@transcend-io/cli 11.0.0 → 12.1.0

package/dist/{fuzzyMatchColumns-CQCzpjWC.mjs.map → fuzzyMatchColumns-2NmQqCZI.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"fuzzyMatchColumns-CQCzpjWC.mjs","names":[],"sources":["../src/lib/requests/fuzzyMatchColumns.ts"],"sourcesContent":["import fuzzysearch from 'fuzzysearch';\nimport inquirer from 'inquirer';\n\nimport { NONE, BULK_APPLY } from './constants.js';\n\n/**\n * Check if word1 and word2 are a fuzzy match of each other.\n * Returns true if word1 is fuzzy match of word2 or vice versa.\n *\n * @param word1 - First word\n * @param word2 - Second word\n * @returns True if words are fuzzy match\n */\nexport function fuzzySearch(word1: string, word2: string): boolean {\n  return (\n    fuzzysearch(word1.toLowerCase(), word2.toLowerCase()) ||\n    fuzzysearch(word2.toLowerCase(), word1.toLowerCase())\n  );\n}\n\n/**\n * Fuzzy match column names for a particular field\n *\n * @param allColumnNames - List of all column names\n * @param fuzzyMapName - The name of field being mapped to\n * @param isRequired - When true, don't include \"NONE\" as an option\n * @param canApplyAll - When true, include an option to specify the value in bulk\n * @returns The list of suggestions for inquirer\n */\nexport function fuzzyMatchColumns(\n  allColumnNames: string[],\n  fuzzyMapName: string,\n  isRequired: boolean,\n  canApplyAll?: boolean,\n): (string | InstanceType<typeof inquirer.Separator>)[] {\n  const matchingColumnNames = allColumnNames.filter((x) =>\n    fuzzySearch(fuzzyMapName.toLowerCase(), x.toLowerCase()),\n  );\n  return [\n    ...matchingColumnNames,\n    new inquirer.Separator(),\n    ...(isRequired ? [] : [NONE]),\n    ...(canApplyAll ? [BULK_APPLY] : []),\n    ...allColumnNames.filter((x) => !matchingColumnNames.includes(x)),\n  ];\n}\n"],"mappings":"uGAaA,SAAgB,EAAY,EAAe,EAAwB,CACjE,OACE,EAAY,EAAM,aAAa,CAAE,EAAM,aAAa,CAAC,EACrD,EAAY,EAAM,aAAa,CAAE,EAAM,aAAa,CAAC,CAazD,SAAgB,EACd,EACA,EACA,EACA,EACsD,CACtD,IAAM,EAAsB,EAAe,OAAQ,GACjD,EAAY,EAAa,aAAa,CAAE,EAAE,aAAa,CAAC,CACzD,CACD,MAAO,CACL,GAAG,EACH,IAAI,EAAS,UACb,GAAI,EAAa,EAAE,CAAG,CAAC,EAAK,CAC5B,GAAI,EAAc,CAAC,EAAW,CAAG,EAAE,CACnC,GAAG,EAAe,OAAQ,GAAM,CAAC,EAAoB,SAAS,EAAE,CAAC,CAClE"}
+{"version":3,"file":"fuzzyMatchColumns-2NmQqCZI.mjs","names":[],"sources":["../src/lib/requests/fuzzyMatchColumns.ts"],"sourcesContent":["import fuzzysearch from 'fuzzysearch';\nimport inquirer from 'inquirer';\n\nimport { NONE, BULK_APPLY } from './constants.js';\n\n/**\n * Check if word1 and word2 are a fuzzy match of each other.\n * Returns true if word1 is fuzzy match of word2 or vice versa.\n *\n * @param word1 - First word\n * @param word2 - Second word\n * @returns True if words are fuzzy match\n */\nexport function fuzzySearch(word1: string, word2: string): boolean {\n  return (\n    fuzzysearch(word1.toLowerCase(), word2.toLowerCase()) ||\n    fuzzysearch(word2.toLowerCase(), word1.toLowerCase())\n  );\n}\n\n/**\n * Fuzzy match column names for a particular field\n *\n * @param allColumnNames - List of all column names\n * @param fuzzyMapName - The name of field being mapped to\n * @param isRequired - When true, don't include \"NONE\" as an option\n * @param canApplyAll - When true, include an option to specify the value in bulk\n * @returns The list of suggestions for inquirer\n */\nexport function fuzzyMatchColumns(\n  allColumnNames: string[],\n  fuzzyMapName: string,\n  isRequired: boolean,\n  canApplyAll?: boolean,\n): (string | InstanceType<typeof inquirer.Separator>)[] {\n  const matchingColumnNames = allColumnNames.filter((x) =>\n    fuzzySearch(fuzzyMapName.toLowerCase(), x.toLowerCase()),\n  );\n  return [\n    ...matchingColumnNames,\n    new inquirer.Separator(),\n    ...(isRequired ? [] : [NONE]),\n    ...(canApplyAll ? [BULK_APPLY] : []),\n    ...allColumnNames.filter((x) => !matchingColumnNames.includes(x)),\n  ];\n}\n"],"mappings":"uGAaA,SAAgB,EAAY,EAAe,EAAwB,CACjE,OACE,EAAY,EAAM,aAAa,CAAE,EAAM,aAAa,CAAC,EACrD,EAAY,EAAM,aAAa,CAAE,EAAM,aAAa,CAAC,CAazD,SAAgB,EACd,EACA,EACA,EACA,EACsD,CACtD,IAAM,EAAsB,EAAe,OAAQ,GACjD,EAAY,EAAa,aAAa,CAAE,EAAE,aAAa,CAAC,CACzD,CACD,MAAO,CACL,GAAG,EACH,IAAI,EAAS,UACb,GAAI,EAAa,EAAE,CAAG,CAAC,EAAK,CAC5B,GAAI,EAAc,CAAC,EAAW,CAAG,EAAE,CACnC,GAAG,EAAe,OAAQ,GAAM,CAAC,EAAoB,SAAS,EAAE,CAAC,CAClE"}

package/dist/{generateCrossAccountApiKeys-DWfJtB3t.mjs → generateCrossAccountApiKeys-CVdsJFOe.mjs}

@@ -1,2 +1,2 @@
-import{a as e}from"./constants-Upxn_rQF.mjs";import{t}from"./logger-zplFSeXU.mjs";import n from"colors";import{assumeRole as r,buildTranscendGraphQLClientGeneric as i,createApiKey as a,deleteApiKey as o,fetchAllApiKeys as s,loginUser as c}from"@transcend-io/sdk";import{mapSeries as l}from"@transcend-io/utils";async function u({email:u,password:d,scopes:f,apiKeyTitle:p,parentOrganizationId:m,deleteExistingApiKey:h=!0,createNewApiKey:g=!0,transcendUrl:_=e}){let v=await i(_,{});t.info(n.magenta(`Logging in using email and password.`));let{roles:y,loginCookie:b}=await c(v,{email:u,password:d,logger:t});t.info(n.green(`Successfully logged in and found ${y.length} role${y.length===1?``:`s`}!`));let x=m?y.filter(e=>e.organization.id===m||e.organization.parentOrganizationId===m):y;v.setHeaders({Cookie:b});let S=[],C=[];return t.info(n.magenta(`Generating API keys with title: ${p}, scopes: ${f.join(`,`)}.`)),await l(x,async e=>{try{await r(v,{roleId:e.id,email:u,logger:t}),t.info(n.magenta(`Checking if API key already exists in organization "${e.organization.name}" with title: "${p}".`));let[i]=await s(v,{logger:t,filterBy:{titles:[p]}});if(i&&h)t.info(n.yellow(`Deleting existing API key in "${e.organization.name}" with title: "${p}".`)),await o(v,{id:i.id,logger:t}),t.info(n.green(`Successfully deleted API key in "${e.organization.name}" with title: "${p}".`));else if(i)throw Error(`API key already exists with title: "${p}"`);if(g){t.info(n.magenta(`Creating API key in "${e.organization.name}" with title: "${p}".`));let{apiKey:r}=await a(v,{input:{title:p,scopes:f},logger:t});S.push({organizationName:e.organization.name,organizationId:e.organization.id,apiKey:r}),t.info(n.green(`Successfully created API key in "${e.organization.name}" with title: "${p}".`))}else S.push({organizationName:e.organization.name,organizationId:e.organization.id,apiKey:``})}catch(r){t.error(n.red(`Failed to create API key in organization "${e.organization.name}"! - ${r.message}`)),C.push({organizationName:e.organization.name,organizationId:e.organization.id,error:r.message})}}),t.info(n.green(`Successfully created ${S.length} API key${S.length===1?``:`s`}`)),C.length>0&&t.error(n.red(`Failed to create ${C.length} API key${C.length===1?``:`s`}!`)),{errors:C,apiKeys:S}}export{u as t};
-//# sourceMappingURL=generateCrossAccountApiKeys-DWfJtB3t.mjs.map
+import{a as e}from"./constants-BlKpAm3R.mjs";import{t}from"./logger-CPu6zbyQ.mjs";import n from"colors";import{mapSeries as r}from"@transcend-io/utils";import{assumeRole as i,buildTranscendGraphQLClientGeneric as a,createApiKey as o,deleteApiKey as s,fetchAllApiKeys as c,loginUser as l}from"@transcend-io/sdk";async function u({email:u,password:d,scopes:f,apiKeyTitle:p,parentOrganizationId:m,deleteExistingApiKey:h=!0,createNewApiKey:g=!0,transcendUrl:_=e}){let v=await a(_,{});t.info(n.magenta(`Logging in using email and password.`));let{roles:y,loginCookie:b}=await l(v,{email:u,password:d,logger:t});t.info(n.green(`Successfully logged in and found ${y.length} role${y.length===1?``:`s`}!`));let x=m?y.filter(e=>e.organization.id===m||e.organization.parentOrganizationId===m):y;v.setHeaders({Cookie:b});let S=[],C=[];return t.info(n.magenta(`Generating API keys with title: ${p}, scopes: ${f.join(`,`)}.`)),await r(x,async e=>{try{await i(v,{roleId:e.id,email:u,logger:t}),t.info(n.magenta(`Checking if API key already exists in organization "${e.organization.name}" with title: "${p}".`));let[r]=await c(v,{logger:t,filterBy:{titles:[p]}});if(r&&h)t.info(n.yellow(`Deleting existing API key in "${e.organization.name}" with title: "${p}".`)),await s(v,{id:r.id,logger:t}),t.info(n.green(`Successfully deleted API key in "${e.organization.name}" with title: "${p}".`));else if(r)throw Error(`API key already exists with title: "${p}"`);if(g){t.info(n.magenta(`Creating API key in "${e.organization.name}" with title: "${p}".`));let{apiKey:r}=await o(v,{input:{title:p,scopes:f},logger:t});S.push({organizationName:e.organization.name,organizationId:e.organization.id,apiKey:r}),t.info(n.green(`Successfully created API key in "${e.organization.name}" with title: "${p}".`))}else S.push({organizationName:e.organization.name,organizationId:e.organization.id,apiKey:``})}catch(r){t.error(n.red(`Failed to create API key in organization "${e.organization.name}"! - ${r.message}`)),C.push({organizationName:e.organization.name,organizationId:e.organization.id,error:r.message})}}),t.info(n.green(`Successfully created ${S.length} API key${S.length===1?``:`s`}`)),C.length>0&&t.error(n.red(`Failed to create ${C.length} API key${C.length===1?``:`s`}!`)),{errors:C,apiKeys:S}}export{u as t};
+//# sourceMappingURL=generateCrossAccountApiKeys-CVdsJFOe.mjs.map

