1G,CAGH,IAAM,EAAoB,EAAW,EAAgB,CACrD,GAAI,EAAkB,WAAA,MAEpB,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA8B,CAAC,wCACxD,EAAY,EAAkB,WAAW,CAAC,iBAC3D,CAGH,OAAO,ECvJT,SAAgB,EAA0B,EAAqD,CAC7F,IAAM,EAAc,EAAG,aAAa,EAAQ,WAAW,CACjD,EAAO,IAAI,SAajB,OAZA,EAAK,OACH,SACA,IAAI,KAAK,CAAC,EAAY,CAAE,CAAE,KAAM,mBAAoB,CAAC,CACrD,EAAK,SAAS,EAAQ,WAAW,CAClC,CACD,EAAK,OAAO,UAAW,EAAQ,QAAQ,CACnC,EAAQ,aACV,EAAK,OAAO,cAAe,EAAQ,YAAY,CAE7C,EAAQ,YACV,EAAK,OAAO,aAAc,EAAQ,WAAW,CAExC,EC9BT,SAAS,EAA6B,EAAoB,CACxD,OAAO,EAAK,aAAa,CAAC,MAAM,EAAG,GAAG,CAAC,QAAQ,QAAS,IAAI,CAU9D,SAAgB,EAA0B,EAAoB,EAAY,IAAI,KAAgB,CAC5F,MAAO,GAAG,EAAW,GAAG,EAA6B,EAAI,GCgC3D,eAAsB,EAEpB,CACE,MACA,cAAe,EACf,OACA,gBAAiB,EACjB,UACA,cACA,OACA,MACA,QAAQ,IAEK,CACf,EAAoB,KAAK,QAAQ,CACjC,EAAwB,EAAM,CAE9B,IAAM,EAAc,EAAK,QAAQ,EAAI,CAC/B,EAAe,GAAW,EAA0B,EAAW,CAC/D,EAAS,EAAwB,EAAc,EAAK,CAEtD,EACJ,GAAI,CACF,KAAK,OAAO,KAAK,EAAO,MAAM,+BAA+B,EAAY,KAAK,CAAC,CAC/E,EAAa,MAAM,EAAsB,EAAY,CAErD,IAAM,EAAmB,MAAM,EAAsB,EAAQ,EAAW,CAEpE,EAEJ,GAAI,EAAkB,CACpB,KAAK,OAAO,KAAK,EAAO,MAAM,qCAAqC,EAAW,MAAM,CAAC,CACrF,IAAM,EAAO,EAA0B,CACrC,aACA,QAAS,EACT,cACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,mCAAmC,EAAiB,WAAY,CAAE,KAAM,EAAM,CAAC,CACpF,MAAyC,CAC7C,KACI,CACL,GAAI,CAAC,KAAK,QAAQ,MAAM,OAAS,CAAC,EAAK,CACrC,KAAK,OAAO,MACV,EAAO,IACL,sFACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,CACpB,OAGF,GAAI,CAAC,IACH,KAAK,OAAO,KACV,EAAO,OAAO,2BAA2B,EAAW,iCAAiC,CACtF,CAIG,CAAC,MAHsB,EAAuB,CAChD,QAAS,2BAA2B,EAAW,6DAChD,CAAC,EACiB,CACjB,KAAK,OAAO,KAAK,EAAO,OAAO,qBAAqB,CAAC,CACrD,OAIJ,KAAK,OAAO,KACV,EAAO,MAAM,oBAAoB,EAAW,kCAAkC,CAC/E,CACD,IAAM,EAAa,EAA0B,CAC3C,aACA,QAAS,EACT,cACA,aACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,kCAAmC,CACvC,KAAM,EACP,CAAC,CACD,MAAkC,CACtC,CAGH,EAAY,KAAK,QAAQ,OAAQ,CAC/B,OACA,KAAM,EACN,gBAAmB,EAAiC,EAAa,QAAQ,CAC1E,CAAC,CAEF,KAAK,OAAO,KAAK,EAAO,MAAM,+CAA+C,CAAC,CAE9E,IAAM,EAAkB,EAA0C,CAAC,SAAU,WAAW,CAAE,CACxF,QAAS,EAAa,QAAQ,QAC9B,cAAe,EAChB,CAAC,CACF,KAAK,OAAO,KACV,EAAO,OACL,+EAA+E,IAChF,CACF,QACO,CACJ,GAAc,KAAK,GAAG,WAAW,EAAW,EAC9C,KAAK,GAAG,WAAW,EAAW"}

package/dist/impl-DEhw1iNn.mjs

@@ -0,0 +1,2 @@
+import{g as e}from"./constants-jjHIzHGm.mjs";import{t}from"./done-input-validation-BUz-aVC5.mjs";import{h as n,n as r,p as i,r as a,t as o}from"./prompts-ClBXdELk.mjs";import{a as s,r as c,t as l}from"./deno-runtime-DV52X8-P.mjs";import{t as u}from"./run-captured-process-BXwWXuTh.mjs";import{t as d}from"./scaffold-model-BAbYTR0q.mjs";import{t as f}from"./project-plan-apply-Dvndx455.mjs";import{c as p,i as m,n as h,s as g}from"./scaffold-planning-CNv83t_v.mjs";import _ from"colors";import{CUSTOM_FUNCTION_TYPES_VERSION as v}from"@transcend-io/custom-function-types";const y={[d.Deno]:`Deno configuration`,[d.Editor]:`VS Code settings`,[d.Skill]:`Agent skill`,[d.Ci]:`GitHub Actions`},b=Object.values(d);function x(e,t,n){return!e.json&&!e.noInteractive&&!!(t&&n)}async function S(e,t,n){let r={[d.Deno]:t.deno,[d.Editor]:t.editor,[d.Skill]:t.skill,[d.Ci]:t.ci};if(!n.interactive)return b.filter(e=>r[e]===!0);let i=b.map(e=>({name:y[e],value:e,checked:r[e]!==!1}));return e.checkbox(`Choose repository setup:`,i)}async function C(y,b){t(this.process);try{let t=s(this,{...b?{directory:b}:{},...y.manifest?{manifest:y.manifest}:{}}),o=new r(this),C=x(y,this.process.stdin.isTTY,this.process.stderr.isTTY),w=await S(o,y,{interactive:C}),T=h({state:t,snapshots:a(this,t.projectRoot,m(t,{features:w})),contractVersion:v,cliVersion:e},{features:w});if(w.includes(d.Deno)){let e=await u(`deno`,[`--version`],{cwd:this.process.cwd()},this);if(e.error?.code===`ENOENT`)T.warnings.push(`Deno 2.x is not installed. Install it from ${l}`);else if(e.code!==0)T.warnings.push(`Deno was found, but its version could not be determined. Deno 2.x is required. See ${l}`);else{let t=c(e.stdout);t.level!==`compatible`&&T.warnings.push(t.message)}}y.json||this.logger.info(n(T,{cwd:this.process.cwd(),title:`Custom Function plan`,details:[{label:`Target`,path:T.targetDirectory},{label:`Manifest`,path:T.manifestPath}]}));let E=T.changes.length===0||y.dryRun;if(T.changes.length>0&&!y.dryRun)if(y.yes)E=!0;else if(C)E=await o.confirm(`Apply this complete plan?`,!0);else throw Error(`The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.`);E&&!y.dryRun&&T.changes.length>0&&await f(this,T);let D=E&&!y.dryRun&&T.changes.length>0,O=E&&!y.dryRun,k=p({targetDirectory:i(this.process.cwd(),t.targetDirectory),manifestPath:i(this.process.cwd(),t.manifestPath),cliVersion:e,hasSkill:O&&w.includes(d.Skill),hasGithubWorkflow:O&&w.includes(d.Ci)&&!!(t.repositoryRoot&&t.usesGithub)}),A=g(T,{applied:D,dryRun:y.dryRun,cwd:this.process.cwd(),aiHandoff:k});if(y.json){this.process.stdout.write(`${JSON.stringify(A)}\n`);return}if(y.dryRun){this.logger.info(_.yellow(`Dry run complete. No changes were written.`));return}if(!E){this.logger.info(_.yellow(`No changes applied.`));return}if(T.changes.length===0){this.logger.info(_.green(`Custom Function project is already initialized.`));return}this.logger.info(_.green(`Custom Function project initialized.`)),T.nextSteps.length>0&&(this.logger.info(`\n${_.bold(`Next steps`)}`),T.nextSteps.forEach(e=>this.logger.info(e))),this.logger.info(`\n${_.bold(`AI handoff — paste into your coding agent`)}`),this.logger.info(k)}catch(e){throw e instanceof o&&this.process.exit(130),e}}export{C as init};
