Initial: Node-RED flow validator with conftest/Rego

- Declarative YAML flow format
- Python flow2json converter with auto-positioning
- Rego policies: 14 validation rules for flow integrity
- Conftest integration
- justfile workflow: generate → validate → deploy

justfile

@@ -0,0 +1,81 @@
+# nr-flow-validator — Declarative Node-RED flows with conftest validation
+
+set export
+
+# Default: generate a flow, validate, and show results
+default: validate
+
+# ---- Flow generation ----
+
+# Generate Node-RED flow JSON from a YAML spec
+generate FLOW="zigbee-monitor":
+    @echo "=== Generating {{FLOW}} ==="
+    python3 scripts/flow2json.py flows/{{FLOW}}.yaml > output/{{FLOW}}.json
+    @echo "Wrote output/{{FLOW}}.json"
+
+# Generate all flows
+generate-all:
+    @for f in flows/*.yaml; do \
+        name=$(basename "$f" .yaml); \
+        just generate "$name"; \
+    done
+
+# ---- Validation ----
+
+# Validate a generated flow against Rego policies
+validate FLOW="zigbee-monitor": generate
+    @echo "=== Validating {{FLOW}} ==="
+    conftest test output/{{FLOW}}.json -p policy/ --namespace nodered --no-color
+
+# Validate all flows
+validate-all:
+    @for f in output/*.json; do \
+        echo "=== Validating $(basename "$f") ==="; \
+        conftest test "$$f" -p policy/ --namespace nodered --no-color; \
+    done
+
+# ---- Deployment ----
+
+# Deploy flow to Node-RED instance
+deploy FLOW="zigbee-monitor" HOST="http://192.168.9.147:1880": generate validate
+    @echo "=== Deploying {{FLOW}} to {{HOST}} ==="
+    curl -s -o /dev/null -w "HTTP %{http_code}" \
+        -X POST {{HOST}}/flows \
+        -H "Content-Type: application/json" \
+        -H "Node-RED-Deployment-Type: full" \
+        -d @output/{{FLOW}}.json
+    @echo ""
+
+# Quick deploy (skip validation)
+deploy-quick FLOW="zigbee-monitor" HOST="http://192.168.9.147:1880": generate
+    @echo "=== Quick deploy {{FLOW}} to {{HOST}} ==="
+    curl -s -o /dev/null -w "HTTP %{http_code}" \
+        -X POST {{HOST}}/flows \
+        -H "Content-Type: application/json" \
+        -H "Node-RED-Deployment-Type: full" \
+        -d @output/{{FLOW}}.json
+    @echo ""
+
+# ---- Viewing ----
+
+# Fetch and display current flows from Node-RED
+pull HOST="http://192.168.9.147:1880":
+    curl -s {{HOST}}/flows | python3 -m json.tool
+
+# Open dashboard in browser
+dashboard:
+    xdg-open http://192.168.9.147:1880/ui 2>/dev/null || open http://192.168.9.147:1880/ui 2>/dev/null || echo "Open: http://192.168.9.147:1880/ui"
+
+# ---- Development ----
+
+# Watch for changes and re-validate
+watch FLOW="zigbee-monitor":
+    @while true; do \
+        inotifywait -q -e modify flows/{{FLOW}}.yaml policy/*.rego; \
+        clear; just validate {{FLOW}}; \
+    done
+
+# Create a new flow from template
+new NAME:
+    @cp flows/zigbee-monitor.yaml flows/{{NAME}}.yaml
+    @echo "Created flows/{{NAME}}.yaml — edit and run 'just validate {{NAME}}'"