@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/lib/conftest-cli.js

@@ -6,38 +6,133 @@
  * other tools work without Conftest installed. If absent, conftest tools
  * return a structured `CONFTEST_NOT_FOUND` error with an install hint.
  *
- * Conftest exit codes:
+ * Conftest exit codes, measured with 0.69.0:
  *   0  -- all tests pass (or no failures, only warnings)
- *   1  -- one or more test failures
- *   2+ -- command error (bad args, policy not found, parse error, etc.)
+ *   1  -- failures, or warnings under --fail-on-warn, or a command error (bad
+ *         args, policy not found, parse error); the two are told apart by
+ *         whether stdout holds results
+ *   2  -- failures together with warnings under --fail-on-warn
  *
  * All structured output is obtained via `--output=json`; raw text output
  * is never parsed.
  */
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
+import { rewriteLoadPaths } from './opa-paths.js';
 import { runBinary } from './subprocess.js';
-// ─── Parser → file extension map ─────────────────────────────────────────────
-const PARSER_TO_EXT = {
-    yaml: '.yaml',
-    json: '.json',
-    toml: '.toml',
-    hcl1: '.hcl',
-    hcl2: '.hcl',
-    ini: '.ini',
-    xml: '.xml',
-    dotenv: '.env',
-    cue: '.cue',
-    jsonnet: '.jsonnet',
-    properties: '.properties',
-    edn: '.edn',
-    hocon: '.conf',
-    // Dockerfile is a special case -- conftest detects by filename
-    dockerfile: '',
+/**
+ * Parse `--output=json` from `conftest test` or `conftest verify` into
+ * results whose array fields are always present.
+ *
+ * conftest marks every array `omitempty`, so a file that passes cleanly
+ * arrives as `{filename, namespace, successes}` with no `failures` key at
+ * all, and `verify` with no test rules prints the literal `null`. Reading
+ * `.failures.length` off that threw on every clean run. Returns null when
+ * stdout is not a JSON array (or `null`), which is what a command-level
+ * failure looks like.
+ */
+export function parseConftestResults(stdout) {
+    const text = stdout.trim();
+    if (text === '')
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null)
+        return [];
+    if (!Array.isArray(parsed))
+        return null;
+    const messages = (v) => Array.isArray(v)
+        ? v.map((m) => m !== null && typeof m === 'object' ? m : { msg: String(m) })
+        : [];
+    return parsed.map((item) => {
+        const r = (item !== null && typeof item === 'object' ? item : {});
+        return {
+            ...r,
+            filename: typeof r['filename'] === 'string' ? r['filename'] : '',
+            namespace: typeof r['namespace'] === 'string' ? r['namespace'] : '',
+            successes: typeof r['successes'] === 'number' ? r['successes'] : 0,
+            failures: messages(r['failures']),
+            warnings: messages(r['warnings']),
+            skipped: messages(r['skipped']),
+            exceptions: messages(r['exceptions']),
+        };
+    });
+}
+// ─── Parser names ─────────────────────────────────────────────────────────────
+/**
+ * The parsers conftest 0.69 accepts for `--parser`, and the only values a
+ * caller may pass. The name also chooses the temp file name for inline
+ * config, so it must never be free text: a value carrying path separators
+ * used to be joined straight into the temp path, and `../` sequences in it
+ * walked out of the temp directory to wherever the caller pointed.
+ */
+export const CONFTEST_PARSERS = [
+    'cue',
+    'dockerfile',
+    'dotenv',
+    'edn',
+    'hcl1',
+    'hcl2',
+    'hocon',
+    'ignore',
+    'ini',
+    'json',
+    'jsonnet',
+    'nginx',
+    'properties',
+    'spdx',
+    'textproto',
+    'toml',
+    'vcl',
+    'xml',
+    'yaml',
+];
+export function isConftestParser(value) {
+    return CONFTEST_PARSERS.includes(value);
+}
+/**
+ * Temp file names for inline config. The parser is passed to conftest
+ * explicitly, so the name only has to be plausible for a reader of the
+ * output; conftest also recognises a Dockerfile by name.
