@orygn/opa-mcp 0.4.0 → 0.5.0

package/dist/lib/bundle-signatures.js

@@ -0,0 +1,152 @@
+/**
+ * Helpers for OPA bundle signatures.
+ *
+ * `opa sign` writes `{ "signatures": ["<JWT>"] }` with exactly one JWT. Its
+ * header carries the algorithm and its payload lists every signed file as
+ * `{ name, hash, algorithm }`, plus whatever extra claims (`keyid`, `scope`)
+ * were supplied through a claims file. Reading that summary back is how the
+ * sign tool describes what it just produced, and it is deliberately not a
+ * verification: nothing here checks the signature, only OPA does that.
+ */
+import { readFile } from 'node:fs/promises';
+function base64UrlDecode(segment) {
+    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+    return Buffer.from(padded, 'base64').toString('utf8');
+}
+/**
+ * Read the summary of a `.signatures.json` file. Throws on any shape OPA
+ * would not have written, so a caller never reports a file it cannot read.
+ */
+export async function readSignaturesSummary(path) {
+    const raw = await readFile(path, 'utf8');
+    const parsed = JSON.parse(raw);
+    const sigs = parsed.signatures;
+    if (!Array.isArray(sigs) || sigs.length !== 1 || typeof sigs[0] !== 'string') {
+        throw new Error('expected exactly one JWT in "signatures"');
+    }
+    const parts = sigs[0].split('.');
+    if (parts.length !== 3)
+        throw new Error('signature is not a JWT');
+    const header = JSON.parse(base64UrlDecode(parts[0]));
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    if (typeof header.alg !== 'string')
+        throw new Error('JWT header has no alg');
+    if (!Array.isArray(payload.files))
+        throw new Error('JWT payload has no files array');
+    const summary = {
+        algorithm: header.alg,
+        filesSigned: payload.files.length,
+    };
+    if (typeof payload.keyid === 'string')
+        summary.keyId = payload.keyid;
+    if (typeof payload.scope === 'string')
+        summary.scope = payload.scope;
+    return summary;
+}
+/**
+ * `opa sign` and `opa build` both print these when the key file is not a PEM
+ * key or the algorithm is not one OPA knows. They are the caller's input, not
+ * the bundle, so the tools report them as INVALID_INPUT.
+ */
+const KEY_OR_ALGORITHM_ERROR = /failed to parse PEM block|unknown signature algorithm/i;
+export function isKeyOrAlgorithmError(output) {
+    return KEY_OR_ALGORITHM_ERROR.test(output);
+}
+/**
+ * Each pattern is text OPA 1.19 prints, on stdout, for that failure.
+ *
+ * The order follows what OPA does while loading a signed bundle: it reads the
+ * key and algorithm, checks the JWT against the key, compares the scope claim,
+ * then reads every file. A Rego file is hashed as written, so its digest is
+ * compared before it is parsed. A data file or `.manifest` is hashed by parsed
+ * value, so one that no longer parses fails BEFORE its digest is compared;
+ * that is why an unparseable data file is `file_unparseable` (possibly
+ * modified) and not a load error of signed content. Rego parse errors come
+ * last, after the signature and every digest passed. Where messages overlap,
+ * the more specific rule is listed first.
+ */
+const FAILURE_RULES = [
+    {
+        reason: 'key_invalid',
+        pattern: KEY_OR_ALGORITHM_ERROR,
+        summary: 'the verification key or algorithm could not be used',
+        hint: 'verificationKey must be a PEM public key, and signingAlg one OPA supports. For an HMAC-signed bundle pass signingAlg (HS256, HS384 or HS512) so the file is read as the secret rather than as PEM.',
+    },
+    {
+        reason: 'not_a_bundle',
