@orygn/opa-mcp 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -17,6 +17,146 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.1.8] - 2026-05-21
+
+### Added
+
+- **`opa_delete_data`** -- removes a document from OPA's data store at the given
+  path (`DELETE /v1/data/{path}`). Accepts the same dotted or slash path forms as
+  `opa_get_data`, `opa_put_data`, and `opa_patch_data`. A missing path returns the
+  new `DATA_NOT_FOUND` error code; percent-encoded traversal attempts are rejected
+  by the shared `parseOpaDataPath` guard with `INVALID_INPUT` before any request is
+  issued. Root-path deletion is intentionally excluded -- the path must be at least
+  one segment deep.
+
+- **`DATA_NOT_FOUND` error code** -- added to `ToolErrorCode`. Returned when a
+  `DELETE /v1/data/{path}` (or any future data-path operation) receives a 404 from
+  OPA. More specific than `UNKNOWN_ERROR` and symmetrical with the existing
+  `POLICY_NOT_FOUND` code.
+
+- **`opa_bundle_verify`** -- verifies the signature of a signed OPA bundle using
+  `opa eval --bundle --verification-key`. Returns `{ bundle, verified: true }` on
+  success. Accepts optional `verificationKeyId`, `signingAlg`, and `scope`. Both
+  `bundle` and `verificationKey` paths are validated against the allow-list before
+  any subprocess call.
+
+- **`rego_migrate_v1`** -- migrates Rego v0 source to v1 syntax using a two-phase
+  approach: `opa fmt --rego-v1` rewrites reserved keywords and adds
+  `import rego.v1`; `opa check --v1-compatible` then validates the result. Returns
+  `{ original, migrated, changed, valid, errors }`. If `fmt` fails the tool returns
+  `INVALID_REGO`; if `check` finds remaining semantic issues `valid` is `false` but
+  `ok` is still `true` so the caller can inspect both the diff and any remaining
+  issues.
+
+- **`opa_exec`** -- batch-evaluates a single decision against multiple input files
+  using `opa exec --format=json`. Returns `{ results, count, successCount, errorCount }`
+  where each result entry carries the input path and either the decision value or an
+  error message. Accepts `bundle` or `dataPaths` as the policy source (mutually
+  exclusive). All three path types (input, bundle, data) are validated against the
+  allow-list.
+
+### Tests
+
+- 10 new unit tests for `opa_delete_data` covering: correct URL construction for
+  dotted, slash, and `data.`-prefixed paths; `{ path, deleted: true }` response
+  shape; bodyless request with no `Content-Type` header; bearer token forwarding;
+  404 mapped to `DATA_NOT_FOUND` with status in details; connection failure mapped to
+  `OPA_UNREACHABLE`; 401 mapped to `OPA_AUTH_FAILED`; 5xx mapped to `UNKNOWN_ERROR`;
+  and two traversal-rejection cases (`%2e%2e` and double `%2e%2e/%2e%2e`).
+
+- 9 new unit tests for `opa_bundle_verify` covering: correct argv construction;
+  optional key-id, alg, and scope flags; `verified: true` response; invalid bundle
+  mapped to `INVALID_BUNDLE`; binary missing mapped to `OPA_BINARY_NOT_FOUND`;
+  timeout mapped to `SUBPROCESS_TIMEOUT`; path-not-found and path-not-allowed.
+
+- 10 new unit tests for `rego_migrate_v1` covering: two-phase mock call sequence;
+  correct `--rego-v1` and `--v1-compatible` flags; `changed` flag; errors array;
+  `ok: true` with `valid: false` when check finds issues; short-circuit to
+  `INVALID_REGO` when fmt fails.
+
+- 12 new unit tests for `opa_exec` covering: correct argv and flags; mutually
+  exclusive `bundle`+`dataPaths` guard; count/successCount/errorCount derivation;
+  mixed success/error results; binary missing; timeout; path validation for all
+  three path types.
+
+- Tool count assertions updated to 43 across `server.test.ts`,
+  `tests/integration/protocol.test.ts`, and `tests/integration/distribution.test.ts`.
+
+### CI
