prae-cli 0.10.0 → 0.10.2

package/lib/pack-h5n43S0F.js

@@ -1,448 +0,0 @@
-import { t as FRAMEWORKS } from "./frameworks-BgZHGKiH.js";
-
-//#region ../kernel/src/pack.ts
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var Check = class {
-	errors = [];
-	fail(path, message) {
-		this.errors.push({
-			path,
-			message
-		});
-	}
-	/** Reject any key the shape does not define. */
-	keys(path, value, allowed) {
-		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
-	}
-	text(path, value) {
-		if (typeof value !== "string" || value.trim() === "") {
-			this.fail(path, "expected a non-empty string");
-			return;
-		}
-		return value;
-	}
-	/** A field that accepts one name or a list of them. */
-	names(path, value) {
-		if (typeof value === "string") return value;
-		if (Array.isArray(value)) {
-			const out = [];
-			value.forEach((entry, index) => {
-				const one = this.text(`${path}[${index}]`, entry);
-				if (one !== void 0) out.push(one);
-			});
-			return out;
-		}
-		this.fail(path, "expected a string or an array of strings");
-	}
-	globs(path, value) {
-		if (!Array.isArray(value)) {
-			this.fail(path, "expected an array of path globs");
-			return;
-		}
-		const out = [];
-		value.forEach((entry, index) => {
-			const one = this.text(`${path}[${index}]`, entry);
-			if (one !== void 0) out.push(one);
-		});
-		return out;
-	}
-	number(path, value) {
-		if (typeof value !== "number" || !Number.isFinite(value)) {
-			this.fail(path, "expected a finite number");
-			return;
-		}
-		return value;
-	}
-};
-function readCommandMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"name",
-		"token",
-		"anyToken",
-		"pipedTo",
-		"pipeline"
-	]);
-	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
-	const out = {};
-	if (value.token !== void 0) {
-		const tokens = check.names(`${path}.token`, value.token);
-		if (tokens !== void 0) out.token = tokens;
-	}
-	if (value.name !== void 0) {
-		const names = check.names(`${path}.name`, value.name);
-		if (names !== void 0) out.name = names;
-	}
-	if (value.anyToken !== void 0) {
-		const tokens = check.names(`${path}.anyToken`, value.anyToken);
-		if (tokens !== void 0) out.anyToken = tokens;
-	}
-	if (value.pipedTo !== void 0) {
-		const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
-		if (pipes !== void 0) out.pipedTo = pipes;
-	}
-	if (value.pipeline !== void 0) {
-		const shapes = check.names(`${path}.pipeline`, value.pipeline);
-		if (shapes !== void 0) out.pipeline = shapes;
-	}
-	return out;
-}
-function readPathMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"arg",
-		"outside",
-		"inside"
-	]);
-	if (value.outside === void 0 && value.inside === void 0) check.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.outside !== void 0) {
-		const globs = check.globs(`${path}.outside`, value.outside);
-		if (globs !== void 0) out.outside = globs;
-	}
-	if (value.inside !== void 0) {
-		const globs = check.globs(`${path}.inside`, value.inside);
-		if (globs !== void 0) out.inside = globs;
-	}
-	return out;
-}
-function readHostMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"arg",
-		"in",
-		"notIn"
-	]);
-	if (value.in === void 0 && value.notIn === void 0) check.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
-	const out = {};
-	if (value.arg !== void 0) {
-		const arg = check.text(`${path}.arg`, value.arg);
-		if (arg !== void 0) out.arg = arg;
-	}
-	if (value.in !== void 0) {
-		const list = check.globs(`${path}.in`, value.in);
-		if (list !== void 0) out.in = list;
-	}
-	if (value.notIn !== void 0) {
-		const list = check.globs(`${path}.notIn`, value.notIn);
-		if (list !== void 0) out.notIn = list;
-	}
-	return out;
-}
-function readArgMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"name",
-		"above",
-		"below",
-		"equals",
-		"oneOf",
-		"present"
-	]);
-	const name = check.text(`${path}.name`, value.name);
-	if (name === void 0) return void 0;
-	const out = { name };
-	if (value.above !== void 0) {
-		const n = check.number(`${path}.above`, value.above);
-		if (n !== void 0) out.above = n;
