@orygn/opa-mcp 0.0.0 → 0.1.0

package/dist/tools/helpers/generate-test-skeleton.js

@@ -0,0 +1,93 @@
+/**
+ * `rego_generate_test_skeleton` — given a policy, parse its AST and
+ * emit a `*_test.rego` skeleton with one stub test per rule.
+ *
+ * The skeleton is mechanical — the agent fills in real assertions.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoGenerateTestSkeletonInput = {
+    source: z.string().min(1).describe('Rego source to generate tests for.'),
+};
+function packageNameFromAst(ast) {
+    const parts = ast.package?.path ?? [];
+    // The first entry is always `data`. Skip it.
+    return parts
+        .slice(1)
+        .map((p) => (typeof p.value === 'string' ? p.value : ''))
+        .filter(Boolean)
+        .join('.');
+}
+function ruleNameFromAst(rule) {
+    if (rule.head?.name)
+        return rule.head.name;
+    const ref = rule.head?.ref;
+    if (Array.isArray(ref) && ref.length > 0) {
+        return ref
+            .map((p) => (typeof p.value === 'string' ? p.value : ''))
+            .filter(Boolean)
+            .join('.');
+    }
+    return undefined;
+}
+function makeSkeleton(packageName, ruleNames) {
+    const lines = [];
+    const testPackage = packageName ? `${packageName}_test` : 'main_test';
+    lines.push(`package ${testPackage}`);
+    lines.push('');
+    lines.push('import rego.v1');
+    if (packageName) {
+        lines.push(`import data.${packageName}`);
+    }
+    lines.push('');
+    for (const name of ruleNames) {
+        const testName = `test_${name.replace(/[^a-zA-Z0-9_]/g, '_')}`;
+        const ruleRef = packageName ? `${packageName}.${name}` : name;
+        lines.push(`# TODO: replace placeholder input with a realistic case.`);
+        lines.push(`${testName} if {`);
+        lines.push(`\t# Arrange`);
+        lines.push(`\tinput := {}`);
+        lines.push('');
+        lines.push(`\t# Act / Assert`);
+        lines.push(`\tdata.${ruleRef} with input as input`);
+        lines.push(`}`);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+export function registerRegoGenerateTestSkeleton(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_generate_test_skeleton', {
+        title: 'Generate Rego test skeleton',
+        description: 'Generate a `*_test.rego` skeleton from a policy. Parses the AST, finds each rule, and emits one stub test per rule. The agent fills in realistic inputs and assertions.',
+        inputSchema: RegoGenerateTestSkeletonInput,
+    }, async ({ source }) => {
+        return withToolEnvelope(config, async () => {
+            const result = await opa.parse({ source });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa parse rejected the source.', {
+                    details: { stderr: result.stderr.trim() },
+                });
+            }
+            const ast = tryParseJson(result.stdout);
+            if (ast === undefined) {
+                return err('UNKNOWN_ERROR', 'opa parse produced no parseable JSON.');
+            }
+            const packageName = packageNameFromAst(ast);
+            const ruleNames = Array.from(new Set((ast.rules ?? [])
+                .map(ruleNameFromAst)
+                .filter((n) => typeof n === 'string' && n.length > 0)));
+            if (ruleNames.length === 0) {
+                return err('INVALID_INPUT', 'No rules found in the source — nothing to test.');
+            }
+            const testFile = makeSkeleton(packageName, ruleNames);
+            return ok({ testFile, ruleNames });
+        });
+    });
+}
+//# sourceMappingURL=generate-test-skeleton.js.map

package/dist/tools/helpers/generate-test-skeleton.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-test-skeleton.js","sourceRoot":"","sources":["../../../src/tools/helpers/generate-test-skeleton.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,6BAA6B,GAAG;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CACzE,CAAC;AAoBF,SAAS,kBAAkB,CAAC,GAAc;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,6CAA6C;IAC7C,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,SAAmB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAiB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,yKAAyK;QAC3K,WAAW,EAAE,6BAA6B;KAC3C,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAiC,MAAM,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAY,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;iBACd,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CACrE,CACF,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtD,OAAO,EAAE,CAAiC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Category E — Higher-level helpers.
+ *
+ * These tools compose lower-level primitives or do mechanical AST
+ * analysis to provide endpoints agents can call directly without
+ * stitching together rego_eval / rego_check / rego_parse_ast
+ * themselves.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerHelperTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/helpers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK3E"}

