@orygn/opa-mcp 0.4.0 → 0.6.0

package/dist/lib/opa-paths.js

@@ -0,0 +1,101 @@
+/**
+ * Making load paths safe to hand to the `opa` binary.
+ *
+ * OPA's loader reads every load path as an optional `prefix:path` pair and
+ * splits on the FIRST colon, mounting the document under `data.<prefix>`.
+ * Every absolute Windows path begins with one:
+ *
+ *     opa eval -d "C:\policies\data.json" data
+ *       -> {"C": {...}}      the document is at data.C, not where it belongs
+ *
+ * Forward slashes do not help, since `C:/policies` still has the colon, and
+ * there is no escape syntax; the `\\?\` prefix is rejected outright. The only
+ * spelling OPA reads correctly is a relative one, so load paths are rewritten
+ * relative to a directory the child is then started in.
+ *
+ * Two things narrow this. Only paths OPA MOUNTS are affected: a `--input`,
+ * `--signing-key` or `--capabilities` file is opened directly and works fine
+ * absolute, so callers pass only their genuine load paths. And a `.rego`
+ * module mounts at its own `package` whatever path it arrived by, so only data
+ * documents and the directories holding them are respelled. That is why this
+ * stayed invisible: policies loaded correctly and their data silently did not.
+ *
+ * A module is still opened by the remainder after the colon, which is a
+ * root-relative path OPA resolves against the drive the child is running on.
+ * That works only when the working directory is on the module's drive, which
+ * on a developer machine it usually is and on a CI runner that keeps its
+ * workspace and its temp directory on different drives it is not. So every
+ * load path, module or not, takes part in choosing the working directory;
+ * only the non-module ones are respelled.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, extname, isAbsolute, parse, relative, sep } from 'node:path';
+/** A path OPA would split: a drive letter followed by a separator. */
+const DRIVE_PATH = /^[A-Za-z]:[\\/]/;
+/**
+ * Would loading this path by an absolute spelling put its contents in the
+ * wrong place?
+ *
+ * A `.rego` module mounts at its own `package` whatever path it arrived by,
+ * verified against OPA 1.19: an absolute `p.rego` lands at `data.p` while an
+ * absolute `d.json` lands at `data.C`. Modules are therefore not respelled,
+ * which also keeps the rewrite away from the temp file this server writes for
+ * inline source, whose absolute path is matched afterwards to redact it from
+ * output. They still count toward the working directory: see `rewriteLoadPaths`.
+ */
+function needsRewrite(path) {
+    return extname(path).toLowerCase() !== '.rego';
+}
+/** Longest directory containing every one of `paths`. */
+function commonAncestor(paths) {
+    const split = paths.map((p) => p.split(/[\\/]+/));
+    const first = split[0];
+    if (!first)
+        return undefined;
+    const shared = [];
+    for (let i = 0; i < first.length; i++) {
+        const segment = first[i];
+        // Windows compares path segments without regard to case.
+        if (!split.every((parts) => parts[i]?.toLowerCase() === segment.toLowerCase()))
+            break;
+        shared.push(segment);
+    }
+    if (shared.length === 0)
+        return undefined;
+    const joined = shared.join(sep);
+    // A drive root keeps its separator: "C:" alone is drive-relative, not root.
+    return shared.length === 1 ? joined + sep : joined;
+}
+export function rewriteLoadPaths(args, loadPaths, options = {}) {
+    // Every drive-letter load path anchors the working directory, modules
+    // included, since a module is opened relative to the child's drive even
+    // though it mounts by package. Only the non-module ones are respelled.
+    const anchors = [...new Set(loadPaths.filter((p) => DRIVE_PATH.test(p) && existsSync(p)))];
+    if (anchors.length === 0)
+        return { args };
+    const drives = [...new Set(anchors.map((p) => parse(p).root.toLowerCase()))];
+    if (drives.length > 1)
+        return { args, conflict: { drives } };
+    // The ancestor is taken over the containing directories, never the paths
+    // themselves: the ancestor of a single file would be that file, and a file
+    // cannot be a working directory.
+    const cwd = commonAncestor(anchors.map(dirname));
+    if (cwd === undefined || !existsSync(cwd))
+        return { args };
+    if (options.respell === false)
+        return { args, cwd };
+    const targets = anchors.filter(needsRewrite);
+    const rewritten = args.map((a) => {
+        if (!targets.includes(a))
+            return a;
+        const rel = relative(cwd, a);
+        // A load path that IS the working directory.
+        if (rel === '')
+            return '.';
+        // Defensive: a result that is still absolute, or climbs out of the
+        // working directory, would not help, so the original is kept.
+        return isAbsolute(rel) || rel.startsWith('..') ? a : rel;
+    });
+    return { args: rewritten, cwd };
+}
+//# sourceMappingURL=opa-paths.js.map

