@orygn/opa-mcp 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -17,6 +17,66 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.1.4] - 2026-05-20
+
+### Fixed
+
+- **`rego_inspect` never returned annotation data.** `opa inspect` was
+  invoked without the `--annotations` flag, so `# METADATA` block
+  contents were always absent from the output even though the tool's
+  output type declared them. The flag is now passed on every call.
+
+- **`rego_security_audit` remediation hints were keyed to wrong rule
+  titles.** Three entries in `REMEDIATION_HINTS` used names that do not
+  match real regal rule titles: `duplicate-definition` (actual:
+  `duplicate-rule`), `shadowing-builtin` (actual: `rule-shadows-builtin`),
+  and `sprintf-formatting` (actual: `sprintf-arguments-mismatch`). All
+  three keys are corrected; affected violations were silently falling
+  back to the generic remediation string instead of the specific guidance.
+
+### Tests
+
+- Added integration test (`regal-cli.test.ts`) that runs a policy
+  containing `constant-condition` and `duplicate-rule` against real
+  regal 0.30.0 and asserts both violation titles appear in the output.
+  Confirms the `bugs` category produces findings in the installed regal
+  version and that every returned violation carries `category: "bugs"`.
+
+## [0.1.3] - 2026-05-18
+
+### Added
+
+- **`rego_coverage_gaps` tool.** Runs `opa test --coverage` and returns a
+  per-file breakdown of uncovered line ranges, sorted by coverage ascending
+  so the worst-covered files appear first. Accepts an optional `threshold`
+  to limit output to files below a target coverage percentage. Surfaces
+  `testsPassed`, `testsFailed`, `testsSkipped`, and `overallCoverage` in
+  the envelope alongside the gap report.
+
+- **`rego_security_audit` tool.** Runs regal lint restricted to the
+  `security` and `bugs` categories across one or more policy directories.
+  Returns findings grouped by severity (high / medium) with per-finding
+  remediation guidance. Designed for fleet-wide periodic sweeps rather
+  than per-file style review. Requires regal.
+
+- **`mcp_server_info` tool.** Returns the server name, version, resolved
+  `opa` and `regal` versions, transport type, and Node.js version in a
+  single call. Useful for verifying which server instance an agent is
+  talking to and confirming binary paths resolved correctly.
+
+- **Claude Code install section** in README with the `claude mcp add --env`
+  command. Standing-instructions template (`examples/CLAUDE.md`) and
+  PostToolUse hook config (`examples/claude-code-hook.json`) for policy
+  repos using Claude Code.
+
+- **Node 24 added to CI matrix.** Unit tests now run on Node 20, 22, and 24
+  across Ubuntu, macOS, and Windows.
+
+### Changed
+
+- All em dashes in source comments replaced with `--` (U+002D pairs).
+  No behavior change; cosmetic consistency fix.
+
 ## [0.1.2] - 2026-05-18
 
 ### Fixed
@@ -157,7 +217,9 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.4...HEAD
+[0.1.4]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.3...v0.1.4
+[0.1.3]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.2
 [0.1.1]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.1
 [0.1.0]: https://github.com/OrygnsCode/opa-mcp-server/releases/tag/v0.1.0

package/README.md

@@ -4,6 +4,7 @@
 [![CodeQL](https://github.com/OrygnsCode/opa-mcp-server/actions/workflows/codeql.yml/badge.svg)](https://github.com/OrygnsCode/opa-mcp-server/actions/workflows/codeql.yml)
 [![npm version](https://img.shields.io/npm/v/@orygn/opa-mcp.svg)](https://www.npmjs.com/package/@orygn/opa-mcp)
 [![Docker pulls](https://img.shields.io/docker/pulls/orygn/opa-mcp.svg)](https://hub.docker.com/r/orygn/opa-mcp)
+[![OPA Ecosystem](https://img.shields.io/badge/OPA-ecosystem-blue.svg)](https://www.openpolicyagent.org/ecosystem/entry/opa-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Node.js](https://img.shields.io/node/v/@orygn/opa-mcp.svg)](./package.json)
 
