@orygn/opa-mcp 0.1.8 → 0.1.10

package/dist/lib/conftest-cli.js

@@ -0,0 +1,224 @@
+/**
+ * Wrapper around the optional `conftest` binary (policy testing for
+ * configuration files using Rego).
+ *
+ * Conftest is OPTIONAL -- only the `conftest_*` tools require it. All
+ * other tools work without Conftest installed. If absent, conftest tools
+ * return a structured `CONFTEST_NOT_FOUND` error with an install hint.
+ *
+ * Conftest exit codes:
+ *   0  -- all tests pass (or no failures, only warnings)
+ *   1  -- one or more test failures
+ *   2+ -- command error (bad args, policy not found, parse error, etc.)
+ *
+ * All structured output is obtained via `--output=json`; raw text output
+ * is never parsed.
+ */
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runBinary } from './subprocess.js';
+// ─── Parser → file extension map ─────────────────────────────────────────────
+const PARSER_TO_EXT = {
+    yaml: '.yaml',
+    json: '.json',
+    toml: '.toml',
+    hcl1: '.hcl',
+    hcl2: '.hcl',
+    ini: '.ini',
+    xml: '.xml',
+    dotenv: '.env',
+    cue: '.cue',
+    jsonnet: '.jsonnet',
+    properties: '.properties',
+    edn: '.edn',
+    hocon: '.conf',
+    // Dockerfile is a special case -- conftest detects by filename
+    dockerfile: '',
+};
+function parserToExt(parser) {
+    return PARSER_TO_EXT[parser.toLowerCase()] ?? `.${parser.toLowerCase()}`;
+}
+// ─── ConftestCli ──────────────────────────────────────────────────────────────
+/**
+ * Wrapper around the local `conftest` binary.
+ *
+ * Methods do not throw on conftest-side errors -- the exit code on the
+ * returned `SpawnResult` is the signal. Inline source is written to temp
+ * files/directories because conftest does not read from stdin.
+ */
+export class ConftestCli {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify the binary is present and return its version string. Returns
+     * null if the binary is unreachable or the version output is malformed.
+     */
+    async version(signal) {
+        const result = await this.run(['--version'], signal);
+        if (result.exitCode !== 0)
+            return null;
+        // conftest --version output: "conftest (version: 0.68.2)"
+        const match = /conftest\s*\(version:\s*([^)]+)\)/i.exec(result.stdout) ??
+            /v?(\d+\.\d+\.\d+\S*)/i.exec(result.stdout);
+        return match?.[1]?.trim() ?? null;
+    }
+    /**
+     * Run `conftest test` against one or more configuration files. Always
+     * uses `--output=json` so output is machine-readable.
+     *
+     * When `inlineConfig` or `inlinePolicy` are provided, temp files are
+     * created and cleaned up automatically. Temp file paths in the JSON
+     * output are replaced with `<inline>` before the result is returned so
+     * callers never see implementation-internal paths.
+     */
+    async test(input, signal) {
+        return this.withTempAssets({
+            inlineConfig: input.inlineConfig,
+            inlineConfigParser: input.inlineConfigParser,
+            inlinePolicy: input.inlinePolicy,
+        }, async ({ configPath, policyDir }) => {
+            const args = ['test', '--output=json', '--no-color'];
+            // Policy source
+            const effectivePolicyDir = policyDir ?? input.policy;
+            if (effectivePolicyDir)
+                args.push('--policy', effectivePolicyDir);
+            // Namespace
+            if (input.allNamespaces) {
+                args.push('--all-namespaces');
+            }
+            else if (input.namespace) {
+                args.push('--namespace', input.namespace);
+            }
+            // Data directories
+            for (const d of input.data ?? [])
+                args.push('--data', d);
+            // Flags
+            if (input.combine)
+                args.push('--combine');
+            if (input.failOnWarn)
+                args.push('--fail-on-warn');
+            // Config files (positional args, must come last)
+            const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
+            args.push(...effectiveFiles);
+            const result = await this.run(args, signal);
+            return this.sanitizeOutput(result, configPath, policyDir);
+        });
+    }
+    /**
+     * Run `conftest verify` -- executes the `_test.rego` tests inside the
+     * policy directory to verify the policies themselves.