package/dist/lib/opa-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opa-paths.js","sourceRoot":"","sources":["../../src/lib/opa-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/E,sEAAsE;AACtE,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AACjD,CAAC;AAcD,yDAAyD;AACzD,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC1B,yDAAyD;QACzD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAAE,MAAM;QACtF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,4EAA4E;IAC5E,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;AACrD,CAAC;AAsBD,MAAM,UAAU,gBAAgB,CAC9B,IAAc,EACd,SAA4B,EAC5B,UAA0B,EAAE;IAE5B,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE1C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE3D,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAEpD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,6CAA6C;QAC7C,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QAC3B,mEAAmE;QACnE,8DAA8D;QAC9D,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAsB5F"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAoCD,wBAAgB,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,CAiF5F"}

package/dist/lib/output.js

@@ -1,17 +1,90 @@
+const bytes = (s) => Buffer.byteLength(s, 'utf8');
+const WARNINGS_DROPPED = '[warnings dropped: response exceeded maxResponseBytes]';
+const DETAILS_DROPPED = {
+    __truncated: true,
+    message: 'Error details exceeded maxResponseBytes and were dropped.',
+};
+/**
+ * Cut `text` so that `measure(text)` stays within `budget`, measured after
+ * serialisation, since JSON escaping can more than double a string of
+ * newlines or control characters. A binary search on the byte length, so the
+ * cost is logarithmic in the message size.
+ */
+function cutToFit(text, measure, budget) {
+    const suffix = ' [truncated]';
+    const raw = Buffer.from(text, 'utf8');
+    let lo = 0;
+    let hi = raw.length;
+    let best = '';
+    while (lo <= hi) {
+        const mid = Math.floor((lo + hi) / 2);
+        const candidate = raw.subarray(0, mid).toString('utf8') + suffix;
+        if (measure(candidate) <= budget) {
+            best = candidate;
+            lo = mid + 1;
+        }
+        else {
+            hi = mid - 1;
+        }
+    }
+    return best;
+}
 export function formatEnvelope(envelope, maxBytes) {
     let serialized = JSON.stringify(envelope, null, 2);
-    if (Buffer.byteLength(serialized, 'utf8') > maxBytes) {
-        const truncatedEnvelope = {
-            ...envelope,
-            truncated: true,
+    if (bytes(serialized) > maxBytes) {
+        // The cap is measured on the serialised text, since JSON escaping can
+        // double a message of newlines. Shrink the least useful field first and
+        // only as far as needed: a success's data, an error's details, then the
+        // warnings, then the hint, and the message last. A field is replaced
+        // only when the replacement is actually smaller.
+        const t = { ...envelope, truncated: true };
+        const size = () => bytes(JSON.stringify(t, null, 2));
+        const fits = () => size() <= maxBytes;
+        const replaceIfSmaller = (apply, revert) => {
+            const before = size();
+            apply();
+            if (size() >= before)
+                revert();
         };
-        if (truncatedEnvelope.ok && truncatedEnvelope.data !== undefined) {
-            truncatedEnvelope.data = {
-                __truncated: true,
-                message: 'Response exceeded maxResponseBytes. Re-run with narrower scope, or write the output to a file path you specify.',
-            };
+        if (t.ok && t.data !== undefined) {
+            const kept = t.data;
+            replaceIfSmaller(() => {
+                t.data = {
+                    __truncated: true,
+                    message: 'Response exceeded maxResponseBytes. Re-run with narrower scope, or write the output to a file path you specify.',
+                };
+            }, () => {
+                t.data = kept;
+            });
+        }
+        const error = !t.ok && t.error !== undefined ? { ...t.error } : undefined;
+        if (error !== undefined)
+            t.error = error;
+        if (error !== undefined && !fits() && error.details !== undefined) {
+            const kept = error.details;
+            replaceIfSmaller(() => {
+                error.details = DETAILS_DROPPED;
+            }, () => {
+                error.details = kept;
+            });
+        }
+        if (!fits() && t.warnings !== undefined) {
+            const kept = t.warnings;
+            replaceIfSmaller(() => {
+                t.warnings = [WARNINGS_DROPPED];
+            }, () => {
+                t.warnings = kept;
+            });
+        }
+        if (error !== undefined && !fits() && error.hint !== undefined) {
+            const others = () => bytes(JSON.stringify({ ...t, error: { ...error, hint: '' } }, null, 2));
+            error.hint = cutToFit(error.hint, (c) => others() + bytes(JSON.stringify(c)) - 2, maxBytes);
+        }
+        if (error !== undefined && !fits()) {
+            const others = () => bytes(JSON.stringify({ ...t, error: { ...error, message: '' } }, null, 2));
+            error.message = cutToFit(error.message, (c) => others() + bytes(JSON.stringify(c)) - 2, maxBytes);
         }
-        serialized = JSON.stringify(truncatedEnvelope, null, 2);
+        serialized = JSON.stringify(t, null, 2);
     }
     return {
         content: [{ type: 'text', text: serialized }],

