@transcend-io/cli 12.1.1 → 12.1.3

package/dist/{impl-DNRA5i0w.mjs.map → impl-DHhm_-pe.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DNRA5i0w.mjs","names":[],"sources":["../src/commands/request/download-files/impl.ts"],"sourcesContent":["import { RequestStatus } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { downloadPrivacyRequestFiles } from '../../../lib/requests/index.js';\n\nexport interface DownloadFilesCommandFlags {\n  auth: string;\n  sombraAuth?: string;\n  concurrency: number;\n  requestIds?: string[];\n  statuses?: RequestStatus[];\n  folderPath: string;\n  createdAtBefore?: Date;\n  createdAtAfter?: Date;\n  updatedAtBefore?: Date;\n  updatedAtAfter?: Date;\n  approveAfterDownload: boolean;\n  transcendUrl: string;\n}\n\nexport async function downloadFiles(\n  this: LocalContext,\n  {\n    auth,\n    transcendUrl,\n    folderPath,\n    requestIds,\n    statuses = [RequestStatus.Approving, RequestStatus.Downloadable],\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  }: DownloadFilesCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await downloadPrivacyRequestFiles({\n    transcendUrl,\n    auth,\n    folderPath,\n    requestIds,\n    statuses,\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  });\n}\n"],"mappings":"+KAqBA,eAAsB,EAEpB,CACE,OACA,eACA,aACA,aACA,WAAW,CAAC,EAAc,UAAW,EAAc,aAAa,CAChE,cACA,kBACA,iBACA,kBACA,iBACA,wBAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAA4B,CAChC,eACA,OACA,aACA,aACA,WACA,cACA,kBACA,iBACA,kBACA,iBACA,uBACD,CAAC"}
+{"version":3,"file":"impl-DHhm_-pe.mjs","names":[],"sources":["../src/commands/request/download-files/impl.ts"],"sourcesContent":["import { RequestStatus } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { downloadPrivacyRequestFiles } from '../../../lib/requests/index.js';\n\nexport interface DownloadFilesCommandFlags {\n  auth: string;\n  sombraAuth?: string;\n  concurrency: number;\n  requestIds?: string[];\n  statuses?: RequestStatus[];\n  folderPath: string;\n  createdAtBefore?: Date;\n  createdAtAfter?: Date;\n  updatedAtBefore?: Date;\n  updatedAtAfter?: Date;\n  approveAfterDownload: boolean;\n  transcendUrl: string;\n}\n\nexport async function downloadFiles(\n  this: LocalContext,\n  {\n    auth,\n    transcendUrl,\n    folderPath,\n    requestIds,\n    statuses = [RequestStatus.Approving, RequestStatus.Downloadable],\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  }: DownloadFilesCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await downloadPrivacyRequestFiles({\n    transcendUrl,\n    auth,\n    folderPath,\n    requestIds,\n    statuses,\n    concurrency,\n    createdAtBefore,\n    createdAtAfter,\n    updatedAtBefore,\n    updatedAtAfter,\n    approveAfterDownload,\n  });\n}\n"],"mappings":"+KAqBA,eAAsB,EAEpB,CACE,OACA,eACA,aACA,aACA,WAAW,CAAC,EAAc,UAAW,EAAc,aAAa,CAChE,cACA,kBACA,iBACA,kBACA,iBACA,wBAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAA4B,CAChC,eACA,OACA,aACA,aACA,WACA,cACA,kBACA,iBACA,kBACA,iBACA,uBACD,CAAC"}

package/dist/{impl-Bf2Qli6c2.mjs → impl-DKhqM6hZ2.mjs}

@@ -1,4 +1,4 @@
-import{g as e}from"./constants-BCmVqlrM.mjs";import{i as t,n,r,t as i}from"./project-plan-output-BHHlkLxe.mjs";import{c as a,d as o,f as s,l as c,t as l,u}from"./project-discovery-CWRjlFnC.mjs";import{b as d,d as f,r as p,t as m,u as h}from"./policy-project-discovery-DV5PnFJq.mjs";import{a as g,c as _,i as v,l as y,o as b,r as x,s as S,t as C}from"./policy-runtime-6jmkXlBk.mjs";import{t as w}from"./done-input-validation-LiTaCEzF.mjs";import{i as T,n as E,r as D,t as O}from"./prompts-BhXfYD6g.mjs";import{t as k}from"./run-captured-process-BjaSDWXG.mjs";import{t as A}from"./project-plan-apply-Bg_1eMX9.mjs";import{a as j,n as ee,o as te,r as ne,t as re}from"./policy-scaffold-config-DtRELUZx.mjs";import{isAbsolute as M,join as N,posix as P,relative as F,sep as I}from"node:path";import L from"colors";const R={Editor:`editor`,Skill:`skill`,Ci:`ci`};var z=`# Idiomatic Rego and document-tree authoring
+import{g as e}from"./constants-rXUIz6Uy.mjs";import{i as t,n,r,t as i}from"./project-plan-output-BHHlkLxe.mjs";import{c as a,d as o,f as s,l as c,t as l,u}from"./project-discovery-CWRjlFnC.mjs";import{b as d,d as f,r as p,t as m,u as h}from"./policy-project-discovery-_6QosI9J.mjs";import{a as g,c as _,i as v,l as y,o as b,r as x,s as S,t as C}from"./policy-runtime-6jmkXlBk.mjs";import{t as w}from"./done-input-validation-LiTaCEzF.mjs";import{i as T,n as E,r as D,t as O}from"./prompts-BhXfYD6g.mjs";import{t as k}from"./run-captured-process-BjaSDWXG.mjs";import{t as A}from"./project-plan-apply-Bg_1eMX9.mjs";import{a as j,n as ee,o as te,r as ne,t as re}from"./policy-scaffold-config-DwZFigj7.mjs";import{isAbsolute as M,join as N,posix as P,relative as F,sep as I}from"node:path";import L from"colors";const R={Editor:`editor`,Skill:`skill`,Ci:`ci`};var z=`# Idiomatic Rego and document-tree authoring
 
 ## Start from the document tree
 
@@ -418,4 +418,4 @@ transcend policy lint --noInteractive
   products into a single \`.manifest\` unless they share activation and callers.
 `;const W=`transcend-policy-engine`,G=[{path:`SKILL.md`,contents:U},{path:`references/setup-tooling.md`,contents:V},{path:`references/authoring.md`,contents:z},{path:`references/testing-debugging.md`,contents:H},{path:`references/publishing.md`,contents:B}];function K(e){return`${e.hasSkill?`Use the \`${W}\` skill and run`:`Run`} ${e.newCommand} to add a bundle from a template, then adapt the policy document tree and input/output contract to the intended application.`}function q(e,n){return{version:e.version,command:e.command,applied:n.applied,dryRun:n.dryRun,targetDirectory:e.targetDirectory,manifestPath:e.manifestPath,changes:e.changes.map(e=>t(n.cwd,e)),warnings:e.warnings,nextSteps:e.nextSteps,features:[...e.features],aiHandoff:n.aiHandoff,tools:n.tools}}const J={name:W,displayName:`Policy Engine`,owner:`@transcend-io/cli`,files:G};function Y(e,t){let n=new Set(d().map(({path:t})=>N(e.targetDirectory,t))),r=new Set(t.features);return r.has(R.Editor)&&(n.add(N(e.projectRoot,`.vscode`,`settings.json`)),n.add(N(e.projectRoot,`.vscode`,`extensions.json`)),n.add(N(e.projectRoot,`.vscode`,`tasks.json`))),r.has(R.Skill)&&a(e.projectRoot,e.existingSkillDirectories,J).forEach(e=>n.add(e)),r.has(R.Ci)&&e.repositoryRoot&&e.usesGithub&&n.add(N(e.repositoryRoot,j)),[...n].sort((e,t)=>e.localeCompare(t))}function X(e,t){let n=F(e,t);if(n===`..`||n.startsWith(`..${I}`)||M(n))throw Error(`Refusing to modify path outside project root: ${t}`)}function ie(e){let t=new Set([`${h}/input.json`]);return e.forEach(({path:e})=>{t.add(e);let n=P.dirname(e);for(;n!==`.`;)t.add(n),n=P.dirname(n)}),t}function Z(e,t,n){let r=s({snapshot:u(t.snapshots,n.path),after:n.contents,description:n.description,...n.createOnly===void 0?{}:{createOnly:n.createOnly}});r?e.changes.push(r):e.unchanged.push(n.path)}function ae(e,t,n,r,a,o){Z(e,t,{path:n,contents:r.contents,description:a}),e.warnings.push(...r.warnings.map(e=>`${e} (${i(o,n)})`))}function oe(e,t){let{state:n}=e,r=d(),a=`transcend policy new`,s={version:3,command:`init`,rootDirectory:n.projectRoot,targetDirectory:n.targetDirectory,manifestPath:n.targetDirectory,changes:[],unchanged:[],warnings:[],nextSteps:[a],features:[...t.features]},l=Y(n,t);if(X(n.projectRoot,n.targetDirectory),l.forEach(e=>X(n.projectRoot,e)),n.relativeFilePaths.length===0)s.directoryPreconditions=[{path:n.targetDirectory,relativePaths:[...n.relativePaths]}],r.forEach(t=>{let r=N(n.targetDirectory,t.path);if(o(e.snapshots,r).kind!==`absent`)throw Error(`Expected an empty policy target, but found an entry at: ${r}`);Z(s,e,{path:r,contents:t.contents,description:t.description,createOnly:!0})});else{let t=!0;r.forEach(r=>{let a=N(n.targetDirectory,r.path),c=o(e.snapshots,a);if(c.kind===`file`&&c.contents===r.contents){s.unchanged.push(a);return}t=!1,c.kind!==`absent`&&(s.unchanged.push(a),s.warnings.push(`Existing policy scaffold path was left unchanged: ${i(n.invocationDirectory,a)}`))});let c=ie(r),l=n.relativeFilePaths.some(e=>!c.has(e));(!t||l)&&s.warnings.push(`Existing policy target contains custom or partial content, so no workspace files were added or overwritten. Review ${i(n.invocationDirectory,n.targetDirectory)} manually, then run \`${a}\`.`)}let u=new Set(t.features),f=n.projectRoot;if(u.has(R.Editor)){let t=N(f,`.vscode`,`settings.json`),r=N(f,`.vscode`,`extensions.json`),a=N(f,`.vscode`,`tasks.json`);[{path:t,description:`Merge strict target-scoped OPA and Rego editor settings`,merge:(e,t,n)=>ee(e,t,n)},{path:r,description:`Recommend the OPA extension and discourage its syntax-only conflict`,merge:e=>re(e)},{path:a,description:`Create the VS Code task configuration`,merge:(e,t,n)=>ne(e,t,n)}].forEach(({path:t,description:r,merge:a})=>{let c=o(e.snapshots,t);if(c.kind!==`absent`&&c.kind!==`file`){s.unchanged.push(t),s.warnings.push(`Existing VS Code artifact is not a regular file and was left unchanged: ${i(n.invocationDirectory,t)}`);return}ae(s,e,t,a(c.kind===`file`?c.contents:null,f,n.targetDirectory),r,n.invocationDirectory)})}if(u.has(R.Skill)){let t=c({rootDirectory:f,existingDirectories:n.existingSkillDirectories,snapshots:e.snapshots,skill:J,preserveModified:!0});s.changes.push(...t.changes),s.unchanged.push(...t.unchanged),s.warnings.push(...t.warnings.map(e=>t.unchanged.reduce((e,t)=>e.replace(t,i(n.invocationDirectory,t)),e)))}if(u.has(R.Ci))if(!n.repositoryRoot||!n.usesGithub)s.warnings.push(`GitHub Actions setup was selected, but this target is not inside a detected GitHub repository.`);else{let r=N(n.repositoryRoot,j),a=F(n.repositoryRoot,n.targetDirectory).split(I).join(`/`)||`.`,c=te({cliVersion:t.cliVersion,workspaceDirectory:a,bundleDirectories:[]}),l=o(e.snapshots,r);l.kind===`absent`?Z(s,e,{path:r,contents:c,description:`Add credential-free Policy Engine validation`,createOnly:!0}):l.kind===`file`&&l.contents===c?s.unchanged.push(r):(s.unchanged.push(r),s.warnings.push(`Existing GitHub Actions workflow was left unchanged: ${i(n.invocationDirectory,r)}. Adapt it manually to validate each policy bundle.`))}return s.changes.forEach(({path:e})=>X(n.projectRoot,e)),s}const se={[R.Editor]:`VS Code settings and lint task`,[R.Skill]:`Policy Engine Agent Skill`,[R.Ci]:`Validation-only GitHub Actions`},ce=Object.values(R);function Q(e,t){let n=[t.stdout.trim(),t.stderr.trim()].filter(Boolean).join(`
 `),r=e===`OPA`?x:g;return`${e===`OPA`?`OPA 1.x`:`Regal ${C} or newer`} is required, but \`${e.toLowerCase()} version\` exited with code ${t.code}${n?`: ${n}`:`.`} Install or upgrade it using the official instructions: ${r}`}async function le(e,t,n){let r={opa:null,regal:null},i=[],a=await n(`opa`,[`version`],{cwd:t},e);if(a.error?.code===`ENOENT`)i.push(v);else{let e=`${a.stdout}\n${a.stderr}`,t=_(e);a.code===0?t?i.push(t):r.opa=S(e).version:i.push(t??Q(`OPA`,a))}let o=await n(`regal`,[`version`],{cwd:t},e);if(o.error?.code===`ENOENT`)i.push(b);else{let e=`${o.stdout}\n${o.stderr}`,t=y(e,C,`the generated OPA ${f} capabilities configuration`);o.code===0?t?i.push(t):r.regal=S(e).version:i.push(t??Q(`Regal`,o))}return{tools:r,warnings:i}}async function $(t,a=m,o=k){w(this.process);try{let s=await le(this,this.process.cwd(),o),c=p(this,a),u=new E(this),d=D(t,this.process.stdin.isTTY,this.process.stderr.isTTY),f=await T(u,{features:ce,labels:se,enabled:{[R.Editor]:t.editor,[R.Skill]:t.skill,[R.Ci]:t.ci},interactive:d}),m=Y(c,{features:f}),h=oe({state:c,snapshots:l(this,c.projectRoot,m)},{features:f,cliVersion:e});h.warnings.push(...s.warnings),t.json||this.logger.info(r(h,{cwd:this.process.cwd(),title:`Policy initialization plan`,details:[{label:`Target`,path:h.targetDirectory}]}));let g=h.changes.length===0||t.dryRun;if(h.changes.length>0&&!t.dryRun)if(t.yes)g=!0;else if(d)g=await u.confirm(`Apply this complete plan?`,!0);else throw Error(`The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.`);g&&!t.dryRun&&h.changes.length>0&&await A(this,h);let _=g&&!t.dryRun&&h.changes.length>0,v=g&&!t.dryRun,y=K({projectPath:n(i(this.process.cwd(),c.targetDirectory)),hasSkill:v&&f.includes(R.Skill),newCommand:h.nextSteps[0]}),b=q(h,{applied:_,dryRun:t.dryRun,cwd:this.process.cwd(),aiHandoff:y,tools:s.tools});if(t.json){this.process.stdout.write(`${JSON.stringify(b)}\n`);return}if(t.dryRun){this.logger.info(L.yellow(`Dry run complete. No changes were written.`));return}if(!g){this.logger.info(L.yellow(`No changes applied.`));return}if(h.changes.length===0){let e=h.warnings.length===s.warnings.length?`Policy project is already initialized.`:`Existing policy project was left unchanged.`;this.logger.info(L.green(e))}else this.logger.info(L.green(`Policy project initialized.`));h.nextSteps.length>0&&(this.logger.info(`\n${L.bold(`Next steps`)}`),h.nextSteps.forEach(e=>this.logger.info(e))),this.logger.info(`\n${L.bold(`AI handoff — paste into your coding agent`)}`),this.logger.info(y)}catch(e){if(e instanceof O)return this.process.exit(130);throw e}}export{$ as init};
-//# sourceMappingURL=impl-Bf2Qli6c2.mjs.map
+//# sourceMappingURL=impl-DKhqM6hZ2.mjs.map

