@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/config.js

@@ -6,10 +6,41 @@
  * Cursor, VS Code) pass config via the `env` object in their JSON.
  */
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join, posix, win32 } from 'node:path';
 import { z } from 'zod';
 import { resolveOpaBinary } from './lib/resolve-binary.js';
 import { DEFAULT_MAX_OUTPUT_BYTES } from './lib/subprocess.js';
+/**
+ * Whether a `*_BINARY` value is acceptable on `platform`: a bare command
+ * name, looked up on PATH by the spawn, or an absolute path. A relative path
+ * would resolve against wherever the client happened to launch the server.
+ * On Windows a path with a leading separator and no drive counts as absolute
+ * to `isAbsolute`, yet it resolves against the current drive, the same hazard
+ * as the drive-relative `C:regal.exe`; a UNC path starts with two separators
+ * and is fine.
+ */
+export function isBinarySpec(value, platform = process.platform) {
+    if (value === '.' || value === '..')
+        return false;
+    if (!/[\\/]/.test(value) && !/^[A-Za-z]:/.test(value))
+        return true;
+    if (platform === 'win32' && /^[\\/](?![\\/])/.test(value))
+        return false;
+    return (platform === 'win32' ? win32 : posix).isAbsolute(value);
+}
+const binarySchema = (name) => z
+    .string()
+    .refine((v) => isBinarySpec(v), {
+    message: 'must be a bare command name found on PATH, or an absolute path',
+})
+    .default(name);
+/**
+ * Node clamps a timer of 2^31 ms or more to 1 ms, with only a process warning.
+ * A large value reads as "effectively no timeout" and produced the opposite:
+ * every subprocess and every HTTP call timed out immediately.
+ */
+const MAX_TIMER_MS = 2_147_483_647;
+const TIMER_TOO_LARGE = 'Timeout must be below 2147483647 ms (about 24 days). Node clamps anything larger to 1 ms, which times out every call immediately.';
 const ConfigSchema = z.object({
     /** Base URL of a running OPA server (used by `opa_*` runtime tools). */
     opaUrl: z
@@ -22,22 +53,42 @@ const ConfigSchema = z.object({
     /** Optional bearer token for OPA running with `--authentication=token`. */
     opaToken: z.string().optional(),
     /** Path to the `opa` binary. Defaults to `opa` on PATH. */
-    opaBinary: z.string().default('opa'),
+    opaBinary: binarySchema('opa'),
     /** Path to the `regal` binary. Defaults to `regal` on PATH. */
-    regalBinary: z.string().default('regal'),
+    regalBinary: binarySchema('regal'),
     /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
-    conftestBinary: z.string().default('conftest'),
+    conftestBinary: binarySchema('conftest'),
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
-    subprocessTimeoutMs: z.coerce.number().int().positive().default(30_000),
+    subprocessTimeoutMs: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(MAX_TIMER_MS, TIMER_TOO_LARGE)
+        .default(30_000),
     /** HTTP request timeout for OPA REST API calls. */
-    httpTimeoutMs: z.coerce.number().int().positive().default(15_000),
+    httpTimeoutMs: z.coerce
+        .number()
+        .int()
+        .positive()
+        .max(MAX_TIMER_MS, TIMER_TOO_LARGE)
+        .default(15_000),
     /**
      * Allow-listed root directories for file path inputs. Tools that accept
      * filesystem paths reject anything outside these roots. Empty by
      * default -- file-based tools refuse to read from disk until the
      * operator explicitly opts in via `OPA_MCP_ALLOWED_PATHS`.
      */
-    allowedPaths: z.array(z.string()).default([]),
