@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/tools/helpers/coverage-gaps.js

@@ -67,10 +67,9 @@ export function registerRegoCoverageGaps(server, config) {
         description: 'Run opa test --coverage and return a per-file breakdown of uncovered line ranges. Identifies which rules or branches are not yet exercised by tests. Files are sorted by coverage ascending so the worst-covered files appear first. Use threshold to limit the report to files below a target coverage percentage.',
         inputSchema: RegoCoverageGapsInput,
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
+            readOnlyHint: false,
+            // Runs Rego supplied by the caller; a policy can reach the network through http.send.
+            openWorldHint: true,
         },
     }, async ({ paths, threshold, runPattern }, { signal }) => {
         return withToolEnvelope(config, async () => {
@@ -100,6 +99,9 @@ export function registerRegoCoverageGaps(server, config) {
             // passing records with any status field, so filtering for pass: true
             // always produces zero. Subtraction is the correct approach.
             const testsPassed = testRecords.length - testsFailed - testsSkipped;
+            // OPA emits no test records in coverage mode, so reporting three zeros
+            // stated that no tests ran when the truth is that it did not say.
+            const counts = testRecords.length > 0 ? { testsPassed, testsFailed, testsSkipped } : {};
             const overallCoverage = coverageReport.coverage ?? 0;
             const filesWithGaps = [];
             for (const [file, report] of Object.entries(coverageReport.files ?? {})) {
@@ -124,9 +126,7 @@ export function registerRegoCoverageGaps(server, config) {
                 overallCoverage,
                 totalFiles: Object.keys(coverageReport.files ?? {}).length,
                 filesWithGaps,
-                testsPassed,
-                testsFailed,
-                testsSkipped,
+                ...counts,
             });
         });
     });

package/dist/tools/helpers/coverage-gaps.js.map

@@ -1 +1 @@
-{"version":3,"file":"coverage-gaps.js","sourceRoot":"","sources":["../../../src/tools/helpers/coverage-gaps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,qFAAqF,CACtF;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uHAAuH,CACxH;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC3F,CAAC;AAyCF;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAI1C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,IAAI,cAA6C,CAAC;IAElD,8DAA8D;IAC9D,MAAM,IAAI,GAAG,YAAY,CAAU,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,IAAyB,EAAE,CAAC;IACpE,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,YAAY,CAAU,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC,GAAI,MAA0B,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC9E,cAAc,GAAG,MAA2B,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,qTAAqT;QACvT,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACrD,OAAO,gBAAgB,CAAyB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B;gBACE,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI;gBACd,UAAU;aACX,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE5E,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,GAAG,CACR,YAAY,EACZ,4IAA4I,EAC5I,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC9C,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CACR,gBAAgB,EAChB,4GAA4G,EAC5G;oBACE,IAAI,EAAE,sFAAsF;iBAC7F,CACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7D,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC9D,oEAAoE;YACpE,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,GAAG,YAAY,CAAC;YACpE,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC;YAErD,MAAM,aAAa,GAAsB,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;gBAE5C,+DAA+D;gBAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,IAAI,SAAS;oBAAE,SAAS;gBACtE,8CAA8C;gBAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEtC,aAAa,CAAC,IAAI,CAAC;oBACjB,IAAI;oBACJ,eAAe;oBACf,eAAe,EAAE,UAAU;oBAC3B,kBAAkB,EAAE,mBAAmB,CAAC,UAAU,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YAED,2EAA2E;YAC3E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;YAEpE,OAAO,EAAE,CAAyB;gBAChC,eAAe;gBACf,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC1D,aAAa;gBACb,WAAW;gBACX,WAAW;gBACX,YAAY;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"coverage-gaps.js","sourceRoot":"","sources":["../../../src/tools/helpers/coverage-gaps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,qFAAqF,CACtF;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uHAAuH,CACxH;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;CAC3F,CAAC;AAiDF;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAI1C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,IAAI,cAA6C,CAAC;IAElD,8DAA8D;IAC9D,MAAM,IAAI,GAAG,YAAY,CAAU,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,IAAyB,EAAE,CAAC;IACpE,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,YAAY,CAAU,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC,GAAI,MAA0B,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YAC9E,cAAc,GAAG,MAA2B,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiB,EAAE,MAAc;IACxE,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,qTAAqT;QACvT,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,sFAAsF;YACtF,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACrD,OAAO,gBAAgB,CAAyB,MAAM,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B;gBACE,KAAK,EAAE,UAAU,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI;gBACd,UAAU;aACX,EACD,MAAM,CACP,CAAC;YAEF,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAEhD,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE5E,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,OAAO,GAAG,CACR,YAAY,EACZ,4IAA4I,EAC5I,