@transcend-io/cli 12.0.0 → 12.1.0

package/dist/{policy-project-discovery-C29UxWwt.mjs → policy-project-discovery-B4cFXUlA.mjs}

@@ -1,36 +1,37 @@
-import{n as e,r as t}from"./project-discovery-CWRjlFnC.mjs";import{join as n,resolve as r}from"node:path";import i from"js-yaml";var a=`https://raw.githubusercontent.com/transcend-io/tools/main/packages/cli/schema/permissions-policy-input.json`,o=[{preferences:[{name:`Analytics`,choice:!0,days_since_choice:42},{name:`SaleOfInfo`,choice:null}],context:{region:`US-CA`}}],s={$schema:`http://json-schema.org/draft-07/schema#`,$id:a,title:`Permissions API policy input`,description:"JSON document Sombra posts as `{ input }` when evaluating a Permissions policy bundle via the OPA Data API.",type:`object`,additionalProperties:!1,required:[`preferences`,`context`],properties:{preferences:{type:`array`,description:`Purpose preference rows from Preference Store for the current subject.`,items:{type:`object`,additionalProperties:!1,required:[`name`,`choice`],properties:{name:{type:`string`,description:`Purpose slug (for example Analytics or SaleOfInfo).`},choice:{type:[`boolean`,`null`],description:`true when opted in, false when opted out, or null when unset.`},days_since_choice:{type:`integer`,minimum:0,description:`Whole days since the preference was last set. Omitted when no timestamp is available.`}}}},context:{type:`object`,description:`Caller-supplied context for the decision (for example region). Use an empty object when none is provided.`,additionalProperties:!0}},examples:o};const c=`1.18.2`,l=`example`,u=`${l}-bundle`,d=`.manifest`,f=`permissions`,p=`transcend.io`,m=[`generic`,`permissions`];function h(e,t=`generic`){return`{
+import{g as e}from"./constants-BlKpAm3R.mjs";import{n as t,r as n}from"./project-discovery-CWRjlFnC.mjs";import{join as r,resolve as i}from"node:path";import a from"js-yaml";var o=`https://raw.githubusercontent.com/transcend-io/tools/main/packages/cli/schema/permissions-policy-input.json`,s=[{preferences:[{name:`Analytics`,choice:!0,days_since_choice:42},{name:`SaleOfInfo`,choice:null}],context:{region:`US-CA`}}],c={$schema:`http://json-schema.org/draft-07/schema#`,$id:o,title:`Permissions API policy input`,description:"JSON document Sombra posts as `{ input }` when evaluating a Permissions policy bundle via the OPA Data API.",type:`object`,additionalProperties:!1,required:[`preferences`,`context`],properties:{preferences:{type:`array`,description:`Purpose preference rows from Preference Store for the current subject.`,items:{type:`object`,additionalProperties:!1,required:[`name`,`choice`],properties:{name:{type:`string`,description:`Purpose slug (for example Analytics or SaleOfInfo).`},choice:{type:[`boolean`,`null`],description:`true when opted in, false when opted out, or null when unset.`},days_since_choice:{type:`integer`,minimum:0,description:`Whole days since the preference was last set. Omitted when no timestamp is available.`}}}},context:{type:`object`,description:`Caller-supplied context for the decision (for example region). Use an empty object when none is provided.`,additionalProperties:!0}},examples:s};const l=o,u=`1.18.2`,d=`example`,f=`${d}-bundle`,p=`input.schema.json`,m=`.manifest`,h=`permissions`,g=`transcend.io`,_={Generic:`generic`,Permissions:`permissions`},v=[_.Generic,_.Permissions];function y(t,n=_.Generic){return`{
   "$schema": "https://openpolicyagent.org/schemas/bundle/v1/manifest.schema.json",
   "revision": "",
-  "roots": ["${e}"],
+  "roots": ["${t}"],
   "rego_version": 1,
   "metadata": {
-    "${p}": {
-      "template": "${t}"
+    "${g}": {
+      "template": "${n}",
+      "templateVersion": "${e}"
     }
   }
 }
-`}h(l,`generic`);function g(e){return`# Workspace-level Regal config for both publishable bundles under this tree.
+`}y(d,_.Generic);function b(e){return`# Workspace-level Regal config for both publishable bundles under this tree.
 # \`project.roots\` are package-path prefixes (same meaning as OPA \`.manifest\`
 # roots), not filesystem folders. Each bundle also has its own \`.manifest\`.
 capabilities:
   from:
     engine: opa
-    version: v${c}
+    version: v${u}
 project:
 ${e.length===0?`  roots: []`:`  roots:\n${e.map(e=>`    - ${e}`).join(`
 `)}`}
   rego-version: 1
-`}function _(e,t){if(e.trim().length===0){let e=[t];return{contents:g(e),roots:e}}let n;try{n=i.load(e)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`.regal/config.yaml is not valid YAML: ${t}`)}if(n==null){let e=[t];return{contents:g(e),roots:e}}if(typeof n!=`object`||Array.isArray(n))throw Error(`.regal/config.yaml must be a YAML mapping at the top level.`);let r={...n},a=r.project;if(a!=null&&(typeof a!=`object`||Array.isArray(a)))throw Error(`.regal/config.yaml project must be a YAML mapping when present.`);let o={...a??{}},s=o.roots,l;if(s===void 0)l=[t];else if(Array.isArray(s)&&s.every(e=>typeof e==`string`))l=[...new Set([...s,t])].sort((e,t)=>e.localeCompare(t));else throw Error(".regal/config.yaml project.roots must be an array of strings. Fix the Regal config before running `transcend policy new`.");o.roots=l,o[`rego-version`]===void 0&&(o[`rego-version`]=1),r.project=o,r.capabilities===void 0&&(r.capabilities={from:{engine:`opa`,version:`v${c}`}});let u=i.dump(r,{lineWidth:-1,noRefs:!0,sortKeys:!1});return{contents:u.endsWith(`
-`)?u:`${u}\n`,roots:l}}g([l]);const v=g([]);`${l}${l}`,`${l}${l}`;const y=`{
+`}function x(e,t){if(e.trim().length===0){let e=[t];return{contents:b(e),roots:e}}let n;try{n=a.load(e)}catch(e){let t=e instanceof Error?e.message:String(e);throw Error(`.regal/config.yaml is not valid YAML: ${t}`)}if(n==null){let e=[t];return{contents:b(e),roots:e}}if(typeof n!=`object`||Array.isArray(n))throw Error(`.regal/config.yaml must be a YAML mapping at the top level.`);let r={...n},i=r.project;if(i!=null&&(typeof i!=`object`||Array.isArray(i)))throw Error(`.regal/config.yaml project must be a YAML mapping when present.`);let o={...i??{}},s=o.roots,c;if(s===void 0)c=[t];else if(Array.isArray(s)&&s.every(e=>typeof e==`string`))c=[...new Set([...s,t])].sort((e,t)=>e.localeCompare(t));else throw Error(".regal/config.yaml project.roots must be an array of strings. Fix the Regal config before running `transcend policy new`.");o.roots=c,o[`rego-version`]===void 0&&(o[`rego-version`]=1),r.project=o,r.capabilities===void 0&&(r.capabilities={from:{engine:`opa`,version:`v${u}`}});let l=a.dump(r,{lineWidth:-1,noRefs:!0,sortKeys:!1});return{contents:l.endsWith(`
+`)?l:`${l}\n`,roots:c}}b([d]);const S=b([]);`${d}`,`${d}${d}`;const C=`{
   "subject": {
     "trusted": false
   }
 }
-`;`${l}`;const b=`# Local policy evaluation input (VS Code / Regal look for input.json here).
+`;`${d}`;const w=`# Local policy evaluation input (VS Code / Regal look for input.json here).
 /input.json
-`,x=`# Transcend Policy
+`,T=`# Transcend Policy
 
-Multi-bundle workspace for [Transcend Policy Engine](https://docs.transcend.io) bundles
+Multi-bundle workspace for Transcend Policy Engine bundles
 (OPA / Rego v1). Requires **Transcend CLI ≥ 11** (\`transcend policy --help\`
 should list \`init\`, \`new\`, and positional \`[directory]\` args).
 
@@ -50,8 +51,8 @@ transcend policy new --template generic # add a bundle from a template
 transcend policy lint --noInteractive
 transcend policy test
 transcend policy eval transcend/policy/example-bundle \\
-  --package data.example.result \\
-  --input transcend/policy/example-bundle/input.json
+  --package=data.example.result \\
+  --input=transcend/policy/example-bundle/input.json
 \`\`\`
 
 \`policy new\` also writes a gitignored \`input.json\` (copy of \`input.example.json\`)
@@ -67,28 +68,44 @@ transcend/policy/
     example/                    # package root (matches .manifest roots)
     input.example.json
     input.json                  # local only (gitignored)
-  schemas/                      # input JSON Schemas (editor + opa check -s)
+    input.schema.json           # input JSON Schema (editor + opa --schema)
   .regal/config.yaml
 \`\`\`
 
 Replace or delete example bundles when you have a real policy. Publish each
-bundle separately (\`transcend policy publish --bundle-name … <dir>\`).
+bundle separately (\`transcend policy publish --remote-bundle-name … <dir>\`).
 
-## Bundle names and Permissions
+## Permissions API
+
+Scaffold the Permissions starter, then simulate the query Sombra runs:
+
+\`\`\`sh
+transcend policy new \\
+  --template permissions \\
+  --name ${h} \\
+  --bundle-dir ${h}-bundle \\
+  --yes
+
+transcend policy eval transcend/policy/${h}-bundle \\
+  --package=data.${h}.purposes \\
+  --input=transcend/policy/${h}-bundle/input.json \\
+  --schema=transcend/policy/${h}-bundle/input.schema.json
+\`\`\`
 
 Upload does **not** distinguish bundle kinds. What makes a bundle “Permissions”
 is the remote name plus where Sombra queries it:
 
 - **Permissions API** always loads the fixed remote bundle name
-  \`${f}\`. Publish that starter with
-  \`--bundle-name=${f}\`.
-- **Generic / decide** bundles use any other \`--bundle-name\` and the decide
+  \`${h}\`. Publish that starter with
+  \`--remote-bundle-name=${h}\`.
+- **Generic / decide** bundles use any other \`--remote-bundle-name\` and the decide
   path.
 
 Scaffolded \`.manifest\` files may include \`metadata.transcend.io.template\`
-(\`generic\` or \`permissions\`) as an authoring hint. Upload ignores it;
-\`policy publish\` may warn when the hint and \`--bundle-name\` disagree.
-`;`${u}${l}`,`${u}${l}`,`${u}${d}`,`${c}`,`${l}`,`${u}`,`${u}`;const S=[{path:`.regal/config.yaml`,contents:v,description:`Pin strict Rego v1 linting to OPA ${c} capabilities`},{path:`README.md`,contents:x,description:`Create the concise multi-bundle workspace guide`}];function C(){return S.map(e=>({...e}))}const w={generic:`Generic example`,permissions:`Permission API starter`},T={generic:`example`,permissions:f};function E(e){return`${e}-bundle`}function D(e){let t=E(e);return[{path:`${t}/${d}`,contents:h(e,`generic`),description:`Create the OPA bundle .manifest`},{path:`schemas/${e}/input.json`,contents:`{
+(\`generic\` or \`permissions\`) and \`templateVersion\` (the \`@transcend-io/cli\`
+version that generated the scaffold) as authoring hints. Upload ignores them;
+\`policy publish\` may warn when the template hint and \`--remote-bundle-name\` disagree.
+`;`${f}${d}`,`${f}${d}`,`${f}${m}`,`${u}`,`${f}${p}`,`${f}`,`${f}`;const E=[{path:`.regal/config.yaml`,contents:S,description:`Pin strict Rego v1 linting to OPA ${u} capabilities`},{path:`README.md`,contents:T,description:`Create the concise multi-bundle workspace guide`}];function D(){return E.map(e=>({...e}))}const O={[_.Generic]:`Generic example`,[_.Permissions]:`Permission API starter`},k={[_.Generic]:`example`,[_.Permissions]:h};function A(e){return`${e}-bundle`}function j(e){return e?e===`.`||e===`..`||e.includes(`/`)||e.includes(`\\`)?`Bundle directory must be a single path segment (no slashes).`:/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(e)?e.length>128?`Bundle directory cannot exceed 128 characters.`:!0:`Bundle directory must be alphanumeric (plus ., _, -), e.g. "my-bundle".`:`Enter a bundle directory name.`}function M(e,t=A(e)){let n=t;return[{path:`${n}/${m}`,contents:y(e,_.Generic),description:`Create the OPA bundle .manifest`},{path:`${n}/${p}`,contents:`{
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://transcend.io/policy-schemas/${e}/input.json",
   "title": "${e===`example`?`Example policy input`:`${e} policy input`}",
@@ -108,14 +125,12 @@ Scaffolded \`.manifest\` files may include \`metadata.transcend.io.template\`
     }
   }
 }
-`,description:`Create the input JSON Schema for the ${e} bundle`},{path:`${t}/${e}/result/result.rego`,contents:`# METADATA
+`,description:`Create the input JSON Schema for the ${e} bundle`},{path:`${n}/${e}/result/result.rego`,contents:`# METADATA
 # title: ${e===`example`?`Disposable example result`:`${e} result`}
 # description: |
 #   A fail-closed ${e===`example`?`teaching `:``}entrypoint. Replace this ${e===`example`?`example `:``}with the document
 #   tree and result contract required by your application.
 # scope: package
-# schemas:
-#   - input: schema.${e}.input
 # entrypoint: true
 package ${e}.result
 
