@orygn/opa-mcp 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -17,6 +17,123 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.1.9] - 2026-05-21
+
+### Added
+
+- **AbortSignal cancellation** -- all 43 tool handlers now wire the MCP SDK's
+  `extra.signal` into every subprocess spawn and OPA HTTP request. When a client
+  sends `notifications/cancelled`, in-flight work is actually terminated:
+  subprocess receives SIGTERM followed by SIGKILL escalation after 2 seconds;
+  HTTP fetches are aborted via `AbortSignal.any()` combining the existing
+  per-request timeout with the external client signal.
+
+- **`CANCELLED` error code** -- added to `ToolErrorCode`. Returned to the caller
+  when a tool is interrupted mid-flight by client cancellation, rather than
+  surfacing a misleading `TIMEOUT` or `OPA_BINARY_NOT_FOUND` code.
+
+- **`OpaCancelledError`** -- new error class in `OpaClient`. Thrown when a
+  fetch aborts because the client signal fired (not a network failure), so
+  `mapOpaClientError` can map it precisely to `CANCELLED`.
+
+- **Tool annotations, instructions, and path sanitization (MCP spec 2025-11-25)**
+  -- all 43 tools now declare `readOnlyHint`, `destructiveHint`, `idempotentHint`,
+  and `openWorldHint` in their `annotations` block per the MCP spec. Server
+  registers `instructions` at startup describing the tool set. All file path
+  arguments validated through a hardened `validatePath` helper that normalises
+  Windows drive-letter casing and resolves symlinks before allow-list comparison,
+  closing a bypass that existed when a symlink target escaped the allowed root.
+
+### Changed
+
+- **`@modelcontextprotocol/sdk` pinned to `^1.29.0`** -- the minimum version that
+  exposes `annotations` on `RegisteredTool` and passes `extra.signal` to handlers.
+
+### Internal
+
+- `subprocess.ts`: `SpawnResult` gains `aborted: boolean`; `SpawnOptions` gains
+  `signal?: AbortSignal`. Early-return path if signal is pre-aborted; abort
+  listener shares the SIGTERM->SIGKILL escalation helper with the timeout path.
+- `tool-helpers.ts`: `mapSubprocessFailure` checks `result.aborted` before
+  `exitCode === null` so cancellation takes priority over binary-not-found.
+- Tests: all mock `SpawnResult` objects updated to include `aborted: false`;
+  `callTool` helper passes `{ signal }` as second argument; two new deterministic
+  abort path tests in `subprocess.test.ts`.
+
+## [0.1.8] - 2026-05-21
+
+### Added
+
+- **`opa_delete_data`** -- removes a document from OPA's data store at the given
+  path (`DELETE /v1/data/{path}`). Accepts the same dotted or slash path forms as
+  `opa_get_data`, `opa_put_data`, and `opa_patch_data`. A missing path returns the
+  new `DATA_NOT_FOUND` error code; percent-encoded traversal attempts are rejected
+  by the shared `parseOpaDataPath` guard with `INVALID_INPUT` before any request is
+  issued. Root-path deletion is intentionally excluded -- the path must be at least
+  one segment deep.
+
+- **`DATA_NOT_FOUND` error code** -- added to `ToolErrorCode`. Returned when a
+  `DELETE /v1/data/{path}` (or any future data-path operation) receives a 404 from
+  OPA. More specific than `UNKNOWN_ERROR` and symmetrical with the existing
+  `POLICY_NOT_FOUND` code.
+
+- **`opa_bundle_verify`** -- verifies the signature of a signed OPA bundle using
+  `opa eval --bundle --verification-key`. Returns `{ bundle, verified: true }` on
+  success. Accepts optional `verificationKeyId`, `signingAlg`, and `scope`. Both
+  `bundle` and `verificationKey` paths are validated against the allow-list before
+  any subprocess call.
+
+- **`rego_migrate_v1`** -- migrates Rego v0 source to v1 syntax using a two-phase
+  approach: `opa fmt --rego-v1` rewrites reserved keywords and adds
+  `import rego.v1`; `opa check --v1-compatible` then validates the result. Returns
+  `{ original, migrated, changed, valid, errors }`. If `fmt` fails the tool returns
+  `INVALID_REGO`; if `check` finds remaining semantic issues `valid` is `false` but
+  `ok` is still `true` so the caller can inspect both the diff and any remaining
+  issues.
