@kybernesis/arp-pdp 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kybernesis AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# `@kybernesis/arp-pdp`
+
+Policy Decision Point. Thin wrapper around `@cedar-policy/cedar-wasm` that
+adds ARP's `@obligation` annotation semantics.
+
+## Use
+
+```ts
+import { createPdp } from '@kybernesis/arp-pdp';
+import schemaJson from '@kybernesis/arp-spec/cedar-schema.json' with { type: 'json' };
+
+const pdp = createPdp(JSON.stringify(schemaJson));
+
+const decision = pdp.evaluate({
+  cedarPolicies: [
+    'permit (principal == Agent::"did:web:ghost.agent", action == Action::"read", resource in Project::"alpha");',
+  ],
+  obligationPolicies: [
+    `@obligation("rate_limit")
+     @obligation_params({ "max_requests_per_hour": 60 })
+     permit (principal, action, resource in Project::"alpha");`,
+  ],
+  principal: { type: 'Agent', id: 'did:web:ghost.agent' },
+  action: 'read',
+  resource: {
+    type: 'Document',
+    id: 'alpha/q2',
+    parents: [{ type: 'Project', id: 'alpha' }],
+  },
+  context: { /* time, spend, vcs, ... */ },
+});
+// → { decision: 'allow', obligations: [...], policies_fired: [...], reasons: [] }
+```
+
+## Decision semantics
+
+Matches `ARP-policy-examples.md §10` exactly:
+
+1. Deny by default.
+2. Any matching `permit` flips to `allow`.
+3. Any matching `forbid` flips back to `deny` (forbid wins over permit).
+4. On `allow`, evaluate obligation policies. Each obligation policy that
+   fires contributes `{ type, params }` to the obligation list.
+
+`obligationPolicies` are *not* evaluated when the decision is `deny`.
+
+## Obligation annotations
+
+ARP extends Cedar with two annotations:
+
+```cedar
+@obligation("redact_fields")
+@obligation_params({ "fields": ["client.name", "client.email"] })
+permit (principal == Agent::"did:web:ghost.agent", action == Action::"read", resource in Project::"alpha");
+```
+
+`@obligation_params(...)` accepts:
+
+- A JSON-object literal (with bare keys + single-quoted strings tolerated)
+- A JSON string — `@obligation_params("{\"fields\":[...]}")`
+
+Both forms are stripped before handing the policy to Cedar so the upstream
+parser never sees the non-standard syntax.
+
+## Context value conventions
+
+Cedar's runtime type system is `long | boolean | string | set | record` — there
+are **no native floats and no native timestamps**. The ARP PDP adapts the
+`context.*` vocabulary from `docs/ARP-policy-examples.md` accordingly, and
+every upstream consumer (scope-catalog compiler, adapters, owner-app consent
+renderer, reference agents) MUST use the same representations:
+
+| Vocabulary from the doc | On the wire (PDP input + policy body) |
+|---|---|
+| `quoted_price_usd`      | `quoted_price_cents` (integer) |
+| `spend_last_24h_usd`    | `spend_last_24h_cents` (integer) |
+| `spend_last_30d_usd`    | `spend_last_30d_cents` (integer) |
+| `spend_all_time_usd`    | `spend_all_time_cents` (integer) |
+| `time.now`              | `time.now_ms` (epoch milliseconds, integer) |
+| `connection.expires_at` | `connection.expires_at_ms` (epoch milliseconds, integer) |
+| `connection.created_at` | `connection.created_at_ms` (epoch milliseconds, integer) |
+
+Money in cents prevents floating-point drift on cap comparisons; epoch
+milliseconds give us ordered integer comparisons without parsing ISO strings
+inside Cedar. The doc's narrative float/ISO syntax is illustrative, not
+normative — Cedar policies compiled by the scope-catalog compiler already
+follow this convention, and adapters that synthesise ad-hoc policies must
+follow it too.
+
+If Cedar later adds a decimal or timestamp type, we migrate by rewriting the
+scope templates and updating this table; the rest of the stack is unchanged
+because it only ever reads the integer fields.
+
+## Design notes
+
+- Each input policy gets an auto-assigned `@id("p_<n>")` / `@id("o_<n>")` if
+  it doesn't already have one; `policies_fired` returns those IDs.
+- `isAuthorized` is called without `enableRequestValidation` in v0. Phase 5
+  can toggle strict schema enforcement once reference agents' contexts are
+  stable.
+- Cedar WASM must be imported per-call; the library memoises the engine
+  internally, so repeated calls are cheap.

package/dist/index.cjs

@@ -0,0 +1,278 @@
+'use strict';
+
+var cedarWasm = require('@cedar-policy/cedar-wasm');
+
+// src/cedar.ts
+function assertSchemaParses(schemaJson) {
+  const trimmed = schemaJson.trim();
+  if (!trimmed) return;
+  const r = cedarWasm.checkParseSchema(trimmed);
+  if (r.type !== "success") {
+    throw new Error(
+      `Cedar schema failed to parse: ${JSON.stringify(r.errors, null, 2)}`
+    );
+  }
+}
+function toCedarValue(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`non-finite number cannot be encoded for Cedar: ${value}`);
+    }
+    return value;
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(toCedarValue);
+  }
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = toCedarValue(v);
+    }
+    return out;
+  }
+  throw new Error(`unsupported Cedar value type: ${typeof value}`);
+}
+function toContext(ctx) {
+  if (!ctx) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(ctx)) {
+    out[k] = toCedarValue(v);
+  }
+  return out;
+}
+function entityToJson(entity) {
+  return {
+    uid: { type: entity.type, id: entity.id },
+    attrs: entity.attrs ? Object.fromEntries(
+      Object.entries(entity.attrs).map(([k, v]) => [k, toCedarValue(v)])
+    ) : {},
+    parents: (entity.parents ?? []).map((p) => ({ type: p.type, id: p.id }))
+  };
+}
+function buildCedarCall(opts) {
+  const actionType = opts.actionType ?? "Action";
+  const all = [opts.principal, opts.resource, ...opts.entities ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const entities = [];
+  for (const e of all) {
+    const key = `${e.type}::${e.id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entities.push(entityToJson(e));
+  }
+  return {
+    principal: { type: opts.principal.type, id: opts.principal.id },
+    action: { type: actionType, id: opts.action },
+    resource: { type: opts.resource.type, id: opts.resource.id },
+    context: toContext(opts.context),
+    slice: {
+      policies: opts.policies,
+      entities,
+      templates: null,
+      templateInstantiations: null
+    }
+  };
+}
+function cedarIsAuthorized(call) {
+  return cedarWasm.isAuthorized(call);
+}
+
+// src/obligations.ts
+function parseObligationPolicy(text, fallbackId) {
+  const { type, rest: afterType } = extractObligationType(text);
+  const { params, rest: afterParams } = extractObligationParams(afterType);
+  const existingId = extractExistingId(afterParams);
+  const cleaned = afterParams.trim();
+  const id = existingId ?? fallbackId;
+  const withId = existingId ? cleaned : `@id("${id}")
+${cleaned}`;
+  return {
+    id,
+    obligationType: type,
+    params,
+    cleanedText: withId
+  };
+}
+function extractObligationType(text) {
+  const match = /@obligation\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*\)/m.exec(text);
+  if (!match) {
+    throw new Error(
+      'obligation policy missing @obligation("<type>") annotation'
+    );
+  }
+  const rest = text.slice(0, match.index) + text.slice(match.index + match[0].length);
+  return { type: match[1] ?? "", rest };
+}
+function extractObligationParams(text) {
+  const headIdx = text.indexOf("@obligation_params");
+  if (headIdx < 0) return { params: {}, rest: text };
+  const parenIdx = text.indexOf("(", headIdx);
+  if (parenIdx < 0) return { params: {}, rest: text };
+  let depth = 1;
+  let inString = null;
+  let i = parenIdx + 1;
+  while (i < text.length && depth > 0) {
+    const ch = text[i];
+    if (inString) {
+      if (ch === "\\") {
+        i += 2;
+        continue;
+      }
+      if (ch === inString) inString = null;
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      inString = ch;
+      i++;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    if (depth === 0 && ch === ")") break;
+    i++;
+  }
+  if (depth !== 0) {
+    throw new Error("unbalanced @obligation_params annotation");
+  }
+  const innerRaw = text.slice(parenIdx + 1, i).trim();
+  const rest = text.slice(0, headIdx) + text.slice(i + 1);
+  const params = parseParamValue(innerRaw);
+  return { params, rest };
+}
+function parseParamValue(raw) {
+  if (!raw) return {};
+  if (raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'")) {
+    const unquoted = raw.slice(1, -1).replace(/\\(.)/g, "$1");
+    try {
+      const parsed = JSON.parse(unquoted);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+      throw new Error("expected object");
+    } catch (err) {
+      throw new Error(
+        `@obligation_params string payload isn't valid JSON object: ${err.message}`
+      );
+    }
+  }
+  const normalised = coerceToJson(raw);
+  try {
+    const parsed = JSON.parse(normalised);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    throw new Error("expected object");
+  } catch (err) {
+    throw new Error(
+      `@obligation_params payload isn't a valid JSON object (after coercion): ${raw}: ${err.message}`
+    );
+  }
+}
+function coerceToJson(raw) {
+  let out = raw.replace(/'([^'\\]*(?:\\.[^'\\]*)*)'/g, (_m, inner) => {
+    return JSON.stringify(inner);
+  });
+  out = out.replace(
+    /([{,]\s*)([A-Za-z_][A-Za-z0-9_]*)(\s*:)/g,
+    (_m, lead, key, tail) => `${lead}"${key}"${tail}`
+  );