@@ -17,10 +18,10 @@ environment.
 +--------------------+  MCP / stdio  +-----------------+  spawn / HTTP  +------------------+
 |  Claude · Cursor · | ------------> |  @orygn/opa-mcp | -------------> |  opa · regal ·   |
 |   VS Code · ...    | <------------ |                 | <------------- |  OPA REST API    |
-+--------------------+   32 tools    +-----------------+                +------------------+
++--------------------+   35 tools    +-----------------+                +------------------+
 ```
 
-> **Status:** v0.1.1. Tool surface, error codes, and
+> **Status:** v0.1.4. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
@@ -100,20 +101,10 @@ recognize the gap this fills.
 The server runs locally over stdio. Pick the install path that matches
 your client.
 
-### Claude Desktop / Claude Code
+### Claude Desktop
 
-The fastest path is the Smithery one-liner:
-
-```bash
-npx -y @smithery/cli install @orygn/opa-mcp --client claude
-```
-
-Or download `opa-mcp.mcpb` from the
-[latest release](https://github.com/OrygnsCode/opa-mcp-server/releases/latest)
-and double-click it.
-
-If you prefer to edit `claude_desktop_config.json` by hand, the snippet
-lives in [`examples/claude-desktop.json`](./examples/claude-desktop.json):
+Edit `claude_desktop_config.json` directly (or copy from
+[`examples/claude-desktop.json`](./examples/claude-desktop.json)):
 
 ```json
 {
@@ -136,6 +127,47 @@ lives in [`examples/claude-desktop.json`](./examples/claude-desktop.json):
 > [first-time install gotcha](#-first-time-install-gotcha-read-this-if-you-used-npx-or-the-global-install)
 > below. Windows users substitute `C:\\path\\to\\opa.exe`.
 
+Or download `opa-mcp.mcpb` from the
+[latest release](https://github.com/OrygnsCode/opa-mcp-server/releases/latest)
+and double-click it.
+
+Alternatively, use the Smithery one-liner:
+
+```bash
+npx -y @smithery/cli install @orygn/opa-mcp --client claude
+```
+
+### Claude Code (CLI)
+
+Register the server for the current project with `claude mcp add`:
+
+```bash
+claude mcp add \
+  --env OPA_BINARY=/usr/local/bin/opa \
+  --env REGAL_BINARY=/usr/local/bin/regal \
+  --env OPA_MCP_ALLOWED_PATHS=/path/to/your/policies \
+  opa -- npx -y @orygn/opa-mcp
+```
+
+This writes the config into `.mcp.json` at your project root and is
+picked up automatically on every `claude` session in that directory.
+Add `--scope user` to register it globally instead.
+
+> Replace the paths with your real absolute paths (same caveat as
+> Claude Desktop above). On Windows use `C:\path\to\opa.exe` syntax.
+
+**Persistent context and auto-checks for policy repos.**
+If you work in an OPA policy repo regularly, two extra files remove
+repetitive setup from every session:
+
+- [`examples/CLAUDE.md`](./examples/CLAUDE.md) -- copy to your repo
+  root or `.claude/CLAUDE.md`. Claude Code loads it every session,
+  so the agent always knows which tools to use and what conventions apply.
+- [`examples/claude-code-hook.json`](./examples/claude-code-hook.json) --
+  merge the `hooks` block into `.claude/settings.json`. Runs `opa check`
+  automatically after any `.rego` file is written, so syntax errors
+  surface immediately without a manual tool call.
+
 ### Cursor
 
 Drop [`examples/cursor.json`](./examples/cursor.json) into either
@@ -369,6 +401,14 @@ the tasks agents are actually asked to do.
 | `rego_generate_test_skeleton` | Given a policy, generate a `_test.rego` skeleton covering each rule.                                                                                  |
 | `rego_describe_policy`        | Summarize what a policy does, its inputs, decisions, and assumptions.                                                                                 |
 | `rego_suggest_fix`            | For a failed `rego_check` or `rego_lint`, propose minimal patches.                                                                                    |
+| `rego_coverage_gaps`          | Run `opa test --coverage` and return per-file uncovered line ranges, sorted worst first. Use `threshold` to focus on files below a target percentage. |
+| `rego_security_audit`         | Run regal lint restricted to `security` and `bugs` categories across a directory. Returns severity-grouped findings with remediation guidance.        |
+
+### Category F: Meta
+
+| Tool              | What it does                                                                                                                                                                         |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `mcp_server_info` | Return server name, version, resolved `opa`/`regal` versions, transport type, and Node.js version in one call. Useful for verifying which server instance the agent is connected to. |
 