@@ -132,7 +147,7 @@ default reason_code := "untrusted_or_invalid_input"
 reason_code := "trusted_subject" if {
 \tdecision == "allow"
 }
-`,description:`Create a documented fail-closed result entrypoint`},{path:`${t}/${e}/result/result_test.rego`,contents:`package ${e}.result_test
+`,description:`Create a documented fail-closed result entrypoint`},{path:`${n}/${e}/result/result_test.rego`,contents:`package ${e}.result_test
 
 import data.${e}.result
 import rego.v1
@@ -151,24 +166,22 @@ test_allows_trusted_subject if {
 \tresult.decision == "allow" with input as {"subject": {"trusted": true}}
 \tresult.reason_code == "trusted_subject" with input as {"subject": {"trusted": true}}
 }
-`,description:`Create executable tests for allow and fail-closed decisions`},{path:`${t}/input.example.json`,contents:y,description:`Create a sanitized local evaluation input example`},{path:`${t}/input.json`,contents:y,description:`Create a local evaluation input (gitignored copy of the example)`},{path:`${t}/.gitignore`,contents:b,description:`Ignore only the private local input file`}]}function O(){return`${JSON.stringify(s,null,2)}\n`}function k(){let[e]=o;if(!e)throw Error(`permissions-policy-input.json must declare at least one example`);return`${JSON.stringify(e,null,2)}\n`}function A(e){let t=E(e),n=k();return[{path:`${t}/${d}`,contents:h(e,`permissions`),description:`Create the OPA bundle .manifest`},{path:`schemas/${e}/input.json`,contents:O(),description:`Create the input JSON Schema for the ${e} bundle (from published permissions-policy-input.json)`},{path:`${t}/${e}/config/config.rego`,contents:`# METADATA
+`,description:`Create executable tests for allow and fail-closed decisions`},{path:`${n}/input.example.json`,contents:C,description:`Create a sanitized local evaluation input example`},{path:`${n}/input.json`,contents:C,description:`Create a local evaluation input (gitignored copy of the example)`},{path:`${n}/.gitignore`,contents:w,description:`Ignore only the private local input file`}]}function N(){return`${JSON.stringify(c,null,2)}\n`}function P(){let[e]=s;if(!e)throw Error(`permissions-policy-input.json must declare at least one example`);return`${JSON.stringify(e,null,2)}\n`}function F(e,t=A(e)){let n=t,r=P();return[{path:`${n}/${m}`,contents:y(e,_.Permissions),description:`Create the OPA bundle .manifest`},{path:`${n}/${p}`,contents:N(),description:`Create the input JSON Schema for the ${e} bundle (from published permissions-policy-input.json)`},{path:`${n}/${e}/config/config.rego`,contents:`# METADATA
 # title: Permissions config
 # description: |
 #   Static bundle configuration. Values come from data.json in this directory.
 package ${e}.config
 
 import rego.v1
-`,description:`Create the static bundle configuration package`},{path:`${t}/${e}/config/data.json`,contents:`{
+`,description:`Create the static bundle configuration package`},{path:`${n}/${e}/config/data.json`,contents:`{
   "default_consent_allowed": true,
   "purposes": [
     "Analytics",
-    "SaleOfInfo",
-    "Marketing",
-    "Personalization"
+    "SaleOfInfo"
   ],
   "default_consent": {}
 }
-`,description:`Create the static purpose configuration data`},{path:`${t}/${e}/helpers/preference/preference.rego`,contents:`# METADATA
+`,description:`Create the static purpose configuration data`},{path:`${n}/${e}/helpers/preference/preference.rego`,contents:`# METADATA
 # title: Purpose preference resolution
 # description: |
 #   Resolves the subject's recorded choice for one purpose from the OPA
@@ -218,7 +231,7 @@ undecided(name) if {
 \tnot enabled(name)
 \tnot disabled(name)
 }
-`,description:`Create purpose preference resolution helpers`},{path:`${t}/${e}/helpers/preference/preference_test.rego`,contents:`# Mechanical tests for purpose preference resolution.
+`,description:`Create purpose preference resolution helpers`},{path:`${n}/${e}/helpers/preference/preference_test.rego`,contents:`# Mechanical tests for purpose preference resolution.
 # Policy outcomes are tested beside the public entrypoint.
 package ${e}.helpers.preference_test
 
@@ -232,18 +245,18 @@ test_treats_an_absent_preferences_array_as_no_recorded_choices if {
 \tfixture := {}
 
 \tpreference.source_available with input as fixture
-\tpreference.undecided("Marketing") with input as fixture
+\tpreference.undecided("Analytics") with input as fixture
 }
 
 test_accepts_an_empty_preferences_array if {
 \tfixture := given([])
 
 \tpreference.source_available with input as fixture
-\tpreference.undecided("Marketing") with input as fixture
+\tpreference.undecided("Analytics") with input as fixture
 }
 
 test_reports_a_non_array_preferences_as_unavailable if {
-\tnot preference.source_available with input as {"preferences": {"Marketing": true}}
+\tnot preference.source_available with input as {"preferences": {"Analytics": true}}
 }
 
 test_reports_entries_without_a_usable_name_as_unavailable if {
@@ -254,35 +267,35 @@ test_reports_entries_without_a_usable_name_as_unavailable if {
 
 test_distinguishes_enabled_and_disabled_choices if {
 \tfixture := given([
-\t\t{"name": "Marketing", "choice": true},
-\t\t{"name": "Analytics", "choice": false},
+\t\t{"name": "Analytics", "choice": true},
+\t\t{"name": "SaleOfInfo", "choice": false},
 \t])
 
-\tpreference.enabled("Marketing") with input as fixture
-\tpreference.disabled("Analytics") with input as fixture
-\tpreference.decided("Marketing") with input as fixture
+\tpreference.enabled("Analytics") with input as fixture
+\tpreference.disabled("SaleOfInfo") with input as fixture
 \tpreference.decided("Analytics") with input as fixture
-\tnot preference.undecided("Marketing") with input as fixture
+\tpreference.decided("SaleOfInfo") with input as fixture
+\tnot preference.undecided("Analytics") with input as fixture
 }
 
 test_treats_a_null_choice_as_undecided if {
-\tfixture := given([{"name": "Marketing", "choice": null}])
+\tfixture := given([{"name": "Analytics", "choice": null}])
 
-\tpreference.undecided("Marketing") with input as fixture
-\tnot preference.decided("Marketing") with input as fixture
+\tpreference.undecided("Analytics") with input as fixture
+\tnot preference.decided("Analytics") with input as fixture
 }
 
 test_treats_an_absent_choice_key_as_undecided if {
-\tfixture := given([{"name": "Marketing", "channel": "email"}])
+\tfixture := given([{"name": "Analytics", "channel": "email"}])
 
-\tpreference.undecided("Marketing") with input as fixture
+\tpreference.undecided("Analytics") with input as fixture
 }
 
 test_treats_a_non_boolean_choice_as_undecided if {
-\tfixture := given([{"name": "Personalization", "choice": "Daily"}])
+\tfixture := given([{"name": "SaleOfInfo", "choice": "Daily"}])
 
-\tpreference.undecided("Personalization") with input as fixture
-\tnot preference.decided("Personalization") with input as fixture
+\tpreference.undecided("SaleOfInfo") with input as fixture
+\tnot preference.decided("SaleOfInfo") with input as fixture
 }
 
 # Sombra dedupes by purpose before sending; last-wins keeps the bundle correct
@@ -301,27 +314,16 @@ test_last_wins_on_duplicate_entries if {
 # rather than treated as a choice.
 test_ignores_fields_beyond_the_recorded_choice if {
 \tfixture := given([{
-\t\t"name": "Marketing",
+\t\t"name": "Analytics",
 \t\t"choice": true,
 \t\t"evidence": "consent_banner",
 \t\t"days_since_choice": 45,
 \t\t"channel": "email",
 \t}])
 
-\tpreference.enabled("Marketing") with input as fixture
+\tpreference.enabled("Analytics") with input as fixture
 }
-`,description:`Create preference resolution tests`},{path:`${t}/${e}/main.rego`,contents:`# METADATA
-# title: Permissions bundle root
-# description: |
-#   Declares the Permissions envelope schema for this package and all
-#   subpackages (helpers, purposes, and static config data).
-# scope: subpackages
-# schemas:
-#   - input: schema.${e}.input
-package ${e}
-
-import rego.v1
-`,description:`Create the bundle root package with schema declaration`},{path:`${t}/${e}/purposes/analytics/analytics.rego`,contents:`# METADATA
+`,description:`Create preference resolution tests`},{path:`${n}/${e}/purposes/analytics/analytics.rego`,contents:`# METADATA
 # title: Analytics purpose decision
 # description: |
 #   The Analytics purpose's verdict as a \`result\` document
@@ -357,7 +359,7 @@ result := {
 } if {
 \tpreference.undecided("Analytics")
 }
-`,description:`Create the analytics purpose decision rule`},{path:`${t}/${e}/purposes/analytics/analytics_test.rego`,contents:`# Policy outcomes for the Analytics purpose (the queried document).
+`,description:`Create the analytics purpose decision rule`},{path:`${n}/${e}/purposes/analytics/analytics_test.rego`,contents:`# Policy outcomes for the Analytics purpose (the queried document).
 package ${e}.purposes.analytics_test
 
 import rego.v1
@@ -415,7 +417,7 @@ test_malformed_preferences_are_treated_as_undecided if {
 \t\t"reason_code": "default_allow",
 \t}
 }
-`,description:`Create analytics purpose decision tests`},{path:`${t}/${e}/purposes/entrypoint.rego`,contents:`# METADATA
+`,description:`Create analytics purpose decision tests`},{path:`${n}/${e}/purposes/entrypoint.rego`,contents:`# METADATA
 # title: Purpose decisions
 # description: Returns each purpose's decision and reason code.
 # scope: package
@@ -423,5 +425,6 @@ test_malformed_preferences_are_treated_as_undecided if {
 package ${e}.purposes
 
