@orygn/opa-mcp 0.0.0 → 0.1.0

package/dist/resources/style-guide.js

@@ -0,0 +1,187 @@
+/**
+ * Curated Rego style guide. Adapted from the Styra reference plus the
+ * OPA team's own conventions, condensed for LLM consumption.
+ */
+export const STYLE_GUIDE = `# Rego style guide
+
+A condensed reference for writing idiomatic, maintainable Rego. Adapted
+from the Styra style guide and the OPA project's conventions.
+
+## Always import \`rego.v1\`
+
+Every \`.rego\` file should start with the v1 import. It enables the
+modern syntax (\`if\`, \`contains\`, \`every\`) and disables the older
+implicit-membership operator that's a frequent source of bugs.
+
+\`\`\`rego
+package authz
+
+import rego.v1
+\`\`\`
+
+OPA 1.0 (released January 2025) treats this as the default, but
+including it explicitly makes intent clear and keeps the file portable
+to older OPA installations.
+
+## Package layout mirrors directory layout
+
+Match \`package foo.bar\` with the file path \`foo/bar/main.rego\` (or
+\`foo/bar/<anything>.rego\`). Regal flags mismatches as
+\`directory-package-mismatch\`.
+
+For a multi-file package, group by responsibility:
+
+\`\`\`
+authz/
+  main.rego          # principal decision (allow / deny)
+  rbac.rego          # role-based access checks
+  abac.rego          # attribute-based access checks
+  helpers.rego       # shared helpers, no decisions
+  main_test.rego     # tests for principal decisions
+  rbac_test.rego     # tests for rbac
+\`\`\`
+
+Tests live in \`*_test.rego\` siblings of the source they test, in the
+same package or a \`<package>_test\` package.
+
+## Naming
+
+- Rule names: \`snake_case\`.
+- Boolean rules: read like predicates — \`allow\`, \`is_admin\`,
+  \`should_log\`. Avoid \`is_not_blocked\` (double negative).
+- Set/object rules: read like nouns — \`grants\`, \`roles\`, \`reasons\`.
+- Helper rules: \`_\` prefix is *not* a convention; just give them names
+  that explain what they return.
+
+Names that conflict with reserved words (\`type\`, \`time\`, \`input\`) won't
+parse. Names matching builtins (\`http\`, \`json\`) shadow them.
+
+## Default deny
+
+Every principal decision should have a default fallback so the policy
+returns a value even when no rule matches.
+
+\`\`\`rego
+default allow := false
+
+allow if {
+    input.user.role == "admin"
+}
+\`\`\`
+
+The same applies to set-valued reasons:
+
+\`\`\`rego
+deny contains reason if {
+    not allow
+    reason := "not authorized"
+}
+\`\`\`
+
+## Comprehensions vs \`every\`
+
+When you need a value derived from a collection, use a comprehension:
+
+\`\`\`rego
+admin_users := {u | some u in input.users; u.role == "admin"}
+\`\`\`
+
+When you need to assert that a property holds for every element, use
+\`every\` (introduced in OPA 0.41):
+
+\`\`\`rego
+allow if {
+    every claim in input.token.claims {
+        claim.verified == true
+    }
+}
+\`\`\`
+
+\`every\` is clearer than the older \`not <comprehension>\` idiom and
+short-circuits on the first failure.
+
+## Annotations
+
+Public rules deserve a metadata block so consumers know what they do.
+
+\`\`\`rego
+# METADATA
+# title: Authorization decision for HTTP requests
+# description: |
+#   Returns true when the requesting principal has a role with a
+#   permission entry for the requested action on the requested
+#   resource. Anonymous requests always deny.
+# entrypoint: true
+allow if {
+    some role in input.principal.roles
+    permission_grants[role][input.action]
+}
+\`\`\`
+
+Annotations show up in \`opa inspect\`, the registry, and editor
+hovers. They are also extracted by \`rego_describe_policy\`.
+
+## Schema annotations
+
+For policies that are sensitive to input shape, attach a JSON Schema:
+
+\`\`\`rego
+# METADATA
+# schemas:
+#   - input: schema.input
+allow if {
+    input.user.id != ""
+}
+\`\`\`
+
+Combined with \`opa check --schema\`, this turns input-shape mismatches
+into compile errors instead of runtime undefineds.
+
+## Anti-patterns
+
+- **\`http.send\` in the decision path.** Each call adds round-trip
+  latency. If you must, scope it to a small, cacheable read.
+- **Deep \`with\` chains.** \`x with input as ... with data as ...\` more
+  than two layers deep is a smell — the test is doing too much. Split.
+- **\`print\` and \`trace\`.** Useful in development; remove before
+  shipping. Regal flags both as \`print-or-trace-call\`.
+- **Mixing \`if\` and the legacy implicit form in the same file.** Pick
+  one. With \`rego.v1\` imported you cannot use the implicit form.
+
+## Tests
+
+\`opa test\` runs every rule whose name starts with \`test_\`. A test
+either evaluates to true (pass) or fails to evaluate (fail). The
+common shape:
+
+\`\`\`rego
+package authz_test
+
+import rego.v1
+import data.authz
+
+test_admin_can_delete if {
+    authz.allow with input as {
+        "user": {"role": "admin"},
+        "action": "delete",
+    }
+}
+
+test_viewer_cannot_delete if {
+    not authz.allow with input as {
+        "user": {"role": "viewer"},
+        "action": "delete",
+    }
+}
+\`\`\`
+
+Run with \`opa test -v ./...\` for verbose output. Add \`--coverage\` to
+verify which lines were exercised.
+
+## References
+
+- Official Rego style guide: https://docs.styra.com/regal/rego-style-guide
+- OPA documentation: https://www.openpolicyagent.org/docs/latest/
+- Regal linter rules: https://docs.styra.com/regal/rules
+`;
+//# sourceMappingURL=style-guide.js.map