+  return out;
+}
+function extractExistingId(text) {
+  const match = /@id\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*\)/m.exec(text);
+  return match ? match[1] ?? null : null;
+}
+function obligationRecord(parsed) {
+  return { type: parsed.obligationType, params: parsed.params };
+}
+
+// src/pdp.ts
+function createPdp(schemaJson) {
+  assertSchemaParses(schemaJson);
+  return {
+    evaluate(input) {
+      const joined = input.cedarPolicies.map((text) => text.trim()).filter((t) => t.length > 0).join("\n");
+      const decisionCall = buildCedarCall({
+        policies: joined,
+        principal: input.principal,
+        action: input.action,
+        resource: input.resource,
+        context: input.context ?? {},
+        entities: input.entities ?? []
+      });
+      const decisionAnswer = cedarIsAuthorized(decisionCall);
+      if (decisionAnswer.type !== "success") {
+        throw new Error(
+          `Cedar authorization failed: ${JSON.stringify(decisionAnswer.errors)}`
+        );
+      }
+      const rawDecision = decisionAnswer.response.decision;
+      const decision = rawDecision === "Allow" ? "allow" : "deny";
+      const firedDecisionPolicies = toStringArray(decisionAnswer.response.diagnostics.reason);
+      const reasons = decisionAnswer.response.diagnostics.errors.map(
+        (e) => e.error.message
+      );
+      const obligations = [];
+      const obligationFired = [];
+      if (decision === "allow" && input.obligationPolicies?.length) {
+        const parsed = input.obligationPolicies.map(
+          (text, idx) => parseObligationPolicy(text, `o_${idx}`)
+        );
+        const obligationMap = {};
+        for (const p of parsed) obligationMap[p.id] = p.cleanedText;
+        const obligationCall = buildCedarCall({
+          policies: obligationMap,
+          principal: input.principal,
+          action: input.action,
+          resource: input.resource,
+          context: input.context ?? {},
+          entities: input.entities ?? []
+        });
+        const obligationAnswer = cedarIsAuthorized(obligationCall);
+        if (obligationAnswer.type !== "success") {
+          throw new Error(
+            `Cedar obligation evaluation failed: ${JSON.stringify(obligationAnswer.errors)}`
+          );
+        }
+        const fired = new Set(
+          toStringArray(obligationAnswer.response.diagnostics.reason)
+        );
+        for (const p of parsed) {
+          if (fired.has(p.id)) {
+            obligations.push(obligationRecord(p));
+            obligationFired.push(p.id);
+          }
+        }
+      }
+      return {
+        decision,
+        obligations,
+        policies_fired: [...firedDecisionPolicies, ...obligationFired],
+        reasons
+      };
+    }
+  };
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.map((v) => String(v));
+  }
+  if (value && typeof value === "object" && Symbol.iterator in value) {
+    return Array.from(value).map((v) => String(v));
+  }
+  return [];
+}
+
+exports.createPdp = createPdp;
+exports.entityToJson = entityToJson;
+exports.obligationRecord = obligationRecord;
+exports.parseObligationPolicy = parseObligationPolicy;
+exports.toCedarValue = toCedarValue;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cedar.ts","../src/obligations.ts","../src/pdp.ts"],"names":["checkParseSchema","isAuthorized"],"mappings":";;;;;AASO,SAAS,mBAAmB,UAAA,EAA0B;AAC3D,EAAA,MAAM,OAAA,GAAU,WAAW,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,CAAA,GAAIA,2BAAiB,OAAO,CAAA;AAClC,EAAA,IAAI,CAAA,CAAE,SAAS,SAAA,EAAW;AACxB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iCAAiC,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,KACpE;AAAA,EACF;AACF;AAOO,SAAS,aAAa,KAAA,EAAgC;AAC3D,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,WAAW,OAAO,KAAA;AACpE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,KAAK,CAAA,CAAE,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,IAAA,EAAM;AACzB,IAAA,OAAO,MAAM,WAAA,EAAY;AAAA,EAC3B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,KAAA,CAAM,IAAI,YAAY,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAsC,EAAC;AAC7C,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,EAAG;AACrE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,YAAA,CAAa,CAAC,CAAA;AAAA,IACzB;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,OAAO,KAAK,CAAA,CAAE,CAAA;AACjE;AAEO,SAAS,UACd,GAAA,EACgC;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,MAAM,MAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,YAAA,CAAa,CAAC,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,aAAa,MAAA,EAA4B;AACvD,EAAA,OAAO;AAAA,IACL,KAAK,EAAE,IAAA,EAAM,OAAO,IAAA,EAAM,EAAA,EAAI,OAAO,EAAA,EAAG;AAAA,IACxC,KAAA,EAAO,MAAA,CAAO,KAAA,GACV,MAAA,CAAO,WAAA;AAAA,MACL,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,CAAE,IAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA,EAAG,YAAA,CAAa,CAAC,CAAC,CAAC;AAAA,QAEnE,EAAC;AAAA,IACL,OAAA,EAAA,CAAU,MAAA,CAAO,OAAA,IAAW,IAAI,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,EAAA,EAAI,CAAA,CAAE,IAAG,CAAE;AAAA,GACzE;AACF;AAMO,SAAS,eAAe,IAAA,EAQT;AACpB,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,QAAA;AACtC,EAAA,MAAM,GAAA,GAAgB,CAAC,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAU,GAAI,IAAA,CAAK,QAAA,IAAY,EAAG,CAAA;AAC9E,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,WAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,EAAE,EAAE,CAAA,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,QAAA,CAAS,IAAA,CAAK,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,IAAA,CAAK,UAAU,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAA,EAAG;AAAA,IAC9D,QAAQ,EAAE,IAAA,EAAM,UAAA,EAAY,EAAA,EAAI,KAAK,MAAA,EAAO;AAAA,IAC5C,QAAA,EAAU,EAAE,IAAA,EAAM,IAAA,CAAK,SAAS,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAA,EAAG;AAAA,IAC3D,OAAA,EAAS,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AAAA,IAC/B,KAAA,EAAO;AAAA,MACL,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAA;AAAA,MACA,SAAA,EAAW,IAAA;AAAA,MACX,sBAAA,EAAwB;AAAA;AAC1B,GACF;AACF;AAEO,SAAS,kBAAkB,IAAA,EAAyB;AACzD,EAAA,OAAOC,uBAAa,IAAI,CAAA;AAC1B;;;ACtFO,SAAS,qBAAA,CACd,MACA,UAAA,EACwB;AACxB,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU,GAAI,sBAAsB,IAAI,CAAA;AAC5D,EAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,WAAA,EAAY,GAAI,wBAAwB,SAAS,CAAA;AACvE,EAAA,MAAM,UAAA,GAAa,kBAAkB,WAAW,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,YAAY,IAAA,EAAK;AACjC,EAAA,MAAM,KAAK,UAAA,IAAc,UAAA;AACzB,EAAA,MAAM,MAAA,GAAS,UAAA,GAAa,OAAA,GAAU,CAAA,KAAA,EAAQ,EAAE,CAAA;AAAA,EAAO,OAAO,CAAA,CAAA;AAC9D,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,cAAA,EAAgB,IAAA;AAAA,IAChB,MAAA;AAAA,IACA,WAAA,EAAa;AAAA,GACf;AACF;AAEA,SAAS,sBAAsB,IAAA,EAA8C;AAC3E,EAAA,MAAM,KAAA,GAAQ,qDAAA,CAAsD,IAAA,CAAK,IAAI,CAAA;AAC7E,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAM,KAAK,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,CAAC,EAAE,MAAM,CAAA;AAClF,EAAA,OAAO,EAAE,IAAA,EAAM,KAAA,CAAM,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AACtC;AAEA,SAAS,wBACP,IAAA,EACmD;AACnD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,oBAAoB,CAAA;AACjD,EAAA,IAAI,OAAA,GAAU,GAAG,OAAO,EAAE,QAAQ,EAAC,EAAG,MAAM,IAAA,EAAK;AAGjD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC1C,EAAA,IAAI,QAAA,GAAW,GAAG,OAAO,EAAE,QAAQ,EAAC,EAAG,MAAM,IAAA,EAAK;AAGlD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,QAAA,GAA6B,IAAA;AACjC,EAAA,IAAI,IAAI,QAAA,GAAW,CAAA;AACnB,EAAA,OAAO,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,KAAA,GAAQ,CAAA,EAAG;AACnC,IAAA,MAAM,EAAA,GAAK,KAAK,CAAC,CAAA;AACjB,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,OAAO,IAAA,EAAM;AACf,QAAA,CAAA,IAAK,CAAA;AACL,QAAA;AAAA,MACF;AACA,MAAA,IAAI,EAAA,KAAO,UAAU,QAAA,GAAW,IAAA;AAChC,MAAA,CAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,EAAK;AAC5B,MAAA,QAAA,GAAW,EAAA;AACX,MAAA,CAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK,KAAA,EAAA;AAAA,SAAA,IACnC,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK,KAAA,EAAA;AACjD,IAAA,IAAI,KAAA,KAAU,CAAA,IAAK,EAAA,KAAO,GAAA,EAAK;AAC/B,IAAA,CAAA,EAAA;AAAA,EACF;AACA,EAAA,IAAI,UAAU,CAAA,EAAG;AACf,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,WAAW,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA,EAAG,CAAC,EAAE,IAAA,EAAK;AAClD,EAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,gBAAgB,QAAQ,CAAA;AACvC,EAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AACxB;AAEA,SAAS,gBAAgB,GAAA,EAAsC;AAC7D,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,IAAK,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,IAAK,IAAI,QAAA,CAAS,GAAG,CAAA,IAAO,GAAA,CAAI,WAAW,GAAG,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAI;AAC5F,IAAA,MAAM,QAAA,GAAW,IAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACxD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAClC,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,2DAAA,EAA+D,IAAc,OAAO,CAAA;AAAA,OACtF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,aAAa,GAAG,CAAA;AACnC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AACpC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,EACnC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uEAAA,EAA0E,GAAG,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA;AAAA,KAC1G;AAAA,EACF;AACF;AAQA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,IAAI,MAAM,GAAA,CAAI,OAAA,CAAQ,6BAAA,EAA+B,CAAC,IAAI,KAAA,KAAkB;AAC1E,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B,CAAC,CAAA;AAED,EAAA,GAAA,GAAM,GAAA,CAAI,OAAA;AAAA,IACR,0