@orygn/opa-mcp 0.0.0 → 0.1.0

package/dist/tools/authoring/index.js

@@ -0,0 +1,17 @@
+import { registerRegoCapabilities } from './capabilities.js';
+import { registerRegoCheck } from './check.js';
+import { registerRegoDeps } from './deps.js';
+import { registerRegoFormat } from './format.js';
+import { registerRegoInspect } from './inspect.js';
+import { registerRegoLint } from './lint.js';
+import { registerRegoParseAst } from './parse.js';
+export function registerAuthoringTools(server, config) {
+    registerRegoFormat(server, config);
+    registerRegoCheck(server, config);
+    registerRegoLint(server, config);
+    registerRegoParseAst(server, config);
+    registerRegoInspect(server, config);
+    registerRegoCapabilities(server, config);
+    registerRegoDeps(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/authoring/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/tools/authoring/inspect.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoInspectOutput {
+    manifest?: unknown;
+    namespaces?: Record<string, unknown>;
+    annotations?: unknown;
+    signatures?: unknown;
+}
+export declare function registerRegoInspect(server: McpServer, config: Config): void;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/tools/authoring/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/inspect.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAiB9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA0C3E"}

package/dist/tools/authoring/inspect.js

@@ -0,0 +1,47 @@
+/**
+ * `rego_inspect` — inspect a bundle, directory, or single Rego file
+ * via `opa inspect`. Returns the manifest (if present), namespaces,
+ * and rule annotations as JSON.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoInspectInput = {
+    target: z
+        .string()
+        .min(1)
+        .describe('Path to a bundle archive (`*.tar.gz`), directory, or single Rego file.'),
+};
+export function registerRegoInspect(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_inspect', {
+        title: 'Inspect bundle or policy',
+        description: 'Inspect an OPA bundle, policy directory, or single Rego file with `opa inspect`. Returns manifest data, namespaces, rule annotations, and (if signed) signature metadata.',
+        inputSchema: RegoInspectInput,
+    }, async ({ target }) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths([target], config, { mustExist: true });
+            if (!validation.ok)
+                return validation.error;
+            const [resolved] = validation.resolved;
+            const result = await opa.inspect({ target: resolved });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_BUNDLE', 'opa inspect rejected the target — it is not a valid bundle, directory, or Rego file.', {
+                    details: { stderr: result.stderr.trim(), stdout: result.stdout.trim() },
+                });
+            }
+            const parsed = tryParseJson(result.stdout);
+            if (parsed === undefined) {
+                return err('UNKNOWN_ERROR', 'opa inspect produced no parseable JSON output.', {
+                    details: { stdout: result.stdout.trim() },
+                });
+            }
+            return ok(parsed);
+        });
+    });
+}
+//# sourceMappingURL=inspect.js.map

package/dist/tools/authoring/inspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../../src/tools/authoring/inspect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;AASF,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAoB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;YAEvC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAS,EAAE,CAAC,CAAC;YAExD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,gBAAgB,EAChB,sFAAsF,EACtF;oBACE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACxE,CACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,gDAAgD,EAAE;oBAC5E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAoB,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/lint.d.ts

@@ -0,0 +1,18 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface LintViolation {
+    title?: string;
+    description?: string;
+    category?: string;
+    level?: string;
+    location?: unknown;
+    related_resources?: unknown;
+}
+export interface RegoLintOutput {
+    violations: LintViolation[];
+    notices?: unknown[];
+    summary?: unknown;
+}
+export declare function registerRegoLint(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=lint.d.ts.map

package/dist/tools/authoring/lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/lint.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAoC9C,UAAU,aAAa;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,aAAa,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6DxE"}