+        pattern: /archive read failed|bundle read failed/i,
+        summary: 'the path is not a bundle directory or a .tar.gz archive',
+    },
+    {
+        reason: 'signature_invalid',
+        pattern: /failed to verify JWT signature|verification error/i,
+        summary: 'the signature does not verify with this key',
+        hint: 'Check the key and pass signingAlg matching how the bundle was signed. OPA verifies against the single key given regardless of the signature keyid claim, so this is the key or the algorithm, not the key id.',
+    },
+    {
+        reason: 'scope_mismatch',
+        pattern: /scope mismatch/i,
+        summary: 'the scope given does not match the scope claim in the signature',
+        hint: 'Pass scope with exactly the value the bundle was signed with, and no scope if it was signed without one.',
+    },
+    {
+        reason: 'file_modified',
+        pattern: /digest mismatch/i,
+        summary: 'a signed file was modified after signing',
+    },
+    {
+        reason: 'file_missing',
+        pattern: /specified in bundle signatures but not found/i,
+        summary: 'a file the signature covers is missing from the bundle',
+    },
+    {
+        reason: 'file_added',
+        pattern: /not included in bundle signature/i,
+        summary: 'the bundle contains a file the signature does not cover',
+        hint: 'A directory signature names files under the directory name given to opa, so this is also what a directory reports when verified under a different name than it was signed with. Moving it elsewhere under the same name is fine; renaming it is not. For an artifact that survives renaming, build a signed archive with opa_bundle_build.',
+    },
+    {
+        reason: 'unsigned',
+        pattern: /missing \.signatures\.json/i,
+        summary: 'the bundle has no .signatures.json',
+    },
+    {
+        reason: 'signatures_malformed',
+        pattern: /signatures decode|missing JWT|base64 decode JWT|split compact JWT|unexpected end of JSON input|\.signatures\.json/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+    {
+        reason: 'file_unparseable',
+        pattern: /yaml:/i,
+        summary: 'a data file or .manifest could not be parsed, so its digest was never compared',
+        hint: 'OPA hashes data files by parsed value and stops at the first one it cannot parse, before comparing digests. The file may have been modified after signing. Restore it, or fix it and sign again.',
+    },
+    {
+        reason: 'bundle_load_error',
+        pattern: /rego_\w+_error|errors? occurred|manifest roots/i,
+        summary: 'the bundle could not be loaded, so verification did not complete',
+        hint: 'OPA parses Rego after the signature and every digest passed, so the policy is signed and unmodified but does not load under Rego v1. A policy written for Rego v0 verifies with v0Compatible.',
+    },
+    {
+        // A JWT payload that decodes but is not JSON: OPA prints only the JSON
+        // error, with none of the prefixes matched above.
+        reason: 'signatures_malformed',
+        pattern: /invalid character/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+];
+/** Classify OPA's stdout+stderr from a failed verification. */
+export function classifyVerificationFailure(output) {
+    for (const rule of FAILURE_RULES) {
+        if (rule.pattern.test(output)) {
+            const { pattern: _pattern, ...failure } = rule;
+            return failure;
+        }
+    }
+    return {
+        reason: 'unknown',
+        summary: 'OPA rejected the bundle for a reason this tool does not recognise',
+    };
+}
+//# sourceMappingURL=bundle-signatures.js.map