+     */
+    async verify(input, signal) {
+        const args = ['verify', '--output=json', '--no-color'];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        if (input.namespace)
+            args.push('--namespace', input.namespace);
+        for (const d of input.data ?? [])
+            args.push('--data', d);
+        return this.run(args, signal);
+    }
+    /**
+     * Pull policies from a remote OCI or Git location into a local
+     * directory. Stdout is minimal; errors go to stderr.
+     */
+    async pull(input, signal) {
+        const args = ['pull', input.url];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Push the local policy bundle to a remote OCI registry. Uses
+     * credentials from the host environment (docker login, ORAS, etc.).
+     */
+    async push(input, signal) {
+        const args = ['push', input.repository];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Run `conftest` with the given argv. Tools should prefer the typed
+     * methods above; this is the escape hatch for unusual invocations.
+     */
+    async run(args, signal) {
+        const opts = {
+            args,
+            timeoutMs: this.config.subprocessTimeoutMs,
+        };
+        if (signal !== undefined)
+            opts.signal = signal;
+        return runBinary(this.config.conftestBinary, opts);
+    }
+    // ─── Internal: temp file / directory management ──────────────────────────
+    /**
+     * Create temp assets for inline inputs, run `fn`, then clean up.
+     * Returns whatever `fn` returns.
+     */
+    async withTempAssets(opts, fn) {
+        const temps = [];
+        const paths = {};
+        try {
+            if (opts.inlineConfig !== undefined) {
+                const ext = opts.inlineConfigParser === 'dockerfile'
+                    ? ''
+                    : parserToExt(opts.inlineConfigParser ?? 'yaml');
+                const basename = opts.inlineConfigParser === 'dockerfile' ? 'Dockerfile' : `config${ext}`;
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const tmpDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-'));
+                temps.push(tmpDir);
+                const configPath = join(tmpDir, basename);
+                await writeFile(configPath, opts.inlineConfig, 'utf8');
+                paths.configPath = configPath;
+            }
+            if (opts.inlinePolicy !== undefined) {
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const policyDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-policy-'));
+                temps.push(policyDir);
+                const policyFile = join(policyDir, 'policy.rego');
+                await writeFile(policyFile, opts.inlinePolicy, 'utf8');
+                paths.policyDir = policyDir;
+            }
+            return await fn(paths);
+        }
+        finally {
+            await Promise.all(temps.map((p) => rm(p, { recursive: true, force: true })));
+        }
+    }
+    /**
+     * Replace the temp inline-config path and temp inline-policy directory
+     * path in the stdout JSON with `<inline>` so callers never see
+     * implementation-internal temp paths.
+     *
+     * conftest emits paths inside a JSON array, so each backslash in the
+     * path is JSON-encoded as `\\`. We match the JSON-encoded form of the
+     * path to handle Windows paths correctly (forward slashes need no
+     * special treatment).
+     */
+    sanitizeOutput(result, configPath, policyDir) {
+        if (!configPath && !policyDir)
+            return result;
+        if (!result.stdout)
+            return result;
+        let stdout = result.stdout;
+        if (configPath) {
+            // JSON.stringify encodes backslashes as \\, so match the encoded form.
+            const jsonEncoded = JSON.stringify(configPath).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline>');
+        }
+        if (policyDir) {
+            const jsonEncoded = JSON.stringify(policyDir).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            // Policy dir appears in conftest output as part of file paths.
+            // Replace the full dir prefix so the policy filename is preserved.
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline-policy>');
+        }
+        return { ...result, stdout };
+    }
+}
+//# sourceMappingURL=conftest-cli.js.map

package/dist/lib/conftest-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA2F9D,gFAAgF;AAEhF,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,OAAO;IACd,+DAA+D;IAC/D,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAElD,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB;QAC5C,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,GAAG,GACP,IAAI,CAAC,kBAAkB,KAAK,YAAY;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;gBAC1F,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/lib/opa-cli.d.ts

@@ -201,13 +201,13 @@ export declare class OpaCli {
      * Verify the binary is present and report its version.