+ */
+const INLINE_CONFIG_FILENAME = {
+    cue: 'config.cue',
+    dockerfile: 'Dockerfile',
+    dotenv: 'config.env',
+    edn: 'config.edn',
+    hcl1: 'config.hcl',
+    hcl2: 'config.hcl',
+    hocon: 'config.conf',
+    ignore: '.gitignore',
+    ini: 'config.ini',
+    json: 'config.json',
+    jsonnet: 'config.jsonnet',
+    nginx: 'nginx.conf',
+    properties: 'config.properties',
+    spdx: 'config.spdx',
+    textproto: 'config.textproto',
+    toml: 'config.toml',
+    vcl: 'config.vcl',
+    xml: 'config.xml',
+    yaml: 'config.yaml',
 };
-function parserToExt(parser) {
-    return PARSER_TO_EXT[parser.toLowerCase()] ?? `.${parser.toLowerCase()}`;
+/**
+ * Temp file name for inline config. Throws on anything outside the closed
+ * set; the tool layer rejects such input first, so this is the backstop for
+ * any other caller.
+ */
+function inlineConfigFilename(parser) {
+    const name = parser ?? 'yaml';
+    if (!isConftestParser(name)) {
+        throw new Error(`unsupported conftest parser: ${name}`);
+    }
+    return INLINE_CONFIG_FILENAME[name];
 }
 // ─── ConftestCli ──────────────────────────────────────────────────────────────
 /**
@@ -47,6 +142,61 @@ function parserToExt(parser) {
  * returned `SpawnResult` is the signal. Inline source is written to temp
  * files/directories because conftest does not read from stdin.
  */
+/**
+ * Split a policy directory into the directory to run from and the name to pass.
+ *
+ * `conftest pull` and `conftest push` resolve `--policy` against the working
+ * directory rather than treating an absolute path as absolute. On Windows pull
+ * fails outright, reporting a path of the form `.\\C:\\...`, and push drops the
+ * volume and reads from the same path on whichever drive it was started on. The
+ * tools resolve the caller's path against the allow-list before handing it over,
+ * so it is always absolute and neither command ever addressed the directory
+ * asked for. Running from the parent and passing the final component is
+ * unambiguous on every platform.
+ */
+function relativeToParent(policy) {
+    if (!policy)
+        return undefined;
+    const parent = dirname(policy);
+    const name = basename(policy);
+    // A root such as `C:\\` or `/` has nothing to descend into.
+    if (name.length === 0 || parent === policy)
+        return undefined;
+    return { parent, name };
+}
+/**
+ * Pick a working directory on the drive the given paths live on.
+ *
+ * Conftest loads its policy and data directories through OPA's loader, which
+ * splits an absolute path on its first colon and resolves the remainder
+ * against the drive the process is on, so `--policy C:...` fails from a
+ * working directory on another drive. The configs under test are read by
+ * conftest itself and open fine from anywhere, so they are not anchors: an
+ * inline config in the temp directory can be tested against a policy on
+ * another drive, and an inline policy against a config on another drive.
+ * The paths are left exactly as given, since conftest echoes them in its
+ * output and the inline temp files are matched there afterwards to redact
+ * them.
+ */
+function anchorDrive(args, paths) {
+    const present = paths.filter((p) => typeof p === 'string' && p.length > 0);
+    const out = rewriteLoadPaths(args, present, { respell: false });
+    if (out.conflict) {
+        return {
+            conflict: {
+                exitCode: 1,
+                stdout: '',
+                stderr: `paths span more than one drive (${out.conflict.drives.join(', ')}). ` +
+                    'conftest resolves an absolute path against the drive it runs on, so the policy ' +
+                    'and data directories must be on a single drive.',
+                timedOut: false,
+                aborted: false,
+                durationMs: 0,
+            },
+        };
+    }
+    return out.cwd !== undefined ? { cwd: out.cwd } : {};
+}
 export class ConftestCli {
     config;
     constructor(config) {
@@ -100,12 +250,21 @@ export class ConftestCli {
                 args.push('--combine');
             if (input.failOnWarn)
                 args.push('--fail-on-warn');
-            if (input.parser)
-                args.push('--parser', input.parser);
+            // conftest's --parser overrides extension detection, so inline
+            // config names its parser explicitly rather than trusting the temp
+            // file's extension. A global `parser` wins when both are given.
