@orygn/opa-mcp 0.1.20 → 0.2.0

package/CHANGELOG.md

@@ -17,6 +17,22 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-06-13
+
+### Added
+
+- OPA is now bundled. The OPA binary ships as platform-specific optional
+  dependencies (`@orygn/opa-mcp-<platform>-<arch>`), so `npx @orygn/opa-mcp` runs
+  without installing OPA separately. npm downloads only the binary that matches
+  your operating system and CPU, so the install stays small. Pinned to OPA 0.69.0.
+
+### Changed
+
+- The `opa` binary is now resolved in this order: an explicit `OPA_BINARY` first,
+  then `opa` found on PATH, then the bundled binary. Setups that already have `opa`
+  on PATH keep working exactly as before; the bundled copy is only a fallback, so
+  no existing install changes behavior.
+
 ## [0.1.20] - 2026-06-03
 
 ### Added

package/README.md

@@ -22,7 +22,7 @@ environment.
 +--------------------+  52 tools  +-----------------+            +---------------------+
 ```
 
-> **Status:** v0.1.20. Tool surface, error codes, and
+> **Status:** v0.2.0. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyBlD,wBAAgB,UAAU,IAAI,MAAM,CAgCnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyBlD,wBAAgB,UAAU,IAAI,MAAM,CAqCnC"}

package/dist/config.js

@@ -8,6 +8,7 @@
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
+import { resolveOpaBinary } from './lib/resolve-binary.js';
 const ConfigSchema = z.object({
     /** Base URL of a running OPA server (used by `opa_*` runtime tools). */
     opaUrl: z
@@ -96,6 +97,11 @@ export function loadConfig() {
         console.error("Run 'opa-mcp --help' for configuration options.");
         process.exit(2);
     }
-    return parsed.data;
+    const config = parsed.data;
+    // Turn the configured binary name into a concrete path: an explicit
+    // OPA_BINARY is kept as-is, otherwise we prefer `opa` on PATH and fall
+    // back to the bundled platform binary. See lib/resolve-binary.ts.
+    config.opaBinary = resolveOpaBinary(config.opaBinary);
+    return config;
 }
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.20";
+export declare const SERVER_VERSION = "0.2.0";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,WAAW,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC"}

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.20';
+export const SERVER_VERSION = '0.2.0';
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}

package/dist/lib/resolve-binary.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The bundled package name for a platform/arch pair, or `undefined` when
+ * that combination is not shipped (e.g. 32-bit, freebsd).
+ */
+export declare function platformPackageName(platform: string, arch: string): string | undefined;
+/**
+ * True when `bin` resolves to a file on PATH. Inputs are injectable so the
+ * scan can be exercised deterministically across platforms in tests.
+ *
+ * On win32 each PATHEXT extension is tried (matching the OS), and
+ * surrounding double quotes are stripped from PATH entries (Windows
+ * permits quoted directories, which the loader unquotes but a naive split
+ * would not).
+ */
+export declare function binOnPath(bin: string, opts?: {
+    platform?: string;
+    pathEnv?: string;
+    pathExt?: string;
+}): boolean;
+/**
+ * Absolute path to the bundled `opa` binary for the given platform/arch,
+ * or `undefined` when the optional dependency is not installed, the
+ * platform is unsupported, or the file is missing.
+ *
+ * On non-Windows platforms the file is checked for the execute bit and
+ * `chmod`ed to 0o755 if a package manager dropped it (npm preserves the
+ * bit, but pnpm/Yarn occasionally do not). The chmod is best-effort: if it
+ * fails the path is still returned so the spawn produces a clear error.
+ */
+export declare function bundledOpaPath(platform?: string, arch?: string): string | undefined;
+/** Injectable probes for {@link resolveOpaBinary}, for deterministic tests. */
+export interface ResolveBinaryDeps {
+    onPath?: (bin: string) => boolean;
+    bundled?: () => string | undefined;
+}
+/**
+ * Decide which `opa` binary to spawn. See the module header for the full
+ * resolution order. `configured` is the value from `OPA_BINARY` (or the