+//# sourceMappingURL=impl-DEhw1iNn.mjs.map

package/dist/impl-DEhw1iNn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"impl-DEhw1iNn.mjs","names":["CLI_VERSION"],"sources":["../src/commands/custom-functions/init/impl.ts"],"sourcesContent":["import { CUSTOM_FUNCTION_TYPES_VERSION } from '@transcend-io/custom-function-types';\nimport colors from 'colors';\n\nimport { version as CLI_VERSION } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { runCapturedProcess } from '../../../lib/cli/run-captured-process.js';\nimport { buildInitAiHandoff } from '../../../lib/custom-functions/ai-handoff.js';\nimport {\n  DENO_INSTALL_URL,\n  getDenoRuntimeCompatibility,\n  SUPPORTED_DENO_MAJOR_VERSION,\n} from '../../../lib/custom-functions/deno-runtime.js';\nimport { discoverCustomFunctionProject } from '../../../lib/custom-functions/project-discovery.js';\nimport {\n  CustomFunctionSetupFeature,\n  type CustomFunctionSetupFeature as CustomFunctionSetupFeatureType,\n} from '../../../lib/custom-functions/scaffold-model.js';\nimport { buildPlanResult } from '../../../lib/custom-functions/scaffold-output.js';\nimport {\n  buildInitPlan,\n  getInitPlanningCandidatePaths,\n} from '../../../lib/custom-functions/scaffold-planning.js';\nimport { collectPlanningSnapshots } from '../../../lib/scaffolding/project-discovery.js';\nimport { applyProjectPlan } from '../../../lib/scaffolding/project-plan-apply.js';\nimport {\n  displayProjectPath,\n  renderProjectPlan,\n} from '../../../lib/scaffolding/project-plan-output.js';\nimport {\n  PromptCancelledError,\n  type PromptChoice,\n  ScaffoldPrompts,\n} from '../../../lib/scaffolding/prompts.js';\n\n/** Flags for `custom-functions init`. */\nexport interface CustomFunctionInitFlags {\n  /** Explicit manifest path. */\n  manifest?: string;\n  /** Install Deno configuration. */\n  deno?: boolean;\n  /** Install editor recommendations. */\n  editor?: boolean;\n  /** Install the coding-agent skill. */\n  skill?: boolean;\n  /** Install GitHub Actions validation. */\n  ci?: boolean;\n  /** Disable prompts. */\n  noInteractive: boolean;\n  /** Render but do not apply. */\n  dryRun: boolean;\n  /** Approve the final displayed plan. */\n  yes: boolean;\n  /** Emit one stable JSON result on stdout. */\n  json: boolean;\n}\n\n/** User-facing setup labels. */\nconst SETUP_LABELS: Readonly<Record<CustomFunctionSetupFeatureType, string>> = {\n  [CustomFunctionSetupFeature.Deno]: 'Deno configuration',\n  [CustomFunctionSetupFeature.Editor]: 'VS Code settings',\n  [CustomFunctionSetupFeature.Skill]: 'Agent skill',\n  [CustomFunctionSetupFeature.Ci]: 'GitHub Actions',\n};\n\n/** All optional setup features in stable prompt order. */\nconst ALL_SETUP_FEATURES = Object.values(CustomFunctionSetupFeature);\n\n/**\n * Whether this invocation can ask questions.\n *\n * @param context - CLI context\n * @param flags - Interaction flags\n * @returns Whether prompts are enabled\n */\nfunction isInteractiveInvocation(\n  flags: Pick<CustomFunctionInitFlags, 'json' | 'noInteractive'>,\n  stdinIsTTY: boolean | undefined,\n  stderrIsTTY: boolean | undefined,\n): boolean {\n  return !flags.json && !flags.noInteractive && Boolean(stdinIsTTY && stderrIsTTY);\n}\n\n/**\n * Resolve setup directly from individual flags or one checkbox prompt.\n *\n * @param context - CLI context\n * @param prompts - Prompt adapters\n * @param flags - Setup flags\n * @param options - Interaction state\n * @returns Selected setup features\n */\nasync function resolveFeatures(\n  prompts: ScaffoldPrompts,\n  flags: CustomFunctionInitFlags,\n  options: {\n    /** Whether prompts are available. */\n    interactive: boolean;\n  },\n): Promise<CustomFunctionSetupFeatureType[]> {\n  const enabled: Readonly<Record<CustomFunctionSetupFeatureType, boolean | undefined>> = {\n    [CustomFunctionSetupFeature.Deno]: flags.deno,\n    [CustomFunctionSetupFeature.Editor]: flags.editor,\n    [CustomFunctionSetupFeature.Skill]: flags.skill,\n    [CustomFunctionSetupFeature.Ci]: flags.ci,\n  };\n  if (!options.interactive) {\n    return ALL_SETUP_FEATURES.filter((feature) => enabled[feature] === true);\n  }\n  const choices: PromptChoice<CustomFunctionSetupFeatureType>[] = ALL_SETUP_FEATURES.map(\n    (feature) => ({\n      name: SETUP_LABELS[feature],\n      value: feature,\n      checked: enabled[feature] !== false,\n    }),\n  );\n  return prompts.checkbox('Choose repository setup:', choices);\n}\n\n/**\n * Initialize a credential-free local Custom Function project.\n *\n * @param this - CLI context\n * @param flags - Scaffold and interaction flags\n * @param directory - Optional target directory\n */\nexport async function init(\n  this: LocalContext,\n  flags: CustomFunctionInitFlags,\n  directory?: string,\n): Promise<void> {\n  doneInputValidation(this.process);\n  try {\n    const state = discoverCustomFunctionProject(this, {\n      ...