@orygn/opa-mcp 0.3.0 → 0.5.0

package/dist/tools/server-management/data.js

@@ -3,17 +3,26 @@
  */
 import { z } from 'zod';
 import { OpaClient } from '../../lib/opa-client.js';
-import { ok } from '../../lib/errors.js';
+import { err, ok } from '../../lib/errors.js';
 import { coerceJsonArg } from '../../lib/json-coerce.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
-import { mapOpaClientError, parseOpaDataPath } from './_shared.js';
+import { mapOpaClientError, OPA_DATA_ROOT, parseOpaDataPath } from './_shared.js';
 export function registerDataTools(server, config) {
     const opa = new OpaClient(config);
     server.registerTool('opa_get_data', {
         title: 'Read data from OPA',
-        description: "Read a path from OPA's data hierarchy. The `path` argument may be in dotted form (`users.alice`) or slash form (`users/alice`).",
+        description: "Read a path from OPA's data hierarchy. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both.",
         inputSchema: {
-            path: z.string().min(1).describe('Data path under `data.`, e.g. "users" or "users/alice".'),
+            path: z
+                .string()
+                .min(1)
+                .optional()
+                .describe('Data path under `data.`, e.g. "users" or "users/alice".'),
+            segments: z
+                .array(z.string().min(1))
+                .min(1)
+                .optional()
+                .describe('Path as literal key segments, e.g. ["labels", "app.kubernetes.io/name"]. Use instead of `path` when a key contains a dot or a slash.'),
         },
         annotations: {
             readOnlyHint: true,
@@ -21,9 +30,16 @@ export function registerDataTools(server, config) {
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async ({ path }, { signal }) => {
+    }, async ({ path, segments }, { signal }) => {
         return withToolEnvelope(config, async () => {
-            const parsed = parseOpaDataPath(path);
+            const target = segments ?? path;
+            if (target === undefined) {
+                return err('INVALID_INPUT', 'Supply either `path` or `segments`.');
+            }
+            if (path !== undefined && segments !== undefined) {
+                return err('INVALID_INPUT', 'Supply `path` or `segments`, not both.');
+            }
+            const parsed = parseOpaDataPath(target);
             if (!parsed.ok)
                 return parsed.error;
             try {
@@ -41,9 +57,14 @@ export function registerDataTools(server, config) {
     });
     server.registerTool('opa_put_data', {
         title: 'Write data to OPA',
-        description: 'Write or replace a value at the given data path. Body is sent as JSON.',
+        description: 'Write or replace a value at the given data path. Body is sent as JSON. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both.',
         inputSchema: {
-            path: z.string().min(1).describe('Data path to write to.'),
+            path: z.string().min(1).optional().describe('Data path to write to.'),
+            segments: z
+                .array(z.string().min(1))
+                .min(1)
+                .optional()
+                .describe('Path as literal key segments, e.g. ["labels", "app.kubernetes.io/name"]. Use instead of `path` when a key contains a dot or a slash.'),
             value: z.unknown().describe('JSON value to store at this path.'),
         },
         annotations: {
@@ -52,9 +73,16 @@ export function registerDataTools(server, config) {
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async ({ path, value }, { signal }) => {
+    }, async ({ path, segments, value }, { signal }) => {
         return withToolEnvelope(config, async () => {
-            const parsed = parseOpaDataPath(path);
+            const target = segments ?? path;
+            if (target === undefined) {
+                return err('INVALID_INPUT', 'Supply either `path` or `segments`.');
+            }
+            if (path !== undefined && segments !== undefined) {
+                return err('INVALID_INPUT', 'Supply `path` or `segments`, not both.');
+            }
+            const parsed = parseOpaDataPath(target);
             if (!parsed.ok)
                 return parsed.error;
             try {
@@ -64,7 +92,11 @@ export function registerDataTools(server, config) {
                     body: coerceJsonArg(value),
                     signal,
                 });
-                return ok({ path, written: true });
+                return ok({
+                    path: path ?? parsed.segments.join('/'),
+                    segments: parsed.segments,
+                    written: true,
+                });
             }
             catch (e) {
                 return mapOpaClientError(e);
@@ -73,9 +105,14 @@ export function registerDataTools(server, config) {
     });
     server.registerTool('opa_patch_data', {
         title: 'Patch data on OPA',
-        description: 'Apply a JSON Patch (RFC 6902) to the data document. Each operation is `{ op, path, value? }`.',