package/dist/tools/helpers/index.js

@@ -0,0 +1,11 @@
+import { registerRegoDescribePolicy } from './describe-policy.js';
+import { registerRegoExplainDecision } from './explain-decision.js';
+import { registerRegoGenerateTestSkeleton } from './generate-test-skeleton.js';
+import { registerRegoSuggestFix } from './suggest-fix.js';
+export function registerHelperTools(server, config) {
+    registerRegoExplainDecision(server, config);
+    registerRegoGenerateTestSkeleton(server, config);
+    registerRegoDescribePolicy(server, config);
+    registerRegoSuggestFix(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/helpers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC"}

package/dist/tools/helpers/suggest-fix.d.ts

@@ -0,0 +1,15 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface FixSuggestion {
+    code: string;
+    message: string;
+    suggestion: string;
+    confidence: 'high' | 'medium' | 'low';
+    patch?: string;
+}
+export interface RegoSuggestFixOutput {
+    suggestions: FixSuggestion[];
+}
+export declare function registerRegoSuggestFix(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=suggest-fix.d.ts.map

package/dist/tools/helpers/suggest-fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest-fix.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/suggest-fix.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAyB9C,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkC9E"}

package/dist/tools/helpers/suggest-fix.js

@@ -0,0 +1,119 @@
+/**
+ * `rego_suggest_fix` — propose mechanical fixes for common Rego
+ * compile errors and Regal lint findings.
+ *
+ * The tool is deliberately rule-based — it doesn't call out to an LLM.
+ * Common error codes have well-known mechanical fixes; we surface
+ * those, and for everything else we hand back a structured "no
+ * automated fix available, here's what we know" envelope so the agent
+ * can reason on it.
+ */
+import { z } from 'zod';
+import { ok } from '../../lib/errors.js';
+import { withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoSuggestFixInput = {
+    diagnostics: z
+        .array(z.object({
+        code: z.string().describe('Diagnostic code (e.g. "rego_unsafe_var_error").'),
+        message: z.string().describe('Diagnostic message.'),
+        location: z
+            .object({
+            file: z.string().optional(),
+            row: z.number().optional(),
+            col: z.number().optional(),
+        })
+            .optional(),
+        title: z.string().optional().describe('Title (Regal violations).'),
+        category: z.string().optional().describe('Category (Regal violations).'),
+    }))
+        .min(1)
+        .describe('Diagnostics from rego_check or rego_lint.'),
+};
+const KNOWN_FIXES = [
+    {
+        match: (code) => code === 'rego_unsafe_var_error',
+        suggest: (message) => {
+            const varMatch = /var (\S+) is unsafe/.exec(message);
+            const varName = varMatch?.[1];
+            return {
+                suggestion: varName
+                    ? `The variable \`${varName}\` is referenced but never bound. Add a clause that defines it (assignment, comprehension, or pattern match) before it is used.`
+                    : 'A variable is referenced before being bound. Add a binding clause earlier in the rule body.',
+                confidence: 'high',
+            };
+        },
+    },
+    {
+        match: (code) => code === 'rego_parse_error',
+        suggest: () => ({
+            suggestion: 'The source did not parse. Run `rego_format` to confirm the syntax is well-formed, then `rego_check` for the precise location.',
+            confidence: 'medium',
+        }),
+    },
+    {
+        match: (code) => code === 'rego_type_error',
+        suggest: (message) => ({
+            suggestion: `Type mismatch: ${message.replace(/^rego_type_error:\s*/, '')}. Reconcile the operand types — most often this is comparing a string with a number, or indexing a value with the wrong key shape.`,
+            confidence: 'medium',
+        }),
+    },
+    {
+        match: (code) => code === 'rego_recursion_error',
+        suggest: () => ({
+            suggestion: 'A rule references itself directly or indirectly. Restructure so each rule depends only on documents lower in the DAG, or introduce an intermediate rule that breaks the cycle.',
+            confidence: 'high',
+        }),
+    },
+    {
+        match: (code) => code === 'rego_compile_error',
+        suggest: () => ({
+            suggestion: 'A compile error occurred. Run `rego_check` for the structured diagnostic — the message text usually points at the precise issue (often an unresolved import or capabilities mismatch).',
+            confidence: 'low',
+        }),
+    },
+    // Regal style/idiom suggestions
+    {
+        match: (code) => code === 'print-or-trace-call',
+        suggest: () => ({
+            suggestion: 'Remove the `print(...)` or `trace(...)` call before shipping — it slows evaluation and is rarely intended in production policy.',
+            confidence: 'high',
+        }),
+    },
+    {
+        match: (code) => code === 'directory-package-mismatch',
+        suggest: () => ({
+            suggestion: 'The Rego file lives in a directory that does not match its `package` declaration. Move the file or rename the package so they agree (e.g., `package foo.bar` belongs in `foo/bar/`).',
+            confidence: 'high',
+        }),
+    },
+];
+export function registerRegoSuggestFix(server, config) {
+    server.registerTool('rego_suggest_fix', {
+        title: 'Suggest fix for Rego diagnostics',
+        description: 'Map common Rego compile errors and Regal lint findings to mechanical fix suggestions. Pass diagnostics from `rego_check` or `rego_lint`. Returns one suggestion per input diagnostic; confidence is `high` for well-known patterns, `medium` for partial matches, `low` for everything else.',
+        inputSchema: RegoSuggestFixInput,
+    }, ({ diagnostics }) => {
+        return withToolEnvelope(config, () => {
+            const suggestions = diagnostics.map((diag) => {
+                const code = diag.code || diag.title || '';
+                const matched = KNOWN_FIXES.find((f) => f.match(code, diag.message));
+                if (matched) {
+                    const partial = matched.suggest(diag.message);
+                    return {
+                        code,
+                        message: diag.message,
+                        ...partial,
+                    };
+                }
+                return {
+                    code,
+                    message: diag.message,
+                    suggestion: 'No automated suggestion available for this diagnostic. Read the message text and the location for context — most Rego errors have an obvious mechanical fix once the trigger is identified.',
+                    confidence: 'low',
+                };
+            });
+            return Promise.resolve(ok({ suggestions }));
+        });
+    });
+}
+//# sourceMappingURL=suggest-fix.js.map

