@fabricorg/policy-opa 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @fabricorg/policy-opa
 
+## 0.3.0 — 2026-05-17
+
+### Minor
+
+- **Policy guidance support.** `OpaDecision` now accepts `guidance?: PolicyGuidance` and the evaluator maps it directly to `PolicyOutcome.guidance`. This makes OPA-backed policies render through the same audit/remediation UI contract as TypeScript code policies.
+- **Engine metadata cleanup.** User-facing facts move out of `dispatchEvidence.engine.metadata` and into `PolicyOutcome.guidance`. Engine metadata remains focused on OPA provenance (`decisionPath`, `inputHash`, `decisionId`, `bundleRevision`, `conditionResults`, `obligations`, raw `provenance`).
+- **Default-deny failure guidance.** OPA infrastructure failures still return `block` by default, now with generic corrective guidance telling operators to check OPA reachability, bundle serving, and decision shape.
+- **Peer-deps:** `@fabricorg/platform ^0.4.0`.
+
+## 0.2.0 — 2026-05-16
+
+### Minor
+
+- **Rich execution provenance.** Adds an `OpaPolicyExecutor` shape (`execute(path, input) → OpaPolicyExecution`) alongside the existing `OpaPolicyClient` (`evaluate(path, input)`). The factory detects either shape on `ctx.services[serviceKey]` and prefers `execute` when both are present. Lets adapter callers surface OPA's `decision_id`, `provenance.version`, and `provenance.bundles[*].revision` — fields the high-level `@open-policy-agent/opa` SDK discards.
+- **`executorFromOpaHttp({ baseUrl, fetch?, headers?, provenance? })`** — official executor that POSTs to `{baseUrl}/v1/data/{path}?provenance=true`, parses the snake_case OPA response, and surfaces full provenance. Zero runtime deps; works on Node 20+ (uses `globalThis.fetch`), and on any runtime by passing a custom `fetch` implementation. Recommended for production deployments that need audit-grade evidence.
+- **`executorFromOpaClient(client)`** — wraps the high-level SDK as an `OpaPolicyExecutor` for hosts that want to standardize on the executor interface even while accepting the limited provenance the SDK exposes.
+- **`OpaPolicyBinding.bundleName?`** — optional selector for `provenance.bundles[name].revision`. Selection rules: explicit `bundleName` wins; otherwise a single-bundle response is used unambiguously; multiple bundles without a selector are recorded as `engine.metadata.bundleRevisionStatus: "ambiguous"` so audit dashboards can flag policies that need explicit selectors.
+- **`engine.metadata` richer fields.** When the executor surfaces them, `dispatchEvidence.engine.metadata` now carries `decisionId`, `bundleName`, `bundleRevision`, `bundleRevisionStatus`, and the raw `provenance` block. `engine.version` is set from `provenance.version` when present, otherwise falls back to the `engineVersion` option.
+- **`mapDecision` third argument.** `mapDecision: (decision, ctx, execution) => …` — the `execution` arg exposes `decisionId`, `bundleRevision`, `opaVersion`, and `provenance` so mappers can lift specific provenance fields into `outcome.metadata` if the host wants them queryable outside `dispatchEvidence`. Existing two-argument mappers from v0.1 continue to work (TypeScript permits implementations with fewer parameters).
+- **Failure evidence now includes provenance** when available. A malformed-response failure under the executor path still records `decisionId` and `bundleRevision` in `engine.metadata` — useful for correlating "OPA returned something we couldn't parse" against OPA's own decision logs.
+- **Tests:** 25 → 50. Added 25 covering: executor path with full provenance, single-bundle vs. multi-bundle vs. ambiguous selection, missing-provenance non-fatality, mapDecision third arg, service shape detection (executor preferred over client), bundle-selector unit tests, `executorFromOpaClient` wrapping, and `executorFromOpaHttp` URL construction / snake_case parsing / header forwarding / non-2xx handling.
+
+### Backwards compatibility
+
+All v0.1 surface area is preserved. Hosts wiring `ctx.services.opa` as an `OpaPolicyClient` (with `evaluate`) continue to work without code changes; they simply don't get OPA-side provenance in `engine.metadata`. Upgrade path is: swap the client for `executorFromOpaHttp(...)` to gain `decisionId` and `bundleRevision`, and add `bundleName` to bindings that target a specific OPA bundle.
+
 ## 0.1.0 — 2026-05-16
 
