@kya-os/checkpoint-wasm-runtime 1.5.1 → 1.6.0

package/wasm/kya-os-engine-cedar-web/kya_os_engine.d.ts

@@ -0,0 +1,117 @@
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Cross-boundary `verify` wrapper. The JS host calls `engine.verify(input,
+ * ctxSpec)`; on success it gets a [`VerifyResult`] JSON object; on
+ * infrastructure failure (or malformed input) it gets a thrown JS error
+ * whose message names the failure mode.
+ *
+ * **Error semantics**:
+ *
+ * - Verification *verdicts* (Block/Challenge/etc.) surface inside the
+ *   returned `VerifyResult` — they are not thrown.
+ * - Engine [`VerifyError`][crate::error::VerifyError] (resolver / cache /
+ *   reputation / policy infra failures) surface as thrown JS errors.
+ * - Serde deserialisation failures (malformed JS input) surface as thrown
+ *   JS errors too, mirroring the typed-vs-thrown split.
+ *
+ * # JS signature
+ *
+ * ```ts
+ * function verify(input: AgentRequest, ctx: ContextSpec): VerifyResult;
+ * ```
+ */
+export function verify(input_js: any, ctx_js: any): any;
+/**
+ * Cross-boundary handle to a compiled Cedar policy bundle.
+ *
+ * Wraps a [`CedarPolicyEvaluator`] so a JS host can compile a tenant
+ * policy once and authorize many requests against it. Construction
+ * compiles the bundle; each [`authorize`][Self::authorize] call evaluates
+ * a single owned request and never re-parses policy text.
+ */
+export class PolicyEvaluator {
+  free(): void;
+  [Symbol.dispose](): void;
+  /**
+   * Compile `policy_text` into a reusable evaluator.
+   *
+   * The Cedar policy bundle is parsed and compiled exactly once here;
+   * the resulting evaluator is held for the lifetime of the handle and
+   * reused by every [`authorize`][Self::authorize] call.
+   *
+   * # Errors
+   *
+   * Returns a thrown JS error whose message names the failure when
+   * `policy_text` is not syntactically valid Cedar
+   * ([`PolicyEvaluationError::Malformed`][crate::error::PolicyEvaluationError::Malformed]).
+   * A malformed bundle is an infrastructure fault surfaced at
+   * construction, never as a per-request deny.
+   */
+  constructor(policy_text: string);
+  /**
+   * Authorize one owned request against the compiled policy bundle.
+   *
+   * The JS host calls `evaluator.authorize(input)` with an
+   * [`AuthorizeInput`]-shaped object (camelCase keys); it gets back a
+   * [`Decision`][crate::types::Decision] JSON object. The evaluator owns
+   * the fail-closed posture — a request it cannot marshal, or one
+   * matching no `permit`, comes back as a
+   * [`Decision::Block`][crate::types::Decision::Block], not a thrown
+   * error.
+   *
+   * # Errors
+   *
+   * Returns a thrown JS error only for boundary faults: a malformed
+   * `input_js` that fails [`AuthorizeInput`] deserialisation, or a
+   * failure serialising the resulting `Decision`. Authorization
+   * *verdicts* never throw — they surface inside the returned value.
+   *
+   * # JS signature
+   *
+   * ```ts
+   * authorize(input: AuthorizeInput): Decision;
+   * ```
+   */
+  authorize(input_js: any): any;
+}
+
+export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
+
+export interface InitOutput {
+  readonly memory: WebAssembly.Memory;
+  readonly __wbg_policyevaluator_free: (a: number, b: number) => void;
+  readonly policyevaluator_authorize: (a: number, b: number, c: number) => void;
+  readonly policyevaluator_new: (a: number, b: number, c: number) => void;
+  readonly verify: (a: number, b: number, c: number) => void;
+  readonly __wbindgen_export: (a: number, b: number) => number;
+  readonly __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;
+  readonly __wbindgen_export3: (a: number) => void;
+  readonly __wbindgen_add_to_stack_pointer: (a: number) => number;
+}
+
+export type SyncInitInput = BufferSource | WebAssembly.Module;
+/**
+ * Instantiates the given `module`, which can either be bytes or
+ * a precompiled `WebAssembly.Module`.
+ *
+ * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
+ *
+ * @returns {InitOutput}
+ */
+export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
+
+/**
+ * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
+ * for everything else, calls `WebAssembly.instantiate` directly.
+ *
+ * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
+ *
+ * @returns {Promise<InitOutput>}
+ */
+export default function __wbg_init(
+  module_or_path?:
+    | { module_or_path: InitInput | Promise<InitInput> }
+    | InitInput
+    | Promise<InitInput>
+): Promise<InitOutput>;