package/dist/{impl-Bf2Qli6c2.mjs.map → impl-DKhqM6hZ2.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-Bf2Qli6c2.mjs","names":["POLICY_SKILL_MD","POLICY_SETUP_TOOLING_REFERENCE_MD","POLICY_AUTHORING_REFERENCE_MD","POLICY_TESTING_DEBUGGING_REFERENCE_MD","POLICY_PUBLISHING_REFERENCE_MD","CLI_VERSION"],"sources":["../src/lib/policy/policy-scaffold-model.ts","../../../skills/transcend-policy-engine/references/authoring.md","../../../skills/transcend-policy-engine/references/publishing.md","../../../skills/transcend-policy-engine/references/setup-tooling.md","../../../skills/transcend-policy-engine/references/testing-debugging.md","../../../skills/transcend-policy-engine/SKILL.md","../src/lib/policy/policy-skill.ts","../src/lib/policy/policy-scaffold-output.ts","../src/lib/policy/policy-scaffold-planning.ts","../src/commands/policy/init/impl.ts"],"sourcesContent":["import type { ExistingProjectSkillDirectory } from '../scaffolding/agent-skill.js';\nimport type { ProjectPlan } from '../scaffolding/project-plan.js';\n\n/** Version of the stable policy initialization JSON result. */\nexport const POLICY_INIT_RESULT_VERSION = 3 as const;\n\n/** Optional repository integrations for policy authoring. */\nexport const PolicySetupFeature = {\n  /** Repository-level editor configuration. */\n  Editor: 'editor',\n  /** Managed policy authoring skill. */\n  Skill: 'skill',\n  /** Credential-free continuous integration. */\n  Ci: 'ci',\n} as const;\n\n/** Optional repository integration for policy authoring. */\nexport type PolicySetupFeature = (typeof PolicySetupFeature)[keyof typeof PolicySetupFeature];\n\n/** Repository and target state collected before policy planning. */\nexport interface PolicyProjectState {\n  /** Directory from which the CLI was invoked. */\n  invocationDirectory: string;\n  /** Absolute user-selected policy directory. */\n  targetDirectory: string;\n  /** Repository or invocation root that owns setup artifacts. */\n  projectRoot: string;\n  /** Nearest repository root, when present. */\n  repositoryRoot?: string;\n  /** Existing project-level skill directories. */\n  existingSkillDirectories: ExistingProjectSkillDirectory[];\n  /** Whether the repository appears to use GitHub. */\n  usesGithub: boolean;\n  /** Case-preserving relative paths below the policy directory. */\n  relativePaths: string[];\n  /** Relative file and link paths below the policy directory. */\n  relativeFilePaths: string[];\n}\n\n/** A complete, validated policy initialization plan. */\nexport interface PolicyInitProjectPlan extends ProjectPlan {\n  /** JSON contract version. */\n  version: typeof POLICY_INIT_RESULT_VERSION;\n  /** Command that produced the plan. */\n  command: 'init';\n  /** Absolute policy project directory. */\n  targetDirectory: string;\n  /** Absolute policy manifest path. */\n  manifestPath: string;\n  /** Files inspected and deliberately left unchanged. */\n  unchanged: string[];\n  /** Non-fatal plan warnings. */\n  warnings: string[];\n  /** Raw commands shown after a successful apply. */\n  nextSteps: string[];\n  /** Exact generated example that remains safe to replace. */\n  disposableExamplePath?: string;\n  /** Selected repository integrations. */\n  features: PolicySetupFeature[];\n}\n",null,null,null,null,null,"import POLICY_AUTHORING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/authoring.md';\nimport POLICY_PUBLISHING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/publishing.md';\nimport POLICY_SETUP_TOOLING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/setup-tooling.md';\nimport POLICY_TESTING_DEBUGGING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/testing-debugging.md';\nimport POLICY_SKILL_MD from '../../../../../skills/transcend-policy-engine/SKILL.md';\nimport type { AgentSkillFile } from '../scaffolding/agent-skill.js';\n\n/** Namespaced directory and frontmatter name for the installed Agent Skill. */\nexport const POLICY_SKILL_NAME = 'transcend-policy-engine';\n\nexport {\n  POLICY_AUTHORING_REFERENCE_MD,\n  POLICY_PUBLISHING_REFERENCE_MD,\n  POLICY_SETUP_TOOLING_REFERENCE_MD,\n  POLICY_SKILL_MD,\n  POLICY_TESTING_DEBUGGING_REFERENCE_MD,\n};\n\n/** Complete portable Policy Engine Agent Skill file set. */\nexport const POLICY_SKILL_FILES: readonly AgentSkillFile[] = [\n  { path: 'SKILL.md', contents: POLICY_SKILL_MD },\n  { path: 'references/setup-tooling.md', contents: POLICY_SETUP_TOOLING_REFERENCE_MD },\n  { path: 'references/authoring.md', contents: POLICY_AUTHORING_REFERENCE_MD },\n  { path: 'references/testing-debugging.md', contents: POLICY_TESTING_DEBUGGING_REFERENCE_MD },\n  { path: 'references/publishing.md', contents: POLICY_PUBLISHING_REFERENCE_MD },\n];\n","import {\n  toPublicPlannedChange,\n  type PublicPlannedChange,\n} from '../scaffolding/project-plan-output.js';\nimport type { PolicyInitProjectPlan, PolicySetupFeature } from './policy-scaffold-model.js';\nimport { POLICY_SKILL_NAME } from './policy-skill.js';\n\n/** Detected local policy tool versions. */\nexport interface PolicyInitToolVersions {\n  /** OPA version, or null when missing or incompatible. */\n  opa: string | null;\n  /** Regal version, or null when missing or incompatible. */\n  regal: string | null;\n}\n\n/** Stable machine-readable policy initialization result. */\nexport interface PolicyInitPlanResult {\n  /** JSON contract version. */\n  version: number;\n  /** Command that produced the result. */\n  command: 'init';\n  /** Whether the plan was applied. */\n  applied: boolean;\n  /** Whether this was a dry run. */\n  dryRun: boolean;\n  /** Absolute policy target directory. */\n  targetDirectory: string;\n  /** Absolute policy manifest path. */\n  manifestPath: string;\n  /** Planned mutations without file contents. */\n  changes: PublicPlannedChange[];\n  /** Non-fatal preservation and runtime warnings. */\n  warnings: string[];\n  /** Suggested raw one-line follow-up commands. */\n  nextSteps: string[];\n  /** Explicitly selected repository integrations. */\n  features: PolicySetupFeature[];\n  /** Compact prompt for continuing with a coding agent. */\n  aiHandoff: string;\n  /** Compatible local policy tool versions. */\n  tools: PolicyInitToolVersions;\n}\n\n/**\n * Build the compact policy implementation and CI handoff.\n *\n * @param options - Portable project path and next step\n * @returns Raw one-line prompt\n */\nexport function buildPolicyInitAiHandoff(options: {\n  /** Display path to the policy project. */\n  projectPath: string;\n  /** Whether the policy authoring skill was installed. */\n  hasSkill: boolean;\n  /** Copyable new-bundle command. */\n  newCommand: string;\n}): string {\n  const instruction = options.hasSkill ? `Use the \\`${POLICY_SKILL_NAME}\\` skill and run` : 'Run';\n  return (\n    `${instruction} ${options.newCommand} to add a bundle from a template, ` +\n    `then adapt the policy document tree and input/output contract to the intended application.`\n  );\n}\n\n/**\n * Build the stable machine-readable initialization result.\n *\n * @param plan - Policy project plan\n * @param options - Apply and runtime state\n * @returns Public JSON result\n */\nexport function buildPolicyInitPlanResult(\n  plan: PolicyInitProjectPlan,\n  options: {\n    /** Whether the plan was applied. */\n    applied: boolean;\n    /** Whether this was a dry run. */\n    dryRun: boolean;\n    /** Working directory for portable paths. */\n    cwd: string;\n    /** Compact coding-agent prompt. */\n    aiHandoff: string;\n    /** Compatible local policy tool versions. */\n    tools: PolicyInitToolVersions;\n  },\n): PolicyInitPlanResult {\n  return {\n    version: plan.version,\n    command: plan.command,\n    applied: options.applied,\n    dryRun: options.dryRun,\n    targetDirectory: plan.targetDirectory,\n    manifestPath: plan.manifestPath,\n    changes: plan.changes.map((change) => toPublicPlannedChange(options.cwd, change)),\n    warnings: plan.warnings,\n    nextSteps: plan.nextSteps,\n    features: [...plan.features],\n    aiHandoff: options.aiHandoff,\n    tools: options.tools,\n  };\n}\n","import { isAbsolute, join, posix, relative, sep } from 'node:path';\n\nimport {\n  getManagedAgentSkillCandidatePaths,\n  planManagedAgentSkill,\n  type ManagedAgentSkillDefinition,\n} from '../scaffolding/agent-skill.js';\nimport { displayProjectPath } from '../scaffolding/project-plan-output.js';\nimport {\n  getPlanningPathSnapshot,\n  getPlanningFileSnapshot,\n  planFileChange,\n  type PlanningPathSnapshot,\n} from '../scaffolding/project-plan.js';\nimport {\n  generatePolicyGithubActionsWorkflow,\n  POLICY_CI_WORKFLOW_PATH,\n} from './policy-scaffold-artifacts.js';\nimport {\n  mergePolicyEditorExtensions,\n  mergePolicyEditorSettings,\n  mergePolicyEditorTasks,\n  type PolicyEditorMergeResult,\n} from './policy-scaffold-config.js';\nimport {\n  POLICY_INIT_RESULT_VERSION,\n  PolicySetupFeature,\n  type PolicyInitProjectPlan,\n  type PolicyProjectState,\n  type PolicySetupFeature as PolicySetupFeatureType,\n} from './policy-scaffold-model.js';\nimport {\n  generatePolicyWorkspaceFiles,\n  POLICY_STARTER_BUNDLE_DIRECTORY,\n  type PolicyStarterFile,\n} from './policy-scaffold-templates.js';\nimport { POLICY_SKILL_FILES, POLICY_SKILL_NAME } from './policy-skill.js';\n\n/** Managed Policy Engine Agent Skill definition. */\nconst POLICY_MANAGED_SKILL: ManagedAgentSkillDefinition = {\n  name: POLICY_SKILL_NAME,\n  displayName: 'Policy Engine',\n  owner: '@transcend-io/cli',\n  files: POLICY_SKILL_FILES,\n};\n\n/** In-memory input consumed by the pure policy initializer. */\nexport interface PolicyInitPlanningInput {\n  /** Project discovery state. */\n  state: PolicyProjectState;\n  /** Potential mutation paths keyed by absolute path. */\n  snapshots: Readonly<Record<string, PlanningPathSnapshot>>;\n}\n\n/** Optional repository setup selected for policy initialization. */\nexport interface PolicyInitPlanOptions {\n  /** Selected setup features. */\n  features: readonly PolicySetupFeatureType[];\n  /** Exact released Transcend CLI version for generated CI. */\n  cliVersion: string;\n}\n\n/**\n * Enumerate all core starter paths that could be created.\n *\n * @param state - Policy project state\n * @param options - Selected repository setup\n * @returns Absolute candidate paths\n */\nexport function getPolicyInitPlanningCandidatePaths(\n  state: PolicyProjectState,\n  options: Pick<PolicyInitPlanOptions, 'features'>,\n): string[] {\n  const paths = new Set(\n    generatePolicyWorkspaceFiles().map(({ path }) => join(state.targetDirectory, path)),\n  );\n  const selected = new Set(options.features);\n  if (selected.has(PolicySetupFeature.Editor)) {\n    paths.add(join(state.projectRoot, '.vscode', 'settings.json'));\n    paths.add(join(state.projectRoot, '.vscode', 'extensions.json'));\n    paths.add(join(state.projectRoot, '.vscode', 'tasks.json'));\n  }\n  if (selected.has(PolicySetupFeature.Skill)) {\n    getManagedAgentSkillCandidatePaths(\n      state.projectRoot,\n      state.existingSkillDirectories,\n      POLICY_MANAGED_SKILL,\n    ).forEach((path) => paths.add(path));\n  }\n  if (selected.has(PolicySetupFeature.Ci) && state.repositoryRoot && state.usesGithub) {\n    paths.add(join(state.repositoryRoot, POLICY_CI_WORKFLOW_PATH));\n  }\n  return [...paths].sort((left, right) => left.localeCompare(right));\n}\n\n/**\n * Ensure a destination stays below an approved project root.\n *\n * @param root - Approved root\n * @param path - Candidate path\n */\nfunction assertContained(root: string, path: string): void {\n  const child = relative(root, path);\n  if (child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child)) {\n    throw new Error(`Refusing to modify path outside project root: ${path}`);\n  }\n}\n\n/**\n * Enumerate generated file and directory paths allowed in an exact starter.\n *\n * @param files - Starter files\n * @returns POSIX relative paths\n */\nfunction starterRelativePaths(files: readonly PolicyStarterFile[]): Set<string> {\n  const paths = new Set<string>([`${POLICY_STARTER_BUNDLE_DIRECTORY}/input.json`]);\n  files.forEach(({ path }) => {\n    paths.add(path);\n    let parent = posix.dirname(path);\n    while (parent !== '.') {\n      paths.add(parent);\n      parent = posix.dirname(parent);\n    }\n  });\n  return paths;\n}\n\n/**\n * Add or classify one regular-file mutation.\n *\n * @param plan - Policy plan being assembled\n * @param input - Collected snapshots\n * @param options - Desired file\n */\nfunction addFileChange(\n  plan: PolicyInitProjectPlan,\n  input: PolicyInitPlanningInput,\n  options: {\n    /** Absolute destination path. */\n    path: string;\n    /** Complete desired contents. */\n    contents: string;\n    /** Human-readable plan description. */\n    description: string;\n    /** Refuse existing contents. */\n    createOnly?: boolean;\n  },\n): void {\n  const change = planFileChange({\n    snapshot: getPlanningFileSnapshot(input.snapshots, options.path),\n    after: options.contents,\n    description: options.description,\n    ...(options.createOnly === undefined ? {} : { createOnly: options.createOnly }),\n  });\n  if (change) {\n    plan.changes.push(change);\n  } else {\n    plan.unchanged.push(options.path);\n  }\n}\n\n/**\n * Add one safe editor merge and its preservation warnings.\n *\n * @param plan - Policy plan being assembled\n * @param input - Collected snapshots\n * @param path - Absolute editor artifact path\n * @param result - Pure JSONC merge result\n * @param description - Human-readable plan description\n * @param cwd - Invocation directory for portable warning paths\n */\nfunction addEditorMerge(\n  plan: PolicyInitProjectPlan,\n  input: PolicyInitPlanningInput,\n  path: string,\n  result: PolicyEditorMergeResult,\n  description: string,\n  cwd: string,\n): void {\n  addFileChange(plan, input, {\n    path,\n    contents: result.contents,\n    description,\n  });\n  plan.warnings.push(\n    ...result.warnings.map((warning) => `${warning} (${displayProjectPath(cwd, path)})`),\n  );\n}\n\n/**\n * Build a safe policy project plan without reading the filesystem.\n *\n * Empty targets receive the complete starter. Existing targets are classified\n * only; no domain file is added, merged, or overwritten.\n *\n * @param input - Collected project state and path snapshots\n * @param options - Selected setup and pinned CLI version\n * @returns Validated policy initialization plan\n */\nexport function buildPolicyInitPlan(\n  input: PolicyInitPlanningInput,\n  options: PolicyInitPlanOptions,\n): PolicyInitProjectPlan {\n  const { state } = input;\n  const files = generatePolicyWorkspaceFiles();\n  const newCommand = 'transcend policy new';\n  const plan: PolicyInitProjectPlan = {\n    version: POLICY_INIT_RESULT_VERSION,\n    command: 'init',\n    rootDirectory: state.projectRoot,\n    targetDirectory: state.targetDirectory,\n    // Init creates a workspace only; bundles (and their .manifest) come from `policy new`.\n    manifestPath: state.targetDirectory,\n    changes: [],\n    unchanged: [],\n    warnings: [],\n    nextSteps: [newCommand],\n    features: [...options.features],\n  };\n\n  const candidatePaths = getPolicyInitPlanningCandidatePaths(state, options);\n  assertContained(state.projectRoot, state.targetDirectory);\n  candidatePaths.forEach((path) => assertContained(state.projectRoot, path));\n\n  if (state.relativeFilePaths.length === 0) {\n    plan.directoryPreconditions = [\n      {\n        path: state.targetDirectory,\n        relativePaths: [...state.relativePaths],\n      },\n    ];\n    files.forEach((file) => {\n      const path = join(state.targetDirectory, file.path);\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind !== 'absent') {\n        throw new Error(`Expected an empty policy target, but found an entry at: ${path}`);\n      }\n      addFileChange(plan, input, {\n        path,\n        contents: file.contents,\n        description: file.description,\n        createOnly: true,\n      });\n    });\n  } else {\n    let allWorkspaceFilesMatch = true;\n    files.forEach((file) => {\n      const path = join(state.targetDirectory, file.path);\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind === 'file' && snapshot.contents === file.contents) {\n        plan.unchanged.push(path);\n        return;\n      }\n      allWorkspaceFilesMatch = false;\n      if (snapshot.kind !== 'absent') {\n        plan.unchanged.push(path);\n        plan.warnings.push(\n          `Existing policy scaffold path was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            path,\n          )}`,\n        );\n      }\n    });\n\n    const allowedPaths = starterRelativePaths(files);\n    const hasCustomPaths = state.relativeFilePaths.some((path) => !allowedPaths.has(path));\n    if (!allWorkspaceFilesMatch || hasCustomPaths) {\n      plan.warnings.push(\n        `Existing policy target contains custom or partial content, so no workspace files were added or overwritten. ` +\n          `Review ${displayProjectPath(\n            state.invocationDirectory,\n            state.targetDirectory,\n          )} manually, then run \\`${newCommand}\\`.`,\n      );\n    }\n  }\n\n  const selected = new Set(options.features);\n  const root = state.projectRoot;\n  if (selected.has(PolicySetupFeature.Editor)) {\n    const settingsPath = join(root, '.vscode', 'settings.json');\n    const extensionsPath = join(root, '.vscode', 'extensions.json');\n    const tasksPath = join(root, '.vscode', 'tasks.json');\n\n    type EditorMergeFn = (\n      contents: string | null,\n      repositoryRoot: string,\n      targetDirectory: string,\n    ) => PolicyEditorMergeResult;\n    const editorArtifacts: {\n      /** Absolute path. */\n      path: string;\n      /** Plan description. */\n      description: string;\n      /** Merge function. */\n      merge: EditorMergeFn;\n    }[] = [\n      {\n        path: settingsPath,\n        description: 'Merge strict target-scoped OPA and Rego editor settings',\n        merge: (contents, repositoryRoot, targetDirectory) =>\n          mergePolicyEditorSettings(contents, repositoryRoot, targetDirectory),\n      },\n      {\n        path: extensionsPath,\n        description: 'Recommend the OPA extension and discourage its syntax-only conflict',\n        merge: (contents) => mergePolicyEditorExtensions(contents),\n      },\n      {\n        path: tasksPath,\n        description: 'Create the VS Code task configuration',\n        merge: (contents, repositoryRoot, targetDirectory) =>\n          mergePolicyEditorTasks(contents, repositoryRoot, targetDirectory),\n      },\n    ];\n    editorArtifacts.forEach(({ path, description, merge }) => {\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind !== 'absent' && snapshot.kind !== 'file') {\n        plan.unchanged.push(path);\n        plan.warnings.push(\n          `Existing VS Code artifact is not a regular file and was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            path,\n          )}`,\n        );\n        return;\n      }\n      addEditorMerge(\n        plan,\n        input,\n        path,\n        merge(snapshot.kind === 'file' ? snapshot.contents : null, root, state.targetDirectory),\n        description,\n        state.invocationDirectory,\n      );\n    });\n  }\n\n  if (selected.has(PolicySetupFeature.Skill)) {\n    const skillPlan = planManagedAgentSkill({\n      rootDirectory: root,\n      existingDirectories: state.existingSkillDirectories,\n      snapshots: input.snapshots,\n      skill: POLICY_MANAGED_SKILL,\n      preserveModified: true,\n    });\n    plan.changes.push(...skillPlan.changes);\n    plan.unchanged.push(...skillPlan.unchanged);\n    plan.warnings.push(\n      ...skillPlan.warnings.map((warning) => {\n        return skillPlan.unchanged.reduce(\n          (rendered, path) =>\n            rendered.replace(path, displayProjectPath(state.invocationDirectory, path)),\n          warning,\n        );\n      }),\n    );\n  }\n\n  if (selected.has(PolicySetupFeature.Ci)) {\n    if (!state.repositoryRoot || !state.usesGithub) {\n      plan.warnings.push(\n        'GitHub Actions setup was selected, but this target is not inside a detected GitHub repository.',\n      );\n    } else {\n      const workflowPath = join(state.repositoryRoot, POLICY_CI_WORKFLOW_PATH);\n      const workspaceDirectory =\n        relative(state.repositoryRoot, state.targetDirectory).split(sep).join('/') || '.';\n      const workflowContents = generatePolicyGithubActionsWorkflow({\n        cliVersion: options.cliVersion,\n        workspaceDirectory,\n        bundleDirectories: [],\n      });\n      const workflowSnapshot = getPlanningPathSnapshot(input.snapshots, workflowPath);\n      if (workflowSnapshot.kind === 'absent') {\n        addFileChange(plan, input, {\n          path: workflowPath,\n          contents: workflowContents,\n          description: 'Add credential-free Policy Engine validation',\n          createOnly: true,\n        });\n      } else if (\n        workflowSnapshot.kind === 'file' &&\n        workflowSnapshot.contents === workflowContents\n      ) {\n        plan.unchanged.push(workflowPath);\n      } else {\n        plan.unchanged.push(workflowPath);\n        plan.warnings.push(\n          `Existing GitHub Actions workflow was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            workflowPath,\n          )}. Adapt it manually to validate each policy bundle.`,\n        );\n      }\n    }\n  }\n\n  plan.changes.forEach(({ path }) => assertContained(state.projectRoot, path));\n  return plan;\n}\n","import colors from 'colors';\n\nimport { version as CLI_VERSION } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport {\n  runCapturedProcess,\n  type CapturedProcessResult,\n  type CapturedProcessRunner,\n} from '../../../lib/cli/run-captured-process.js';\nimport {\n  DEFAULT_POLICY_PROJECT_DIRECTORY,\n  discoverPolicyProject,\n} from '../../../lib/policy/policy-project-discovery.js';\nimport {\n  OPA_INSTALL_URL,\n  OPA_MISSING_MESSAGE,\n  parsePolicyToolVersion,\n  MINIMUM_POLICY_STARTER_REGAL_VERSION,\n  REGAL_INSTALL_URL,\n  REGAL_MISSING_MESSAGE,\n  unsupportedOpaVersionMessage,\n  unsupportedRegalVersionMessage,\n} from '../../../lib/policy/policy-runtime.js';\nimport {\n  PolicySetupFeature,\n  type PolicySetupFeature as PolicySetupFeatureType,\n} from '../../../lib/policy/policy-scaffold-model.js';\nimport {\n  buildPolicyInitAiHandoff,\n  buildPolicyInitPlanResult,\n  type PolicyInitToolVersions,\n} from '../../../lib/policy/policy-scaffold-output.js';\nimport {\n  buildPolicyInitPlan,\n  getPolicyInitPlanningCandidatePaths,\n} from '../../../lib/policy/policy-scaffold-planning.js';\nimport { POLICY_STARTER_OPA_VERSION } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { collectPlanningSnapshots } from '../../../lib/scaffolding/project-discovery.js';\nimport { applyProjectPlan } from '../../../lib/scaffolding/project-plan-apply.js';\nimport {\n  displayProjectPath,\n  quoteShellArgument,\n  renderProjectPlan,\n} from '../../../lib/scaffolding/project-plan-output.js';\nimport {\n  isInteractivePromptInvocation,\n  PromptCancelledError,\n  resolveSetupFeatures,\n  ScaffoldPrompts,\n} from '../../../lib/scaffolding/prompts.js';\n\n/** Flags for `transcend policy init`. */\nexport interface PolicyInitFlags {\n  /** Install repository-level VS Code setup. */\n  editor?: boolean;\n  /** Install the Policy Engine Agent Skill. */\n  skill?: boolean;\n  /** Install validation-only GitHub Actions CI. */\n  ci?: boolean;\n  /** Disable prompts. */\n  noInteractive: boolean;\n  /** Render but do not apply the plan. */\n  dryRun: boolean;\n  /** Approve the final displayed plan. */\n  yes: boolean;\n  /** Emit one stable JSON result on stdout. */\n  json: boolean;\n}\n\n/** User-facing optional setup labels. */\nconst SETUP_LABELS: Readonly<Record<PolicySetupFeatureType, string>> = {\n  [PolicySetupFeature.Editor]: 'VS Code settings and lint task',\n  [PolicySetupFeature.Skill]: 'Policy Engine Agent Skill',\n  [PolicySetupFeature.Ci]: 'Validation-only GitHub Actions',\n};\n\n/** All optional setup features in stable prompt order. */\nconst ALL_SETUP_FEATURES = Object.values(PolicySetupFeature);\n\n/** Runtime compatibility detected before policy planning. */\ninterface PolicyRuntimeProbe {\n  /** Compatible tool versions. */\n  tools: PolicyInitToolVersions;\n  /** Missing or incompatible runtime guidance. */\n  warnings: string[];\n}\n\n/**\n * Explain a failed version subprocess with official installation guidance.\n *\n * @param tool - Policy tool name\n * @param result - Failed captured process\n * @returns Actionable warning\n */\nfunction failedVersionProbeMessage(tool: 'OPA' | 'Regal', result: CapturedProcessResult): string {\n  const detail = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join('\\n');\n  const url = tool === 'OPA' ? OPA_INSTALL_URL : REGAL_INSTALL_URL;\n  const requirement =\n    tool === 'OPA' ? 'OPA 1.x' : `Regal ${MINIMUM_POLICY_STARTER_REGAL_VERSION} or newer`;\n  return (\n    `${requirement} is required, but \\`${tool.toLowerCase()} version\\` exited with code ` +\n    `${result.code}${detail ? `: ${detail}` : '.'} ` +\n    `Install or upgrade it using the official instructions: ${url}`\n  );\n}\n\n/**\n * Probe both local policy runtimes without installing or modifying them.\n *\n * @param context - CLI context\n * @param cwd - Invocation working directory\n * @param runner - Captured subprocess runner\n * @returns Compatible versions and exact runtime guidance\n */\nasync function probePolicyRuntimes(\n  context: LocalContext,\n  cwd: string,\n  runner: CapturedProcessRunner,\n): Promise<PolicyRuntimeProbe> {\n  const tools: PolicyInitToolVersions = { opa: null, regal: null };\n  const warnings: string[] = [];\n\n  const opaResult = await runner('opa', ['version'], { cwd }, context);\n  if (opaResult.error?.code === 'ENOENT') {\n    warnings.push(OPA_MISSING_MESSAGE);\n  } else {\n    const output = `${opaResult.stdout}\\n${opaResult.stderr}`;\n    const unsupported = unsupportedOpaVersionMessage(output);\n    if (opaResult.code !== 0) {\n      warnings.push(unsupported ?? failedVersionProbeMessage('OPA', opaResult));\n    } else if (unsupported) {\n      warnings.push(unsupported);\n    } else {\n      tools.opa = parsePolicyToolVersion(output)!.version;\n    }\n  }\n\n  const regalResult = await runner('regal', ['version'], { cwd }, context);\n  if (regalResult.error?.code === 'ENOENT') {\n    warnings.push(REGAL_MISSING_MESSAGE);\n  } else {\n    const output = `${regalResult.stdout}\\n${regalResult.stderr}`;\n    const unsupported = unsupportedRegalVersionMessage(\n      output,\n      MINIMUM_POLICY_STARTER_REGAL_VERSION,\n      `the generated OPA ${POLICY_STARTER_OPA_VERSION} capabilities configuration`,\n    );\n    if (regalResult.code !== 0) {\n      warnings.push(unsupported ?? failedVersionProbeMessage('Regal', regalResult));\n    } else if (unsupported) {\n      warnings.push(unsupported);\n    } else {\n      tools.regal = parsePolicyToolVersion(output)!.version;\n    }\n  }\n\n  return { tools, warnings };\n}\n\n/**\n * Initialize a credential-free local Policy Engine project.\n *\n * @param this - CLI context\n * @param flags - Scaffold and interaction flags\n * @param directory - Target policy directory\n * @param runner - Captured policy tool runner\n */\nexport async function init(\n  this: LocalContext,\n  flags: PolicyInitFlags,\n  directory: string = DEFAULT_POLICY_PROJECT_DIRECTORY,\n  runner: CapturedProcessRunner = runCapturedProcess,\n): Promise<void> {\n  doneInputValidation(this.process);\n  try {\n    const runtime = await probePolicyRuntimes(this, this.process.cwd(), runner);\n    const state = discoverPolicyProject(this, directory);\n    const prompts = new ScaffoldPrompts(this);\n    const interactive = isInteractivePromptInvocation(\n      flags,\n      this.process.stdin.isTTY,\n      this.process.stderr.isTTY,\n    );\n    const features = await resolveSetupFeatures(prompts, {\n      features: ALL_SETUP_FEATURES,\n      labels: SETUP_LABELS,\n      enabled: {\n        [PolicySetupFeature.Editor]: flags.editor,\n        [PolicySetupFeature.Skill]: flags.skill,\n        [PolicySetupFeature.Ci]: flags.ci,\n      },\n      interactive,\n    });\n    const candidatePaths = getPolicyInitPlanningCandidatePaths(state, { features });\n    const snapshots = collectPlanningSnapshots(this, state.projectRoot, candidatePaths);\n\n    const plan = buildPolicyInitPlan(\n      { state, snapshots },\n      {\n        features,\n        cliVersion: CLI_VERSION,\n      },\n    );\n    plan.warnings.push(...runtime.warnings);\n\n    if (!flags.json) {\n      this.logger.info(\n        renderProjectPlan(plan, {\n          cwd: this.process.cwd(),\n          title: 'Policy initialization plan',\n          details: [{ label: 'Target', path: plan.targetDirectory }],\n        }),\n      );\n    }\n\n    let approved = plan.changes.length === 0 || flags.dryRun;\n    if (plan.changes.length > 0 && !flags.dryRun) {\n      if (flags.yes) {\n        approved = true;\n      } else if (interactive) {\n        approved = await prompts.confirm('Apply this complete plan?', true);\n      } else {\n        throw new Error(\n          'The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.',\n        );\n      }\n    }\n\n    if (approved && !flags.dryRun && plan.changes.length > 0) {\n      await applyProjectPlan(this, plan);\n    }\n    const applied = approved && !flags.dryRun && plan.changes.length > 0;\n    const setupAvailable = approved && !flags.dryRun;\n    const aiHandoff = buildPolicyInitAiHandoff({\n      projectPath: quoteShellArgument(\n        displayProjectPath(this.process.cwd(), state.targetDirectory),\n      ),\n      hasSkill: setupAvailable && features.includes(PolicySetupFeature.Skill),\n      newCommand: plan.nextSteps[0]!,\n    });\n    const result = buildPolicyInitPlanResult(plan, {\n      applied,\n      dryRun: flags.dryRun,\n      cwd: this.process.cwd(),\n      aiHandoff,\n      tools: runtime.tools,\n    });\n    if (flags.json) {\n      this.process.stdout.write(`${JSON.stringify(result)}\\n`);\n      return;\n    }\n    if (flags.dryRun) {\n      this.logger.info(colors.yellow('Dry run complete. No changes were written.'));\n      return;\n    }\n    if (!approved) {\n      this.logger.info(colors.yellow('No changes applied.'));\n      return;\n    }\n    if (plan.changes.length === 0) {\n      const message =\n        plan.warnings.length === runtime.warnings.length\n          ? 'Policy project is already initialized.'\n          : 'Existing policy project was left unchanged.';\n      this.logger.info(colors.green(message));\n    } else {\n      this.logger.info(colors.green('Policy project initialized.'));\n    }\n    if (plan.nextSteps.length > 0) {\n      this.logger.info(`\\n${colors.bold('Next steps')}`);\n      plan.nextSteps.forEach((step) => this.logger.info(step));\n    }\n    this.logger.info(`\\n${colors.bold('AI handoff — paste into your coding agent')}`);\n    this.logger.info(aiHandoff);\n  } catch (error) {\n    if (error instanceof PromptCancelledError) {\n      return this.process.exit(130);\n    }\n    throw error;\n  }\n}\n"],"mappings":"uyBAOA,MAAa,EAAqB,CAEhC,OAAQ,SAER,MAAO,QAEP,GAAI,KACL,OCdD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ECQA,MAAa,EAAoB,0BAWpB,EAAgD,CAC3D,CAAE,KAAM,WAAY,SAAUA,EAAiB,CAC/C,CAAE,KAAM,8BAA+B,SAAUC,EAAmC,CACpF,CAAE,KAAM,0BAA2B,SAAUC,EAA+B,CAC5E,CAAE,KAAM,kCAAmC,SAAUC,EAAuC,CAC5F,CAAE,KAAM,2BAA4B,SAAUC,EAAgC,CAC/E,CCwBD,SAAgB,EAAyB,EAO9B,CAET,MACE,GAFkB,EAAQ,SAAW,aAAa,EAAkB,kBAAoB,MAEzE,GAAG,EAAQ,WAAW,8HAYzC,SAAgB,EACd,EACA,EAYsB,CACtB,MAAO,CACL,QAAS,EAAK,QACd,QAAS,EAAK,QACd,QAAS,EAAQ,QACjB,OAAQ,EAAQ,OAChB,gBAAiB,EAAK,gBACtB,aAAc,EAAK,aACnB,QAAS,EAAK,QAAQ,IAAK,GAAW,EAAsB,EAAQ,IAAK,EAAO,CAAC,CACjF,SAAU,EAAK,SACf,UAAW,EAAK,UAChB,SAAU,CAAC,GAAG,EAAK,SAAS,CAC5B,UAAW,EAAQ,UACnB,MAAO,EAAQ,MAChB,CC5DH,MAAM,EAAoD,CACxD,KAAM,EACN,YAAa,gBACb,MAAO,oBACP,MAAO,EACR,CAyBD,SAAgB,EACd,EACA,EACU,CACV,IAAM,EAAQ,IAAI,IAChB,GAA8B,CAAC,KAAK,CAAE,UAAW,EAAK,EAAM,gBAAiB,EAAK,CAAC,CACpF,CACK,EAAW,IAAI,IAAI,EAAQ,SAAS,CAgB1C,OAfI,EAAS,IAAI,EAAmB,OAAO,GACzC,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,gBAAgB,CAAC,CAC9D,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,kBAAkB,CAAC,CAChE,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,aAAa,CAAC,EAEzD,EAAS,IAAI,EAAmB,MAAM,EACxC,EACE,EAAM,YACN,EAAM,yBACN,EACD,CAAC,QAAS,GAAS,EAAM,IAAI,EAAK,CAAC,CAElC,EAAS,IAAI,EAAmB,GAAG,EAAI,EAAM,gBAAkB,EAAM,YACvE,EAAM,IAAI,EAAK,EAAM,eAAgB,EAAwB,CAAC,CAEzD,CAAC,GAAG,EAAM,CAAC,MAAM,EAAM,IAAU,EAAK,cAAc,EAAM,CAAC,CASpE,SAAS,EAAgB,EAAc,EAAoB,CACzD,IAAM,EAAQ,EAAS,EAAM,EAAK,CAClC,GAAI,IAAU,MAAQ,EAAM,WAAW,KAAK,IAAM,EAAI,EAAW,EAAM,CACrE,MAAU,MAAM,iDAAiD,IAAO,CAU5E,SAAS,GAAqB,EAAkD,CAC9E,IAAM,EAAQ,IAAI,IAAY,CAAC,GAAG,EAAgC,aAAa,CAAC,CAShF,OARA,EAAM,SAAS,CAAE,UAAW,CAC1B,EAAM,IAAI,EAAK,CACf,IAAI,EAAS,EAAM,QAAQ,EAAK,CAChC,KAAO,IAAW,KAChB,EAAM,IAAI,EAAO,CACjB,EAAS,EAAM,QAAQ,EAAO,EAEhC,CACK,EAUT,SAAS,EACP,EACA,EACA,EAUM,CACN,IAAM,EAAS,EAAe,CAC5B,SAAU,EAAwB,EAAM,UAAW,EAAQ,KAAK,CAChE,MAAO,EAAQ,SACf,YAAa,EAAQ,YACrB,GAAI,EAAQ,aAAe,IAAA,GAAY,EAAE,CAAG,CAAE,WAAY,EAAQ,WAAY,CAC/E,CAAC,CACE,EACF,EAAK,QAAQ,KAAK,EAAO,CAEzB,EAAK,UAAU,KAAK,EAAQ,KAAK,CAcrC,SAAS,GACP,EACA,EACA,EACA,EACA,EACA,EACM,CACN,EAAc,EAAM,EAAO,CACzB,OACA,SAAU,EAAO,SACjB,cACD,CAAC,CACF,EAAK,SAAS,KACZ,GAAG,EAAO,SAAS,IAAK,GAAY,GAAG,EAAQ,IAAI,EAAmB,EAAK,EAAK,CAAC,GAAG,CACrF,CAaH,SAAgB,GACd,EACA,EACuB,CACvB,GAAM,CAAE,SAAU,EACZ,EAAQ,GAA8B,CACtC,EAAa,uBACb,EAA8B,CAClC,QAAA,EACA,QAAS,OACT,cAAe,EAAM,YACrB,gBAAiB,EAAM,gBAEvB,aAAc,EAAM,gBACpB,QAAS,EAAE,CACX,UAAW,EAAE,CACb,SAAU,EAAE,CACZ,UAAW,CAAC,EAAW,CACvB,SAAU,CAAC,GAAG,EAAQ,SAAS,CAChC,CAEK,EAAiB,EAAoC,EAAO,EAAQ,CAI1E,GAHA,EAAgB,EAAM,YAAa,EAAM,gBAAgB,CACzD,EAAe,QAAS,GAAS,EAAgB,EAAM,YAAa,EAAK,CAAC,CAEtE,EAAM,kBAAkB,SAAW,EACrC,EAAK,uBAAyB,CAC5B,CACE,KAAM,EAAM,gBACZ,cAAe,CAAC,GAAG,EAAM,cAAc,CACxC,CACF,CACD,EAAM,QAAS,GAAS,CACtB,IAAM,EAAO,EAAK,EAAM,gBAAiB,EAAK,KAAK,CAEnD,GADiB,EAAwB,EAAM,UAAW,EAC9C,CAAC,OAAS,SACpB,MAAU,MAAM,2DAA2D,IAAO,CAEpF,EAAc,EAAM,EAAO,CACzB,OACA,SAAU,EAAK,SACf,YAAa,EAAK,YAClB,WAAY,GACb,CAAC,EACF,KACG,CACL,IAAI,EAAyB,GAC7B,EAAM,QAAS,GAAS,CACtB,IAAM,EAAO,EAAK,EAAM,gBAAiB,EAAK,KAAK,CAC7C,EAAW,EAAwB,EAAM,UAAW,EAAK,CAC/D,GAAI,EAAS,OAAS,QAAU,EAAS,WAAa,EAAK,SAAU,CACnE,EAAK,UAAU,KAAK,EAAK,CACzB,OAEF,EAAyB,GACrB,EAAS,OAAS,WACpB,EAAK,UAAU,KAAK,EAAK,CACzB,EAAK,SAAS,KACZ,qDAAqD,EACnD,EAAM,oBACN,EACD,GACF,GAEH,CAEF,IAAM,EAAe,GAAqB,EAAM,CAC1C,EAAiB,EAAM,kBAAkB,KAAM,GAAS,CAAC,EAAa,IAAI,EAAK,CAAC,EAClF,CAAC,GAA0B,IAC7B,EAAK,SAAS,KACZ,sHACY,EACR,EAAM,oBACN,EAAM,gBACP,CAAC,wBAAwB,EAAW,KACxC,CAIL,IAAM,EAAW,IAAI,IAAI,EAAQ,SAAS,CACpC,EAAO,EAAM,YACnB,GAAI,EAAS,IAAI,EAAmB,OAAO,CAAE,CAC3C,IAAM,EAAe,EAAK,EAAM,UAAW,gBAAgB,CACrD,EAAiB,EAAK,EAAM,UAAW,kBAAkB,CACzD,EAAY,EAAK,EAAM,UAAW,aAAa,CAiCrD,CAlBE,CACE,KAAM,EACN,YAAa,0DACb,OAAQ,EAAU,EAAgB,IAChC,GAA0B,EAAU,EAAgB,EAAgB,CACvE,CACD,CACE,KAAM,EACN,YAAa,sEACb,MAAQ,GAAa,GAA4B,EAAS,CAC3D,CACD,CACE,KAAM,EACN,YAAa,wCACb,OAAQ,EAAU,EAAgB,IAChC,GAAuB,EAAU,EAAgB,EAAgB,CACpE,CAEY,CAAC,SAAS,CAAE,OAAM,cAAa,WAAY,CACxD,IAAM,EAAW,EAAwB,EAAM,UAAW,EAAK,CAC/D,GAAI,EAAS,OAAS,UAAY,EAAS,OAAS,OAAQ,CAC1D,EAAK,UAAU,KAAK,EAAK,CACzB,EAAK,SAAS,KACZ,2EAA2E,EACzE,EAAM,oBACN,EACD,GACF,CACD,OAEF,GACE,EACA,EACA,EACA,EAAM,EAAS,OAAS,OAAS,EAAS,SAAW,KAAM,EAAM,EAAM,gBAAgB,CACvF,EACA,EAAM,oBACP,EACD,CAGJ,GAAI,EAAS,IAAI,EAAmB,MAAM,CAAE,CAC1C,IAAM,EAAY,EAAsB,CACtC,cAAe,EACf,oBAAqB,EAAM,yBAC3B,UAAW,EAAM,UACjB,MAAO,EACP,iBAAkB,GACnB,CAAC,CACF,EAAK,QAAQ,KAAK,GAAG,EAAU,QAAQ,CACvC,EAAK,UAAU,KAAK,GAAG,EAAU,UAAU,CAC3C,EAAK,SAAS,KACZ,GAAG,EAAU,SAAS,IAAK,GAClB,EAAU,UAAU,QACxB,EAAU,IACT,EAAS,QAAQ,EAAM,EAAmB,EAAM,oBAAqB,EAAK,CAAC,CAC7E,EACD,CACD,CACH,CAGH,GAAI,EAAS,IAAI,EAAmB,GAAG,CACrC,GAAI,CAAC,EAAM,gBAAkB,CAAC,EAAM,WAClC,EAAK,SAAS,KACZ,iGACD,KACI,CACL,IAAM,EAAe,EAAK,EAAM,eAAgB,EAAwB,CAClE,EACJ,EAAS,EAAM,eAAgB,EAAM,gBAAgB,CAAC,MAAM,EAAI,CAAC,KAAK,IAAI,EAAI,IAC1E,EAAmB,GAAoC,CAC3D,WAAY,EAAQ,WACpB,qBACA,kBAAmB,EAAE,CACtB,CAAC,CACI,EAAmB,EAAwB,EAAM,UAAW,EAAa,CAC3E,EAAiB,OAAS,SAC5B,EAAc,EAAM,EAAO,CACzB,KAAM,EACN,SAAU,EACV,YAAa,+CACb,WAAY,GACb,CAAC,CAEF,EAAiB,OAAS,QAC1B,EAAiB,WAAa,EAE9B,EAAK,UAAU,KAAK,EAAa,EAEjC,EAAK,UAAU,KAAK,EAAa,CACjC,EAAK,SAAS,KACZ,wDAAwD,EACtD,EAAM,oBACN,EACD,CAAC,qDACH,EAMP,OADA,EAAK,QAAQ,SAAS,CAAE,UAAW,EAAgB,EAAM,YAAa,EAAK,CAAC,CACrE,ECzUT,MAAM,GAAiE,EACpE,EAAmB,QAAS,kCAC5B,EAAmB,OAAQ,6BAC3B,EAAmB,IAAK,iCAC1B,CAGK,GAAqB,OAAO,OAAO,EAAmB,CAiB5D,SAAS,EAA0B,EAAuB,EAAuC,CAC/F,IAAM,EAAS,CAAC,EAAO,OAAO,MAAM,CAAE,EAAO,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK;EAAK,CAChF,EAAM,IAAS,MAAQ,EAAkB,EAG/C,MACE,GAFA,IAAS,MAAQ,UAAY,SAAS,EAAqC,WAE5D,sBAAsB,EAAK,aAAa,CAAC,8BACrD,EAAO,OAAO,EAAS,KAAK,IAAW,IAAI,0DACY,IAY9D,eAAe,GACb,EACA,EACA,EAC6B,CAC7B,IAAM,EAAgC,CAAE,IAAK,KAAM,MAAO,KAAM,CAC1D,EAAqB,EAAE,CAEvB,EAAY,MAAM,EAAO,MAAO,CAAC,UAAU,CAAE,CAAE,MAAK,CAAE,EAAQ,CACpE,GAAI,EAAU,OAAO,OAAS,SAC5B,EAAS,KAAK,EAAoB,KAC7B,CACL,IAAM,EAAS,GAAG,EAAU,OAAO,IAAI,EAAU,SAC3C,EAAc,EAA6B,EAAO,CACpD,EAAU,OAAS,EAEZ,EACT,EAAS,KAAK,EAAY,CAE1B,EAAM,IAAM,EAAuB,EAAO,CAAE,QAJ5C,EAAS,KAAK,GAAe,EAA0B,MAAO,EAAU,CAAC,CAQ7E,IAAM,EAAc,MAAM,EAAO,QAAS,CAAC,UAAU,CAAE,CAAE,MAAK,CAAE,EAAQ,CACxE,GAAI,EAAY,OAAO,OAAS,SAC9B,EAAS,KAAK,EAAsB,KAC/B,CACL,IAAM,EAAS,GAAG,EAAY,OAAO,IAAI,EAAY,SAC/C,EAAc,EAClB,EACA,EACA,qBAAqB,EAA2B,6BACjD,CACG,EAAY,OAAS,EAEd,EACT,EAAS,KAAK,EAAY,CAE1B,EAAM,MAAQ,EAAuB,EAAO,CAAE,QAJ9C,EAAS,KAAK,GAAe,EAA0B,QAAS,EAAY,CAAC,CAQjF,MAAO,CAAE,QAAO,WAAU,CAW5B,eAAsB,EAEpB,EACA,EAAoB,EACpB,EAAgC,EACjB,CACf,EAAoB,KAAK,QAAQ,CACjC,GAAI,CACF,IAAM,EAAU,MAAM,GAAoB,KAAM,KAAK,QAAQ,KAAK,CAAE,EAAO,CACrE,EAAQ,EAAsB,KAAM,EAAU,CAC9C,EAAU,IAAI,EAAgB,KAAK,CACnC,EAAc,EAClB,EACA,KAAK,QAAQ,MAAM,MACnB,KAAK,QAAQ,OAAO,MACrB,CACK,EAAW,MAAM,EAAqB,EAAS,CACnD,SAAU,GACV,OAAQ,GACR,QAAS,EACN,EAAmB,QAAS,EAAM,QAClC,EAAmB,OAAQ,EAAM,OACjC,EAAmB,IAAK,EAAM,GAChC,CACD,cACD,CAAC,CACI,EAAiB,EAAoC,EAAO,CAAE,WAAU,CAAC,CAGzE,EAAO,GACX,CAAE,QAAO,UAHO,EAAyB,KAAM,EAAM,YAAa,EAGhD,CAAE,CACpB,CACE,WACA,WAAYC,EACb,CACF,CACD,EAAK,SAAS,KAAK,GAAG,EAAQ,SAAS,CAElC,EAAM,MACT,KAAK,OAAO,KACV,EAAkB,EAAM,CACtB,IAAK,KAAK,QAAQ,KAAK,CACvB,MAAO,6BACP,QAAS,CAAC,CAAE,MAAO,SAAU,KAAM,EAAK,gBAAiB,CAAC,CAC3D,CAAC,CACH,CAGH,IAAI,EAAW,EAAK,QAAQ,SAAW,GAAK,EAAM,OAClD,GAAI,EAAK,QAAQ,OAAS,GAAK,CAAC,EAAM,OACpC,GAAI,EAAM,IACR,EAAW,WACF,EACT,EAAW,MAAM,EAAQ,QAAQ,4BAA6B,GAAK,MAEnE,MAAU,MACR,qGACD,CAID,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,GACrD,MAAM,EAAiB,KAAM,EAAK,CAEpC,IAAM,EAAU,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,EAC7D,EAAiB,GAAY,CAAC,EAAM,OACpC,EAAY,EAAyB,CACzC,YAAa,EACX,EAAmB,KAAK,QAAQ,KAAK,CAAE,EAAM,gBAAgB,CAC9D,CACD,SAAU,GAAkB,EAAS,SAAS,EAAmB,MAAM,CACvE,WAAY,EAAK,UAAU,GAC5B,CAAC,CACI,EAAS,EAA0B,EAAM,CAC7C,UACA,OAAQ,EAAM,OACd,IAAK,KAAK,QAAQ,KAAK,CACvB,YACA,MAAO,EAAQ,MAChB,CAAC,CACF,GAAI,EAAM,KAAM,CACd,KAAK,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,EAAO,CAAC,IAAI,CACxD,OAEF,GAAI,EAAM,OAAQ,CAChB,KAAK,OAAO,KAAK,EAAO,OAAO,6CAA6C,CAAC,CAC7E,OAEF,GAAI,CAAC,EAAU,CACb,KAAK,OAAO,KAAK,EAAO,OAAO,sBAAsB,CAAC,CACtD,OAEF,GAAI,EAAK,QAAQ,SAAW,EAAG,CAC7B,IAAM,EACJ,EAAK,SAAS,SAAW,EAAQ,SAAS,OACtC,yCACA,8CACN,KAAK,OAAO,KAAK,EAAO,MAAM,EAAQ,CAAC,MAEvC,KAAK,OAAO,KAAK,EAAO,MAAM,8BAA8B,CAAC,CAE3D,EAAK,UAAU,OAAS,IAC1B,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,aAAa,GAAG,CAClD,EAAK,UAAU,QAAS,GAAS,KAAK,OAAO,KAAK,EAAK,CAAC,EAE1D,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,4CAA4C,GAAG,CACjF,KAAK,OAAO,KAAK,EAAU,OACpB,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,KAAK,QAAQ,KAAK,IAAI,CAE/B,MAAM"}