 ## Prompts
 
@@ -452,7 +492,8 @@ Agent: Done. Policy `rbac` is live on staging at $OPA_URL.
 │                          ├── tools/evaluation/        ─┤                              │
 │                          ├── tools/bundles/           ─┼─── lib/opa-cli.ts ──┐        │
 │                          ├── tools/server-management/ ─┤                     │        │
-│                          ├── tools/helpers/           ─┘                     │        │
+│                          ├── tools/helpers/           ─┤                     │        │
+│                          ├── tools/meta/              ─┘                     │        │
 │                          │                                                   ▼        │
 │                          │                              lib/subprocess.ts ──┴── opa   │
 │                          │                              lib/regal-cli.ts   ───── regal│
@@ -554,11 +595,10 @@ upgrade Regal: `brew upgrade regal` or download from the
 
 **`directory-package-mismatch` violation when linting inline source.**
 
-When you pass `source` rather than `paths` to `rego_lint`, Regal sees a
-randomized temp-file path that can't possibly match your declared package
-path. The diagnostic is an artifact of inline linting, not a real issue.
-Disable the rule for inline workflows or lint via `paths` against the
-real on-disk file when you want canonical signal.
+Since v0.1.1, the server auto-disables this rule for inline-source calls.
+If you see it, you are running an older version -- upgrade to v0.1.1 or
+later. To get canonical signal on this rule, lint via `paths` against the
+real on-disk file instead of passing `source` directly.
 