+            const parser = input.parser ?? (configPath ? (input.inlineConfigParser ?? 'yaml') : undefined);
+            if (parser)
+                args.push('--parser', parser);
             // Config files (positional args, must come last)
             const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
             args.push(...effectiveFiles);
-            const result = await this.run(args, signal);
+            // Only the policy and data go through OPA's loader; conftest reads
+            // the configs itself, so they may sit on any drive.
+            const anchored = anchorDrive(args, [effectivePolicyDir, ...(input.data ?? [])]);
+            if (anchored.conflict)
+                return anchored.conflict;
+            const result = await this.run(args, signal, anchored.cwd);
             return this.sanitizeOutput(result, configPath, policyDir);
         });
     }
@@ -121,7 +280,10 @@ export class ConftestCli {
             args.push('--namespace', input.namespace);
         for (const d of input.data ?? [])
             args.push('--data', d);
-        return this.run(args, signal);
+        const anchored = anchorDrive(args, [input.policy, ...(input.data ?? [])]);
+        if (anchored.conflict)
+            return anchored.conflict;
+        return this.run(args, signal, anchored.cwd);
     }
     /**
      * Pull policies from a remote OCI or Git location into a local
@@ -129,9 +291,10 @@ export class ConftestCli {
      */
     async pull(input, signal) {
         const args = ['pull', input.url];
-        if (input.policy)
-            args.push('--policy', input.policy);
-        return this.run(args, signal);
+        const target = relativeToParent(input.policy);
+        if (target)
+            args.push('--policy', target.name);
+        return this.run(args, signal, target?.parent);
     }
     /**
      * Push the local policy bundle to a remote OCI registry. Uses
@@ -139,15 +302,16 @@ export class ConftestCli {
      */
     async push(input, signal) {
         const args = ['push', input.repository];
-        if (input.policy)
-            args.push('--policy', input.policy);
-        return this.run(args, signal);
+        const target = relativeToParent(input.policy);
+        if (target)
+            args.push('--policy', target.name);
+        return this.run(args, signal, target?.parent);
     }
     /**
      * Run `conftest` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch for unusual invocations.
      */
-    async run(args, signal) {
+    async run(args, signal, cwd) {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
@@ -155,6 +319,8 @@ export class ConftestCli {
         };
         if (signal !== undefined)
             opts.signal = signal;
+        if (cwd !== undefined)
+            opts.cwd = cwd;
         return runBinary(this.config.conftestBinary, opts);
     }
     // ─── Internal: temp file / directory management ──────────────────────────
@@ -167,10 +333,7 @@ export class ConftestCli {
         const paths = {};
         try {
             if (opts.inlineConfig !== undefined) {
-                const ext = opts.inlineConfigParser === 'dockerfile'
-                    ? ''
-                    : parserToExt(opts.inlineConfigParser ?? 'yaml');
-                const basename = opts.inlineConfigParser === 'dockerfile' ? 'Dockerfile' : `config${ext}`;
+                const basename = inlineConfigFilename(opts.inlineConfigParser);
                 // mkdtemp creates the directory atomically (O_CREAT|O_EXCL) -- safe temp file pattern.
                 const tmpDir = await mkdtemp(join(tmpdir(), 'orygn-conftest-'));
                 temps.push(tmpDir);
@@ -205,23 +368,43 @@ export class ConftestCli {
     sanitizeOutput(result, configPath, policyDir) {
         if (!configPath && !policyDir)
             return result;
-        if (!result.stdout)
-            return result;
+        // stdout holds a JSON document, where a backslash in the path is encoded
+        // as two; stderr holds the raw path. Both spellings are replaced in both
+        // streams, since an error message can quote either.