package/dist/tools/helpers/suggest-fix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest-fix.js","sourceRoot":"","sources":["../../../src/tools/helpers/suggest-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D,MAAM,mBAAmB,GAAG;IAC1B,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;QAC5E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnD,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC3B,CAAC;aACD,QAAQ,EAAE;QACb,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KACzE,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,2CAA2C,CAAC;CACzD,CAAC;AAUF,MAAM,WAAW,GAGZ;IACH;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,uBAAuB;QACjD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO;gBACL,UAAU,EAAE,OAAO;oBACjB,CAAC,CAAC,kBAAkB,OAAO,iIAAiI;oBAC5J,CAAC,CAAC,6FAA6F;gBACjG,UAAU,EAAE,MAAM;aACnB,CAAC;QACJ,CAAC;KACF;IACD;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB;QAC5C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,UAAU,EACR,+HAA+H;YACjI,UAAU,EAAE,QAAQ;SACrB,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,iBAAiB;QAC3C,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrB,UAAU,EAAE,kBAAkB,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,oIAAoI;YAC7M,UAAU,EAAE,QAAQ;SACrB,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,sBAAsB;QAChD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,UAAU,EACR,gLAAgL;YAClL,UAAU,EAAE,MAAM;SACnB,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oBAAoB;QAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,UAAU,EACR,wLAAwL;YAC1L,UAAU,EAAE,KAAK;SAClB,CAAC;KACH;IACD,gCAAgC;IAChC;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,qBAAqB;QAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,UAAU,EACR,iIAAiI;YACnI,UAAU,EAAE,MAAM;SACnB,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,4BAA4B;QACtD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,UAAU,EACR,sLAAsL;YACxL,UAAU,EAAE,MAAM;SACnB,CAAC;KACH;CACF,CAAC;AAMF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,8RAA8R;QAChS,WAAW,EAAE,mBAAmB;KACjC,EACD,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;QAClB,OAAO,gBAAgB,CAAuB,MAAM,EAAE,GAAG,EAAE;YACzD,MAAM,WAAW,GAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACrE,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC9C,OAAO;wBACL,IAAI;wBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,GAAG,OAAO;qBACX,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,UAAU,EACR,6LAA6L;oBAC/L,UAAU,EAAE,KAAc;iBAC3B,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAuB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Tool registration entry point.
+ *
+ * Each category module exports a `register*` function. They're called
+ * here in order; ordering doesn't affect behavior but keeps the
+ * declaration site tidy.
+ *
+ * Tools planned (see SPEC.md / per-tool docs):
+ *   Category A — Authoring:        rego_format, rego_check, rego_lint,
+ *                                   rego_parse_ast, rego_inspect,
+ *                                   rego_capabilities, rego_deps
+ *   Category B — Evaluation:       rego_eval, rego_eval_with_explain,
+ *                                   rego_eval_with_profile,
+ *                                   rego_eval_with_coverage, rego_test,
+ *                                   rego_bench, rego_compile_query
+ *   Category C — Bundles:          opa_bundle_build, opa_bundle_sign
+ *   Category D — Server mgmt:      opa_list_policies, opa_get_policy,
+ *                                   opa_put_policy, opa_delete_policy,
+ *                                   opa_get_data, opa_put_data,
+ *                                   opa_patch_data, opa_query_decision,
+ *                                   opa_compile_query, opa_health,
+ *                                   opa_status, opa_config
+ *   Category E — Helpers:          rego_explain_decision,
+ *                                   rego_generate_test_skeleton,
+ *                                   rego_describe_policy,
+ *                                   rego_suggest_fix
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../config.js';
+export declare function registerTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAO3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMrE"}