+    allowedPaths: z
+        .array(
+    // A relative root is resolved against the server's working directory,
+    // which for a stdio server is wherever the client happened to launch it.
+    // The same configuration would then permit different directories on
+    // different machines, so it is refused rather than guessed at, which is
+    // what the documentation has always said happens.
+    z.string().refine(isAbsolute, {
+        message: 'must be an absolute path',
+    }))
+        .default([]),
     /** Path to the log file. Defaults to OS tmpdir + orygn-opa-mcp.log. */
     logFile: z.string().default(join(tmpdir(), 'orygn-opa-mcp.log')),
     /** Log level for the file logger. */
@@ -47,7 +98,13 @@ const ConfigSchema = z.object({
      * Larger payloads are truncated with `truncated: true` and a hint to
      * write to a file path the agent specifies.
      */
-    maxResponseBytes: z.coerce.number().int().positive().default(100_000),
+    maxResponseBytes: z.coerce
+        .number()
+        .int()
+        // The smallest complete envelope is under 300 bytes; a cap that cannot
+        // hold one is refused rather than exceeded.
+        .min(512, { message: 'must be at least 512' })
+        .default(100_000),
     /**
      * Maximum bytes captured from a subprocess's stdout and stderr, each counted
      * separately. On overflow the stream is clamped and the child is killed.
@@ -87,21 +144,36 @@ const ENV_VAR_NAMES = {
     maxResponseBytes: 'OPA_MCP_MAX_RESPONSE_BYTES',
     maxSubprocessBytes: 'OPA_MCP_MAX_SUBPROCESS_BYTES',
 };
+/**
+ * Read an environment variable, treating an empty or blank value as unset.
+ *
+ * A shell that expands an unset variable leaves an empty string behind, and
+ * `OPA_BINARY=""` was taken as a real path: it is not the literal default
+ * `opa`, so binary resolution skipped the bundled build and every tool call
+ * tried to spawn nothing. Blank means "not configured" for every variable here.
+ */
+function env(name) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return undefined;
+    const trimmed = raw.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
 export function loadConfig() {
     const allowedPaths = parseAllowedPaths(process.env['OPA_MCP_ALLOWED_PATHS']);
     const parsed = ConfigSchema.safeParse({
-        opaUrl: process.env['OPA_URL'],
-        opaToken: process.env['OPA_TOKEN'],
-        opaBinary: process.env['OPA_BINARY'],
-        regalBinary: process.env['REGAL_BINARY'],
-        conftestBinary: process.env['CONFTEST_BINARY'],
-        subprocessTimeoutMs: process.env['OPA_MCP_TIMEOUT_MS'],
-        httpTimeoutMs: process.env['OPA_MCP_HTTP_TIMEOUT_MS'],
+        opaUrl: env('OPA_URL'),
+        opaToken: env('OPA_TOKEN'),
+        opaBinary: env('OPA_BINARY'),
+        regalBinary: env('REGAL_BINARY'),
+        conftestBinary: env('CONFTEST_BINARY'),
+        subprocessTimeoutMs: env('OPA_MCP_TIMEOUT_MS'),
+        httpTimeoutMs: env('OPA_MCP_HTTP_TIMEOUT_MS'),
         allowedPaths,
-        logFile: process.env['OPA_MCP_LOG_FILE'],
-        logLevel: process.env['OPA_MCP_LOG_LEVEL'],
-        maxResponseBytes: process.env['OPA_MCP_MAX_RESPONSE_BYTES'],
-        maxSubprocessBytes: process.env['OPA_MCP_MAX_SUBPROCESS_BYTES'],
+        logFile: env('OPA_MCP_LOG_FILE'),
+        logLevel: env('OPA_MCP_LOG_LEVEL'),
+        maxResponseBytes: env('OPA_MCP_MAX_RESPONSE_BYTES'),
+        maxSubprocessBytes: env('OPA_MCP_MAX_SUBPROCESS_BYTES'),
     });
     if (!parsed.success) {
         console.error('opa-mcp: invalid configuration');