+
+- Added Smithery publish step to release workflow so the Smithery listing is
+  updated automatically on every release.
+
+- Updated Node.js Docker base image from `node:20-alpine` to `node:26-alpine`.
+
+- Updated `actions/setup-node` from v4 to v6 in CI and release workflows.
+
+## [0.1.7] - 2026-05-21
+
+### Fixed
+
+- **`rego_explain_decision` always returned empty `rulesFired` and zero
+  summary counts.** OPA's `--explain=full` trace uses capitalized field
+  names (`Op`, `Message`, `Node`) but the `summarizeTrace` helper was
+  reading lowercase `op`, `message`, `node`. No events ever matched, so
+  `enterEvents`, `exitEvents`, `failEvents`, `rulesFired`, and
+  `rulesEvaluated` were always zero or empty regardless of what the trace
+  contained. Fixed by reading the correct capitalized fields. Rule names
+  are now extracted from `Node.head.name`, which is where OPA actually
+  puts them, rather than from a regex match on a message string that is
+  empty in real OPA output. Unit test mocks updated to use the real OPA
+  trace format.
+
+- **Eval tools returned wrong decisions when `input` was passed as a JSON
+  string.** LLMs frequently serialize the input document as a string
+  (`'{"user":"alice"}'`) rather than passing it as a native object. The
+  eval tools then called `JSON.stringify` on that string, double-encoding
+  it. OPA received `'"{\\"user\\":\\"alice\\"}"'` as the input document,
+  parsed it as a plain string, `input.user` was undefined, and decisions
+  that should have been `true` came back `false`. The shared eval handler
+  now detects a string `input`, attempts `JSON.parse`, and passes the
+  parsed object forward. Non-JSON strings are forwarded as-is.
+
+### Security
+
+- **Percent-encoded path traversal in OPA REST data tools.** `opa_get_data`,
+  `opa_put_data`, `opa_patch_data`, and `opa_query_decision` constructed
+  OPA REST API paths from user-supplied strings. Literal dots (`..`) in the
+  input are converted to slashes by the `dataPath` function and are not a
+  traversal risk. However, percent-encoded dots (`%2e%2e`) bypass that
+  replacement -- `new URL()` normalizes `%2e%2e` as a real `..` segment,
+  allowing requests to escape `/v1/data/` and reach arbitrary OPA endpoints.
+  Worst-case impact: `GET %2e%2e/v1/config` reaches OPA's config endpoint
+  (which can expose bundle credentials and plugin settings); `PUT` to a
+  traversed path could overwrite the entire OPA data document.
+
+  Fixed by normalizing the candidate path through `URL` parsing and
+  verifying the resulting pathname still starts with `/v1/data/`. Both
+  `%2e` (lowercase) and `%2E` (uppercase) variants are caught. The
+  duplicate `dataPath()` functions in `data.ts` and `decisions.ts` are
+  replaced by a single `parseOpaDataPath()` in `_shared.ts` that returns
+  a structured `ok/error` result.
+
+### Tests
+
+- `rego_explain_decision` mock traces updated to match real OPA capitalized
+  field names (`Op`, `Node`, `Message`). Test description for the
+  "no recognizable rule message" case updated to reflect that the actual
+  condition is a query-level event where `Node` is an array of terms rather
+  than a rule object with `head.name`.
+
+- Two new `rego_eval` tests: string `input` that is valid JSON is parsed and
+  forwarded as an object; string `input` that is not JSON is forwarded as-is.
+
+- `parseOpaDataPath` unit tests covering: dotted form, slash form, `data.`
+  prefix stripping, root path, `%2e%2e` rejected, `%2E%2E` rejected, and
+  double traversal rejected.
+
+- Tool-level traversal rejection tests added for `opa_get_data`,
+  `opa_put_data`, `opa_patch_data`, and `opa_query_decision` -- each
+  verifies that a `%2e%2e` path returns `INVALID_INPUT` with no fetch
+  issued.
+
 ## [0.1.6] - 2026-05-21
 
