@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/lib/subprocess.js

@@ -25,6 +25,61 @@ import { buildChildEnv } from './child-env.js';
  * OPA_MCP_MAX_SUBPROCESS_BYTES.
  */
 export const DEFAULT_MAX_OUTPUT_BYTES = 32 * 1024 * 1024;
+/**
+ * How long to wait for the stdio pipes to close once the child has exited.
+ *
+ * The child's own output is complete at 'exit'; 'close' follows when every
+ * holder of the pipes is gone. A grandchild that inherited them, which is the
+ * ordinary shape of a wrapper script around the binary, keeps 'close' from
+ * ever firing, and a result that waits for it never settles.
+ */
+const PIPE_DRAIN_GRACE_MS = 1_000;
+/** Grace between SIGTERM and SIGKILL. */
+const KILL_ESCALATION_MS = 2_000;
+/**
+ * Ceiling on the drain after 'exit', however often late data re-arms it. The
+ * deadline bounds the drain while it is still pending; once it has fired, a
+ * writer that survived the group signal could otherwise keep the result open
+ * for as long as it kept writing.
+ */
+const PIPE_DRAIN_MAX_MS = 5 * PIPE_DRAIN_GRACE_MS;
+/**
+ * Signal the child, and on POSIX its whole process group, so a grandchild
+ * started by a wrapper script dies with it. The child is spawned as a group
+ * leader for this purpose; when the group is already gone, or the platform
+ * has no groups, fall back to the child alone.
+ */
+function signalTree(child, sig) {
+    // The group is addressed by the child's pid, which the kernel may hand to
+    // an unrelated process once the child has been reaped. Past that point only
+    // the handle is safe to use, and Node's kill on a dead handle is a no-op.
+    const unreaped = child.exitCode === null && child.signalCode === null;
+    if (unreaped && process.platform !== 'win32' && child.pid !== undefined) {
+        try {
+            process.kill(-child.pid, sig);
+            return;
+        }
+        catch {
+            // ESRCH or EPERM: no group to signal. The child itself may still be there.
+        }
+    }
+    child.kill(sig);
+}
+/** Children that have been spawned and have not settled yet. */
+const liveChildren = new Set();
+/**
+ * Signal every child still running. A child sits in its own process group on
+ * POSIX, so a signal that stops the server does not reach it on its own; the
+ * server calls this on the way out. Returns how many were signalled.
+ */
+export function terminateChildren(sig = 'SIGTERM') {
+    let n = 0;
+    for (const child of liveChildren) {
+        signalTree(child, sig);
+        n++;
+    }
+    return n;
+}
 /** Accumulates a stream's chunks up to a byte ceiling. */
 class CappedBuffer {
     limit;
@@ -88,6 +143,9 @@ export async function runBinary(binary, opts) {
             env: buildChildEnv(opts.env),
             shell: false,
             windowsHide: true,
+            // A process group of its own on POSIX, so a kill reaches a grandchild
+            // as well. See signalTree.
+            detached: process.platform !== 'win32',
         });
         const limit = opts.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
         const stdout = new CappedBuffer(limit);
@@ -96,27 +154,53 @@ export async function runBinary(binary, opts) {
         let aborted = false;
         let settled = false;
         let killTimer;
+        let drainTimer;
+        /** Set once 'exit' has fired: the child is gone, only its pipes remain. */
+        let exited;
+        /** Absolute time by which the drain finishes regardless of late data. */
+        let drainUntil = 0;
+        liveChildren.add(child);
+        // Whether the child has actually ended. `child.killed` is not that: Node
+        // sets it as soon as a signal was sent, whether or not the child obeyed,
+        // so a guard on it never escalated and a child that trapped SIGTERM hung
+        // the call for good.
+        const alive = () => child.exitCode === null && child.signalCode === null;
         const killChild = () => {
-            child.kill('SIGTERM');
+            if (settled)
+                return;
+            signalTree(child, 'SIGTERM');
             killTimer = setTimeout(() => {
-                if (!child.killed)
-                    child.kill('SIGKILL');
-            }, 2_000);
+                if (alive())
+                    signalTree(child, 'SIGKILL');
+            }, KILL_ESCALATION_MS);
         };
         const timer = setTimeout(() => {
+            // The child is already gone and only the drain is pending: settle from
+            // what was captured. Calling that a timeout would be wrong.
+            if (exited) {
+                finishFromCapture();
+                return;
+            }
             timedOut = true;
             killChild();
         }, opts.timeoutMs);
-        if (opts.signal) {
-            opts.signal.addEventListener('abort', () => {
-                aborted = true;
-                killChild();
-            }, { once: true });
-        }
+        // Once the child has exited there is nothing to cancel, and a listener
+        // left behind after settling would signal a pid the kernel may have
+        // handed to someone else. rego_test_multiroot passes one signal through
+        // a whole sequence of runs, so the listener has to go when the run does.
+        const onAbort = () => {
+            if (settled || exited)
+                return;
+            aborted = true;
+            killChild();
+        };
+        opts.signal?.addEventListener('abort', onAbort, { once: true });
         const clearTimers = () => {
             clearTimeout(timer);
             if (killTimer)
                 clearTimeout(killTimer);
+            if (drainTimer)
+                clearTimeout(drainTimer);
         };
         /**
          * Resolve at most once. 'error' and 'close' can both fire -- killing a child
@@ -128,16 +212,51 @@ export async function runBinary(binary, opts) {
                 return;
             settled = true;
             clearTimers();
+            liveChildren.delete(child);
+            opts.signal?.removeEventListener('abort', onAbort);
             resolvePromise(result);
         };
-        child.stdout?.on('data', (chunk) => {
-            if (stdout.push(chunk))
-                killChild();
-        });
-        child.stderr?.on('data', (chunk) => {
-            if (stderr.push(chunk))
+        /**
+         * Build the result from the capture and let go of the pipes. Used once the
+         * child has exited but something it left behind still holds its stdio.
+         */
+        const finishFromCapture = () => {
+            if (settled || !exited)
+                return;
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+            finish(exited.code, exited.signal);
+        };
+        // (Re)start the wait for 'close'. Bytes can still be sitting in the pipe
+        // at 'exit', and on a loaded machine the reads that deliver them may
+        // queue behind an expired timer; each chunk that arrives pushes the
+        // grace out again, and the deadline above bounds the whole thing.
+        const armDrain = () => {
+            if (drainTimer)
+                clearTimeout(drainTimer);
+            const left = drainUntil - Date.now();
+            if (left <= 0) {
+                finishFromCapture();
+                return;
+            }
+            drainTimer = setTimeout(finishFromCapture, Math.min(PIPE_DRAIN_GRACE_MS, left));
+        };
+        const onData = (buf, chunk) => {
+            const overflowed = buf.push(chunk);
+            if (exited) {
+                // Nothing left to kill; a writer that outlived the child is either
+                // done, or has just been cut off by the cap.
+                if (overflowed)
+                    finishFromCapture();
+                else
+                    armDrain();
+                return;
+            }
+            if (overflowed)
                 killChild();
-        });
+        };
+        child.stdout?.on('data', (chunk) => onData(stdout, chunk));
+        child.stderr?.on('data', (chunk) => onData(stderr, chunk));
         // Killing a child mid-write can surface an EPIPE on the pipe. Without a
         // listener that is an unhandled 'error' event, which would take the whole
         // server down -- the exact failure mode this cap exists to prevent.
@@ -153,9 +272,10 @@ export async function runBinary(binary, opts) {
                 aborted,
                 durationMs: Date.now() - start,
                 outputTruncated: false,
+                signal: null,
             });
         });
-        child.on('close', (code) => {
+        const finish = (code, signal) => {
             // Decoding runs here, in an async callback whose throw would escape every
             // try/catch upstream and reach the process as an uncaughtException. The
             // byte cap is what makes that unreachable; this is the belt to its braces.
@@ -168,6 +288,7 @@ export async function runBinary(binary, opts) {
                     aborted,
                     durationMs: Date.now() - start,
                     outputTruncated: stdout.didOverflow || stderr.didOverflow,
+                    signal,
                 });
             }
             catch (e) {
@@ -179,9 +300,23 @@ export async function runBinary(binary, opts) {
                     aborted,
                     durationMs: Date.now() - start,
                     outputTruncated: true,
+                    signal,
                 });
             }
+        };
+        // 'close' carries the complete output and is the normal way to finish.
+        // 'exit' starts a short grace for it: when the pipes are still held open
+        // by something the child left behind, the result is built from what was
+        // captured and the server's ends of the pipes are released.
+        child.on('exit', (code, signal) => {
+            // A spawn failure settles on 'error' and may still be followed by 'exit'.
+            if (settled)
+                return;
+            exited = { code, signal };
+            drainUntil = Date.now() + PIPE_DRAIN_MAX_MS;
+            armDrain();
         });
+        child.on('close', (code, signal) => finish(code, signal));
         if (opts.stdin !== undefined) {
             child.stdin?.write(opts.stdin);
             child.stdin?.end();