 **Where are the logs?**
 
@@ -588,8 +628,8 @@ npm run build             # compile to dist/
 ```
 
 CI runs lint, typecheck, build, and unit tests on every push and PR
-across Ubuntu, macOS, and Windows on Node 20 and 22. Integration tests
-run on Linux against pinned `opa` and `regal` releases.
+across Ubuntu, macOS, and Windows on Node 20, 22, and 24. Integration
+tests run on Linux against pinned `opa` and `regal` releases.
 
 For the full contributor workflow (adding tools, naming conventions,
 logging discipline, release process), see [CONTRIBUTING.md](./CONTRIBUTING.md).
@@ -621,3 +661,5 @@ endorsed by, or sponsored by the Open Policy Agent project, the Cloud
 Native Computing Foundation, Styra, or Anthropic. "Open Policy Agent"
 and "Rego" are trademarks of their respective owners. "Model Context
 Protocol" is a trademark of Anthropic, PBC.
+
+Listed in the [OPA Ecosystem](https://www.openpolicyagent.org/ecosystem/entry/opa-mcp).

package/dist/config.d.ts

@@ -15,7 +15,7 @@ declare const ConfigSchema: z.ZodObject<{
     /**
      * Allow-listed root directories for file path inputs. Tools that accept
      * filesystem paths reject anything outside these roots. Empty by
-     * default — file-based tools refuse to read from disk until the
+     * default -- file-based tools refuse to read from disk until the
      * operator explicitly opts in via `OPA_MCP_ALLOWED_PATHS`.
      */
     allowedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;

package/dist/config.js

@@ -1,7 +1,7 @@
 /**
  * Centralized configuration loaded from environment variables.
  *
- * Environment variables are the only configuration surface — there is no
+ * Environment variables are the only configuration surface -- there is no
  * config file, no flags. This matches how MCP clients (Claude Desktop,
  * Cursor, VS Code) pass config via the `env` object in their JSON.
  */
@@ -24,7 +24,7 @@ const ConfigSchema = z.object({
     /**
      * Allow-listed root directories for file path inputs. Tools that accept
      * filesystem paths reject anything outside these roots. Empty by
-     * default — file-based tools refuse to read from disk until the
+     * default -- file-based tools refuse to read from disk until the
      * operator explicitly opts in via `OPA_MCP_ALLOWED_PATHS`.
      */
     allowedPaths: z.array(z.string()).default([]),

package/dist/constants.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Server identity constants shared between the entry point and the
+ * mcp_server_info tool. Defined here to avoid a circular import
+ * (server.ts -> tools -> meta -> server.ts).
+ */
+export declare const SERVER_NAME = "orygn-opa-mcp";
+export declare const SERVER_VERSION = "0.1.3";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC"}

package/dist/constants.js

@@ -0,0 +1,8 @@
+/**
+ * Server identity constants shared between the entry point and the
+ * mcp_server_info tool. Defined here to avoid a circular import
+ * (server.ts -> tools -> meta -> server.ts).
+ */
+export const SERVER_NAME = 'orygn-opa-mcp';
+export const SERVER_VERSION = '0.1.3';
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/dist/lib/errors.d.ts

@@ -1,7 +1,7 @@
 /**
  * Helpers for building structured tool errors.
  *
- * Tools should never throw raw exceptions to the MCP layer — every failure
+ * Tools should never throw raw exceptions to the MCP layer -- every failure
  * mode returns a `ToolEnvelope` with `ok: false` and a structured `error`.
  */
 import type { ToolEnvelope, ToolErrorCode } from '../types.js';

package/dist/lib/logger.js

@@ -1,7 +1,7 @@
 /**
  * File-only logger.
  *
- * Stdout is reserved for MCP protocol traffic — writing anywhere else
+ * Stdout is reserved for MCP protocol traffic -- writing anywhere else
  * would corrupt the JSON-RPC stream. This logger appends to a file with
  * level filtering, and never touches stdout.
  *
@@ -37,7 +37,7 @@ function write(level, msg, ctx) {
     }
     catch {
         // Logging must never throw. If the log file is unreachable, drop the
-        // line silently — better than crashing the server.
+        // line silently -- better than crashing the server.
     }
 }
 export const logger = {

package/dist/lib/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIzC,MAAM,cAAc,GAA0B;IAC5C,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAOF,kDAAkD;AAClD,IAAI,KAA8B,CAAC;AAEnC,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAY;IACnD,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,KAAY,EAAE,GAAW,EAAE,GAA6B;IACrE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEnE,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,KAAK;QACL,GAAG;QACH,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;IACF,IAAI,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,mDAAmD;IACrD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QAC1D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QACzD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QACzD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QAC1D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIzC,MAAM,cAAc,GAA0B;IAC5C,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;CACV,CAAC;AAOF,kDAAkD;AAClD,IAAI,KAA8B,CAAC;AAEnC,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAY;IACnD,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,KAAK,CAAC,KAAY,EAAE,GAAW,EAAE,GAA6B;IACrE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,cAAc,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEnE,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,KAAK;QACL,GAAG;QACH,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;IACF,IAAI,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QAC1D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QACzD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QACzD,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,EAAE,CAAC,GAAW,EAAE,GAA6B,EAAQ,EAAE;QAC1D,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF,CAAC"}

