@orygn/opa-mcp 0.1.11 → 0.1.13

package/dist/tools/evaluation/test.js

@@ -1,8 +1,10 @@
 /**
  * `rego_test` -- run Rego unit tests via `opa test`.
  *
- * Returns per-test pass/fail records. With `coverage: true`, returns
- * per-line coverage data alongside the test results.
+ * Returns per-test pass/fail records. With `coverage: true` or `threshold`,
+ * OPA switches to coverage-report output mode: stdout becomes a coverage
+ * JSON object (no test-record array), and a threshold failure causes OPA to
+ * exit non-zero with a human-readable message on stderr.
  */
 import { z } from 'zod';
 import { OpaCli } from '../../lib/opa-cli.js';
@@ -14,14 +16,30 @@ const RegoTestInput = {
         .min(1)
         .describe('Test directories or files. `opa test` looks for `*_test.rego` siblings of source files.'),
     verbose: z.boolean().optional().describe('Emit per-test pass/fail details.'),
-    coverage: z.boolean().optional().describe('Include per-line coverage data in the output.'),
-    runPattern: z.string().optional().describe('Run only tests whose names match this regex.'),
+    coverage: z
+        .boolean()
+        .optional()
+        .describe('Include per-line coverage data. Switches output to coverage-report mode: test record counts are not available, but `coverage` and `coveragePct` fields are populated.'),
+    runPattern: z
+        .string()
+        .optional()
+        .describe('Run only tests whose names match this regular expression (passed as `--run`).'),
+    threshold: z
+        .number()
+        .min(0)
+        .max(100)
+        .optional()
+        .describe('Minimum coverage percentage required (0–100). Returns COVERAGE_BELOW_THRESHOLD when actual coverage falls below this value. Implicitly enables coverage-report output mode.'),
+    varValues: z
+        .boolean()
+        .optional()
+        .describe('Include local variable bindings in trace output (`--var-values`). When a table-driven test using `every tc in cases { ... }` fails, the trace shows which `tc` triggered the failure. Has no effect unless `verbose: true` is also set (OPA only emits trace entries in verbose mode).'),
 };
 export function registerRegoTest(server, config) {
     const opa = new OpaCli(config);
     server.registerTool('rego_test', {
         title: 'Run Rego tests',
-        description: 'Run Rego unit tests with `opa test`. Returns aggregate pass/fail counts plus per-test records. Tests live in `*_test.rego` files; rule names beginning with `test_` are picked up.',
+        description: 'Run Rego unit tests with `opa test`. Returns aggregate pass/fail counts plus per-test records. Tests live in `*_test.rego` files; rule names beginning with `test_` are picked up. Use `runPattern` to filter by name regex. Use `threshold` to gate on a minimum coverage percentage (returns COVERAGE_BELOW_THRESHOLD on failure). Use `varValues: true` with `verbose: true` to include local variable bindings in the trace -- essential for debugging table-driven tests written with `every tc in cases { ... }` to identify which case caused a failure. Note: enabling `coverage` or `threshold` switches OPA to coverage-report output mode -- per-test counts are unavailable but `coverage` and `coveragePct` fields are populated.',
         inputSchema: RegoTestInput,
         annotations: {
             readOnlyHint: true,
@@ -29,52 +47,121 @@ export function registerRegoTest(server, config) {
             idempotentHint: true,
             openWorldHint: false,
         },
-    }, async ({ paths, verbose, coverage, runPattern }, { signal }) => {
+    }, async ({ paths, verbose, coverage, runPattern, threshold, varValues }, { signal }) => {
         return withToolEnvelope(config, async () => {
             const validation = validatePaths(paths, config, { mustExist: true });
             if (!validation.ok)
                 return validation.error;
+            // When coverage or threshold is set, OPA changes its output format:
+            // stdout becomes a coverage JSON object instead of a test-record array.
+            const coverageMode = coverage === true || threshold !== undefined;
             const result = await opa.test({
                 paths: validation.resolved,
                 verbose,
-                coverage,
+                coverage: coverageMode,
                 runPattern,
+                varValues,
+                threshold,
             }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'opa');
             if (subprocessFailure)
                 return subprocessFailure;
-            // `opa test --format=json` emits a JSON array (or sometimes
-            // newline-delimited objects depending on OPA version). Try the
-            // array form first; fall back to NDJSON.
-            let records = [];
-            const arrayParsed = tryParseJson(result.stdout);
-            if (Array.isArray(arrayParsed)) {
-                records = arrayParsed;
+            if (coverageMode) {
+                return handleCoverageMode(result.stdout, result.stderr, result.exitCode, threshold);