package/dist/lib/bundle-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signatures.js","sourceRoot":"","sources":["../../src/lib/bundle-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAIpD,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAErF,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;KAClC,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,wDAAwD,CAAC;AAExF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAA6D;IAC9E;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,qDAAqD;QAC9D,IAAI,EAAE,oMAAoM;KAC3M;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,+MAA+M;KACtN;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,0GAA0G;KACjH;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,4UAA4U;KACnV;IACD;QACE,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EACL,oHAAoH;QACtH,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,gFAAgF;QACzF,IAAI,EAAE,kMAAkM;KACzM;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,+LAA+L;KACtM;IACD;QACE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mEAAmE;KAC7E,CAAC;AACJ,CAAC"}

package/dist/lib/child-env.d.ts

@@ -10,7 +10,13 @@
  * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
  * their client config, and whatever else the operator's shell happens to hold.
  *
- * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
  * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
  * and `build` all succeed with a completely empty environment, so the entries
  * below exist for correctness in real-world setups (proxies, custom CA bundles,
@@ -25,7 +31,8 @@
  *
  * @param extra   Variables the calling command needs. Readable by evaluated
  *                policy like everything else here, so pass secrets only when the
- *                command actually requires them.
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
  * @param source  Environment to read from. Injectable for testing.
  */
 export declare function buildChildEnv(extra?: Record<string, string>, source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/lib/child-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA0GH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAanB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA0HH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAyBnB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}

package/dist/lib/child-env.js

@@ -10,7 +10,13 @@
  * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
  * their client config, and whatever else the operator's shell happens to hold.
  *
- * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
  * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
  * and `build` all succeed with a completely empty environment, so the entries
  * below exist for correctness in real-world setups (proxies, custom CA bundles,
@@ -77,9 +83,8 @@ const TOOL_CONFIG = [
     'REGISTRY_AUTH_FILE',
 ];
 const ALLOWED = [...COMMON, ...POSIX, ...WINDOWS, ...NETWORK, ...TOOL_CONFIG];
-/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
-function passthroughNames(source) {
-    const raw = source['OPA_MCP_PASSTHROUGH_ENV'];
+/** Split a comma or semicolon separated list of variable names. */
+function nameList(raw) {
     if (!raw)
         return [];
     return raw
@@ -87,6 +92,21 @@ function passthroughNames(source) {
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
 }
+/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
+function passthroughNames(source) {
+    return nameList(source['OPA_MCP_PASSTHROUGH_ENV']);
+}
+/**
+ * Names an operator withheld via OPA_MCP_BLOCK_ENV.
+ *
+ * Applied last, so it overrides the allow-list, the passthrough list and the
+ * caller's own `extra`. The point is to be able to say no to something this
+ * module would otherwise hand down, and a rule that could be overridden by the
+ * thing it is meant to restrain would not be worth having.
+ */
+function blockedNames(source) {
+    return nameList(source['OPA_MCP_BLOCK_ENV']);
+}
 /**
  * Windows treats variable names case-insensitively, and the casing in
  * `process.env` follows whatever the parent used, so an exact-key lookup would
@@ -123,7 +143,8 @@ const WINDOWS_IDENTITY_TO_BLANK = ['USERNAME', 'USERDOMAIN', 'LOGONSERVER'];
  *
  * @param extra   Variables the calling command needs. Readable by evaluated
  *                policy like everything else here, so pass secrets only when the
- *                command actually requires them.
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
  * @param source  Environment to read from. Injectable for testing.
  */
 export function buildChildEnv(extra, source = process.env) {
@@ -137,7 +158,18 @@ export function buildChildEnv(extra, source = process.env) {
         if (value !== undefined)
             env[name] = value;
     }
-    return extra ? { ...env, ...extra } : env;
+    const result = extra ? { ...env, ...extra } : env;
+    for (const name of blockedNames(source)) {
+        delete result[name];
+        if (process.platform === 'win32') {
+            const wanted = name.toLowerCase();
+            for (const key of Object.keys(result)) {
+                if (key.toLowerCase() === wanted)
+                    delete result[key];
+            }
+        }
+    }
+    return result;
 }
 /** Exposed for tests and for documenting the surface. */
 export const ALLOWED_CHILD_ENV_VARS = ALLOWED;

package/dist/lib/child-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,OAAO,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAAyB;IAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}