+        description: 'Apply a JSON Patch (RFC 6902) to the data document. Each operation is `{ op, path, value? }`. Omit both `path` and `segments` to patch the root of the data hierarchy, which is how a whole new top-level document is added.',
         inputSchema: {
-            path: z.string().min(1).describe('Data path the patch is applied to. Use "" for the root.'),
+            path: z.string().min(1).optional().describe('Data path the patch is applied to.'),
+            segments: z
+                .array(z.string().min(1))
+                .min(1)
+                .optional()
+                .describe('Path as literal key segments, e.g. ["labels", "app.kubernetes.io/name"]. Use instead of `path` when a key contains a dot or a slash.'),
             operations: z
                 .array(z.object({
                 op: z.enum(['add', 'remove', 'replace']),
@@ -91,20 +128,31 @@ export function registerDataTools(server, config) {
             idempotentHint: false,
             openWorldHint: true,
         },
-    }, async ({ path, operations }, { signal }) => {
+    }, async ({ path, segments, operations }, { signal }) => {
         return withToolEnvelope(config, async () => {
-            const parsed = parseOpaDataPath(path);
-            if (!parsed.ok)
-                return parsed.error;
+            const target = segments ?? path;
+            if (path !== undefined && segments !== undefined) {
+                return err('INVALID_INPUT', 'Supply `path` or `segments`, not both.');
+            }
+            // Neither given addresses the root, which OPA accepts for PATCH alone.
+            let apiPath = OPA_DATA_ROOT;
+            let addressed = [];
+            if (target !== undefined) {
+                const parsed = parseOpaDataPath(target);
+                if (!parsed.ok)
+                    return parsed.error;
+                apiPath = parsed.apiPath;
+                addressed = parsed.segments;
+            }
             try {
                 await opa.request({
                     method: 'PATCH',
-                    path: parsed.apiPath,
+                    path: apiPath,
                     body: operations.map((op) => op.value !== undefined ? { ...op, value: coerceJsonArg(op.value) } : op),
                     headers: { 'Content-Type': 'application/json-patch+json' },
                     signal,
                 });
-                return ok({ path, patched: true });
+                return ok({ path: path ?? addressed.join('/'), segments: addressed, patched: true });
             }
             catch (e) {
                 return mapOpaClientError(e, 'DATA_NOT_FOUND');
@@ -113,12 +161,18 @@ export function registerDataTools(server, config) {
     });
     server.registerTool('opa_delete_data', {
         title: 'Delete a data document from OPA',
-        description: "Remove a document from OPA's data store at the given path. The path may be in dotted form (`users.alice`) or slash form (`users/alice`). OPA responds with 204 No Content on success; if no document exists at the path, OPA returns 404 which is mapped to `DATA_NOT_FOUND`. Root-path deletion (`/v1/data/` itself) is intentionally excluded -- supply at least one path segment.",
+        description: "Remove a document from OPA's data store at the given path. A `path` is read as dotted (`users.alice`) unless it contains a slash, in which case slash is the only separator (`users/alice`), so a key such as `example.com` is addressable as `hosts/example.com`. Pass `segments` instead when a key contains both. OPA responds with 204 No Content on success; if no document exists at the path, OPA returns 404 which is mapped to `DATA_NOT_FOUND`. Root-path deletion (`/v1/data/` itself) is intentionally excluded -- supply at least one path segment.",
         inputSchema: {
             path: z
                 .string()
                 .min(1)
+                .optional()
                 .describe('Data path to delete, e.g. "users.alice" or "users/alice". Must be at least one segment deep.'),
+            segments: z
+                .array(z.string().min(1))
+                .min(1)
+                .optional()
+                .describe('Path as literal key segments, e.g. ["labels", "app.kubernetes.io/name"]. Use instead of `path` when a key contains a dot or a slash.'),
         },
         annotations: {
             readOnlyHint: false,
@@ -126,9 +180,16 @@ export function registerDataTools(server, config) {
             idempotentHint: false,
             openWorldHint: true,
         },
-    }, async ({ path }, { signal }) => {
+    }, async ({ path, segments }, { signal }) => {
         return withToolEnvelope(config, async () => {
-            const parsed = parseOpaDataPath(path);
+            const target = segments ?? path;
+            if (target === undefined) {
+                return err('INVALID_INPUT', 'Supply either `path` or `segments`.');
+            }
+            if (path !== undefined && segments !== undefined) {