 ### Initial release

package/README.md

@@ -8,11 +8,16 @@ The platform stays zero-dependency and vendor-neutral; the OPA-specific glue liv
 
 ```bash
 pnpm add @fabricorg/platform @fabricorg/policy-opa
-# Bring your own OPA client. The high-level SDK works out of the box:
+# Optionally the official SDK if you want the high-level client shape:
 pnpm add @open-policy-agent/opa
 ```
 
-`@fabricorg/policy-opa` has **zero runtime dependencies**. The OPA client is structurally typed (`{ evaluate(path, input): Promise<unknown> }`) so the official `@open-policy-agent/opa` SDK works, and so do hand-rolled wrappers that capture more provenance from the low-level API.
+`@fabricorg/policy-opa` has **zero runtime dependencies**. Two wiring shapes are supported:
+
+- **`OpaPolicyExecutor`** (recommended) — `execute(path, input) → OpaPolicyExecution`. Surfaces full OPA-side provenance (`decisionId`, `bundleRevision`, `opaVersion`, raw `provenance` block) under `engine.metadata`. The package ships `executorFromOpaHttp({ baseUrl, ... })` for this.
+- **`OpaPolicyClient`** — `evaluate(path, input) → Promise<unknown>`. Structurally compatible with the high-level `@open-policy-agent/opa` SDK. Simpler to wire but the SDK discards `decisionId` and `provenance` from the response, so audit evidence is thinner.
+
+If a service implements both methods, `execute` is preferred.
 
 ## Usage — the four pieces
 
@@ -20,7 +25,7 @@ A complete OPA-backed evaluator has four pieces, three of which the vertical own
 
 ### 1. The vertical policy manifest
 
-Keep Fabric policy IDs, versions, decision paths, and Rego package names in one place. Don't inline strings at call sites.
+Keep Fabric policy IDs, versions, decision paths, Rego package names, and bundle selectors in one place. Don't inline strings at call sites.
 
 ```ts
 import type { OpaPolicyBinding } from "@fabricorg/policy-opa";
@@ -31,10 +36,13 @@ export const LENDING_POLICY_BINDINGS = {
     version: 1,
     decisionPath: "fabric/lending/tcpa/contact_window/decision",
     regoPackage: "fabric.lending.tcpa.contact_window",
+    bundleName: "lending",
   },
 } satisfies Record<string, OpaPolicyBinding>;
 ```
 
+`bundleName` is optional. Set it when your OPA serves multiple bundles and you need audit evidence to record exactly which bundle's revision produced the decision. If OPA serves only one bundle, omit `bundleName` and the adapter uses that bundle's revision unambiguously.
+
 ### 2. The fact builder (TypeScript)
 
 Snapshot the facts OPA needs from your database. OPA never touches your DB directly — your TypeScript host owns reads, tenant scoping, and redaction.
@@ -70,14 +78,18 @@ decision := {
   "result": result,
   "reason": reason,
   "conditionResults": condition_results,
-  "factsUsed": facts_used,
+  "guidance": {
+    "summary": reason,
+    "factsUsed": facts_used,
+    "correctiveActions": corrective_actions,
+  },
 }
 
 result := "block" if not consent_active
 result := "block" if not within_window
 default result := "pass"
 
-# ...rules computing reason, condition_results, facts_used...
+# ...rules computing reason, condition_results, facts_used, corrective_actions...
 ```
 
 The validator accepts the following fields (TypeScript types: `OpaDecision`):
@@ -92,7 +104,7 @@ The validator accepts the following fields (TypeScript types: `OpaDecision`):
     result: "pass" | "warn" | "block";
     reason?: string;
   }>;
-  factsUsed?: Record<string, unknown>;
+  guidance?: PolicyGuidance;
   obligations?: Record<string, unknown>;
 }
 ```
@@ -117,12 +129,19 @@ registerPolicy(tcpaPolicy);
 
