@transcend-io/cli 10.28.0 → 10.29.1

package/README.md

@@ -65,6 +65,7 @@ A command line interface that allows you to programatically interact with the Tr
   - [`transcend policy deactivate`](#transcend-policy-deactivate)
   - [`transcend policy download`](#transcend-policy-download)
   - [`transcend policy eval`](#transcend-policy-eval)
+  - [`transcend policy init`](#transcend-policy-init)
   - [`transcend policy lint`](#transcend-policy-lint)
   - [`transcend policy bundles`](#transcend-policy-bundles)
   - [`transcend policy publish`](#transcend-policy-publish)
@@ -131,13 +132,13 @@ api-keys:
 
 # Manage at: https://app.transcend.io/privacy-requests/identifiers
 # See https://docs.transcend.io/docs/identity-enrichment
-# Define enricher or pre-flight check webhooks that will be executed
+# Define preflight check webhooks that will be executed
 # prior to privacy request workflows. Some examples may include:
 #   - identity enrichment: look up additional identifiers for that user.
 #                          i.e. map an email address to a user ID
 #   - fraud check: auto-cancel requests if the user is flagged for fraudulent behavior
 #   - customer check: auto-cancel request for some custom business criteria
-enrichers:
+preflights:
   - title: Basic Identity Enrichment
     description: Enrich an email address to the userId and phone number
     url: https://example.acme.com/transcend-enrichment-webhook
@@ -2545,12 +2546,12 @@ USAGE
   transcend custom-functions new [--manifest value] [--name value] [--template general|dsr-datapoint|dsr-enricher|dsr-both] [--noInteractive] [--dryRun] [--yes] [--json] [<directory>]
   transcend custom-functions new --help
 
-Adds a deterministic General or DSR starter to an initialized Custom Function project and safely appends its manifest entry without credentials.
+Adds a deterministic starter for one of two Custom Function types: General functions triggered by Rules Automation, or DSR functions triggered by a Workflow step and supporting data point resolvers, preflight checks, or both.
 
 FLAGS
      [--manifest]       Path to an existing transcend-functions.yml
      [--name]           Customer-visible Custom Function display name
-     [--template]       Generated handler and fixture shape                        [general|dsr-datapoint|dsr-enricher|dsr-both]
+     [--template]       Function type and generated handler shape                  [general|dsr-datapoint|dsr-enricher|dsr-both]
      [--noInteractive]  Disable prompts and require every missing answer as a flag [default = false]
      [--dryRun]         Preview all changes without writing files                  [default = false]
      [--yes]            Skip only the final plan confirmation                      [default = false]
@@ -2571,7 +2572,7 @@ transcend custom-functions new ./transcend/custom-functions \
   --yes
 ```
 
-Run `transcend custom-functions init` once before adding functions. The four templates are `general`, `dsr-datapoint`, `dsr-enricher`, and `dsr-both`. Without a directory argument, `new` uses the initialized project at `transcend/custom-functions`. If that manifest is missing, it reports any other project manifest it discovers as an explicit suggestion.
+Run `transcend custom-functions init` once before adding functions. The interactive flow first asks for the Custom Function type: General functions are triggered by Rules Automation, while DSR functions are triggered by a step in a Workflow. General currently has one template, so selecting it continues immediately. Selecting DSR opens a second prompt: choose `dsr-datapoint` for a data point resolver, `dsr-enricher` for a preflight check, or `dsr-both` to support both. The `dsr-enricher` flag retains the API's technical export name, but the user-facing workflow is called preflight. Without a directory argument, `new` uses the initialized project at `transcend/custom-functions`. If that manifest is missing, it reports any other project manifest it discovers as an explicit suggestion.
 
 Generated code contains only the selected handler exports and focused TODOs. Customer-specific API and mapping choices remain for the developer or the installed `transcend-custom-functions` skill. The final output includes a short, copyable AI handoff naming the generated source and validation command.
 
@@ -2901,7 +2902,7 @@ The API key permissions for this command vary based on the `resources` argument:
 | `customFields`              | `attributes`                  | Custom Field definitions that define extra metadata for each table in the Admin Dashboard.                                                                                               | View Global Attributes                                           | [Custom Fields](https://app.transcend.io/infrastructure/attributes)                                                                                                                                                                                    |
 | `templates`                 | `templates`                   | Email templates. Only template titles can be created and mapped to other resources.                                                                                                      | View Email Templates                                             | [DSR Automation -> Email Settings -> Templates](https://app.transcend.io/privacy-requests/email-settings/templates)                                                                                                                                    |
 | `dataSilos`                 | `data-silos`                  | The Data System (formerly "Data Silo") definitions.                                                                                                                                      | View Data Map, View Data Subject Request Settings, View API Keys | [Data Inventory -> Data Systems](https://app.transcend.io/data-map/data-inventory/data-silos)<br>[Infrastructure -> Integrations](https://app.transcend.io/infrastructure/integrations)                                                                |
-| `enrichers`                 | `enrichers`                   | The Privacy Request enricher configurations.                                                                                                                                             | View Identity Verification Settings                              | [DSR Automation -> Identifiers](https://app.transcend.io/privacy-requests/identifiers)                                                                                                                                                                 |
+| `enrichers`                 | `preflights`                  | The Privacy Request preflight check configurations (formerly "enrichers").                                                                                                               | View Identity Verification Settings                              | [DSR Automation -> Identifiers](https://app.transcend.io/privacy-requests/identifiers)                                                                                                                                                                 |
 | `dataFlows`                 | `data-flows`                  | Consent Manager Data Flow definitions.                                                                                                                                                   | View Data Flows                                                  | [Consent Management -> Data Flows](https://app.transcend.io/consent-manager/data-flows/approved)                                                                                                                                                       |
 | `businessEntities`          | `business-entities`           | The business entities in the Data Inventory.                                                                                                                                             | View Data Inventory                                              | [Data Inventory -> Business Entities](https://app.transcend.io/data-map/data-inventory/business-entities)                                                                                                                                              |
 | `processingActivities`      | `processing-activities`       | The processing activities in the Data Inventory.                                                                                                                                         | View Data Inventory                                              | [Data Inventory -> Processing Activities](https://app.transcend.io/data-map/data-inventory/processing-activities)                                                                                                                                      |
@@ -3005,7 +3006,7 @@ transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=businessEntitie
 transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=processingActivities
 ```
 
