@orygn/opa-mcp 0.1.8 → 0.1.9

package/CHANGELOG.md

@@ -17,6 +17,49 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.1.9] - 2026-05-21
+
+### Added
+
+- **AbortSignal cancellation** -- all 43 tool handlers now wire the MCP SDK's
+  `extra.signal` into every subprocess spawn and OPA HTTP request. When a client
+  sends `notifications/cancelled`, in-flight work is actually terminated:
+  subprocess receives SIGTERM followed by SIGKILL escalation after 2 seconds;
+  HTTP fetches are aborted via `AbortSignal.any()` combining the existing
+  per-request timeout with the external client signal.
+
+- **`CANCELLED` error code** -- added to `ToolErrorCode`. Returned to the caller
+  when a tool is interrupted mid-flight by client cancellation, rather than
+  surfacing a misleading `TIMEOUT` or `OPA_BINARY_NOT_FOUND` code.
+
+- **`OpaCancelledError`** -- new error class in `OpaClient`. Thrown when a
+  fetch aborts because the client signal fired (not a network failure), so
+  `mapOpaClientError` can map it precisely to `CANCELLED`.
+
+- **Tool annotations, instructions, and path sanitization (MCP spec 2025-11-25)**
+  -- all 43 tools now declare `readOnlyHint`, `destructiveHint`, `idempotentHint`,
+  and `openWorldHint` in their `annotations` block per the MCP spec. Server
+  registers `instructions` at startup describing the tool set. All file path
+  arguments validated through a hardened `validatePath` helper that normalises
+  Windows drive-letter casing and resolves symlinks before allow-list comparison,
+  closing a bypass that existed when a symlink target escaped the allowed root.
+
+### Changed
+
+- **`@modelcontextprotocol/sdk` pinned to `^1.29.0`** -- the minimum version that
+  exposes `annotations` on `RegisteredTool` and passes `extra.signal` to handlers.
+
+### Internal
+
+- `subprocess.ts`: `SpawnResult` gains `aborted: boolean`; `SpawnOptions` gains
+  `signal?: AbortSignal`. Early-return path if signal is pre-aborted; abort
+  listener shares the SIGTERM->SIGKILL escalation helper with the timeout path.
+- `tool-helpers.ts`: `mapSubprocessFailure` checks `result.aborted` before
+  `exitCode === null` so cancellation takes priority over binary-not-found.
+- Tests: all mock `SpawnResult` objects updated to include `aborted: false`;
+  `callTool` helper passes `{ signal }` as second argument; two new deterministic
+  abort path tests in `subprocess.test.ts`.
+
 ## [0.1.8] - 2026-05-21
 
 ### Added
@@ -514,7 +557,8 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.8...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.9...HEAD
+[0.1.9]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.8...v0.1.9
 [0.1.8]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.7...v0.1.8
 [0.1.7]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.5...v0.1.6

package/README.md

@@ -18,10 +18,10 @@ environment.
 +--------------------+  MCP / stdio  +-----------------+  spawn / HTTP  +------------------+
 |  Claude · Cursor · | ------------> |  @orygn/opa-mcp | -------------> |  opa · regal ·   |
 |   VS Code · ...    | <------------ |                 | <------------- |  OPA REST API    |
-+--------------------+   39 tools    +-----------------+                +------------------+
++--------------------+   43 tools    +-----------------+                +------------------+
 ```
 
-> **Status:** v0.1.5. Tool surface, error codes, and
+> **Status:** v0.1.8. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
@@ -264,7 +264,7 @@ Every tool returns a JSON envelope:
 Stable error codes: `INVALID_INPUT`, `INVALID_REGO`, `INVALID_BUNDLE`,
 `EVAL_ERROR`, `OPA_BINARY_NOT_FOUND`, `REGAL_NOT_FOUND`,
 `REGAL_VERSION_TOO_OLD`, `OPA_UNREACHABLE`, `OPA_AUTH_FAILED`,
-`POLICY_NOT_FOUND`, `PATH_NOT_ALLOWED`, `PATH_NOT_FOUND`,
+`POLICY_NOT_FOUND`, `DATA_NOT_FOUND`, `PATH_NOT_ALLOWED`, `PATH_NOT_FOUND`,
 `DEPENDENCY_CONFLICT`, `NO_TESTS_FOUND`, `HTTP_SEND_BLOCKED`, `TIMEOUT`,
 `UNKNOWN_ERROR`.