package/dist/lib/opa-cli.d.ts

@@ -138,7 +138,7 @@ export interface SignInput {
 /**
  * Wrapper around the local `opa` binary.
  *
- * Methods do not throw on `opa` errors — non-zero exit codes are
+ * Methods do not throw on `opa` errors -- non-zero exit codes are
  * surfaced on the returned `SpawnResult` so tools can map them to
  * structured error envelopes at their layer. They DO throw on
  * caller-side bugs (e.g. an empty `paths` array passed where one is
@@ -154,7 +154,7 @@ export declare class OpaCli {
     version(): Promise<string | null>;
     /**
      * Format Rego source. Stdout contains the formatted output. Reports
-     * `exitCode: 0` even when no changes are needed — callers compare
+     * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
     fmt(input: FmtInput): Promise<SpawnResult>;
@@ -162,7 +162,7 @@ export declare class OpaCli {
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
      * policy is valid. On failure, `exitCode` is non-zero and the JSON
      * error report is written to **stderr** (this is OPA's actual
-     * behavior — tools must read `stderr`, not `stdout`, for `check`
+     * behavior -- tools must read `stderr`, not `stdout`, for `check`
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */

package/dist/lib/opa-cli.js

@@ -10,7 +10,7 @@
  * The `-` (read-from-stdin) convention some opa subcommands document is
  * unreliable on Windows, where `-` is treated as a literal filename.
  *
- * The methods do not parse stdout into typed result objects — different
+ * The methods do not parse stdout into typed result objects -- different
  * tools need different shapes of the same output and a one-size parser
  * would force conversions both ways. Stdout is JSON whenever
  * `--format=json` is set, and tools call `JSON.parse` on it themselves.
@@ -23,7 +23,7 @@ import { runBinary } from './subprocess.js';
 /**
  * Wrapper around the local `opa` binary.
  *
- * Methods do not throw on `opa` errors — non-zero exit codes are
+ * Methods do not throw on `opa` errors -- non-zero exit codes are
  * surfaced on the returned `SpawnResult` so tools can map them to
  * structured error envelopes at their layer. They DO throw on
  * caller-side bugs (e.g. an empty `paths` array passed where one is
@@ -48,7 +48,7 @@ export class OpaCli {
     // ─── Authoring ───────────────────────────────────────────────────────
     /**
      * Format Rego source. Stdout contains the formatted output. Reports
-     * `exitCode: 0` even when no changes are needed — callers compare
+     * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
     async fmt(input) {
@@ -58,7 +58,7 @@ export class OpaCli {
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
      * policy is valid. On failure, `exitCode` is non-zero and the JSON
      * error report is written to **stderr** (this is OPA's actual
-     * behavior — tools must read `stderr`, not `stdout`, for `check`
+     * behavior -- tools must read `stderr`, not `stdout`, for `check`
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
@@ -90,7 +90,7 @@ export class OpaCli {
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
     async inspect(input) {
-        return this.run(['inspect', '--format=json', input.target]);
+        return this.run(['inspect', '--format=json', '--annotations', input.target]);
     }
     /**
      * Print available capabilities. With `current=true`, prints the

package/dist/lib/opa-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.js","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAoJ9D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAA2B,EAAE;QAC9C,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,mBAAmB;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5D,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzE,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IAExE,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,KAAc;QACtC,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IAExE;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"opa-cli.js","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAoJ9D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAA2B,EAAE;QAC9C,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,mBAAmB;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5D,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzE,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IAExE,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,KAAc;QACtC,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IAExE;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/dist/lib/opa-client.d.ts