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAC9C,CAAC;gBACJ,CAAC;gBACD,OAAO,GAAG,CACR,gBAAgB,EAChB,4GAA4G,EAC5G;oBACE,IAAI,EAAE,sFAAsF;iBAC7F,CACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7D,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC9D,oEAAoE;YACpE,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,GAAG,YAAY,CAAC;YACpE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,IAAI,CAAC,CAAC;YAErD,MAAM,aAAa,GAAsB,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBACxE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;gBAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;gBAE5C,+DAA+D;gBAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,eAAe,IAAI,SAAS;oBAAE,SAAS;gBACtE,8CAA8C;gBAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEtC,aAAa,CAAC,IAAI,CAAC;oBACjB,IAAI;oBACJ,eAAe;oBACf,eAAe,EAAE,UAAU;oBAC3B,kBAAkB,EAAE,mBAAmB,CAAC,UAAU,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YAED,2EAA2E;YAC3E,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;YAEpE,OAAO,EAAE,CAAyB;gBAChC,eAAe;gBACf,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM;gBAC1D,aAAa;gBACb,GAAG,MAAM;aACV,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/describe-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-policy.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/describe-policy.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAc9C,UAAU,cAAc;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAqBD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AAUD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6ElF"}
+{"version":3,"file":"describe-policy.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/describe-policy.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAmB9C,UAAU,cAAc;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC3B;AAqBD,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,SAAS,EAAE,OAAO,CAAC;IACnB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,kBAAkB,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AAUD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6ElF"}

package/dist/tools/helpers/describe-policy.js

@@ -5,7 +5,7 @@
 import { z } from 'zod';
 import { OpaCli } from '../../lib/opa-cli.js';
 import { err, ok } from '../../lib/errors.js';
-import { mapSubprocessFailure, tryParseJson, withToolEnvelope } from '../../lib/tool-helpers.js';
+import { mapSubprocessFailure, sanitizeInlinePathsDeep, tryParseJson, withToolEnvelope, } from '../../lib/tool-helpers.js';
 const RegoDescribePolicyInput = {
     source: z.string().min(1).describe('Rego source to describe.'),
 };
@@ -37,7 +37,7 @@ export function registerRegoDescribePolicy(server, config) {
                 return subprocessFailure;
             if (result.exitCode !== 0) {
                 return err('INVALID_REGO', 'opa parse rejected the source.', {
-                    details: { stderr: result.stderr.trim() },
+                    details: sanitizeInlinePathsDeep({ stderr: result.stderr.trim() }),
                 });
             }
             const ast = tryParseJson(result.stdout);

package/dist/tools/helpers/describe-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"describe-policy.js","sourceRoot":"","sources":["../../../src/tools/helpers/describe-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,uBAAuB,GAAG;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CAC/D,CAAC;AAsDF,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAiB,EAAE,MAAc;IAC1E,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,mWAAmW;QACrW,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,OAAO,gBAAgB,CAA2B,MAAM,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAY,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1C,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC;oBAC1B,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC;oBAC/B,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,eAAe,CAAC;oBAC3D,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,aAAa,CAAC;oBACrD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;wBAAE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;oBACvF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,IAAI;oBACJ,SAAS,EAAE,eAAe;oBAC1B,WAAW,EAAE,CAAC;oBACd,OAAO,EAAE,aAAa;oBACtB,UAAU,EAAE,OAAO;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAEjC,OAAO,EAAE,CAA2B;gBAClC,OAAO,EAAE,WAAW;gBACpB,OAAO;gBACP,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,KAAK;gBACL,kBAAkB,EAAE,GAAG,CAAC,WAAW;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"describe-policy.js","sourceRoot":"","sources":["../../../src/tools/helpers/describe-policy.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,EACZ,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,uBAAuB,GAAG;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CAC/D,CAAC;AAsDF,SAAS,WAAW,CAAC,KAA+B;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAAiB,EAAE,MAAc;IAC1E,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,mWAAmW;QACrW,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/B,OAAO,gBAAgB,CAA2B,MAAM,EAAE,KAAK,IAAI,EAAE;YACnE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAC;YAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,GAAG,CAAC,cAAc,EAAE,gCAAgC,EAAE;oBAC3D,OAAO,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAY,MAAM,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;YAE9C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC9C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1C,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,CAAC,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;gBAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC;oBAC1B,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC;oBAC/B,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,eAAe,CAAC;oBAC3D,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,aAAa,CAAC;oBACrD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;wBAAE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;oBACvF,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;oBACb,IAAI;oBACJ,SAAS,EAAE,eAAe;oBAC1B,WAAW,EAAE,CAAC;oBACd,OAAO,EAAE,aAAa;oBACtB,UAAU,EAAE,OAAO;oBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAEjC,OAAO,EAAE,CAA2B;gBAClC,OAAO,EAAE,WAAW;gBACpB,OAAO;gBACP,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,KAAK;gBACL,kBAAkB,EAAE,GAAG,CAAC,WAAW;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/explain-decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"explain-decision.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/explain-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,UAAU,UAAU;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAwCD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAoDnF"}