(directory ? { directory } : {}),\n      ...(flags.manifest ? { manifest: flags.manifest } : {}),\n    });\n    const prompts = new ScaffoldPrompts(this);\n    const interactive = isInteractiveInvocation(\n      flags,\n      this.process.stdin.isTTY,\n      this.process.stderr.isTTY,\n    );\n    const features = await resolveFeatures(prompts, flags, { interactive });\n    const snapshots = collectPlanningSnapshots(\n      this,\n      state.projectRoot,\n      getInitPlanningCandidatePaths(state, { features }),\n    );\n    const plan = buildInitPlan(\n      {\n        state,\n        snapshots,\n        contractVersion: CUSTOM_FUNCTION_TYPES_VERSION,\n        cliVersion: CLI_VERSION,\n      },\n      { features },\n    );\n    if (features.includes(CustomFunctionSetupFeature.Deno)) {\n      const denoVersion = await runCapturedProcess(\n        'deno',\n        ['--version'],\n        { cwd: this.process.cwd() },\n        this,\n      );\n      if (denoVersion.error?.code === 'ENOENT') {\n        plan.warnings.push(\n          `Deno ${SUPPORTED_DENO_MAJOR_VERSION}.x is not installed. Install it from ${DENO_INSTALL_URL}`,\n        );\n      } else if (denoVersion.code !== 0) {\n        plan.warnings.push(\n          `Deno was found, but its version could not be determined. Deno ${SUPPORTED_DENO_MAJOR_VERSION}.x is required. See ${DENO_INSTALL_URL}`,\n        );\n      } else {\n        const compatibility = getDenoRuntimeCompatibility(denoVersion.stdout);\n        if (compatibility.level !== 'compatible') {\n          plan.warnings.push(compatibility.message);\n        }\n      }\n    }\n    if (!flags.json) {\n      this.logger.info(\n        renderProjectPlan(plan, {\n          cwd: this.process.cwd(),\n          title: 'Custom Function plan',\n          details: [\n            { label: 'Target', path: plan.targetDirectory },\n            { label: 'Manifest', path: plan.manifestPath },\n          ],\n        }),\n      );\n    }\n\n    let approved = plan.changes.length === 0 || flags.dryRun;\n    if (plan.changes.length > 0 && !flags.dryRun) {\n      if (flags.yes) {\n        approved = true;\n      } else if (interactive) {\n        approved = await prompts.confirm('Apply this complete plan?', true);\n      } else {\n        throw new Error(\n          'The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.',\n        );\n      }\n    }\n\n    if (approved && !flags.dryRun && plan.changes.length > 0) {\n      await applyProjectPlan(this, plan);\n    }\n    const applied = approved && !flags.dryRun && plan.changes.length > 0;\n    const setupAvailable = approved && !flags.dryRun;\n    const aiHandoff = buildInitAiHandoff({\n      targetDirectory: displayProjectPath(this.process.cwd(), state.targetDirectory),\n      manifestPath: displayProjectPath(this.process.cwd(), state.manifestPath),\n      cliVersion: CLI_VERSION,\n      hasSkill: setupAvailable && features.includes(CustomFunctionSetupFeature.Skill),\n      hasGithubWorkflow:\n        setupAvailable &&\n        features.includes(CustomFunctionSetupFeature.Ci) &&\n        Boolean(state.repositoryRoot && state.usesGithub),\n    });\n    const result = buildPlanResult(plan, {\n      applied,\n      dryRun: flags.dryRun,\n      cwd: this.process.cwd(),\n      aiHandoff,\n    });\n    if (flags.json) {\n      this.process.stdout.write(`${JSON.stringify(result)}\\n`);\n      return;\n    }\n    if (flags.dryRun) {\n      this.logger.info(colors.yellow('Dry run complete. No changes were written.'));\n      return;\n    }\n    if (!approved) {\n      this.logger.info(colors.yellow('No changes applied.'));\n      return;\n    }\n    if (plan.changes.length === 0) {\n      this.logger.info(colors.green('Custom Function project is already initialized.'));\n      return;\n    }\n    this.logger.info(colors.green('Custom Function project initialized.'));\n    if (plan.nextSteps.length > 0) {\n      this.logger.info(`\\n${colors.bold('Next steps')}`);\n      plan.nextSteps.forEach((step) => this.logger.info(step));\n    }\n    this.logger.info(`\\n${colors.bold('AI handoff — paste into your coding agent')}`);\n    this.logger.info(aiHandoff);\n  } catch (error) {\n    if (error instanceof PromptCancelledError) {\n      this.process.exit(130);\n    }\n    throw error;\n  }\n}\n"],"mappings":"0jBA0DA,MAAM,EAAyE,EAC5E,EAA2B,MAAO,sBAClC,EAA2B,QAAS,oBACpC,EAA2B,OAAQ,eACnC,EAA2B,IAAK,iBAClC,CAGK,EAAqB,OAAO,OAAO,EAA2B,CASpE,SAAS,EACP,EACA,EACA,EACS,CACT,MAAO,CAAC,EAAM,MAAQ,CAAC,EAAM,eAAiB,GAAQ,GAAc,GAYtE,eAAe,EACb,EACA,EACA,EAI2C,CAC3C,IAAM,EAAiF,EACpF,EAA2B,MAAO,EAAM,MACxC,EAA2B,QAAS,EAAM,QAC1C,EAA2B,OAAQ,EAAM,OACzC,EAA2B,IAAK,EAAM,GACxC,CACD,GAAI,CAAC,EAAQ,YACX,OAAO,EAAmB,OAAQ,GAAY,EAAQ,KAAa,GAAK,CAE1E,IAAM,EAA0D,EAAmB,IAChF,IAAa,CACZ,KAAM,EAAa,GACnB,MAAO,EACP,QAAS,EAAQ,KAAa,GAC/B,EACF,CACD,OAAO,EAAQ,SAAS,2BAA4B,EAAQ,CAU9D,eAAsB,EAEpB,EACA,EACe,CACf,EAAoB,KAAK,QAAQ,CACjC,GAAI,CACF,IAAM,EAAQ,EAA8B,KAAM,CAChD,GAAI,EAAY,CAAE,YAAW,CAAG,EAAE,CAClC,GAAI,EAAM,SAAW,CAAE,SAAU,EAAM,SAAU,CAAG,EAAE,CACvD,CAAC,CACI,EAAU,IAAI,EAAgB,KAAK,CACnC,EAAc,EAClB,EACA,KAAK,QAAQ,MAAM,MACnB,KAAK,QAAQ,OAAO,MACrB,CACK,EAAW,MAAM,EAAgB,EAAS,EAAO,CAAE,cAAa,CAAC,CAMjE,EAAO,EACX,CACE,QACA,UARc,EAChB,KACA,EAAM,YACN,EAA8B,EAAO,CAAE,WAAU,CAAC,CAKvC,CACT,gBAAiB,EACjB,WAAYA,EACb,CACD,CAAE,WAAU,CACb,CACD,GAAI,EAAS,SAAS,EAA2B,KAAK,CAAE,CACtD,IAAM,EAAc,MAAM,EACxB,OACA,CAAC,YAAY,CACb,CAAE,IAAK,KAAK,QAAQ,KAAK,CAAE,CAC3B,KACD,CACD,GAAI,EAAY,OAAO,OAAS,SAC9B,EAAK,SAAS,KACZ,8CAA4E,IAC7E,SACQ,EAAY,OAAS,EAC9B,EAAK,SAAS,KACZ,sFAAoH,IACrH,KACI,CACL,IAAM,EAAgB,EAA4B,EAAY,OAAO,CACjE,EAAc,QAAU,cAC1B,EAAK,SAAS,KAAK,EAAc,QAAQ,EAI1C,EAAM,MACT,KAAK,OAAO,KACV,EAAkB,EAAM,CACtB,IAAK,KAAK,QAAQ,KAAK,CACvB,MAAO,uBACP,QAAS,CACP,CAAE,MAAO,SAAU,KAAM,EAAK,gBAAiB,CAC/C,CAAE,MAAO,WAAY,KAAM,EAAK,aAAc,CAC/C,CACF,CAAC,CACH,CAGH,IAAI,EAAW,EAAK,QAAQ,SAAW,GAAK,EAAM,OAClD,GAAI,EAAK,QAAQ,OAAS,GAAK,CAAC,EAAM,OACpC,GAAI,EAAM,IACR,EAAW,WACF,EACT,EAAW,MAAM,EAAQ,QAAQ,4BAA6B,GAAK,MAEnE,MAAU,MACR,qGACD,CAID,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,GACrD,MAAM,EAAiB,KAAM,EAAK,CAEpC,IAAM,EAAU,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,EAC7D,EAAiB,GAAY,CAAC,EAAM,OACpC,EAAY,EAAmB,CACnC,gBAAiB,EAAmB,KAAK,QAAQ,KAAK,CAAE,EAAM,gBAAgB,CAC9E,aAAc,EAAmB,KAAK,QAAQ,KAAK,CAAE,EAAM,aAAa,CACxE,WAAYA,EACZ,SAAU,GAAkB,EAAS,SAAS,EAA2B,MAAM,CAC/E,kBACE,GACA,EAAS,SAAS,EAA2B,GAAG,EAChD,GAAQ,EAAM,gBAAkB,EAAM,YACzC,CAAC,CACI,EAAS,EAAgB,EAAM,CACnC,UACA,OAAQ,EAAM,OACd,IAAK,KAAK,QAAQ,KAAK,CACvB,YACD,CAAC,CACF,GAAI,EAAM,KAAM,CACd,KAAK,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,EAAO,CAAC,IAAI,CACxD,OAEF,GAAI,EAAM,OAAQ,CAChB,KAAK,OAAO,KAAK,EAAO,OAAO,6CAA6C,CAAC,CAC7E,OAEF,GAAI,CAAC,EAAU,CACb,KAAK,OAAO,KAAK,EAAO,OAAO,sBAAsB,CAAC,CACtD,OAEF,GAAI,EAAK,QAAQ,SAAW,EAAG,CAC7B,KAAK,OAAO,KAAK,EAAO,MAAM,kDAAkD,CAAC,CACjF,OAEF,KAAK,OAAO,KAAK,EAAO,MAAM,uCAAuC,CAAC,CAClE,EAAK,UAAU,OAAS,IAC1B,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,aAAa,GAAG,CAClD,EAAK,UAAU,QAAS,GAAS,KAAK,OAAO,KAAK,EAAK,CAAC,EAE1D,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,4CAA4C,GAAG,CACjF,KAAK,OAAO,KAAK,EAAU,OACpB,EAAO,CAId,MAHI,aAAiB,GACnB,KAAK,QAAQ,KAAK,IAAI,CAElB"}

package/dist/impl-DK7nSMle2.mjs

@@ -0,0 +1,303 @@
+import{g as e}from"./constants-jjHIzHGm.mjs";import{a as t,c as n,i as r,l as i,o as a,r as o,s,t as c}from"./policy-runtime-BMKa-Upy.mjs";import{t as l}from"./done-input-validation-BUz-aVC5.mjs";import{a as u,c as d,d as f,f as p,g as m,h,i as g,l as ee,m as _,n as v,p as y,r as te,t as ne,u as re}from"./prompts-ClBXdELk.mjs";import{t as ie}from"./run-captured-process-BXwWXuTh.mjs";import{t as ae}from"./project-plan-apply-Dvndx455.mjs";import{n as b,r as x,t as S}from"./jsonc-D9dDWb1J.mjs";import{isAbsolute as C,join as w,posix as T,relative as E,resolve as oe,sep as D}from"node:path";import O from"colors";const k=`transcend/policy`;function se(e,t=k){let n=e.process.cwd(),r=oe(n,t);if(e.fs.existsSync(r)&&!e.fs.statSync(r).isDirectory())throw Error(`Policy target is not a directory: ${r}`);return{invocationDirectory:n,targetDirectory:r,...u(e,{invocationDirectory:n,targetDirectory:r,standaloneProjectRoot:n}),relativePaths:g(e,r),relativeFilePaths:g(e,r,{includeDirectories:!1})}}function ce(e){return w(e.targetDirectory,`manifest.json`)}const A={Editor:`editor`,Skill:`skill`,Ci:`ci`};var le=`# Idiomatic Rego and document-tree authoring
+
+## Start from the document tree
+
+OPA evaluates queries against one document tree:
+
+- \`input\` is the request-specific document supplied by the caller.
+- \`data\` contains loaded policy packages and static data.
+- A Rego \`package\` determines where a module contributes documents below \`data\`.
+
+Choose package paths from the application's required query and ownership boundaries. Keep directory and package names aligned when practical, and cover every publishable package with a \`manifest.json\` root.
+
+Use Rego v1 explicitly:
+
+\`\`\`rego
+package policy_engine.example
+
+import rego.v1
+\`\`\`
+
+When one publishable package reads another package under the same manifest root, import it and use the local name:
+
+\`\`\`rego
+import data.policy_engine.facts
+
+allow if facts.subject_is_trusted
+\`\`\`
+
+Do not use a fully qualified \`data.policy_engine...\` reference directly in a rule body. Policy Engine re-namespaces package declarations and imports during activation, and \`transcend policy lint\` rejects direct self-root references that would change meaning.
+
+## Define the contract before implementation
+
+Find the actual caller and document:
+
+1. the query path below \`data\`;
+2. required and optional \`input\` fields;
+3. the result document consumed by the caller;
+4. fail-closed behavior for absent, malformed, or unknown input;
+5. stable reason codes and any fields reserved for later extension.
+
+Do not infer a product contract from the generated example. Replace its package names and fields when the repository's contract is known.