package/dist/{generateCrossAccountApiKeys-DWfJtB3t.mjs.map → generateCrossAccountApiKeys-CVdsJFOe.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"generateCrossAccountApiKeys-DWfJtB3t.mjs","names":[],"sources":["../src/lib/api-keys/generateCrossAccountApiKeys.ts"],"sourcesContent":["import { ScopeName } from '@transcend-io/privacy-types';\nimport {\n  buildTranscendGraphQLClientGeneric,\n  loginUser,\n  createApiKey,\n  fetchAllApiKeys,\n  deleteApiKey,\n  assumeRole,\n} from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { StoredApiKey } from '../../codecs.js';\nimport { DEFAULT_TRANSCEND_API } from '../../constants.js';\nimport { logger } from '../../logger.js';\n\nexport interface ApiKeyGenerateError {\n  /** Name of instance */\n  organizationName: string;\n  /** Error */\n  error: string;\n  /** Organization ID API key is for */\n  organizationId: string;\n}\n\n/**\n * Generate API keys across multiple transcend accounts\n *\n * @param options - Options\n * @returns Number of API keys created\n */\nexport async function generateCrossAccountApiKeys({\n  email,\n  password,\n  scopes,\n  apiKeyTitle,\n  parentOrganizationId,\n  deleteExistingApiKey = true,\n  createNewApiKey = true,\n  transcendUrl = DEFAULT_TRANSCEND_API,\n}: {\n  /** Email address of user generating API keys */\n  email: string;\n  /** Password of user generating API keys */\n  password: string;\n  /** Filter for organizations that match this parent organization ID */\n  parentOrganizationId?: string;\n  /** Title of the API create to create */\n  apiKeyTitle: string;\n  /** Title of the API create to create */\n  scopes: ScopeName[];\n  /** API URL for Transcend backend */\n  transcendUrl?: string;\n  /** When true delete existing API keys with that title, if set to false an API key exists with that title, an error is thrown */\n  deleteExistingApiKey?: boolean;\n  /** When true, generate new API keys, otherwise only will delete past API keys */\n  createNewApiKey?: boolean;\n}): Promise<{\n  /** Successfully generated */\n  apiKeys: StoredApiKey[];\n  /** Error results */\n  errors: ApiKeyGenerateError[];\n}> {\n  // Create GraphQL client\n  const client = await buildTranscendGraphQLClientGeneric(transcendUrl, {});\n\n  // Login the user\n  logger.info(colors.magenta('Logging in using email and password.'));\n  const { roles, loginCookie } = await loginUser(client, { email, password, logger });\n  logger.info(\n    colors.green(\n      `Successfully logged in and found ${roles.length} role${roles.length === 1 ? '' : 's'}!`,\n    ),\n  );\n\n  // Filter down by parentOrganizationId\n  const filteredRoles = parentOrganizationId\n    ? roles.filter(\n        (role) =>\n          role.organization.id === parentOrganizationId ||\n          role.organization.parentOrganizationId === parentOrganizationId,\n      )\n    : roles;\n\n  // Save cookie to call route subsequent times\n  client.setHeaders({\n    Cookie: loginCookie,\n  });\n\n  // Save the resulting API keys\n  const results: StoredApiKey[] = [];\n  const errors: ApiKeyGenerateError[] = [];\n\n  // Generate API keys\n  logger.info(\n    colors.magenta(`Generating API keys with title: ${apiKeyTitle}, scopes: ${scopes.join(',')}.`),\n  );\n\n  // Map over each role\n  await mapSeries(filteredRoles, async (role) => {\n    try {\n      // Log into the other instance\n      await assumeRole(client, { roleId: role.id, email, logger });\n\n      // Grab API keys with that title\n      logger.info(\n        colors.magenta(\n          `Checking if API key already exists in organization \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n        ),\n      );\n\n      // Delete existing API key\n      const [apiKeyWithTitle] = await fetchAllApiKeys(client, {\n        logger,\n        filterBy: { titles: [apiKeyTitle] },\n      });\n      if (apiKeyWithTitle && deleteExistingApiKey) {\n        logger.info(\n          colors.yellow(\n            `Deleting existing API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n        await deleteApiKey(client, { id: apiKeyWithTitle.id, logger });\n        logger.info(\n          colors.green(\n            `Successfully deleted API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n      } else if (apiKeyWithTitle) {\n        // throw error if one exists but not configured to delete\n        throw new Error(`API key already exists with title: \"${apiKeyTitle}\"`);\n      }\n\n      // Create the API key\n      if (createNewApiKey) {\n        logger.info(\n          colors.magenta(\n            `Creating API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n        const { apiKey } = await createApiKey(client, {\n          input: { title: apiKeyTitle, scopes },\n          logger,\n        });\n        results.push({\n          organizationName: role.organization.name,\n          organizationId: role.organization.id,\n          apiKey,\n        });\n        logger.info(\n          colors.green(\n            `Successfully created API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n      } else {\n        // Delete only\n        results.push({\n          organizationName: role.organization.name,\n          organizationId: role.organization.id,\n          apiKey: '',\n        });\n      }\n    } catch (err) {\n      logger.error(\n        colors.red(\n          `Failed to create API key in organization \"${role.organization.name}\"! - ${err.message}`,\n        ),\n      );\n      errors.push({\n        organizationName: role.organization.name,\n        organizationId: role.organization.id,\n        error: err.message,\n      });\n    }\n  });\n  logger.info(\n    colors.green(\n      `Successfully created ${results.length} API key${results.length === 1 ? '' : 's'}`,\n    ),\n  );\n\n  if (errors.length > 0) {\n    logger.error(\n      colors.red(`Failed to create ${errors.length} API key${errors.length === 1 ? '' : 's'}!`),\n    );\n  }\n\n  return { errors, apiKeys: results };\n}\n"],"mappings":"uTA+BA,eAAsB,EAA4B,CAChD,QACA,WACA,SACA,cACA,uBACA,uBAAuB,GACvB,kBAAkB,GAClB,eAAe,GAuBd,CAED,IAAM,EAAS,MAAM,EAAmC,EAAc,EAAE,CAAC,CAGzE,EAAO,KAAK,EAAO,QAAQ,uCAAuC,CAAC,CACnE,GAAM,CAAE,QAAO,eAAgB,MAAM,EAAU,EAAQ,CAAE,QAAO,WAAU,SAAQ,CAAC,CACnF,EAAO,KACL,EAAO,MACL,oCAAoC,EAAM,OAAO,OAAO,EAAM,SAAW,EAAI,GAAK,IAAI,GACvF,CACF,CAGD,IAAM,EAAgB,EAClB,EAAM,OACH,GACC,EAAK,aAAa,KAAO,GACzB,EAAK,aAAa,uBAAyB,EAC9C,CACD,EAGJ,EAAO,WAAW,CAChB,OAAQ,EACT,CAAC,CAGF,IAAM,EAA0B,EAAE,CAC5B,EAAgC,EAAE,CAgGxC,OA7FA,EAAO,KACL,EAAO,QAAQ,mCAAmC,EAAY,YAAY,EAAO,KAAK,IAAI,CAAC,GAAG,CAC/F,CAGD,MAAM,EAAU,EAAe,KAAO,IAAS,CAC7C,GAAI,CAEF,MAAM,EAAW,EAAQ,CAAE,OAAQ,EAAK,GAAI,QAAO,SAAQ,CAAC,CAG5D,EAAO,KACL,EAAO,QACL,uDAAuD,EAAK,aAAa,KAAK,iBAAiB,EAAY,IAC5G,CACF,CAGD,GAAM,CAAC,GAAmB,MAAM,EAAgB,EAAQ,CACtD,SACA,SAAU,CAAE,OAAQ,CAAC,EAAY,CAAE,CACpC,CAAC,CACF,GAAI,GAAmB,EACrB,EAAO,KACL,EAAO,OACL,iCAAiC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACtF,CACF,CACD,MAAM,EAAa,EAAQ,CAAE,GAAI,EAAgB,GAAI,SAAQ,CAAC,CAC9D,EAAO,KACL,EAAO,MACL,oCAAoC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACzF,CACF,SACQ,EAET,MAAU,MAAM,uCAAuC,EAAY,GAAG,CAIxE,GAAI,EAAiB,CACnB,EAAO,KACL,EAAO,QACL,wBAAwB,EAAK,aAAa,KAAK,iBAAiB,EAAY,IAC7E,CACF,CACD,GAAM,CAAE,UAAW,MAAM,EAAa,EAAQ,CAC5C,MAAO,CAAE,MAAO,EAAa,SAAQ,CACrC,SACD,CAAC,CACF,EAAQ,KAAK,CACX,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,SACD,CAAC,CACF,EAAO,KACL,EAAO,MACL,oCAAoC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACzF,CACF,MAGD,EAAQ,KAAK,CACX,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,OAAQ,GACT,CAAC,OAEG,EAAK,CACZ,EAAO,MACL,EAAO,IACL,6CAA6C,EAAK,aAAa,KAAK,OAAO,EAAI,UAChF,CACF,CACD,EAAO,KAAK,CACV,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,MAAO,EAAI,QACZ,CAAC,GAEJ,CACF,EAAO,KACL,EAAO,MACL,wBAAwB,EAAQ,OAAO,UAAU,EAAQ,SAAW,EAAI,GAAK,MAC9E,CACF,CAEG,EAAO,OAAS,GAClB,EAAO,MACL,EAAO,IAAI,oBAAoB,EAAO,OAAO,UAAU,EAAO,SAAW,EAAI,GAAK,IAAI,GAAG,CAC1F,CAGI,CAAE,SAAQ,QAAS,EAAS"}
