@orygn/opa-mcp 0.0.0 → 0.1.0

package/dist/lib/opa-cli.js

@@ -0,0 +1,283 @@
+/**
+ * Wrapper around the local `opa` binary.
+ *
+ * Tool implementations call into this module rather than spawning
+ * subprocesses directly. Every method here builds argv with the flags
+ * `opa` actually expects so each tool above can ignore CLI minutiae and
+ * just describe its inputs.
+ *
+ * Inline Rego source is always written to a temp file before invocation.
+ * The `-` (read-from-stdin) convention some opa subcommands document is
+ * unreliable on Windows, where `-` is treated as a literal filename.
+ *
+ * The methods do not parse stdout into typed result objects — different
+ * tools need different shapes of the same output and a one-size parser
+ * would force conversions both ways. Stdout is JSON whenever
+ * `--format=json` is set, and tools call `JSON.parse` on it themselves.
+ */
+import { randomUUID } from 'node:crypto';
+import { rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runBinary } from './subprocess.js';
+/**
+ * Wrapper around the local `opa` binary.
+ *
+ * Methods do not throw on `opa` errors — non-zero exit codes are
+ * surfaced on the returned `SpawnResult` so tools can map them to
+ * structured error envelopes at their layer. They DO throw on
+ * caller-side bugs (e.g. an empty `paths` array passed where one is
+ * required), since those represent contract violations.
+ */
+export class OpaCli {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify the binary is present and report its version.
+     * Returns null if the binary is unreachable or output is malformed.
+     */
+    async version() {
+        const result = await this.run(['version']);
+        if (result.exitCode !== 0)
+            return null;
+        const match = /Version:\s*(\S+)/i.exec(result.stdout);
+        return match?.[1] ?? null;
+    }
+    // ─── Authoring ───────────────────────────────────────────────────────
+    /**
+     * Format Rego source. Stdout contains the formatted output. Reports
+     * `exitCode: 0` even when no changes are needed — callers compare
+     * input vs output to detect a no-op.
+     */
+    async fmt(input) {
+        return this.withTempSource(input.source, (path) => this.run(['fmt', path]));
+    }
+    /**
+     * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
+     * policy is valid. On failure, `exitCode` is non-zero and the JSON
+     * error report is written to **stderr** (this is OPA's actual
+     * behavior — tools must read `stderr`, not `stdout`, for `check`
+     * diagnostics). Either inline `source` or one or more `paths` must be
+     * provided.
+     */
+    async check(input) {
+        if (!input.source && !input.paths?.length) {
+            throw new Error('opa check requires either source or at least one path');
+        }
+        const args = ['check', '--format=json'];
+        if (input.strict)
+            args.push('--strict');
+        if (input.capabilities)
+            args.push('--capabilities', input.capabilities);
+        if (input.schemaDir)
+            args.push('--schema', input.schemaDir);
+        if (input.source !== undefined) {
+            return this.withTempSource(input.source, (path) => this.run([...args, path]));
+        }
+        args.push(...(input.paths ?? []));
+        return this.run(args);
+    }
+    /**
+     * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
+     */
+    async parse(input) {
+        return this.withTempSource(input.source, (path) => this.run(['parse', '--format=json', path]));
+    }
+    /**
+     * Inspect a bundle, directory, or single Rego file. Returns its
+     * packages, namespaces, manifest, and annotations as JSON on stdout.
+     */
+    async inspect(input) {
+        return this.run(['inspect', '--format=json', input.target]);
+    }
+    /**
+     * Print available capabilities. With `current=true`, prints the
+     * capabilities of the running OPA. With a `version`, prints those of
+     * a specific named version. Without either, lists available named
+     * versions.
+     */
+    async capabilities(input = {}) {
+        const args = ['capabilities'];
+        if (input.current)
+            args.push('--current');
+        if (input.version)
+            args.push('--version', input.version);
+        return this.run(args);
+    }
+    /**
+     * Static dependency analysis for a Rego ref. Stdout is JSON with the
+     * `base` and `virtual` document references the ref depends on.
+     */
+    async deps(input) {
+        if (input.paths.length === 0) {
+            throw new Error('opa deps requires at least one path');
+        }
+        const args = ['deps', '--format=json'];
+        for (const path of input.paths) {
+            args.push('--data', path);
+        }
+        args.push(input.ref);
+        return this.run(args);
+    }
+    // ─── Evaluation ──────────────────────────────────────────────────────
+    /**
+     * Evaluate a query against a policy + input. Stdout is JSON with the
+     * standard `{result: [...]}` shape (plus optional explain, profile,
+     * coverage, and metrics sections).
+     */
+    async eval(input) {
+        // Inline source becomes a temp file added to --data.
+        if (input.source !== undefined) {
+            const { source, ...rest } = input;
+            void source;
+            return this.withTempSource(input.source, (sourcePath) => this.eval({
+                ...rest,