 ### Host wiring
 
-The runtime host injects the OPA client into `PolicyContext.services` when it builds a policy context. With the high-level SDK:
+The runtime host injects an OPA executor (or client) into `PolicyContext.services` when it builds a policy context.
+
+**Recommended — HTTP executor with full provenance:**
 
 ```ts
-import { OPAClient } from "@open-policy-agent/opa";
+import { executorFromOpaHttp } from "@fabricorg/policy-opa";
 
-const opa = new OPAClient(process.env.OPA_URL ?? "http://localhost:8181");
+const opa = executorFromOpaHttp({
+  baseUrl: process.env.OPA_URL ?? "http://localhost:8181",
+  // provenance: true is the default — `?provenance=true` is appended to
+  // every request so OPA returns decision_id and bundle revisions.
+  // headers: { authorization: `Bearer ${process.env.OPA_TOKEN}` },
+});
 
 // when constructing PolicyContext for evaluatePolicyDefinitions:
 const policyCtx = {
@@ -133,9 +152,21 @@ const policyCtx = {
 };
 ```
 
+**Alternative — wrap the high-level SDK:**
+
+```ts
+import { OPAClient } from "@open-policy-agent/opa";
+import { executorFromOpaClient } from "@fabricorg/policy-opa";
+
+const opa = executorFromOpaClient(new OPAClient(process.env.OPA_URL ?? "http://localhost:8181"));
+// ... services: { opa }
+```
+
+This works (the adapter accepts an `OpaPolicyClient` directly too, so wrapping isn't strictly required), but the high-level SDK discards `decision_id` and `provenance` — audit evidence is thinner than with `executorFromOpaHttp`.
+
 ## What lands in audit evidence
 
-For a successful OPA evaluation, `PolicyDispatchEvidence.engine` looks like:
+For a successful OPA evaluation under the HTTP executor (with provenance enabled), `PolicyDispatchEvidence.engine` looks like:
 
 ```json
 {
@@ -145,13 +176,21 @@ For a successful OPA evaluation, `PolicyDispatchEvidence.engine` looks like:
     "decisionPath": "fabric/lending/tcpa/contact_window/decision",
     "regoPackage": "fabric.lending.tcpa.contact_window",
     "inputHash": "sha256:8a3c…",
-    "conditionResults": [{ "conditionId": "consent_active", "passed": true, "result": "pass" }],
-    "factsUsed": { "consent": { "active": true } }
+    "decisionId": "01J0Q9MZ…",
+    "bundleName": "lending",
+    "bundleRevision": "2026-05-16.3",
+    "provenance": {
+      "version": "0.65.0",
+      "bundles": { "lending": { "revision": "2026-05-16.3" } }
+    },
+    "conditionResults": [{ "conditionId": "consent_active", "passed": true, "result": "pass" }]
   }
 }
 ```
 
-Fabric's `policyId` / `policyVersion` remain canonical (`"what was evaluated"`). `engine.metadata` answers `"which artifact produced the answer"`. Both ride on the `PolicyEvaluation` row Fabric persists per outcome.
+Fabric's `policyId` / `policyVersion` remain canonical (`"what was evaluated"`). `engine.metadata.{decisionId, bundleName, bundleRevision}` answers `"which artifact produced the answer"`, and `decisionId` is the join key against OPA's own decision-log stream if you ship it to a SIEM. User-facing facts and remediation steps live on `PolicyOutcome.guidance`, not in engine metadata, so code policies and OPA policies render through the same audit UI contract.
+
+If OPA serves multiple bundles and the binding has no `bundleName` selector, `bundleRevision` is omitted and `bundleRevisionStatus: "ambiguous"` is recorded — audit dashboards can flag these for a manual fix.
 
 ## Failure modes
 
@@ -171,9 +210,9 @@ OPA evaluation is a network call, so the adapter defaults `previewSafe: false`.
 ## What this package does NOT do
 
 - It doesn't talk to your database. `buildInput` is yours.
-- It doesn't run an OPA server. You bring an OPA sidecar (or remote service) and inject a client.
+- It doesn't run an OPA server. You bring an OPA sidecar (or remote service) and inject an executor or client.
 - It doesn't ship Rego policies. You author and bundle those.
-- It doesn't (yet) capture `bundleRevision` / `decisionId`. The high-level OPA SDK discards those fields; capturing them requires using the SDK's low-level `OpaApiClient` directly. A future minor release will add a richer client interface for hosts that want that provenance.
+- It doesn't auto-discover bundle names. Bind one explicitly with `binding.bundleName` if OPA serves multiple bundles, or accept the `"ambiguous"` status in evidence.
 
