@orygn/opa-mcp 0.1.9 → 0.1.11

package/dist/lib/conftest-cli.js

@@ -0,0 +1,224 @@
+/**
+ * Wrapper around the optional `conftest` binary (policy testing for
+ * configuration files using Rego).
+ *
+ * Conftest is OPTIONAL -- only the `conftest_*` tools require it. All
+ * other tools work without Conftest installed. If absent, conftest tools
+ * return a structured `CONFTEST_NOT_FOUND` error with an install hint.
+ *
+ * Conftest exit codes:
+ *   0  -- all tests pass (or no failures, only warnings)
+ *   1  -- one or more test failures
+ *   2+ -- command error (bad args, policy not found, parse error, etc.)
+ *
+ * All structured output is obtained via `--output=json`; raw text output
+ * is never parsed.
+ */
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { runBinary } from './subprocess.js';
+// ─── Parser → file extension map ─────────────────────────────────────────────
+const PARSER_TO_EXT = {
+    yaml: '.yaml',
+    json: '.json',
+    toml: '.toml',
+    hcl1: '.hcl',
+    hcl2: '.hcl',
+    ini: '.ini',
+    xml: '.xml',
+    dotenv: '.env',
+    cue: '.cue',
+    jsonnet: '.jsonnet',
+    properties: '.properties',
+    edn: '.edn',
+    hocon: '.conf',
+    // Dockerfile is a special case -- conftest detects by filename
+    dockerfile: '',
+};
+function parserToExt(parser) {
+    return PARSER_TO_EXT[parser.toLowerCase()] ?? `.${parser.toLowerCase()}`;
+}
+// ─── ConftestCli ──────────────────────────────────────────────────────────────
+/**
+ * Wrapper around the local `conftest` binary.
+ *
+ * Methods do not throw on conftest-side errors -- the exit code on the
+ * returned `SpawnResult` is the signal. Inline source is written to temp
+ * files/directories because conftest does not read from stdin.
+ */
+export class ConftestCli {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Verify the binary is present and return its version string. Returns
+     * null if the binary is unreachable or the version output is malformed.
+     */
+    async version(signal) {
+        const result = await this.run(['--version'], signal);
+        if (result.exitCode !== 0)
+            return null;
+        // conftest --version output: "conftest (version: 0.68.2)"
+        const match = /conftest\s*\(version:\s*([^)]+)\)/i.exec(result.stdout) ??
+            /v?(\d+\.\d+\.\d+\S*)/i.exec(result.stdout);
+        return match?.[1]?.trim() ?? null;
+    }
+    /**
+     * Run `conftest test` against one or more configuration files. Always
+     * uses `--output=json` so output is machine-readable.
+     *
+     * When `inlineConfig` or `inlinePolicy` are provided, temp files are
+     * created and cleaned up automatically. Temp file paths in the JSON
+     * output are replaced with `<inline>` before the result is returned so
+     * callers never see implementation-internal paths.
+     */
+    async test(input, signal) {
+        return this.withTempAssets({
+            inlineConfig: input.inlineConfig,
+            inlineConfigParser: input.inlineConfigParser,
+            inlinePolicy: input.inlinePolicy,
+        }, async ({ configPath, policyDir }) => {
+            const args = ['test', '--output=json', '--no-color'];
+            // Policy source
+            const effectivePolicyDir = policyDir ?? input.policy;
+            if (effectivePolicyDir)
+                args.push('--policy', effectivePolicyDir);
+            // Namespace
+            if (input.allNamespaces) {
+                args.push('--all-namespaces');
+            }
+            else if (input.namespace) {
+                args.push('--namespace', input.namespace);
+            }
+            // Data directories
+            for (const d of input.data ?? [])
+                args.push('--data', d);
+            // Flags
+            if (input.combine)
+                args.push('--combine');
+            if (input.failOnWarn)
+                args.push('--fail-on-warn');
+            // Config files (positional args, must come last)
+            const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
+            args.push(...effectiveFiles);
+            const result = await this.run(args, signal);
+            return this.sanitizeOutput(result, configPath, policyDir);
+        });
+    }
+    /**
+     * Run `conftest verify` -- executes the `_test.rego` tests inside the
+     * policy directory to verify the policies themselves.
+     */
+    async verify(input, signal) {
+        const args = ['verify', '--output=json', '--no-color'];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        if (input.namespace)
+            args.push('--namespace', input.namespace);
+        for (const d of input.data ?? [])
+            args.push('--data', d);