@@ -29,7 +29,7 @@ export interface RequestOptions {
     body?: unknown;
     /**
      * Raw string body sent verbatim. Used for endpoints that accept
-     * non-JSON content — notably `PUT /v1/policies/{id}` which expects
+     * non-JSON content -- notably `PUT /v1/policies/{id}` which expects
      * Rego source as `text/plain`.
      */
     rawBody?: string;

package/dist/lib/regal-cli.d.ts

@@ -39,7 +39,7 @@ export interface LintInput {
 /**
  * Wrapper around the local `regal` binary.
  *
- * Like `OpaCli`, methods do not throw on Regal-side errors — the exit
+ * Like `OpaCli`, methods do not throw on Regal-side errors -- the exit
  * code on the returned `SpawnResult` is the signal. Inline source is
  * always written to a temp file because `regal lint` does not read
  * from stdin.
@@ -58,9 +58,9 @@ export declare class RegalCli {
      * provided.
      *
      * Regal's exit codes:
-     * - 0 — no findings at or above `failLevel`
-     * - 3 — findings present
-     * - non-zero other — Regal-internal failure (config error, etc.)
+     * - 0 -- no findings at or above `failLevel`
+     * - 3 -- findings present
+     * - non-zero other -- Regal-internal failure (config error, etc.)
      *
      * When called with inline `source`, location-bound rules whose
      * verdict depends on the on-disk path (currently

package/dist/lib/regal-cli.js

@@ -1,7 +1,7 @@
 /**
  * Wrapper around the optional `regal` binary (Rego linter, by Styra).
  *
- * Regal is OPTIONAL — only the `rego_lint` tool requires it. Other
+ * Regal is OPTIONAL -- only the `rego_lint` tool requires it. Other
  * tools work without Regal installed. If absent, `rego_lint` returns a
  * structured `REGAL_NOT_FOUND` error with an install hint.
  */
@@ -21,7 +21,7 @@ export const INLINE_SOURCE_FALSE_POSITIVE_RULES = ['directory-package-mismatch']
 /**
  * Wrapper around the local `regal` binary.
  *
- * Like `OpaCli`, methods do not throw on Regal-side errors — the exit
+ * Like `OpaCli`, methods do not throw on Regal-side errors -- the exit
  * code on the returned `SpawnResult` is the signal. Inline source is
  * always written to a temp file because `regal lint` does not read
  * from stdin.
@@ -48,9 +48,9 @@ export class RegalCli {
      * provided.
      *
      * Regal's exit codes:
-     * - 0 — no findings at or above `failLevel`
-     * - 3 — findings present
-     * - non-zero other — Regal-internal failure (config error, etc.)
+     * - 0 -- no findings at or above `failLevel`
+     * - 3 -- findings present
+     * - non-zero other -- Regal-internal failure (config error, etc.)
      *
      * When called with inline `source`, location-bound rules whose
      * verdict depends on the on-disk path (currently

package/dist/lib/subprocess.d.ts

@@ -19,7 +19,7 @@ export interface SpawnResult {
     durationMs: number;
 }
 /**
- * Run a binary and return its captured output. Never throws — failures
+ * Run a binary and return its captured output. Never throws -- failures
  * are reflected in `exitCode` / `timedOut`.
  */
 export declare function runBinary(binary: string, opts: SpawnOptions): Promise<SpawnResult>;

package/dist/lib/subprocess.js

@@ -1,14 +1,14 @@
 /**
  * Subprocess wrapper used by `opa-cli.ts` and `regal-cli.ts`.
  *
- * - Uses argv arrays only (never shell strings) — prevents injection.
+ * - Uses argv arrays only (never shell strings) -- prevents injection.
  * - Hard timeout per invocation, defaulting to config.subprocessTimeoutMs.
  * - Captures stdout / stderr / exit code separately.
  * - Optional stdin payload for piping source code.
  */
 import { spawn } from 'node:child_process';
 /**
- * Run a binary and return its captured output. Never throws — failures
+ * Run a binary and return its captured output. Never throws -- failures
  * are reflected in `exitCode` / `timedOut`.
  */
 export async function runBinary(binary, opts) {

package/dist/lib/tool-helpers.d.ts

@@ -1,7 +1,7 @@
 /**
  * Helpers shared across tool implementations.
  *
- * Each tool follows the same shape — validate input, call into a CLI
+ * Each tool follows the same shape -- validate input, call into a CLI
  * wrapper or HTTP client, map errors to a structured envelope, return
  * the formatted MCP result. The pieces here factor out the parts every
  * tool repeats so each tool file can stay focused on its own logic.

package/dist/prompts/index.js

@@ -1,5 +1,5 @@
 /**
- * MCP Prompts — slash-command-like workflow templates.
+ * MCP Prompts -- slash-command-like workflow templates.
  *
  * Each prompt is a stateless instruction set the agent receives when
  * the user invokes it. They orient the agent toward a specific
@@ -64,7 +64,7 @@ Return a concise review with: pass/fail per item, recommended diffs.`;
 const decisionDebuggingWorkflowPrompt = (args) => {
     return `You are debugging an unexpected Rego decision.
 
-Query: ${args.query ?? '<not provided — ask the user>'}
+Query: ${args.query ?? '<not provided -- ask the user>'}
 User's expectation: ${args.expectation ?? '<ask the user what they expected>'}
 
