unbound-cli 1.18.0 → 1.19.0

package/test/pack-export.test.js

@@ -0,0 +1,83 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const schema = require('../src/lib/pack-schema');
+const plan = require('../src/lib/pack-plan');
+const exp = require('../src/lib/pack-export');
+
+const REF = {
+  userGroups: [{ id: 1, name: 'Engineering' }],
+  guardrails: [{ id: 7, name: 'PII', supported_actions: ['BLOCK', 'AUDIT'], entities: [{ id: 70, name: 'EMAIL' }, { id: 71, name: 'SSN' }] }],
+  aiModels: [{ id: 100, name: 'claude-sonnet' }, { id: 101, name: 'gpt-4o' }],
+  toolTypes: ['cursor'],
+  labels: [{ id: 5, name: 'baseline' }],
+  mcpServers: [],
+};
+
+const LIVE = {
+  tool: [
+    { id: '11', name: 'no-rm', code_pack: 'base', code_slug: 'no-rm', policy_type: 'TERMINAL_COMMAND', action: 'BLOCK', custom_message: 'no', description: 'd', enabled: false, status: 'INACTIVE', command_family: 'custom', config: { command: 'rm -rf*' }, scope_user_groups: [{ id: 1, name: 'Engineering' }] },
+    { id: '12', name: 'gh-writes', code_pack: 'base', code_slug: 'gh-writes', policy_type: 'MCP_TOOL', action: 'AUDIT', custom_message: '', description: '', enabled: true, status: 'ACTIVE', mcp_server: 'GitHub', mcp_tools: ['push_files'], mcp_canonical_group: { id: 9, name: 'github' }, config: {}, scope_user_groups: [] },
+  ],
+  generic: [
+    { id: 21, name: 'pii', code_pack: 'base', code_slug: 'pii', type: 'SECURITY', enabled: true, priority: 3, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 4, enabled: true, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: false }] }] }, scope_user_groups: [], scope_tool_types: ['cursor'], labels: [{ id: 5, name: 'baseline' }] },
+    { id: 22, name: 'models', code_pack: 'base', code_slug: 'models', type: 'MODEL', enabled: true, priority: 1, config: { support_all_models: false, allowed_model_ids: [100], excluded_model_ids: [] }, scope_user_groups: [], scope_tool_types: [], labels: [] },
+    { id: 23, name: 'cap', code_pack: 'base', code_slug: 'cap', type: 'COST', enabled: true, priority: 2, config: { monthly_budget: 100 }, scope_user_groups: [], scope_tool_types: [], labels: [] },
+  ],
+};
+
+test('liveToPack: ids become names and sugar is restored', () => {
+  const doc = exp.liveToPack('base', LIVE, REF, { version: '2.0.0' });
+  assert.equal(doc.apiVersion, 'unbound.security/v1');
+  assert.deepEqual(doc.metadata, { name: 'base', version: '2.0.0' });
+  const byId = Object.fromEntries(doc.policies.map((p) => [p.id, p]));
+  assert.deepEqual(byId['no-rm'], { id: 'no-rm', kind: 'tool', type: 'TERMINAL_COMMAND', action: 'BLOCK', enabled: false, description: 'd', customMessage: 'no', commandFamily: 'custom', config: { command: 'rm -rf*' }, scope: { userGroups: ['Engineering'] } });
+  assert.deepEqual(byId['gh-writes'].mcp, { server: 'GitHub', tools: ['push_files'] });
+  assert.deepEqual(byId.pii.guardrails, [{ name: 'PII', action: 'BLOCK', threshold: 4, entities: ['EMAIL'] }]);
+  assert.deepEqual(byId.pii.scope, { toolTypes: ['cursor'] });
+  assert.deepEqual(byId.pii.labels, ['baseline']);
+  assert.deepEqual(byId.models.models, { allowed: ['claude-sonnet'] });
+  assert.deepEqual(byId.cap.config, { monthly_budget: 100 });
+  assert.equal(byId.cap.priority, 2);
+});
+
+test('round trip: export -> parse -> validate -> plan is a no-op', () => {
+  const doc = exp.liveToPack('base', LIVE, REF);
+  const text = exp.stringifyPack(doc);
+  assert.match(text, /^# PolicyPack "base"/);
+  const pack = schema.validatePack(schema.parsePackText(text, 'base.yaml'), 'base.yaml');
+  const desired = plan.toDesired(pack, REF);
+  const ops = plan.buildPlan(desired, LIVE, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ops.map(() => 'unchanged'), JSON.stringify(ops.filter((o) => o.op !== 'unchanged').map((o) => o.changes)));
+});
+
+test('stringifyPack: JSON-compatible document without header', () => {
+  const doc = exp.liveToPack('base', { tool: [], generic: [LIVE.generic[2]] }, REF);
+  const text = exp.stringifyPack(doc, { header: false });
+  assert.doesNotMatch(text, /^#/);
+  assert.deepEqual(schema.parsePackText(text, 'x.yaml'), doc);
+});
+
+test('round trip keeps a disabled guardrail entry disabled', () => {
+  const live = { tool: [], generic: [{ ...LIVE.generic[0], config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'AUDIT', threshold: 1, enabled: false, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: true }] }] } }] };
+  const doc = exp.liveToPack('base', live, REF);
+  assert.deepEqual(doc.policies[0].guardrails, [{ name: 'PII', action: 'AUDIT', enabled: false }]);
+  const packDoc = schema.validatePack(doc, 'base.yaml');
+  const ops = plan.buildPlan(plan.toDesired(packDoc, REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged']);