-	}
-	if (value.below !== void 0) {
-		const n = check.number(`${path}.below`, value.below);
-		if (n !== void 0) out.below = n;
-	}
-	if (value.equals !== void 0) out.equals = value.equals;
-	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check.fail(`${path}.oneOf`, "expected an array");
-	else out.oneOf = value.oneOf;
-	if (value.present !== void 0) if (typeof value.present !== "boolean") check.fail(`${path}.present`, "expected a boolean");
-	else out.present = value.present;
-	return out;
-}
-function readSecretsMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"types",
-		"minConfidence",
-		"atLeast"
-	]);
-	const out = {};
-	if (value.types !== void 0) {
-		const types = check.globs(`${path}.types`, value.types);
-		if (types !== void 0) out.types = types;
-	}
-	if (value.minConfidence !== void 0) {
-		const n = check.number(`${path}.minConfidence`, value.minConfidence);
-		if (n !== void 0) if (n < 0 || n > 1) check.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
-		else out.minConfidence = n;
-	}
-	if (value.atLeast !== void 0) {
-		const n = check.number(`${path}.atLeast`, value.atLeast);
-		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check.fail(`${path}.atLeast`, "expected an integer of at least 1");
-		else out.atLeast = n;
-	}
-	return out;
-}
-function readMatch(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return {};
-	}
-	check.keys(path, value, [
-		"tool",
-		"capability",
-		"plugin",
-		"agent",
-		"command",
-		"path",
-		"host",
-		"arg",
-		"count",
-		"secrets"
-	]);
-	const out = {};
-	for (const key of [
-		"tool",
-		"capability",
-		"plugin",
-		"agent"
-	]) if (value[key] !== void 0) {
-		const names = check.names(`${path}.${key}`, value[key]);
-		if (names !== void 0) out[key] = names;
-	}
-	if (value.command !== void 0) {
-		const match = readCommandMatch(check, `${path}.command`, value.command);
-		if (match !== void 0) out.command = match;
-	}
-	if (value.path !== void 0) {
-		const match = readPathMatch(check, `${path}.path`, value.path);
-		if (match !== void 0) out.path = match;
-	}
-	if (value.host !== void 0) {
-		const match = readHostMatch(check, `${path}.host`, value.host);
-		if (match !== void 0) out.host = match;
-	}
-	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check.fail(`${path}.arg`, "expected an array of argument matchers");
-	else {
-		const list = [];
-		value.arg.forEach((entry, index) => {
-			const one = readArgMatch(check, `${path}.arg[${index}]`, entry);
-			if (one !== void 0) list.push(one);
-		});
-		out.arg = list;
-	}
-	if (value.count !== void 0) if (!isObject(value.count)) check.fail(`${path}.count`, "expected an object");
-	else {
-		check.keys(`${path}.count`, value.count, ["above"]);
-		const above = check.number(`${path}.count.above`, value.count.above);
-		if (above !== void 0) out.count = { above };
-	}
-	if (value.secrets !== void 0) {
-		const match = readSecretsMatch(check, `${path}.secrets`, value.secrets);
-		if (match !== void 0) out.secrets = match;
-	}
-	return out;
-}
-function readEffect(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	const kind = value.kind === "hold" ? "ask" : value.kind;
-	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
-		check.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
-		return;
-	}
-	check.keys(path, value, kind === "correct" ? [
-		"kind",
-		"set",
-		"because"
-	] : ["kind", "because"]);
-	const because = check.text(`${path}.because`, value.because);
-	if (because === void 0) return void 0;
-	if (kind === "correct") {
-		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
-			check.fail(`${path}.set`, "expected a non-empty object of arguments to set");
-			return;
-		}
-		return {
-			kind,
-			set: value.set,
-			because
-		};
-	}
-	return {
-		kind,
-		because
-	};
-}
-function readRule(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object");
-		return;
-	}
-	check.keys(path, value, [
-		"id",
-		"title",
-		"description",
-		"when",
-		"effect",
-		"frameworks"
-	]);
-	const id = check.text(`${path}.id`, value.id);
