@orygn/opa-mcp 0.1.11 → 0.1.12

package/dist/lib/rego-type-inferencer.js

@@ -0,0 +1,138 @@
+export function inferTypes(clauses, inputPaths) {
+    // Pass 1: collect every local-variable assignment as a raw VerifyValue.
+    // This covers both direct (x := input.age) and chained (x := y; y := input.age)
+    // assignments. resolveToInputPath follows chains transitively.
+    const localAssignments = new Map(); // local_var_name → assigned VerifyValue
+    for (const ruleClauses of clauses) {
+        for (const clause of ruleClauses) {
+            for (const expr of clause.expressions) {
+                if (expr.kind === 'assign') {
+                    localAssignments.set(expr.local, expr.value);
+                }
+            }
+        }
+    }
+    // Initialize evidence sets from all known paths.
+    const evidence = new Map();
+    for (const path of inputPaths.keys()) {
+        evidence.set(path, new Set());
+    }
+    // Pass 2: collect sort evidence from all expressions, resolving locals via the
+    // assignment map (transitively, so x := y; y := input.age propagates correctly).
+    for (const ruleClauses of clauses) {
+        for (const clause of ruleClauses) {
+            for (const expr of clause.expressions) {
+                collectEvidence(expr, evidence, localAssignments);
+            }
+        }
+    }
+    const sorts = new Map();
+    const conflicts = [];
+    for (const [path, ev] of evidence) {
+        if (ev.size === 0) {
+            sorts.set(path, 'string');
+        }
+        else if (ev.size === 1) {
+            const only = [...ev][0];
+            sorts.set(path, only);
+        }
+        else {
+            conflicts.push({
+                path,
+                reason: `Path '${path}' used as both ${[...ev].join(' and ')}; using uninterpreted sort (equality only).`,
+            });
+            sorts.set(path, 'uninterpreted');
+        }
+    }
+    return { sorts, conflicts };
+}
+function collectEvidence(expr, evidence, localAssignments) {
+    switch (expr.kind) {
+        case 'eq':
+        case 'neq':
+            addLiteralEvidence(expr.left, expr.right, evidence, localAssignments);
+            addLiteralEvidence(expr.right, expr.left, evidence, localAssignments);
+            break;
+        case 'assign':
+            // The local variable itself is not an input path; evidence flows via localAssignments.
+            break;
+        case 'gt':
+        case 'gte':
+        case 'lt':
+        case 'lte':
+            addSortEvidence(expr.left, 'int', evidence, localAssignments);
+            addSortEvidence(expr.right, 'int', evidence, localAssignments);
+            break;
+        case 'startswith':
+        case 'endswith':
+            addSortEvidence(expr.str, 'string', evidence, localAssignments);
+            break;
+        case 'contains':
+            addSortEvidence(expr.str, 'string', evidence, localAssignments);
+            break;
+        case 'regex_match':
+            addSortEvidence(expr.str, 'string', evidence, localAssignments);
+            break;
+        case 'bool_check':
+            addSortEvidence(expr.ref, 'bool', evidence, localAssignments);
+            break;
+        default:
+            break;
+    }
+}
+/**
+ * Follow an assignment chain from a VerifyValue back to an input path.
+ *
+ * Handles transitive local-variable chains:
+ *   x := y; y := input.age  →  resolveToInputPath(x) = 'input.age'
+ *
+ * Returns undefined when the chain terminates at a literal, an unaliased
+ * local, a data ref, or a cycle.
+ */
+function resolveToInputPath(value, localAssignments) {
+    const visited = new Set();
+    let current = value;
+    while (true) {
+        if (current.kind === 'input_ref')
+            return current.path;
+        if (current.kind !== 'local_var')
+            return undefined; // literal or unsupported
+        if (visited.has(current.name))
+            return undefined; // cycle guard
+        visited.add(current.name);
+        const next = localAssignments.get(current.name);
+        if (next === undefined)
+            return undefined; // unassigned local
+        current = next;
+    }
+}
+function addLiteralEvidence(subject, comparand, evidence, localAssignments) {
+    const path = resolveToInputPath(subject, localAssignments);
+    if (path === undefined)
+        return;
+    switch (comparand.kind) {
+        case 'literal_string':
+            addPathEvidence(path, 'string', evidence);
+            break;
+        case 'literal_number':
+            addPathEvidence(path, 'int', evidence);
+            break;
+        case 'literal_bool':
+            addPathEvidence(path, 'bool', evidence);
+            break;
+        default:
+            break;
+    }
+}
+function addSortEvidence(value, sort, evidence, localAssignments) {
+    const path = resolveToInputPath(value, localAssignments);
+    if (path === undefined)
+        return;
+    addPathEvidence(path, sort, evidence);
+}
+function addPathEvidence(path, sort, evidence) {
+    const ev = evidence.get(path);
+    if (ev !== undefined)
+        ev.add(sort);
+}
+//# sourceMappingURL=rego-type-inferencer.js.map

