@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/lib/inline-paths.js

@@ -0,0 +1,162 @@
+/**
+ * Strip this server's own temp-file paths out of anything a tool returns.
+ *
+ * Inline source is written to a private temp directory for the binaries to
+ * read, and their diagnostics, traces and coverage name that file. Nothing
+ * here imports another module of this server, so errors.ts can sanitise
+ * every envelope without an import cycle.
+ */
+import { tmpdir } from 'node:os';
+/**
+ * Matches the temp-file paths written by OpaCli.withTempSource and
+ * RegalCli.withTempSource when handling inline source. Both now use
+ * mkdtemp which produces a private directory; the file inside is always
+ * named input.rego. Matches both Unix (/) and Windows (\) separators.
+ */
+export const INLINE_TEMP_PATH_PATTERN = /orygn-(?:opa|regal)-mcp-[^/\\]+[/\\]input\.rego$/i;
+/**
+ * Replace a file path that refers to one of our temp files with the
+ * sentinel string `<inline>`. Returns the original string unchanged when
+ * it does not match the pattern, so callers can unconditionally apply it
+ * to all location.file values regardless of whether inline source was used.
+ */
+export function sanitizeInlinePath(file) {
+    return INLINE_TEMP_PATH_PATTERN.test(file) ? '<inline>' : file;
+}
+/**
+ * The files this server writes under the OS temp directory and hands to a
+ * binary: inline source for opa and regal, an inline schema for check-schema,
+ * and the archive bundle-verify extracts. A diagnostic names one of them by
+ * its full path, and a JSON-encoded diagnostic doubles the backslashes, so a
+ * separator is any run of them.
+ */
+const TEMP_FILE_MARKER = /orygn-(?:opa-mcp|regal-mcp|schema)[^\\/\r\n]{0,255}[\\/]+(?:input\.rego|schema\.json|verified\.tar\.gz)/gi;
+const SEGMENT_CHAR = /[^\\/:*?"<>|\r\n]/;
+const isSeparator = (c) => c === '/' || c === '\\';
+const isBlank = (c) => c === ' ' || c === '\t';
+/**
+ * Where the path that ends at `markerStart` begins: walk back over
+ * `<separators><segment>` pairs, then over a drive letter. Nothing before
+ * `floor` is examined, so a scan over a whole string is linear. A segment may
+ * hold whitespace, since a Windows temp directory sits under the user's
+ * profile and a macOS one can sit under the home directory; but a directory
+ * name does not start or end with whitespace, and text that does is prose
+ * around the path, where the walk stops. That is a heuristic, and it trades
+ * two ways: a word abutting a separator reads as a segment and is taken
+ * along with the path (prose lost, nothing leaked), and a temp directory
+ * under a component that itself starts or ends with whitespace keeps the
+ * components before it (the random temp name is still replaced).
+ */
+function pathStart(text, markerStart, floor) {
+    let start = markerStart;
+    let i = markerStart - 1;
+    while (i >= floor && isSeparator(text[i])) {
+        let j = i;
+        while (j >= floor && isSeparator(text[j]))
+            j--;
+        // Rooted at this separator run unless a segment precedes it.
+        start = j + 1;
+        let k = j;
+        while (k >= floor && SEGMENT_CHAR.test(text[k]))
+            k--;
+        if (k < j && k >= floor && isSeparator(text[k])) {
+            if (isBlank(text[j]) || isBlank(text[k + 1]))
+                break;
+            i = k;
+            continue;
+        }
+        if (k === j &&
+            j >= floor + 1 &&
+            text[j] === ':' &&
+            /[A-Za-z]/.test(text[j - 1]) &&
+            (j - 2 < floor || !/[A-Za-z0-9]/.test(text[j - 2]))) {
+            start = j - 1;
+        }
+        break;
+    }
+    return start;
+}
+/**
+ * The spellings a binary may use for a path under `root`: as written, with
+ * every separator run as either kind, JSON-encoded (backslashes doubled), and
+ * on Windows with the drive dropped, which OPA's loader does. Longest first,
+ * so a prefix never wins over the full form.
+ */
+function rootSpellings(root) {
+    const slashes = root.replace(/\\/g, '/');
+    const backslashes = root.replace(/\//g, '\\');
+    const bases = [root, slashes, backslashes];
+    for (const base of [...bases])
+        bases.push(base.replace(/^[A-Za-z]:/, ''));
+    const all = bases.flatMap((b) => [b, JSON.stringify(b).slice(1, -1)]);
+    return [...new Set(all)].filter((b) => b.length > 1).sort((a, b) => b.length - a.length);
+}
+const escapeRegExp = (text) => text.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+/**
+ * Exact matchers for this process's own temp files: the temp root the server
+ * writes under, a separator run, the directory prefix mkdtemp extends, its
+ * random suffix, and the file name. No guessing is involved, so a component
+ * of the root that starts or ends with whitespace, which the walk below has
+ * to treat as prose, is handled here.
+ */
+function exactMatchers(root) {
+    const sep = String.raw `(?:\\\\|\\|/)+`;
+    // The root must begin at a path boundary. Without this, a root such as
+    // `/tmp` matched inside `\\srv\tmp\...` or after `file://` and the text
+    // before it survived; the walk handles those spellings whole.
+    const boundary = String.raw `(?<![A-Za-z0-9_.~\\/-])`;
+    const tail = String.raw `orygn-(?:opa-mcp|regal-mcp|schema)[^\\/\r\n]{0,255}` +
+        sep +
+        String.raw `(?:input\.rego|schema\.json|verified\.tar\.gz)`;
+    return rootSpellings(root).map((r) => new RegExp(boundary + escapeRegExp(r) + sep + tail, 'gi'));
+}
+let ownMatchers;
+/** Built on first use, from the temp root the server runs with. */
+function ownTempMatchers() {
+    ownMatchers ??= exactMatchers(tmpdir());
+    return ownMatchers;
+}
+/**
+ * Replace every temp-file path wherever it sits inside `text`: first this
+ * process's own files by their exact spelling, then anything shaped like one
+ * of them by the walk below.
+ */
+export function sanitizeInlineText(text, roots) {
+    if (!text.toLowerCase().includes('orygn-'))
+        return text;
+    const matchers = roots === undefined ? ownTempMatchers() : roots.flatMap(exactMatchers);
+    for (const matcher of matchers)
+        text = text.replace(matcher, '<inline>');
+    if (!text.toLowerCase().includes('orygn-'))
+        return text;
+    let out = '';
+    let last = 0;
+    for (const match of text.matchAll(TEMP_FILE_MARKER)) {
+        const start = pathStart(text, match.index, last);
+        out += text.slice(last, start) + '<inline>';
+        last = match.index + match[0].length;
+    }
+    return out + text.slice(last);
+}
+/**
+ * Recursively rewrite every temp-file path, in string values and object
+ * keys, to the `<inline>` sentinel. OPA writes inline source to a temp file,
+ * so trace, coverage and profile output and every diagnostic reference that
+ * path; this normalizes the whole structure so callers never see an absolute
+ * temp path. Only a path shaped like this server's own temp files matches.
+ */
+export function sanitizeInlinePathsDeep(value) {
+    if (typeof value === 'string')
+        return sanitizeInlineText(value);
+    if (Array.isArray(value))
+        return value.map(sanitizeInlinePathsDeep);
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, val] of Object.entries(value)) {
+            out[sanitizeInlineText(key)] = sanitizeInlinePathsDeep(val);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=inline-paths.js.map