+
+## Prefer declarative result construction
+
+String decisions inside an object remain readable and extensible. Keep one result document shape and derive its fields from named rules:
+
+\`\`\`rego
+default decision := "deny"
+
+decision := "allow" if {
+	input.subject.trusted == true
+}
+
+default reason_code := "untrusted_or_invalid_input"
+
+reason_code := "trusted_subject" if {
+	decision == "allow"
+}
+
+result := {
+	"decision": decision,
+	"reason_code": reason_code,
+}
+\`\`\`
+
+Rego rules define documents; they are not an imperative sequence of variable assignments. Prefer small named predicates and one result constructor over repeated branch-specific copies of the full output object.
+
+## Fail closed
+
+- Give the externally queried decision or result a deny/error default.
+- Treat missing fields and unknown enum values as non-authorizing.
+- Avoid broad truthiness checks when exact values are required.
+- Add tests for malformed and incomplete inputs, not only expected allow cases.
+- Add result fields compatibly so existing consumers can continue reading the stable core.
+`,ue=`# Publishing
+
+## Validate the upload contract
+
+\`manifest.json\` declares the document-tree roots included in the Policy Engine bundle. Each non-test Rego package must equal a root or be nested below one. Test modules remain local and are excluded from the upload archive.
+
+Before publishing:
+
+1. confirm the intended package and query paths with the consuming application;
+2. run \`transcend policy lint --dir <policy-directory> --noInteractive\`;
+3. review the generated bundle name, version, description, and target Transcend environment;
+4. keep API keys in the environment or the repository's approved secret store.
+
+The publish path validates strict Rego compatibility and bundle compilation before creating the upload tarball.
+
+## Publish deliberately
+
+Run \`transcend policy publish --help\` for the current required flags and authentication scopes. Publishing creates or updates remote Policy Engine bundle resources, so keep it out of pull-request validation and require the repository's normal deployment approval.
+
+Do not add publishing, Transcend API credentials, or environment activation to the validation-only workflow generated by \`policy init\`. Treat those as separate deployment decisions.
+`,de="# Setup and tooling\n\n## Install the CLI\n\nInstall the Transcend CLI:\n\n```sh\nnpm install --global @transcend-io/cli\n```\n\n## Initialize safely\n\nRun `transcend policy init --help` before choosing flags. The default target is `transcend/policy`.\n\nInteractive initialization offers VS Code setup, this Agent Skill, and validation-only GitHub Actions. Non-interactive automation enables only explicitly supplied `--editor`, `--skill`, and `--ci` flags:\n\n```sh\ntranscend policy init ./transcend/policy --editor --skill --ci --noInteractive --yes\n```\n\nUse `--dryRun` to inspect the complete transactional plan. Existing policy files, manifests, Regal configuration, workflows, and customized managed artifacts are preserved.\n\n## Required tools\n\n- Use OPA 1.x for Rego v1 parsing, formatting, checks, tests, and bundle compilation.\n- Use Regal for idiomatic Rego linting and editor language-server features.\n- Run `opa version` and `regal version` to confirm the active executables.\n\nThe generated Regal configuration targets OPA 1.13.1 capabilities. Generated CI installs OPA 1.13.1 and Regal 0.42.0; local tools only need to satisfy the compatible versions reported by `policy init` and `policy lint`. Follow their official installation links when a compatible tool is missing.\n\n## Editor and CI\n\nRepository-level VS Code files scope OPA bundle roots and the `policy: lint` task to the selected policy directory. Preserve custom settings and tasks when adapting them.\n\nGenerated GitHub Actions CI is read-only and credential-free: it installs pinned tools and the pinned Transcend CLI, then runs `transcend policy lint`. Adapt triggers, runner labels, dependency installation, and caching to established repository conventions without adding publish steps or secrets.\n",fe=`# Testing and debugging
+
+## Write executable tests
+
+Place tests next to the package they exercise and suffix test modules with \`_test.rego\`. A separate \`_test\` package makes the production API and test helpers easy to distinguish:
+
+\`\`\`rego
+package policy_engine.example_test
+
+import data.policy_engine.example
+import rego.v1
+
+test_denies_missing_input if {
+	result := example.result with input as {}
+	result == {
+		"decision": "deny",
+		"reason_code": "untrusted_or_invalid_input",
+	}
+}
+\`\`\`
+
+Cover at least:
+
+- the ordinary allow case;
+- explicit deny cases;
+- absent, malformed, and unknown input;
+- important result fields and reason codes;
+- interactions between packages when one policy reads another document.
+
+\`transcend policy lint\` invokes \`opa test --fail-on-empty\`, so an empty suite fails validation.
+
+## Use local inputs safely
+
+Keep a sanitized \`input.example.json\` in source control. Put realistic local data in the target-local \`input.json\`, which the generated \`.gitignore\` excludes. Do not put credentials, personal data, or production payloads in fixtures unless repository policy explicitly permits sanitized versions.
+
+## Run the complete gate
+
+\`\`\`sh
+transcend policy lint --dir ./transcend/policy --noInteractive
+\`\`\`
+
+Use \`transcend policy lint --help\` to inspect \`--fix\` and JSON output. The lint gate checks:
+
+- manifest shape and package-root coverage;
+- compatible OPA and Regal versions;
+- OPA formatting;
+- a strict production-only OPA check that excludes local test modules;
+- Regal lint with warnings treated as failures;
+- non-empty OPA tests.
+
+Use \`--fix\` only for OPA formatting. Review Regal findings deliberately instead of applying broad rewrites.
+
+## Evaluate a query
+
+Use \`transcend policy eval --help\` to construct a local query with a sanitized input file and optional bundle directory. Evaluate the exact query used by the caller. If the result differs from expectations, inspect package paths, imports, defaults, input field presence, and the selected bundle root before changing policy logic.
+`,pe=`---
+name: transcend-policy-engine
+description: Sets up, authors, validates, tests, and publishes Transcend Policy Engine projects backed by OPA and Rego. Use for manifest.json roots, Rego v1 policy trees, Regal configuration, local policy inputs, Policy Engine CI, or transcend policy CLI commands.
+compatibility: Requires OPA 1.x and Regal for local validation, plus the Transcend CLI.
+---
+
+# Transcend Policy Engine
+
+Use the CLI for deterministic scaffolding and validation. Treat the generated example as disposable teaching material and derive the real policy contract from repository code and product requirements.
+
+## Workflow
+
+1. Locate the policy directory and its \`manifest.json\`.
+2. For initialization, editor support, tools, or CI, read [references/setup-tooling.md](references/setup-tooling.md).
+3. For package layout, document-tree design, decisions, and inputs, read [references/authoring.md](references/authoring.md).
+4. For tests, local inputs, linting, and evaluation, read [references/testing-debugging.md](references/testing-debugging.md).
+5. For bundle validation and publishing, read [references/publishing.md](references/publishing.md).
+6. Preserve repository conventions and run \`transcend policy lint --dir <policy-directory> --noInteractive\` before finishing.
+
+## Documentation
+
+- Every Transcend CLI command and subcommand provides contextual help with \`transcend <command> --help\`.