+{"version":3,"file":"generateCrossAccountApiKeys-CVdsJFOe.mjs","names":[],"sources":["../src/lib/api-keys/generateCrossAccountApiKeys.ts"],"sourcesContent":["import { ScopeName } from '@transcend-io/privacy-types';\nimport {\n  buildTranscendGraphQLClientGeneric,\n  loginUser,\n  createApiKey,\n  fetchAllApiKeys,\n  deleteApiKey,\n  assumeRole,\n} from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { StoredApiKey } from '../../codecs.js';\nimport { DEFAULT_TRANSCEND_API } from '../../constants.js';\nimport { logger } from '../../logger.js';\n\nexport interface ApiKeyGenerateError {\n  /** Name of instance */\n  organizationName: string;\n  /** Error */\n  error: string;\n  /** Organization ID API key is for */\n  organizationId: string;\n}\n\n/**\n * Generate API keys across multiple transcend accounts\n *\n * @param options - Options\n * @returns Number of API keys created\n */\nexport async function generateCrossAccountApiKeys({\n  email,\n  password,\n  scopes,\n  apiKeyTitle,\n  parentOrganizationId,\n  deleteExistingApiKey = true,\n  createNewApiKey = true,\n  transcendUrl = DEFAULT_TRANSCEND_API,\n}: {\n  /** Email address of user generating API keys */\n  email: string;\n  /** Password of user generating API keys */\n  password: string;\n  /** Filter for organizations that match this parent organization ID */\n  parentOrganizationId?: string;\n  /** Title of the API create to create */\n  apiKeyTitle: string;\n  /** Title of the API create to create */\n  scopes: ScopeName[];\n  /** API URL for Transcend backend */\n  transcendUrl?: string;\n  /** When true delete existing API keys with that title, if set to false an API key exists with that title, an error is thrown */\n  deleteExistingApiKey?: boolean;\n  /** When true, generate new API keys, otherwise only will delete past API keys */\n  createNewApiKey?: boolean;\n}): Promise<{\n  /** Successfully generated */\n  apiKeys: StoredApiKey[];\n  /** Error results */\n  errors: ApiKeyGenerateError[];\n}> {\n  // Create GraphQL client\n  const client = await buildTranscendGraphQLClientGeneric(transcendUrl, {});\n\n  // Login the user\n  logger.info(colors.magenta('Logging in using email and password.'));\n  const { roles, loginCookie } = await loginUser(client, { email, password, logger });\n  logger.info(\n    colors.green(\n      `Successfully logged in and found ${roles.length} role${roles.length === 1 ? '' : 's'}!`,\n    ),\n  );\n\n  // Filter down by parentOrganizationId\n  const filteredRoles = parentOrganizationId\n    ? roles.filter(\n        (role) =>\n          role.organization.id === parentOrganizationId ||\n          role.organization.parentOrganizationId === parentOrganizationId,\n      )\n    : roles;\n\n  // Save cookie to call route subsequent times\n  client.setHeaders({\n    Cookie: loginCookie,\n  });\n\n  // Save the resulting API keys\n  const results: StoredApiKey[] = [];\n  const errors: ApiKeyGenerateError[] = [];\n\n  // Generate API keys\n  logger.info(\n    colors.magenta(`Generating API keys with title: ${apiKeyTitle}, scopes: ${scopes.join(',')}.`),\n  );\n\n  // Map over each role\n  await mapSeries(filteredRoles, async (role) => {\n    try {\n      // Log into the other instance\n      await assumeRole(client, { roleId: role.id, email, logger });\n\n      // Grab API keys with that title\n      logger.info(\n        colors.magenta(\n          `Checking if API key already exists in organization \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n        ),\n      );\n\n      // Delete existing API key\n      const [apiKeyWithTitle] = await fetchAllApiKeys(client, {\n        logger,\n        filterBy: { titles: [apiKeyTitle] },\n      });\n      if (apiKeyWithTitle && deleteExistingApiKey) {\n        logger.info(\n          colors.yellow(\n            `Deleting existing API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n        await deleteApiKey(client, { id: apiKeyWithTitle.id, logger });\n        logger.info(\n          colors.green(\n            `Successfully deleted API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n      } else if (apiKeyWithTitle) {\n        // throw error if one exists but not configured to delete\n        throw new Error(`API key already exists with title: \"${apiKeyTitle}\"`);\n      }\n\n      // Create the API key\n      if (createNewApiKey) {\n        logger.info(\n          colors.magenta(\n            `Creating API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n        const { apiKey } = await createApiKey(client, {\n          input: { title: apiKeyTitle, scopes },\n          logger,\n        });\n        results.push({\n          organizationName: role.organization.name,\n          organizationId: role.organization.id,\n          apiKey,\n        });\n        logger.info(\n          colors.green(\n            `Successfully created API key in \"${role.organization.name}\" with title: \"${apiKeyTitle}\".`,\n          ),\n        );\n      } else {\n        // Delete only\n        results.push({\n          organizationName: role.organization.name,\n          organizationId: role.organization.id,\n          apiKey: '',\n        });\n      }\n    } catch (err) {\n      logger.error(\n        colors.red(\n          `Failed to create API key in organization \"${role.organization.name}\"! - ${err.message}`,\n        ),\n      );\n      errors.push({\n        organizationName: role.organization.name,\n        organizationId: role.organization.id,\n        error: err.message,\n      });\n    }\n  });\n  logger.info(\n    colors.green(\n      `Successfully created ${results.length} API key${results.length === 1 ? '' : 's'}`,\n    ),\n  );\n\n  if (errors.length > 0) {\n    logger.error(\n      colors.red(`Failed to create ${errors.length} API key${errors.length === 1 ? '' : 's'}!`),\n    );\n  }\n\n  return { errors, apiKeys: results };\n}\n"],"mappings":"uTA+BA,eAAsB,EAA4B,CAChD,QACA,WACA,SACA,cACA,uBACA,uBAAuB,GACvB,kBAAkB,GAClB,eAAe,GAuBd,CAED,IAAM,EAAS,MAAM,EAAmC,EAAc,EAAE,CAAC,CAGzE,EAAO,KAAK,EAAO,QAAQ,uCAAuC,CAAC,CACnE,GAAM,CAAE,QAAO,eAAgB,MAAM,EAAU,EAAQ,CAAE,QAAO,WAAU,SAAQ,CAAC,CACnF,EAAO,KACL,EAAO,MACL,oCAAoC,EAAM,OAAO,OAAO,EAAM,SAAW,EAAI,GAAK,IAAI,GACvF,CACF,CAGD,IAAM,EAAgB,EAClB,EAAM,OACH,GACC,EAAK,aAAa,KAAO,GACzB,EAAK,aAAa,uBAAyB,EAC9C,CACD,EAGJ,EAAO,WAAW,CAChB,OAAQ,EACT,CAAC,CAGF,IAAM,EAA0B,EAAE,CAC5B,EAAgC,EAAE,CAgGxC,OA7FA,EAAO,KACL,EAAO,QAAQ,mCAAmC,EAAY,YAAY,EAAO,KAAK,IAAI,CAAC,GAAG,CAC/F,CAGD,MAAM,EAAU,EAAe,KAAO,IAAS,CAC7C,GAAI,CAEF,MAAM,EAAW,EAAQ,CAAE,OAAQ,EAAK,GAAI,QAAO,SAAQ,CAAC,CAG5D,EAAO,KACL,EAAO,QACL,uDAAuD,EAAK,aAAa,KAAK,iBAAiB,EAAY,IAC5G,CACF,CAGD,GAAM,CAAC,GAAmB,MAAM,EAAgB,EAAQ,CACtD,SACA,SAAU,CAAE,OAAQ,CAAC,EAAY,CAAE,CACpC,CAAC,CACF,GAAI,GAAmB,EACrB,EAAO,KACL,EAAO,OACL,iCAAiC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACtF,CACF,CACD,MAAM,EAAa,EAAQ,CAAE,GAAI,EAAgB,GAAI,SAAQ,CAAC,CAC9D,EAAO,KACL,EAAO,MACL,oCAAoC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACzF,CACF,SACQ,EAET,MAAU,MAAM,uCAAuC,EAAY,GAAG,CAIxE,GAAI,EAAiB,CACnB,EAAO,KACL,EAAO,QACL,wBAAwB,EAAK,aAAa,KAAK,iBAAiB,EAAY,IAC7E,CACF,CACD,GAAM,CAAE,UAAW,MAAM,EAAa,EAAQ,CAC5C,MAAO,CAAE,MAAO,EAAa,SAAQ,CACrC,SACD,CAAC,CACF,EAAQ,KAAK,CACX,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,SACD,CAAC,CACF,EAAO,KACL,EAAO,MACL,oCAAoC,EAAK,aAAa,KAAK,iBAAiB,EAAY,IACzF,CACF,MAGD,EAAQ,KAAK,CACX,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,OAAQ,GACT,CAAC,OAEG,EAAK,CACZ,EAAO,MACL,EAAO,IACL,6CAA6C,EAAK,aAAa,KAAK,OAAO,EAAI,UAChF,CACF,CACD,EAAO,KAAK,CACV,iBAAkB,EAAK,aAAa,KACpC,eAAgB,EAAK,aAAa,GAClC,MAAO,EAAI,QACZ,CAAC,GAEJ,CACF,EAAO,KACL,EAAO,MACL,wBAAwB,EAAQ,OAAO,UAAU,EAAQ,SAAW,EAAI,GAAK,MAC9E,CACF,CAEG,EAAO,OAAS,GAClB,EAAO,MACL,EAAO,IAAI,oBAAoB,EAAO,OAAO,UAAU,EAAO,SAAW,EAAI,GAAK,IAAI,GAAG,CAC1F,CAGI,CAAE,SAAQ,QAAS,EAAS"}