+{"version":3,"file":"explain-decision.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/explain-decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAM9C,UAAU,UAAU;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,EAAE;QACP,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAwCD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAmDnF"}

package/dist/tools/helpers/explain-decision.js

@@ -47,10 +47,9 @@ export function registerRegoExplainDecision(server, config) {
         description: 'Evaluate a Rego query with full tracing and return a structured trace plus per-rule fired/not-fired summary. Use this when you need to answer "why was this denied?" -- the agent reads the structured trace and narrates the cause without re-implementing the trace parser.',
         inputSchema: SharedEvalInput,
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
+            readOnlyHint: false,
+            // Runs Rego supplied by the caller; a policy can reach the network through http.send.
+            openWorldHint: true,
         },
     }, async (args, { signal }) => {
         return withToolEnvelope(config, async () => {

package/dist/tools/helpers/explain-decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"explain-decision.js","sourceRoot":"","sources":["../../../src/tools/helpers/explain-decision.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,0BAA0B,CAAC;AA4BzF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAQ,IAAqC,CAAC,IAAI,EAAE,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B;IAIrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC;QACnC,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACnB,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI;gBAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,UAAU;QACV,cAAc;QACd,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,+QAA+Q;QACjR,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,OAAO,gBAAgB,CAA4B,MAAM,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,yDAAyD;gBACzD,OAAO,GAAG,CAAC,YAAY,CAAC,KAAM,CAAC,IAAI,EAAE,YAAY,CAAC,KAAM,CAAC,OAAO,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,KAAM,CAAC,IAAI;oBAC9B,OAAO,EAAE,YAAY,CAAC,KAAM,CAAC,OAAO;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAsB,CAAC;YAEjD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAiB,CAAC;YACvD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAEtC,OAAO,EAAE,CAA4B;gBACnC,MAAM,EACJ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;oBAC5B,CAAC,CAAE,IAAI,CAAC,MAA8D,CAAC,CAAC,CAAC;wBACrE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;oBAC7B,CAAC,CAAC,SAAS;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;gBACnC,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC3C,KAAK;gBACL,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"explain-decision.js","sourceRoot":"","sources":["../../../src/tools/helpers/explain-decision.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuB,MAAM,0BAA0B,CAAC;AA4BzF,SAAS,eAAe,CAAC,IAAa;IACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAQ,IAAqC,CAAC,IAAI,EAAE,IAAI,CAAC;AAC3D,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B;IAIrD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC;QACnC,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YACnB,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI;gBAAE,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;QAC/B,WAAW;QACX,UAAU;QACV,UAAU;QACV,cAAc;QACd,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,+QAA+Q;QACjR,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,sFAAsF;YACtF,aAAa,EAAE,IAAI;SACpB;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,OAAO,gBAAgB,CAA4B,MAAM,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACnF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;gBACrB,yDAAyD;gBACzD,OAAO,GAAG,CAAC,YAAY,CAAC,KAAM,CAAC,IAAI,EAAE,YAAY,CAAC,KAAM,CAAC,OAAO,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,KAAM,CAAC,IAAI;oBAC9B,OAAO,EAAE,YAAY,CAAC,KAAM,CAAC,OAAO;iBACrC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAsB,CAAC;YAEjD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAiB,CAAC;YACvD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAEtC,OAAO,EAAE,CAA4B;gBACnC,MAAM,EACJ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;oBAC5B,CAAC,CAAE,IAAI,CAAC,MAA8D,CAAC,CAAC,CAAC;wBACrE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;oBAC7B,CAAC,CAAC,SAAS;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;gBACnC,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC3C,KAAK;gBACL,OAAO,EAAE;oBACP,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/helpers/explain-undefined.d.ts

@@ -33,9 +33,15 @@ export interface RuleAnalysis {
     source: 'trace' | 'standalone-eval';
 }
 export interface RegoExplainUndefinedOutput {
-    /** Whether the query produced a value or not. */
-    queryResult: 'undefined' | 'defined';
-    /** Present only when queryResult is "defined". */
+    /**
+     * Whether the query produced a value.