package/dist/lib/rego-type-inferencer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-type-inferencer.js","sourceRoot":"","sources":["../../src/lib/rego-type-inferencer.ts"],"names":[],"mappings":"AA0BA,MAAM,UAAU,UAAU,CACxB,OAA6B,EAC7B,UAAiC;IAEjC,wEAAwE;IACxE,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,wCAAwC;IACjG,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,+EAA+E;IAC/E,iFAAiF;IACjF,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,SAAS,GAA4C,EAAE,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI;gBACJ,MAAM,EAAE,SAAS,IAAI,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,6CAA6C;aAC1G,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,IAAgB,EAChB,QAAwC,EACxC,gBAA0C;IAE1C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACtE,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACtE,MAAM;QACR,KAAK,QAAQ;YACX,uFAAuF;YACvF,MAAM;QACR,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC9D,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC/D,MAAM;QACR,KAAK,YAAY,CAAC;QAClB,KAAK,UAAU;YACb,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAChE,MAAM;QACR,KAAK,UAAU;YACb,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAChE,MAAM;QACR,KAAK,aAAa;YAChB,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAChE,MAAM;QACR,KAAK,YAAY;YACf,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YAC9D,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,KAAkB,EAClB,gBAA0C;IAE1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,OAAO,GAAgB,KAAK,CAAC;IAEjC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,SAAS,CAAC,CAAC,yBAAyB;QAC7E,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,cAAc;QAC/D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,CAAC,mBAAmB;QAC7D,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoB,EACpB,SAAsB,EACtB,QAAwC,EACxC,gBAA0C;IAE1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,gBAAgB;YACnB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,gBAAgB;YACnB,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM;QACR,KAAK,cAAc;YACjB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAkB,EAClB,IAAkB,EAClB,QAAwC,EACxC,gBAA0C;IAE1C,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACzD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/B,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAkB,EAClB,QAAwC;IAExC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,EAAE,KAAK,SAAS;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/lib/rego-verify-engine.d.ts

@@ -0,0 +1,37 @@
+/**
+ * rego_verify engine - orchestrates the full verification pipeline:
+ *
+ *   Rego source
+ *     → opa parse (JSON AST)
+ *     → walkModule (IR)
+ *     → inferTypes (Z3 sorts)
+ *     → createInputVars (Z3 constants)
+ *     → encodeRule (Z3 Bool formula)
+ *     → negate / check property
+ *     → solver.check() → sat | unsat | unknown
+ *     → extractCounterexample (on sat)
+ *     → VerifyResult
+ */
+import type { OpaModule } from './rego-ast-types.js';
+import { type CounterexampleInput } from './rego-counterexample.js';
+import { type VerifyProperty } from './rego-property-parser.js';
+export type VerifyVerdict = 'proven' | 'counterexample' | 'inconclusive' | 'unsatisfiable';
+export interface VerifyResult {
+    verdict: VerifyVerdict;
+    property: string;
+    rule: string;
+    counterexample?: CounterexampleInput;
+    counterexampleFormatted?: string;
+    unsupportedConstructs: Array<{
+        constructType: string;
+        description: string;
+    }>;
+    warnings: string[];
+    message: string;
+}
+/**
+ * Run formal verification on a pre-parsed OPA module.
+ * The caller must pass the JSON-parsed result of `opa parse --format=json`.
+ */
+export declare function runVerify(ast: OpaModule, property: VerifyProperty, signal?: AbortSignal): Promise<VerifyResult>;
+//# sourceMappingURL=rego-verify-engine.d.ts.map