package/dist/lib/subprocess.js.map

@@ -1 +1 @@
-{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../src/lib/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AA6CzD,0DAA0D;AAC1D,MAAM,YAAY;IAKa;IAJZ,MAAM,GAAa,EAAE,CAAC;IAC/B,KAAK,GAAG,CAAC,CAAC;IACV,UAAU,GAAG,KAAK,CAAC;IAE3B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,qEAAqE;IACrE,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1C,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,2CAA2C;QAC3C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,QAAQ;QACN,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAkB;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAc,CAAC,cAAc,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5B,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAoD,CAAC;QAEzD,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,EAAE,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC1B,OAAO,EACP,GAAG,EAAE;gBACH,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS,EAAE,CAAC;YACd,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAQ,EAAE;YAC3C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC;gBACL,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,CAAC,CAAC,OAAO;gBACjB,QAAQ,EAAE,KAAK;gBACf,OAAO;gBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,CAAC;oBACL,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,QAAQ;oBACR,OAAO;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,eAAe,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW;iBAC1D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC;oBACL,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;oBAC7E,QAAQ;oBACR,OAAO;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,eAAe,EAAE,IAAI;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../src/lib/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAoDzD;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAG,mBAAmB,CAAC;AAElD;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAmB,EAAE,GAAmB;IAC1D,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;IACtE,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAgB,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB,SAAS;IAC/D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACvB,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0DAA0D;AAC1D,MAAM,YAAY;IAKa;IAJZ,MAAM,GAAa,EAAE,CAAC;IAC/B,KAAK,GAAG,CAAC,CAAC;IACV,UAAU,GAAG,KAAK,CAAC;IAE3B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAE9C,qEAAqE;IACrE,IAAI,CAAC,KAAa;QAChB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1C,oEAAoE;QACpE,yEAAyE;QACzE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,2CAA2C;QAC3C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,QAAQ;QACN,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,IAAkB;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAc,CAAC,cAAc,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5B,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,2BAA2B;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;SACvC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAoD,CAAC;QACzD,IAAI,UAAqD,CAAC;QAC1D,2EAA2E;QAC3E,IAAI,MAA0E,CAAC;QAC/E,yEAAyE;QACzE,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAExB,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;QAElF,MAAM,SAAS,GAAG,GAAS,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAO;YACpB,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC7B,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,KAAK,EAAE;oBAAE,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,uEAAuE;YACvE,4DAA4D;YAC5D,IAAI,MAAM,EAAE,CAAC;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS,EAAE,CAAC;QACd,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,OAAO,IAAI,MAAM;gBAAE,OAAO;YAC9B,OAAO,GAAG,IAAI,CAAC;YACf,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhE,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,MAAM,GAAG,CAAC,MAAmB,EAAQ,EAAE;YAC3C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,CAAC;YACd,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,cAAc,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF;;;WAGG;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC/B,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC;QAEF,yEAAyE;QACzE,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,UAAU,GAAG,UAAU,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAE,KAAa,EAAQ,EAAE;YACxD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,mEAAmE;gBACnE,6CAA6C;gBAC7C,IAAI,UAAU;oBAAE,iBAAiB,EAAE,CAAC;;oBAC/B,QAAQ,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,UAAU;gBAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAEnE,wEAAwE;QACxE,0EAA0E;QAC1E,oEAAoE;QACpE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE1C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC;gBACL,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,CAAC,CAAC,OAAO;gBACjB,QAAQ,EAAE,KAAK;gBACf,OAAO;gBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC9B,eAAe,EAAE,KAAK;gBACtB,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAE,MAA6B,EAAQ,EAAE;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,CAAC;oBACL,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;oBACzB,QAAQ;oBACR,OAAO;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,eAAe,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW;oBACzD,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC;oBACL,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;oBAC7E,QAAQ;oBACR,OAAO;oBACP,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,eAAe,EAAE,IAAI;oBACrB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QAEF,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,0EAA0E;YAC1E,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;YAC5C,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/tool-helpers.d.ts