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEvE,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAEjE;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7C,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAErE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9C,mBAAmB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACtD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACrD,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;QAC3D,kBAAkB,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;KAChE,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACtF,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,CAAC;KACE,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC9B,OAAO,EAAE,gEAAgE;CAC1E,CAAC;KACD,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;GAIG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GACnB,mIAAmI,CAAC;AAEtI,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC;IAE9B,+DAA+D;IAC/D,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC;IAElC,qEAAqE;IACrE,cAAc,EAAE,YAAY,CAAC,UAAU,CAAC;IAExC,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB;;;;;OAKG;IACH,YAAY,EAAE,CAAC;SACZ,KAAK;IACJ,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,kDAAkD;IAClD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IAEd,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;QACN,uEAAuE;QACvE,4CAA4C;SAC3C,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;SAC7C,OAAO,CAAC,OAAO,CAAC;IAEnB;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACtC,mBAAmB,EAAE,GAAG,CAAC,oBAAoB,CAAC;QAC9C,aAAa,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC7C,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAClC,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,GAAG,CAAC,8BAA8B,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/constants.d.ts

@@ -1,8 +1,3 @@
-/**
- * Server identity constants shared between the entry point and the
- * mcp_server_info tool. Defined here to avoid a circular import
- * (server.ts -> tools -> meta -> server.ts).
- */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.4.0";
+export declare const SERVER_VERSION: string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAgB3C,eAAO,MAAM,cAAc,EAAE,MAA6B,CAAC"}

package/dist/constants.js

@@ -1,8 +1,22 @@
 /**
- * Server identity constants shared between the entry point and the
- * mcp_server_info tool. Defined here to avoid a circular import
+ * Server identity shared between the entry point and the mcp_server_info
+ * tool. Defined here to avoid a circular import
  * (server.ts -> tools -> meta -> server.ts).
  */
+import { createRequire } from 'node:module';
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.4.0';
+/**
+ * Read from package.json, which the release flow bumps, so the server cannot
+ * report one version while carrying another. Every packaging places
+ * package.json beside dist: the npm tarball, the Docker image and the .mcpb
+ * bundle.
+ */
+function versionFromPackage() {
+    const pkg = createRequire(import.meta.url)('../package.json');
+    const version = typeof pkg === 'object' && pkg !== null ? pkg.version : undefined;
+    if (typeof version !== 'string')
+        throw new Error('package.json beside dist has no version');
+    return version;
+}
+export const SERVER_VERSION = versionFromPackage();
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAE3C;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAY,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACvE,MAAM,OAAO,GACX,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAW,kBAAkB,EAAE,CAAC"}

package/dist/lib/bundle-signatures.d.ts

@@ -0,0 +1,23 @@
+export interface SignaturesSummary {
+    /** JWT `alg` header, e.g. `RS256`. */
+    algorithm: string;
+    /** Number of files the signature covers. */
+    filesSigned: number;
+    keyId?: string;
+    scope?: string;
+}
+/**
+ * Read the summary of a `.signatures.json` file. Throws on any shape OPA
+ * would not have written, so a caller never reports a file it cannot read.
+ */
+export declare function readSignaturesSummary(path: string): Promise<SignaturesSummary>;
+export declare function isKeyOrAlgorithmError(output: string): boolean;
+export type VerificationFailureReason = 'key_invalid' | 'not_a_bundle' | 'signature_invalid' | 'scope_mismatch' | 'file_modified' | 'file_missing' | 'file_added' | 'unsigned' | 'signatures_malformed' | 'file_unparseable' | 'bundle_load_error' | 'unknown';
+export interface VerificationFailure {
+    reason: VerificationFailureReason;
+    summary: string;
+    hint?: string;
+}
+/** Classify OPA's stdout+stderr from a failed verification. */
+export declare function classifyVerificationFailure(output: string): VerificationFailure;
+//# sourceMappingURL=bundle-signatures.d.ts.map

package/dist/lib/bundle-signatures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signatures.d.ts","sourceRoot":"","sources":["../../src/lib/bundle-signatures.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0BpF;AASD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,YAAY,GACZ,UAAU,GACV,sBAAsB,GACtB,kBAAkB,GAClB,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,yBAAyB,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAuFD,+DAA+D;AAC/D,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAW/E"}

