@janssenproject/cedarling_wasm 2.4.0-nodejs → 2.5.0

package/dist/types/cjs/generated.d.ts

@@ -0,0 +1,1166 @@
+/// <reference lib="esnext.disposable" />
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * The `ReadableStreamType` enum.
+ *
+ * *This API requires the following crate features to be activated: `ReadableStreamType`*
+ */
+
+export type ReadableStreamType = "bytes";
+
+/**
+ * A WASM wrapper for the Rust `cedarling::AuthorizeResult` struct.
+ * Represents the result of an authorization request.
+ */
+export class AuthorizeResult {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Convert `AuthorizeResult` to json string value
+     */
+    jsonString(): string;
+    /**
+     * Result of authorization
+     * true means `ALLOW`
+     * false means `Deny`
+     *
+     * this field is [`bool`] type to be compatible with [authzen Access Evaluation Decision](https://openid.github.io/authzen/#section-6.2.1).
+     */
+    decision: boolean;
+    /**
+     * Request ID of the authorization request
+     */
+    request_id: string;
+    /**
+     * Cedar authorization response for the request.
+     */
+    response: AuthorizeResultResponse;
+}
+
+/**
+ * A WASM wrapper for the Rust `cedar_policy::Response` struct.
+ * Represents the result of an authorization request.
+ */
+export class AuthorizeResultResponse {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Authorization decision
+     */
+    readonly decision: boolean;
+    /**
+     * Diagnostics providing more information on how this decision was reached
+     */
+    readonly diagnostics: Diagnostics;
+}
+
+/**
+ * WASM wrapper for
+ * `cedarling::BatchAuthorizeResponse<Result<MultiIssuerAuthorizeResult, BatchItemError>>`.
+ * Same shape as [`BatchAuthorizeUnsignedResponse`] with multi-issuer results.
+ */
+export class BatchAuthorizeMultiIssuerResponse {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Shared correlation id stamped on every per-item decision log entry.
+     */
+    readonly batch_id: string;
+    /**
+     * Per-item results in input order — each slot is a
+     * [`BatchItemMultiIssuerResult`].
+     */
+    readonly results: BatchItemMultiIssuerResult[];
+}
+
+/**
+ * WASM wrapper for `cedarling::BatchAuthorizeResponse<Result<AuthorizeResult, BatchItemError>>`.
+ *
+ * Carries a shared `batch_id` (UUIDv7) alongside per-item results. Each result
+ * is a [`BatchItemUnsignedResult`] — Cedar decision on `is_ok()`, per-item
+ * build failure on `error`. `results[i]` corresponds to `items[i]`.
+ */
+export class BatchAuthorizeUnsignedResponse {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Shared correlation id stamped on every per-item decision log entry.
+     */
+    readonly batch_id: string;
+    /**
+     * Per-item results in input order — each slot is a
+     * [`BatchItemUnsignedResult`].
+     */
+    readonly results: BatchItemUnsignedResult[];
+}
+
+/**
+ * Per-item build failure surfaced inside a batch response at `results[i]`
+ * when Cedar couldn't be reached for that item.
+ */
+export class BatchItemError {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Stable variant slug — `action_parse`, `resource_build`, `context_build`,
+     * `principal_build`, `schema_validation`, `multi_issuer_entity`,
+     * `request_validation`.
+     */
+    readonly category: string;
+    /**
+     * Position of the failing item in the original `items` vector.
+     */
+    readonly item_index: number;
+    /**
+     * Human-readable diagnostic. Safe to log.
+     */
+    readonly message: string;
+}
+
+/**
+ * Multi-issuer analog of [`BatchItemUnsignedResult`].
+ */
+export class BatchItemMultiIssuerResult {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The multi-issuer decision if `is_ok()`; throws otherwise.
+     */
+    unwrap(): MultiIssuerAuthorizeResult;
+    /**
+     * The per-item error if `!is_ok()`; `undefined` otherwise.
+     */
+    readonly error: BatchItemError | undefined;
+    /**
+     * `true` when Cedar evaluated this item.
+     */
+    readonly is_ok: boolean;
+}
+
+/**
+ * One slot in a batch response's `results` array. Callers switch on
+ * `is_ok()` — on `true`, read `unwrap()`; on `false`, read `error()`.
+ */
+export class BatchItemUnsignedResult {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The Cedar decision if `is_ok()`; throws otherwise.
+     */
+    unwrap(): AuthorizeResult;
+    /**
+     * The per-item error if `!is_ok()`; `undefined` otherwise.
+     */
+    readonly error: BatchItemError | undefined;
+    /**
+     * `true` when Cedar evaluated this item (Allow or Deny); `false` when it
+     * failed to build.
+     */
+    readonly is_ok: boolean;
+}
+
+/**
+ * The instance of the Cedarling application.
+ */
+export class Cedarling {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Collect every value of the annotation `key` across the given policies,
+     * preserving duplicates. Unknown policy IDs are silently skipped.