package/dist/lib/conftest-cli.d.ts

@@ -20,8 +20,20 @@ export interface ConftestFileResult {
     failures: ConftestMessage[];
     warnings: ConftestMessage[];
     skipped: ConftestMessage[];
-    exceptions: string[];
+    exceptions: ConftestMessage[];
 }
+/**
+ * Parse `--output=json` from `conftest test` or `conftest verify` into
+ * results whose array fields are always present.
+ *
+ * conftest marks every array `omitempty`, so a file that passes cleanly
+ * arrives as `{filename, namespace, successes}` with no `failures` key at
+ * all, and `verify` with no test rules prints the literal `null`. Reading
+ * `.failures.length` off that threw on every clean run. Returns null when
+ * stdout is not a JSON array (or `null`), which is what a command-level
+ * failure looks like.
+ */
+export declare function parseConftestResults(stdout: string): ConftestFileResult[] | null;
 /** Input for `conftest test`. */
 export interface ConftestTestInput {
     /** Absolute paths to configuration files to evaluate. */
@@ -30,10 +42,10 @@ export interface ConftestTestInput {
     inlineConfig?: string;
     /**
      * Parser used for inline config content. Determines the temp file
-     * extension (yaml → .yaml, json → .json, dockerfile → Dockerfile, etc.).
+     * name (yaml -> config.yaml, dockerfile -> Dockerfile, and so on).
      * Defaults to `yaml` when not specified.
      */
-    inlineConfigParser?: string;
+    inlineConfigParser?: ConftestParser;
     /**
      * Absolute path to a directory or file containing Rego policies.
      * Defaults to `./policy` (conftest's convention). Mutually exclusive
@@ -60,7 +72,7 @@ export interface ConftestTestInput {
      * flag, overriding extension-based detection. Use it to parse files whose
      * extension does not match their format (e.g. a `.tfstate` file as `json`).
      */
-    parser?: string;
+    parser?: ConftestParser;
 }
 /** Input for `conftest verify`. */
 export interface ConftestVerifyInput {
@@ -86,12 +98,15 @@ export interface ConftestPushInput {
     policy?: string;
 }
 /**
- * Wrapper around the local `conftest` binary.
- *
- * Methods do not throw on conftest-side errors -- the exit code on the
- * returned `SpawnResult` is the signal. Inline source is written to temp
- * files/directories because conftest does not read from stdin.
+ * The parsers conftest 0.69 accepts for `--parser`, and the only values a
+ * caller may pass. The name also chooses the temp file name for inline
+ * config, so it must never be free text: a value carrying path separators
+ * used to be joined straight into the temp path, and `../` sequences in it
+ * walked out of the temp directory to wherever the caller pointed.
  */
+export declare const CONFTEST_PARSERS: readonly ["cue", "dockerfile", "dotenv", "edn", "hcl1", "hcl2", "hocon", "ignore", "ini", "json", "jsonnet", "nginx", "properties", "spdx", "textproto", "toml", "vcl", "xml", "yaml"];
+export type ConftestParser = (typeof CONFTEST_PARSERS)[number];
+export declare function isConftestParser(value: string): value is ConftestParser;
 export declare class ConftestCli {
     private readonly config;
     constructor(config: Config);
@@ -129,7 +144,7 @@ export declare class ConftestCli {
      * Run `conftest` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch for unusual invocations.
      */
-    run(args: string[], signal?: AbortSignal): Promise<SpawnResult>;
+    run(args: string[], signal?: AbortSignal, cwd?: string): Promise<SpawnResult>;
     /**
      * Create temp assets for inline inputs, run `fn`, then clean up.
      * Returns whatever `fn` returns.

package/dist/lib/conftest-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrE;;;OAGG;YACW,cAAc;IAyC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}
+{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,IAAI,CA8BhF;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,wLAoBnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AA0ED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IA4ChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAanF;;;OAGG;YACW,cAAc;IAqC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}