package/dist/impl-0-_oxvck.mjs

@@ -0,0 +1,2 @@
+import{t as e}from"./validateTranscendAuth-D-dDINof.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";import{t as n}from"./command-output-BJcDRXNr.mjs";import{t as r}from"./command-output-BRfF3YFv.mjs";import i from"colors";import{buildTranscendGraphQLClient as a,fetchAllCustomFunctions as o}from"@transcend-io/sdk";async function s({auth:s,transcendUrl:c,json:l}){t(this.process);let u=e(s,this);Array.isArray(u)&&(this.logger.error(i.red(`transcend custom-functions list does not support a list of API keys — pass a single API key.`)),this.process.exit(1));let d=await o(a(c,u),{logger:n(this.logger,l)});if(l){let e=r(d);this.process.stdout.write(`${JSON.stringify(e)}\n`);return}if(d.length===0){this.logger.info(i.yellow(`No custom functions found in this organization.`));return}this.logger.info(i.magenta(`Found ${d.length} custom function(s):`)),d.forEach(e=>{let t=e.activeVersion?`active v${e.activeVersion.versionNumber}`:`no active version`,n=e.hasPendingDraft&&e.draftVersion?`, pending draft v${e.draftVersion.versionNumber}`:``;this.logger.info(`  - ${i.green(e.name)} [${e.type}] (${e.lifecycleState.toLowerCase()}, ${t}${n}) `+i.dim(`id: ${e.id}`))})}export{s as list};
+//# sourceMappingURL=impl-0-_oxvck.mjs.map

package/dist/impl-0-_oxvck.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"impl-0-_oxvck.mjs","names":[],"sources":["../src/commands/custom-functions/list/impl.ts"],"sourcesContent":["import { buildTranscendGraphQLClient, fetchAllCustomFunctions } from '@transcend-io/sdk';\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { validateTranscendAuth } from '../../../lib/api-keys/index.js';\nimport { selectCommandLogger } from '../../../lib/cli/command-output.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { buildCustomFunctionListJsonResult } from '../../../lib/custom-functions/command-output.js';\n\nexport interface CustomFunctionsListCommandFlags {\n  /** Transcend API key. */\n  auth: string;\n  /** Transcend backend URL. */\n  transcendUrl: string;\n  /** Emit stable JSON output. */\n  json: boolean;\n}\n\nexport async function list(\n  this: LocalContext,\n  { auth, transcendUrl, json }: CustomFunctionsListCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  const apiKeyOrList = validateTranscendAuth(auth, this);\n  if (Array.isArray(apiKeyOrList)) {\n    this.logger.error(\n      colors.red(\n        'transcend custom-functions list does not support a list of API keys — pass a single API key.',\n      ),\n    );\n    this.process.exit(1);\n  }\n\n  const client = buildTranscendGraphQLClient(transcendUrl, apiKeyOrList as string);\n  const commandLogger = selectCommandLogger(this.logger, json);\n  const customFunctions = await fetchAllCustomFunctions(client, { logger: commandLogger });\n\n  if (json) {\n    const result = buildCustomFunctionListJsonResult(customFunctions);\n    this.process.stdout.write(`${JSON.stringify(result)}\\n`);\n    return;\n  }\n\n  if (customFunctions.length === 0) {\n    this.logger.info(colors.yellow('No custom functions found in this organization.'));\n    return;\n  }\n\n  this.logger.info(colors.magenta(`Found ${customFunctions.length} custom function(s):`));\n  customFunctions.forEach((customFunction) => {\n    const active = customFunction.activeVersion\n      ? `active v${customFunction.activeVersion.versionNumber}`\n      : 'no active version';\n    const draft =\n      customFunction.hasPendingDraft && customFunction.draftVersion\n        ? `, pending draft v${customFunction.draftVersion.versionNumber}`\n        : '';\n    this.logger.info(\n      `  - ${colors.green(customFunction.name)} [${customFunction.type}] ` +\n        `(${customFunction.lifecycleState.toLowerCase()}, ${active}${draft}) ` +\n        colors.dim(`id: ${customFunction.id}`),\n    );\n  });\n}\n"],"mappings":"oUAkBA,eAAsB,EAEpB,CAAE,OAAM,eAAc,QACP,CACf,EAAoB,KAAK,QAAQ,CAEjC,IAAM,EAAe,EAAsB,EAAM,KAAK,CAClD,MAAM,QAAQ,EAAa,GAC7B,KAAK,OAAO,MACV,EAAO,IACL,+FACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,EAKtB,IAAM,EAAkB,MAAM,EAFf,EAA4B,EAAc,EAEG,CAAE,CAAE,OAD1C,EAAoB,KAAK,OAAQ,EAC8B,CAAE,CAAC,CAExF,GAAI,EAAM,CACR,IAAM,EAAS,EAAkC,EAAgB,CACjE,KAAK,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,EAAO,CAAC,IAAI,CACxD,OAGF,GAAI,EAAgB,SAAW,EAAG,CAChC,KAAK,OAAO,KAAK,EAAO,OAAO,kDAAkD,CAAC,CAClF,OAGF,KAAK,OAAO,KAAK,EAAO,QAAQ,SAAS,EAAgB,OAAO,sBAAsB,CAAC,CACvF,EAAgB,QAAS,GAAmB,CAC1C,IAAM,EAAS,EAAe,cAC1B,WAAW,EAAe,cAAc,gBACxC,oBACE,EACJ,EAAe,iBAAmB,EAAe,aAC7C,oBAAoB,EAAe,aAAa,gBAChD,GACN,KAAK,OAAO,KACV,OAAO,EAAO,MAAM,EAAe,KAAK,CAAC,IAAI,EAAe,KAAK,KAC3D,EAAe,eAAe,aAAa,CAAC,IAAI,IAAS,EAAM,IACnE,EAAO,IAAI,OAAO,EAAe,KAAK,CACzC,EACD"}

package/dist/{impl-ByFyaZkK.mjs → impl-2sYR_UFO.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./removeUnverifiedRequestIdentifiers-Do3Pus6m.mjs";import{t}from"./done-input-validation-BUz-aVC5.mjs";async function n({auth:n,transcendUrl:r,identifierNames:i,actions:a=[]}){t(this.process),await e({requestActions:a,transcendUrl:r,auth:n,identifierNames:i})}export{n as rejectUnverifiedIdentifiers};
-//# sourceMappingURL=impl-ByFyaZkK.mjs.map
+import{t as e}from"./removeUnverifiedRequestIdentifiers-DcI9ut4q.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,transcendUrl:r,identifierNames:i,actions:a=[]}){t(this.process),await e({requestActions:a,transcendUrl:r,auth:n,identifierNames:i})}export{n as rejectUnverifiedIdentifiers};
+//# sourceMappingURL=impl-2sYR_UFO.mjs.map

package/dist/{impl-ByFyaZkK.mjs.map → impl-2sYR_UFO.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-ByFyaZkK.mjs","names":[],"sources":["../src/commands/request/reject-unverified-identifiers/impl.ts"],"sourcesContent":["import type { RequestAction } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { removeUnverifiedRequestIdentifiers } from '../../../lib/requests/index.js';\n\nexport interface RejectUnverifiedIdentifiersCommandFlags {\n  auth: string;\n  identifierNames: string[];\n  actions?: RequestAction[];\n  transcendUrl: string;\n}\n\nexport async function rejectUnverifiedIdentifiers(\n  this: LocalContext,\n  { auth, transcendUrl, identifierNames, actions = [] }: RejectUnverifiedIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await removeUnverifiedRequestIdentifiers({\n    requestActions: actions,\n    transcendUrl,\n    auth,\n    identifierNames,\n  });\n}\n"],"mappings":"0HAaA,eAAsB,EAEpB,CAAE,OAAM,eAAc,kBAAiB,UAAU,EAAE,EACpC,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAmC,CACvC,eAAgB,EAChB,eACA,OACA,kBACD,CAAC"}
+{"version":3,"file":"impl-2sYR_UFO.mjs","names":[],"sources":["../src/commands/request/reject-unverified-identifiers/impl.ts"],"sourcesContent":["import type { RequestAction } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { removeUnverifiedRequestIdentifiers } from '../../../lib/requests/index.js';\n\nexport interface RejectUnverifiedIdentifiersCommandFlags {\n  auth: string;\n  identifierNames: string[];\n  actions?: RequestAction[];\n  transcendUrl: string;\n}\n\nexport async function rejectUnverifiedIdentifiers(\n  this: LocalContext,\n  { auth, transcendUrl, identifierNames, actions = [] }: RejectUnverifiedIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await removeUnverifiedRequestIdentifiers({\n    requestActions: actions,\n    transcendUrl,\n    auth,\n    identifierNames,\n  });\n}\n"],"mappings":"0HAaA,eAAsB,EAEpB,CAAE,OAAM,eAAc,kBAAiB,UAAU,EAAE,EACpC,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAmC,CACvC,eAAgB,EAChB,eACA,OACA,kBACD,CAAC"}