             }
-            else {
-                for (const line of result.stdout.split(/\r?\n/)) {
-                    const trimmed = line.trim();
-                    if (trimmed.length === 0)
-                        continue;
-                    const parsed = tryParseJson(trimmed);
-                    if (parsed)
-                        records.push(parsed);
-                }
-            }
-            if (records.length === 0 && result.exitCode === 0) {
-                return err('NO_TESTS_FOUND', 'opa test did not discover any test rules in the provided paths.', { hint: 'Tests live in *_test.rego files with rules named test_*.' });
-            }
-            const passed = records.filter((r) => r.pass).length;
-            const failed = records.filter((r) => r.fail).length;
-            const skipped = records.filter((r) => r.skip).length;
-            return ok({
-                passed,
-                failed,
-                skipped,
-                total: records.length,
-                results: records,
-            });
+            return handleTestRecordsMode(result.stdout, result.exitCode);
+        });
+    });
+}
+/**
+ * Handle output from `opa test --coverage` or `opa test --threshold`.
+ *
+ * OPA emits a coverage JSON object on stdout when all tests pass and the
+ * threshold (if set) is met. On any failure, stdout is empty and stderr
+ * carries a human-readable message.
+ *
+ * Exit codes in coverage mode:
+ *   0  -- all tests pass, threshold met (coverage JSON on stdout)
+ *   1  -- one or more tests failed (threshold was set; stderr has FAIL lines)
+ *   2  -- threshold not met with all tests passing (stderr has threshold message)
+ *        OR one or more tests failed without threshold (stderr has FAIL lines)
+ */
+function handleCoverageMode(stdout, stderr, exitCode, threshold) {
+    if (exitCode === 0) {
+        const coverageData = tryParseJson(stdout);
+        return ok({
+            passed: 0,
+            failed: 0,
+            skipped: 0,
+            total: 0,
+            results: [],
+            coverage: coverageData,
+            coveragePct: coverageData?.coverage,
+            thresholdMet: threshold !== undefined ? true : undefined,
+        });
+    }
+    // Non-zero exit: distinguish threshold failure from test failures by stderr content.
+    // Threshold not met: "Code coverage threshold not met: got X instead of Y"
+    const stderrTrimmed = stderr.trim();
+    const thresholdMatch = /got\s+([\d.]+)\s+instead\s+of\s+([\d.]+)/i.exec(stderrTrimmed);
+    if (thresholdMatch) {
+        const actualCoverage = parseFloat(thresholdMatch[1]);
+        const requiredThreshold = parseFloat(thresholdMatch[2]);
+        return err('COVERAGE_BELOW_THRESHOLD', stderrTrimmed, {
+            hint: `Increase test coverage to at least ${requiredThreshold}%. Currently at ${actualCoverage}%.`,
+            details: { actualCoverage, requiredThreshold },
+        });
+    }
+    // Test failures in coverage mode (stderr has "package.test_name: FAIL" lines).
+    return err('EVAL_ERROR', stderrTrimmed || 'One or more tests failed.', {
+        hint: 'Fix the failing tests then re-run. Use verbose: true for trace output.',
+        details: { exitCode },
+    });
+}
+/**
+ * Handle output from `opa test` without coverage or threshold.
+ *
+ * OPA emits a JSON array of test records. Passing tests have no `pass` field;
+ * only failing tests carry `fail: true` and skipped tests carry `skip: true`.
+ * `passed` is derived as `total - failed - skipped`.
+ *
+ * Exit codes in normal mode:
+ *   0 -- all tests pass
+ *   2 -- one or more tests failed (failed records still appear in the JSON array)
+ */
+function handleTestRecordsMode(stdout, exitCode) {
+    let records = [];
+    // OPA emits a JSON array. Older versions may emit NDJSON (one object per line).
+    const arrayParsed = tryParseJson(stdout);
+    if (Array.isArray(arrayParsed)) {
+        records = arrayParsed;
+    }
+    else {
+        for (const line of stdout.split(/\r?\n/)) {
+            const trimmed = line.trim();
+            if (trimmed.length === 0)
+                continue;
+            const parsed = tryParseJson(trimmed);
+            if (parsed)
+                records.push(parsed);
+        }
+    }
+    if (records.length === 0 && exitCode === 0) {
+        return err('NO_TESTS_FOUND', 'opa test did not discover any test rules in the provided paths.', {
+            hint: 'Tests live in *_test.rego files with rules named test_*.',
         });
+    }
+    // OPA does NOT emit `pass: true` for passing tests; only `fail: true` for
+    // failures and `skip: true` for todo_* tests. Derive passed count from total.
+    const failed = records.filter((r) => r.fail).length;
+    const skipped = records.filter((r) => r.skip).length;
+    const passed = records.length - failed - skipped;
+    return ok({
+        passed,
+        failed,
+        skipped,
+        total: records.length,
+        results: records,
     });
 }
 //# sourceMappingURL=test.js.map