+});
+
+test('export keeps a loadable file for an empty BLOCK message and an allow-nothing model policy', () => {
+  const live = {
+    tool: [{ ...LIVE.tool[0], name: 'quiet-block', code_slug: 'quiet-block', custom_message: '' }],
+    generic: [{ ...LIVE.generic[1], name: 'none', code_slug: 'none', config: { support_all_models: false, allowed_model_ids: [], excluded_model_ids: [] } }],
+  };
+  const doc = exp.liveToPack('base', live, REF);
+  const byId = Object.fromEntries(doc.policies.map((p) => [p.id, p]));
+  assert.equal(byId['quiet-block'].customMessage, '');
+  assert.equal(byId.none.models, undefined);
+  assert.deepEqual(byId.none.config, { support_all_models: false, allowed_model_ids: [], excluded_model_ids: [] });
+  const packDoc = schema.validatePack(doc, 'base.yaml');
+  const ops = plan.buildPlan(plan.toDesired(packDoc, REF), live, { prune: true });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged', 'unchanged']);
+});

package/test/pack-plan.test.js

@@ -0,0 +1,201 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const schema = require('../src/lib/pack-schema');
+const plan = require('../src/lib/pack-plan');
+
+const REF = {
+  userGroups: [{ id: 1, name: 'Engineering' }, { id: 2, name: 'Contractors' }],
+  guardrails: [{ id: 7, name: 'PII', supported_actions: ['BLOCK', 'AUDIT'], entities: [{ id: 70, name: 'EMAIL' }, { id: 71, name: 'SSN' }] }],
+  aiModels: [{ id: 100, name: 'claude-sonnet' }, { id: 101, name: 'gpt-4o' }],
+  toolTypes: ['cursor', 'claude-code'],
+  labels: [{ id: 5, name: 'baseline' }],
+  mcpServers: [{ mcp_server: 'GitHub', tool_calls: ['push_files', 'create_pull_request', 'get_file'], tool_action_types: { push_files: 'write', create_pull_request: 'write', get_file: 'read' } }],
+};
+
+function pack(policies, extra = '') {
+  return schema.validatePack({
+    apiVersion: 'unbound.security/v1',
+    kind: 'PolicyPack',
+    metadata: { name: 'base', version: '1.0.0' },
+    policies,
+    ...(extra || {}),
+  }, 'base.yaml');
+}
+
+const TERMINAL = { id: 'no-rm', kind: 'tool', type: 'TERMINAL_COMMAND', action: 'BLOCK', commandFamily: 'custom', customMessage: 'no', config: { command: 'rm -rf*' }, scope: { userGroups: ['Engineering'] } };
+const MCP = { id: 'gh-writes', kind: 'tool', type: 'MCP_TOOL', action: 'AUDIT', mcp: { server: 'github', actionType: 'write' } };
+const SECURITY = { id: 'pii', kind: 'security', priority: 3, guardrails: [{ name: 'pii', action: 'BLOCK', entities: ['EMAIL'] }], labels: ['baseline'] };
+const MODEL = { id: 'models', kind: 'model', models: { allowAll: true, excluded: ['gpt-4o'] } };
+const COST = { id: 'cap', kind: 'cost', config: { monthly_budget: 100 }, scope: { toolTypes: ['cursor'] } };
+
+const LIVE_TERMINAL = { id: '11', name: 'no-rm', code_pack: 'base', code_slug: 'no-rm', policy_type: 'TERMINAL_COMMAND', action: 'BLOCK', custom_message: 'no', description: '', enabled: true, status: 'ACTIVE', command_family: 'custom', config: { command: 'rm -rf*' }, scope_user_groups: [{ id: 1, name: 'Engineering' }] };
+const LIVE_MCP = { id: '12', name: 'gh-writes', code_pack: 'base', code_slug: 'gh-writes', policy_type: 'MCP_TOOL', action: 'AUDIT', custom_message: '', description: '', enabled: true, status: 'ACTIVE', mcp_server: 'GitHub', mcp_tools: ['create_pull_request', 'push_files'], mcp_canonical_group: { id: 9, name: 'github' }, config: {}, scope_user_groups: [] };
+const LIVE_SECURITY = { id: 21, name: 'pii', code_pack: 'base', code_slug: 'pii', type: 'SECURITY', enabled: true, priority: 3, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 1, enabled: true, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: false }] }] }, scope_user_groups: [], scope_tool_types: [], labels: [{ id: 5, name: 'baseline' }] };
+const LIVE_MODEL = { id: 22, name: 'models', code_pack: 'base', code_slug: 'models', type: 'MODEL', enabled: true, priority: 1, config: { support_all_models: true, allowed_model_ids: [], excluded_model_ids: [101] }, scope_user_groups: [], scope_tool_types: [], labels: [] };
+const LIVE_COST = { id: 23, name: 'cap', code_pack: 'base', code_slug: 'cap', type: 'COST', enabled: true, priority: 2, config: { monthly_budget: 100 }, scope_user_groups: [], scope_tool_types: ['cursor'], labels: [] };
+
+test('toDesired: builds write bodies with resolved ids', () => {
+  const desired = plan.toDesired(pack([TERMINAL, MCP, SECURITY, MODEL, COST]), REF);
+  const [t, m, s, mo, c] = desired;
+  assert.equal(t.table, 'tool');
+  assert.deepEqual(t.body.scope_user_group_ids, [1]);
+  assert.equal(t.body.command_family, 'custom');
+  assert.equal(m.body.mcp_tool_action_type, 'write');
+  assert.deepEqual(m.proj.mcp_tools, ['create_pull_request', 'push_files'], 'action type expanded from metadata');