package/dist/lib/bundle-signatures.js

@@ -0,0 +1,152 @@
+/**
+ * Helpers for OPA bundle signatures.
+ *
+ * `opa sign` writes `{ "signatures": ["<JWT>"] }` with exactly one JWT. Its
+ * header carries the algorithm and its payload lists every signed file as
+ * `{ name, hash, algorithm }`, plus whatever extra claims (`keyid`, `scope`)
+ * were supplied through a claims file. Reading that summary back is how the
+ * sign tool describes what it just produced, and it is deliberately not a
+ * verification: nothing here checks the signature, only OPA does that.
+ */
+import { readFile } from 'node:fs/promises';
+function base64UrlDecode(segment) {
+    const b64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = b64 + '='.repeat((4 - (b64.length % 4)) % 4);
+    return Buffer.from(padded, 'base64').toString('utf8');
+}
+/**
+ * Read the summary of a `.signatures.json` file. Throws on any shape OPA
+ * would not have written, so a caller never reports a file it cannot read.
+ */
+export async function readSignaturesSummary(path) {
+    const raw = await readFile(path, 'utf8');
+    const parsed = JSON.parse(raw);
+    const sigs = parsed.signatures;
+    if (!Array.isArray(sigs) || sigs.length !== 1 || typeof sigs[0] !== 'string') {
+        throw new Error('expected exactly one JWT in "signatures"');
+    }
+    const parts = sigs[0].split('.');
+    if (parts.length !== 3)
+        throw new Error('signature is not a JWT');
+    const header = JSON.parse(base64UrlDecode(parts[0]));
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    if (typeof header.alg !== 'string')
+        throw new Error('JWT header has no alg');
+    if (!Array.isArray(payload.files))
+        throw new Error('JWT payload has no files array');
+    const summary = {
+        algorithm: header.alg,
+        filesSigned: payload.files.length,
+    };
+    if (typeof payload.keyid === 'string')
+        summary.keyId = payload.keyid;
+    if (typeof payload.scope === 'string')
+        summary.scope = payload.scope;
+    return summary;
+}
+/**
+ * `opa sign` and `opa build` both print these when the key file is not a PEM
+ * key or the algorithm is not one OPA knows. They are the caller's input, not
+ * the bundle, so the tools report them as INVALID_INPUT.
+ */
+const KEY_OR_ALGORITHM_ERROR = /failed to parse PEM block|unknown signature algorithm/i;
+export function isKeyOrAlgorithmError(output) {
+    return KEY_OR_ALGORITHM_ERROR.test(output);
+}
+/**
+ * Each pattern is text OPA 1.19 prints, on stdout, for that failure.
+ *
+ * The order follows what OPA does while loading a signed bundle: it reads the
+ * key and algorithm, checks the JWT against the key, compares the scope claim,
+ * then reads every file. A Rego file is hashed as written, so its digest is
+ * compared before it is parsed. A data file or `.manifest` is hashed by parsed
+ * value, so one that no longer parses fails BEFORE its digest is compared;
+ * that is why an unparseable data file is `file_unparseable` (possibly
+ * modified) and not a load error of signed content. Rego parse errors come
+ * last, after the signature and every digest passed. Where messages overlap,
+ * the more specific rule is listed first.
+ */
+const FAILURE_RULES = [
+    {
+        reason: 'key_invalid',
+        pattern: KEY_OR_ALGORITHM_ERROR,
+        summary: 'the verification key or algorithm could not be used',
+        hint: 'verificationKey must be a PEM public key, and signingAlg one OPA supports. For an HMAC-signed bundle pass signingAlg (HS256, HS384 or HS512) so the file is read as the secret rather than as PEM.',
+    },
+    {
+        reason: 'not_a_bundle',
+        pattern: /archive read failed|bundle read failed/i,
+        summary: 'the path is not a bundle directory or a .tar.gz archive',
+    },
+    {
+        reason: 'signature_invalid',
+        pattern: /failed to verify JWT signature|verification error/i,
+        summary: 'the signature does not verify with this key',
+        hint: 'Check the key and pass signingAlg matching how the bundle was signed. OPA verifies against the single key given regardless of the signature keyid claim, so this is the key or the algorithm, not the key id.',
+    },
+    {
+        reason: 'scope_mismatch',
+        pattern: /scope mismatch/i,
+        summary: 'the scope given does not match the scope claim in the signature',
+        hint: 'Pass scope with exactly the value the bundle was signed with, and no scope if it was signed without one.',
+    },
+    {
+        reason: 'file_modified',
+        pattern: /digest mismatch/i,
+        summary: 'a signed file was modified after signing',
+    },
+    {
+        reason: 'file_missing',
+        pattern: /specified in bundle signatures but not found/i,
+        summary: 'a file the signature covers is missing from the bundle',
+    },
+    {
+        reason: 'file_added',
+        pattern: /not included in bundle signature/i,
+        summary: 'the bundle contains a file the signature does not cover',
+        hint: 'A directory signature names files under the directory name given to opa, so this is also what a directory reports when verified under a different name than it was signed with. Moving it elsewhere under the same name is fine; renaming it is not. For an artifact that survives renaming, build a signed archive with opa_bundle_build.',
+    },
+    {
+        reason: 'unsigned',
+        pattern: /missing \.signatures\.json/i,
+        summary: 'the bundle has no .signatures.json',
+    },
+    {
+        reason: 'signatures_malformed',
+        pattern: /signatures decode|missing JWT|base64 decode JWT|split compact JWT|unexpected end of JSON input|\.signatures\.json/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+    {
+        reason: 'file_unparseable',
+        pattern: /yaml:/i,
+        summary: 'a data file or .manifest could not be parsed, so its digest was never compared',
+        hint: 'OPA hashes data files by parsed value and stops at the first one it cannot parse, before comparing digests. The file may have been modified after signing. Restore it, or fix it and sign again.',
+    },
+    {
+        reason: 'bundle_load_error',
+        pattern: /rego_\w+_error|errors? occurred|manifest roots/i,
+        summary: 'the bundle could not be loaded, so verification did not complete',
+        hint: 'OPA parses Rego after the signature and every digest passed, so the policy is signed and unmodified but does not load under Rego v1. A policy written for Rego v0 verifies with v0Compatible.',
+    },
+    {
+        // A JWT payload that decodes but is not JSON: OPA prints only the JSON
+        // error, with none of the prefixes matched above.
+        reason: 'signatures_malformed',
+        pattern: /invalid character/i,
+        summary: '.signatures.json is not a valid signature file',
+    },
+];
+/** Classify OPA's stdout+stderr from a failed verification. */
+export function classifyVerificationFailure(output) {
+    for (const rule of FAILURE_RULES) {
+        if (rule.pattern.test(output)) {
+            const { pattern: _pattern, ...failure } = rule;
+            return failure;
+        }
+    }
+    return {
+        reason: 'unknown',
+        summary: 'OPA rejected the bundle for a reason this tool does not recognise',
+    };
+}
+//# sourceMappingURL=bundle-signatures.js.map