package/dist/lib/output.js.map

@@ -1 +1 @@
-{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,cAAc,CAAI,QAAyB,EAAE,QAAgB;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,iBAAiB,GAAoB;YACzC,GAAG,QAAQ;YACX,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,IAAI,iBAAiB,CAAC,EAAE,IAAI,iBAAiB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjE,iBAAiB,CAAC,IAAI,GAAG;gBACvB,WAAW,EAAE,IAAI;gBACjB,OAAO,EACL,iHAAiH;aAC/G,CAAC;QACT,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE;KACtB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../src/lib/output.ts"],"names":[],"mappings":"AAcA,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAElE,MAAM,gBAAgB,GAAG,wDAAwD,CAAC;AAElF,MAAM,eAAe,GAAG;IACtB,WAAW,EAAE,IAAI;IACjB,OAAO,EAAE,2DAA2D;CACrE,CAAC;AAEF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAsC,EAAE,MAAc;IACpF,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IACpB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;QACjE,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,GAAG,SAAS,CAAC;YACjB,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAI,QAAyB,EAAE,QAAgB;IAC3E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,QAAQ,EAAE,CAAC;QACjC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,qEAAqE;QACrE,iDAAiD;QACjD,MAAM,CAAC,GAAoB,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,GAAY,EAAE,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC/C,MAAM,gBAAgB,GAAG,CAAC,KAAiB,EAAE,MAAkB,EAAQ,EAAE;YACvE,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,IAAI,EAAE,IAAI,MAAM;gBAAE,MAAM,EAAE,CAAC;QACjC,CAAC,CAAC;QAEF,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,gBAAgB,CACd,GAAG,EAAE;gBACH,CAAC,CAAC,IAAI,GAAG;oBACP,WAAW,EAAE,IAAI;oBACjB,OAAO,EACL,iHAAiH;iBAC/G,CAAC;YACT,CAAC,EACD,GAAG,EAAE;gBACH,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,CAAC,CACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GACT,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,KAAK,KAAK,SAAS;YAAE,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;QAEzC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;YAC3B,gBAAgB,CACd,GAAG,EAAE;gBACH,KAAK,CAAC,OAAO,GAAG,eAAe,CAAC;YAClC,CAAC,EACD,GAAG,EAAE;gBACH,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YACvB,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxB,gBAAgB,CACd,GAAG,EAAE;gBACH,CAAC,CAAC,QAAQ,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAClC,CAAC,EACD,GAAG,EAAE;gBACH,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YACpB,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1E,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,GAAW,EAAE,CAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,KAAK,CAAC,OAAO,GAAG,QAAQ,CACtB,KAAK,CAAC,OAAO,EACb,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAC9C,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE;KACtB,CAAC;AACJ,CAAC"}