+                return err('INVALID_INPUT', 'Supply `path` or `segments`, not both.');
+            }
+            const parsed = parseOpaDataPath(target);
             if (!parsed.ok)
                 return parsed.error;
             try {
@@ -137,7 +198,11 @@ export function registerDataTools(server, config) {
                     path: parsed.apiPath,
                     signal,
                 });
-                return ok({ path, deleted: true });
+                return ok({
+                    path: path ?? parsed.segments.join('/'),
+                    segments: parsed.segments,
+                    deleted: true,
+                });
             }
             catch (e) {
                 return mapOpaClientError(e, 'DATA_NOT_FOUND');

package/dist/tools/server-management/data.js.map

@@ -1 +1 @@
-{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/tools/server-management/data.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,iIAAiI;QACnI,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;SAC5F;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAC1D,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACpC,OAAO,gBAAgB,CAAqC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;oBAC1B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,+FAA+F;QACjG,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;YAC3F,UAAU,EAAE,CAAC;iBACV,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;gBACP,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;aAC9B,CAAC,CACH;iBACA,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iCAAiC,CAAC;SAC/C;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,OAAO,gBAAgB,CAAqC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CACxE;oBACD,OAAO,EAAE,EAAE,cAAc,EAAE,6BAA6B,EAAE;oBAC1D,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,sXAAsX;QACxX,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CACP,8FAA8F,CAC/F;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7B,OAAO,gBAAgB,CAAqC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../../src/tools/server-management/data.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElF,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,kSAAkS;QACpS,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,yDAAyD,CAAC;YACtE,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,sIAAsI,CACvI;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvC,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,GAAG,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,kUAAkU;QACpU,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACrE,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,sIAAsI,CACvI;YACH,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACjE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC9C,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,GAAG,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC;oBAC1B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,8NAA8N;QAChO,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;YACjF,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,sIAAsI,CACvI;YACH,UAAU,EAAE,CAAC;iBACV,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;gBACP,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;aAC9B,CAAC,CACH;iBACA,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iCAAiC,CAAC;SAC/C;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,GAAG,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,uEAAuE;YACvE,IAAI,OAAO,GAAG,aAAa,CAAC;YAC5B,IAAI,SAAS,GAAa,EAAE,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,MAAM,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;gBACpC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;gBACzB,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC9B,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CACxE;oBACD,OAAO,EAAE,EAAE,cAAc,EAAE,6BAA6B,EAAE;oBAC1D,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,kiBAAkiB;QACpiB,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,8FAA8F,CAC/F;YACH,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,sIAAsI,CACvI;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvC,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,GAAG,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;oBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/decisions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAO9C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAsG7E"}
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAO9C,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqH7E"}

package/dist/tools/server-management/decisions.js

@@ -4,7 +4,7 @@
  */
 import { z } from 'zod';
 import { OpaClient } from '../../lib/opa-client.js';
-import { ok } from '../../lib/errors.js';
+import { err, ok } from '../../lib/errors.js';
 import { coerceJsonArg } from '../../lib/json-coerce.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
 import { mapOpaClientError, parseOpaDataPath } from './_shared.js';
@@ -17,7 +17,13 @@ export function registerDecisionTools(server, config) {
             path: z
                 .string()
                 .min(1)
