@orygn/opa-mcp 0.1.9 → 0.1.11

package/CHANGELOG.md

@@ -17,6 +17,72 @@ not part of the public surface and may change in minor releases.
 
 ## [Unreleased]
 
+## [0.1.11] - 2026-05-24
+
+### Added
+
+- **`rego_check_schema` (48 tools total)** -- new authoring tool that runs
+  `opa check --schema` to validate that every `input.*` field reference in a
+  Rego policy exists in the provided JSON Schema. Schema violations surface as
+  `rego_type_error` diagnostics with file/line locations. Accepts the schema
+  inline (`inlineSchema` -- pass the `schema` output of `rego_infer_input_schema`
+  directly) or as a path to a JSON Schema file on disk (`schemaPath`). Closes the
+  infer-then-validate loop: use `rego_infer_input_schema` to derive the schema
+  from an existing policy, then validate a new or modified policy against it
+  without leaving the MCP session. Supports `strict` mode and all standard
+  path-validation and subprocess error handling.
+
+## [0.1.10] - 2026-05-22
+
+### Added
+
+- **Conftest integration (4 new tools, 47 total)** -- adds `conftest_test`,
+  `conftest_verify`, `conftest_pull`, and `conftest_push`, wrapping the
+  [conftest](https://www.conftest.dev/) CLI for policy testing of Kubernetes,
+  Terraform, Helm, Dockerfile, and other configuration formats. Conftest is
+  optional; all existing tools continue to work without it installed.
+
+- **`conftest_test`** -- runs `conftest test` against one or more configuration
+  files and returns structured JSON pass/fail/warn results per namespace. Supports
+  inline configuration (written to a secure temp file, path redacted from output)
+  and inline Rego policy (written to a secure temp dir), multiple data directories,
+  namespace targeting, `--all-namespaces`, `--combine`, and `--fail-on-warn`.
+
+- **`conftest_verify`** -- runs `conftest verify` to execute `_test.rego` unit
+  tests inside a policy directory, verifying that the policies themselves are
+  correct. Returns structured JSON output.
+
+- **`conftest_pull`** -- pulls a policy bundle from a remote OCI or Git registry
+  into a local directory (`oci://registry/repo:tag` form).
+
+- **`conftest_push`** -- pushes a local policy bundle to a remote OCI registry,
+  using host-environment credentials (docker login / ORAS).
+
+- **`CONFTEST_NOT_FOUND` error code** -- returned by all four conftest tools when
+  the binary is absent, with a structured install hint. Consistent with the
+  existing `OPA_BINARY_NOT_FOUND` and `REGAL_NOT_FOUND` pattern.
+
+- **`CONFTEST_BINARY` environment variable** -- configures the path to the conftest
+  binary. Defaults to `conftest` on PATH.
+
+### Security
+
+- Temp files for inline config and inline policy are now created via `mkdtemp`
+  (atomically, with `O_CREAT|O_EXCL` semantics at the OS level) rather than
+  constructing a path from `os.tmpdir()` and a UUID. This eliminates the TOCTOU
+  race window flagged by CodeQL CWE-377.
+
+### Internal
+
+- `src/lib/conftest-cli.ts`: `ConftestCli` class with `withTempAssets()` temp
+  file lifecycle management and `sanitizeOutput()` for redacting internal paths
+  from conftest JSON output. Path redaction uses `JSON.stringify` encoding to
+  correctly handle backslashes in Windows paths embedded in JSON output.
+- Exit-code semantics: 0 and 1 both produce valid JSON (pass/fail respectively);
+  exit 2+ is a command error surfaced as `UNKNOWN_ERROR`.
+- Tests: 57 tool-layer unit tests, 46 CLI unit tests, 12 real-binary integration
+  tests (auto-skipped when conftest is not on PATH).
+
 ## [0.1.9] - 2026-05-21
 
 ### Added
@@ -557,7 +623,9 @@ wrappers end-to-end. CI matrix: Ubuntu, macOS, and Windows on Node
 20 and 22, plus CodeQL security scanning and weekly Dependabot updates
 for npm, GitHub Actions, and Docker base images.
 