package/dist/lib/regal-cli.d.ts

@@ -72,6 +72,21 @@ export interface LintInput {
 export declare class RegalCli {
     private readonly config;
     constructor(config: Config);
+    /**
+     * The directory regal should run in for a given set of targets.
+     *
+     * Regal finds `.regal/config.yaml` by walking up from its own working
+     * directory, never from the files it is asked to lint. Spawned without one
+     * it inherited this server's, which for a stdio server is wherever the
+     * client happened to launch it: a project's own configuration was ignored,
+     * and any configuration above the server's directory was applied to every
+     * call, including inline source. Running in the target's directory is what
+     * a person typing `regal lint` in their project gets.
+     *
+     * Undefined when the targets do not share a directory, in which case regal
+     * keeps the inherited one and behaves as it did before.
+     */
+    private configDiscoveryDir;
     /**
      * Verify the binary is present and report its version. Returns null
      * if the binary is unreachable or output is malformed.
@@ -106,7 +121,7 @@ export declare class RegalCli {
      * Run `regal` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch.
      */
-    run(args: string[], signal?: AbortSignal): Promise<SpawnResult>;
+    run(args: string[], signal?: AbortSignal, cwd?: string): Promise<SpawnResult>;
     private withTempSource;
 }
 //# sourceMappingURL=regal-cli.d.ts.map

package/dist/lib/regal-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regal-cli.d.ts","sourceRoot":"","sources":["../../src/lib/regal-cli.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,yCAA0C,CAAC;AAE1F,6BAA6B;AAC7B,MAAM,WAAW,QAAQ;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ3D;;;;;;;;;;;;;;;OAeG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgCxE;;;;;;OAMG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBtE;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YAcvD,cAAc;CAU7B"}
+{"version":3,"file":"regal-cli.d.ts","sourceRoot":"","sources":["../../src/lib/regal-cli.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,kCAAkC,yCAA0C,CAAC;AAE1F,6BAA6B;AAC7B,MAAM,WAAW,QAAQ;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qCAAqC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAQ3D;;;;;;;;;;;;;;;OAeG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAsCxE;;;;;;OAMG;IACG,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBtE;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;YAgBrE,cAAc;CAU7B"}

package/dist/lib/regal-cli.js

@@ -5,9 +5,10 @@
  * tools work without Regal installed. If absent, `rego_lint` returns a
  * structured `REGAL_NOT_FOUND` error with an install hint.
  */
+import { statSync } from 'node:fs';
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { runBinary } from './subprocess.js';
 /**
  * Rules whose verdict depends on the on-disk path of the file being
@@ -30,6 +31,32 @@ export class RegalCli {
     constructor(config) {
         this.config = config;
     }
+    /**
+     * The directory regal should run in for a given set of targets.
+     *
+     * Regal finds `.regal/config.yaml` by walking up from its own working
+     * directory, never from the files it is asked to lint. Spawned without one
+     * it inherited this server's, which for a stdio server is wherever the
+     * client happened to launch it: a project's own configuration was ignored,
+     * and any configuration above the server's directory was applied to every
+     * call, including inline source. Running in the target's directory is what
+     * a person typing `regal lint` in their project gets.
+     *
+     * Undefined when the targets do not share a directory, in which case regal
+     * keeps the inherited one and behaves as it did before.
+     */
+    configDiscoveryDir(targets) {
+        const dirs = new Set();
+        for (const target of targets) {
+            try {
+                dirs.add(statSync(target).isDirectory() ? target : dirname(target));
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return dirs.size === 1 ? [...dirs][0] : undefined;
+    }
     /**
      * Verify the binary is present and report its version. Returns null
      * if the binary is unreachable or output is malformed.
@@ -90,10 +117,14 @@ export class RegalCli {
         for (const pattern of input.ignoreFiles ?? [])
             args.push('--ignore-files', pattern);
         if (input.source !== undefined) {
-            return this.withTempSource(input.source, (path) => this.run([...args, path], signal));
+            // Inline source has no project, so regal runs in its private temp
+            // directory: config discovery walks up from there and finds nothing,
+            // rather than picking up whatever sits above the server's directory.
+            return this.withTempSource(input.source, (path) => this.run([...args, path], signal, dirname(path)));
         }
-        args.push(...(input.paths ?? []));
-        return this.run(args, signal);
+        const paths = input.paths ?? [];
+        args.push(...paths);
+        return this.run(args, signal, this.configDiscoveryDir(paths));
     }
     /**
      * Auto-fix Rego violations for rules that support mechanical fixes.
@@ -124,13 +155,13 @@ export class RegalCli {
         for (const pattern of input.ignoreFiles ?? [])
             args.push('--ignore-files', pattern);
         args.push(...input.paths);
-        return this.run(args, signal);
+        return this.run(args, signal, this.configDiscoveryDir(input.paths));
     }
     /**
      * Run `regal` with the given argv. Tools should prefer the typed
      * methods above; this is the escape hatch.
      */
-    async run(args, signal) {
+    async run(args, signal, cwd) {
         const opts = {
             args,
             timeoutMs: this.config.subprocessTimeoutMs,
@@ -138,6 +169,9 @@ export class RegalCli {
         };
         if (signal !== undefined)
             opts.signal = signal;
+        // Regal discovers its configuration by walking up from here.
+        if (cwd !== undefined)
+            opts.cwd = cwd;
         return runBinary(this.config.regalBinary, opts);
     }
     // ─── Internal: temp file management ──────────────────────────────────