+                paths: [...(input.paths ?? []), sourcePath],
+            }));
+        }
+        const args = ['eval', '--format=json'];
+        for (const path of input.paths ?? [])
+            args.push('--data', path);
+        if (input.inputPath)
+            args.push('--input', input.inputPath);
+        if (input.explain)
+            args.push('--explain', input.explain);
+        if (input.profile)
+            args.push('--profile');
+        if (input.coverage)
+            args.push('--coverage');
+        if (input.metrics)
+            args.push('--metrics');
+        if (input.instrument)
+            args.push('--instrument');
+        if (input.partial)
+            args.push('--partial');
+        for (const ref of input.unknowns ?? [])
+            args.push('--unknowns', ref);
+        if (input.strictBuiltinErrors)
+            args.push('--strict-builtin-errors');
+        if (input.capabilities)
+            args.push('--capabilities', input.capabilities);
+        if (input.schemaDir)
+            args.push('--schema', input.schemaDir);
+        let stdin;
+        if (input.input !== undefined) {
+            args.push('--stdin-input');
+            stdin = JSON.stringify(input.input);
+        }
+        args.push(input.query);
+        return this.run(args, stdin);
+    }
+    /**
+     * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
+     */
+    async test(input) {
+        if (input.paths.length === 0) {
+            throw new Error('opa test requires at least one path');
+        }
+        const args = ['test', '--format=json'];
+        if (input.verbose)
+            args.push('--verbose');
+        if (input.coverage)
+            args.push('--coverage');
+        if (input.bench)
+            args.push('--bench');
+        if (input.runPattern)
+            args.push('--run', input.runPattern);
+        args.push(...input.paths);
+        return this.run(args);
+    }
+    /**
+     * Benchmark a query. Stdout is JSON with iteration timing statistics.
+     */
+    async bench(input) {
+        const args = ['bench', '--format=json'];
+        for (const path of input.paths ?? [])
+            args.push('--data', path);
+        if (input.inputPath)
+            args.push('--input', input.inputPath);
+        if (input.count !== undefined)
+            args.push('--count', String(input.count));
+        let stdin;
+        if (input.input !== undefined) {
+            args.push('--stdin-input');
+            stdin = JSON.stringify(input.input);
+        }
+        args.push(input.query);
+        return this.run(args, stdin);
+    }
+    // ─── Bundles ─────────────────────────────────────────────────────────
+    /** Build a deployable bundle from policy + data paths. */
+    async build(input) {
+        if (input.paths.length === 0) {
+            throw new Error('opa build requires at least one input path');
+        }
+        const args = ['build', '-o', input.output];
+        if (input.optimize !== undefined)
+            args.push('--optimize', String(input.optimize));
+        if (input.revision)
+            args.push('--revision', input.revision);
+        if (input.target)
+            args.push('--target', input.target);
+        for (const ep of input.entrypoints ?? [])
+            args.push('--entrypoint', ep);
+        if (input.signingKey)
+            args.push('--signing-key', input.signingKey);
+        if (input.signingAlg)
+            args.push('--signing-alg', input.signingAlg);
+        if (input.claimsFile)
+            args.push('--claims-file', input.claimsFile);
+        if (input.capabilities)
+            args.push('--capabilities', input.capabilities);
+        args.push(...input.paths);
+        return this.run(args);
+    }
+    /**
+     * Sign a bundle. Writes a `.signatures.json` next to the bundle
+     * directory.
+     */
+    async sign(input) {
+        const args = ['sign', '--signing-key', input.signingKey];
+        if (input.signingAlg)
+            args.push('--signing-alg', input.signingAlg);
+        if (input.claimsFile)
+            args.push('--claims-file', input.claimsFile);
+        args.push('--bundle', input.bundle);
+        return this.run(args);
+    }
+    // ─── Low-level escape hatch ──────────────────────────────────────────
+    /**
+     * Run `opa` with the given argv and optional stdin. Tools should
+     * prefer the typed methods above, but this exists for the rare cases
+     * the typed surface does not yet cover.
+     */
+    async run(args, stdin) {
+        const opts = {
+            args,
+            timeoutMs: this.config.subprocessTimeoutMs,
+        };
+        if (stdin !== undefined)
+            opts.stdin = stdin;
+        return runBinary(this.config.opaBinary, opts);
+    }
+    // ─── Internal: temp file management ──────────────────────────────────
+    /**
+     * Write `source` to a uniquely named `.rego` file in the OS tmp dir,
+     * pass its path to `fn`, and remove it on completion (success or
+     * failure). The path is unique per call so concurrent invocations do
+     * not collide.
+     */
+    async withTempSource(source, fn) {
+        const path = join(tmpdir(), `orygn-opa-mcp-${randomUUID()}.rego`);
+        await writeFile(path, source, 'utf8');
+        try {
+            return await fn(path);
+        }
+        finally {
+            await rm(path, { force: true });
+        }
+    }
+}
+//# sourceMappingURL=opa-cli.js.map

