@orygn/opa-mcp 0.1.2 → 0.1.3

package/dist/resources/patterns.js

@@ -8,7 +8,7 @@
 export const PATTERNS = `# Rego pattern library
 
 Common Rego patterns with working examples, tests, and pitfalls. Each
-pattern is self-contained — copy, adapt, and ship.
+pattern is self-contained -- copy, adapt, and ship.
 
 ---
 
@@ -25,7 +25,7 @@ import rego.v1
 
 default allow := false
 
-# Permissions table — extend as roles evolve.
+# Permissions table -- extend as roles evolve.
 permissions := {
     "admin": {"read", "write", "delete", "manage_users"},
     "editor": {"read", "write"},
@@ -37,7 +37,7 @@ allow if {
     input.action in permissions[role]
 }
 
-# Why was it denied? — useful for audit logs.
+# Why was it denied? -- useful for audit logs.
 deny_reasons contains reason if {
     not allow
     input.user
@@ -91,7 +91,7 @@ test_anonymous_denied if {
 
 ## 2. Attribute-based access control (ABAC)
 
-**When to use:** when "who" alone isn't enough — decisions also depend
+**When to use:** when "who" alone isn't enough -- decisions also depend
 on resource attributes (ownership, tenant, sensitivity) and context
 (time of day, source IP).
 
@@ -250,7 +250,7 @@ deny contains msg if {
 **Pitfalls:**
 - Terraform plan JSON is verbose and version-specific. Pin the
   \`terraform plan -json\` schema you target.
-- \`resource_changes[_].change.after\` may be \`null\` for destroys —
+- \`resource_changes[_].change.after\` may be \`null\` for destroys --
   guard against it.
 - For wide-radius changes, use \`opa exec --decision\` against a plan
   file in CI, not the live API.
@@ -270,7 +270,7 @@ import rego.v1
 
 default allow := false
 
-# Public endpoints — no auth required.
+# Public endpoints -- no auth required.
 public_endpoints := {
     {"method": "GET", "path": ["health"]},
     {"method": "GET", "path": ["version"]},
@@ -353,7 +353,7 @@ deny_reason := sprintf(
 **Pitfalls:**
 - \`data.requests\` grows unbounded unless the writer prunes outside the
   window. Schedule prune on every write.
-- This pattern is *advisory* — under load, two concurrent decisions
+- This pattern is *advisory* -- under load, two concurrent decisions
   can both see \`count == limit - 1\` and both allow. For strict
   limits, use a Lua/Redis token bucket at the gateway and have OPA
   validate the token, not count requests.