 
@@ -274,15 +274,16 @@ Operate on Rego source code without needing a running OPA server. Wrap
 `opa fmt`, `opa parse`, `opa check`, `opa inspect`, `opa capabilities`,
 `opa deps`, and `regal`.
 
-| Tool                | What it does                                                                                                                      |
-| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
-| `rego_format`       | Format Rego source. Wraps `opa fmt`. Idempotent.                                                                                  |
-| `rego_check`        | Type-check and validate Rego. Wraps `opa check`.                                                                                  |
-| `rego_lint`         | Run Regal across a file or directory. Returns findings grouped by category. **Requires `regal` on `PATH` or `REGAL_BINARY` set.** |
-| `rego_parse_ast`    | Parse Rego to AST JSON. Wraps `opa parse`.                                                                                        |
-| `rego_inspect`      | Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.                                                 |
-| `rego_capabilities` | Return the capabilities (built-ins, future keywords) understood by the bundled OPA.                                               |
-| `rego_deps`         | Static dependency analysis: rule-level data references and cross-package calls.                                                   |
+| Tool                | What it does                                                                                                                                                             |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `rego_format`       | Format Rego source. Wraps `opa fmt`. Idempotent.                                                                                                                         |
+| `rego_check`        | Type-check and validate Rego. Wraps `opa check`.                                                                                                                         |
+| `rego_lint`         | Run Regal across a file or directory. Returns findings grouped by category. **Requires `regal` on `PATH` or `REGAL_BINARY` set.**                                        |
+| `rego_parse_ast`    | Parse Rego to AST JSON. Wraps `opa parse`.                                                                                                                               |
+| `rego_inspect`      | Inspect a bundle or directory: packages, rules, annotations. Wraps `opa inspect`.                                                                                        |
+| `rego_capabilities` | Return the capabilities (built-ins, future keywords) understood by the bundled OPA.                                                                                      |
+| `rego_deps`         | Static dependency analysis: rule-level data references and cross-package calls.                                                                                          |
+| `rego_migrate_v1`   | Migrate Rego v0 source to v1 syntax. Runs `opa fmt --rego-v1` then validates with `opa check --v1-compatible`. Returns `{ original, migrated, changed, valid, errors }`. |
 
 #### Featured: `rego_format`
 
@@ -332,15 +333,16 @@ Operate on Rego source code without needing a running OPA server. Wrap
 Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 `opa bench`.
 
-| Tool                      | What it does                                                                         |
-| ------------------------- | ------------------------------------------------------------------------------------ |
-| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.              |
-| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                        |
-| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.          |
-| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                             |
-| `rego_test`               | Run `opa test` over a directory. Returns pass/fail per test, with optional coverage. |
-| `rego_bench`              | Run `opa bench` and return statistical timing data.                                  |
-| `rego_compile_query`      | Partially evaluate a query against a policy.                                         |
+| Tool                      | What it does                                                                                                           |
+| ------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| `rego_eval`               | Evaluate a query against a policy and input. The bread-and-butter tool.                                                |
+| `rego_eval_with_explain`  | Evaluate with `--explain=full` and return a structured trace.                                                          |
+| `rego_eval_with_profile`  | Evaluate with `--profile` and return per-rule timing and evaluation counts.                                            |
+| `rego_eval_with_coverage` | Evaluate with `--coverage` and return per-line coverage.                                                               |
+| `rego_test`               | Run `opa test` over a directory. Returns pass/fail per test, with optional coverage.                                   |
+| `rego_bench`              | Run `opa bench` and return statistical timing data.                                                                    |
+| `rego_compile_query`      | Partially evaluate a query against a policy.                                                                           |
+| `opa_exec`                | Batch-evaluate a decision against multiple input files. Returns per-file results with `successCount` and `errorCount`. |
 
 #### Featured: `rego_eval`
 
@@ -365,10 +367,11 @@ Run a query against a policy and input. Wrap `opa eval`, `opa test`, and
 
 Package and sign deployable bundles. Wrap `opa build` and `opa sign`.