CAAA;AAAA,IACA,CAAC,EAAA,EAAI,IAAA,EAAc,GAAA,EAAa,IAAA,KAAiB,GAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,IAAI,CAAA;AAAA,GACzE;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,kBAAkB,IAAA,EAA6B;AACtD,EAAA,MAAM,KAAA,GAAQ,6CAAA,CAA8C,IAAA,CAAK,IAAI,CAAA;AACrE,EAAA,OAAO,KAAA,GAAS,KAAA,CAAM,CAAC,CAAA,IAAK,IAAA,GAAQ,IAAA;AACtC;AAEO,SAAS,iBAAiB,MAAA,EAA4C;AAC3E,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,cAAA,EAAgB,MAAA,EAAQ,OAAO,MAAA,EAAO;AAC9D;;;AC5IO,SAAS,UAAU,UAAA,EAAyB;AACjD,EAAA,kBAAA,CAAmB,UAAU,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,SAAS,KAAA,EAAoB;AAM3B,MAAA,MAAM,SAAS,KAAA,CAAM,aAAA,CAClB,IAAI,CAAC,IAAA,KAAS,KAAK,IAAA,EAAM,CAAA,CACzB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA,CAC1B,KAAK,IAAI,CAAA;AAEZ,MAAA,MAAM,eAAe,cAAA,CAAe;AAAA,QAClC,QAAA,EAAU,MAAA;AAAA,QACV,WAAW,KAAA,CAAM,SAAA;AAAA,QACjB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,QAC3B,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY;AAAC,OAC9B,CAAA;AACD,MAAA,MAAM,cAAA,GAAiB,kBAAkB,YAAY,CAAA;AACrD,MAAA,IAAI,cAAA,CAAe,SAAS,SAAA,EAAW;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,4BAAA,EAA+B,IAAA,CAAK,SAAA,CAAU,cAAA,CAAe,MAAM,CAAC,CAAA;AAAA,SACtE;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,eAAe,QAAA,CAAS,QAAA;AAC5C,MAAA,MAAM,QAAA,GAA6B,WAAA,KAAgB,OAAA,GAAU,OAAA,GAAU,MAAA;AAEvE,MAAA,MAAM,qBAAA,GAAwB,aAAA,CAAc,cAAA,CAAe,QAAA,CAAS,YAAY,MAAM,CAAA;AACtF,MAAA,MAAM,OAAA,GAAU,cAAA,CAAe,QAAA,CAAS,WAAA,CAAY,MAAA,CAAO,GAAA;AAAA,QACzD,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM;AAAA,OACjB;AAEA,MAAA,MAAM,cAA4B,EAAC;AACnC,MAAA,MAAM,kBAA4B,EAAC;AACnC,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,KAAA,CAAM,kBAAA,EAAoB,MAAA,EAAQ;AAC5D,QAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,GAAA;AAAA,UAAI,CAAC,IAAA,EAAM,GAAA,KACjD,sBAAsB,IAAA,EAAM,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE;AAAA,SACxC;AACA,QAAA,MAAM,gBAAwC,EAAC;AAC/C,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ,aAAA,CAAc,CAAA,CAAE,EAAE,IAAI,CAAA,CAAE,WAAA;AAEhD,QAAA,MAAM,iBAAiB,cAAA,CAAe;AAAA,UACpC,QAAA,EAAU,aAAA;AAAA,UACV,WAAW,KAAA,CAAM,SAAA;AAAA,UACjB,QAAQ,KAAA,CAAM,MAAA;AAAA,UACd,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,UAC3B,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY;AAAC,SAC9B,CAAA;AACD,QAAA,MAAM,gBAAA,GAAmB,kBAAkB,cAAc,CAAA;AACzD,QAAA,IAAI,gBAAA,CAAiB,SAAS,SAAA,EAAW;AACvC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,WAChF;AAAA,QACF;AACA,QAAA,MAAM,QAAQ,IAAI,GAAA;AAAA,UAChB,aAAA,CAAc,gBAAA,CAAiB,QAAA,CAAS,WAAA,CAAY,MAAM;AAAA,SAC5D;AACA,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,UAAA,IAAI,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AACnB,YAAA,WAAA,CAAY,IAAA,CAAK,gBAAA,CAAiB,CAAC,CAAC,CAAA;AACpC,YAAA,eAAA,CAAgB,IAAA,CAAK,EAAE,EAAE,CAAA;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,QAAA;AAAA,QACA,WAAA;AAAA,QACA,cAAA,EAAgB,CAAC,GAAG,qBAAA,EAAuB,GAAG,eAAe,CAAA;AAAA,QAC7D;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,cAAc,KAAA,EAA0B;AAG/C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,SAAS,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,YAAY,KAAA,EAAO;AAClE,IAAA,OAAO,KAAA,CAAM,KAAK,KAA0B,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,EAAC;AACV","file":"index.cjs","sourcesContent":["import {\n  checkParseSchema,\n  isAuthorized,\n  type AuthorizationCall,\n  type CedarValueJson,\n  type EntityJson,\n} from '@cedar-policy/cedar-wasm';\nimport type { Entity } from './types.js';\n\nexport function assertSchemaParses(schemaJson: string): void {\n  const trimmed = schemaJson.trim();\n  if (!trimmed) return;\n  const r = checkParseSchema(trimmed);\n  if (r.type !== 'success') {\n    throw new Error(\n      `Cedar schema failed to parse: ${JSON.stringify(r.errors, null, 2)}`,\n    );\n  }\n}\n\n/**\n * Convert a plain JS value into the Cedar JSON form accepted by\n * `@cedar-policy/cedar-wasm`. Arrays stay arrays, objects stay objects,\n * primitives stay primitives. Dates serialise to their ISO string.\n */\nexport function toCedarValue(value: unknown): CedarValueJson {\n  if (value === null || value === undefined) return null;\n  if (typeof value === 'string' || typeof value === 'boolean') return value;\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(`non-finite number cannot be encoded for Cedar: ${value}`);\n    }\n    return value;\n  }\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  if (Array.isArray(value)) {\n    return value.map(toCedarValue);\n  }\n  if (typeof value === 'object') {\n    const out: Record<string, CedarValueJson> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      out[k] = toCedarValue(v);\n    }\n    return out;\n  }\n  throw new Error(`unsupported Cedar value type: ${typeof value}`);\n}\n\nexport function toContext(\n  ctx: Record<string, unknown> | undefined,\n): Record<string, CedarValueJson> {\n  if (!ctx) return {};\n  const out: Record<string, CedarValueJson> = {};\n  for (const [k, v] of Object.entries(ctx)) {\n    out[k] = toCedarValue(v);\n  }\n  return out;\n}\n\nexport function entityToJson(entity: Entity): EntityJson {\n  return {\n    uid: { type: entity.type, id: entity.id },\n    attrs: entity.attrs\n      ? Object.fromEntries(\n          Object.entries(entity.attrs).map(([k, v]) => [k, toCedarValue(v)]),\n        )\n      : {},\n    parents: (entity.parents ?? []).map((p) => ({ type: p.type, id: p.id })),\n  };\n}\n\nexport interface CedarCallParts {\n  call: AuthorizationCall;\n}\n\nexport function buildCedarCall(opts: {\n  policies: Record<string, string> | string;\n  principal: Entity;\n  action: string;\n  resource: Entity;\n  context?: Record<string, unknown>;\n  entities?: Entity[];\n  actionType?: string;\n}): AuthorizationCall {\n  const actionType = opts.actionType ?? 'Action';\n  const all: Entity[] = [opts.principal, opts.resource, ...(opts.entities ?? [])];\n  const seen = new Set<string>();\n  const entities: EntityJson[] = [];\n  for (const e of all) {\n    const key = `${e.type}::${e.id}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    entities.push(entityToJson(e));\n  }\n  return {\n    principal: { type: opts.principal.type, id: opts.principal.id },\n    action: { type: actionType, id: opts.action },\n    resource: { type: opts.resource.type, id: opts.resource.id },\n    context: toContext(opts.context),\n    slice: {\n      policies: opts.policies,\n      entities,\n      templates: null,\n      templateInstantiations: null,\n    },\n  };\n}\n\nexport function cedarIsAuthorized(call: AuthorizationCall) {\n  return isAuthorized(call);\n}\n","import type { Obligation } from '@kybernesis/arp-spec';\n\nexport interface ParsedObligationPolicy {\n  /** Auto-generated stable id assigned to the cleaned-up policy text. */\n  id: string;\n  /** Obligation `type` from `@obligation(\"...\")`. */\n  obligationType: string;\n  /** Parsed params from `@obligation_params(...)` (object, JSON string, or empty). */\n  params: Record<string, unknown>;\n  /** Policy text with ARP-specific annotations removed, safe for Cedar. */\n  cleanedText: string;\n}\n\n/**\n * Parse ARP's non-standard obligation annotations out of a Cedar policy.\n *\n * Accepted forms:\n *\n *   @obligation(\"redact_fields\")\n *   @obligation_params({ \"fields\": [\"client.name\"] })      // object literal\n *   @obligation_params(\"{\\\"fields\\\":[...]}\")               // JSON string\n *\n * The returned `cleanedText` has both annotations removed and is safe to pass\n * straight to Cedar. Auto-prefixes an `@id(...)` so callers can track the\n * policy's `policies_fired` id.\n */\nexport function parseObligationPolicy(\n  text: string,\n  fallbackId: string,\n): ParsedObligationPolicy {\n  const { type, rest: afterType } = extractObligationType(text);\n  const { params, rest: afterParams } = extractObligationParams(afterType);\n  const existingId = extractExistingId(afterParams);\n  const cleaned = afterParams.trim();\n  const id = existingId ?? fallbackId;\n  const withId = existingId ? cleaned : `@id(\"${id}\")\\n${cleaned}`;\n  return {\n    id,\n    obligationType: type,\n    params,\n    cleanedText: withId,\n  };\n}\n\nfunction extractObligationType(text: string): { type: string; rest: string } {\n  const match = /@obligation\\s*\\(\\s*\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"\\s*\\)/m.exec(text);\n  if (!match) {\n    throw new Error(\n      'obligation policy missing @obligation(\"<type>\") annotation',\n    );\n  }\n  const rest = text.slice(0, match.index) + text.slice(match.index + match[0].length);\n  return { type: match[1] ?? '', rest };\n}\n\nfunction extractObligationParams(\n  text: string,\n): { params: Record<string, unknown>; rest: string } {\n  const headIdx = text.indexOf('@obligation_params');\n  if (headIdx < 0) return { params: {}, rest: text };\n\n  // Find the opening paren after the keyword.\n  const parenIdx = text.indexOf('(', headIdx);\n  if (parenIdx < 0) return { params: {}, rest: text };\n\n  // Walk forward balancing braces/quotes to find the matching close paren.\n  let depth = 1;\n  let inString: '\"' | \"'\" | null = null;\n  let i = parenIdx + 1;\n  while (i < text.length && depth > 0) {\n    const ch = text[i];\n    if (inString) {\n      if (ch === '\\\\') {\n        i += 2;\n        continue;\n      }\n      if (ch === inString) inString = null;\n      i++;\n      continue;\n    }\n    if (ch === '\"' || ch === \"'\") {\n      inString = ch;\n      i++;\n      continue;\n    }\n    if (ch === '(' || ch === '{' || ch === '[') depth++;\n    else if (ch === ')' || ch === '}' || ch === ']') depth--;\n    if (depth === 0 && ch === ')') break;\n    i++;\n  }\n  if (depth !