+- Use the [Transcend CLI README](https://github.com/transcend-io/tools/tree/main/packages/cli#readme) for command documentation and examples.
+- Use the [Transcend documentation index](https://docs.transcend.io/llms.txt) to find current product documentation.
+
+## Guardrails
+
+- Do not invent an input shape, output contract, package tree, or deployment convention.
+- Keep decisions fail-closed and make result documents extensible.
+- Never commit credentials or a real local \`input.json\`.
+- Keep every publishable Rego package covered by a \`manifest.json\` root.
+`;const j=`transcend-policy-engine`,M=[{path:`SKILL.md`,contents:pe},{path:`references/setup-tooling.md`,contents:de},{path:`references/authoring.md`,contents:le},{path:`references/testing-debugging.md`,contents:fe},{path:`references/publishing.md`,contents:ue}];function N(e){return e.examplePath?`${e.hasSkill?`Use the \`${j}\` skill to replace`:`Replace`} the disposable example in ${e.examplePath} with the intended policy document tree and input/output contract, adapt repository validation to local conventions, and rerun ${e.lintCommand}.`:`${e.hasSkill?`Use the \`${j}\` skill to review`:`Review`} the existing policy project in ${e.projectPath}, align its document tree and input/output contract with the intended application, adapt repository validation as needed, and rerun ${e.lintCommand}.`}function P(e,t){return{version:e.version,command:e.command,applied:t.applied,dryRun:t.dryRun,targetDirectory:e.targetDirectory,manifestPath:e.manifestPath,changes:e.changes.map(e=>m(t.cwd,e)),warnings:e.warnings,nextSteps:e.nextSteps,features:[...e.features],aiHandoff:t.aiHandoff,tools:t.tools}}const F=`1.13.1`,I=[{path:`manifest.json`,contents:`{
+  "roots": ["policy_engine"]
+}
+`,description:`Create the publishable Policy Engine manifest`},{path:`.regal/config.yaml`,contents:`capabilities:
+  from:
+    engine: opa
+    version: v${F}
+project:
+  roots:
+    - .
+  rego-version: 1
+`,description:`Pin strict Rego v1 linting to OPA 1.13.1 capabilities`},{path:`policy_engine/example/result.rego`,contents:`package policy_engine.example
+
+import rego.v1
+
+# METADATA
+# title: Disposable example result
+# description: |
+#   A fail-closed teaching entrypoint. Replace this example with the document
+#   tree and result contract required by your application.
+# entrypoint: true
+default result := {
+	"decision": "deny",
+	"reason_code": "untrusted_or_invalid_input",
+}
+
+result := {
+	"decision": "allow",
+	"reason_code": "trusted_subject",
+} if {
+	input.subject.trusted == true
+}
+`,description:`Create a documented fail-closed result entrypoint`},{path:`policy_engine/example/result_test.rego`,contents:`package policy_engine.example_test
+
+import data.policy_engine.example
+import rego.v1
+
+test_denies_untrusted_subject if {
+	result := example.result with input as {"subject": {"trusted": false}}
+	result == {
+		"decision": "deny",
+		"reason_code": "untrusted_or_invalid_input",
+	}
+}
+
+test_fails_closed_for_missing_subject if {
+	result := example.result with input as {}
+	result == {
+		"decision": "deny",
+		"reason_code": "untrusted_or_invalid_input",
+	}
+}
+
+test_allows_trusted_subject if {
+	result := example.result with input as {"subject": {"trusted": true}}
+	result == {
+		"decision": "allow",
+		"reason_code": "trusted_subject",
+	}
+}
+`,description:`Create executable tests for allow and fail-closed decisions`},{path:`input.example.json`,contents:`{
+  "subject": {
+    "trusted": false
+  }
+}
+`,description:`Create a sanitized local evaluation input`},{path:`.gitignore`,contents:`# Local policy evaluation input.
+/input.json
+`,description:`Ignore only the private local input file`},{path:`README.md`,contents:`# Transcend Policy Project
+
+This directory is an OPA document tree that can be published to Transcend Policy Engine.
+
+The policy under \`policy_engine/example\` is disposable teaching material. Replace it with your intended package tree, input shape, and extensible result documents. Keep decisions fail-closed and cover every non-test package with \`manifest.json\`.
+
+Validate formatting, strict Rego v1 compatibility, Regal lint, tests, and the publish contract:
+
+\`\`\`sh
+transcend policy lint --dir .
+\`\`\`
+`,description:`Create the concise policy project guide`}];function L(){return I.map(e=>({...e}))}const R=`.github/workflows/transcend-policy.yml`;function z(e,t){return e===`.`?t:T.join(e,t)}function B(e){let t=[z(e.targetDirectory,`**/*.rego`),z(e.targetDirectory,`**/*.json`),z(e.targetDirectory,`**/*.yaml`),z(e.targetDirectory,`**/*.yml`),z(e.targetDirectory,`.regal/config.yaml`),z(e.targetDirectory,`.regal.yaml`),R].map(e=>`      - ${JSON.stringify(e)}`).join(`
+`);return`# Generated by transcend policy init.
