drupal-mcp-connector 2.10.1 → 2.12.0

package/CHANGELOG.md

@@ -7,6 +7,70 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.12.0] - 2026-09-02
+
+### Security
+- **W&L-operated policy-bundle promotion on the relay edge (#253).** Optional
+  `auth.promotions` maps a SHA-256 digest to a sealed portable document plus
+  two distinct operator ids. Eligible documents fan down the tenant-agent
+  channel after hello; the agent presents them to local enforcement
+  (verify / activate / attest). When the table is present, non-diagnostic
+  `tools/call` requires the bound `auth.policies` digest **and** a matching
+  agent attestation. The edge never mints a Sentinel HMAC key. Omitting
+  `auth.promotions` keeps the digest-only path. Lab/loopback only — not
+  tenant self-service or a hosted-service claim.
+
+## [2.11.0] - 2026-09-02
+
+### Security
+- **Expected policy digest on the relay edge (#250).** Optional
+  `auth.policies` maps inbound `sub` (then `azp`) to a SHA-256 digest.
+  When that table is present, non-diagnostic `tools/call` without a
+  mapping is `not_entitled` with no frames (including a call that omits
+  the tool name, and even when no agent is connected). The granted digest
+  is stamped on `identity.policy` and `correlation.policyDigest`. Caller
+  `policy` / `digest` arguments are ignored and stripped. Diagnostic
+  tools stay callable. Omitting `auth.policies` keeps the prior path.
+  Lab/loopback only — not dual-control promotion, bundle distribution, or
+  a hosted-service claim.
+- **Principal → Drupal actor mapping on the relay edge (#247).** Optional
+  `auth.actors` maps inbound `sub` (then `azp`) to a Drupal user UUID. When
+  that table is present, write-like `tools/call` without a mapping is
+  `not_entitled` with no frames. The granted actor is stamped on
+  `identity.actor`; JWT `act.sub` is a confirming hint inside `delegators`
+  and becomes `identity.delegator`. Caller `actor` / `delegator` arguments
+  and spoofable identity headers are ignored and stripped from the framed
+  body. JSON:API writes attach `relationships.uid` from the grant. The
+  northbound JWT is never the southbound Drupal credential. Omitting
+  `auth.actors` keeps writes on the site OAuth consumer's owner. Lab/loopback
+  only — not a live revision-uid or public-URL claim.
+- **Authoritative tenant routing on the relay edge (#244).** Optional
+  `auth.tenantGrants` maps inbound client id to tenant agent ids. When that
+  table is present, the edge selects the tenant from the grant (JWT `azp`),
+  not from caller `tenant` / `site` input. A hint for another tenant is
+  `not_entitled` with no frames on any tunnel. The granted tenant is stamped
+  on `identity.tenant` and on `correlation: { requestId, tenant, target,
+  source }`; the caller `tenant` argument is stripped from the framed body.
+  `drupal_list_sites` reports grant-sourced `tenants`. Installs without
+  `tenantGrants` keep the site-derived unique-agent path. Lab/loopback
+  token-resolved tenancy only — not a public hostname or path-prefix claim.
+- **Two-tenant isolation on the relay edge (#242).** The edge keeps one
+  agent-channel session per `agentId` instead of replacing the previous
+  tenant. Channel records may bind `sites` (catalog names); that bind is
+  the tenant boundary. A second unscoped agent is denied `unbound_tenant`,
+  overlapping site claims are denied `overlapping_tenant`, and fan-down
+  selects the unique agent granted to the northbound principal. Cross-tenant
+  hints still fail closed before any frame reaches the wrong process. A
+  tenant disconnect rejects only that tenant's in-flight requests. A
+  spoofed `mcp-response` from another agent cannot complete the wait.
+  A hot-reload that changes a connected agent's `sites` bind drops that
+  tunnel on the next request (`no_agent`) instead of routing on the stale
+  hello snapshot.
+  Fan-down frames carry `{ requestId, tenant, target, source }` correlation
+  and still never carry site secrets, the channel token, or the northbound JWT. A single
+  unscoped agent remains the previous compatibility path. Lab/loopback
+  proof only — not a hosted-service or public-URL claim.
+
 ## [2.10.1] - 2026-08-28
 
 ### Fixed
@@ -1329,6 +1393,8 @@ The connector is now **dual-protocol**: every tool runs against an abstract back
 - User tools gained explicit PII-access assertions.
 - Whole tree lint-clean (`npm run lint`) with object-injection sinks rewritten to safe lookups.
 