+     *
+     * # Arguments
+     *
+     * * `policy_ids` - List of policy IDs to search. Typically
+     *   `result.response.diagnostics.reason` from an authorization result.
+     * * `key` - The annotation key to collect values for (e.g. `"redirect"`).
+     *
+     * # Example
+     *
+     * ```javascript
+     * const redirects = cedarling.annotationValues(
+     *   result.response.diagnostics.reason,
+     *   "redirect",
+     * );
+     * // ["/upgrade"]
+     * ```
+     */
+    annotationValues(policy_ids: string[], key: string): string[];
+    /**
+     * Return the annotations of each given policy, grouped by policy ID. It is
+     * the loss-free companion to `annotationsMap`. Unknown policy IDs are
+     * silently skipped.
+     *
+     * # Arguments
+     *
+     * * `policy_ids` - List of policy IDs whose annotations should be returned
+     *   grouped by policy ID. Typically `result.response.diagnostics.reason` from
+     *   an authorization result.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const byPolicy = cedarling.annotationsByPolicy(result.response.diagnostics.reason);
+     * // { "5": { redirect: "/upgrade", tier: "premium" } }
+     * ```
+     */
+    annotationsByPolicy(policy_ids: string[]): any;
+    /**
+     * Merge the annotations (`@key("value")`) of the given policies into a single object.
+     *
+     * Intended for resolving the determining policies of an authorization decision:
+     * pass `result.response.diagnostics.reason`.
+     *
+     * Lossy: if the same annotation key appears on several policies, one value wins
+     * arbitrarily. Use `annotationValues` / `annotationsByPolicy` when duplicates
+     * matter. Unknown policy IDs are silently skipped.
+     *
+     * # Arguments
+     *
+     * * `policy_ids` - List of policy IDs whose annotations should be merged into
+     *   a single object. Typically `result.response.diagnostics.reason` from an
+     *   authorization result.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const annotations = cedarling.annotationsMap(result.response.diagnostics.reason);
+     * // { redirect: "/upgrade", tier: "premium" }
+     * ```
+     */
+    annotationsMap(policy_ids: string[]): any;
+    /**
+     * Authorize a batch of multi-issuer requests against one shared token set.
+     *
+     * Tokens are validated and token/issuer entities are built once, then
+     * each item is evaluated in input order. Batch-level failures (validation,
+     * JWT verification, status-list refresh) reject the whole call; per-item
+     * failures are returned as `BatchItemError` results and exposed by WASM
+     * with `is_ok=false` and `error`, while genuine Cedar denials remain
+     * `AuthorizeResult` values with `decision=false`.
+     *
+     * # Arguments
+     *
+     * * `request` - JSON string representation of [`BatchAuthorizeMultiIssuerRequest`].
+     *
+     * # Example
+     *
+     * ```javascript
+     * const result = await cedarling.authorizeMultiIssuerBatch(JSON.stringify(batchRequest));
+     * ```
+     */
+    authorizeMultiIssuerBatch(request: string): Promise<BatchAuthorizeMultiIssuerResponse>;
+    /**
+     * Authorize multi-issuer request.
+     * Makes authorization decision based on multiple JWT tokens from different issuers.
+     *
+     * # Arguments
+     *
+     * * `request` - JSON string representation of [`AuthorizeMultiIssuerRequest`].
+     *
+     * # Example
+     *
+     * ```javascript
+     * const result = await cedarling.authorizeMultiIssuer(JSON.stringify(request));
+     * ```
+     */
+    authorizeMultiIssuer(request: string): Promise<MultiIssuerAuthorizeResult>;
+    /**
+     * Authorize a batch of unsigned requests against one shared principal.
+     *
+     * Setup work (principal build + pushed-data snapshot) runs once and each
+     * item is evaluated in input order. Results are returned inside a
+     * [`BatchAuthorizeUnsignedResponse`] carrying the shared `batch_id`.
+     * Batch-level failures (validation, principal parse) reject the whole
+     * call; per-item failures are returned as `BatchItemError` results and
+     * exposed by WASM with `is_ok=false` and `error`, while genuine Cedar
+     * denials remain `AuthorizeResult` values with `decision=false`.
+     * # Arguments
+     *
+     * * `request` - JSON string representation of [`BatchAuthorizeUnsignedRequest`].
+     *
+     * # Example
+     *
+     * ```javascript
+     * const result = await cedarling.authorizeUnsignedBatch(JSON.stringify(batchRequest));
+     * ```
+     */
+    authorizeUnsignedBatch(request: string): Promise<BatchAuthorizeUnsignedResponse>;
+    /**
+     * Authorize an unsigned request carrying an optional single principal.
+     * Makes an authorization decision based on the [`RequestUnsigned`].
+     *
+     * When `principal` is omitted / `null` on the JS side the core uses Cedar
+     * partial evaluation; residual-dependent requests fail closed with
+     * `Decision::Deny` and surface residual policy ids in
+     * `response.diagnostics.reason`.