@@ -6,41 +6,28 @@
  * the formatted MCP result. The pieces here factor out the parts every
  * tool repeats so each tool file can stay focused on its own logic.
  */
-/**
- * Matches the temp-file paths written by OpaCli.withTempSource and
- * RegalCli.withTempSource when handling inline source. Both now use
- * mkdtemp which produces a private directory; the file inside is always
- * named input.rego. Matches both Unix (/) and Windows (\) separators.
- */
-export declare const INLINE_TEMP_PATH_PATTERN: RegExp;
-/**
- * Replace a file path that refers to one of our temp files with the
- * sentinel string `<inline>`. Returns the original string unchanged when
- * it does not match the pattern, so callers can unconditionally apply it
- * to all location.file values regardless of whether inline source was used.
- */
-export declare function sanitizeInlinePath(file: string): string;
-/**
- * Recursively rewrite every temp-file path -- in both string values and object
- * keys -- to the `<inline>` sentinel. OPA writes inline source to a temp file,
- * so trace (`explanation`), coverage, and profile output reference that path;
- * this normalizes the whole structure so callers never see an absolute temp
- * path. Only our own temp paths match the pattern, so real user file paths pass
- * through untouched.
- */
-export declare function sanitizeInlinePathsDeep(value: unknown): unknown;
 import type { Config } from '../config.js';
 import { type McpToolResult } from './output.js';
 import type { SpawnResult } from './subprocess.js';
 import type { ToolEnvelope } from '../types.js';
+export { INLINE_TEMP_PATH_PATTERN, sanitizeInlinePath, sanitizeInlinePathsDeep, sanitizeInlineText, } from './inline-paths.js';
 /**
  * Convert a subprocess outcome into a structured tool error envelope
- * for the cases that are universal across all CLI-backed tools:
- * binary missing, subprocess timed out. Returns `undefined` when the
+ * for the cases that are universal across all CLI-backed tools: cancelled
+ * by the client, timed out, output over the capture cap, killed by a
+ * signal from outside the server, binary missing. Returns `undefined` when the
  * subprocess exited normally (exitCode is a number) so the caller can
  * inspect the result.
  */
 export declare function mapSubprocessFailure(result: SpawnResult, binary: 'opa' | 'regal' | 'conftest'): ToolEnvelope<never> | undefined;
+/**
+ * Parse the last top-level JSON object in `text`, for a command that prints
+ * one document per run (`opa test --coverage --count N`). Strings are
+ * honoured, so a brace inside a file name does not end a document. Returns
+ * `undefined` when there is none. `accept` narrows it to the last object of
+ * the shape wanted, so trace text that happens to hold braces is skipped.
+ */
+export declare function lastJsonObject<T = unknown>(text: string, accept?: (parsed: unknown) => boolean): T | undefined;
 /**
  * Try to parse `text` as JSON. Returns `undefined` on failure so the
  * caller can fall back to a textual error envelope rather than throwing.

package/dist/lib/tool-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAsD,CAAC;AAE5F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW/D;AACD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,GACnC,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CAiDjC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CAgBxB"}
+{"version":3,"file":"tool-helpers.d.ts","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAE/D,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,UAAU,GACnC,YAAY,CAAC,KAAK,CAAC,GAAG,SAAS,CA+DjC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,GAAG,OAAO,EACxC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAoB,GAChD,CAAC,GAAG,SAAS,CAkCf;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAOrE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;CAAE,CAU9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,aAAa,CAAC,CAgBxB"}

package/dist/lib/tool-helpers.js

@@ -6,52 +6,16 @@
  * the formatted MCP result. The pieces here factor out the parts every
  * tool repeats so each tool file can stay focused on its own logic.
  */
-/**
- * Matches the temp-file paths written by OpaCli.withTempSource and
- * RegalCli.withTempSource when handling inline source. Both now use
- * mkdtemp which produces a private directory; the file inside is always
- * named input.rego. Matches both Unix (/) and Windows (\) separators.
- */
-export const INLINE_TEMP_PATH_PATTERN = /orygn-(?:opa|regal)-mcp-[^/\\]+[/\\]input\.rego$/i;
-/**
- * Replace a file path that refers to one of our temp files with the
- * sentinel string `<inline>`. Returns the original string unchanged when
- * it does not match the pattern, so callers can unconditionally apply it
- * to all location.file values regardless of whether inline source was used.
- */
-export function sanitizeInlinePath(file) {
-    return INLINE_TEMP_PATH_PATTERN.test(file) ? '<inline>' : file;
-}
-/**
- * Recursively rewrite every temp-file path -- in both string values and object
- * keys -- to the `<inline>` sentinel. OPA writes inline source to a temp file,
- * so trace (`explanation`), coverage, and profile output reference that path;
- * this normalizes the whole structure so callers never see an absolute temp
- * path. Only our own temp paths match the pattern, so real user file paths pass
- * through untouched.
- */
-export function sanitizeInlinePathsDeep(value) {
-    if (typeof value === 'string')
-        return sanitizeInlinePath(value);
-    if (Array.isArray(value))
-        return value.map(sanitizeInlinePathsDeep);
-    if (value !== null && typeof value === 'object') {
-        const out = {};
-        for (const [key, val] of Object.entries(value)) {
-            out[sanitizeInlinePath(key)] = sanitizeInlinePathsDeep(val);
-        }
-        return out;
-    }
-    return value;
-}
 import { err } from './errors.js';
 import { logger } from './logger.js';
 import { formatEnvelope } from './output.js';
 import { validatePath } from './security.js';
+export { INLINE_TEMP_PATH_PATTERN, sanitizeInlinePath, sanitizeInlinePathsDeep, sanitizeInlineText, } from './inline-paths.js';
 /**
  * Convert a subprocess outcome into a structured tool error envelope
- * for the cases that are universal across all CLI-backed tools:
- * binary missing, subprocess timed out. Returns `undefined` when the
+ * for the cases that are universal across all CLI-backed tools: cancelled
+ * by the client, timed out, output over the capture cap, killed by a
+ * signal from outside the server, binary missing. Returns `undefined` when the
  * subprocess exited normally (exitCode is a number) so the caller can
  * inspect the result.
  */
@@ -80,6 +44,16 @@ export function mapSubprocessFailure(result, binary) {
             details: { durationMs: result.durationMs },
         });
     }
+    // The server's own kills are handled above. A signal that reaches here came
+    // from outside it, most often the kernel's out-of-memory killer, and the
+    // binary is installed and was running; sending the user to reinstall it
+    // would be wrong.
+    if (result.exitCode === null && result.signal) {
+        return err('SUBPROCESS_KILLED', `${binary} was terminated by ${result.signal} before it finished.`, {
+            hint: 'The process was killed from outside the server, for example by the out-of-memory killer or a container limit. Check the host memory limits and system logs.',
+            details: { signal: result.signal, durationMs: result.durationMs },
+        });
+    }
     if (result.exitCode === null) {
         const code = binary === 'opa'
             ? 'OPA_BINARY_NOT_FOUND'
@@ -95,6 +69,58 @@ export function mapSubprocessFailure(result, binary) {
     }
     return undefined;
 }
+/**
+ * Parse the last top-level JSON object in `text`, for a command that prints
+ * one document per run (`opa test --coverage --count N`). Strings are
+ * honoured, so a brace inside a file name does not end a document. Returns
+ * `undefined` when there is none. `accept` narrows it to the last object of
+ * the shape wanted, so trace text that happens to hold braces is skipped.
+ */
+export function lastJsonObject(text, accept = () => true) {
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    let start = -1;
+    let last;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === '{') {
+            if (depth === 0)
+                start = i;
+            depth++;
+        }
+        else if (ch === '}') {
+            // A stray closing brace must not put every later object out of reach.
+            if (depth > 0)
+                depth--;
+            if (depth === 0 && start !== -1) {
+                const candidate = tryParseJson(text.slice(start, i + 1));
+                if (candidate !== undefined && accept(candidate))
+                    last = text.slice(start, i + 1);
+                start = -1;
+            }
+        }
+    }
+    if (last === undefined)
+        return undefined;
+    try {
+        return JSON.parse(last);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Try to parse `text` as JSON. Returns `undefined` on failure so the
  * caller can fall back to a textual error envelope rather than throwing.