package/dist/tools/index.js

@@ -0,0 +1,13 @@
+import { registerAuthoringTools } from './authoring/index.js';
+import { registerBundleTools } from './bundles/index.js';
+import { registerEvaluationTools } from './evaluation/index.js';
+import { registerHelperTools } from './helpers/index.js';
+import { registerServerManagementTools } from './server-management/index.js';
+export function registerTools(server, config) {
+    registerAuthoringTools(server, config);
+    registerEvaluationTools(server, config);
+    registerBundleTools(server, config);
+    registerServerManagementTools(server, config);
+    registerHelperTools(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/tools/server-management/_shared.d.ts

@@ -0,0 +1,9 @@
+import type { ToolEnvelope, ToolErrorCode } from '../../types.js';
+/**
+ * Translate an exception thrown by OpaClient into a structured error
+ * envelope. `notFoundCode` lets a tool override the default 404
+ * mapping (which is generic) with something specific like
+ * `POLICY_NOT_FOUND`.
+ */
+export declare function mapOpaClientError(e: unknown, notFoundCode?: ToolErrorCode): ToolEnvelope<never>;
+//# sourceMappingURL=_shared.d.ts.map

package/dist/tools/server-management/_shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/_shared.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,CAAC,EAAE,OAAO,EACV,YAAY,GAAE,aAA+B,GAC5C,YAAY,CAAC,KAAK,CAAC,CA0BrB"}

package/dist/tools/server-management/_shared.js

@@ -0,0 +1,41 @@
+/**
+ * Shared helpers for the server-management tool category. Maps the
+ * OpaClient's exception classes to the structured error codes the tool
+ * envelope contract defines.
+ */
+import { err } from '../../lib/errors.js';
+import { OpaAuthError, OpaHttpError, OpaUnreachableError } from '../../lib/opa-client.js';
+/**
+ * Translate an exception thrown by OpaClient into a structured error
+ * envelope. `notFoundCode` lets a tool override the default 404
+ * mapping (which is generic) with something specific like
+ * `POLICY_NOT_FOUND`.
+ */
+export function mapOpaClientError(e, notFoundCode = 'UNKNOWN_ERROR') {
+    if (e instanceof OpaUnreachableError) {
+        return err('OPA_UNREACHABLE', `OPA server unreachable at ${e.url}`, {
+            hint: 'Confirm OPA_URL points at a running OPA server (e.g. `curl $OPA_URL/health`).',
+            details: { url: e.url },
+        });
+    }
+    if (e instanceof OpaAuthError) {
+        return err('OPA_AUTH_FAILED', 'OPA rejected the request with 401 Unauthorized.', {
+            hint: 'Set OPA_TOKEN to a valid bearer token, or remove the auth requirement on the OPA server.',
+        });
+    }
+    if (e instanceof OpaHttpError) {
+        if (e.status === 404) {
+            return err(notFoundCode, `OPA returned 404 Not Found.`, {
+                details: { status: e.status, body: e.body },
+            });
+        }
+        return err('UNKNOWN_ERROR', `OPA returned HTTP ${e.status}.`, {
+            details: { status: e.status, body: e.body },
+        });
+    }
+    const message = e instanceof Error ? e.message : 'Unknown error';
+    return err('UNKNOWN_ERROR', message, {
+        details: e instanceof Error ? { stack: e.stack } : { value: e },
+    });
+}
+//# sourceMappingURL=_shared.js.map

