@orygn/opa-mcp 0.1.11 → 0.1.12

package/dist/lib/rego-ir.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Intermediate Representation produced by the AST walker and consumed by
+ * the SMT encoder. This layer insulates the encoder from OPA AST details:
+ * the walker owns all AST knowledge, the encoder owns all Z3 knowledge.
+ */
+/**
+ * A value that appears as an operand in a VerifyExpr.
+ *
+ * input_ref   - a path like input.user.role (path = "input.user.role",
+ *               segments = ["user","role"])
+ * local_var   - a local variable bound by :=/= in the same clause
+ * literal_*   - a constant from the policy source
+ */
+export type VerifyValue = {
+    kind: 'input_ref';
+    path: string;
+    segments: string[];
+} | {
+    kind: 'local_var';
+    name: string;
+} | {
+    kind: 'literal_string';
+    value: string;
+} | {
+    kind: 'literal_number';
+    value: number;
+} | {
+    kind: 'literal_bool';
+    value: boolean;
+} | {
+    kind: 'literal_null';
+};
+/**
+ * A single verifiable expression derived from a rule body expression.
+ *
+ * All supported operator semantics map cleanly to Z3. The 'unsupported'
+ * variant is included so the walker can pass through the reason; the
+ * engine treats any clause containing it as inconclusive.
+ */
+export type VerifyExpr = {
+    kind: 'eq';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'neq';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'lt';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'lte';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'gt';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'gte';
+    left: VerifyValue;
+    right: VerifyValue;
+} | {
+    kind: 'startswith';
+    str: VerifyValue;
+    prefix: VerifyValue;
+} | {
+    kind: 'endswith';
+    str: VerifyValue;
+    suffix: VerifyValue;
+} | {
+    kind: 'contains';
+    str: VerifyValue;
+    sub: VerifyValue;
+} | {
+    kind: 'regex_match';
+    pattern: VerifyValue;
+    str: VerifyValue;
+} | {
+    kind: 'bool_check';
+    ref: VerifyValue;
+} | {
+    kind: 'assign';
+    local: string;
+    value: VerifyValue;
+} | {
+    kind: 'unsupported';
+    constructType: string;
+    reason: string;
+};
+/**
+ * One clause of a rule -- corresponds to one `rule { body... }` block.
+ * Multiple clauses for the same rule name are OR'd together.
+ * Expressions within one clause are AND'd together.
+ */
+export interface VerifyRuleClause {
+    clauseIndex: number;
+    headValue: boolean | number | string | null;
+    expressions: VerifyExpr[];
+}
+export interface UnsupportedConstruct {
+    constructType: string;
+    description: string;
+    location?: {
+        row: number;
+        col: number;
+        file?: string;
+    };
+}
+export interface VerifyWalkResult {
+    rules: Map<string, VerifyRuleClause[]>;
+    defaults: Map<string, boolean | number | string | null>;
+    inputPaths: Map<string, string[]>;
+    unsupported: UnsupportedConstruct[];
+}
+//# sourceMappingURL=rego-ir.d.ts.map

package/dist/lib/rego-ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-ir.d.ts","sourceRoot":"","sources":["../../src/lib/rego-ir.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,WAAW,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACvC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC;IACxD,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC"}

package/dist/lib/rego-ir.js

@@ -0,0 +1,7 @@
+/**
+ * Intermediate Representation produced by the AST walker and consumed by
+ * the SMT encoder. This layer insulates the encoder from OPA AST details:
+ * the walker owns all AST knowledge, the encoder owns all Z3 knowledge.
+ */
+export {};
+//# sourceMappingURL=rego-ir.js.map