+
+- **`opa_exec`** -- batch-evaluates a single decision against multiple input files
+  using `opa exec --format=json`. Returns `{ results, count, successCount, errorCount }`
+  where each result entry carries the input path and either the decision value or an
+  error message. Accepts `bundle` or `dataPaths` as the policy source (mutually
+  exclusive). All three path types (input, bundle, data) are validated against the
+  allow-list.
+
+### Tests
+
+- 10 new unit tests for `opa_delete_data` covering: correct URL construction for
+  dotted, slash, and `data.`-prefixed paths; `{ path, deleted: true }` response
+  shape; bodyless request with no `Content-Type` header; bearer token forwarding;
+  404 mapped to `DATA_NOT_FOUND` with status in details; connection failure mapped to
+  `OPA_UNREACHABLE`; 401 mapped to `OPA_AUTH_FAILED`; 5xx mapped to `UNKNOWN_ERROR`;
+  and two traversal-rejection cases (`%2e%2e` and double `%2e%2e/%2e%2e`).
+
+- 9 new unit tests for `opa_bundle_verify` covering: correct argv construction;
+  optional key-id, alg, and scope flags; `verified: true` response; invalid bundle
+  mapped to `INVALID_BUNDLE`; binary missing mapped to `OPA_BINARY_NOT_FOUND`;
+  timeout mapped to `SUBPROCESS_TIMEOUT`; path-not-found and path-not-allowed.
+
+- 10 new unit tests for `rego_migrate_v1` covering: two-phase mock call sequence;
+  correct `--rego-v1` and `--v1-compatible` flags; `changed` flag; errors array;
+  `ok: true` with `valid: false` when check finds issues; short-circuit to
+  `INVALID_REGO` when fmt fails.
+
+- 12 new unit tests for `opa_exec` covering: correct argv and flags; mutually
+  exclusive `bundle`+`dataPaths` guard; count/successCount/errorCount derivation;
+  mixed success/error results; binary missing; timeout; path validation for all
+  three path types.
+
+- Tool count assertions updated to 43 across `server.test.ts`,
+  `tests/integration/protocol.test.ts`, and `tests/integration/distribution.test.ts`.
+
+### CI
+
+- Added Smithery publish step to release workflow so the Smithery listing is
+  updated automatically on every release.
+
+- Updated Node.js Docker base image from `node:20-alpine` to `node:26-alpine`.
+
+- Updated `actions/setup-node` from v4 to v6 in CI and release workflows.
+
 ## [0.1.7] - 2026-05-21
 
 ### Fixed
@@ -440,7 +557,10 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.9...HEAD
+[0.1.9]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.8...v0.1.9
+[0.1.8]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.7...v0.1.8
+[0.1.7]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.3...v0.1.4

package/README.md

@@ -18,10 +18,10 @@ environment.
 +--------------------+  MCP / stdio  +-----------------+  spawn / HTTP  +------------------+
 |  Claude · Cursor · | ------------> |  @orygn/opa-mcp | -------------> |  opa · regal ·   |
 |   VS Code · ...    | <------------ |                 | <------------- |  OPA REST API    |
-+--------------------+   39 tools    +-----------------+                +------------------+
++--------------------+   43 tools    +-----------------+                +------------------+
 ```
 
-> **Status:** v0.1.5. Tool surface, error codes, and
+> **Status:** v0.1.8. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
@@ -264,7 +264,7 @@ Every tool returns a JSON envelope:
 Stable error codes: `INVALID_INPUT`, `INVALID_REGO`, `INVALID_BUNDLE`,
 `EVAL_ERROR`, `OPA_BINARY_NOT_FOUND`, `REGAL_NOT_FOUND`,
 `REGAL_VERSION_TOO_OLD`, `OPA_UNREACHABLE`, `OPA_AUTH_FAILED`,
-`POLICY_NOT_FOUND`, `PATH_NOT_ALLOWED`, `PATH_NOT_FOUND`,
+`POLICY_NOT_FOUND`, `DATA_NOT_FOUND`, `PATH_NOT_ALLOWED`, `PATH_NOT_FOUND`,
 `DEPENDENCY_CONFLICT`, `NO_TESTS_FOUND`, `HTTP_SEND_BLOCKED`, `TIMEOUT`,
 `UNKNOWN_ERROR`.