+                .optional()
                 .describe('Decision path under `data.`, e.g. "rbac/allow" or "rbac.allow".'),
+            segments: z
+                .array(z.string().min(1))
+                .min(1)
+                .optional()
+                .describe('Path as literal key segments, e.g. ["labels", "app.kubernetes.io/name"]. Use instead of `path` when a key contains a dot or a slash.'),
             input: z.unknown().optional().describe('Input document to evaluate against.'),
             explain: z
                 .enum(['notes', 'fails', 'full', 'debug'])
@@ -31,9 +37,16 @@ export function registerDecisionTools(server, config) {
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async ({ path, input, explain, metrics }, { signal }) => {
+    }, async ({ path, segments, input, explain, metrics }, { signal }) => {
         return withToolEnvelope(config, async () => {
-            const parsed = parseOpaDataPath(path);
+            const target = segments ?? path;
+            if (target === undefined) {
+                return err('INVALID_INPUT', 'Supply either `path` or `segments`.');
+            }
+            if (path !== undefined && segments !== undefined) {
+                return err('INVALID_INPUT', 'Supply `path` or `segments`, not both.');
+            }
+            const parsed = parseOpaDataPath(target);
             if (!parsed.ok)
                 return parsed.error;
             try {

package/dist/tools/server-management/decisions.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,8MAA8M;QAChN,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAC7E,OAAO,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;iBACzC,QAAQ,EAAE;iBACV,QAAQ,CAAC,yCAAyC,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;SAC7E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACtD,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAqC,EAAE,CAAC;gBACnD,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;gBACxC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAI3B;oBACD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAChE,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC3F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC1E,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,gDAAgD,CAAC;SAC9D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/C,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,CAAC;gBAChD,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa;oBACnB,IAAI;oBACJ,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../../src/tools/server-management/decisions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,MAAc;IACrE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,8MAA8M;QAChN,WAAW,EAAE;YACX,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,iEAAiE,CAAC;YAC9E,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,QAAQ,CACP,sIAAsI,CACvI;YACH,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;YAC7E,OAAO,EAAE,CAAC;iBACP,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;iBACzC,QAAQ,EAAE;iBACV,QAAQ,CAAC,yCAAyC,CAAC;YACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;SAC7E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAChE,OAAO,gBAAgB,CACrB,MAAM,EACN,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,GAAG,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAqC,EAAE,CAAC;gBACnD,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;gBACxC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAI3B;oBACD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAChE,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YAC3F,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YAC1E,QAAQ,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;iBACjB,QAAQ,EAAE;iBACV,QAAQ,CAAC,gDAAgD,CAAC;SAC9D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/C,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,CAAC;gBAChD,IAAI,KAAK,KAAK,SAAS;oBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC9D,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,aAAa;oBACnB,IAAI;oBACJ,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/policies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAY9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiI3E"}
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAgC9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA2J3E"}

package/dist/tools/server-management/policies.js

@@ -7,19 +7,46 @@ import { OpaClient } from '../../lib/opa-client.js';
 import { ok } from '../../lib/errors.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
 import { mapOpaClientError } from './_shared.js';
+/**
+ * Drop the parts of a policy record the caller did not ask for.
+ *
+ * OPA answers the policy endpoints with the parsed AST alongside the source,
+ * and the AST is far larger than the text it came from: a 477-byte policy comes
+ * back as a 19 KB response once the envelope is indented. Returning it by
+ * default pushed a list of any real size past the response cap, and the cap's
+ * advice to narrow the scope was unfollowable because the list tool takes no
+ * arguments.