package/dist/lib/bundle-signatures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-signatures.js","sourceRoot":"","sources":["../../src/lib/bundle-signatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAsB,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAIpD,CAAC;IACF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAErF,MAAM,OAAO,GAAsB;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;KAClC,CAAC;IACF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,wDAAwD,CAAC;AAExF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,MAAM,aAAa,GAA6D;IAC9E;QACE,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,qDAAqD;QAC9D,IAAI,EAAE,oMAAoM;KAC3M;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,yCAAyC;QAClD,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,oDAAoD;QAC7D,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,+MAA+M;KACtN;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,iEAAiE;QAC1E,IAAI,EAAE,0GAA0G;KACjH;IACD;QACE,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,0CAA0C;KACpD;IACD;QACE,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,4UAA4U;KACnV;IACD;QACE,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,oCAAoC;KAC9C;IACD;QACE,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EACL,oHAAoH;QACtH,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,gFAAgF;QACzF,IAAI,EAAE,kMAAkM;KACzM;IACD;QACE,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,kEAAkE;QAC3E,IAAI,EAAE,+LAA+L;KACtM;IACD;QACE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC;YAC/C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mEAAmE;KAC7E,CAAC;AACJ,CAAC"}

package/dist/lib/child-env.d.ts

@@ -10,7 +10,13 @@
  * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
  * their client config, and whatever else the operator's shell happens to hold.
  *
- * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
  * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
  * and `build` all succeed with a completely empty environment, so the entries
  * below exist for correctness in real-world setups (proxies, custom CA bundles,
@@ -25,7 +31,8 @@
  *
  * @param extra   Variables the calling command needs. Readable by evaluated
  *                policy like everything else here, so pass secrets only when the
- *                command actually requires them.
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
  * @param source  Environment to read from. Injectable for testing.
  */
 export declare function buildChildEnv(extra?: Record<string, string>, source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/lib/child-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA0GH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAanB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}
+{"version":3,"file":"child-env.d.ts","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA0HH;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAyBnB;AAED,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAY,CAAC"}