 
@@ -274,15 +274,16 @@ Operate on Rego source code without needing a running OPA server. Wrap
 `opa fmt`, `opa parse`, `opa check`, `opa inspect`, `opa capabilities`,
 `opa deps`, and `regal`.
 
-| Tool                | What it does                                                                                                                      |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `rego_format`       | Format Rego source. Wraps `opa fmt`. Idempotent.                                                                                  |
-| `rego_check`        | Type-check and validate Rego. Wraps `opa check`.                                                                                  |
-| `rego_lint`         | Run Regal across a file or directory. Returns findings grouped by category. **Requires `regal` on `PATH` or `REGAL_BINARY` set.** |
-| `rego_parse_ast`    | Parse Rego to AST JSON. Wraps `opa parse`.                                                                                        |
-| `rego_inspect`      | Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.                                                 |
-| `rego_capabilities` | Return the capabilities (built-ins, future keywords) understood by the bundled OPA.                                               |
-| `rego_deps`         | Static dependency analysis: rule-level data references and cross-package calls.                                                   |
+| Tool                | What it does                                                                                                                                                             |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `rego_format`       | Format Rego source. Wraps `opa fmt`. Idempotent.                                                                                                                         |
+| `rego_check`        | Type-check and validate Rego. Wraps `opa check`.                                                                                                                         |
+| `rego_lint`         | Run Regal across a file or directory. Returns findings grouped by category. **Requires `regal` on `PATH` or `REGAL_BINARY` set.**                                        |
+| `rego_parse_ast`    | Parse Rego to AST JSON. Wraps `opa parse`.                                                                                                                               |
+| `rego_inspect`      | Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.                                                                                        |
+| `rego_capabilities` | Return the capabilities (built-ins, future keywords) understood by the bundled OPA.                                                                                      |
+| `rego_deps`         | Static dependency analysis: rule-level data references and cross-package calls.                                                                                          |
+| `rego_migrate_v1`   | Migrate Rego v0 source to v1 syntax. Runs `opa fmt --rego-v1` then validates with `opa check --v1-compatible`. Returns `{ original, migrated, changed, valid, errors }`. |
 
 #### Featured: `rego_format`
 
@@ -332,15 +333,16 @@ Operate on Rego source code without needing a running OPA server. Wrap
 Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 `opa bench`.
 
-| Tool                      | What it does                                                                         |
-| ------------------------- | ------------------------------------------------------------------------------------ |
-| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.              |
-| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                        |
-| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.          |
-| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                             |
-| `rego_test`               | Run `opa test` over a directory. Returns pass/fail per test, with optional coverage. |
-| `rego_bench`              | Run `opa bench` and return statistical timing data.                                  |
-| `rego_compile_query`      | Partially evaluate a query against a policy.                                         |
+| Tool                      | What it does                                                                                                           |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.                                                |
+| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                                                          |
+| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.                                            |
+| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                                                               |
+| `rego_test`               | Run `opa test` over a directory. Returns pass/fail per test, with optional coverage.                                   |
+| `rego_bench`              | Run `opa bench` and return statistical timing data.                                                                    |
+| `rego_compile_query`      | Partially evaluate a query against a policy.                                                                           |
+| `opa_exec`                | Batch-evaluate a decision against multiple input files. Returns per-file results with `successCount` and `errorCount`. |
 
 #### Featured: `rego_eval`
 
@@ -365,10 +367,11 @@ Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 
 Package and sign deployable bundles. Wrap `opa build` and `opa sign`.
 
-| Tool               | What it does                                                                          |
-| ------------------ | ------------------------------------------------------------------------------------- |
-| `opa_bundle_build` | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`. |
-| `opa_bundle_sign`  | Sign a bundle with a private key. Returns `.signatures.json` content.                 |
+| Tool                | What it does                                                                                      |
+| ------------------- | ------------------------------------------------------------------------------------------------- |
+| `opa_bundle_build`  | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`.             |
+| `opa_bundle_sign`   | Sign a bundle with a private key. Returns `.signatures.json` content.                             |
+| `opa_bundle_verify` | Verify the signature of a signed bundle using a public key. Returns `{ bundle, verified: true }`. |
 
 ### Category D: OPA server management
 
@@ -384,6 +387,7 @@ point at a reachable server.