 
-| Tool               | What it does                                                                          |
-| ------------------ | ------------------------------------------------------------------------------------- |
-| `opa_bundle_build` | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`. |
-| `opa_bundle_sign`  | Sign a bundle with a private key. Returns `.signatures.json` content.                 |
+| Tool                | What it does                                                                                      |
+| ------------------- | ------------------------------------------------------------------------------------------------- |
+| `opa_bundle_build`  | Build a `.tar.gz` bundle from a policy directory. Supports `optimize` and `revision`.             |
+| `opa_bundle_sign`   | Sign a bundle with a private key. Returns `.signatures.json` content.                             |
+| `opa_bundle_verify` | Verify the signature of a signed bundle using a public key. Returns `{ bundle, verified: true }`. |
 
 ### Category D: OPA server management
 
@@ -384,6 +387,7 @@ point at a reachable server.
 | `opa_get_data`       | Read a path from the data hierarchy.                   |
 | `opa_put_data`       | Write to a path in the data hierarchy.                 |
 | `opa_patch_data`     | Apply a JSON Patch to the data hierarchy.              |
+| `opa_delete_data`    | Delete a document from the data hierarchy.             |
 | `opa_query_decision` | POST to a `/v1/data/...` decision endpoint with input. |
 | `opa_compile_query`  | Partially evaluate a query against the running server. |
 | `opa_health`         | Liveness / readiness check.                            |
@@ -416,7 +420,7 @@ the tasks agents are actually asked to do.
 
 ## Prompts
 
-Three [MCP prompts](https://modelcontextprotocol.io/specification/server/prompts)
+Three [MCP prompts](https://modelcontextprotocol.io/specification/2025-11-25/server/prompts)
 ship with the server. Clients surface them as slash commands or workflow
 templates.
 
@@ -428,7 +432,7 @@ templates.
 
 ## Resources
 
-Three [MCP resources](https://modelcontextprotocol.io/specification/server/resources)
+Three [MCP resources](https://modelcontextprotocol.io/specification/2025-11-25/server/resources)
 expose curated reference data the agent can read at any time.
 
 | Resource URI        | What's there                                                                                                                                                                                 |

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.8";
+export declare const SERVER_VERSION = "0.1.9";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.8';
+export const SERVER_VERSION = '0.1.9';
 //# sourceMappingURL=constants.js.map

package/dist/lib/opa-cli.d.ts

@@ -201,13 +201,13 @@ export declare class OpaCli {
      * Verify the binary is present and report its version.
      * Returns null if the binary is unreachable or output is malformed.
      */
-    version(): Promise<string | null>;
+    version(signal?: AbortSignal): Promise<string | null>;
     /**
      * Format Rego source. Stdout contains the formatted output. Reports
      * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
-    fmt(input: FmtInput): Promise<SpawnResult>;
+    fmt(input: FmtInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * List files that would be reformatted. Stdout is one absolute path per
      * line for each file that is not already canonical. Exit 0 on success,
@@ -216,12 +216,12 @@ export declare class OpaCli {
      * NOTE: --list and --write are mutually exclusive in OPA: passing both
      * suppresses the write. Always use separate fmtList + fmtWrite calls.
      */
-    fmtList(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtList(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Overwrite each file with its canonically formatted version. Exit 0 on
      * success, non-zero (exit 2) if any file cannot be parsed.
