@orygn/opa-mcp 0.5.0 → 0.6.0

package/dist/config.d.ts

@@ -1,15 +1,25 @@
 import { z } from 'zod';
+/**
+ * Whether a `*_BINARY` value is acceptable on `platform`: a bare command
+ * name, looked up on PATH by the spawn, or an absolute path. A relative path
+ * would resolve against wherever the client happened to launch the server.
+ * On Windows a path with a leading separator and no drive counts as absolute
+ * to `isAbsolute`, yet it resolves against the current drive, the same hazard
+ * as the drive-relative `C:regal.exe`; a UNC path starts with two separators
+ * and is fine.
+ */
+export declare function isBinarySpec(value: string, platform?: NodeJS.Platform): boolean;
 declare const ConfigSchema: z.ZodObject<{
     /** Base URL of a running OPA server (used by `opa_*` runtime tools). */
     opaUrl: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
     /** Optional bearer token for OPA running with `--authentication=token`. */
     opaToken: z.ZodOptional<z.ZodString>;
     /** Path to the `opa` binary. Defaults to `opa` on PATH. */
-    opaBinary: z.ZodDefault<z.ZodString>;
+    opaBinary: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
     /** Path to the `regal` binary. Defaults to `regal` on PATH. */
-    regalBinary: z.ZodDefault<z.ZodString>;
+    regalBinary: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
     /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
-    conftestBinary: z.ZodDefault<z.ZodString>;
+    conftestBinary: z.ZodDefault<z.ZodEffects<z.ZodString, string, string>>;
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
     subprocessTimeoutMs: z.ZodDefault<z.ZodNumber>;
     /** HTTP request timeout for OPA REST API calls. */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAQlE,mDAAmD;;IAQnD;;;;;OAKG;;IAcH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;IAGH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyClD,wBAAgB,UAAU,IAAI,MAAM,CAsCnC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,OAAO,CAKjG;AAmBD,QAAA,MAAM,YAAY;IAChB,wEAAwE;;IASxE,2EAA2E;;IAG3E,2DAA2D;;IAG3D,+DAA+D;;IAG/D,qEAAqE;;IAGrE,kEAAkE;;IAQlE,mDAAmD;;IAQnD;;;;;OAKG;;IAcH,uEAAuE;;IAGvE,qCAAqC;;IAGrC;;;;OAIG;;IASH;;;;;;;;OAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUH,CAAC;AAEH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAyClD,wBAAgB,UAAU,IAAI,MAAM,CAsCnC"}