+     *
+     * # Arguments
+     *
+     * * `request` - JSON string representation of [`RequestUnsigned`].
+     *
+     * # Example
+     *
+     * ```javascript
+     * const result = await cedarling.authorizeUnsigned(JSON.stringify(request));
+     * ```
+     */
+    authorizeUnsigned(request: string): Promise<AuthorizeResult>;
+    /**
+     * Clear all entries from the data store.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * cedarling.clearDataCtx();
+     * console.log("All data entries cleared");
+     * ```
+     */
+    clearDataCtx(): void;
+    /**
+     * Destructive read: returns the telemetry metrics snapshot and resets
+     * the counters for the next interval.
+     *
+     * Fails when `CEDARLING_METRICS_COLLECTION` is disabled or whenever
+     * `CEDARLING_LOCK_TELEMETRY_INTERVAL` is set (even if the Lock server
+     * has no telemetry endpoint). `interval_secs` is fractional seconds,
+     * so sub-second intervals are reported exactly.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const snapshot = cedarling.drainMetrics();
+     * console.log(`Requests: ${snapshot.operational_stats.get("authz.requests_total")}`);
+     * ```
+     */
+    drainMetrics(): MetricsSnapshot;
+    /**
+     * Get trusted issuer identifiers that failed to load.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const ids = cedarling.failedTrustedIssuerIds();
+     * ```
+     */
+    failedTrustedIssuerIds(): Array<any>;
+    /**
+     * Get a value from the data store by key.
+     * Returns null if the key doesn't exist or the entry has expired.
+     *
+     * # Arguments
+     *
+     * * `key` - A string key for the data entry to retrieve
+     *
+     * # Example
+     *
+     * ```javascript
+     * const value = cedarling.getDataCtx("user:123");
+     * if (value !== null) {
+     *     console.log(value.name); // "John"
+     * }
+     * ```
+     */
+    getDataCtx(key: string): any;
+    /**
+     * Get a data entry with full metadata by key.
+     * Returns undefined if the key doesn't exist or the entry has expired.
+     *
+     * # Arguments
+     *
+     * * `key` - A string key for the data entry to retrieve
+     *
+     * # Example
+     *
+     * ```javascript
+     * const entry = cedarling.getDataEntryCtx("user:123");
+     * if (entry !== undefined) {
+     *     console.log(entry.key); // "user:123"
+     *     console.log(entry.value()); // { name: "John", age: 30 }
+     *     console.log(entry.data_type); // "Record"
+     *     console.log(entry.created_at); // "2024-01-01T12:00:00Z"
+     *     console.log(entry.access_count); // 5
+     * }
+     * ```
+     */
+    getDataEntryCtx(key: string): DataEntry | undefined;
+    /**
+     * Returns one retained memory log by ID, or `null` when it is not retained.
+     *
+     * # Arguments
+     *
+     * * `id` - The retained log identifier.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const log = cedarling.getLogById("request-id");
+     * ```
+     */
+    getLogById(id: string): any;
+    /**
+     * Returns identifiers for all retained memory logs.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const ids = cedarling.getLogIds();
+     * ```
+     */
+    getLogIds(): Array<any>;
+    /**
+     * Returns retained memory logs matching one request ID and indexed value.
+     *
+     * # Arguments
+     *
+     * * `requestId` - The request identifier to match.
+     * * `tag` - A log kind (`"System"`, `"Decision"`, or `"Metric"`) or a
+     *   system-log level such as `"DEBUG"`.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const logs = cedarling.getLogsByRequestIdAndTag("request-id", "System");
+     * ```
+     */
+    getLogsByRequestIdAndTag(request_id: string, tag: string): any[];
+    /**
+     * Returns retained memory logs for one request ID.
+     *
+     * # Arguments
+     *
+     * * `requestId` - The request identifier to match.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const logs = cedarling.getLogsByRequestId("request-id");
+     * ```
+     */
+    getLogsByRequestId(request_id: string): any[];
+    /**
+     * Returns retained memory logs matching an indexed value.
+     *
+     * # Arguments
+     *
+     * * `tag` - A log kind (`"System"`, `"Decision"`, or `"Metric"`) or a
+     *   system-log level such as `"DEBUG"`.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const logs = cedarling.getLogsByTag("System");
+     * ```
+     */
+    getLogsByTag(tag: string): any[];
+    /**
+     * Get statistics about the data store.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const stats = cedarling.getStatsCtx();
+     * console.log(`Entries: ${stats.entry_count}/${stats.max_entries || 'unlimited'}`);
+     * console.log(`Capacity: ${stats.capacity_usage_percent.toFixed(2)}%`);
+     * console.log(`Total size: ${stats.total_size_bytes} bytes`);
+     * ```
+     */
+    getStatsCtx(): DataStoreStats;
+    /**
+     * Check whether a trusted issuer was loaded by `iss` claim.