package/dist/resources/style-guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"style-guide.js","sourceRoot":"","sources":["../../src/resources/style-guide.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqL1B,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { type Config } from './config.js';
+export declare const SERVER_NAME = "orygn-opa-mcp";
+export declare const SERVER_VERSION = "0.1.0";
+/**
+ * Construct an `McpServer`, register every tool / prompt / resource
+ * onto it, and return it. Exported for tests so they can drive a
+ * fully-loaded server without standing up a stdio transport.
+ */
+export declare function buildServer(config: Config): McpServer;
+/**
+ * Entry-point flow: load config from env, build the server, connect
+ * to the supplied transport (defaults to stdio for production).
+ *
+ * Tests pass an in-memory transport so the connection succeeds
+ * without touching real stdio. Production callers omit the argument
+ * and get the standard stdio transport.
+ */
+export declare function main(transport?: Transport): Promise<McpServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAMtD,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAoBrD;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CASpE"}

package/dist/server.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * @orygn/opa-mcp — entry point.
+ *
+ * Initializes the MCP server, registers tools/prompts/resources,
+ * and connects the stdio transport.
+ *
+ * IMPORTANT: never write to stdout from anywhere in this process —
+ * stdout is the MCP protocol channel. Use `logger` (file) or stderr.
+ */
+import { pathToFileURL } from 'node:url';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { loadConfig } from './config.js';
+import { initLogger, logger } from './lib/logger.js';
+import { registerPrompts } from './prompts/index.js';
+import { registerResources } from './resources/index.js';
+import { registerTools } from './tools/index.js';
+export const SERVER_NAME = 'orygn-opa-mcp';
+export const SERVER_VERSION = '0.1.0';
+/**
+ * Construct an `McpServer`, register every tool / prompt / resource
+ * onto it, and return it. Exported for tests so they can drive a
+ * fully-loaded server without standing up a stdio transport.
+ */
+export function buildServer(config) {
+    initLogger(config.logFile, config.logLevel);
+    logger.info('starting orygn-opa-mcp', {
+        version: SERVER_VERSION,
+        opaUrl: config.opaUrl,
+        opaBinary: config.opaBinary,
+        regalBinary: config.regalBinary,
+    });
+    const server = new McpServer({
+        name: SERVER_NAME,
+        version: SERVER_VERSION,
+    });
+    registerTools(server, config);
+    registerPrompts(server, config);
+    registerResources(server, config);
+    return server;
+}
+/**
+ * Entry-point flow: load config from env, build the server, connect
+ * to the supplied transport (defaults to stdio for production).
+ *
+ * Tests pass an in-memory transport so the connection succeeds
+ * without touching real stdio. Production callers omit the argument
+ * and get the standard stdio transport.
+ */
+export async function main(transport) {
+    const config = loadConfig();
+    const server = buildServer(config);
+    const connectTo = transport ?? new StdioServerTransport();
+    await server.connect(connectTo);
+    logger.info('connected to transport, ready for requests');
+    return server;
+}
+/**
+ * Auto-run when this module is invoked as the entry point (`node
+ * dist/server.js` or via the `opa-mcp` bin shim). Tests that import
+ * `server.ts` directly do not trip this branch.
+ */
+function isEntryPoint() {
+    const argv1 = process.argv[1];
+    if (!argv1)
+        return false;
+    try {
+        return import.meta.url === pathToFileURL(argv1).href;
+    }
+    catch {
+        return false;
+    }
+}
+if (isEntryPoint()) {
+    main().catch((cause) => {
+        logger.error('fatal error in server entry', { error: cause });
+        console.error('orygn-opa-mcp fatal error:', cause);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/authoring/capabilities.d.ts