 import rego.v1
-`,description:`Create the purposes entrypoint`},{path:`${t}/input.example.json`,contents:n,description:`Create a sanitized permissions evaluation input example`},{path:`${t}/input.json`,contents:n,description:`Create a local evaluation input (gitignored copy of the example)`},{path:`${t}/.gitignore`,contents:b,description:`Ignore only the private local input file`}]}function j(e,t){switch(e){case`generic`:return D(t);case`permissions`:return A(t);default:throw Error(`Unknown policy template: ${String(e)}`)}}const M=`transcend/policy`;function N(e,t=M){return r(e,t)}function P(e,t){if(!e.fs.existsSync(t)||!e.fs.statSync(t).isDirectory())return[];let r=n(t,d);return e.fs.existsSync(r)&&e.fs.statSync(r).isFile()?[t]:e.fs.readdirSync(t,{withFileTypes:!0}).filter(e=>e.isDirectory()).map(e=>n(t,e.name)).filter(t=>{let r=n(t,d);return e.fs.existsSync(r)&&e.fs.statSync(r).isFile()}).sort((e,t)=>e.localeCompare(t))}function F(n,r=M){let i=n.process.cwd(),a=N(i,r);if(n.fs.existsSync(a)&&!n.fs.statSync(a).isDirectory())throw Error(`Policy target is not a directory: ${a}`);return{invocationDirectory:i,targetDirectory:a,...t(n,{invocationDirectory:i,targetDirectory:a,standaloneProjectRoot:i}),relativePaths:e(n,a),relativeFilePaths:e(n,a,{includeDirectories:!1})}}export{_,f as a,u as c,T as d,m as f,C as g,j as h,N as i,c as l,E as m,P as n,d as o,w as p,F as r,p as s,M as t,l as u};
-//# sourceMappingURL=policy-project-discovery-C29UxWwt.mjs.map
+`,description:`Create the purposes entrypoint`},{path:`${n}/input.example.json`,contents:r,description:`Create a sanitized permissions evaluation input example`},{path:`${n}/input.json`,contents:r,description:`Create a local evaluation input (gitignored copy of the example)`},{path:`${n}/.gitignore`,contents:w,description:`Ignore only the private local input file`}]}function I(e,t,n=A(t)){switch(e){case _.Generic:return M(t,n);case _.Permissions:return F(t,n);default:throw Error(`Unknown policy template: ${String(e)}`)}}function L(e){let{bundleDirectory:t,root:n,template:r}=e,i=r===_.Permissions?`data.${n}.purposes`:`data.${n}.result`;return[`transcend policy eval ${t} \\`,`  --package=${i} \\`,`  --input=${t}/input.json \\`,`  --schema=${t}/${p}`].join(`
+`)}const R=`transcend/policy`;function z(e,t=R){return i(e,t)}function B(e,t){if(!e.fs.existsSync(t)||!e.fs.statSync(t).isDirectory())return[];let n=r(t,m);return e.fs.existsSync(n)&&e.fs.statSync(n).isFile()?[t]:e.fs.readdirSync(t,{withFileTypes:!0}).filter(e=>e.isDirectory()).map(e=>r(t,e.name)).filter(t=>{let n=r(t,m);return e.fs.existsSync(n)&&e.fs.statSync(n).isFile()}).sort((e,t)=>e.localeCompare(t))}function V(e,r=R){let i=e.process.cwd(),a=z(i,r);if(e.fs.existsSync(a)&&!e.fs.statSync(a).isDirectory())throw Error(`Policy target is not a directory: ${a}`);return{invocationDirectory:i,targetDirectory:a,...n(e,{invocationDirectory:i,targetDirectory:a,standaloneProjectRoot:i}),relativePaths:t(e,a),relativeFilePaths:t(e,a,{includeDirectories:!1})}}export{j as S,A as _,h as a,D as b,m as c,u as d,d as f,_ as g,O as h,z as i,g as l,v as m,B as n,l as o,k as p,V as r,p as s,R as t,f as u,L as v,x,I as y};
+//# sourceMappingURL=policy-project-discovery-B4cFXUlA.mjs.map