package/dist/tools/evaluation/test.js.map

@@ -1 +1 @@
-{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/evaluation/test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yFAAyF,CAC1F;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;IAC1F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC3F,CAAC;AAuBF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,oLAAoL;QACtL,WAAW,EAAE,aAAa;QAC1B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7D,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B;gBACE,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,OAAO;gBACP,QAAQ;gBACR,UAAU;aACX,EACD,MAAM,CACP,CAAC;YACF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,4DAA4D;YAC5D,+DAA+D;YAC/D,yCAAyC;YACzC,IAAI,OAAO,GAAiB,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,YAAY,CAAe,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,WAAW,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBACnC,MAAM,MAAM,GAAG,YAAY,CAAa,OAAO,CAAC,CAAC;oBACjD,IAAI,MAAM;wBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,GAAG,CACR,gBAAgB,EAChB,iEAAiE,EACjE,EAAE,IAAI,EAAE,0DAA0D,EAAE,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAErD,OAAO,EAAE,CAAiB;gBACxB,MAAM;gBACN,MAAM;gBACN,OAAO;gBACP,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"test.js","sourceRoot":"","sources":["../../../src/tools/evaluation/test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yFAAyF,CAC1F;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC5E,QAAQ,EAAE,CAAC;SACR,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,uKAAuK,CACxK;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+EAA+E,CAAC;IAC5F,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,6KAA6K,CAC9K;IACH,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wRAAwR,CACzR;CACJ,CAAC;AAyDF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,gtBAAgtB;QACltB,WAAW,EAAE,aAAa;QAC1B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnF,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,oEAAoE;YACpE,wEAAwE;YACxE,MAAM,YAAY,GAAG,QAAQ,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,CAAC;YAElE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B;gBACE,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,OAAO;gBACP,QAAQ,EAAE,YAAY;gBACtB,UAAU;gBACV,SAAS;gBACT,SAAS;aACV,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtF,CAAC;YAED,OAAO,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CACzB,MAAc,EACd,MAAc,EACd,QAAuB,EACvB,SAA6B;IAE7B,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,YAAY,GAAG,YAAY,CAAiB,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAiB;YACxB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,YAAY;YACtB,WAAW,EAAE,YAAY,EAAE,QAAQ;YACnC,YAAY,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,2EAA2E;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,cAAc,GAAG,2CAA2C,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACvF,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAC;QACtD,MAAM,iBAAiB,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAC;QACzD,OAAO,GAAG,CAAC,0BAA0B,EAAE,aAAa,EAAE;YACpD,IAAI,EAAE,sCAAsC,iBAAiB,mBAAmB,cAAc,IAAI;YAClG,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,OAAO,GAAG,CAAC,YAAY,EAAE,aAAa,IAAI,2BAA2B,EAAE;QACrE,IAAI,EAAE,wEAAwE;QAC9E,OAAO,EAAE,EAAE,QAAQ,EAAE;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,MAAc,EACd,QAAuB;IAEvB,IAAI,OAAO,GAAiB,EAAE,CAAC;IAE/B,gFAAgF;IAChF,MAAM,WAAW,GAAG,YAAY,CAAe,MAAM,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,GAAG,WAAW,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,MAAM,MAAM,GAAG,YAAY,CAAa,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,CACR,gBAAgB,EAChB,iEAAiE,EACjE;YACE,IAAI,EAAE,0DAA0D;SACjE,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAEjD,OAAO,EAAE,CAAiB;QACxB,MAAM;QACN,MAAM;QACN,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/helpers/generate-test-skeleton.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-test-skeleton.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/generate-test-skeleton.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAsB9C,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAkDD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAmDxF"}
+{"version":3,"file":"generate-test-skeleton.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/generate-test-skeleton.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4B9C,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAqFD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqDxF"}