package/dist/resources/style-guide.d.ts

@@ -2,5 +2,5 @@
  * Curated Rego style guide. Adapted from the Styra reference plus the
  * OPA team's own conventions, condensed for LLM consumption.
  */
-export declare const STYLE_GUIDE = "# Rego style guide\n\nA condensed reference for writing idiomatic, maintainable Rego. Adapted\nfrom the Styra style guide and the OPA project's conventions.\n\n## Always import `rego.v1`\n\nEvery `.rego` file should start with the v1 import. It enables the\nmodern syntax (`if`, `contains`, `every`) and disables the older\nimplicit-membership operator that's a frequent source of bugs.\n\n```rego\npackage authz\n\nimport rego.v1\n```\n\nOPA 1.0 (released January 2025) treats this as the default, but\nincluding it explicitly makes intent clear and keeps the file portable\nto older OPA installations.\n\n## Package layout mirrors directory layout\n\nMatch `package foo.bar` with the file path `foo/bar/main.rego` (or\n`foo/bar/<anything>.rego`). Regal flags mismatches as\n`directory-package-mismatch`.\n\nFor a multi-file package, group by responsibility:\n\n```\nauthz/\n  main.rego          # principal decision (allow / deny)\n  rbac.rego          # role-based access checks\n  abac.rego          # attribute-based access checks\n  helpers.rego       # shared helpers, no decisions\n  main_test.rego     # tests for principal decisions\n  rbac_test.rego     # tests for rbac\n```\n\nTests live in `*_test.rego` siblings of the source they test, in the\nsame package or a `<package>_test` package.\n\n## Naming\n\n- Rule names: `snake_case`.\n- Boolean rules: read like predicates \u2014 `allow`, `is_admin`,\n  `should_log`. Avoid `is_not_blocked` (double negative).\n- Set/object rules: read like nouns \u2014 `grants`, `roles`, `reasons`.\n- Helper rules: `_` prefix is *not* a convention; just give them names\n  that explain what they return.\n\nNames that conflict with reserved words (`type`, `time`, `input`) won't\nparse. Names matching builtins (`http`, `json`) shadow them.\n\n## Default deny\n\nEvery principal decision should have a default fallback so the policy\nreturns a value even when no rule matches.\n\n```rego\ndefault allow := false\n\nallow if {\n    input.user.role == \"admin\"\n}\n```\n\nThe same applies to set-valued reasons:\n\n```rego\ndeny contains reason if {\n    not allow\n    reason := \"not authorized\"\n}\n```\n\n## Comprehensions vs `every`\n\nWhen you need a value derived from a collection, use a comprehension:\n\n```rego\nadmin_users := {u | some u in input.users; u.role == \"admin\"}\n```\n\nWhen you need to assert that a property holds for every element, use\n`every` (introduced in OPA 0.41):\n\n```rego\nallow if {\n    every claim in input.token.claims {\n        claim.verified == true\n    }\n}\n```\n\n`every` is clearer than the older `not <comprehension>` idiom and\nshort-circuits on the first failure.\n\n## Annotations\n\nPublic rules deserve a metadata block so consumers know what they do.\n\n```rego\n# METADATA\n# title: Authorization decision for HTTP requests\n# description: |\n#   Returns true when the requesting principal has a role with a\n#   permission entry for the requested action on the requested\n#   resource. Anonymous requests always deny.\n# entrypoint: true\nallow if {\n    some role in input.principal.roles\n    permission_grants[role][input.action]\n}\n```\n\nAnnotations show up in `opa inspect`, the registry, and editor\nhovers. They are also extracted by `rego_describe_policy`.\n\n## Schema annotations\n\nFor policies that are sensitive to input shape, attach a JSON Schema:\n\n```rego\n# METADATA\n# schemas:\n#   - input: schema.input\nallow if {\n    input.user.id != \"\"\n}\n```\n\nCombined with `opa check --schema`, this turns input-shape mismatches\ninto compile errors instead of runtime undefineds.\n\n## Anti-patterns\n\n- **`http.send` in the decision path.** Each call adds round-trip\n  latency. If you must, scope it to a small, cacheable read.\n- **Deep `with` chains.** `x with input as ... with data as ...` more\n  than two layers deep is a smell \u2014 the test is doing too much. Split.\n- **`print` and `trace`.** Useful in development; remove before\n  shipping. Regal flags both as `print-or-trace-call`.\n- **Mixing `if` and the legacy implicit form in the same file.** Pick\n  one. With `rego.v1` imported you cannot use the implicit form.\n\n## Tests\n\n`opa test` runs every rule whose name starts with `test_`. A test\neither evaluates to true (pass) or fails to evaluate (fail). The\ncommon shape:\n\n```rego\npackage authz_test\n\nimport rego.v1\nimport data.authz\n\ntest_admin_can_delete if {\n    authz.allow with input as {\n        \"user\": {\"role\": \"admin\"},\n        \"action\": \"delete\",\n    }\n}\n\ntest_viewer_cannot_delete if {\n    not authz.allow with input as {\n        \"user\": {\"role\": \"viewer\"},\n        \"action\": \"delete\",\n    }\n}\n```\n\nRun with `opa test -v ./...` for verbose output. Add `--coverage` to\nverify which lines were exercised.\n\n## References\n\n- Official Rego style guide: https://docs.styra.com/regal/rego-style-guide\n- OPA documentation: https://www.openpolicyagent.org/docs/latest/\n- Regal linter rules: https://docs.styra.com/regal/rules\n";