+{"version":3,"file":"impl-DKhqM6hZ2.mjs","names":["POLICY_SKILL_MD","POLICY_SETUP_TOOLING_REFERENCE_MD","POLICY_AUTHORING_REFERENCE_MD","POLICY_TESTING_DEBUGGING_REFERENCE_MD","POLICY_PUBLISHING_REFERENCE_MD","CLI_VERSION"],"sources":["../src/lib/policy/policy-scaffold-model.ts","../../../skills/transcend-policy-engine/references/authoring.md","../../../skills/transcend-policy-engine/references/publishing.md","../../../skills/transcend-policy-engine/references/setup-tooling.md","../../../skills/transcend-policy-engine/references/testing-debugging.md","../../../skills/transcend-policy-engine/SKILL.md","../src/lib/policy/policy-skill.ts","../src/lib/policy/policy-scaffold-output.ts","../src/lib/policy/policy-scaffold-planning.ts","../src/commands/policy/init/impl.ts"],"sourcesContent":["import type { ExistingProjectSkillDirectory } from '../scaffolding/agent-skill.js';\nimport type { ProjectPlan } from '../scaffolding/project-plan.js';\n\n/** Version of the stable policy initialization JSON result. */\nexport const POLICY_INIT_RESULT_VERSION = 3 as const;\n\n/** Optional repository integrations for policy authoring. */\nexport const PolicySetupFeature = {\n  /** Repository-level editor configuration. */\n  Editor: 'editor',\n  /** Managed policy authoring skill. */\n  Skill: 'skill',\n  /** Credential-free continuous integration. */\n  Ci: 'ci',\n} as const;\n\n/** Optional repository integration for policy authoring. */\nexport type PolicySetupFeature = (typeof PolicySetupFeature)[keyof typeof PolicySetupFeature];\n\n/** Repository and target state collected before policy planning. */\nexport interface PolicyProjectState {\n  /** Directory from which the CLI was invoked. */\n  invocationDirectory: string;\n  /** Absolute user-selected policy directory. */\n  targetDirectory: string;\n  /** Repository or invocation root that owns setup artifacts. */\n  projectRoot: string;\n  /** Nearest repository root, when present. */\n  repositoryRoot?: string;\n  /** Existing project-level skill directories. */\n  existingSkillDirectories: ExistingProjectSkillDirectory[];\n  /** Whether the repository appears to use GitHub. */\n  usesGithub: boolean;\n  /** Case-preserving relative paths below the policy directory. */\n  relativePaths: string[];\n  /** Relative file and link paths below the policy directory. */\n  relativeFilePaths: string[];\n}\n\n/** A complete, validated policy initialization plan. */\nexport interface PolicyInitProjectPlan extends ProjectPlan {\n  /** JSON contract version. */\n  version: typeof POLICY_INIT_RESULT_VERSION;\n  /** Command that produced the plan. */\n  command: 'init';\n  /** Absolute policy project directory. */\n  targetDirectory: string;\n  /** Absolute policy manifest path. */\n  manifestPath: string;\n  /** Files inspected and deliberately left unchanged. */\n  unchanged: string[];\n  /** Non-fatal plan warnings. */\n  warnings: string[];\n  /** Raw commands shown after a successful apply. */\n  nextSteps: string[];\n  /** Exact generated example that remains safe to replace. */\n  disposableExamplePath?: string;\n  /** Selected repository integrations. */\n  features: PolicySetupFeature[];\n}\n",null,null,null,null,null,"import POLICY_AUTHORING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/authoring.md';\nimport POLICY_PUBLISHING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/publishing.md';\nimport POLICY_SETUP_TOOLING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/setup-tooling.md';\nimport POLICY_TESTING_DEBUGGING_REFERENCE_MD from '../../../../../skills/transcend-policy-engine/references/testing-debugging.md';\nimport POLICY_SKILL_MD from '../../../../../skills/transcend-policy-engine/SKILL.md';\nimport type { AgentSkillFile } from '../scaffolding/agent-skill.js';\n\n/** Namespaced directory and frontmatter name for the installed Agent Skill. */\nexport const POLICY_SKILL_NAME = 'transcend-policy-engine';\n\nexport {\n  POLICY_AUTHORING_REFERENCE_MD,\n  POLICY_PUBLISHING_REFERENCE_MD,\n  POLICY_SETUP_TOOLING_REFERENCE_MD,\n  POLICY_SKILL_MD,\n  POLICY_TESTING_DEBUGGING_REFERENCE_MD,\n};\n\n/** Complete portable Policy Engine Agent Skill file set. */\nexport const POLICY_SKILL_FILES: readonly AgentSkillFile[] = [\n  { path: 'SKILL.md', contents: POLICY_SKILL_MD },\n  { path: 'references/setup-tooling.md', contents: POLICY_SETUP_TOOLING_REFERENCE_MD },\n  { path: 'references/authoring.md', contents: POLICY_AUTHORING_REFERENCE_MD },\n  { path: 'references/testing-debugging.md', contents: POLICY_TESTING_DEBUGGING_REFERENCE_MD },\n  { path: 'references/publishing.md', contents: POLICY_PUBLISHING_REFERENCE_MD },\n];\n","import {\n  toPublicPlannedChange,\n  type PublicPlannedChange,\n} from '../scaffolding/project-plan-output.js';\nimport type { PolicyInitProjectPlan, PolicySetupFeature } from './policy-scaffold-model.js';\nimport { POLICY_SKILL_NAME } from './policy-skill.js';\n\n/** Detected local policy tool versions. */\nexport interface PolicyInitToolVersions {\n  /** OPA version, or null when missing or incompatible. */\n  opa: string | null;\n  /** Regal version, or null when missing or incompatible. */\n  regal: string | null;\n}\n\n/** Stable machine-readable policy initialization result. */\nexport interface PolicyInitPlanResult {\n  /** JSON contract version. */\n  version: number;\n  /** Command that produced the result. */\n  command: 'init';\n  /** Whether the plan was applied. */\n  applied: boolean;\n  /** Whether this was a dry run. */\n  dryRun: boolean;\n  /** Absolute policy target directory. */\n  targetDirectory: string;\n  /** Absolute policy manifest path. */\n  manifestPath: string;\n  /** Planned mutations without file contents. */\n  changes: PublicPlannedChange[];\n  /** Non-fatal preservation and runtime warnings. */\n  warnings: string[];\n  /** Suggested raw one-line follow-up commands. */\n  nextSteps: string[];\n  /** Explicitly selected repository integrations. */\n  features: PolicySetupFeature[];\n  /** Compact prompt for continuing with a coding agent. */\n  aiHandoff: string;\n  /** Compatible local policy tool versions. */\n  tools: PolicyInitToolVersions;\n}\n\n/**\n * Build the compact policy implementation and CI handoff.\n *\n * @param options - Portable project path and next step\n * @returns Raw one-line prompt\n */\nexport function buildPolicyInitAiHandoff(options: {\n  /** Display path to the policy project. */\n  projectPath: string;\n  /** Whether the policy authoring skill was installed. */\n  hasSkill: boolean;\n  /** Copyable new-bundle command. */\n  newCommand: string;\n}): string {\n  const instruction = options.hasSkill ? `Use the \\`${POLICY_SKILL_NAME}\\` skill and run` : 'Run';\n  return (\n    `${instruction} ${options.newCommand} to add a bundle from a template, ` +\n    `then adapt the policy document tree and input/output contract to the intended application.`\n  );\n}\n\n/**\n * Build the stable machine-readable initialization result.\n *\n * @param plan - Policy project plan\n * @param options - Apply and runtime state\n * @returns Public JSON result\n */\nexport function buildPolicyInitPlanResult(\n  plan: PolicyInitProjectPlan,\n  options: {\n    /** Whether the plan was applied. */\n    applied: boolean;\n    /** Whether this was a dry run. */\n    dryRun: boolean;\n    /** Working directory for portable paths. */\n    cwd: string;\n    /** Compact coding-agent prompt. */\n    aiHandoff: string;\n    /** Compatible local policy tool versions. */\n    tools: PolicyInitToolVersions;\n  },\n): PolicyInitPlanResult {\n  return {\n    version: plan.version,\n    command: plan.command,\n    applied: options.applied,\n    dryRun: options.dryRun,\n    targetDirectory: plan.targetDirectory,\n    manifestPath: plan.manifestPath,\n    changes: plan.changes.map((change) => toPublicPlannedChange(options.cwd, change)),\n    warnings: plan.warnings,\n    nextSteps: plan.nextSteps,\n    features: [...plan.features],\n    aiHandoff: options.aiHandoff,\n    tools: options.tools,\n  };\n}\n","import { isAbsolute, join, posix, relative, sep } from 'node:path';\n\nimport {\n  getManagedAgentSkillCandidatePaths,\n  planManagedAgentSkill,\n  type ManagedAgentSkillDefinition,\n} from '../scaffolding/agent-skill.js';\nimport { displayProjectPath } from '../scaffolding/project-plan-output.js';\nimport {\n  getPlanningPathSnapshot,\n  getPlanningFileSnapshot,\n  planFileChange,\n  type PlanningPathSnapshot,\n} from '../scaffolding/project-plan.js';\nimport {\n  generatePolicyGithubActionsWorkflow,\n  POLICY_CI_WORKFLOW_PATH,\n} from './policy-scaffold-artifacts.js';\nimport {\n  mergePolicyEditorExtensions,\n  mergePolicyEditorSettings,\n  mergePolicyEditorTasks,\n  type PolicyEditorMergeResult,\n} from './policy-scaffold-config.js';\nimport {\n  POLICY_INIT_RESULT_VERSION,\n  PolicySetupFeature,\n  type PolicyInitProjectPlan,\n  type PolicyProjectState,\n  type PolicySetupFeature as PolicySetupFeatureType,\n} from './policy-scaffold-model.js';\nimport {\n  generatePolicyWorkspaceFiles,\n  POLICY_STARTER_BUNDLE_DIRECTORY,\n  type PolicyStarterFile,\n} from './policy-scaffold-templates.js';\nimport { POLICY_SKILL_FILES, POLICY_SKILL_NAME } from './policy-skill.js';\n\n/** Managed Policy Engine Agent Skill definition. */\nconst POLICY_MANAGED_SKILL: ManagedAgentSkillDefinition = {\n  name: POLICY_SKILL_NAME,\n  displayName: 'Policy Engine',\n  owner: '@transcend-io/cli',\n  files: POLICY_SKILL_FILES,\n};\n\n/** In-memory input consumed by the pure policy initializer. */\nexport interface PolicyInitPlanningInput {\n  /** Project discovery state. */\n  state: PolicyProjectState;\n  /** Potential mutation paths keyed by absolute path. */\n  snapshots: Readonly<Record<string, PlanningPathSnapshot>>;\n}\n\n/** Optional repository setup selected for policy initialization. */\nexport interface PolicyInitPlanOptions {\n  /** Selected setup features. */\n  features: readonly PolicySetupFeatureType[];\n  /** Exact released Transcend CLI version for generated CI. */\n  cliVersion: string;\n}\n\n/**\n * Enumerate all core starter paths that could be created.\n *\n * @param state - Policy project state\n * @param options - Selected repository setup\n * @returns Absolute candidate paths\n */\nexport function getPolicyInitPlanningCandidatePaths(\n  state: PolicyProjectState,\n  options: Pick<PolicyInitPlanOptions, 'features'>,\n): string[] {\n  const paths = new Set(\n    generatePolicyWorkspaceFiles().map(({ path }) => join(state.targetDirectory, path)),\n  );\n  const selected = new Set(options.features);\n  if (selected.has(PolicySetupFeature.Editor)) {\n    paths.add(join(state.projectRoot, '.vscode', 'settings.json'));\n    paths.add(join(state.projectRoot, '.vscode', 'extensions.json'));\n    paths.add(join(state.projectRoot, '.vscode', 'tasks.json'));\n  }\n  if (selected.has(PolicySetupFeature.Skill)) {\n    getManagedAgentSkillCandidatePaths(\n      state.projectRoot,\n      state.existingSkillDirectories,\n      POLICY_MANAGED_SKILL,\n    ).forEach((path) => paths.add(path));\n  }\n  if (selected.has(PolicySetupFeature.Ci) && state.repositoryRoot && state.usesGithub) {\n    paths.add(join(state.repositoryRoot, POLICY_CI_WORKFLOW_PATH));\n  }\n  return [...paths].sort((left, right) => left.localeCompare(right));\n}\n\n/**\n * Ensure a destination stays below an approved project root.\n *\n * @param root - Approved root\n * @param path - Candidate path\n */\nfunction assertContained(root: string, path: string): void {\n  const child = relative(root, path);\n  if (child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child)) {\n    throw new Error(`Refusing to modify path outside project root: ${path}`);\n  }\n}\n\n/**\n * Enumerate generated file and directory paths allowed in an exact starter.\n *\n * @param files - Starter files\n * @returns POSIX relative paths\n */\nfunction starterRelativePaths(files: readonly PolicyStarterFile[]): Set<string> {\n  const paths = new Set<string>([`${POLICY_STARTER_BUNDLE_DIRECTORY}/input.json`]);\n  files.forEach(({ path }) => {\n    paths.add(path);\n    let parent = posix.dirname(path);\n    while (parent !== '.') {\n      paths.add(parent);\n      parent = posix.dirname(parent);\n    }\n  });\n  return paths;\n}\n\n/**\n * Add or classify one regular-file mutation.\n *\n * @param plan - Policy plan being assembled\n * @param input - Collected snapshots\n * @param options - Desired file\n */\nfunction addFileChange(\n  plan: PolicyInitProjectPlan,\n  input: PolicyInitPlanningInput,\n  options: {\n    /** Absolute destination path. */\n    path: string;\n    /** Complete desired contents. */\n    contents: string;\n    /** Human-readable plan description. */\n    description: string;\n    /** Refuse existing contents. */\n    createOnly?: boolean;\n  },\n): void {\n  const change = planFileChange({\n    snapshot: getPlanningFileSnapshot(input.snapshots, options.path),\n    after: options.contents,\n    description: options.description,\n    ...(options.createOnly === undefined ? {} : { createOnly: options.createOnly }),\n  });\n  if (change) {\n    plan.changes.push(change);\n  } else {\n    plan.unchanged.push(options.path);\n  }\n}\n\n/**\n * Add one safe editor merge and its preservation warnings.\n *\n * @param plan - Policy plan being assembled\n * @param input - Collected snapshots\n * @param path - Absolute editor artifact path\n * @param result - Pure JSONC merge result\n * @param description - Human-readable plan description\n * @param cwd - Invocation directory for portable warning paths\n */\nfunction addEditorMerge(\n  plan: PolicyInitProjectPlan,\n  input: PolicyInitPlanningInput,\n  path: string,\n  result: PolicyEditorMergeResult,\n  description: string,\n  cwd: string,\n): void {\n  addFileChange(plan, input, {\n    path,\n    contents: result.contents,\n    description,\n  });\n  plan.warnings.push(\n    ...result.warnings.map((warning) => `${warning} (${displayProjectPath(cwd, path)})`),\n  );\n}\n\n/**\n * Build a safe policy project plan without reading the filesystem.\n *\n * Empty targets receive the complete starter. Existing targets are classified\n * only; no domain file is added, merged, or overwritten.\n *\n * @param input - Collected project state and path snapshots\n * @param options - Selected setup and pinned CLI version\n * @returns Validated policy initialization plan\n */\nexport function buildPolicyInitPlan(\n  input: PolicyInitPlanningInput,\n  options: PolicyInitPlanOptions,\n): PolicyInitProjectPlan {\n  const { state } = input;\n  const files = generatePolicyWorkspaceFiles();\n  const newCommand = 'transcend policy new';\n  const plan: PolicyInitProjectPlan = {\n    version: POLICY_INIT_RESULT_VERSION,\n    command: 'init',\n    rootDirectory: state.projectRoot,\n    targetDirectory: state.targetDirectory,\n    // Init creates a workspace only; bundles (and their .manifest) come from `policy new`.\n    manifestPath: state.targetDirectory,\n    changes: [],\n    unchanged: [],\n    warnings: [],\n    nextSteps: [newCommand],\n    features: [...options.features],\n  };\n\n  const candidatePaths = getPolicyInitPlanningCandidatePaths(state, options);\n  assertContained(state.projectRoot, state.targetDirectory);\n  candidatePaths.forEach((path) => assertContained(state.projectRoot, path));\n\n  if (state.relativeFilePaths.length === 0) {\n    plan.directoryPreconditions = [\n      {\n        path: state.targetDirectory,\n        relativePaths: [...state.relativePaths],\n      },\n    ];\n    files.forEach((file) => {\n      const path = join(state.targetDirectory, file.path);\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind !== 'absent') {\n        throw new Error(`Expected an empty policy target, but found an entry at: ${path}`);\n      }\n      addFileChange(plan, input, {\n        path,\n        contents: file.contents,\n        description: file.description,\n        createOnly: true,\n      });\n    });\n  } else {\n    let allWorkspaceFilesMatch = true;\n    files.forEach((file) => {\n      const path = join(state.targetDirectory, file.path);\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind === 'file' && snapshot.contents === file.contents) {\n        plan.unchanged.push(path);\n        return;\n      }\n      allWorkspaceFilesMatch = false;\n      if (snapshot.kind !== 'absent') {\n        plan.unchanged.push(path);\n        plan.warnings.push(\n          `Existing policy scaffold path was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            path,\n          )}`,\n        );\n      }\n    });\n\n    const allowedPaths = starterRelativePaths(files);\n    const hasCustomPaths = state.relativeFilePaths.some((path) => !allowedPaths.has(path));\n    if (!allWorkspaceFilesMatch || hasCustomPaths) {\n      plan.warnings.push(\n        `Existing policy target contains custom or partial content, so no workspace files were added or overwritten. ` +\n          `Review ${displayProjectPath(\n            state.invocationDirectory,\n            state.targetDirectory,\n          )} manually, then run \\`${newCommand}\\`.`,\n      );\n    }\n  }\n\n  const selected = new Set(options.features);\n  const root = state.projectRoot;\n  if (selected.has(PolicySetupFeature.Editor)) {\n    const settingsPath = join(root, '.vscode', 'settings.json');\n    const extensionsPath = join(root, '.vscode', 'extensions.json');\n    const tasksPath = join(root, '.vscode', 'tasks.json');\n\n    type EditorMergeFn = (\n      contents: string | null,\n      repositoryRoot: string,\n      targetDirectory: string,\n    ) => PolicyEditorMergeResult;\n    const editorArtifacts: {\n      /** Absolute path. */\n      path: string;\n      /** Plan description. */\n      description: string;\n      /** Merge function. */\n      merge: EditorMergeFn;\n    }[] = [\n      {\n        path: settingsPath,\n        description: 'Merge strict target-scoped OPA and Rego editor settings',\n        merge: (contents, repositoryRoot, targetDirectory) =>\n          mergePolicyEditorSettings(contents, repositoryRoot, targetDirectory),\n      },\n      {\n        path: extensionsPath,\n        description: 'Recommend the OPA extension and discourage its syntax-only conflict',\n        merge: (contents) => mergePolicyEditorExtensions(contents),\n      },\n      {\n        path: tasksPath,\n        description: 'Create the VS Code task configuration',\n        merge: (contents, repositoryRoot, targetDirectory) =>\n          mergePolicyEditorTasks(contents, repositoryRoot, targetDirectory),\n      },\n    ];\n    editorArtifacts.forEach(({ path, description, merge }) => {\n      const snapshot = getPlanningPathSnapshot(input.snapshots, path);\n      if (snapshot.kind !== 'absent' && snapshot.kind !== 'file') {\n        plan.unchanged.push(path);\n        plan.warnings.push(\n          `Existing VS Code artifact is not a regular file and was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            path,\n          )}`,\n        );\n        return;\n      }\n      addEditorMerge(\n        plan,\n        input,\n        path,\n        merge(snapshot.kind === 'file' ? snapshot.contents : null, root, state.targetDirectory),\n        description,\n        state.invocationDirectory,\n      );\n    });\n  }\n\n  if (selected.has(PolicySetupFeature.Skill)) {\n    const skillPlan = planManagedAgentSkill({\n      rootDirectory: root,\n      existingDirectories: state.existingSkillDirectories,\n      snapshots: input.snapshots,\n      skill: POLICY_MANAGED_SKILL,\n      preserveModified: true,\n    });\n    plan.changes.push(...skillPlan.changes);\n    plan.unchanged.push(...skillPlan.unchanged);\n    plan.warnings.push(\n      ...skillPlan.warnings.map((warning) => {\n        return skillPlan.unchanged.reduce(\n          (rendered, path) =>\n            rendered.replace(path, displayProjectPath(state.invocationDirectory, path)),\n          warning,\n        );\n      }),\n    );\n  }\n\n  if (selected.has(PolicySetupFeature.Ci)) {\n    if (!state.repositoryRoot || !state.usesGithub) {\n      plan.warnings.push(\n        'GitHub Actions setup was selected, but this target is not inside a detected GitHub repository.',\n      );\n    } else {\n      const workflowPath = join(state.repositoryRoot, POLICY_CI_WORKFLOW_PATH);\n      const workspaceDirectory =\n        relative(state.repositoryRoot, state.targetDirectory).split(sep).join('/') || '.';\n      const workflowContents = generatePolicyGithubActionsWorkflow({\n        cliVersion: options.cliVersion,\n        workspaceDirectory,\n        bundleDirectories: [],\n      });\n      const workflowSnapshot = getPlanningPathSnapshot(input.snapshots, workflowPath);\n      if (workflowSnapshot.kind === 'absent') {\n        addFileChange(plan, input, {\n          path: workflowPath,\n          contents: workflowContents,\n          description: 'Add credential-free Policy Engine validation',\n          createOnly: true,\n        });\n      } else if (\n        workflowSnapshot.kind === 'file' &&\n        workflowSnapshot.contents === workflowContents\n      ) {\n        plan.unchanged.push(workflowPath);\n      } else {\n        plan.unchanged.push(workflowPath);\n        plan.warnings.push(\n          `Existing GitHub Actions workflow was left unchanged: ${displayProjectPath(\n            state.invocationDirectory,\n            workflowPath,\n          )}. Adapt it manually to validate each policy bundle.`,\n        );\n      }\n    }\n  }\n\n  plan.changes.forEach(({ path }) => assertContained(state.projectRoot, path));\n  return plan;\n}\n","import colors from 'colors';\n\nimport { version as CLI_VERSION } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport {\n  runCapturedProcess,\n  type CapturedProcessResult,\n  type CapturedProcessRunner,\n} from '../../../lib/cli/run-captured-process.js';\nimport {\n  DEFAULT_POLICY_PROJECT_DIRECTORY,\n  discoverPolicyProject,\n} from '../../../lib/policy/policy-project-discovery.js';\nimport {\n  OPA_INSTALL_URL,\n  OPA_MISSING_MESSAGE,\n  parsePolicyToolVersion,\n  MINIMUM_POLICY_STARTER_REGAL_VERSION,\n  REGAL_INSTALL_URL,\n  REGAL_MISSING_MESSAGE,\n  unsupportedOpaVersionMessage,\n  unsupportedRegalVersionMessage,\n} from '../../../lib/policy/policy-runtime.js';\nimport {\n  PolicySetupFeature,\n  type PolicySetupFeature as PolicySetupFeatureType,\n} from '../../../lib/policy/policy-scaffold-model.js';\nimport {\n  buildPolicyInitAiHandoff,\n  buildPolicyInitPlanResult,\n  type PolicyInitToolVersions,\n} from '../../../lib/policy/policy-scaffold-output.js';\nimport {\n  buildPolicyInitPlan,\n  getPolicyInitPlanningCandidatePaths,\n} from '../../../lib/policy/policy-scaffold-planning.js';\nimport { POLICY_STARTER_OPA_VERSION } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { collectPlanningSnapshots } from '../../../lib/scaffolding/project-discovery.js';\nimport { applyProjectPlan } from '../../../lib/scaffolding/project-plan-apply.js';\nimport {\n  displayProjectPath,\n  quoteShellArgument,\n  renderProjectPlan,\n} from '../../../lib/scaffolding/project-plan-output.js';\nimport {\n  isInteractivePromptInvocation,\n  PromptCancelledError,\n  resolveSetupFeatures,\n  ScaffoldPrompts,\n} from '../../../lib/scaffolding/prompts.js';\n\n/** Flags for `transcend policy init`. */\nexport interface PolicyInitFlags {\n  /** Install repository-level VS Code setup. */\n  editor?: boolean;\n  /** Install the Policy Engine Agent Skill. */\n  skill?: boolean;\n  /** Install validation-only GitHub Actions CI. */\n  ci?: boolean;\n  /** Disable prompts. */\n  noInteractive: boolean;\n  /** Render but do not apply the plan. */\n  dryRun: boolean;\n  /** Approve the final displayed plan. */\n  yes: boolean;\n  /** Emit one stable JSON result on stdout. */\n  json: boolean;\n}\n\n/** User-facing optional setup labels. */\nconst SETUP_LABELS: Readonly<Record<PolicySetupFeatureType, string>> = {\n  [PolicySetupFeature.Editor]: 'VS Code settings and lint task',\n  [PolicySetupFeature.Skill]: 'Policy Engine Agent Skill',\n  [PolicySetupFeature.Ci]: 'Validation-only GitHub Actions',\n};\n\n/** All optional setup features in stable prompt order. */\nconst ALL_SETUP_FEATURES = Object.values(PolicySetupFeature);\n\n/** Runtime compatibility detected before policy planning. */\ninterface PolicyRuntimeProbe {\n  /** Compatible tool versions. */\n  tools: PolicyInitToolVersions;\n  /** Missing or incompatible runtime guidance. */\n  warnings: string[];\n}\n\n/**\n * Explain a failed version subprocess with official installation guidance.\n *\n * @param tool - Policy tool name\n * @param result - Failed captured process\n * @returns Actionable warning\n */\nfunction failedVersionProbeMessage(tool: 'OPA' | 'Regal', result: CapturedProcessResult): string {\n  const detail = [result.stdout.trim(), result.stderr.trim()].filter(Boolean).join('\\n');\n  const url = tool === 'OPA' ? OPA_INSTALL_URL : REGAL_INSTALL_URL;\n  const requirement =\n    tool === 'OPA' ? 'OPA 1.x' : `Regal ${MINIMUM_POLICY_STARTER_REGAL_VERSION} or newer`;\n  return (\n    `${requirement} is required, but \\`${tool.toLowerCase()} version\\` exited with code ` +\n    `${result.code}${detail ? `: ${detail}` : '.'} ` +\n    `Install or upgrade it using the official instructions: ${url}`\n  );\n}\n\n/**\n * Probe both local policy runtimes without installing or modifying them.\n *\n * @param context - CLI context\n * @param cwd - Invocation working directory\n * @param runner - Captured subprocess runner\n * @returns Compatible versions and exact runtime guidance\n */\nasync function probePolicyRuntimes(\n  context: LocalContext,\n  cwd: string,\n  runner: CapturedProcessRunner,\n): Promise<PolicyRuntimeProbe> {\n  const tools: PolicyInitToolVersions = { opa: null, regal: null };\n  const warnings: string[] = [];\n\n  const opaResult = await runner('opa', ['version'], { cwd }, context);\n  if (opaResult.error?.code === 'ENOENT') {\n    warnings.push(OPA_MISSING_MESSAGE);\n  } else {\n    const output = `${opaResult.stdout}\\n${opaResult.stderr}`;\n    const unsupported = unsupportedOpaVersionMessage(output);\n    if (opaResult.code !== 0) {\n      warnings.push(unsupported ?? failedVersionProbeMessage('OPA', opaResult));\n    } else if (unsupported) {\n      warnings.push(unsupported);\n    } else {\n      tools.opa = parsePolicyToolVersion(output)!.version;\n    }\n  }\n\n  const regalResult = await runner('regal', ['version'], { cwd }, context);\n  if (regalResult.error?.code === 'ENOENT') {\n    warnings.push(REGAL_MISSING_MESSAGE);\n  } else {\n    const output = `${regalResult.stdout}\\n${regalResult.stderr}`;\n    const unsupported = unsupportedRegalVersionMessage(\n      output,\n      MINIMUM_POLICY_STARTER_REGAL_VERSION,\n      `the generated OPA ${POLICY_STARTER_OPA_VERSION} capabilities configuration`,\n    );\n    if (regalResult.code !== 0) {\n      warnings.push(unsupported ?? failedVersionProbeMessage('Regal', regalResult));\n    } else if (unsupported) {\n      warnings.push(unsupported);\n    } else {\n      tools.regal = parsePolicyToolVersion(output)!.version;\n    }\n  }\n\n  return { tools, warnings };\n}\n\n/**\n * Initialize a credential-free local Policy Engine project.\n *\n * @param this - CLI context\n * @param flags - Scaffold and interaction flags\n * @param directory - Target policy directory\n * @param runner - Captured policy tool runner\n */\nexport async function init(\n  this: LocalContext,\n  flags: PolicyInitFlags,\n  directory: string = DEFAULT_POLICY_PROJECT_DIRECTORY,\n  runner: CapturedProcessRunner = runCapturedProcess,\n): Promise<void> {\n  doneInputValidation(this.process);\n  try {\n    const runtime = await probePolicyRuntimes(this, this.process.cwd(), runner);\n    const state = discoverPolicyProject(this, directory);\n    const prompts = new ScaffoldPrompts(this);\n    const interactive = isInteractivePromptInvocation(\n      flags,\n      this.process.stdin.isTTY,\n      this.process.stderr.isTTY,\n    );\n    const features = await resolveSetupFeatures(prompts, {\n      features: ALL_SETUP_FEATURES,\n      labels: SETUP_LABELS,\n      enabled: {\n        [PolicySetupFeature.Editor]: flags.editor,\n        [PolicySetupFeature.Skill]: flags.skill,\n        [PolicySetupFeature.Ci]: flags.ci,\n      },\n      interactive,\n    });\n    const candidatePaths = getPolicyInitPlanningCandidatePaths(state, { features });\n    const snapshots = collectPlanningSnapshots(this, state.projectRoot, candidatePaths);\n\n    const plan = buildPolicyInitPlan(\n      { state, snapshots },\n      {\n        features,\n        cliVersion: CLI_VERSION,\n      },\n    );\n    plan.warnings.push(...runtime.warnings);\n\n    if (!flags.json) {\n      this.logger.info(\n        renderProjectPlan(plan, {\n          cwd: this.process.cwd(),\n          title: 'Policy initialization plan',\n          details: [{ label: 'Target', path: plan.targetDirectory }],\n        }),\n      );\n    }\n\n    let approved = plan.changes.length === 0 || flags.dryRun;\n    if (plan.changes.length > 0 && !flags.dryRun) {\n      if (flags.yes) {\n        approved = true;\n      } else if (interactive) {\n        approved = await prompts.confirm('Apply this complete plan?', true);\n      } else {\n        throw new Error(\n          'The plan requires approval in a non-interactive invocation. Review with --dryRun, then pass --yes.',\n        );\n      }\n    }\n\n    if (approved && !flags.dryRun && plan.changes.length > 0) {\n      await applyProjectPlan(this, plan);\n    }\n    const applied = approved && !flags.dryRun && plan.changes.length > 0;\n    const setupAvailable = approved && !flags.dryRun;\n    const aiHandoff = buildPolicyInitAiHandoff({\n      projectPath: quoteShellArgument(\n        displayProjectPath(this.process.cwd(), state.targetDirectory),\n      ),\n      hasSkill: setupAvailable && features.includes(PolicySetupFeature.Skill),\n      newCommand: plan.nextSteps[0]!,\n    });\n    const result = buildPolicyInitPlanResult(plan, {\n      applied,\n      dryRun: flags.dryRun,\n      cwd: this.process.cwd(),\n      aiHandoff,\n      tools: runtime.tools,\n    });\n    if (flags.json) {\n      this.process.stdout.write(`${JSON.stringify(result)}\\n`);\n      return;\n    }\n    if (flags.dryRun) {\n      this.logger.info(colors.yellow('Dry run complete. No changes were written.'));\n      return;\n    }\n    if (!approved) {\n      this.logger.info(colors.yellow('No changes applied.'));\n      return;\n    }\n    if (plan.changes.length === 0) {\n      const message =\n        plan.warnings.length === runtime.warnings.length\n          ? 'Policy project is already initialized.'\n          : 'Existing policy project was left unchanged.';\n      this.logger.info(colors.green(message));\n    } else {\n      this.logger.info(colors.green('Policy project initialized.'));\n    }\n    if (plan.nextSteps.length > 0) {\n      this.logger.info(`\\n${colors.bold('Next steps')}`);\n      plan.nextSteps.forEach((step) => this.logger.info(step));\n    }\n    this.logger.info(`\\n${colors.bold('AI handoff — paste into your coding agent')}`);\n    this.logger.info(aiHandoff);\n  } catch (error) {\n    if (error instanceof PromptCancelledError) {\n      return this.process.exit(130);\n    }\n    throw error;\n  }\n}\n"],"mappings":"uyBAOA,MAAa,EAAqB,CAEhC,OAAQ,SAER,MAAO,QAEP,GAAI,KACL,OCdD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ICAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ECQA,MAAa,EAAoB,0BAWpB,EAAgD,CAC3D,CAAE,KAAM,WAAY,SAAUA,EAAiB,CAC/C,CAAE,KAAM,8BAA+B,SAAUC,EAAmC,CACpF,CAAE,KAAM,0BAA2B,SAAUC,EAA+B,CAC5E,CAAE,KAAM,kCAAmC,SAAUC,EAAuC,CAC5F,CAAE,KAAM,2BAA4B,SAAUC,EAAgC,CAC/E,CCwBD,SAAgB,EAAyB,EAO9B,CAET,MACE,GAFkB,EAAQ,SAAW,aAAa,EAAkB,kBAAoB,MAEzE,GAAG,EAAQ,WAAW,8HAYzC,SAAgB,EACd,EACA,EAYsB,CACtB,MAAO,CACL,QAAS,EAAK,QACd,QAAS,EAAK,QACd,QAAS,EAAQ,QACjB,OAAQ,EAAQ,OAChB,gBAAiB,EAAK,gBACtB,aAAc,EAAK,aACnB,QAAS,EAAK,QAAQ,IAAK,GAAW,EAAsB,EAAQ,IAAK,EAAO,CAAC,CACjF,SAAU,EAAK,SACf,UAAW,EAAK,UAChB,SAAU,CAAC,GAAG,EAAK,SAAS,CAC5B,UAAW,EAAQ,UACnB,MAAO,EAAQ,MAChB,CC5DH,MAAM,EAAoD,CACxD,KAAM,EACN,YAAa,gBACb,MAAO,oBACP,MAAO,EACR,CAyBD,SAAgB,EACd,EACA,EACU,CACV,IAAM,EAAQ,IAAI,IAChB,GAA8B,CAAC,KAAK,CAAE,UAAW,EAAK,EAAM,gBAAiB,EAAK,CAAC,CACpF,CACK,EAAW,IAAI,IAAI,EAAQ,SAAS,CAgB1C,OAfI,EAAS,IAAI,EAAmB,OAAO,GACzC,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,gBAAgB,CAAC,CAC9D,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,kBAAkB,CAAC,CAChE,EAAM,IAAI,EAAK,EAAM,YAAa,UAAW,aAAa,CAAC,EAEzD,EAAS,IAAI,EAAmB,MAAM,EACxC,EACE,EAAM,YACN,EAAM,yBACN,EACD,CAAC,QAAS,GAAS,EAAM,IAAI,EAAK,CAAC,CAElC,EAAS,IAAI,EAAmB,GAAG,EAAI,EAAM,gBAAkB,EAAM,YACvE,EAAM,IAAI,EAAK,EAAM,eAAgB,EAAwB,CAAC,CAEzD,CAAC,GAAG,EAAM,CAAC,MAAM,EAAM,IAAU,EAAK,cAAc,EAAM,CAAC,CASpE,SAAS,EAAgB,EAAc,EAAoB,CACzD,IAAM,EAAQ,EAAS,EAAM,EAAK,CAClC,GAAI,IAAU,MAAQ,EAAM,WAAW,KAAK,IAAM,EAAI,EAAW,EAAM,CACrE,MAAU,MAAM,iDAAiD,IAAO,CAU5E,SAAS,GAAqB,EAAkD,CAC9E,IAAM,EAAQ,IAAI,IAAY,CAAC,GAAG,EAAgC,aAAa,CAAC,CAShF,OARA,EAAM,SAAS,CAAE,UAAW,CAC1B,EAAM,IAAI,EAAK,CACf,IAAI,EAAS,EAAM,QAAQ,EAAK,CAChC,KAAO,IAAW,KAChB,EAAM,IAAI,EAAO,CACjB,EAAS,EAAM,QAAQ,EAAO,EAEhC,CACK,EAUT,SAAS,EACP,EACA,EACA,EAUM,CACN,IAAM,EAAS,EAAe,CAC5B,SAAU,EAAwB,EAAM,UAAW,EAAQ,KAAK,CAChE,MAAO,EAAQ,SACf,YAAa,EAAQ,YACrB,GAAI,EAAQ,aAAe,IAAA,GAAY,EAAE,CAAG,CAAE,WAAY,EAAQ,WAAY,CAC/E,CAAC,CACE,EACF,EAAK,QAAQ,KAAK,EAAO,CAEzB,EAAK,UAAU,KAAK,EAAQ,KAAK,CAcrC,SAAS,GACP,EACA,EACA,EACA,EACA,EACA,EACM,CACN,EAAc,EAAM,EAAO,CACzB,OACA,SAAU,EAAO,SACjB,cACD,CAAC,CACF,EAAK,SAAS,KACZ,GAAG,EAAO,SAAS,IAAK,GAAY,GAAG,EAAQ,IAAI,EAAmB,EAAK,EAAK,CAAC,GAAG,CACrF,CAaH,SAAgB,GACd,EACA,EACuB,CACvB,GAAM,CAAE,SAAU,EACZ,EAAQ,GAA8B,CACtC,EAAa,uBACb,EAA8B,CAClC,QAAA,EACA,QAAS,OACT,cAAe,EAAM,YACrB,gBAAiB,EAAM,gBAEvB,aAAc,EAAM,gBACpB,QAAS,EAAE,CACX,UAAW,EAAE,CACb,SAAU,EAAE,CACZ,UAAW,CAAC,EAAW,CACvB,SAAU,CAAC,GAAG,EAAQ,SAAS,CAChC,CAEK,EAAiB,EAAoC,EAAO,EAAQ,CAI1E,GAHA,EAAgB,EAAM,YAAa,EAAM,gBAAgB,CACzD,EAAe,QAAS,GAAS,EAAgB,EAAM,YAAa,EAAK,CAAC,CAEtE,EAAM,kBAAkB,SAAW,EACrC,EAAK,uBAAyB,CAC5B,CACE,KAAM,EAAM,gBACZ,cAAe,CAAC,GAAG,EAAM,cAAc,CACxC,CACF,CACD,EAAM,QAAS,GAAS,CACtB,IAAM,EAAO,EAAK,EAAM,gBAAiB,EAAK,KAAK,CAEnD,GADiB,EAAwB,EAAM,UAAW,EAC9C,CAAC,OAAS,SACpB,MAAU,MAAM,2DAA2D,IAAO,CAEpF,EAAc,EAAM,EAAO,CACzB,OACA,SAAU,EAAK,SACf,YAAa,EAAK,YAClB,WAAY,GACb,CAAC,EACF,KACG,CACL,IAAI,EAAyB,GAC7B,EAAM,QAAS,GAAS,CACtB,IAAM,EAAO,EAAK,EAAM,gBAAiB,EAAK,KAAK,CAC7C,EAAW,EAAwB,EAAM,UAAW,EAAK,CAC/D,GAAI,EAAS,OAAS,QAAU,EAAS,WAAa,EAAK,SAAU,CACnE,EAAK,UAAU,KAAK,EAAK,CACzB,OAEF,EAAyB,GACrB,EAAS,OAAS,WACpB,EAAK,UAAU,KAAK,EAAK,CACzB,EAAK,SAAS,KACZ,qDAAqD,EACnD,EAAM,oBACN,EACD,GACF,GAEH,CAEF,IAAM,EAAe,GAAqB,EAAM,CAC1C,EAAiB,EAAM,kBAAkB,KAAM,GAAS,CAAC,EAAa,IAAI,EAAK,CAAC,EAClF,CAAC,GAA0B,IAC7B,EAAK,SAAS,KACZ,sHACY,EACR,EAAM,oBACN,EAAM,gBACP,CAAC,wBAAwB,EAAW,KACxC,CAIL,IAAM,EAAW,IAAI,IAAI,EAAQ,SAAS,CACpC,EAAO,EAAM,YACnB,GAAI,EAAS,IAAI,EAAmB,OAAO,CAAE,CAC3C,IAAM,EAAe,EAAK,EAAM,UAAW,gBAAgB,CACrD,EAAiB,EAAK,EAAM,UAAW,kBAAkB,CACzD,EAAY,EAAK,EAAM,UAAW,aAAa,CAiCrD,CAlBE,CACE,KAAM,EACN,YAAa,0DACb,OAAQ,EAAU,EAAgB,IAChC,GAA0B,EAAU,EAAgB,EAAgB,CACvE,CACD,CACE,KAAM,EACN,YAAa,sEACb,MAAQ,GAAa,GAA4B,EAAS,CAC3D,CACD,CACE,KAAM,EACN,YAAa,wCACb,OAAQ,EAAU,EAAgB,IAChC,GAAuB,EAAU,EAAgB,EAAgB,CACpE,CAEY,CAAC,SAAS,CAAE,OAAM,cAAa,WAAY,CACxD,IAAM,EAAW,EAAwB,EAAM,UAAW,EAAK,CAC/D,GAAI,EAAS,OAAS,UAAY,EAAS,OAAS,OAAQ,CAC1D,EAAK,UAAU,KAAK,EAAK,CACzB,EAAK,SAAS,KACZ,2EAA2E,EACzE,EAAM,oBACN,EACD,GACF,CACD,OAEF,GACE,EACA,EACA,EACA,EAAM,EAAS,OAAS,OAAS,EAAS,SAAW,KAAM,EAAM,EAAM,gBAAgB,CACvF,EACA,EAAM,oBACP,EACD,CAGJ,GAAI,EAAS,IAAI,EAAmB,MAAM,CAAE,CAC1C,IAAM,EAAY,EAAsB,CACtC,cAAe,EACf,oBAAqB,EAAM,yBAC3B,UAAW,EAAM,UACjB,MAAO,EACP,iBAAkB,GACnB,CAAC,CACF,EAAK,QAAQ,KAAK,GAAG,EAAU,QAAQ,CACvC,EAAK,UAAU,KAAK,GAAG,EAAU,UAAU,CAC3C,EAAK,SAAS,KACZ,GAAG,EAAU,SAAS,IAAK,GAClB,EAAU,UAAU,QACxB,EAAU,IACT,EAAS,QAAQ,EAAM,EAAmB,EAAM,oBAAqB,EAAK,CAAC,CAC7E,EACD,CACD,CACH,CAGH,GAAI,EAAS,IAAI,EAAmB,GAAG,CACrC,GAAI,CAAC,EAAM,gBAAkB,CAAC,EAAM,WAClC,EAAK,SAAS,KACZ,iGACD,KACI,CACL,IAAM,EAAe,EAAK,EAAM,eAAgB,EAAwB,CAClE,EACJ,EAAS,EAAM,eAAgB,EAAM,gBAAgB,CAAC,MAAM,EAAI,CAAC,KAAK,IAAI,EAAI,IAC1E,EAAmB,GAAoC,CAC3D,WAAY,EAAQ,WACpB,qBACA,kBAAmB,EAAE,CACtB,CAAC,CACI,EAAmB,EAAwB,EAAM,UAAW,EAAa,CAC3E,EAAiB,OAAS,SAC5B,EAAc,EAAM,EAAO,CACzB,KAAM,EACN,SAAU,EACV,YAAa,+CACb,WAAY,GACb,CAAC,CAEF,EAAiB,OAAS,QAC1B,EAAiB,WAAa,EAE9B,EAAK,UAAU,KAAK,EAAa,EAEjC,EAAK,UAAU,KAAK,EAAa,CACjC,EAAK,SAAS,KACZ,wDAAwD,EACtD,EAAM,oBACN,EACD,CAAC,qDACH,EAMP,OADA,EAAK,QAAQ,SAAS,CAAE,UAAW,EAAgB,EAAM,YAAa,EAAK,CAAC,CACrE,ECzUT,MAAM,GAAiE,EACpE,EAAmB,QAAS,kCAC5B,EAAmB,OAAQ,6BAC3B,EAAmB,IAAK,iCAC1B,CAGK,GAAqB,OAAO,OAAO,EAAmB,CAiB5D,SAAS,EAA0B,EAAuB,EAAuC,CAC/F,IAAM,EAAS,CAAC,EAAO,OAAO,MAAM,CAAE,EAAO,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ,CAAC,KAAK;EAAK,CAChF,EAAM,IAAS,MAAQ,EAAkB,EAG/C,MACE,GAFA,IAAS,MAAQ,UAAY,SAAS,EAAqC,WAE5D,sBAAsB,EAAK,aAAa,CAAC,8BACrD,EAAO,OAAO,EAAS,KAAK,IAAW,IAAI,0DACY,IAY9D,eAAe,GACb,EACA,EACA,EAC6B,CAC7B,IAAM,EAAgC,CAAE,IAAK,KAAM,MAAO,KAAM,CAC1D,EAAqB,EAAE,CAEvB,EAAY,MAAM,EAAO,MAAO,CAAC,UAAU,CAAE,CAAE,MAAK,CAAE,EAAQ,CACpE,GAAI,EAAU,OAAO,OAAS,SAC5B,EAAS,KAAK,EAAoB,KAC7B,CACL,IAAM,EAAS,GAAG,EAAU,OAAO,IAAI,EAAU,SAC3C,EAAc,EAA6B,EAAO,CACpD,EAAU,OAAS,EAEZ,EACT,EAAS,KAAK,EAAY,CAE1B,EAAM,IAAM,EAAuB,EAAO,CAAE,QAJ5C,EAAS,KAAK,GAAe,EAA0B,MAAO,EAAU,CAAC,CAQ7E,IAAM,EAAc,MAAM,EAAO,QAAS,CAAC,UAAU,CAAE,CAAE,MAAK,CAAE,EAAQ,CACxE,GAAI,EAAY,OAAO,OAAS,SAC9B,EAAS,KAAK,EAAsB,KAC/B,CACL,IAAM,EAAS,GAAG,EAAY,OAAO,IAAI,EAAY,SAC/C,EAAc,EAClB,EACA,EACA,qBAAqB,EAA2B,6BACjD,CACG,EAAY,OAAS,EAEd,EACT,EAAS,KAAK,EAAY,CAE1B,EAAM,MAAQ,EAAuB,EAAO,CAAE,QAJ9C,EAAS,KAAK,GAAe,EAA0B,QAAS,EAAY,CAAC,CAQjF,MAAO,CAAE,QAAO,WAAU,CAW5B,eAAsB,EAEpB,EACA,EAAoB,EACpB,EAAgC,EACjB,CACf,EAAoB,KAAK,QAAQ,CACjC,GAAI,CACF,IAAM,EAAU,MAAM,GAAoB,KAAM,KAAK,QAAQ,KAAK,CAAE,EAAO,CACrE,EAAQ,EAAsB,KAAM,EAAU,CAC9C,EAAU,IAAI,EAAgB,KAAK,CACnC,EAAc,EAClB,EACA,KAAK,QAAQ,MAAM,MACnB,KAAK,QAAQ,OAAO,MACrB,CACK,EAAW,MAAM,EAAqB,EAAS,CACnD,SAAU,GACV,OAAQ,GACR,QAAS,EACN,EAAmB,QAAS,EAAM,QAClC,EAAmB,OAAQ,EAAM,OACjC,EAAmB,IAAK,EAAM,GAChC,CACD,cACD,CAAC,CACI,EAAiB,EAAoC,EAAO,CAAE,WAAU,CAAC,CAGzE,EAAO,GACX,CAAE,QAAO,UAHO,EAAyB,KAAM,EAAM,YAAa,EAGhD,CAAE,CACpB,CACE,WACA,WAAYC,EACb,CACF,CACD,EAAK,SAAS,KAAK,GAAG,EAAQ,SAAS,CAElC,EAAM,MACT,KAAK,OAAO,KACV,EAAkB,EAAM,CACtB,IAAK,KAAK,QAAQ,KAAK,CACvB,MAAO,6BACP,QAAS,CAAC,CAAE,MAAO,SAAU,KAAM,EAAK,gBAAiB,CAAC,CAC3D,CAAC,CACH,CAGH,IAAI,EAAW,EAAK,QAAQ,SAAW,GAAK,EAAM,OAClD,GAAI,EAAK,QAAQ,OAAS,GAAK,CAAC,EAAM,OACpC,GAAI,EAAM,IACR,EAAW,WACF,EACT,EAAW,MAAM,EAAQ,QAAQ,4BAA6B,GAAK,MAEnE,MAAU,MACR,qGACD,CAID,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,GACrD,MAAM,EAAiB,KAAM,EAAK,CAEpC,IAAM,EAAU,GAAY,CAAC,EAAM,QAAU,EAAK,QAAQ,OAAS,EAC7D,EAAiB,GAAY,CAAC,EAAM,OACpC,EAAY,EAAyB,CACzC,YAAa,EACX,EAAmB,KAAK,QAAQ,KAAK,CAAE,EAAM,gBAAgB,CAC9D,CACD,SAAU,GAAkB,EAAS,SAAS,EAAmB,MAAM,CACvE,WAAY,EAAK,UAAU,GAC5B,CAAC,CACI,EAAS,EAA0B,EAAM,CAC7C,UACA,OAAQ,EAAM,OACd,IAAK,KAAK,QAAQ,KAAK,CACvB,YACA,MAAO,EAAQ,MAChB,CAAC,CACF,GAAI,EAAM,KAAM,CACd,KAAK,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,EAAO,CAAC,IAAI,CACxD,OAEF,GAAI,EAAM,OAAQ,CAChB,KAAK,OAAO,KAAK,EAAO,OAAO,6CAA6C,CAAC,CAC7E,OAEF,GAAI,CAAC,EAAU,CACb,KAAK,OAAO,KAAK,EAAO,OAAO,sBAAsB,CAAC,CACtD,OAEF,GAAI,EAAK,QAAQ,SAAW,EAAG,CAC7B,IAAM,EACJ,EAAK,SAAS,SAAW,EAAQ,SAAS,OACtC,yCACA,8CACN,KAAK,OAAO,KAAK,EAAO,MAAM,EAAQ,CAAC,MAEvC,KAAK,OAAO,KAAK,EAAO,MAAM,8BAA8B,CAAC,CAE3D,EAAK,UAAU,OAAS,IAC1B,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,aAAa,GAAG,CAClD,EAAK,UAAU,QAAS,GAAS,KAAK,OAAO,KAAK,EAAK,CAAC,EAE1D,KAAK,OAAO,KAAK,KAAK,EAAO,KAAK,4CAA4C,GAAG,CACjF,KAAK,OAAO,KAAK,EAAU,OACpB,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,KAAK,QAAQ,KAAK,IAAI,CAE/B,MAAM"}