-[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.9...HEAD
+[Unreleased]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.11...HEAD
+[0.1.11]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.10...v0.1.11
+[0.1.10]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.9...v0.1.10
 [0.1.9]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.8...v0.1.9
 [0.1.8]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.7...v0.1.8
 [0.1.7]: https://github.com/OrygnsCode/opa-mcp-server/compare/v0.1.6...v0.1.7

package/README.md

@@ -15,13 +15,13 @@ VS Code, Windsurf, Zed, and others) into a first-class
 environment.
 
 ```
-+--------------------+  MCP / stdio  +-----------------+  spawn / HTTP  +------------------+
-|  Claude · Cursor · | ------------> |  @orygn/opa-mcp | -------------> |  opa · regal ·   |
-|   VS Code · ...    | <------------ |                 | <------------- |  OPA REST API    |
-+--------------------+   43 tools    +-----------------+                +------------------+
++--------------------+  MCP / stdio  +-----------------+  spawn / HTTP  +------------------------+
+|  Claude · Cursor · | ------------> |  @orygn/opa-mcp | -------------> |  opa · regal · conftest |
+|   VS Code · ...    | <------------ |                 | <------------- |  OPA REST API          |
++--------------------+   48 tools    +-----------------+                +------------------------+
 ```
 
-> **Status:** v0.1.8. Tool surface, error codes, and
+> **Status:** v0.1.11. Tool surface, error codes, and
 > environment variables follow [SemVer](https://semver.org/) from
 > v0.1.0 forward.
 
@@ -241,6 +241,7 @@ variable is optional; defaults are sensible for a local OPA on
 | `OPA_TOKEN`                  | _(unset)_                    | Bearer token for OPA, if your instance requires auth. Treated as a secret. Never echoed in logs or tool responses.                                        |
 | `OPA_BINARY`                 | `opa` (on `PATH`)            | Path to the `opa` CLI, used by `rego_*` tools.                                                                                                            |
 | `REGAL_BINARY`               | `regal` (on `PATH`)          | Path to the `regal` linter. Only required by `rego_lint`.                                                                                                 |
+| `CONFTEST_BINARY`            | `conftest` (on `PATH`)       | Path to the `conftest` binary. Only required by `conftest_*` tools. Returns `CONFTEST_NOT_FOUND` if absent.                                               |
 | `OPA_MCP_ALLOWED_PATHS`      | _(unset)_                    | Comma- or semicolon-separated list of directories the server is allowed to read policies from. **When unset, file-based tools refuse to read from disk.** |
 | `OPA_MCP_LOG_FILE`           | `<tmpdir>/orygn-opa-mcp.log` | Path the server appends logs to. The server never writes to stdout; that channel is reserved for the MCP protocol.                                        |
 | `OPA_MCP_LOG_LEVEL`          | `info`                       | One of `debug`, `info`, `warn`, `error`.                                                                                                                  |
@@ -412,11 +413,55 @@ the tasks agents are actually asked to do.
 | `rego_format_write`           | Run `opa fmt --write` to canonically format one or more Rego files or directories in place. Use `dryRun: true` to list which files would change without modifying them. Validates all files parse successfully before writing any. Supports `regoV1`, `v0Compatible`, and `v1Compatible` flags. Only requires `opa`.                                                              |
 | `rego_policy_diff`            | Evaluate the same query against two policies in parallel and compare the results. Returns `equal: true/false`, the raw value from each side (`resultA`/`resultB`), and `changedPaths` -- dot/bracket JSON paths that differ. Each side takes inline source or a file/directory path. Useful for verifying refactor equivalence or mapping divergence between two policy versions. |
 
-### Category F: Meta
+### Category F: Conftest (configuration policy testing)
 