-**Pull enrichers and identifiers (see [this example](./examples/enrichers.yml))**
+**Pull preflight checks and identifiers (see [this example](./examples/preflights.yml))**
 
 ```sh
 transcend inventory pull --auth="$TRANSCEND_API_KEY" --resources=enrichers,identifiers
@@ -3110,7 +3111,7 @@ The API key permissions for this command vary based on the resources declared as
 | `customFields`              | `attributes`                  | Custom Field definitions that define extra metadata for each table in the Admin Dashboard.                                                                                               | Manage Global Attributes                                                                                                    | [Custom Fields](https://app.transcend.io/infrastructure/attributes)                                                                                                                                                                                    |
 | `templates`                 | `templates`                   | Email templates. Only template titles can be created and mapped to other resources.                                                                                                      | Manage Email Templates                                                                                                      | [DSR Automation -> Email Settings -> Templates](https://app.transcend.io/privacy-requests/email-settings/templates)                                                                                                                                    |
 | `dataSilos`                 | `data-silos`                  | The Data System (formerly "Data Silo") definitions.                                                                                                                                      | Manage Data Map, Connect Data Silos, View API Keys                                                                          | [Data Inventory -> Data Systems](https://app.transcend.io/data-map/data-inventory/data-silos)<br>[Infrastructure -> Integrations](https://app.transcend.io/infrastructure/integrations)                                                                |
-| `enrichers`                 | `enrichers`                   | The Privacy Request enricher configurations.                                                                                                                                             | Manage Request Identity Verification                                                                                        | [DSR Automation -> Identifiers](https://app.transcend.io/privacy-requests/identifiers)                                                                                                                                                                 |
+| `enrichers`                 | `preflights`                  | The Privacy Request preflight check configurations (formerly "enrichers").                                                                                                               | Manage Request Identity Verification                                                                                        | [DSR Automation -> Identifiers](https://app.transcend.io/privacy-requests/identifiers)                                                                                                                                                                 |
 | `dataFlows`                 | `data-flows`                  | Consent Manager Data Flow definitions.                                                                                                                                                   | Manage Data Flows                                                                                                           | [Consent Management -> Data Flows](https://app.transcend.io/consent-manager/data-flows/approved)                                                                                                                                                       |
 | `businessEntities`          | `business-entities`           | The business entities in the Data Inventory.                                                                                                                                             | Manage Data Inventory                                                                                                       | [Data Inventory -> Business Entities](https://app.transcend.io/data-map/data-inventory/business-entities)                                                                                                                                              |
 | `processingActivities`      | `processing-activities`       | The processing activities in the Data Inventory.                                                                                                                                         | Manage Data Map                                                                                                             | [Data Inventory -> Processing Activities](https://app.transcend.io/data-map/data-inventory/processing-activities)                                                                                                                                      |
@@ -3307,7 +3308,7 @@ This command can fill out multiple variables in a YAML file like [./examples/mul
 ```yml
 api-keys:
   - title: Webhook Key
-enrichers:
+preflights:
   - title: Basic Identity Enrichment
     description: Enrich an email address to the userId and phone number
     # The data silo webhook URL is the same in each environment,
@@ -4299,26 +4300,91 @@ FLAGS
 transcend policy eval --pkg=data.transcend.decision --input=./fixtures/envelope.json --bundle=./policies
 ```
 
+### `transcend policy init`
+
+```txt
+USAGE
+  transcend policy init [--editor] [--skill] [--ci] [--noInteractive] [--dryRun] [--yes] [--json] [<directory>]
+  transcend policy init --help
+
+Probes OPA and Regal, previews one safe transactional plan, and creates a publishable fail-closed Rego v1 starter only in an empty target. Optional editor, Agent Skill, and validation-only CI setup preserve repository customization. No Transcend credentials are needed.
+
+FLAGS
+     [--editor/--noEditor]  Merge strict target-scoped VS Code settings, extensions, and lint task
+     [--skill/--noSkill]    Install the canonical Policy Engine coding-agent skill
+     [--ci/--noCi]          Generate credential-free validation-only GitHub Actions
+     [--noInteractive]      Disable prompts and enable optional setup only through explicit flags  [default = false]
+     [--dryRun]             Preview all changes without writing files                              [default = false]
+     [--yes]                Skip only the final plan confirmation                                  [default = false]
+     [--json]               Emit one stable JSON result and imply non-interactive output           [default = false]
+  -h  --help                Print help information and exit
+
+ARGUMENTS
+  [directory]  Policy project directory [default = transcend/policy]
+```
+
+#### Create the safe default policy project
+
+```sh
+transcend policy init
+```
+
+This creates a publishable, fail-closed Rego v1 starter under `transcend/policy`. The example policy is disposable teaching material, not an application contract. Initialization checks local OPA and Regal versions and prints official installation guidance when they are missing or incompatible; it never installs tools or creates runtime-manager configuration.
+
+The interactive checklist selects repository-level VS Code setup, the `transcend-policy-engine` Agent Skill, and credential-free validation-only GitHub Actions by default. VS Code setup recommends the official OPA extension, scopes bundle authoring and a default `policy: lint` task to the selected project, and configures strict Rego v1 formatting with Regal.
+
+To give an agent the same policy guidance before initialization, install the standalone skill directly from this repository:
+
+```sh
+npx skills add transcend-io/tools --skill transcend-policy-engine
+```
+
+#### Preview or choose another directory
+
+```sh
+transcend policy init ./policies --dryRun --json
+transcend policy init ./policies --editor --skill --ci --noInteractive --yes
+```
+
+Non-interactive setup enables only the individual `--editor`, `--skill`, and `--ci` flags passed. There are no setup presets. The complete plan is applied transactionally. Existing or partially initialized policy targets are left unchanged with actionable warnings, including customized Rego, manifests, Regal configuration, README files, workflows, editor values and tasks, and managed skill content.
+
+Generated CI pins OPA 1.13.1, Regal 0.42.0, immutable setup action commits, and the current Transcend CLI release. It runs only `transcend policy lint --noInteractive --json`; it never publishes or adds Transcend API credentials. After successful initialization, copyable one-line next steps and an AI handoff prompt identify the disposable example, repository-specific CI adaptation, and the final lint gate.
+
 ### `transcend policy lint`
 