package/dist/tools/server-management/_shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../../src/tools/server-management/_shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAG1F;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAU,EACV,eAA8B,eAAe;IAE7C,IAAI,CAAC,YAAY,mBAAmB,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,GAAG,EAAE,EAAE;YAClE,IAAI,EAAE,+EAA+E;YACrF,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;YAC/E,IAAI,EAAE,0FAA0F;SACjG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,YAAY,EAAE,6BAA6B,EAAE;gBACtD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,MAAM,GAAG,EAAE;YAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,OAAO,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE;QACnC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/server-management/data.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerDataTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=data.d.ts.map

package/dist/tools/server-management/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/data.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAa9C,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0FzE"}

package/dist/tools/server-management/data.js

@@ -0,0 +1,90 @@
+/**
+ * Data-document tools: opa_get_data, opa_put_data, opa_patch_data.
+ */
+import { z } from 'zod';
+import { OpaClient } from '../../lib/opa-client.js';
+import { ok } from '../../lib/errors.js';
+import { withToolEnvelope } from '../../lib/tool-helpers.js';
+import { mapOpaClientError } from './_shared.js';
+function dataPath(path) {
+    // Strip leading "data." or "/" — server always prepends /v1/data/.
+    const stripped = path.replace(/^data\./, '').replace(/^\/+/, '');
+    // Convert dotted form to slash form: "users.alice" -> "users/alice".
+    return `/v1/data/${stripped.replace(/\./g, '/')}`;
+}
+export function registerDataTools(server, config) {
+    const opa = new OpaClient(config);
+    server.registerTool('opa_get_data', {
+        title: 'Read data from OPA',
+        description: "Read a path from OPA's data hierarchy. The `path` argument may be in dotted form (`users.alice`) or slash form (`users/alice`).",
+        inputSchema: {
+            path: z.string().min(1).describe('Data path under `data.`, e.g. "users" or "users/alice".'),
+        },
+    }, async ({ path }) => {
+        return withToolEnvelope(config, async () => {
+            try {
+                const data = await opa.request({
+                    method: 'GET',
+                    path: dataPath(path),
+                });
+                return ok({ result: data.result });
+            }
+            catch (e) {
+                return mapOpaClientError(e);
+            }
+        });
+    });
+    server.registerTool('opa_put_data', {
+        title: 'Write data to OPA',
+        description: 'Write or replace a value at the given data path. Body is sent as JSON.',
+        inputSchema: {
+            path: z.string().min(1).describe('Data path to write to.'),
+            value: z.unknown().describe('JSON value to store at this path.'),
+        },
+    }, async ({ path, value }) => {
+        return withToolEnvelope(config, async () => {
+            try {
+                await opa.request({
+                    method: 'PUT',
+                    path: dataPath(path),
+                    body: value,
+                });
+                return ok({ path, written: true });
+            }
+            catch (e) {
+                return mapOpaClientError(e);
+            }
+        });
+    });
+    server.registerTool('opa_patch_data', {
+        title: 'Patch data on OPA',
+        description: 'Apply a JSON Patch (RFC 6902) to the data document. Each operation is `{ op, path, value? }`.',
+        inputSchema: {
+            path: z.string().min(1).describe('Data path the patch is applied to. Use "" for the root.'),
+            operations: z
+                .array(z.object({
+                op: z.enum(['add', 'remove', 'replace']),
+                path: z.string(),
+                value: z.unknown().optional(),
+            }))
+                .min(1)
+                .describe('Array of JSON Patch operations.'),
+        },
+    }, async ({ path, operations }) => {
+        return withToolEnvelope(config, async () => {
+            try {
+                await opa.request({
+                    method: 'PATCH',
+                    path: dataPath(path),
+                    body: operations,
+                    headers: { 'Content-Type': 'application/json-patch+json' },
+                });
+                return ok({ path, patched: true });
+            }
+            catch (e) {
+                return mapOpaClientError(e);
+            }
+        });
+    });
+}
+//# sourceMappingURL=data.js.map

package/dist/tools/server-management/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/tools/server-management/data.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,mEAAmE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,qEAAqE;IACrE,OAAO,YAAY,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,iIAAiI;QACnI,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;SAC5F;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACjB,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;iBACrB,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjE;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACxB,OAAO,gBAAgB,CAAqC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,KAAK;iBACZ,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,+FAA+F;QACjG,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;YAC3F,UAAU,EAAE,CAAC;iBACV,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;gBACP,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;aAC9B,CAAC,CACH;iBACA,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iCAAiC,CAAC;SAC/C;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE;QAC7B,OAAO,gBAAgB,CAAqC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,EAAE,cAAc,EAAE,6BAA6B,EAAE;iBAC3D,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/decisions.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerDecisionTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/tools/server-management/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAW9C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsF7E"}