package/dist/lib/inline-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-paths.js","sourceRoot":"","sources":["../../src/lib/inline-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,mDAAmD,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GACpB,2GAA2G,CAAC;AAE9G,MAAM,YAAY,GAAG,mBAAmB,CAAC;AACzC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;AAEpE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,WAAmB,EAAE,KAAa;IACjE,IAAI,KAAK,GAAG,WAAW,CAAC;IACxB,IAAI,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QAChD,6DAA6D;QAC7D,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,IAAI,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAAE,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACjD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;gBAAE,MAAM;YACtD,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IACE,CAAC,KAAK,CAAC;YACP,CAAC,IAAI,KAAK,GAAG,CAAC;YACd,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YACf,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,EACpD,CAAC;YACD,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,MAAM;IACR,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE3F;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA,gBAAgB,CAAC;IACvC,uEAAuE;IACvE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,yBAAyB,CAAC;IACrD,MAAM,IAAI,GACR,MAAM,CAAC,GAAG,CAAA,qDAAqD;QAC/D,GAAG;QACH,MAAM,CAAC,GAAG,CAAA,gDAAgD,CAAC;IAC7D,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,IAAI,WAAiC,CAAC;AACtC,mEAAmE;AACnE,SAAS,eAAe;IACtB,WAAW,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAyB;IACxE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACxF,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC;QAC5C,IAAI,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/install-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-id.d.ts","sourceRoot":"","sources":["../../src/lib/install-id.ts"],"names":[],"mappings":"AA2CA;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B3D"}
+{"version":3,"file":"install-id.d.ts","sourceRoot":"","sources":["../../src/lib/install-id.ts"],"names":[],"mappings":"AA2CA;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA0C3D"}