 | `opa_get_data`       | Read a path from the data hierarchy.                   |
 | `opa_put_data`       | Write to a path in the data hierarchy.                 |
 | `opa_patch_data`     | Apply a JSON Patch to the data hierarchy.              |
+| `opa_delete_data`    | Delete a document from the data hierarchy.             |
 | `opa_query_decision` | POST to a `/v1/data/...` decision endpoint with input. |
 | `opa_compile_query`  | Partially evaluate a query against the running server. |
 | `opa_health`         | Liveness / readiness check.                            |
@@ -416,7 +420,7 @@ the tasks agents are actually asked to do.
 
 ## Prompts
 
-Three [MCP prompts](https://modelcontextprotocol.io/specification/server/prompts)
+Three [MCP prompts](https://modelcontextprotocol.io/specification/2025-11-25/server/prompts)
 ship with the server. Clients surface them as slash commands or workflow
 templates.
 
@@ -428,7 +432,7 @@ templates.
 
 ## Resources
 
-Three [MCP resources](https://modelcontextprotocol.io/specification/server/resources)
+Three [MCP resources](https://modelcontextprotocol.io/specification/2025-11-25/server/resources)
 expose curated reference data the agent can read at any time.
 
 | Resource URI        | What's there                                                                                                                                                                                 |

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.7";
+export declare const SERVER_VERSION = "0.1.9";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.7';
+export const SERVER_VERSION = '0.1.9';
 //# sourceMappingURL=constants.js.map

package/dist/lib/opa-cli.d.ts

@@ -4,6 +4,8 @@ import { type SpawnResult } from './subprocess.js';
 export interface FmtInput {
     /** Rego source code to format. */
     source: string;
+    /** Format for compatibility with both Rego v1 and the current OPA version (`opa fmt --rego-v1`). */
+    regoV1?: boolean;
 }
 /** Input for `opa fmt --list` / `opa fmt --write` (file-based formatting). */
 export interface FmtWriteInput {
@@ -28,6 +30,10 @@ export interface CheckInput {
     strict?: boolean;
     /** Schema directory for input/data validation. */
     schemaDir?: string;
+    /** Opt-in to OPA v1.0-compatible behaviors (`opa check --v1-compatible`). */
+    v1Compatible?: boolean;
+    /** Opt-in to OPA behaviors prior to the v1.0 release (`opa check --v0-compatible`). */
+    v0Compatible?: boolean;
 }
 /** Input for `opa parse`. */
 export interface ParseInput {
@@ -146,6 +152,39 @@ export interface SignInput {
     /** Path to a claims file (extra signed claims). */
     claimsFile?: string;
 }
+/** Input for `opa exec` -- batch evaluation against multiple input files. */
+export interface ExecInput {
+    /** One or more input file paths (JSON/YAML) or directories to evaluate. */
+    inputPaths: string[];
+    /** The policy decision (entrypoint) to evaluate for each input, e.g. `data.authz.allow`. */
+    decision: string;
+    /** Load path as a bundle file or root directory. Mutually exclusive with `dataPaths`. */
+    bundle?: string;
+    /** Policy/data file or directory paths to load. Mutually exclusive with `bundle`. */
+    dataPaths?: string[];
+}
+/** Input for bundle signature verification via `opa eval --bundle`. */
+export interface BundleVerifyInput {
+    /** Path to the signed bundle directory or `.tar.gz` archive. */
+    bundle: string;
+    /**
+     * Path to the PEM file containing the public key (RSA/ECDSA) or the
+     * HMAC secret file used to verify the bundle signature.
+     */
+    verificationKey: string;
+    /**
+     * Key ID that must match the `keyid` claim in the bundle signature.
+     * Required when the bundle was signed with `--public-key-id`.
+     */
+    verificationKeyId?: string;
+    /** Signing algorithm used when the bundle was signed (e.g. `RS256`, `HS256`). */
+    signingAlg?: string;
+    /**
+     * Expected `scope` value in the bundle signature. Required when the
+     * bundle was signed with `--scope`.
+     */
+    scope?: string;
+}
 /**
  * Wrapper around the local `opa` binary.
  *
@@ -162,13 +201,13 @@ export declare class OpaCli {
      * Verify the binary is present and report its version.