+     *
+     * `default` means it produced one only because a `default` rule supplied it:
+     * no other definition of the rule matched. The per-rule breakdown says why,
+     * which is the same question `undefined` asks.
+     */
+    queryResult: 'undefined' | 'defined' | 'default';
+    /** Present when queryResult is "defined" or "default". */
     value?: unknown;
     /** Human-readable explanation. */
     summary: string;

package/dist/tools/helpers/explain-undefined.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"explain-undefined.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/explain-undefined.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA6E9C,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,sDAAsD;IACtD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,sEAAsE;IACtE,iBAAiB,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,0CAA0C;IAC1C,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC,iDAAiD;IACjD,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0BAA0B;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AA+KD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA4NpF"}
+{"version":3,"file":"explain-undefined.d.ts","sourceRoot":"","sources":["../../../src/tools/helpers/explain-undefined.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AA+E9C,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,sDAAsD;IACtD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,sEAAsE;IACtE,iBAAiB,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,0CAA0C;IAC1C,MAAM,EAAE,OAAO,GAAG,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,0BAA0B;IACzC;;;;;;OAMG;IACH,WAAW,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;IACjD,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0BAA0B;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAsPD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CA6SpF"}

package/dist/tools/helpers/explain-undefined.js

@@ -15,8 +15,9 @@
  * For rules that appear in the trace (OPA entered them), the blocking
  * condition is identified by matching Fail-event rows against body-
  * expression rows from the AST. For rules that do not appear in the trace
- * (indexed out), each body expression is evaluated as a standalone query
- * to determine which one is not satisfied.
+ * (indexed out), the body is evaluated as cumulative prefixes inside the
+ * rule's package, with its imports, to find the first condition that does
+ * not hold.
  */
 import { readFile } from 'node:fs/promises';
 import { z } from 'zod';
@@ -75,20 +76,35 @@ function queryToPackageAndRule(query) {
         packagePath: parts.slice(0, -1).join('.'),
     };
 }
+/**
+ * The source row a trace event refers to.
+ *
+ * OPA does not populate `Node.location` on trace events; the row lives on the
+ * event's own `Location`. Reading only the node meant every row comparison fell
+ * through to matching on the rule name alone, so all clauses of a multi-clause
+ * rule looked present in the trace as soon as any one of them was, and the ones
+ * the indexer had eliminated were never evaluated standalone. They came back as
+ * `unevaluable` with no blocking condition, which is the answer this tool
+ * exists to give.
+ */
+function traceEventRow(ev) {
+    return ev.Node?.location?.row ?? ev.Location?.row;
+}
+function matchesRule(ev, ruleName, ruleRow) {
+    if (ev.Op?.toLowerCase() !== 'enter')
+        return false;
+    if (!ev.Node)
+        return false;
+    if (extractRuleHeadName(ev.Node.head) !== ruleName)
+        return false;
+    const row = traceEventRow(ev);
+    // Disambiguate the clauses of an incremental rule by source row.
+    if (ruleRow !== undefined && row !== undefined)
+        return row === ruleRow;
+    return true;
+}
 function ruleAppearsInTrace(ruleName, ruleRow, trace) {
-    return trace.some((ev) => {
-        if (ev.Op?.toLowerCase() !== 'enter')
-            return false;
-        if (!ev.Node)
-            return false;
-        if (extractRuleHeadName(ev.Node.head) !== ruleName)
-            return false;
-        // When we have source row information, use it to disambiguate incremental rules.