package/dist/tools/helpers/generate-test-skeleton.js

@@ -10,6 +10,10 @@ import { err, ok } from '../../lib/errors.js';
 import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
 const RegoGenerateTestSkeletonInput = {
     source: z.string().min(1).describe('Rego source to generate tests for.'),
+    tableStyle: z
+        .boolean()
+        .optional()
+        .describe('Generate table-driven test stubs instead of single-case stubs. Each rule gets a `cases` array and an `every tc in cases { ... }` assertion loop. Pair with `rego_test varValues: true` to see which case failed.'),
 };
 function packageNameFromAst(ast) {
     const parts = ast.package?.path ?? [];
@@ -32,6 +36,40 @@ function ruleNameFromAst(rule) {
     }
     return undefined;
 }
+function makeTableSkeleton(packageName, ruleNames) {
+    const lines = [];
+    const testPackage = packageName ? `${packageName}_test` : 'main_test';
+    lines.push(`package ${testPackage}`);
+    lines.push('');
+    lines.push('import rego.v1');
+    if (packageName) {
+        lines.push(`import data.${packageName}`);
+    }
+    lines.push('');
+    for (const name of ruleNames) {
+        const safeName = name.replace(/[^a-zA-Z0-9_]/g, '_');
+        const testName = `test_${safeName}`;
+        const ruleRef = packageName ? `data.${packageName}.${name}` : `data.${name}`;
+        const casesVar = `${safeName}_cases`;
+        lines.push(`# TODO: add test cases -- one object per scenario.`);
+        lines.push(`${casesVar} := [`);
+        lines.push(`\t{`);
+        lines.push(`\t\t"description": "TODO: describe what this case tests",`);
+        lines.push(`\t\t"input": {},`);
+        lines.push(`\t\t"expected": true,`);
+        lines.push(`\t},`);
+        lines.push(`]`);
+        lines.push('');
+        lines.push(`${testName} if {`);
+        lines.push(`\tevery tc in ${casesVar} {`);
+        lines.push(`\t\tactual := ${ruleRef} with input as tc.input`);
+        lines.push(`\t\tactual == tc.expected`);
+        lines.push(`\t}`);
+        lines.push(`}`);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
 function makeSkeleton(packageName, ruleNames) {
     const lines = [];
     const testPackage = packageName ? `${packageName}_test` : 'main_test';
@@ -61,7 +99,7 @@ export function registerRegoGenerateTestSkeleton(server, config) {
     const opa = new OpaCli(config);
     server.registerTool('rego_generate_test_skeleton', {
         title: 'Generate Rego test skeleton',
-        description: 'Generate a `*_test.rego` skeleton from a policy. Parses the AST, finds each rule, and emits one stub test per rule. The agent fills in realistic inputs and assertions.',
+        description: 'Generate a `*_test.rego` skeleton from a policy. Parses the AST, finds each rule, and emits one stub test per rule. The agent fills in realistic inputs and assertions. With `tableStyle: true`, each stub uses an `every tc in cases { ... }` loop so you can add multiple input/expected pairs without duplicating assertion code.',
         inputSchema: RegoGenerateTestSkeletonInput,
         annotations: {
             readOnlyHint: true,
@@ -69,7 +107,7 @@ export function registerRegoGenerateTestSkeleton(server, config) {
             idempotentHint: true,
             openWorldHint: false,
         },
-    }, async ({ source }, { signal }) => {
+    }, async ({ source, tableStyle }, { signal }) => {
         return withToolEnvelope(config, async () => {
             const result = await opa.parse({ source }, signal);
             const subprocessFailure = mapSubprocessFailure(result, 'opa');
@@ -91,7 +129,9 @@ export function registerRegoGenerateTestSkeleton(server, config) {
             if (ruleNames.length === 0) {
                 return err('INVALID_INPUT', 'No rules found in the source -- nothing to test.');
             }
-            const testFile = makeSkeleton(packageName, ruleNames);
+            const testFile = tableStyle
+                ? makeTableSkeleton(packageName, ruleNames)
+                : makeSkeleton(packageName, ruleNames);
             return ok({ testFile, ruleNames });
         });
     });