-| Tool              | What it does                                                                                                                                                                         |
-| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `mcp_server_info` | Return server name, version, resolved `opa`/`regal` versions, transport type, and Node.js version in one call. Useful for verifying which server instance the agent is connected to. |
+Test Kubernetes manifests, Terraform plans, Dockerfiles, Helm charts, and any
+YAML/JSON/HCL/TOML/INI against Rego policies using
+[conftest](https://www.conftest.dev/). Requires `conftest` on `PATH` or
+`CONFTEST_BINARY` set; all four tools return `CONFTEST_NOT_FOUND` otherwise.
+
+| Tool              | What it does                                                                                                                                                                                                                              |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `conftest_test`   | Evaluate configuration files against policies with `conftest test`. Accepts file paths or `inlineConfig` (inline YAML/JSON/HCL/etc) and `policy` path or `inlinePolicy` source. Returns per-file pass/fail/warn results and a summary.    |
+| `conftest_verify` | Run `test_*` rules inside `*_test.rego` files to verify the policies themselves are correct. Equivalent to `opa test` but using conftest's policy-loading machinery.                                                                      |
+| `conftest_pull`   | Pull a policy bundle from an OCI registry or Git repo into a local directory with `conftest pull`. The target directory need not exist; conftest creates it.                                                                              |
+| `conftest_push`   | Package a local policy directory as an OCI artifact and push to a registry with `conftest push`. Registry credentials come from the host environment (`docker login`, ORAS keychain, etc.) -- credentials are never passed through tools. |
+
+#### Featured: `conftest_test` with inline config
+
+```jsonc
+// Input
+{
+  "inlineConfig": "apiVersion: v1\nkind: Pod\nspec:\n  containers:\n  - name: app\n    image: nginx:latest",
+  "inlinePolicy": "package main\ndeny[msg] { input.spec.containers[_].image == \"nginx:latest\"; msg := \"pin your image tag\" }"
+}
+
+// Output
+{
+  "ok": true,
+  "data": {
+    "passed": false,
+    "results": [
+      {
+        "filename": "<inline>",
+        "namespace": "main",
+        "successes": 0,
+        "failures": [{ "msg": "pin your image tag" }],
+        "warnings": [],
+        "skipped": [],
+        "exceptions": []
+      }
+    ],
+    "summary": { "passed": 0, "failed": 1, "warnings": 0, "skipped": 0 }
+  }
+}
+```
+
+### Category G: Meta
+
+| Tool              | What it does                                                                                                                                                                                    |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `mcp_server_info` | Return server name, version, resolved `opa`/`regal`/`conftest` versions, transport type, and Node.js version in one call. Useful for verifying which server instance the agent is connected to. |
 
 ## Prompts
 
@@ -662,7 +707,7 @@ Dependabot or a manual PR.
 
 ## License
 
-[MIT](./LICENSE) © Orygn LLC
+[MIT](./LICENSE) © [Orygn LLC](https://orygn.tech)
 
 `@orygn/opa-mcp` is an independent project. It is not affiliated with,
 endorsed by, or sponsored by the Open Policy Agent project, the Cloud

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiC1C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAgD/C;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAMA"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAiC1C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAiD/C;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAMA"}

package/dist/cli.js

@@ -30,6 +30,7 @@ export function formatHelp(col) {
     const rows = [
         ['OPA_BINARY', 'opa binary path', 'opa'],
         ['REGAL_BINARY', 'regal binary path', 'regal'],
+        ['CONFTEST_BINARY', 'conftest binary path', 'conftest'],
         ['OPA_URL', 'OPA server base URL', 'http://localhost:8181'],
         ['OPA_TOKEN', 'OPA authentication token', ''],
         ['OPA_MCP_ALLOWED_PATHS', 'allowed filesystem roots, comma or semicolon separated', ''],