+        return this.run(args, signal);
+    }
+    /**
+     * Pull policies from a remote OCI or Git location into a local
+     * directory. Stdout is minimal; errors go to stderr.
+     */
+    async pull(input, signal) {
+        const args = ['pull', input.url];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Push the local policy bundle to a remote OCI registry. Uses
+     * credentials from the host environment (docker login, ORAS, etc.).
+     */
+    async push(input, signal) {
+        const args = ['push', input.repository];
+        if (input.policy)
+            args.push('--policy', input.policy);
+        return this.run(args, signal);
+    }
+    /**
+     * Run `conftest` with the given argv. Tools should prefer the typed
+     * methods above; this is the escape hatch for unusual invocations.
+     */
+    async run(args, signal) {
+        const opts = {
+            args,
+            timeoutMs: this.config.subprocessTimeoutMs,
+        };
+        if (signal !== undefined)
+            opts.signal = signal;
+        return runBinary(this.config.conftestBinary, opts);
+    }
+    // ─── Internal: temp file / directory management ──────────────────────────
+    /**
+     * Create temp assets for inline inputs, run `fn`, then clean up.
+     * Returns whatever `fn` returns.
+     */
+    async withTempAssets(opts, fn) {
+        const temps = [];
+        const paths = {};
+        try {
+            if (opts.inlineConfig !== undefined) {
+                const ext = opts.inlineConfigParser === 'dockerfile'
+                    ? ''
+                    : parserToExt(opts.inlineConfigParser ?? 'yaml');
+                const basename = opts.inlineConfigParser === 'dockerfile' ? 'Dockerfile' : `config${ext}`;
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const tmpDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-'));
+                temps.push(tmpDir);
+                const configPath = join(tmpDir, basename);
+                await writeFile(configPath, opts.inlineConfig, 'utf8');
+                paths.configPath = configPath;
+            }
+            if (opts.inlinePolicy !== undefined) {
+                // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
+                const policyDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-policy-'));
+                temps.push(policyDir);
+                const policyFile = join(policyDir, 'policy.rego');
+                await writeFile(policyFile, opts.inlinePolicy, 'utf8');
+                paths.policyDir = policyDir;
+            }
+            return await fn(paths);
+        }
+        finally {
+            await Promise.all(temps.map((p) => rm(p, { recursive: true, force: true })));
+        }
+    }
+    /**
+     * Replace the temp inline-config path and temp inline-policy directory
+     * path in the stdout JSON with `<inline>` so callers never see
+     * implementation-internal temp paths.
+     *
+     * conftest emits paths inside a JSON array, so each backslash in the
+     * path is JSON-encoded as `\\`. We match the JSON-encoded form of the
+     * path to handle Windows paths correctly (forward slashes need no
+     * special treatment).
+     */
+    sanitizeOutput(result, configPath, policyDir) {
+        if (!configPath && !policyDir)
+            return result;
+        if (!result.stdout)
+            return result;
+        let stdout = result.stdout;
+        if (configPath) {
+            // JSON.stringify encodes backslashes as \\, so match the encoded form.
+            const jsonEncoded = JSON.stringify(configPath).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline>');
+        }
+        if (policyDir) {
+            const jsonEncoded = JSON.stringify(policyDir).slice(1, -1);
+            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+            // Policy dir appears in conftest output as part of file paths.
+            // Replace the full dir prefix so the policy filename is preserved.
+            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline-policy>');
+        }
+        return { ...result, stdout };
+    }
+}
+//# sourceMappingURL=conftest-cli.js.map

package/dist/lib/conftest-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA2F9D,gFAAgF;AAEhF,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,OAAO;IACd,+DAA+D;IAC/D,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAElD,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB;QAC5C,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,GAAG,GACP,IAAI,CAAC,kBAAkB,KAAK,YAAY;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;gBAC1F,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/lib/tool-helpers.d.ts