      * Returns null if the binary is unreachable or output is malformed.
      */
-    version(): Promise<string | null>;
+    version(signal?: AbortSignal): Promise<string | null>;
     /**
      * Format Rego source. Stdout contains the formatted output. Reports
      * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
-    fmt(input: FmtInput): Promise<SpawnResult>;
+    fmt(input: FmtInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * List files that would be reformatted. Stdout is one absolute path per
      * line for each file that is not already canonical. Exit 0 on success,
@@ -216,12 +216,12 @@ export declare class OpaCli {
      * NOTE: --list and --write are mutually exclusive in OPA: passing both
      * suppresses the write. Always use separate fmtList + fmtWrite calls.
      */
-    fmtList(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtList(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Overwrite each file with its canonically formatted version. Exit 0 on
      * success, non-zero (exit 2) if any file cannot be parsed.
      */
-    fmtWrite(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtWrite(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
      * policy is valid. On failure, `exitCode` is non-zero and the JSON
@@ -230,49 +230,49 @@ export declare class OpaCli {
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
-    check(input: CheckInput): Promise<SpawnResult>;
+    check(input: CheckInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
      */
-    parse(input: ParseInput): Promise<SpawnResult>;
+    parse(input: ParseInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Inspect a bundle, directory, or single Rego file. Returns its
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
-    inspect(input: InspectInput): Promise<SpawnResult>;
+    inspect(input: InspectInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Print available capabilities. With `current=true`, prints the
      * capabilities of the running OPA. With a `version`, prints those of
      * a specific named version. Without either, lists available named
      * versions.
      */
-    capabilities(input?: CapabilitiesInput): Promise<SpawnResult>;
+    capabilities(input?: CapabilitiesInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Static dependency analysis for a Rego ref. Stdout is JSON with the
      * `base` and `virtual` document references the ref depends on.
      */
-    deps(input: DepsInput): Promise<SpawnResult>;
+    deps(input: DepsInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Evaluate a query against a policy + input. Stdout is JSON with the
      * standard `{result: [...]}` shape (plus optional explain, profile,
      * coverage, and metrics sections).
      */
-    eval(input: EvalInput): Promise<SpawnResult>;
+    eval(input: EvalInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
      */
-    test(input: TestInput): Promise<SpawnResult>;
+    test(input: TestInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Benchmark a query. Stdout is JSON with iteration timing statistics.
      */
-    bench(input: BenchInput): Promise<SpawnResult>;
+    bench(input: BenchInput, signal?: AbortSignal): Promise<SpawnResult>;
     /** Build a deployable bundle from policy + data paths. */
-    build(input: BuildInput): Promise<SpawnResult>;
+    build(input: BuildInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Sign a bundle. Writes a `.signatures.json` next to the bundle
      * directory.
      */
-    sign(input: SignInput): Promise<SpawnResult>;
+    sign(input: SignInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Verify a signed bundle using `opa eval --bundle --verification-key`.
      * OPA verifies the bundle signature before loading any policies; a
@@ -280,19 +280,19 @@ export declare class OpaCli {
      * stderr. The trivial query `true` is used so the process exits
      * immediately after verification without entering a REPL.
      */
-    bundleVerify(input: BundleVerifyInput): Promise<SpawnResult>;
+    bundleVerify(input: BundleVerifyInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Batch-evaluate a policy decision against one or more input files using
      * `opa exec`. Each input file is evaluated independently; results are
      * returned as a JSON array with one entry per file.