package/dist/config.js

@@ -6,10 +6,34 @@
  * Cursor, VS Code) pass config via the `env` object in their JSON.
  */
 import { tmpdir } from 'node:os';
-import { isAbsolute, join } from 'node:path';
+import { isAbsolute, join, posix, win32 } from 'node:path';
 import { z } from 'zod';
 import { resolveOpaBinary } from './lib/resolve-binary.js';
 import { DEFAULT_MAX_OUTPUT_BYTES } from './lib/subprocess.js';
+/**
+ * Whether a `*_BINARY` value is acceptable on `platform`: a bare command
+ * name, looked up on PATH by the spawn, or an absolute path. A relative path
+ * would resolve against wherever the client happened to launch the server.
+ * On Windows a path with a leading separator and no drive counts as absolute
+ * to `isAbsolute`, yet it resolves against the current drive, the same hazard
+ * as the drive-relative `C:regal.exe`; a UNC path starts with two separators
+ * and is fine.
+ */
+export function isBinarySpec(value, platform = process.platform) {
+    if (value === '.' || value === '..')
+        return false;
+    if (!/[\\/]/.test(value) && !/^[A-Za-z]:/.test(value))
+        return true;
+    if (platform === 'win32' && /^[\\/](?![\\/])/.test(value))
+        return false;
+    return (platform === 'win32' ? win32 : posix).isAbsolute(value);
+}
+const binarySchema = (name) => z
+    .string()
+    .refine((v) => isBinarySpec(v), {
+    message: 'must be a bare command name found on PATH, or an absolute path',
+})
+    .default(name);
 /**
  * Node clamps a timer of 2^31 ms or more to 1 ms, with only a process warning.
  * A large value reads as "effectively no timeout" and produced the opposite:
@@ -29,11 +53,11 @@ const ConfigSchema = z.object({
     /** Optional bearer token for OPA running with `--authentication=token`. */
     opaToken: z.string().optional(),
     /** Path to the `opa` binary. Defaults to `opa` on PATH. */
-    opaBinary: z.string().default('opa'),
+    opaBinary: binarySchema('opa'),
     /** Path to the `regal` binary. Defaults to `regal` on PATH. */
-    regalBinary: z.string().default('regal'),
+    regalBinary: binarySchema('regal'),
     /** Path to the `conftest` binary. Defaults to `conftest` on PATH. */
-    conftestBinary: z.string().default('conftest'),
+    conftestBinary: binarySchema('conftest'),
     /** Hard timeout in ms for any spawned subprocess (opa, regal). */
     subprocessTimeoutMs: z.coerce
         .number()
@@ -74,7 +98,13 @@ const ConfigSchema = z.object({
      * Larger payloads are truncated with `truncated: true` and a hint to
      * write to a file path the agent specifies.
      */
-    maxResponseBytes: z.coerce.number().int().positive().default(100_000),
+    maxResponseBytes: z.coerce
+        .number()
+        .int()
+        // The smallest complete envelope is under 300 bytes; a cap that cannot
+        // hold one is refused rather than exceeded.
+        .min(512, { message: 'must be at least 512' })
+        .default(100_000),
     /**
      * Maximum bytes captured from a subprocess's stdout and stderr, each counted
      * separately. On overflow the stream is clamped and the child is killed.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GACnB,mIAAmI,CAAC;AAEtI,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAEpC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAExC,qEAAqE;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;IAE9C,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB;;;;;OAKG;IACH,YAAY,EAAE,CAAC;SACZ,KAAK;IACJ,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,kDAAkD;IAClD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IAEd,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAErE;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACtC,mBAAmB,EAAE,GAAG,CAAC,oBAAoB,CAAC;QAC9C,aAAa,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC7C,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAClC,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,GAAG,CAAC,8BAA8B,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,WAA4B,OAAO,CAAC,QAAQ;IACtF,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE,CACpC,CAAC;KACE,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;IAC9B,OAAO,EAAE,gEAAgE;CAC1E,CAAC;KACD,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;GAIG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,eAAe,GACnB,mIAAmI,CAAC;AAEtI,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,EAAE;SACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAClE,OAAO,EAAE,4CAA4C;KACtD,CAAC;SACD,OAAO,CAAC,uBAAuB,CAAC;IAEnC,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2DAA2D;IAC3D,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC;IAE9B,+DAA+D;IAC/D,WAAW,EAAE,YAAY,CAAC,OAAO,CAAC;IAElC,qEAAqE;IACrE,cAAc,EAAE,YAAY,CAAC,UAAU,CAAC;IAExC,kEAAkE;IAClE,mBAAmB,EAAE,CAAC,CAAC,MAAM;SAC1B,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB,mDAAmD;IACnD,aAAa,EAAE,CAAC,CAAC,MAAM;SACpB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC;SAClC,OAAO,CAAC,MAAM,CAAC;IAElB;;;;;OAKG;IACH,YAAY,EAAE,CAAC;SACZ,KAAK;IACJ,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,wEAAwE;IACxE,kDAAkD;IAClD,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;QAC5B,OAAO,EAAE,0BAA0B;KACpC,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IAEd,uEAAuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAEhE,qCAAqC;IACrC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEpE;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM;SACvB,MAAM,EAAE;SACR,GAAG,EAAE;QACN,uEAAuE;QACvE,4CAA4C;SAC3C,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;SAC7C,OAAO,CAAC,OAAO,CAAC;IAEnB;;;;;;;;OAQG;IACH,kBAAkB,EAAE,CAAC,CAAC,MAAM;SACzB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CACF,wBAAwB,GAAG,CAAC,EAC5B,yFAAyF,CAC1F;SACA,OAAO,CAAC,wBAAwB,CAAC;CACrC,CAAC,CAAC;AAIH,SAAS,iBAAiB,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,WAAW;IACrB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,oBAAoB;IACzC,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,uBAAuB;IACrC,OAAO,EAAE,kBAAkB;IAC3B,QAAQ,EAAE,mBAAmB;IAC7B,gBAAgB,EAAE,4BAA4B;IAC9C,kBAAkB,EAAE,8BAA8B;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;QACtB,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC;QAC5B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC;QAChC,cAAc,EAAE,GAAG,CAAC,iBAAiB,CAAC;QACtC,mBAAmB,EAAE,GAAG,CAAC,oBAAoB,CAAC;QAC9C,aAAa,EAAE,GAAG,CAAC,yBAAyB,CAAC;QAC7C,YAAY;QACZ,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC;QAChC,QAAQ,EAAE,GAAG,CAAC,mBAAmB,CAAC;QAClC,gBAAgB,EAAE,GAAG,CAAC,4BAA4B,CAAC;QACnD,kBAAkB,EAAE,GAAG,CAAC,8BAA8B,CAAC;KACxD,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,aAAa;gBACjD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,oEAAoE;IACpE,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,CAAC,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/constants.d.ts

