@watchlight/engine 0.1.0

package/LICENSE

@@ -0,0 +1,87 @@
+Watchlight Engine — Developer Edition License
+
+Copyright (c) 2026 Watchlight AI, LLC. All rights reserved.
+
+This software, including its compiled artifacts and accompanying files (the
+"Software"), is the proprietary property of Watchlight AI, LLC ("Watchlight").
+The Software is licensed, not sold.
+
+1. LICENSE GRANT (Developer Edition)
+
+Subject to your compliance with this License, Watchlight grants you a personal,
+non-exclusive, non-transferable, non-sublicensable, royalty-free license to
+download, install, and use the Software — including in production and for
+commercial or revenue-generating purposes — as a component of your own
+applications, agents, or services (the "Permitted Use"). This grant is
+IRREVOCABLE with respect to the version of the Software you have received, so
+long as you comply with Sections 2 and 3; a later version, or the withdrawal of
+future versions, does not affect your right to continue using a version already
+received.
+
+2. FREE TIER; WHEN A COMMERCIAL LICENSE IS REQUIRED
+
+The Permitted Use is provided free of charge up to the Free Tier limit:
+
+    Up to twenty-five (25) agents under management per organization, an "agent"
+    meaning a distinct governed agent identity. The tier gates on SCALE, not on
+    whether the use is production or commercial. A high per-month authorization
+    volume ceiling may also apply solely to prevent abuse.
+
+A separate written commercial license from Watchlight is required only to:
+
+  (a) use the Software above the Free Tier limit; or
+  (b) provide the Software ITSELF — its authorization decision engine or API —
+      to any third party as a standalone hosted, managed, or embedded
+      authorization service (i.e. re-offering the Software's functionality as a
+      service). Using the Software as an internal component of your own product
+      or service, including one you offer to your customers, is Permitted Use
+      and does NOT require a separate agreement.
+
+Contact legal@watchlight.ai for a commercial license.
+
+3. RESTRICTIONS
+
+Except as expressly permitted above, and except to the extent applicable law
+prohibits a given restriction, you may NOT, in whole or in part:
+
+  (a) distribute, publish, sublicense, rent, lease, sell, or otherwise make the
+      Software itself available to any third party as the Software (deploying it
+      within your own application or service as permitted in Section 1 is not a
+      distribution of the Software);
+  (b) modify, adapt, translate, or create derivative works of the Software;
+  (c) decompile, disassemble, reverse engineer, or otherwise attempt to derive
+      the source code, structure, or underlying ideas of the Software;
+  (d) remove, obscure, or alter any proprietary notices in the Software; or
+  (e) use the Software outside the scope of the Permitted Use.
+
+4. RESERVATION OF RIGHTS
+
+Watchlight reserves all rights not expressly granted. No rights are granted by
+implication, estoppel, or otherwise. The Software is licensed, not sold, and
+Watchlight retains all right, title, and interest in and to the Software.
+
+5. TERMINATION
+
+If you breach this License, Watchlight will provide written notice and a period
+of thirty (30) days to cure the breach. If the breach is cured within that
+period, this License continues uninterrupted. If it is not cured, this License
+terminates at the end of the cure period, and you must then cease all use of the
+Software and destroy all copies in your possession or control. To avoid
+disrupting a live authorization path, termination for a curable breach never
+takes effect before the cure period ends. Sections 3, 4, 6, and 7 survive
+termination.
+
+6. DISCLAIMER OF WARRANTY
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, TITLE, AND NONINFRINGEMENT.
+
+7. LIMITATION OF LIABILITY
+
+IN NO EVENT SHALL WATCHLIGHT AI, LLC BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM,
+OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+For licensing inquiries, contact: legal@watchlight.ai

package/README.md

@@ -0,0 +1,75 @@
+# @watchlight/engine
+
+The Watchlight **Developer Edition** authorization engine for Node — the real
+`wl-apdp` Cedar pipeline (delegation → intent → goal → policy selection → Cedar
+→ strict-subset sub-agent attenuation → enforcement effects) compiled to
+WebAssembly. In-process, fail-closed, zero infrastructure.