package/dist/policy-project-discovery-B4cFXUlA.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-project-discovery-B4cFXUlA.mjs","names":["permissionsPolicyInputSchema.$id","CLI_VERSION","permissionsPolicyInputSchema","permissionsPolicyInputSchema.examples"],"sources":["../schema/permissions-policy-input.json","../src/lib/policy/policy-scaffold-templates.ts","../src/lib/policy/policy-project-discovery.ts"],"sourcesContent":["","import yaml from 'js-yaml';\n\nimport permissionsPolicyInputSchema from '../../../schema/permissions-policy-input.json' with { type: 'json' };\nimport { version as CLI_VERSION } from '../../constants.js';\n\n/** Published Permissions API OPA input schema `$id` (raw GitHub URL). */\nexport const PERMISSIONS_POLICY_INPUT_SCHEMA_ID = permissionsPolicyInputSchema.$id;\n\n/** OPA version targeted by generated policy authoring configuration. */\nexport const POLICY_STARTER_OPA_VERSION = '1.18.2';\n\n/**\n * Package-path prefix for the disposable starter bundle.\n *\n * Matches OPA `.manifest` `roots` and Regal `project.roots` (not a filesystem\n * folder name by itself). The default publish directory is `{root}-bundle/`;\n * `policy new --bundle-dir` can override that basename.\n */\nexport const POLICY_STARTER_ROOT = 'example';\n\n/** Publish directory name for the disposable starter (`{root}-bundle`). */\nexport const POLICY_STARTER_BUNDLE_DIRECTORY = `${POLICY_STARTER_ROOT}-bundle`;\n\n/** Input JSON Schema filename written beside each publish directory's fixtures. */\nexport const POLICY_INPUT_SCHEMA_FILENAME = 'input.schema.json';\n\n/** One deterministic file in the safe policy starter. */\nexport interface PolicyStarterFile {\n  /** POSIX-style path relative to the policy workspace directory. */\n  path: string;\n  /** Complete UTF-8 file contents. */\n  contents: string;\n  /** Human-readable reason shown in the plan. */\n  description: string;\n}\n\n/** OPA bundle manifest filename used for local authoring and upload. */\nexport const POLICY_MANIFEST_FILENAME = '.manifest';\n\n/**\n * Remote bundle name reserved for Permissions API.\n *\n * Upload treats every bundle the same; Sombra's Permissions API always queries\n * this fixed name (never taken from the request body).\n */\nexport const PERMISSIONS_POLICY_BUNDLE_NAME = 'permissions';\n\n/** OPA `.manifest` `metadata` key for Transcend authoring hints. */\nexport const POLICY_MANIFEST_TRANSCEND_METADATA_KEY = 'transcend.io';\n\n/** Supported policy bundle templates (enum-style constants). */\nexport const PolicyTemplate = {\n  Generic: 'generic',\n  Permissions: 'permissions',\n} as const;\n\n/** Supported policy bundle template names. */\nexport const POLICY_TEMPLATE_NAMES = [PolicyTemplate.Generic, PolicyTemplate.Permissions] as const;\n\n/** A supported policy bundle template name. */\nexport type PolicyTemplateName = (typeof PolicyTemplate)[keyof typeof PolicyTemplate];\n\n/**\n * OPA `.manifest` `metadata.transcend.io` key for the CLI version that\n * generated the scaffold template.\n */\nexport const POLICY_MANIFEST_TEMPLATE_VERSION_KEY = 'templateVersion';\n\n/**\n * Build an OPA bundle manifest for a given root and scaffold template.\n *\n * `metadata.transcend.io.template` and `templateVersion` are authoring hints\n * only — Policy Engine upload does not branch on them. Permissions API still\n * keys off the remote bundle name {@link PERMISSIONS_POLICY_BUNDLE_NAME}.\n * `templateVersion` records the `@transcend-io/cli` package version used to\n * generate the scaffold.\n *\n * @param root - Package root\n * @param template - Scaffold template that produced this bundle\n * @returns Manifest JSON\n */\nexport function buildPolicyManifestTemplate(\n  root: string,\n  template: PolicyTemplateName = PolicyTemplate.Generic,\n): string {\n  return `{\n  \"$schema\": \"https://openpolicyagent.org/schemas/bundle/v1/manifest.schema.json\",\n  \"revision\": \"\",\n  \"roots\": [\"${root}\"],\n  \"rego_version\": 1,\n  \"metadata\": {\n    \"${POLICY_MANIFEST_TRANSCEND_METADATA_KEY}\": {\n      \"template\": \"${template}\",\n      \"${POLICY_MANIFEST_TEMPLATE_VERSION_KEY}\": \"${CLI_VERSION}\"\n    }\n  }\n}\n`;\n}\n\n/** OPA bundle manifest for the disposable starter publish directory. */\nexport const POLICY_MANIFEST_TEMPLATE = buildPolicyManifestTemplate(\n  POLICY_STARTER_ROOT,\n  PolicyTemplate.Generic,\n);\n\n/**\n * Build workspace-level Regal configuration for given roots.\n *\n * `project.roots` are package-path prefixes (same meaning as OPA `.manifest`\n * roots), not filesystem folders.\n *\n * @param roots - Package-path roots\n * @returns YAML configuration\n */\nexport function buildPolicyRegalConfigTemplate(roots: readonly string[]): string {\n  const rootsSection =\n    roots.length === 0\n      ? '  roots: []'\n      : `  roots:\\n${roots.map((root) => `    - ${root}`).join('\\n')}`;\n  return `# Workspace-level Regal config for both publishable bundles under this tree.\n# \\`project.roots\\` are package-path prefixes (same meaning as OPA \\`.manifest\\`\n# roots), not filesystem folders. Each bundle also has its own \\`.manifest\\`.\ncapabilities:\n  from:\n    engine: opa\n    version: v${POLICY_STARTER_OPA_VERSION}\nproject:\n${rootsSection}\n  rego-version: 1\n`;\n}\n\n/**\n * Merge one package-path root into an existing Regal config without wiping\n * unrelated keys (custom rules, ignores, etc.).\n *\n * Comments and key order may be reformatted by the YAML serializer. Invalid\n * `project.roots` shapes throw instead of silently dropping prior roots.\n *\n * @param existingContents - Current `.regal/config.yaml` contents\n * @param rootToAdd - Package-path root to include\n * @returns Updated file contents and the full roots list\n */\nexport function mergePolicyRegalConfigRoots(\n  existingContents: string,\n  rootToAdd: string,\n): { contents: string; roots: string[] } {\n  const trimmed = existingContents.trim();\n  if (trimmed.length === 0) {\n    const roots = [rootToAdd];\n    return { contents: buildPolicyRegalConfigTemplate(roots), roots };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = yaml.load(existingContents);\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new Error(`.regal/config.yaml is not valid YAML: ${detail}`);\n  }\n\n  if (parsed === null || parsed === undefined) {\n    const roots = [rootToAdd];\n    return { contents: buildPolicyRegalConfigTemplate(roots), roots };\n  }\n  if (typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('.regal/config.yaml must be a YAML mapping at the top level.');\n  }\n\n  const config = { ...(parsed as Record<string, unknown>) };\n  const existingProject = config.project;\n  if (\n    existingProject !== undefined &&\n    existingProject !== null &&\n    (typeof existingProject !== 'object' || Array.isArray(existingProject))\n  ) {\n    throw new Error('.regal/config.yaml project must be a YAML mapping when present.');\n  }\n\n  const project: Record<string, unknown> = {\n    ...((existingProject as Record<string, unknown> | undefined) ?? {}),\n  };\n  const existingRoots = project.roots;\n  let roots: string[];\n  if (existingRoots === undefined) {\n    roots = [rootToAdd];\n  } else if (\n    Array.isArray(existingRoots) &&\n    existingRoots.every((root): root is string => typeof root === 'string')\n  ) {\n    roots = [...new Set([...existingRoots, rootToAdd])].sort((left, right) =>\n      left.localeCompare(right),\n    );\n  } else {\n    throw new Error(\n      '.regal/config.yaml project.roots must be an array of strings. ' +\n        'Fix the Regal config before running `transcend policy new`.',\n    );\n  }\n\n  project.roots = roots;\n  if (project['rego-version'] === undefined) {\n    project['rego-version'] = 1;\n  }\n  config.project = project;\n\n  if (config.capabilities === undefined) {\n    config.capabilities = {\n      from: {\n        engine: 'opa',\n        version: `v${POLICY_STARTER_OPA_VERSION}`,\n      },\n    };\n  }\n\n  const dumped = yaml.dump(config, {\n    lineWidth: -1,\n    noRefs: true,\n    sortKeys: false,\n  });\n  return {\n    contents: dumped.endsWith('\\n') ? dumped : `${dumped}\\n`,\n    roots,\n  };\n}\n\n/**\n * Workspace-level Regal configuration.\n *\n * `project.roots` are package-path prefixes (same meaning as OPA `.manifest`\n * roots), not filesystem folders.\n */\nexport const POLICY_REGAL_CONFIG_TEMPLATE = buildPolicyRegalConfigTemplate([POLICY_STARTER_ROOT]);\n\n/** Regal config for an empty workspace with no bundles yet. */\nexport const POLICY_REGAL_CONFIG_EMPTY_TEMPLATE = buildPolicyRegalConfigTemplate([]);\n\n/** Disposable, fail-closed example policy. */\nexport const POLICY_RESULT_REGO_TEMPLATE = `# METADATA\n# title: Disposable example result\n# description: |\n#   A fail-closed teaching entrypoint. Replace this example with the document\n#   tree and result contract required by your application.\n# scope: package\n# entrypoint: true\npackage ${POLICY_STARTER_ROOT}.result\n\nimport rego.v1\n\ndefault decision := \"deny\"\n\ndecision := \"allow\" if {\n\tinput.subject.trusted == true\n}\n\ndefault reason_code := \"untrusted_or_invalid_input\"\n\nreason_code := \"trusted_subject\" if {\n\tdecision == \"allow\"\n}\n`;\n\n/** Executable tests adjacent to the disposable example policy. */\nexport const POLICY_RESULT_TEST_REGO_TEMPLATE = `package ${POLICY_STARTER_ROOT}.result_test\n\nimport data.${POLICY_STARTER_ROOT}.result\nimport rego.v1\n\ntest_denies_untrusted_subject if {\n\tresult.decision == \"deny\" with input as {\"subject\": {\"trusted\": false}}\n\tresult.reason_code == \"untrusted_or_invalid_input\" with input as {\"subject\": {\"trusted\": false}}\n}\n\ntest_fails_closed_for_missing_subject if {\n\tresult.decision == \"deny\" with input as {}\n\tresult.reason_code == \"untrusted_or_invalid_input\" with input as {}\n}\n\ntest_allows_trusted_subject if {\n\tresult.decision == \"allow\" with input as {\"subject\": {\"trusted\": true}}\n\tresult.reason_code == \"trusted_subject\" with input as {\"subject\": {\"trusted\": true}}\n}\n`;\n\n/** Sanitized local input example containing no credentials or personal data. */\nexport const POLICY_INPUT_EXAMPLE_TEMPLATE = `{\n  \"subject\": {\n    \"trusted\": false\n  }\n}\n`;\n\n/** Input JSON Schema for the disposable starter (editor + \\`opa check -s\\`). */\nexport const POLICY_INPUT_SCHEMA_TEMPLATE = `{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"$id\": \"https://transcend.io/policy-schemas/${POLICY_STARTER_ROOT}/input.json\",\n  \"title\": \"Example policy input\",\n  \"description\": \"Disposable teaching envelope for the example bundle.\",\n  \"type\": \"object\",\n  \"additionalProperties\": true,\n  \"properties\": {\n    \"subject\": {\n      \"type\": \"object\",\n      \"additionalProperties\": true,\n      \"properties\": {\n        \"trusted\": {\n          \"type\": \"boolean\",\n          \"description\": \"When true, the example policy allows; otherwise it denies.\"\n        }\n      }\n    }\n  }\n}\n`;\n\n/** Target-local ignore rules for private evaluation input only. */\nexport const POLICY_GITIGNORE_TEMPLATE = `# Local policy evaluation input (VS Code / Regal look for input.json here).\n/input.json\n`;\n\n/** Concise workspace-local authoring guide (multi-bundle, empty workspace). */\nexport const POLICY_README_TEMPLATE = `# Transcend Policy\n\nMulti-bundle workspace for Transcend Policy Engine bundles\n(OPA / Rego v1). Requires **Transcend CLI ≥ 11** (\\`transcend policy --help\\`\nshould list \\`init\\`, \\`new\\`, and positional \\`[directory]\\` args).