package/dist/lib/install-id.js

@@ -43,21 +43,36 @@ function parseId(content) {
  */
 export async function getInstallId() {
     // Try reading an existing file first.
+    let unusableFileExists = false;
     try {
         const content = await readFile(INSTALL_ID_FILE, 'utf8');
         const id = parseId(content);
         if (id)
             return id;
+        // The file is there but holds no id: truncated by a crash or a full
+        // disk, or a first run interrupted between create and write.
+        unusableFileExists = true;
     }
     catch {
         // File not found yet -- fall through to create.
     }
-    // Generate a new UUID and write it exclusively (wx = fail if exists,
-    // handles two processes starting simultaneously without a lock).
     const id = randomUUID();
     try {
         await mkdir(INSTALL_ID_DIR, { recursive: true });
-        await writeFile(INSTALL_ID_FILE, FILE_HEADER + id + '\n', { flag: 'wx' });
+        // `wx` (fail if exists) when the file is absent, so two processes
+        // starting at once cannot both claim to have created it.
+        //
+        // `w` when the file exists but is unusable, so it can be repaired. With
+        // `wx` unconditionally a zero-byte file was permanent: the read found no
+        // id, the exclusive write failed because the file existed, the fallback
+        // read found no id again, and every later run repeated that. The install
+        // then pinged without an id forever, was never counted as an install, and
+        // cost the collector six writes per start instead of one read. Two
+        // processes repairing at once may write different ids and one wins, which
+        // over-counts a single install once; that is the cheaper failure.
+        await writeFile(INSTALL_ID_FILE, FILE_HEADER + id + '\n', {
+            flag: unusableFileExists ? 'w' : 'wx',
+        });
         return id;
     }
     catch {