      */
-    fmtWrite(input: FmtWriteInput): Promise<SpawnResult>;
+    fmtWrite(input: FmtWriteInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
      * policy is valid. On failure, `exitCode` is non-zero and the JSON
@@ -230,49 +230,49 @@ export declare class OpaCli {
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
-    check(input: CheckInput): Promise<SpawnResult>;
+    check(input: CheckInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
      */
-    parse(input: ParseInput): Promise<SpawnResult>;
+    parse(input: ParseInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Inspect a bundle, directory, or single Rego file. Returns its
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
-    inspect(input: InspectInput): Promise<SpawnResult>;
+    inspect(input: InspectInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Print available capabilities. With `current=true`, prints the
      * capabilities of the running OPA. With a `version`, prints those of
      * a specific named version. Without either, lists available named
      * versions.
      */
-    capabilities(input?: CapabilitiesInput): Promise<SpawnResult>;
+    capabilities(input?: CapabilitiesInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Static dependency analysis for a Rego ref. Stdout is JSON with the
      * `base` and `virtual` document references the ref depends on.
      */
-    deps(input: DepsInput): Promise<SpawnResult>;
+    deps(input: DepsInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Evaluate a query against a policy + input. Stdout is JSON with the
      * standard `{result: [...]}` shape (plus optional explain, profile,
      * coverage, and metrics sections).
      */
-    eval(input: EvalInput): Promise<SpawnResult>;
+    eval(input: EvalInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
      */
-    test(input: TestInput): Promise<SpawnResult>;
+    test(input: TestInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Benchmark a query. Stdout is JSON with iteration timing statistics.
      */
-    bench(input: BenchInput): Promise<SpawnResult>;
+    bench(input: BenchInput, signal?: AbortSignal): Promise<SpawnResult>;
     /** Build a deployable bundle from policy + data paths. */
-    build(input: BuildInput): Promise<SpawnResult>;
+    build(input: BuildInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Sign a bundle. Writes a `.signatures.json` next to the bundle
      * directory.
      */
-    sign(input: SignInput): Promise<SpawnResult>;
+    sign(input: SignInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Verify a signed bundle using `opa eval --bundle --verification-key`.
      * OPA verifies the bundle signature before loading any policies; a
@@ -280,19 +280,19 @@ export declare class OpaCli {
      * stderr. The trivial query `true` is used so the process exits
      * immediately after verification without entering a REPL.
      */
-    bundleVerify(input: BundleVerifyInput): Promise<SpawnResult>;
+    bundleVerify(input: BundleVerifyInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Batch-evaluate a policy decision against one or more input files using
      * `opa exec`. Each input file is evaluated independently; results are
      * returned as a JSON array with one entry per file.
      */
-    exec(input: ExecInput): Promise<SpawnResult>;
+    exec(input: ExecInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Run `opa` with the given argv and optional stdin. Tools should
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
      */
-    run(args: string[], stdin?: string): Promise<SpawnResult>;
+    run(args: string[], stdin?: string, signal?: AbortSignal): Promise<SpawnResult>;
     /**
      * Write `source` to a uniquely named `.rego` file in the OS tmp dir,
      * pass its path to `fn`, and remove it on completion (success or

package/dist/lib/opa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IASvC;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhD;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAYzD;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;IAY1D;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpD;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,GAAG,OAAO,CAAC,WAAW,CAAC;IAOvE;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAclD;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAqClD;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAkBpD,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBpD;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAQlD;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IASlE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC;IAalD;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAW/D;;;;;OAKG;YACW,cAAc;CAS7B"}
+{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQtE;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAY/E;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYhF;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAmB1E;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAM1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9E;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAO7F;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAcxE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAwCxE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAkB1E,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiB1E;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IASxF;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAaxE;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrF;;;;;OAKG;YACW,cAAc;CAS7B"}

package/dist/lib/opa-cli.js

@@ -38,8 +38,8 @@ export class OpaCli {
      * Verify the binary is present and report its version.
      * Returns null if the binary is unreachable or output is malformed.