+[2.12.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.12.0
+[2.11.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.11.0
 [2.10.1]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v2.10.1
 [1.0.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v1.0.0
 [0.10.0]: https://github.com/Wilkes-Liberty/drupal-mcp-connector/releases/tag/v0.10.0

package/bin/drupal-mcp-edge.js

@@ -16,7 +16,10 @@
  *   MCP_CHANNEL_CREDENTIALS_FILE
  *                     Agent channel credential store (or config
  *                     relay.channelCredentialsFile). Required. JSON:
- *                     {"agents": {"<id>": {"tokenSha256": "<hex>"}}}
+ *                     {"agents": {"<id>": {"tokenSha256": "<hex>",
+ *                     "sites": ["site-name"]}}}. `sites` binds the tunnel
+ *                     to catalog names (the tenant boundary). Omit `sites`
+ *                     only for a single-agent install.
  *   MCP_EDGE_PORT     Northbound port (default: MCP_PORT / config tls.port).
  *   MCP_EDGE_AGENT_PORT
  *                     Agent channel port (default: northbound port + 1).
@@ -31,12 +34,19 @@
  *                     primary entry point).
  *
  * Config: auth.grants (client id -> [site names]) is mandatory; the edge
- * refuses to start without it.
+ * refuses to start without it. Optional auth.tenantGrants (client id ->
+ * [tenant agent ids]) makes tenant routing grant-authoritative. Optional
+ * auth.actors (sub / azp -> Drupal user UUID) maps the inbound principal
+ * to a Drupal actor for write-like tools. Optional auth.policies
+ * (sub / azp -> SHA-256 digest) is the expected signed policy on the edge.
+ * Optional auth.promotions (digest -> sealed document + two operator ids)
+ * is the W&L-operated dual-control ledger; the edge fans eligible bundles
+ * to the tenant agent and requires a matching local attestation.
  */
 
 import { readFileSync } from "node:fs";
 import process from "node:process";
-import { getInboundGrants, getTlsConfig, loadConfig } from "../src/lib/config.js";
+import { getInboundActors, getInboundGrants, getInboundPolicies, getInboundPromotions, getInboundTenantGrants, getTlsConfig, loadConfig } from "../src/lib/config.js";
 import { resolveInboundAuthConfig } from "../src/lib/http-auth.js";
 import { createRateLimiter } from "../src/lib/rate-limit.js";
 import {
@@ -121,6 +131,10 @@ try {
   edge = await startEdge({
     auth: inboundCfg,
     grants,
+    tenantGrants: getInboundTenantGrants(),
+    actors: getInboundActors(),
+    policies: getInboundPolicies(),
+    promotions: getInboundPromotions(),
     sites,
     defaultSite: config.defaultSite,
     channelCredentials: createChannelCredentialStore({ filePath: channelFile }),

package/config/config.example.json

@@ -32,6 +32,18 @@
     "grants": {
       "_comment": "Optional. Map inbound OAuth client_id (azp) to site names, e.g. \"content-agent\": [\"production\", \"staging\"]. When the map names any client, unknown clients receive no sites. Omit this object (or leave only this comment) to let every resolvable site stay visible; inbound scopes still gate the tool surface."
     },
+    "tenantGrants": {
+      "_comment": "Optional on the library path; used by drupal-mcp-edge for token-resolved tenancy. Map inbound client_id (azp) to tenant agent ids, e.g. \"content-agent\": [\"tenant-a\"]. Caller tenant/site arguments are hints checked against this grant, never authority. Omit to derive the tenant from the unique agent covering the site grant."
+    },
+    "actors": {
+      "_comment": "Optional. Map inbound sub or client_id (azp) to a Drupal user UUID for write authorship, e.g. \"content-agent\": { \"uuid\": \"11111111-1111-4111-8111-111111111111\", \"delegators\": [\"operator-1\"] }. When present, write-like tools/call without a mapping are not_entitled. JWT act.sub is a confirming hint inside delegators. Caller actor/delegator arguments are never authority. Omit to keep writes on the site OAuth consumer's owner account."
+    },
+    "policies": {
+      "_comment": "Optional. Map inbound sub or client_id (azp) to a SHA-256 digest of the expected signed Sentinel policy bundle, e.g. \"content-agent\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\". When present, non-diagnostic tools/call without a mapping are not_entitled. Caller policy/digest arguments are never authority. Omit to keep the prior path (no digest required at the edge). Local verify/activate stays on mcp_sentinel."
+    },
+    "promotions": {
+      "_comment": "Optional W&L-operated dual-control ledger. Map a SHA-256 digest to { document, approvals } where document is the sealed portable Sentinel bundle (claims + digest + hmac-sha256 seal) and approvals is two distinct operator ids. When present, the edge fans eligible documents to the tenant agent; non-diagnostic tools/call require a matching local attestation. The edge never mints a seal. Omit to keep the digest-only path. Tenant self-service is not this table."
+    },
     "revocationFile": "",
     "introspectionUrl": "",
     "introspectionClientIdEnv": "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.10.1",
+  "version": "2.12.0",
   "description": "A secure, multi-site Model Context Protocol (MCP) connector for Drupal — dual-protocol JSON:API and GraphQL.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/backends/jsonapi.js