      */
-    exec(input: ExecInput): Promise<SpawnResult>;
+    exec(input: ExecInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run `opa` with the given argv and optional stdin. Tools should
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
      */
-    run(args: string[], stdin?: string): Promise<SpawnResult>;
+    run(args: string[], stdin?: string, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Write `source` to a uniquely named `.rego` file in the OS tmp dir,
      * pass its path to `fn`, and remove it on completion (success or

package/dist/lib/opa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvC;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhD;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAYzD;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAY1D;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAclD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClD;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBpD,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAQlD;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IASlE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/D;;;;;OAKG;YACW,cAAc;CAS7B"}
+{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQtE;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAY/E;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYhF;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAmB1E;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAM1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9E;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAO7F;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAcxE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwCxE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAkB1E,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiB1E;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IASxF;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrF;;;;;OAKG;YACW,cAAc;CAS7B"}

package/dist/lib/opa-cli.js

@@ -38,8 +38,8 @@ export class OpaCli {
      * Verify the binary is present and report its version.
      * Returns null if the binary is unreachable or output is malformed.
      */
-    async version() {
-        const result = await this.run(['version']);
+    async version(signal) {
+        const result = await this.run(['version'], undefined, signal);
         if (result.exitCode !== 0)
             return null;
         const match = /Version:\s*(\S+)/i.exec(result.stdout);
@@ -51,11 +51,11 @@ export class OpaCli {
      * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
-    async fmt(input) {
+    async fmt(input, signal) {
         const args = ['fmt'];
         if (input.regoV1)
             args.push('--rego-v1');
-        return this.withTempSource(input.source, (path) => this.run([...args, path]));
+        return this.withTempSource(input.source, (path) => this.run([...args, path], undefined, signal));
     }
     /**
      * List files that would be reformatted. Stdout is one absolute path per
@@ -65,7 +65,7 @@ export class OpaCli {
      * NOTE: --list and --write are mutually exclusive in OPA: passing both
      * suppresses the write. Always use separate fmtList + fmtWrite calls.
      */
-    async fmtList(input) {
+    async fmtList(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa fmt requires at least one path');
         }
@@ -77,13 +77,13 @@ export class OpaCli {
         if (input.v1Compatible)
             args.push('--v1-compatible');
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Overwrite each file with its canonically formatted version. Exit 0 on
      * success, non-zero (exit 2) if any file cannot be parsed.
      */
-    async fmtWrite(input) {
+    async fmtWrite(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa fmt requires at least one path');
         }
@@ -95,7 +95,7 @@ export class OpaCli {
         if (input.v1Compatible)
             args.push('--v1-compatible');
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
@@ -105,7 +105,7 @@ export class OpaCli {
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
-    async check(input) {
+    async check(input, signal) {
         if (!input.source && !input.paths?.length) {
             throw new Error('opa check requires either source or at least one path');
         }
@@ -121,23 +121,23 @@ export class OpaCli {
         if (input.schemaDir)
             args.push('--schema', input.schemaDir);
         if (input.source !== undefined) {
-            return this.withTempSource(input.source, (path) => this.run([...args, path]));
+            return this.withTempSource(input.source, (path) => this.run([...args, path], undefined, signal));
         }
         args.push(...(input.paths ?? []));
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
      */
-    async parse(input) {
-        return this.withTempSource(input.source, (path) => this.run(['parse', '--format=json', path]));
+    async parse(input, signal) {
+        return this.withTempSource(input.source, (path) => this.run(['parse', '--format=json', path], undefined, signal));
     }
     /**
      * Inspect a bundle, directory, or single Rego file. Returns its
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
-    async inspect(input) {
-        return this.run(['inspect', '--format=json', '--annotations', input.target]);
+    async inspect(input, signal) {
+        return this.run(['inspect', '--format=json', '--annotations', input.target], undefined, signal);
     }
     /**
      * Print available capabilities. With `current=true`, prints the
@@ -145,19 +145,19 @@ export class OpaCli {
      * a specific named version. Without either, lists available named
      * versions.
      */
-    async capabilities(input = {}) {
+    async capabilities(input = {}, signal) {
         const args = ['capabilities'];
         if (input.current)
             args.push('--current');
         if (input.version)
             args.push('--version', input.version);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Static dependency analysis for a Rego ref. Stdout is JSON with the
      * `base` and `virtual` document references the ref depends on.