package/dist/lib/opa-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-cli.js","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAoJ9D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAA2B,EAAE;QAC9C,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,mBAAmB;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5D,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzE,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IAExE,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,KAAc;QACtC,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IAExE;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/dist/lib/opa-client.d.ts

@@ -0,0 +1,47 @@
+/**
+ * HTTP client for a running OPA server (the `opa run --server` REST API).
+ *
+ * Used by tools in the `opa_*` server-management category. CLI-only
+ * tools (`rego_*`) do not touch this module.
+ *
+ * Connection failures map to `OPA_UNREACHABLE`; 401s map to `OPA_AUTH_FAILED`.
+ * Per-tool error mapping happens at the call site.
+ */
+import type { Config } from '../config.js';
+export declare class OpaUnreachableError extends Error {
+    readonly url: string;
+    constructor(url: string, cause?: unknown);
+}
+export declare class OpaAuthError extends Error {
+    constructor();
+}
+export declare class OpaHttpError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(status: number, body: unknown);
+}
+export interface RequestOptions {
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+    /**
+     * JSON body to serialize. Mutually exclusive with `rawBody`.
+     */
+    body?: unknown;
+    /**
+     * Raw string body sent verbatim. Used for endpoints that accept
+     * non-JSON content — notably `PUT /v1/policies/{id}` which expects
+     * Rego source as `text/plain`.
+     */
+    rawBody?: string;
+    /** Content-Type for `rawBody`. Defaults to `text/plain`. */
+    rawContentType?: string;
+    query?: Record<string, string | number | boolean | undefined>;
+    headers?: Record<string, string>;
+}
+export declare class OpaClient {
+    private readonly config;
+    constructor(config: Config);
+    request<T = unknown>(opts: RequestOptions): Promise<T>;
+    private buildUrl;
+}
+//# sourceMappingURL=opa-client.d.ts.map

package/dist/lib/opa-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-client.d.ts","sourceRoot":"","sources":["../../src/lib/opa-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,GAAG,EAAE,MAAM;gBAAX,GAAG,EAAE,MAAM,EAC3B,KAAK,CAAC,EAAE,OAAO;CAMlB;AAED,qBAAa,YAAa,SAAQ,KAAK;;CAKtC;AAED,qBAAa,YAAa,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,OAAO;gBADb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO;CAKhC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAErC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC;IA+D5D,OAAO,CAAC,QAAQ;CAWjB"}