package/dist/tools/helpers/generate-test-skeleton.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-test-skeleton.js","sourceRoot":"","sources":["../../../src/tools/helpers/generate-test-skeleton.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,6BAA6B,GAAG;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;CACzE,CAAC;AAoBF,SAAS,kBAAkB,CAAC,GAAc;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,6CAA6C;IAC7C,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,SAAmB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAiB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,yKAAyK;QAC3K,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,OAAO,gBAAgB,CAAiC,MAAM,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAY,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;iBACd,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CACrE,CACF,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACtD,OAAO,EAAE,CAAiC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generate-test-skeleton.js","sourceRoot":"","sources":["../../../src/tools/helpers/generate-test-skeleton.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,6BAA6B,GAAG;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACxE,UAAU,EAAE,CAAC;SACV,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,kNAAkN,CACnN;CACJ,CAAC;AAoBF,SAAS,kBAAkB,CAAC,GAAc;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,6CAA6C;IAC7C,OAAO,KAAK;SACT,KAAK,CAAC,CAAC,CAAC;SACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACxD,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB,EAAE,SAAmB;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,QAAQ,QAAQ,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,GAAG,QAAQ,QAAQ,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,IAAI,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,yBAAyB,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,SAAmB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACvE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,sBAAsB,CAAC,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,MAAiB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,sUAAsU;QACxU,WAAW,EAAE,6BAA6B;QAC1C,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3C,OAAO,gBAAgB,CAAiC,MAAM,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAY,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAC1B,IAAI,GAAG,CACL,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;iBACd,GAAG,CAAC,eAAe,CAAC;iBACpB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CACrE,CACF,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,QAAQ,GAAG,UAAU;gBACzB,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;gBAC3C,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACzC,OAAO,EAAE,CAAiC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAW3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAa9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAY3E"}

package/dist/tools/helpers/index.js

@@ -8,6 +8,7 @@ import { registerRegoInferInputSchema } from './infer-input-schema.js';
 import { registerRegoPolicyDiff } from './policy-diff.js';
 import { registerRegoSecurityAudit } from './security-audit.js';
 import { registerRegoSuggestFix } from './suggest-fix.js';
+import { registerRegoVerify } from './verify.js';
 export function registerHelperTools(server, config) {
     registerRegoExplainDecision(server, config);
     registerRegoGenerateTestSkeleton(server, config);
@@ -19,5 +20,6 @@ export function registerHelperTools(server, config) {
     registerRegoFix(server, config);
     registerRegoFormatWrite(server, config);
     registerRegoPolicyDiff(server, config);
+    registerRegoVerify(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/helpers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/helpers/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gCAAgC,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,gCAAgC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC"}

package/dist/tools/helpers/verify.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerRegoVerify(server: McpServer, config: Config): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/tools/helpers/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/verify.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAqB9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA8D1E"}