@@ -30,7 +30,7 @@ import type { ToolEnvelope } from '../types.js';
  * subprocess exited normally (exitCode is a number) so the caller can
  * inspect the result.
  */
-export declare function mapSubprocessFailure(result: SpawnResult, binary: 'opa' | 'regal'): ToolEnvelope<never> | undefined;
+export declare function mapSubprocessFailure(result: SpawnResult, binary: 'opa' | 'regal' | 'conftest'): ToolEnvelope<never> | undefined;
 /**
  * Try to parse `text` as JSON. Returns `undefined` on failure so the
  * caller can fall back to a textual error envelope rather than throwing.

package/dist/lib/tool-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAqC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AACD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GACtB,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CAwBjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CASxB"}
+{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,QAAqC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AACD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,GACnC,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CA+BjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CASxB"}

package/dist/lib/tool-helpers.js

@@ -38,10 +38,16 @@ export function mapSubprocessFailure(result, binary) {
         });
     }
     if (result.exitCode === null) {
-        const code = binary === 'opa' ? 'OPA_BINARY_NOT_FOUND' : 'REGAL_NOT_FOUND';
+        const code = binary === 'opa'
+            ? 'OPA_BINARY_NOT_FOUND'
+            : binary === 'regal'
+                ? 'REGAL_NOT_FOUND'
+                : 'CONFTEST_NOT_FOUND';
         const hint = binary === 'opa'
             ? 'Install OPA (https://www.openpolicyagent.org/docs/latest/) or set OPA_BINARY to the absolute path of the binary.'
-            : 'Install Regal (https://docs.styra.com/regal) or set REGAL_BINARY to the absolute path of the binary.';
+            : binary === 'regal'
+                ? 'Install Regal (https://docs.styra.com/regal) or set REGAL_BINARY to the absolute path of the binary.'
+                : 'Install Conftest (https://www.conftest.dev/) or set CONFTEST_BINARY to the absolute path of the binary.';
         return err(code, `${binary} binary unreachable: ${result.stderr || 'spawn failed'}`, { hint });
     }
     if (result.timedOut) {

package/dist/lib/tool-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAuB;IAEvB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAkB,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC1F,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,sGAAsG,CAAC;QAC7G,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAoC;IAEpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,oBAAoB,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,yGAAyG,CAAC;QAClH,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACvE,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAI/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQ7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBpE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAI/E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAS7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAuBrD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0CvE;AAED;;;;;;;GAOG;AACH,wBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAqBpE"}