+  assert.equal(s.body.type, 'SECURITY');
+  assert.deepEqual(s.body.config.guardrails[0], { guardrail_id: 7, enabled: true, action: 'BLOCK', threshold: 1, route_model_id: null, entities: [{ entity_id: 70, enabled: true }] });
+  assert.deepEqual(s.body.label_ids, [5]);
+  assert.deepEqual(mo.body.config, { support_all_models: true, allowed_model_ids: [], excluded_model_ids: [101] });
+  assert.deepEqual(c.body.scope_tool_types, ['cursor']);
+  assert.equal(c.body.priority, undefined, 'priority is unmanaged when absent');
+});
+
+test('toDesired: unresolved names fail before any write', () => {
+  assert.throws(() => plan.toDesired(pack([{ ...TERMINAL, scope: { userGroups: ['Nope'] } }]), REF), /no user group named "Nope"/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'Secrets', action: 'BLOCK' }] }]), REF), /no guardrail named "Secrets"/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'PII', action: 'REDACT' }] }]), REF), /does not support REDACT/);
+  assert.throws(() => plan.toDesired(pack([{ ...MODEL, models: { allowed: ['llama'] } }]), REF), /no model named "llama"/);
+  assert.throws(() => plan.toDesired(pack([{ ...COST, scope: { toolTypes: ['vim'] } }]), REF), /unknown tool type vim/);
+  assert.throws(() => plan.toDesired(pack([{ ...SECURITY, labels: ['nope'] }]), REF), /no label named "nope"/);
+});
+
+test('buildPlan: in-sync org yields only unchanged ops', () => {
+  const desired = plan.toDesired(pack([TERMINAL, MCP, SECURITY, MODEL, COST]), REF);
+  const ops = plan.buildPlan(desired, { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_SECURITY, LIVE_MODEL, LIVE_COST] });
+  assert.deepEqual(ops.map((o) => o.op), ['unchanged', 'unchanged', 'unchanged', 'unchanged', 'unchanged']);
+  assert.equal(plan.summarize(ops).drift, 0);
+});
+
+test('buildPlan: create, patch-update, orphan and prune', () => {
+  const desired = plan.toDesired(pack([{ ...TERMINAL, action: 'AUDIT', customMessage: undefined }, { ...COST, config: { monthly_budget: 250 } }]), REF);
+  const live = { tool: [LIVE_TERMINAL, LIVE_MCP], generic: [LIVE_COST] };
+
+  const ops = plan.buildPlan(desired, live);
+  const byName = Object.fromEntries(ops.map((o) => [o.serverName, o]));
+  assert.equal(byName['no-rm'].op, 'update');
+  assert.deepEqual(byName['no-rm'].body, { action: 'AUDIT', custom_message: '' }, 'only changed fields are sent');
+  assert.equal(byName['cap'].op, 'update');
+  assert.deepEqual(byName['cap'].body, { config: { monthly_budget: 250 } });
+  assert.equal(byName['gh-writes'].op, 'orphan', 'without prune the orphan is kept');
+
+  const pruned = plan.buildPlan(desired, live, { prune: true });
+  assert.equal(pruned.find((o) => o.serverName === 'gh-writes').op, 'delete');
+  assert.equal(plan.summarize(pruned).delete, 1);
+
+  const created = plan.buildPlan(plan.toDesired(pack([SECURITY]), REF), { tool: [], generic: [] });
+  assert.equal(created[0].op, 'create');
+  assert.equal(created[0].body.name, 'pii');
+  assert.equal(created[0].body.code_pack, 'base');
+  assert.equal(created[0].body.code_slug, 'pii');
+});
+
+test('buildPlan: MCP tool-set change patches with the canonical group id', () => {
+  const desired = plan.toDesired(pack([{ ...MCP, mcp: { server: 'github', tools: ['push_files'] } }]), REF);
+  const [op] = plan.buildPlan(desired, { tool: [LIVE_MCP], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { mcp_canonical_group_id: 9, mcp_tools: ['push_files'] });
+});
+
+test('buildPlan: MCP server change and type change are replace', () => {
+  const server = plan.toDesired(pack([{ ...MCP, mcp: { server: 'slack', tool: 'post_message' } }]), REF);
+  assert.equal(plan.buildPlan(server, { tool: [LIVE_MCP], generic: [] })[0].op, 'replace');
+  const type = plan.toDesired(pack([{ ...TERMINAL, id: 'gh-writes' }]), REF);
+  assert.equal(plan.buildPlan(type, { tool: [LIVE_MCP], generic: [] })[0].op, 'replace');
+});
+
+test('an action-type selector the catalogue cannot resolve is an error, never "unchanged"', () => {
+  const unknownServer = { ...MCP, mcp: { server: 'nope', actionType: 'write' } };
+  assert.throws(() => plan.toDesired(pack([unknownServer]), REF), /not in this org's MCP catalogue/);
+  const emptyRef = { ...REF, mcpServers: [] };
+  assert.throws(() => plan.toDesired(pack([MCP]), emptyRef), /not in this org's MCP catalogue/);
+  const noTools = { ...MCP, mcp: { server: 'github', actionType: 'destructive' } };
+  assert.throws(() => plan.toDesired(pack([noTools]), REF), /has no destructive tools/);
+});
+
+test('buildPlan: conflicts are reported, never written', () => {
+  // same name exists in the other table
+  const desired = plan.toDesired(pack([{ ...COST, id: 'no-rm' }]), REF);