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AAEjF,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,EAAE,GAAG,UAAU,CAAC;AAEtB,SAAS,CAAC,CAAC,EAAW,EAAE,GAAG,KAAe;IACxC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,iFAAiF;AAEjF,2DAA2D;AAC3D,8CAA8C;AAC9C,sEAAsE;AAEtE,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,GAAG,GACP,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAExD,MAAM,IAAI,GAA+B;QACvC,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAK,CAAC;QACxC,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC9C,CAAC,SAAS,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAC3D,CAAC,WAAW,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC7C,CAAC,uBAAuB,EAAE,wDAAwD,EAAE,EAAE,CAAC;QACvF,CAAC,oBAAoB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAC3D,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAChE,CAAC,kBAAkB,EAAE,eAAe,EAAE,4BAA4B,CAAC;QACnE,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,MAAM,CAAC;QACnE,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,QAAQ,CAAC;KACvE,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,SAAS,CAAC,GAAG,CAAC;QACd,EAAE;QACF,gDAAgD;QAChD,2DAA2D;QAC3D,EAAE;QACF,CAAC,CAAC,wCAAwC,CAAC;QAC3C,EAAE;QACF,QAAQ;QACR,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,8CAA8C;QAC9C,yCAAyC;QACzC,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,sBAAsB;QACtB,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAY;IAC9D,MAAM,KAAK,GACT,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAExF,MAAM,MAAM,GAAG;QACb,OAAO,MAAM,CAAC,SAAS,EAAE;QACzB,SAAS,MAAM,CAAC,WAAW,EAAE;QAC7B,SAAS,KAAK,EAAE;QAChB,OAAO,MAAM,CAAC,OAAO,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAEjD,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAc;IAKzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,iFAAiF;AAEjF,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,CAAC,GAAG,SAAS,CAAC;AACpB,MAAM,EAAE,GAAG,UAAU,CAAC;AAEtB,SAAS,CAAC,CAAC,EAAW,EAAE,GAAG,KAAe;IACxC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,iFAAiF;AAEjF,2DAA2D;AAC3D,8CAA8C;AAC9C,sEAAsE;AAEtE,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,GAAG,GACP,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAExD,MAAM,IAAI,GAA+B;QACvC,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAK,CAAC;QACxC,CAAC,cAAc,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC9C,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,UAAU,CAAC;QACvD,CAAC,SAAS,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QAC3D,CAAC,WAAW,EAAE,0BAA0B,EAAE,EAAE,CAAC;QAC7C,CAAC,uBAAuB,EAAE,wDAAwD,EAAE,EAAE,CAAC;QACvF,CAAC,oBAAoB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAC3D,CAAC,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,CAAC;QAChE,CAAC,kBAAkB,EAAE,eAAe,EAAE,4BAA4B,CAAC;QACnE,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,MAAM,CAAC;QACnE,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,QAAQ,CAAC;KACvE,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI;SAClB,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,OAAO,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;QACL,SAAS,CAAC,GAAG,CAAC;QACd,EAAE;QACF,gDAAgD;QAChD,2DAA2D;QAC3D,EAAE;QACF,CAAC,CAAC,wCAAwC,CAAC;QAC3C,EAAE;QACF,QAAQ;QACR,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,8CAA8C;QAC9C,yCAAyC;QACzC,EAAE;QACF,CAAC,CAAC,QAAQ,CAAC;QACX,EAAE;QACF,sBAAsB;QACtB,yDAAyD;QACzD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAY;IAC9D,MAAM,KAAK,GACT,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAExF,MAAM,MAAM,GAAG;QACb,OAAO,MAAM,CAAC,SAAS,EAAE;QACzB,SAAS,MAAM,CAAC,WAAW,EAAE;QAC7B,SAAS,KAAK,EAAE;QAChB,OAAO,MAAM,CAAC,OAAO,EAAE;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAEjD,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,IAAc;IAKzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC"}

package/dist/config.d.ts

@@ -8,6 +8,8 @@ declare const ConfigSchema: z.ZodObject<{
     opaBinary: z.ZodDefault<z.ZodString>;
     /** Path to the `regal` binary. Defaults to `regal` on PATH. */
     regalBinary: z.ZodDefault<z.ZodString>;
+    /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
+    conftestBinary: z.ZodDefault<z.ZodString>;
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
     subprocessTimeoutMs: z.ZodDefault<z.ZodNumber>;
     /** HTTP request timeout for OPA REST API calls. */
@@ -33,6 +35,7 @@ declare const ConfigSchema: z.ZodObject<{
     opaUrl: string;
     opaBinary: string;
     regalBinary: string;
+    conftestBinary: string;
     subprocessTimeoutMs: number;
     httpTimeoutMs: number;
     allowedPaths: string[];
@@ -45,6 +48,7 @@ declare const ConfigSchema: z.ZodObject<{
     opaToken?: string | undefined;
     opaBinary?: string | undefined;
     regalBinary?: string | undefined;
+    conftestBinary?: string | undefined;
     subprocessTimeoutMs?: number | undefined;
     httpTimeoutMs?: number | undefined;
     allowedPaths?: string[] | undefined;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IAGxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAwBlD,wBAAgB,UAAU,IAAI,MAAM,CA+BnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IAGxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAGlE,mDAAmD;;IAGnD;;;;;OAKG;;IAGH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyBlD,wBAAgB,UAAU,IAAI,MAAM,CAgCnC"}