package/dist/lib/rego-ir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-ir.js","sourceRoot":"","sources":["../../src/lib/rego-ir.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/lib/rego-property-parser.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Parse and validate user-supplied verification property specs.
+ *
+ * The property spec drives what the SMT engine proves:
+ *   always_true  - rule evaluates to true for EVERY possible input
+ *                  (engine finds inputs where rule is false, expects UNSAT)
+ *   never_true   - rule is never true for any input
+ *                  (engine finds inputs where rule is true, expects UNSAT)
+ *   satisfiable  - at least one input exists that makes rule true
+ *                  (engine checks SAT directly, any model is a witness)
+ */
+export type PropertyKind = 'always_true' | 'never_true' | 'satisfiable';
+export interface VerifyProperty {
+    ruleName: string;
+    kind: PropertyKind;
+}
+export interface PropertyParseError {
+    field: string;
+    message: string;
+}
+export interface PropertyParseResult {
+    property: VerifyProperty | null;
+    errors: PropertyParseError[];
+}
+/**
+ * Parse a raw property object from MCP tool input.
+ * Returns errors array (non-empty = invalid).
+ */
+export declare function parseProperty(raw: unknown): PropertyParseResult;
+/**
+ * Human-readable description of a property for use in result messages.
+ */
+export declare function describeProperty(property: VerifyProperty): string;
+//# sourceMappingURL=rego-property-parser.d.ts.map

package/dist/lib/rego-property-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-property-parser.d.ts","sourceRoot":"","sources":["../../src/lib/rego-property-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,YAAY,GAAG,aAAa,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,CAmC/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CASjE"}

package/dist/lib/rego-property-parser.js

@@ -0,0 +1,60 @@
+/**
+ * Parse and validate user-supplied verification property specs.
+ *
+ * The property spec drives what the SMT engine proves:
+ *   always_true  - rule evaluates to true for EVERY possible input
+ *                  (engine finds inputs where rule is false, expects UNSAT)
+ *   never_true   - rule is never true for any input
+ *                  (engine finds inputs where rule is true, expects UNSAT)
+ *   satisfiable  - at least one input exists that makes rule true
+ *                  (engine checks SAT directly, any model is a witness)
+ */
+const VALID_KINDS = new Set(['always_true', 'never_true', 'satisfiable']);
+/**
+ * Parse a raw property object from MCP tool input.
+ * Returns errors array (non-empty = invalid).
+ */
+export function parseProperty(raw) {
+    const errors = [];
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        errors.push({ field: 'property', message: 'Must be an object with "rule" and "kind" fields.' });
+        return { property: null, errors };
+    }
+    const obj = raw;
+    if (typeof obj['rule'] !== 'string' || obj['rule'].trim() === '') {
+        errors.push({
+            field: 'rule',
+            message: 'Must be a non-empty string naming the Rego rule to verify.',
+        });
+    }
+    if (typeof obj['kind'] !== 'string' || !VALID_KINDS.has(obj['kind'])) {
+        errors.push({
+            field: 'kind',
+            message: `Must be one of: ${[...VALID_KINDS].join(', ')}.`,
+        });
+    }
+    if (errors.length > 0) {
+        return { property: null, errors };
+    }
+    return {
+        property: {
+            ruleName: obj['rule'].trim(),
+            kind: obj['kind'],
+        },
+        errors: [],
+    };
+}
+/**
+ * Human-readable description of a property for use in result messages.
+ */
+export function describeProperty(property) {
+    switch (property.kind) {
+        case 'always_true':
+            return `"${property.ruleName}" is true for all possible inputs`;
+        case 'never_true':
+            return `"${property.ruleName}" is never true (always false/undefined) for any input`;
+        case 'satisfiable':
+            return `"${property.ruleName}" is true for at least one input`;
+    }
+}
+//# sourceMappingURL=rego-property-parser.js.map