package/dist/lib/child-env.js

@@ -10,7 +10,13 @@
  * `OPA_TOKEN`, the `GITHUB_TOKEN` this project's own README asks users to put in
  * their client config, and whatever else the operator's shell happens to hold.
  *
- * So the child gets an explicit allow-list instead. Nothing on it is a secret.
+ * So the child gets an explicit allow-list instead. It holds no cloud or
+ * repository token, which is what motivated the list, but it is not free of
+ * credentials: a proxy URL can embed one, and `HTTP_PROXY` and its siblings are
+ * on the list because dropping them breaks every user behind a corporate proxy.
+ * An operator who would rather lose proxy support than expose those credentials
+ * to evaluated policy can name them in `OPA_MCP_BLOCK_ENV`.
+ *
  * Measured against the bundled OPA 1.19.0, `version`, `eval`, `check`, `test`
  * and `build` all succeed with a completely empty environment, so the entries
  * below exist for correctness in real-world setups (proxies, custom CA bundles,
@@ -77,9 +83,8 @@ const TOOL_CONFIG = [
     'REGISTRY_AUTH_FILE',
 ];
 const ALLOWED = [...COMMON, ...POSIX, ...WINDOWS, ...NETWORK, ...TOOL_CONFIG];
-/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
-function passthroughNames(source) {
-    const raw = source['OPA_MCP_PASSTHROUGH_ENV'];
+/** Split a comma or semicolon separated list of variable names. */
+function nameList(raw) {
     if (!raw)
         return [];
     return raw
@@ -87,6 +92,21 @@ function passthroughNames(source) {
         .map((s) => s.trim())
         .filter((s) => s.length > 0);
 }
+/** Names an operator opted into via OPA_MCP_PASSTHROUGH_ENV. */
+function passthroughNames(source) {
+    return nameList(source['OPA_MCP_PASSTHROUGH_ENV']);
+}
+/**
+ * Names an operator withheld via OPA_MCP_BLOCK_ENV.
+ *
+ * Applied last, so it overrides the allow-list, the passthrough list and the
+ * caller's own `extra`. The point is to be able to say no to something this
+ * module would otherwise hand down, and a rule that could be overridden by the
+ * thing it is meant to restrain would not be worth having.
+ */
+function blockedNames(source) {
+    return nameList(source['OPA_MCP_BLOCK_ENV']);
+}
 /**
  * Windows treats variable names case-insensitively, and the casing in
  * `process.env` follows whatever the parent used, so an exact-key lookup would
@@ -123,7 +143,8 @@ const WINDOWS_IDENTITY_TO_BLANK = ['USERNAME', 'USERDOMAIN', 'LOGONSERVER'];
  *
  * @param extra   Variables the calling command needs. Readable by evaluated
  *                policy like everything else here, so pass secrets only when the
- *                command actually requires them.
+ *                command actually requires them. `OPA_MCP_BLOCK_ENV` removes a
+ *                name even when it appears here.
  * @param source  Environment to read from. Injectable for testing.
  */
 export function buildChildEnv(extra, source = process.env) {
@@ -137,7 +158,18 @@ export function buildChildEnv(extra, source = process.env) {
         if (value !== undefined)
             env[name] = value;
     }
-    return extra ? { ...env, ...extra } : env;
+    const result = extra ? { ...env, ...extra } : env;
+    for (const name of blockedNames(source)) {
+        delete result[name];
+        if (process.platform === 'win32') {
+            const wanted = name.toLowerCase();
+            for (const key of Object.keys(result)) {
+                if (key.toLowerCase() === wanted)
+                    delete result[key];
+            }
+        }
+    }
+    return result;
 }
 /** Exposed for tests and for documenting the surface. */
 export const ALLOWED_CHILD_ENV_VARS = ALLOWED;

package/dist/lib/child-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,MAAM,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}
+{"version":3,"file":"child-env.js","sourceRoot":"","sources":["../../src/lib/child-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,GAAG;IACd,SAAS;IACT,YAAY;IACZ,aAAa;IACb,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,aAAa;IACb,WAAW;IACX,UAAU;IACV,SAAS;IACT,cAAc;IACd,wBAAwB;IACxB,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,eAAe;IACf,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,eAAe;IACf,eAAe;IACf,oBAAoB;CACrB,CAAC;AAEF,MAAM,OAAO,GAAsB,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC;AAEjG,mEAAmE;AACnE,SAAS,QAAQ,CAAC,GAAuB;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACP,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,MAAyB;IACjD,OAAO,QAAQ,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAAyB;IAC7C,OAAO,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,yBAAyB,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA8B,EAC9B,SAA4B,OAAO,CAAC,GAAG;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,yBAAyB;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAsB,OAAO,CAAC"}