package/dist/{impl-4WoLxjdU.mjs → impl-DP9iMlRn.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./skipRequestDataSilos-MTbj-OfW.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,dataSiloId:r,status:i,statuses:a,transcendUrl:o,actionTypes:s}){t(this.process),await e({transcendUrl:o,auth:n,status:i,dataSiloId:r,requestStatuses:a,actionTypes:s})}export{n as skipRequestDataSilos};
-//# sourceMappingURL=impl-4WoLxjdU.mjs.map
+import{t as e}from"./skipRequestDataSilos-DB1_3m-p.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,dataSiloId:r,status:i,statuses:a,transcendUrl:o,actionTypes:s}){t(this.process),await e({transcendUrl:o,auth:n,status:i,dataSiloId:r,requestStatuses:a,actionTypes:s})}export{n as skipRequestDataSilos};
+//# sourceMappingURL=impl-DP9iMlRn.mjs.map

package/dist/{impl-4WoLxjdU.mjs.map → impl-DP9iMlRn.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-4WoLxjdU.mjs","names":["skipRequestDataSilosHelper"],"sources":["../src/commands/request/system/skip-request-data-silos/impl.ts"],"sourcesContent":["import type {\n  RequestAction,\n  RequestDataSiloStatus,\n  RequestStatus,\n} from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { skipRequestDataSilos as skipRequestDataSilosHelper } from '../../../../lib/requests/index.js';\n\nexport interface SkipRequestDataSilosCommandFlags {\n  auth: string;\n  dataSiloId: string;\n  transcendUrl: string;\n  statuses: RequestStatus[];\n  status: (typeof RequestDataSiloStatus)['Skipped'] | (typeof RequestDataSiloStatus)['Resolved'];\n  actionTypes?: RequestAction[];\n}\n\nexport async function skipRequestDataSilos(\n  this: LocalContext,\n  {\n    auth,\n    dataSiloId,\n    status,\n    statuses,\n    transcendUrl,\n    actionTypes,\n  }: SkipRequestDataSilosCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await skipRequestDataSilosHelper({\n    transcendUrl,\n    auth,\n    status,\n    dataSiloId,\n    requestStatuses: statuses,\n    actionTypes,\n  });\n}\n"],"mappings":"4GAmBA,eAAsB,EAEpB,CACE,OACA,aACA,SACA,WACA,eACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAMA,EAA2B,CAC/B,eACA,OACA,SACA,aACA,gBAAiB,EACjB,cACD,CAAC"}
+{"version":3,"file":"impl-DP9iMlRn.mjs","names":["skipRequestDataSilosHelper"],"sources":["../src/commands/request/system/skip-request-data-silos/impl.ts"],"sourcesContent":["import type {\n  RequestAction,\n  RequestDataSiloStatus,\n  RequestStatus,\n} from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { skipRequestDataSilos as skipRequestDataSilosHelper } from '../../../../lib/requests/index.js';\n\nexport interface SkipRequestDataSilosCommandFlags {\n  auth: string;\n  dataSiloId: string;\n  transcendUrl: string;\n  statuses: RequestStatus[];\n  status: (typeof RequestDataSiloStatus)['Skipped'] | (typeof RequestDataSiloStatus)['Resolved'];\n  actionTypes?: RequestAction[];\n}\n\nexport async function skipRequestDataSilos(\n  this: LocalContext,\n  {\n    auth,\n    dataSiloId,\n    status,\n    statuses,\n    transcendUrl,\n    actionTypes,\n  }: SkipRequestDataSilosCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await skipRequestDataSilosHelper({\n    transcendUrl,\n    auth,\n    status,\n    dataSiloId,\n    requestStatuses: statuses,\n    actionTypes,\n  });\n}\n"],"mappings":"4GAmBA,eAAsB,EAEpB,CACE,OACA,aACA,SACA,WACA,eACA,eAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAMA,EAA2B,CAC/B,eACA,OACA,SACA,aACA,gBAAiB,EACjB,cACD,CAAC"}

package/dist/{impl-BCP4X_zk.mjs → impl-DbqbZmAc.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./pullManualEnrichmentIdentifiersToCsv-CiEFIvl_.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,transcendUrl:r,file:i,concurrency:a,actions:o,sombraAuth:s}){t(this.process),await e({file:i,transcendUrl:r,concurrency:a,requestActions:o,auth:n,sombraAuth:s})}export{n as pullIdentifiers};
-//# sourceMappingURL=impl-BCP4X_zk.mjs.map
+import{t as e}from"./pullManualEnrichmentIdentifiersToCsv-CWVaEx3x.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,transcendUrl:r,file:i,concurrency:a,actions:o,sombraAuth:s}){t(this.process),await e({file:i,transcendUrl:r,concurrency:a,requestActions:o,auth:n,sombraAuth:s})}export{n as pullIdentifiers};
+//# sourceMappingURL=impl-DbqbZmAc.mjs.map

package/dist/{impl-BCP4X_zk.mjs.map → impl-DbqbZmAc.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-BCP4X_zk.mjs","names":[],"sources":["../src/commands/request/preflight/pull-identifiers/impl.ts"],"sourcesContent":["import type { RequestAction } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { pullManualEnrichmentIdentifiersToCsv } from '../../../../lib/manual-enrichment/index.js';\n\nexport interface PullIdentifiersCommandFlags {\n  auth: string;\n  sombraAuth?: string;\n  transcendUrl: string;\n  file: string;\n  actions?: RequestAction[];\n  concurrency: number;\n}\n\nexport async function pullIdentifiers(\n  this: LocalContext,\n  { auth, transcendUrl, file, concurrency, actions, sombraAuth }: PullIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await pullManualEnrichmentIdentifiersToCsv({\n    file,\n    transcendUrl,\n    concurrency,\n    requestActions: actions,\n    auth,\n    sombraAuth,\n  });\n}\n"],"mappings":"4HAeA,eAAsB,EAEpB,CAAE,OAAM,eAAc,OAAM,cAAa,UAAS,cACnC,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAqC,CACzC,OACA,eACA,cACA,eAAgB,EAChB,OACA,aACD,CAAC"}
+{"version":3,"file":"impl-DbqbZmAc.mjs","names":[],"sources":["../src/commands/request/preflight/pull-identifiers/impl.ts"],"sourcesContent":["import type { RequestAction } from '@transcend-io/privacy-types';\n\nimport type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { pullManualEnrichmentIdentifiersToCsv } from '../../../../lib/manual-enrichment/index.js';\n\nexport interface PullIdentifiersCommandFlags {\n  auth: string;\n  sombraAuth?: string;\n  transcendUrl: string;\n  file: string;\n  actions?: RequestAction[];\n  concurrency: number;\n}\n\nexport async function pullIdentifiers(\n  this: LocalContext,\n  { auth, transcendUrl, file, concurrency, actions, sombraAuth }: PullIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await pullManualEnrichmentIdentifiersToCsv({\n    file,\n    transcendUrl,\n    concurrency,\n    requestActions: actions,\n    auth,\n    sombraAuth,\n  });\n}\n"],"mappings":"4HAeA,eAAsB,EAEpB,CAAE,OAAM,eAAc,OAAM,cAAa,UAAS,cACnC,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAqC,CACzC,OACA,eACA,cACA,eAAgB,EAChB,OACA,aACD,CAAC"}