 ```txt
 USAGE
-  transcend policy lint (--dir value)
+  transcend policy lint [--dir value] [--fix] [--noInteractive] [--json]
   transcend policy lint --help
 
-Runs `opa check --strict` for Rego validation and `opa fmt` for formatting. When files are not formatted, lists the affected paths, prints a diff, and prompts to format them in place. Requires the `opa` CLI on PATH. No Transcend API key is needed.
+Validates manifest roots and package coverage, verifies OPA 1.x and Regal, checks or repairs OPA formatting, runs a production-only strict OPA check, treats Regal warnings as failures, and requires non-empty OPA tests. No Transcend API key is needed.
 
 FLAGS
-     --dir   Directory containing Rego policy files
-  -h --help  Print help information and exit
+     [--dir]            Directory containing the local policy project                  [default = transcend/policy]
+     [--fix]            Apply OPA formatting without running broad Regal fixes         [default = false]
+     [--noInteractive]  Disable the optional formatting confirmation                   [default = false]
+     [--json]           Emit one stable JSON result and imply non-interactive behavior [default = false]
+  -h  --help            Print help information and exit
 ```
 
 #### Examples
 
-**Lint a local policy directory and optionally format Rego files**
+**Verify the default local policy project**
+
+```sh
+transcend policy lint
+```
+
+**Verify and format a custom policy project**
+
+```sh
+transcend policy lint --dir=./policies --fix
+```
+
+**Run the verification gate in CI or an editor**
 
 ```sh
-transcend policy lint --dir=./policies
+transcend policy lint --noInteractive --json
 ```
 
 ### `transcend policy bundles`