package/dist/tools/authoring/lint.js

@@ -0,0 +1,84 @@
+/**
+ * `rego_lint` — lint Rego with the optional `regal` binary.
+ *
+ * The only authoring tool that requires Regal. Returns
+ * `REGAL_NOT_FOUND` with an install hint if the binary is missing.
+ */
+import { z } from 'zod';
+import { RegalCli } from '../../lib/regal-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoLintInput = {
+    source: z.string().optional().describe('Inline Rego source. Mutually exclusive with `paths`.'),
+    paths: z
+        .array(z.string())
+        .optional()
+        .describe('Filesystem paths to lint. Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS).'),
+    configFile: z
+        .string()
+        .optional()
+        .describe('Path to a Regal config file (defaults to .regal/config.yaml lookup).'),
+    disable: z.array(z.string()).optional().describe('Disable specific named rules.'),
+    enable: z.array(z.string()).optional().describe('Enable specific named rules.'),
+    disableCategory: z
+        .array(z.string())
+        .optional()
+        .describe('Disable entire rule categories (e.g. style, idiomatic, bugs).'),
+    enableCategory: z.array(z.string()).optional().describe('Enable entire rule categories.'),
+    failLevel: z
+        .enum(['error', 'warning'])
+        .optional()
+        .describe('Severity at which Regal returns a non-zero exit. Default: `error`.'),
+    ignoreFiles: z.array(z.string()).optional().describe('Glob patterns to skip.'),
+};
+export function registerRegoLint(server, config) {
+    const regal = new RegalCli(config);
+    server.registerTool('rego_lint', {
+        title: 'Lint Rego',
+        description: 'Lint Rego source with the Regal linter. Returns categorized violations (style, bugs, idiomatic, performance) with file/line locations. Requires `regal` on PATH or `REGAL_BINARY` set; returns REGAL_NOT_FOUND otherwise. When called with inline `source` rather than `paths`, expect location-bound rules such as `directory-package-mismatch` to fire as artifacts of the randomized temp-file path. Prefer `paths` for canonical signal; for inline workflows, ignore or `disable` those rules.',
+        inputSchema: RegoLintInput,
+    }, async (input) => {
+        return withToolEnvelope(config, async () => {
+            const { source, paths } = input;
+            if (!source && !paths?.length) {
+                return err('INVALID_INPUT', 'rego_lint requires either `source` or at least one entry in `paths`.');
+            }
+            if (source && paths?.length) {
+                return err('INVALID_INPUT', 'rego_lint does not accept both `source` and `paths`.');
+            }
+            let resolvedPaths;
+            if (paths?.length) {
+                const validation = validatePaths(paths, config, { mustExist: true });
+                if (!validation.ok)
+                    return validation.error;
+                resolvedPaths = validation.resolved;
+            }
+            const result = await regal.lint({
+                source,
+                paths: resolvedPaths,
+                configFile: input.configFile,
+                disable: input.disable,
+                enable: input.enable,
+                disableCategory: input.disableCategory,
+                enableCategory: input.enableCategory,
+                failLevel: input.failLevel,
+                ignoreFiles: input.ignoreFiles,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'regal');
+            if (subprocessFailure)
+                return subprocessFailure;
+            const parsed = tryParseJson(result.stdout);
+            if (!parsed) {
+                return err('UNKNOWN_ERROR', 'regal lint produced no parseable JSON output.', {
+                    details: { stderr: result.stderr.trim(), exitCode: result.exitCode },
+                });
+            }
+            return ok({
+                violations: parsed.violations ?? [],
+                notices: parsed.notices,
+                summary: parsed.summary,
+            });
+        });
+    });
+}
+//# sourceMappingURL=lint.js.map

package/dist/tools/authoring/lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint.js","sourceRoot":"","sources":["../../../src/tools/authoring/lint.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC9F,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,6FAA6F,CAC9F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACjF,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;IAC/E,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IACzF,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;SAC1B,QAAQ,EAAE;SACV,QAAQ,CAAC,oEAAoE,CAAC;IACjF,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;CAC/E,CAAC;AAiBF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,WAAW;QAClB,WAAW,EACT,qeAAqe;QACve,WAAW,EAAE,aAAa;KAC3B,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,GAAG,CACR,eAAe,EACf,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;YACtF,CAAC;YAED,IAAI,aAAmC,CAAC;YACxC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAC5C,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;gBAC9B,MAAM;gBACN,KAAK,EAAE,aAAa;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,MAAM,MAAM,GAAG,YAAY,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CAAC,eAAe,EAAE,+CAA+C,EAAE;oBAC3E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,CAAiB;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;gBACnC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/parse.d.ts