+
+This is the **same authorization core** as the Python engine
+([`watchlight-engine`](https://pypi.org/project/watchlight-engine/)) — a
+conformance test asserts both bindings return identical decisions for identical
+inputs. No sidecar, no network, no policy re-implementation in JS.
+
+## Install
+
+```bash
+npm install @watchlight/engine
+```
+
+Node ≥ 18 (uses WebAssembly bulk-memory + Web Crypto, both stable there).
+
+## Use
+
+```js
+const { Engine } = require("@watchlight/engine");
+
+const engine = await Engine.create();
+
+await engine.addPolicy({
+  name: "allow-read",
+  code: 'permit(principal, action == Action::"read", resource);',
+});
+
+// Authorize — context defaults to {}. Fail-closed: unmatched → Deny.
+const resp = await engine.authorize({
+  principal: 'User::"alice"',
+  action: 'Action::"read"',
+  resource: 'Document::"doc1"',
+});
+console.log(resp.decision); // "Allow"
+
+// Strict-subset sub-agent scope attenuation (synchronous).
+const atten = engine.attenuateScope(
+  { allowed_tools: ["read", "search"], allowed_resources: [], allowed_intents: [], max_depth: 5, time_budget_seconds: 600, depth: 0 },
+  { allowed_tools: ["read"], allowed_resources: [], allowed_intents: [], max_depth: 2, time_budget_seconds: 300 }
+);
+console.log(atten.decision); // "Allow" (child ⊆ parent) — a superset would Deny
+```
+
+`authorize` / `addPolicy` are async (the engine's pipeline is async;
+WebAssembly has no blocking wait, so they return Promises). `attenuateScope`
+is synchronous. TypeScript types ship in `index.d.ts`.
+
+## Graduation to Enterprise
+
+The same code moves to the networked Watchlight control plane (signed lineage,
+cross-tenant isolation, IdP/mTLS attestation) by pointing at it — your policies
+and call sites do not change.
+
+## Build from source
+
+Requires the `wasm32-unknown-unknown` target, [`wasm-pack`](https://rustwasm.github.io/wasm-pack/),
+and (optionally, for a smaller artifact) a modern [`binaryen`](https://github.com/WebAssembly/binaryen) `wasm-opt`:
+
+```bash
+rustup target add wasm32-unknown-unknown
+npm run build        # → ./wasm (regenerated; not committed)
+npm test             # Node conformance (7/7)
+npm run conformance  # Node + Python parity (needs: pip install watchlight-engine)
+```
+
+## License
+
+Watchlight Engine — Developer Edition License (see `LICENSE`). Free for
+development, testing, **and production**, including commercially, for up to 25
+governed agents per organization.

package/index.d.ts

@@ -0,0 +1,80 @@
+// Type definitions for @watchlight/engine
+
+/** A Cedar policy to load into the engine. At minimum `{ name, code }`. */
+export interface PolicyInput {
+  name: string;
+  /** Cedar policy source. */
+  code: string;
+  id?: string;
+  description?: string;
+  active?: boolean;
+  [k: string]: unknown;
+}
+
+/** An authorization request. At minimum `{ principal, action, resource }`. */
+export interface AuthorizationRequest {
+  principal: string;
+  action: string;
+  resource: string;
+  /** Defaults to `{}` when omitted. */
+  context?: Record<string, unknown>;
+  intent?: string;
+  execution_id?: string;
+  [k: string]: unknown;
+}
+
+/** The engine's decision. Fail-closed: an unmatched request is `"Deny"`. */
+export interface AuthorizationResponse {
+  decision: "Allow" | "Deny" | string;
+  reason?: string;
+  details?: Record<string, unknown>;
+  [k: string]: unknown;
+}
+
+/** A parent's granted sub-agent scope. */
+export interface GrantedScope {
+  allowed_tools: string[];
+  allowed_resources: { matcher: string }[];
+  allowed_intents: string[];
+  max_depth: number;
+  time_budget_seconds: number;
+  depth?: number;
+  deadline?: string | null;
+  parent_run_handle_id?: string | null;
+}
+
+/** A requested child sub-agent scope. */
+export interface RequestedScope {
+  allowed_tools: string[];
+  allowed_resources: { matcher: string }[];
+  allowed_intents: string[];
+  max_depth: number;
+  time_budget_seconds: number;
+}
+
+/** Result of `attenuateScope`. */
+export type AttenuationResult =
+  | { decision: "Allow"; granted_scope: GrantedScope }
+  | { decision: "Deny"; reason: string; violations: string[] };
+
+/**
+ * In-process Watchlight policy engine — the real wl-apdp Cedar pipeline over
+ * in-memory storage, compiled to WebAssembly. Fail-closed.