package/dist/lib/rego-verify-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-verify-engine.d.ts","sourceRoot":"","sources":["../../src/lib/rego-verify-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUlF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,CAAC;AAE3F,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,SAAS,EACd,QAAQ,EAAE,cAAc,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,YAAY,CAAC,CAuKvB"}

package/dist/lib/rego-verify-engine.js

@@ -0,0 +1,236 @@
+import { walkModule } from './rego-ast-walker.js';
+import { inferTypes } from './rego-type-inferencer.js';
+import { createInputVars, encodeRule } from './rego-smt-encoder.js';
+import { extractCounterexample, formatCounterexample, } from './rego-counterexample.js';
+import { describeProperty } from './rego-property-parser.js';
+import { getZ3 } from './rego-z3.js';
+// Monotonically increasing counter used to generate a unique prefix for all
+// Z3 constant names within each runVerify call. This prevents sort conflicts
+// when the same input path is inferred with different sorts across calls
+// (e.g. two policies using input.x as string vs int) within the shared Z3
+// singleton context.
+let _verifyCallCounter = 0;
+/** Timeout for Z3 solver in milliseconds. */
+const SOLVER_TIMEOUT_MS = 10_000;
+/**
+ * Run formal verification on a pre-parsed OPA module.
+ * The caller must pass the JSON-parsed result of `opa parse --format=json`.
+ */
+export async function runVerify(ast, property, signal) {
+    const walked = walkModule(ast);
+    const warnings = [];
+    const targetClauses = walked.rules.get(property.ruleName);
+    // Collect only the construct types that actually appear in the target rule's
+    // clause expressions. This prevents unsupported constructs from OTHER rules
+    // in the same module (e.g. a "deny" rule with NAF) from being reported when
+    // verifying an unrelated "allow" rule that is fully encodable.
+    const unsupportedTypesInTarget = new Set();
+    for (const clause of targetClauses ?? []) {
+        for (const expr of clause.expressions) {
+            if (expr.kind === 'unsupported')
+                unsupportedTypesInTarget.add(expr.constructType);
+        }
+    }
+    const unsupportedInRule = walked.unsupported.filter((u) => unsupportedTypesInTarget.has(u.constructType));
+    if (targetClauses === undefined || targetClauses.length === 0) {
+        // A default-only rule (e.g. "default allow = false") has no clauses but a known
+        // constant value -- derive the correct verdict without running Z3.
+        const defaultValue = walked.defaults.get(property.ruleName);
+        if (typeof defaultValue === 'boolean') {
+            return solveDefaultOnlyRule(property, defaultValue, unsupportedInRule, warnings);
+        }
+        return inconclusive(property, `Rule "${property.ruleName}" not found in the provided policy.`, unsupportedInRule, warnings);
+    }
+    // Any clause with an unsupported expression makes verification incomplete.
+    const hasUnsupportedInClauses = targetClauses.some((c) => c.expressions.some((e) => e.kind === 'unsupported'));
+    if (hasUnsupportedInClauses) {
+        return inconclusive(property, `Rule "${property.ruleName}" contains constructs that cannot be encoded in Z3 (e.g. negation-as-failure, comprehensions, built-ins beyond string/comparison ops). Verification is inconclusive.`, unsupportedInRule, warnings);
+    }
+    // Type inference + Z3 setup
+    const typeResult = inferTypes([...walked.rules.values()], walked.inputPaths);
+    for (const conflict of typeResult.conflicts) {
+        warnings.push(conflict.reason);
+    }
+    signal?.throwIfAborted();
+    const Z3 = await getZ3();
+    signal?.throwIfAborted();
+    const callId = `v${_verifyCallCounter++}`;
+    const inputVars = createInputVars(Z3, walked.inputPaths, typeResult.sorts, callId);
+    const ctx = { Z3, inputVars, sorts: typeResult.sorts, callId };