 ### Added
@@ -374,7 +514,9 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.8...HEAD
+[0.1.8]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.7...v0.1.8
+[0.1.7]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.3...v0.1.4

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.6";
+export declare const SERVER_VERSION = "0.1.8";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.6';
+export const SERVER_VERSION = '0.1.8';
 //# sourceMappingURL=constants.js.map

package/dist/lib/opa-cli.d.ts

@@ -4,6 +4,8 @@ import { type SpawnResult } from './subprocess.js';
 export interface FmtInput {
     /** Rego source code to format. */
     source: string;
+    /** Format for compatibility with both Rego v1 and the current OPA version (`opa fmt --rego-v1`). */
+    regoV1?: boolean;
 }
 /** Input for `opa fmt --list` / `opa fmt --write` (file-based formatting). */
 export interface FmtWriteInput {
@@ -28,6 +30,10 @@ export interface CheckInput {
     strict?: boolean;
     /** Schema directory for input/data validation. */
     schemaDir?: string;
+    /** Opt-in to OPA v1.0-compatible behaviors (`opa check --v1-compatible`). */
+    v1Compatible?: boolean;
+    /** Opt-in to OPA behaviors prior to the v1.0 release (`opa check --v0-compatible`). */
+    v0Compatible?: boolean;
 }
 /** Input for `opa parse`. */
 export interface ParseInput {
@@ -146,6 +152,39 @@ export interface SignInput {
     /** Path to a claims file (extra signed claims). */
     claimsFile?: string;
 }
+/** Input for `opa exec` -- batch evaluation against multiple input files. */
+export interface ExecInput {
+    /** One or more input file paths (JSON/YAML) or directories to evaluate. */
+    inputPaths: string[];
+    /** The policy decision (entrypoint) to evaluate for each input, e.g. `data.authz.allow`. */
+    decision: string;
+    /** Load path as a bundle file or root directory. Mutually exclusive with `dataPaths`. */
+    bundle?: string;
+    /** Policy/data file or directory paths to load. Mutually exclusive with `bundle`. */
+    dataPaths?: string[];
+}
+/** Input for bundle signature verification via `opa eval --bundle`. */
+export interface BundleVerifyInput {
+    /** Path to the signed bundle directory or `.tar.gz` archive. */
+    bundle: string;
+    /**
+     * Path to the PEM file containing the public key (RSA/ECDSA) or the
+     * HMAC secret file used to verify the bundle signature.
+     */
+    verificationKey: string;
+    /**
+     * Key ID that must match the `keyid` claim in the bundle signature.
+     * Required when the bundle was signed with `--public-key-id`.
+     */
+    verificationKeyId?: string;
+    /** Signing algorithm used when the bundle was signed (e.g. `RS256`, `HS256`). */
+    signingAlg?: string;
+    /**
+     * Expected `scope` value in the bundle signature. Required when the
+     * bundle was signed with `--scope`.
+     */
+    scope?: string;
+}
 /**
  * Wrapper around the local `opa` binary.
  *
@@ -234,6 +273,20 @@ export declare class OpaCli {
      * directory.
      */
     sign(input: SignInput): Promise<SpawnResult>;
+    /**
+     * Verify a signed bundle using `opa eval --bundle --verification-key`.
+     * OPA verifies the bundle signature before loading any policies; a
+     * failed signature produces a non-zero exit and the error message on
+     * stderr. The trivial query `true` is used so the process exits
+     * immediately after verification without entering a REPL.
+     */
+    bundleVerify(input: BundleVerifyInput): Promise<SpawnResult>;
+    /**
+     * Batch-evaluate a policy decision against one or more input files using
+     * `opa exec`. Each input file is evaluated independently; results are
+     * returned as a JSON array with one entry per file.
+     */
+    exec(input: ExecInput): Promise<SpawnResult>;
     /**
      * Run `opa` with the given argv and optional stdin. Tools should
      * prefer the typed methods above, but this exists for the rare cases

package/dist/lib/opa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvC;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAIhD;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAYzD;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAY1D;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAepD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAclD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClD;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBpD,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAUlD;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/D;;;;;OAKG;YACW,cAAc;CAS7B"}
+{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvC;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhD;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAYzD;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAY1D;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAclD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClD;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBpD,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAQlD;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IASlE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/D;;;;;OAKG;YACW,cAAc;CAS7B"}