package/dist/server.js

@@ -15,6 +15,7 @@ import { formatHelp, formatStartupBanner, formatVersion, parseCliArgs } from './
 import { loadConfig } from './config.js';
 import { SERVER_NAME, SERVER_VERSION } from './constants.js';
 import { initLogger, logger } from './lib/logger.js';
+import { ConftestCli } from './lib/conftest-cli.js';
 import { OpaCli } from './lib/opa-cli.js';
 import { RegalCli } from './lib/regal-cli.js';
 import { registerPrompts } from './prompts/index.js';
@@ -35,7 +36,7 @@ export function buildServer(config) {
         regalBinary: config.regalBinary,
     });
     const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, {
-        instructions: '43 tools split into six categories. rego_* authoring/analysis tools use the local opa binary -- no running OPA server required. rego_lint requires regal (REGAL_BINARY). opa_* server-management tools talk to a live OPA instance via OPA_URL; set OPA_TOKEN if the server requires bearer-token authentication. File-based tools require paths inside OPA_MCP_ALLOWED_PATHS; inline-source tools work without it. Start with rego_check + rego_lint for policy authoring, mcp_server_info to confirm which binaries are reachable.',
+        instructions: '47 tools split into seven categories. rego_* authoring/analysis tools use the local opa binary -- no running OPA server required. rego_lint requires regal (REGAL_BINARY). opa_* server-management tools talk to a live OPA instance via OPA_URL; set OPA_TOKEN if the server requires bearer-token authentication. conftest_* tools use the local conftest binary (CONFTEST_BINARY) to test configuration files (Kubernetes manifests, Terraform plans, Dockerfiles) against Rego policies. File-based tools require paths inside OPA_MCP_ALLOWED_PATHS; inline-source tools work without it. Start with rego_check + rego_lint for policy authoring, conftest_test for configuration file validation, mcp_server_info to confirm which binaries are reachable.',
     });
     registerTools(server, config);
     registerPrompts(server, config);
@@ -56,9 +57,11 @@ export function buildServer(config) {
 export async function runStartupSelfCheck(config) {
     const opa = new OpaCli(config);
     const regal = new RegalCli(config);
-    const [opaVersion, regalVersion] = await Promise.all([
+    const conftest = new ConftestCli(config);
+    const [opaVersion, regalVersion, conftestVersion] = await Promise.all([
         opa.version().catch(() => null),
         regal.version().catch(() => null),
+        conftest.version().catch(() => null),
     ]);
     if (opaVersion === null) {
         logger.warn('startup self-check: opa binary not reachable; rego_* tools will fail', {
@@ -78,6 +81,15 @@ export async function runStartupSelfCheck(config) {
     else {
         logger.info('startup self-check: regal OK', { version: regalVersion });
     }
+    if (conftestVersion === null) {
+        logger.warn('startup self-check: conftest binary not reachable; conftest_* tools will return CONFTEST_NOT_FOUND', {
+            conftestBinary: config.conftestBinary,
+            hint: 'set CONFTEST_BINARY to an absolute path, or ensure conftest is on PATH. Conftest is optional; only conftest_* tools require it.',
+        });
+    }
+    else {
+        logger.info('startup self-check: conftest OK', { version: conftestVersion });
+    }
 }
 /**
  * Entry-point flow: load config from env, build the server, connect

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,sgBAAsgB;KACzgB,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,OAAO,CAAC,CAAC,CAAE,qCAAqC,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAGjF,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExF,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;QACpC,OAAO,EAAE,cAAc;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,EAC9C;QACE,YAAY,EACV,kuBAAkuB;KACruB,CACF,CAAC;IAEF,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpE,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACjC,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;YAClF,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,6LAA6L;SACpM,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,uFAAuF,EACvF;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kHAAkH;SACzH,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,oGAAoG,EACpG;YACE,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,IAAI,EAAE,iIAAiI;SACxI,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,SAAqB;IAC9C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,wEAAwE;IACxE,+CAA+C;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,IAAI,IAAI,oBAAoB,EAAE,CAAC;IAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAE1D,iEAAiE;IACjE,KAAK,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACxD,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,OAAO,CAAC,CAAC,CAAE,qCAAqC,CAC3E,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/authoring/check-schema.d.ts

@@ -0,0 +1,20 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+interface CheckErrorRecord {
+    message?: string;
+    code?: string;
+    location?: {
+        file?: string;
+        row?: number;
+        col?: number;
+    };
+}
+export interface RegoCheckSchemaOutput {
+    /** Whether the policy passes schema-aware type checking. */
+    valid: boolean;
+    /** Structured diagnostics. Empty when `valid` is true. */
+    errors: CheckErrorRecord[];
+}
+export declare function registerRegoCheckSchema(server: McpServer, config: Config): void;
+export {};
+//# sourceMappingURL=check-schema.d.ts.map

package/dist/tools/authoring/check-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-schema.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/check-schema.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA4C9C,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA8H/E"}