package/dist/{impl-DRpK-QLC.mjs → impl-ApZGIx6l.mjs}

@@ -1,2 +1,2 @@
-import{D as e}from"./codecs-CTxFjCg4.mjs";import{t}from"./readCsv-DLg8pwjd.mjs";import{t as n}from"./mapConsentCsvRowsToInputs-Dqb6WL4r.mjs";import{t as r}from"./done-input-validation-BUz-aVC5.mjs";import i from"colors";import{buildTranscendGraphQLClient as a,syncCookies as o}from"@transcend-io/sdk";async function s({auth:s,trackerStatus:c,file:l,transcendUrl:u}){r(this.process),this.logger.info(i.magenta(`Reading "${l}" from disk`));let d=n(t(this.fs.readFileSync(l,`utf8`),e),c);await o(a(u,s),d,{logger:this.logger})||(this.logger.error(i.red(`Encountered error(s) syncing cookies from CSV, see logs above for more info. `)),this.process.exit(1))}export{s as uploadCookiesFromCsv};
-//# sourceMappingURL=impl-DRpK-QLC.mjs.map
+import{D as e}from"./codecs-CfcaFoZR.mjs";import{t}from"./readCsv-DNcJ_UfU.mjs";import{t as n}from"./mapConsentCsvRowsToInputs-CkLfxaIf.mjs";import{t as r}from"./done-input-validation-LiTaCEzF.mjs";import i from"colors";import{buildTranscendGraphQLClient as a,syncCookies as o}from"@transcend-io/sdk";async function s({auth:s,trackerStatus:c,file:l,transcendUrl:u}){r(this.process),this.logger.info(i.magenta(`Reading "${l}" from disk`));let d=n(t(this.fs.readFileSync(l,`utf8`),e),c);await o(a(u,s),d,{logger:this.logger})||(this.logger.error(i.red(`Encountered error(s) syncing cookies from CSV, see logs above for more info. `)),this.process.exit(1))}export{s as uploadCookiesFromCsv};
+//# sourceMappingURL=impl-ApZGIx6l.mjs.map

package/dist/{impl-DRpK-QLC.mjs.map → impl-ApZGIx6l.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DRpK-QLC.mjs","names":[],"sources":["../src/commands/consent/upload-cookies-from-csv/impl.ts"],"sourcesContent":["import { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient, syncCookies } from '@transcend-io/sdk';\nimport colors from 'colors';\n\nimport { CookieCsvInput } from '../../../codecs.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { mapCookieCsvRowsToInputs } from '../../../lib/consent-manager/mapConsentCsvRowsToInputs.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadCookiesFromCsvCommandFlags {\n  auth: string;\n  trackerStatus: ConsentTrackerStatus;\n  file: string;\n  transcendUrl: string;\n}\n\nexport async function uploadCookiesFromCsv(\n  this: LocalContext,\n  { auth, trackerStatus, file, transcendUrl }: UploadCookiesFromCsvCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  this.logger.info(colors.magenta(`Reading \"${file}\" from disk`));\n  const cookieRows = parseCsv(this.fs.readFileSync(file, 'utf8'), CookieCsvInput);\n  const cookieInputs = mapCookieCsvRowsToInputs(cookieRows, trackerStatus);\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n  const syncedCookies = await syncCookies(client, cookieInputs, { logger: this.logger });\n\n  if (!syncedCookies) {\n    this.logger.error(\n      colors.red('Encountered error(s) syncing cookies from CSV, see logs above for more info. '),\n    );\n    this.process.exit(1);\n  }\n}\n"],"mappings":"6SAiBA,eAAsB,EAEpB,CAAE,OAAM,gBAAe,OAAM,gBACd,CACf,EAAoB,KAAK,QAAQ,CAEjC,KAAK,OAAO,KAAK,EAAO,QAAQ,YAAY,EAAK,aAAa,CAAC,CAE/D,IAAM,EAAe,EADF,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EACR,CAAE,EAAc,CAInE,MAFuB,EADb,EAA4B,EAAc,EACX,CAAE,EAAc,CAAE,OAAQ,KAAK,OAAQ,CAAC,GAGpF,KAAK,OAAO,MACV,EAAO,IAAI,gFAAgF,CAC5F,CACD,KAAK,QAAQ,KAAK,EAAE"}
+{"version":3,"file":"impl-ApZGIx6l.mjs","names":[],"sources":["../src/commands/consent/upload-cookies-from-csv/impl.ts"],"sourcesContent":["import { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient, syncCookies } from '@transcend-io/sdk';\nimport colors from 'colors';\n\nimport { CookieCsvInput } from '../../../codecs.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { mapCookieCsvRowsToInputs } from '../../../lib/consent-manager/mapConsentCsvRowsToInputs.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadCookiesFromCsvCommandFlags {\n  auth: string;\n  trackerStatus: ConsentTrackerStatus;\n  file: string;\n  transcendUrl: string;\n}\n\nexport async function uploadCookiesFromCsv(\n  this: LocalContext,\n  { auth, trackerStatus, file, transcendUrl }: UploadCookiesFromCsvCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  this.logger.info(colors.magenta(`Reading \"${file}\" from disk`));\n  const cookieRows = parseCsv(this.fs.readFileSync(file, 'utf8'), CookieCsvInput);\n  const cookieInputs = mapCookieCsvRowsToInputs(cookieRows, trackerStatus);\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n  const syncedCookies = await syncCookies(client, cookieInputs, { logger: this.logger });\n\n  if (!syncedCookies) {\n    this.logger.error(\n      colors.red('Encountered error(s) syncing cookies from CSV, see logs above for more info. '),\n    );\n    this.process.exit(1);\n  }\n}\n"],"mappings":"6SAiBA,eAAsB,EAEpB,CAAE,OAAM,gBAAe,OAAM,gBACd,CACf,EAAoB,KAAK,QAAQ,CAEjC,KAAK,OAAO,KAAK,EAAO,QAAQ,YAAY,EAAK,aAAa,CAAC,CAE/D,IAAM,EAAe,EADF,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EACR,CAAE,EAAc,CAInE,MAFuB,EADb,EAA4B,EAAc,EACX,CAAE,EAAc,CAAE,OAAQ,KAAK,OAAQ,CAAC,GAGpF,KAAK,OAAO,MACV,EAAO,IAAI,gFAAgF,CAC5F,CACD,KAAK,QAAQ,KAAK,EAAE"}

package/dist/{impl-DVeGQCrr.mjs → impl-Ay6JeH-7.mjs}

@@ -1,2 +1,2 @@
-import{N as e}from"./codecs-CTxFjCg4.mjs";import{t}from"./readCsv-DLg8pwjd.mjs";import{n}from"./mapConsentCsvRowsToInputs-Dqb6WL4r.mjs";import{t as r}from"./done-input-validation-BUz-aVC5.mjs";import i from"colors";import{buildTranscendGraphQLClient as a,syncDataFlows as o}from"@transcend-io/sdk";async function s({auth:s,trackerStatus:c,file:l,classifyService:u,transcendUrl:d}){r(this.process),this.logger.info(i.magenta(`Reading "${l}" from disk`));let f=n(t(this.fs.readFileSync(l,`utf8`),e),c);await o(a(d,s),f,{classifyService:u,logger:this.logger})||(this.logger.error(i.red(`Encountered error(s) syncing data flows from CSV, see logs above for more info. `)),this.process.exit(1))}export{s as uploadDataFlowsFromCsv};
-//# sourceMappingURL=impl-DVeGQCrr.mjs.map
+import{N as e}from"./codecs-CfcaFoZR.mjs";import{t}from"./readCsv-DNcJ_UfU.mjs";import{n}from"./mapConsentCsvRowsToInputs-CkLfxaIf.mjs";import{t as r}from"./done-input-validation-LiTaCEzF.mjs";import i from"colors";import{buildTranscendGraphQLClient as a,syncDataFlows as o}from"@transcend-io/sdk";async function s({auth:s,trackerStatus:c,file:l,classifyService:u,transcendUrl:d}){r(this.process),this.logger.info(i.magenta(`Reading "${l}" from disk`));let f=n(t(this.fs.readFileSync(l,`utf8`),e),c);await o(a(d,s),f,{classifyService:u,logger:this.logger})||(this.logger.error(i.red(`Encountered error(s) syncing data flows from CSV, see logs above for more info. `)),this.process.exit(1))}export{s as uploadDataFlowsFromCsv};
+//# sourceMappingURL=impl-Ay6JeH-7.mjs.map