@@ -1,8 +1,3 @@
-/**
- * Server identity constants shared between the entry point and the
- * mcp_server_info tool. Defined here to avoid a circular import
- * (server.ts -> tools -> meta -> server.ts).
- */
 export declare const SERVER_NAME = "orygn-opa-mcp";
-export declare const SERVER_VERSION = "0.4.0";
+export declare const SERVER_VERSION: string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAC3C,eAAO,MAAM,cAAc,UAAU,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAgB3C,eAAO,MAAM,cAAc,EAAE,MAA6B,CAAC"}

package/dist/constants.js

@@ -1,8 +1,22 @@
 /**
- * Server identity constants shared between the entry point and the
- * mcp_server_info tool. Defined here to avoid a circular import
+ * Server identity shared between the entry point and the mcp_server_info
+ * tool. Defined here to avoid a circular import
  * (server.ts -> tools -> meta -> server.ts).
  */
+import { createRequire } from 'node:module';
 export const SERVER_NAME = 'orygn-opa-mcp';
-export const SERVER_VERSION = '0.4.0';
+/**
+ * Read from package.json, which the release flow bumps, so the server cannot
+ * report one version while carrying another. Every packaging places
+ * package.json beside dist: the npm tarball, the Docker image and the .mcpb
+ * bundle.
+ */
+function versionFromPackage() {
+    const pkg = createRequire(import.meta.url)('../package.json');
+    const version = typeof pkg === 'object' && pkg !== null ? pkg.version : undefined;
+    if (typeof version !== 'string')
+        throw new Error('package.json beside dist has no version');
+    return version;
+}
+export const SERVER_VERSION = versionFromPackage();
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAC3C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,WAAW,GAAG,eAAe,CAAC;AAE3C;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,GAAG,GAAY,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACvE,MAAM,OAAO,GACX,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAW,kBAAkB,EAAE,CAAC"}

package/dist/lib/conftest-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,IAAI,CA8BhF;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,wLAoBnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AA0ED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IA4ChF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAQpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAanF;;;OAGG;YACW,cAAc;IAqC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA2BvB"}
+{"version":3,"file":"conftest-cli.d.ts","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,EAAE,GAAG,IAAI,CA8BhF;AAID,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iCAAiC;AACjC,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,wLAoBnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAgHD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAU3D;;;;;;;;OAQG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgDhF;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAUpF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAOhF;;;OAGG;IACG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAanF;;;OAGG;YACW,cAAc;IAqC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;CA8CvB"}