@@ -0,0 +1,11 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoCapabilitiesOutput {
+    builtins?: unknown[];
+    future_keywords?: unknown[];
+    features?: unknown[];
+    wasm_abi_versions?: unknown[];
+    versions?: string[];
+}
+export declare function registerRegoCapabilities(server: McpServer, config: Config): void;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/tools/authoring/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/capabilities.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAoB9C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkDhF"}

package/dist/tools/authoring/capabilities.js

@@ -0,0 +1,57 @@
+/**
+ * `rego_capabilities` — list OPA's built-in functions and feature flags.
+ *
+ * Useful as a reference when authoring policies, especially for
+ * answering "is `crypto.x509.parse_certificates` available?" without
+ * grepping the OPA repo.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoCapabilitiesInput = {
+    current: z
+        .boolean()
+        .optional()
+        .describe('Print the capabilities of the currently installed OPA. Mutually exclusive with `version`.'),
+    version: z
+        .string()
+        .optional()
+        .describe('A specific OPA capabilities version (e.g. "v0.69.0"). When neither flag is set, lists available versions.'),
+};
+export function registerRegoCapabilities(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_capabilities', {
+        title: 'OPA capabilities',
+        description: 'Return OPA capabilities — the available builtins, future keywords, features, and WASM ABI versions. With `current: true`, returns the running OPA\'s capabilities. With `version: "v0.69.0"`, returns those of a specific version. With neither, lists available named versions.',
+        inputSchema: RegoCapabilitiesInput,
+    }, async ({ current, version }) => {
+        return withToolEnvelope(config, async () => {
+            if (current && version) {
+                return err('INVALID_INPUT', 'rego_capabilities accepts at most one of `current` or `version`.');
+            }
+            const result = await opa.capabilities({ current, version });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_INPUT', 'opa capabilities exited non-zero — `version` is likely unrecognized.', { details: { stderr: result.stderr.trim(), version } });
+            }
+            // When listing versions (no flags), output is a newline-separated
+            // list of names. Otherwise, output is JSON.
+            const trimmed = result.stdout.trim();
+            if (!current && !version) {
+                const versions = trimmed.length === 0 ? [] : trimmed.split(/\r?\n/).filter(Boolean);
+                return ok({ versions });
+            }
+            const parsed = tryParseJson(trimmed);
+            if (parsed === undefined) {
+                return err('UNKNOWN_ERROR', 'opa capabilities produced no parseable JSON output.', {
+                    details: { stdout: trimmed },
+                });
+            }
+            return ok(parsed);
+        });
+    });
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/tools/authoring/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../../src/tools/authoring/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,qBAAqB,GAAG;IAC5B,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,2GAA2G,CAC5G;CACJ,CAAC;AAUF,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,kRAAkR;QACpR,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC7B,OAAO,gBAAgB,CAAyB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjE,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,OAAO,GAAG,CACR,eAAe,EACf,kEAAkE,CACnE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5D,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,eAAe,EACf,sEAAsE,EACtE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CACvD,CAAC;YACJ,CAAC;YAED,kEAAkE;YAClE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpF,OAAO,EAAE,CAAyB,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAyB,OAAO,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,qDAAqD,EAAE;oBACjF,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAyB,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/check.d.ts