+ */
+function trimPolicy(record, opts) {
+    const trimmed = { id: record.id };
+    if (opts.source && record.raw !== undefined)
+        trimmed.raw = record.raw;
+    if (opts.ast && record.ast !== undefined)
+        trimmed.ast = record.ast;
+    return trimmed;
+}
 export function registerPolicyTools(server, config) {
     const opa = new OpaClient(config);
     server.registerTool('opa_list_policies', {
         title: 'List OPA policies',
-        description: 'List policies registered on the running OPA server. Returns an array of `{ id, raw, ast }` records.',
-        inputSchema: {},
+        description: 'List policies registered on the running OPA server. Returns the policy IDs and a count. Set `includeSource` for the Rego text of every policy, or `includeAst` for the parsed AST of every policy; both are off by default because either one pushes a list of any real size past the response cap.',
+        inputSchema: {
+            includeSource: z
+                .boolean()
+                .optional()
+                .describe("Include each policy's Rego source. Off by default: fetch one policy with `opa_get_policy` rather than every policy at once."),
+            includeAst: z
+                .boolean()
+                .optional()
+                .describe("Include each policy's parsed AST. Off by default; it is roughly forty times the size of the source and will exceed the response cap on all but the smallest servers."),
+        },
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async (_input, { signal }) => {
+    }, async ({ includeSource, includeAst }, { signal }) => {
         return withToolEnvelope(config, async () => {
             try {
                 const data = await opa.request({
@@ -27,7 +54,11 @@ export function registerPolicyTools(server, config) {
                     path: '/v1/policies',
                     signal,
                 });
-                return ok({ policies: data.result ?? [] });
+                const records = data.result ?? [];
+                return ok({
+                    policies: records.map((r) => trimPolicy(r, { source: includeSource === true, ast: includeAst === true })),
+                    count: records.length,
+                });
             }
             catch (e) {
                 return mapOpaClientError(e);
@@ -36,9 +67,13 @@ export function registerPolicyTools(server, config) {
     });
     server.registerTool('opa_get_policy', {
         title: 'Get OPA policy by ID',
-        description: 'Fetch a single policy by ID from the running OPA server.',
+        description: "Fetch a single policy by ID from the running OPA server. Returns the Rego source; the parsed AST is omitted unless asked for, since it is roughly forty times the size of the source it came from. Use `rego_parse_ast` on the source when an AST is what's wanted.",
         inputSchema: {
             id: z.string().min(1).describe('Policy ID, e.g. "rbac" or "policies/auth/main".'),
+            includeAst: z
+                .boolean()
+                .optional()
+                .describe("Include OPA's parsed AST alongside the source. Off by default."),
         },
         annotations: {
             readOnlyHint: true,
@@ -46,7 +81,7 @@ export function registerPolicyTools(server, config) {
             idempotentHint: true,
             openWorldHint: true,
         },
-    }, async ({ id }, { signal }) => {
+    }, async ({ id, includeAst }, { signal }) => {
         return withToolEnvelope(config, async () => {
             try {
                 const data = await opa.request({
@@ -54,7 +89,9 @@ export function registerPolicyTools(server, config) {
                     path: `/v1/policies/${encodeURIComponent(id)}`,
                     signal,
                 });
-                return ok({ policy: data.result });
+                return ok({
+                    policy: trimPolicy(data.result, { source: true, ast: includeAst === true }),
+                });
             }
             catch (e) {
                 return mapOpaClientError(e, 'POLICY_NOT_FOUND');

package/dist/tools/server-management/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,qGAAqG;QACvG,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAkC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAgC;oBAC5D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,0DAA0D;QACvE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;SAClF;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAA8B,MAAM,EAAE,KAAK,IAAI,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAA8B;oBAC1D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;SACnD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,OAAO,gBAAgB,CAAoC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,YAAY;oBAC5B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;SACvD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAmC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC3E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/tools/server-management/policies.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAQjD;;;;;;;;;GASG;AACH,SAAS,UAAU,CACjB,MAAuB,EACvB,IAAuC;IAEvC,MAAM,OAAO,GAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACtE,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACnE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,qSAAqS;QACvS,WAAW,EAAE;YACX,aAAa,EAAE,CAAC;iBACb,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,6HAA6H,CAC9H;YACH,UAAU,EAAE,CAAC;iBACV,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,sKAAsK,CACvK;SACJ;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAClD,OAAO,gBAAgB,CAAiD,MAAM,EAAE,KAAK,IAAI,EAAE;YACzF,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAgC;oBAC5D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM;iBACP,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;oBACR,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1B,UAAU,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,KAAK,IAAI,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC,CAC5E;oBACD,KAAK,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,qQAAqQ;QACvQ,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;YACjF,UAAU,EAAE,CAAC;iBACV,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CAAC,gEAAgE,CAAC;SAC9E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACvC,OAAO,gBAAgB,CAA8B,MAAM,EAAE,KAAK,IAAI,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAA8B;oBAC1D,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC;oBACR,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;iBAC5E,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,mKAAmK;QACrK,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YACjE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;SACnD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,OAAO,gBAAgB,CAAoC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,OAAO,EAAE,MAAM;oBACf,cAAc,EAAE,YAAY;oBAC5B,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;SACvD;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAmC,MAAM,EAAE,KAAK,IAAI,EAAE;YAC3E,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC9C,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/server-management/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6G3E"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAuE9C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAkH3E"}

package/dist/tools/server-management/status.js

@@ -2,15 +2,77 @@
  * Server-status tools: opa_health, opa_status, opa_config.