@@ -0,0 +1,7 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface RegoParseAstOutput {
+    ast: unknown;
+}
+export declare function registerRegoParseAst(server: McpServer, config: Config): void;
+//# sourceMappingURL=parse.d.ts.map

package/dist/tools/authoring/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/parse.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAS9C,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,OAAO,CAAC;CACd;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAmC5E"}

package/dist/tools/authoring/parse.js

@@ -0,0 +1,43 @@
+/**
+ * `rego_parse_ast` — parse Rego source to a JSON AST.
+ *
+ * Wraps `opa parse --format=json`. Useful for tools that want to walk
+ * the structure of a policy programmatically (rule discovery, ref
+ * extraction, etc.) without re-implementing the parser.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoParseAstInput = {
+    source: z.string().min(1).describe('Rego source code to parse.'),
+};
+export function registerRegoParseAst(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_parse_ast', {
+        title: 'Parse Rego to AST',
+        description: 'Parse Rego source to a JSON AST using `opa parse`. Returns the AST as a tree of nodes (package, imports, rules, expressions, terms). Use this when you need to introspect policy structure programmatically.',
+        inputSchema: RegoParseAstInput,
+    }, async ({ source }) => {
+        return withToolEnvelope(config, async () => {
+            const result = await opa.parse({ source });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                const parsed = tryParseJson(result.stdout);
+                return err('INVALID_REGO', 'opa parse rejected the source.', {
+                    details: parsed ?? { stderr: result.stderr.trim() },
+                });
+            }
+            const ast = tryParseJson(result.stdout);
+            if (ast === undefined) {
+                return err('UNKNOWN_ERROR', 'opa parse produced no parseable JSON on stdout.', {
+                    details: { stdout: result.stdout.trim() },
+                });
+            }
+            return ok({ ast });
+        });
+    });
+}
+//# sourceMappingURL=parse.js.map

package/dist/tools/authoring/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../src/tools/authoring/parse.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;CACjE,CAAC;AAMF,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,MAAc;IACpE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,8MAA8M;QAChN,WAAW,EAAE,iBAAiB;KAC/B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAqB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAE3C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,YAAY,CAAyB,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnE,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,iDAAiD,EAAE;oBAC7E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/bundles/build.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface OpaBundleBuildOutput {
+    output: string;
+    bytes: number;
+}
+export declare function registerOpaBundleBuild(server: McpServer, config: Config): void;
+//# sourceMappingURL=build.d.ts.map

package/dist/tools/bundles/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/build.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAiC9C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA2D9E"}