== 0) {\n    throw new Error('unbalanced @obligation_params annotation');\n  }\n\n  const innerRaw = text.slice(parenIdx + 1, i).trim();\n  const rest = text.slice(0, headIdx) + text.slice(i + 1);\n  const params = parseParamValue(innerRaw);\n  return { params, rest };\n}\n\nfunction parseParamValue(raw: string): Record<string, unknown> {\n  if (!raw) return {};\n  // If the whole value is a quoted string, it's a JSON-stringified payload.\n  if ((raw.startsWith('\"') && raw.endsWith('\"')) || (raw.startsWith(\"'\") && raw.endsWith(\"'\"))) {\n    const unquoted = raw.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    try {\n      const parsed = JSON.parse(unquoted);\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>;\n      }\n      throw new Error('expected object');\n    } catch (err) {\n      throw new Error(\n        `@obligation_params string payload isn't valid JSON object: ${(err as Error).message}`,\n      );\n    }\n  }\n  // Otherwise treat as a direct JSON5-ish object literal — standardise quotes.\n  const normalised = coerceToJson(raw);\n  try {\n    const parsed = JSON.parse(normalised);\n    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>;\n    }\n    throw new Error('expected object');\n  } catch (err) {\n    throw new Error(\n      `@obligation_params payload isn't a valid JSON object (after coercion): ${raw}: ${(err as Error).message}`,\n    );\n  }\n}\n\n/**\n * Light JSON coercion for the Cedar annotation param form. Converts\n * single-quoted strings to double-quoted, and unquoted object keys to quoted.\n * Good enough for the param shapes in ARP-policy-examples.md §5 — not a full\n * JSON5 parser.\n */\nfunction coerceToJson(raw: string): string {\n  let out = raw.replace(/'([^'\\\\]*(?:\\\\.[^'\\\\]*)*)'/g, (_m, inner: string) => {\n    return JSON.stringify(inner);\n  });\n  // Quote bare keys: {{ foo: ... }} → {{ \"foo\": ... }}\n  out = out.replace(\n    /([{,]\\s*)([A-Za-z_][A-Za-z0-9_]*)(\\s*:)/g,\n    (_m, lead: string, key: string, tail: string) => `${lead}\"${key}\"${tail}`,\n  );\n  return out;\n}\n\nfunction extractExistingId(text: string): string | null {\n  const match = /@id\\s*\\(\\s*\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"\\s*\\)/m.exec(text);\n  return match ? (match[1] ?? null) : null;\n}\n\nexport function obligationRecord(parsed: ParsedObligationPolicy): Obligation {\n  return { type: parsed.obligationType, params: parsed.params };\n}\n","import type { Obligation } from '@kybernesis/arp-spec';\nimport {\n  assertSchemaParses,\n  buildCedarCall,\n  cedarIsAuthorized,\n} from './cedar.js';\nimport { parseObligationPolicy, obligationRecord } from './obligations.js';\nimport type { Pdp, PdpDecision } from './types.js';\n\n/**\n * Build a PDP bound to a Cedar schema. The schema is parsed eagerly so\n * malformed schemas fail at construction rather than on first evaluation.\n *\n * v0 does NOT enforce the schema at request time — `isAuthorized` is called\n * without `enableRequestValidation`, mirroring the posture in Phase 2. Phase\n * 5 can turn validation on once all reference agents' contexts conform.\n */\nexport function createPdp(schemaJson: string): Pdp {\n  assertSchemaParses(schemaJson);\n\n  return {\n    evaluate(input): PdpDecision {\n      // Concatenate all permit/forbid entries into a single policy-set string.\n      // Each entry may contain multiple Cedar policies (e.g. a permit + a\n      // sibling forbid). Cedar auto-generates IDs (`policy0`, `policy1`, ...)\n      // which surface in diagnostics.reason; we return those as\n      // `policies_fired`.\n      const joined = input.cedarPolicies\n        .map((text) => text.trim())\n        .filter((t) => t.length > 0)\n        .join('\\n');\n\n      const decisionCall = buildCedarCall({\n        policies: joined,\n        principal: input.principal,\n        action: input.action,\n        resource: input.resource,\n        context: input.context ?? {},\n        entities: input.entities ?? [],\n      });\n      const decisionAnswer = cedarIsAuthorized(decisionCall);\n      if (decisionAnswer.type !== 'success') {\n        throw new Error(\n          `Cedar authorization failed: ${JSON.stringify(decisionAnswer.errors)}`,\n        );\n      }\n      const rawDecision = decisionAnswer.response.decision;\n      const decision: 'allow' | 'deny' = rawDecision === 'Allow' ? 'allow' : 'deny';\n\n      const firedDecisionPolicies = toStringArray(decisionAnswer.response.diagnostics.reason);\n      const reasons = decisionAnswer.response.diagnostics.errors.map(\n        (e) => e.error.message,\n      );\n\n      const obligations: Obligation[] = [];\n      const obligationFired: string[] = [];\n      if (decision === 'allow' && input.obligationPolicies?.length) {\n        const parsed = input.obligationPolicies.map((text, idx) =>\n          parseObligationPolicy(text, `o_${idx}`),\n        );\n        const obligationMap: Record<string, string> = {};\n        for (const p of parsed) obligationMap[p.id] = p.cleanedText;\n\n        const obligationCall = buildCedarCall({\n          policies: obligationMap,\n          principal: input.principal,\n          action: input.action,\n          resource: input.resource,\n          context: input.context ?? {},\n          entities: input.entities ?? [],\n        });\n        const obligationAnswer = cedarIsAuthorized(obligationCall);\n        if (obligationAnswer.type !== 'success') {\n          throw new Error(\n            `Cedar obligation evaluation failed: ${JSON.stringify(obligationAnswer.errors)}`,\n          );\n        }\n        const fired = new Set(\n          toStringArray(obligationAnswer.response.diagnostics.reason),\n        );\n        for (const p of parsed) {\n          if (fired.has(p.id)) {\n            obligations.push(obligationRecord(p));\n            obligationFired.push(p.id);\n          }\n        }\n      }\n\n      return {\n        decision,\n        obligations,\n        policies_fired: [...firedDecisionPolicies, ...obligationFired],\n        reasons,\n      };\n    },\n  };\n}\n\nfunction toStringArray(value: unknown): string[] {\n  // cedar-wasm types `reason` as `Set<String>` at the TS layer but returns a\n  // plain array at runtime. Defensive normalise — treat either as iterable.\n  if (Array.isArray(value)) {\n    return value.map((v) => String(v));\n  }\n  if (value && typeof value === 'object' && Symbol.iterator in value) {\n    return Array.from(value as Iterable<unknown>).map((v) => String(v));\n  }\n  return [];\n}\n\n"]}

package/dist/index.d.cts

@@ -0,0 +1,77 @@
+import { Obligation } from '@kybernesis/arp-spec';
+import { EntityJson, CedarValueJson } from '@cedar-policy/cedar-wasm';
+
+type PdpDecision = {
+    decision: 'allow' | 'deny';
+    obligations: Obligation[];
+    policies_fired: string[];
+    reasons: string[];
+};
+interface Entity {
+    type: string;
+    id: string;
+    attrs?: Record<string, unknown>;
+    parents?: Array<{
+        type: string;
+        id: string;
+    }>;
+}
+interface EvaluateInput {
+    cedarPolicies: string[];
+    obligationPolicies?: string[];
+    principal: Entity;
+    action: string;
+    resource: Entity;
+    context?: Record<string, unknown>;
+    /** Extra entity records to hand to Cedar (parents, attribute lookups). */
+    entities?: Entity[];
+}
+interface Pdp {
+    evaluate(input: EvaluateInput): PdpDecision;
+}
+
+/**
+ * Build a PDP bound to a Cedar schema. The schema is parsed eagerly so
+ * malformed schemas fail at construction rather than on first evaluation.
+ *
+ * v0 does NOT enforce the schema at request time — `isAuthorized` is called
+ * without `enableRequestValidation`, mirroring the posture in Phase 2. Phase
+ * 5 can turn validation on once all reference agents' contexts conform.
+ */
+declare function createPdp(schemaJson: string): Pdp;
+
+interface ParsedObligationPolicy {
+    /** Auto-generated stable id assigned to the cleaned-up policy text. */
+    id: string;
+    /** Obligation `type` from `@obligation("...")`. */
+    obligationType: string;
+    /** Parsed params from `@obligation_params(...)` (object, JSON string, or empty). */
+    params: Record<string, unknown>;
+    /** Policy text with ARP-specific annotations removed, safe for Cedar. */
+    cleanedText: string;
+}
+/**
+ * Parse ARP's non-standard obligation annotations out of a Cedar policy.
+ *
+ * Accepted forms:
+ *
+ *   @obligation("redact_fields")
+ *   @obligation_params({ "fields": ["client.name"] })      // object literal
+ *   @obligation_params("{\"fields\":[...]}")               // JSON string
+ *
+ * The returned `cleanedText` has both annotations removed and is safe to pass
+ * straight to Cedar. Auto-prefixes an `@id(...)` so callers can track the
+ * policy's `policies_fired` id.
+ */
+declare function parseObligationPolicy(text: string, fallbackId: string): ParsedObligationPolicy;
+declare function obligationRecord(parsed: ParsedObligationPolicy): Obligation;
+
+/**
+ * Convert a plain JS value into the Cedar JSON form accepted by
+ * `@cedar-policy/cedar-wasm`. Arrays stay arrays, objects stay objects,
+ * primitives stay primitives. Dates serialise to their ISO string.