package/dist/lib/opa-client.js

@@ -0,0 +1,101 @@
+export class OpaUnreachableError extends Error {
+    url;
+    constructor(url, cause) {
+        super(`OPA server unreachable at ${url}`);
+        this.url = url;
+        this.name = 'OpaUnreachableError';
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+export class OpaAuthError extends Error {
+    constructor() {
+        super('OPA rejected the request with 401 Unauthorized');
+        this.name = 'OpaAuthError';
+    }
+}
+export class OpaHttpError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`OPA returned HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+        this.name = 'OpaHttpError';
+    }
+}
+export class OpaClient {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async request(opts) {
+        const url = this.buildUrl(opts.path, opts.query);
+        const headers = {
+            Accept: 'application/json',
+            ...(opts.headers ?? {}),
+        };
+        if (this.config.opaToken) {
+            headers['Authorization'] = `Bearer ${this.config.opaToken}`;
+        }
+        let bodyToSend;
+        if (opts.rawBody !== undefined) {
+            if (opts.body !== undefined) {
+                throw new Error('OpaClient.request: pass either `body` or `rawBody`, not both.');
+            }
+            bodyToSend = opts.rawBody;
+            if (!headers['Content-Type']) {
+                headers['Content-Type'] = opts.rawContentType ?? 'text/plain';
+            }
+        }
+        else if (opts.body !== undefined) {
+            bodyToSend = JSON.stringify(opts.body);
+            if (!headers['Content-Type']) {
+                headers['Content-Type'] = 'application/json';
+            }
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.config.httpTimeoutMs);
+        const init = {
+            method: opts.method,
+            headers,
+            signal: controller.signal,
+        };
+        if (bodyToSend !== undefined) {
+            init.body = bodyToSend;
+        }
+        let response;
+        try {
+            response = await fetch(url, init);
+        }
+        catch (e) {
+            throw new OpaUnreachableError(this.config.opaUrl, e);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status === 401) {
+            throw new OpaAuthError();
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        const isJson = contentType.includes('application/json');
+        const payload = isJson ? await response.json() : await response.text();
+        if (!response.ok) {
+            throw new OpaHttpError(response.status, payload);
+        }
+        return payload;
+    }
+    buildUrl(path, query) {
+        const base = this.config.opaUrl.replace(/\/+$/, '');
+        const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+        const url = new URL(`${base}${normalizedPath}`);
+        if (query) {
+            for (const [key, value] of Object.entries(query)) {
+                if (value !== undefined)
+                    url.searchParams.set(key, String(value));
+            }
+        }
+        return url.toString();
+    }
+}
+//# sourceMappingURL=opa-client.js.map

package/dist/lib/opa-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-client.js","sourceRoot":"","sources":["../../src/lib/opa-client.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IADlB,YACkB,GAAW,EAC3B,KAAe;QAEf,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAH1B,QAAG,GAAH,GAAG,CAAQ;QAI3B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC;QACE,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IACA;IAFlB,YACkB,MAAc,EACd,IAAa;QAE7B,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAHrB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAqBD,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,OAAO,CAAc,IAAoB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjD,MAAM,OAAO,GAA2B;YACtC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9D,CAAC;QAED,IAAI,UAA8B,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE9E,MAAM,IAAI,GAAgB;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,OAAO,GAAY,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,OAAY,CAAC;IACtB,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA+B;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/lib/output.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Format a tool envelope for MCP transport.
+ *
+ * The MCP SDK expects `{ content: [{ type: 'text', text: string }] }`.
+ * We serialize the envelope as JSON and apply size-based truncation.
+ */
+import type { ToolEnvelope } from '../types.js';
+export interface McpToolResult {
+    [key: string]: unknown;
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}
+export declare function formatEnvelope<T>(envelope: ToolEnvelope<T>, maxBytes: number): McpToolResult;
+//# sourceMappingURL=output.d.ts.map