\n\nEach \\`*-bundle/\\` directory is a separate publishable unit (own \\`.manifest\\`,\ninput, and query path). Add a new bundle with:\n\n\\`\\`\\`sh\ntranscend policy new\n\\`\\`\\`\n\n## Quick start\n\n\\`\\`\\`sh\ntranscend policy init                   # create the workspace\ntranscend policy new --template generic # add a bundle from a template\n\ntranscend policy lint --noInteractive\ntranscend policy test\ntranscend policy eval transcend/policy/example-bundle \\\\\n  --package=data.example.result \\\\\n  --input=transcend/policy/example-bundle/input.json\n\\`\\`\\`\n\n\\`policy new\\` also writes a gitignored \\`input.json\\` (copy of \\`input.example.json\\`)\nfor local Evaluate. \\`policy lint\\` / \\`policy test\\` default to every child with a\n\\`.manifest\\` and use bundle-mode \\`opa test -b\\`, so both input files can coexist\nwithout a merge error.\n\n## Layout\n\n\\`\\`\\`\ntranscend/policy/\n  example-bundle/               # publish directory (added by policy new)\n    example/                    # package root (matches .manifest roots)\n    input.example.json\n    input.json                  # local only (gitignored)\n    input.schema.json           # input JSON Schema (editor + opa --schema)\n  .regal/config.yaml\n\\`\\`\\`\n\nReplace or delete example bundles when you have a real policy. Publish each\nbundle separately (\\`transcend policy publish --remote-bundle-name … <dir>\\`).\n\n## Permissions API\n\nScaffold the Permissions starter, then simulate the query Sombra runs:\n\n\\`\\`\\`sh\ntranscend policy new \\\\\n  --template permissions \\\\\n  --name ${PERMISSIONS_POLICY_BUNDLE_NAME} \\\\\n  --bundle-dir ${PERMISSIONS_POLICY_BUNDLE_NAME}-bundle \\\\\n  --yes\n\ntranscend policy eval transcend/policy/${PERMISSIONS_POLICY_BUNDLE_NAME}-bundle \\\\\n  --package=data.${PERMISSIONS_POLICY_BUNDLE_NAME}.purposes \\\\\n  --input=transcend/policy/${PERMISSIONS_POLICY_BUNDLE_NAME}-bundle/input.json \\\\\n  --schema=transcend/policy/${PERMISSIONS_POLICY_BUNDLE_NAME}-bundle/input.schema.json\n\\`\\`\\`\n\nUpload does **not** distinguish bundle kinds. What makes a bundle “Permissions”\nis the remote name plus where Sombra queries it:\n\n- **Permissions API** always loads the fixed remote bundle name\n  \\`${PERMISSIONS_POLICY_BUNDLE_NAME}\\`. Publish that starter with\n  \\`--remote-bundle-name=${PERMISSIONS_POLICY_BUNDLE_NAME}\\`.\n- **Generic / decide** bundles use any other \\`--remote-bundle-name\\` and the decide\n  path.\n\nScaffolded \\`.manifest\\` files may include \\`metadata.transcend.io.template\\`\n(\\`generic\\` or \\`permissions\\`) and \\`templateVersion\\` (the \\`@transcend-io/cli\\`\nversion that generated the scaffold) as authoring hints. Upload ignores them;\n\\`policy publish\\` may warn when the template hint and \\`--remote-bundle-name\\` disagree.\n`;\n\n/** Workspace-relative path to the disposable example entrypoint. */\nexport const POLICY_STARTER_RESULT_REGO_PATH = `${POLICY_STARTER_BUNDLE_DIRECTORY}/${POLICY_STARTER_ROOT}/result/result.rego`;\n\n/** Workspace-relative path to the disposable example tests. */\nexport const POLICY_STARTER_RESULT_TEST_REGO_PATH = `${POLICY_STARTER_BUNDLE_DIRECTORY}/${POLICY_STARTER_ROOT}/result/result_test.rego`;\n\n/** Complete safe starter in deterministic plan order. */\nconst POLICY_STARTER_FILES: readonly PolicyStarterFile[] = [\n  {\n    path: `${POLICY_STARTER_BUNDLE_DIRECTORY}/${POLICY_MANIFEST_FILENAME}`,\n    contents: POLICY_MANIFEST_TEMPLATE,\n    description: 'Create the OPA bundle .manifest',\n  },\n  {\n    path: '.regal/config.yaml',\n    contents: POLICY_REGAL_CONFIG_TEMPLATE,\n    description: `Pin strict Rego v1 linting to OPA ${POLICY_STARTER_OPA_VERSION} capabilities`,\n  },\n  {\n    path: `${POLICY_STARTER_BUNDLE_DIRECTORY}/${POLICY_INPUT_SCHEMA_FILENAME}`,\n    contents: POLICY_INPUT_SCHEMA_TEMPLATE,\n    description: 'Create the input JSON Schema for the example bundle',\n  },\n  {\n    path: POLICY_STARTER_RESULT_REGO_PATH,\n    contents: POLICY_RESULT_REGO_TEMPLATE,\n    description: 'Create a documented fail-closed result entrypoint',\n  },\n  {\n    path: POLICY_STARTER_RESULT_TEST_REGO_PATH,\n    contents: POLICY_RESULT_TEST_REGO_TEMPLATE,\n    description: 'Create executable tests for allow and fail-closed decisions',\n  },\n  {\n    path: `${POLICY_STARTER_BUNDLE_DIRECTORY}/input.example.json`,\n    contents: POLICY_INPUT_EXAMPLE_TEMPLATE,\n    description: 'Create a sanitized local evaluation input',\n  },\n  {\n    path: `${POLICY_STARTER_BUNDLE_DIRECTORY}/.gitignore`,\n    contents: POLICY_GITIGNORE_TEMPLATE,\n    description: 'Ignore only the private local input file',\n  },\n  {\n    path: 'README.md',\n    contents: POLICY_README_TEMPLATE,\n    description: 'Create the concise policy project guide',\n  },\n];\n\n/**\n * Generate an independent copy of the safe policy starter.\n *\n * @returns Deterministic relative files\n */\nexport function generatePolicyStarterFiles(): PolicyStarterFile[] {\n  return POLICY_STARTER_FILES.map((file) => ({ ...file }));\n}\n\n// ---------------------------------------------------------------------------\n// Workspace-only init files (no bundles)\n// ---------------------------------------------------------------------------\n\n/** Files created by `policy init` — empty workspace only. */\nconst POLICY_INIT_WORKSPACE_FILES: readonly PolicyStarterFile[] = [\n  {\n    path: '.regal/config.yaml',\n    contents: POLICY_REGAL_CONFIG_EMPTY_TEMPLATE,\n    description: `Pin strict Rego v1 linting to OPA ${POLICY_STARTER_OPA_VERSION} capabilities`,\n  },\n  {\n    path: 'README.md',\n    contents: POLICY_README_TEMPLATE,\n    description: 'Create the concise multi-bundle workspace guide',\n  },\n];\n\n/**\n * Generate files for an empty workspace (init without bundles).\n *\n * @returns Deterministic workspace files\n */\nexport function generatePolicyWorkspaceFiles(): PolicyStarterFile[] {\n  return POLICY_INIT_WORKSPACE_FILES.map((file) => ({ ...file }));\n}\n\n// ---------------------------------------------------------------------------\n// Policy bundle templates (used by `policy new`)\n// ---------------------------------------------------------------------------\n\n/** Interactive labels for each policy template. */\nexport const POLICY_TEMPLATE_PROMPT_LABELS: Record<PolicyTemplateName, string> = {\n  [PolicyTemplate.Generic]: 'Generic example',\n  [PolicyTemplate.Permissions]: 'Permission API starter',\n};\n\n/** Default root names for each template. */\nexport const POLICY_TEMPLATE_DEFAULT_ROOTS: Record<PolicyTemplateName, string> = {\n  [PolicyTemplate.Generic]: 'example',\n  [PolicyTemplate.Permissions]: PERMISSIONS_POLICY_BUNDLE_NAME,\n};\n\n/**\n * Build the bundle directory name from a root.\n *\n * @param root - Package root\n * @returns Bundle directory name\n */\nexport function buildBundleDirectoryName(root: string): string {\n  return `${root}-bundle`;\n}\n\n/**\n * Validate a local bundle directory basename (under the policy workspace).\n *\n * @param value - Proposed directory basename\n * @returns True or error message\n */\nexport function validateBundleDirectoryName(value: string): true | string {\n  if (!value) {\n    return 'Enter a bundle directory name.';\n  }\n  if (value === '.' || value === '..' || value.includes('/') || value.includes('\\\\')) {\n    return 'Bundle directory must be a single path segment (no slashes).';\n  }\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(value)) {\n    return 'Bundle directory must be alphanumeric (plus ., _, -), e.g. \"my-bundle\".';\n  }\n  if (value.length > 128) {\n    return 'Bundle directory cannot exceed 128 characters.';\n  }\n  return true;\n}\n\n/**\n * Generate bundle files for the generic template.\n *\n * @param root - Package root name\n * @param bundleDir - Publish directory basename under the workspace\n * @returns Bundle files relative to the workspace\n */\nexport function generateGenericBundleFiles(\n  root: string,\n  bundleDir: string = buildBundleDirectoryName(root),\n): PolicyStarterFile[] {\n  const bundle = bundleDir;\n  return [\n    {\n      path: `${bundle}/${POLICY_MANIFEST_FILENAME}`,\n      contents: buildPolicyManifestTemplate(root, PolicyTemplate.Generic),\n      description: 'Create the OPA bundle .manifest',\n    },\n    {\n      path: `${bundle}/${POLICY_INPUT_SCHEMA_FILENAME}`,\n      contents: `{\n  \"$schema\": \"http://json-schema.org/draft-07/schema#\",\n  \"$id\": \"https://transcend.io/policy-schemas/${root}/input.json\",\n  \"title\": \"${root === 'example' ? 'Example policy input' : `${root} policy input`}\",\n  \"description\": \"${root === 'example' ? 'Disposable teaching envelope for the example bundle.' : `Input envelope for the ${root} bundle.`}\",\n  \"type\": \"object\",\n  \"additionalProperties\": true,\n  \"properties\": {\n    \"subject\": {\n      \"type\": \"object\",\n      \"additionalProperties\": true,\n      \"properties\": {\n        \"trusted\": {\n          \"type\": \"boolean\",\n          \"description\": \"When true, the ${root === 'example' ? 'example' : root} policy allows; otherwise it denies.\"\n        }\n      }\n    }\n  }\n}\n`,\n      description: `Create the input JSON Schema for the ${root} bundle`,\n    },\n    {\n      path: `${bundle}/${root}/result/result.rego`,\n      contents: `# METADATA\n# title: ${root === 'example' ? 'Disposable example result' : `${root} result`}\n# description: |\n#   A fail-closed ${root === 'example' ? 'teaching ' : ''}entrypoint. Replace this ${root === 'example' ? 'example ' : ''}with the document\n#   tree and result contract required by your application.\n# scope: package\n# entrypoint: true\npackage ${root}.result\n\nimport rego.v1\n\ndefault decision := \"deny\"\n\ndecision := \"allow\" if {\n\\tinput.subject.trusted == true\n}\n\ndefault reason_code := \"untrusted_or_invalid_input\"\n\nreason_code := \"trusted_subject\" if {\n\\tdecision == \"allow\"\n}\n`,\n      description: 'Create a documented fail-closed result entrypoint',\n    },\n    {\n      path: `${bundle}/${root}/result/result_test.rego`,\n      contents: `package ${root}.result_test\n\nimport data.${root}.result\nimport rego.v1\n\ntest_denies_untrusted_subject if {\n\\tresult.decision == \"deny\" with input as {\"subject\": {\"trusted\": false}}\n\\tresult.reason_code == \"untrusted_or_invalid_input\" with input as {\"subject\": {\"trusted\": false}}\n}\n\ntest_fails_closed_for_missing_subject if {\n\\tresult.decision == \"deny\" with input as {}\n\\tresult.reason_code == \"untrusted_or_invalid_input\" with input as {}\n}\n\ntest_allows_trusted_subject if {\n\\tresult.decision == \"allow\" with input as {\"subject\": {\"trusted\": true}}\n\\tresult.reason_code == \"trusted_subject\" with input as {\"subject\": {\"trusted\": true}}\n}\n`,\n      description: 'Create executable tests for allow and fail-closed decisions',\n    },\n    {\n      path: `${bundle}/input.example.json`,\n      contents: POLICY_INPUT_EXAMPLE_TEMPLATE,\n      description: 'Create a sanitized local evaluation input example',\n    },\n    {\n      path: `${bundle}/input.json`,\n      contents: POLICY_INPUT_EXAMPLE_TEMPLATE,\n      description: 'Create a local evaluation input (gitignored copy of the example)',\n    },\n    {\n      path: `${bundle}/.gitignore`,\n      contents: POLICY_GITIGNORE_TEMPLATE,\n      description: 'Ignore only the private local input file',\n    },\n  ];\n}\n\n/**\n * Generate bundle files for the permissions template.\n *\n * @param root - Package root name\n * @returns Bundle files relative to the workspace\n */\n/**\n * Serialize the published Permissions input schema for the local bundle path.\n *\n * Written as `{bundle}/input.schema.json` so editors and `opa --schema` can\n * type-check the envelope offline without a workspace `schemas/` directory.