@o3co/auth.policy-verifier.cedar-wasm 0.0.1 → 0.11.0

package/dist/index.d.mts

@@ -0,0 +1,3 @@
+export type { CedarWasmEngine } from "./wasmEngine.mjs";
+export { CEDAR_WASM_ENGINE_NAME, cedarWasmEngine } from "./wasmEngine.mjs";
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","sourceRoot":"","sources":["../src/index.mts"],"names":[],"mappings":"AAiBA,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.mjs

@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { registerCedarEngine } from "@o3co/auth.policy-verifier.cedar";
+import { cedarWasmEngine } from "./wasmEngine.mjs";
+/*
+ * Registered here, at module scope: importing this package is all a
+ * deployment does to make `engine = "wasm"` — and the engine-less default —
+ * resolve to the in-process evaluator. An import runs this module body to
+ * completion before anything that imported it continues, and `createApp`
+ * builds no collector until every module is initialized, so the registration
+ * is in place before the first `CedarPolicyRuleCollector` is constructed. The
+ * same shape, and the same reasoning, as cedar's attribute key reservation.
+ */
+registerCedarEngine(cedarWasmEngine);
+export { CEDAR_WASM_ENGINE_NAME, cedarWasmEngine } from "./wasmEngine.mjs";

package/dist/wasmEngine.d.mts

@@ -0,0 +1,24 @@
+import { type CedarEngine, type PolicySource, type SyncCedarPolicySet } from "@o3co/auth.policy-verifier.cedar";
+/** The name this engine registers under, and the config value that selects it. */
+export declare const CEDAR_WASM_ENGINE_NAME: "wasm";
+/** The wasm engine's own type: it loads synchronously and answers synchronously. */
+export interface CedarWasmEngine extends CedarEngine {
+    readonly name: typeof CEDAR_WASM_ENGINE_NAME;
+    load(source: PolicySource): SyncCedarPolicySet;
+}
+/**
+ * The in-process Cedar engine: the official `@cedar-policy/cedar-wasm`
+ * bindings behind the `CedarEngine` port.
+ *
+ * `load` parse-checks every file individually — so a syntax error names the
+ * file that contains it — then compiles the concatenated set once, at boot,
+ * into wasm memory under a per-load id. `isAuthorized` references that id per
+ * request and re-parses nothing; the call is synchronous, deterministic, and a
+ * few tens of microseconds, so the policy set answers as a plain `Rule`.
+ *
+ * What this engine costs is paid at import: the wasm module (about 12 MB on
+ * disk) is instantiated when the bindings load. That is why it lives in its
+ * own package — a deployment that evaluates out of process never carries it.
+ */
+export declare const cedarWasmEngine: CedarWasmEngine;
+//# sourceMappingURL=wasmEngine.d.mts.map

package/dist/wasmEngine.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAsC7B,CAAC"}

package/dist/wasmEngine.mjs

@@ -0,0 +1,57 @@
+// SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
+// SPDX-License-Identifier: Apache-2.0
+import { checkParsePolicySet, preparsePolicySet, statefulIsAuthorized, } from "@cedar-policy/cedar-wasm/nodejs";
+import { CedarEngineError, } from "@o3co/auth.policy-verifier.cedar";
+/** The name this engine registers under, and the config value that selects it. */
+export const CEDAR_WASM_ENGINE_NAME = "wasm";
+/** Distinguishes concurrently-loaded policy sets inside the one wasm instance. */
+let policySetCounter = 0;
+/**
+ * The in-process Cedar engine: the official `@cedar-policy/cedar-wasm`
+ * bindings behind the `CedarEngine` port.
+ *
+ * `load` parse-checks every file individually — so a syntax error names the
+ * file that contains it — then compiles the concatenated set once, at boot,
+ * into wasm memory under a per-load id. `isAuthorized` references that id per
+ * request and re-parses nothing; the call is synchronous, deterministic, and a
+ * few tens of microseconds, so the policy set answers as a plain `Rule`.
+ *
+ * What this engine costs is paid at import: the wasm module (about 12 MB on
+ * disk) is instantiated when the bindings load. That is why it lives in its
+ * own package — a deployment that evaluates out of process never carries it.
+ */
+export const cedarWasmEngine = {
+    name: CEDAR_WASM_ENGINE_NAME,
+    async: false,
+    load(source) {
+        for (const file of source.files) {
+            const answer = checkParsePolicySet({ staticPolicies: file.text });
+            if (answer.type === "failure") {
+                throw new CedarEngineError(`${file.source} failed to parse: ${details(answer.errors)}`);
+            }
+        }
+        const policySetId = `auth.policy-verifier.cedar-wasm:${policySetCounter++}`;
+        const compiled = preparsePolicySet(policySetId, { staticPolicies: source.text });
+        if (compiled.type === "failure") {
+            throw new CedarEngineError(`policy set from ${source.description} failed to compile: ${details(compiled.errors)}`);
+        }
+        return {
+            async: false,
+            isAuthorized(request) {
+                const answer = statefulIsAuthorized({ ...request, preparsedPolicySetId: policySetId });
+                if (answer.type !== "success") {
+                    throw new CedarEngineError(`cedar-wasm could not evaluate the request: ${details(answer.errors)}`);
+                }
+                const { decision, diagnostics } = answer.response;
+                return {
+                    decision,
+                    reason: diagnostics.reason,
+                    errors: diagnostics.errors.map((error) => `${error.policyId}: ${error.error.message}`),
+                };
+            },
+        };
+    },
+};
+function details(errors) {
+    return errors.map((error) => error.message).join("; ");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.cedar-wasm",
-  "version": "0.0.1",
+  "version": "0.11.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -26,13 +26,13 @@
   },
   "dependencies": {
     "@cedar-policy/cedar-wasm": "4.12.0",
-    "@o3co/auth.policy-verifier.cedar": "0.0.0"
+    "@o3co/auth.policy-verifier.cedar": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "^26.5.1",
     "@vitest/coverage-v8": "^5.0.0",
     "vitest": "^5.0.0",
-    "@o3co/auth.policy-verifier.core": "0.0.0"
+    "@o3co/auth.policy-verifier.core": "0.11.0"
   },
   "scripts": {
     "prebuild": "rimraf dist",