package/dist/lib/install-id.js.map

@@ -1 +1 @@
-{"version":3,"file":"install-id.js","sourceRoot":"","sources":["../../src/lib/install-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAE3D,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,WAAW,GAAG;IAClB,sBAAsB;IACtB,GAAG;IACH,yDAAyD;IACzD,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,GAAG;IACH,2DAA2D;IAC3D,GAAG;IACH,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,OAAO,CAAC,OAAe;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IAED,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,eAAe,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"install-id.js","sourceRoot":"","sources":["../../src/lib/install-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAE3D,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,WAAW,GAAG;IAClB,sBAAsB;IACtB,GAAG;IACH,yDAAyD;IACzD,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,GAAG;IACH,2DAA2D;IAC3D,GAAG;IACH,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,SAAS,OAAO,CAAC,OAAe;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,sCAAsC;IACtC,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,oEAAoE;QACpE,6DAA6D;QAC7D,kBAAkB,GAAG,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,kEAAkE;QAClE,yDAAyD;QACzD,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,mEAAmE;QACnE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,SAAS,CAAC,eAAe,EAAE,WAAW,GAAG,EAAE,GAAG,IAAI,EAAE;YACxD,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACxD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/json-stream.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Reading a stream of concatenated JSON values.
+ *
+ * `opa test --count N` prints one pretty-printed JSON array per repetition,
+ * back to back, so the whole output is neither a single JSON value nor NDJSON:
+ *
+ *     [
+ *       { "name": "test_a" }
+ *     ]
+ *     [
+ *       { "name": "test_a" }
+ *     ]
+ *
+ * `JSON.parse` rejects that, and parsing line by line finds no complete value
+ * on any line. Splitting into top-level values is the only way to read it.
+ */
+/**
+ * Split `text` into its top-level JSON values, in order.
+ *
+ * Scans for balanced brackets while tracking string state, so a bracket or a
+ * brace inside a string literal cannot end a value early. Returns an empty
+ * array when nothing parses, so a caller can treat that exactly as it treats
+ * unparseable output.
+ */
+export declare function parseJsonValues<T = unknown>(text: string): T[];
+//# sourceMappingURL=json-stream.d.ts.map

package/dist/lib/json-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-stream.d.ts","sourceRoot":"","sources":["../../src/lib/json-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,EAAE,CA2C9D"}

package/dist/lib/json-stream.js

@@ -0,0 +1,69 @@
+/**
+ * Reading a stream of concatenated JSON values.
+ *
+ * `opa test --count N` prints one pretty-printed JSON array per repetition,
+ * back to back, so the whole output is neither a single JSON value nor NDJSON:
+ *
+ *     [
+ *       { "name": "test_a" }
+ *     ]
+ *     [
+ *       { "name": "test_a" }
+ *     ]
+ *
+ * `JSON.parse` rejects that, and parsing line by line finds no complete value
+ * on any line. Splitting into top-level values is the only way to read it.
+ */
+/**
+ * Split `text` into its top-level JSON values, in order.
+ *
+ * Scans for balanced brackets while tracking string state, so a bracket or a
+ * brace inside a string literal cannot end a value early. Returns an empty
+ * array when nothing parses, so a caller can treat that exactly as it treats
+ * unparseable output.
+ */
+export function parseJsonValues(text) {
+    const values = [];
+    let depth = 0;
+    let start = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === '[' || ch === '{') {
+            if (depth === 0)
+                start = i;
+            depth++;
+            continue;
+        }
+        if (ch === ']' || ch === '}') {
+            if (depth === 0)
+                continue; // stray closer; nothing is open
+            depth--;
+            if (depth === 0 && start !== -1) {
+                try {
+                    values.push(JSON.parse(text.slice(start, i + 1)));
+                }
+                catch {
+                    // A malformed value is skipped rather than discarding the rest.
+                }
+                start = -1;
+            }
+        }
+    }
+    return values;
+}
+//# sourceMappingURL=json-stream.js.map

package/dist/lib/json-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-stream.js","sourceRoot":"","sources":["../../src/lib/json-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAc,IAAY;IACvD,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QAEpB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;YAC3B,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS,CAAC,gCAAgC;YAC3D,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAM,CAAC,CAAC;gBACzD,CAAC;gBAAC,MAAM,CAAC;oBACP,gEAAgE;gBAClE,CAAC;gBACD,KAAK,GAAG,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/opa-cli.d.ts