package/dist/{impl-tYHONQMu.mjs → impl-DlPwOUAc.mjs}

@@ -1,2 +1,2 @@
-import{r as e}from"./constants-BCmVqlrM.mjs";import{r as t}from"./readTranscendYaml-BfqQbPiT.mjs";import{n,t as r}from"./mergeTranscendInputs-B7WjxYMN.mjs";import{t as i}from"./parseVariablesFromString-6TYW65LF.mjs";import{t as a}from"./validateTranscendAuth-D-dDINof.mjs";import{t as o}from"./listFiles-DDGCBdtx.mjs";import{t as s}from"./done-input-validation-LiTaCEzF.mjs";import c from"node:path";import l from"colors";import{mapSeries as u}from"@transcend-io/utils";import{buildTranscendGraphQLClient as d}from"@transcend-io/sdk";async function f({transcendUrl:e,auth:t,pageSize:r,publishToPrivacyCenter:i,contents:a,deleteExtraAttributeValues:o=!1,classifyService:s=!1,logger:c}){let u=d(e,t);try{let e=await n(a,u,{pageSize:r,publishToPrivacyCenter:i,classifyService:s,deleteExtraAttributeValues:o,logger:c});return e.success||e.errors.forEach(({resource:e,item:t,message:n})=>{c.error(l.red(`Failed to sync ${e}${t?` "${t}"`:``}: ${n}`))}),e.success}catch(e){return c.error(l.red(`An unexpected error occurred syncing the schema: ${e.message}`)),!1}}async function p({file:n=`./transcend.yml`,transcendUrl:d,auth:p,variables:m,pageSize:h,publishToPrivacyCenter:g,classifyService:_,deleteExtraAttributeValues:v}){s(this.process);let y=await a(p,this),b=i(m),x;if(x=Array.isArray(y)&&this.fs.lstatSync(n).isDirectory()?o(this.fs.readdirSync(n)).map(e=>c.join(n,e)):n.split(`,`),x.length<1)throw Error(`No file specified!`);let S=x.map(e=>{this.fs.existsSync(e)?this.logger.info(l.magenta(`Reading file "${e}"...`)):(this.logger.error(l.red(`The file path does not exist on disk: ${e}. You can specify the filepath using --file=./examples/transcend.yml`)),this.process.exit(1));try{let n=t(this.fs.readFileSync(e,`utf8`),b,e);return this.logger.info(l.green(`Successfully read in "${e}"`)),{content:n,name:e.split(`/`).pop().replace(`.yml`,``)}}catch(e){this.logger.error(l.red(`The shape of your yaml file is invalid with the following errors: ${e.message}`)),this.process.exit(1)}});if(typeof y==`string`){let[t,...n]=S.map(({content:e})=>e);await f({transcendUrl:d,auth:y,contents:r(t,...n),publishToPrivacyCenter:g,deleteExtraAttributeValues:v,pageSize:h,classifyService:!!_,logger:this.logger})||(this.logger.info(l.red(`Sync encountered errors. View output above for more information, or check out ${e}`)),this.process.exit(1))}else{if(S.length!==1&&S.length!==y.length)throw Error(`Expected list of yml files to be equal to the list of API keys.Got ${S.length} YML file${S.length===1?``:`s`} and ${y.length} API key${y.length===1?``:`s`}`);let t=[];await u(y,async(e,n)=>{let r=`[${n+1}/${y.length}][${e.organizationName}] `;this.logger.info(l.magenta(`~~~\n\n${r}Attempting to push configuration...\n\n~~~`));let i=S.length===1?S[0].content:S.find(t=>t.name===e.organizationName)?.content;if(!i){this.logger.error(l.red(`${r}Failed to find transcend.yml file for organization: "${e.organizationName}".`)),t.push(e.organizationName);return}await f({transcendUrl:d,auth:e.apiKey,contents:i,pageSize:h,publishToPrivacyCenter:g,deleteExtraAttributeValues:v,classifyService:_,logger:this.logger})?this.logger.info(l.green(`${r}Successfully pushed configuration!`)):(this.logger.error(l.red(`${r}Failed to sync configuration.`)),t.push(e.organizationName))}),t.length>0&&(this.logger.info(l.red(`Sync encountered errors for "${t.join(`,`)}". View output above for more information, or check out ${e}`)),this.process.exit(1))}this.logger.info(l.green(`Successfully synced yaml file to Transcend! View at ${e}`))}export{p as push};
-//# sourceMappingURL=impl-tYHONQMu.mjs.map
+import{r as e}from"./constants-rXUIz6Uy.mjs";import{r as t}from"./readTranscendYaml-BfqQbPiT.mjs";import{n,t as r}from"./mergeTranscendInputs-B7WjxYMN.mjs";import{t as i}from"./parseVariablesFromString-6TYW65LF.mjs";import{t as a}from"./validateTranscendAuth-D-dDINof.mjs";import{t as o}from"./listFiles-DDGCBdtx.mjs";import{t as s}from"./done-input-validation-LiTaCEzF.mjs";import c from"node:path";import l from"colors";import{mapSeries as u}from"@transcend-io/utils";import{buildTranscendGraphQLClient as d}from"@transcend-io/sdk";async function f({transcendUrl:e,auth:t,pageSize:r,publishToPrivacyCenter:i,contents:a,deleteExtraAttributeValues:o=!1,classifyService:s=!1,logger:c}){let u=d(e,t);try{let e=await n(a,u,{pageSize:r,publishToPrivacyCenter:i,classifyService:s,deleteExtraAttributeValues:o,logger:c});return e.success||e.errors.forEach(({resource:e,item:t,message:n})=>{c.error(l.red(`Failed to sync ${e}${t?` "${t}"`:``}: ${n}`))}),e.success}catch(e){return c.error(l.red(`An unexpected error occurred syncing the schema: ${e.message}`)),!1}}async function p({file:n=`./transcend.yml`,transcendUrl:d,auth:p,variables:m,pageSize:h,publishToPrivacyCenter:g,classifyService:_,deleteExtraAttributeValues:v}){s(this.process);let y=await a(p,this),b=i(m),x;if(x=Array.isArray(y)&&this.fs.lstatSync(n).isDirectory()?o(this.fs.readdirSync(n)).map(e=>c.join(n,e)):n.split(`,`),x.length<1)throw Error(`No file specified!`);let S=x.map(e=>{this.fs.existsSync(e)?this.logger.info(l.magenta(`Reading file "${e}"...`)):(this.logger.error(l.red(`The file path does not exist on disk: ${e}. You can specify the filepath using --file=./examples/transcend.yml`)),this.process.exit(1));try{let n=t(this.fs.readFileSync(e,`utf8`),b,e);return this.logger.info(l.green(`Successfully read in "${e}"`)),{content:n,name:e.split(`/`).pop().replace(`.yml`,``)}}catch(e){this.logger.error(l.red(`The shape of your yaml file is invalid with the following errors: ${e.message}`)),this.process.exit(1)}});if(typeof y==`string`){let[t,...n]=S.map(({content:e})=>e);await f({transcendUrl:d,auth:y,contents:r(t,...n),publishToPrivacyCenter:g,deleteExtraAttributeValues:v,pageSize:h,classifyService:!!_,logger:this.logger})||(this.logger.info(l.red(`Sync encountered errors. View output above for more information, or check out ${e}`)),this.process.exit(1))}else{if(S.length!==1&&S.length!==y.length)throw Error(`Expected list of yml files to be equal to the list of API keys.Got ${S.length} YML file${S.length===1?``:`s`} and ${y.length} API key${y.length===1?``:`s`}`);let t=[];await u(y,async(e,n)=>{let r=`[${n+1}/${y.length}][${e.organizationName}] `;this.logger.info(l.magenta(`~~~\n\n${r}Attempting to push configuration...\n\n~~~`));let i=S.length===1?S[0].content:S.find(t=>t.name===e.organizationName)?.content;if(!i){this.logger.error(l.red(`${r}Failed to find transcend.yml file for organization: "${e.organizationName}".`)),t.push(e.organizationName);return}await f({transcendUrl:d,auth:e.apiKey,contents:i,pageSize:h,publishToPrivacyCenter:g,deleteExtraAttributeValues:v,classifyService:_,logger:this.logger})?this.logger.info(l.green(`${r}Successfully pushed configuration!`)):(this.logger.error(l.red(`${r}Failed to sync configuration.`)),t.push(e.organizationName))}),t.length>0&&(this.logger.info(l.red(`Sync encountered errors for "${t.join(`,`)}". View output above for more information, or check out ${e}`)),this.process.exit(1))}this.logger.info(l.green(`Successfully synced yaml file to Transcend! View at ${e}`))}export{p as push};
+//# sourceMappingURL=impl-DlPwOUAc.mjs.map

package/dist/{impl-tYHONQMu.mjs.map → impl-DlPwOUAc.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-tYHONQMu.mjs","names":[],"sources":["../src/commands/inventory/push/impl.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { buildTranscendGraphQLClient } from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { TranscendInput } from '../../../codecs.js';\nimport { ADMIN_DASH_INTEGRATIONS } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { validateTranscendAuth, filterFileNames } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { syncConfigurationToTranscend } from '../../../lib/graphql/index.js';\nimport { parseVariablesFromString } from '../../../lib/helpers/parseVariablesFromString.js';\nimport { mergeTranscendInputs } from '../../../lib/mergeTranscendInputs.js';\nimport { parseTranscendYaml } from '../../../lib/readTranscendYaml.js';\n\n/**\n * Sync configuration to Transcend\n *\n * @param options - Options\n * @returns True if synced successfully, false if error occurs\n */\nasync function syncConfiguration({\n  transcendUrl,\n  auth,\n  pageSize,\n  publishToPrivacyCenter,\n  contents,\n  deleteExtraAttributeValues = false,\n  classifyService = false,\n  logger,\n}: {\n  /** Transcend YAML */\n  contents: TranscendInput;\n  /** Transcend URL */\n  transcendUrl: string;\n  /** API key */\n  auth: string;\n  /** Page size */\n  pageSize: number;\n  /** Skip privacy center publish step */\n  publishToPrivacyCenter: boolean;\n  /** classify data flow service if missing */\n  classifyService?: boolean;\n  /** Delete attributes when syncing */\n  deleteExtraAttributeValues?: boolean;\n  /** Logger for reporting sync progress and errors */\n  logger: LocalContext['logger'];\n}): Promise<boolean> {\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n\n  // Sync to Transcend\n  try {\n    const result = await syncConfigurationToTranscend(contents, client, {\n      pageSize,\n      publishToPrivacyCenter,\n      classifyService,\n      deleteExtraAttributeValues,\n      logger,\n    });\n    if (!result.success) {\n      result.errors.forEach(({ resource, item, message }) => {\n        logger.error(\n          colors.red(`Failed to sync ${resource}${item ? ` \"${item}\"` : ''}: ${message}`),\n        );\n      });\n    }\n    return result.success;\n  } catch (err) {\n    logger.error(colors.red(`An unexpected error occurred syncing the schema: ${err.message}`));\n    return false;\n  }\n}\n\nexport interface PushCommandFlags {\n  auth: string;\n  file: string;\n  transcendUrl: string;\n  pageSize: number;\n  variables: string;\n  publishToPrivacyCenter: boolean;\n  classifyService: boolean;\n  deleteExtraAttributeValues: boolean;\n}\n\nexport async function push(\n  this: LocalContext,\n  {\n    file = './transcend.yml',\n    transcendUrl,\n    auth,\n    variables,\n    pageSize,\n    publishToPrivacyCenter,\n    classifyService,\n    deleteExtraAttributeValues,\n  }: PushCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  const vars = parseVariablesFromString(variables);\n\n  // check if we are being passed a list of API keys and a list of files\n  let fileList: string[];\n  if (Array.isArray(apiKeyOrList) && this.fs.lstatSync(file).isDirectory()) {\n    fileList = filterFileNames(this.fs.readdirSync(file)).map((filePath) =>\n      path.join(file, filePath),\n    );\n  } else {\n    fileList = file.split(',');\n  }\n\n  // Ensure at least one file is parsed\n  if (fileList.length < 1) {\n    throw new Error('No file specified!');\n  }\n\n  // eslint-disable-next-line array-callback-return,consistent-return\n  const transcendInputs = fileList.map((filePath) => {\n    // Ensure yaml file exists on disk\n    if (!this.fs.existsSync(filePath)) {\n      this.logger.error(\n        colors.red(\n          `The file path does not exist on disk: ${filePath}. You can specify the filepath using --file=./examples/transcend.yml`,\n        ),\n      );\n      this.process.exit(1);\n    } else {\n      this.logger.info(colors.magenta(`Reading file \"${filePath}\"...`));\n    }\n\n    try {\n      // Read in the yaml file and validate it's shape\n      const newContents = parseTranscendYaml(\n        this.fs.readFileSync(filePath, 'utf8'),\n        vars,\n        filePath,\n      );\n      this.logger.info(colors.green(`Successfully read in \"${filePath}\"`));\n      return {\n        content: newContents,\n        name: filePath.split('/').pop()!.replace('.yml', ''),\n      };\n    } catch (err) {\n      this.logger.error(\n        colors.red(\n          `The shape of your yaml file is invalid with the following errors: ${err.message}`,\n        ),\n      );\n      this.process.exit(1);\n    }\n  });\n\n  // process a single API key\n  if (typeof apiKeyOrList === 'string') {\n    // if passed multiple inputs, merge them together\n    const [base, ...rest] = transcendInputs.map(({ content }) => content);\n    const contents = mergeTranscendInputs(base, ...rest);\n\n    // sync the configuration\n    const success = await syncConfiguration({\n      transcendUrl,\n      auth: apiKeyOrList,\n      contents,\n      publishToPrivacyCenter,\n      deleteExtraAttributeValues,\n      pageSize,\n      classifyService: !!classifyService,\n      logger: this.logger,\n    });\n\n    // exist with error code\n    if (!success) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors. View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  } else {\n    // if passed multiple inputs, expect them to be one per instance\n    if (transcendInputs.length !== 1 && transcendInputs.length !== apiKeyOrList.length) {\n      throw new Error(\n        'Expected list of yml files to be equal to the list of API keys.' +\n          `Got ${transcendInputs.length} YML file${\n            transcendInputs.length === 1 ? '' : 's'\n          } and ${apiKeyOrList.length} API key${apiKeyOrList.length === 1 ? '' : 's'}`,\n      );\n    }\n\n    const encounteredErrors: string[] = [];\n    await mapSeries(apiKeyOrList, async (apiKey, ind) => {\n      const prefix = `[${ind + 1}/${apiKeyOrList.length}][${apiKey.organizationName}] `;\n      this.logger.info(\n        colors.magenta(`~~~\\n\\n${prefix}Attempting to push configuration...\\n\\n~~~`),\n      );\n\n      // use the merged contents if 1 yml passed, else use the contents that map to that organization\n      const useContents =\n        transcendInputs.length === 1\n          ? transcendInputs[0].content\n          : transcendInputs.find((input) => input.name === apiKey.organizationName)?.content;\n\n      // Throw error if cannot find a yml file matching that organization name\n      if (!useContents) {\n        this.logger.error(\n          colors.red(\n            `${prefix}Failed to find transcend.yml file for organization: \"${apiKey.organizationName}\".`,\n          ),\n        );\n        encounteredErrors.push(apiKey.organizationName);\n        return;\n      }\n\n      const success = await syncConfiguration({\n        transcendUrl,\n        auth: apiKey.apiKey,\n        contents: useContents,\n        pageSize,\n        publishToPrivacyCenter,\n        deleteExtraAttributeValues,\n        classifyService,\n        logger: this.logger,\n      });\n\n      if (success) {\n        this.logger.info(colors.green(`${prefix}Successfully pushed configuration!`));\n      } else {\n        this.logger.error(colors.red(`${prefix}Failed to sync configuration.`));\n        encounteredErrors.push(apiKey.organizationName);\n      }\n    });\n\n    if (encounteredErrors.length > 0) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors for \"${encounteredErrors.join(\n            ',',\n          )}\". View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  }\n\n  // Indicate success\n  this.logger.info(\n    colors.green(`Successfully synced yaml file to Transcend! View at ${ADMIN_DASH_INTEGRATIONS}`),\n  );\n}\n"],"mappings":"shBAsBA,eAAe,EAAkB,CAC/B,eACA,OACA,WACA,yBACA,WACA,6BAA6B,GAC7B,kBAAkB,GAClB,UAkBmB,CACnB,IAAM,EAAS,EAA4B,EAAc,EAAK,CAG9D,GAAI,CACF,IAAM,EAAS,MAAM,EAA6B,EAAU,EAAQ,CAClE,WACA,yBACA,kBACA,6BACA,SACD,CAAC,CAQF,OAPK,EAAO,SACV,EAAO,OAAO,SAAS,CAAE,WAAU,OAAM,aAAc,CACrD,EAAO,MACL,EAAO,IAAI,kBAAkB,IAAW,EAAO,KAAK,EAAK,GAAK,GAAG,IAAI,IAAU,CAChF,EACD,CAEG,EAAO,cACP,EAAK,CAEZ,OADA,EAAO,MAAM,EAAO,IAAI,oDAAoD,EAAI,UAAU,CAAC,CACpF,IAeX,eAAsB,EAEpB,CACE,OAAO,kBACP,eACA,OACA,YACA,WACA,yBACA,kBACA,8BAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAEtD,EAAO,EAAyB,EAAU,CAG5C,EAUJ,GATA,AAKE,EALE,MAAM,QAAQ,EAAa,EAAI,KAAK,GAAG,UAAU,EAAK,CAAC,aAAa,CAC3D,EAAgB,KAAK,GAAG,YAAY,EAAK,CAAC,CAAC,IAAK,GACzD,EAAK,KAAK,EAAM,EAAS,CAC1B,CAEU,EAAK,MAAM,IAAI,CAIxB,EAAS,OAAS,EACpB,MAAU,MAAM,qBAAqB,CAIvC,IAAM,EAAkB,EAAS,IAAK,GAAa,CAE5C,KAAK,GAAG,WAAW,EAAS,CAQ/B,KAAK,OAAO,KAAK,EAAO,QAAQ,iBAAiB,EAAS,MAAM,CAAC,EAPjE,KAAK,OAAO,MACV,EAAO,IACL,yCAAyC,EAAS,sEACnD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,EAKtB,GAAI,CAEF,IAAM,EAAc,EAClB,KAAK,GAAG,aAAa,EAAU,OAAO,CACtC,EACA,EACD,CAED,OADA,KAAK,OAAO,KAAK,EAAO,MAAM,yBAAyB,EAAS,GAAG,CAAC,CAC7D,CACL,QAAS,EACT,KAAM,EAAS,MAAM,IAAI,CAAC,KAAK,CAAE,QAAQ,OAAQ,GAAG,CACrD,OACM,EAAK,CACZ,KAAK,OAAO,MACV,EAAO,IACL,qEAAqE,EAAI,UAC1E,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,GAEtB,CAGF,GAAI,OAAO,GAAiB,SAAU,CAEpC,GAAM,CAAC,EAAM,GAAG,GAAQ,EAAgB,KAAK,CAAE,aAAc,EAAQ,CAgBhE,MAZiB,EAAkB,CACtC,eACA,KAAM,EACN,SANe,EAAqB,EAAM,GAAG,EAMrC,CACR,yBACA,6BACA,WACA,gBAAiB,CAAC,CAAC,EACnB,OAAQ,KAAK,OACd,CAAC,GAIA,KAAK,OAAO,KACV,EAAO,IACL,iFAAiF,IAClF,CACF,CAED,KAAK,QAAQ,KAAK,EAAE,MAEjB,CAEL,GAAI,EAAgB,SAAW,GAAK,EAAgB,SAAW,EAAa,OAC1E,MAAU,MACR,sEACS,EAAgB,OAAO,WAC5B,EAAgB,SAAW,EAAI,GAAK,IACrC,OAAO,EAAa,OAAO,UAAU,EAAa,SAAW,EAAI,GAAK,MAC1E,CAGH,IAAM,EAA8B,EAAE,CACtC,MAAM,EAAU,EAAc,MAAO,EAAQ,IAAQ,CACnD,IAAM,EAAS,IAAI,EAAM,EAAE,GAAG,EAAa,OAAO,IAAI,EAAO,iBAAiB,IAC9E,KAAK,OAAO,KACV,EAAO,QAAQ,UAAU,EAAO,4CAA4C,CAC7E,CAGD,IAAM,EACJ,EAAgB,SAAW,EACvB,EAAgB,GAAG,QACnB,EAAgB,KAAM,GAAU,EAAM,OAAS,EAAO,iBAAiB,EAAE,QAG/E,GAAI,CAAC,EAAa,CAChB,KAAK,OAAO,MACV,EAAO,IACL,GAAG,EAAO,uDAAuD,EAAO,iBAAiB,IAC1F,CACF,CACD,EAAkB,KAAK,EAAO,iBAAiB,CAC/C,OAcE,MAXkB,EAAkB,CACtC,eACA,KAAM,EAAO,OACb,SAAU,EACV,WACA,yBACA,6BACA,kBACA,OAAQ,KAAK,OACd,CAAC,CAGA,KAAK,OAAO,KAAK,EAAO,MAAM,GAAG,EAAO,oCAAoC,CAAC,EAE7E,KAAK,OAAO,MAAM,EAAO,IAAI,GAAG,EAAO,+BAA+B,CAAC,CACvE,EAAkB,KAAK,EAAO,iBAAiB,GAEjD,CAEE,EAAkB,OAAS,IAC7B,KAAK,OAAO,KACV,EAAO,IACL,gCAAgC,EAAkB,KAChD,IACD,CAAC,0DAA0D,IAC7D,CACF,CAED,KAAK,QAAQ,KAAK,EAAE,EAKxB,KAAK,OAAO,KACV,EAAO,MAAM,uDAAuD,IAA0B,CAC/F"}
+{"version":3,"file":"impl-DlPwOUAc.mjs","names":[],"sources":["../src/commands/inventory/push/impl.ts"],"sourcesContent":["import path from 'node:path';\n\nimport { buildTranscendGraphQLClient } from '@transcend-io/sdk';\nimport { mapSeries } from '@transcend-io/utils';\nimport colors from 'colors';\n\nimport { TranscendInput } from '../../../codecs.js';\nimport { ADMIN_DASH_INTEGRATIONS } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { validateTranscendAuth, filterFileNames } from '../../../lib/api-keys/index.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { syncConfigurationToTranscend } from '../../../lib/graphql/index.js';\nimport { parseVariablesFromString } from '../../../lib/helpers/parseVariablesFromString.js';\nimport { mergeTranscendInputs } from '../../../lib/mergeTranscendInputs.js';\nimport { parseTranscendYaml } from '../../../lib/readTranscendYaml.js';\n\n/**\n * Sync configuration to Transcend\n *\n * @param options - Options\n * @returns True if synced successfully, false if error occurs\n */\nasync function syncConfiguration({\n  transcendUrl,\n  auth,\n  pageSize,\n  publishToPrivacyCenter,\n  contents,\n  deleteExtraAttributeValues = false,\n  classifyService = false,\n  logger,\n}: {\n  /** Transcend YAML */\n  contents: TranscendInput;\n  /** Transcend URL */\n  transcendUrl: string;\n  /** API key */\n  auth: string;\n  /** Page size */\n  pageSize: number;\n  /** Skip privacy center publish step */\n  publishToPrivacyCenter: boolean;\n  /** classify data flow service if missing */\n  classifyService?: boolean;\n  /** Delete attributes when syncing */\n  deleteExtraAttributeValues?: boolean;\n  /** Logger for reporting sync progress and errors */\n  logger: LocalContext['logger'];\n}): Promise<boolean> {\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n\n  // Sync to Transcend\n  try {\n    const result = await syncConfigurationToTranscend(contents, client, {\n      pageSize,\n      publishToPrivacyCenter,\n      classifyService,\n      deleteExtraAttributeValues,\n      logger,\n    });\n    if (!result.success) {\n      result.errors.forEach(({ resource, item, message }) => {\n        logger.error(\n          colors.red(`Failed to sync ${resource}${item ? ` \"${item}\"` : ''}: ${message}`),\n        );\n      });\n    }\n    return result.success;\n  } catch (err) {\n    logger.error(colors.red(`An unexpected error occurred syncing the schema: ${err.message}`));\n    return false;\n  }\n}\n\nexport interface PushCommandFlags {\n  auth: string;\n  file: string;\n  transcendUrl: string;\n  pageSize: number;\n  variables: string;\n  publishToPrivacyCenter: boolean;\n  classifyService: boolean;\n  deleteExtraAttributeValues: boolean;\n}\n\nexport async function push(\n  this: LocalContext,\n  {\n    file = './transcend.yml',\n    transcendUrl,\n    auth,\n    variables,\n    pageSize,\n    publishToPrivacyCenter,\n    classifyService,\n    deleteExtraAttributeValues,\n  }: PushCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Parse authentication as API key or path to list of API keys\n  const apiKeyOrList = await validateTranscendAuth(auth, this);\n\n  const vars = parseVariablesFromString(variables);\n\n  // check if we are being passed a list of API keys and a list of files\n  let fileList: string[];\n  if (Array.isArray(apiKeyOrList) && this.fs.lstatSync(file).isDirectory()) {\n    fileList = filterFileNames(this.fs.readdirSync(file)).map((filePath) =>\n      path.join(file, filePath),\n    );\n  } else {\n    fileList = file.split(',');\n  }\n\n  // Ensure at least one file is parsed\n  if (fileList.length < 1) {\n    throw new Error('No file specified!');\n  }\n\n  // eslint-disable-next-line array-callback-return,consistent-return\n  const transcendInputs = fileList.map((filePath) => {\n    // Ensure yaml file exists on disk\n    if (!this.fs.existsSync(filePath)) {\n      this.logger.error(\n        colors.red(\n          `The file path does not exist on disk: ${filePath}. You can specify the filepath using --file=./examples/transcend.yml`,\n        ),\n      );\n      this.process.exit(1);\n    } else {\n      this.logger.info(colors.magenta(`Reading file \"${filePath}\"...`));\n    }\n\n    try {\n      // Read in the yaml file and validate it's shape\n      const newContents = parseTranscendYaml(\n        this.fs.readFileSync(filePath, 'utf8'),\n        vars,\n        filePath,\n      );\n      this.logger.info(colors.green(`Successfully read in \"${filePath}\"`));\n      return {\n        content: newContents,\n        name: filePath.split('/').pop()!.replace('.yml', ''),\n      };\n    } catch (err) {\n      this.logger.error(\n        colors.red(\n          `The shape of your yaml file is invalid with the following errors: ${err.message}`,\n        ),\n      );\n      this.process.exit(1);\n    }\n  });\n\n  // process a single API key\n  if (typeof apiKeyOrList === 'string') {\n    // if passed multiple inputs, merge them together\n    const [base, ...rest] = transcendInputs.map(({ content }) => content);\n    const contents = mergeTranscendInputs(base, ...rest);\n\n    // sync the configuration\n    const success = await syncConfiguration({\n      transcendUrl,\n      auth: apiKeyOrList,\n      contents,\n      publishToPrivacyCenter,\n      deleteExtraAttributeValues,\n      pageSize,\n      classifyService: !!classifyService,\n      logger: this.logger,\n    });\n\n    // exist with error code\n    if (!success) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors. View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  } else {\n    // if passed multiple inputs, expect them to be one per instance\n    if (transcendInputs.length !== 1 && transcendInputs.length !== apiKeyOrList.length) {\n      throw new Error(\n        'Expected list of yml files to be equal to the list of API keys.' +\n          `Got ${transcendInputs.length} YML file${\n            transcendInputs.length === 1 ? '' : 's'\n          } and ${apiKeyOrList.length} API key${apiKeyOrList.length === 1 ? '' : 's'}`,\n      );\n    }\n\n    const encounteredErrors: string[] = [];\n    await mapSeries(apiKeyOrList, async (apiKey, ind) => {\n      const prefix = `[${ind + 1}/${apiKeyOrList.length}][${apiKey.organizationName}] `;\n      this.logger.info(\n        colors.magenta(`~~~\\n\\n${prefix}Attempting to push configuration...\\n\\n~~~`),\n      );\n\n      // use the merged contents if 1 yml passed, else use the contents that map to that organization\n      const useContents =\n        transcendInputs.length === 1\n          ? transcendInputs[0].content\n          : transcendInputs.find((input) => input.name === apiKey.organizationName)?.content;\n\n      // Throw error if cannot find a yml file matching that organization name\n      if (!useContents) {\n        this.logger.error(\n          colors.red(\n            `${prefix}Failed to find transcend.yml file for organization: \"${apiKey.organizationName}\".`,\n          ),\n        );\n        encounteredErrors.push(apiKey.organizationName);\n        return;\n      }\n\n      const success = await syncConfiguration({\n        transcendUrl,\n        auth: apiKey.apiKey,\n        contents: useContents,\n        pageSize,\n        publishToPrivacyCenter,\n        deleteExtraAttributeValues,\n        classifyService,\n        logger: this.logger,\n      });\n\n      if (success) {\n        this.logger.info(colors.green(`${prefix}Successfully pushed configuration!`));\n      } else {\n        this.logger.error(colors.red(`${prefix}Failed to sync configuration.`));\n        encounteredErrors.push(apiKey.organizationName);\n      }\n    });\n\n    if (encounteredErrors.length > 0) {\n      this.logger.info(\n        colors.red(\n          `Sync encountered errors for \"${encounteredErrors.join(\n            ',',\n          )}\". View output above for more information, or check out ${ADMIN_DASH_INTEGRATIONS}`,\n        ),\n      );\n\n      this.process.exit(1);\n    }\n  }\n\n  // Indicate success\n  this.logger.info(\n    colors.green(`Successfully synced yaml file to Transcend! View at ${ADMIN_DASH_INTEGRATIONS}`),\n  );\n}\n"],"mappings":"shBAsBA,eAAe,EAAkB,CAC/B,eACA,OACA,WACA,yBACA,WACA,6BAA6B,GAC7B,kBAAkB,GAClB,UAkBmB,CACnB,IAAM,EAAS,EAA4B,EAAc,EAAK,CAG9D,GAAI,CACF,IAAM,EAAS,MAAM,EAA6B,EAAU,EAAQ,CAClE,WACA,yBACA,kBACA,6BACA,SACD,CAAC,CAQF,OAPK,EAAO,SACV,EAAO,OAAO,SAAS,CAAE,WAAU,OAAM,aAAc,CACrD,EAAO,MACL,EAAO,IAAI,kBAAkB,IAAW,EAAO,KAAK,EAAK,GAAK,GAAG,IAAI,IAAU,CAChF,EACD,CAEG,EAAO,cACP,EAAK,CAEZ,OADA,EAAO,MAAM,EAAO,IAAI,oDAAoD,EAAI,UAAU,CAAC,CACpF,IAeX,eAAsB,EAEpB,CACE,OAAO,kBACP,eACA,OACA,YACA,WACA,yBACA,kBACA,8BAEa,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAe,MAAM,EAAsB,EAAM,KAAK,CAEtD,EAAO,EAAyB,EAAU,CAG5C,EAUJ,GATA,AAKE,EALE,MAAM,QAAQ,EAAa,EAAI,KAAK,GAAG,UAAU,EAAK,CAAC,aAAa,CAC3D,EAAgB,KAAK,GAAG,YAAY,EAAK,CAAC,CAAC,IAAK,GACzD,EAAK,KAAK,EAAM,EAAS,CAC1B,CAEU,EAAK,MAAM,IAAI,CAIxB,EAAS,OAAS,EACpB,MAAU,MAAM,qBAAqB,CAIvC,IAAM,EAAkB,EAAS,IAAK,GAAa,CAE5C,KAAK,GAAG,WAAW,EAAS,CAQ/B,KAAK,OAAO,KAAK,EAAO,QAAQ,iBAAiB,EAAS,MAAM,CAAC,EAPjE,KAAK,OAAO,MACV,EAAO,IACL,yCAAyC,EAAS,sEACnD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,EAKtB,GAAI,CAEF,IAAM,EAAc,EAClB,KAAK,GAAG,aAAa,EAAU,OAAO,CACtC,EACA,EACD,CAED,OADA,KAAK,OAAO,KAAK,EAAO,MAAM,yBAAyB,EAAS,GAAG,CAAC,CAC7D,CACL,QAAS,EACT,KAAM,EAAS,MAAM,IAAI,CAAC,KAAK,CAAE,QAAQ,OAAQ,GAAG,CACrD,OACM,EAAK,CACZ,KAAK,OAAO,MACV,EAAO,IACL,qEAAqE,EAAI,UAC1E,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,GAEtB,CAGF,GAAI,OAAO,GAAiB,SAAU,CAEpC,GAAM,CAAC,EAAM,GAAG,GAAQ,EAAgB,KAAK,CAAE,aAAc,EAAQ,CAgBhE,MAZiB,EAAkB,CACtC,eACA,KAAM,EACN,SANe,EAAqB,EAAM,GAAG,EAMrC,CACR,yBACA,6BACA,WACA,gBAAiB,CAAC,CAAC,EACnB,OAAQ,KAAK,OACd,CAAC,GAIA,KAAK,OAAO,KACV,EAAO,IACL,iFAAiF,IAClF,CACF,CAED,KAAK,QAAQ,KAAK,EAAE,MAEjB,CAEL,GAAI,EAAgB,SAAW,GAAK,EAAgB,SAAW,EAAa,OAC1E,MAAU,MACR,sEACS,EAAgB,OAAO,WAC5B,EAAgB,SAAW,EAAI,GAAK,IACrC,OAAO,EAAa,OAAO,UAAU,EAAa,SAAW,EAAI,GAAK,MAC1E,CAGH,IAAM,EAA8B,EAAE,CACtC,MAAM,EAAU,EAAc,MAAO,EAAQ,IAAQ,CACnD,IAAM,EAAS,IAAI,EAAM,EAAE,GAAG,EAAa,OAAO,IAAI,EAAO,iBAAiB,IAC9E,KAAK,OAAO,KACV,EAAO,QAAQ,UAAU,EAAO,4CAA4C,CAC7E,CAGD,IAAM,EACJ,EAAgB,SAAW,EACvB,EAAgB,GAAG,QACnB,EAAgB,KAAM,GAAU,EAAM,OAAS,EAAO,iBAAiB,EAAE,QAG/E,GAAI,CAAC,EAAa,CAChB,KAAK,OAAO,MACV,EAAO,IACL,GAAG,EAAO,uDAAuD,EAAO,iBAAiB,IAC1F,CACF,CACD,EAAkB,KAAK,EAAO,iBAAiB,CAC/C,OAcE,MAXkB,EAAkB,CACtC,eACA,KAAM,EAAO,OACb,SAAU,EACV,WACA,yBACA,6BACA,kBACA,OAAQ,KAAK,OACd,CAAC,CAGA,KAAK,OAAO,KAAK,EAAO,MAAM,GAAG,EAAO,oCAAoC,CAAC,EAE7E,KAAK,OAAO,MAAM,EAAO,IAAI,GAAG,EAAO,+BAA+B,CAAC,CACvE,EAAkB,KAAK,EAAO,iBAAiB,GAEjD,CAEE,EAAkB,OAAS,IAC7B,KAAK,OAAO,KACV,EAAO,IACL,gCAAgC,EAAkB,KAChD,IACD,CAAC,0DAA0D,IAC7D,CACF,CAED,KAAK,QAAQ,KAAK,EAAE,EAKxB,KAAK,OAAO,KACV,EAAO,MAAM,uDAAuD,IAA0B,CAC/F"}