      * Returns null if the binary is unreachable or output is malformed.
      */
-    version(): Promise<string | null>;
+    version(signal?: AbortSignal): Promise<string | null>;
     /**
      * Format Rego source. Stdout contains the formatted output. Reports
      * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
-    fmt(input: FmtInput): Promise<SpawnResult>;
+    fmt(input: FmtInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * List files that would be reformatted. Stdout is one absolute path per
      * line for each file that is not already canonical. Exit 0 on success,
@@ -177,12 +216,12 @@ export declare class OpaCli {
      * NOTE: --list and --write are mutually exclusive in OPA: passing both
      * suppresses the write. Always use separate fmtList + fmtWrite calls.
      */
-    fmtList(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtList(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Overwrite each file with its canonically formatted version. Exit 0 on
      * success, non-zero (exit 2) if any file cannot be parsed.
      */
-    fmtWrite(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtWrite(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
      * policy is valid. On failure, `exitCode` is non-zero and the JSON
@@ -191,55 +230,69 @@ export declare class OpaCli {
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
-    check(input: CheckInput): Promise<SpawnResult>;
+    check(input: CheckInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
      */
-    parse(input: ParseInput): Promise<SpawnResult>;
+    parse(input: ParseInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Inspect a bundle, directory, or single Rego file. Returns its
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
-    inspect(input: InspectInput): Promise<SpawnResult>;
+    inspect(input: InspectInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Print available capabilities. With `current=true`, prints the
      * capabilities of the running OPA. With a `version`, prints those of
      * a specific named version. Without either, lists available named
      * versions.
      */
-    capabilities(input?: CapabilitiesInput): Promise<SpawnResult>;
+    capabilities(input?: CapabilitiesInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Static dependency analysis for a Rego ref. Stdout is JSON with the
      * `base` and `virtual` document references the ref depends on.
      */
-    deps(input: DepsInput): Promise<SpawnResult>;
+    deps(input: DepsInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Evaluate a query against a policy + input. Stdout is JSON with the
      * standard `{result: [...]}` shape (plus optional explain, profile,
      * coverage, and metrics sections).
      */
-    eval(input: EvalInput): Promise<SpawnResult>;
+    eval(input: EvalInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
      */
-    test(input: TestInput): Promise<SpawnResult>;
+    test(input: TestInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Benchmark a query. Stdout is JSON with iteration timing statistics.
      */
-    bench(input: BenchInput): Promise<SpawnResult>;
+    bench(input: BenchInput, signal?: AbortSignal): Promise<SpawnResult>;
     /** Build a deployable bundle from policy + data paths. */
-    build(input: BuildInput): Promise<SpawnResult>;
+    build(input: BuildInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Sign a bundle. Writes a `.signatures.json` next to the bundle
      * directory.
      */
-    sign(input: SignInput): Promise<SpawnResult>;
+    sign(input: SignInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Verify a signed bundle using `opa eval --bundle --verification-key`.
+     * OPA verifies the bundle signature before loading any policies; a
+     * failed signature produces a non-zero exit and the error message on
+     * stderr. The trivial query `true` is used so the process exits
+     * immediately after verification without entering a REPL.
+     */
+    bundleVerify(input: BundleVerifyInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Batch-evaluate a policy decision against one or more input files using
+     * `opa exec`. Each input file is evaluated independently; results are
+     * returned as a JSON array with one entry per file.
+     */
+    exec(input: ExecInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run `opa` with the given argv and optional stdin. Tools should
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
      */
-    run(args: string[], stdin?: string): Promise<SpawnResult>;
+    run(args: string[], stdin?: string, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Write `source` to a uniquely named `.rego` file in the OS tmp dir,
      * pass its path to `fn`, and remove it on completion (success or

package/dist/lib/opa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvC;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAIhD;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAYzD;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAY1D;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAepD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAclD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClD;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBpD,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAUlD;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/D;;;;;OAKG;YACW,cAAc;CAS7B"}
+{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQtE;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAY/E;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYhF;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAmB1E;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAM1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9E;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAO7F;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAcxE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwCxE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAkB1E,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiB1E;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IASxF;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrF;;;;;OAKG;YACW,cAAc;CAS7B"}