+        // OPA's loader inside conftest prints a Windows path without its drive
+        // letter, and may use either separator; each spelling is replaced in its
+        // raw and JSON-encoded form, longest first so a prefix does not win.
+        const forms = (path) => {
+            const slashes = path.replace(/\\/g, '/');
+            const spellings = [
+                path,
+                path.replace(/^[A-Za-z]:/, ''),
+                slashes,
+                slashes.replace(/^[A-Za-z]:/, ''),
+            ];
+            const all = spellings.flatMap((f) => [f, JSON.stringify(f).slice(1, -1)]);
+            return [...new Set(all)].filter((f) => f.length > 1).sort((a, b) => b.length - a.length);
+        };
+        const escapeRe = (s) => s.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+        const replaceAll = (text, path, marker) => {
+            let out = text;
+            for (const form of forms(path))
+                out = out.replace(new RegExp(escapeRe(form), 'g'), marker);
+            return out;
+        };
         let stdout = result.stdout;
+        let stderr = result.stderr;
         if (configPath) {
-            // JSON.stringify encodes backslashes as \\, so match the encoded form.
-            const jsonEncoded = JSON.stringify(configPath).slice(1, -1);
-            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
-            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline>');
+            stdout = replaceAll(stdout, configPath, '<inline>');
+            stderr = replaceAll(stderr, configPath, '<inline>');
         }
         if (policyDir) {
-            const jsonEncoded = JSON.stringify(policyDir).slice(1, -1);
-            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
-            // Policy dir appears in conftest output as part of file paths.
-            // Replace the full dir prefix so the policy filename is preserved.
-            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline-policy>');
+            // The policy dir appears as a prefix of file paths; the file name is
+            // kept.
+            stdout = replaceAll(stdout, policyDir, '<inline-policy>');
+            stderr = replaceAll(stderr, policyDir, '<inline-policy>');
         }
-        return { ...result, stdout };
+        return { ...result, stdout, stderr };
     }
 }
 //# sourceMappingURL=conftest-cli.js.map

package/dist/lib/conftest-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAiG9D,gFAAgF;AAEhF,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,MAAM;IACd,GAAG,EAAE,MAAM;IACX,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,OAAO;IACd,+DAA+D;IAC/D,UAAU,EAAE,EAAE;CACf,CAAC;AAEF,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAEtD,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB;QAC5C,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,GAAG,GACP,IAAI,CAAC,kBAAkB,KAAK,YAAY;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,CAAC;gBAC1F,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA4B9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAqB,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACV,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAqB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAClF;QACH,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAChE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/B,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAuED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,YAAY;IACZ,MAAM;IACN,WAAW;IACX,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;CACE,CAAC;AAIX,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAmC;IAC7D,GAAG,EAAE,YAAY;IACjB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,YAAY;IACnB,UAAU,EAAE,mBAAmB;IAC/B,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,kBAAkB;IAC7B,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;CACpB,CAAC;AAEF;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC;IAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAClB,IAAc,EACd,KAAgC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EACJ,mCAAmC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACtE,iFAAiF;oBACjF,iDAAiD;gBACnD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClD,+DAA+D;YAC/D,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE1C,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,mEAAmE;YACnE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB,EAAE,GAAY;QAC1D,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACtC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAE7C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAY,EAAE;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG;gBAChB,IAAI;gBACJ,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC9B,OAAO;gBACP,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;aAClC,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAU,EAAE;YACxE,IAAI,GAAG,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QAEF,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACpD,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,qEAAqE;YACrE,QAAQ;YACR,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC1D,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/lib/errors.d.ts

@@ -1,10 +1,9 @@
+import type { ToolEnvelope, ToolErrorCode } from '../types.js';
 /**
- * Helpers for building structured tool errors.
- *
- * Tools should never throw raw exceptions to the MCP layer -- every failure
- * mode returns a `ToolEnvelope` with `ok: false` and a structured `error`.
+ * Build an error envelope. The message, hint and details all pass through
+ * the temp-path sanitiser here, so a tool that quotes a binary's stderr does
+ * not have to remember to.