package/dist/lib/tool-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mDAAmD,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAoC;IAEpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,GAAG,CACR,kBAAkB,EAClB,GAAG,MAAM,sGAAsG,EAC/G;YACE,IAAI,EAAE,0OAA0O;YAChP,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,oBAAoB,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,yGAAyG,CAAC;QAClH,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,4EAA4E;QAC5E,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,OAAO;YACP,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAChD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}
+{"version":3,"file":"tool-helpers.js","sourceRoot":"","sources":["../../src/lib/tool-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAI7C,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,MAAoC;IAEpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,WAAW,EAAE,6CAA6C,EAAE;YACrE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,GAAG,CACR,SAAS,EACT,GAAG,MAAM,mEAAmE,EAC5E;YACE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,GAAG,CACR,kBAAkB,EAClB,GAAG,MAAM,sGAAsG,EAC/G;YACE,IAAI,EAAE,0OAA0O;YAChP,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAC3C,CACF,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,kBAAkB;IAClB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,GAAG,CACR,mBAAmB,EACnB,GAAG,MAAM,sBAAsB,MAAM,CAAC,MAAM,sBAAsB,EAClE;YACE,IAAI,EAAE,6JAA6J;YACnK,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;SAClE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,oBAAoB,CAAC;QAC7B,MAAM,IAAI,GACR,MAAM,KAAK,KAAK;YACd,CAAC,CAAC,kHAAkH;YACpH,CAAC,CAAC,MAAM,KAAK,OAAO;gBAClB,CAAC,CAAC,sGAAsG;gBACxG,CAAC,CAAC,yGAAyG,CAAC;QAClH,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,wBAAwB,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,SAAuC,GAAG,EAAE,CAAC,IAAI;IAEjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,IAAwB,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,KAAK,KAAK,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;YAC3B,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,sEAAsE;YACtE,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;YACvB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzD,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClF,KAAK,GAAG,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAc,IAAY;IACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAe,EACf,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAM,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,IAAoC;IAEpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC7E,4EAA4E;QAC5E,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;YACnC,OAAO;YACP,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;SAChD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/prompts/index.js

@@ -58,7 +58,7 @@ Apply this checklist, calling tools as needed:
    concern in a policy hot path.
 6. **Annotations.** Check that exported rules have docstrings. If
    missing, suggest minimal \`# METADATA\` annotations.
-7. **Shape of input.** Use \`rego_describe_policy\` to enumerate input
+7. **Shape of input.** Use \`rego_infer_input_schema\` to enumerate input
    refs the policy reads; confirm the documented input contract
    matches.
 
@@ -81,7 +81,7 @@ Workflow:
    Identify which rules were evaluated and which fired.
 4. The cause is one of:
    a. **Input mismatch** -- the policy expected a different input shape.
-      Use \`rego_describe_policy\` to list the refs the policy reads
+      Use \`rego_infer_input_schema\` to list the refs the policy reads
       and confirm each is present in the input.
    b. **Rule logic** -- a guard fired or didn't fire when it should
       have. Read the trace and explain which rule's body evaluated to

package/dist/resources/index.js

@@ -49,7 +49,7 @@ async function buildBuiltinsResource(opa) {
         .filter((n) => typeof n === 'string' && SECURITY_SENSITIVE.has(n))
         .sort();
     return JSON.stringify({
-        version_note: 'Derived at read time from `opa capabilities --current`. Reflects the OPA build linked into this MCP server, not necessarily the OPA the user has installed locally.',
+        version_note: 'Derived at read time from `opa capabilities --current` of the opa binary this server resolved: OPA_BINARY, then PATH, then the bundled copy.',
         builtin_count: caps.builtins?.length ?? 0,
         categories: grouped,
         future_keywords: caps.future_keywords ?? [],