package/dist/{impl-DbddBTRj2.mjs → impl-DlrJX5Gl2.mjs}

@@ -1,4 +1,4 @@
-import{t as e}from"./constants-BCmVqlrM.mjs";import{t}from"./logger-CPu6zbyQ.mjs";import{t as n}from"./done-input-validation-LiTaCEzF.mjs";import{n as r}from"./constants-DC_bBO09.mjs";import i from"colors";import a from"fast-glob";import{buildTranscendGraphQLClient as o,fetchActiveSiloDiscoPlugin as s,uploadSiloDiscoveryResults as c}from"@transcend-io/sdk";import{stringify as l}from"query-string";async function u({scanPath:e,fileGlobs:n,ignoreDirs:r,config:i}){let{ignoreDirs:o,supportedFiles:s,scanFunction:c}=i,l=n===``?s:s.concat(n.split(`,`)),d=[...r.split(`,`),...o].filter(e=>e.length>0);try{let n=await a(`${e}/**/${l.join(`|`)}`,{ignore:d.map(t=>`${e}/**/${t}`),unique:!0,onlyFiles:!0});t.info(`Scanning: ${n.length} files`);let r=n.map(e=>c(e)).flat().map(e=>e.softwareDevelopmentKits||[]).flat(),i=[...new Set(r.map(e=>e.name))];return t.info(`Found: ${i.length} unique dependencies`),i.map(t=>({name:t,resourceId:`${e}/**/${t}`,useStrictClassifier:!0}))}catch(e){throw Error(`Error scanning globs ${u} with error: ${e}`)}}async function d({scanPath:t,dataSiloId:a,auth:d,fileGlobs:f,ignoreDirs:p,transcendUrl:m}){n(this.process);let h=o(m,d),g=await s(h,{logger:this.logger,filterBy:{dataSiloId:a}}),_=r[g.dataSilo.type];_||(this.logger.error(i.red(`This plugin "${g.dataSilo.type}" is not supported for offline silo discovery.`)),this.process.exit(1));let v=await u({scanPath:t,fileGlobs:f,ignoreDirs:p,config:_});await c(h,{pluginId:g.id,results:v,logger:this.logger});let y=new URL(e);y.pathname=`/data-map/data-inventory/silo-discovery/triage`,y.search=l({filters:JSON.stringify({pluginIds:[g.id]})}),this.logger.info(i.green(`Scan found ${v.length} potential data silos at ${t}! View at '${y.href}' 
+import{t as e}from"./constants-rXUIz6Uy.mjs";import{t}from"./logger-CPu6zbyQ.mjs";import{t as n}from"./done-input-validation-LiTaCEzF.mjs";import{n as r}from"./constants-DC_bBO09.mjs";import i from"colors";import a from"fast-glob";import{buildTranscendGraphQLClient as o,fetchActiveSiloDiscoPlugin as s,uploadSiloDiscoveryResults as c}from"@transcend-io/sdk";import{stringify as l}from"query-string";async function u({scanPath:e,fileGlobs:n,ignoreDirs:r,config:i}){let{ignoreDirs:o,supportedFiles:s,scanFunction:c}=i,l=n===``?s:s.concat(n.split(`,`)),d=[...r.split(`,`),...o].filter(e=>e.length>0);try{let n=await a(`${e}/**/${l.join(`|`)}`,{ignore:d.map(t=>`${e}/**/${t}`),unique:!0,onlyFiles:!0});t.info(`Scanning: ${n.length} files`);let r=n.map(e=>c(e)).flat().map(e=>e.softwareDevelopmentKits||[]).flat(),i=[...new Set(r.map(e=>e.name))];return t.info(`Found: ${i.length} unique dependencies`),i.map(t=>({name:t,resourceId:`${e}/**/${t}`,useStrictClassifier:!0}))}catch(e){throw Error(`Error scanning globs ${u} with error: ${e}`)}}async function d({scanPath:t,dataSiloId:a,auth:d,fileGlobs:f,ignoreDirs:p,transcendUrl:m}){n(this.process);let h=o(m,d),g=await s(h,{logger:this.logger,filterBy:{dataSiloId:a}}),_=r[g.dataSilo.type];_||(this.logger.error(i.red(`This plugin "${g.dataSilo.type}" is not supported for offline silo discovery.`)),this.process.exit(1));let v=await u({scanPath:t,fileGlobs:f,ignoreDirs:p,config:_});await c(h,{pluginId:g.id,results:v,logger:this.logger});let y=new URL(e);y.pathname=`/data-map/data-inventory/silo-discovery/triage`,y.search=l({filters:JSON.stringify({pluginIds:[g.id]})}),this.logger.info(i.green(`Scan found ${v.length} potential data silos at ${t}! View at '${y.href}' 
 
  NOTE: it may take 2-3 minutes for scan results to appear in the UI.`))}export{d as discoverSilos};
-//# sourceMappingURL=impl-DbddBTRj2.mjs.map
+//# sourceMappingURL=impl-DlrJX5Gl2.mjs.map

package/dist/{impl-DbddBTRj2.mjs.map → impl-DlrJX5Gl2.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DbddBTRj2.mjs","names":[],"sources":["../src/lib/code-scanning/findFilesToScan.ts","../src/commands/inventory/discover-silos/impl.ts"],"sourcesContent":["import fastGlob from 'fast-glob';\n\nimport { logger } from '../../logger.js';\nimport { CodeScanningConfig } from './types.js';\n\nexport interface SiloDiscoveryRawResults {\n  /** The name of the potential data silo entry */\n  name: string;\n  /** A unique UUID (represents the same resource across different silo discovery runs) */\n  resourceId: string;\n  /** Any hosts associated with the entry */\n  host?: string;\n  /** Type of data silo */\n  type?: string | undefined;\n}\n\n/**\n * Helper to scan for data silos in all package.json files that it can find in a directory\n *\n * @deprecated TODO: https://transcend.height.app/T-32325 - use code scanning instead\n * @param options - Options\n * @returns the list of integrations\n */\nexport async function findFilesToScan({\n  scanPath,\n  fileGlobs,\n  ignoreDirs,\n  config,\n}: {\n  /** Where to look for package.json files */\n  scanPath: string;\n  /** Globs to look for */\n  fileGlobs: string;\n  /** The directories to ignore (excludes node_modules and serverless-build) */\n  ignoreDirs: string;\n  /** Silo Discovery configuration */\n  config: CodeScanningConfig;\n}): Promise<SiloDiscoveryRawResults[]> {\n  const { ignoreDirs: IGNORE_DIRS, supportedFiles, scanFunction } = config;\n  const globsToSupport =\n    fileGlobs === '' ? supportedFiles : supportedFiles.concat(fileGlobs.split(','));\n  const dirsToIgnore = [...ignoreDirs.split(','), ...IGNORE_DIRS].filter((dir) => dir.length > 0);\n  try {\n    const filesToScan: string[] = await fastGlob(`${scanPath}/**/${globsToSupport.join('|')}`, {\n      ignore: dirsToIgnore.map((dir: string) => `${scanPath}/**/${dir}`),\n      unique: true,\n      onlyFiles: true,\n    });\n    logger.info(`Scanning: ${filesToScan.length} files`);\n    const allPackages = filesToScan.map((filePath: string) => scanFunction(filePath)).flat();\n    const allSdks = allPackages\n      .map((appPackage) => appPackage.softwareDevelopmentKits || [])\n      .flat();\n    const uniqueDeps = new Set(allSdks.map((sdk) => sdk.name));\n    const deps = [...uniqueDeps];\n    logger.info(`Found: ${deps.length} unique dependencies`);\n    return deps.map((dep) => ({\n      name: dep,\n      resourceId: `${scanPath}/**/${dep}`,\n      useStrictClassifier: true,\n    }));\n  } catch (error) {\n    throw new Error(`Error scanning globs ${findFilesToScan} with error: ${error}`);\n  }\n}\n","import {\n  buildTranscendGraphQLClient,\n  fetchActiveSiloDiscoPlugin,\n  uploadSiloDiscoveryResults,\n} from '@transcend-io/sdk';\nimport colors from 'colors';\nimport { stringify } from 'query-string';\n\nimport { ADMIN_DASH } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { findFilesToScan } from '../../../lib/code-scanning/findFilesToScan.js';\nimport { SILO_DISCOVERY_CONFIGS } from '../../../lib/code-scanning/index.js';\n\nexport interface DiscoverSilosCommandFlags {\n  scanPath: string;\n  dataSiloId: string;\n  auth: string;\n  fileGlobs: string;\n  ignoreDirs: string;\n  transcendUrl: string;\n}\n\nexport async function discoverSilos(\n  this: LocalContext,\n  { scanPath, dataSiloId, auth, fileGlobs, ignoreDirs, transcendUrl }: DiscoverSilosCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Create a GraphQL client\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n\n  const plugin = await fetchActiveSiloDiscoPlugin(client, {\n    logger: this.logger,\n    filterBy: { dataSiloId },\n  });\n\n  const config = SILO_DISCOVERY_CONFIGS[plugin.dataSilo.type];\n  if (!config) {\n    this.logger.error(\n      colors.red(\n        `This plugin \"${plugin.dataSilo.type}\" is not supported for offline silo discovery.`,\n      ),\n    );\n    this.process.exit(1);\n  }\n\n  const results = await findFilesToScan({\n    scanPath,\n    fileGlobs,\n    ignoreDirs,\n    config,\n  });\n\n  await uploadSiloDiscoveryResults(client, {\n    pluginId: plugin.id,\n    results,\n    logger: this.logger,\n  });\n\n  const newUrl = new URL(ADMIN_DASH);\n  newUrl.pathname = '/data-map/data-inventory/silo-discovery/triage';\n  newUrl.search = stringify({\n    filters: JSON.stringify({ pluginIds: [plugin.id] }),\n  });\n\n  // Indicate success\n  this.logger.info(\n    colors.green(\n      `Scan found ${results.length} potential data silos at ${scanPath}! ` +\n        `View at '${newUrl.href}' ` +\n        '\\n\\n NOTE: it may take 2-3 minutes for scan results to appear in the UI.',\n    ),\n  );\n}\n"],"mappings":"gZAuBA,eAAsB,EAAgB,CACpC,WACA,YACA,aACA,UAUqC,CACrC,GAAM,CAAE,WAAY,EAAa,iBAAgB,gBAAiB,EAC5D,EACJ,IAAc,GAAK,EAAiB,EAAe,OAAO,EAAU,MAAM,IAAI,CAAC,CAC3E,EAAe,CAAC,GAAG,EAAW,MAAM,IAAI,CAAE,GAAG,EAAY,CAAC,OAAQ,GAAQ,EAAI,OAAS,EAAE,CAC/F,GAAI,CACF,IAAM,EAAwB,MAAM,EAAS,GAAG,EAAS,MAAM,EAAe,KAAK,IAAI,GAAI,CACzF,OAAQ,EAAa,IAAK,GAAgB,GAAG,EAAS,MAAM,IAAM,CAClE,OAAQ,GACR,UAAW,GACZ,CAAC,CACF,EAAO,KAAK,aAAa,EAAY,OAAO,QAAQ,CAEpD,IAAM,EADc,EAAY,IAAK,GAAqB,EAAa,EAAS,CAAC,CAAC,MACvD,CACxB,IAAK,GAAe,EAAW,yBAA2B,EAAE,CAAC,CAC7D,MAAM,CAEH,EAAO,CAAC,GAAG,IADM,IAAI,EAAQ,IAAK,GAAQ,EAAI,KAAK,CAC9B,CAAC,CAE5B,OADA,EAAO,KAAK,UAAU,EAAK,OAAO,sBAAsB,CACjD,EAAK,IAAK,IAAS,CACxB,KAAM,EACN,WAAY,GAAG,EAAS,MAAM,IAC9B,oBAAqB,GACtB,EAAE,OACI,EAAO,CACd,MAAU,MAAM,wBAAwB,EAAgB,eAAe,IAAQ,ECvCnF,eAAsB,EAEpB,CAAE,WAAU,aAAY,OAAM,YAAW,aAAY,gBACtC,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAS,EAA4B,EAAc,EAAK,CAExD,EAAS,MAAM,EAA2B,EAAQ,CACtD,OAAQ,KAAK,OACb,SAAU,CAAE,aAAY,CACzB,CAAC,CAEI,EAAS,EAAuB,EAAO,SAAS,MACjD,IACH,KAAK,OAAO,MACV,EAAO,IACL,gBAAgB,EAAO,SAAS,KAAK,gDACtC,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,EAGtB,IAAM,EAAU,MAAM,EAAgB,CACpC,WACA,YACA,aACA,SACD,CAAC,CAEF,MAAM,EAA2B,EAAQ,CACvC,SAAU,EAAO,GACjB,UACA,OAAQ,KAAK,OACd,CAAC,CAEF,IAAM,EAAS,IAAI,IAAI,EAAW,CAClC,EAAO,SAAW,iDAClB,EAAO,OAAS,EAAU,CACxB,QAAS,KAAK,UAAU,CAAE,UAAW,CAAC,EAAO,GAAG,CAAE,CAAC,CACpD,CAAC,CAGF,KAAK,OAAO,KACV,EAAO,MACL,cAAc,EAAQ,OAAO,2BAA2B,EAAS,aACnD,EAAO,KAAK;;sEAE3B,CACF"}
+{"version":3,"file":"impl-DlrJX5Gl2.mjs","names":[],"sources":["../src/lib/code-scanning/findFilesToScan.ts","../src/commands/inventory/discover-silos/impl.ts"],"sourcesContent":["import fastGlob from 'fast-glob';\n\nimport { logger } from '../../logger.js';\nimport { CodeScanningConfig } from './types.js';\n\nexport interface SiloDiscoveryRawResults {\n  /** The name of the potential data silo entry */\n  name: string;\n  /** A unique UUID (represents the same resource across different silo discovery runs) */\n  resourceId: string;\n  /** Any hosts associated with the entry */\n  host?: string;\n  /** Type of data silo */\n  type?: string | undefined;\n}\n\n/**\n * Helper to scan for data silos in all package.json files that it can find in a directory\n *\n * @deprecated TODO: https://transcend.height.app/T-32325 - use code scanning instead\n * @param options - Options\n * @returns the list of integrations\n */\nexport async function findFilesToScan({\n  scanPath,\n  fileGlobs,\n  ignoreDirs,\n  config,\n}: {\n  /** Where to look for package.json files */\n  scanPath: string;\n  /** Globs to look for */\n  fileGlobs: string;\n  /** The directories to ignore (excludes node_modules and serverless-build) */\n  ignoreDirs: string;\n  /** Silo Discovery configuration */\n  config: CodeScanningConfig;\n}): Promise<SiloDiscoveryRawResults[]> {\n  const { ignoreDirs: IGNORE_DIRS, supportedFiles, scanFunction } = config;\n  const globsToSupport =\n    fileGlobs === '' ? supportedFiles : supportedFiles.concat(fileGlobs.split(','));\n  const dirsToIgnore = [...ignoreDirs.split(','), ...IGNORE_DIRS].filter((dir) => dir.length > 0);\n  try {\n    const filesToScan: string[] = await fastGlob(`${scanPath}/**/${globsToSupport.join('|')}`, {\n      ignore: dirsToIgnore.map((dir: string) => `${scanPath}/**/${dir}`),\n      unique: true,\n      onlyFiles: true,\n    });\n    logger.info(`Scanning: ${filesToScan.length} files`);\n    const allPackages = filesToScan.map((filePath: string) => scanFunction(filePath)).flat();\n    const allSdks = allPackages\n      .map((appPackage) => appPackage.softwareDevelopmentKits || [])\n      .flat();\n    const uniqueDeps = new Set(allSdks.map((sdk) => sdk.name));\n    const deps = [...uniqueDeps];\n    logger.info(`Found: ${deps.length} unique dependencies`);\n    return deps.map((dep) => ({\n      name: dep,\n      resourceId: `${scanPath}/**/${dep}`,\n      useStrictClassifier: true,\n    }));\n  } catch (error) {\n    throw new Error(`Error scanning globs ${findFilesToScan} with error: ${error}`);\n  }\n}\n","import {\n  buildTranscendGraphQLClient,\n  fetchActiveSiloDiscoPlugin,\n  uploadSiloDiscoveryResults,\n} from '@transcend-io/sdk';\nimport colors from 'colors';\nimport { stringify } from 'query-string';\n\nimport { ADMIN_DASH } from '../../../constants.js';\nimport type { LocalContext } from '../../../context.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { findFilesToScan } from '../../../lib/code-scanning/findFilesToScan.js';\nimport { SILO_DISCOVERY_CONFIGS } from '../../../lib/code-scanning/index.js';\n\nexport interface DiscoverSilosCommandFlags {\n  scanPath: string;\n  dataSiloId: string;\n  auth: string;\n  fileGlobs: string;\n  ignoreDirs: string;\n  transcendUrl: string;\n}\n\nexport async function discoverSilos(\n  this: LocalContext,\n  { scanPath, dataSiloId, auth, fileGlobs, ignoreDirs, transcendUrl }: DiscoverSilosCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  // Create a GraphQL client\n  const client = buildTranscendGraphQLClient(transcendUrl, auth);\n\n  const plugin = await fetchActiveSiloDiscoPlugin(client, {\n    logger: this.logger,\n    filterBy: { dataSiloId },\n  });\n\n  const config = SILO_DISCOVERY_CONFIGS[plugin.dataSilo.type];\n  if (!config) {\n    this.logger.error(\n      colors.red(\n        `This plugin \"${plugin.dataSilo.type}\" is not supported for offline silo discovery.`,\n      ),\n    );\n    this.process.exit(1);\n  }\n\n  const results = await findFilesToScan({\n    scanPath,\n    fileGlobs,\n    ignoreDirs,\n    config,\n  });\n\n  await uploadSiloDiscoveryResults(client, {\n    pluginId: plugin.id,\n    results,\n    logger: this.logger,\n  });\n\n  const newUrl = new URL(ADMIN_DASH);\n  newUrl.pathname = '/data-map/data-inventory/silo-discovery/triage';\n  newUrl.search = stringify({\n    filters: JSON.stringify({ pluginIds: [plugin.id] }),\n  });\n\n  // Indicate success\n  this.logger.info(\n    colors.green(\n      `Scan found ${results.length} potential data silos at ${scanPath}! ` +\n        `View at '${newUrl.href}' ` +\n        '\\n\\n NOTE: it may take 2-3 minutes for scan results to appear in the UI.',\n    ),\n  );\n}\n"],"mappings":"gZAuBA,eAAsB,EAAgB,CACpC,WACA,YACA,aACA,UAUqC,CACrC,GAAM,CAAE,WAAY,EAAa,iBAAgB,gBAAiB,EAC5D,EACJ,IAAc,GAAK,EAAiB,EAAe,OAAO,EAAU,MAAM,IAAI,CAAC,CAC3E,EAAe,CAAC,GAAG,EAAW,MAAM,IAAI,CAAE,GAAG,EAAY,CAAC,OAAQ,GAAQ,EAAI,OAAS,EAAE,CAC/F,GAAI,CACF,IAAM,EAAwB,MAAM,EAAS,GAAG,EAAS,MAAM,EAAe,KAAK,IAAI,GAAI,CACzF,OAAQ,EAAa,IAAK,GAAgB,GAAG,EAAS,MAAM,IAAM,CAClE,OAAQ,GACR,UAAW,GACZ,CAAC,CACF,EAAO,KAAK,aAAa,EAAY,OAAO,QAAQ,CAEpD,IAAM,EADc,EAAY,IAAK,GAAqB,EAAa,EAAS,CAAC,CAAC,MACvD,CACxB,IAAK,GAAe,EAAW,yBAA2B,EAAE,CAAC,CAC7D,MAAM,CAEH,EAAO,CAAC,GAAG,IADM,IAAI,EAAQ,IAAK,GAAQ,EAAI,KAAK,CAC9B,CAAC,CAE5B,OADA,EAAO,KAAK,UAAU,EAAK,OAAO,sBAAsB,CACjD,EAAK,IAAK,IAAS,CACxB,KAAM,EACN,WAAY,GAAG,EAAS,MAAM,IAC9B,oBAAqB,GACtB,EAAE,OACI,EAAO,CACd,MAAU,MAAM,wBAAwB,EAAgB,eAAe,IAAQ,ECvCnF,eAAsB,EAEpB,CAAE,WAAU,aAAY,OAAM,YAAW,aAAY,gBACtC,CACf,EAAoB,KAAK,QAAQ,CAGjC,IAAM,EAAS,EAA4B,EAAc,EAAK,CAExD,EAAS,MAAM,EAA2B,EAAQ,CACtD,OAAQ,KAAK,OACb,SAAU,CAAE,aAAY,CACzB,CAAC,CAEI,EAAS,EAAuB,EAAO,SAAS,MACjD,IACH,KAAK,OAAO,MACV,EAAO,IACL,gBAAgB,EAAO,SAAS,KAAK,gDACtC,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,EAGtB,IAAM,EAAU,MAAM,EAAgB,CACpC,WACA,YACA,aACA,SACD,CAAC,CAEF,MAAM,EAA2B,EAAQ,CACvC,SAAU,EAAO,GACjB,UACA,OAAQ,KAAK,OACd,CAAC,CAEF,IAAM,EAAS,IAAI,IAAI,EAAW,CAClC,EAAO,SAAW,iDAClB,EAAO,OAAS,EAAU,CACxB,QAAS,KAAK,UAAU,CAAE,UAAW,CAAC,EAAO,GAAG,CAAE,CAAC,CACpD,CAAC,CAGF,KAAK,OAAO,KACV,EAAO,MACL,cAAc,EAAQ,OAAO,2BAA2B,EAAS,aACnD,EAAO,KAAK;;sEAE3B,CACF"}

package/dist/{impl-F2lRJEqw.mjs → impl-KukgjmYS.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./pushManualEnrichmentIdentifiersFromCsv-B3iVwuvs.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,transcendUrl:r,file:i,enricherId:a,concurrency:o,markSilent:s,sombraAuth:c}){t(this.process),await e({file:i,transcendUrl:r,enricherId:a,concurrency:o,markSilent:s,auth:n,sombraAuth:c})}export{n as pushIdentifiers};
-//# sourceMappingURL=impl-F2lRJEqw.mjs.map
+import{t as e}from"./pushManualEnrichmentIdentifiersFromCsv-Dyh7-KVs.mjs";import{t}from"./done-input-validation-LiTaCEzF.mjs";async function n({auth:n,transcendUrl:r,file:i,enricherId:a,concurrency:o,markSilent:s,sombraAuth:c}){t(this.process),await e({file:i,transcendUrl:r,enricherId:a,concurrency:o,markSilent:s,auth:n,sombraAuth:c})}export{n as pushIdentifiers};
+//# sourceMappingURL=impl-KukgjmYS.mjs.map

package/dist/{impl-F2lRJEqw.mjs.map → impl-KukgjmYS.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-F2lRJEqw.mjs","names":[],"sources":["../src/commands/request/preflight/push-identifiers/impl.ts"],"sourcesContent":["import type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { pushManualEnrichmentIdentifiersFromCsv } from '../../../../lib/manual-enrichment/index.js';\n\nexport interface PushIdentifiersCommandFlags {\n  auth: string;\n  enricherId: string;\n  sombraAuth?: string;\n  transcendUrl: string;\n  file: string;\n  markSilent: boolean;\n  concurrency: number;\n}\n\nexport async function pushIdentifiers(\n  this: LocalContext,\n  {\n    auth,\n    transcendUrl,\n    file,\n    enricherId,\n    concurrency,\n    markSilent,\n    sombraAuth,\n  }: PushIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await pushManualEnrichmentIdentifiersFromCsv({\n    file,\n    transcendUrl,\n    enricherId,\n    concurrency,\n    markSilent,\n    auth,\n    sombraAuth,\n  });\n}\n"],"mappings":"8HAcA,eAAsB,EAEpB,CACE,OACA,eACA,OACA,aACA,cACA,aACA,cAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAuC,CAC3C,OACA,eACA,aACA,cACA,aACA,OACA,aACD,CAAC"}
+{"version":3,"file":"impl-KukgjmYS.mjs","names":[],"sources":["../src/commands/request/preflight/push-identifiers/impl.ts"],"sourcesContent":["import type { LocalContext } from '../../../../context.js';\nimport { doneInputValidation } from '../../../../lib/cli/done-input-validation.js';\nimport { pushManualEnrichmentIdentifiersFromCsv } from '../../../../lib/manual-enrichment/index.js';\n\nexport interface PushIdentifiersCommandFlags {\n  auth: string;\n  enricherId: string;\n  sombraAuth?: string;\n  transcendUrl: string;\n  file: string;\n  markSilent: boolean;\n  concurrency: number;\n}\n\nexport async function pushIdentifiers(\n  this: LocalContext,\n  {\n    auth,\n    transcendUrl,\n    file,\n    enricherId,\n    concurrency,\n    markSilent,\n    sombraAuth,\n  }: PushIdentifiersCommandFlags,\n): Promise<void> {\n  doneInputValidation(this.process);\n\n  await pushManualEnrichmentIdentifiersFromCsv({\n    file,\n    transcendUrl,\n    enricherId,\n    concurrency,\n    markSilent,\n    auth,\n    sombraAuth,\n  });\n}\n"],"mappings":"8HAcA,eAAsB,EAEpB,CACE,OACA,eACA,OACA,aACA,cACA,aACA,cAEa,CACf,EAAoB,KAAK,QAAQ,CAEjC,MAAM,EAAuC,CAC3C,OACA,eACA,aACA,cACA,aACA,OACA,aACD,CAAC"}