@@ -96,6 +96,16 @@ export interface EvalInput {
     partial?: boolean;
     /** Refs treated as unknown during partial evaluation, e.g. ["input.user"]. */
     unknowns?: string[];
+    /**
+     * Package the query is evaluated in, passed as `--package`, so a bare
+     * reference to a rule of that package resolves without qualification.
+     */
+    package?: string;
+    /**
+     * Import statements for the query, each passed as `--import`, in the form
+     * they appear in a module: "data.lib", "input.tier as t".
+     */
+    imports?: string[];
     /** Treat builtin errors as fatal instead of returning undefined. */
     strictBuiltinErrors?: boolean;
     /** Path to a capabilities JSON file. */
@@ -213,12 +223,29 @@ export interface BuildInput {
 export interface SignInput {
     /** Path to a bundle directory or archive. */
     bundle: string;
-    /** Path to the signing key. */
+    /**
+     * Path to the PEM private key (RSA or ECDSA). For HMAC algorithms OPA
+     * accepts either the raw secret or a path to a file holding it; the tool
+     * layer only ever passes a validated path.
+     */
     signingKey: string;
     /** Signing algorithm (e.g. `RS256`). Defaults to `RS256` in OPA. */
     signingAlg?: string;
-    /** Path to a claims file (extra signed claims). */
+    /** Path to a claims file. `keyid` and `scope` are set this way; `opa sign` has no flags for them. */
     claimsFile?: string;
+    /**
+     * Directory that receives `.signatures.json` (`--output-file-path`).
+     * OPA defaults this to the process working directory, which for a
+     * long-running server is never where the caller wants the file.
+     */
+    outputDir: string;
+    /**
+     * Working directory for opa. OPA records each signed file under the bundle
+     * path exactly as given, so for a directory the tool passes the parent here
+     * and the directory name as `bundle`; the signature then names files as
+     * `<name>/<file>` and stays valid wherever the directory sits under that name.
+     */
+    cwd?: string;
 }
 /** Input for `opa exec` -- batch evaluation against multiple input files. */
 export interface ExecInput {
@@ -244,27 +271,32 @@ export interface ExecInput {
     /** Opt in to OPA v1.0-compatible behaviors (`--v1-compatible`). */
     v1Compatible?: boolean;
 }
-/** Input for bundle signature verification via `opa eval --bundle`. */
+/** Input for bundle signature verification via `opa build --verification-key`. */
 export interface BundleVerifyInput {
     /** Path to the signed bundle directory or `.tar.gz` archive. */
     bundle: string;
     /**
-     * Path to the PEM file containing the public key (RSA/ECDSA) or the
-     * HMAC secret file used to verify the bundle signature.
+     * Path to the PEM file containing the public key (RSA/ECDSA), or for
+     * HMAC algorithms a file holding the secret.
      */
     verificationKey: string;
     /**
-     * Key ID that must match the `keyid` claim in the bundle signature.
-     * Required when the bundle was signed with `--public-key-id`.
+     * Name the key is registered under (`--verification-key-id`, default
+     * `default`). With a single key OPA does not check it against the
+     * signature's `keyid` claim; only `scope` is enforced.
      */
     verificationKeyId?: string;
     /** Signing algorithm used when the bundle was signed (e.g. `RS256`, `HS256`). */
     signingAlg?: string;
     /**
      * Expected `scope` value in the bundle signature. Required when the
-     * bundle was signed with `--scope`.
+     * bundle was signed with a claims file that sets `scope`.
      */
     scope?: string;
+    /** Load the bundle as Rego v0 (`--v0-compatible`). */
+    v0Compatible?: boolean;
+    /** Working directory for opa; see `SignInput.cwd`. */
+    cwd?: string;
 }
 /**
  * Wrapper around the local `opa` binary.
@@ -352,16 +384,23 @@ export declare class OpaCli {
     /** Build a deployable bundle from policy + data paths. */
     build(input: BuildInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
-     * Sign a bundle. Writes a `.signatures.json` next to the bundle
-     * directory.
+     * Sign a bundle with `opa sign`, writing `.signatures.json` into
+     * `input.outputDir`.
+     *
+     * `--bundle` is a boolean flag on `opa sign`; the bundle path is positional
+     * and goes after `--` so it can never be parsed as a flag.
      */
     sign(input: SignInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
-     * Verify a signed bundle using `opa eval --bundle --verification-key`.
-     * OPA verifies the bundle signature before loading any policies; a
-     * failed signature produces a non-zero exit and the error message on
-     * stderr. The trivial query `true` is used so the process exits
-     * immediately after verification without entering a REPL.
+     * Verify a signed bundle.
+     *
+     * OPA has no standalone verify command, and `opa eval` accepts no
+     * `--verification-key` at all. The flag lives on `opa build` and `opa run`.
+     * Build reads the key, checks the JWT against it, compares the scope claim,
+     * then checks every file, then parses, and exits non-zero at the first
+     * failure with the reason on stdout. The rebuilt archive goes to a private
+     * temp directory and is discarded: it is a side effect of the only
+     * verification path OPA offers, not a result.
      */
     bundleVerify(input: BundleVerifyInput, signal?: AbortSignal): Promise<SpawnResult>;
     /**
@@ -374,8 +413,27 @@ export declare class OpaCli {
      * Run `opa` with the given argv and optional stdin. Tools should
      * prefer the typed methods above, but this exists for the rare cases
      * the typed surface does not yet cover.
+     *
+     * `cwd` is for commands whose output location defaults to the working
+     * directory; the server's own cwd is never a place a tool should write.
+     */
+    run(args: string[], stdin?: string, signal?: AbortSignal, 
+    /**
+     * The arguments OPA will mount as documents. On Windows an absolute one
+     * mounts under its drive letter, so these are rewritten relative to a
+     * working directory the child then runs in. Files OPA merely opens
+     * (`--input`, `--signing-key`, `--capabilities`, `-o`) must NOT be listed:
+     * they work absolute, and rewriting them risks a spurious drive conflict.
+     * See lib/opa-paths.ts.
+     */
+    loadPaths?: readonly string[], 
+    /**
+     * Run the child here. Used where OPA binds behaviour to the path it is
+     * given rather than to the file it opens, as `opa sign` does for a
+     * directory bundle. A rewritten load path derives its own working
+     * directory, and the two are never needed by the same command.
      */
-    run(args: string[], stdin?: string, signal?: AbortSignal): Promise<SpawnResult>;
+    cwd?: string): Promise<SpawnResult>;
     /**
      * Write `source` to a private temp directory (mode 0700) created with
      * mkdtemp. The directory and its contents are removed on completion.