+export declare const STYLE_GUIDE = "# Rego style guide\n\nA condensed reference for writing idiomatic, maintainable Rego. Adapted\nfrom the Styra style guide and the OPA project's conventions.\n\n## Always import `rego.v1`\n\nEvery `.rego` file should start with the v1 import. It enables the\nmodern syntax (`if`, `contains`, `every`) and disables the older\nimplicit-membership operator that's a frequent source of bugs.\n\n```rego\npackage authz\n\nimport rego.v1\n```\n\nOPA 1.0 (released January 2025) treats this as the default, but\nincluding it explicitly makes intent clear and keeps the file portable\nto older OPA installations.\n\n## Package layout mirrors directory layout\n\nMatch `package foo.bar` with the file path `foo/bar/main.rego` (or\n`foo/bar/<anything>.rego`). Regal flags mismatches as\n`directory-package-mismatch`.\n\nFor a multi-file package, group by responsibility:\n\n```\nauthz/\n  main.rego          # principal decision (allow / deny)\n  rbac.rego          # role-based access checks\n  abac.rego          # attribute-based access checks\n  helpers.rego       # shared helpers, no decisions\n  main_test.rego     # tests for principal decisions\n  rbac_test.rego     # tests for rbac\n```\n\nTests live in `*_test.rego` siblings of the source they test, in the\nsame package or a `<package>_test` package.\n\n## Naming\n\n- Rule names: `snake_case`.\n- Boolean rules: read like predicates -- `allow`, `is_admin`,\n  `should_log`. Avoid `is_not_blocked` (double negative).\n- Set/object rules: read like nouns -- `grants`, `roles`, `reasons`.\n- Helper rules: `_` prefix is *not* a convention; just give them names\n  that explain what they return.\n\nNames that conflict with reserved words (`type`, `time`, `input`) won't\nparse. Names matching builtins (`http`, `json`) shadow them.\n\n## Default deny\n\nEvery principal decision should have a default fallback so the policy\nreturns a value even when no rule matches.\n\n```rego\ndefault allow := false\n\nallow if {\n    input.user.role == \"admin\"\n}\n```\n\nThe same applies to set-valued reasons:\n\n```rego\ndeny contains reason if {\n    not allow\n    reason := \"not authorized\"\n}\n```\n\n## Comprehensions vs `every`\n\nWhen you need a value derived from a collection, use a comprehension:\n\n```rego\nadmin_users := {u | some u in input.users; u.role == \"admin\"}\n```\n\nWhen you need to assert that a property holds for every element, use\n`every` (introduced in OPA 0.41):\n\n```rego\nallow if {\n    every claim in input.token.claims {\n        claim.verified == true\n    }\n}\n```\n\n`every` is clearer than the older `not <comprehension>` idiom and\nshort-circuits on the first failure.\n\n## Annotations\n\nPublic rules deserve a metadata block so consumers know what they do.\n\n```rego\n# METADATA\n# title: Authorization decision for HTTP requests\n# description: |\n#   Returns true when the requesting principal has a role with a\n#   permission entry for the requested action on the requested\n#   resource. Anonymous requests always deny.\n# entrypoint: true\nallow if {\n    some role in input.principal.roles\n    permission_grants[role][input.action]\n}\n```\n\nAnnotations show up in `opa inspect`, the registry, and editor\nhovers. They are also extracted by `rego_describe_policy`.\n\n## Schema annotations\n\nFor policies that are sensitive to input shape, attach a JSON Schema:\n\n```rego\n# METADATA\n# schemas:\n#   - input: schema.input\nallow if {\n    input.user.id != \"\"\n}\n```\n\nCombined with `opa check --schema`, this turns input-shape mismatches\ninto compile errors instead of runtime undefineds.\n\n## Anti-patterns\n\n- **`http.send` in the decision path.** Each call adds round-trip\n  latency. If you must, scope it to a small, cacheable read.\n- **Deep `with` chains.** `x with input as ... with data as ...` more\n  than two layers deep is a smell -- the test is doing too much. Split.\n- **`print` and `trace`.** Useful in development; remove before\n  shipping. Regal flags both as `print-or-trace-call`.\n- **Mixing `if` and the legacy implicit form in the same file.** Pick\n  one. With `rego.v1` imported you cannot use the implicit form.\n\n## Tests\n\n`opa test` runs every rule whose name starts with `test_`. A test\neither evaluates to true (pass) or fails to evaluate (fail). The\ncommon shape:\n\n```rego\npackage authz_test\n\nimport rego.v1\nimport data.authz\n\ntest_admin_can_delete if {\n    authz.allow with input as {\n        \"user\": {\"role\": \"admin\"},\n        \"action\": \"delete\",\n    }\n}\n\ntest_viewer_cannot_delete if {\n    not authz.allow with input as {\n        \"user\": {\"role\": \"viewer\"},\n        \"action\": \"delete\",\n    }\n}\n```\n\nRun with `opa test -v ./...` for verbose output. Add `--coverage` to\nverify which lines were exercised.\n\n## References\n\n- Official Rego style guide: https://docs.styra.com/regal/rego-style-guide\n- OPA documentation: https://www.openpolicyagent.org/docs/latest/\n- Regal linter rules: https://docs.styra.com/regal/rules\n";
 //# sourceMappingURL=style-guide.d.ts.map