+    const encoded = encodeRule(targetClauses, ctx);
+    warnings.push(...encoded.warnings);
+    // Z3's high-level Solver and Model objects use FinalizationRegistry internally
+    // (solver_dec_ref / model_dec_ref) so they are cleaned up when GC'd.
+    // We avoid holding a reference to the Model beyond extractCounterexample so
+    // it becomes eligible for GC as soon as the call returns, reducing WASM heap
+    // pressure under high call volume.
+    const solver = new Z3.Solver();
+    // Set timeout to prevent hanging on complex policies
+    solver.set('timeout', SOLVER_TIMEOUT_MS);
+    switch (property.kind) {
+        case 'always_true':
+            // Prove rule is always true: check if NOT(rule) is satisfiable.
+            // SAT → counterexample (input where rule is false)
+            // UNSAT → proven always true
+            solver.add(Z3.Not(encoded.formula));
+            break;
+        case 'never_true':
+            // Prove rule is never true: check if rule IS satisfiable.
+            // SAT → counterexample (input where rule fires, violating "never")
+            // UNSAT → proven never true
+            solver.add(encoded.formula);
+            break;
+        case 'satisfiable':
+            // Check if any input satisfies the rule.
+            // SAT → witness found (not a bug, just a satisfying input)
+            // UNSAT → rule is vacuously false / dead code
+            solver.add(encoded.formula);
+            break;
+    }
+    signal?.throwIfAborted();
+    const solverResult = await solver.check();
+    if (solverResult === 'unknown') {
+        return inconclusive(property, `Z3 solver returned "unknown" (timeout or resource limit reached after ${SOLVER_TIMEOUT_MS}ms). The policy may be too complex for automated verification.`, unsupportedInRule, warnings);
+    }
+    if (solverResult === 'unsat') {
+        if (property.kind === 'satisfiable') {
+            // No satisfying input exists -- rule is dead code or has contradictory conditions.
+            return {
+                verdict: 'unsatisfiable',
+                property: describeProperty(property),
+                rule: property.ruleName,
+                unsupportedConstructs: unsupportedInRule,
+                warnings,
+                message: `UNSATISFIABLE: No input can make "${property.ruleName}" true. The rule may be dead code or have contradictory conditions.`,
+            };
+        }
+        // For always_true / never_true: UNSAT on the negation = property proven
+        return {
+            verdict: 'proven',
+            property: describeProperty(property),
+            rule: property.ruleName,
+            unsupportedConstructs: unsupportedInRule,
+            warnings,
+            message: `PROVEN: ${describeProperty(property)}.`,
+        };
+    }
+    // SAT: pass solver.model() inline so the Model object is not kept alive
+    // beyond extractCounterexample -- it becomes GC-eligible immediately after.
+    const ce = extractCounterexample(solver.model(), inputVars, typeResult.sorts);
+    const ceFormatted = formatCounterexample(ce);
+    if (property.kind === 'satisfiable') {
+        return {
+            verdict: 'proven',
+            property: describeProperty(property),
+            rule: property.ruleName,
+            counterexample: ce,
+            counterexampleFormatted: ceFormatted,
+            unsupportedConstructs: unsupportedInRule,
+            warnings,
+            message: `SATISFIABLE: Found an input that makes "${property.ruleName}" true.\n\nWitness input:\n${ceFormatted}`,
+        };
+    }
+    // always_true / never_true: SAT means we found a violation
+    const ceLabel = property.kind === 'always_true'
+        ? 'input where rule is FALSE'
+        : 'input where rule is TRUE (violates "never")';
+    return {
+        verdict: 'counterexample',
+        property: describeProperty(property),
+        rule: property.ruleName,