package/dist/lib/conftest-cli.js

@@ -6,10 +6,12 @@
  * other tools work without Conftest installed. If absent, conftest tools
  * return a structured `CONFTEST_NOT_FOUND` error with an install hint.
  *
- * Conftest exit codes:
+ * Conftest exit codes, measured with 0.69.0:
  *   0  -- all tests pass (or no failures, only warnings)
- *   1  -- one or more test failures
- *   2+ -- command error (bad args, policy not found, parse error, etc.)
+ *   1  -- failures, or warnings under --fail-on-warn, or a command error (bad
+ *         args, policy not found, parse error); the two are told apart by
+ *         whether stdout holds results
+ *   2  -- failures together with warnings under --fail-on-warn
  *
  * All structured output is obtained via `--output=json`; raw text output
  * is never parsed.
@@ -17,6 +19,7 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
+import { rewriteLoadPaths } from './opa-paths.js';
 import { runBinary } from './subprocess.js';
 /**
  * Parse `--output=json` from `conftest test` or `conftest verify` into
@@ -161,6 +164,39 @@ function relativeToParent(policy) {
         return undefined;
     return { parent, name };
 }
+/**
+ * Pick a working directory on the drive the given paths live on.
+ *
+ * Conftest loads its policy and data directories through OPA's loader, which
+ * splits an absolute path on its first colon and resolves the remainder
+ * against the drive the process is on, so `--policy C:...` fails from a
+ * working directory on another drive. The configs under test are read by
+ * conftest itself and open fine from anywhere, so they are not anchors: an
+ * inline config in the temp directory can be tested against a policy on
+ * another drive, and an inline policy against a config on another drive.
+ * The paths are left exactly as given, since conftest echoes them in its
+ * output and the inline temp files are matched there afterwards to redact
+ * them.
+ */
+function anchorDrive(args, paths) {
+    const present = paths.filter((p) => typeof p === 'string' && p.length > 0);
+    const out = rewriteLoadPaths(args, present, { respell: false });
+    if (out.conflict) {
+        return {
+            conflict: {
+                exitCode: 1,
+                stdout: '',
+                stderr: `paths span more than one drive (${out.conflict.drives.join(', ')}). ` +
+                    'conftest resolves an absolute path against the drive it runs on, so the policy ' +
+                    'and data directories must be on a single drive.',
+                timedOut: false,
+                aborted: false,
+                durationMs: 0,
+            },
+        };
+    }
+    return out.cwd !== undefined ? { cwd: out.cwd } : {};
+}
 export class ConftestCli {
     config;
     constructor(config) {
@@ -223,7 +259,12 @@ export class ConftestCli {
             // Config files (positional args, must come last)
             const effectiveFiles = configPath ? [configPath] : (input.files ?? []);
             args.push(...effectiveFiles);
-            const result = await this.run(args, signal);
+            // Only the policy and data go through OPA's loader; conftest reads
+            // the configs itself, so they may sit on any drive.
+            const anchored = anchorDrive(args, [effectivePolicyDir, ...(input.data ?? [])]);
+            if (anchored.conflict)
+                return anchored.conflict;
+            const result = await this.run(args, signal, anchored.cwd);
             return this.sanitizeOutput(result, configPath, policyDir);
         });
     }
@@ -239,7 +280,10 @@ export class ConftestCli {
             args.push('--namespace', input.namespace);
         for (const d of input.data ?? [])
             args.push('--data', d);
-        return this.run(args, signal);
+        const anchored = anchorDrive(args, [input.policy, ...(input.data ?? [])]);
+        if (anchored.conflict)
+            return anchored.conflict;
+        return this.run(args, signal, anchored.cwd);
     }
     /**
      * Pull policies from a remote OCI or Git location into a local
@@ -324,23 +368,43 @@ export class ConftestCli {
     sanitizeOutput(result, configPath, policyDir) {
         if (!configPath && !policyDir)
             return result;
-        if (!result.stdout)
-            return result;
+        // stdout holds a JSON document, where a backslash in the path is encoded
+        // as two; stderr holds the raw path. Both spellings are replaced in both
+        // streams, since an error message can quote either.
+        // OPA's loader inside conftest prints a Windows path without its drive
+        // letter, and may use either separator; each spelling is replaced in its
+        // raw and JSON-encoded form, longest first so a prefix does not win.
+        const forms = (path) => {
+            const slashes = path.replace(/\\/g, '/');
+            const spellings = [
+                path,
+                path.replace(/^[A-Za-z]:/, ''),
+                slashes,
+                slashes.replace(/^[A-Za-z]:/, ''),
+            ];
+            const all = spellings.flatMap((f) => [f, JSON.stringify(f).slice(1, -1)]);
+            return [...new Set(all)].filter((f) => f.length > 1).sort((a, b) => b.length - a.length);
+        };
+        const escapeRe = (s) => s.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
+        const replaceAll = (text, path, marker) => {
+            let out = text;
+            for (const form of forms(path))
+                out = out.replace(new RegExp(escapeRe(form), 'g'), marker);
+            return out;
+        };
         let stdout = result.stdout;
+        let stderr = result.stderr;
         if (configPath) {
-            // JSON.stringify encodes backslashes as \\, so match the encoded form.
-            const jsonEncoded = JSON.stringify(configPath).slice(1, -1);
-            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
-            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline>');
+            stdout = replaceAll(stdout, configPath, '<inline>');
+            stderr = replaceAll(stderr, configPath, '<inline>');
         }
         if (policyDir) {
-            const jsonEncoded = JSON.stringify(policyDir).slice(1, -1);
-            const escaped = jsonEncoded.replace(/[\\^$*+?.()|[\]{}]/g, '\\$&');
-            // Policy dir appears in conftest output as part of file paths.
-            // Replace the full dir prefix so the policy filename is preserved.
-            stdout = stdout.replace(new RegExp(escaped, 'g'), '<inline-policy>');
+            // The policy dir appears as a prefix of file paths; the file name is
+            // kept.
+            stdout = replaceAll(stdout, policyDir, '<inline-policy>');
+            stderr = replaceAll(stderr, policyDir, '<inline-policy>');
         }
-        return { ...result, stdout };
+        return { ...result, stdout, stderr };
     }
 }
 //# sourceMappingURL=conftest-cli.js.map