+ * `'opa'` default). Never throws.
+ */
+export declare function resolveOpaBinary(configured: string, deps?: ResolveBinaryDeps): string;
+//# sourceMappingURL=resolve-binary.d.ts.map

package/dist/lib/resolve-binary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-binary.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-binary.ts"],"names":[],"mappings":"AA6CA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtF;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GACnE,OAAO,CAkBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAyB,EACnC,IAAI,GAAE,MAAqB,GAC1B,MAAM,GAAG,SAAS,CAyBpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,MAAM,CAQzF"}

package/dist/lib/resolve-binary.js

@@ -0,0 +1,131 @@
+/**
+ * Resolves which `opa` binary the server should spawn.
+ *
+ * The server ships the OPA binary as platform-specific optional
+ * dependencies (`@orygn/opa-mcp-<platform>-<arch>`), following the same
+ * model esbuild and @swc use. npm installs only the package matching the
+ * host's `os`/`cpu`, so the right binary lands in `node_modules` with no
+ * postinstall download.
+ *
+ * Resolution order, highest priority first:
+ *   1. An explicit `OPA_BINARY` (anything other than the bare default
+ *      `'opa'`) is returned verbatim. The operator's choice always wins.
+ *   2. `opa` already on PATH is used as-is, preserving the exact behavior
+ *      of every install that predates bundling. No version is swapped out
+ *      from under an existing user.
+ *   3. The bundled optional-dependency binary, if installed.
+ *   4. Falls back to the literal `'opa'`, so a missing binary surfaces the
+ *      same `OPA_BINARY_NOT_FOUND` install hint as before.
+ *
+ * This function never throws: every filesystem and module-resolution
+ * failure degrades to returning `'opa'`.
+ *
+ * Note on the PATH scan (step 2): it mirrors how the OS resolves a bare
+ * command name, but is not guaranteed bit-identical to the platform's
+ * loader in every edge case. While no platform packages are published it
+ * is moot -- `bundledOpaPath()` returns undefined, so the resolver can
+ * only ever return `'opa'`. Scan fidelity becomes load-bearing once the
+ * platform packages ship, and is validated by the cross-platform CI
+ * matrix before that point.
+ */
+import { accessSync, chmodSync, constants, existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { delimiter, dirname, join } from 'node:path';
+const nodeRequire = createRequire(import.meta.url);
+/** Optional-dependency package name keyed by `${platform}-${arch}`. */
+const PLATFORM_PACKAGES = {
+    'linux-x64': '@orygn/opa-mcp-linux-x64',
+    'linux-arm64': '@orygn/opa-mcp-linux-arm64',
+    'darwin-x64': '@orygn/opa-mcp-darwin-x64',
+    'darwin-arm64': '@orygn/opa-mcp-darwin-arm64',
+    'win32-x64': '@orygn/opa-mcp-win32-x64',
+};
+/**
+ * The bundled package name for a platform/arch pair, or `undefined` when
+ * that combination is not shipped (e.g. 32-bit, freebsd).
+ */
+export function platformPackageName(platform, arch) {
+    return PLATFORM_PACKAGES[`${platform}-${arch}`];
+}
+/**
+ * True when `bin` resolves to a file on PATH. Inputs are injectable so the
+ * scan can be exercised deterministically across platforms in tests.
+ *
+ * On win32 each PATHEXT extension is tried (matching the OS), and
+ * surrounding double quotes are stripped from PATH entries (Windows
+ * permits quoted directories, which the loader unquotes but a naive split
+ * would not).
+ */
+export function binOnPath(bin, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    const pathEnv = opts.pathEnv ?? process.env['PATH'] ?? '';
+    const exts = platform === 'win32'
+        ? (opts.pathExt ?? process.env['PATHEXT'] ?? '.EXE;.CMD;.BAT')
+            .split(';')
+            .map((e) => e.toLowerCase())
+        : [''];
+    for (const rawDir of pathEnv.split(delimiter)) {
+        const dir = rawDir.replace(/^"(.*)"$/, '$1');
+        if (!dir)
+            continue;
+        for (const ext of exts) {
+            if (existsSync(join(dir, bin + ext)))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Absolute path to the bundled `opa` binary for the given platform/arch,