 ## License
 

package/dist/index.cjs

@@ -2,6 +2,33 @@
 
 var crypto = require('crypto');
 
+// src/bundle-selector.ts
+function selectBundleRevision(execution, binding) {
+  if (typeof execution.bundleRevision === "string" && execution.bundleRevision.length > 0) {
+    return { bundleRevision: execution.bundleRevision };
+  }
+  const bundles = readBundles(execution.provenance);
+  if (!bundles) return {};
+  const names = Object.keys(bundles);
+  if (names.length === 0) return {};
+  if (binding.bundleName) {
+    const revision = bundles[binding.bundleName]?.revision;
+    return typeof revision === "string" && revision.length > 0 ? { bundleRevision: revision } : {};
+  }
+  if (names.length === 1) {
+    const only = names[0];
+    const revision = only !== void 0 ? bundles[only]?.revision : void 0;
+    return typeof revision === "string" && revision.length > 0 ? { bundleRevision: revision } : {};
+  }
+  return { bundleRevisionStatus: "ambiguous" };
+}
+function readBundles(provenance) {
+  if (!provenance || typeof provenance !== "object") return void 0;
+  const b = provenance.bundles;
+  if (!b || typeof b !== "object" || Array.isArray(b)) return void 0;
+  return b;
+}
+
 // src/decision-schema.ts
 var POLICY_RESULTS = ["pass", "warn", "block"];
 function parseOpaDecision(raw) {
@@ -27,8 +54,9 @@ function parseOpaDecision(raw) {
       if (err) return { ok: false, error: err };
     }
   }
-  if (d.factsUsed !== void 0 && !isPlainObject(d.factsUsed)) {
-    return { ok: false, error: "factsUsed must be an object when present" };
+  if (d.guidance !== void 0) {
+    const err = validateGuidance(d.guidance);
+    if (err) return { ok: false, error: err };
   }
   if (d.obligations !== void 0 && !isPlainObject(d.obligations)) {
     return { ok: false, error: "obligations must be an object when present" };
@@ -54,6 +82,68 @@ function validateConditionResult(value, index) {
   }
   return null;
 }
+function validateGuidance(value) {
+  if (!isPlainObject(value)) {
+    return "guidance must be an object when present";
+  }
+  const guidance = value;
+  if (guidance.summary !== void 0 && typeof guidance.summary !== "string") {
+    return "guidance.summary must be a string when present";
+  }
+  if (!Array.isArray(guidance.factsUsed)) {
+    return "guidance.factsUsed must be an array";
+  }
+  for (let i = 0; i < guidance.factsUsed.length; i += 1) {
+    const err = validatePolicyFact(guidance.factsUsed[i], i);
+    if (err) return err;
+  }
+  if (!Array.isArray(guidance.correctiveActions)) {
+    return "guidance.correctiveActions must be an array";
+  }
+  for (let i = 0; i < guidance.correctiveActions.length; i += 1) {
+    const err = validateCorrectiveAction(guidance.correctiveActions[i], i);
+    if (err) return err;
+  }
+  return null;
+}
+function validatePolicyFact(value, index) {
+  if (!isPlainObject(value)) {
+    return `guidance.factsUsed[${index}] must be an object`;
+  }
+  const fact = value;
+  if (typeof fact.name !== "string" || fact.name.length === 0) {
+    return `guidance.factsUsed[${index}].name must be a non-empty string`;
+  }
+  if (fact.label !== void 0 && typeof fact.label !== "string") {
+    return `guidance.factsUsed[${index}].label must be a string when present`;
+  }
+  return null;
+}
+function validateCorrectiveAction(value, index) {
+  if (!isPlainObject(value)) {
+    return `guidance.correctiveActions[${index}] must be an object`;
+  }
+  const action = value;
+  if (typeof action.label !== "string" || action.label.length === 0) {
+    return `guidance.correctiveActions[${index}].label must be a non-empty string`;
+  }
+  if (action.description !== void 0 && typeof action.description !== "string") {
+    return `guidance.correctiveActions[${index}].description must be a string when present`;
+  }
+  if (action.actionId !== void 0 && typeof action.actionId !== "string") {
+    return `guidance.correctiveActions[${index}].actionId must be a string when present`;
+  }
+  if (action.parameters !== void 0 && !isPlainObject(action.parameters)) {
+    return `guidance.correctiveActions[${index}].parameters must be an object when present`;
+  }
+  if (action.target !== void 0 && !isPlainObject(action.target)) {
+    return `guidance.correctiveActions[${index}].target must be an object when present`;
+  }
+  if (action.requiresConfirmation !== void 0 && typeof action.requiresConfirmation !== "boolean") {
+    return `guidance.correctiveActions[${index}].requiresConfirmation must be a boolean when present`;
+  }
+  return null;
+}
 function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -91,13 +181,14 @@ function createOpaPolicyEvaluator(options) {
     version: binding.version,
     previewSafe,
     evaluate: async (ctx) => {
-      const client = ctx.services?.[serviceKey];
-      if (!client || typeof client.evaluate !== "function") {
+      const service = ctx.services?.[serviceKey];
+      const transport = resolveTransport(service);
+      if (!transport) {
         return makeFailureOutcome(
           binding,
           engineVersion,
           "client_unavailable",
-          `No OPA client at ctx.services["${serviceKey}"]`,
+          `No OPA client/executor at ctx.services["${serviceKey}"]`,
           onError