+ */
+declare function toCedarValue(value: unknown): CedarValueJson;
+declare function entityToJson(entity: Entity): EntityJson;
+
+export { type Entity, type EvaluateInput, type ParsedObligationPolicy, type Pdp, type PdpDecision, createPdp, entityToJson, obligationRecord, parseObligationPolicy, toCedarValue };

package/dist/index.d.ts

@@ -0,0 +1,77 @@
+import { Obligation } from '@kybernesis/arp-spec';
+import { EntityJson, CedarValueJson } from '@cedar-policy/cedar-wasm';
+
+type PdpDecision = {
+    decision: 'allow' | 'deny';
+    obligations: Obligation[];
+    policies_fired: string[];
+    reasons: string[];
+};
+interface Entity {
+    type: string;
+    id: string;
+    attrs?: Record<string, unknown>;
+    parents?: Array<{
+        type: string;
+        id: string;
+    }>;
+}
+interface EvaluateInput {
+    cedarPolicies: string[];
+    obligationPolicies?: string[];
+    principal: Entity;
+    action: string;
+    resource: Entity;
+    context?: Record<string, unknown>;
+    /** Extra entity records to hand to Cedar (parents, attribute lookups). */
+    entities?: Entity[];
+}
+interface Pdp {
+    evaluate(input: EvaluateInput): PdpDecision;
+}
+
+/**
+ * Build a PDP bound to a Cedar schema. The schema is parsed eagerly so
+ * malformed schemas fail at construction rather than on first evaluation.
+ *
+ * v0 does NOT enforce the schema at request time — `isAuthorized` is called
+ * without `enableRequestValidation`, mirroring the posture in Phase 2. Phase
+ * 5 can turn validation on once all reference agents' contexts conform.
+ */
+declare function createPdp(schemaJson: string): Pdp;
+
+interface ParsedObligationPolicy {
+    /** Auto-generated stable id assigned to the cleaned-up policy text. */
+    id: string;
+    /** Obligation `type` from `@obligation("...")`. */
+    obligationType: string;
+    /** Parsed params from `@obligation_params(...)` (object, JSON string, or empty). */
+    params: Record<string, unknown>;
+    /** Policy text with ARP-specific annotations removed, safe for Cedar. */
+    cleanedText: string;
+}
+/**
+ * Parse ARP's non-standard obligation annotations out of a Cedar policy.
+ *
+ * Accepted forms:
+ *
+ *   @obligation("redact_fields")
+ *   @obligation_params({ "fields": ["client.name"] })      // object literal
+ *   @obligation_params("{\"fields\":[...]}")               // JSON string
+ *
+ * The returned `cleanedText` has both annotations removed and is safe to pass
+ * straight to Cedar. Auto-prefixes an `@id(...)` so callers can track the
+ * policy's `policies_fired` id.
+ */
+declare function parseObligationPolicy(text: string, fallbackId: string): ParsedObligationPolicy;
+declare function obligationRecord(parsed: ParsedObligationPolicy): Obligation;
+
+/**
+ * Convert a plain JS value into the Cedar JSON form accepted by
+ * `@cedar-policy/cedar-wasm`. Arrays stay arrays, objects stay objects,
+ * primitives stay primitives. Dates serialise to their ISO string.
+ */
+declare function toCedarValue(value: unknown): CedarValueJson;
+declare function entityToJson(entity: Entity): EntityJson;
+
+export { type Entity, type EvaluateInput, type ParsedObligationPolicy, type Pdp, type PdpDecision, createPdp, entityToJson, obligationRecord, parseObligationPolicy, toCedarValue };

package/dist/index.js

@@ -0,0 +1,272 @@
+import { checkParseSchema, isAuthorized } from '@cedar-policy/cedar-wasm';
+
+// src/cedar.ts
+function assertSchemaParses(schemaJson) {
+  const trimmed = schemaJson.trim();
+  if (!trimmed) return;
+  const r = checkParseSchema(trimmed);
+  if (r.type !== "success") {
+    throw new Error(
+      `Cedar schema failed to parse: ${JSON.stringify(r.errors, null, 2)}`
+    );
+  }
+}
+function toCedarValue(value) {
+  if (value === null || value === void 0) return null;
+  if (typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`non-finite number cannot be encoded for Cedar: ${value}`);
+    }
+    return value;
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map(toCedarValue);
+  }
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = toCedarValue(v);
+    }
+    return out;
+  }
+  throw new Error(`unsupported Cedar value type: ${typeof value}`);
+}
+function toContext(ctx) {
+  if (!ctx) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(ctx)) {
+    out[k] = toCedarValue(v);
+  }
+  return out;
+}
+function entityToJson(entity) {
+  return {
+    uid: { type: entity.type, id: entity.id },
+    attrs: entity.attrs ? Object.fromEntries(
+      Object.entries(entity.attrs).map(([k, v]) => [k, toCedarValue(v)])
+    ) : {},
+    parents: (entity.parents ?? []).map((p) => ({ type: p.type, id: p.id }))
+  };
+}
+function buildCedarCall(opts) {
+  const actionType = opts.actionType ?? "Action";
+  const all = [opts.principal, opts.resource, ...opts.entities ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const entities = [];
+  for (const e of all) {
+    const key = `${e.type}::${e.id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entities.push(entityToJson(e));
+  }
+  return {
+    principal: { type: opts.principal.type, id: opts.principal.id },
+    action: { type: actionType, id: opts.action },
+    resource: { type: opts.resource.type, id: opts.resource.id },
+    context: toContext(opts.context),
+    slice: {
+      policies: opts.policies,
+      entities,
+      templates: null,
+      templateInstantiations: null
+    }
+  };
+}
+function cedarIsAuthorized(call) {
+  return isAuthorized(call);
+}
+
+// src/obligations.ts
+function parseObligationPolicy(text, fallbackId) {
+  const { type, rest: afterType } = extractObligationType(text);
+  const { params, rest: afterParams } = extractObligationParams(afterType);
+  const existingId = extractExistingId(afterParams);
+  const cleaned = afterParams.trim();
+  const id = existingId ?? fallbackId;
+  const withId = existingId ? cleaned : `@id("${id}")
+${cleaned}`;
+  return {
+    id,
+    obligationType: type,
+    params,
+    cleanedText: withId
+  };
+}
+function extractObligationType(text) {
+  const match = /@obligation\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*\)/m.exec(text);
+  if (!match) {
+    throw new Error(
+      'obligation policy missing @obligation("<type>") annotation'
+    );
+  }
+  const rest = text.slice(0, match.index) + text.slice(match.index + match[0].length);
+  return { type: match[1] ?? "", rest };
+}
+function extractObligationParams(text) {
+  const headIdx = text.indexOf("@obligation_params");
+  if (headIdx < 0) return { params: {}, rest: text };
+  const parenIdx = text.indexOf("(", headIdx);
+  if (parenIdx < 0) return { params: {}, rest: text };
+  let depth = 1;
+  let inString = null;
+  let i = parenIdx + 1;
+  while (i < text.length && depth > 0) {
+    const ch = text[i];
+    if (inString) {
+      if (ch === "\\") {
+        i += 2;
+        continue;
+      }
+      if (ch === inString) inString = null;
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      inString = ch;
+      i++;
+      continue;
+    }
+    if (ch === "(" || ch === "{" || ch === "[") depth++;
+    else if (ch === ")" || ch === "}" || ch === "]") depth--;
+    if (depth === 0 && ch === ")") break;
+    i++;
+  }
+  if (depth !== 0) {
+    throw new Error("unbalanced @obligation_params annotation");
+  }
+  const innerRaw = text.slice(parenIdx + 1, i).trim();
+  const rest = text.slice(0, headIdx) + text.slice(i + 1);
+  const params = parseParamValue(innerRaw);
+  return { params, rest };
+}
+function parseParamValue(raw) {
+  if (!raw) return {};
+  if (raw.startsWith('"') && raw.endsWith('"') || raw.startsWith("'") && raw.endsWith("'")) {
+    const unquoted = raw.slice(1, -1).replace(/\\(.)/g, "$1");
+    try {
+      const parsed = JSON.parse(unquoted);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+      throw new Error("expected object");
+    } catch (err) {
+      throw new Error(
+        `@obligation_params string payload isn't valid JSON object: ${err.message}`
+      );
+    }
+  }
+  const normalised = coerceToJson(raw);
+  try {
+    const parsed = JSON.parse(normalised);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    throw new Error("expected object");
+  } catch (err) {
+    throw new Error(
+      `@obligation_params payload isn't a valid JSON object (after coercion): ${raw}: ${err.message}`
+    );
+  }
+}
+function coerceToJson(raw) {
+  let out = raw.replace(/'([^'\\]*(?:\\.[^'\\]*)*)'/g, (_m, inner) => {
+    return JSON.stringify(inner);
+  });
+  out = out.replace(
+    /([{,]\s*)([A-Za-z_][A-Za-z0-9_]*)(\s*:)/g,
+    (_m, lead, key, tail) => `${lead}"${key}"${tail}`
+  );
+  return out;
+}
+function extractExistingId(text) {
+  const match = /@id\s*\(\s*"([^"\\]*(?:\\.[^"\\]*)*)"\s*\)/m.exec(text);