+ * or `undefined` when the optional dependency is not installed, the
+ * platform is unsupported, or the file is missing.
+ *
+ * On non-Windows platforms the file is checked for the execute bit and
+ * `chmod`ed to 0o755 if a package manager dropped it (npm preserves the
+ * bit, but pnpm/Yarn occasionally do not). The chmod is best-effort: if it
+ * fails the path is still returned so the spawn produces a clear error.
+ */
+export function bundledOpaPath(platform = process.platform, arch = process.arch) {
+    const pkg = platformPackageName(platform, arch);
+    if (!pkg)
+        return undefined;
+    const binName = platform === 'win32' ? 'opa.exe' : 'opa';
+    let file;
+    try {
+        file = join(dirname(nodeRequire.resolve(`${pkg}/package.json`)), binName);
+    }
+    catch {
+        return undefined; // optional dependency not installed
+    }
+    if (!existsSync(file))
+        return undefined;
+    if (platform !== 'win32') {
+        try {
+            accessSync(file, constants.X_OK);
+        }
+        catch {
+            try {
+                chmodSync(file, 0o755);
+            }
+            catch {
+                /* best effort; an unusable binary will surface OPA_BINARY_NOT_FOUND on spawn */
+            }
+        }
+    }
+    return file;
+}
+/**
+ * Decide which `opa` binary to spawn. See the module header for the full
+ * resolution order. `configured` is the value from `OPA_BINARY` (or the
+ * `'opa'` default). Never throws.
+ */
+export function resolveOpaBinary(configured, deps = {}) {
+    if (configured !== 'opa')
+        return configured;
+    const onPath = deps.onPath ?? ((b) => binOnPath(b));
+    if (onPath('opa'))
+        return 'opa';
+    const bundled = deps.bundled ?? (() => bundledOpaPath());
+    return bundled() ?? 'opa';
+}
+//# sourceMappingURL=resolve-binary.js.map

package/dist/lib/resolve-binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-binary.js","sourceRoot":"","sources":["../../src/lib/resolve-binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAErD,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEnD,uEAAuE;AACvE,MAAM,iBAAiB,GAA2B;IAChD,WAAW,EAAE,0BAA0B;IACvC,aAAa,EAAE,4BAA4B;IAC3C,YAAY,EAAE,2BAA2B;IACzC,cAAc,EAAE,6BAA6B;IAC7C,WAAW,EAAE,0BAA0B;CACxC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAY;IAChE,OAAO,iBAAiB,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,OAAkE,EAAE;IAEpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GACR,QAAQ,KAAK,OAAO;QAClB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEX,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAmB,OAAO,CAAC,QAAQ,EACnC,OAAe,OAAO,CAAC,IAAI;IAE3B,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,oCAAoC;IACxD,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAA0B,EAAE;IAC/E,IAAI,UAAU,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAS,EAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAuB,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7E,OAAO,OAAO,EAAE,IAAI,KAAK,CAAC;AAC5B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orygn/opa-mcp",
-  "version": "0.1.20",
+  "version": "0.2.0",
   "mcpName": "io.github.OrygnsCode/opa-mcp",
   "description": "Model Context Protocol server for Open Policy Agent (OPA). Author, validate, debug, and explain Rego policies through any MCP-compatible client.",
   "type": "module",
@@ -60,13 +60,22 @@
     "test:coverage": "vitest run --config vitest.coverage.config.ts --coverage",
     "test:integration": "vitest run --config vitest.integration.config.ts",
     "prepublishOnly": "npm run lint && npm run typecheck && npm run test && npm run build",
-    "clean": "rimraf dist coverage .vitest-cache"
+    "clean": "rimraf dist coverage .vitest-cache",
+    "bundle:fetch": "node scripts/fetch-opa-binaries.mjs",
+    "bundle:sync": "node scripts/sync-versions.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "z3-solver": "^4.16.0",
     "zod": "^3.23.0"
   },
+  "optionalDependencies": {
+    "@orygn/opa-mcp-linux-x64": "0.2.0",
+    "@orygn/opa-mcp-linux-arm64": "0.2.0",
+    "@orygn/opa-mcp-darwin-x64": "0.2.0",
+    "@orygn/opa-mcp-darwin-arm64": "0.2.0",
+    "@orygn/opa-mcp-win32-x64": "0.2.0"
+  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^25.9.1",