+     *
+     * # Arguments
+     *
+     * * `iss_claim` - Issuer `iss` claim value to check.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const ok = cedarling.isTrustedIssuerLoadedByIss("https://issuer.example.org");
+     * ```
+     */
+    isTrustedIssuerLoadedByIss(iss_claim: string): boolean;
+    /**
+     * Check whether a trusted issuer was loaded by issuer identifier.
+     *
+     * # Arguments
+     *
+     * * `issuer_id` - Trusted issuer identifier to check.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const ok = cedarling.isTrustedIssuerLoadedByName("issuer_id");
+     * ```
+     */
+    isTrustedIssuerLoadedByName(issuer_id: string): boolean;
+    /**
+     * List all entries with their metadata.
+     * Returns an array of DataEntry objects.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const entries = cedarling.listDataCtx();
+     * entries.forEach(entry => {
+     *     console.log(`${entry.key}: ${entry.data_type} (accessed ${entry.access_count} times)`);
+     * });
+     * ```
+     */
+    listDataCtx(): Array<any>;
+    /**
+     * Get trusted issuer identifiers loaded successfully.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const ids = cedarling.loadedTrustedIssuerIds();
+     * ```
+     */
+    loadedTrustedIssuerIds(): Array<any>;
+    /**
+     * Get the number of trusted issuers loaded successfully.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const loadedCount = cedarling.loadedTrustedIssuersCount();
+     * ```
+     */
+    loadedTrustedIssuersCount(): number;
+    /**
+     * Creates a new Cedarling application from a JavaScript `Map`.
+     *
+     * # Arguments
+     *
+     * * `config` - A `Map` of Cedarling bootstrap-property names and values.
+     *
+     * # Example
+     *
+     * ```javascript
+     * await initWasm();
+     * const cedarling = await Cedarling.newFromMap(new Map([
+     *   ["CEDARLING_APPLICATION_NAME", "task-api"],
+     *   ["CEDARLING_POLICY_STORE_URI", "https://example.com/policy-store.cjar"],
+     *   ["CEDARLING_LOG_TYPE", "memory"],
+     *   ["CEDARLING_LOG_TTL", 120],
+     * ]));
+     * ```
+     */
+    static newFromMap(config: Map<any, any>): Promise<Cedarling>;
+    /**
+     * Creates a Cedarling application from bootstrap properties.
+     *
+     * # Arguments
+     *
+     * * `config` - A plain object of Cedarling bootstrap-property names and values.
+     *
+     * # Example
+     *
+     * ```javascript
+     * await initWasm();
+     * const cedarling = await Cedarling.new({
+     *   CEDARLING_APPLICATION_NAME: "task-api",
+     *   CEDARLING_POLICY_STORE_URI: "https://example.com/policy-store.cjar",
+     *   CEDARLING_LOG_TYPE: "memory",
+     *   CEDARLING_LOG_TTL: 120,
+     * });
+     * ```
+     */
+    static new(config: object): Promise<Cedarling>;
+    /**
+     * Get the ID of the currently published policy store, if it carries one.
+     *
+     * `undefined` means the store carries no ID. The value is an opaque,
+     * source-dependent string; it may change after a background refresh.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const id = cedarling.policyStoreId();
+     * ```
+     */
+    policyStoreId(): string | undefined;
+    /**
+     * Returns all retained memory logs and removes them from storage.
+     * Other log configurations return an empty array.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const logs = cedarling.popLogs();
+     * ```
+     */
+    popLogs(): Array<any>;
+    /**
+     * Push a value into the data store with an optional TTL.
+     * If the key already exists, the value will be replaced.
+     * If TTL is not provided, the default TTL from configuration is used.
+     *
+     * # Arguments
+     *
+     * * `key` - A string key for the data entry (must not be empty)
+     * * `value` - The value to store (any JSON-serializable JavaScript value: object, array, string, number, boolean)
+     * * `ttl_secs` - Optional TTL in seconds (undefined/null uses default from config)
+     *
+     * # Example
+     *
+     * ```javascript
+     * cedarling.pushDataCtx("user:123", { name: "John", age: 30 }, 3600);
+     * cedarling.pushDataCtx("config", { setting: "value" }); // Uses default TTL
+     * ```
+     */
+    pushDataCtx(key: string, value: any, ttl_secs?: bigint | null): void;
+    /**
+     * Remove a value from the data store by key.
+     * Returns true if the key existed and was removed, false otherwise.
+     *
+     * # Arguments
+     *
+     * * `key` - A string key for the data entry to remove
+     *
+     * # Example
+     *
+     * ```javascript
+     * const removed = cedarling.removeDataCtx("user:123");
+     * if (removed) {
+     *     console.log("Entry was successfully removed");
+     * }
+     * ```
+     */
+    removeDataCtx(key: string): boolean;
+    /**
+     * Closes Lock Server connections and pushes all available logs.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * await cedarling.shutDown();
+     * ```
+     */
+    shutDown(): Promise<void>;
+    /**
+     * Get the total number of trusted issuer entries discovered.