package/dist/resources/style-guide.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"style-guide.d.ts","sourceRoot":"","sources":["../../src/resources/style-guide.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,WAAW,+6JAqLvB,CAAC"}
+{"version":3,"file":"style-guide.d.ts","sourceRoot":"","sources":["../../src/resources/style-guide.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,WAAW,m6JAqLvB,CAAC"}

package/dist/resources/style-guide.js

@@ -47,9 +47,9 @@ same package or a \`<package>_test\` package.
 ## Naming
 
 - Rule names: \`snake_case\`.
-- Boolean rules: read like predicates — \`allow\`, \`is_admin\`,
+- Boolean rules: read like predicates -- \`allow\`, \`is_admin\`,
   \`should_log\`. Avoid \`is_not_blocked\` (double negative).
-- Set/object rules: read like nouns — \`grants\`, \`roles\`, \`reasons\`.
+- Set/object rules: read like nouns -- \`grants\`, \`roles\`, \`reasons\`.
 - Helper rules: \`_\` prefix is *not* a convention; just give them names
   that explain what they return.
 
@@ -142,7 +142,7 @@ into compile errors instead of runtime undefineds.
 - **\`http.send\` in the decision path.** Each call adds round-trip
   latency. If you must, scope it to a small, cacheable read.
 - **Deep \`with\` chains.** \`x with input as ... with data as ...\` more
-  than two layers deep is a smell — the test is doing too much. Split.
+  than two layers deep is a smell -- the test is doing too much. Split.
 - **\`print\` and \`trace\`.** Useful in development; remove before
   shipping. Regal flags both as \`print-or-trace-call\`.
 - **Mixing \`if\` and the legacy implicit form in the same file.** Pick

package/dist/server.d.ts

@@ -2,8 +2,8 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
 import { type Config } from './config.js';
-export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.2";
+import { SERVER_NAME, SERVER_VERSION } from './constants.js';
+export { SERVER_NAME, SERVER_VERSION };
 /**
  * Construct an `McpServer`, register every tool / prompt / resource
  * onto it, and return it. Exported for tests so they can drive a

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAQtD,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAoBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAepE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAE/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAoBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAepE"}

package/dist/server.js

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 /**
- * @orygn/opa-mcp — entry point.
+ * @orygn/opa-mcp -- entry point.
  *
  * Initializes the MCP server, registers tools/prompts/resources,
  * and connects the stdio transport.
  *
- * IMPORTANT: never write to stdout from anywhere in this process —
+ * IMPORTANT: never write to stdout from anywhere in this process --
  * stdout is the MCP protocol channel. Use `logger` (file) or stderr.
  */
 import { pathToFileURL } from 'node:url';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { loadConfig } from './config.js';
+import { SERVER_NAME, SERVER_VERSION } from './constants.js';
 import { initLogger, logger } from './lib/logger.js';
 import { OpaCli } from './lib/opa-cli.js';
 import { RegalCli } from './lib/regal-cli.js';
 import { registerPrompts } from './prompts/index.js';
 import { registerResources } from './resources/index.js';
 import { registerTools } from './tools/index.js';
-export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.2';
+export { SERVER_NAME, SERVER_VERSION };
 /**
  * Construct an `McpServer`, register every tool / prompt / resource
  * onto it, and return it. Exported for tests so they can drive a

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/authoring/capabilities.js

@@ -1,5 +1,5 @@
 /**
- * `rego_capabilities` — list OPA's built-in functions and feature flags.
+ * `rego_capabilities` -- list OPA's built-in functions and feature flags.
  *
  * Useful as a reference when authoring policies, especially for
  * answering "is `crypto.x509.parse_certificates` available?" without

package/dist/tools/authoring/check.js

@@ -1,5 +1,5 @@
 /**
- * `rego_check` — type-check Rego using `opa check`.
+ * `rego_check` -- type-check Rego using `opa check`.
  *
  * Returns `{ valid: true }` when the policy passes. On failure,
  * returns the structured error report `opa check --format=json` writes
@@ -18,7 +18,7 @@ const RegoCheckInput = {
     strict: z
         .boolean()
         .optional()
-        .describe('Enable strict mode — fail on unused vars, deprecated builtins, etc.'),
+        .describe('Enable strict mode -- fail on unused vars, deprecated builtins, etc.'),
     capabilities: z
         .string()
         .optional()
@@ -37,7 +37,7 @@ export function registerRegoCheck(server, config) {
                 return err('INVALID_INPUT', 'rego_check requires either `source` or at least one entry in `paths`.');
             }
             if (source && paths?.length) {
-                return err('INVALID_INPUT', 'rego_check does not accept both `source` and `paths` — pass one or the other.');
+                return err('INVALID_INPUT', 'rego_check does not accept both `source` and `paths` -- pass one or the other.');
             }
             let resolvedPaths;
             if (paths?.length) {