  */
-import type { ToolEnvelope, ToolErrorCode } from '../types.js';
 export declare function err(code: ToolErrorCode, message: string, options?: {
     hint?: string;
     details?: unknown;

package/dist/lib/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAa,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E,wBAAgB,GAAG,CACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,YAAY,CAAC,KAAK,CAAC,CAKrB;AAED,wBAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAInE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAO7D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAa,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,GAAG,CACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,YAAY,CAAC,KAAK,CAAC,CAKrB;AAED,wBAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAInE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAO7D"}

package/dist/lib/errors.js

@@ -1,9 +1,21 @@
+/**
+ * Helpers for building structured tool errors.
+ *
+ * Tools should never throw raw exceptions to the MCP layer -- every failure
+ * mode returns a `ToolEnvelope` with `ok: false` and a structured `error`.
+ */
+import { sanitizeInlinePathsDeep, sanitizeInlineText } from './inline-paths.js';
+/**
+ * Build an error envelope. The message, hint and details all pass through
+ * the temp-path sanitiser here, so a tool that quotes a binary's stderr does
+ * not have to remember to.
+ */
 export function err(code, message, options) {
-    const error = { code, message };
+    const error = { code, message: sanitizeInlineText(message) };
     if (options?.hint !== undefined)
-        error.hint = options.hint;
+        error.hint = sanitizeInlineText(options.hint);
     if (options?.details !== undefined)
-        error.details = options.details;
+        error.details = sanitizeInlinePathsDeep(options.details);
     return { ok: false, error };
 }
 export function ok(data, warnings) {

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,GAAG,CACjB,IAAmB,EACnB,OAAe,EACf,OAA8C;IAE9C,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,EAAE,CAAI,IAAO,EAAE,QAAmB;IAChD,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGhF;;;;GAIG;AACH,MAAM,UAAU,GAAG,CACjB,IAAmB,EACnB,OAAe,EACf,OAA8C;IAE9C,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACxE,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,EAAE,CAAI,IAAO,EAAE,QAAmB;IAChD,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/lib/inline-paths.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Strip this server's own temp-file paths out of anything a tool returns.
+ *
+ * Inline source is written to a private temp directory for the binaries to
+ * read, and their diagnostics, traces and coverage name that file. Nothing
+ * here imports another module of this server, so errors.ts can sanitise
+ * every envelope without an import cycle.
+ */
+/**
+ * Matches the temp-file paths written by OpaCli.withTempSource and
+ * RegalCli.withTempSource when handling inline source. Both now use
+ * mkdtemp which produces a private directory; the file inside is always
+ * named input.rego. Matches both Unix (/) and Windows (\) separators.
+ */
+export declare const INLINE_TEMP_PATH_PATTERN: RegExp;
+/**
+ * Replace a file path that refers to one of our temp files with the
+ * sentinel string `<inline>`. Returns the original string unchanged when
+ * it does not match the pattern, so callers can unconditionally apply it
+ * to all location.file values regardless of whether inline source was used.
+ */
+export declare function sanitizeInlinePath(file: string): string;
+/**
+ * Replace every temp-file path wherever it sits inside `text`: first this
+ * process's own files by their exact spelling, then anything shaped like one
+ * of them by the walk below.
+ */
+export declare function sanitizeInlineText(text: string, roots?: readonly string[]): string;
+/**
+ * Recursively rewrite every temp-file path, in string values and object
+ * keys, to the `<inline>` sentinel. OPA writes inline source to a temp file,
+ * so trace, coverage and profile output and every diagnostic reference that
+ * path; this normalizes the whole structure so callers never see an absolute
+ * temp path. Only a path shaped like this server's own temp files matches.
+ */
+export declare function sanitizeInlinePathsDeep(value: unknown): unknown;
+//# sourceMappingURL=inline-paths.d.ts.map

package/dist/lib/inline-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-paths.d.ts","sourceRoot":"","sources":["../../src/lib/inline-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAsD,CAAC;AAE5F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAuGD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW/D"}