package/dist/{impl-DVeGQCrr.mjs.map → impl-Ay6JeH-7.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DVeGQCrr.mjs","names":[],"sources":["../src/commands/consent/upload-data-flows-from-csv/impl.ts"],"sourcesContent":["import { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient, syncDataFlows } from '@transcend-io/sdk';\nimport colors from 'colors';\n\nimport { DataFlowCsvInput } from '../../../codecs.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { mapDataFlowCsvRowsToInputs } from '../../../lib/consent-manager/mapConsentCsvRowsToInputs.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadDataFlowsFromCsvCommandFlags {\n  auth: string;\n  trackerStatus: ConsentTrackerStatus;\n  file: string;\n  classifyService: boolean;\n  transcendUrl: string;\n}\n\nexport async function uploadDataFlowsFromCsv(\n  this: LocalContext,\n  { auth, trackerStatus, file, classifyService, transcendUrl }: UploadDataFlowsFromCsvCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  this.logger.info(colors.magenta(`Reading \"${file}\" from disk`));\n  const dataFlowRows = parseCsv(this.fs.readFileSync(file, 'utf8'), DataFlowCsvInput);\n  const dataFlowInputs = mapDataFlowCsvRowsToInputs(dataFlowRows, trackerStatus);\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n  const syncedDataFlows = await syncDataFlows(client, dataFlowInputs, {\n    classifyService,\n    logger: this.logger,\n  });\n\n  if (!syncedDataFlows) {\n    this.logger.error(\n      colors.red(\n        'Encountered error(s) syncing data flows from CSV, see logs above for more info. ',\n      ),\n    );\n    this.process.exit(1);\n  }\n}\n"],"mappings":"0SAkBA,eAAsB,EAEpB,CAAE,OAAM,gBAAe,OAAM,kBAAiB,gBAC/B,CACf,EAAoB,KAAK,QAAQ,CAEjC,KAAK,OAAO,KAAK,EAAO,QAAQ,YAAY,EAAK,aAAa,CAAC,CAE/D,IAAM,EAAiB,EADF,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EACJ,CAAE,EAAc,CAOzE,MALyB,EADf,EAA4B,EAAc,EACP,CAAE,EAAgB,CAClE,kBACA,OAAQ,KAAK,OACd,CAAC,GAGA,KAAK,OAAO,MACV,EAAO,IACL,mFACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE"}
+{"version":3,"file":"impl-Ay6JeH-7.mjs","names":[],"sources":["../src/commands/consent/upload-data-flows-from-csv/impl.ts"],"sourcesContent":["import { ConsentTrackerStatus } from '@transcend-io/privacy-types';\nimport { buildTranscendGraphQLClient, syncDataFlows } from '@transcend-io/sdk';\nimport colors from 'colors';\n\nimport { DataFlowCsvInput } from '../../../codecs.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { mapDataFlowCsvRowsToInputs } from '../../../lib/consent-manager/mapConsentCsvRowsToInputs.js';\nimport { parseCsv } from '../../../lib/requests/readCsv.js';\n\nexport interface UploadDataFlowsFromCsvCommandFlags {\n  auth: string;\n  trackerStatus: ConsentTrackerStatus;\n  file: string;\n  classifyService: boolean;\n  transcendUrl: string;\n}\n\nexport async function uploadDataFlowsFromCsv(\n  this: LocalContext,\n  { auth, trackerStatus, file, classifyService, transcendUrl }: UploadDataFlowsFromCsvCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  this.logger.info(colors.magenta(`Reading \"${file}\" from disk`));\n  const dataFlowRows = parseCsv(this.fs.readFileSync(file, 'utf8'), DataFlowCsvInput);\n  const dataFlowInputs = mapDataFlowCsvRowsToInputs(dataFlowRows, trackerStatus);\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n  const syncedDataFlows = await syncDataFlows(client, dataFlowInputs, {\n    classifyService,\n    logger: this.logger,\n  });\n\n  if (!syncedDataFlows) {\n    this.logger.error(\n      colors.red(\n        'Encountered error(s) syncing data flows from CSV, see logs above for more info. ',\n      ),\n    );\n    this.process.exit(1);\n  }\n}\n"],"mappings":"0SAkBA,eAAsB,EAEpB,CAAE,OAAM,gBAAe,OAAM,kBAAiB,gBAC/B,CACf,EAAoB,KAAK,QAAQ,CAEjC,KAAK,OAAO,KAAK,EAAO,QAAQ,YAAY,EAAK,aAAa,CAAC,CAE/D,IAAM,EAAiB,EADF,EAAS,KAAK,GAAG,aAAa,EAAM,OAAO,CAAE,EACJ,CAAE,EAAc,CAOzE,MALyB,EADf,EAA4B,EAAc,EACP,CAAE,EAAgB,CAClE,kBACA,OAAQ,KAAK,OACd,CAAC,GAGA,KAAK,OAAO,MACV,EAAO,IACL,mFACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE"}