+  const [clash] = plan.buildPlan(desired, { tool: [LIVE_TERMINAL], generic: [] });
+  assert.equal(clash.op, 'conflict');
+  // generic kind change
+  const kindChange = plan.toDesired(pack([{ ...SECURITY, id: 'cap' }]), REF);
+  assert.equal(plan.buildPlan(kindChange, { tool: [], generic: [LIVE_COST] })[0].op, 'conflict');
+  assert.equal(plan.summarize([clash]).conflict, 1);
+});
+
+test('diffFields: scope and label order do not count as drift', () => {
+  const desired = plan.toDesired(pack([{ ...TERMINAL, scope: { userGroups: ['Contractors', 'Engineering'] } }]), REF);
+  const live = { ...LIVE_TERMINAL, scope_user_groups: [{ id: 2, name: 'Contractors' }, { id: 1, name: 'Engineering' }] };
+  assert.deepEqual(plan.diffFields(desired[0].proj, plan.liveProjection(live, 'tool')), []);
+});
+
+test('MCP writes keep the author casing; only the comparison is lowercased', () => {
+  const ref = { ...REF, mcpServers: [{ mcp_server: 'Jira', tool_calls: ['getJiraIssue', 'createIssue'], tool_action_types: { getJiraIssue: 'read', createIssue: 'write' } }] };
+  const desired = plan.toDesired(pack([{ ...MCP, id: 'jira', mcp: { server: 'jira', tools: ['getJiraIssue'] } }, { ...MCP, id: 'jira-writes', mcp: { server: 'jira', actionType: 'write' } }]), ref);
+  assert.deepEqual(desired[0].proj.mcp_tools, ['getjiraissue']);
+  assert.deepEqual(desired[0].body.mcp_tools, ['getJiraIssue']);
+  assert.deepEqual(desired[1].proj.mcp_tools, ['createissue']);
+  assert.equal(desired[1].body.mcp_tool_action_type, 'write');
+  const live = { ...LIVE_MCP, name: 'jira', code_slug: 'jira', mcp_server: 'Jira', mcp_canonical_group: { id: 4, name: 'jira' }, mcp_tools: ['createIssue'] };
+  const [op] = plan.buildPlan([desired[0]], { tool: [live], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { mcp_canonical_group_id: 4, mcp_tools: ['getJiraIssue'] });
+  const liveWrites = { ...live, name: 'jira-writes', code_slug: 'jira-writes', mcp_tools: ['getJiraIssue'] };
+  const [op2] = plan.buildPlan([desired[1]], { tool: [liveWrites], generic: [] });
+  assert.deepEqual(op2.body, { mcp_canonical_group_id: 4, mcp_tools: ['createIssue'] }, 'action type expansion keeps server casing');
+});
+
+test('guardrail entries can be disabled in the pack', () => {
+  const desired = plan.toDesired(pack([{ ...SECURITY, guardrails: [{ name: 'PII', action: 'BLOCK', enabled: false }] }]), REF);
+  assert.equal(desired[0].body.config.guardrails[0].enabled, false);
+  const live = { ...LIVE_SECURITY, config: { sub_type: 'guardrails', guardrails: [{ guardrail_id: 7, action: 'BLOCK', threshold: 1, enabled: false, route_model_id: null, entities: [{ entity_id: 70, enabled: true }, { entity_id: 71, enabled: true }] }] } };
+  assert.equal(plan.buildPlan(desired, { tool: [], generic: [live] })[0].op, 'unchanged');
+});
+
+test('MCP config changes are drift and patch only config', () => {
+  const desired = plan.toDesired(pack([{ ...MCP, mcp: { server: 'github', tools: ['create_pull_request', 'push_files'] }, config: { note: 'x' } }]), REF);
+  const [op] = plan.buildPlan(desired, { tool: [LIVE_MCP], generic: [] });
+  assert.equal(op.op, 'update');
+  assert.deepEqual(op.body, { config: { note: 'x' } });
+});
+
+test('an unsupported row under the desired name is a conflict, never a create', () => {
+  const desired = plan.toDesired(pack([{ ...COST, id: 'skill' }]), REF);
+  const live = { tool: [], generic: [], unsupported: [{ table: 'tool', row: { id: '7', name: 'Skill', policy_type: 'SKILL_INJECTION', origin: 'CODE', code_pack: 'base', code_slug: 'skill' } }] };
+  const [op] = plan.buildPlan(desired, live);
+  assert.equal(op.op, 'conflict');
+  assert.match(op.reason, /SKILL_INJECTION/);
+});
+
+test('a managed row switched off in the console is an enabled-only update', () => {
+  const desired = plan.toDesired(pack([TERMINAL, COST]), REF);
+  const live = {
+    tool: [{ ...LIVE_TERMINAL, origin: 'CODE', enabled: false, status: 'INACTIVE' }],
+    generic: [{ ...LIVE_COST, origin: 'CODE', enabled: false }],
+  };
+  const ops = plan.buildPlan(desired, live);
+  for (const op of ops) {
+    assert.equal(op.op, 'update', op.serverName);
+    assert.deepEqual(op.body, { enabled: true });
+    assert.deepEqual(op.changes, [{ field: 'enabled', from: false, to: true }]);
+  }
+  assert.equal(plan.summarize(ops).drift, 2);
+});
+
+test('a name already used elsewhere in the org is a conflict at plan time, not a failed create', () => {
+  const desired = plan.toDesired(pack([{ ...COST, name: 'Monthly cap' }, { ...SECURITY, name: 'PII guard' }]), REF);
+  const names = new Map([
+    ['Monthly cap', { table: 'generic', id: 77, code_pack: null, code_slug: null }],
+    ['PII guard', { table: 'generic', id: 21, code_pack: 'base', code_slug: 'pii' }],