package/dist/config.js

@@ -17,6 +17,8 @@ const ConfigSchema = z.object({
     opaBinary: z.string().default('opa'),
     /** Path to the `regal` binary. Defaults to `regal` on PATH. */
     regalBinary: z.string().default('regal'),
+    /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
+    conftestBinary: z.string().default('conftest'),
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
     subprocessTimeoutMs: z.coerce.number().int().positive().default(30_000),
     /** HTTP request timeout for OPA REST API calls. */
@@ -53,6 +55,7 @@ const ENV_VAR_NAMES = {
     opaToken: 'OPA_TOKEN',
     opaBinary: 'OPA_BINARY',
     regalBinary: 'REGAL_BINARY',
+    conftestBinary: 'CONFTEST_BINARY',
     subprocessTimeoutMs: 'OPA_MCP_TIMEOUT_MS',
     httpTimeoutMs: 'OPA_MCP_HTTP_TIMEOUT_MS',
     allowedPaths: 'OPA_MCP_ALLOWED_PATHS',
@@ -67,6 +70,7 @@ export function loadConfig() {
         opaToken: process.env['OPA_TOKEN'],
         opaBinary: process.env['OPA_BINARY'],
         regalBinary: process.env['REGAL_BINARY'],
+        conftestBinary: process.env['CONFTEST_BINARY'],
         subprocessTimeoutMs: process.env['OPA_MCP_TIMEOUT_MS'],
         httpTimeoutMs: process.env['OPA_MCP_HTTP_TIMEOUT_MS'],
         allowedPaths,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAEzD,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAEzD,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;CACtE,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;CAC/C,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;KAC5D,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/constants.d.ts

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.1.9";
+export declare const SERVER_VERSION = "0.1.11";
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,WAAW,CAAC"}

package/dist/constants.js

@@ -4,5 +4,5 @@
  * (server.ts -> tools -> meta -> server.ts).
  */
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.1.9';
+export const SERVER_VERSION = '0.1.11';
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC"}