@@ -0,0 +1,18 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface CheckErrorRecord {
+    message?: string;
+    code?: string;
+    location?: {
+        file?: string;
+        row?: number;
+        col?: number;
+    };
+}
+export interface RegoCheckOutput {
+    valid: boolean;
+    errors: CheckErrorRecord[];
+}
+export declare function registerRegoCheck(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=check.d.ts.map

package/dist/tools/authoring/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/check.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA6B9C,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6DzE"}

package/dist/tools/authoring/check.js

@@ -0,0 +1,71 @@
+/**
+ * `rego_check` — type-check Rego using `opa check`.
+ *
+ * Returns `{ valid: true }` when the policy passes. On failure,
+ * returns the structured error report `opa check --format=json` writes
+ * to its stderr stream.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoCheckInput = {
+    source: z.string().optional().describe('Inline Rego source. Mutually exclusive with `paths`.'),
+    paths: z
+        .array(z.string())
+        .optional()
+        .describe('Filesystem paths to check. Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).'),
+    strict: z
+        .boolean()
+        .optional()
+        .describe('Enable strict mode — fail on unused vars, deprecated builtins, etc.'),
+    capabilities: z
+        .string()
+        .optional()
+        .describe('Path to a capabilities JSON file restricting allowed builtins.'),
+    schemaDir: z.string().optional().describe('Schema directory for input/data validation.'),
+};
+export function registerRegoCheck(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_check', {
+        title: 'Check Rego',
+        description: 'Type-check Rego with `opa check`. Returns `{ valid: true, errors: [] }` on success, or a list of structured diagnostics with file/line locations on failure. Provide either `source` for inline checking or `paths` for file/directory checking.',
+        inputSchema: RegoCheckInput,
+    }, async ({ source, paths, strict, capabilities, schemaDir }) => {
+        return withToolEnvelope(config, async () => {
+            if (!source && !paths?.length) {
+                return err('INVALID_INPUT', 'rego_check requires either `source` or at least one entry in `paths`.');
+            }
+            if (source && paths?.length) {
+                return err('INVALID_INPUT', 'rego_check does not accept both `source` and `paths` — pass one or the other.');
+            }
+            let resolvedPaths;
+            if (paths?.length) {
+                const validation = validatePaths(paths, config, { mustExist: true });
+                if (!validation.ok)
+                    return validation.error;
+                resolvedPaths = validation.resolved;
+            }
+            const result = await opa.check({
+                source,
+                paths: resolvedPaths,
+                strict,
+                capabilities,
+                schemaDir,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode === 0) {
+                return ok({ valid: true, errors: [] });
+            }
+            // `opa check --format=json` writes diagnostics to stderr.
+            const parsed = tryParseJson(result.stderr);
+            if (!parsed) {
+                return err('INVALID_REGO', 'opa check exited non-zero but produced no parseable diagnostics.', { details: { stderr: result.stderr.trim(), stdout: result.stdout.trim() } });
+            }
+            return ok({ valid: false, errors: parsed.errors ?? [] });
+        });
+    });
+}
+//# sourceMappingURL=check.js.map

package/dist/tools/authoring/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/tools/authoring/check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC9F,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F,CAC/F;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACzF,CAAC;AAaF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,kPAAkP;QACpP,WAAW,EAAE,cAAc;KAC5B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3D,OAAO,gBAAgB,CAAkB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,GAAG,CACR,eAAe,EACf,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,CACR,eAAe,EACf,+EAA+E,CAChF,CAAC;YACJ,CAAC;YAED,IAAI,aAAmC,CAAC;YACxC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAC5C,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;gBAC7B,MAAM;gBACN,KAAK,EAAE,aAAa;gBACpB,MAAM;gBACN,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,0DAA0D;YAC1D,MAAM,MAAM,GAAG,YAAY,CAAkC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CACR,cAAc,EACd,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/deps.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoDepsOutput {
+    base?: unknown[];
+    virtual?: unknown[];
+}
+export declare function registerRegoDeps(server: McpServer, config: Config): void;
+//# sourceMappingURL=deps.d.ts.map

package/dist/tools/authoring/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/deps.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAuB9C,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsCxE"}