package/dist/lib/rego-property-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-property-parser.js","sourceRoot":"","sources":["../../src/lib/rego-property-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAe,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;QAChG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAiB,CAAC,EAAE,CAAC;QACrF,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,mBAAmB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE;YACR,QAAQ,EAAG,GAAG,CAAC,MAAM,CAAY,CAAC,IAAI,EAAE;YACxC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAiB;SAClC;QACD,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,IAAI,QAAQ,CAAC,QAAQ,mCAAmC,CAAC;QAClE,KAAK,YAAY;YACf,OAAO,IAAI,QAAQ,CAAC,QAAQ,wDAAwD,CAAC;QACvF,KAAK,aAAa;YAChB,OAAO,IAAI,QAAQ,CAAC,QAAQ,kCAAkC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/lib/rego-smt-encoder.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SMT encoder: translates a VerifyWalkResult into Z3 formulas.
+ *
+ * The encoder knows Z3 API details but knows nothing about OPA AST.
+ * It receives typed IR from the walker and produces Z3 Bool expressions.
+ *
+ * Design:
+ *   - One Z3 constant per input path, typed by the type inferencer.
+ *   - One Z3 constant per local variable, scoped per clause.
+ *   - Each clause body becomes an AND of its expression formulas.
+ *   - The full rule formula is an OR of all its clause formulas.
+ *   - Uninterpreted sorts get a dedicated Z3 uninterpreted sort and
+ *     can only participate in equality/inequality constraints.
+ */
+import type { init as Z3Init } from 'z3-solver';
+import type { Z3Sort } from './rego-type-inferencer.js';
+import type { VerifyRuleClause } from './rego-ir.js';
+type Z3Context = ReturnType<Awaited<ReturnType<typeof Z3Init>>['Context']>;
+type Z3Bool = ReturnType<Z3Context['Bool']['const']>;
+type Z3AnyExpr = Z3Bool | ReturnType<Z3Context['Int']['const']> | ReturnType<Z3Context['String']['const']>;
+export interface EncoderContext {
+    Z3: Z3Context;
+    inputVars: Map<string, Z3AnyExpr>;
+    sorts: Map<string, Z3Sort>;
+    /** Per-call unique prefix for all Z3 constant names. Prevents sort conflicts
+     *  when the same input path is inferred as different sorts across calls in the
+     *  same Z3 singleton context (e.g. one policy treats input.x as string, another
+     *  as int). Each call gets a fresh prefix so constants never collide. */
+    callId: string;
+}
+export interface EncodedRule {
+    formula: Z3Bool;
+    warnings: string[];
+}
+/**
+ * Create Z3 constants for all input paths based on inferred sorts.
+ * Each constant name is prefixed with callId to ensure uniqueness across
+ * verification calls in the same Z3 singleton context.
+ */
+export declare function createInputVars(Z3: Z3Context, inputPaths: Map<string, string[]>, sorts: Map<string, Z3Sort>, callId: string): Map<string, Z3AnyExpr>;
+/**
+ * Encode a complete rule as a Z3 Bool formula.
+ * rule_formula = clause_0 OR clause_1 OR ... OR clause_n
+ */
+export declare function encodeRule(clauses: VerifyRuleClause[], ctx: EncoderContext): EncodedRule;
+/** Convert an input path like "input.user.role" to a valid Z3 var name. */
+export declare function pathToVarName(path: string): string;
+/** Reconstruct a nested JSON object from flat Z3 var name → value pairs. */
+export declare function varNameToPath(varName: string): string;
+type Z3Re = ReturnType<Z3Context['Re']['toRe']>;
+/**
+ * Compile a PCRE/RE2 pattern string to a Z3 regex expression.
+ * Falls back to exact literal match for unrecognized constructs.
+ */
+export declare function compilePcreToZ3Re(Z3: Z3Context, pattern: string): Z3Re;
+export {};
+//# sourceMappingURL=rego-smt-encoder.d.ts.map

package/dist/lib/rego-smt-encoder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-smt-encoder.d.ts","sourceRoot":"","sources":["../../src/lib/rego-smt-encoder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAc,gBAAgB,EAAe,MAAM,cAAc,CAAC;AAE9E,KAAK,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3E,KAAK,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrD,KAAK,SAAS,GACV,MAAM,GACN,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GACrC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B;;;6EAGyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACjC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,MAAM,EAAE,MAAM,GACb,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CA2BxB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,EAAE,cAAc,GAAG,WAAW,CAuBxF;AAwQD,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AA4ED,KAAK,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAGhD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMtE"}