package/dist/tools/server-management/decisions.js

@@ -0,0 +1,87 @@
+/**
+ * Decision-query tools that talk to a running OPA over REST:
+ * opa_query_decision, opa_compile_query.
+ */
+import { z } from 'zod';
+import { OpaClient } from '../../lib/opa-client.js';
+import { ok } from '../../lib/errors.js';
+import { withToolEnvelope } from '../../lib/tool-helpers.js';
+import { mapOpaClientError } from './_shared.js';
+function dataPath(path) {
+    const stripped = path.replace(/^data\./, '').replace(/^\/+/, '');
+    return `/v1/data/${stripped.replace(/\./g, '/')}`;
+}
+export function registerDecisionTools(server, config) {
+    const opa = new OpaClient(config);
+    server.registerTool('opa_query_decision', {
+        title: 'Query OPA decision',
+        description: 'Evaluate a decision against the running OPA server. POSTs to the data path with `{input}` and returns whatever the rule produces. Use this to ask the server "given this input, what does data.X.allow say?"',
+        inputSchema: {
+            path: z
+                .string()
+                .min(1)
+                .describe('Decision path under `data.`, e.g. "rbac/allow" or "rbac.allow".'),
+            input: z.unknown().optional().describe('Input document to evaluate against.'),
+            explain: z
+                .enum(['notes', 'fails', 'full', 'debug'])
+                .optional()
+                .describe('Include a trace at the requested level.'),
+            metrics: z.boolean().optional().describe('Include metrics in the response.'),
+        },
+    }, async ({ path, input, explain, metrics }) => {
+        return withToolEnvelope(config, async () => {
+            try {
+                const query = {};
+                if (explain)
+                    query['explain'] = explain;
+                if (metrics)
+                    query['metrics'] = true;
+                const data = await opa.request({
+                    method: 'POST',
+                    path: dataPath(path),
+                    body: input !== undefined ? { input } : {},
+                    query,
+                });
+                return ok({
+                    result: data.result,
+                    explanation: data.explanation,
+                    metrics: data.metrics,
+                });
+            }
+            catch (e) {
+                return mapOpaClientError(e);
+            }
+        });
+    });
+    server.registerTool('opa_compile_query', {
+        title: 'Compile (partially evaluate) a query on OPA',
+        description: "Send a query to the OPA server's `/v1/compile` endpoint for partial evaluation. Returns the residual query — what remains after substituting in everything that's known.",
+        inputSchema: {
+            query: z.string().min(1).describe('Rego query to compile, e.g. "data.rbac.allow == true".'),
+            input: z.unknown().optional().describe('Optional partial input document.'),
+            unknowns: z
+                .array(z.string())
+                .optional()
+                .describe('Refs to treat as unknown (default: ["input"]).'),
+        },
+    }, async ({ query, input, unknowns }) => {
+        return withToolEnvelope(config, async () => {
+            try {
+                const body = { query };
+                if (input !== undefined)
+                    body['input'] = input;
+                body['unknowns'] = unknowns?.length ? unknowns : ['input'];
+                const data = await opa.request({
+                    method: 'POST',
+                    path: '/v1/compile',
+                    body,
+                });
+                return ok({ result: data.result });
+            }
+            catch (e) {
+                return mapOpaClientError(e);
+            }
+        });
+    });
+}
+//# sourceMappingURL=decisions.js.map

package/dist/tools/server-management/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,OAAO,YAAY,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,8MAA8M;QAChN,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAC7E,OAAO,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;iBACzC,QAAQ,EAAE;iBACV,QAAQ,CAAC,yCAAyC,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;SAC7E;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1C,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,KAAK,GAAqC,EAAE,CAAC;gBACnD,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;gBACxC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAI3B;oBACD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;oBAC1C,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,0KAA0K;QAC5K,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC3F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC1E,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,gDAAgD,CAAC;SAC9D;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,CAAC;gBAChD,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;gBAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa;oBACnB,IAAI;iBACL,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Category D — OPA server management.
+ *
+ * Tools in this category talk to a running OPA server via its REST
+ * API. They require `OPA_URL` to point at a reachable server (default
+ * `http://localhost:8181`).
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerServerManagementTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/server-management/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAKrF"}