speckeeper 0.11.0 → 0.11.1

package/dist/cli.js

@@ -4,7 +4,6 @@ import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync, statSy
 import { dirname, join, resolve, basename, isAbsolute } from 'path';
 import { fileURLToPath } from 'url';
 import { Command } from 'commander';
-import { isOptionActive, derivePolicy } from 'cli-contracts/policy';
 import chalk4 from 'chalk';
 import { stringify, parse } from 'yaml';
 import 'crypto';
@@ -536,6 +535,196 @@ var init_dsl = __esm({
     init_workflows();
   }
 });
+
+// src/generated/policy-runtime.ts
+var RISK_ORDER = {
+  low: 0,
+  medium: 1,
+  high: 2,
+  critical: 3
+};
+function maxRiskLevel(...levels) {
+  let max = "low";
+  for (const level of levels) {
+    if (RISK_ORDER[level] > RISK_ORDER[max]) {
+      max = level;
+    }
+  }
+  return max;
+}
+function isOptionActive(definition, value, specified) {
+  const schemaType = definition.schema?.type;
+  if (schemaType === "boolean") {
+    return value === true;
+  }
+  if (definition.repeatable) {
+    return specified && Array.isArray(value) && value.length > 0;
+  }
+  return specified && value != null;
+}
+function derivePolicy(input) {
+  const sideEffects = /* @__PURE__ */ new Set();
+  const reads = [];
+  const writes = [];
+  const networkEffects = [];
+  const riskLevels = [];
+  let executionMode;
+  let explicitConfirmation;
+  if (input.commandEffects) {
+    const ce = input.commandEffects;
+    riskLevels.push(ce.riskLevel ?? "low");
+    if (ce.writes) {
+      sideEffects.add("file_write");
+      for (const w of ce.writes) {
+        writes.push({
+          kind: "semantic",
+          target: w.target,
+          description: w.description,
+          overwrite: w.overwrite,
+          destructive: w.destructive,
+          ...w.idempotent !== void 0 ? { idempotent: w.idempotent } : {},
+          ...w.idempotencyKey ? { idempotencyKey: w.idempotencyKey } : {},
+          ...w.idempotentNote ? { idempotentNote: w.idempotentNote } : {},
+          source: `command:${input.commandId}`
+        });
+      }
+    }
+    if (ce.reads) {
+      for (const r of ce.reads) {
+        reads.push({
+          kind: "semantic",
+          target: r.target,
+          description: r.description,
+          source: `command:${input.commandId}`
+        });
+      }
+    }
+    if (ce.network) {
+      sideEffects.add("network");
+      if (typeof ce.network === "object") {
+        networkEffects.push({
+          ...ce.network.description ? { description: ce.network.description } : {},
+          ...ce.network.domains ? { domains: ce.network.domains } : {},
+          ...ce.network.idempotent !== void 0 ? { idempotent: ce.network.idempotent } : {},
+          ...ce.network.idempotencyKey ? { idempotencyKey: ce.network.idempotencyKey } : {},
+          ...ce.network.idempotentNote ? { idempotentNote: ce.network.idempotentNote } : {},
+          source: `command:${input.commandId}`
+        });
+      }
+    }
+    if (ce.executionMode) {
+      executionMode = ce.executionMode;
+    }
+    if (ce.requiresConfirmation !== void 0) {
+      explicitConfirmation = ce.requiresConfirmation;
+    }
+  }
+  for (const [optName, optInput] of Object.entries(input.options)) {
+    const { definition, value, specified } = optInput;
+    const active = isOptionActive(definition, value, specified);
+    if (!active) continue;
+    if (definition.file) {
+      const filePath = typeof value === "string" ? value : void 0;
+      const mode = definition.file.mode;
+      if (mode === "read" || mode === "readWrite") {
+        reads.push({
+          kind: "option-file",
+          option: optName,
+          path: filePath,
+          source: `option:${optName}`
+        });
+      }
+      if (mode === "write" || mode === "append" || mode === "readWrite") {
+        sideEffects.add("file_write");
+        writes.push({
+          kind: "option-file",
+          option: optName,
+          path: filePath,
+          mode,
+          source: `option:${optName}`
+        });
+      }
+    }
+    if (definition.effects) {
+      const eff = definition.effects;
+      riskLevels.push(eff.riskLevel ?? "low");
+      if (eff.writes) {
+        sideEffects.add("file_write");
+        for (const w of eff.writes) {
+          writes.push({
+            kind: "semantic",
+            target: w.target,
+            description: w.description,
+            overwrite: w.overwrite,
+            destructive: w.destructive,
+            ...w.idempotent !== void 0 ? { idempotent: w.idempotent } : {},
+            ...w.idempotencyKey ? { idempotencyKey: w.idempotencyKey } : {},
+            ...w.idempotentNote ? { idempotentNote: w.idempotentNote } : {},
+            source: `option:${optName}`
+          });
+        }
+      }
+      if (eff.reads) {
+        for (const r of eff.reads) {
+          reads.push({
+            kind: "semantic",
+            target: r.target,
+            description: r.description,
+            source: `option:${optName}`
+          });
+        }
+      }
+      if (eff.network) {
+        sideEffects.add("network");
+        if (typeof eff.network === "object") {
+          networkEffects.push({
+            ...eff.network.description ? { description: eff.network.description } : {},
+            ...eff.network.domains ? { domains: eff.network.domains } : {},
+            ...eff.network.idempotent !== void 0 ? { idempotent: eff.network.idempotent } : {},
+            ...eff.network.idempotencyKey ? { idempotencyKey: eff.network.idempotencyKey } : {},
+            ...eff.network.idempotentNote ? { idempotentNote: eff.network.idempotentNote } : {},
+            source: `option:${optName}`
+          });
+        }
+      }
+      if (eff.executionMode && !executionMode) {
+        executionMode = eff.executionMode;
+      }
+      if (eff.requiresConfirmation !== void 0 && explicitConfirmation === void 0) {
+        explicitConfirmation = eff.requiresConfirmation;
+      }
+    }
+  }
+  const finalRiskLevel = riskLevels.length > 0 ? maxRiskLevel(...riskLevels) : "low";
+  const requiresConfirmation = explicitConfirmation ?? (finalRiskLevel === "high" || finalRiskLevel === "critical");
+  let requiresSecrets;
+  if (input.env) {
+    const secrets = [];
+    for (const [envName, envVar] of Object.entries(input.env)) {
+      if (envVar.sensitive) {
+        secrets.push(envName);
+      }
+    }
+    if (secrets.length > 0) {
+      requiresSecrets = secrets;
+    }
+  }
+  const semanticWrites = writes.filter((w) => w.kind === "semantic");
+  const idempotent = semanticWrites.every((w) => w.idempotent === true) && networkEffects.every((n) => n.idempotent === true);
+  return {
+    riskLevel: finalRiskLevel,
+    requiresConfirmation,
+    idempotent,
+    sideEffects: [...sideEffects],
+    reads,
+    writes,
+    ...networkEffects.length > 0 ? { network: networkEffects } : {},
+    ...executionMode ? { executionMode } : {},
+    ...requiresSecrets ? { requiresSecrets } : {}
+  };
+}
+
+// src/generated/policy.ts
 var commandDefinitions = {
   "init": {
     "effects": {