+        counterexample: ce,
+        counterexampleFormatted: ceFormatted,
+        unsupportedConstructs: unsupportedInRule,
+        warnings,
+        message: `COUNTEREXAMPLE: Property does NOT hold. Found ${ceLabel}:\n\n${ceFormatted}`,
+    };
+}
+function inconclusive(property, reason, unsupportedConstructs, warnings) {
+    return {
+        verdict: 'inconclusive',
+        property: describeProperty(property),
+        rule: property.ruleName,
+        unsupportedConstructs,
+        warnings,
+        message: `INCONCLUSIVE: ${reason}`,
+    };
+}
+/**
+ * Return the correct verdict for a rule that has no non-default clauses
+ * (e.g. "default allow = false"). The rule always evaluates to its constant
+ * default value, so no Z3 solving is needed.
+ */
+function solveDefaultOnlyRule(property, defaultValue, unsupportedConstructs, warnings) {
+    // An empty input object is a valid witness/counterexample since the rule
+    // fires (or doesn't) unconditionally regardless of input.
+    const emptyWitness = {};
+    const emptyFormatted = formatCounterexample(emptyWitness);
+    const prop = describeProperty(property);
+    const name = property.ruleName;
+    switch (property.kind) {
+        case 'always_true':
+            if (defaultValue) {
+                return {
+                    verdict: 'proven',
+                    property: prop,
+                    rule: name,
+                    unsupportedConstructs,
+                    warnings,
+                    message: `PROVEN: ${prop}. Rule "${name}" is defined only as "default = true" and is always true.`,
+                };
+            }
+            return {
+                verdict: 'counterexample',
+                property: prop,
+                rule: name,
+                counterexample: emptyWitness,
+                counterexampleFormatted: emptyFormatted,
+                unsupportedConstructs,
+                warnings,
+                message: `COUNTEREXAMPLE: Rule "${name}" is defined only as "default = false" and is never true. Any input is a counterexample to "always true".`,
+            };
+        case 'never_true':
+            if (!defaultValue) {
+                return {
+                    verdict: 'proven',
+                    property: prop,
+                    rule: name,
+                    unsupportedConstructs,
+                    warnings,
+                    message: `PROVEN: ${prop}. Rule "${name}" is defined only as "default = false" and is never true.`,
+                };
+            }
+            return {
+                verdict: 'counterexample',
+                property: prop,
+                rule: name,
+                counterexample: emptyWitness,
+                counterexampleFormatted: emptyFormatted,
+                unsupportedConstructs,
+                warnings,
+                message: `COUNTEREXAMPLE: Rule "${name}" is defined only as "default = true" and is always true. Any input is a counterexample to "never true".`,
+            };
+        case 'satisfiable':
+            if (defaultValue) {
+                return {
+                    verdict: 'proven',
+                    property: prop,
+                    rule: name,
+                    counterexample: emptyWitness,
+                    counterexampleFormatted: emptyFormatted,
+                    unsupportedConstructs,
+                    warnings,
+                    message: `SATISFIABLE: Rule "${name}" is defined only as "default = true" -- any input satisfies it.`,
+                };
+            }
+            return {
+                verdict: 'unsatisfiable',
+                property: prop,
+                rule: name,
+                unsupportedConstructs,
+                warnings,
+                message: `UNSATISFIABLE: Rule "${name}" is defined only as "default = false" -- no input can make it true.`,
+            };
+    }
+}
+//# sourceMappingURL=rego-verify-engine.js.map