+  ]);
+  const ops = plan.buildPlan(desired, { tool: [], generic: [{ ...LIVE_SECURITY, name: 'PII guard' }], names });
+  const byId = Object.fromEntries(ops.map((o) => [o.id, o]));
+  assert.equal(byId.cap.op, 'conflict');
+  assert.match(byId.cap.reason, /made in the console/);
+  assert.equal(byId.pii.op, 'unchanged', 'the row that already owns the name is not a conflict with itself');
+
+  const renamed = plan.toDesired(pack([{ ...SECURITY, name: 'Monthly cap' }]), REF);
+  const renamedOps = plan.buildPlan(renamed, { tool: [], generic: [{ ...LIVE_SECURITY, name: 'PII guard' }], names }, { prune: true });
+  assert.deepEqual(renamedOps.map((o) => o.op), ['conflict'], 'a refused rename is a conflict and never also an orphan or delete');
+});

package/test/pack-remote.test.js

@@ -0,0 +1,179 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+
+// Stub the HTTP layer before pack-remote loads it.
+const calls = [];
+const stub = {
+  get: async (p, opts) => { calls.push(['GET', p, opts]); return stub.onGet(p, opts); },
+  post: async (p, opts) => { calls.push(['POST', p, opts]); return stub.onPost(p, opts); },
+  put: async (p, opts) => { calls.push(['PUT', p, opts]); return stub.onPut(p, opts); },
+  del: async (p, opts) => { calls.push(['DELETE', p, opts]); return stub.onDel(p, opts); },
+  onGet: async () => ({}),
+  onPost: async () => ({ id: '99' }),
+  onPut: async () => ({}),
+  onDel: async () => ({}),
+};
+require.cache[require.resolve('../src/api')] = { id: path.resolve(__dirname, '../src/api.js'), filename: path.resolve(__dirname, '../src/api.js'), loaded: true, exports: stub };
+const remote = require('../src/lib/pack-remote');
+
+function reset() {
+  calls.length = 0;
+  stub.onGet = async () => ({});
+  stub.onPost = async () => ({ id: '99' });
+  stub.onPut = async () => ({});
+  stub.onDel = async () => ({});
+}
+
+test('replaceRow creates under a temporary name before deleting the old row', async () => {
+  reset();
+  await remote.replaceRow('tool', { id: '11', name: 'Block x' }, { name: 'Block x', policy_type: 'MCP_TOOL', code_pack: 'base', code_slug: 'x' });
+  assert.deepEqual(calls.map((c) => c[0]), ['POST', 'DELETE', 'PUT']);
+  assert.match(calls[0][2].body.name, /^Block x-replacing-/);
+  assert.equal(calls[1][1], '/api/v1/command-policies/11/');
+  assert.deepEqual(calls[2], ['PUT', '/api/v1/command-policies/99/', { body: { name: 'Block x', code_pack: 'base', code_slug: 'x', origin: 'CODE' } }]);
+});
+
+test('replaceRow: a failed create leaves the old row in place', async () => {
+  reset();
+  stub.onPost = async () => { throw new Error('boom'); };
+  await assert.rejects(() => remote.replaceRow('generic', { id: 5, name: 'base/y' }, { name: 'base/y', type: 'COST' }), /boom/);
+  assert.deepEqual(calls.map((c) => c[0]), ['POST'], 'no delete after a failed create');
+});
+
+test('replaceRow reads the id from the generic {policy: ...} envelope', async () => {
+  reset();
+  stub.onPost = async () => ({ policy: { id: 42 } });
+  await remote.replaceRow('generic', { id: 5, name: 'base/y' }, { name: 'base/y', type: 'COST' });
+  assert.equal(calls[2][1], '/api/v1/policies/42/');
+});
+
+test('writeOps never throws for one failed op and reports every outcome', async () => {
+  reset();
+  stub.onPut = async () => { throw new Error('nope'); };
+  const results = await remote.writeOps([
+    { op: 'create', table: 'generic', body: { name: 'base/a' } },
+    { op: 'update', table: 'tool', row: { id: '1' }, body: { action: 'AUDIT' } },
+    { op: 'unchanged', table: 'tool', row: { id: '2' } },
+  ]);
+  assert.deepEqual(results.map((r) => r.status), ['ok', 'failed', 'skipped']);
+  assert.equal(results[1].error, 'nope');
+});
+
+test('fetchManaged asks for the pack by identity and splits unsupported types', async () => {
+  reset();
+  stub.onGet = async (p) => {
+    if (p.startsWith('/api/v1/command-policies/')) {
+      return { policies: [
+        { id: '1', name: 'Audit pushes', policy_type: 'TERMINAL_COMMAND', origin: 'CODE', code_pack: 'base', code_slug: 'a' },
+        { id: '2', name: 'Skill', policy_type: 'SKILL_INJECTION', origin: 'CODE', code_pack: 'base', code_slug: 'skill' },
+        { id: '3', name: 'base/a', policy_type: 'TERMINAL_COMMAND', origin: 'MANUAL' },
+      ], total_pages: 1 };
+    }
+    return { policies: [
+      { id: 10, name: 'Cap', type: 'COST', origin: 'CODE', code_pack: 'base', code_slug: 'cost' },
+      { id: 11, name: 'Repo', type: 'REPO', origin: 'CODE', code_pack: 'base', code_slug: 'repo' },
+      { id: 12, name: 'Other', type: 'COST', origin: 'CODE', code_pack: 'other', code_slug: 'x' },
+    ] };
+  };
+  const live = await remote.fetchManaged('base');