      */
-    async deps(input) {
+    async deps(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa deps requires at least one path');
         }
@@ -166,7 +166,7 @@ export class OpaCli {
             args.push('--data', path);
         }
         args.push(input.ref);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     // ─── Evaluation ──────────────────────────────────────────────────────
     /**
@@ -174,7 +174,7 @@ export class OpaCli {
      * standard `{result: [...]}` shape (plus optional explain, profile,
      * coverage, and metrics sections).
      */
-    async eval(input) {
+    async eval(input, signal) {
         // Inline source becomes a temp file added to --data.
         if (input.source !== undefined) {
             const { source, ...rest } = input;
@@ -182,7 +182,7 @@ export class OpaCli {
             return this.withTempSource(input.source, (sourcePath) => this.eval({
                 ...rest,
                 paths: [...(input.paths ?? []), sourcePath],
-            }));
+            }, signal));
         }
         const args = ['eval', '--format=json'];
         for (const path of input.paths ?? [])
@@ -215,12 +215,12 @@ export class OpaCli {
             stdin = JSON.stringify(input.input);
         }
         args.push(input.query);
-        return this.run(args, stdin);
+        return this.run(args, stdin, signal);
     }
     /**
      * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
      */
-    async test(input) {
+    async test(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa test requires at least one path');
         }
@@ -234,12 +234,12 @@ export class OpaCli {
         if (input.runPattern)
             args.push('--run', input.runPattern);
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Benchmark a query. Stdout is JSON with iteration timing statistics.
      */
-    async bench(input) {
+    async bench(input, signal) {
         const args = ['bench', '--format=json'];
         for (const path of input.paths ?? [])
             args.push('--data', path);
@@ -253,11 +253,11 @@ export class OpaCli {
             stdin = JSON.stringify(input.input);
         }
         args.push(input.query);
-        return this.run(args, stdin);
+        return this.run(args, stdin, signal);
     }
     // ─── Bundles ─────────────────────────────────────────────────────────
     /** Build a deployable bundle from policy + data paths. */
-    async build(input) {
+    async build(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa build requires at least one input path');
         }
@@ -279,20 +279,20 @@ export class OpaCli {
         if (input.capabilities)
             args.push('--capabilities', input.capabilities);
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Sign a bundle. Writes a `.signatures.json` next to the bundle
      * directory.
      */
-    async sign(input) {
+    async sign(input, signal) {
         const args = ['sign', '--signing-key', input.signingKey];
         if (input.signingAlg)
             args.push('--signing-alg', input.signingAlg);
         if (input.claimsFile)
             args.push('--claims-file', input.claimsFile);
         args.push('--bundle', input.bundle);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Verify a signed bundle using `opa eval --bundle --verification-key`.
@@ -301,7 +301,7 @@ export class OpaCli {
      * stderr. The trivial query `true` is used so the process exits
      * immediately after verification without entering a REPL.
      */
-    async bundleVerify(input) {
+    async bundleVerify(input, signal) {
         const args = ['eval', '--bundle', input.bundle, '--verification-key', input.verificationKey];
         if (input.verificationKeyId)
             args.push('--verification-key-id', input.verificationKeyId);
@@ -310,14 +310,14 @@ export class OpaCli {
         if (input.scope)
             args.push('--scope', input.scope);
         args.push('true');
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Batch-evaluate a policy decision against one or more input files using
      * `opa exec`. Each input file is evaluated independently; results are
      * returned as a JSON array with one entry per file.
      */
-    async exec(input) {
+    async exec(input, signal) {
         if (input.inputPaths.length === 0) {
             throw new Error('opa exec requires at least one input path');
         }
@@ -327,7 +327,7 @@ export class OpaCli {
         for (const p of input.dataPaths ?? [])
             args.push('--data', p);
         args.push(...input.inputPaths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     // ─── Low-level escape hatch ──────────────────────────────────────────
     /**
@@ -335,13 +335,15 @@ export class OpaCli {
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
      */
-    async run(args, stdin) {
+    async run(args, stdin, signal) {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
         };
         if (stdin !== undefined)
             opts.stdin = stdin;
+        if (signal !== undefined)
+            opts.signal = signal;
         return runBinary(this.config.opaBinary, opts);
     }
     // ─── Internal: temp file management ──────────────────────────────────