package/dist/resources/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAazC,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,SAAS;QAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,aAAa;IACb,gCAAgC;IAChC,uCAAuC;IACvC,2BAA2B;IAC3B,mCAAmC;IACnC,2BAA2B;CAC5B,CAAC,CAAC;AAEH,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,SAAS,CACnB;YACE,KAAK,EAAE,mCAAmC;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9E,IAAI,EAAE,CAAC;IAEV,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,YAAY,EACV,qKAAqK;QACvK,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QACzC,UAAU,EAAE,OAAO;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;QAC/C,2BAA2B,EAAE,SAAS;QACtC,aAAa,EACX,uMAAuM;KAC1M,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,gBAAgB,CACrB,cAAc,EACd,gBAAgB,EAChB;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,sNAAsN;QACxN,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,OAAO;iBACd;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,iBAAiB,EACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,0JAA0J;QAC5J,QAAQ,EAAE,eAAe;KAC1B,EACD,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,eAAe;gBACzB,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,cAAc,EACd,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,kMAAkM;QACpM,QAAQ,EAAE,eAAe;KAC1B,EACD,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,eAAe;gBACzB,IAAI,EAAE,QAAQ;aACf;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/resources/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAazC,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,SAAS;QAC5B,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAChC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,aAAa;IACb,gCAAgC;IAChC,uCAAuC;IACvC,2BAA2B;IAC3B,mCAAmC;IACnC,2BAA2B;CAC5B,CAAC,CAAC;AAEH,KAAK,UAAU,qBAAqB,CAAC,GAAW;IAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,SAAS,CACnB;YACE,KAAK,EAAE,mCAAmC;YAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;SAC7B,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAoB,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6CAA6C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC9E,IAAI,EAAE,CAAC;IAEV,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,YAAY,EACV,8IAA8I;QAChJ,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QACzC,UAAU,EAAE,OAAO;QACnB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;QAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE;QAC/C,2BAA2B,EAAE,SAAS;QACtC,aAAa,EACX,uMAAuM;KAC1M,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAiB,EAAE,MAAc;IACjE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,gBAAgB,CACrB,cAAc,EACd,gBAAgB,EAChB;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,sNAAsN;QACxN,QAAQ,EAAE,kBAAkB;KAC7B,EACD,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO;YACL,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,QAAQ,EAAE,kBAAkB;oBAC5B,IAAI,EAAE,OAAO;iBACd;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,iBAAiB,EACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,0JAA0J;QAC5J,QAAQ,EAAE,eAAe;KAC1B,EACD,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,eAAe;gBACzB,IAAI,EAAE,WAAW;aAClB;SACF;KACF,CAAC,CACL,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,cAAc,EACd,gBAAgB,EAChB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,kMAAkM;QACpM,QAAQ,EAAE,eAAe;KAC1B,EACD,CAAC,GAAG,EAAE,EAAE,CACN,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,QAAQ,EAAE,eAAe;gBACzB,IAAI,EAAE,QAAQ;aACf;SACF;KACF,CAAC,CACL,CAAC;AACJ,CAAC"}