+  return match ? match[1] ?? null : null;
+}
+function obligationRecord(parsed) {
+  return { type: parsed.obligationType, params: parsed.params };
+}
+
+// src/pdp.ts
+function createPdp(schemaJson) {
+  assertSchemaParses(schemaJson);
+  return {
+    evaluate(input) {
+      const joined = input.cedarPolicies.map((text) => text.trim()).filter((t) => t.length > 0).join("\n");
+      const decisionCall = buildCedarCall({
+        policies: joined,
+        principal: input.principal,
+        action: input.action,
+        resource: input.resource,
+        context: input.context ?? {},
+        entities: input.entities ?? []
+      });
+      const decisionAnswer = cedarIsAuthorized(decisionCall);
+      if (decisionAnswer.type !== "success") {
+        throw new Error(
+          `Cedar authorization failed: ${JSON.stringify(decisionAnswer.errors)}`
+        );
+      }
+      const rawDecision = decisionAnswer.response.decision;
+      const decision = rawDecision === "Allow" ? "allow" : "deny";
+      const firedDecisionPolicies = toStringArray(decisionAnswer.response.diagnostics.reason);
+      const reasons = decisionAnswer.response.diagnostics.errors.map(
+        (e) => e.error.message
+      );
+      const obligations = [];
+      const obligationFired = [];
+      if (decision === "allow" && input.obligationPolicies?.length) {
+        const parsed = input.obligationPolicies.map(
+          (text, idx) => parseObligationPolicy(text, `o_${idx}`)
+        );
+        const obligationMap = {};
+        for (const p of parsed) obligationMap[p.id] = p.cleanedText;
+        const obligationCall = buildCedarCall({
+          policies: obligationMap,
+          principal: input.principal,
+          action: input.action,
+          resource: input.resource,
+          context: input.context ?? {},
+          entities: input.entities ?? []
+        });
+        const obligationAnswer = cedarIsAuthorized(obligationCall);
+        if (obligationAnswer.type !== "success") {
+          throw new Error(
+            `Cedar obligation evaluation failed: ${JSON.stringify(obligationAnswer.errors)}`
+          );
+        }
+        const fired = new Set(
+          toStringArray(obligationAnswer.response.diagnostics.reason)
+        );
+        for (const p of parsed) {
+          if (fired.has(p.id)) {
+            obligations.push(obligationRecord(p));
+            obligationFired.push(p.id);
+          }
+        }
+      }
+      return {
+        decision,
+        obligations,
+        policies_fired: [...firedDecisionPolicies, ...obligationFired],
+        reasons
+      };
+    }
+  };
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) {
+    return value.map((v) => String(v));
+  }
+  if (value && typeof value === "object" && Symbol.iterator in value) {
+    return Array.from(value).map((v) => String(v));
+  }
+  return [];
+}
+
+export { createPdp, entityToJson, obligationRecord, parseObligationPolicy, toCedarValue };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cedar.ts","../src/obligations.ts","../src/pdp.ts"],"names":[],"mappings":";;;AASO,SAAS,mBAAmB,UAAA,EAA0B;AAC3D,EAAA,MAAM,OAAA,GAAU,WAAW,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,MAAM,CAAA,GAAI,iBAAiB,OAAO,CAAA;AAClC,EAAA,IAAI,CAAA,CAAE,SAAS,SAAA,EAAW;AACxB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iCAAiC,IAAA,CAAK,SAAA,CAAU,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,KACpE;AAAA,EACF;AACF;AAOO,SAAS,aAAa,KAAA,EAAgC;AAC3D,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,KAAA,KAAU,WAAW,OAAO,KAAA;AACpE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,KAAK,CAAA,CAAE,CAAA;AAAA,IAC3E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,iBAAiB,IAAA,EAAM;AACzB,IAAA,OAAO,MAAM,WAAA,EAAY;AAAA,EAC3B;AACA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,KAAA,CAAM,IAAI,YAAY,CAAA;AAAA,EAC/B;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,MAAsC,EAAC;AAC7C,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,EAAG;AACrE,MAAA,GAAA,CAAI,CAAC,CAAA,GAAI,YAAA,CAAa,CAAC,CAAA;AAAA,IACzB;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8BAAA,EAAiC,OAAO,KAAK,CAAA,CAAE,CAAA;AACjE;AAEO,SAAS,UACd,GAAA,EACgC;AAChC,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAClB,EAAA,MAAM,MAAsC,EAAC;AAC7C,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,YAAA,CAAa,CAAC,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,aAAa,MAAA,EAA4B;AACvD,EAAA,OAAO;AAAA,IACL,KAAK,EAAE,IAAA,EAAM,OAAO,IAAA,EAAM,EAAA,EAAI,OAAO,EAAA,EAAG;AAAA,IACxC,KAAA,EAAO,MAAA,CAAO,KAAA,GACV,MAAA,CAAO,WAAA;AAAA,MACL,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,CAAE,IAAI,CAAC,CAAC,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA,EAAG,YAAA,CAAa,CAAC,CAAC,CAAC;AAAA,QAEnE,EAAC;AAAA,IACL,OAAA,EAAA,CAAU,MAAA,CAAO,OAAA,IAAW,IAAI,GAAA,CAAI,CAAC,CAAA,MAAO,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,EAAA,EAAI,CAAA,CAAE,IAAG,CAAE;AAAA,GACzE;AACF;AAMO,SAAS,eAAe,IAAA,EAQT;AACpB,EAAA,MAAM,UAAA,GAAa,KAAK,UAAA,IAAc,QAAA;AACtC,EAAA,MAAM,GAAA,GAAgB,CAAC,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAU,GAAI,IAAA,CAAK,QAAA,IAAY,EAAG,CAAA;AAC9E,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,WAAyB,EAAC;AAChC,EAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,IAAA,MAAM,MAAM,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,EAAE,EAAE,CAAA,CAAA;AAC9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,QAAA,CAAS,IAAA,CAAK,YAAA,CAAa,CAAC,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,EAAE,IAAA,EAAM,IAAA,CAAK,UAAU,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAA,EAAG;AAAA,IAC9D,QAAQ,EAAE,IAAA,EAAM,UAAA,EAAY,EAAA,EAAI,KAAK,MAAA,EAAO;AAAA,IAC5C,QAAA,EAAU,EAAE,IAAA,EAAM,IAAA,CAAK,SAAS,IAAA,EAAM,EAAA,EAAI,IAAA,CAAK,QAAA,CAAS,EAAA,EAAG;AAAA,IAC3D,OAAA,EAAS,SAAA,CAAU,IAAA,CAAK,OAAO,CAAA;AAAA,IAC/B,KAAA,EAAO;AAAA,MACL,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,QAAA;AAAA,MACA,SAAA,EAAW,IAAA;AAAA,MACX,sBAAA,EAAwB;AAAA;AAC1B,GACF;AACF;AAEO,SAAS,kBAAkB,IAAA,EAAyB;AACzD,EAAA,OAAO,aAAa,IAAI,CAAA;AAC1B;;;ACtFO,SAAS,qBAAA,CACd,MACA,UAAA,EACwB;AACxB,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAM,SAAA,EAAU,GAAI,sBAAsB,IAAI,CAAA;AAC5D,EAAA,MAAM,EAAE,MAAA,EAAQ,IAAA,EAAM,WAAA,EAAY,GAAI,wBAAwB,SAAS,CAAA;AACvE,EAAA,MAAM,UAAA,GAAa,kBAAkB,WAAW,CAAA;AAChD,EAAA,MAAM,OAAA,GAAU,YAAY,IAAA,EAAK;AACjC,EAAA,MAAM,KAAK,UAAA,IAAc,UAAA;AACzB,EAAA,MAAM,MAAA,GAAS,UAAA,GAAa,OAAA,GAAU,CAAA,KAAA,EAAQ,EAAE,CAAA;AAAA,EAAO,OAAO,CAAA,CAAA;AAC9D,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,cAAA,EAAgB,IAAA;AAAA,IAChB,MAAA;AAAA,IACA,WAAA,EAAa;AAAA,GACf;AACF;AAEA,SAAS,sBAAsB,IAAA,EAA8C;AAC3E,EAAA,MAAM,KAAA,GAAQ,qDAAA,CAAsD,IAAA,CAAK,IAAI,CAAA;AAC7E,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,MAAM,KAAK,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,CAAC,EAAE,MAAM,CAAA;AAClF,EAAA,OAAO,EAAE,IAAA,EAAM,KAAA,CAAM,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AACtC;AAEA,SAAS,wBACP,IAAA,EACmD;AACnD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,oBAAoB,CAAA;AACjD,EAAA,IAAI,OAAA,GAAU,GAAG,OAAO,EAAE,QAAQ,EAAC,EAAG,MAAM,IAAA,EAAK;AAGjD,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,OAAO,CAAA;AAC1C,EAAA,IAAI,QAAA,GAAW,GAAG,OAAO,EAAE,QAAQ,EAAC,EAAG,MAAM,IAAA,EAAK;AAGlD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,QAAA,GAA6B,IAAA;AACjC,EAAA,IAAI,IAAI,QAAA,GAAW,CAAA;AACnB,EAAA,OAAO,CAAA,GAAI,IAAA,CAAK,MAAA,IAAU,KAAA,GAAQ,CAAA,EAAG;AACnC,IAAA,MAAM,EAAA,GAAK,KAAK,CAAC,CAAA;AACjB,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,IAAI,OAAO,IAAA,EAAM;AACf,QAAA,CAAA,IAAK,CAAA;AACL,QAAA;AAAA,MACF;AACA,MAAA,IAAI,EAAA,KAAO,UAAU,QAAA,GAAW,IAAA;AAChC,MAAA,CAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,EAAK;AAC5B,MAAA,QAAA,GAAW,EAAA;AACX,MAAA,CAAA,EAAA;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK,KAAA,EAAA;AAAA,SAAA,IACnC,EAAA,KAAO,GAAA,IAAO,EAAA,KAAO,GAAA,IAAO,OAAO,GAAA,EAAK,KAAA,EAAA;AACjD,IAAA,IAAI,KAAA,KAAU,CAAA,IAAK,EAAA,KAAO,GAAA,EAAK;AAC/B,IAAA,CAAA,EAAA;AAAA,EACF;AACA,EAAA,IAAI,UAAU,CAAA,EAAG;AACf,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AAEA,EAAA,MAAM,WAAW,IAAA,CAAK,KAAA,CAAM,WAAW,CAAA,EAAG,CAAC,EAAE,IAAA,EAAK;AAClD,EAAA,MAAM,IAAA,GAAO,KAAK,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA;AACtD,EAAA,MAAM,MAAA,GAAS,gBAAgB,QAAQ,CAAA;AACvC,EAAA,OAAO,EAAE,QAAQ,IAAA,EAAK;AACxB;AAEA,SAAS,gBAAgB,GAAA,EAAsC;AAC7D,EAAA,IAAI,CAAC,GAAA,EAAK,OAAO,EAAC;AAElB,EAAA,IAAK,GAAA,CAAI,UAAA,CAAW,GAAG,CAAA,IAAK,IAAI,QAAA,CAAS,GAAG,CAAA,IAAO,GAAA,CAAI,WAAW,GAAG,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAI;AAC5F,IAAA,MAAM,QAAA,GAAW,IAAI,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACxD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AAClC,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,2DAAA,EAA+D,IAAc,OAAO,CAAA;AAAA,OACtF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