+ */
+export class Engine {
+  private constructor(inner: unknown);
+  /** Construct the engine. */
+  static create(): Promise<Engine>;
+  /** Load a Cedar policy. */
+  addPolicy(policy: PolicyInput | string): Promise<void>;
+  /** Authorize a request; `context` defaults to `{}`. */
+  authorize(request: AuthorizationRequest | string): Promise<AuthorizationResponse>;
+  /** Attenuate a child scope against a parent's granted scope (synchronous). */
+  attenuateScope(
+    parentScope: GrantedScope | string,
+    requestedScope: RequestedScope | string
+  ): AttenuationResult;
+}
+
+/** The compiled engine version. */
+export function version(): string;

package/index.js

@@ -0,0 +1,70 @@
+// @watchlight/engine — ergonomic wrapper over the wasm-bindgen bindings for the
+// real wl-apdp authorization core. Mirrors the Developer-Edition Python
+// `PolicyEngine` API (create → addPolicy → authorize / attenuateScope), returns
+// parsed JS objects, and defaults `context` to `{}` so callers never hand-write
+// it. Fail-closed throughout — an unmatched request denies.
+//
+// The heavy lifting (Cedar eval, attenuation, enforcement effects) is the
+// compiled wasm core; this file is glue only, no decision logic.
+
+const wasm = require("./wasm/wl_apdp_wasm.js");
+
+const asJson = (v) => (typeof v === "string" ? v : JSON.stringify(v));
+
+/** In-process Watchlight policy engine (real wl-apdp core over in-memory storage). */
+class Engine {
+  /** @param {import("./wasm/wl_apdp_wasm").PolicyEngine} inner */
+  constructor(inner) {
+    /** @private */
+    this._inner = inner;
+  }
+
+  /** Construct the engine. `const engine = await Engine.create();` */
+  static async create() {
+    const inner = await wasm.PolicyEngine.create();
+    return new Engine(inner);
+  }
+
+  /**
+   * Load a Cedar policy. Accepts an object or JSON string; at minimum
+   * `{ name, code }` (Cedar source). id/active/timestamps are defaulted.
+   * @param {object|string} policy
+   * @returns {Promise<void>}
+   */
+  addPolicy(policy) {
+    return this._inner.addPolicy(asJson(policy));
+  }
+
+  /**
+   * Authorize a request. Accepts an object or JSON string; at minimum
+   * `{ principal, action, resource }`. `context` defaults to `{}`.
+   * Resolves to the parsed AuthorizationResponse (`decision`, `reason`,
+   * `details`, ...). Fail-closed: unmatched → `decision: "Deny"`.
+   * @param {object|string} request
+   * @returns {Promise<object>}
+   */
+  async authorize(request) {
+    let req = request;
+    if (req && typeof req === "object" && req.context === undefined) {
+      req = { ...req, context: {} };
+    }
+    const raw = await this._inner.authorize(asJson(req));
+    return JSON.parse(raw);
+  }
+
+  /**
+   * Attenuate a requested sub-agent scope against a parent's granted scope
+   * (strict-subset validator). Synchronous. Returns the parsed result:
+   * `{ decision: "Allow", granted_scope }` or `{ decision: "Deny", reason,
+   * violations }`. Fail-closed.