package/dist/{impl-DE_cRfz52.mjs → impl-Sx15m6eC2.mjs}

@@ -1,2 +1,2 @@
-import{t as e}from"./buildExamples-kR5_7dkU.mjs";import{r as t}from"./policyEngineCliError-CZrOHhLv.mjs";import{a as n,c as r,g as i,i as a}from"./policy-project-discovery-DV5PnFJq.mjs";import{r as o,t as s}from"./runOpa-ojIqU1tO.mjs";import{n as c,t as l}from"./policy-bundle-manifest-BDey6EBs.mjs";import{i as u,n as d,t as f}from"./printResult-Dmwv78e7.mjs";import{t as p}from"./formatPolicyBundleVersionSummary-DCHl1Vhy.mjs";import{n as m}from"./resolveBundleIdByName-BPrMkU0w.mjs";import{n as h}from"./inquirer-jzIQWAvq.mjs";import{t as g}from"./done-input-validation-LiTaCEzF.mjs";import{r as _}from"./prompts-BhXfYD6g.mjs";import{t as v}from"./command-output-BJcDRXNr.mjs";import y,{join as b}from"node:path";import x from"colors";import{spawnSync as S}from"node:child_process";import C from"node:fs";import w from"node:os";import{gunzipSync as T}from"node:zlib";import{MAX_BUNDLE_COMPRESSED_BYTES as E,MAX_BUNDLE_DECOMPRESSED_BYTES as D}from"@transcend-io/utils";import O from"fast-glob";function k(e){let t=O.sync(`**/*.rego`,{cwd:e,onlyFiles:!0,dot:!1}).sort(),n=y.join(e,r),{publishableRegoPaths:i}=c(C.existsSync(n)?C.readFileSync(n,`utf8`):void 0,t.map(t=>({path:t,contents:C.readFileSync(y.join(e,t),`utf8`)})));return{entries:[r,...i]}}async function A(e){let t=y.join(w.tmpdir(),`transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`);try{let{code:n,stderr:r}=await s([`build`,`--ignore`,`*_test.rego`,`-b`,`-o`,t,`.`],{cwd:e});if(n!==0)throw Error(r.trim()||`opa build failed with exit code ${n}`)}finally{C.existsSync(t)&&C.unlinkSync(t)}}function j(e){if(e<1024)return`${e} B`;let t=e/1024;if(t<1024)return`${t%1==0?t.toFixed(0):t.toFixed(1)} KiB`;let n=t/1024;return`${n%1==0?n.toFixed(0):n.toFixed(1)} MiB`}async function M(e){o();let t=y.resolve(e);if(!C.existsSync(t)||!C.statSync(t).isDirectory())throw Error(`Policy directory does not exist or is not a directory: ${t}`);let{entries:n}=k(t),{code:r,stderr:i}=await s([`check`,`--strict`,t]);if(r!==0)throw Error(i.trim()||`opa check failed with exit code ${r}`);await A(t);let a=y.join(w.tmpdir(),`transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`),c=S(`tar`,[`-czf`,a,`-C`,t,...n],{env:{...process.env,COPYFILE_DISABLE:`1`},encoding:`utf8`});if(c.status!==0)throw Error(`Failed to create policy bundle archive: ${c.stderr.trim()||`tar failed`}`);let l=C.readFileSync(a);if(l.byteLength>E)throw C.unlinkSync(a),Error(`Policy bundle exceeds the ${j(E)} compressed upload limit (bundle is ${j(l.byteLength)}). The server also rejects decompressed bundles larger than ${j(D)}.`);let u=T(l);if(u.byteLength>D)throw C.unlinkSync(a),Error(`Policy bundle exceeds the ${j(D)} decompressed upload limit (bundle is ${j(u.byteLength)} decompressed).`);return a}function N(e){let t=C.readFileSync(e.bundlePath),n=new FormData;return n.append(`bundle`,new Blob([t],{type:`application/gzip`}),y.basename(e.bundlePath)),n.append(`version`,e.version),e.description&&n.append(`description`,e.description),e.bundleName&&n.append(`bundleName`,e.bundleName),n}function P(e){return e.toISOString().slice(0,19).replace(/[T:]/g,`-`)}function F(e,t=new Date){return`${e}-${P(t)}`}function I(e){return e.template===i.Permissions?!0:e.template===i.Generic?!1:e.roots.some(e=>e===`permissions`||e.startsWith(`permissions/`))}function L(e,t){let r=I(t),i=e===n;if(r&&!i)return`This directory looks like a Permissions API policy, but --remote-bundle-name is "${e}". Permissions API only loads the remote bundle named "${n}". Upload still succeeds; pass --remote-bundle-name=${n} if that is the intended path.`;if(!r&&i)return`--remote-bundle-name=${n} reserves the Permissions API path. Upload treats all bundles the same; only that fixed name is queried by the Permissions API. Continue only if you intend this bundle for the Permissions API.`}async function R({"remote-bundle-name":n,auth:i,"transcend-url":o,version:s,description:c,json:y,yes:S,debug:C=!1},w){g(this.process),t(C);let T=v(this.logger,y),E=a(this.process.cwd(),w),D=s??F(n),O=u(o,i),k=_({json:y,noInteractive:!1},this.process.stdin.isTTY,this.process.stderr.isTTY),A;try{T.info(x.green(`Building policy bundle from ${E}...`)),A=await M(E);try{let e=b(E,r),t=L(n,l(this.fs.readFileSync(e,`utf8`)));t&&T.warn(x.yellow(t))}catch{}let t=await m(O,n),i;if(t){T.info(x.green(`Uploading new version for bundle "${n}"...`));let e=N({bundlePath:A,version:D,description:c});i=await d(O.post(`v1/policy-engine/policy-bundles/${t}/versions`,{body:e}).json())}else{if(!k&&!S){this.logger.error(x.red(`Cannot create a new bundle in non-interactive or JSON mode; pass --yes to confirm.`)),this.process.exit(1);return}if(!S&&(T.warn(x.yellow(`No policy bundle named "${n}" exists for this organization.`)),!await h({message:`No policy bundle named "${n}" exists. Create a new bundle and upload its first version?`}))){T.info(x.yellow(`Publish cancelled.`));return}T.info(x.green(`Creating bundle "${n}" and uploading first version...`));let e=N({bundlePath:A,version:D,description:c,bundleName:n});i=await d(O.post(`v1/policy-engine/policy-bundles`,{body:e}).json())}f(this.process.stdout,{json:y,data:i,renderTable:()=>p(i.version)}),T.info(x.green(`Policy bundle version uploaded successfully.`));let a=e([`policy`,`activate`],{version:i.version.version,"remote-bundle-name":n});T.info(x.yellow(`Publishing a policy does not activate it. To activate this version, run:\n  ${a}`))}finally{A&&this.fs.existsSync(A)&&this.fs.unlinkSync(A)}}export{R as publish};
-//# sourceMappingURL=impl-DE_cRfz52.mjs.map
+import{t as e}from"./buildExamples-BPpsiPem.mjs";import{r as t}from"./policyEngineCliError-CZrOHhLv.mjs";import{a as n,c as r,g as i,i as a}from"./policy-project-discovery-_6QosI9J.mjs";import{r as o,t as s}from"./runOpa-ojIqU1tO.mjs";import{n as c,t as l}from"./policy-bundle-manifest-CDbVx8E6.mjs";import{i as u,n as d,t as f}from"./printResult-Dmwv78e7.mjs";import{t as p}from"./formatPolicyBundleVersionSummary-DCHl1Vhy.mjs";import{n as m}from"./resolveBundleIdByName-BPrMkU0w.mjs";import{n as h}from"./inquirer-jzIQWAvq.mjs";import{t as g}from"./done-input-validation-LiTaCEzF.mjs";import{r as _}from"./prompts-BhXfYD6g.mjs";import{t as v}from"./command-output-BJcDRXNr.mjs";import y,{join as b}from"node:path";import x from"colors";import{spawnSync as S}from"node:child_process";import C from"node:fs";import w from"node:os";import{gunzipSync as T}from"node:zlib";import{MAX_BUNDLE_COMPRESSED_BYTES as E,MAX_BUNDLE_DECOMPRESSED_BYTES as D}from"@transcend-io/utils";import O from"fast-glob";function k(e){let t=O.sync(`**/*.rego`,{cwd:e,onlyFiles:!0,dot:!1}).sort(),n=y.join(e,r),{publishableRegoPaths:i}=c(C.existsSync(n)?C.readFileSync(n,`utf8`):void 0,t.map(t=>({path:t,contents:C.readFileSync(y.join(e,t),`utf8`)})));return{entries:[r,...i]}}async function A(e){let t=y.join(w.tmpdir(),`transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`);try{let{code:n,stderr:r}=await s([`build`,`--ignore`,`*_test.rego`,`-b`,`-o`,t,`.`],{cwd:e});if(n!==0)throw Error(r.trim()||`opa build failed with exit code ${n}`)}finally{C.existsSync(t)&&C.unlinkSync(t)}}function j(e){if(e<1024)return`${e} B`;let t=e/1024;if(t<1024)return`${t%1==0?t.toFixed(0):t.toFixed(1)} KiB`;let n=t/1024;return`${n%1==0?n.toFixed(0):n.toFixed(1)} MiB`}async function M(e){o();let t=y.resolve(e);if(!C.existsSync(t)||!C.statSync(t).isDirectory())throw Error(`Policy directory does not exist or is not a directory: ${t}`);let{entries:n}=k(t),{code:r,stderr:i}=await s([`check`,`--strict`,t]);if(r!==0)throw Error(i.trim()||`opa check failed with exit code ${r}`);await A(t);let a=y.join(w.tmpdir(),`transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`),c=S(`tar`,[`-czf`,a,`-C`,t,...n],{env:{...process.env,COPYFILE_DISABLE:`1`},encoding:`utf8`});if(c.status!==0)throw Error(`Failed to create policy bundle archive: ${c.stderr.trim()||`tar failed`}`);let l=C.readFileSync(a);if(l.byteLength>E)throw C.unlinkSync(a),Error(`Policy bundle exceeds the ${j(E)} compressed upload limit (bundle is ${j(l.byteLength)}). The server also rejects decompressed bundles larger than ${j(D)}.`);let u=T(l);if(u.byteLength>D)throw C.unlinkSync(a),Error(`Policy bundle exceeds the ${j(D)} decompressed upload limit (bundle is ${j(u.byteLength)} decompressed).`);return a}function N(e){let t=C.readFileSync(e.bundlePath),n=new FormData;return n.append(`bundle`,new Blob([t],{type:`application/gzip`}),y.basename(e.bundlePath)),n.append(`version`,e.version),e.description&&n.append(`description`,e.description),e.bundleName&&n.append(`bundleName`,e.bundleName),n}function P(e){return e.toISOString().slice(0,19).replace(/[T:]/g,`-`)}function F(e,t=new Date){return`${e}-${P(t)}`}function I(e){return e.template===i.Permissions?!0:e.template===i.Generic?!1:e.roots.some(e=>e===`permissions`||e.startsWith(`permissions/`))}function L(e,t){let r=I(t),i=e===n;if(r&&!i)return`This directory looks like a Permissions API policy, but --remote-bundle-name is "${e}". Permissions API only loads the remote bundle named "${n}". Upload still succeeds; pass --remote-bundle-name=${n} if that is the intended path.`;if(!r&&i)return`--remote-bundle-name=${n} reserves the Permissions API path. Upload treats all bundles the same; only that fixed name is queried by the Permissions API. Continue only if you intend this bundle for the Permissions API.`}async function R({"remote-bundle-name":n,auth:i,"transcend-url":o,version:s,description:c,json:y,yes:S,debug:C=!1},w){g(this.process),t(C);let T=v(this.logger,y),E=a(this.process.cwd(),w),D=s??F(n),O=u(o,i),k=_({json:y,noInteractive:!1},this.process.stdin.isTTY,this.process.stderr.isTTY),A;try{T.info(x.green(`Building policy bundle from ${E}...`)),A=await M(E);try{let e=b(E,r),t=L(n,l(this.fs.readFileSync(e,`utf8`)));t&&T.warn(x.yellow(t))}catch{}let t=await m(O,n),i;if(t){T.info(x.green(`Uploading new version for bundle "${n}"...`));let e=N({bundlePath:A,version:D,description:c});i=await d(O.post(`v1/policy-engine/policy-bundles/${t}/versions`,{body:e}).json())}else{if(!k&&!S){this.logger.error(x.red(`Cannot create a new bundle in non-interactive or JSON mode; pass --yes to confirm.`)),this.process.exit(1);return}if(!S&&(T.warn(x.yellow(`No policy bundle named "${n}" exists for this organization.`)),!await h({message:`No policy bundle named "${n}" exists. Create a new bundle and upload its first version?`}))){T.info(x.yellow(`Publish cancelled.`));return}T.info(x.green(`Creating bundle "${n}" and uploading first version...`));let e=N({bundlePath:A,version:D,description:c,bundleName:n});i=await d(O.post(`v1/policy-engine/policy-bundles`,{body:e}).json())}f(this.process.stdout,{json:y,data:i,renderTable:()=>p(i.version)}),T.info(x.green(`Policy bundle version uploaded successfully.`));let a=e([`policy`,`activate`],{version:i.version.version,"remote-bundle-name":n});T.info(x.yellow(`Publishing a policy does not activate it. To activate this version, run:\n  ${a}`))}finally{A&&this.fs.existsSync(A)&&this.fs.unlinkSync(A)}}export{R as publish};
+//# sourceMappingURL=impl-Sx15m6eC2.mjs.map