,aAAa,GAAG,CAAA;AACnC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,UAAU,CAAA;AACpC,IAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAAA,EACnC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uEAAA,EAA0E,GAAG,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO,CAAA;AAAA,KAC1G;AAAA,EACF;AACF;AAQA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,IAAI,MAAM,GAAA,CAAI,OAAA,CAAQ,6BAAA,EAA+B,CAAC,IAAI,KAAA,KAAkB;AAC1E,IAAA,OAAO,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EAC7B,CAAC,CAAA;AAED,EAAA,GAAA,GAAM,GAAA,CAAI,OAAA;AAAA,IACR,0CAAA;AAAA,IACA,CAAC,EAAA,EAAI,IAAA,EAAc,GAAA,EAAa,IAAA,KAAiB,GAAG,IAAI,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,IAAI,CAAA;AAAA,GACzE;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,kBAAkB,IAAA,EAA6B;AACtD,EAAA,MAAM,KAAA,GAAQ,6CAAA,CAA8C,IAAA,CAAK,IAAI,CAAA;AACrE,EAAA,OAAO,KAAA,GAAS,KAAA,CAAM,CAAC,CAAA,IAAK,IAAA,GAAQ,IAAA;AACtC;AAEO,SAAS,iBAAiB,MAAA,EAA4C;AAC3E,EAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,cAAA,EAAgB,MAAA,EAAQ,OAAO,MAAA,EAAO;AAC9D;;;AC5IO,SAAS,UAAU,UAAA,EAAyB;AACjD,EAAA,kBAAA,CAAmB,UAAU,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,SAAS,KAAA,EAAoB;AAM3B,MAAA,MAAM,SAAS,KAAA,CAAM,aAAA,CAClB,IAAI,CAAC,IAAA,KAAS,KAAK,IAAA,EAAM,CAAA,CACzB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA,CAC1B,KAAK,IAAI,CAAA;AAEZ,MAAA,MAAM,eAAe,cAAA,CAAe;AAAA,QAClC,QAAA,EAAU,MAAA;AAAA,QACV,WAAW,KAAA,CAAM,SAAA;AAAA,QACjB,QAAQ,KAAA,CAAM,MAAA;AAAA,QACd,UAAU,KAAA,CAAM,QAAA;AAAA,QAChB,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,QAC3B,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY;AAAC,OAC9B,CAAA;AACD,MAAA,MAAM,cAAA,GAAiB,kBAAkB,YAAY,CAAA;AACrD,MAAA,IAAI,cAAA,CAAe,SAAS,SAAA,EAAW;AACrC,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,4BAAA,EAA+B,IAAA,CAAK,SAAA,CAAU,cAAA,CAAe,MAAM,CAAC,CAAA;AAAA,SACtE;AAAA,MACF;AACA,MAAA,MAAM,WAAA,GAAc,eAAe,QAAA,CAAS,QAAA;AAC5C,MAAA,MAAM,QAAA,GAA6B,WAAA,KAAgB,OAAA,GAAU,OAAA,GAAU,MAAA;AAEvE,MAAA,MAAM,qBAAA,GAAwB,aAAA,CAAc,cAAA,CAAe,QAAA,CAAS,YAAY,MAAM,CAAA;AACtF,MAAA,MAAM,OAAA,GAAU,cAAA,CAAe,QAAA,CAAS,WAAA,CAAY,MAAA,CAAO,GAAA;AAAA,QACzD,CAAC,CAAA,KAAM,CAAA,CAAE,KAAA,CAAM;AAAA,OACjB;AAEA,MAAA,MAAM,cAA4B,EAAC;AACnC,MAAA,MAAM,kBAA4B,EAAC;AACnC,MAAA,IAAI,QAAA,KAAa,OAAA,IAAW,KAAA,CAAM,kBAAA,EAAoB,MAAA,EAAQ;AAC5D,QAAA,MAAM,MAAA,GAAS,MAAM,kBAAA,CAAmB,GAAA;AAAA,UAAI,CAAC,IAAA,EAAM,GAAA,KACjD,sBAAsB,IAAA,EAAM,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE;AAAA,SACxC;AACA,QAAA,MAAM,gBAAwC,EAAC;AAC/C,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ,aAAA,CAAc,CAAA,CAAE,EAAE,IAAI,CAAA,CAAE,WAAA;AAEhD,QAAA,MAAM,iBAAiB,cAAA,CAAe;AAAA,UACpC,QAAA,EAAU,aAAA;AAAA,UACV,WAAW,KAAA,CAAM,SAAA;AAAA,UACjB,QAAQ,KAAA,CAAM,MAAA;AAAA,UACd,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAA,EAAS,KAAA,CAAM,OAAA,IAAW,EAAC;AAAA,UAC3B,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY;AAAC,SAC9B,CAAA;AACD,QAAA,MAAM,gBAAA,GAAmB,kBAAkB,cAAc,CAAA;AACzD,QAAA,IAAI,gBAAA,CAAiB,SAAS,SAAA,EAAW;AACvC,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,CAAA,oCAAA,EAAuC,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,MAAM,CAAC,CAAA;AAAA,WAChF;AAAA,QACF;AACA,QAAA,MAAM,QAAQ,IAAI,GAAA;AAAA,UAChB,aAAA,CAAc,gBAAA,CAAiB,QAAA,CAAS,WAAA,CAAY,MAAM;AAAA,SAC5D;AACA,QAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,UAAA,IAAI,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,EAAE,CAAA,EAAG;AACnB,YAAA,WAAA,CAAY,IAAA,CAAK,gBAAA,CAAiB,CAAC,CAAC,CAAA;AACpC,YAAA,eAAA,CAAgB,IAAA,CAAK,EAAE,EAAE,CAAA;AAAA,UAC3B;AAAA,QACF;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,QAAA;AAAA,QACA,WAAA;AAAA,QACA,cAAA,EAAgB,CAAC,GAAG,qBAAA,EAAuB,GAAG,eAAe,CAAA;AAAA,QAC7D;AAAA,OACF;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,cAAc,KAAA,EAA0B;AAG/C,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,SAAS,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,YAAY,KAAA,EAAO;AAClE,IAAA,OAAO,KAAA,CAAM,KAAK,KAA0B,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,MAAA,CAAO,CAAC,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,OAAO,EAAC;AACV","file":"index.js","sourcesContent":["import {\n  checkParseSchema,\n  isAuthorized,\n  type AuthorizationCall,\n  type CedarValueJson,\n  type EntityJson,\n} from '@cedar-policy/cedar-wasm';\nimport type { Entity } from './types.js';\n\nexport function assertSchemaParses(schemaJson: string): void {\n  const trimmed = schemaJson.trim();\n  if (!trimmed) return;\n  const r = checkParseSchema(trimmed);\n  if (r.type !== 'success') {\n    throw new Error(\n      `Cedar schema failed to parse: ${JSON.stringify(r.errors, null, 2)}`,\n    );\n  }\n}\n\n/**\n * Convert a plain JS value into the Cedar JSON form accepted by\n * `@cedar-policy/cedar-wasm`. Arrays stay arrays, objects stay objects,\n * primitives stay primitives. Dates serialise to their ISO string.\n */\nexport function toCedarValue(value: unknown): CedarValueJson {\n  if (value === null || value === undefined) return null;\n  if (typeof value === 'string' || typeof value === 'boolean') return value;\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error(`non-finite number cannot be encoded for Cedar: ${value}`);\n    }\n    return value;\n  }\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  if (Array.isArray(value)) {\n    return value.map(toCedarValue);\n  }\n  if (typeof value === 'object') {\n    const out: Record<string, CedarValueJson> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      out[k] = toCedarValue(v);\n    }\n    return out;\n  }\n  throw new Error(`unsupported Cedar value type: ${typeof value}`);\n}\n\nexport function toContext(\n  ctx: Record<string, unknown> | undefined,\n): Record<string, CedarValueJson> {\n  if (!ctx) return {};\n  const out: Record<string, CedarValueJson> = {};\n  for (const [k, v] of Object.entries(ctx)) {\n    out[k] = toCedarValue(v);\n  }\n  return out;\n}\n\nexport function entityToJson(entity: Entity): EntityJson {\n  return {\n    uid: { type: entity.type, id: entity.id },\n    attrs: entity.attrs\n      ? Object.fromEntries(\n          Object.entries(entity.attrs).map(([k, v]) => [k, toCedarValue(v)]),\n        )\n      : {},\n    parents: (entity.parents ?? []).map((p) => ({ type: p.type, id: p.id })),\n  };\n}\n\nexport interface CedarCallParts {\n  call: AuthorizationCall;\n}\n\nexport function buildCedarCall(opts: {\n  policies: Record<string, string> | string;\n  principal: Entity;\n  action: string;\n  resource: Entity;\n  context?: Record<string, unknown>;\n  entities?: Entity[];\n  actionType?: string;\n}): AuthorizationCall {\n  const actionType = opts.actionType ?? 'Action';\n  const all: Entity[] = [opts.principal, opts.resource, ...(opts.entities ?? [])];\n  const seen = new Set<string>();\n  const entities: EntityJson[] = [];\n  for (const e of all) {\n    const key = `${e.type}::${e.id}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    entities.push(entityToJson(e));\n  }\n  return {\n    principal: { type: opts.principal.type, id: opts.principal.id },\n    action: { type: actionType, id: opts.action },\n    resource: { type: opts.resource.type, id: opts.resource.id },\n    context: toContext(opts.context),\n    slice: {\n      policies: opts.policies,\n      entities,\n      templates: null,\n      templateInstantiations: null,\n    },\n  };\n}\n\nexport function cedarIsAuthorized(call: AuthorizationCall) {\n  return isAuthorized(call);\n}\n","import type { Obligation } from '@kybernesis/arp-spec';\n\nexport interface ParsedObligationPolicy {\n  /** Auto-generated stable id assigned to the cleaned-up policy text. */\n  id: string;\n  /** Obligation `type` from `@obligation(\"...\")`. */\n  obligationType: string;\n  /** Parsed params from `@obligation_params(...)` (object, JSON string, or empty). */\n  params: Record<string, unknown>;\n  /** Policy text with ARP-specific annotations removed, safe for Cedar. */\n  cleanedText: string;\n}\n\n/**\n * Parse ARP's non-standard obligation annotations out of a Cedar policy.\n *\n * Accepted forms:\n *\n *   @obligation(\"redact_fields\")\n *   @obligation_params({ \"fields\": [\"client.name\"] })      // object literal\n *   @obligation_params(\"{\\\"fields\\\":[...]}\")               // JSON string\n *\n * The returned `cleanedText` has both annotations removed and is safe to pass\n * straight to Cedar. Auto-prefixes an `@id(...)` so callers can track the\n * policy's `policies_fired` id.