package/dist/tools/authoring/deps.js

@@ -0,0 +1,51 @@
+/**
+ * `rego_deps` — static dependency analysis for a Rego ref.
+ *
+ * Wraps `opa deps`. Given a target like `data.example.allow`, returns
+ * the base (input/data) and virtual (rule) document references the
+ * target depends on. Helpful for impact analysis when a data shape
+ * changes.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoDepsInput = {
+    paths: z
+        .array(z.string())
+        .min(1)
+        .describe('Policy / data paths to load before computing dependencies. Each must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).'),
+    ref: z
+        .string()
+        .min(1)
+        .describe('Reference to compute dependencies for, e.g. "data.example.allow".'),
+};
+export function registerRegoDeps(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_deps', {
+        title: 'Rego dependency analysis',
+        description: 'Static dependency analysis for a Rego reference. Given a target ref like "data.example.allow", returns the base document references (input/data leaves) and virtual document references (rules) it depends on, transitively.',
+        inputSchema: RegoDepsInput,
+    }, async ({ paths, ref }) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths(paths, config, { mustExist: true });
+            if (!validation.ok)
+                return validation.error;
+            const result = await opa.deps({ paths: validation.resolved, ref });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa deps exited non-zero — the policy did not compile or the ref is invalid.', { details: { stderr: result.stderr.trim(), ref } });
+            }
+            const parsed = tryParseJson(result.stdout);
+            if (parsed === undefined) {
+                return err('UNKNOWN_ERROR', 'opa deps produced no parseable JSON output.', {
+                    details: { stdout: result.stdout.trim() },
+                });
+            }
+            return ok(parsed);
+        });
+    });
+}
+//# sourceMappingURL=deps.js.map

package/dist/tools/authoring/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/tools/authoring/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yHAAyH,CAC1H;IACH,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;AAOF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,8NAA8N;QAChO,WAAW,EAAE,aAAa;KAC3B,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,cAAc,EACd,8EAA8E,EAC9E,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,6CAA6C,EAAE;oBACzE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAiB,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/format.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoFormatOutput {
+    formatted: string;
+    changed: boolean;
+}
+export declare function registerRegoFormat(server: McpServer, config: Config): void;
+//# sourceMappingURL=format.d.ts.map

package/dist/tools/authoring/format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/format.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAS9C,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA2C1E"}

package/dist/tools/authoring/format.js

@@ -0,0 +1,44 @@
+/**
+ * `rego_format` — format Rego source via `opa fmt`.
+ *
+ * Idempotent: running it on already-formatted source produces
+ * identical output and `changed: false`.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoFormatInput = {
+    source: z.string().min(1).describe('Rego source code to format.'),
+};
+export function registerRegoFormat(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_format', {
+        title: 'Format Rego',
+        description: 'Format Rego source code using `opa fmt`. Returns the formatted source and a `changed` flag indicating whether the input was already canonical.',
+        inputSchema: RegoFormatInput,
+    }, async ({ source }) => {
+        return withToolEnvelope(config, async () => {
+            const result = await opa.fmt({ source });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                // `opa fmt` only fails when the source cannot be parsed.
+                // The error report goes to stderr as JSON (or as plain text
+                // for older OPA builds). Tools should surface whichever is
+                // available.
+                const parsedErrors = tryParseJson(result.stderr);
+                return err('INVALID_REGO', 'opa fmt rejected the source; the input is not parseable Rego.', {
+                    details: parsedErrors ?? { stderr: result.stderr.trim() },
+                });
+            }
+            const formatted = result.stdout;
+            return ok({
+                formatted,
+                changed: formatted !== source,
+            });
+        });
+    });
+}
+//# sourceMappingURL=format.js.map

package/dist/tools/authoring/format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"format.js","sourceRoot":"","sources":["../../../src/tools/authoring/format.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CAClE,CAAC;AAOF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,gJAAgJ;QAClJ,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAEzC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,yDAAyD;gBACzD,4DAA4D;gBAC5D,2DAA2D;gBAC3D,aAAa;gBACb,MAAM,YAAY,GAAG,YAAY,CAE9B,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO,GAAG,CACR,cAAc,EACd,+DAA+D,EAC/D;oBACE,OAAO,EAAE,YAAY,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1D,CACF,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,CAAmB;gBAC1B,SAAS;gBACT,OAAO,EAAE,SAAS,KAAK,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Category A — Authoring & static analysis.
+ *
+ * Tools in this category operate on Rego source code without requiring
+ * a running OPA server. They wrap `opa fmt`, `opa check`, `opa parse`,
+ * `opa inspect`, `opa capabilities`, `opa deps`, and the `regal` linter.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerAuthoringTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/authoring/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAS9C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ9E"}