package/dist/{impl-DE_cRfz52.mjs.map → impl-Sx15m6eC2.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"impl-DE_cRfz52.mjs","names":["fg"],"sources":["../src/commands/policy/helpers/buildOpaBundleTarball.ts","../src/commands/policy/helpers/buildPolicyBundleFormData.ts","../src/commands/policy/helpers/defaultPolicyVersionLabel.ts","../src/lib/policy/policy-publish-hints.ts","../src/commands/policy/publish/impl.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { gunzipSync } from 'node:zlib';\n\nimport { MAX_BUNDLE_COMPRESSED_BYTES, MAX_BUNDLE_DECOMPRESSED_BYTES } from '@transcend-io/utils';\nimport fg from 'fast-glob';\n\nimport { validatePolicyBundleContents } from '../../../lib/policy/policy-bundle-manifest.js';\nimport { POLICY_MANIFEST_FILENAME } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { assertOpaInstalled } from './assertOpaInstalled.js';\nimport { runOPACapture } from './runOpa.js';\n\n/** Result of collecting publishable entries from a policy bundle directory. */\ninterface PolicyBundleArchiveContents {\n  /** Relative paths to include in the upload tarball (manifest first, then rego) */\n  entries: string[];\n}\n\n/**\n * Collects `.manifest` and publishable `.rego` files from a policy directory.\n *\n * @param dir - Absolute path to the policy bundle directory\n * @returns Validated archive entries\n */\nfunction collectPolicyBundleArchiveEntries(dir: string): PolicyBundleArchiveContents {\n  const regoFiles = fg\n    .sync('**/*.rego', {\n      cwd: dir,\n      onlyFiles: true,\n      dot: false,\n    })\n    .sort();\n  const onDiskManifestPath = path.join(dir, POLICY_MANIFEST_FILENAME);\n  const { publishableRegoPaths } = validatePolicyBundleContents(\n    fs.existsSync(onDiskManifestPath) ? fs.readFileSync(onDiskManifestPath, 'utf8') : undefined,\n    regoFiles.map((relativePath) => ({\n      path: relativePath,\n      contents: fs.readFileSync(path.join(dir, relativePath), 'utf8'),\n    })),\n  );\n\n  return {\n    entries: [POLICY_MANIFEST_FILENAME, ...publishableRegoPaths],\n  };\n}\n\n/**\n * Verifies that a policy directory compiles end-to-end with `opa build`.\n *\n * The compiled output is discarded — the server receives the `.manifest` +\n * `.rego` archive produced by {@link buildOpaBundleTarball}, not the OPA bundle\n * — but a successful build guarantees the policies compile and link, surfacing\n * errors (syntax, missing imports, undefined references, etc.) before upload.\n *\n * @param dir - Absolute path to the policy bundle directory\n */\nasync function assertBundleCompiles(dir: string): Promise<void> {\n  const buildOutputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n  try {\n    // Run with `cwd` set to the bundle directory and pass `.` so `opa build`\n    // resolves the bundle root correctly. Bundle mode (`-b`) keeps local\n    // `input.json` / `input.example.json` fixtures from merging as data.\n    // `*_test.rego` files are local-only.\n    const { code, stderr } = await runOPACapture(\n      ['build', '--ignore', '*_test.rego', '-b', '-o', buildOutputPath, '.'],\n      { cwd: dir },\n    );\n    if (code !== 0) {\n      throw new Error(stderr.trim() || `opa build failed with exit code ${code}`);\n    }\n  } finally {\n    if (fs.existsSync(buildOutputPath)) {\n      fs.unlinkSync(buildOutputPath);\n    }\n  }\n}\n\n/**\n * Formats a byte count as a human-readable size with binary units.\n *\n * @param bytes - Number of bytes\n * @returns Human-readable size, e.g. `14 MiB` or `4 KiB`\n */\nfunction formatBytes(bytes: number): string {\n  if (bytes < 1024) {\n    return `${bytes} B`;\n  }\n  const kib = bytes / 1024;\n  if (kib < 1024) {\n    return `${kib % 1 === 0 ? kib.toFixed(0) : kib.toFixed(1)} KiB`;\n  }\n  const mib = kib / 1024;\n  return `${mib % 1 === 0 ? mib.toFixed(0) : mib.toFixed(1)} MiB`;\n}\n\n/**\n * Builds a gzip-compressed policy bundle tarball for upload to Transcend.\n *\n * The Policy Engine API expects a plain archive containing `.manifest` and\n * one or more `.rego` files. Local projects author an OPA `.manifest` and it\n * is uploaded directly — no rename at pack time. Before packaging, the\n * manifest is validated (shape + root coverage) and the bundle is validated\n * with `opa check` (strict Rego linting) and `opa build` (full compilation) so\n * failures surface client-side rather than after upload.\n *\n * @param dir - Directory containing `.manifest` and `.rego` policy files\n * @returns Absolute path to the generated `.tar.gz` bundle\n */\nexport async function buildOpaBundleTarball(dir: string): Promise<string> {\n  assertOpaInstalled();\n\n  const resolvedDir = path.resolve(dir);\n  if (!fs.existsSync(resolvedDir) || !fs.statSync(resolvedDir).isDirectory()) {\n    throw new Error(`Policy directory does not exist or is not a directory: ${resolvedDir}`);\n  }\n\n  // Validate the manifest shape and that roots cover every Rego package before\n  // invoking OPA, so invalid manifests surface a clear error instead of an\n  // opaque `opa build failed with exit code 1`.\n  const { entries: archiveEntries } = collectPolicyBundleArchiveEntries(resolvedDir);\n\n  // Match the Rego v1 validation the Policy Engine API runs on upload.\n  const { code: checkCode, stderr: checkStderr } = await runOPACapture([\n    'check',\n    '--strict',\n    resolvedDir,\n  ]);\n  if (checkCode !== 0) {\n    throw new Error(checkStderr.trim() || `opa check failed with exit code ${checkCode}`);\n  }\n\n  // Ensure the bundle compiles end-to-end before packaging for upload.\n  await assertBundleCompiles(resolvedDir);\n\n  const outputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n  const tarResult = spawnSync('tar', ['-czf', outputPath, '-C', resolvedDir, ...archiveEntries], {\n    env: { ...process.env, COPYFILE_DISABLE: '1' },\n    encoding: 'utf8',\n  });\n  if (tarResult.status !== 0) {\n    throw new Error(\n      `Failed to create policy bundle archive: ${tarResult.stderr.trim() || 'tar failed'}`,\n    );\n  }\n\n  const compressedBytes = fs.readFileSync(outputPath);\n  if (compressedBytes.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_COMPRESSED_BYTES)} compressed upload limit ` +\n        `(bundle is ${formatBytes(compressedBytes.byteLength)}). ` +\n        `The server also rejects decompressed bundles larger than ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)}.`,\n    );\n  }\n\n  const decompressedBytes = gunzipSync(compressedBytes);\n  if (decompressedBytes.byteLength > MAX_BUNDLE_DECOMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)} decompressed upload limit ` +\n        `(bundle is ${formatBytes(decompressedBytes.byteLength)} decompressed).`,\n    );\n  }\n\n  return outputPath;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\n/** Fields for building a policy bundle upload form. */\nexport interface BuildPolicyBundleFormDataOptions {\n  /** Absolute path to the bundle tarball */\n  bundlePath: string;\n  /** Version label */\n  version: string;\n  /** Optional description */\n  description?: string;\n  /** Bundle name (only for create) */\n  bundleName?: string;\n}\n\n/**\n * Builds multipart form data for a policy bundle upload.\n *\n * @param options - Upload fields\n * @returns FormData ready for POST\n */\nexport function buildPolicyBundleFormData(options: BuildPolicyBundleFormDataOptions): FormData {\n  const bundleBytes = fs.readFileSync(options.bundlePath);\n  const form = new FormData();\n  form.append(\n    'bundle',\n    new Blob([bundleBytes], { type: 'application/gzip' }),\n    path.basename(options.bundlePath),\n  );\n  form.append('version', options.version);\n  if (options.description) {\n    form.append('description', options.description);\n  }\n  if (options.bundleName) {\n    form.append('bundleName', options.bundleName);\n  }\n  return form;\n}\n","/**\n * Formats a date as `yyyy-mm-dd-hh-mm-ss` in UTC.\n *\n * @param date - Date to format\n * @returns Timestamp label\n */\nfunction formatPolicyVersionTimestamp(date: Date): string {\n  return date.toISOString().slice(0, 19).replace(/[T:]/g, '-');\n}\n\n/**\n * Returns a default version label from the bundle name and current UTC timestamp.\n *\n * @param bundleName - Tenant-unique policy bundle name\n * @param now - Current time (for testing)\n * @returns Version label in `{bundleName}-yyyy-mm-dd-hh-mm-ss` form\n */\nexport function defaultPolicyVersionLabel(bundleName: string, now: Date = new Date()): string {\n  return `${bundleName}-${formatPolicyVersionTimestamp(now)}`;\n}\n","import {\n  PERMISSIONS_POLICY_BUNDLE_NAME,\n  PolicyTemplate,\n  type PolicyTemplateName,\n} from './policy-scaffold-templates.js';\n\n/** Inputs used to soft-warn about Permissions vs generic publish naming. */\nexport interface PolicyPublishBundleNameHintInput {\n  /** Optional scaffold template from `.manifest` metadata. */\n  template?: PolicyTemplateName;\n  /** Declared OPA package roots. */\n  roots: string[];\n}\n\n/**\n * Whether local authoring signals suggest a Permissions API bundle.\n *\n * Prefers explicit `metadata.transcend.io.template`. Without metadata, falls\n * back to a root that is exactly `permissions` or nested under it.\n *\n * @param input - Manifest template hint and roots\n * @returns Whether the local tree looks Permissions-oriented\n */\nfunction looksLikePermissionsBundle(input: PolicyPublishBundleNameHintInput): boolean {\n  if (input.template === PolicyTemplate.Permissions) {\n    return true;\n  }\n  if (input.template === PolicyTemplate.Generic) {\n    return false;\n  }\n  return input.roots.some(\n    (root) =>\n      root === PERMISSIONS_POLICY_BUNDLE_NAME ||\n      root.startsWith(`${PERMISSIONS_POLICY_BUNDLE_NAME}/`),\n  );\n}\n\n/**\n * Soft-warning when `--remote-bundle-name` disagrees with Permissions conventions.\n *\n * Upload does not enforce bundle kinds. Permissions API only loads the\n * remote bundle named {@link PERMISSIONS_POLICY_BUNDLE_NAME}.\n *\n * @param bundleName - Value of `--remote-bundle-name`\n * @param input - Local manifest template/roots\n * @returns Warning text, or undefined when names align\n */\nexport function formatPolicyPublishBundleNameHint(\n  bundleName: string,\n  input: PolicyPublishBundleNameHintInput,\n): string | undefined {\n  const permissionsLocal = looksLikePermissionsBundle(input);\n  const permissionsRemote = bundleName === PERMISSIONS_POLICY_BUNDLE_NAME;\n\n  if (permissionsLocal && !permissionsRemote) {\n    return (\n      `This directory looks like a Permissions API policy, but --remote-bundle-name is ` +\n      `\"${bundleName}\". Permissions API only loads the remote bundle named ` +\n      `\"${PERMISSIONS_POLICY_BUNDLE_NAME}\". Upload still succeeds; pass ` +\n      `--remote-bundle-name=${PERMISSIONS_POLICY_BUNDLE_NAME} if that is the intended path.`\n    );\n  }\n\n  if (!permissionsLocal && permissionsRemote) {\n    return (\n      `--remote-bundle-name=${PERMISSIONS_POLICY_BUNDLE_NAME} reserves the Permissions API ` +\n      `path. Upload treats all bundles the same; only that fixed name is queried by ` +\n      `the Permissions API. Continue only if you intend this bundle for the Permissions API.`\n    );\n  }\n\n  return undefined;\n}\n","import { join } from 'node:path';\n\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { selectCommandLogger } from '../../../lib/cli/command-output.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { buildExampleCommand } from '../../../lib/docgen/buildExamples.js';\nimport { inquirerConfirmBoolean } from '../../../lib/helpers/inquirer.js';\nimport { parsePolicyBundleManifest } from '../../../lib/policy/policy-bundle-manifest.js';\nimport { resolvePolicyProjectDirectory } from '../../../lib/policy/policy-project-discovery.js';\nimport { formatPolicyPublishBundleNameHint } from '../../../lib/policy/policy-publish-hints.js';\nimport { POLICY_MANIFEST_FILENAME } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { isInteractivePromptInvocation } from '../../../lib/scaffolding/prompts.js';\nimport type { ActivateCommandFlags } from '../activate/impl.js';\nimport {\n  buildPolicyBundleFormData,\n  buildPolicyEngineClient,\n  buildOpaBundleTarball,\n  defaultPolicyVersionLabel,\n  formatPolicyBundleVersionSummary,\n  policyEngineRequest,\n  printResult,\n  resolveBundleIdByName,\n  setPolicyEngineCliDebug,\n} from '../helpers/index.js';\nimport type { CreatePolicyBundleResponse, CreatePolicyBundleVersionResponse } from '../types.js';\n\n/** CLI flags for `transcend policy publish`. */\nexport interface PublishCommandFlags {\n  /** Tenant-unique bundle name */\n  'remote-bundle-name': string;\n  /** Transcend API key */\n  auth: string;\n  /** Transcend API URL */\n  'transcend-url': string;\n  /** Version label (defaults to `{bundleName}-yyyy-mm-dd-hh-mm-ss`) */\n  version?: string;\n  /** Optional version description */\n  description?: string;\n  /** Print raw JSON response */\n  json: boolean;\n  /** Skip the \"create new bundle\" confirmation */\n  yes: boolean;\n  /** Include technical error details when a command fails */\n  debug?: boolean;\n}\n\n/**\n * Build and upload a new immutable policy bundle version.\n *\n * @param this - CLI context\n * @param flags - Command flags\n * @param directory - Policy bundle directory containing a `.manifest`\n */\nexport async function publish(\n  this: LocalContext,\n  {\n    'remote-bundle-name': bundleName,\n    auth,\n    'transcend-url': transcendUrl,\n    version,\n    description,\n    json,\n    yes,\n    debug = false,\n  }: PublishCommandFlags,\n  directory: string,\n): Promise<void> {\n  doneInputValidation(this.process);\n  setPolicyEngineCliDebug(debug);\n\n  const commandLogger = selectCommandLogger(this.logger, json);\n  const resolvedDir = resolvePolicyProjectDirectory(this.process.cwd(), directory);\n  const versionLabel = version ?? defaultPolicyVersionLabel(bundleName);\n  const client = buildPolicyEngineClient(transcendUrl, auth);\n  const interactive = isInteractivePromptInvocation(\n    { json, noInteractive: false },\n    this.process.stdin.isTTY,\n    this.process.stderr.isTTY,\n  );\n\n  let bundlePath: string | undefined;\n  try {\n    commandLogger.info(colors.green(`Building policy bundle from ${resolvedDir}...`));\n    bundlePath = await buildOpaBundleTarball(resolvedDir);\n\n    try {\n      const manifestPath = join(resolvedDir, POLICY_MANIFEST_FILENAME);\n      const manifest = parsePolicyBundleManifest(this.fs.readFileSync(manifestPath, 'utf8'));\n      const bundleNameHint = formatPolicyPublishBundleNameHint(bundleName, manifest);\n      if (bundleNameHint) {\n        commandLogger.warn(colors.yellow(bundleNameHint));\n      }\n    } catch {\n      // Best-effort authoring hint; tarball build already validated the manifest.\n    }\n\n    const existingBundleId = await resolveBundleIdByName(client, bundleName);\n\n    let responseBody: CreatePolicyBundleResponse | CreatePolicyBundleVersionResponse;\n\n    if (existingBundleId) {\n      commandLogger.info(colors.green(`Uploading new version for bundle \"${bundleName}\"...`));\n      const form = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post(`v1/policy-engine/policy-bundles/${existingBundleId}/versions`, { body: form })\n          .json<CreatePolicyBundleVersionResponse>(),\n      );\n    } else {\n      if (!interactive && !yes) {\n        this.logger.error(\n          colors.red(\n            'Cannot create a new bundle in non-interactive or JSON mode; pass --yes to confirm.',\n          ),\n        );\n        this.process.exit(1);\n        return;\n      }\n\n      if (!yes) {\n        commandLogger.warn(\n          colors.yellow(`No policy bundle named \"${bundleName}\" exists for this organization.`),\n        );\n        const shouldCreate = await inquirerConfirmBoolean({\n          message: `No policy bundle named \"${bundleName}\" exists. Create a new bundle and upload its first version?`,\n        });\n        if (!shouldCreate) {\n          commandLogger.info(colors.yellow('Publish cancelled.'));\n          return;\n        }\n      }\n\n      commandLogger.info(\n        colors.green(`Creating bundle \"${bundleName}\" and uploading first version...`),\n      );\n      const createForm = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n        bundleName,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post('v1/policy-engine/policy-bundles', {\n            body: createForm,\n          })\n          .json<CreatePolicyBundleResponse>(),\n      );\n    }\n\n    printResult(this.process.stdout, {\n      json,\n      data: responseBody,\n      renderTable: () => formatPolicyBundleVersionSummary(responseBody.version),\n    });\n\n    commandLogger.info(colors.green('Policy bundle version uploaded successfully.'));\n\n    const activateCommand = buildExampleCommand<ActivateCommandFlags>(['policy', 'activate'], {\n      version: responseBody.version.version,\n      'remote-bundle-name': bundleName,\n    });\n    commandLogger.info(\n      colors.yellow(\n        `Publishing a policy does not activate it. To activate this version, run:\\n  ${activateCommand}`,\n      ),\n    );\n  } finally {\n    if (bundlePath && this.fs.existsSync(bundlePath)) {\n      this.fs.unlinkSync(bundlePath);\n    }\n  }\n}\n"],"mappings":"o+BA0BA,SAAS,EAAkC,EAA0C,CACnF,IAAM,EAAYA,EACf,KAAK,YAAa,CACjB,IAAK,EACL,UAAW,GACX,IAAK,GACN,CAAC,CACD,MAAM,CACH,EAAqB,EAAK,KAAK,EAAK,EAAyB,CAC7D,CAAE,wBAAyB,EAC/B,EAAG,WAAW,EAAmB,CAAG,EAAG,aAAa,EAAoB,OAAO,CAAG,IAAA,GAClF,EAAU,IAAK,IAAkB,CAC/B,KAAM,EACN,SAAU,EAAG,aAAa,EAAK,KAAK,EAAK,EAAa,CAAE,OAAO,CAChE,EAAE,CACJ,CAED,MAAO,CACL,QAAS,CAAC,EAA0B,GAAG,EAAqB,CAC7D,CAaH,eAAe,EAAqB,EAA4B,CAC9D,IAAM,EAAkB,EAAK,KAC3B,EAAG,QAAQ,CACX,iCAAiC,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SACpF,CACD,GAAI,CAKF,GAAM,CAAE,OAAM,UAAW,MAAM,EAC7B,CAAC,QAAS,WAAY,cAAe,KAAM,KAAM,EAAiB,IAAI,CACtE,CAAE,IAAK,EAAK,CACb,CACD,GAAI,IAAS,EACX,MAAU,MAAM,EAAO,MAAM,EAAI,mCAAmC,IAAO,QAErE,CACJ,EAAG,WAAW,EAAgB,EAChC,EAAG,WAAW,EAAgB,EAWpC,SAAS,EAAY,EAAuB,CAC1C,GAAI,EAAQ,KACV,MAAO,GAAG,EAAM,IAElB,IAAM,EAAM,EAAQ,KACpB,GAAI,EAAM,KACR,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAE5D,IAAM,EAAM,EAAM,KAClB,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAgB5D,eAAsB,EAAsB,EAA8B,CACxE,GAAoB,CAEpB,IAAM,EAAc,EAAK,QAAQ,EAAI,CACrC,GAAI,CAAC,EAAG,WAAW,EAAY,EAAI,CAAC,EAAG,SAAS,EAAY,CAAC,aAAa,CACxE,MAAU,MAAM,0DAA0D,IAAc,CAM1F,GAAM,CAAE,QAAS,GAAmB,EAAkC,EAAY,CAG5E,CAAE,KAAM,EAAW,OAAQ,GAAgB,MAAM,EAAc,CACnE,QACA,WACA,EACD,CAAC,CACF,GAAI,IAAc,EAChB,MAAU,MAAM,EAAY,MAAM,EAAI,mCAAmC,IAAY,CAIvF,MAAM,EAAqB,EAAY,CAEvC,IAAM,EAAa,EAAK,KACtB,EAAG,QAAQ,CACX,2BAA2B,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SAC9E,CACK,EAAY,EAAU,MAAO,CAAC,OAAQ,EAAY,KAAM,EAAa,GAAG,EAAe,CAAE,CAC7F,IAAK,CAAE,GAAG,QAAQ,IAAK,iBAAkB,IAAK,CAC9C,SAAU,OACX,CAAC,CACF,GAAI,EAAU,SAAW,EACvB,MAAU,MACR,2CAA2C,EAAU,OAAO,MAAM,EAAI,eACvE,CAGH,IAAM,EAAkB,EAAG,aAAa,EAAW,CACnD,GAAI,EAAgB,WAAa,EAE/B,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA4B,CAAC,sCACtD,EAAY,EAAgB,WAAW,CAAC,8DACM,EAAY,EAA8B,CAAC,GAC1G,CAGH,IAAM,EAAoB,EAAW,EAAgB,CACrD,GAAI,EAAkB,WAAa,EAEjC,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA8B,CAAC,wCACxD,EAAY,EAAkB,WAAW,CAAC,iBAC3D,CAGH,OAAO,ECvJT,SAAgB,EAA0B,EAAqD,CAC7F,IAAM,EAAc,EAAG,aAAa,EAAQ,WAAW,CACjD,EAAO,IAAI,SAajB,OAZA,EAAK,OACH,SACA,IAAI,KAAK,CAAC,EAAY,CAAE,CAAE,KAAM,mBAAoB,CAAC,CACrD,EAAK,SAAS,EAAQ,WAAW,CAClC,CACD,EAAK,OAAO,UAAW,EAAQ,QAAQ,CACnC,EAAQ,aACV,EAAK,OAAO,cAAe,EAAQ,YAAY,CAE7C,EAAQ,YACV,EAAK,OAAO,aAAc,EAAQ,WAAW,CAExC,EC9BT,SAAS,EAA6B,EAAoB,CACxD,OAAO,EAAK,aAAa,CAAC,MAAM,EAAG,GAAG,CAAC,QAAQ,QAAS,IAAI,CAU9D,SAAgB,EAA0B,EAAoB,EAAY,IAAI,KAAgB,CAC5F,MAAO,GAAG,EAAW,GAAG,EAA6B,EAAI,GCK3D,SAAS,EAA2B,EAAkD,CAOpF,OANI,EAAM,WAAa,EAAe,YAC7B,GAEL,EAAM,WAAa,EAAe,QAC7B,GAEF,EAAM,MAAM,KAChB,GACC,IAAA,eACA,EAAK,WAAW,eAAqC,CACxD,CAaH,SAAgB,EACd,EACA,EACoB,CACpB,IAAM,EAAmB,EAA2B,EAAM,CACpD,EAAoB,IAAe,EAEzC,GAAI,GAAoB,CAAC,EACvB,MACE,oFACI,EAAW,yDACX,EAA+B,sDACX,EAA+B,gCAI3D,GAAI,CAAC,GAAoB,EACvB,MACE,wBAAwB,EAA+B,kMCV7D,eAAsB,EAEpB,CACE,qBAAsB,EACtB,OACA,gBAAiB,EACjB,UACA,cACA,OACA,MACA,QAAQ,IAEV,EACe,CACf,EAAoB,KAAK,QAAQ,CACjC,EAAwB,EAAM,CAE9B,IAAM,EAAgB,EAAoB,KAAK,OAAQ,EAAK,CACtD,EAAc,EAA8B,KAAK,QAAQ,KAAK,CAAE,EAAU,CAC1E,EAAe,GAAW,EAA0B,EAAW,CAC/D,EAAS,EAAwB,EAAc,EAAK,CACpD,EAAc,EAClB,CAAE,OAAM,cAAe,GAAO,CAC9B,KAAK,QAAQ,MAAM,MACnB,KAAK,QAAQ,OAAO,MACrB,CAEG,EACJ,GAAI,CACF,EAAc,KAAK,EAAO,MAAM,+BAA+B,EAAY,KAAK,CAAC,CACjF,EAAa,MAAM,EAAsB,EAAY,CAErD,GAAI,CACF,IAAM,EAAe,EAAK,EAAa,EAAyB,CAE1D,EAAiB,EAAkC,EADxC,EAA0B,KAAK,GAAG,aAAa,EAAc,OAAO,CACR,CAAC,CAC1E,GACF,EAAc,KAAK,EAAO,OAAO,EAAe,CAAC,MAE7C,EAIR,IAAM,EAAmB,MAAM,EAAsB,EAAQ,EAAW,CAEpE,EAEJ,GAAI,EAAkB,CACpB,EAAc,KAAK,EAAO,MAAM,qCAAqC,EAAW,MAAM,CAAC,CACvF,IAAM,EAAO,EAA0B,CACrC,aACA,QAAS,EACT,cACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,mCAAmC,EAAiB,WAAY,CAAE,KAAM,EAAM,CAAC,CACpF,MAAyC,CAC7C,KACI,CACL,GAAI,CAAC,GAAe,CAAC,EAAK,CACxB,KAAK,OAAO,MACV,EAAO,IACL,qFACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,CACpB,OAGF,GAAI,CAAC,IACH,EAAc,KACZ,EAAO,OAAO,2BAA2B,EAAW,iCAAiC,CACtF,CAIG,CAAC,MAHsB,EAAuB,CAChD,QAAS,2BAA2B,EAAW,6DAChD,CAAC,EACiB,CACjB,EAAc,KAAK,EAAO,OAAO,qBAAqB,CAAC,CACvD,OAIJ,EAAc,KACZ,EAAO,MAAM,oBAAoB,EAAW,kCAAkC,CAC/E,CACD,IAAM,EAAa,EAA0B,CAC3C,aACA,QAAS,EACT,cACA,aACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,kCAAmC,CACvC,KAAM,EACP,CAAC,CACD,MAAkC,CACtC,CAGH,EAAY,KAAK,QAAQ,OAAQ,CAC/B,OACA,KAAM,EACN,gBAAmB,EAAiC,EAAa,QAAQ,CAC1E,CAAC,CAEF,EAAc,KAAK,EAAO,MAAM,+CAA+C,CAAC,CAEhF,IAAM,EAAkB,EAA0C,CAAC,SAAU,WAAW,CAAE,CACxF,QAAS,EAAa,QAAQ,QAC9B,qBAAsB,EACvB,CAAC,CACF,EAAc,KACZ,EAAO,OACL,+EAA+E,IAChF,CACF,QACO,CACJ,GAAc,KAAK,GAAG,WAAW,EAAW,EAC9C,KAAK,GAAG,WAAW,EAAW"}
+{"version":3,"file":"impl-Sx15m6eC2.mjs","names":["fg"],"sources":["../src/commands/policy/helpers/buildOpaBundleTarball.ts","../src/commands/policy/helpers/buildPolicyBundleFormData.ts","../src/commands/policy/helpers/defaultPolicyVersionLabel.ts","../src/lib/policy/policy-publish-hints.ts","../src/commands/policy/publish/impl.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { gunzipSync } from 'node:zlib';\n\nimport { MAX_BUNDLE_COMPRESSED_BYTES, MAX_BUNDLE_DECOMPRESSED_BYTES } from '@transcend-io/utils';\nimport fg from 'fast-glob';\n\nimport { validatePolicyBundleContents } from '../../../lib/policy/policy-bundle-manifest.js';\nimport { POLICY_MANIFEST_FILENAME } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { assertOpaInstalled } from './assertOpaInstalled.js';\nimport { runOPACapture } from './runOpa.js';\n\n/** Result of collecting publishable entries from a policy bundle directory. */\ninterface PolicyBundleArchiveContents {\n  /** Relative paths to include in the upload tarball (manifest first, then rego) */\n  entries: string[];\n}\n\n/**\n * Collects `.manifest` and publishable `.rego` files from a policy directory.\n *\n * @param dir - Absolute path to the policy bundle directory\n * @returns Validated archive entries\n */\nfunction collectPolicyBundleArchiveEntries(dir: string): PolicyBundleArchiveContents {\n  const regoFiles = fg\n    .sync('**/*.rego', {\n      cwd: dir,\n      onlyFiles: true,\n      dot: false,\n    })\n    .sort();\n  const onDiskManifestPath = path.join(dir, POLICY_MANIFEST_FILENAME);\n  const { publishableRegoPaths } = validatePolicyBundleContents(\n    fs.existsSync(onDiskManifestPath) ? fs.readFileSync(onDiskManifestPath, 'utf8') : undefined,\n    regoFiles.map((relativePath) => ({\n      path: relativePath,\n      contents: fs.readFileSync(path.join(dir, relativePath), 'utf8'),\n    })),\n  );\n\n  return {\n    entries: [POLICY_MANIFEST_FILENAME, ...publishableRegoPaths],\n  };\n}\n\n/**\n * Verifies that a policy directory compiles end-to-end with `opa build`.\n *\n * The compiled output is discarded — the server receives the `.manifest` +\n * `.rego` archive produced by {@link buildOpaBundleTarball}, not the OPA bundle\n * — but a successful build guarantees the policies compile and link, surfacing\n * errors (syntax, missing imports, undefined references, etc.) before upload.\n *\n * @param dir - Absolute path to the policy bundle directory\n */\nasync function assertBundleCompiles(dir: string): Promise<void> {\n  const buildOutputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-build-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n  try {\n    // Run with `cwd` set to the bundle directory and pass `.` so `opa build`\n    // resolves the bundle root correctly. Bundle mode (`-b`) keeps local\n    // `input.json` / `input.example.json` fixtures from merging as data.\n    // `*_test.rego` files are local-only.\n    const { code, stderr } = await runOPACapture(\n      ['build', '--ignore', '*_test.rego', '-b', '-o', buildOutputPath, '.'],\n      { cwd: dir },\n    );\n    if (code !== 0) {\n      throw new Error(stderr.trim() || `opa build failed with exit code ${code}`);\n    }\n  } finally {\n    if (fs.existsSync(buildOutputPath)) {\n      fs.unlinkSync(buildOutputPath);\n    }\n  }\n}\n\n/**\n * Formats a byte count as a human-readable size with binary units.\n *\n * @param bytes - Number of bytes\n * @returns Human-readable size, e.g. `14 MiB` or `4 KiB`\n */\nfunction formatBytes(bytes: number): string {\n  if (bytes < 1024) {\n    return `${bytes} B`;\n  }\n  const kib = bytes / 1024;\n  if (kib < 1024) {\n    return `${kib % 1 === 0 ? kib.toFixed(0) : kib.toFixed(1)} KiB`;\n  }\n  const mib = kib / 1024;\n  return `${mib % 1 === 0 ? mib.toFixed(0) : mib.toFixed(1)} MiB`;\n}\n\n/**\n * Builds a gzip-compressed policy bundle tarball for upload to Transcend.\n *\n * The Policy Engine API expects a plain archive containing `.manifest` and\n * one or more `.rego` files. Local projects author an OPA `.manifest` and it\n * is uploaded directly — no rename at pack time. Before packaging, the\n * manifest is validated (shape + root coverage) and the bundle is validated\n * with `opa check` (strict Rego linting) and `opa build` (full compilation) so\n * failures surface client-side rather than after upload.\n *\n * @param dir - Directory containing `.manifest` and `.rego` policy files\n * @returns Absolute path to the generated `.tar.gz` bundle\n */\nexport async function buildOpaBundleTarball(dir: string): Promise<string> {\n  assertOpaInstalled();\n\n  const resolvedDir = path.resolve(dir);\n  if (!fs.existsSync(resolvedDir) || !fs.statSync(resolvedDir).isDirectory()) {\n    throw new Error(`Policy directory does not exist or is not a directory: ${resolvedDir}`);\n  }\n\n  // Validate the manifest shape and that roots cover every Rego package before\n  // invoking OPA, so invalid manifests surface a clear error instead of an\n  // opaque `opa build failed with exit code 1`.\n  const { entries: archiveEntries } = collectPolicyBundleArchiveEntries(resolvedDir);\n\n  // Match the Rego v1 validation the Policy Engine API runs on upload.\n  const { code: checkCode, stderr: checkStderr } = await runOPACapture([\n    'check',\n    '--strict',\n    resolvedDir,\n  ]);\n  if (checkCode !== 0) {\n    throw new Error(checkStderr.trim() || `opa check failed with exit code ${checkCode}`);\n  }\n\n  // Ensure the bundle compiles end-to-end before packaging for upload.\n  await assertBundleCompiles(resolvedDir);\n\n  const outputPath = path.join(\n    os.tmpdir(),\n    `transcend-policy-bundle-${Date.now()}-${Math.random().toString(36).slice(2)}.tar.gz`,\n  );\n  const tarResult = spawnSync('tar', ['-czf', outputPath, '-C', resolvedDir, ...archiveEntries], {\n    env: { ...process.env, COPYFILE_DISABLE: '1' },\n    encoding: 'utf8',\n  });\n  if (tarResult.status !== 0) {\n    throw new Error(\n      `Failed to create policy bundle archive: ${tarResult.stderr.trim() || 'tar failed'}`,\n    );\n  }\n\n  const compressedBytes = fs.readFileSync(outputPath);\n  if (compressedBytes.byteLength > MAX_BUNDLE_COMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_COMPRESSED_BYTES)} compressed upload limit ` +\n        `(bundle is ${formatBytes(compressedBytes.byteLength)}). ` +\n        `The server also rejects decompressed bundles larger than ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)}.`,\n    );\n  }\n\n  const decompressedBytes = gunzipSync(compressedBytes);\n  if (decompressedBytes.byteLength > MAX_BUNDLE_DECOMPRESSED_BYTES) {\n    fs.unlinkSync(outputPath);\n    throw new Error(\n      `Policy bundle exceeds the ${formatBytes(MAX_BUNDLE_DECOMPRESSED_BYTES)} decompressed upload limit ` +\n        `(bundle is ${formatBytes(decompressedBytes.byteLength)} decompressed).`,\n    );\n  }\n\n  return outputPath;\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\n\n/** Fields for building a policy bundle upload form. */\nexport interface BuildPolicyBundleFormDataOptions {\n  /** Absolute path to the bundle tarball */\n  bundlePath: string;\n  /** Version label */\n  version: string;\n  /** Optional description */\n  description?: string;\n  /** Bundle name (only for create) */\n  bundleName?: string;\n}\n\n/**\n * Builds multipart form data for a policy bundle upload.\n *\n * @param options - Upload fields\n * @returns FormData ready for POST\n */\nexport function buildPolicyBundleFormData(options: BuildPolicyBundleFormDataOptions): FormData {\n  const bundleBytes = fs.readFileSync(options.bundlePath);\n  const form = new FormData();\n  form.append(\n    'bundle',\n    new Blob([bundleBytes], { type: 'application/gzip' }),\n    path.basename(options.bundlePath),\n  );\n  form.append('version', options.version);\n  if (options.description) {\n    form.append('description', options.description);\n  }\n  if (options.bundleName) {\n    form.append('bundleName', options.bundleName);\n  }\n  return form;\n}\n","/**\n * Formats a date as `yyyy-mm-dd-hh-mm-ss` in UTC.\n *\n * @param date - Date to format\n * @returns Timestamp label\n */\nfunction formatPolicyVersionTimestamp(date: Date): string {\n  return date.toISOString().slice(0, 19).replace(/[T:]/g, '-');\n}\n\n/**\n * Returns a default version label from the bundle name and current UTC timestamp.\n *\n * @param bundleName - Tenant-unique policy bundle name\n * @param now - Current time (for testing)\n * @returns Version label in `{bundleName}-yyyy-mm-dd-hh-mm-ss` form\n */\nexport function defaultPolicyVersionLabel(bundleName: string, now: Date = new Date()): string {\n  return `${bundleName}-${formatPolicyVersionTimestamp(now)}`;\n}\n","import {\n  PERMISSIONS_POLICY_BUNDLE_NAME,\n  PolicyTemplate,\n  type PolicyTemplateName,\n} from './policy-scaffold-templates.js';\n\n/** Inputs used to soft-warn about Permissions vs generic publish naming. */\nexport interface PolicyPublishBundleNameHintInput {\n  /** Optional scaffold template from `.manifest` metadata. */\n  template?: PolicyTemplateName;\n  /** Declared OPA package roots. */\n  roots: string[];\n}\n\n/**\n * Whether local authoring signals suggest a Permissions API bundle.\n *\n * Prefers explicit `metadata.transcend.io.template`. Without metadata, falls\n * back to a root that is exactly `permissions` or nested under it.\n *\n * @param input - Manifest template hint and roots\n * @returns Whether the local tree looks Permissions-oriented\n */\nfunction looksLikePermissionsBundle(input: PolicyPublishBundleNameHintInput): boolean {\n  if (input.template === PolicyTemplate.Permissions) {\n    return true;\n  }\n  if (input.template === PolicyTemplate.Generic) {\n    return false;\n  }\n  return input.roots.some(\n    (root) =>\n      root === PERMISSIONS_POLICY_BUNDLE_NAME ||\n      root.startsWith(`${PERMISSIONS_POLICY_BUNDLE_NAME}/`),\n  );\n}\n\n/**\n * Soft-warning when `--remote-bundle-name` disagrees with Permissions conventions.\n *\n * Upload does not enforce bundle kinds. Permissions API only loads the\n * remote bundle named {@link PERMISSIONS_POLICY_BUNDLE_NAME}.\n *\n * @param bundleName - Value of `--remote-bundle-name`\n * @param input - Local manifest template/roots\n * @returns Warning text, or undefined when names align\n */\nexport function formatPolicyPublishBundleNameHint(\n  bundleName: string,\n  input: PolicyPublishBundleNameHintInput,\n): string | undefined {\n  const permissionsLocal = looksLikePermissionsBundle(input);\n  const permissionsRemote = bundleName === PERMISSIONS_POLICY_BUNDLE_NAME;\n\n  if (permissionsLocal && !permissionsRemote) {\n    return (\n      `This directory looks like a Permissions API policy, but --remote-bundle-name is ` +\n      `\"${bundleName}\". Permissions API only loads the remote bundle named ` +\n      `\"${PERMISSIONS_POLICY_BUNDLE_NAME}\". Upload still succeeds; pass ` +\n      `--remote-bundle-name=${PERMISSIONS_POLICY_BUNDLE_NAME} if that is the intended path.`\n    );\n  }\n\n  if (!permissionsLocal && permissionsRemote) {\n    return (\n      `--remote-bundle-name=${PERMISSIONS_POLICY_BUNDLE_NAME} reserves the Permissions API ` +\n      `path. Upload treats all bundles the same; only that fixed name is queried by ` +\n      `the Permissions API. Continue only if you intend this bundle for the Permissions API.`\n    );\n  }\n\n  return undefined;\n}\n","import { join } from 'node:path';\n\nimport colors from 'colors';\n\nimport type { LocalContext } from '../../../context.js';\nimport { selectCommandLogger } from '../../../lib/cli/command-output.js';\nimport { doneInputValidation } from '../../../lib/cli/done-input-validation.js';\nimport { buildExampleCommand } from '../../../lib/docgen/buildExamples.js';\nimport { inquirerConfirmBoolean } from '../../../lib/helpers/inquirer.js';\nimport { parsePolicyBundleManifest } from '../../../lib/policy/policy-bundle-manifest.js';\nimport { resolvePolicyProjectDirectory } from '../../../lib/policy/policy-project-discovery.js';\nimport { formatPolicyPublishBundleNameHint } from '../../../lib/policy/policy-publish-hints.js';\nimport { POLICY_MANIFEST_FILENAME } from '../../../lib/policy/policy-scaffold-templates.js';\nimport { isInteractivePromptInvocation } from '../../../lib/scaffolding/prompts.js';\nimport type { ActivateCommandFlags } from '../activate/impl.js';\nimport {\n  buildPolicyBundleFormData,\n  buildPolicyEngineClient,\n  buildOpaBundleTarball,\n  defaultPolicyVersionLabel,\n  formatPolicyBundleVersionSummary,\n  policyEngineRequest,\n  printResult,\n  resolveBundleIdByName,\n  setPolicyEngineCliDebug,\n} from '../helpers/index.js';\nimport type { CreatePolicyBundleResponse, CreatePolicyBundleVersionResponse } from '../types.js';\n\n/** CLI flags for `transcend policy publish`. */\nexport interface PublishCommandFlags {\n  /** Tenant-unique bundle name */\n  'remote-bundle-name': string;\n  /** Transcend API key */\n  auth: string;\n  /** Transcend API URL */\n  'transcend-url': string;\n  /** Version label (defaults to `{bundleName}-yyyy-mm-dd-hh-mm-ss`) */\n  version?: string;\n  /** Optional version description */\n  description?: string;\n  /** Print raw JSON response */\n  json: boolean;\n  /** Skip the \"create new bundle\" confirmation */\n  yes: boolean;\n  /** Include technical error details when a command fails */\n  debug?: boolean;\n}\n\n/**\n * Build and upload a new immutable policy bundle version.\n *\n * @param this - CLI context\n * @param flags - Command flags\n * @param directory - Policy bundle directory containing a `.manifest`\n */\nexport async function publish(\n  this: LocalContext,\n  {\n    'remote-bundle-name': bundleName,\n    auth,\n    'transcend-url': transcendUrl,\n    version,\n    description,\n    json,\n    yes,\n    debug = false,\n  }: PublishCommandFlags,\n  directory: string,\n): Promise<void> {\n  doneInputValidation(this.process);\n  setPolicyEngineCliDebug(debug);\n\n  const commandLogger = selectCommandLogger(this.logger, json);\n  const resolvedDir = resolvePolicyProjectDirectory(this.process.cwd(), directory);\n  const versionLabel = version ?? defaultPolicyVersionLabel(bundleName);\n  const client = buildPolicyEngineClient(transcendUrl, auth);\n  const interactive = isInteractivePromptInvocation(\n    { json, noInteractive: false },\n    this.process.stdin.isTTY,\n    this.process.stderr.isTTY,\n  );\n\n  let bundlePath: string | undefined;\n  try {\n    commandLogger.info(colors.green(`Building policy bundle from ${resolvedDir}...`));\n    bundlePath = await buildOpaBundleTarball(resolvedDir);\n\n    try {\n      const manifestPath = join(resolvedDir, POLICY_MANIFEST_FILENAME);\n      const manifest = parsePolicyBundleManifest(this.fs.readFileSync(manifestPath, 'utf8'));\n      const bundleNameHint = formatPolicyPublishBundleNameHint(bundleName, manifest);\n      if (bundleNameHint) {\n        commandLogger.warn(colors.yellow(bundleNameHint));\n      }\n    } catch {\n      // Best-effort authoring hint; tarball build already validated the manifest.\n    }\n\n    const existingBundleId = await resolveBundleIdByName(client, bundleName);\n\n    let responseBody: CreatePolicyBundleResponse | CreatePolicyBundleVersionResponse;\n\n    if (existingBundleId) {\n      commandLogger.info(colors.green(`Uploading new version for bundle \"${bundleName}\"...`));\n      const form = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post(`v1/policy-engine/policy-bundles/${existingBundleId}/versions`, { body: form })\n          .json<CreatePolicyBundleVersionResponse>(),\n      );\n    } else {\n      if (!interactive && !yes) {\n        this.logger.error(\n          colors.red(\n            'Cannot create a new bundle in non-interactive or JSON mode; pass --yes to confirm.',\n          ),\n        );\n        this.process.exit(1);\n        return;\n      }\n\n      if (!yes) {\n        commandLogger.warn(\n          colors.yellow(`No policy bundle named \"${bundleName}\" exists for this organization.`),\n        );\n        const shouldCreate = await inquirerConfirmBoolean({\n          message: `No policy bundle named \"${bundleName}\" exists. Create a new bundle and upload its first version?`,\n        });\n        if (!shouldCreate) {\n          commandLogger.info(colors.yellow('Publish cancelled.'));\n          return;\n        }\n      }\n\n      commandLogger.info(\n        colors.green(`Creating bundle \"${bundleName}\" and uploading first version...`),\n      );\n      const createForm = buildPolicyBundleFormData({\n        bundlePath,\n        version: versionLabel,\n        description,\n        bundleName,\n      });\n      responseBody = await policyEngineRequest(\n        client\n          .post('v1/policy-engine/policy-bundles', {\n            body: createForm,\n          })\n          .json<CreatePolicyBundleResponse>(),\n      );\n    }\n\n    printResult(this.process.stdout, {\n      json,\n      data: responseBody,\n      renderTable: () => formatPolicyBundleVersionSummary(responseBody.version),\n    });\n\n    commandLogger.info(colors.green('Policy bundle version uploaded successfully.'));\n\n    const activateCommand = buildExampleCommand<ActivateCommandFlags>(['policy', 'activate'], {\n      version: responseBody.version.version,\n      'remote-bundle-name': bundleName,\n    });\n    commandLogger.info(\n      colors.yellow(\n        `Publishing a policy does not activate it. To activate this version, run:\\n  ${activateCommand}`,\n      ),\n    );\n  } finally {\n    if (bundlePath && this.fs.existsSync(bundlePath)) {\n      this.fs.unlinkSync(bundlePath);\n    }\n  }\n}\n"],"mappings":"o+BA0BA,SAAS,EAAkC,EAA0C,CACnF,IAAM,EAAYA,EACf,KAAK,YAAa,CACjB,IAAK,EACL,UAAW,GACX,IAAK,GACN,CAAC,CACD,MAAM,CACH,EAAqB,EAAK,KAAK,EAAK,EAAyB,CAC7D,CAAE,wBAAyB,EAC/B,EAAG,WAAW,EAAmB,CAAG,EAAG,aAAa,EAAoB,OAAO,CAAG,IAAA,GAClF,EAAU,IAAK,IAAkB,CAC/B,KAAM,EACN,SAAU,EAAG,aAAa,EAAK,KAAK,EAAK,EAAa,CAAE,OAAO,CAChE,EAAE,CACJ,CAED,MAAO,CACL,QAAS,CAAC,EAA0B,GAAG,EAAqB,CAC7D,CAaH,eAAe,EAAqB,EAA4B,CAC9D,IAAM,EAAkB,EAAK,KAC3B,EAAG,QAAQ,CACX,iCAAiC,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SACpF,CACD,GAAI,CAKF,GAAM,CAAE,OAAM,UAAW,MAAM,EAC7B,CAAC,QAAS,WAAY,cAAe,KAAM,KAAM,EAAiB,IAAI,CACtE,CAAE,IAAK,EAAK,CACb,CACD,GAAI,IAAS,EACX,MAAU,MAAM,EAAO,MAAM,EAAI,mCAAmC,IAAO,QAErE,CACJ,EAAG,WAAW,EAAgB,EAChC,EAAG,WAAW,EAAgB,EAWpC,SAAS,EAAY,EAAuB,CAC1C,GAAI,EAAQ,KACV,MAAO,GAAG,EAAM,IAElB,IAAM,EAAM,EAAQ,KACpB,GAAI,EAAM,KACR,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAE5D,IAAM,EAAM,EAAM,KAClB,MAAO,GAAG,EAAM,GAAM,EAAI,EAAI,QAAQ,EAAE,CAAG,EAAI,QAAQ,EAAE,CAAC,MAgB5D,eAAsB,EAAsB,EAA8B,CACxE,GAAoB,CAEpB,IAAM,EAAc,EAAK,QAAQ,EAAI,CACrC,GAAI,CAAC,EAAG,WAAW,EAAY,EAAI,CAAC,EAAG,SAAS,EAAY,CAAC,aAAa,CACxE,MAAU,MAAM,0DAA0D,IAAc,CAM1F,GAAM,CAAE,QAAS,GAAmB,EAAkC,EAAY,CAG5E,CAAE,KAAM,EAAW,OAAQ,GAAgB,MAAM,EAAc,CACnE,QACA,WACA,EACD,CAAC,CACF,GAAI,IAAc,EAChB,MAAU,MAAM,EAAY,MAAM,EAAI,mCAAmC,IAAY,CAIvF,MAAM,EAAqB,EAAY,CAEvC,IAAM,EAAa,EAAK,KACtB,EAAG,QAAQ,CACX,2BAA2B,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,SAC9E,CACK,EAAY,EAAU,MAAO,CAAC,OAAQ,EAAY,KAAM,EAAa,GAAG,EAAe,CAAE,CAC7F,IAAK,CAAE,GAAG,QAAQ,IAAK,iBAAkB,IAAK,CAC9C,SAAU,OACX,CAAC,CACF,GAAI,EAAU,SAAW,EACvB,MAAU,MACR,2CAA2C,EAAU,OAAO,MAAM,EAAI,eACvE,CAGH,IAAM,EAAkB,EAAG,aAAa,EAAW,CACnD,GAAI,EAAgB,WAAa,EAE/B,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA4B,CAAC,sCACtD,EAAY,EAAgB,WAAW,CAAC,8DACM,EAAY,EAA8B,CAAC,GAC1G,CAGH,IAAM,EAAoB,EAAW,EAAgB,CACrD,GAAI,EAAkB,WAAa,EAEjC,MADA,EAAG,WAAW,EAAW,CACf,MACR,6BAA6B,EAAY,EAA8B,CAAC,wCACxD,EAAY,EAAkB,WAAW,CAAC,iBAC3D,CAGH,OAAO,ECvJT,SAAgB,EAA0B,EAAqD,CAC7F,IAAM,EAAc,EAAG,aAAa,EAAQ,WAAW,CACjD,EAAO,IAAI,SAajB,OAZA,EAAK,OACH,SACA,IAAI,KAAK,CAAC,EAAY,CAAE,CAAE,KAAM,mBAAoB,CAAC,CACrD,EAAK,SAAS,EAAQ,WAAW,CAClC,CACD,EAAK,OAAO,UAAW,EAAQ,QAAQ,CACnC,EAAQ,aACV,EAAK,OAAO,cAAe,EAAQ,YAAY,CAE7C,EAAQ,YACV,EAAK,OAAO,aAAc,EAAQ,WAAW,CAExC,EC9BT,SAAS,EAA6B,EAAoB,CACxD,OAAO,EAAK,aAAa,CAAC,MAAM,EAAG,GAAG,CAAC,QAAQ,QAAS,IAAI,CAU9D,SAAgB,EAA0B,EAAoB,EAAY,IAAI,KAAgB,CAC5F,MAAO,GAAG,EAAW,GAAG,EAA6B,EAAI,GCK3D,SAAS,EAA2B,EAAkD,CAOpF,OANI,EAAM,WAAa,EAAe,YAC7B,GAEL,EAAM,WAAa,EAAe,QAC7B,GAEF,EAAM,MAAM,KAChB,GACC,IAAA,eACA,EAAK,WAAW,eAAqC,CACxD,CAaH,SAAgB,EACd,EACA,EACoB,CACpB,IAAM,EAAmB,EAA2B,EAAM,CACpD,EAAoB,IAAe,EAEzC,GAAI,GAAoB,CAAC,EACvB,MACE,oFACI,EAAW,yDACX,EAA+B,sDACX,EAA+B,gCAI3D,GAAI,CAAC,GAAoB,EACvB,MACE,wBAAwB,EAA+B,kMCV7D,eAAsB,EAEpB,CACE,qBAAsB,EACtB,OACA,gBAAiB,EACjB,UACA,cACA,OACA,MACA,QAAQ,IAEV,EACe,CACf,EAAoB,KAAK,QAAQ,CACjC,EAAwB,EAAM,CAE9B,IAAM,EAAgB,EAAoB,KAAK,OAAQ,EAAK,CACtD,EAAc,EAA8B,KAAK,QAAQ,KAAK,CAAE,EAAU,CAC1E,EAAe,GAAW,EAA0B,EAAW,CAC/D,EAAS,EAAwB,EAAc,EAAK,CACpD,EAAc,EAClB,CAAE,OAAM,cAAe,GAAO,CAC9B,KAAK,QAAQ,MAAM,MACnB,KAAK,QAAQ,OAAO,MACrB,CAEG,EACJ,GAAI,CACF,EAAc,KAAK,EAAO,MAAM,+BAA+B,EAAY,KAAK,CAAC,CACjF,EAAa,MAAM,EAAsB,EAAY,CAErD,GAAI,CACF,IAAM,EAAe,EAAK,EAAa,EAAyB,CAE1D,EAAiB,EAAkC,EADxC,EAA0B,KAAK,GAAG,aAAa,EAAc,OAAO,CACR,CAAC,CAC1E,GACF,EAAc,KAAK,EAAO,OAAO,EAAe,CAAC,MAE7C,EAIR,IAAM,EAAmB,MAAM,EAAsB,EAAQ,EAAW,CAEpE,EAEJ,GAAI,EAAkB,CACpB,EAAc,KAAK,EAAO,MAAM,qCAAqC,EAAW,MAAM,CAAC,CACvF,IAAM,EAAO,EAA0B,CACrC,aACA,QAAS,EACT,cACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,mCAAmC,EAAiB,WAAY,CAAE,KAAM,EAAM,CAAC,CACpF,MAAyC,CAC7C,KACI,CACL,GAAI,CAAC,GAAe,CAAC,EAAK,CACxB,KAAK,OAAO,MACV,EAAO,IACL,qFACD,CACF,CACD,KAAK,QAAQ,KAAK,EAAE,CACpB,OAGF,GAAI,CAAC,IACH,EAAc,KACZ,EAAO,OAAO,2BAA2B,EAAW,iCAAiC,CACtF,CAIG,CAAC,MAHsB,EAAuB,CAChD,QAAS,2BAA2B,EAAW,6DAChD,CAAC,EACiB,CACjB,EAAc,KAAK,EAAO,OAAO,qBAAqB,CAAC,CACvD,OAIJ,EAAc,KACZ,EAAO,MAAM,oBAAoB,EAAW,kCAAkC,CAC/E,CACD,IAAM,EAAa,EAA0B,CAC3C,aACA,QAAS,EACT,cACA,aACD,CAAC,CACF,EAAe,MAAM,EACnB,EACG,KAAK,kCAAmC,CACvC,KAAM,EACP,CAAC,CACD,MAAkC,CACtC,CAGH,EAAY,KAAK,QAAQ,OAAQ,CAC/B,OACA,KAAM,EACN,gBAAmB,EAAiC,EAAa,QAAQ,CAC1E,CAAC,CAEF,EAAc,KAAK,EAAO,MAAM,+CAA+C,CAAC,CAEhF,IAAM,EAAkB,EAA0C,CAAC,SAAU,WAAW,CAAE,CACxF,QAAS,EAAa,QAAQ,QAC9B,qBAAsB,EACvB,CAAC,CACF,EAAc,KACZ,EAAO,OACL,+EAA+E,IAChF,CACF,QACO,CACJ,GAAc,KAAK,GAAG,WAAW,EAAW,EAC9C,KAAK,GAAG,WAAW,EAAW"}