+     *
+     * # Arguments
+     *
+     * None.
+     *
+     * # Example
+     *
+     * ```javascript
+     * const total = cedarling.totalIssuers();
+     * ```
+     */
+    totalIssuers(): number;
+}
+
+/**
+ * A WASM wrapper for the Rust `cedarling::DataEntry` struct.
+ * Represents a data entry in the DataStore with value and metadata.
+ */
+export class DataEntry {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Convert `DataEntry` to json string value
+     */
+    jsonString(): string;
+    /**
+     * Get the value stored in this entry as a JavaScript object
+     */
+    value(): any;
+    /**
+     * Number of times this entry has been accessed
+     */
+    access_count: bigint;
+    /**
+     * Timestamp when this entry was created (RFC 3339 format)
+     */
+    created_at: string;
+    /**
+     * The inferred Cedar type of the value
+     */
+    data_type: string;
+    /**
+     * Timestamp when this entry expires (RFC 3339 format). The getter returns undefined if no TTL.
+     */
+    get expires_at(): string | undefined;
+    /**
+     * Timestamp when this entry expires (RFC 3339 format). The getter returns undefined if no TTL.
+     */
+    set expires_at(value: string | null | undefined);
+    /**
+     * The key for this entry
+     */
+    key: string;
+}
+
+/**
+ * A WASM wrapper for the Rust `cedarling::DataStoreStats` struct.
+ * Statistics about the DataStore.
+ */
+export class DataStoreStats {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Convert `DataStoreStats` to json string value
+     */
+    jsonString(): string;
+    /**
+     * Average size per entry in bytes (0 if no entries)
+     */
+    avg_entry_size_bytes: number;
+    /**
+     * Percentage of capacity used (0.0-100.0, based on entry count)
+     */
+    capacity_usage_percent: number;
+    /**
+     * Number of entries currently stored
+     */
+    entry_count: number;
+    /**
+     * Maximum number of entries allowed (0 = unlimited)
+     */
+    max_entries: number;
+    /**
+     * Maximum size per entry in bytes (0 = unlimited)
+     */
+    max_entry_size: number;
+    /**
+     * Memory usage threshold percentage (from config)
+     */
+    memory_alert_threshold: number;
+    /**
+     * Whether memory usage exceeds the alert threshold
+     */
+    memory_alert_triggered: boolean;
+    /**
+     * Whether metrics tracking is enabled
+     */
+    metrics_enabled: boolean;
+    /**
+     * Total size of all entries in bytes (approximate, based on JSON serialization)
+     */
+    total_size_bytes: number;
+}
+
+/**
+ * Diagnostics
+ * ===========
+ *
+ * Provides detailed information about how a policy decision was made, including policies that contributed to the decision and any errors encountered during evaluation.
+ */
+export class Diagnostics {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Errors that occurred during authorization. The errors should be
+     * treated as unordered, since policies may be evaluated in any order.
+     */
+    readonly errors: PolicyEvaluationError[];
+    /**
+     * `PolicyId`s of the policies that contributed to the decision.
+     * If no policies applied to the request, this set will be empty.
+     *
+     * The ids should be treated as unordered,
+     */
+    readonly reason: string[];
+}
+
+declare class IntoUnderlyingByteSource {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    cancel(): void;
+    pull(controller: ReadableByteStreamController): Promise<any>;
+    start(controller: ReadableByteStreamController): void;
+    readonly autoAllocateChunkSize: number;
+    readonly type: ReadableStreamType;
+}
+export type { IntoUnderlyingByteSource };
+
+declare class IntoUnderlyingSink {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    abort(reason: any): Promise<any>;
+    close(): Promise<any>;
+    write(chunk: any): Promise<any>;
+}
+export type { IntoUnderlyingSink };
+
+declare class IntoUnderlyingSource {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    cancel(): void;
+    pull(controller: ReadableStreamDefaultController): Promise<any>;
+}
+export type { IntoUnderlyingSource };
+
+/**
+ * A WASM wrapper for the Rust `cedarling::MetricsSnapshot` struct.
+ * Represents a snapshot of the collected telemetry metrics for the current
+ * interval. Destructive read: taking a snapshot resets the collected
+ * metrics, so use a single consumer.
+ */
+export class MetricsSnapshot {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Convert `MetricsSnapshot` to json string value.
+     *
+     * `policy_stats`, `error_counters` and `operational_stats` are converted
+     * from `Map` to plain objects so `JSON.stringify` emits their entries.
+     */
+    jsonString(): string;
+    /**
+     * Classified error counters keyed by error metric key.
+     */
+    error_counters: Map<any, any>;
+    /**
+     * Duration of the snapshot interval in fractional seconds.
+     * Exposed as `Number` (not `BigInt`) so plain JS arithmetic works.
+     */
+    interval_secs: number;
+    /**
+     * Operational counters and gauges (authorization, cache, JWT, data, lock).