      */
-    async version() {
-        const result = await this.run(['version']);
+    async version(signal) {
+        const result = await this.run(['version'], undefined, signal);
         if (result.exitCode !== 0)
             return null;
         const match = /Version:\s*(\S+)/i.exec(result.stdout);
@@ -51,11 +51,11 @@ export class OpaCli {
      * `exitCode: 0` even when no changes are needed -- callers compare
      * input vs output to detect a no-op.
      */
-    async fmt(input) {
+    async fmt(input, signal) {
         const args = ['fmt'];
         if (input.regoV1)
             args.push('--rego-v1');
-        return this.withTempSource(input.source, (path) => this.run([...args, path]));
+        return this.withTempSource(input.source, (path) => this.run([...args, path], undefined, signal));
     }
     /**
      * List files that would be reformatted. Stdout is one absolute path per
@@ -65,7 +65,7 @@ export class OpaCli {
      * NOTE: --list and --write are mutually exclusive in OPA: passing both
      * suppresses the write. Always use separate fmtList + fmtWrite calls.
      */
-    async fmtList(input) {
+    async fmtList(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa fmt requires at least one path');
         }
@@ -77,13 +77,13 @@ export class OpaCli {
         if (input.v1Compatible)
             args.push('--v1-compatible');
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Overwrite each file with its canonically formatted version. Exit 0 on
      * success, non-zero (exit 2) if any file cannot be parsed.
      */
-    async fmtWrite(input) {
+    async fmtWrite(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa fmt requires at least one path');
         }
@@ -95,7 +95,7 @@ export class OpaCli {
         if (input.v1Compatible)
             args.push('--v1-compatible');
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Type-check Rego. Returns `exitCode: 0` and empty `stdout` when the
@@ -105,7 +105,7 @@ export class OpaCli {
      * diagnostics). Either inline `source` or one or more `paths` must be
      * provided.
      */
-    async check(input) {
+    async check(input, signal) {
         if (!input.source && !input.paths?.length) {
             throw new Error('opa check requires either source or at least one path');
         }
@@ -121,23 +121,23 @@ export class OpaCli {
         if (input.schemaDir)
             args.push('--schema', input.schemaDir);
         if (input.source !== undefined) {
-            return this.withTempSource(input.source, (path) => this.run([...args, path]));
+            return this.withTempSource(input.source, (path) => this.run([...args, path], undefined, signal));
         }
         args.push(...(input.paths ?? []));
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Parse Rego source to a JSON AST. Stdout is the AST as JSON.
      */
-    async parse(input) {
-        return this.withTempSource(input.source, (path) => this.run(['parse', '--format=json', path]));
+    async parse(input, signal) {
+        return this.withTempSource(input.source, (path) => this.run(['parse', '--format=json', path], undefined, signal));
     }
     /**
      * Inspect a bundle, directory, or single Rego file. Returns its
      * packages, namespaces, manifest, and annotations as JSON on stdout.
      */
-    async inspect(input) {
-        return this.run(['inspect', '--format=json', '--annotations', input.target]);
+    async inspect(input, signal) {
+        return this.run(['inspect', '--format=json', '--annotations', input.target], undefined, signal);
     }
     /**
      * Print available capabilities. With `current=true`, prints the
@@ -145,19 +145,19 @@ export class OpaCli {
      * a specific named version. Without either, lists available named
      * versions.
      */
-    async capabilities(input = {}) {
+    async capabilities(input = {}, signal) {
         const args = ['capabilities'];
         if (input.current)
             args.push('--current');
         if (input.version)
             args.push('--version', input.version);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Static dependency analysis for a Rego ref. Stdout is JSON with the
      * `base` and `virtual` document references the ref depends on.
      */
-    async deps(input) {
+    async deps(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa deps requires at least one path');
         }
@@ -166,7 +166,7 @@ export class OpaCli {
             args.push('--data', path);
         }
         args.push(input.ref);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     // ─── Evaluation ──────────────────────────────────────────────────────
     /**
@@ -174,7 +174,7 @@ export class OpaCli {
      * standard `{result: [...]}` shape (plus optional explain, profile,
      * coverage, and metrics sections).