package/dist/tools/authoring/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/tools/authoring/check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC9F,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F,CAC/F;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACzF,CAAC;AAaF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,kPAAkP;QACpP,WAAW,EAAE,cAAc;KAC5B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3D,OAAO,gBAAgB,CAAkB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,GAAG,CACR,eAAe,EACf,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,CACR,eAAe,EACf,+EAA+E,CAChF,CAAC;YACJ,CAAC;YAED,IAAI,aAAmC,CAAC;YACxC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAC5C,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;gBAC7B,MAAM;gBACN,KAAK,EAAE,aAAa;gBACpB,MAAM;gBACN,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,0DAA0D;YAC1D,MAAM,MAAM,GAAG,YAAY,CAAkC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CACR,cAAc,EACd,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/tools/authoring/check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAC9F,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,8FAA8F,CAC/F;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,sEAAsE,CAAC;IACnF,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACzF,CAAC;AAaF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,kPAAkP;QACpP,WAAW,EAAE,cAAc;KAC5B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3D,OAAO,gBAAgB,CAAkB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,GAAG,CACR,eAAe,EACf,uEAAuE,CACxE,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,CACR,eAAe,EACf,gFAAgF,CACjF,CAAC;YACJ,CAAC;YAED,IAAI,aAAmC,CAAC;YACxC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAC5C,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC;gBAC7B,MAAM;gBACN,KAAK,EAAE,aAAa;gBACpB,MAAM;gBACN,YAAY;gBACZ,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,0DAA0D;YAC1D,MAAM,MAAM,GAAG,YAAY,CAAkC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CACR,cAAc,EACd,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/deps.js

@@ -1,5 +1,5 @@
 /**
- * `rego_deps` — static dependency analysis for a Rego ref.
+ * `rego_deps` -- static dependency analysis for a Rego ref.
  *
  * Wraps `opa deps`. Given a target like `data.example.allow`, returns
  * the base (input/data) and virtual (rule) document references the
@@ -36,7 +36,7 @@ export function registerRegoDeps(server, config) {
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode !== 0) {
-                return err('INVALID_REGO', 'opa deps exited non-zero — the policy did not compile or the ref is invalid.', { details: { stderr: result.stderr.trim(), ref } });
+                return err('INVALID_REGO', 'opa deps exited non-zero -- the policy did not compile or the ref is invalid.', { details: { stderr: result.stderr.trim(), ref } });
             }
             const parsed = tryParseJson(result.stdout);
             if (parsed === undefined) {

package/dist/tools/authoring/deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/tools/authoring/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yHAAyH,CAC1H;IACH,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;AAOF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,8NAA8N;QAChO,WAAW,EAAE,aAAa;KAC3B,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,cAAc,EACd,8EAA8E,EAC9E,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,6CAA6C,EAAE;oBACzE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAiB,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/tools/authoring/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,aAAa,GAAG;IACpB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yHAAyH,CAC1H;IACH,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;AAOF,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,8NAA8N;QAChO,WAAW,EAAE,aAAa;KAC3B,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,OAAO,gBAAgB,CAAiB,MAAM,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,cAAc,EACd,+EAA+E,EAC/E,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CACnD,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAiB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,6CAA6C,EAAE;oBACzE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAiB,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/format.js

@@ -1,5 +1,5 @@
 /**
- * `rego_format` — format Rego source via `opa fmt`.
+ * `rego_format` -- format Rego source via `opa fmt`.
  *
  * Idempotent: running it on already-formatted source produces
  * identical output and `changed: false`.

package/dist/tools/authoring/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Category A — Authoring & static analysis.
+ * Category A -- Authoring & static analysis.
  *
  * Tools in this category operate on Rego source code without requiring
  * a running OPA server. They wrap `opa fmt`, `opa check`, `opa parse`,

package/dist/tools/authoring/inspect.js

@@ -1,5 +1,5 @@
 /**
- * `rego_inspect` — inspect a bundle, directory, or single Rego file
+ * `rego_inspect` -- inspect a bundle, directory, or single Rego file
  * via `opa inspect`. Returns the manifest (if present), namespaces,
  * and rule annotations as JSON.
  */
@@ -30,7 +30,7 @@ export function registerRegoInspect(server, config) {
             if (subprocessFailure)
                 return subprocessFailure;
             if (result.exitCode !== 0) {
-                return err('INVALID_BUNDLE', 'opa inspect rejected the target — it is not a valid bundle, directory, or Rego file.', {
+                return err('INVALID_BUNDLE', 'opa inspect rejected the target -- it is not a valid bundle, directory, or Rego file.', {
                     details: { stderr: result.stderr.trim(), stdout: result.stdout.trim() },
                 });
             }

package/dist/tools/authoring/inspect.js.map

@@ -1 +1 @@
-{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../../src/tools/authoring/inspect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;AASF,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAoB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;YAEvC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAS,EAAE,CAAC,CAAC;YAExD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,gBAAgB,EAChB,sFAAsF,EACtF;oBACE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACxE,CACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,gDAAgD,EAAE;oBAC5E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAoB,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"inspect.js","sourceRoot":"","sources":["../../../src/tools/authoring/inspect.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;AASF,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE,gBAAgB;KAC9B,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAoB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;YAEvC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAS,EAAE,CAAC,CAAC;YAExD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CACR,gBAAgB,EAChB,uFAAuF,EACvF;oBACE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBACxE,CACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,gDAAgD,EAAE;oBAC5E,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAoB,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/lint.js