package/dist/tools/helpers/verify.js

@@ -0,0 +1,75 @@
+/**
+ * `rego_verify` -- formal SMT-based policy verification.
+ *
+ * Uses Microsoft Z3 (via WASM) to mathematically prove or disprove
+ * a property about a Rego rule for ALL possible inputs. Returns a
+ * concrete counterexample when the property fails.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+import { parseProperty } from '../../lib/rego-property-parser.js';
+import { runVerify } from '../../lib/rego-verify-engine.js';
+const RegoVerifyInput = {
+    source: z.string().min(1).describe('Rego source to verify.'),
+    rule: z.string().min(1).describe('Name of the rule to verify (e.g. "allow", "deny").'),
+    kind: z
+        .enum(['always_true', 'never_true', 'satisfiable'])
+        .describe('Property to prove:\n' +
+        '  always_true  - rule is true for every possible input (finds inputs that violate this)\n' +
+        '  never_true   - rule is never true for any input (finds inputs that trigger it)\n' +
+        '  satisfiable  - at least one input exists where rule is true (returns a witness)'),
+};
+export function registerRegoVerify(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_verify', {
+        title: 'Formally verify a Rego policy rule',
+        description: 'Formally verify a property about a Rego rule using SMT solving (Microsoft Z3). ' +
+            'Unlike testing, this checks ALL possible inputs and either proves the property holds or ' +
+            'returns a concrete counterexample input that falsifies it. ' +
+            'Supports equality, comparison, startswith, endswith, contains, regex.match, and multi-clause rules. ' +
+            'Reports INCONCLUSIVE for negation-as-failure (not), comprehensions, and other unsupported constructs.',
+        inputSchema: RegoVerifyInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ source, rule, kind }, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // Parse property spec
+            const { property, errors: propErrors } = parseProperty({ rule, kind });
+            if (propErrors.length > 0) {
+                return err('INVALID_INPUT', 'Invalid property specification.', {
+                    details: { errors: propErrors },
+                });
+            }
+            // Parse the Rego source via OPA
+            const parseResult = await opa.parse({ source }, signal);
+            const subprocessFailure = mapSubprocessFailure(parseResult, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (parseResult.exitCode !== 0) {
+                return err('INVALID_REGO', 'opa parse rejected the policy source.', {
+                    hint: 'Fix syntax errors before verifying.',
+                    details: { stderr: parseResult.stderr.trim() },
+                });
+            }
+            const ast = tryParseJson(parseResult.stdout);
+            if (ast === undefined) {
+                return err('UNKNOWN_ERROR', 'opa parse produced no parseable JSON AST.');
+            }
+            // Run the verification pipeline
+            const result = await runVerify(ast, property, signal);
+            const warnings = [...result.warnings];
+            if (result.unsupportedConstructs.length > 0) {
+                warnings.push(`${result.unsupportedConstructs.length} unsupported construct(s) were skipped: ` +
+                    result.unsupportedConstructs.map((u) => u.constructType).join(', '));
+            }
+            return ok(result, warnings.length > 0 ? warnings : undefined);
+        });
+    });
+}
+//# sourceMappingURL=verify.js.map

package/dist/tools/helpers/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/tools/helpers/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAqB,MAAM,iCAAiC,CAAC;AAG/E,MAAM,eAAe,GAAG;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;SAClD,QAAQ,CACP,sBAAsB;QACpB,2FAA2F;QAC3F,oFAAoF;QACpF,mFAAmF,CACtF;CACJ,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,iFAAiF;YACjF,0FAA0F;YAC1F,6DAA6D;YAC7D,sGAAsG;YACtG,uGAAuG;QACzG,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3C,OAAO,gBAAgB,CAAe,MAAM,EAAE,KAAK,IAAI,EAAE;YACvD,sBAAsB;YACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,eAAe,EAAE,iCAAiC,EAAE;oBAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;iBAChC,CAAC,CAAC;YACL,CAAC;YAED,gCAAgC;YAChC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACxD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACnE,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,GAAG,CAAC,cAAc,EAAE,uCAAuC,EAAE;oBAClE,IAAI,EAAE,qCAAqC;oBAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,GAAG,YAAY,CAAY,WAAW,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;YAC3E,CAAC;YAED,gCAAgC;YAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAS,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,QAAQ,GAAa,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,0CAA0C;oBAC9E,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACtE,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,CAAe,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts

@@ -5,11 +5,12 @@
  * here in order; ordering doesn't affect behavior but keeps the
  * declaration site tidy.
  *
- * Tools (48 total):
+ * Tools (49 total):
  *   Category A -- Authoring:        rego_format, rego_check,
  *                                   rego_check_schema, rego_lint,
  *                                   rego_parse_ast, rego_inspect,
- *                                   rego_capabilities, rego_deps
+ *                                   rego_capabilities, rego_deps,
+ *                                   rego_migrate_v1
  *   Category B -- Evaluation:       rego_eval, rego_eval_with_explain,
  *                                   rego_eval_with_profile,
  *                                   rego_eval_with_coverage, rego_test,
@@ -30,7 +31,7 @@
  *                                   rego_security_audit,
  *                                   rego_infer_input_schema,
  *                                   rego_fix, rego_format_write,
- *                                   rego_migrate_v1, rego_policy_diff
+ *                                   rego_policy_diff, rego_verify
  *   Category F -- Conftest:         conftest_test, conftest_verify,
  *                                   conftest_pull, conftest_push
  *   Category G -- Meta:             mcp_server_info