package/dist/lib/rego-verify-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-verify-engine.js","sourceRoot":"","sources":["../../src/lib/rego-verify-engine.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAErC,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,qBAAqB;AACrB,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAe3B,6CAA6C;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAc,EACd,QAAwB,EACxB,MAAoB;IAEpB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+DAA+D;IAC/D,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,aAAa,IAAI,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;gBAAE,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACxD,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAC9C,CAAC;IAEF,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,OAAO,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,qCAAqC,EAC/D,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,MAAM,uBAAuB,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CACpD,CAAC;IACF,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,YAAY,CACjB,QAAQ,EACR,SAAS,QAAQ,CAAC,QAAQ,sKAAsK,EAChM,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7E,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IAEzB,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnC,+EAA+E;IAC/E,qEAAqE;IACrE,4EAA4E;IAC5E,6EAA6E;IAC7E,mCAAmC;IACnC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;IAE/B,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEzC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,aAAa;YAChB,gEAAgE;YAChE,mDAAmD;YACnD,6BAA6B;YAC7B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,MAAM;QACR,KAAK,YAAY;YACf,0DAA0D;YAC1D,mEAAmE;YACnE,4BAA4B;YAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM;QACR,KAAK,aAAa;YAChB,yCAAyC;YACzC,2DAA2D;YAC3D,8CAA8C;YAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM;IACV,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAE1C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,YAAY,CACjB,QAAQ,EACR,yEAAyE,iBAAiB,gEAAgE,EAC1J,iBAAiB,EACjB,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,mFAAmF;YACnF,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;gBACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,qBAAqB,EAAE,iBAAiB;gBACxC,QAAQ;gBACR,OAAO,EAAE,qCAAqC,QAAQ,CAAC,QAAQ,qEAAqE;aACrI,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;YACvB,qBAAqB,EAAE,iBAAiB;YACxC,QAAQ;YACR,OAAO,EAAE,WAAW,gBAAgB,CAAC,QAAQ,CAAC,GAAG;SAClD,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;YACvB,cAAc,EAAE,EAAE;YAClB,uBAAuB,EAAE,WAAW;YACpC,qBAAqB,EAAE,iBAAiB;YACxC,QAAQ;YACR,OAAO,EAAE,2CAA2C,QAAQ,CAAC,QAAQ,8BAA8B,WAAW,EAAE;SACjH,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,aAAa;QAC7B,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,6CAA6C,CAAC;IAEpD,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,cAAc,EAAE,EAAE;QAClB,uBAAuB,EAAE,WAAW;QACpC,qBAAqB,EAAE,iBAAiB;QACxC,QAAQ;QACR,OAAO,EAAE,iDAAiD,OAAO,QAAQ,WAAW,EAAE;KACvF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,QAAwB,EACxB,MAAc,EACd,qBAA4E,EAC5E,QAAkB;IAElB,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ;QACvB,qBAAqB;QACrB,QAAQ;QACR,OAAO,EAAE,iBAAiB,MAAM,EAAE;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,QAAwB,EACxB,YAAqB,EACrB,qBAA4E,EAC5E,QAAkB;IAElB,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAE/B,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,2GAA2G;aAClJ,CAAC;QAEJ,KAAK,YAAY;YACf,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,WAAW,IAAI,WAAW,IAAI,2DAA2D;iBACnG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,cAAc,EAAE,YAAY;gBAC5B,uBAAuB,EAAE,cAAc;gBACvC,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,yBAAyB,IAAI,0GAA0G;aACjJ,CAAC;QAEJ,KAAK,aAAa;YAChB,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,QAAQ;oBACjB,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;oBACV,cAAc,EAAE,YAAY;oBAC5B,uBAAuB,EAAE,cAAc;oBACvC,qBAAqB;oBACrB,QAAQ;oBACR,OAAO,EAAE,sBAAsB,IAAI,kEAAkE;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,IAAI;gBACV,qBAAqB;gBACrB,QAAQ;gBACR,OAAO,EAAE,wBAAwB,IAAI,sEAAsE;aAC5G,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/lib/rego-z3.d.ts