         );
       }
@@ -118,9 +209,9 @@ function createOpaPolicyEvaluator(options) {
         inputHash = hashInput(input);
       } catch {
       }
-      let rawResult;
+      let execution;
       try {
-        rawResult = await client.evaluate(binding.decisionPath, input);
+        execution = await transport(binding.decisionPath, input);
       } catch (err) {
         return makeFailureOutcome(
           binding,
@@ -131,7 +222,7 @@ function createOpaPolicyEvaluator(options) {
           inputHash
         );
       }
-      const parsed = parseOpaDecision(rawResult);
+      const parsed = parseOpaDecision(execution.decision);
       if (!parsed.ok) {
         return makeFailureOutcome(
           binding,
@@ -139,13 +230,15 @@ function createOpaPolicyEvaluator(options) {
           "invalid_response",
           `OPA returned malformed decision: ${parsed.error}`,
           onError,
-          inputHash
+          inputHash,
+          execution
         );
       }
       return buildSuccessOutcome(
         binding,
         engineVersion,
         parsed.decision,
+        execution,
         inputHash,
         ctx,
         mapDecision
@@ -153,13 +246,29 @@ function createOpaPolicyEvaluator(options) {
     }
   };
 }
-function buildSuccessOutcome(binding, engineVersion, decision, inputHash, ctx, mapDecision) {
-  const mapped = mapDecision ? mapDecision(decision, ctx) : { result: decision.result, reason: decision.reason };
+function resolveTransport(service) {
+  if (!service || typeof service !== "object") return null;
+  const exec = service.execute;
+  if (typeof exec === "function") {
+    return (path, input) => service.execute(path, input);
+  }
+  const eval_ = service.evaluate;
+  if (typeof eval_ === "function") {
+    return async (path, input) => ({
+      decision: await service.evaluate(path, input)
+    });
+  }
+  return null;
+}
+function buildSuccessOutcome(binding, engineVersion, decision, execution, inputHash, ctx, mapDecision) {
+  const selection = selectBundleRevision(execution, binding);
+  const mapped = mapDecision ? mapDecision(decision, ctx, execution) : { result: decision.result, reason: decision.reason };
   return {
     policyId: binding.policyId,
     policyVersion: binding.version,
-    result: mapped.result,
-    reason: mapped.reason,
+    result: mapped.result ?? decision.result,
+    reason: mapped.reason ?? decision.reason,
+    guidance: mapped.guidance ?? decision.guidance,
     metadata: {
       ...mapped.metadata ?? {},
       opaDecision: decision
@@ -171,30 +280,48 @@ function buildSuccessOutcome(binding, engineVersion, decision, inputHash, ctx, m
       dispatchPath: ["code"],
       engine: {
         name: ENGINE_NAME,
-        version: engineVersion,
+        version: execution.opaVersion ?? engineVersion,
         metadata: stripUndefined({
           decisionPath: binding.decisionPath,
           regoPackage: binding.regoPackage,
           inputHash,
+          decisionId: execution.decisionId,
+          bundleName: binding.bundleName,
+          bundleRevision: selection.bundleRevision,
+          bundleRevisionStatus: selection.bundleRevisionStatus,
+          provenance: execution.provenance,
           conditionResults: decision.conditionResults,
-          factsUsed: decision.factsUsed,
           obligations: decision.obligations
         })
       }
     }
   };
 }
-function makeFailureOutcome(binding, engineVersion, error, reason, onError, inputHash) {
+function makeFailureOutcome(binding, engineVersion, error, reason, onError, inputHash, execution) {
   if (onError === "throw") {
     const err = new Error(reason);
     err.kind = error;
     throw err;
   }
+  const selection = execution ? selectBundleRevision(execution, binding) : {};
   return {
     policyId: binding.policyId,
     policyVersion: binding.version,
     result: "block",
     reason,
+    guidance: {
+      summary: "OPA policy evaluation could not complete.",
+      factsUsed: [
+        { name: "opaFailureKind", value: error, label: "Failure kind" },
+        { name: "decisionPath", value: binding.decisionPath, label: "Decision path" }
+      ],
+      correctiveActions: [
+        {
+          label: "Check OPA policy engine",
+          description: "Verify the OPA service is reachable, serving the expected bundle, and returning the Fabric OPA decision shape."
+        }
+      ]
+    },
     metadata: {
       opaError: error
     },
@@ -205,11 +332,16 @@ function makeFailureOutcome(binding, engineVersion, error, reason, onError, inpu
       dispatchPath: ["code"],
       engine: {
         name: ENGINE_NAME,
-        version: engineVersion,
+        version: execution?.opaVersion ?? engineVersion,
         metadata: stripUndefined({
           decisionPath: binding.decisionPath,
           regoPackage: binding.regoPackage,
           inputHash,
+          decisionId: execution?.decisionId,
+          bundleName: binding.bundleName,
+          bundleRevision: selection.bundleRevision,
+          bundleRevisionStatus: selection.bundleRevisionStatus,
+          provenance: execution?.provenance,
           error,
           errorReason: reason
         })
@@ -234,9 +366,77 @@ function formatError(err) {
   }
 }
 