package/dist/lib/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAsB5F"}

package/dist/lib/output.js

@@ -0,0 +1,21 @@
+export function formatEnvelope(envelope, maxBytes) {
+    let serialized = JSON.stringify(envelope, null, 2);
+    if (Buffer.byteLength(serialized, 'utf8') > maxBytes) {
+        const truncatedEnvelope = {
+            ...envelope,
+            truncated: true,
+        };
+        if (truncatedEnvelope.ok && truncatedEnvelope.data !== undefined) {
+            truncatedEnvelope.data = {
+                __truncated: true,
+                message: 'Response exceeded maxResponseBytes. Re-run with narrower scope, or write the output to a file path you specify.',
+            };
+        }
+        serialized = JSON.stringify(truncatedEnvelope, null, 2);
+    }
+    return {
+        content: [{ type: 'text', text: serialized }],
+        isError: !envelope.ok,
+    };
+}
+//# sourceMappingURL=output.js.map

package/dist/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,cAAc,CAAI,QAAyB,EAAE,QAAgB;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAoB;YACzC,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,iBAAiB,CAAC,EAAE,IAAI,iBAAiB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjE,iBAAiB,CAAC,IAAI,GAAG;gBACvB,WAAW,EAAE,IAAI;gBACjB,OAAO,EACL,iHAAiH;aAC/G,CAAC;QACT,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE;KACtB,CAAC;AACJ,CAAC"}

package/dist/lib/regal-cli.d.ts

@@ -0,0 +1,65 @@
+import type { Config } from '../config.js';
+import { type SpawnResult } from './subprocess.js';
+/** Input for `regal lint`. */
+export interface LintInput {
+    /** Inline Rego source. Mutually exclusive with `paths`. */
+    source?: string;
+    /** Paths to Rego files or directories to lint. */
+    paths?: string[];
+    /** Path to a Regal config file. */
+    configFile?: string;
+    /** Disable specific named rules (e.g. `print-or-trace-call`). */
+    disable?: string[];
+    /** Disable entire rule categories (e.g. `style`, `idiomatic`). */
+    disableCategory?: string[];
+    /** Enable specific named rules. */
+    enable?: string[];
+    /** Enable entire rule categories. */
+    enableCategory?: string[];
+    /** Disable every rule before applying enable* flags. */
+    disableAll?: boolean;
+    /** Enable every rule (overrides config defaults). */
+    enableAll?: boolean;
+    /** Glob patterns to skip. */
+    ignoreFiles?: string[];
+    /**
+     * Severity at which Regal returns a non-zero exit code (`error` or
+     * `warning`). Defaults to `error` to match Regal's own default.
+     */
+    failLevel?: 'error' | 'warning';
+}
+/**
+ * Wrapper around the local `regal` binary.
+ *
+ * Like `OpaCli`, methods do not throw on Regal-side errors — the exit
+ * code on the returned `SpawnResult` is the signal. Inline source is
+ * always written to a temp file because `regal lint` does not read
+ * from stdin.
+ */
+export declare class RegalCli {
+    private readonly config;
+    constructor(config: Config);
+    /**
+     * Verify the binary is present and report its version. Returns null
+     * if the binary is unreachable or output is malformed.
+     */
+    version(): Promise<string | null>;
+    /**
+     * Lint Rego source. Stdout is JSON when `--format=json` is set
+     * (always, here). Either `source` or one or more `paths` must be
+     * provided.
+     *
+     * Regal's exit codes:
+     * - 0 — no findings at or above `failLevel`
+     * - 3 — findings present
+     * - non-zero other — Regal-internal failure (config error, etc.)
+     */
+    lint(input: LintInput): Promise<SpawnResult>;
+    /**
+     * Run `regal` with the given argv. Tools should prefer the typed
+     * methods above; this is the escape hatch.
+     */
+    run(args: string[]): Promise<SpawnResult>;
+    private withTempSource;
+}
+//# sourceMappingURL=regal-cli.d.ts.map

package/dist/lib/regal-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regal-cli.d.ts","sourceRoot":"","sources":["../../src/lib/regal-cli.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQvC;;;;;;;;;OASG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAsBlD;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC;YAUjC,cAAc;CAS7B"}