+   * @param {object|string} parentScope
+   * @param {object|string} requestedScope
+   * @returns {object}
+   */
+  attenuateScope(parentScope, requestedScope) {
+    const raw = this._inner.attenuateScope(asJson(parentScope), asJson(requestedScope));
+    return JSON.parse(raw);
+  }
+}
+
+module.exports = { Engine, version: wasm.version };

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@watchlight/engine",
+  "version": "0.1.0",
+  "description": "Watchlight Developer Edition authorization engine for Node — the real wl-apdp Cedar pipeline (delegation → intent → goal → policy selection → Cedar → strict-subset attenuation → enforcement effects) compiled to WebAssembly. In-process, fail-closed, zero infrastructure.",
+  "type": "commonjs",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "wasm/wl_apdp_wasm.js",
+    "wasm/wl_apdp_wasm_bg.wasm",
+    "wasm/wl_apdp_wasm.d.ts",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "./build.sh",
+    "test": "node conformance/run_node.mjs",
+    "conformance": "node conformance/run_node.mjs && python3 conformance/run_python.py",
+    "prepublishOnly": "./build.sh"
+  },
+  "keywords": [
+    "authorization",
+    "cedar",
+    "policy",
+    "agent",
+    "governance",
+    "wasm",
+    "watchlight"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://www.watchlight.ai",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/wasm/wl_apdp_wasm.d.ts

@@ -0,0 +1,53 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * The in-process Watchlight policy engine, exposed to JS.
+ *
+ * Wraps the real wl-apdp `AuthzService` over in-memory storage. `Rc` (not
+ * `Arc`) because wasm is single-threaded; each async method clones the handle
+ * into a `'static` future so the returned Promise never borrows `self`.
+ */
+export class PolicyEngine {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * Load a Cedar policy. `policy_json` is the wl-apdp [`Policy`] shape — at
+     * minimum `{"name": ..., "code": "<cedar>"}`. `id`/`active`/timestamps are
+     * defaulted so a developer never hand-writes them (mirrors the PyO3
+     * binding). Runs the REAL validation + load path.
+     */
+    addPolicy(policy_json: string): Promise<any>;
+    /**
+     * Attenuate a requested sub-agent scope against a parent's granted scope
+     * via the REAL strict-subset validator (M43-C `validate_strict_subset`).
+     * Synchronous — the validator does no I/O. Returns a JSON string:
+     * `{"decision":"Allow","granted_scope":{...}}` or
+     * `{"decision":"Deny","reason":"...","violations":[...]}`. Fail-closed.
+     *
+     * Developer-Edition simplification (identical to the PyO3 binding):
+     * single-tenant and no tenant time-budget ceiling — cross-tenant isolation
+     * and tenant-budget clamps are the Enterprise control plane's concern.
+     */
+    attenuateScope(parent_scope_json: string, requested_scope_json: string): string;
+    /**
+     * Authorize a request; resolves to the [`AuthorizationResponse`] JSON
+     * string (`decision`, `reason`, `details`, ...). Drives the FULL
+     * production pipeline in-process and is fail-closed: an unmatched request
+     * denies. JS: `const resp = JSON.parse(await engine.authorize(reqJson));`.
+     */
+    authorize(request_json: string): Promise<any>;
+    /**
+     * Build an in-process engine over in-memory storage (no Postgres, no
+     * network). Async because `AuthzService::new` is async — JS calls it as
+     * `const engine = await PolicyEngine.create();`.
+     */
+    static create(): Promise<any>;
+}
+
+/**
+ * The crate version — a trivial smoke function to confirm the module loads and
+ * the real core linked.
+ */
+export function version(): string;

package/wasm/wl_apdp_wasm.js

@@ -0,0 +1,431 @@
+/* @ts-self-types="./wl_apdp_wasm.d.ts" */
+
+/**
+ * The in-process Watchlight policy engine, exposed to JS.
+ *
+ * Wraps the real wl-apdp `AuthzService` over in-memory storage. `Rc` (not
+ * `Arc`) because wasm is single-threaded; each async method clones the handle
+ * into a `'static` future so the returned Promise never borrows `self`.