\n *\n * @returns Schema file contents ending in a trailing newline\n */\nexport function buildPermissionsInputSchemaContents(): string {\n  return `${JSON.stringify(permissionsPolicyInputSchema, null, 2)}\\n`;\n}\n\n/**\n * Serialize the published Permissions input example for local evaluation.\n *\n * @returns Example input JSON ending in a trailing newline\n */\nexport function buildPermissionsInputExampleContents(): string {\n  const [example] = permissionsPolicyInputSchema.examples;\n  if (!example) {\n    throw new Error('permissions-policy-input.json must declare at least one example');\n  }\n  return `${JSON.stringify(example, null, 2)}\\n`;\n}\n\n/**\n * Generate bundle files for the permissions template.\n *\n * @param root - Package root name\n * @param bundleDir - Publish directory basename under the workspace\n * @returns Bundle files relative to the workspace\n */\nexport function generatePermissionsBundleFiles(\n  root: string,\n  bundleDir: string = buildBundleDirectoryName(root),\n): PolicyStarterFile[] {\n  const bundle = bundleDir;\n  const inputExample = buildPermissionsInputExampleContents();\n  return [\n    {\n      path: `${bundle}/${POLICY_MANIFEST_FILENAME}`,\n      contents: buildPolicyManifestTemplate(root, PolicyTemplate.Permissions),\n      description: 'Create the OPA bundle .manifest',\n    },\n    {\n      path: `${bundle}/${POLICY_INPUT_SCHEMA_FILENAME}`,\n      contents: buildPermissionsInputSchemaContents(),\n      description: `Create the input JSON Schema for the ${root} bundle (from published permissions-policy-input.json)`,\n    },\n    {\n      path: `${bundle}/${root}/config/config.rego`,\n      contents: `# METADATA\n# title: Permissions config\n# description: |\n#   Static bundle configuration. Values come from data.json in this directory.\npackage ${root}.config\n\nimport rego.v1\n`,\n      description: 'Create the static bundle configuration package',\n    },\n    {\n      path: `${bundle}/${root}/config/data.json`,\n      contents: `{\n  \"default_consent_allowed\": true,\n  \"purposes\": [\n    \"Analytics\",\n    \"SaleOfInfo\"\n  ],\n  \"default_consent\": {}\n}\n`,\n      description: 'Create the static purpose configuration data',\n    },\n    {\n      path: `${bundle}/${root}/helpers/preference/preference.rego`,\n      contents: `# METADATA\n# title: Purpose preference resolution\n# description: |\n#   Resolves the subject's recorded choice for one purpose from the OPA\n#   \\`input.preferences\\` array Sombra injects (one \\`{name, choice,\n#   days_since_choice?}\\` entry per purpose; \\`choice\\` may be null when unset).\npackage ${root}.helpers.preference\n\nimport rego.v1\n\nimport data.${root}.config\n\nraw_preferences := object.get(input, \"preferences\", [])\n\nsource_available if {\n\\tis_array(raw_preferences)\n\\tevery entry in raw_preferences {\n\\t\\tis_object(entry)\n\\t\\tis_string(entry.name)\n\\t\\tentry.name != \"\"\n\\t}\n}\n\n# Boolean choice for a purpose, last-wins across duplicate entries (matching\n# Sombra's own dedup semantics). Returns the boolean only when a usable choice\n# exists; otherwise the rule is undefined and the purpose is undecided.\nchoice(name) := choice if {\n\\tsource_available\n\\tmatching := [entry | some entry in raw_preferences; entry.name == name]\n\\tcount(matching) > 0\n\\tlast := matching[count(matching) - 1]\n\\tchoice := object.get(last, \"choice\", null)\n\\tis_boolean(choice)\n}\n\nenabled(name) if choice(name) == true\n\ndisabled(name) if choice(name) == false\n\ndecided(name) if enabled(name)\n\ndecided(name) if disabled(name)\n\n# A configured purpose with no usable boolean choice is undecided: the subject\n# never chose, so the resolved default applies (not an opt-out).\nundecided(name) if {\n\\tname in config.purposes\n\\tnot enabled(name)\n\\tnot disabled(name)\n}\n`,\n      description: 'Create purpose preference resolution helpers',\n    },\n    {\n      path: `${bundle}/${root}/helpers/preference/preference_test.rego`,\n      contents: `# Mechanical tests for purpose preference resolution.\n# Policy outcomes are tested beside the public entrypoint.\npackage ${root}.helpers.preference_test\n\nimport rego.v1\n\nimport data.${root}.helpers.preference\n\ngiven(preferences) := {\"preferences\": preferences}\n\ntest_treats_an_absent_preferences_array_as_no_recorded_choices if {\n\\tfixture := {}\n\n\\tpreference.source_available with input as fixture\n\\tpreference.undecided(\"Analytics\") with input as fixture\n}\n\ntest_accepts_an_empty_preferences_array if {\n\\tfixture := given([])\n\n\\tpreference.source_available with input as fixture\n\\tpreference.undecided(\"Analytics\") with input as fixture\n}\n\ntest_reports_a_non_array_preferences_as_unavailable if {\n\\tnot preference.source_available with input as {\"preferences\": {\"Analytics\": true}}\n}\n\ntest_reports_entries_without_a_usable_name_as_unavailable if {\n\\tnot preference.source_available with input as {\"preferences\": [{}]}\n\\tnot preference.source_available with input as {\"preferences\": [{\"name\": \"\"}]}\n\\tnot preference.source_available with input as {\"preferences\": [{\"choice\": true}]}\n}\n\ntest_distinguishes_enabled_and_disabled_choices if {\n\\tfixture := given([\n\\t\\t{\"name\": \"Analytics\", \"choice\": true},\n\\t\\t{\"name\": \"SaleOfInfo\", \"choice\": false},\n\\t])\n\n\\tpreference.enabled(\"Analytics\") with input as fixture\n\\tpreference.disabled(\"SaleOfInfo\") with input as fixture\n\\tpreference.decided(\"Analytics\") with input as fixture\n\\tpreference.decided(\"SaleOfInfo\") with input as fixture\n\\tnot preference.undecided(\"Analytics\") with input as fixture\n}\n\ntest_treats_a_null_choice_as_undecided if {\n\\tfixture := given([{\"name\": \"Analytics\", \"choice\": null}])\n\n\\tpreference.undecided(\"Analytics\") with input as fixture\n\\tnot preference.decided(\"Analytics\") with input as fixture\n}\n\ntest_treats_an_absent_choice_key_as_undecided if {\n\\tfixture := given([{\"name\": \"Analytics\", \"channel\": \"email\"}])\n\n\\tpreference.undecided(\"Analytics\") with input as fixture\n}\n\ntest_treats_a_non_boolean_choice_as_undecided if {\n\\tfixture := given([{\"name\": \"SaleOfInfo\", \"choice\": \"Daily\"}])\n\n\\tpreference.undecided(\"SaleOfInfo\") with input as fixture\n\\tnot preference.decided(\"SaleOfInfo\") with input as fixture\n}\n\n# Sombra dedupes by purpose before sending; last-wins keeps the bundle correct\n# against hand-crafted input that names the same purpose twice.\ntest_last_wins_on_duplicate_entries if {\n\\tfixture := given([\n\\t\\t{\"name\": \"SaleOfInfo\", \"choice\": true},\n\\t\\t{\"name\": \"SaleOfInfo\", \"choice\": false},\n\\t])\n\n\\tpreference.disabled(\"SaleOfInfo\") with input as fixture\n\\tnot preference.enabled(\"SaleOfInfo\") with input as fixture\n}\n\n# Extra fields on an entry (evidence, days_since_choice, channel) are ignored\n# rather than treated as a choice.\ntest_ignores_fields_beyond_the_recorded_choice if {\n\\tfixture := given([{\n\\t\\t\"name\": \"Analytics\",\n\\t\\t\"choice\": true,\n\\t\\t\"evidence\": \"consent_banner\",\n\\t\\t\"days_since_choice\": 45,\n\\t\\t\"channel\": \"email\",\n\\t}])\n\n\\tpreference.enabled(\"Analytics\") with input as fixture\n}\n`,\n      description: 'Create preference resolution tests',\n    },\n    {\n      path: `${bundle}/${root}/purposes/analytics/analytics.rego`,\n      contents: `# METADATA\n# title: Analytics purpose decision\n# description: |\n#   The Analytics purpose's verdict as a \\`result\\` document\n#   (\\`data.${root}.purposes.analytics.result\\`).\npackage ${root}.purposes.analytics\n\nimport rego.v1\n\nimport data.${root}.helpers.preference\n\ndefault result := {\n\\t\"decision\": \"deny\",\n\\t\"reason_code\": \"default_deny\",\n}\n\nresult := {\n\\t\"decision\": \"allow\",\n\\t\"reason_code\": \"explicit_allow\",\n} if {\n\\tpreference.enabled(\"Analytics\")\n}\n\nresult := {\n\\t\"decision\": \"deny\",\n\\t\"reason_code\": \"explicit_deny\",\n} if {\n\\tpreference.disabled(\"Analytics\")\n}\n\nresult := {\n\\t\"decision\": \"allow\",\n\\t\"reason_code\": \"default_allow\",\n} if {\n\\tpreference.undecided(\"Analytics\")\n}\n`,\n      description: 'Create the analytics purpose decision rule',\n    },\n    {\n      path: `${bundle}/${root}/purposes/analytics/analytics_test.rego`,\n      contents: `# Policy outcomes for the Analytics purpose (the queried document).\npackage ${root}.purposes.analytics_test\n\nimport rego.v1\n\nimport data.${root}.purposes.analytics\n\ngiven(preferences) := {\"preferences\": preferences}\n\ntest_explicit_allow if {\n\\tresult := analytics.result with input as given([{\"name\": \"Analytics\", \"choice\": true}])\n\\tresult == {\n\\t\\t\"decision\": \"allow\",\n\\t\\t\"reason_code\": \"explicit_allow\",\n\\t}\n}\n\ntest_explicit_deny if {\n\\tresult := analytics.result with input as given([{\"name\": \"Analytics\", \"choice\": false}])\n\\tresult == {\n\\t\\t\"decision\": \"deny\",\n\\t\\t\"reason_code\": \"explicit_deny\",\n\\t}\n}\n\ntest_undecided_resolves_to_default_allow if {\n\\tresult := analytics.result with input as given([])\n\\tresult == {\n\\t\\t\"decision\": \"allow\",\n\\t\\t\"reason_code\": \"default_allow\",\n\\t}\n}\n\ntest_missing_preferences_resolves_to_default_allow if {\n\\tresult := analytics.result with input as {}\n\\tresult == {\n\\t\\t\"decision\": \"allow\",\n\\t\\t\"reason_code\": \"default_allow\",\n\\t}\n}\n\ntest_non_boolean_choice_falls_back_to_default_allow if {\n\\tresult := analytics.result with input as given([{\"name\": \"Analytics\", \"choice\": \"yes\"}])\n\\tresult == {\n\\t\\t\"decision\": \"allow\",\n\\t\\t\"reason_code\": \"default_allow\",\n\\t}\n}\n\ntest_malformed_preferences_are_treated_as_undecided if {\n\\t# source_available is false, so enabled/disabled never fire; undecided still\n\\t# holds for configured purposes (not enabled and not disabled).\n\\tresult := analytics.result with input as {\"preferences\": {\"Analytics\": true}}\n\\tresult == {\n\\t\\t\"decision\": \"allow\",\n\\t\\t\"reason_code\": \"default_allow\",\n\\t}\n}\n`,\n      description: 'Create analytics purpose decision tests',\n    },\n    {\n      path: `${bundle}/${root}/purposes/entrypoint.rego`,\n      contents: `# METADATA\n# title: Purpose decisions\n# description: Returns each purpose's decision and reason code.\n# scope: package\n# entrypoint: true\npackage ${root}.purposes\n\nimport rego.v1\n`,\n      description: 'Create the purposes entrypoint',\n    },\n    {\n      path: `${bundle}/input.example.json`,\n      contents: inputExample,\n      description: 'Create a sanitized permissions evaluation input example',\n    },\n    {\n      path: `${bundle}/input.json`,\n      contents: inputExample,\n      description: 'Create a local evaluation input (gitignored copy of the example)',\n    },\n    {\n      path: `${bundle}/.gitignore`,\n      contents: POLICY_GITIGNORE_TEMPLATE,\n      description: 'Ignore only the private local input file',\n    },\n  ];\n}\n\n/**\n * Generate bundle files for a given template and root.\n *\n * @param template - Template name\n * @param root - Package root name\n * @param bundleDir - Publish directory basename under the workspace\n * @returns Bundle files relative to the workspace\n */\nexport function generatePolicyBundleFiles(\n  template: PolicyTemplateName,\n  root: string,\n  bundleDir: string = buildBundleDirectoryName(root),\n): PolicyStarterFile[] {\n  switch (template) {\n    case PolicyTemplate.Generic:\n      return generateGenericBundleFiles(root, bundleDir);\n    case PolicyTemplate.Permissions:\n      return generatePermissionsBundleFiles(root, bundleDir);\n    default:\n      throw new Error(`Unknown policy template: ${String(template)}`);\n  }\n}\n\n/**\n * Build the suggested `policy eval` follow-up after `policy new`.