package/dist/tools/bundles/build.js

@@ -0,0 +1,87 @@
+/**
+ * `opa_bundle_build` — build a deployable bundle from policy + data
+ * paths via `opa build`.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const OpaBundleBuildInput = {
+    paths: z
+        .array(z.string())
+        .min(1)
+        .describe('Policy / data paths to include. Each must be in an allowed root.'),
+    output: z
+        .string()
+        .min(1)
+        .describe('Output bundle path (typically `*.tar.gz`). Must be in an allowed root.'),
+    optimize: z
+        .union([z.literal(0), z.literal(1), z.literal(2)])
+        .optional()
+        .describe('Optimization level (0 = none, 2 = aggressive).'),
+    revision: z.string().optional().describe('Bundle revision string written to the manifest.'),
+    target: z
+        .enum(['rego', 'wasm'])
+        .optional()
+        .describe('Build target (default `rego`; `wasm` compiles to WebAssembly).'),
+    entrypoints: z
+        .array(z.string())
+        .optional()
+        .describe('Entrypoint refs (required when `target=wasm` or `optimize > 0`).'),
+    signingKey: z.string().optional().describe('Path to a signing key for inline signing.'),
+    signingAlg: z.string().optional().describe('Signing algorithm (e.g. RS256).'),
+    claimsFile: z.string().optional().describe('Path to a claims file for inline signing.'),
+    capabilities: z.string().optional().describe('Path to a capabilities JSON file.'),
+};
+export function registerOpaBundleBuild(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('opa_bundle_build', {
+        title: 'Build OPA bundle',
+        description: 'Build a deployable bundle from policy / data paths using `opa build`. Output is a `.tar.gz` archive with optional inline signing. Supports optimization, custom revision strings, and the WASM target.',
+        inputSchema: OpaBundleBuildInput,
+    }, async (input) => {
+        return withToolEnvelope(config, async () => {
+            const inputPaths = [...input.paths, input.output];
+            const validation = validatePaths(inputPaths, config);
+            if (!validation.ok)
+                return validation.error;
+            const sourcePaths = validation.resolved.slice(0, input.paths.length);
+            const outputPath = validation.resolved[input.paths.length];
+            // Validate auxiliary files separately (they may live elsewhere).
+            for (const auxPath of [input.signingKey, input.claimsFile, input.capabilities]) {
+                if (auxPath) {
+                    const auxValidation = validatePaths([auxPath], config, { mustExist: true });
+                    if (!auxValidation.ok)
+                        return auxValidation.error;
+                }
+            }
+            const result = await opa.build({
+                paths: sourcePaths,
+                output: outputPath,
+                optimize: input.optimize,
+                revision: input.revision,
+                target: input.target,
+                entrypoints: input.entrypoints,
+                signingKey: input.signingKey,
+                signingAlg: input.signingAlg,
+                claimsFile: input.claimsFile,
+                capabilities: input.capabilities,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa build failed.', {
+                    details: { stderr: result.stderr.trim(), stdout: result.stdout.trim() },
+                });
+            }
+            const { stat } = await import('node:fs/promises');
+            const fileStat = await stat(outputPath);
+            return ok({
+                output: outputPath,
+                bytes: fileStat.size,
+            });
+        });
+    });
+}
+//# sourceMappingURL=build.js.map

package/dist/tools/bundles/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../../src/tools/bundles/build.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,mBAAmB,GAAG;IAC1B,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,wEAAwE,CAAC;IACrF,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACvF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;IACvF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;CAClF,CAAC;AAOF,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,wMAAwM;QAC1M,WAAW,EAAE,mBAAmB;KACjC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;YAE5D,iEAAiE;YACjE,KAAK,MAAM,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/E,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC5E,IAAI,CAAC,aAAa,CAAC,EAAE;wBAAE,OAAO,aAAa,CAAC,KAAK,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;gBAC7B,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,mBAAmB,EAAE;oBAC9C,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;YACxC,OAAO,EAAE,CAAuB;gBAC9B,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,QAAQ,CAAC,IAAI;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/bundles/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Category C — Bundle operations.
+ *
+ * Wraps `opa build` and `opa sign` for packaging and signing
+ * deployable bundles.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerBundleTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/bundles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAI9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG3E"}

package/dist/tools/bundles/index.js

@@ -0,0 +1,7 @@
+import { registerOpaBundleBuild } from './build.js';
+import { registerOpaBundleSign } from './sign.js';
+export function registerBundleTools(server, config) {
+    registerOpaBundleBuild(server, config);
+    registerOpaBundleSign(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/bundles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/tools/bundles/sign.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface OpaBundleSignOutput {
+    signed: boolean;
+    signaturesPath?: string;
+}
+export declare function registerOpaBundleSign(server: McpServer, config: Config): void;
+//# sourceMappingURL=sign.d.ts.map

package/dist/tools/bundles/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/sign.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAe9C,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuC7E"}