+ */
+class PolicyEngine {
+    static __wrap(ptr) {
+        const obj = Object.create(PolicyEngine.prototype);
+        obj.__wbg_ptr = ptr;
+        PolicyEngineFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        PolicyEngineFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_policyengine_free(ptr, 0);
+    }
+    /**
+     * Load a Cedar policy. `policy_json` is the wl-apdp [`Policy`] shape — at
+     * minimum `{"name": ..., "code": "<cedar>"}`. `id`/`active`/timestamps are
+     * defaulted so a developer never hand-writes them (mirrors the PyO3
+     * binding). Runs the REAL validation + load path.
+     * @param {string} policy_json
+     * @returns {Promise<any>}
+     */
+    addPolicy(policy_json) {
+        const ptr0 = passStringToWasm0(policy_json, wasm.__wbindgen_export3, wasm.__wbindgen_export4);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.policyengine_addPolicy(this.__wbg_ptr, ptr0, len0);
+        return takeObject(ret);
+    }
+    /**
+     * Attenuate a requested sub-agent scope against a parent's granted scope
+     * via the REAL strict-subset validator (M43-C `validate_strict_subset`).
+     * Synchronous — the validator does no I/O. Returns a JSON string:
+     * `{"decision":"Allow","granted_scope":{...}}` or
+     * `{"decision":"Deny","reason":"...","violations":[...]}`. Fail-closed.
+     *
+     * Developer-Edition simplification (identical to the PyO3 binding):
+     * single-tenant and no tenant time-budget ceiling — cross-tenant isolation
+     * and tenant-budget clamps are the Enterprise control plane's concern.
+     * @param {string} parent_scope_json
+     * @param {string} requested_scope_json
+     * @returns {string}
+     */
+    attenuateScope(parent_scope_json, requested_scope_json) {
+        let deferred4_0;
+        let deferred4_1;
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            const ptr0 = passStringToWasm0(parent_scope_json, wasm.__wbindgen_export3, wasm.__wbindgen_export4);
+            const len0 = WASM_VECTOR_LEN;
+            const ptr1 = passStringToWasm0(requested_scope_json, wasm.__wbindgen_export3, wasm.__wbindgen_export4);
+            const len1 = WASM_VECTOR_LEN;
+            wasm.policyengine_attenuateScope(retptr, this.__wbg_ptr, ptr0, len0, ptr1, len1);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            var r3 = getDataViewMemory0().getInt32(retptr + 4 * 3, true);
+            var ptr3 = r0;
+            var len3 = r1;
+            if (r3) {
+                ptr3 = 0; len3 = 0;
+                throw takeObject(r2);
+            }
+            deferred4_0 = ptr3;
+            deferred4_1 = len3;
+            return getStringFromWasm0(ptr3, len3);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+            wasm.__wbindgen_export5(deferred4_0, deferred4_1, 1);
+        }
+    }
+    /**
+     * Authorize a request; resolves to the [`AuthorizationResponse`] JSON
+     * string (`decision`, `reason`, `details`, ...). Drives the FULL
+     * production pipeline in-process and is fail-closed: an unmatched request
+     * denies. JS: `const resp = JSON.parse(await engine.authorize(reqJson));`.
+     * @param {string} request_json
+     * @returns {Promise<any>}
+     */
+    authorize(request_json) {
+        const ptr0 = passStringToWasm0(request_json, wasm.__wbindgen_export3, wasm.__wbindgen_export4);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.policyengine_authorize(this.__wbg_ptr, ptr0, len0);
+        return takeObject(ret);
+    }
+    /**
+     * Build an in-process engine over in-memory storage (no Postgres, no
+     * network). Async because `AuthzService::new` is async — JS calls it as
+     * `const engine = await PolicyEngine.create();`.
+     * @returns {Promise<any>}
+     */
+    static create() {
+        const ret = wasm.policyengine_create();
+        return takeObject(ret);
+    }
+}
+if (Symbol.dispose) PolicyEngine.prototype[Symbol.dispose] = PolicyEngine.prototype.free;
+exports.PolicyEngine = PolicyEngine;
+
+/**
+ * The crate version — a trivial smoke function to confirm the module loads and
+ * the real core linked.