package/dist/resources/patterns.d.ts

@@ -5,5 +5,5 @@
  *   - A test
  *   - Common pitfalls
  */
-export declare const PATTERNS = "# Rego pattern library\n\nCommon Rego patterns with working examples, tests, and pitfalls. Each\npattern is self-contained -- copy, adapt, and ship.\n\n---\n\n## 1. Role-based access control (RBAC)\n\n**When to use:** the simplest authorization model. Every user has one\nor more roles; each role grants a set of actions on a set of\nresources. Sufficient for ~80% of internal applications.\n\n```rego\npackage rbac\n\nimport rego.v1\n\ndefault allow := false\n\n# Permissions table -- extend as roles evolve.\npermissions := {\n    \"admin\": {\"read\", \"write\", \"delete\", \"manage_users\"},\n    \"editor\": {\"read\", \"write\"},\n    \"viewer\": {\"read\"},\n}\n\nallow if {\n    some role in input.user.roles\n    input.action in permissions[role]\n}\n\n# Why was it denied? -- useful for audit logs.\ndeny_reasons contains reason if {\n    not allow\n    input.user\n    reason := sprintf(\n        \"user %q has roles %v, none grant %q\",\n        [input.user.id, input.user.roles, input.action],\n    )\n}\n\ndeny_reasons contains \"anonymous request\" if {\n    not allow\n    not input.user\n}\n```\n\n**Test:**\n\n```rego\npackage rbac_test\n\nimport rego.v1\nimport data.rbac\n\ntest_admin_can_delete if {\n    rbac.allow with input as {\n        \"user\": {\"id\": \"alice\", \"roles\": [\"admin\"]},\n        \"action\": \"delete\",\n    }\n}\n\ntest_viewer_cannot_delete if {\n    not rbac.allow with input as {\n        \"user\": {\"id\": \"bob\", \"roles\": [\"viewer\"]},\n        \"action\": \"delete\",\n    }\n}\n\ntest_anonymous_denied if {\n    not rbac.allow with input as {\"action\": \"read\"}\n    reasons := rbac.deny_reasons with input as {\"action\": \"read\"}\n    \"anonymous request\" in reasons\n}\n```\n\n**Pitfalls:**\n- The `permissions` table grows unbounded. Move to data files\n  (`data.permissions`) once you have more than ~20 roles.\n- Roles overlap with groups in real auth systems; map at the boundary\n  rather than carrying both.\n\n---\n\n## 2. Attribute-based access control (ABAC)\n\n**When to use:** when \"who\" alone isn't enough -- decisions also depend\non resource attributes (ownership, tenant, sensitivity) and context\n(time of day, source IP).\n\n```rego\npackage abac\n\nimport rego.v1\n\ndefault allow := false\n\n# A user can read any resource they own.\nallow if {\n    input.action == \"read\"\n    input.resource.owner_id == input.user.id\n}\n\n# A user can read shared resources at their organization.\nallow if {\n    input.action == \"read\"\n    input.resource.shared\n    input.resource.org_id == input.user.org_id\n}\n\n# Admins can do anything within their organization.\nallow if {\n    \"admin\" in input.user.roles\n    input.resource.org_id == input.user.org_id\n}\n\n# Don't show \"secret\" resources to anyone outside the owner's\n# organization, even admins.\nallow := false if {\n    input.resource.classification == \"secret\"\n    input.resource.org_id != input.user.org_id\n}\n```\n\n**Test:**\n\n```rego\npackage abac_test\n\nimport rego.v1\nimport data.abac\n\ntest_owner_reads_own if {\n    abac.allow with input as {\n        \"action\": \"read\",\n        \"user\": {\"id\": \"u1\", \"org_id\": \"o1\"},\n        \"resource\": {\"owner_id\": \"u1\", \"org_id\": \"o1\"},\n    }\n}\n\ntest_admin_blocked_from_secret_in_other_org if {\n    not abac.allow with input as {\n        \"action\": \"read\",\n        \"user\": {\"id\": \"u1\", \"org_id\": \"o1\", \"roles\": [\"admin\"]},\n        \"resource\": {\n            \"owner_id\": \"u2\",\n            \"org_id\": \"o2\",\n            \"classification\": \"secret\",\n        },\n    }\n}\n```\n\n**Pitfalls:**\n- Multiple `allow` rules combine with logical OR. Use explicit\n  `allow := false if ...` to *override* an allow.\n- Don't compute attributes inside the policy; compute them at the\n  boundary and pass via `input`.\n\n---\n\n## 3. Kubernetes admission control\n\n**When to use:** validate or mutate Kubernetes resources at admission\ntime. Run as a Gatekeeper, OPA-as-a-webhook, or Kyverno-equivalent\npolicy layer.\n\n```rego\npackage k8s.admission\n\nimport rego.v1\n\n# Reject pods without resource limits.\ndeny contains msg if {\n    input.request.kind.kind == \"Pod\"\n    container := input.request.object.spec.containers[_]\n    not container.resources.limits.memory\n    msg := sprintf(\n        \"Pod %q container %q is missing resources.limits.memory\",\n        [input.request.object.metadata.name, container.name],\n    )\n}\n\n# Reject privileged containers in production.\ndeny contains msg if {\n    input.request.kind.kind == \"Pod\"\n    input.request.namespace != \"kube-system\"\n    container := input.request.object.spec.containers[_]\n    container.securityContext.privileged == true\n    msg := sprintf(\n        \"privileged containers are not allowed: %q in %q\",\n        [container.name, input.request.object.metadata.name],\n    )\n}\n```\n\n**Pitfalls:**\n- Use `input.request.object` for the resource being admitted; the\n  envelope shape comes from Kubernetes, not your control.\n- For mutations, return a JSON Patch via the `patch` field. Test\n  patches with the actual admission webhook in dry-run mode before\n  enforcing.\n- Iteration order is undefined; never rely on `containers[0]` to mean\n  anything specific.\n\n---\n\n## 4. Infrastructure-as-Code gates (Terraform)\n\n**When to use:** validate Terraform plans before apply. Catch overly\npermissive IAM, public S3 buckets, missing encryption.\n\n```rego\npackage terraform\n\nimport rego.v1\n\n# Reject S3 buckets without server-side encryption.\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    after := resource.change.after\n    not after.server_side_encryption_configuration\n    msg := sprintf(\n        \"S3 bucket %q has no server-side encryption configured\",\n        [resource.address],\n    )\n}\n\n# Reject IAM policies with action \"*\" on resource \"*\".\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_iam_policy\"\n    policy := json.unmarshal(resource.change.after.policy)\n    statement := policy.Statement[_]\n    statement.Effect == \"Allow\"\n    \"*\" in statement.Action\n    statement.Resource == \"*\"\n    msg := sprintf(\"IAM policy %q grants Allow * on *\", [resource.address])\n}\n```\n\n**Pitfalls:**\n- Terraform plan JSON is verbose and version-specific. Pin the\n  `terraform plan -json` schema you target.\n- `resource_changes[_].change.after` may be `null` for destroys --\n  guard against it.\n- For wide-radius changes, use `opa exec --decision` against a plan\n  file in CI, not the live API.\n\n---\n\n## 5. API authorization (HTTP request gating)\n\n**When to use:** at the API gateway / reverse proxy layer, validate\neach request against the caller's identity and the requested\nendpoint.\n\n```rego\npackage api.authz\n\nimport rego.v1\n\ndefault allow := false\n\n# Public endpoints -- no auth required.\npublic_endpoints := {\n    {\"method\": \"GET\", \"path\": [\"health\"]},\n    {\"method\": \"GET\", \"path\": [\"version\"]},\n}\n\nallow if {\n    some endpoint in public_endpoints\n    matches_endpoint(endpoint)\n}\n\n# Authenticated reads on resources the user has access to.