+name: Transcend Policy
+
+on:
+  pull_request:
+    paths:
+${t}
+  push:
+    paths:
+${t}
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Set up OPA
+        uses: open-policy-agent/setup-opa@b2b258e089860efaadaaf71bf6e3aecb4a3eeff1 # v2.4.0
+        with:
+          version: ${JSON.stringify(F)}
+      - name: Set up Regal
+        uses: open-policy-agent/setup-regal@761188c3b435761fa254beca508a44875619648f # v2.0.0
+        with:
+          version: ${JSON.stringify(`0.42.0`)}
+      - name: Install the Transcend CLI
+        run: npm install --global @transcend-io/cli@${e.cliVersion}
+      - name: Validate Policy Engine project
+        env:
+          POLICY_DIRECTORY: ${JSON.stringify(e.targetDirectory)}
+        run: >-
+          transcend policy lint
+          --dir "$POLICY_DIRECTORY"
+          --noInteractive
+          --json
+`}const V=`tsandall.opa`,H=`glebbash.opa-highlight-only`;function U(e,t){return JSON.stringify(e)===JSON.stringify(t)}function W(e,t){try{return{current:x(e??`{}
+`,t)}}catch(t){return{contents:e??`{}
+`,warning:`${t instanceof Error?t.message:String(t)} Existing content was left unchanged.`}}}function G(e,t,n,r){if(t.length===0)return{contents:e??`{}
+`,warnings:r};try{return{contents:S(e,t,n),warnings:r}}catch(t){return{contents:e??`{}
+`,warnings:[...r,`${t instanceof Error?t.message:String(t)} Existing content was left unchanged.`]}}}function K(e,t,n,r){t.forEach(({path:t,value:i,label:a})=>{let o=t.reduce((e,t)=>e&&typeof e==`object`&&!Array.isArray(e)?e[t]:void 0,e);o===void 0?n.push({path:t,value:i}):U(o,i)||r.push(`VS Code setting "${a}" has a repository-specific value and was left unchanged.`)})}function me(e,t){let n=E(e,t).split(D).join(`/`)||`.`;return n===`.`?"${workspaceFolder}":`\${workspaceFolder}/${n}`}function he(e,t,n){let r=W(e,`VS Code policy settings`);if(`warning`in r)return{contents:r.contents,warnings:[r.warning]};let{current:i}=r,a=[],o=[],s=i[`opa.roots`],c=me(t,n);if(s===void 0)a.push({path:[`opa.roots`],value:[c]});else if(Array.isArray(s)&&s.every(e=>typeof e==`string`)){let e=b(s,[c]);U(e,s)||a.push({path:[`opa.roots`],value:e})}else o.push(`VS Code setting "opa.roots" is customized and was left unchanged.`);K(i,[{path:[`opa.checkOnSave`],value:!0,label:`opa.checkOnSave`},{path:[`opa.strictMode`],value:!0,label:`opa.strictMode`},{path:[`opa.bundleMode`],value:!0,label:`opa.bundleMode`},{path:[`opa.formatter`],value:`opa-fmt-rego-v1`,label:`opa.formatter`}],a,o);let l=i[`[rego]`];return l===void 0?a.push({path:[`[rego]`],value:{"editor.defaultFormatter":V,"editor.formatOnSave":!0,"editor.insertSpaces":!1,"editor.tabSize":4}}):typeof l==`object`&&l&&!Array.isArray(l)?K(i,[{path:[`[rego]`,`editor.defaultFormatter`],value:V,label:`[rego].editor.defaultFormatter`},{path:[`[rego]`,`editor.formatOnSave`],value:!0,label:`[rego].editor.formatOnSave`},{path:[`[rego]`,`editor.insertSpaces`],value:!1,label:`[rego].editor.insertSpaces`},{path:[`[rego]`,`editor.tabSize`],value:4,label:`[rego].editor.tabSize`}],a,o):o.push(`VS Code language setting "[rego]" is customized and was left unchanged.`),G(e,a,`VS Code policy settings`,o)}function ge(e){let t=W(e,`VS Code policy extension recommendations`);if(`warning`in t)return{contents:t.contents,warnings:[t.warning]};let{current:n}=t,r=[],i=[],a=n.recommendations;if(a===void 0||Array.isArray(a)&&a.every(e=>typeof e==`string`)){let e=a??[],t=b(e,[V]).filter(e=>e!==H);U(e,t)||r.push({path:[`recommendations`],value:t})}else i.push(`VS Code extension recommendations use an unknown shape and were left unchanged.`);let o=n.unwantedRecommendations;if(o===void 0||Array.isArray(o)&&o.every(e=>typeof e==`string`)){let e=o??[],t=b(e,[H]);U(e,t)||r.push({path:[`unwantedRecommendations`],value:t})}else i.push(`VS Code unwanted extension recommendations use an unknown shape and were left unchanged.`);return G(e,r,`VS Code policy extension recommendations`,i)}function _e(e,t){return{label:`policy: lint`,type:`process`,command:`transcend`,args:[`policy`,`lint`,`--dir`,E(e,t).split(D).join(`/`)||`.`,`--noInteractive`],group:{kind:`test`,isDefault:!0},problemMatcher:[]}}function ve(e,t,n){let r=W(e,`VS Code policy tasks`);if(`warning`in r)return{contents:r.contents,warnings:[r.warning]};let{current:i}=r,a=[],o=[],s=i.version;s===void 0?a.push({path:[`version`],value:`2.0.0`}):s!==`2.0.0`&&o.push(`VS Code task schema version is customized and was left unchanged.`);let c=_e(t,n),l=i.tasks;if(l===void 0)a.push({path:[`tasks`],value:[c]});else if(Array.isArray(l)){let e=l.find(e=>typeof e==`object`&&!!e&&!Array.isArray(e)&&e.label===`policy: lint`);e===void 0?a.push({path:[`tasks`],value:[...l,c]}):U(e,c)||o.push(`VS Code task "policy: lint" has repository-specific customization and was left unchanged.`)}else o.push(`VS Code tasks use an unknown shape and were left unchanged.`);return G(e,a,`VS Code policy tasks`,o)}const q={name:j,displayName:`Policy Engine`,owner:`@transcend-io/cli`,files:M};function ye(e){return`transcend policy lint --dir ${_(y(e.invocationDirectory,e.targetDirectory))} --noInteractive`}function J(e,t){let n=new Set(L().map(({path:t})=>w(e.targetDirectory,t))),r=new Set(t.features);return r.has(A.Editor)&&(n.add(w(e.projectRoot,`.vscode`,`settings.json`)),n.add(w(e.projectRoot,`.vscode`,`extensions.json`)),n.add(w(e.projectRoot,`.vscode`,`tasks.json`))),r.has(A.Skill)&&d(e.projectRoot,e.existingSkillDirectories,q).forEach(e=>n.add(e)),r.has(A.Ci)&&e.repositoryRoot&&e.usesGithub&&n.add(w(e.repositoryRoot,R)),[...n].sort((e,t)=>e.localeCompare(t))}function Y(e,t){let n=E(e,t);if(n===`..`||n.startsWith(`..${D}`)||C(n))throw Error(`Refusing to modify path outside project root: ${t}`)}function be(e){let t=new Set([`input.json`]);return e.forEach(({path:e})=>{t.add(e);let n=T.dirname(e);for(;n!==`.`;)t.add(n),n=T.dirname(n)}),t}function X(e,t,n){let r=p({snapshot:re(t.snapshots,n.path),after:n.contents,description:n.description,...n.createOnly===void 0?