package/dist/tools/authoring/check-schema.js

@@ -0,0 +1,140 @@
+/**
+ * `rego_check_schema` -- validate that a Rego policy's input.* references
+ * are consistent with a JSON Schema.
+ *
+ * Wraps `opa check --schema` to add schema-aware type checking on top of the
+ * standard AST check: every `input.*` field the policy reads must exist in the
+ * provided schema. Fields referenced in the policy but absent from the schema
+ * surface as rego_type_error diagnostics with file/line locations.
+ *
+ * Accepts the schema inline (a JSON Schema object) or as a file path on disk.
+ * Inline schemas are written to a temporary file via mkdtemp (atomic creation)
+ * and cleaned up unconditionally after the subprocess completes.
+ *
+ * Designed to close the loop with rego_infer_input_schema: call
+ * rego_infer_input_schema to derive the schema from policy A, then pass its
+ * output directly as `inlineSchema` here to validate policy B against it.
+ */
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { OpaCli } from '../../lib/opa-cli.js';
+import { err, ok } from '../../lib/errors.js';
+import { mapSubprocessFailure, sanitizeInlinePath, tryParseJson, validatePaths, withToolEnvelope, } from '../../lib/tool-helpers.js';
+const RegoCheckSchemaInput = {
+    source: z
+        .string()
+        .optional()
+        .describe('Inline Rego source to validate against the schema. Mutually exclusive with `paths`.'),
+    paths: z
+        .array(z.string())
+        .optional()
+        .describe('Filesystem paths to policy files or directories to validate. Each path must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `source`.'),
+    inlineSchema: z
+        .record(z.unknown())
+        .optional()
+        .describe('JSON Schema (draft-07) object describing the expected shape of the `input` document. Mutually exclusive with `schemaPath`. Accepts the `schema` field from `rego_infer_input_schema` output directly.'),
+    schemaPath: z
+        .string()
+        .optional()
+        .describe('Path to a JSON Schema file on disk to use for `input` validation. Must be inside an allowed root (OPA_MCP_ALLOWED_PATHS). Mutually exclusive with `inlineSchema`.'),
+    strict: z
+        .boolean()
+        .optional()
+        .describe('Enable strict mode -- also fail on unused variables, deprecated builtins, and other non-fatal issues in addition to schema violations.'),
+};
+export function registerRegoCheckSchema(server, config) {
+    const opa = new OpaCli(config);
+    server.registerTool('rego_check_schema', {
+        title: 'Check Rego against a JSON Schema',
+        description: "Validate that a Rego policy's input.* field references are consistent with a JSON Schema using `opa check --schema`. Every field the policy reads from `input` must exist in the schema; mismatches surface as rego_type_error diagnostics with file/line locations. Returns `{ valid: true, errors: [] }` when all references match the schema, or `{ valid: false, errors: [...] }` with structured diagnostics when they do not. Accepts the schema inline (pass the `schema` output of `rego_infer_input_schema` directly as `inlineSchema`) or as a path to an existing JSON Schema file on disk (`schemaPath`). Provide `source` for inline Rego or `paths` for file/directory checking.",
+        inputSchema: RegoCheckSchemaInput,
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+    }, async ({ source, paths, inlineSchema, schemaPath, strict }, { signal }) => {
+        return withToolEnvelope(config, async () => {
+            // ── Policy input validation ─────────────────────────────────────
+            if (!source && !paths?.length) {
+                return err('INVALID_INPUT', 'rego_check_schema requires either `source` or at least one entry in `paths`.');
+            }
+            if (source && paths?.length) {
+                return err('INVALID_INPUT', 'rego_check_schema does not accept both `source` and `paths` -- pass one or the other.');
+            }
+            // ── Schema input validation ─────────────────────────────────────
+            if (!inlineSchema && !schemaPath) {
+                return err('INVALID_INPUT', 'rego_check_schema requires either `inlineSchema` (a JSON Schema object) or `schemaPath` (a path to a schema file on disk).');
+            }
+            if (inlineSchema && schemaPath) {
+                return err('INVALID_INPUT', 'rego_check_schema does not accept both `inlineSchema` and `schemaPath` -- pass one or the other.');
+            }
+            // ── Policy path resolution ──────────────────────────────────────
+            let resolvedPaths;
+            if (paths?.length) {
+                const validation = validatePaths(paths, config, { mustExist: true });
+                if (!validation.ok)
+                    return validation.error;
+                resolvedPaths = validation.resolved;
+            }
+            // ── Schema path resolution ──────────────────────────────────────
+            let resolvedSchemaFile;
+            if (schemaPath) {
+                const v = validatePaths([schemaPath], config, { mustExist: true });
+                if (!v.ok)
+                    return v.error;
+                resolvedSchemaFile = v.resolved[0];
+            }
+            // ── Inline schema: write to a temp file, clean up unconditionally ─
+            let tempDir;
+            try {
+                if (inlineSchema !== undefined) {
+                    tempDir = await mkdtemp(join(tmpdir(), 'orygn-schema-'));
+                    const schemaFile = join(tempDir, 'schema.json');
+                    await writeFile(schemaFile, JSON.stringify(inlineSchema), 'utf8');
+                    resolvedSchemaFile = schemaFile;
+                }
+                // ── Run opa check ─────────────────────────────────────────────
+                const result = await opa.check({
+                    source,
+                    paths: resolvedPaths,
+                    strict,
+                    schemaDir: resolvedSchemaFile,
+                }, signal);
+                const subprocessFailure = mapSubprocessFailure(result, 'opa');
+                if (subprocessFailure)
+                    return subprocessFailure;
+                if (result.exitCode === 0) {
+                    return ok({ valid: true, errors: [] });
+                }
+                // `opa check --format=json` writes diagnostics to stderr.
+                const parsed = tryParseJson(result.stderr);
+                if (!parsed) {
+                    return err('INVALID_REGO', 'opa check exited non-zero but produced no parseable diagnostics.', { details: { stderr: result.stderr.trim(), stdout: result.stdout.trim() } });
+                }
+                const rawErrors = parsed.errors ?? [];
+                // When source was provided inline, OPA references a temp .rego path in
+                // error locations. Replace those paths with the sentinel <inline> so
+                // callers see a stable, meaningful location instead of an ephemeral path.
+                const errors = source !== undefined
+                    ? rawErrors.map((e) => e.location?.file
+                        ? {
+                            ...e,
+                            location: { ...e.location, file: sanitizeInlinePath(e.location.file) },
+                        }
+                        : e)
+                    : rawErrors;
+                return ok({ valid: false, errors });
+            }
+            finally {
+                if (tempDir !== undefined) {
+                    await rm(tempDir, { recursive: true, force: true });
+                }
+            }
+        });
+    });
+}
+//# sourceMappingURL=check-schema.js.map