  */
 import { z } from 'zod';
-import { OpaClient, OpaUnreachableError } from '../../lib/opa-client.js';
-import { err, ok } from '../../lib/errors.js';
+import { OpaClient, OpaHttpError } from '../../lib/opa-client.js';
+import { ok } from '../../lib/errors.js';
 import { withToolEnvelope } from '../../lib/tool-helpers.js';
 import { mapOpaClientError } from './_shared.js';
+/** Stands in for a header value so the header is still visible as configured. */
+const REDACTED = '<redacted by opa-mcp>';
+/** OPA answers an unhealthy check with `{"error": "..."}`; surface that text. */
+function healthReason(e) {
+    const body = e.body;
+    if (typeof body === 'string' && body.trim().length > 0) {
+        try {
+            const parsed = JSON.parse(body);
+            if (typeof parsed.error === 'string')
+                return parsed.error;
+        }
+        catch {
+            return body.trim();
+        }
+        return body.trim();
+    }
+    if (typeof body === 'object' && body !== null) {
+        const parsed = body;
+        if (typeof parsed.error === 'string')
+            return parsed.error;
+    }
+    return undefined;
+}
+/**
+ * Redact the values of `services.*.headers` in an OPA configuration document.
+ *
+ * OPA drops the `credentials` block from `GET /v1/config` but returns `headers`
+ * verbatim, and a header is the ordinary way to put an API key or a bearer token
+ * in an OPA config. Handing those to an agent, which is what these two tools do
+ * with the document, puts a live credential into a transcript. The header names
+ * survive, so the document still answers what the server is configured to send.
+ */
+function redactServiceHeaders(document) {
+    if (typeof document !== 'object' || document === null || Array.isArray(document)) {
+        return document;
+    }
+    const doc = document;
+    const services = doc['services'];
+    if (typeof services !== 'object' || services === null || Array.isArray(services)) {
+        return document;
+    }
+    let touched = false;
+    const redactedServices = {};
+    for (const [name, service] of Object.entries(services)) {
+        if (typeof service !== 'object' || service === null || Array.isArray(service)) {
+            redactedServices[name] = service;
+            continue;
+        }
+        const entry = service;
+        const headers = entry['headers'];
+        if (typeof headers !== 'object' || headers === null || Array.isArray(headers)) {
+            redactedServices[name] = service;
+            continue;
+        }
+        touched = true;
+        redactedServices[name] = {
+            ...entry,
+            headers: Object.fromEntries(Object.keys(headers).map((k) => [k, REDACTED])),
+        };
+    }
+    return touched ? { ...doc, services: redactedServices } : document;
+}
 export function registerStatusTools(server, config) {
     const opa = new OpaClient(config);
     server.registerTool('opa_health', {
         title: 'OPA health check',
-        description: 'Hit the OPA `/health` endpoint. Returns `{ healthy: true }` on 200. Supports `bundles` and `plugins` query flags to require those subsystems to also be healthy.',
+        description: "Hit the OPA `/health` endpoint. A server that answers reports `{ healthy: true }` on 200 and `{ healthy: false }` with OPA's own reason otherwise, so an unactivated bundle is a health result rather than a tool error. `OPA_UNREACHABLE` means the server could not be reached at all. Supports `bundles` and `plugins` query flags to require those subsystems to also be healthy.",
         inputSchema: {
             bundles: z.boolean().optional().describe('Require bundle plugin to be healthy as well.'),
             plugins: z.boolean().optional().describe('Require all plugins to be healthy.'),
@@ -38,13 +100,16 @@ export function registerStatusTools(server, config) {
                 return ok({ healthy: true });
             }
             catch (e) {
-                if (e instanceof OpaUnreachableError) {
-                    return mapOpaClientError(e);
+                // A server that answered is reachable. Reporting an unactivated
+                // bundle as OPA_UNREACHABLE told the caller to go start a server that
+                // was already running, and buried OPA's own reason in a stringified
+                // error. Authentication is its own failure, not a health result, and
+                // so is a server that could not be reached or a cancelled request.