package/dist/lib/opa-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0GAA0G;IAC1G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQtE;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAY/E;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYhF;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB1E;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAS1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAI9E;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAO7F;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAcxE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IA0CxE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBxE;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAoB1E,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB1E;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IASxF;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBxE;;;;OAIG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAarF;;;;;OAKG;YACW,cAAc;CAU7B"}
+{"version":3,"file":"opa-cli.d.ts","sourceRoot":"","sources":["../../src/lib/opa-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D,+BAA+B;AAC/B,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oGAAoG;IACpG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uFAAuF;IACvF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gGAAgG;IAChG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,gCAAgC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,uEAAuE;IACvE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/C,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,qCAAqC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0GAA0G;IAC1G,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,4BAA4B;AAC5B,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+GAA+G;IAC/G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAS3D;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQtE;;;;;;;OAOG;IACG,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAY/E;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAYhF;;;;;;;OAOG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAyB1E;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAS1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAS9E;;;;;OAKG;IACG,YAAY,CAAC,KAAK,GAAE,iBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAO7F;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAcxE;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IA4CxE;;OAEG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAqBxE;;OAEG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAoB1E,0DAA0D;IACpD,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAuB1E;;;;;;OAMG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQxE;;;;;;;;;;OAUG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAexF;;;;OAIG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAyBxE;;;;;;;OAOG;IACG,GAAG,CACP,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW;IACpB;;;;;;;OAOG;IACH,SAAS,GAAE,SAAS,MAAM,EAAO;IACjC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,WAAW,CAAC;IA6CvB;;;;;OAKG;YACW,cAAc;CAU7B"}