+     */
+    operational_stats: Map<any, any>;
+    /**
+     * Per-policy evaluation counts (`policy_id`, `policy_id.allow`, `policy_id.deny`).
+     */
+    policy_stats: Map<any, any>;
+}
+
+/**
+ * A WASM wrapper for the Rust `cedarling::MultiIssuerAuthorizeResult` struct.
+ * Represents the result of a multi-issuer authorization request.
+ */
+export class MultiIssuerAuthorizeResult {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Convert `MultiIssuerAuthorizeResult` to json string value
+     */
+    jsonString(): string;
+    /**
+     * Result of authorization
+     * true means `ALLOW`
+     * false means `Deny`
+     */
+    decision: boolean;
+    /**
+     * Request ID of the authorization request
+     */
+    request_id: string;
+    /**
+     * Result of Cedar policy authorization
+     */
+    response: AuthorizeResultResponse;
+}
+
+/**
+ * PolicyEvaluationError
+ * =====================
+ *
+ * Represents an error that occurred when evaluating a Cedar policy.
+ */
+export class PolicyEvaluationError {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Underlying evaluation error string representation
+     */
+    readonly error: string;
+    /**
+     * Id of the policy with an error
+     */
+    readonly id: string;
+}
+
+/**
+ * Creates a Cedarling application from bootstrap properties.
+ *
+ * # Arguments
+ *
+ * * `config` - A JavaScript `Map` or plain object of Cedarling
+ *   bootstrap-property names and values.
+ *
+ * # Example
+ *
+ * ```javascript
+ * await initWasm();
+ * const cedarling = await init({
+ *   CEDARLING_APPLICATION_NAME: "task-api",
+ *   CEDARLING_POLICY_STORE_URI: "https://example.com/policy-store.cjar",
+ *   CEDARLING_LOG_TYPE: "memory",
+ *   CEDARLING_LOG_TTL: 120,
+ * });
+ * ```
+ */
+export function init(config: any): Promise<Cedarling>;
+
+/**
+ * Create a new instance of the Cedarling application from archive bytes.
+ *
+ * This function allows loading a policy store from a Cedar Archive (.cjar)
+ * that was fetched with custom logic (e.g., with authentication headers).
+ *
+ * # Arguments
+ * * `config` - Bootstrap configuration (Map or Object) without a policy-store
+ *   source property. The archive bytes provide the policy store.
+ * * `archive_bytes` - The .cjar archive bytes (Uint8Array)
+ *
+ * # Example
+ * ```javascript
+ * await initWasm();
+ * const config = {
+ *   CEDARLING_APPLICATION_NAME: "task-api",
+ *   CEDARLING_LOG_TYPE: "memory",
+ *   CEDARLING_LOG_TTL: 120,
+ * };
+ * const response = await fetch("https://example.com/policy-store.cjar", {
+ *   headers: { Authorization: "Bearer <token>" },
+ * });
+ * if (!response.ok) throw new Error("Unable to fetch policy store");
+ * const archiveBytes = new Uint8Array(await response.arrayBuffer());
+ * const cedarling = await initFromArchiveBytes(config, archiveBytes);
+ * ```
+ */
+export function initFromArchiveBytes(config: any, archive_bytes: Uint8Array): Promise<Cedarling>;
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+    readonly memory: WebAssembly.Memory;
+    readonly __wbg_authorizeresult_free: (a: number, b: number) => void;
+    readonly __wbg_authorizeresultresponse_free: (a: number, b: number) => void;
+    readonly __wbg_batchauthorizemultiissuerresponse_free: (a: number, b: number) => void;
+    readonly __wbg_batchauthorizeunsignedresponse_free: (a: number, b: number) => void;
+    readonly __wbg_batchitemerror_free: (a: number, b: number) => void;
+    readonly __wbg_batchitemmultiissuerresult_free: (a: number, b: number) => void;
+    readonly __wbg_batchitemunsignedresult_free: (a: number, b: number) => void;
+    readonly __wbg_cedarling_free: (a: number, b: number) => void;
+    readonly __wbg_dataentry_free: (a: number, b: number) => void;
+    readonly __wbg_datastorestats_free: (a: number, b: number) => void;
+    readonly __wbg_diagnostics_free: (a: number, b: number) => void;
+    readonly __wbg_get_authorizeresult_decision: (a: number) => number;
+    readonly __wbg_get_authorizeresult_request_id: (a: number, b: number) => void;
+    readonly __wbg_get_authorizeresult_response: (a: number) => number;
+    readonly __wbg_get_dataentry_access_count: (a: number) => bigint;
+    readonly __wbg_get_dataentry_created_at: (a: number, b: number) => void;
+    readonly __wbg_get_dataentry_data_type: (a: number, b: number) => void;
+    readonly __wbg_get_dataentry_expires_at: (a: number, b: number) => void;
+    readonly __wbg_get_dataentry_key: (a: number, b: number) => void;
+    readonly __wbg_get_datastorestats_avg_entry_size_bytes: (a: number) => number;
+    readonly __wbg_get_datastorestats_capacity_usage_percent: (a: number) => number;
+    readonly __wbg_get_datastorestats_entry_count: (a: number) => number;
+    readonly __wbg_get_datastorestats_max_entries: (a: number) => number;
+    readonly __wbg_get_datastorestats_max_entry_size: (a: number) => number;
