@o3co/auth.policy-verifier.cedar-wasm 0.15.0 → 0.16.1

package/dist/wasmEngine.d.mts

@@ -12,29 +12,26 @@ export interface CedarWasmEngine extends CedarEngine {
  *
  * `load` parses every file on its own — so a syntax error names the file that
  * contains it — splits it into its policies, and names each for its file
- * (`namePolicies`, #199): the file's name for a file that holds one, numbered
- * `#1`, `#2`… for one that holds several. Those are the ids Cedar answers with
- * in `diagnostics.reason` and names in `errors`, and the ids the http engine
+ * (`namePolicies`): the file's name for a file that holds one, numbered `#1`,
+ * `#2`… for one that holds several. Those are the ids Cedar answers with in
+ * `diagnostics.reason` and names in `errors`, and the ids the http engine
  * gives cedar-agent, so a corpus laid out one policy per file reads the same
  * under both. Refused at load: two policies that would share an id (`a.cedar`
  * holding two, beside `a#1.cedar`), a policy in a file named only `.cedar`,
- * and a template. The set is then compiled once, at boot, into
- * wasm memory under a per-load id. `isAuthorized` references that id per
- * request and re-parses nothing; the call is synchronous, deterministic, and a
- * few tens of microseconds, so the policy set answers as a plain `Rule`.
+ * and a template. The set is then compiled once, at boot, into wasm memory
+ * under a per-load id. `isAuthorized` references that id per request and
+ * re-parses nothing; the call is synchronous, deterministic, and a few tens of
+ * microseconds, so the policy set answers as a plain `Rule`.
  *
- * What this engine costs is paid at import: the wasm module (about 12 MB on
- * disk) is instantiated when the bindings load. That is why it lives in its
- * own package — a deployment that evaluates out of process never carries it.
+ * The wasm module (about 12 MB on disk) is instantiated when the bindings
+ * load, which is why this engine lives in its own package: a deployment that
+ * evaluates out of process never carries it.
  *
- * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
- * the set is compiled here, from the source `load` was handed, under an id
- * minted here and known to nothing else. An answer through that id cannot have
- * come from any other policies, so every answer names the revision of that
- * source — read once, at `load`, beside the compile. `PolicySource` is a plain
- * object the caller still holds; reading `source.revision` when answering would
- * be reading "the current revision", which is a claim about the object and not
- * about the policies that were compiled.
+ * It vouches for the revision it evaluated (`confirmsRevision`): the set is
+ * compiled here, under an id known to nothing else, so an answer through that
+ * id comes from the source `load` was handed and names that source's revision,
+ * read once at `load`. Reading `source.revision` when answering would describe
+ * the caller's object as it is now, not the policies that were compiled.
  */
 export declare const cedarWasmEngine: CedarWasmEngine;
 //# sourceMappingURL=wasmEngine.d.mts.map

package/dist/wasmEngine.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AAeA,OAAO,EAEN,KAAK,WAAW,EAKhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,eAAe,EAAE,eAuC7B,CAAC"}
+{"version":3,"file":"wasmEngine.d.mts","sourceRoot":"","sources":["../src/wasmEngine.mts"],"names":[],"mappings":"AAeA,OAAO,EAEN,KAAK,WAAW,EAKhB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,EAAG,MAAe,CAAC;AAEtD,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;CAC/C;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,eAAe,EAAE,eAuC7B,CAAC"}

package/dist/wasmEngine.mjs

@@ -17,29 +17,26 @@ let policySetCounter = 0;
  *
  * `load` parses every file on its own — so a syntax error names the file that
  * contains it — splits it into its policies, and names each for its file
- * (`namePolicies`, #199): the file's name for a file that holds one, numbered
- * `#1`, `#2`… for one that holds several. Those are the ids Cedar answers with
- * in `diagnostics.reason` and names in `errors`, and the ids the http engine
+ * (`namePolicies`): the file's name for a file that holds one, numbered `#1`,
+ * `#2`… for one that holds several. Those are the ids Cedar answers with in
+ * `diagnostics.reason` and names in `errors`, and the ids the http engine
  * gives cedar-agent, so a corpus laid out one policy per file reads the same
  * under both. Refused at load: two policies that would share an id (`a.cedar`
  * holding two, beside `a#1.cedar`), a policy in a file named only `.cedar`,
- * and a template. The set is then compiled once, at boot, into
- * wasm memory under a per-load id. `isAuthorized` references that id per
- * request and re-parses nothing; the call is synchronous, deterministic, and a
- * few tens of microseconds, so the policy set answers as a plain `Rule`.
+ * and a template. The set is then compiled once, at boot, into wasm memory
+ * under a per-load id. `isAuthorized` references that id per request and
+ * re-parses nothing; the call is synchronous, deterministic, and a few tens of
+ * microseconds, so the policy set answers as a plain `Rule`.
  *
- * What this engine costs is paid at import: the wasm module (about 12 MB on
- * disk) is instantiated when the bindings load. That is why it lives in its
- * own package — a deployment that evaluates out of process never carries it.
+ * The wasm module (about 12 MB on disk) is instantiated when the bindings
+ * load, which is why this engine lives in its own package: a deployment that
+ * evaluates out of process never carries it.
  *
- * It vouches for the revision it evaluated (`confirmsRevision`, #244), and can:
- * the set is compiled here, from the source `load` was handed, under an id
- * minted here and known to nothing else. An answer through that id cannot have
- * come from any other policies, so every answer names the revision of that
- * source — read once, at `load`, beside the compile. `PolicySource` is a plain
- * object the caller still holds; reading `source.revision` when answering would
- * be reading "the current revision", which is a claim about the object and not
- * about the policies that were compiled.
+ * It vouches for the revision it evaluated (`confirmsRevision`): the set is
+ * compiled here, under an id known to nothing else, so an answer through that
+ * id comes from the source `load` was handed and names that source's revision,
+ * read once at `load`. Reading `source.revision` when answering would describe
+ * the caller's object as it is now, not the policies that were compiled.
  */
 export const cedarWasmEngine = {
     name: CEDAR_WASM_ENGINE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/auth.policy-verifier.cedar-wasm",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
@@ -26,13 +26,13 @@
   },
   "dependencies": {
     "@cedar-policy/cedar-wasm": "4.13.0",
-    "@o3co/auth.policy-verifier.cedar": "0.15.0"
+    "@o3co/auth.policy-verifier.cedar": "0.16.1"
   },
   "devDependencies": {
-    "@types/node": "^26.6.2",
-    "@vitest/coverage-v8": "^5.0.1",
-    "vitest": "^5.0.1",
-    "@o3co/auth.policy-verifier.core": "0.15.0"
+    "@types/node": "^26.6.3",
+    "@vitest/coverage-v8": "^5.0.2",
+    "vitest": "^5.0.2",
+    "@o3co/auth.policy-verifier.core": "0.16.1"
   },
   "scripts": {
     "prebuild": "rimraf dist",