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQrE"}

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,MAAc;IAC7D,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC"}

package/dist/tools/server-management/_shared.js

@@ -37,7 +37,7 @@ export function mapOpaClientError(e, notFoundCode = 'UNKNOWN_ERROR') {
     }
     if (e instanceof OpaUnreachableError) {
         return err('OPA_UNREACHABLE', `OPA server unreachable at ${e.url}`, {
-            hint: 'Confirm OPA_URL points at a running OPA server (e.g. `curl $OPA_URL/health`).',
+            hint: 'No running OPA server was found at OPA_URL. To start one locally: `opa run --server`. For production, OPA is typically deployed as a sidecar or standalone service. Verify the address with `curl $OPA_URL/health`. Set OPA_URL to the correct base URL if needed.',
             details: { url: e.url },
         });
     }

package/dist/tools/server-management/_shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../../src/tools/server-management/_shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAGjC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAE3D,wEAAwE;IACxE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,+BAA+B,IAAI,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAU,EACV,eAA8B,eAAe;IAE7C,IAAI,CAAC,YAAY,iBAAiB,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,YAAY,mBAAmB,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,GAAG,EAAE,EAAE;YAClE,IAAI,EAAE,+EAA+E;YACrF,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;YAC/E,IAAI,EAAE,0FAA0F;SACjG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,YAAY,EAAE,6BAA6B,EAAE;gBACtD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,MAAM,GAAG,EAAE;YAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,OAAO,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE;QACnC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KAChE,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"_shared.js","sourceRoot":"","sources":["../../../src/tools/server-management/_shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAGjC;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY;IAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAE3D,wEAAwE;IACxE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,CAAC,eAAe,EAAE,+BAA+B,IAAI,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAU,EACV,eAA8B,eAAe;IAE7C,IAAI,CAAC,YAAY,iBAAiB,EAAE,CAAC;QACnC,OAAO,GAAG,CAAC,WAAW,EAAE,0CAA0C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,YAAY,mBAAmB,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC,GAAG,EAAE,EAAE;YAClE,IAAI,EAAE,oQAAoQ;YAC1Q,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;YAC/E,IAAI,EAAE,0FAA0F;SACjG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,YAAY,YAAY,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,YAAY,EAAE,6BAA6B,EAAE;gBACtD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,MAAM,GAAG,EAAE;YAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SAC5C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,OAAO,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE;QACnC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -2,7 +2,7 @@
  * Shared types used across tools, prompts, and resources.
  */
 /** Standard error codes returned by tools. */
-export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'HTTP_SEND_BLOCKED' | 'TIMEOUT' | 'CANCELLED' | 'UNKNOWN_ERROR';
+export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'COVERAGE_BELOW_THRESHOLD' | 'HTTP_SEND_BLOCKED' | 'TIMEOUT' | 'CANCELLED' | 'VERIFY_INCONCLUSIVE' | 'Z3_INIT_ERROR' | 'UNKNOWN_ERROR';
 /** Structured error payload. */
 export interface ToolError {
     code: ToolErrorCode;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,0BAA0B,GAC1B,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orygn/opa-mcp",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "mcpName": "io.github.OrygnsCode/opa-mcp",
   "description": "Model Context Protocol server for Open Policy Agent (OPA). Author, validate, debug, and explain Rego policies through any MCP-compatible client.",
   "type": "module",
@@ -64,20 +64,22 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "z3-solver": "^4.16.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {
-    "@types/node": "^20.14.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.9.1",
     "@typescript-eslint/eslint-plugin": "^8.0.0",
     "@typescript-eslint/parser": "^8.0.0",
     "@vitest/coverage-v8": "^4.1.5",
-    "eslint": "^9.10.0",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint": "^10.4.0",
+    "eslint-config-prettier": "^10.1.8",
     "globals": "^17.6.0",
     "prettier": "^3.3.0",
     "rimraf": "^6.0.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.6.0",
+    "typescript": "^6.0.3",
     "vitest": "^4.1.5"
   },
   "publishConfig": {