@@ -0,0 +1,13 @@
+import type { init as Z3Init } from 'z3-solver';
+export type Z3Context = ReturnType<Awaited<ReturnType<typeof Z3Init>>['Context']>;
+/**
+ * Return the shared Z3 Context, initializing WASM on first call.
+ * Safe to call from concurrent async paths.
+ */
+export declare function getZ3(): Promise<Z3Context>;
+/**
+ * Reset the singleton - intended for test teardown only.
+ * Do NOT call in production paths; re-init is expensive.
+ */
+export declare function resetZ3ForTesting(): void;
+//# sourceMappingURL=rego-z3.d.ts.map

package/dist/lib/rego-z3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-z3.d.ts","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,WAAW,CAAC;AAKhD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAKlF;;;GAGG;AACH,wBAAsB,KAAK,IAAI,OAAO,CAAC,SAAS,CAAC,CAKhD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}

package/dist/lib/rego-z3.js

@@ -0,0 +1,29 @@
+/**
+ * Z3 singleton initialization.
+ *
+ * The z3-solver WASM module takes ~500ms to load and must only be
+ * initialized once per process. Concurrent calls safely await the
+ * same promise. Each verification call creates its own fresh Solver
+ * from the shared Context, so contexts never accumulate stale state.
+ */
+import { init } from 'z3-solver';
+// Module-level singleton
+let z3InitPromise = null;
+/**
+ * Return the shared Z3 Context, initializing WASM on first call.
+ * Safe to call from concurrent async paths.
+ */
+export async function getZ3() {
+    if (z3InitPromise === null) {
+        z3InitPromise = init().then(({ Context }) => Context('main'));
+    }
+    return z3InitPromise;
+}
+/**
+ * Reset the singleton - intended for test teardown only.
+ * Do NOT call in production paths; re-init is expensive.
+ */
+export function resetZ3ForTesting() {
+    z3InitPromise = null;
+}
+//# sourceMappingURL=rego-z3.js.map

package/dist/lib/rego-z3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rego-z3.js","sourceRoot":"","sources":["../../src/lib/rego-z3.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,yBAAyB;AACzB,IAAI,aAAa,GAA4B,IAAI,CAAC;AAElD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,aAAa,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,aAAmC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,aAAa,GAAG,IAAI,CAAC;AACvB,CAAC"}

package/dist/tools/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAW3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAa9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAY3E"}

package/dist/tools/helpers/index.js

@@ -8,6 +8,7 @@ import { registerRegoInferInputSchema } from './infer-input-schema.js';
 import { registerRegoPolicyDiff } from './policy-diff.js';
 import { registerRegoSecurityAudit } from './security-audit.js';
 import { registerRegoSuggestFix } from './suggest-fix.js';
+import { registerRegoVerify } from './verify.js';
 export function registerHelperTools(server, config) {
     registerRegoExplainDecision(server, config);
     registerRegoGenerateTestSkeleton(server, config);
@@ -19,5 +20,6 @@ export function registerHelperTools(server, config) {
     registerRegoFix(server, config);
     registerRegoFormatWrite(server, config);
     registerRegoPolicyDiff(server, config);
+    registerRegoVerify(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/tools/helpers/verify.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerRegoVerify(server: McpServer, config: Config): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/tools/helpers/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/verify.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAqB9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA8D1E"}