+  assert.deepEqual(live.tool.map((r) => r.name), ['Audit pushes'], 'a MANUAL row named like a pack policy is not managed');
+  assert.deepEqual(live.generic.map((r) => r.name), ['Cap'], 'a row of another pack is not managed');
+  assert.deepEqual(live.unsupported.map((u) => u.row.name), ['Skill', 'Repo']);
+  assert.deepEqual(calls[0][2].query, { code_pack: 'base', origin: 'CODE', page: 1, page_size: 200 });
+  assert.deepEqual(calls[1][2].query, { code_pack: 'base', origin: 'CODE' });
+});
+
+test('fetchAllGrouped walks every page and groups by code_pack', async () => {
+  reset();
+  stub.onGet = async (p, opts) => {
+    if (p.startsWith('/api/v1/command-policies/')) {
+      const page = opts.query.page;
+      return { policies: [{ id: String(page), name: `policy ${page}`, policy_type: 'MCP_TOOL', origin: 'CODE', code_pack: `p${page}`, code_slug: 'a' }], total_pages: 2 };
+    }
+    return { policies: [{ id: 1, name: 'loose', type: 'COST', origin: 'MANUAL' }] };
+  };
+  const { packs, unmanaged } = await remote.fetchAllGrouped();
+  assert.deepEqual([...packs.keys()].sort(), ['p1', 'p2']);
+  assert.equal(unmanaged.length, 1);
+});
+
+test('replaceRow uses a temporary name and identity and rolls back when the old delete fails', async () => {
+  reset();
+  const slug = remote.tempSlug('a-very-long-policy-identifier-that-is-close-to-the-sixty-four-limit');
+  assert.ok(/^[a-z0-9-]{1,64}$/.test(slug), slug);
+  assert.match(remote.tempName('Block rm'), /^Block rm-replacing-/);
+  stub.onDel = async (p) => { if (p.endsWith('/11/')) throw new Error('old delete failed'); return {}; };
+  await assert.rejects(() => remote.replaceRow('tool', { id: '11', name: 'x' }, { name: 'x', code_pack: 'base', code_slug: 'x' }), /old delete failed/);
+  assert.deepEqual(calls.map((c) => [c[0], c[1]]), [['POST', '/api/v1/command-policies/'], ['DELETE', '/api/v1/command-policies/11/'], ['DELETE', '/api/v1/command-policies/99/']]);
+  assert.match(calls[0][2].body.code_slug, /^x-replacing-/);
+  assert.equal(calls[0][2].body.code_pack, 'base');
+});
+
+test('createdId tolerates the response envelopes the CLI accepts', () => {
+  assert.equal(remote.createdId('tool', { id: '7', name: 'x' }), '7');
+  assert.equal(remote.createdId('tool', { command_policy: { id: '8' } }), '8');
+  assert.equal(remote.createdId('tool', { policy: { id: '9' } }), '9');
+  assert.equal(remote.createdId('generic', { policy: { id: 10 } }), 10);
+  assert.equal(remote.createdId('generic', {}), null);
+  assert.equal(remote.createdId('generic', null), null);
+});
+
+test('findByExactName tags rows of unmanaged types as unsupported', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Skill', policy_type: 'SKILL_INJECTION' }, { id: '2', name: 'Skill2', policy_type: 'MCP_TOOL' }], total_pages: 1 }
+    : { policies: [] });
+  const hits = await remote.findByExactName('Skill');
+  assert.equal(hits.length, 1);
+  assert.equal(hits[0].supported, false);
+  const ok = await remote.findByExactName('Skill2');
+  assert.equal(ok[0].supported, true);
+});
+
+test('every write declares origin CODE; delete carries it as a query parameter', async () => {
+  reset();
+  await remote.createRow('tool', { name: 'base/x', action: 'AUDIT' });
+  await remote.updateRow('generic', 23, { enabled: true });
+  await remote.deleteRow('tool', '11');
+  assert.deepEqual(calls[0], ['POST', '/api/v1/command-policies/', { body: { name: 'base/x', action: 'AUDIT', origin: 'CODE' } }]);
+  assert.deepEqual(calls[1], ['PUT', '/api/v1/policies/23/', { body: { enabled: true, origin: 'CODE' } }]);
+  assert.deepEqual(calls[2], ['DELETE', '/api/v1/command-policies/11/', { query: { origin: 'CODE' } }]);
+});
+
+test('loadReference records why the MCP catalogue is missing instead of hiding it', async () => {
+  reset();
+  remote.resetReference();
+  stub.onGet = async (p) => {
+    if (p.includes('mcp-servers')) throw new Error('503 from gateway-data');
+    if (p.includes('labels')) return { labels: [] };
+    return { user_groups: [], guardrails: [], ai_models: [], tool_types: [] };
+  };
+  const ref = await remote.loadReference({ mcp: true });
+  assert.deepEqual(ref.mcpServers, []);
+  assert.match(ref.mcpServersError, /503 from gateway-data/);
+  remote.resetReference();
+});
+
+test('a backend without the origin field is refused before any write', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Block rm', policy_type: 'TERMINAL_COMMAND' }], total_pages: 1 }
+    : { policies: [{ id: 10, name: 'Cap', type: 'COST' }] });
+  await assert.rejects(() => remote.fetchManaged('base'), /newer server release/);
+  await assert.rejects(() => remote.fetchAllGrouped(), /newer server release/);
+  // An empty org cannot be told apart and simply has nothing to manage yet.