 Workflow:
@@ -77,13 +77,13 @@ Workflow:
 3. Re-run with \`rego_explain_decision\` to get a structured trace.
    Identify which rules were evaluated and which fired.
 4. The cause is one of:
-   a. **Input mismatch** — the policy expected a different input shape.
+   a. **Input mismatch** -- the policy expected a different input shape.
       Use \`rego_describe_policy\` to list the refs the policy reads
       and confirm each is present in the input.
-   b. **Rule logic** — a guard fired or didn't fire when it should
+   b. **Rule logic** -- a guard fired or didn't fire when it should
       have. Read the trace and explain which rule's body evaluated to
       true/false and why.
-   c. **Default decision** — no rule produced a value, so the default
+   c. **Default decision** -- no rule produced a value, so the default
       kicked in.
 5. Propose the smallest fix: either an input correction or a policy
    change. If a policy change, run \`rego_check\` and \`rego_test\` on the
@@ -115,7 +115,7 @@ export function registerPrompts(server, _config) {
             source: z
                 .string()
                 .optional()
-                .describe('Rego source to review. Optional — agent can ask for it.'),
+                .describe('Rego source to review. Optional -- agent can ask for it.'),
         },
     }, (args) => ({
         messages: [

package/dist/prompts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,8BAA8B,GAAG,CAAC,IAGvC,EAAU,EAAE;IACX,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC1E,OAAO;;;;;EAKP,WAAW;;qBAEQ,WAAW;;;;;;;;;;;;;;;gDAegB,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,IAAyB,EAAU,EAAE;IACxE,OAAO;;;EAGP,IAAI,CAAC,MAAM,IAAI,8CAA8C;;;;;;;;;;;;;;;;;;;;;qEAqBM,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CAAC,IAGxC,EAAU,EAAE;IACX,OAAO;;SAEA,IAAI,CAAC,KAAK,IAAI,+BAA+B;sBAChC,IAAI,CAAC,WAAW,IAAI,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;2CAyBlC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,OAAe;IAChE,MAAM,CAAC,cAAc,CACnB,4BAA4B,EAC5B;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,uHAAuH;QACzH,UAAU,EAAE;YACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SACvF;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,CAAC,IAAI,CAAC,EAAE;aACtE;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,wHAAwH;QAC1H,UAAU,EAAE;YACV,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,yDAAyD,CAAC;SACvE;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,CAAC,IAAI,CAAC,EAAE;aACnE;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,2IAA2I;QAC7I,UAAU,EAAE;YACV,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qDAAqD,CAAC;YAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjF;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,CAAC,IAAI,CAAC,EAAE;aACvE;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,8BAA8B,GAAG,CAAC,IAGvC,EAAU,EAAE;IACX,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,gCAAgC,CAAC;IAC1E,OAAO;;;;;EAKP,WAAW;;qBAEQ,WAAW;;;;;;;;;;;;;;;gDAegB,CAAC;AACjD,CAAC,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,IAAyB,EAAU,EAAE;IACxE,OAAO;;;EAGP,IAAI,CAAC,MAAM,IAAI,8CAA8C;;;;;;;;;;;;;;;;;;;;;qEAqBM,CAAC;AACtE,CAAC,CAAC;AAEF,MAAM,+BAA+B,GAAG,CAAC,IAGxC,EAAU,EAAE;IACX,OAAO;;SAEA,IAAI,CAAC,KAAK,IAAI,gCAAgC;sBACjC,IAAI,CAAC,WAAW,IAAI,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;2CAyBlC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,OAAe;IAChE,MAAM,CAAC,cAAc,CACnB,4BAA4B,EAC5B;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,uHAAuH;QACzH,UAAU,EAAE;YACV,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;YAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;SACvF;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,CAAC,IAAI,CAAC,EAAE;aACtE;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,yBAAyB,EACzB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,wHAAwH;QAC1H,UAAU,EAAE;YACV,MAAM,EAAE,CAAC;iBACN,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,0DAA0D,CAAC;SACxE;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,CAAC,IAAI,CAAC,EAAE;aACnE;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,cAAc,CACnB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,2IAA2I;QAC7I,UAAU,EAAE;YACV,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,qDAAqD,CAAC;YAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjF;KACF,EACD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,CAAC,IAAI,CAAC,EAAE;aACvE;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/resources/index.d.ts

@@ -1,9 +1,9 @@
 /**
- * MCP Resources — read-only references the agent can fetch by URI.
+ * MCP Resources -- read-only references the agent can fetch by URI.
  *
- * - opa://builtins      — derived at read-time from `opa capabilities`.
- * - opa://style-guide   — curated Rego style guide content.
- * - opa://patterns      — pattern library: RBAC, ABAC, K8s admission,
+ * - opa://builtins      -- derived at read-time from `opa capabilities`.
+ * - opa://style-guide   -- curated Rego style guide content.
+ * - opa://patterns      -- pattern library: RBAC, ABAC, K8s admission,
  *                         IaC gates, API authz, rate limiting.
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';