      */
-    async eval(input) {
+    async eval(input, signal) {
         // Inline source becomes a temp file added to --data.
         if (input.source !== undefined) {
             const { source, ...rest } = input;
@@ -182,7 +182,7 @@ export class OpaCli {
             return this.withTempSource(input.source, (sourcePath) => this.eval({
                 ...rest,
                 paths: [...(input.paths ?? []), sourcePath],
-            }));
+            }, signal));
         }
         const args = ['eval', '--format=json'];
         for (const path of input.paths ?? [])
@@ -215,12 +215,12 @@ export class OpaCli {
             stdin = JSON.stringify(input.input);
         }
         args.push(input.query);
-        return this.run(args, stdin);
+        return this.run(args, stdin, signal);
     }
     /**
      * Run Rego unit tests. Stdout is JSON with per-test pass/fail.
      */
-    async test(input) {
+    async test(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa test requires at least one path');
         }
@@ -234,12 +234,12 @@ export class OpaCli {
         if (input.runPattern)
             args.push('--run', input.runPattern);
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Benchmark a query. Stdout is JSON with iteration timing statistics.
      */
-    async bench(input) {
+    async bench(input, signal) {
         const args = ['bench', '--format=json'];
         for (const path of input.paths ?? [])
             args.push('--data', path);
@@ -253,11 +253,11 @@ export class OpaCli {
             stdin = JSON.stringify(input.input);
         }
         args.push(input.query);
-        return this.run(args, stdin);
+        return this.run(args, stdin, signal);
     }
     // ─── Bundles ─────────────────────────────────────────────────────────
     /** Build a deployable bundle from policy + data paths. */
-    async build(input) {
+    async build(input, signal) {
         if (input.paths.length === 0) {
             throw new Error('opa build requires at least one input path');
         }
@@ -279,20 +279,20 @@ export class OpaCli {
         if (input.capabilities)
             args.push('--capabilities', input.capabilities);
         args.push(...input.paths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Sign a bundle. Writes a `.signatures.json` next to the bundle
      * directory.
      */
-    async sign(input) {
+    async sign(input, signal) {
         const args = ['sign', '--signing-key', input.signingKey];
         if (input.signingAlg)
             args.push('--signing-alg', input.signingAlg);
         if (input.claimsFile)
             args.push('--claims-file', input.claimsFile);
         args.push('--bundle', input.bundle);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Verify a signed bundle using `opa eval --bundle --verification-key`.
@@ -301,7 +301,7 @@ export class OpaCli {
      * stderr. The trivial query `true` is used so the process exits
      * immediately after verification without entering a REPL.
      */
-    async bundleVerify(input) {
+    async bundleVerify(input, signal) {
         const args = ['eval', '--bundle', input.bundle, '--verification-key', input.verificationKey];
         if (input.verificationKeyId)
             args.push('--verification-key-id', input.verificationKeyId);
@@ -310,14 +310,14 @@ export class OpaCli {
         if (input.scope)
             args.push('--scope', input.scope);
         args.push('true');
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     /**
      * Batch-evaluate a policy decision against one or more input files using
      * `opa exec`. Each input file is evaluated independently; results are
      * returned as a JSON array with one entry per file.
      */
-    async exec(input) {
+    async exec(input, signal) {
         if (input.inputPaths.length === 0) {
             throw new Error('opa exec requires at least one input path');
         }
@@ -327,7 +327,7 @@ export class OpaCli {
         for (const p of input.dataPaths ?? [])
             args.push('--data', p);
         args.push(...input.inputPaths);
-        return this.run(args);
+        return this.run(args, undefined, signal);
     }
     // ─── Low-level escape hatch ──────────────────────────────────────────
     /**
@@ -335,13 +335,15 @@ export class OpaCli {
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
      */
-    async run(args, stdin) {
+    async run(args, stdin, signal) {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
         };
         if (stdin !== undefined)
             opts.stdin = stdin;
+        if (signal !== undefined)
+            opts.signal = signal;
         return runBinary(this.config.opaBinary, opts);
     }
     // ─── Internal: temp file management ──────────────────────────────────