\nallow if {\n    input.method == \"GET\"\n    input.user\n    user_can_read(input.user, input.path)\n}\n\n# Authenticated writes only with specific scopes.\nallow if {\n    input.method in {\"POST\", \"PUT\", \"PATCH\", \"DELETE\"}\n    input.user\n    \"write\" in input.user.scopes\n    user_can_write(input.user, input.path)\n}\n\nmatches_endpoint(spec) if {\n    spec.method == input.method\n    spec.path == input.path\n}\n\nuser_can_read(user, path) if {\n    path[0] == \"users\"\n    user.id == path[1]\n}\n\nuser_can_write(user, path) if {\n    path[0] == \"users\"\n    user.id == path[1]\n}\n```\n\n**Pitfalls:**\n- `input.path` is typically an array (`[\"users\", \"alice\"]`), not a\n  string. Build it consistently at the gateway.\n- Path-prefix matching is easy; full pattern matching is not. For\n  parameterized routes, decode at the gateway and pass structured\n  fields.\n\n---\n\n## 6. Rate limiting (with sliding window data)\n\n**When to use:** allow N requests per principal per window. Lightweight\nlimit enforcement; for high throughput, push to a dedicated rate\nlimiter.\n\n```rego\npackage rate\n\nimport rego.v1\n\n# Configuration: 100 requests per principal per 60-second window.\nlimit := 100\nwindow_seconds := 60\n\n# input.now is a unix timestamp in nanoseconds.\n# data.requests[principal] is an array of nanosecond timestamps.\n\ncurrent_window := requests if {\n    requests := [t | some t in data.requests[input.principal]; t > input.now - window_seconds * 1000000000]\n}\n\n# Do not name this rule `count`: it would shadow the built-in of the same\n# name, and the call below would resolve to the rule instead.\nrequest_count := count(current_window)\n\nallow if request_count < limit\n\ndeny_reason := sprintf(\n    \"rate limit exceeded: %d requests in last %d seconds (limit %d)\",\n    [request_count, window_seconds, limit],\n) if not allow\n```\n\n**Pitfalls:**\n- `data.requests` grows unbounded unless the writer prunes outside the\n  window. Schedule prune on every write.\n- This pattern is *advisory* -- under load, two concurrent decisions\n  can both see `count == limit - 1` and both allow. For strict\n  limits, use a Lua/Redis token bucket at the gateway and have OPA\n  validate the token, not count requests.\n\n---\n\n## Where these patterns came from\n\nEach is distilled from production policy code. The full Rego files,\ntests, and policy data fixtures live in this server's GitHub\nrepository under `tests/fixtures/policies/`.\n\nFor more patterns, see:\n\n- OPA Playground: https://play.openpolicyagent.org/\n- Awesome OPA: https://github.com/anderseknert/awesome-opa\n- Styra DAS pattern library: https://docs.styra.com/das/policies\n";
+export declare const PATTERNS = "# Rego pattern library\n\nCommon Rego patterns with working examples, tests, and pitfalls. Each\npattern is self-contained -- copy, adapt, and ship.\n\n---\n\n## 1. Role-based access control (RBAC)\n\n**When to use:** the simplest authorization model. Every user has one\nor more roles; each role grants a set of actions on a set of\nresources. Sufficient for ~80% of internal applications.\n\n```rego\npackage rbac\n\nimport rego.v1\n\ndefault allow := false\n\n# Permissions table -- extend as roles evolve.\npermissions := {\n    \"admin\": {\"read\", \"write\", \"delete\", \"manage_users\"},\n    \"editor\": {\"read\", \"write\"},\n    \"viewer\": {\"read\"},\n}\n\nallow if {\n    some role in input.user.roles\n    input.action in permissions[role]\n}\n\n# Why was it denied? -- useful for audit logs.\ndeny_reasons contains reason if {\n    not allow\n    input.user\n    reason := sprintf(\n        \"user %q has roles %v, none grant %q\",\n        [input.user.id, input.user.roles, input.action],\n    )\n}\n\ndeny_reasons contains \"anonymous request\" if {\n    not allow\n    not input.user\n}\n```\n\n**Test:**\n\n```rego\npackage rbac_test\n\nimport rego.v1\nimport data.rbac\n\ntest_admin_can_delete if {\n    rbac.allow with input as {\n        \"user\": {\"id\": \"alice\", \"roles\": [\"admin\"]},\n        \"action\": \"delete\",\n    }\n}\n\ntest_viewer_cannot_delete if {\n    not rbac.allow with input as {\n        \"user\": {\"id\": \"bob\", \"roles\": [\"viewer\"]},\n        \"action\": \"delete\",\n    }\n}\n\ntest_anonymous_denied if {\n    not rbac.allow with input as {\"action\": \"read\"}\n    reasons := rbac.deny_reasons with input as {\"action\": \"read\"}\n    \"anonymous request\" in reasons\n}\n```\n\n**Pitfalls:**\n- The `permissions` table grows unbounded. Move to data files\n  (`data.permissions`) once you have more than ~20 roles.\n- Roles overlap with groups in real auth systems; map at the boundary\n  rather than carrying both.\n\n---\n\n## 2. Attribute-based access control (ABAC)\n\n**When to use:** when \"who\" alone isn't enough -- decisions also depend\non resource attributes (ownership, tenant, sensitivity) and context\n(time of day, source IP).\n\n```rego\npackage abac\n\nimport rego.v1\n\ndefault allow := false\n\n# Don't show \"secret\" resources to anyone outside the owner's\n# organization, even admins.\n#\n# Written as a guard the permissive rules consult. A second rule\n# assigning `allow := false` is a conflict in Rego, not an override:\n# both rules produce a value for the same document and evaluation\n# fails with eval_conflict_error. Deny wins by being a precondition,\n# not by being written last.\nhidden_from_other_org if {\n    input.resource.classification == \"secret\"\n    input.resource.org_id != input.user.org_id\n}\n\n# A user can read any resource they own.\nallow if {\n    input.action == \"read\"\n    input.resource.owner_id == input.user.id\n    not hidden_from_other_org\n}\n\n# A user can read shared resources at their organization.\nallow if {\n    input.action == \"read\"\n    input.resource.shared\n    input.resource.org_id == input.user.org_id\n    not hidden_from_other_org\n}\n\n# Admins can do anything within their organization.\nallow if {\n    \"admin\" in input.user.roles\n    input.resource.org_id == input.user.org_id\n    not hidden_from_other_org\n}\n```\n\n**Test:**\n\n```rego\npackage abac_test\n\nimport rego.v1\nimport data.abac\n\ntest_owner_reads_own if {\n    abac.allow with input as {\n        \"action\": \"read\",\n        \"user\": {\"id\": \"u1\", \"org_id\": \"o1\"},\n        \"resource\": {\"owner_id\": \"u1\", \"org_id\": \"o1\"},\n    }\n}\n\ntest_admin_blocked_from_secret_in_other_org if {\n    not abac.allow with input as {\n        \"action\": \"read\",\n        \"user\": {\"id\": \"u1\", \"org_id\": \"o1\", \"roles\": [\"admin\"]},\n        \"resource\": {\n            \"owner_id\": \"u2\",\n            \"org_id\": \"o2\",\n            \"classification\": \"secret\",\n        },\n    }\n}\n```\n\n**Pitfalls:**\n- Multiple `allow` rules combine with logical OR. A later rule\n  cannot override an earlier one by assigning a different value:\n  two rules producing different values for the same document is an\n  `eval_conflict_error` and evaluation fails. Express a denial as a\n  condition the permissive rules must pass, as `hidden_from_other_org`\n  does above.