@@ -1,5 +1,5 @@
 /**
- * `rego_lint` — lint Rego with the optional `regal` binary.
+ * `rego_lint` -- lint Rego with the optional `regal` binary.
  *
  * The only authoring tool that requires Regal. Returns
  * `REGAL_NOT_FOUND` with an install hint if the binary is missing.

package/dist/tools/authoring/parse.js

@@ -1,5 +1,5 @@
 /**
- * `rego_parse_ast` — parse Rego source to a JSON AST.
+ * `rego_parse_ast` -- parse Rego source to a JSON AST.
  *
  * Wraps `opa parse --format=json`. Useful for tools that want to walk
  * the structure of a policy programmatically (rule discovery, ref

package/dist/tools/bundles/build.js

@@ -1,5 +1,5 @@
 /**
- * `opa_bundle_build` — build a deployable bundle from policy + data
+ * `opa_bundle_build` -- build a deployable bundle from policy + data
  * paths via `opa build`.
  */
 import { z } from 'zod';

package/dist/tools/bundles/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Category C — Bundle operations.
+ * Category C -- Bundle operations.
  *
  * Wraps `opa build` and `opa sign` for packaging and signing
  * deployable bundles.

package/dist/tools/bundles/sign.js

@@ -1,5 +1,5 @@
 /**
- * `opa_bundle_sign` — sign an existing bundle directory or archive
+ * `opa_bundle_sign` -- sign an existing bundle directory or archive
  * via `opa sign`.
  */
 import { z } from 'zod';

package/dist/tools/evaluation/_shared.d.ts

@@ -2,7 +2,7 @@
  * Shared helpers for the evaluation tool category.
  *
  * `rego_eval` and its three trace/profile/coverage variants all share
- * the same input/output shape and error handling — only the OPA flags
+ * the same input/output shape and error handling -- only the OPA flags
  * differ. The shared `runEval` helper takes the resolved EvalInput and
  * returns an envelope; each tool's handler is a thin adapter that
  * preps inputs and forwards.

package/dist/tools/evaluation/_shared.js

@@ -2,7 +2,7 @@
  * Shared helpers for the evaluation tool category.
  *
  * `rego_eval` and its three trace/profile/coverage variants all share
- * the same input/output shape and error handling — only the OPA flags
+ * the same input/output shape and error handling -- only the OPA flags
  * differ. The shared `runEval` helper takes the resolved EvalInput and
  * returns an envelope; each tool's handler is a thin adapter that
  * preps inputs and forwards.

package/dist/tools/evaluation/bench.js

@@ -1,5 +1,5 @@
 /**
- * `rego_bench` — benchmark a query via `opa bench`.
+ * `rego_bench` -- benchmark a query via `opa bench`.
  *
  * Returns iteration count plus statistical timing data (ns/op,
  * allocations, etc.).

package/dist/tools/evaluation/compile.d.ts

@@ -1,8 +1,8 @@
 /**
- * `rego_compile_query` — partially evaluate a query.
+ * `rego_compile_query` -- partially evaluate a query.
  *
  * Wraps `opa eval --partial` with a defaulted `unknowns` set. The
- * result is a residual query — what remains after substituting in
+ * result is a residual query -- what remains after substituting in
  * everything that's known. Useful for offline policy slicing.
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

package/dist/tools/evaluation/compile.js

@@ -6,7 +6,7 @@ export function registerRegoCompileQuery(server, config) {
     const opa = new OpaCli(config);
     server.registerTool('rego_compile_query', {
         title: 'Partially evaluate a Rego query',
-        description: 'Run partial evaluation on a query — substitute known values and return the residual policy. Defaults `unknowns` to `["input"]` (treat input as unknown), so the residual encodes "given input X, this is what would have to be true." Use this for offline policy slicing or pre-computing decision sets.',
+        description: 'Run partial evaluation on a query -- substitute known values and return the residual policy. Defaults `unknowns` to `["input"]` (treat input as unknown), so the residual encodes "given input X, this is what would have to be true." Use this for offline policy slicing or pre-computing decision sets.',
         inputSchema: RegoCompileQueryInput,
     }, async (args) => {
         return withToolEnvelope(config, () => runEval(opa, config, {