-        if (ruleRow !== undefined && ev.Node.location?.row !== undefined) {
-            return ev.Node.location.row === ruleRow;
-        }
-        return true;
-    });
+    return trace.some((ev) => matchesRule(ev, ruleName, ruleRow));
 }
 function findBlockingRowFromTrace(rule, trace) {
     const ruleName = extractRuleHeadName(rule.head);
@@ -97,16 +113,7 @@ function findBlockingRowFromTrace(rule, trace) {
     if (bodyRows.size === 0)
         return undefined;
     // Locate the Enter event for this specific rule definition.
-    const enterIdx = trace.findIndex((ev) => {
-        if (ev.Op?.toLowerCase() !== 'enter')
-            return false;
-        if (extractRuleHeadName(ev.Node?.head) !== ruleName)
-            return false;
-        if (ruleRow !== undefined && ev.Node?.location?.row !== undefined) {
-            return ev.Node.location.row === ruleRow;
-        }
-        return true;
-    });
+    const enterIdx = trace.findIndex((ev) => matchesRule(ev, ruleName ?? '', ruleRow));
     if (enterIdx < 0)
         return undefined;
     // Find the first Fail event after the Enter that falls on a body expression row.
@@ -126,24 +133,66 @@ function findBlockingRowFromTrace(rule, trace) {
     }
     return undefined;
 }
-async function evalConditionStandalone(exprText, evalBase, opa, signal) {
+/**
+ * The module's import statements as `--import` takes them: the path as
+ * written, plus the alias when there is one. `--package` alone does not bring
+ * them, and a body expression through an import is unsafe without them.
+ */
+function moduleImports(ast) {
+    const out = [];
+    for (const imp of ast.imports ?? []) {
+        const path = decodeBase64Text(imp.path?.location?.text);
+        if (!path)
+            continue;
+        out.push(imp.alias ? `${path} as ${imp.alias}` : path);
+    }
+    return out;
+}
+/**
+ * Ceiling on the query text handed to opa. Windows caps a command line at
+ * 32 KiB, and the prefixes grow with every condition that held.
+ */
+const MAX_PREFIX_CHARS = 16_000;
+/**
+ * Evaluate a prefix of a rule body as a query inside the rule's package. The
+ * prefix carries the locals assigned earlier, and the package makes a bare
+ * reference to a sibling rule resolve, so the answer is the one the rule
+ * itself would get up to that point.
+ */
+async function evalPrefixStandalone(prefixText, pkg, imports, evalBase, opa, signal) {
     const result = await opa.eval({
-        query: exprText,
+        query: prefixText,
         source: evalBase.source,
         paths: evalBase.paths,
         input: evalBase.input,
         inputPath: evalBase.inputPath,
+        // The parsed path carries the `data` root; the flag takes the package
+        // name as written in the module.
+        package: pkg.replace(/^data\./, '') || undefined,
+        imports,
     }, signal);
+    // A binary that could not be run, or a run that was killed, is the tool's
+    // failure, not a fact about this condition.
+    const spawnFailure = mapSubprocessFailure(result, 'opa');
+    if (spawnFailure)
+        return { spawnFailure };
     if (result.exitCode === null || result.exitCode !== 0) {
-        const firstLine = (result.stderr.trim() || result.stdout.trim()).split('\n')[0] ?? 'unknown error';
-        return { result: 'unevaluable', note: `Standalone eval failed: ${firstLine}` };
+        // With --format=json OPA writes its error document to stdout; the first
+        // line of that is a brace. Read the messages out of it.
+        const errors = tryParseJson(result.stdout)?.errors;
+        const detail = errors
+            ?.map((e) => e.message)
+            .filter((m) => typeof m === 'string' && m.length > 0)
+            .join('; ') ||
+            (result.stderr.trim() || result.stdout.trim()).split('\n')[0] ||
+            'unknown error';
+        return { result: 'unevaluable', note: `Standalone eval failed: ${detail}` };
     }
-    // OPA returns a result row for a body expression even when it evaluates to a
-    // false value -- e.g. `input.user.tier == "premium"` against tier "free"
-    // yields a row whose expression value is `false`, not an empty result. A
-    // condition is satisfied only when it produces a solution whose expressions
-    // are all defined and not `false`, so inspect the expression values rather
-    // than merely the presence of a row (which would mark every comparison true).