\n- Don't compute attributes inside the policy; compute them at the\n  boundary and pass via `input`.\n\n---\n\n## 3. Kubernetes admission control\n\n**When to use:** validate or mutate Kubernetes resources at admission\ntime. Run as a Gatekeeper, OPA-as-a-webhook, or Kyverno-equivalent\npolicy layer.\n\n```rego\npackage k8s.admission\n\nimport rego.v1\n\n# Reject pods without resource limits.\ndeny contains msg if {\n    input.request.kind.kind == \"Pod\"\n    container := input.request.object.spec.containers[_]\n    not container.resources.limits.memory\n    msg := sprintf(\n        \"Pod %q container %q is missing resources.limits.memory\",\n        [input.request.object.metadata.name, container.name],\n    )\n}\n\n# Reject privileged containers in production.\ndeny contains msg if {\n    input.request.kind.kind == \"Pod\"\n    input.request.namespace != \"kube-system\"\n    container := input.request.object.spec.containers[_]\n    container.securityContext.privileged == true\n    msg := sprintf(\n        \"privileged containers are not allowed: %q in %q\",\n        [container.name, input.request.object.metadata.name],\n    )\n}\n```\n\n**Pitfalls:**\n- Use `input.request.object` for the resource being admitted; the\n  envelope shape comes from Kubernetes, not your control.\n- For mutations, return a JSON Patch via the `patch` field. Test\n  patches with the actual admission webhook in dry-run mode before\n  enforcing.\n- Iteration order is undefined; never rely on `containers[0]` to mean\n  anything specific.\n\n---\n\n## 4. Infrastructure-as-Code gates (Terraform)\n\n**When to use:** validate Terraform plans before apply. Catch overly\npermissive IAM, public S3 buckets, missing encryption.\n\n```rego\npackage terraform\n\nimport rego.v1\n\n# Reject S3 buckets without server-side encryption.\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_s3_bucket\"\n    after := resource.change.after\n    not after.server_side_encryption_configuration\n    msg := sprintf(\n        \"S3 bucket %q has no server-side encryption configured\",\n        [resource.address],\n    )\n}\n\n# Reject IAM policies with action \"*\" on resource \"*\".\n#\n# AWS accepts either a bare string or an array for Statement, Action\n# and Resource, so each is widened to a set before the wildcard test.\n# Testing the array form alone lets the most common admin policy of\n# all, {\"Action\": \"*\", \"Resource\": \"*\"}, through untouched.\nto_set(v) := {v} if is_string(v)\n\nto_set(v) := {x | some x in v} if is_array(v)\n\nstatements(policy) := to_set(policy.Statement) if is_array(policy.Statement)\n\nstatements(policy) := {policy.Statement} if is_object(policy.Statement)\n\ndeny contains msg if {\n    resource := input.resource_changes[_]\n    resource.type == \"aws_iam_policy\"\n    policy := json.unmarshal(resource.change.after.policy)\n    some statement in statements(policy)\n    statement.Effect == \"Allow\"\n    \"*\" in to_set(statement.Action)\n    \"*\" in to_set(statement.Resource)\n    msg := sprintf(\"IAM policy %q grants Allow * on *\", [resource.address])\n}\n```\n\n**Pitfalls:**\n- Terraform plan JSON is verbose and version-specific. Pin the\n  `terraform plan -json` schema you target.\n- `resource_changes[_].change.after` may be `null` for destroys --\n  guard against it.\n- IAM policy documents are string-or-array in several places. Match\n  both, or a policy that grants everything slips through.\n- For wide-radius changes, use `opa exec --decision` against a plan\n  file in CI, not the live API.\n\n---\n\n## 5. API authorization (HTTP request gating)\n\n**When to use:** at the API gateway / reverse proxy layer, validate\neach request against the caller's identity and the requested\nendpoint.\n\n```rego\npackage api.authz\n\nimport rego.v1\n\ndefault allow := false\n\n# Public endpoints -- no auth required.\npublic_endpoints := {\n    {\"method\": \"GET\", \"path\": [\"health\"]},\n    {\"method\": \"GET\", \"path\": [\"version\"]},\n}\n\nallow if {\n    some endpoint in public_endpoints\n    matches_endpoint(endpoint)\n}\n\n# Authenticated reads on resources the user has access to.\nallow if {\n    input.method == \"GET\"\n    input.user\n    user_can_read(input.user, input.path)\n}\n\n# Authenticated writes only with specific scopes.\nallow if {\n    input.method in {\"POST\", \"PUT\", \"PATCH\", \"DELETE\"}\n    input.user\n    \"write\" in input.user.scopes\n    user_can_write(input.user, input.path)\n}\n\nmatches_endpoint(spec) if {\n    spec.method == input.method\n    spec.path == input.path\n}\n\nuser_can_read(user, path) if {\n    path[0] == \"users\"\n    user.id == path[1]\n}\n\nuser_can_write(user, path) if {\n    path[0] == \"users\"\n    user.id == path[1]\n}\n```\n\n**Pitfalls:**\n- `input.path` is typically an array (`[\"users\", \"alice\"]`), not a\n  string. Build it consistently at the gateway.\n- Path-prefix matching is easy; full pattern matching is not. For\n  parameterized routes, decode at the gateway and pass structured\n  fields.\n\n---\n\n## 6. Rate limiting (with sliding window data)\n\n**When to use:** allow N requests per principal per window. Lightweight\nlimit enforcement; for high throughput, push to a dedicated rate\nlimiter.\n\n```rego\npackage rate\n\nimport rego.v1\n\n# Configuration: 100 requests per principal per 60-second window.\nlimit := 100\nwindow_seconds := 60\n\n# input.now is a unix timestamp in nanoseconds.\n# data.requests[principal] is an array of nanosecond timestamps.\n\ncurrent_window := requests if {\n    requests := [t | some t in data.requests[input.principal]; t > input.now - window_seconds * 1000000000]\n}\n\n# Do not name this rule `count`: it would shadow the built-in of the same\n# name, and the call below would resolve to the rule instead.\nrequest_count := count(current_window)\n\nallow if request_count < limit\n\ndeny_reason := sprintf(\n    \"rate limit exceeded: %d requests in last %d seconds (limit %d)\",\n    [request_count, window_seconds, limit],\n) if not allow\n```\n\n**Pitfalls:**\n- `data.requests` grows unbounded unless the writer prunes outside the\n  window. Schedule prune on every write.\n- This pattern is *advisory* -- under load, two concurrent decisions\n  can both see `count == limit - 1` and both allow. For strict\n  limits, use a Lua/Redis token bucket at the gateway and have OPA\n  validate the token, not count requests.\n\n---\n\n## Where these patterns came from\n\nEach is distilled from production policy code, and this server's\nintegration tests evaluate every pattern against OPA.\n\nFor more patterns, see:\n\n- OPA Playground: https://play.openpolicyagent.org/\n- Awesome OPA: https://github.com/anderseknert/awesome-opa\n- Styra DAS pattern library: https://docs.styra.com/das/policies\n";
 //# sourceMappingURL=patterns.d.ts.map

package/dist/resources/patterns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/resources/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,wwTAoXpB,CAAC"}
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/resources/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,m/VA+YpB,CAAC"}