package/dist/tools/bundles/sign.js

@@ -0,0 +1,47 @@
+/**
+ * `opa_bundle_sign` — sign an existing bundle directory or archive
+ * via `opa sign`.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const OpaBundleSignInput = {
+    bundle: z
+        .string()
+        .min(1)
+        .describe('Path to a bundle directory or archive. Must be in an allowed root.'),
+    signingKey: z.string().min(1).describe('Path to the signing key.'),
+    signingAlg: z.string().optional().describe('Signing algorithm (e.g. RS256). Default: RS256.'),
+    claimsFile: z.string().optional().describe('Path to extra claims to include in the signature.'),
+};
+export function registerOpaBundleSign(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('opa_bundle_sign', {
+        title: 'Sign OPA bundle',
+        description: 'Sign an OPA bundle with a private key using `opa sign`. Writes a `.signatures.json` next to the bundle directory, or updates the archive in place.',
+        inputSchema: OpaBundleSignInput,
+    }, async (input) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths([input.bundle, input.signingKey, ...(input.claimsFile ? [input.claimsFile] : [])], config, { mustExist: true });
+            if (!validation.ok)
+                return validation.error;
+            const result = await opa.sign({
+                bundle: validation.resolved[0],
+                signingKey: validation.resolved[1],
+                signingAlg: input.signingAlg,
+                claimsFile: input.claimsFile ? validation.resolved[2] : undefined,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_BUNDLE', 'opa sign failed.', {
+                    details: { stderr: result.stderr.trim() },
+                });
+            }
+            return ok({ signed: true });
+        });
+    });
+}
+//# sourceMappingURL=sign.js.map

package/dist/tools/bundles/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/tools/bundles/sign.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,oEAAoE,CAAC;IACjF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC7F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;CAChG,CAAC;AAOF,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,oJAAoJ;QACtJ,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,KAAK,EAAE,EAAE;QACd,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,UAAU,GAAG,aAAa,CAC9B,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACjF,MAAM,EACN,EAAE,SAAS,EAAE,IAAI,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAE;gBAC/B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAE;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;aAClE,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,EAAE;oBAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/evaluation/_shared.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Shared helpers for the evaluation tool category.
+ *
+ * `rego_eval` and its three trace/profile/coverage variants all share
+ * the same input/output shape and error handling — only the OPA flags
+ * differ. The shared `runEval` helper takes the resolved EvalInput and
+ * returns an envelope; each tool's handler is a thin adapter that
+ * preps inputs and forwards.
+ */
+import { z } from 'zod';
+import type { Config } from '../../config.js';
+import type { OpaCli } from '../../lib/opa-cli.js';
+import type { ToolEnvelope } from '../../types.js';
+/** Common input fields shared across rego_eval and its variants. */
+export declare const SharedEvalInput: {
+    query: z.ZodString;
+    source: z.ZodOptional<z.ZodString>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    input: z.ZodOptional<z.ZodUnknown>;
+    inputPath: z.ZodOptional<z.ZodString>;
+    unknowns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    partial: z.ZodOptional<z.ZodBoolean>;
+    strictBuiltinErrors: z.ZodOptional<z.ZodBoolean>;
+};
+export interface RegoEvalOutput {
+    result?: unknown[];
+    errors?: unknown[];
+    metrics?: Record<string, unknown>;
+    explanation?: unknown[];
+    profile?: unknown[];
+    coverage?: unknown;
+}
+interface EvalArgs {
+    query: string;
+    source?: string;
+    paths?: string[];
+    input?: unknown;
+    inputPath?: string;
+    unknowns?: string[];
+    partial?: boolean;
+    strictBuiltinErrors?: boolean;
+}
+interface EvalFlags {
+    explain?: 'full' | 'notes' | 'fails' | 'debug';
+    profile?: boolean;
+    coverage?: boolean;
+    metrics?: boolean;
+}
+/**
+ * Validate inputs (paths, input/inputPath conflict), call `opa eval`,
+ * and return the structured envelope.
+ */
+export declare function runEval(opa: OpaCli, config: Config, args: EvalArgs, flags: EvalFlags): Promise<ToolEnvelope<RegoEvalOutput>>;
+export {};
+//# sourceMappingURL=_shared.d.ts.map

package/dist/tools/evaluation/_shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_shared.d.ts","sourceRoot":"","sources":["../../../src/tools/evaluation/_shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,MAAM,EAAa,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,oEAAoE;AACpE,eAAO,MAAM,eAAe;;;;;;;;;CAwB3B,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,QAAQ;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,UAAU,SAAS;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CA2DvC"}