package/dist/tools/helpers/verify.js

@@ -0,0 +1,75 @@
+/**
+ * `rego_verify` -- formal SMT-based policy verification.
+ *
+ * Uses Microsoft Z3 (via WASM) to mathematically prove or disprove
+ * a property about a Rego rule for ALL possible inputs. Returns a
+ * concrete counterexample when the property fails.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+import { parseProperty } from '../../lib/rego-property-parser.js';
+import { runVerify } from '../../lib/rego-verify-engine.js';
+const RegoVerifyInput = {
+    source: z.string().min(1).describe('Rego source to verify.'),
+    rule: z.string().min(1).describe('Name of the rule to verify (e.g. "allow", "deny").'),
+    kind: z
+        .enum(['always_true', 'never_true', 'satisfiable'])
+        .describe('Property to prove:\n' +
+        '  always_true  - rule is true for every possible input (finds inputs that violate this)\n' +
+        '  never_true   - rule is never true for any input (finds inputs that trigger it)\n' +
+        '  satisfiable  - at least one input exists where rule is true (returns a witness)'),
+};
+export function registerRegoVerify(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_verify', {
+        title: 'Formally verify a Rego policy rule',
+        description: 'Formally verify a property about a Rego rule using SMT solving (Microsoft Z3). ' +
+            'Unlike testing, this checks ALL possible inputs and either proves the property holds or ' +
+            'returns a concrete counterexample input that falsifies it. ' +
+            'Supports equality, comparison, startswith, endswith, contains, regex.match, and multi-clause rules. ' +
+            'Reports INCONCLUSIVE for negation-as-failure (not), comprehensions, and other unsupported constructs.',
+        inputSchema: RegoVerifyInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ source, rule, kind }, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // Parse property spec
+            const { property, errors: propErrors } = parseProperty({ rule, kind });
+            if (propErrors.length > 0) {
+                return err('INVALID_INPUT', 'Invalid property specification.', {
+                    details: { errors: propErrors },
+                });
+            }
+            // Parse the Rego source via OPA
+            const parseResult = await opa.parse({ source }, signal);
+            const subprocessFailure = mapSubprocessFailure(parseResult, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (parseResult.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa parse rejected the policy source.', {
+                    hint: 'Fix syntax errors before verifying.',
+                    details: { stderr: parseResult.stderr.trim() },
+                });
+            }
+            const ast = tryParseJson(parseResult.stdout);
+            if (ast === undefined) {
+                return err('UNKNOWN_ERROR', 'opa parse produced no parseable JSON AST.');
+            }
+            // Run the verification pipeline
+            const result = await runVerify(ast, property, signal);
+            const warnings = [...result.warnings];
+            if (result.unsupportedConstructs.length > 0) {
+                warnings.push(`${result.unsupportedConstructs.length} unsupported construct(s) were skipped: ` +
+                    result.unsupportedConstructs.map((u) => u.constructType).join(', '));
+            }
+            return ok(result, warnings.length > 0 ? warnings : undefined);
+        });
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/tools/helpers/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/helpers/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAqB,MAAM,iCAAiC,CAAC;AAG/E,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;SAClD,QAAQ,CACP,sBAAsB;QACpB,2FAA2F;QAC3F,oFAAoF;QACpF,mFAAmF,CACtF;CACJ,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,iFAAiF;YACjF,0FAA0F;YAC1F,6DAA6D;YAC7D,sGAAsG;YACtG,uGAAuG;QACzG,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3C,OAAO,gBAAgB,CAAe,MAAM,EAAE,KAAK,IAAI,EAAE;YACvD,sBAAsB;YACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,eAAe,EAAE,iCAAiC,EAAE;oBAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;iBAChC,CAAC,CAAC;YACL,CAAC;YAED,gCAAgC;YAChC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,CAAC,cAAc,EAAE,uCAAuC,EAAE;oBAClE,IAAI,EAAE,qCAAqC;oBAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAY,WAAW,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;YAC3E,CAAC;YAED,gCAAgC;YAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAS,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,QAAQ,GAAa,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,0CAA0C;oBAC9E,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACtE,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAe,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -5,7 +5,7 @@
  * here in order; ordering doesn't affect behavior but keeps the
  * declaration site tidy.
  *
- * Tools (48 total):
+ * Tools (49 total):
  *   Category A -- Authoring:        rego_format, rego_check,
  *                                   rego_check_schema, rego_lint,
  *                                   rego_parse_ast, rego_inspect,
@@ -30,7 +30,8 @@
  *                                   rego_security_audit,
  *                                   rego_infer_input_schema,
  *                                   rego_fix, rego_format_write,
- *                                   rego_migrate_v1, rego_policy_diff
+ *                                   rego_migrate_v1, rego_policy_diff,
+ *                                   rego_verify
  *   Category F -- Conftest:         conftest_test, conftest_verify,
  *                                   conftest_pull, conftest_push
  *   Category G -- Meta:             mcp_server_info

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrE"}

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}