+  stub.onGet = async () => ({ policies: [], total_pages: 1 });
+  const live = await remote.fetchManaged('base');
+  assert.deepEqual(live, { tool: [], generic: [], unsupported: [] });
+});
+
+test('fetchAllNames maps every live name to its owner', async () => {
+  reset();
+  stub.onGet = async (p) => (p.startsWith('/api/v1/command-policies/')
+    ? { policies: [{ id: '1', name: 'Block rm', policy_type: 'TERMINAL_COMMAND', origin: 'MANUAL' }], total_pages: 1 }
+    : { policies: [{ id: 10, name: 'Cap', type: 'COST', origin: 'CODE', code_pack: 'base', code_slug: 'cap' }] });
+  const names = await remote.fetchAllNames();
+  assert.deepEqual(names.get('Block rm'), { table: 'tool', id: '1', code_pack: null, code_slug: null });
+  assert.deepEqual(names.get('Cap'), { table: 'generic', id: 10, code_pack: 'base', code_slug: 'cap' });
+});

package/test/pack-schema.test.js

@@ -0,0 +1,144 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+const schema = require('../src/lib/pack-schema');
+
+const BASE = `
+apiVersion: unbound.security/v1
+kind: PolicyPack
+metadata:
+  name: k8s-baseline
+  version: 1.2.0
+defaults:
+  scope:
+    userGroups: [Engineering]
+policies:
+  - id: block-secret-reads
+    kind: tool
+    type: TERMINAL_COMMAND
+    action: BLOCK
+    commandFamily: custom
+    customMessage: Reading cluster secrets is blocked.
+    config:
+      command: "regex:kubectl\\\\s+get\\\\s+secrets?"
+  - id: github-writes
+    kind: tool
+    type: MCP_TOOL
+    action: REQUIRE_SLACK_APPROVAL
+    mcp:
+      server: github
+      tools: [create_pull_request, push_files]
+    scope:
+      userGroups: [Contractors]
+  - id: pii-guard
+    kind: security
+    priority: 10
+    guardrails:
+      - name: PII
+        action: BLOCK
+        threshold: 5
+  - id: monthly-cap
+    kind: cost
+    enabled: false
+    config:
+      monthly_budget: 5000
+`;
+
+function load(text, file = 'pack.yaml') {
+  return schema.validatePack(schema.parsePackText(text, file), file);
+}
+
+test('validatePack: happy path merges defaults and builds server names', () => {
+  const pack = load(BASE);
+  assert.equal(pack.name, 'k8s-baseline');
+  assert.equal(pack.version, '1.2.0');
+  assert.equal(pack.policies.length, 4);
+  const [terminal, mcp, security, cost] = pack.policies;
+  assert.equal(terminal.serverName, 'block-secret-reads');
+  assert.equal(terminal.enabled, true);
+  assert.deepEqual(terminal.scope, { userGroups: ['Engineering'] });
+  assert.deepEqual(mcp.scope, { userGroups: ['Contractors'] }, 'policy scope wins over defaults');
+  assert.equal(security.priority, 10);
+  assert.equal(cost.enabled, false);
+});
+
+test('parsePackText: JSON by extension, YAML otherwise', () => {
+  const doc = { apiVersion: 'unbound.security/v1', kind: 'PolicyPack', metadata: { name: 'p', version: '1' }, policies: [{ id: 'a', kind: 'cost', config: { monthly_budget: 1 } }] };
+  assert.deepEqual(schema.parsePackText(JSON.stringify(doc), 'p.json'), doc);
+  assert.deepEqual(schema.parsePackText('a: 1\n', 'p.yaml'), { a: 1 });
+  assert.throws(() => schema.parsePackText('a: [\n', 'bad.yaml'), (err) => err instanceof schema.PackError && err.exitCode === 2);
+  assert.throws(() => schema.parsePackText('a: 1\n---\nb: 2\n', 'two.yaml'), /exactly one YAML document/);
+});
+
+test('validatePack: rejects wrong apiVersion and kind', () => {
+  assert.throws(() => load(BASE.replace('unbound.security/v1', 'unbound.security/v2')), /apiVersion must be/);
+  assert.throws(() => load(BASE.replace('kind: PolicyPack', 'kind: Pack')), /kind must be/);
+});
+
+test('validatePack: unknown keys fail at every level', () => {
+  assert.throws(() => load(`${BASE}\nextra: 1\n`), /top level: unknown key "extra"/);
+  assert.throws(() => load(BASE.replace('  version: 1.2.0', '  version: 1.2.0\n  author: x')), /metadata: unknown key "author"/);
+  assert.throws(() => load(BASE.replace('    kind: cost', '    kind: cost\n    colour: red')), /unknown key "colour"/);
+  assert.throws(() => load(BASE.replace('      server: github', '      server: github\n      port: 1')), /mcp: unknown key "port"/);
+});
+
+test('validatePack: slug rules and duplicate ids', () => {
+  assert.throws(() => load(BASE.replace('name: k8s-baseline', 'name: K8s Baseline')), /metadata.name/);
+  assert.throws(() => load(BASE.replace('id: monthly-cap', 'id: Monthly Cap')), /policies\[3\].id/);