package/dist/lib/opa-cli.js

@@ -52,7 +52,10 @@ export class OpaCli {
      * input vs output to detect a no-op.
      */
     async fmt(input) {
-        return this.withTempSource(input.source, (path) => this.run(['fmt', path]));
+        const args = ['fmt'];
+        if (input.regoV1)
+            args.push('--rego-v1');
+        return this.withTempSource(input.source, (path) => this.run([...args, path]));
     }
     /**
      * List files that would be reformatted. Stdout is one absolute path per
@@ -109,6 +112,10 @@ export class OpaCli {
         const args = ['check', '--format=json'];
         if (input.strict)
             args.push('--strict');
+        if (input.v1Compatible)
+            args.push('--v1-compatible');
+        if (input.v0Compatible)
+            args.push('--v0-compatible');
         if (input.capabilities)
             args.push('--capabilities', input.capabilities);
         if (input.schemaDir)
@@ -287,6 +294,41 @@ export class OpaCli {
         args.push('--bundle', input.bundle);
         return this.run(args);
     }
+    /**
+     * Verify a signed bundle using `opa eval --bundle --verification-key`.
+     * OPA verifies the bundle signature before loading any policies; a
+     * failed signature produces a non-zero exit and the error message on
+     * stderr. The trivial query `true` is used so the process exits
+     * immediately after verification without entering a REPL.
+     */
+    async bundleVerify(input) {
+        const args = ['eval', '--bundle', input.bundle, '--verification-key', input.verificationKey];
+        if (input.verificationKeyId)
+            args.push('--verification-key-id', input.verificationKeyId);
+        if (input.signingAlg)
+            args.push('--signing-alg', input.signingAlg);
+        if (input.scope)
+            args.push('--scope', input.scope);
+        args.push('true');
+        return this.run(args);
+    }
+    /**
+     * Batch-evaluate a policy decision against one or more input files using
+     * `opa exec`. Each input file is evaluated independently; results are
+     * returned as a JSON array with one entry per file.
+     */
+    async exec(input) {
+        if (input.inputPaths.length === 0) {
+            throw new Error('opa exec requires at least one input path');
+        }
+        const args = ['exec', '--format=json', '--decision', input.decision];
+        if (input.bundle)
+            args.push('--bundle', input.bundle);
+        for (const p of input.dataPaths ?? [])
+            args.push('--data', p);
+        args.push(...input.inputPaths);
+        return this.run(args);
+    }
     // ─── Low-level escape hatch ──────────────────────────────────────────
     /**
      * Run `opa` with the given argv and optional stdin. Tools should

package/dist/lib/opa-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.js","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAgK9D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe;QACvB,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,KAAoB;QAChC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAA2B,EAAE;QAC9C,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,mBAAmB;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5D,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzE,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IAExE,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,KAAc;QACtC,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IAExE;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"opa-cli.js","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAyM9D;;;;;;;;GAQG;AACH,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe;QACvB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,KAAoB;QAChC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,QAA2B,EAAE;QAC9C,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,KAAK,MAAM,CAAC;YACZ,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtD,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG,IAAI;gBACP,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;aAC5C,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,mBAAmB;YAAE,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAE5D,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAEzE,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC3B,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IAExE,0DAA0D;IAC1D,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAwB;QACzC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7F,IAAI,KAAK,CAAC,iBAAiB;YAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACzF,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,KAAc;QACtC,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAC5C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IAExE;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/dist/tools/authoring/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAS9C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQ9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAU9C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAS9E"}

package/dist/tools/authoring/index.js

@@ -4,6 +4,7 @@ import { registerRegoDeps } from './deps.js';
 import { registerRegoFormat } from './format.js';
 import { registerRegoInspect } from './inspect.js';
 import { registerRegoLint } from './lint.js';
+import { registerRegoMigrateV1 } from './migrate-v1.js';
 import { registerRegoParseAst } from './parse.js';
 export function registerAuthoringTools(server, config) {
     registerRegoFormat(server, config);
@@ -13,5 +14,6 @@ export function registerAuthoringTools(server, config) {
     registerRegoInspect(server, config);
     registerRegoCapabilities(server, config);
     registerRegoDeps(server, config);
+    registerRegoMigrateV1(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/authoring/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/tools/authoring/migrate-v1.d.ts

@@ -0,0 +1,26 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface CheckErrorRecord {
+    message?: string;
+    code?: string;
+    location?: {
+        file?: string;
+        row?: number;
+        col?: number;
+    };
+}
+export interface RegoMigrateV1Output {
+    /** The source as provided -- returned for side-by-side comparison. */
+    original: string;
+    /** The source after `opa fmt --rego-v1`. Identical to `original` when no changes were needed. */
+    migrated: string;
+    /** Whether `opa fmt --rego-v1` changed anything. */
+    changed: boolean;
+    /** Whether `opa check --v1-compatible` found no errors in the migrated source. */
+    valid: boolean;
+    /** Structured errors from `opa check --v1-compatible`. Empty when `valid` is true. */
+    errors: CheckErrorRecord[];
+}
+export declare function registerRegoMigrateV1(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=migrate-v1.d.ts.map

package/dist/tools/authoring/migrate-v1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-v1.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/migrate-v1.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAc9C,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,KAAK,EAAE,OAAO,CAAC;IACf,sFAAsF;IACtF,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6D7E"}