package/dist/impl-B-Oe7DcE2.mjs

@@ -0,0 +1,421 @@
+import{g as e}from"./constants-BlKpAm3R.mjs";import{i as t,n,r,t as i}from"./project-plan-output-BHHlkLxe.mjs";import{c as a,d as o,f as s,l as c,t as l,u}from"./project-discovery-CWRjlFnC.mjs";import{b as d,d as f,r as p,t as m,u as h}from"./policy-project-discovery-B4cFXUlA.mjs";import{a as g,c as _,i as v,l as y,o as b,r as x,s as S,t as C}from"./policy-runtime-6jmkXlBk.mjs";import{t as w}from"./done-input-validation-LiTaCEzF.mjs";import{i as T,n as E,r as D,t as O}from"./prompts-BhXfYD6g.mjs";import{t as k}from"./run-captured-process-BjaSDWXG.mjs";import{t as A}from"./project-plan-apply-Bg_1eMX9.mjs";import{a as j,n as ee,o as te,r as ne,t as re}from"./policy-scaffold-config-CwlygiTz.mjs";import{isAbsolute as M,join as N,posix as P,relative as F,sep as I}from"node:path";import L from"colors";const R={Editor:`editor`,Skill:`skill`,Ci:`ci`};var z=`# Idiomatic Rego and document-tree authoring
+
+## Start from the document tree
+
+OPA evaluates queries against one document tree:
+
+- \`input\` is the request-specific document supplied by the caller.
+- \`data\` contains loaded policy packages and static data.
+- A Rego \`package\` determines where a module contributes documents below \`data\`.
+
+Choose package paths from the application's required query and ownership
+boundaries. Keep directory and package names aligned
+(\`directory-package-mismatch\`), and cover every publishable package with a
+\`.manifest\` root.
+
+### Multi-bundle template layout
+
+Prefer a publish directory named \`{root}-bundle/\` so the package-root folder can
+be \`{root}/\` without doubling names:
+
+\`\`\`
+example-bundle/               # transcend policy publish … <dir>
+  .manifest                   # roots + optional metadata.transcend.io.template / templateVersion
+  example/
+    result/…                  # package example.result
+  input.example.json
+  input.json                  # gitignored; VS Code / Regal Evaluate
+  input.schema.json           # input JSON Schema for editors and opa --schema
+\`\`\`
+
+Permissions starters use the same layout. Upload does not branch on template
+metadata; Permissions API still loads only the remote bundle named
+\`permissions\` (publish with \`--remote-bundle-name=permissions\`). Local folder
+(\`--bundle-dir\` / \`{root}-bundle/\`) and remote \`--remote-bundle-name\` are independent.
+
+OPA \`.rego\` placement follows the \`package\` line; \`data.json\` paths follow the
+filesystem and must sit under the manifest root prefix on disk.
+
+Use Rego v1 explicitly:
+
+\`\`\`rego
+package example.result
+
+import rego.v1
+\`\`\`
+
+When one publishable package reads another package under the same manifest root,
+import it and use the local name:
+
+\`\`\`rego
+import data.example.facts
+
+allow if facts.subject_is_trusted
+\`\`\`
+
+Do not use a fully qualified \`data.<root>…\` reference directly in a rule body.
+Policy Engine re-namespaces package declarations and imports during activation,
+and \`transcend policy lint\` rejects direct self-root references that would
+change meaning.
+
+## Define the contract before implementation
+
+Find the actual caller and document:
+
+1. the query path below \`data\`;
+2. required and optional \`input\` fields;
+3. the result document consumed by the caller;
+4. fail-closed behavior for absent, malformed, or unknown input;
+5. stable reason codes and any fields reserved for later extension.
+
+Do not infer a product contract from the generated example. Replace its package
+names and fields when the repository's contract is known.
+
+Keep the input JSON Schema as \`input.schema.json\` in the publish directory.
+Pass that file to \`opa check -s\` / \`transcend policy eval --schema\` when you want
+OPA to type-check \`input\`.
+
+## Prefer declarative result construction
+
+String decisions inside an object remain readable and extensible. Keep one
+result document shape and derive its fields from named rules:
+
+\`\`\`rego
+default decision := "deny"
+
+decision := "allow" if {
+	input.subject.trusted == true
+}
+
+default reason_code := "untrusted_or_invalid_input"
+
+reason_code := "trusted_subject" if {
+	decision == "allow"
+}
+\`\`\`
+
+Rego rules define documents; they are not an imperative sequence of variable
+assignments. Prefer small named predicates and one result constructor over
+repeated branch-specific copies of the full output object.
+
+## Fail closed
+
+- Give the externally queried decision or result a deny/error default.
+- Treat missing fields and unknown enum values as non-authorizing.
+- Avoid broad truthiness checks when exact values are required.
+- Add tests for malformed and incomplete inputs, not only expected allow cases.
+- Add result fields compatibly so existing consumers can continue reading the
+  stable core.
+`,B=`# Publishing
+
+## Validate the upload contract
+
+\`.manifest\` declares the document-tree roots included in the Policy Engine
+bundle. Each non-test Rego package must equal a root or be nested below one.
+Test modules remain local and are excluded from the upload archive.
+
+In this template, the publish directory is \`{root}-bundle/\` (the folder that
+contains \`.manifest\`), not the inner \`{root}/\` package tree alone.
+
+Scaffolded manifests may include optional OPA \`metadata\`:
+
+\`\`\`json
+"metadata": {
+  "transcend.io": {
+    "template": "generic",
+    "templateVersion": "<@transcend-io/cli version>"
+  }
+}
+\`\`\`
+
+\`template\` (\`generic\` or \`permissions\`) and \`templateVersion\` (the
+\`@transcend-io/cli\` version that generated the scaffold) are **authoring
+hints**. Upload does not branch on them.
+
+Before publishing:
+
+1. confirm the intended package and query paths with the consuming application;
+2. run \`transcend policy lint <bundle-directory> --noInteractive\` and tests;
+3. review the generated bundle name, version, description, and target Transcend environment;
+4. keep API keys in the environment or the repository's approved secret store.
+
+The publish path validates strict Rego compatibility and bundle compilation
+before creating the upload tarball.
+
+## Bundle names: local folder vs remote name
+
+Upload uses one create/version path for every bundle. Keep these distinct:
+
+- **Local** publish directory (\`{root}-bundle/\` or \`--bundle-dir\`) — the
+  \`<bundle>\` positional on \`policy publish\` / \`policy eval\`
+- **Remote** \`--remote-bundle-name\` — the Policy Engine resource name in Transcend
+
+What makes a bundle “Permissions” is convention plus where Sombra queries it:
+
+- **Permissions API** always loads the fixed remote bundle name
+  \`permissions\`. Publish that starter with \`--remote-bundle-name=permissions\`.
+- **Generic / decide** bundles use any other \`--remote-bundle-name\` and the decide
+  path.
+
+\`policy publish\` may warn when \`.manifest\` metadata/roots look Permissions-
+oriented but \`--remote-bundle-name\` is not \`permissions\` (or the reverse). The warning
+does not block upload.
+
+## Publish deliberately
+
+\`\`\`sh
+# Generic / decide path
+transcend policy publish --remote-bundle-name example --auth "$TRANSCEND_API_KEY" \\
+  transcend/policy/example-bundle
+
+# Permissions API path (fixed remote name)
+transcend policy publish --remote-bundle-name permissions --auth "$TRANSCEND_API_KEY" \\
+  transcend/policy/permissions-bundle
+\`\`\`
+
+Run \`transcend policy publish --help\` for current flags and scopes. Publishing
+creates or updates remote Policy Engine bundle resources, so keep it out of
+pull-request validation and require the repository's normal deployment approval.
+
+Publish each \`{root}-bundle/\` separately with its own \`--remote-bundle-name\`. Do not
+add publishing, Transcend API credentials, or environment activation to the
+validation-only workflow generated by \`policy init\`.
+`,V=`# Setup and tooling
+
+## Install the CLI
+
+Install the Transcend CLI **≥ 11**:
+
+\`\`\`sh
+npm install --global @transcend-io/cli@^11
+transcend policy --help   # should list init, new, lint [<directory>], …
+\`\`\`
+
+## Initialize safely
+
+Run \`transcend policy init --help\` before choosing flags. The default target is
+\`transcend/policy\`.
+
+\`policy init\` creates an empty multi-bundle workspace — shared Regal config
+(\`project.roots: []\`) and a README. No bundles or Rego are created.
+
+Interactive initialization offers VS Code setup, this Agent Skill, and
+validation-only GitHub Actions. Non-interactive automation enables only
+explicitly supplied \`--editor\`, \`--skill\`, and \`--ci\` flags:
+
+\`\`\`sh
+transcend policy init ./transcend/policy --editor --skill --ci --noInteractive --yes
+\`\`\`
+
+Use \`--dryRun\` to inspect the complete transactional plan. Existing policy
+files, manifests, Regal configuration, workflows, and customized managed
+artifacts are preserved.
+
+## Add bundles
+
+After initializing the workspace, add bundles with \`transcend policy new\`:
+
+\`\`\`sh
+transcend policy new --template generic --name example --yes
+transcend policy new --template permissions --name permissions --yes
+# optional: different local folder than {name}-bundle
+transcend policy new --template permissions --name permissions --bundle-dir my-bundle --yes
+\`\`\`
+
+Templates available:
+
+- \`generic\` — A fail-closed teaching entrypoint (default root: \`example\`)
+- \`permissions\` — A Permission API starter with purpose preferences (default root: \`permissions\`)
+
+Naming triad (keep these distinct):
+
+- \`--name\` — Rego / \`.manifest\` package root
+- \`--bundle-dir\` — local publish folder basename under the workspace (default
+  \`{name}-bundle\`)
+- \`--remote-bundle-name\` — remote Policy Engine name at upload time; unrelated to
+  the local folder
+
+Each publish directory includes its own \`input.schema.json\` beside the input
+fixtures.
+
+\`policy new\` creates the publish directory, its \`.manifest\`, Rego tree,
+input fixtures, and input schema. It also merges the root into Regal config and
+updates VS Code settings/tasks when \`.vscode\` is present.
+
+## Required tools
+
+- Use OPA 1.x for Rego v1 parsing, formatting, checks, tests, and bundle compilation.
+- Use Regal for idiomatic Rego linting and editor language-server features.
+- Run \`opa version\` and \`regal version\` to confirm the active executables.
+
+The generated Regal configuration targets OPA 1.18.2 capabilities. Generated CI
+installs OPA 1.18.2 and Regal 0.42.0; local tools only need to satisfy the
+compatible versions reported by \`policy init\` and \`policy lint\`. Follow their
+official installation links when a compatible tool is missing.
+
+## Editor and CI
+
+Repository-level VS Code settings should include:
+
+- \`opa.roots\` — one entry per \`{root}-bundle/\` publish directory
+- \`opa.bundleMode: true\` — avoid loading fixture JSON as data
+- \`json.schemas\` — validates \`input.json\` / \`input.example.json\`; Permissions
+  templates point at the published schema \`$id\`, generic bundles use the local
+  \`input.schema.json\`
+
+Preserve custom settings and tasks when adapting generated editor files.
+
+Generated GitHub Actions CI is read-only and credential-free: it installs pinned
+tools and the pinned Transcend CLI, then runs \`transcend policy lint\` per
+publish directory (matrix when multiple bundles exist). Locally, bare
+\`transcend policy lint\` verifies every child under the workspace that contains
+a \`.manifest\`:
+
+\`\`\`sh
+transcend policy lint --noInteractive --json
+transcend policy lint transcend/policy/example-bundle --noInteractive --json
+\`\`\`
+
+Adapt triggers, runner labels, dependency installation, and caching to
+established repository conventions without adding publish steps or secrets.
+`,H=`# Testing and debugging
+
+## Write executable tests
+
+Place tests next to the package they exercise and suffix test modules with
+\`_test.rego\`. A separate \`_test\` package makes the production API and test
+helpers easy to distinguish. Keep the \`_test\` package under the same manifest
+root (for example \`example.result_test\`, not a sibling root), so bundle-mode
+loads accept it.
+
+\`\`\`rego
+package example.result_test
+
+import data.example.result
+import rego.v1
+
+test_denies_missing_input if {
+	result.decision == "deny" with input as {}
+	result.reason_code == "untrusted_or_invalid_input" with input as {}
+}
+\`\`\`
+
+Cover at least:
+
+- the ordinary allow case;
+- explicit deny cases;
+- absent, malformed, and unknown input;
+- important result fields and reason codes;
+- interactions between packages when one policy reads another document.
+
+\`transcend policy lint\` requires a non-empty test suite.
+
+## Use local inputs safely
+
+Keep a sanitized \`input.example.json\` in each publish directory. \`policy new\`
+also writes a gitignored \`input.json\` beside it (same contents) so VS Code /
