@o3co/auth.policy-verifier.cedar-wasm 0.11.0 → 0.13.0

package/README.md

@@ -1,5 +1,7 @@
 # @o3co/auth.policy-verifier.cedar-wasm
 
+Last updated: 2026-09-23
+
 The in-process Cedar engine for
 [`@o3co/auth.policy-verifier.cedar`](../cedar/README.md): the official
 [`@cedar-policy/cedar-wasm`](https://www.npmjs.com/package/@cedar-policy/cedar-wasm)
@@ -18,6 +20,41 @@ same choice out — that setting refuses to start when this package was not
 imported, naming it. Nothing else about the collector's config changes with the
 engine; see cedar's README for the whole of it.
 
+It also vouches for the policy revision behind every answer
+(`confirmsRevision`, #244): the set is compiled in this process, from the files
+the revision was computed over, under an id nothing else holds — so an answer
+cannot have come from any other policies. It is the engine
+`requireConfirmedRevision = true` boots over; see cedar's [Policy
+revision](../cedar/README.md#policy-revision-which-policies-decided).
+
+## Responsibility
+
+**Role.** One engine behind cedar's `CedarEngine` port
+([`engine.mts`](../cedar/src/engine.mts)). It depends on
+`@o3co/auth.policy-verifier.cedar` and on `@cedar-policy/cedar-wasm`. No
+package in this repository depends on it (only the integration tests do); a
+deployment imports it.
+
+**Owns** ([`src/wasmEngine.mts`](src/wasmEngine.mts)):
+
+- Parse-checking each policy file at boot, so a syntax error names its file,
+  and compiling the set once into wasm memory under an id minted per load.
+- Evaluating each request against that compiled set, synchronously, and
+  rendering the bindings' answer as a `CedarDecision`.
+- Naming the revision of the source it compiled on every answer.
+- The exact version of `@cedar-policy/cedar-wasm`.
+- Registering itself as `"wasm"` when imported
+  ([`src/index.mts`](src/index.mts)).
+
+**Does not own.** Policy loading, the policy revision itself, the
+attribute-to-request mapping, what an answer means (the answer table,
+`onNoDeterminingPolicy`, the revision check) and which engine is selected. All
+of that is cedar's, and is identical whichever engine runs.
+
+**Why a separate package.** The cost below: about 12 MB of wasm instantiated
+on import. Kept out of cedar, it is carried only by a deployment that
+evaluates in-process; one that runs cedar's `http` engine never loads it.
+
 ## What it costs, and when to choose it
 
 The policy set is compiled once, at boot, into wasm memory; each request

package/dist/wasmEngine.d.mts

@@ -19,6 +19,15 @@ export interface CedarWasmEngine extends CedarEngine {
  * What this engine costs is paid at import: the wasm module (about 12 MB on
  * disk) is instantiated when the bindings load. That is why it lives in its
  * own package — a deployment that evaluates out of process never carries it.
+ *
+ * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
+ * the set is compiled here, from the source `load` was handed, under an id
+ * minted here and known to nothing else. An answer through that id cannot have
+ * come from any other policies, so every answer names the revision of that
+ * source — read once, at `load`, beside the compile. `PolicySource` is a plain
+ * object the caller still holds; reading `source.revision` when answering would
+ * be reading "the current revision", which is a claim about the object and not
+ * about the policies that were compiled.
  */
 export declare const cedarWasmEngine: CedarWasmEngine;
 //# sourceMappingURL=wasmEngine.d.mts.map

package/dist/wasmEngine.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AASA,OAAO,EAEN,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,eAsC7B,CAAC"}
+{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AAeA,OAAO,EAEN,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,EAAE,eA0C7B,CAAC"}

package/dist/wasmEngine.mjs

@@ -1,5 +1,10 @@
 // SPDX-FileCopyrightText: 2026 1o1 Co. Ltd.
 // SPDX-License-Identifier: Apache-2.0
+/*
+ * The `wasm` engine: evaluates the policy set in process through the official
+ * `@cedar-policy/cedar-wasm` bindings, compiling it once at load and answering
+ * synchronously. The package index registers it.
+ */
 import { checkParsePolicySet, preparsePolicySet, statefulIsAuthorized, } from "@cedar-policy/cedar-wasm/nodejs";
 import { CedarEngineError, } from "@o3co/auth.policy-verifier.cedar";
 /** The name this engine registers under, and the config value that selects it. */
@@ -19,10 +24,20 @@ let policySetCounter = 0;
  * What this engine costs is paid at import: the wasm module (about 12 MB on
  * disk) is instantiated when the bindings load. That is why it lives in its
  * own package — a deployment that evaluates out of process never carries it.
+ *
+ * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
+ * the set is compiled here, from the source `load` was handed, under an id
+ * minted here and known to nothing else. An answer through that id cannot have
+ * come from any other policies, so every answer names the revision of that
+ * source — read once, at `load`, beside the compile. `PolicySource` is a plain
+ * object the caller still holds; reading `source.revision` when answering would
+ * be reading "the current revision", which is a claim about the object and not
+ * about the policies that were compiled.
  */
 export const cedarWasmEngine = {
     name: CEDAR_WASM_ENGINE_NAME,
     async: false,
+    confirmsRevision: true,
     load(source) {
         for (const file of source.files) {
             const answer = checkParsePolicySet({ staticPolicies: file.text });
@@ -30,6 +45,8 @@ export const cedarWasmEngine = {
                 throw new CedarEngineError(`${file.source} failed to parse: ${details(answer.errors)}`);
             }
         }
+        // Captured with the compile below, not read per answer — see the doc comment.
+        const { revision } = source;
         const policySetId = `auth.policy-verifier.cedar-wasm:${policySetCounter++}`;
         const compiled = preparsePolicySet(policySetId, { staticPolicies: source.text });
         if (compiled.type === "failure") {
@@ -47,6 +64,7 @@ export const cedarWasmEngine = {
                     decision,
                     reason: diagnostics.reason,
                     errors: diagnostics.errors.map((error) => `${error.policyId}: ${error.error.message}`),
+                    revision,
                 };
             },
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.cedar-wasm",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -25,14 +25,14 @@
     "directory": "packages/cedar-wasm"
   },
   "dependencies": {
-    "@cedar-policy/cedar-wasm": "4.12.0",
-    "@o3co/auth.policy-verifier.cedar": "0.11.0"
+    "@cedar-policy/cedar-wasm": "4.13.0",
+    "@o3co/auth.policy-verifier.cedar": "0.13.0"
   },
   "devDependencies": {
-    "@types/node": "^26.5.1",
-    "@vitest/coverage-v8": "^5.0.0",
-    "vitest": "^5.0.0",
-    "@o3co/auth.policy-verifier.core": "0.11.0"
+    "@types/node": "^26.6.2",
+    "@vitest/coverage-v8": "^5.0.1",
+    "vitest": "^5.0.1",
+    "@o3co/auth.policy-verifier.core": "0.13.0"
   },
   "scripts": {
     "prebuild": "rimraf dist",