package/dist/tools/authoring/migrate-v1.js

@@ -0,0 +1,68 @@
+/**
+ * `rego_migrate_v1` -- migrate Rego v0 source to Rego v1 syntax.
+ *
+ * Two-phase execution:
+ *   1. `opa fmt --rego-v1` auto-fixes reserved keywords (`if`, `contains`,
+ *      `every`, `in`) and adds `import rego.v1` where missing.
+ *   2. `opa check --v1-compatible` validates the migrated source and surfaces
+ *      any remaining semantic issues that `opa fmt` cannot auto-fix.
+ *
+ * Returns the migrated source even when check finds remaining issues so the
+ * caller can inspect the diff and decide how to resolve them.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+const RegoMigrateV1Input = {
+    source: z
+        .string()
+        .min(1)
+        .describe('Rego v0 source to migrate to Rego v1 syntax. `opa fmt --rego-v1` auto-fixes reserved keywords and adds `import rego.v1`; any remaining issues are returned in `errors` so you can resolve them manually.'),
+};
+export function registerRegoMigrateV1(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_migrate_v1', {
+        title: 'Migrate Rego to v1 syntax',
+        description: 'Migrate Rego v0 source to Rego v1 syntax in two phases: (1) `opa fmt --rego-v1` auto-fixes reserved keywords (`if`, `contains`, `every`, `in` in rule heads) and adds `import rego.v1`; (2) `opa check --v1-compatible` validates the migrated source and reports any remaining issues that cannot be auto-fixed (e.g. removed builtins, semantic conflicts). Returns the migrated source and a `changed` flag even when check finds remaining errors -- this lets you inspect what changed and fix the remainder manually. If the source is completely unparseable, returns `INVALID_REGO`.',
+        inputSchema: RegoMigrateV1Input,
+    }, async ({ source }) => {
+        return withToolEnvelope(config, async () => {
+            // Phase 1: migrate syntax with opa fmt --rego-v1.
+            const fmtResult = await opa.fmt({ source, regoV1: true });
+            const fmtFailure = mapSubprocessFailure(fmtResult, 'opa');
+            if (fmtFailure)
+                return fmtFailure;
+            if (fmtResult.exitCode !== 0) {
+                const parsedErrors = tryParseJson(fmtResult.stderr);
+                return err('INVALID_REGO', 'opa fmt --rego-v1 could not parse the source. Fix syntax errors before migrating.', { details: parsedErrors ?? { stderr: fmtResult.stderr.trim() } });
+            }
+            const migrated = fmtResult.stdout;
+            const changed = migrated !== source;
+            // Phase 2: validate the migrated source in v1-compatible mode.
+            const checkResult = await opa.check({ source: migrated, v1Compatible: true });
+            const checkFailure = mapSubprocessFailure(checkResult, 'opa');
+            if (checkFailure)
+                return checkFailure;
+            if (checkResult.exitCode === 0) {
+                return ok({
+                    original: source,
+                    migrated,
+                    changed,
+                    valid: true,
+                    errors: [],
+                });
+            }
+            // Check found remaining issues -- return them alongside the partial migration.
+            const parsed = tryParseJson(checkResult.stderr);
+            return ok({
+                original: source,
+                migrated,
+                changed,
+                valid: false,
+                errors: parsed?.errors ?? [],
+            });
+        });
+    });
+}
+//# sourceMappingURL=migrate-v1.js.map

package/dist/tools/authoring/migrate-v1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-v1.js","sourceRoot":"","sources":["../../../src/tools/authoring/migrate-v1.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,kBAAkB,GAAG;IACzB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,0MAA0M,CAC3M;CACJ,CAAC;AAqBF,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,8jBAA8jB;QAChkB,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,kDAAkD;YAClD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1D,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAC1D,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAElC,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,YAAY,GAAG,YAAY,CAE9B,SAAS,CAAC,MAAM,CAAC,CAAC;gBACrB,OAAO,GAAG,CACR,cAAc,EACd,mFAAmF,EACnF,EAAE,OAAO,EAAE,YAAY,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,KAAK,MAAM,CAAC;YAEpC,+DAA+D;YAC/D,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YAE9E,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,YAAY;gBAAE,OAAO,YAAY,CAAC;YAEtC,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAsB;oBAC7B,QAAQ,EAAE,MAAM;oBAChB,QAAQ;oBACR,OAAO;oBACP,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YAED,+EAA+E;YAC/E,MAAM,MAAM,GAAG,YAAY,CAAkC,WAAW,CAAC,MAAM,CAAC,CAAC;YACjF,OAAO,EAAE,CAAsB;gBAC7B,QAAQ,EAAE,MAAM;gBAChB,QAAQ;gBACR,OAAO;gBACP,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/bundles/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Category C -- Bundle operations.
  *
- * Wraps `opa build` and `opa sign` for packaging and signing
- * deployable bundles.
+ * Wraps `opa build`, `opa sign`, and bundle signature verification for
+ * packaging, signing, and verifying deployable bundles.
  */
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { Config } from '../../config.js';