package/dist/lib/conftest-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGpD,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA4B9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAqB,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACV,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAqB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAClF;QACH,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAChE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/B,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAuED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,YAAY;IACZ,MAAM;IACN,WAAW;IACX,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;CACE,CAAC;AAIX,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAmC;IAC7D,GAAG,EAAE,YAAY;IACjB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,YAAY;IACnB,UAAU,EAAE,mBAAmB;IAC/B,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,kBAAkB;IAC7B,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;CACpB,CAAC;AAEF;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC;IAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClD,+DAA+D;YAC/D,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE1C,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB,EAAE,GAAY;QAC1D,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACtC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAElC,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE3B,IAAI,UAAU,EAAE,CAAC;YACf,uEAAuE;YACvE,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YACnE,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"conftest-cli.js","sourceRoot":"","sources":["../../src/lib/conftest-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AA4B9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAqB,EAAE,CACjD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACV,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAqB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAClF;QACH,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;YAChE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACnE,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACjC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC/B,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAuED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,MAAM;IACN,SAAS;IACT,OAAO;IACP,YAAY;IACZ,MAAM;IACN,WAAW;IACX,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;CACE,CAAC;AAIX,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,sBAAsB,GAAmC;IAC7D,GAAG,EAAE,YAAY;IACjB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;IACnB,OAAO,EAAE,gBAAgB;IACzB,KAAK,EAAE,YAAY;IACnB,UAAU,EAAE,mBAAmB;IAC/B,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,kBAAkB;IAC7B,IAAI,EAAE,aAAa;IACnB,GAAG,EAAE,YAAY;IACjB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,aAAa;CACpB,CAAC;AAEF;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC;IAC9B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH;;;;;;;;;;;GAWG;AACH,SAAS,gBAAgB,CACvB,MAA0B;IAE1B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAClB,IAAc,EACd,KAAgC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EACJ,mCAAmC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBACtE,iFAAiF;oBACjF,iDAAiD;gBACnD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,0DAA0D;QAC1D,MAAM,KAAK,GACT,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACxD,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,OAAO,IAAI,CAAC,cAAc,CACxB;YACE,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YAErD,gBAAgB;YAChB,MAAM,kBAAkB,GAAG,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YACrD,IAAI,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;YAElE,YAAY;YACZ,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC;YAED,mBAAmB;YACnB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAEzD,QAAQ;YACR,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAClD,+DAA+D;YAC/D,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,MAAM,GACV,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAClF,IAAI,MAAM;gBAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE1C,iDAAiD;YACjD,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAE7B,mEAAmE;YACnE,oDAAoD;YACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAA0B,EAAE,MAAoB;QAC3D,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,QAAQ,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;QAChD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAwB,EAAE,MAAoB;QACvD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,MAAoB,EAAE,GAAY;QAC1D,MAAM,IAAI,GAAoC;YAC5C,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAC1C,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;SAC/C,CAAC;QACF,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACtC,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACK,KAAK,CAAC,cAAc,CAC1B,IAIC,EACD,EAAsE;QAEtE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAgD,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC/D,uFAAuF;gBACvF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpC,uFAAuF;gBACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvD,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,cAAc,CACpB,MAAmB,EACnB,UAA8B,EAC9B,SAA6B;QAE7B,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,OAAO,MAAM,CAAC;QAE7C,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAY,EAAE;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG;gBAChB,IAAI;gBACJ,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC9B,OAAO;gBACP,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;aAClC,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3F,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAU,EAAE;YACxE,IAAI,GAAG,GAAG,IAAI,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QAEF,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACpD,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,qEAAqE;YACrE,QAAQ;YACR,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;YAC1D,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/lib/errors.d.ts