package/dist/lib/regal-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"regal-cli.js","sourceRoot":"","sources":["../../src/lib/regal-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,4BAA4B,CAAU,CAAC;AAyD1F;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB,EAAE,MAAoB;QAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,kCAAkC,EAAE,CAAC;gBACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAEpF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,MAAoB;QAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB;QAC5C,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,wEAAwE;IAExE,sEAAsE;IACtE,mEAAmE;IAC3D,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"regal-cli.js","sourceRoot":"","sources":["../../src/lib/regal-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,4BAA4B,CAAU,CAAC;AAyD1F;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;;;;;;;;;;OAaG;IACK,kBAAkB,CAAC,OAA0B;QACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB,EAAE,MAAoB;QAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,kCAAkC,EAAE,CAAC;gBACtD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,gBAAgB;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAEpF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAChD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,CAAC,KAAe,EAAE,MAAoB;QAC7C,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU;YAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,cAAc,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB,EAAE,GAAY;QAC1D,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,6DAA6D;QAC7D,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACtC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,wEAAwE;IAExE,sEAAsE;IACtE,mEAAmE;IAC3D,KAAK,CAAC,cAAc,CAAI,MAAc,EAAE,EAAgC;QAC9E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF"}

package/dist/lib/rego-ast-walker.d.ts

@@ -12,10 +12,4 @@
 import type { OpaModule } from './rego-ast-types.js';
 import type { VerifyWalkResult } from './rego-ir.js';
 export declare function walkModule(ast: OpaModule): VerifyWalkResult;
-/**
- * Collect all input.* paths recursively from a raw OPA AST value.
- * Used for deep scans of comprehension bodies (Phase 2), but exported
- * here for reuse in the engine's path-discovery pass.
- */
-export declare function collectAllInputPaths(node: unknown, out: Map<string, string[]>): void;
 //# sourceMappingURL=rego-ast-walker.d.ts.map

package/dist/lib/rego-ast-walker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rego-ast-walker.d.ts","sourceRoot":"","sources":["../../src/lib/rego-ast-walker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAiB,SAAS,EAAoB,MAAM,qBAAqB,CAAC;AACtF,OAAO,KAAK,EAA2B,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAqB9E,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,gBAAgB,CAiB3D;AA4oBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CA6BpF"}
+{"version":3,"file":"rego-ast-walker.d.ts","sourceRoot":"","sources":["../../src/lib/rego-ast-walker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAiB,SAAS,EAAoB,MAAM,qBAAqB,CAAC;AACtF,OAAO,KAAK,EAAsC,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAsBzF,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,gBAAgB,CAkB3D"}