\n *\n * @param options - Bundle display path, package root, and template\n * @returns Multi-line shell command ready to paste\n */\nexport function buildPolicyBundleEvalNextStep(options: {\n  /** Workspace-relative publish directory (e.g. `transcend/policy/permissions-bundle`). */\n  bundleDirectory: string;\n  /** Rego / `.manifest` package root. */\n  root: string;\n  /** Scaffold template that determined the query path. */\n  template: PolicyTemplateName;\n}): string {\n  const { bundleDirectory, root, template } = options;\n  const packagePath =\n    template === PolicyTemplate.Permissions ? `data.${root}.purposes` : `data.${root}.result`;\n  return [\n    `transcend policy eval ${bundleDirectory} \\\\`,\n    `  --package=${packagePath} \\\\`,\n    `  --input=${bundleDirectory}/input.json \\\\`,\n    `  --schema=${bundleDirectory}/${POLICY_INPUT_SCHEMA_FILENAME}`,\n  ].join('\\n');\n}\n","import { join, resolve } from 'node:path';\n\nimport type { LocalContext } from '../../context.js';\nimport {\n  collectProjectRelativePaths,\n  discoverProjectRepository,\n} from '../scaffolding/project-discovery.js';\nimport type { PolicyProjectState } from './policy-scaffold-model.js';\nimport {\n  POLICY_MANIFEST_FILENAME,\n  POLICY_STARTER_BUNDLE_DIRECTORY,\n} from './policy-scaffold-templates.js';\n\n/** Default local policy workspace directory (shared Regal config + bundles). */\nexport const DEFAULT_POLICY_PROJECT_DIRECTORY = 'transcend/policy';\n\n/**\n * Resolve a selected policy project relative to the invocation directory.\n *\n * @param invocationDirectory - CLI working directory\n * @param directory - User-selected project directory\n * @returns Absolute policy project directory\n */\nexport function resolvePolicyProjectDirectory(\n  invocationDirectory: string,\n  directory: string = DEFAULT_POLICY_PROJECT_DIRECTORY,\n): string {\n  return resolve(invocationDirectory, directory);\n}\n\n/**\n * Absolute path to the disposable starter publish directory under a workspace.\n *\n * @param workspaceDirectory - Absolute policy workspace directory\n * @returns Absolute starter bundle directory\n */\nexport function getPolicyStarterBundleDirectory(workspaceDirectory: string): string {\n  return join(workspaceDirectory, POLICY_STARTER_BUNDLE_DIRECTORY);\n}\n\n/**\n * Resolve publishable bundle directories under a path.\n *\n * - If `directory` itself contains a `.manifest`, it is treated as one bundle.\n * - Otherwise immediate child directories that contain a `.manifest` are\n *   returned in sorted order (multi-bundle workspace). Folder names are not\n *   required to end in `-bundle`; that suffix is only the `policy new`\n *   scaffolding convention.\n *\n * @param context - Filesystem-bearing CLI context\n * @param directory - Absolute workspace or bundle directory\n * @returns Absolute bundle directories to lint / test\n */\nexport function discoverPolicyBundleDirectories(\n  context: Pick<LocalContext, 'fs'>,\n  directory: string,\n): string[] {\n  if (!context.fs.existsSync(directory) || !context.fs.statSync(directory).isDirectory()) {\n    return [];\n  }\n  const manifestAtRoot = join(directory, POLICY_MANIFEST_FILENAME);\n  if (context.fs.existsSync(manifestAtRoot) && context.fs.statSync(manifestAtRoot).isFile()) {\n    return [directory];\n  }\n  return context.fs\n    .readdirSync(directory, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry) => join(directory, entry.name))\n    .filter((bundleDirectory) => {\n      const manifestPath = join(bundleDirectory, POLICY_MANIFEST_FILENAME);\n      return context.fs.existsSync(manifestPath) && context.fs.statSync(manifestPath).isFile();\n    })\n    .sort((left, right) => left.localeCompare(right));\n}\n\n/**\n * Collect repository state required by the pure policy planner.\n *\n * @param context - CLI context\n * @param directory - User-selected target directory\n * @returns Policy project discovery state\n */\nexport function discoverPolicyProject(\n  context: LocalContext,\n  directory: string = DEFAULT_POLICY_PROJECT_DIRECTORY,\n): PolicyProjectState {\n  const invocationDirectory = context.process.cwd();\n  const targetDirectory = resolvePolicyProjectDirectory(invocationDirectory, directory);\n  if (\n    context.fs.existsSync(targetDirectory) &&\n    !context.fs.statSync(targetDirectory).isDirectory()\n  ) {\n    throw new Error(`Policy target is not a directory: ${targetDirectory}`);\n  }\n  const repository = discoverProjectRepository(context, {\n    invocationDirectory,\n    targetDirectory,\n    standaloneProjectRoot: invocationDirectory,\n  });\n  return {\n    invocationDirectory,\n    targetDirectory,\n    ...repository,\n    relativePaths: collectProjectRelativePaths(context, targetDirectory),\n    relativeFilePaths: collectProjectRelativePaths(context, targetDirectory, {\n      includeDirectories: false,\n    }),\n  };\n}\n\n/**\n * Resolve the starter bundle manifest path for a discovered workspace.\n *\n * @param state - Policy project state\n * @returns Absolute manifest path under the starter `{root}-bundle/`\n */\nexport function getPolicyManifestPath(state: PolicyProjectState): string {\n  return join(getPolicyStarterBundleDirectory(state.targetDirectory), POLICY_MANIFEST_FILENAME);\n}\n"],"mappings":"g6CCMA,MAAa,EAAqCA,EAGrC,EAA6B,SAS7B,EAAsB,UAGtB,EAAkC,GAAG,EAAoB,SAGzD,EAA+B,oBAa/B,EAA2B,YAQ3B,EAAiC,cAGjC,EAAyC,eAGzC,EAAiB,CAC5B,QAAS,UACT,YAAa,cACd,CAGY,EAAwB,CAAC,EAAe,QAAS,EAAe,YAAY,CAwBzF,SAAgB,EACd,EACA,EAA+B,EAAe,QACtC,CACR,MAAO;;;eAGM,EAAK;;;OAGb,EAAuC;qBACzB,EAAS;4BACsBC,EAAY;;;;EAQxB,EACtC,EACA,EAAe,QAChB,CAWD,SAAgB,EAA+B,EAAkC,CAK/E,MAAO;;;;;;gBAMO,EAA2B;;EATvC,EAAM,SAAW,EACb,cACA,aAAa,EAAM,IAAK,GAAS,SAAS,IAAO,CAAC,KAAK;EAAK,GASrD;;EAgBf,SAAgB,EACd,EACA,EACuC,CAEvC,GADgB,EAAiB,MACtB,CAAC,SAAW,EAAG,CACxB,IAAM,EAAQ,CAAC,EAAU,CACzB,MAAO,CAAE,SAAU,EAA+B,EAAM,CAAE,QAAO,CAGnE,IAAI,EACJ,GAAI,CACF,EAAS,EAAK,KAAK,EAAiB,OAC7B,EAAO,CACd,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,CACrE,MAAU,MAAM,yCAAyC,IAAS,CAGpE,GAAI,GAAW,KAA8B,CAC3C,IAAM,EAAQ,CAAC,EAAU,CACzB,MAAO,CAAE,SAAU,EAA+B,EAAM,CAAE,QAAO,CAEnE,GAAI,OAAO,GAAW,UAAY,MAAM,QAAQ,EAAO,CACrD,MAAU,MAAM,8DAA8D,CAGhF,IAAM,EAAS,CAAE,GAAI,EAAoC,CACnD,EAAkB,EAAO,QAC/B,GACE,GACoB,OACnB,OAAO,GAAoB,UAAY,MAAM,QAAQ,EAAgB,EAEtE,MAAU,MAAM,kEAAkE,CAGpF,IAAM,EAAmC,CACvC,GAAK,GAA2D,EAAE,CACnE,CACK,EAAgB,EAAQ,MAC1B,EACJ,GAAI,IAAkB,IAAA,GACpB,EAAQ,CAAC,EAAU,SAEnB,MAAM,QAAQ,EAAc,EAC5B,EAAc,MAAO,GAAyB,OAAO,GAAS,SAAS,CAEvE,EAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAe,EAAU,CAAC,CAAC,CAAC,MAAM,EAAM,IAC9D,EAAK,cAAc,EAAM,CAC1B,MAED,MAAU,MACR,4HAED,CAGH,EAAQ,MAAQ,EACZ,EAAQ,kBAAoB,IAAA,KAC9B,EAAQ,gBAAkB,GAE5B,EAAO,QAAU,EAEb,EAAO,eAAiB,IAAA,KAC1B,EAAO,aAAe,CACpB,KAAM,CACJ,OAAQ,MACR,QAAS,IAAI,IACd,CACF,EAGH,IAAM,EAAS,EAAK,KAAK,EAAQ,CAC/B,UAAW,GACX,OAAQ,GACR,SAAU,GACX,CAAC,CACF,MAAO,CACL,SAAU,EAAO,SAAS;EAAK,CAAG,EAAS,GAAG,EAAO,IACrD,QACD,CASyC,EAA+B,CAAC,EAAoB,CAAC,CAAjG,MAGa,EAAqC,EAA+B,EAAE,CAAC,CAGzC,GAOjC,EAPiC,EAyBK,GAAW,EAAX,EAElC,EAFkC,EA/BhD,MAqDa,EAAgC;;;;;EAQD,GAEI,EAFJ,EA7D5C,MAoFa,EAA4B;;EAK5B,EAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAqD3B,EAA+B;iBACzB,EAA+B;;;yCAGP,EAA+B;mBACrD,EAA+B;6BACrB,EAA+B;8BAC9B,EAA+B;;;;;;;MAOvD,EAA+B;2BACV,EAA+B;;;;;;;;EAWX,GAAG,EAAH,EAAsC,EAAtC,EAGK,GAAG,EAAH,EAAsC,EAAtC,EAK1C,GAAG,EAAH,EAAsC,EAAtC,EAOO,GAAqC,EAArC,EAGP,GAAG,EAAH,EAAsC,EAAtC,EAeA,GAAG,EAAH,EAKA,GAAG,EAAH,EAyBV,MAAM,EAA4D,CAChE,CACE,KAAM,qBACN,SAAU,EACV,YAAa,qCAAqC,EAA2B,eAC9E,CACD,CACE,KAAM,YACN,SAAU,EACV,YAAa,kDACd,CACF,CAOD,SAAgB,GAAoD,CAClE,OAAO,EAA4B,IAAK,IAAU,CAAE,GAAG,EAAM,EAAE,CAQjE,MAAa,EAAoE,EAC9E,EAAe,SAAU,mBACzB,EAAe,aAAc,yBAC/B,CAGY,EAAoE,EAC9E,EAAe,SAAU,WACzB,EAAe,aAAc,EAC/B,CAQD,SAAgB,EAAyB,EAAsB,CAC7D,MAAO,GAAG,EAAK,SASjB,SAAgB,EAA4B,EAA8B,CAaxE,OAZK,EAGD,IAAU,KAAO,IAAU,MAAQ,EAAM,SAAS,IAAI,EAAI,EAAM,SAAS,KAAK,CACzE,+DAEJ,gCAAgC,KAAK,EAAM,CAG5C,EAAM,OAAS,IACV,iDAEF,GALE,0EANA,iCAqBX,SAAgB,EACd,EACA,EAAoB,EAAyB,EAAK,CAC7B,CACrB,IAAM,EAAS,EACf,MAAO,CACL,CACE,KAAM,GAAG,EAAO,GAAG,IACnB,SAAU,EAA4B,EAAM,EAAe,QAAQ,CACnE,YAAa,kCACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,IACnB,SAAU;;gDAEgC,EAAK;cACvC,IAAS,UAAY,uBAAyB,GAAG,EAAK,eAAe;oBAC/D,IAAS,UAAY,uDAAyD,0BAA0B,EAAK,UAAU;;;;;;;;;;2CAUhG,IAAS,UAAY,UAAY,EAAK;;;;;;EAO3E,YAAa,wCAAwC,EAAK,SAC3D,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,qBACxB,SAAU;WACL,IAAS,UAAY,4BAA8B,GAAG,EAAK,SAAS;;oBAE3D,IAAS,UAAY,YAAc,GAAG,2BAA2B,IAAS,UAAY,WAAa,GAAG;;;;UAIhH,EAAK;;;;;;;;;;;;;;;EAgBT,YAAa,oDACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,0BACxB,SAAU,WAAW,EAAK;;cAElB,EAAK;;;;;;;;;;;;;;;;;EAkBb,YAAa,8DACd,CACD,CACE,KAAM,GAAG,EAAO,qBAChB,SAAU,EACV,YAAa,oDACd,CACD,CACE,KAAM,GAAG,EAAO,aAChB,SAAU,EACV,YAAa,mEACd,CACD,CACE,KAAM,GAAG,EAAO,aAChB,SAAU,EACV,YAAa,2CACd,CACF,CAiBH,SAAgB,GAA8C,CAC5D,MAAO,GAAG,KAAK,UAAUC,EAA8B,KAAM,EAAE,CAAC,IAQlE,SAAgB,GAA+C,CAC7D,GAAM,CAAC,GAAWC,EAClB,GAAI,CAAC,EACH,MAAU,MAAM,kEAAkE,CAEpF,MAAO,GAAG,KAAK,UAAU,EAAS,KAAM,EAAE,CAAC,IAU7C,SAAgB,EACd,EACA,EAAoB,EAAyB,EAAK,CAC7B,CACrB,IAAM,EAAS,EACT,EAAe,GAAsC,CAC3D,MAAO,CACL,CACE,KAAM,GAAG,EAAO,GAAG,IACnB,SAAU,EAA4B,EAAM,EAAe,YAAY,CACvE,YAAa,kCACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,IACnB,SAAU,GAAqC,CAC/C,YAAa,wCAAwC,EAAK,wDAC3D,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,qBACxB,SAAU;;;;UAIN,EAAK;;;EAIT,YAAa,iDACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,mBACxB,SAAU;;;;;;;;EASV,YAAa,+CACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,qCACxB,SAAU;;;;;;UAMN,EAAK;;;;cAID,EAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCb,YAAa,+CACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,0CACxB,SAAU;;UAEN,EAAK;;;;cAID,EAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuFb,YAAa,qCACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,oCACxB,SAAU;;;;cAIF,EAAK;UACT,EAAK;;;;cAID,EAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4Bb,YAAa,6CACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,yCACxB,SAAU;UACN,EAAK;;;;cAID,EAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDb,YAAa,0CACd,CACD,CACE,KAAM,GAAG,EAAO,GAAG,EAAK,2BACxB,SAAU;;;;;UAKN,EAAK;;;EAIT,YAAa,iCACd,CACD,CACE,KAAM,GAAG,EAAO,qBAChB,SAAU,EACV,YAAa,0DACd,CACD,CACE,KAAM,GAAG,EAAO,aAChB,SAAU,EACV,YAAa,mEACd,CACD,CACE,KAAM,GAAG,EAAO,aAChB,SAAU,EACV,YAAa,2CACd,CACF,CAWH,SAAgB,EACd,EACA,EACA,EAAoB,EAAyB,EAAK,CAC7B,CACrB,OAAQ,EAAR,CACE,KAAK,EAAe,QAClB,OAAO,EAA2B,EAAM,EAAU,CACpD,KAAK,EAAe,YAClB,OAAO,EAA+B,EAAM,EAAU,CACxD,QACE,MAAU,MAAM,4BAA4B,OAAO,EAAS,GAAG,EAUrE,SAAgB,EAA8B,EAOnC,CACT,GAAM,CAAE,kBAAiB,OAAM,YAAa,EACtC,EACJ,IAAa,EAAe,YAAc,QAAQ,EAAK,WAAa,QAAQ,EAAK,SACnF,MAAO,CACL,yBAAyB,EAAgB,KACzC,eAAe,EAAY,KAC3B,aAAa,EAAgB,gBAC7B,cAAc,EAAgB,GAAG,IAClC,CAAC,KAAK;EAAK,CCphCd,MAAa,EAAmC,mBAShD,SAAgB,EACd,EACA,EAAoB,EACZ,CACR,OAAO,EAAQ,EAAqB,EAAU,CA0BhD,SAAgB,EACd,EACA,EACU,CACV,GAAI,CAAC,EAAQ,GAAG,WAAW,EAAU,EAAI,CAAC,EAAQ,GAAG,SAAS,EAAU,CAAC,aAAa,CACpF,MAAO,EAAE,CAEX,IAAM,EAAiB,EAAK,EAAW,EAAyB,CAIhE,OAHI,EAAQ,GAAG,WAAW,EAAe,EAAI,EAAQ,GAAG,SAAS,EAAe,CAAC,QAAQ,CAChF,CAAC,EAAU,CAEb,EAAQ,GACZ,YAAY,EAAW,CAAE,cAAe,GAAM,CAAC,CAC/C,OAAQ,GAAU,EAAM,aAAa,CAAC,CACtC,IAAK,GAAU,EAAK,EAAW,EAAM,KAAK,CAAC,CAC3C,OAAQ,GAAoB,CAC3B,IAAM,EAAe,EAAK,EAAiB,EAAyB,CACpE,OAAO,EAAQ,GAAG,WAAW,EAAa,EAAI,EAAQ,GAAG,SAAS,EAAa,CAAC,QAAQ,EACxF,CACD,MAAM,EAAM,IAAU,EAAK,cAAc,EAAM,CAAC,CAUrD,SAAgB,EACd,EACA,EAAoB,EACA,CACpB,IAAM,EAAsB,EAAQ,QAAQ,KAAK,CAC3C,EAAkB,EAA8B,EAAqB,EAAU,CACrF,GACE,EAAQ,GAAG,WAAW,EAAgB,EACtC,CAAC,EAAQ,GAAG,SAAS,EAAgB,CAAC,aAAa,CAEnD,MAAU,MAAM,qCAAqC,IAAkB,CAOzE,MAAO,CACL,sBACA,kBACA,GARiB,EAA0B,EAAS,CACpD,sBACA,kBACA,sBAAuB,EACxB,CAIc,CACb,cAAe,EAA4B,EAAS,EAAgB,CACpE,kBAAmB,EAA4B,EAAS,EAAiB,CACvE,mBAAoB,GACrB,CAAC,CACH"}