package/dist/tools/evaluation/compile.js.map

@@ -1 +1 @@
-{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../../src/tools/evaluation/compile.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,cAAc,CAAC;AAE7E,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAE9C,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,2SAA2S;QAC7S,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CACL,GAAG,EACH,MAAM,EACN;YACE,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;SAC5D,EACD,EAAE,CACH,CACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"compile.js","sourceRoot":"","sources":["../../../src/tools/evaluation/compile.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,cAAc,CAAC;AAE7E,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAE9C,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,4SAA4S;QAC9S,WAAW,EAAE,qBAAqB;KACnC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CACL,GAAG,EACH,MAAM,EACN;YACE,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;SAC5D,EACD,EAAE,CACH,CACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/evaluation/eval.d.ts

@@ -1,8 +1,8 @@
 /**
  * `rego_eval` and the three flag-extended variants.
  *
- * Each variant is a thin adapter — same input shape, different OPA
- * flags — built on the shared `runEval` helper.
+ * Each variant is a thin adapter -- same input shape, different OPA
+ * flags -- built on the shared `runEval` helper.
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';

package/dist/tools/evaluation/eval.js

@@ -12,7 +12,7 @@ export function registerRegoEval(server, config) {
     });
     server.registerTool('rego_eval_with_explain', {
         title: 'Evaluate Rego with execution trace',
-        description: "Evaluate with `--explain=full` and return a structured trace alongside the result. Use this when an agent needs to see why a rule fired (or didn't) — the trace is the basis for `rego_explain_decision`.",
+        description: "Evaluate with `--explain=full` and return a structured trace alongside the result. Use this when an agent needs to see why a rule fired (or didn't) -- the trace is the basis for `rego_explain_decision`.",
         inputSchema: SharedEvalInput,
     }, async (args) => {
         return withToolEnvelope(config, () => runEval(opa, config, args, { explain: 'full' }));

package/dist/tools/evaluation/eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../../src/tools/evaluation/eval.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,cAAc,CAAC;AAE7E,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,2MAA2M;QAC7M,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAChD,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,6IAA6I;QAC/I,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"eval.js","sourceRoot":"","sources":["../../../src/tools/evaluation/eval.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,cAAc,CAAC;AAE7E,MAAM,UAAU,gBAAgB,CAAC,MAAiB,EAAE,MAAc;IAChE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,4MAA4M;QAC9M,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAChD,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,0HAA0H;QAC5H,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,yBAAyB,EACzB;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,6IAA6I;QAC/I,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,OAAO,gBAAgB,CAAiB,MAAM,EAAE,GAAG,EAAE,CACnD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAC/C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/evaluation/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * Category B — Evaluation & testing.
+ * Category B -- Evaluation & testing.
  *
  * Tools in this category run Rego queries against policies + input,
  * with optional trace/profile/coverage output. They wrap `opa eval`,

package/dist/tools/evaluation/test.js

@@ -1,5 +1,5 @@
 /**
- * `rego_test` — run Rego unit tests via `opa test`.
+ * `rego_test` -- run Rego unit tests via `opa test`.
  *
  * Returns per-test pass/fail records. With `coverage: true`, returns
  * per-line coverage data alongside the test results.

package/dist/tools/helpers/coverage-gaps.d.ts

@@ -0,0 +1,29 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface CoverageRange {
+    start: {
+        row: number;
+        col?: number;
+    };
+    end: {
+        row: number;
+        col?: number;
+    };
+}
+export interface FileCoverageGap {
+    file: string;
+    coveragePercent: number;
+    uncoveredRanges: CoverageRange[];
+    uncoveredLineCount: number;
+}
+export interface RegoCoverageGapsOutput {
+    overallCoverage: number;
+    totalFiles: number;
+    filesWithGaps: FileCoverageGap[];
+    testsPassed: number;
+    testsFailed: number;
+    testsSkipped: number;
+}
+export declare function registerRegoCoverageGaps(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=coverage-gaps.d.ts.map

package/dist/tools/helpers/coverage-gaps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-gaps.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/coverage-gaps.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4B9C,UAAU,aAAa;IACrB,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpC;AAmBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AA0CD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiFhF"}