+    // For a single-expression query OPA returns a row even when the value is
+    // `false`; with several expressions an unsatisfied one yields no row at
+    // all. Either way a condition is satisfied only when some row has every
+    // expression defined and not `false`, so inspect the values rather than the
+    // presence of a row.
     const parsed = tryParseJson(result.stdout);
     const satisfied = (parsed?.result ?? []).some((row) => {
         const exprs = row.expressions ?? [];
@@ -151,14 +200,25 @@ async function evalConditionStandalone(exprText, evalBase, opa, signal) {
     });
     return satisfied ? { result: 'true' } : { result: 'false' };
 }
-function buildSummary(query, rules, defaultValue) {
+/** Structural equality, enough for the scalars and small literals a default holds. */
+function deepEqual(a, b) {
+    if (a === b)
+        return true;
+    if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+function buildSummary(query, rules, defaultValue, viaDefault) {
     const lines = [];
+    const state = viaDefault
+        ? `falls back to its default value ${JSON.stringify(defaultValue)} because no other definition matched`
+        : 'is undefined';
     if (rules.length === 0) {
-        lines.push(`${query} is undefined: no matching rules found in the analysed source.`);
+        lines.push(`${query} ${state}: no matching rules found in the analysed source.`);
     }
     else {
         const count = rules.length;
-        lines.push(`${query} is undefined. ${count} rule definition${count !== 1 ? 's' : ''} analysed:`);
+        lines.push(`${query} ${state}. ${count} rule definition${count !== 1 ? 's' : ''} analysed:`);
         for (const r of rules) {
             const loc = r.location.row > 0 ? ` (row ${r.location.row})` : '';
             const bc = r.blockingCondition;
@@ -171,13 +231,15 @@ function buildSummary(query, rules, defaultValue) {
                 lines.push(`  Rule ${r.ruleIndex}${loc}: no analysable body conditions.`);
             }
             else {
-                const unevalCount = r.conditions.filter((c) => c.result === 'unevaluable').length;
+                // Conditions behind the one that stopped evaluation were never attempted
+                // and are not what the summary is warning about.
+                const unevalCount = r.conditions.filter((c) => c.result === 'unevaluable' && !/^Not (reached|evaluated):/.test(c.note ?? '')).length;
                 lines.push(`  Rule ${r.ruleIndex}${loc}: blocking condition could not be determined ` +
                     `(${unevalCount} unevaluable expression${unevalCount !== 1 ? 's' : ''}).`);
             }
         }
     }
-    if (defaultValue !== undefined) {
+    if (!viaDefault && defaultValue !== undefined) {
         lines.push(`Default value: ${JSON.stringify(defaultValue)}.`);
     }
     return lines.join('\n');
@@ -188,16 +250,18 @@ export function registerRegoExplainUndefined(server, config) {
     server.registerTool('rego_explain_undefined', {
         title: 'Explain why a Rego query is undefined',
         description: 'Diagnose why a fully-qualified Rego query (e.g. "data.authz.allow") produces no ' +
-            'value. Combines a plain eval, a full-trace eval, and per-condition AST analysis to ' +
-            'identify the exact body expression blocking each rule. Handles both runtime failures ' +
-            '(trace-based) and indexer elimination (standalone condition eval). Returns a structured ' +
+            'value, or falls back to its default. Combines a plain eval, a full-trace eval, and ' +
+            'per-condition AST analysis to identify the exact body expression blocking each rule. ' +
+            'Handles both runtime failures (trace-based) and indexer elimination (standalone ' +
+            'condition eval). A rule written with `default allow := false` always has a value, so ' +
+            '`queryResult` reports `default` for it and the same per-rule breakdown follows: the ' +
+            'question "why is allow false" is the question this answers. Returns a structured ' +
             'breakdown of which conditions blocked each rule plus a human-readable summary.',
         inputSchema: RegoExplainUndefinedInput,
         annotations: {
-            readOnlyHint: true,
-            destructiveHint: false,
-            idempotentHint: true,
-            openWorldHint: false,
+            readOnlyHint: false,
+            // Runs Rego supplied by the caller; a policy can reach the network through http.send.