+Regal Evaluate work immediately. Customize \`input.json\` locally; keep
+\`input.example.json\` committed and free of credentials or personal data.
+
+## Run the complete gate
+
+With no directory argument, \`policy lint\` and \`policy test\` verify every
+immediate child under the workspace (\`transcend/policy\`) that contains a
+\`.manifest\`. Pass one bundle path to target a single unit:
+
+\`\`\`sh
+transcend policy lint --noInteractive
+transcend policy test
+transcend policy lint transcend/policy/permissions-bundle --noInteractive
+transcend policy test transcend/policy/permissions-bundle
+opa check --strict -b transcend/policy/permissions-bundle -s transcend/policy/permissions-bundle/input.schema.json
+\`\`\`
+
+\`policy lint\` and \`policy test\` run \`opa test -b\` (bundle mode) so a local
+gitignored \`input.json\` beside \`input.example.json\` does not cause a merge
+error. Prefer the CLI over raw directory-mode \`opa test\`. Strict OPA checks use
+Rego v1 (no \`--v0-compatible\`).
+
+Use \`transcend policy lint --help\` for formatter flags. Review Regal findings
+deliberately instead of applying broad rewrites.
+
+## Evaluate a query
+
+\`policy eval\` requires an explicit local publish directory (\`<bundle>\`).
+
+Generic example bundle:
+
+\`\`\`sh
+transcend policy eval transcend/policy/example-bundle \\
+  --package=data.example.result \\
+  --input=transcend/policy/example-bundle/input.json
+\`\`\`
+
+To simulate the Permissions API, pass the bundle, a purpose query (\`--package\`),
+the local envelope (\`--input\`), and the bundle's input schema (\`--schema\`) so
+OPA type-checks \`input\`:
+
+\`\`\`sh
+transcend policy eval transcend/policy/permissions-bundle \\
+  --package=data.permissions.purposes \\
+  --input=transcend/policy/permissions-bundle/input.json \\
+  --schema=transcend/policy/permissions-bundle/input.schema.json
+\`\`\`
+
+Or pipe the envelope with \`--stdin-input\`. \`policy eval\` ignores \`*_test.rego\`
+(same as lint/publish — tests are not shipped). Use \`transcend policy eval --help\`
+for curated \`opa eval\` pass-through flags (format, explain, metrics, and similar).
+Exit-on-result flags like OPA \`--fail\` are not exposed — production Evaluate uses
+the Data API (policy deny is a successful evaluation).
+
+Or \`opa eval -b … -i …\` with the caller's query path. If the result differs from
+expectations, inspect package paths, imports, defaults, input field presence,
+and the selected bundle directory before changing policy logic.
+`,U=`---
+name: transcend-policy-engine
+description: Sets up, authors, validates, tests, and publishes Transcend Policy Engine projects backed by OPA and Rego. Use for .manifest roots, Rego v1 policy trees, Regal configuration, local policy inputs, Policy Engine CI, or transcend policy CLI commands.
+compatibility: Requires OPA 1.x, Regal, and Transcend CLI ≥ 11 for local validation.
+---
+
+# Transcend Policy Engine
+
+Use the CLI for deterministic scaffolding and validation. Treat generated
+examples as disposable teaching material and derive the real policy contract
+from repository code and product requirements.
+
+Requires **Transcend CLI ≥ 11** (\`transcend policy lint [<directory>]\`, with
+\`init\` available).
+
+## Workflow
+
+1. Locate each publishable bundle directory (a directory with a \`.manifest\`;
+   \`policy new\` scaffolds these as \`{root}-bundle/\` by default (override with
+   \`--bundle-dir\`) with a \`{root}/\` package
+   tree inside).
+2. For initialization, editor support, tools, or CI, read [references/setup-tooling.md](references/setup-tooling.md).
+3. For package layout, document-tree design, decisions, and inputs, read [references/authoring.md](references/authoring.md).
+4. For tests, local inputs, linting, and evaluation, read [references/testing-debugging.md](references/testing-debugging.md).
+5. For bundle validation and publishing, read [references/publishing.md](references/publishing.md).
+6. Preserve repository conventions and finish with:
+
+\`\`\`sh
+transcend policy lint --noInteractive
+\`\`\`
+
+## Documentation
+
+- Every Transcend CLI command and subcommand provides contextual help with \`transcend <command> --help\`.
+- Use the [Transcend CLI README](https://github.com/transcend-io/tools/tree/main/packages/cli#readme) for command documentation and examples.
+- Use the [Transcend documentation index](https://docs.transcend.io/llms.txt) to find current product documentation.
+
+## Guardrails
+
+- Do not invent an input shape, output contract, package tree, or deployment convention.
+- Keep decisions fail-closed and make result documents extensible.
+- Never commit credentials or a real local \`input.json\`.
+- Keep every publishable Rego package covered by a \`.manifest\` root.
+- One publish directory = one Policy Engine bundle; do not merge unrelated
+  products into a single \`.manifest\` unless they share activation and callers.
+`;const W=`transcend-policy-engine`,G=[{path:`SKILL.md`,contents:U},{path:`references/setup-tooling.md`,contents:V},{path:`references/authoring.md`,contents:z},{path:`references/testing-debugging.md`,contents:H},{path:`references/publishing.md`,contents:B}];function K(e){return`${e.hasSkill?`Use the \`${W}\` skill and run`:`Run`} ${e.newCommand} to add a bundle from a template, then adapt the policy document tree and input/output contract to the intended application.`}function q(e,n){return{version:e.version,command:e.command,applied:n.applied,dryRun:n.dryRun,targetDirectory:e.targetDirectory,manifestPath:e.manifestPath,changes:e.changes.map(e=>t(n.cwd,e)),warnings:e.warnings,nextSteps:e.nextSteps,features:[...e.features],aiHandoff:n.aiHandoff,tools:n.tools}}const J={name:W,displayName:`Policy Engine`,owner:`@transcend-io/cli`,files:G};function Y(e,t){let n=new Set(d().map(({path:t})=>N(e.targetDirectory,t))),r=new Set(t.features);return r.has(R.Editor)&&(n.add(N(e.projectRoot,`.vscode`,`settings.json`)),n.add(N(e.projectRoot,`.vscode`,`extensions.json`)),n.add(N(e.projectRoot,`.vscode`,`tasks.json`))),r.has(R.Skill)&&a(e.projectRoot,e.existingSkillDirectories,J).forEach(e=>n.add(e)),r.has(R.Ci)&&e.repositoryRoot&&e.usesGithub&&n.add(N(e.repositoryRoot,j)),[...n].sort((e,t)=>e.localeCompare(t))}function X(e,t){let n=F(e,t);if(n===`..`||n.startsWith(`..${I}`)||M(n))throw Error(`Refusing to modify path outside project root: ${t}`)}function ie(e){let t=new Set([`${h}/input.json`]);return e.forEach(({path:e})=>{t.add(e);let n=P.dirname(e);for(;n!==`.`;)t.add(n),n=P.dirname(n)}),t}function Z(e,t,n){let r=s({snapshot:u(t.snapshots,n.path),after:n.contents,description:n.description,...n.createOnly===void 0?{}:{createOnly:n.createOnly}});r?e.changes.push(r):e.unchanged.push(n.path)}function ae(e,t,n,r,a,o){Z(e,t,{path:n,contents:r.contents,description:a}),e.warnings.push(...r.warnings.map(e=>`${e} (${i(o,n)})`))}function oe(e,t){let{state:n}=e,r=d(),a=`transcend policy new`,s={version:3,command:`init`,rootDirectory:n.projectRoot,targetDirectory:n.targetDirectory,manifestPath:n.targetDirectory,changes:[],unchanged:[],warnings:[],nextSteps:[a],features:[...t.features]},l=Y(n,t);if(X(n.projectRoot,n.targetDirectory),l.forEach(e=>X(n.projectRoot,e)),n.relativeFilePaths.length===0)s.directoryPreconditions=[{path:n.targetDirectory,relativePaths:[...n.relativePaths]}],r.forEach(t=>{let r=N(n.targetDirectory,t.path);if(o(e.snapshots,r).kind!==`absent`)throw Error(`Expected an empty policy target, but found an entry at: ${r}`);Z(s,e,{path:r,contents:t.contents,description:t.description,createOnly:!0})});else{let t=!0;r.forEach(r=>{let a=N(n.targetDirectory,r.path),c=o(e.snapshots,a);if(c.kind===`file`&&c.contents===r.contents){s.unchanged.push(a);return}t=!1,c.kind!==`absent`&&(s.unchanged.push(a),s.warnings.push(`Existing policy scaffold path was left unchanged: ${i(n.invocationDirectory,a)}`))});let c=ie(r),l=n.relativeFilePaths.some(e=>!c.has(e));(!t||l)&&s.warnings.push(`Existing policy target contains custom or partial content, so no workspace files were added or overwritten. Review ${i(n.invocationDirectory,n.targetDirectory)} manually, then run \`${a}\`.`)}let u=new Set(t.features),f=n.projectRoot;if(u.has(R.Editor)){let t=N(f,`.vscode`,`settings.json`),r=N(f,`.vscode`,`extensions.json`),a=N(f,`.vscode`,`tasks.json`);[{path:t,description:`Merge strict target-scoped OPA and Rego editor settings`,merge:(e,t,n)=>ee(e,t,n)},{path:r,description:`Recommend the OPA extension and discourage its syntax-only conflict`,merge:e=>re(e)},{path:a,description:`Create the VS Code task configuration`,merge:(e,t,n)=>ne(e,t,n)}].forEach(({path:t,description:r,merge:a})=>{let c=o(e.snapshots,t);if(c.kind!==`absent`&&c.kind!==`file`){s.unchanged.push(t),s.warnings.push(`Existing VS Code artifact is not a regular file and was left unchanged: ${i(n.invocationDirectory,t)}`);return}ae(s,e,t,a(c.kind===`file`?c.contents:null,f,n.targetDirectory),r,n.invocationDirectory)})}if(u.has(R.Skill)){let t=c({rootDirectory:f,existingDirectories:n.existingSkillDirectories,snapshots:e.snapshots,skill:J,preserveModified:!0});s.changes.push(...t.changes),s.unchanged.push(...t.unchanged),s.warnings.push(...t.warnings.map(e=>t.unchanged.reduce((e,t)=>e.replace(t,i(n.invocationDirectory,t)),e)))}if(u.has(R.Ci))if(!n.repositoryRoot||!n.usesGithub)s.warnings.push(`GitHub Actions setup was selected, but this target is not inside a detected GitHub repository.`);else{let r=N(n.repositoryRoot,j),a=F(n.repositoryRoot,n.targetDirectory).split(I).join(`/`)||`.`,c=te({cliVersion:t.cliVersion,workspaceDirectory:a,bundleDirectories:[]}),l=o(e.snapshots,r);l.kind===`absent`?Z(s,e,{path:r,contents:c,description:`Add credential-free Policy Engine validation`,createOnly:!0}):l.kind===`file`&&l.contents===c?s.unchanged.push(r):(s.unchanged.push(r),s.warnings.push(`Existing GitHub Actions workflow was left unchanged: ${i(n.invocationDirectory,r)}. Adapt it manually to validate each policy bundle.`))}return s.changes.forEach(({path:e})=>X(n.projectRoot,e)),s}const se={[R.Editor]:`VS Code settings and lint task`,[R.Skill]:`Policy Engine Agent Skill`,[R.Ci]:`Validation-only GitHub Actions`},ce=Object.values(R);function Q(e,t){let n=[t.stdout.trim(),t.stderr.trim()].filter(Boolean).join(`
+`),r=e===`OPA`?x:g;return`${e===`OPA`?`OPA 1.x`:`Regal ${C} or newer`} is required, but \`${e.toLowerCase()} version\` exited with code ${t.code}${n?`: ${n}`:`.`} Install or upgrade it using the official instructions: ${r}`}async function le(e,t,n){let r={opa:null,regal:null},i=[],a=await n(`opa`,[`version`],{cwd:t},e);if(a.error?.code===`ENOENT`)i.push(v);else{let e=`${a.stdout}\n${a.stderr}`,t=_(e);a.code===0?t?i.push(t):r.opa=S(e).version:i.push(t??Q(`OPA`,a))}let o=await n(`regal`,[`version`],{cwd:t},e);if(o.error?.code===`ENOENT`)i.push(b);else{let e=`${o.stdout}\n${o.stderr}`,t=y(e,C,`the generated OPA ${f} capabilities configuration`);o.code===0?t?i.push(t):r.regal=S(e).version:i.push(t??Q(`Regal`,o))}return{tools:r,warnings:i}}async function $(t,a=m,o=k){w(this.process);try{let s=await le(this,this.process.cwd(),o),c=p(this,a),u=new E(this),d=D(t,this.process.stdin.isTTY,this.process.stderr.isTTY),f=await T(u,{features:ce,labels:se,enabled:{[R.Editor]:t.editor,[R.Skill]:t.skill,[R.Ci]:t.ci},interactive:d}),m=Y(c,{features:f}),h=oe({state:c,snapshots:l(this,c.projectRoot,m)},{features:f,cliVersion:e});h.warnings.push(...s.warnings),t.json||this.logger.info(r(h,{cwd:this.process.cwd(),title:`Policy initialization plan`,details:[{label:`Target`,path:h.targetDirectory}]}));let g=h.changes.length===0||t.dryRun;if(h.changes.length>0&&!t.dryRun)if(t.yes)g=!0;else if(d)g=await u.confirm(`Apply this complete plan?`,!0);else throw Error(`The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.`);g&&!t.dryRun&&h.changes.length>0&&await A(this,h);let _=g&&!t.dryRun&&h.changes.length>0,v=g&&!t.dryRun,y=K({projectPath:n(i(this.process.cwd(),c.targetDirectory)),hasSkill:v&&f.includes(R.Skill),newCommand:h.nextSteps[0]}),b=q(h,{applied:_,dryRun:t.dryRun,cwd:this.process.cwd(),aiHandoff:y,tools:s.tools});if(t.json){this.process.stdout.write(`${JSON.stringify(b)}\n`);return}if(t.dryRun){this.logger.info(L.yellow(`Dry run complete. No changes were written.`));return}if(!g){this.logger.info(L.yellow(`No changes applied.`));return}if(h.changes.length===0){let e=h.warnings.length===s.warnings.length?`Policy project is already initialized.`:`Existing policy project was left unchanged.`;this.logger.info(L.green(e))}else this.logger.info(L.green(`Policy project initialized.`));h.nextSteps.length>0&&(this.logger.info(`\n${L.bold(`Next steps`)}`),h.nextSteps.forEach(e=>this.logger.info(e))),this.logger.info(`\n${L.bold(`AI handoff — paste into your coding agent`)}`),this.logger.info(y)}catch(e){if(e instanceof O)return this.process.exit(130);throw e}}export{$ as init};
+//# sourceMappingURL=impl-B-Oe7DcE2.mjs.map