package/dist/tools/helpers/coverage-gaps.js

@@ -0,0 +1,125 @@
+/**
+ * `rego_coverage_gaps` -- run opa test --coverage and surface the
+ * uncovered line ranges per file as a structured gap report.
+ *
+ * OPA emits two JSON documents on stdout when --coverage is set: a
+ * test-results array followed by a coverage report object. Both are
+ * parsed here; files with uncovered ranges are returned sorted by
+ * coverage ascending so the worst-covered files appear first.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoCoverageGapsInput = {
+    paths: z
+        .array(z.string())
+        .min(1)
+        .describe('Test directories or files. opa test looks for *_test.rego siblings of source files.'),
+    threshold: z
+        .number()
+        .min(0)
+        .max(100)
+        .optional()
+        .describe('Report only files below this coverage percentage (0-100). When omitted, all files with uncovered ranges are reported.'),
+    runPattern: z.string().optional().describe('Run only tests whose names match this regex.'),
+};
+/**
+ * Parse the combined stdout of `opa test --coverage --format=json`.
+ *
+ * OPA emits a JSON test-results array followed by a JSON coverage
+ * report object. They may appear on separate lines or concatenated.
+ * We scan lines and classify each by shape: arrays are test records,
+ * objects with a `files` key are coverage reports.
+ */
+function parseTestAndCoverage(stdout) {
+    const testRecords = [];
+    let coverageReport;
+    // Fast path: entire stdout is already a coverage-only object.
+    const full = tryParseJson(stdout);
+    if (full && typeof full === 'object' && !Array.isArray(full) && 'files' in full) {
+        return { testRecords, coverageReport: full };
+    }
+    // Scan line-by-line for the two documents.
+    for (const line of stdout.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const parsed = tryParseJson(trimmed);
+        if (!parsed)
+            continue;
+        if (Array.isArray(parsed)) {
+            testRecords.push(...parsed);
+        }
+        else if (typeof parsed === 'object' && parsed !== null && 'files' in parsed) {
+            coverageReport = parsed;
+        }
+    }
+    return { testRecords, coverageReport };
+}
+function countUncoveredLines(ranges) {
+    return ranges.reduce((sum, r) => sum + (r.end.row - r.start.row + 1), 0);
+}
+export function registerRegoCoverageGaps(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_coverage_gaps', {
+        title: 'Rego test coverage gaps',
+        description: 'Run opa test --coverage and return a per-file breakdown of uncovered line ranges. Identifies which rules or branches are not yet exercised by tests. Files are sorted by coverage ascending so the worst-covered files appear first. Use threshold to limit the report to files below a target coverage percentage.',
+        inputSchema: RegoCoverageGapsInput,
+    }, async ({ paths, threshold, runPattern }) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths(paths, config, { mustExist: true });
+            if (!validation.ok)
+                return validation.error;
+            const result = await opa.test({
+                paths: validation.resolved,
+                coverage: true,
+                runPattern,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            const { testRecords, coverageReport } = parseTestAndCoverage(result.stdout);
+            if (!coverageReport) {
+                if (result.exitCode !== 0) {
+                    return err('EVAL_ERROR', 'opa test reported failures or a compile error; coverage is only emitted when all tests pass. Fix the failing tests or policy errors first.', { details: { stderr: result.stderr.trim() } });
+                }
+                return err('NO_TESTS_FOUND', 'opa test ran but produced no coverage report. Ensure the paths contain *_test.rego files with test_ rules.', {
+                    hint: 'Test rules must begin with test_ and live in *_test.rego files alongside the policy.',
+                });
+            }
+            const testsPassed = testRecords.filter((r) => r.pass).length;
+            const testsFailed = testRecords.filter((r) => r.fail).length;
+            const testsSkipped = testRecords.filter((r) => r.skip).length;
+            const overallCoverage = coverageReport.coverage ?? 0;
+            const filesWithGaps = [];
+            for (const [file, report] of Object.entries(coverageReport.files ?? {})) {
+                const coveragePercent = report.coverage ?? 0;
+                const notCovered = report.not_covered ?? [];
+                // Apply threshold filter: skip files already above the target.
+                if (threshold !== undefined && coveragePercent >= threshold)
+                    continue;
+                // Skip files with no uncovered ranges at all.
+                if (notCovered.length === 0)
+                    continue;
+                filesWithGaps.push({
+                    file,
+                    coveragePercent,
+                    uncoveredRanges: notCovered,
+                    uncoveredLineCount: countUncoveredLines(notCovered),
+                });
+            }
+            // Sort worst-covered first so the agent sees the biggest gaps immediately.
+            filesWithGaps.sort((a, b) => a.coveragePercent - b.coveragePercent);
+            return ok({
+                overallCoverage,
+                totalFiles: Object.keys(coverageReport.files ?? {}).length,
+                filesWithGaps,
+                testsPassed,
+                testsFailed,
+                testsSkipped,
+            });
+        });
+    });
+}
+//# sourceMappingURL=coverage-gaps.js.map