+    readonly __wbg_get_datastorestats_memory_alert_threshold: (a: number) => number;
+    readonly __wbg_get_datastorestats_memory_alert_triggered: (a: number) => number;
+    readonly __wbg_get_datastorestats_metrics_enabled: (a: number) => number;
+    readonly __wbg_get_datastorestats_total_size_bytes: (a: number) => number;
+    readonly __wbg_get_metricssnapshot_error_counters: (a: number) => number;
+    readonly __wbg_get_metricssnapshot_interval_secs: (a: number) => number;
+    readonly __wbg_get_metricssnapshot_operational_stats: (a: number) => number;
+    readonly __wbg_get_metricssnapshot_policy_stats: (a: number) => number;
+    readonly __wbg_get_multiissuerauthorizeresult_decision: (a: number) => number;
+    readonly __wbg_get_multiissuerauthorizeresult_request_id: (a: number, b: number) => void;
+    readonly __wbg_get_multiissuerauthorizeresult_response: (a: number) => number;
+    readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
+    readonly __wbg_intounderlyingsink_free: (a: number, b: number) => void;
+    readonly __wbg_intounderlyingsource_free: (a: number, b: number) => void;
+    readonly __wbg_metricssnapshot_free: (a: number, b: number) => void;
+    readonly __wbg_multiissuerauthorizeresult_free: (a: number, b: number) => void;
+    readonly __wbg_policyevaluationerror_free: (a: number, b: number) => void;
+    readonly __wbg_set_authorizeresult_decision: (a: number, b: number) => void;
+    readonly __wbg_set_authorizeresult_request_id: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_authorizeresult_response: (a: number, b: number) => void;
+    readonly __wbg_set_dataentry_access_count: (a: number, b: bigint) => void;
+    readonly __wbg_set_dataentry_created_at: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_dataentry_data_type: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_dataentry_expires_at: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_dataentry_key: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_datastorestats_avg_entry_size_bytes: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_capacity_usage_percent: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_entry_count: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_max_entries: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_max_entry_size: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_memory_alert_threshold: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_memory_alert_triggered: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_metrics_enabled: (a: number, b: number) => void;
+    readonly __wbg_set_datastorestats_total_size_bytes: (a: number, b: number) => void;
+    readonly __wbg_set_metricssnapshot_error_counters: (a: number, b: number) => void;
+    readonly __wbg_set_metricssnapshot_interval_secs: (a: number, b: number) => void;
+    readonly __wbg_set_metricssnapshot_operational_stats: (a: number, b: number) => void;
+    readonly __wbg_set_metricssnapshot_policy_stats: (a: number, b: number) => void;
+    readonly __wbg_set_multiissuerauthorizeresult_decision: (a: number, b: number) => void;
+    readonly __wbg_set_multiissuerauthorizeresult_request_id: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_multiissuerauthorizeresult_response: (a: number, b: number) => void;
+    readonly authorizeresult_jsonString: (a: number, b: number) => void;
+    readonly authorizeresultresponse_decision: (a: number) => number;
+    readonly authorizeresultresponse_diagnostics: (a: number) => number;
+    readonly batchauthorizemultiissuerresponse_batch_id: (a: number, b: number) => void;
+    readonly batchauthorizemultiissuerresponse_results: (a: number, b: number) => void;
+    readonly batchauthorizeunsignedresponse_batch_id: (a: number, b: number) => void;
+    readonly batchauthorizeunsignedresponse_results: (a: number, b: number) => void;
+    readonly batchitemerror_category: (a: number, b: number) => void;
+    readonly batchitemerror_item_index: (a: number) => number;
+    readonly batchitemerror_message: (a: number, b: number) => void;
+    readonly batchitemmultiissuerresult_error: (a: number) => number;
+    readonly batchitemmultiissuerresult_is_ok: (a: number) => number;
+    readonly batchitemmultiissuerresult_unwrap: (a: number, b: number) => void;
+    readonly batchitemunsignedresult_error: (a: number) => number;
+    readonly batchitemunsignedresult_is_ok: (a: number) => number;
+    readonly batchitemunsignedresult_unwrap: (a: number, b: number) => void;
+    readonly cedarling_annotationValues: (a: number, b: number, c: number, d: number, e: number, f: number) => void;
+    readonly cedarling_annotationsByPolicy: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_annotationsMap: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_authorizeMultiIssuer: (a: number, b: number, c: number) => number;
+    readonly cedarling_authorizeMultiIssuerBatch: (a: number, b: number, c: number) => number;