-	const effect = readEffect(check, `${path}.effect`, value.effect);
-	if (value.when === void 0) check.fail(`${path}.when`, "expected an object");
-	const when = readMatch(check, `${path}.when`, value.when ?? {});
-	if (id === void 0 || effect === void 0) return void 0;
-	const rule = {
-		id,
-		when,
-		effect
-	};
-	if (value.title !== void 0) {
-		const title = check.text(`${path}.title`, value.title);
-		if (title !== void 0) rule.title = title;
-	}
-	if (value.description !== void 0) {
-		const description = check.text(`${path}.description`, value.description);
-		if (description !== void 0) rule.description = description;
-	}
-	if (value.frameworks !== void 0) {
-		const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
-		if (frameworks !== void 0) rule.frameworks = frameworks;
-	}
-	return rule;
-}
-/**
-* A citation names a framework edition and controls the registry knows. A
-* typo here would be a rule that claims a mapping no view can render, so it
-* is a pack error rather than an ignored key — the same line the rest of the
-* parser takes.
-*/
-function readFrameworks(check, path, value) {
-	if (!isObject(value)) {
-		check.fail(path, "expected an object keyed by framework id");
-		return;
-	}
-	const out = {};
-	for (const [framework, controls] of Object.entries(value)) {
-		const known = FRAMEWORKS[framework];
-		if (known === void 0) {
-			check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
-			continue;
-		}
-		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
-			check.fail(`${path}.${framework}`, "expected an array of control ids");
-			continue;
-		}
-		const ids = controls;
-		for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
-		if (ids.length > 0) out[framework] = [...new Set(ids)];
-	}
-	return out;
-}
-/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
-function parsePack(source) {
-	let raw;
-	try {
-		raw = JSON.parse(source);
-	} catch (error) {
-		return {
-			ok: false,
-			errors: [{
-				path: "",
-				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
-			}]
-		};
-	}
-	const check = new Check();
-	if (!isObject(raw)) return {
-		ok: false,
-		errors: [{
-			path: "",
-			message: "expected an object"
-		}]
-	};
-	check.keys("", raw, [
-		"prae",
-		"pack",
-		"version",
-		"description",
-		"owner",
-		"expires_at",
-		"baseline",
-		"rules"
-	]);
-	if (raw.prae !== "0.1") check.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
-	const name = check.text(".pack", raw.pack);
-	const version = check.text(".version", raw.version);
-	const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
-	const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
-	const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
-	if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
-	let baseline;
-	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
-	else {
-		check.keys(".baseline", raw.baseline, ["capabilities"]);
-		const caps = check.globs(".baseline.capabilities", raw.baseline.capabilities);
-		if (caps !== void 0) baseline = { capabilities: caps };
-	}
-	const rules = [];
-	if (!Array.isArray(raw.rules)) check.fail(".rules", "expected an array");
-	else {
-		const seen = /* @__PURE__ */ new Set();
-		raw.rules.forEach((entry, index) => {
-			const rule = readRule(check, `rules[${index}]`, entry);
-			if (rule === void 0) return;
-			if (seen.has(rule.id)) {
-				check.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
-				return;
-			}
-			seen.add(rule.id);
-			rules.push(rule);
-		});
-	}
-	if (check.errors.length > 0) return {
-		ok: false,
-		errors: check.errors
-	};
-	if (name === void 0 || version === void 0) return {
-		ok: false,
-		errors: check.errors
-	};
-	return {
-		ok: true,
-		pack: {
-			prae: "0.1",
-			pack: name,
-			version,
-			...description === void 0 ? {} : { description },
-			...owner === void 0 ? {} : { owner },
-			...expires === void 0 ? {} : { expires_at: expires },
-			...baseline === void 0 ? {} : { baseline },
-			rules
-		}
-	};
-}
-
-//#endregion
-export { parsePack as t };