+// src/executor-client.ts
+function executorFromOpaClient(client) {
+  return {
+    async execute(path, input) {
+      const decision = await client.evaluate(path, input);
+      return { decision };
+    }
+  };
+}
+
+// src/executor-http.ts
+function executorFromOpaHttp(opts) {
+  const baseUrl = stripTrailingSlash(opts.baseUrl);
+  const provenance = opts.provenance ?? true;
+  const customFetch = opts.fetch;
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json",
+    ...opts.headers ?? {}
+  };
+  return {
+    async execute(path, input) {
+      const fetchImpl = customFetch ?? globalThis.fetch;
+      if (typeof fetchImpl !== "function") {
+        throw new Error(
+          "executorFromOpaHttp: no fetch implementation available. Pass `fetch` in options or run on a runtime with `globalThis.fetch`."
+        );
+      }
+      const url = `${baseUrl}/v1/data/${stripLeadingSlash(path)}${provenance ? "?provenance=true" : ""}`;
+      const response = await fetchImpl(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({ input })
+      });
+      if (!response.ok) {
+        const text = await safeReadText(response);
+        throw new Error(`OPA HTTP ${response.status} at ${url}: ${truncate(text, 500)}`);
+      }
+      const body = await response.json();
+      return {
+        decision: body.result,
+        decisionId: body.decision_id,
+        opaVersion: body.provenance?.version,
+        provenance: body.provenance
+      };
+    }
+  };
+}
+function stripTrailingSlash(s) {
+  return s.replace(/\/+$/, "");
+}
+function stripLeadingSlash(s) {
+  return s.replace(/^\/+/, "");
+}
+async function safeReadText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "<unreadable body>";
+  }
+}
+function truncate(s, max) {
+  return s.length <= max ? s : `${s.slice(0, max)}\u2026`;
+}
+
 exports.createOpaPolicyEvaluator = createOpaPolicyEvaluator;
 exports.defaultHashInput = defaultHashInput;
+exports.executorFromOpaClient = executorFromOpaClient;
+exports.executorFromOpaHttp = executorFromOpaHttp;
 exports.parseOpaDecision = parseOpaDecision;
+exports.selectBundleRevision = selectBundleRevision;
 exports.stableStringify = stableStringify;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map