package/dist/policy-scaffold-config-CwlygiTz.mjs

@@ -0,0 +1,76 @@
+import{_ as e,c as t,d as n,f as r,g as i,o as a,s as o,u as s}from"./policy-project-discovery-B4cFXUlA.mjs";import{n as c,r as l,t as u}from"./jsonc-CdTubr53.mjs";import{posix as d,relative as f,sep as p}from"node:path";const m=`0.42.0`,h=`.github/workflows/transcend-policy.yml`,g=`d23441a48e516b6c34aea4fa41551a30e30af803`,_=`b2b258e089860efaadaaf71bf6e3aecb4a3eeff1`,v=`761188c3b435761fa254beca508a44875619648f`;function y(e,t){return e===`.`?t:d.join(e,t)}function b(e){let t=e.bundleDirectories??[y(e.workspaceDirectory,s)],r=[y(e.workspaceDirectory,`**/*.rego`),y(e.workspaceDirectory,`**/*.json`),y(e.workspaceDirectory,`**/*.yaml`),y(e.workspaceDirectory,`**/*.yml`),y(e.workspaceDirectory,`**/.manifest`),y(e.workspaceDirectory,`.regal/config.yaml`),y(e.workspaceDirectory,`.regal.yaml`),h].map(e=>`      - ${JSON.stringify(e)}`).join(`
+`),i;return i=t.length===0?`  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@${g} # v6
+      - name: No publishable bundles yet
+        run: >-
+          echo "Run transcend policy new to add a bundle;
+          policy new refreshes this workflow automatically."
+`:t.length===1?`  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@${g} # v6
+      - name: Set up OPA
+        uses: open-policy-agent/setup-opa@${_} # v2.4.0
+        with:
+          version: ${JSON.stringify(n)}
+      - name: Set up Regal
+        uses: open-policy-agent/setup-regal@${v} # v2.0.0
+        with:
+          version: ${JSON.stringify(m)}
+      - name: Install the Transcend CLI
+        run: npm install --global @transcend-io/cli@${e.cliVersion}
+      - name: Validate Policy Engine project
+        env:
+          POLICY_DIRECTORY: ${JSON.stringify(t[0])}
+        run: >-
+          transcend policy lint
+          "$POLICY_DIRECTORY"
+          --noInteractive
+          --json
+`:`  lint:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        policy_directory:
+${t.map(e=>`          - ${JSON.stringify(e)}`).join(`
+`)}
+    steps:
+      - uses: actions/checkout@${g} # v6
+      - name: Set up OPA
+        uses: open-policy-agent/setup-opa@${_} # v2.4.0
+        with:
+          version: ${JSON.stringify(n)}
+      - name: Set up Regal
+        uses: open-policy-agent/setup-regal@${v} # v2.0.0
+        with:
+          version: ${JSON.stringify(m)}
+      - name: Install the Transcend CLI
+        run: npm install --global @transcend-io/cli@${e.cliVersion}
+      - name: Validate Policy Engine project
+        env:
+          POLICY_DIRECTORY: \${{ matrix.policy_directory }}
+        run: transcend policy lint "$POLICY_DIRECTORY" --noInteractive --json
+`,`# Generated by transcend policy init.
+name: Transcend Policy
+
+on:
+  pull_request:
+    paths:
+${r}
+  push:
+    paths:
+${r}
+
+permissions:
+  contents: read
+
+jobs:
+${i}`}const x=`tsandall.opa`,S=`glebbash.opa-highlight-only`;function C(t,n){return n===void 0?{root:t,bundleDir:e(t)}:{root:t,bundleDir:e(t),template:n}}function w(e,t){return JSON.stringify(e)===JSON.stringify(t)}function T(e,t){try{return{current:l(e??`{}
+`,t)}}catch(t){return{contents:e??`{}
+`,warning:`${t instanceof Error?t.message:String(t)} Existing content was left unchanged.`}}}function E(e,t,n,r){if(t.length===0)return{contents:e??`{}
+`,warnings:r};try{return{contents:u(e,t,n),warnings:r}}catch(t){return{contents:e??`{}
+`,warnings:[...r,`${t instanceof Error?t.message:String(t)} Existing content was left unchanged.`]}}}function D(e,t,n,r){t.forEach(({path:t,value:i,label:a})=>{let o=t.reduce((e,t)=>e&&typeof e==`object`&&!Array.isArray(e)?e[t]:void 0,e);o===void 0?n.push({path:t,value:i}):w(o,i)||r.push(`VS Code setting "${a}" has a repository-specific value and was left unchanged.`)})}function O(e){return e===`.`?"${workspaceFolder}":`\${workspaceFolder}/${e}`}function k(e,t){return f(e,t).split(p).join(`/`)||`.`}function A(e,t,n=C(r)){let i=k(e,t);return O(i===`.`?n.bundleDir:`${i}/${n.bundleDir}`)}function j(e,n){let r=k(e,n);return r===`.`?`**/${t}`:`**/${r}/**/${t}`}function M(e,t,n=C(r)){let s=k(e,t),c=s===`.`?`/${n.bundleDir}`:`/${s}/${n.bundleDir}`,l=n.template===i.Permissions?a:s===`.`?`./${n.bundleDir}/${o}`:`./${s}/${n.bundleDir}/${o}`;return{fileMatch:[`${c}/input.json`,`${c}/input.example.json`],url:l}}function N(e,t,n,r){let i=T(e,`VS Code policy settings`);if(`warning`in i)return{contents:i.contents,warnings:[i.warning]};let{current:a}=i,o=[],s=[];if(r&&r.length>0){let e=a[`opa.roots`],i=r.map(e=>A(t,n,e));if(e===void 0)o.push({path:[`opa.roots`],value:i});else if(Array.isArray(e)&&e.every(e=>typeof e==`string`)){let t=c(e,i);w(t,e)||o.push({path:[`opa.roots`],value:t})}else s.push(`VS Code setting "opa.roots" is customized and was left unchanged.`)}D(a,[{path:[`opa.checkOnSave`],value:!0,label:`opa.checkOnSave`},{path:[`opa.strictMode`],value:!0,label:`opa.strictMode`},{path:[`opa.bundleMode`],value:!0,label:`opa.bundleMode`},{path:[`opa.formatter`],value:`opa-fmt-rego-v1`,label:`opa.formatter`}],o,s);let l=a[`files.associations`],u=j(t,n);if(l===void 0?o.push({path:[`files.associations`],value:{[u]:`json`}}):typeof l==`object`&&l&&!Array.isArray(l)?D(a,[{path:[`files.associations`,u],value:`json`,label:`files.associations."${u}"`}],o,s):s.push(`VS Code setting "files.associations" is customized and was left unchanged.`),r&&r.length>0){let e=r.map(e=>M(t,n,e)),i=a[`json.schemas`];if(i===void 0)o.push({path:[`json.schemas`],value:e});else if(Array.isArray(i)){let t=[...i];e.forEach(e=>{if(t.some(t=>typeof t==`object`&&!!t&&!Array.isArray(t)&&w(t,e)))return;let n=t.findIndex(t=>typeof t==`object`&&!!t&&!Array.isArray(t)&&typeof t.url==`string`&&t.url===e.url);if(n===-1){t=[...t,e];return}let r=t[n],i=r.fileMatch;if(!Array.isArray(i)||!i.every(e=>typeof e==`string`)){s.push(`VS Code setting "json.schemas" has a repository-specific entry for the ${e.url} schema and was left unchanged.`);return}let a=c(i,e.fileMatch);w(a,i)||(t=t.map((e,t)=>t===n?{...r,fileMatch:a}:e))}),w(t,i)||o.push({path:[`json.schemas`],value:t})}else s.push(`VS Code setting "json.schemas" is customized and was left unchanged.`)}let d=a[`[rego]`];return d===void 0?o.push({path:[`[rego]`],value:{"editor.defaultFormatter":x,"editor.formatOnSave":!0,"editor.insertSpaces":!1,"editor.tabSize":4}}):typeof d==`object`&&d&&!Array.isArray(d)?D(a,[{path:[`[rego]`,`editor.defaultFormatter`],value:x,label:`[rego].editor.defaultFormatter`},{path:[`[rego]`,`editor.formatOnSave`],value:!0,label:`[rego].editor.formatOnSave`},{path:[`[rego]`,`editor.insertSpaces`],value:!1,label:`[rego].editor.insertSpaces`},{path:[`[rego]`,`editor.tabSize`],value:4,label:`[rego].editor.tabSize`}],o,s):s.push(`VS Code language setting "[rego]" is customized and was left unchanged.`),E(e,o,`VS Code policy settings`,s)}function P(e){let t=T(e,`VS Code policy extension recommendations`);if(`warning`in t)return{contents:t.contents,warnings:[t.warning]};let{current:n}=t,r=[],i=[],a=n.recommendations;if(a===void 0||Array.isArray(a)&&a.every(e=>typeof e==`string`)){let e=a??[],t=c(e,[x]).filter(e=>e!==S);w(e,t)||r.push({path:[`recommendations`],value:t})}else i.push(`VS Code extension recommendations use an unknown shape and were left unchanged.`);let o=n.unwantedRecommendations;if(o===void 0||Array.isArray(o)&&o.every(e=>typeof e==`string`)){let e=o??[],t=c(e,[S]);w(e,t)||r.push({path:[`unwantedRecommendations`],value:t})}else i.push(`VS Code unwanted extension recommendations use an unknown shape and were left unchanged.`);return E(e,r,`VS Code policy extension recommendations`,i)}function F(e,t,n=C(r)){let i=k(e,t),a=i===`.`?n.bundleDir:`${i}/${n.bundleDir}`;return{label:`policy: lint ${n.root}`,type:`process`,command:`transcend`,args:[`policy`,`lint`,a,`--noInteractive`],group:{kind:`test`,isDefault:!1},problemMatcher:[]}}function I(e){return{label:`policy: lint`,dependsOn:e.map(e=>`policy: lint ${e.root}`),dependsOrder:`sequence`,group:{kind:`test`,isDefault:!0},problemMatcher:[]}}function L(e,t,n,r){let i=T(e,`VS Code policy tasks`);if(`warning`in i)return{contents:i.contents,warnings:[i.warning]};let{current:a}=i,o=[],s=[],c=a.version;if(c===void 0?o.push({path:[`version`],value:`2.0.0`}):c!==`2.0.0`&&s.push(`VS Code task schema version is customized and was left unchanged.`),!r||r.length===0)return E(e,o,`VS Code policy tasks`,s);let l=r.map(e=>F(t,n,e)),u=I(r),d=[...l,u],f=new Set(d.map(e=>e.label)),p=a.tasks;if(p===void 0)o.push({path:[`tasks`],value:d});else if(Array.isArray(p)){let e=[...p],t=!1;d.forEach(n=>{let r=n.label,i=e.findIndex(e=>typeof e==`object`&&!!e&&!Array.isArray(e)&&e.label===r);if(i===-1){e=[...e,n],t=!0;return}w(e[i],n)||(f.has(r)?(e=e.map((e,t)=>t===i?n:e),t=!0):s.push(`VS Code task "${r}" has repository-specific customization and was left unchanged.`))}),t&&o.push({path:[`tasks`],value:e})}else s.push(`VS Code tasks use an unknown shape and were left unchanged.`);return E(e,o,`VS Code policy tasks`,s)}export{h as a,C as i,N as n,b as o,L as r,P as t};
+//# sourceMappingURL=policy-scaffold-config-CwlygiTz.mjs.map