+                if (e instanceof OpaHttpError && e.status !== 401) {
+                    const reason = healthReason(e);
+                    return ok({ healthy: false, ...(reason !== undefined ? { reason } : {}) });
                 }
-                // Any non-2xx counts as unhealthy without raising.
-                return err('OPA_UNREACHABLE', 'OPA reported unhealthy.', {
-                    details: { error: e instanceof Error ? e.message : String(e) },
-                });
+                return mapOpaClientError(e);
             }
         });
     });
@@ -54,7 +119,9 @@ export function registerStatusTools(server, config) {
             'Returns the same underlying document as `opa_config` but presented under a `status` ' +
             'key as a convenience for agents that want to check "what is running" rather than ' +
             '"what was the server configured with". The response includes bundle settings, ' +
-            'decision-log settings, and plugin configuration as OPA reported them at startup.',
+            'decision-log settings, and plugin configuration as OPA reported them at startup. ' +
+            'Service header values are redacted, since OPA returns them verbatim and a header is ' +
+            'the ordinary place to put an API key.',
         inputSchema: {},
         annotations: {
             readOnlyHint: true,
@@ -70,7 +137,7 @@ export function registerStatusTools(server, config) {
                     path: '/v1/config',
                     signal,
                 });
-                return ok({ status: data.result ?? data });
+                return ok({ status: redactServiceHeaders(data.result ?? data) });
             }
             catch (e) {
                 return mapOpaClientError(e);
@@ -79,7 +146,7 @@ export function registerStatusTools(server, config) {
     });
     server.registerTool('opa_config', {
         title: 'OPA configuration',
-        description: 'Return the running OPA server configuration (sanitized -- secrets are not included).',
+        description: 'Return the running OPA server configuration from `GET /v1/config`. OPA drops the `credentials` block but returns `services.*.headers` verbatim, which is the ordinary place to put an API key or a bearer token, so those values are redacted here and the header names kept.',
         inputSchema: {},
         annotations: {
             readOnlyHint: true,
@@ -95,7 +162,7 @@ export function registerStatusTools(server, config) {
                     path: '/v1/config',
                     signal,
                 });
-                return ok({ config: data.result ?? data });
+                return ok({ config: redactServiceHeaders(data.result ?? data) });
             }
             catch (e) {
                 return mapOpaClientError(e);

package/dist/tools/server-management/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,kKAAkK;QACpK,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAC/E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,OAAO,gBAAgB,CAAuB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/D,IAAI,CAAC;gBACH,MAAM,KAAK,GAA4B,EAAE,CAAC;gBAC1C,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,mBAAmB,EAAE,CAAC;oBACrC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBACD,mDAAmD;gBACnD,OAAO,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,EAAE;oBACvD,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,oEAAoE;YACpE,sFAAsF;YACtF,mFAAmF;YACnF,gFAAgF;YAChF,kFAAkF;QACpF,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAuB;oBACnD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,sFAAsF;QACxF,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/tools/server-management/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,iFAAiF;AACjF,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AAEzC,iFAAiF;AACjF,SAAS,YAAY,CAAC,CAAe;IACnC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