+            openWorldHint: true,
         },
     }, async (args, { signal }) => {
         return withToolEnvelope(config, async () => {
@@ -209,17 +273,19 @@ export function registerRegoExplainUndefined(server, config) {
                     return pv.error;
                 resolvedPaths = pv.resolved;
             }
+            let resolvedInputPath;
             if (args.inputPath) {
                 const iv = validatePaths([args.inputPath], config, { mustExist: true });
                 if (!iv.ok)
                     return iv.error;
+                resolvedInputPath = iv.resolved[0];
             }
             const evalBase = {
                 query: args.query,
                 source: args.source,
                 paths: resolvedPaths.length > 0 ? resolvedPaths : undefined,
                 input: args.input,
-                inputPath: args.inputPath,
+                inputPath: resolvedInputPath,
             };
             // ── Step 1: plain eval ────────────────────────────────────────────
             const plainResult = await opa.eval(evalBase, signal);
@@ -237,27 +303,17 @@ export function registerRegoExplainUndefined(server, config) {
             }
             const plainJson = tryParseJson(plainResult.stdout);
             const isDefined = (plainJson?.result?.length ?? 0) > 0;
-            if (isDefined) {
-                const value = plainJson.result[0]?.expressions?.[0]?.value;
-                return ok({
-                    queryResult: 'defined',
-                    value,
-                    summary: `${args.query} is defined with value: ${JSON.stringify(value)}.`,
-                    rulesFound: 0,
-                    rules: [],
-                });
-            }
-            // ── Step 2: eval with --explain=full ──────────────────────────────
-            const traceResult = await opa.eval({ ...evalBase, explain: 'full' }, signal);
-            const traceSpawnErr = mapSubprocessFailure(traceResult, 'opa');
-            if (traceSpawnErr)
-                return traceSpawnErr;
-            const traceJson = tryParseJson(traceResult.stdout);
-            const trace = traceJson?.explanation ?? [];
-            // ── Step 3: parse AST(s) ──────────────────────────────────────────
+            const definedValue = isDefined
+                ? plainJson.result[0]
+                    ?.expressions?.[0]?.value
+                : undefined;
+            // ── Step 2: parse AST(s) ──────────────────────────────────────────
             const asts = [];
             if (args.source) {
                 const pr = await opa.parse({ source: args.source, includeLocations: true }, signal);
+                const parseFailure = mapSubprocessFailure(pr, 'opa');
+                if (parseFailure)
+                    return parseFailure;
                 if (pr.exitCode === 0) {
                     const ast = tryParseJson(pr.stdout);
                     if (ast)
@@ -270,6 +326,9 @@ export function registerRegoExplainUndefined(server, config) {
                     try {
                         const src = await readFile(filePath, 'utf8');
                         const pr = await opa.parse({ source: src, includeLocations: true }, signal);
+                        const parseFailure = mapSubprocessFailure(pr, 'opa');
+                        if (parseFailure)
+                            return parseFailure;
                         if (pr.exitCode === 0) {
                             const ast = tryParseJson(pr.stdout);
                             if (ast)
@@ -281,9 +340,12 @@ export function registerRegoExplainUndefined(server, config) {
                     }
                 }
             }
-            // ── Step 4: find matching rules ───────────────────────────────────
+            // ── Step 3: find matching rules ───────────────────────────────────
             const queryParsed = queryToPackageAndRule(args.query);
             const matchedRules = [];
+            /** Package and imports of each matched rule, index-aligned with matchedRules. */
+            const matchedPackages = [];
+            const matchedImports = [];
             for (const ast of asts) {
                 const pkgPath = extractPackagePath(ast);
                 if (queryParsed && pkgPath !== queryParsed.packagePath)
@@ -292,9 +354,35 @@ export function registerRegoExplainUndefined(server, config) {
                     const name = extractRuleHeadName(rule.head);
                     if (!queryParsed || name === queryParsed.ruleName) {
                         matchedRules.push(rule);
+                        matchedPackages.push(pkgPath);
+                        matchedImports.push(moduleImports(ast));
                     }
                 }
             }
+            // A rule written with `default allow := false` always has a value, so the
+            // query is never undefined and the analysis below used to be skipped for
+            // the shape most policies are written in. When the value came from the
+            // default and nothing else matched, the interesting question is unchanged.