package/dist/tools/authoring/check-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-schema.js","sourceRoot":"","sources":["../../../src/tools/authoring/check-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,oBAAoB,GAAG;IAC3B,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,qFAAqF,CACtF;IACH,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CACP,kKAAkK,CACnK;IACH,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACnB,QAAQ,EAAE;SACV,QAAQ,CACP,uMAAuM,CACxM;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,mKAAmK,CACpK;IACH,MAAM,EAAE,CAAC;SACN,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,wIAAwI,CACzI;CACJ,CAAC;AAeF,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,gqBAAgqB;QAClqB,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACxE,OAAO,gBAAgB,CAAwB,MAAM,EAAE,KAAK,IAAI,EAAE;YAChE,mEAAmE;YACnE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,GAAG,CACR,eAAe,EACf,8EAA8E,CAC/E,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,CACR,eAAe,EACf,uFAAuF,CACxF,CAAC;YACJ,CAAC;YAED,mEAAmE;YACnE,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,OAAO,GAAG,CACR,eAAe,EACf,4HAA4H,CAC7H,CAAC;YACJ,CAAC;YACD,IAAI,YAAY,IAAI,UAAU,EAAE,CAAC;gBAC/B,OAAO,GAAG,CACR,eAAe,EACf,kGAAkG,CACnG,CAAC;YACJ,CAAC;YAED,mEAAmE;YACnE,IAAI,aAAmC,CAAC;YACxC,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;gBAClB,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,UAAU,CAAC,EAAE;oBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;gBAC5C,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,CAAC;YAED,mEAAmE;YACnE,IAAI,kBAAsC,CAAC;YAC3C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,OAAO,CAAC,CAAC,KAAK,CAAC;gBAC1B,kBAAkB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YAED,qEAAqE;YACrE,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;oBACzD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBAChD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;oBAClE,kBAAkB,GAAG,UAAU,CAAC;gBAClC,CAAC;gBAED,iEAAiE;gBACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAC5B;oBACE,MAAM;oBACN,KAAK,EAAE,aAAa;oBACpB,MAAM;oBACN,SAAS,EAAE,kBAAkB;iBAC9B,EACD,MAAM,CACP,CAAC;gBAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC9D,IAAI,iBAAiB;oBAAE,OAAO,iBAAiB,CAAC;gBAEhD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,EAAE,CAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChE,CAAC;gBAED,0DAA0D;gBAC1D,MAAM,MAAM,GAAG,YAAY,CAAkC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,GAAG,CACR,cAAc,EACd,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC5E,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACtC,uEAAuE;gBACvE,qEAAqE;gBACrE,0EAA0E;gBAC1E,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;oBAClB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClB,CAAC,CAAC,QAAQ,EAAE,IAAI;wBACd,CAAC,CAAC;4BACE,GAAG,CAAC;4BACJ,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;yBACvE;wBACH,CAAC,CAAC,CAAC,CACN;oBACH,CAAC,CAAC,SAAS,CAAC;gBAEhB,OAAO,EAAE,CAAwB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;oBAAS,CAAC;gBACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/authoring/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAU9C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAS9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAW9C,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAU9E"}