+  assert.throws(() => load(BASE.replace('id: monthly-cap', 'id: pii-guard')), /used twice/);
+});
+
+test('validatePack: kind-specific keys are enforced', () => {
+  // tool-only key on a generic policy
+  assert.throws(() => load(BASE.replace('    kind: cost', '    kind: cost\n    action: BLOCK')), /unknown key "action"/);
+  // generic-only key on a tool policy
+  assert.throws(() => load(BASE.replace('    kind: tool\n    type: TERMINAL_COMMAND', '    kind: tool\n    priority: 1\n    type: TERMINAL_COMMAND')), /unknown key "priority"/);
+  // toolTypes scope only on generic
+  assert.throws(() => load(BASE.replace('      userGroups: [Contractors]', '      toolTypes: [cursor]')), /scope.toolTypes applies to/);
+  // guardrails only on security
+  assert.throws(() => load(BASE.replace('    kind: cost', '    kind: cost\n    guardrails: []')), /unknown key "guardrails"/);
+});
+
+test('validatePack: tool policy rules', () => {
+  assert.throws(() => load(BASE.replace('action: BLOCK\n    commandFamily', 'action: DENY\n    commandFamily')), /action must be one of/);
+  assert.throws(() => load(BASE.replace('    customMessage: Reading cluster secrets is blocked.\n', '')), /customMessage is required when action is BLOCK or WARN/);
+  assert.throws(() => load(BASE.replace('    commandFamily: custom\n', '')), /commandFamily is required/);
+  assert.throws(() => load(BASE.replace('      tools: [create_pull_request, push_files]', '      tool: a\n      actionType: write')), /exactly one of tool, tools or actionType/);
+  assert.throws(() => load(BASE.replace('      tools: [create_pull_request, push_files]', '      actionType: nuke')), /actionType must be one of/);
+});
+
+test('validatePack: generic policy rules', () => {
+  assert.throws(() => load(BASE.replace('        threshold: 5', '        threshold: 500')), /threshold must be an integer from 1 to 100/);
+  assert.throws(() => load(BASE.replace('        action: BLOCK\n        threshold: 5', '        action: ROUTE\n')), /routeModel is required when action is ROUTE/);
+  assert.throws(() => load(BASE.replace('    config:\n      monthly_budget: 5000', '    config: {}')), /cost policy needs a config/);
+  assert.throws(() => load(BASE.replace('    priority: 10', '    priority: 10\n    config:\n      guardrails: []')), /either guardrails or config.guardrails/);
+  const modelBad = BASE.replace('    kind: cost\n    enabled: false\n    config:\n      monthly_budget: 5000', '    kind: model\n    models:\n      allowed: [a]\n      allowAll: true');
+  assert.throws(() => load(modelBad), /allowed cannot be combined/);
+});
+
+test('validatePack: policies must be a non-empty list', () => {
+  assert.throws(() => load(BASE.replace(/policies:[\s\S]*$/, 'policies: []\n')), /non-empty list/);
+});
+
+test('slugify turns a console name into a policy id', () => {
+  assert.equal(schema.slugify('Block kubectl secrets!'), 'block-kubectl-secrets');
+  assert.equal(schema.slugify('   '), null);
+});
+
+test('validatePack: name is optional free text, unique within the pack', () => {
+  const base = { apiVersion: 'unbound.security/v1', kind: 'PolicyPack', metadata: { name: 'p', version: '1' } };
+  const ok = schema.validatePack({ ...base, policies: [
+    { id: 'a', name: 'Monthly cap for engineering', kind: 'cost', config: { monthly_budget: 1 } },
+    { id: 'b', kind: 'cost', config: { monthly_budget: 2 } },
+  ] }, 'p.yaml');
+  assert.deepEqual(ok.policies.map((x) => x.serverName), ['Monthly cap for engineering', 'b']);
+  assert.throws(() => schema.validatePack({ ...base, policies: [{ id: 'a', name: '  ', kind: 'cost', config: { monthly_budget: 1 } }] }, 'p.yaml'), /name must be a non-empty string/);
+  assert.throws(() => schema.validatePack({ ...base, policies: [
+    { id: 'a', name: 'Same', kind: 'cost', config: { monthly_budget: 1 } }, { id: 'b', name: 'Same', kind: 'cost', config: { monthly_budget: 2 } },
+  ] }, 'p.yaml'), /"Same" is used twice/);
+});
+
+test('validatePack: description is a tool-policy key only', () => {
+  assert.throws(() => load(BASE.replace('    kind: cost', '    kind: cost\n    description: dropped')), /unknown key "description"/);
+  assert.doesNotThrow(() => load(BASE.replace('    kind: tool\n    type: TERMINAL_COMMAND', '    kind: tool\n    description: kept\n    type: TERMINAL_COMMAND')));
+});