package/dist/lib/conftest-cli.js

@@ -16,28 +16,120 @@
  */
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 import { runBinary } from './subprocess.js';
-// ─── Parser → file extension map ─────────────────────────────────────────────
-const PARSER_TO_EXT = {
-    yaml: '.yaml',
-    json: '.json',
-    toml: '.toml',
-    hcl1: '.hcl',
-    hcl2: '.hcl',
-    ini: '.ini',
-    xml: '.xml',
-    dotenv: '.env',
-    cue: '.cue',
-    jsonnet: '.jsonnet',
-    properties: '.properties',
-    edn: '.edn',
-    hocon: '.conf',
-    // Dockerfile is a special case -- conftest detects by filename
-    dockerfile: '',
+/**
+ * Parse `--output=json` from `conftest test` or `conftest verify` into
+ * results whose array fields are always present.
+ *
+ * conftest marks every array `omitempty`, so a file that passes cleanly
+ * arrives as `{filename, namespace, successes}` with no `failures` key at
+ * all, and `verify` with no test rules prints the literal `null`. Reading
+ * `.failures.length` off that threw on every clean run. Returns null when
+ * stdout is not a JSON array (or `null`), which is what a command-level
+ * failure looks like.
+ */
+export function parseConftestResults(stdout) {
+    const text = stdout.trim();
+    if (text === '')
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null)
+        return [];
+    if (!Array.isArray(parsed))
+        return null;
+    const messages = (v) => Array.isArray(v)
+        ? v.map((m) => m !== null && typeof m === 'object' ? m : { msg: String(m) })
+        : [];
+    return parsed.map((item) => {
+        const r = (item !== null && typeof item === 'object' ? item : {});
+        return {
+            ...r,
+            filename: typeof r['filename'] === 'string' ? r['filename'] : '',
+            namespace: typeof r['namespace'] === 'string' ? r['namespace'] : '',
+            successes: typeof r['successes'] === 'number' ? r['successes'] : 0,
+            failures: messages(r['failures']),
+            warnings: messages(r['warnings']),
+            skipped: messages(r['skipped']),
+            exceptions: messages(r['exceptions']),
+        };
+    });
+}
+// ─── Parser names ─────────────────────────────────────────────────────────────
+/**
+ * The parsers conftest 0.69 accepts for `--parser`, and the only values a
+ * caller may pass. The name also chooses the temp file name for inline
+ * config, so it must never be free text: a value carrying path separators
+ * used to be joined straight into the temp path, and `../` sequences in it
+ * walked out of the temp directory to wherever the caller pointed.
+ */
+export const CONFTEST_PARSERS = [
+    'cue',
+    'dockerfile',
+    'dotenv',
+    'edn',
+    'hcl1',
+    'hcl2',
+    'hocon',
+    'ignore',
+    'ini',
+    'json',
+    'jsonnet',
+    'nginx',
+    'properties',
+    'spdx',
+    'textproto',
+    'toml',
+    'vcl',
+    'xml',
+    'yaml',
+];
+export function isConftestParser(value) {
+    return CONFTEST_PARSERS.includes(value);
+}
+/**
+ * Temp file names for inline config. The parser is passed to conftest
+ * explicitly, so the name only has to be plausible for a reader of the
+ * output; conftest also recognises a Dockerfile by name.
+ */
+const INLINE_CONFIG_FILENAME = {
+    cue: 'config.cue',
+    dockerfile: 'Dockerfile',
+    dotenv: 'config.env',
+    edn: 'config.edn',
+    hcl1: 'config.hcl',
+    hcl2: 'config.hcl',
+    hocon: 'config.conf',
+    ignore: '.gitignore',
+    ini: 'config.ini',
+    json: 'config.json',
+    jsonnet: 'config.jsonnet',
+    nginx: 'nginx.conf',
+    properties: 'config.properties',
+    spdx: 'config.spdx',
+    textproto: 'config.textproto',
+    toml: 'config.toml',
+    vcl: 'config.vcl',
+    xml: 'config.xml',
+    yaml: 'config.yaml',
 };
-function parserToExt(parser) {
-    return PARSER_TO_EXT[parser.toLowerCase()] ?? `.${parser.toLowerCase()}`;
+/**
+ * Temp file name for inline config. Throws on anything outside the closed
+ * set; the tool layer rejects such input first, so this is the backstop for
+ * any other caller.
+ */
+function inlineConfigFilename(parser) {
+    const name = parser ?? 'yaml';
+    if (!isConftestParser(name)) {
+        throw new Error(`unsupported conftest parser: ${name}`);
+    }
+    return INLINE_CONFIG_FILENAME[name];
 }
 // ─── ConftestCli ──────────────────────────────────────────────────────────────