package/dist/tools/bundles/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAI9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG3E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAI3E"}

package/dist/tools/bundles/index.js

@@ -1,7 +1,9 @@
 import { registerOpaBundleBuild } from './build.js';
 import { registerOpaBundleSign } from './sign.js';
+import { registerOpaBundleVerify } from './verify.js';
 export function registerBundleTools(server, config) {
     registerOpaBundleBuild(server, config);
     registerOpaBundleSign(server, config);
+    registerOpaBundleVerify(server, config);
 }
 //# sourceMappingURL=index.js.map

package/dist/tools/bundles/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/bundles/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/tools/bundles/verify.d.ts

@@ -0,0 +1,8 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface OpaBundleVerifyOutput {
+    bundle: string;
+    verified: boolean;
+}
+export declare function registerOpaBundleVerify(server: McpServer, config: Config): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/tools/bundles/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/tools/bundles/verify.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAsC9C,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA4C/E"}

package/dist/tools/bundles/verify.js

@@ -0,0 +1,67 @@
+/**
+ * `opa_bundle_verify` -- verify the cryptographic signature of a signed
+ * OPA bundle via `opa eval --bundle --verification-key`.
+ */
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, validatePaths, withToolEnvelope } from '../../lib/tool-helpers.js';
+const OpaBundleVerifyInput = {
+    bundle: z
+        .string()
+        .min(1)
+        .describe('Path to the signed bundle directory or `.tar.gz` archive. Must be inside an allowed root.'),
+    verificationKey: z
+        .string()
+        .min(1)
+        .describe('Path to the PEM file containing the RSA or ECDSA public key, or the path to the HMAC secret file. Must be inside an allowed root.'),
+    verificationKeyId: z
+        .string()
+        .optional()
+        .describe('Key ID that must match the `keyid` field in the bundle signature. Required when the bundle was signed with `--public-key-id`.'),
+    signingAlg: z
+        .string()
+        .optional()
+        .describe('Signing algorithm used when the bundle was signed (e.g. `RS256`, `PS256`, `ES256`, `HS256`). Defaults to `RS256`.'),
+    scope: z
+        .string()
+        .optional()
+        .describe('Expected `scope` value in the bundle signature. Required when the bundle was signed with `--scope`.'),
+};
+export function registerOpaBundleVerify(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('opa_bundle_verify', {
+        title: 'Verify OPA bundle signature',
+        description: 'Verify the cryptographic signature of a signed OPA bundle using `opa eval --bundle --verification-key`. The bundle must have been signed with `opa sign` (or `opa_bundle_sign`). OPA checks the `.signatures.json` manifest inside the bundle against the provided public key before loading any policy -- a tampered or unsigned bundle will fail with `INVALID_BUNDLE`. Returns `{ bundle, verified: true }` on success.',
+        inputSchema: OpaBundleVerifyInput,
+    }, async (input) => {
+        return withToolEnvelope(config, async () => {
+            const validation = validatePaths([input.bundle, input.verificationKey], config, {
+                mustExist: true,
+            });
+            if (!validation.ok)
+                return validation.error;
+            const [resolvedBundle, resolvedKey] = validation.resolved;
+            const result = await opa.bundleVerify({
+                bundle: resolvedBundle,
+                verificationKey: resolvedKey,
+                verificationKeyId: input.verificationKeyId,
+                signingAlg: input.signingAlg,
+                scope: input.scope,
+            });
+            const subprocessFailure = mapSubprocessFailure(result, 'opa');
+            if (subprocessFailure)
+                return subprocessFailure;
+            if (result.exitCode !== 0) {
+                return err('INVALID_BUNDLE', 'Bundle signature verification failed.', {
+                    details: {
+                        stderr: result.stderr.trim(),
+                        stdout: result.stdout.trim(),
+                    },
+                });
+            }
+            return ok({ bundle: input.bundle, verified: true });
+        });
+    });
+}
+//# sourceMappingURL=verify.js.map