+ * @returns {string}
+ */
+function version() {
+    let deferred1_0;
+    let deferred1_1;
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        wasm.version(retptr);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        deferred1_0 = r0;
+        deferred1_1 = r1;
+        return getStringFromWasm0(r0, r1);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+        wasm.__wbindgen_export5(deferred1_0, deferred1_1, 1);
+    }
+}
+exports.version = version;
+function __wbg_get_imports() {
+    const import0 = {
+        __proto__: null,
+        __wbg___wbindgen_is_function_5e4570eb24ffa122: function(arg0) {
+            const ret = typeof(getObject(arg0)) === 'function';
+            return ret;
+        },
+        __wbg___wbindgen_is_undefined_6cff064c44e0d823: function(arg0) {
+            const ret = getObject(arg0) === undefined;
+            return ret;
+        },
+        __wbg___wbindgen_throw_bb96b2010945f0bc: function(arg0, arg1) {
+            throw new Error(getStringFromWasm0(arg0, arg1));
+        },
+        __wbg__wbg_cb_unref_be22cc64ae6946a0: function(arg0) {
+            getObject(arg0)._wbg_cb_unref();
+        },
+        __wbg_call_35dba3c747ad7521: function() { return handleError(function (arg0, arg1, arg2) {
+            const ret = getObject(arg0).call(getObject(arg1), getObject(arg2));
+            return addHeapObject(ret);
+        }, arguments); },
+        __wbg_getRandomValues_26c0cdf963e46393: function() { return handleError(function (arg0, arg1) {
+            globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
+        }, arguments); },
+        __wbg_getTime_63fb0332e6c4ec17: function(arg0) {
+            const ret = getObject(arg0).getTime();
+            return ret;
+        },
+        __wbg_new_0_f117d868b403dc07: function() {
+            const ret = new Date();
+            return addHeapObject(ret);
+        },
+        __wbg_new_typed_cceaf62d8d95e9f2: function(arg0, arg1) {
+            try {
+                var state0 = {a: arg0, b: arg1};
+                var cb0 = (arg0, arg1) => {
+                    const a = state0.a;
+                    state0.a = 0;
+                    try {
+                        return __wasm_bindgen_func_elem_3775(a, state0.b, arg0, arg1);
+                    } finally {
+                        state0.a = a;
+                    }
+                };
+                const ret = new Promise(cb0);
+                return addHeapObject(ret);
+            } finally {
+                state0.a = 0;
+            }
+        },
+        __wbg_now_e7c6795a7f81e10f: function(arg0) {
+            const ret = getObject(arg0).now();
+            return ret;
+        },
+        __wbg_performance_3fcf6e32a7e1ed0a: function(arg0) {
+            const ret = getObject(arg0).performance;
+            return addHeapObject(ret);
+        },
+        __wbg_policyengine_new: function(arg0) {
+            const ret = PolicyEngine.__wrap(arg0);
+            return addHeapObject(ret);
+        },
+        __wbg_queueMicrotask_ac694eae12e92dfb: function(arg0) {
+            queueMicrotask(getObject(arg0));
+        },
+        __wbg_queueMicrotask_be5fe34a8f4cad4d: function(arg0) {
+            const ret = getObject(arg0).queueMicrotask;
+            return addHeapObject(ret);
+        },
+        __wbg_resolve_020f95d838c6ef25: function(arg0) {
+            const ret = Promise.resolve(getObject(arg0));
+            return addHeapObject(ret);
+        },
+        __wbg_static_accessor_GLOBAL_THIS_466428f93b4eaa76: function() {
+            const ret = typeof globalThis === 'undefined' ? null : globalThis;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_GLOBAL_c7aea38d4de089bc: function() {
+            const ret = typeof global === 'undefined' ? null : global;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_SELF_42d4fae05e59267a: function() {
+            const ret = typeof self === 'undefined' ? null : self;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_static_accessor_WINDOW_e0db14a0eba6a812: function() {
+            const ret = typeof window === 'undefined' ? null : window;
+            return isLikeNone(ret) ? 0 : addHeapObject(ret);
+        },
+        __wbg_then_7026b513a94278a8: function(arg0, arg1) {
+            const ret = getObject(arg0).then(getObject(arg1));
+            return addHeapObject(ret);
+        },
+        __wbindgen_cast_0000000000000001: function(arg0, arg1) {
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 477, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, __wasm_bindgen_func_elem_3744);
+            return addHeapObject(ret);
+        },
+        __wbindgen_cast_0000000000000002: function(arg0, arg1) {
+            // Cast intrinsic for `Ref(String) -> Externref`.