 /**
@@ -47,6 +139,28 @@ function parserToExt(parser) {
  * returned `SpawnResult` is the signal. Inline source is written to temp
  * files/directories because conftest does not read from stdin.
  */
+/**
+ * Split a policy directory into the directory to run from and the name to pass.
+ *
+ * `conftest pull` and `conftest push` resolve `--policy` against the working
+ * directory rather than treating an absolute path as absolute. On Windows pull
+ * fails outright, reporting a path of the form `.\\C:\\...`, and push drops the
+ * volume and reads from the same path on whichever drive it was started on. The
+ * tools resolve the caller's path against the allow-list before handing it over,
+ * so it is always absolute and neither command ever addressed the directory
+ * asked for. Running from the parent and passing the final component is
+ * unambiguous on every platform.
+ */
+function relativeToParent(policy) {
+    if (!policy)
+        return undefined;
+    const parent = dirname(policy);
+    const name = basename(policy);
+    // A root such as `C:\\` or `/` has nothing to descend into.
+    if (name.length === 0 || parent === policy)
+        return undefined;
+    return { parent, name };
+}
 export class ConftestCli {
     config;
     constructor(config) {
@@ -100,8 +214,12 @@ export class ConftestCli {
                 args.push('--combine');
             if (input.failOnWarn)
                 args.push('--fail-on-warn');
-            if (input.parser)
-                args.push('--parser', input.parser);
+            // conftest's --parser overrides extension detection, so inline
+            // config names its parser explicitly rather than trusting the temp
+            // file's extension. A global `parser` wins when both are given.
+            const parser = input.parser ?? (configPath ? (input.inlineConfigParser ?? 'yaml') : undefined);
+            if (parser)
+                args.push('--parser', parser);
             // Config files (positional args, must come last)
             const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
             args.push(...effectiveFiles);
@@ -129,9 +247,10 @@ export class ConftestCli {
      */
     async pull(input, signal) {
         const args = ['pull', input.url];
-        if (input.policy)
-            args.push('--policy', input.policy);
-        return this.run(args, signal);
+        const target = relativeToParent(input.policy);
+        if (target)
+            args.push('--policy', target.name);
+        return this.run(args, signal, target?.parent);
     }
     /**
      * Push the local policy bundle to a remote OCI registry. Uses
@@ -139,15 +258,16 @@ export class ConftestCli {
      */
     async push(input, signal) {
         const args = ['push', input.repository];
-        if (input.policy)
-            args.push('--policy', input.policy);
-        return this.run(args, signal);
+        const target = relativeToParent(input.policy);
+        if (target)
+            args.push('--policy', target.name);
+        return this.run(args, signal, target?.parent);
     }
     /**
      * Run `conftest` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch for unusual invocations.
      */
-    async run(args, signal) {
+    async run(args, signal, cwd) {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
@@ -155,6 +275,8 @@ export class ConftestCli {
         };
         if (signal !== undefined)
             opts.signal = signal;
+        if (cwd !== undefined)
+            opts.cwd = cwd;
         return runBinary(this.config.conftestBinary, opts);
     }
     // ─── Internal: temp file / directory management ──────────────────────────
@@ -167,10 +289,7 @@ export class ConftestCli {
         const paths = {};
         try {
             if (opts.inlineConfig !== undefined) {
-                const ext = opts.inlineConfigParser === 'dockerfile'
-                    ? ''
-                    : parserToExt(opts.inlineConfigParser ?? 'yaml');
-                const basename = opts.inlineConfigParser === 'dockerfile' ? 'Dockerfile' : `config${ext}`;
+                const basename = inlineConfigFilename(opts.inlineConfigParser);
                 // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
                 const tmpDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-'));
                 temps.push(tmpDir);