@@ -1,10 +1,9 @@
+import type { ToolEnvelope, ToolErrorCode } from '../types.js';
 /**
- * Helpers for building structured tool errors.
- *
- * Tools should never throw raw exceptions to the MCP layer -- every failure
- * mode returns a `ToolEnvelope` with `ok: false` and a structured `error`.
+ * Build an error envelope. The message, hint and details all pass through
+ * the temp-path sanitiser here, so a tool that quotes a binary's stderr does
+ * not have to remember to.
  */
-import type { ToolEnvelope, ToolErrorCode } from '../types.js';
 export declare function err(code: ToolErrorCode, message: string, options?: {
     hint?: string;
     details?: unknown;

package/dist/lib/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAa,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E,wBAAgB,GAAG,CACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,YAAY,CAAC,KAAK,CAAC,CAKrB;AAED,wBAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAInE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAO7D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAa,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,GAAG,CACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,YAAY,CAAC,KAAK,CAAC,CAKrB;AAED,wBAAgB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAInE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAO7D"}

package/dist/lib/errors.js

@@ -1,9 +1,21 @@
+/**
+ * Helpers for building structured tool errors.
+ *
+ * Tools should never throw raw exceptions to the MCP layer -- every failure
+ * mode returns a `ToolEnvelope` with `ok: false` and a structured `error`.
+ */
+import { sanitizeInlinePathsDeep, sanitizeInlineText } from './inline-paths.js';
+/**
+ * Build an error envelope. The message, hint and details all pass through
+ * the temp-path sanitiser here, so a tool that quotes a binary's stderr does
+ * not have to remember to.
+ */
 export function err(code, message, options) {
-    const error = { code, message };
+    const error = { code, message: sanitizeInlineText(message) };
     if (options?.hint !== undefined)
-        error.hint = options.hint;
+        error.hint = sanitizeInlineText(options.hint);
     if (options?.details !== undefined)
-        error.details = options.details;
+        error.details = sanitizeInlinePathsDeep(options.details);
     return { ok: false, error };
 }
 export function ok(data, warnings) {

package/dist/lib/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,GAAG,CACjB,IAAmB,EACnB,OAAe,EACf,OAA8C;IAE9C,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,EAAE,CAAI,IAAO,EAAE,QAAmB;IAChD,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/lib/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGhF;;;;GAIG;AACH,MAAM,UAAU,GAAG,CACjB,IAAmB,EACnB,OAAe,EACf,OAA8C;IAE9C,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACxE,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,EAAE,CAAI,IAAO,EAAE,QAAmB;IAChD,MAAM,QAAQ,GAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU;IACtC,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC,eAAe,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/dist/lib/inline-paths.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Strip this server's own temp-file paths out of anything a tool returns.
+ *
+ * Inline source is written to a private temp directory for the binaries to
+ * read, and their diagnostics, traces and coverage name that file. Nothing
+ * here imports another module of this server, so errors.ts can sanitise
+ * every envelope without an import cycle.
+ */
+/**
+ * Matches the temp-file paths written by OpaCli.withTempSource and
+ * RegalCli.withTempSource when handling inline source. Both now use
+ * mkdtemp which produces a private directory; the file inside is always
+ * named input.rego. Matches both Unix (/) and Windows (\) separators.
+ */
+export declare const INLINE_TEMP_PATH_PATTERN: RegExp;
+/**
+ * Replace a file path that refers to one of our temp files with the
+ * sentinel string `<inline>`. Returns the original string unchanged when
+ * it does not match the pattern, so callers can unconditionally apply it
+ * to all location.file values regardless of whether inline source was used.
+ */
+export declare function sanitizeInlinePath(file: string): string;
+/**
+ * Replace every temp-file path wherever it sits inside `text`: first this
+ * process's own files by their exact spelling, then anything shaped like one
+ * of them by the walk below.
+ */
+export declare function sanitizeInlineText(text: string, roots?: readonly string[]): string;
+/**
+ * Recursively rewrite every temp-file path, in string values and object
+ * keys, to the `<inline>` sentinel. OPA writes inline source to a temp file,
+ * so trace, coverage and profile output and every diagnostic reference that
+ * path; this normalizes the whole structure so callers never see an absolute
+ * temp path. Only a path shaped like this server's own temp files matches.
+ */
+export declare function sanitizeInlinePathsDeep(value: unknown): unknown;
+//# sourceMappingURL=inline-paths.d.ts.map

package/dist/lib/inline-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-paths.d.ts","sourceRoot":"","sources":["../../src/lib/inline-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAsD,CAAC;AAE5F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvD;AAuGD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAalF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW/D"}