+            const ret = getStringFromWasm0(arg0, arg1);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_clone_ref: function(arg0) {
+            const ret = getObject(arg0);
+            return addHeapObject(ret);
+        },
+        __wbindgen_object_drop_ref: function(arg0) {
+            takeObject(arg0);
+        },
+    };
+    return {
+        __proto__: null,
+        "./wl_apdp_wasm_bg.js": import0,
+    };
+}
+
+function __wasm_bindgen_func_elem_3744(arg0, arg1, arg2) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        wasm.__wasm_bindgen_func_elem_3744(retptr, arg0, arg1, addHeapObject(arg2));
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        if (r1) {
+            throw takeObject(r0);
+        }
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+
+function __wasm_bindgen_func_elem_3775(arg0, arg1, arg2, arg3) {
+    wasm.__wasm_bindgen_func_elem_3775(arg0, arg1, addHeapObject(arg2), addHeapObject(arg3));
+}
+
+const PolicyEngineFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_policyengine_free(ptr, 1));
+
+function addHeapObject(obj) {
+    if (heap_next === heap.length) heap.push(heap.length + 1);
+    const idx = heap_next;
+    heap_next = heap[idx];
+
+    heap[idx] = obj;
+    return idx;
+}
+
+const CLOSURE_DTORS = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(state => wasm.__wbindgen_export2(state.a, state.b));
+
+function dropObject(idx) {
+    if (idx < 1028) return;
+    heap[idx] = heap_next;
+    heap_next = idx;
+}
+
+function getArrayU8FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+
+let cachedDataViewMemory0 = null;
+function getDataViewMemory0() {
+    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+    }
+    return cachedDataViewMemory0;
+}
+
+function getStringFromWasm0(ptr, len) {
+    return decodeText(ptr >>> 0, len);
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function getObject(idx) { return heap[idx]; }
+
+function handleError(f, args) {
+    try {
+        return f.apply(this, args);
+    } catch (e) {
+        wasm.__wbindgen_export(addHeapObject(e));
+    }
+}
+
+let heap = new Array(1024).fill(undefined);
+heap.push(undefined, null, true, false);
+
+let heap_next = heap.length;
+
+function isLikeNone(x) {
+    return x === undefined || x === null;
+}
+
+function makeMutClosure(arg0, arg1, f) {
+    const state = { a: arg0, b: arg1, cnt: 1 };
+    const real = (...args) => {
+
+        // First up with a closure we increment the internal reference
+        // count. This ensures that the Rust closure environment won't
+        // be deallocated while we're invoking it.
+        state.cnt++;
+        const a = state.a;
+        state.a = 0;
+        try {
+            return f(a, state.b, ...args);
+        } finally {
+            state.a = a;
+            real._wbg_cb_unref();
+        }
+    };
+    real._wbg_cb_unref = () => {
+        if (--state.cnt === 0) {
+            wasm.__wbindgen_export2(state.a, state.b);
+            state.a = 0;
+            CLOSURE_DTORS.unregister(state);
+        }
+    };
+    CLOSURE_DTORS.register(real, state, state);
+    return real;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeObject(idx) {
+    const ret = getObject(idx);
+    dropObject(idx);
+    return ret;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+cachedTextDecoder.decode();
+function decodeText(ptr, len) {
+    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+const wasmPath = `${__dirname}/wl_apdp_wasm_bg.wasm`;
+const wasmBytes = require('fs').readFileSync(wasmPath);
+const wasmModule = new WebAssembly.Module(wasmBytes);
+let wasmInstance = new WebAssembly.Instance(wasmModule, __wbg_get_imports());
+let wasm = wasmInstance.exports;