package/dist/lib/conftest-cli.d.ts

@@ -20,8 +20,20 @@ export interface ConftestFileResult {
     failures: ConftestMessage[];
     warnings: ConftestMessage[];
     skipped: ConftestMessage[];
-    exceptions: string[];
+    exceptions: ConftestMessage[];
 }
+/**
+ * Parse `--output=json` from `conftest test` or `conftest verify` into
+ * results whose array fields are always present.
+ *
+ * conftest marks every array `omitempty`, so a file that passes cleanly
+ * arrives as `{filename, namespace, successes}` with no `failures` key at
+ * all, and `verify` with no test rules prints the literal `null`. Reading
+ * `.failures.length` off that threw on every clean run. Returns null when
+ * stdout is not a JSON array (or `null`), which is what a command-level
+ * failure looks like.
+ */
+export declare function parseConftestResults(stdout: string): ConftestFileResult[] | null;
 /** Input for `conftest test`. */
 export interface ConftestTestInput {
     /** Absolute paths to configuration files to evaluate. */
@@ -30,10 +42,10 @@ export interface ConftestTestInput {
     inlineConfig?: string;
     /**
      * Parser used for inline config content. Determines the temp file
-     * extension (yaml → .yaml, json → .json, dockerfile → Dockerfile, etc.).
+     * name (yaml -> config.yaml, dockerfile -> Dockerfile, and so on).
      * Defaults to `yaml` when not specified.
      */
-    inlineConfigParser?: string;
+    inlineConfigParser?: ConftestParser;
     /**
      * Absolute path to a directory or file containing Rego policies.
      * Defaults to `./policy` (conftest's convention). Mutually exclusive
@@ -60,7 +72,7 @@ export interface ConftestTestInput {
      * flag, overriding extension-based detection. Use it to parse files whose
      * extension does not match their format (e.g. a `.tfstate` file as `json`).
      */
-    parser?: string;
+    parser?: ConftestParser;
 }
 /** Input for `conftest verify`. */
 export interface ConftestVerifyInput {
@@ -86,12 +98,15 @@ export interface ConftestPushInput {
     policy?: string;
 }
 /**
- * Wrapper around the local `conftest` binary.
- *
- * Methods do not throw on conftest-side errors -- the exit code on the
- * returned `SpawnResult` is the signal. Inline source is written to temp
- * files/directories because conftest does not read from stdin.
+ * The parsers conftest 0.69 accepts for `--parser`, and the only values a
+ * caller may pass. The name also chooses the temp file name for inline
+ * config, so it must never be free text: a value carrying path separators
+ * used to be joined straight into the temp path, and `../` sequences in it
+ * walked out of the temp directory to wherever the caller pointed.
  */
+export declare const CONFTEST_PARSERS: readonly ["cue", "dockerfile", "dotenv", "edn", "hcl1", "hcl2", "hocon", "ignore", "ini", "json", "jsonnet", "nginx", "properties", "spdx", "textproto", "toml", "vcl", "xml", "yaml"];
+export type ConftestParser = (typeof CONFTEST_PARSERS)[number];
+export declare function isConftestParser(value: string): value is ConftestParser;
 export declare class ConftestCli {
     private readonly config;
     constructor(config: Config);
@@ -129,7 +144,7 @@ export declare class ConftestCli {
      * Run `conftest` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch for unusual invocations.
      */
-    run(args: string[], signal?: AbortSignal): Promise<SpawnResult>;
+    run(args: string[], signal?: AbortSignal, cwd?: string): Promise<SpawnResult>;
     /**
      * Create temp assets for inline inputs, run `fn`, then clean up.
      * Returns whatever `fn` returns.

package/dist/lib/conftest-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD;;;;;;GAMG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAMhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYrE;;;OAGG;YACW,cAAc;IAyC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}
+{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,IAAI,CA8BhF;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,wLAoBnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAgHD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgDhF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAUpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAanF;;;OAGG;YACW,cAAc;IAqC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA8CvB"}