;YACvD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAA2B,CAAC;QAC3C,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAAiB;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,QAAmC,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IAErD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;QAClF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAkC,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,gBAAgB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YACjC,SAAS;QACX,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,gBAAgB,CAAC,IAAI,CAAC,GAAG;YACvB,GAAG,KAAK;YACR,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;SAC5E,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,uXAAuX;QACzX,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;YACxF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;SAC/E;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,OAAO,gBAAgB,CAAwC,MAAM,EAAE,KAAK,IAAI,EAAE;YAChF,IAAI,CAAC;gBACH,MAAM,KAAK,GAA4B,EAAE,CAAC;gBAC1C,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,IAAI,OAAO;oBAAE,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACrC,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK;oBACL,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,gEAAgE;gBAChE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,oEAAoE;YACpE,sFAAsF;YACtF,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,sFAAsF;YACtF,uCAAuC;QACzC,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAuB;oBACnD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,+QAA+Q;QACjR,WAAW,EAAE,EAAE;QACf,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC3B,OAAO,gBAAgB,CAAsB,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAsB;oBAClD,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,YAAY;oBAClB,MAAM;iBACP,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -2,7 +2,16 @@
  * Shared types used across tools, prompts, and resources.
  */
 /** Standard error codes returned by tools. */
-export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'COVERAGE_BELOW_THRESHOLD' | 'TIMEOUT' | 'CANCELLED' | 'VERIFY_INCONCLUSIVE' | 'Z3_INIT_ERROR' | 'OPA_VERSION_UNSUPPORTED' | 'GITHUB_TOKEN_MISSING' | 'GIST_CREATE_FAILED' | 'UNKNOWN_ERROR';
+/**
+ * Codes a tool can return.
+ *
+ * Four names are reserved and currently unused: REGAL_VERSION_TOO_OLD (no
+ * minimum-version check exists), DEPENDENCY_CONFLICT, VERIFY_INCONCLUSIVE
+ * (rego_verify reports an inconclusive result as a verdict, not an error) and
+ * Z3_INIT_ERROR. They are kept so the union stays stable for consumers, and
+ * are no longer listed in the README as codes a caller can expect.
+ */
+export type ToolErrorCode = 'INVALID_INPUT' | 'OPA_BINARY_NOT_FOUND' | 'REGAL_NOT_FOUND' | 'REGAL_VERSION_TOO_OLD' | 'CONFTEST_NOT_FOUND' | 'INVALID_REGO' | 'INVALID_BUNDLE' | 'EVAL_ERROR' | 'PATH_NOT_ALLOWED' | 'PATH_NOT_FOUND' | 'OPA_UNREACHABLE' | 'OPA_AUTH_FAILED' | 'POLICY_NOT_FOUND' | 'DATA_NOT_FOUND' | 'DEPENDENCY_CONFLICT' | 'NO_TESTS_FOUND' | 'COVERAGE_BELOW_THRESHOLD' | 'OUTPUT_TOO_LARGE' | 'TIMEOUT' | 'CANCELLED' | 'VERIFY_INCONCLUSIVE' | 'Z3_INIT_ERROR' | 'OPA_VERSION_UNSUPPORTED' | 'GITHUB_TOKEN_MISSING' | 'GIST_CREATE_FAILED' | 'UNKNOWN_ERROR';
 /** Structured error payload. */
 export interface ToolError {
     code: ToolErrorCode;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,0BAA0B,GAC1B,SAAS,GACT,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,GACtB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,8CAA8C;AAC9C;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,sBAAsB,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,kBAAkB,GAClB,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,0BAA0B,GAC1B,kBAAkB,GAClB,SAAS,GACT,WAAW,GACX,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,sBAAsB,GACtB,oBAAoB,GACpB,eAAe,CAAC;AAEpB,gCAAgC;AAChC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB"}