+            const defaultRule = matchedRules.find((r) => r.default === true);
+            const viaDefault = isDefined &&
+                defaultRule !== undefined &&
+                deepEqual(defaultRule.head?.value?.value, definedValue);
+            if (isDefined && !viaDefault) {
+                return ok({
+                    queryResult: 'defined',
+                    value: definedValue,
+                    summary: `${args.query} is defined with value: ${JSON.stringify(definedValue)}.`,
+                    rulesFound: 0,
+                    rules: [],
+                });
+            }
+            // ── Step 4: eval with --explain=full ──────────────────────────────
+            const traceResult = await opa.eval({ ...evalBase, explain: 'full' }, signal);
+            const traceSpawnErr = mapSubprocessFailure(traceResult, 'opa');
+            if (traceSpawnErr)
+                return traceSpawnErr;
+            const traceJson = tryParseJson(traceResult.stdout);
+            const trace = traceJson?.explanation ?? [];
             // ── Step 5: analyse each rule ─────────────────────────────────────
             let defaultValue;
             const rules = [];
@@ -353,18 +441,70 @@ export function registerRegoExplainUndefined(server, config) {
                 }
                 else {
                     // Standalone eval: OPA's indexer eliminated this rule before
-                    // entering its body. Evaluate each condition independently.
+                    // entering its body. Each condition is judged inside the rule's
+                    // package, with its imports, and with the conditions before it in
+                    // scope, so a local assigned earlier and a bare reference to a
+                    // sibling rule both resolve. Evaluation stops at the first
+                    // condition that does not hold, as on the traced path.
+                    // Evaluating each condition alone left the dependent ones
+                    // unevaluable and named the first non-true one as the blocker,
+                    // often a satisfied guard sitting ahead of the real one.
+                    const pkg = matchedPackages[ruleIndex] ?? '';
+                    const imports = matchedImports[ruleIndex] ?? [];
+                    const held = [];
+                    let stopped;
                     for (const cond of conditions) {
                         if (cond.text === '<expression>') {
                             cond.note = 'No location text available; cannot evaluate standalone.';
-                            continue;
+                            stopped = 'Not evaluated: an earlier condition has no location text.';
+                            break;
+                        }
+                        // Keep the query under the command-line limit by dropping the
+                        // oldest held terms. A shorter prefix only widens the solutions,
+                        // so a false stays a real blocker; a dropped assignment makes a
+                        // later term unsafe, which comes back unevaluable, not guessed.
+                        let prefix = [...held, cond.text];
+                        while (prefix.length > 1 && prefix.join('; ').length > MAX_PREFIX_CHARS) {
+                            prefix = prefix.slice(1);
                         }
-                        const evalOut = await evalConditionStandalone(cond.text, evalBase, opa, signal);
+                        let evalOut;
+                        try {
+                            evalOut = await evalPrefixStandalone(prefix.join('; '), pkg, imports, evalBase, opa, signal);
+                        }
+                        catch (e) {
+                            if (signal?.aborted)
+                                throw e;
+                            evalOut = {
+                                result: 'unevaluable',
+                                note: `Standalone eval failed: ${e instanceof Error ? e.message : String(e)}`,
+                            };
+                        }
+                        if ('spawnFailure' in evalOut)
+                            return evalOut.spawnFailure;
                         cond.result = evalOut.result;
                         if (evalOut.note)
                             cond.note = evalOut.note;
+                        if (evalOut.result === 'true') {
+                            held.push(cond.text);
+                            continue;
+                        }
+                        stopped =
+                            evalOut.result === 'false'
+                                ? 'Not reached: an earlier condition does not hold.'
+                                : 'Not evaluated: an earlier condition could not be evaluated.';
+                        break;
+                    }
+                    if (stopped !== undefined) {
+                        for (const cond of conditions) {
+                            if (cond.result === 'unevaluable' && cond.note === undefined)
+                                cond.note = stopped;
+                        }
                     }
-                    const blockingCondition = conditions.find((c) => c.result !== 'true') ?? null;
+                    // The blocker is the first condition that is not true, and only
+                    // when it is a definite false; past one that could not be
+                    // evaluated, naming a later condition would be a guess.
+                    const firstNotTrue = conditions.find((c) => c.result !== 'true');
+                    const blockingCondition = firstNotTrue?.result === 'false' ? firstNotTrue : null;
                     rules.push({
                         ruleIndex,
                         isDefault: false,
@@ -376,9 +516,10 @@ export function registerRegoExplainUndefined(server, config) {
                 }
             }
             const nonDefaultRules = rules.filter((r) => !r.isDefault);
-            const summary = buildSummary(args.query, nonDefaultRules, defaultValue);
+            const summary = buildSummary(args.query, nonDefaultRules, defaultValue, viaDefault);
             return ok({
-                queryResult: 'undefined',
+                queryResult: viaDefault ? 'default' : 'undefined',
+                ...(viaDefault ? { value: definedValue } : {}),
                 summary,
                 rulesFound: nonDefaultRules.length,
                 defaultValue,