package/dist/lib/conftest-cli.d.ts

@@ -0,0 +1,144 @@
+import type { Config } from '../config.js';
+import { type SpawnResult } from './subprocess.js';
+/**
+ * A single denial or warning message returned by conftest. The `metadata`
+ * field carries any structured data attached via the `{"msg": ..., ...}`
+ * violation object form -- it is absent when the rule returned a plain string.
+ */
+export interface ConftestMessage {
+    msg: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Per-file test result. One entry is emitted for each (filename, namespace)
+ * pair that conftest evaluates.
+ */
+export interface ConftestFileResult {
+    filename: string;
+    namespace: string;
+    successes: number;
+    failures: ConftestMessage[];
+    warnings: ConftestMessage[];
+    skipped: ConftestMessage[];
+    exceptions: string[];
+}
+/** Input for `conftest test`. */
+export interface ConftestTestInput {
+    /** Absolute paths to configuration files to evaluate. */
+    files?: string[];
+    /** Inline configuration content. Mutually exclusive with `files`. */
+    inlineConfig?: string;
+    /**
+     * Parser used for inline config content. Determines the temp file
+     * extension (yaml → .yaml, json → .json, dockerfile → Dockerfile, etc.).
+     * Defaults to `yaml` when not specified.
+     */
+    inlineConfigParser?: string;
+    /**
+     * Absolute path to a directory or file containing Rego policies.
+     * Defaults to `./policy` (conftest's convention). Mutually exclusive
+     * with `inlinePolicy`.
+     */
+    policy?: string;
+    /**
+     * Inline Rego policy source. Written to a temp directory and passed as
+     * `--policy`. Mutually exclusive with `policy`.
+     */
+    inlinePolicy?: string;
+    /** Namespace to test. Defaults to `main`. */
+    namespace?: string;
+    /** Test policies in all discovered namespaces. */
+    allNamespaces?: boolean;
+    /** Absolute paths to data directories for Rego policies. */
+    data?: string[];
+    /** Combine all config files into a single document before testing. */
+    combine?: boolean;
+    /** Return exit 1 when only warnings are present (no hard failures). */
+    failOnWarn?: boolean;
+}
+/** Input for `conftest verify`. */
+export interface ConftestVerifyInput {
+    /** Absolute path to the policy directory to verify. */
+    policy?: string;
+    /** Namespace to verify. Defaults to `main`. */
+    namespace?: string;
+    /** Absolute paths to data directories. */
+    data?: string[];
+}
+/** Input for `conftest pull`. */
+export interface ConftestPullInput {
+    /** Policy URL to pull from (OCI: `oci://registry/repo:tag`). */
+    url: string;
+    /** Local directory to store pulled policies. Defaults to `./policy`. */
+    policy?: string;
+}
+/** Input for `conftest push`. */
+export interface ConftestPushInput {
+    /** OCI repository URL to push policies to. */
+    repository: string;
+    /** Local directory containing policies to push. Defaults to `./policy`. */
+    policy?: string;
+}
+/**
+ * Wrapper around the local `conftest` binary.
+ *
+ * Methods do not throw on conftest-side errors -- the exit code on the
+ * returned `SpawnResult` is the signal. Inline source is written to temp
+ * files/directories because conftest does not read from stdin.
+ */
+export declare class ConftestCli {
+    private readonly config;
+    constructor(config: Config);
+    /**
+     * Verify the binary is present and return its version string. Returns
+     * null if the binary is unreachable or the version output is malformed.
+     */
+    version(signal?: AbortSignal): Promise<string | null>;
+    /**
+     * Run `conftest test` against one or more configuration files. Always
+     * uses `--output=json` so output is machine-readable.
+     *
+     * When `inlineConfig` or `inlinePolicy` are provided, temp files are
+     * created and cleaned up automatically. Temp file paths in the JSON
+     * output are replaced with `<inline>` before the result is returned so
+     * callers never see implementation-internal paths.
+     */
+    test(input: ConftestTestInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Run `conftest verify` -- executes the `_test.rego` tests inside the
+     * policy directory to verify the policies themselves.
+     */
+    verify(input: ConftestVerifyInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Pull policies from a remote OCI or Git location into a local
+     * directory. Stdout is minimal; errors go to stderr.
+     */
+    pull(input: ConftestPullInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Push the local policy bundle to a remote OCI registry. Uses
+     * credentials from the host environment (docker login, ORAS, etc.).
+     */
+    push(input: ConftestPushInput, signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Run `conftest` with the given argv. Tools should prefer the typed
+     * methods above; this is the escape hatch for unusual invocations.
+     */
+    run(args: string[], signal?: AbortSignal): Promise<SpawnResult>;
+    /**
+     * Create temp assets for inline inputs, run `fn`, then clean up.
+     * Returns whatever `fn` returns.
+     */
+    private withTempAssets;
+    /**
+     * Replace the temp inline-config path and temp inline-policy directory
+     * path in the stdout JSON with `<inline>` so callers never see
+     * implementation-internal temp paths.
+     *
+     * conftest emits paths inside a JSON array, so each backslash in the
+     * path is JSON-encoded as `\\`. We match the JSON-encoded form of the
+     * path to handle Windows paths correctly (forward slashes need no
+     * special treatment).
+     */
+    private sanitizeOutput;
+}
+//# sourceMappingURL=conftest-cli.d.ts.map

package/dist/lib/conftest-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAsChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAWrE;;;OAGG;YACW,cAAc;IAyC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}