@@ -8,6 +8,7 @@
  */
 
 import { drupalFetch, drupalUploadFile } from "../drupal-fetch.js";
+import { getRequestIdentity } from "../principal.js";
 import { validateUuid, validateMachineName } from "../validate.js";
 import { parseFieldConfigObject } from "../field-definition.js";
 import { Backend } from "./backend-interface.js";
@@ -134,8 +135,34 @@ function applyFilter(params, { field, op = "eq", value }) {
 }
 
 /**
- * Read/write Backend adapter backed by Drupal core JSON:API.
+ * Bind JSON:API `uid` from the grant-stamped identity. Caller uid is overwritten.
+ * User entities are left unchanged. No actor claim (auth.actors not in effect
+ * for this principal) leaves relationships as-is — the prior, pre-DEV-123 path.
+ * A *present* actor claim that fails UUID validation fails closed (throws)
+ * rather than silently keeping a caller-supplied uid: resolveActor()/
+ * normalizeActors() already validate the shape before stamping identity.actor,
+ * so this should be unreachable in the normal path — it exists so a future
+ * bug upstream of this call can never downgrade into "trust the caller".
+ *
+ * @param {string} entityType
+ * @param {object|undefined} relationships
+ * @returns {object|undefined}
  */
+export function grantActorUid(entityType, relationships) {
+  if (entityType === "user") return relationships;
+  const uuid = getRequestIdentity()?.actor;
+  if (typeof uuid !== "string") return relationships;
+  validateUuid(uuid, "actor");
+  const base = relationships && typeof relationships === "object" && !Array.isArray(relationships)
+    ? relationships
+    : {};
+  return {
+    ...base,
+    uid: { data: { type: "user--user", id: uuid } },
+  };
+}
+
+/** Read/write Backend adapter backed by Drupal core JSON:API. */
 export class JsonApiBackend extends Backend {
   /** @param {object} site Site config (must include `_name`). */
   constructor(site) {
@@ -337,7 +364,8 @@ export class JsonApiBackend extends Backend {
   async createEntity({ entityType, bundle, attributes = {}, relationships }) {
     const buildPayload = (attrs) => {
       const payload = { data: { type: `${entityType}--${bundle}`, attributes: attrs } };
-      if (relationships) payload.data.relationships = relationships;
+      const rels = grantActorUid(entityType, relationships);
+      if (rels) payload.data.relationships = rels;
       return payload;
     };
     const data = await this.writeWithModerationFallback(this.resourcePath(entityType, bundle), "POST", buildPayload, attributes);
@@ -357,7 +385,8 @@ export class JsonApiBackend extends Backend {
     validateUuid(id);
     const buildPayload = (attrs) => {
       const payload = { data: { type: `${entityType}--${bundle}`, id, attributes: attrs } };
-      if (relationships) payload.data.relationships = relationships;
+      const rels = grantActorUid(entityType, relationships);
+      if (rels) payload.data.relationships = rels;
       return payload;
     };
     let path = `${this.resourcePath(entityType, bundle)}/${encodeURIComponent(id)}`;

package/src/lib/config.js

@@ -244,6 +244,70 @@ export function getInboundGrants() {
   return entries.length ? Object.fromEntries(entries) : null;
 }
 