package/dist/tools/evaluation/_shared.js

@@ -0,0 +1,102 @@
+/**
+ * Shared helpers for the evaluation tool category.
+ *
+ * `rego_eval` and its three trace/profile/coverage variants all share
+ * the same input/output shape and error handling — only the OPA flags
+ * differ. The shared `runEval` helper takes the resolved EvalInput and
+ * returns an envelope; each tool's handler is a thin adapter that
+ * preps inputs and forwards.
+ */
+import { z } from 'zod';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths } from '../../lib/tool-helpers.js';
+/** Common input fields shared across rego_eval and its variants. */
+export const SharedEvalInput = {
+    query: z.string().min(1).describe('Rego query to evaluate, e.g. "data.example.allow".'),
+    source: z
+        .string()
+        .optional()
+        .describe('Inline Rego policy source. Mutually exclusive with `paths`.'),
+    paths: z
+        .array(z.string())
+        .optional()
+        .describe('Policy / data file or directory paths. Each must be inside an allowed root.'),
+    input: z.unknown().optional().describe('Inline input document.'),
+    inputPath: z
+        .string()
+        .optional()
+        .describe('Path to a JSON input file. Mutually exclusive with `input`.'),
+    unknowns: z
+        .array(z.string())
+        .optional()
+        .describe('Refs to treat as unknown during partial evaluation.'),
+    partial: z.boolean().optional().describe('Run partial evaluation rather than full evaluation.'),
+    strictBuiltinErrors: z
+        .boolean()
+        .optional()
+        .describe('Treat builtin errors as fatal instead of returning undefined.'),
+};
+/**
+ * Validate inputs (paths, input/inputPath conflict), call `opa eval`,
+ * and return the structured envelope.
+ */
+export async function runEval(opa, config, args, flags) {
+    if (!args.source && !args.paths?.length) {
+        return err('INVALID_INPUT', 'rego_eval requires either `source` or at least one entry in `paths`.');
+    }
+    if (args.input !== undefined && args.inputPath) {
+        return err('INVALID_INPUT', 'rego_eval accepts either `input` or `inputPath`, not both.');
+    }
+    const evalInput = { query: args.query };
+    if (args.source !== undefined)
+        evalInput.source = args.source;
+    if (args.paths?.length) {
+        const validation = validatePaths(args.paths, config, { mustExist: true });
+        if (!validation.ok)
+            return validation.error;
+        evalInput.paths = validation.resolved;
+    }
+    if (args.input !== undefined) {
+        evalInput.input = args.input;
+    }
+    else if (args.inputPath) {
+        const inputPathValidation = validatePaths([args.inputPath], config, { mustExist: true });
+        if (!inputPathValidation.ok)
+            return inputPathValidation.error;
+        evalInput.inputPath = inputPathValidation.resolved[0];
+    }
+    if (args.partial)
+        evalInput.partial = true;
+    if (args.unknowns?.length)
+        evalInput.unknowns = args.unknowns;
+    if (args.strictBuiltinErrors)
+        evalInput.strictBuiltinErrors = true;
+    if (flags.explain)
+        evalInput.explain = flags.explain;
+    if (flags.profile)
+        evalInput.profile = true;
+    if (flags.coverage)
+        evalInput.coverage = true;
+    if (flags.metrics)
+        evalInput.metrics = true;
+    const result = await opa.eval(evalInput);
+    const subprocessFailure = mapSubprocessFailure(result, 'opa');
+    if (subprocessFailure)
+        return subprocessFailure;
+    // `opa eval` returns exit code 0 even when the query produces no
+    // results or partial results. A non-zero exit means a hard error
+    // (parse, type, runtime). Output JSON is on stdout.
+    const parsed = tryParseJson(result.stdout);
+    if (result.exitCode !== 0) {
+        return err('EVAL_ERROR', 'opa eval exited with an error.', {
+            details: parsed ?? { stderr: result.stderr.trim(), stdout: result.stdout.trim() },
+        });
+    }
+    if (parsed === undefined) {
+        return err('UNKNOWN_ERROR', 'opa eval produced no parseable JSON output.', {
+            details: { stdout: result.stdout.trim() },
+        });
+    }
+    return ok(parsed);
+}
+//# sourceMappingURL=_shared.js.map