\n */\nexport function parseObligationPolicy(\n  text: string,\n  fallbackId: string,\n): ParsedObligationPolicy {\n  const { type, rest: afterType } = extractObligationType(text);\n  const { params, rest: afterParams } = extractObligationParams(afterType);\n  const existingId = extractExistingId(afterParams);\n  const cleaned = afterParams.trim();\n  const id = existingId ?? fallbackId;\n  const withId = existingId ? cleaned : `@id(\"${id}\")\\n${cleaned}`;\n  return {\n    id,\n    obligationType: type,\n    params,\n    cleanedText: withId,\n  };\n}\n\nfunction extractObligationType(text: string): { type: string; rest: string } {\n  const match = /@obligation\\s*\\(\\s*\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"\\s*\\)/m.exec(text);\n  if (!match) {\n    throw new Error(\n      'obligation policy missing @obligation(\"<type>\") annotation',\n    );\n  }\n  const rest = text.slice(0, match.index) + text.slice(match.index + match[0].length);\n  return { type: match[1] ?? '', rest };\n}\n\nfunction extractObligationParams(\n  text: string,\n): { params: Record<string, unknown>; rest: string } {\n  const headIdx = text.indexOf('@obligation_params');\n  if (headIdx < 0) return { params: {}, rest: text };\n\n  // Find the opening paren after the keyword.\n  const parenIdx = text.indexOf('(', headIdx);\n  if (parenIdx < 0) return { params: {}, rest: text };\n\n  // Walk forward balancing braces/quotes to find the matching close paren.\n  let depth = 1;\n  let inString: '\"' | \"'\" | null = null;\n  let i = parenIdx + 1;\n  while (i < text.length && depth > 0) {\n    const ch = text[i];\n    if (inString) {\n      if (ch === '\\\\') {\n        i += 2;\n        continue;\n      }\n      if (ch === inString) inString = null;\n      i++;\n      continue;\n    }\n    if (ch === '\"' || ch === \"'\") {\n      inString = ch;\n      i++;\n      continue;\n    }\n    if (ch === '(' || ch === '{' || ch === '[') depth++;\n    else if (ch === ')' || ch === '}' || ch === ']') depth--;\n    if (depth === 0 && ch === ')') break;\n    i++;\n  }\n  if (depth !== 0) {\n    throw new Error('unbalanced @obligation_params annotation');\n  }\n\n  const innerRaw = text.slice(parenIdx + 1, i).trim();\n  const rest = text.slice(0, headIdx) + text.slice(i + 1);\n  const params = parseParamValue(innerRaw);\n  return { params, rest };\n}\n\nfunction parseParamValue(raw: string): Record<string, unknown> {\n  if (!raw) return {};\n  // If the whole value is a quoted string, it's a JSON-stringified payload.\n  if ((raw.startsWith('\"') && raw.endsWith('\"')) || (raw.startsWith(\"'\") && raw.endsWith(\"'\"))) {\n    const unquoted = raw.slice(1, -1).replace(/\\\\(.)/g, '$1');\n    try {\n      const parsed = JSON.parse(unquoted);\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>;\n      }\n      throw new Error('expected object');\n    } catch (err) {\n      throw new Error(\n        `@obligation_params string payload isn't valid JSON object: ${(err as Error).message}`,\n      );\n    }\n  }\n  // Otherwise treat as a direct JSON5-ish object literal — standardise quotes.\n  const normalised = coerceToJson(raw);\n  try {\n    const parsed = JSON.parse(normalised);\n    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>;\n    }\n    throw new Error('expected object');\n  } catch (err) {\n    throw new Error(\n      `@obligation_params payload isn't a valid JSON object (after coercion): ${raw}: ${(err as Error).message}`,\n    );\n  }\n}\n\n/**\n * Light JSON coercion for the Cedar annotation param form. Converts\n * single-quoted strings to double-quoted, and unquoted object keys to quoted.\n * Good enough for the param shapes in ARP-policy-examples.md §5 — not a full\n * JSON5 parser.\n */\nfunction coerceToJson(raw: string): string {\n  let out = raw.replace(/'([^'\\\\]*(?:\\\\.[^'\\\\]*)*)'/g, (_m, inner: string) => {\n    return JSON.stringify(inner);\n  });\n  // Quote bare keys: {{ foo: ... }} → {{ \"foo\": ... }}\n  out = out.replace(\n    /([{,]\\s*)([A-Za-z_][A-Za-z0-9_]*)(\\s*:)/g,\n    (_m, lead: string, key: string, tail: string) => `${lead}\"${key}\"${tail}`,\n  );\n  return out;\n}\n\nfunction extractExistingId(text: string): string | null {\n  const match = /@id\\s*\\(\\s*\"([^\"\\\\]*(?:\\\\.[^\"\\\\]*)*)\"\\s*\\)/m.exec(text);\n  return match ? (match[1] ?? null) : null;\n}\n\nexport function obligationRecord(parsed: ParsedObligationPolicy): Obligation {\n  return { type: parsed.obligationType, params: parsed.params };\n}\n","import type { Obligation } from '@kybernesis/arp-spec';\nimport {\n  assertSchemaParses,\n  buildCedarCall,\n  cedarIsAuthorized,\n} from './cedar.js';\nimport { parseObligationPolicy, obligationRecord } from './obligations.js';\nimport type { Pdp, PdpDecision } from './types.js';\n\n/**\n * Build a PDP bound to a Cedar schema. The schema is parsed eagerly so\n * malformed schemas fail at construction rather than on first evaluation.\n *\n * v0 does NOT enforce the schema at request time — `isAuthorized` is called\n * without `enableRequestValidation`, mirroring the posture in Phase 2. Phase\n * 5 can turn validation on once all reference agents' contexts conform.\n */\nexport function createPdp(schemaJson: string): Pdp {\n  assertSchemaParses(schemaJson);\n\n  return {\n    evaluate(input): PdpDecision {\n      // Concatenate all permit/forbid entries into a single policy-set string.\n      // Each entry may contain multiple Cedar policies (e.g. a permit + a\n      // sibling forbid). Cedar auto-generates IDs (`policy0`, `policy1`, ...)\n      // which surface in diagnostics.reason; we return those as\n      // `policies_fired`.\n      const joined = input.cedarPolicies\n        .map((text) => text.trim())\n        .filter((t) => t.length > 0)\n        .join('\\n');\n\n      const decisionCall = buildCedarCall({\n        policies: joined,\n        principal: input.principal,\n        action: input.action,\n        resource: input.resource,\n        context: input.context ?? {},\n        entities: input.entities ?? [],\n      });\n      const decisionAnswer = cedarIsAuthorized(decisionCall);\n      if (decisionAnswer.type !== 'success') {\n        throw new Error(\n          `Cedar authorization failed: ${JSON.stringify(decisionAnswer.errors)}`,\n        );\n      }\n      const rawDecision = decisionAnswer.response.decision;\n      const decision: 'allow' | 'deny' = rawDecision === 'Allow' ? 'allow' : 'deny';\n\n      const firedDecisionPolicies = toStringArray(decisionAnswer.response.diagnostics.reason);\n      const reasons = decisionAnswer.response.diagnostics.errors.map(\n        (e) => e.error.message,\n      );\n\n      const obligations: Obligation[] = [];\n      const obligationFired: string[] = [];\n      if (decision === 'allow' && input.obligationPolicies?.length) {\n        const parsed = input.obligationPolicies.map((text, idx) =>\n          parseObligationPolicy(text, `o_${idx}`),\n        );\n        const obligationMap: Record<string, string> = {};\n        for (const p of parsed) obligationMap[p.id] = p.cleanedText;\n\n        const obligationCall = buildCedarCall({\n          policies: obligationMap,\n          principal: input.principal,\n          action: input.action,\n          resource: input.resource,\n          context: input.context ?? {},\n          entities: input.entities ?? [],\n        });\n        const obligationAnswer = cedarIsAuthorized(obligationCall);\n        if (obligationAnswer.type !== 'success') {\n          throw new Error(\n            `Cedar obligation evaluation failed: ${JSON.stringify(obligationAnswer.errors)}`,\n          );\n        }\n        const fired = new Set(\n          toStringArray(obligationAnswer.response.diagnostics.reason),\n        );\n        for (const p of parsed) {\n          if (fired.has(p.id)) {\n            obligations.push(obligationRecord(p));\n            obligationFired.push(p.id);\n          }\n        }\n      }\n\n      return {\n        decision,\n        obligations,\n        policies_fired: [...firedDecisionPolicies, ...obligationFired],\n        reasons,\n      };\n    },\n  };\n}\n\nfunction toStringArray(value: unknown): string[] {\n  // cedar-wasm types `reason` as `Set<String>` at the TS layer but returns a\n  // plain array at runtime. Defensive normalise — treat either as iterable.\n  if (Array.isArray(value)) {\n    return value.map((v) => String(v));\n  }\n  if (value && typeof value === 'object' && Symbol.iterator in value) {\n    return Array.from(value as Iterable<unknown>).map((v) => String(v));\n  }\n  return [];\n}\n\n"]}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@kybernesis/arp-pdp",
+  "version": "0.3.0",
+  "description": "ARP Policy Decision Point — wraps @cedar-policy/cedar-wasm, adds ARP's @obligation annotation semantics.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/KybernesisAI/arp.git",
+    "directory": "packages/pdp"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@cedar-policy/cedar-wasm": "^3.2.4",
+    "@kybernesis/arp-spec": "0.2.0"
+  },
+  "devDependencies": {},
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src tests"
+  }
+}