+/**
+ * Server-resolved inbound tenant grants keyed by OAuth client id.
+ * When present, the edge routes by tenant agent id, never by caller input.
+ * A missing or empty map means tenant is derived from site grants (compat).
+ * @returns {object|null}
+ */
+export function getInboundTenantGrants() {
+  const grants = loadConfig().auth?.tenantGrants;
+  if (!grants || typeof grants !== "object" || Array.isArray(grants)) return null;
+  const entries = Object.entries(grants)
+    .filter(([clientId, tenants]) => !clientId.startsWith("_") && Array.isArray(tenants))
+    .map(([clientId, tenants]) => [
+      clientId,
+      [...new Set(
+        tenants.map((id) => String(id).trim()).filter((id) => id && !id.startsWith("_")),
+      )],
+    ]);
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
+/**
+ * Server-resolved inbound actor map keyed by OAuth `sub` or client id.
+ * When present, write-like tools require a mapped Drupal user UUID.
+ * @returns {object|null}
+ */
+export function getInboundActors() {
+  const actors = loadConfig().auth?.actors;
+  if (!actors || typeof actors !== "object" || Array.isArray(actors)) return null;
+  const entries = Object.entries(actors)
+    .map(([key, value]) => [key.trim(), value])
+    .filter(([key]) => key && !key.startsWith("_"));
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
+/**
+ * Server-resolved inbound policy map keyed by OAuth `sub` or client id.
+ * When present, non-diagnostic tools/call require a mapped SHA-256 digest.
+ * @returns {object|null}
+ */
+export function getInboundPolicies() {
+  const policies = loadConfig().auth?.policies;
+  if (!policies || typeof policies !== "object" || Array.isArray(policies)) return null;
+  const entries = Object.entries(policies)
+    .map(([key, value]) => [key.trim(), value])
+    .filter(([key]) => key && !key.startsWith("_"));
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
+/**
+ * W&L-operated dual-control promotion ledger keyed by SHA-256 digest.
+ * When present, the edge fans eligible sealed documents to the tenant agent.
+ * @returns {object|null}
+ */
+export function getInboundPromotions() {
+  const promotions = loadConfig().auth?.promotions;
+  if (!promotions || typeof promotions !== "object" || Array.isArray(promotions)) {
+    return null;
+  }
+  const entries = Object.entries(promotions)
+    .map(([key, value]) => [key.trim(), value])
+    .filter(([key]) => key && !key.startsWith("_"));
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
 // ---------------------------------------------------------------------------
 // Auth headers — never logged, never exposed in tool responses
 // ---------------------------------------------------------------------------

package/src/lib/http-auth.js

@@ -68,7 +68,7 @@ export function scopesFromClaim(scope) {
 /**
  * Freeze a request identity from validated claims. Caller headers are not an input.
  * @param {object} claims
- * @returns {Readonly<{sub: ?string, iss: ?string, aud: string|string[]|null, scopes: readonly string[], sites: readonly string[]|null, exp: ?number, nbf: ?number, jti: ?string, clientId: ?string}>}
+ * @returns {Readonly<{sub: ?string, iss: ?string, aud: string|string[]|null, scopes: readonly string[], sites: readonly string[]|null, exp: ?number, nbf: ?number, jti: ?string, clientId: ?string, actSub: ?string}>}
  */
 export function buildIdentity(claims) {
   const scopes = scopesFromClaim(claims.scope ?? claims.scp);
@@ -95,6 +95,10 @@ export function buildIdentity(claims) {
       && (claims.client_id === undefined || claims.client_id === null)
       ? null
       : String(claims.azp ?? claims.client_id),
+    actSub: (claims.act && typeof claims.act === "object" && !Array.isArray(claims.act)
+      && typeof claims.act.sub === "string" && claims.act.sub.trim())
+      ? claims.act.sub.trim()
+      : null,
   });
 }
 