{}:{createOnly:n.createOnly}});r?e.changes.push(r):e.unchanged.push(n.path)}function xe(e,t,n,r,i,a){X(e,t,{path:n,contents:r.contents,description:i}),e.warnings.push(...r.warnings.map(e=>`${e} (${y(a,n)})`))}function Se(e,t){let{state:n}=e,r=L(),i=ce(n),a=ye(n),o=w(n.targetDirectory,`policy_engine`,`example`,`result.rego`),s={version:1,command:`init`,rootDirectory:n.projectRoot,targetDirectory:n.targetDirectory,manifestPath:i,changes:[],unchanged:[],warnings:[],nextSteps:[a],features:[...t.features]},c=J(n,t);Y(n.projectRoot,n.targetDirectory),c.forEach(e=>Y(n.projectRoot,e));let l=!1;if(n.relativeFilePaths.length===0)l=!0,s.directoryPreconditions=[{path:n.targetDirectory,relativePaths:[...n.relativePaths]}],r.forEach(t=>{let r=w(n.targetDirectory,t.path);if(f(e.snapshots,r).kind!==`absent`)throw Error(`Expected an empty policy target, but found an entry at: ${r}`);X(s,e,{path:r,contents:t.contents,description:t.description,createOnly:!0})});else{let t=!0;r.forEach(r=>{let i=w(n.targetDirectory,r.path),a=f(e.snapshots,i);if(a.kind===`file`&&a.contents===r.contents){s.unchanged.push(i);return}t=!1,a.kind!==`absent`&&(s.unchanged.push(i),s.warnings.push(`Existing policy scaffold path was left unchanged: ${y(n.invocationDirectory,i)}`))}),l=t;let i=be(r),o=n.relativeFilePaths.some(e=>!i.has(e));(!t||o)&&s.warnings.push(`Existing policy target contains custom or partial content, so no starter files were added or overwritten. Review ${y(n.invocationDirectory,n.targetDirectory)} manually, then run \`${a}\`.`)}l&&(s.disposableExamplePath=o,s.nextSteps.push(`Edit ${_(y(n.invocationDirectory,o))}`));let u=new Set(t.features),d=n.projectRoot;if(u.has(A.Editor)){let t=w(d,`.vscode`,`settings.json`),r=w(d,`.vscode`,`extensions.json`),i=w(d,`.vscode`,`tasks.json`);[{path:t,description:`Merge strict target-scoped OPA and Rego editor settings`,merge:he},{path:r,description:`Recommend the OPA extension and discourage its syntax-only conflict`,merge:(e,t,n)=>ge(e)},{path:i,description:`Add the default target-scoped policy lint task`,merge:ve}].forEach(({path:t,description:r,merge:i})=>{let a=f(e.snapshots,t);if(a.kind!==`absent`&&a.kind!==`file`){s.unchanged.push(t),s.warnings.push(`Existing VS Code artifact is not a regular file and was left unchanged: ${y(n.invocationDirectory,t)}`);return}xe(s,e,t,i(a.kind===`file`?a.contents:null,d,n.targetDirectory),r,n.invocationDirectory)})}if(u.has(A.Skill)){let t=ee({rootDirectory:d,existingDirectories:n.existingSkillDirectories,snapshots:e.snapshots,skill:q,preserveModified:!0});s.changes.push(...t.changes),s.unchanged.push(...t.unchanged),s.warnings.push(...t.warnings.map(e=>t.unchanged.reduce((e,t)=>e.replace(t,y(n.invocationDirectory,t)),e)))}if(u.has(A.Ci))if(!n.repositoryRoot||!n.usesGithub)s.warnings.push(`GitHub Actions setup was selected, but this target is not inside a detected GitHub repository.`);else{let r=w(n.repositoryRoot,R),i=E(n.repositoryRoot,n.targetDirectory).split(D).join(`/`)||`.`,o=B({cliVersion:t.cliVersion,targetDirectory:i}),c=f(e.snapshots,r);c.kind===`absent`?X(s,e,{path:r,contents:o,description:`Add credential-free Policy Engine validation`,createOnly:!0}):c.kind===`file`&&c.contents===o?s.unchanged.push(r):(s.unchanged.push(r),s.warnings.push(`Existing GitHub Actions workflow was left unchanged: ${y(n.invocationDirectory,r)}. Adapt it manually to run \`${a}\`.`))}return s.changes.forEach(({path:e})=>Y(n.projectRoot,e)),s}const Z={[A.Editor]:`VS Code settings and lint task`,[A.Skill]:`Policy Engine Agent Skill`,[A.Ci]:`Validation-only GitHub Actions`},Q=Object.values(A);function Ce(e,t,n){return!e.json&&!e.noInteractive&&!!(t&&n)}async function we(e,t,n){let r={[A.Editor]:t.editor,[A.Skill]:t.skill,[A.Ci]:t.ci};if(!n.interactive)return Q.filter(e=>r[e]===!0);let i=Q.map(e=>({name:Z[e],value:e,checked:r[e]!==!1}));return e.checkbox(`Choose repository setup:`,i)}function $(e,n){let r=[n.stdout.trim(),n.stderr.trim()].filter(Boolean).join(`
+`),i=e===`OPA`?o:t;return`${e===`OPA`?`OPA 1.x`:`Regal ${c} or newer`} is required, but \`${e.toLowerCase()} version\` exited with code ${n.code}${r?`: ${r}`:`.`} Install or upgrade it using the official instructions: ${i}`}async function Te(e,t,o){let l={opa:null,regal:null},u=[],d=await o(`opa`,[`version`],{cwd:t},e);if(d.error?.code===`ENOENT`)u.push(r);else{let e=`${d.stdout}\n${d.stderr}`,t=n(e);d.code===0?t?u.push(t):l.opa=s(e).version:u.push(t??$(`OPA`,d))}let f=await o(`regal`,[`version`],{cwd:t},e);if(f.error?.code===`ENOENT`)u.push(a);else{let e=`${f.stdout}\n${f.stderr}`,t=i(e,c,`the generated OPA 1.13.1 capabilities configuration`);f.code===0?t?u.push(t):l.regal=s(e).version:u.push(t??$(`Regal`,f))}return{tools:l,warnings:u}}async function Ee(t,n=k,r=ie){l(this.process);try{let i=await Te(this,this.process.cwd(),r),a=se(this,n),o=new v(this),s=Ce(t,this.process.stdin.isTTY,this.process.stderr.isTTY),c=await we(o,t,{interactive:s}),l=J(a,{features:c}),u=Se({state:a,snapshots:te(this,a.projectRoot,l)},{features:c,cliVersion:e});u.warnings.push(...i.warnings),t.json||this.logger.info(h(u,{cwd:this.process.cwd(),title:`Policy initialization plan`,details:[{label:`Target`,path:u.targetDirectory},{label:`Manifest`,path:u.manifestPath}]}));let d=u.changes.length===0||t.dryRun;if(u.changes.length>0&&!t.dryRun)if(t.yes)d=!0;else if(s)d=await o.confirm(`Apply this complete plan?`,!0);else throw Error(`The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.`);d&&!t.dryRun&&u.changes.length>0&&await ae(this,u);let f=d&&!t.dryRun&&u.changes.length>0,p=d&&!t.dryRun,m=N({projectPath:_(y(this.process.cwd(),a.targetDirectory)),...u.disposableExamplePath?{examplePath:_(y(this.process.cwd(),u.disposableExamplePath))}:{},hasSkill:p&&c.includes(A.Skill),lintCommand:u.nextSteps[0]}),g=P(u,{applied:f,dryRun:t.dryRun,cwd:this.process.cwd(),aiHandoff:m,tools:i.tools});if(t.json){this.process.stdout.write(`${JSON.stringify(g)}\n`);return}if(t.dryRun){this.logger.info(O.yellow(`Dry run complete. No changes were written.`));return}if(!d){this.logger.info(O.yellow(`No changes applied.`));return}if(u.changes.length===0){let e=u.warnings.length===i.warnings.length?`Policy project is already initialized.`:`Existing policy project was left unchanged.`;this.logger.info(O.green(e))}else this.logger.info(O.green(`Policy project initialized.`));u.nextSteps.length>0&&(this.logger.info(`\n${O.bold(`Next steps`)}`),u.nextSteps.forEach(e=>this.logger.info(e))),this.logger.info(`\n${O.bold(`AI handoff — paste into your coding agent`)}`),this.logger.info(m)}catch(e){if(e instanceof ne)return this.process.exit(130);throw e}}export{Ee as init};
+//# sourceMappingURL=impl-DK7nSMle2.mjs.map