package/dist/tools/authoring/index.js

@@ -1,5 +1,6 @@
 import { registerRegoCapabilities } from './capabilities.js';
 import { registerRegoCheck } from './check.js';
+import { registerRegoCheckSchema } from './check-schema.js';
 import { registerRegoDeps } from './deps.js';
 import { registerRegoFormat } from './format.js';
 import { registerRegoInspect } from './inspect.js';
@@ -9,6 +10,7 @@ import { registerRegoParseAst } from './parse.js';
 export function registerAuthoringTools(server, config) {
     registerRegoFormat(server, config);
     registerRegoCheck(server, config);
+    registerRegoCheckSchema(server, config);
     registerRegoLint(server, config);
     registerRegoParseAst(server, config);
     registerRegoInspect(server, config);

package/dist/tools/authoring/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/authoring/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,MAAc;IACtE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/tools/conftest/index.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export declare function registerConftestTools(server: McpServer, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/conftest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAK7E"}

package/dist/tools/conftest/index.js

@@ -0,0 +1,11 @@
+import { registerConftestPull } from './pull.js';
+import { registerConftestPush } from './push.js';
+import { registerConftestTest } from './test.js';
+import { registerConftestVerify } from './verify.js';
+export function registerConftestTools(server, config) {
+    registerConftestTest(server, config);
+    registerConftestVerify(server, config);
+    registerConftestPull(server, config);
+    registerConftestPush(server, config);
+}
+//# sourceMappingURL=index.js.map

package/dist/tools/conftest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/conftest/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC"}

package/dist/tools/conftest/pull.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Config } from '../../config.js';
+export interface ConftestPullOutput {
+    /** The URL that was pulled. */
+    url: string;
+    /** The local directory where policies were written. */
+    policyDir: string;
+}
+export declare function registerConftestPull(server: McpServer, config: Config): void;
+//# sourceMappingURL=pull.d.ts.map

package/dist/tools/conftest/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../src/tools/conftest/pull.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA0B9C,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsD5E"}