+    readonly cedarling_authorizeUnsigned: (a: number, b: number, c: number) => number;
+    readonly cedarling_authorizeUnsignedBatch: (a: number, b: number, c: number) => number;
+    readonly cedarling_clearDataCtx: (a: number, b: number) => void;
+    readonly cedarling_drainMetrics: (a: number, b: number) => void;
+    readonly cedarling_failedTrustedIssuerIds: (a: number) => number;
+    readonly cedarling_getDataCtx: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_getDataEntryCtx: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_getLogById: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_getLogIds: (a: number) => number;
+    readonly cedarling_getLogsByRequestId: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_getLogsByRequestIdAndTag: (a: number, b: number, c: number, d: number, e: number, f: number) => void;
+    readonly cedarling_getLogsByTag: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_getStatsCtx: (a: number, b: number) => void;
+    readonly cedarling_isTrustedIssuerLoadedByIss: (a: number, b: number, c: number) => number;
+    readonly cedarling_isTrustedIssuerLoadedByName: (a: number, b: number, c: number) => number;
+    readonly cedarling_listDataCtx: (a: number, b: number) => void;
+    readonly cedarling_loadedTrustedIssuerIds: (a: number) => number;
+    readonly cedarling_loadedTrustedIssuersCount: (a: number) => number;
+    readonly cedarling_new: (a: number) => number;
+    readonly cedarling_newFromMap: (a: number) => number;
+    readonly cedarling_policyStoreId: (a: number, b: number) => void;
+    readonly cedarling_popLogs: (a: number, b: number) => void;
+    readonly cedarling_pushDataCtx: (a: number, b: number, c: number, d: number, e: number, f: number, g: bigint) => void;
+    readonly cedarling_removeDataCtx: (a: number, b: number, c: number, d: number) => void;
+    readonly cedarling_shutDown: (a: number) => number;
+    readonly cedarling_totalIssuers: (a: number) => number;
+    readonly dataentry_jsonString: (a: number, b: number) => void;
+    readonly dataentry_value: (a: number, b: number) => void;
+    readonly datastorestats_jsonString: (a: number, b: number) => void;
+    readonly diagnostics_errors: (a: number, b: number) => void;
+    readonly diagnostics_reason: (a: number, b: number) => void;
+    readonly init: (a: number) => number;
+    readonly rust_zstd_wasm_shim_calloc: (a: number, b: number) => number;
+    readonly rust_zstd_wasm_shim_free: (a: number) => void;
+    readonly rust_zstd_wasm_shim_malloc: (a: number) => number;
+    readonly rust_zstd_wasm_shim_memcmp: (a: number, b: number, c: number) => number;
+    readonly rust_zstd_wasm_shim_memcpy: (a: number, b: number, c: number) => number;
+    readonly rust_zstd_wasm_shim_memmove: (a: number, b: number, c: number) => number;
+    readonly rust_zstd_wasm_shim_memset: (a: number, b: number, c: number) => number;
+    readonly rust_zstd_wasm_shim_qsort: (a: number, b: number, c: number, d: number) => void;
+    readonly initFromArchiveBytes: (a: number, b: number) => number;
+    readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
+    readonly intounderlyingbytesource_cancel: (a: number) => void;
+    readonly intounderlyingbytesource_pull: (a: number, b: number) => number;
+    readonly intounderlyingbytesource_start: (a: number, b: number) => void;
+    readonly intounderlyingbytesource_type: (a: number) => number;
+    readonly intounderlyingsink_abort: (a: number, b: number) => number;
+    readonly intounderlyingsink_close: (a: number) => number;
+    readonly intounderlyingsink_write: (a: number, b: number) => number;
+    readonly intounderlyingsource_cancel: (a: number) => void;
+    readonly intounderlyingsource_pull: (a: number, b: number) => number;
+    readonly metricssnapshot_jsonString: (a: number, b: number) => void;
+    readonly multiissuerauthorizeresult_jsonString: (a: number, b: number) => void;
+    readonly policyevaluationerror_error: (a: number, b: number) => void;
+    readonly policyevaluationerror_id: (a: number, b: number) => void;
+    readonly __wasm_bindgen_func_elem_8937: (a: number, b: number, c: number, d: number) => void;
+    readonly __wasm_bindgen_func_elem_8992: (a: number, b: number, c: number, d: number) => void;
+    readonly __wasm_bindgen_func_elem_12497: (a: number, b: number, c: number) => void;
+    readonly __wasm_bindgen_func_elem_8771: (a: number, b: number) => void;
+    readonly __wbindgen_export: (a: number, b: number) => number;
+    readonly __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
+    readonly __wbindgen_export3: (a: number) => void;
+    readonly __wbindgen_export4: (a: number, b: number) => void;
+    readonly __wbindgen_add_to_stack_pointer: (a: number) => number;
+    readonly __wbindgen_export5: (a: number, b: number, c: number) => void;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;