package/src/lib/policy-enforcement.js

@@ -0,0 +1,268 @@
+/**
+ * Tenant-side local policy enforcement (#253 / DEV-125).
+ *
+ * Loopback stand-in for mcp_sentinel `McpPolicyBundleRegistry`: mint / verify
+ * / activate / simulate / revoke / rollback / emergency deny. The relay edge
+ * never receives the signing key and never calls mint. A missing key cannot
+ * mint, verify, or activate — emergency deny still arms a deny floor without
+ * minting new authority.
+ */
+
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { SEAL_PREFIX } from "./policy-promotion.js";
+
+export const POLICY_BUNDLE_VERSION = 1;
+
+export const DEFAULT_BUNDLE_TTL = 86400 * 30;
+
+export const EMERGENCY_DENY = "*";
+
+export const EMERGENCY_DIGEST = "emergency-deny";
+
+function normalize(value) {
+  if (value === null || typeof value === "string" || typeof value === "number"
+    || typeof value === "boolean") {
+    return value;
+  }
+  if (Array.isArray(value)) return value.map(normalize);
+  if (value && typeof value === "object") {
+    const source = new Map(Object.entries(value));
+    const bag = new Map();
+    for (const key of [...source.keys()].sort()) {
+      bag.set(key, normalize(source.get(key)));
+    }
+    return Object.fromEntries(bag);
+  }
+  throw new TypeError("Policy bundle claims may only contain scalars, lists and maps.");
+}
+
+/**
+ * Canonical JSON of claims (HMAC / digest input). Maps are key-sorted;
+ * lists keep caller order. Matches mcp_sentinel `McpPolicyBundle::canonicalJson`.
+ *
+ * @param {object} claims
+ * @returns {string}
+ */
+export function canonicalJson(claims) {
+  return JSON.stringify(normalize(claims));
+}
+
+/**
+ * Hex SHA-256 of the canonical claims.
+ *
+ * @param {object} claims
+ * @returns {string}
+ */
+export function digestOf(claims) {
+  return createHash("sha256").update(canonicalJson(claims)).digest("hex");
+}
+
+function safeEqual(left, right) {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+function deniedOperationsOf(claims) {
+  const denials = new Map(Object.entries(claims ?? {})).get("denials");
+  if (!denials || typeof denials !== "object" || Array.isArray(denials)) return [];
+  const ops = new Map(Object.entries(denials)).get("operations");
+  if (!Array.isArray(ops)) return [];
+  return ops.map(String);
+}
+
+function bundleFrom(claims, digest, seal) {
+  return Object.freeze({
+    claims,
+    digest,
+    seal,
+    version: () => Number(new Map(Object.entries(claims)).get("v") ?? 0),
+    expires: () => Number(new Map(Object.entries(claims)).get("expires") ?? 0),
+    deniedOperations: () => deniedOperationsOf(claims),
+    denies: (operation) => deniedOperationsOf(claims).includes(operation),
+    isExpired: (now) => {
+      const expires = Number(new Map(Object.entries(claims)).get("expires") ?? 0);
+      return expires > 0 && now >= expires;
+    },
+    toArray: () => ({ ...claims, digest, seal }),
+  });
+}
+
+/**
+ * In-process local enforcement used by the tenant agent in the loopback lab.
+ *
+ * @param {object} [options]
+ * @param {string|null} [options.signingKey] HMAC material. Null = disconnected.
+ * @param {() => number} [options.now] Unix seconds.
+ * @returns {object}
+ */
+export function createLocalPolicyEnforcement({
+  signingKey = null,
+  now = () => Math.floor(Date.now() / 1000),
+} = {}) {
+  let active = null;
+  let lastGood = null;
+  const revoked = new Map();
+
+  function canSeal() {
+    return typeof signingKey === "string" && signingKey.length > 0;
+  }
+
+  function isRevoked(digest) {
+    return revoked.has(digest);
+  }
+
+  function mint(deniedOperations = [], ttl = DEFAULT_BUNDLE_TTL) {
+    if (!canSeal()) return null;
+    const issued = now();
+    const unique = [...new Set((Array.isArray(deniedOperations) ? deniedOperations : [])
+      .map(String))];
+    const claims = {
+      denials: { operations: unique },
+      expires: issued + (ttl ?? DEFAULT_BUNDLE_TTL),
+      id: randomUUID(),
+      issued,
+      v: POLICY_BUNDLE_VERSION,
+    };
+    const digest = digestOf(claims);
+    const seal = SEAL_PREFIX + createHmac("sha256", signingKey).update(digest).digest("hex");
+    return bundleFrom(claims, digest, seal);
+  }
+
+  function verify(document) {
+    if (!canSeal()) return null;
+    if (!document || typeof document !== "object" || Array.isArray(document)) return null;
+    const bag = new Map(Object.entries(document));
+    const seal = bag.get("seal");
+    const claimedDigest = bag.get("digest");
+    bag.delete("seal");
+    bag.delete("digest");
+    const claims = Object.fromEntries(bag);
+    if (typeof seal !== "string" || !seal.startsWith(SEAL_PREFIX)) return null;
+    if (Number(new Map(Object.entries(claims)).get("v") ?? 0) !== POLICY_BUNDLE_VERSION) {
+      return null;
+    }
+    const digest = digestOf(claims);
+    if (!safeEqual(digest, typeof claimedDigest === "string" ? claimedDigest : "")) return null;
+    const expected = SEAL_PREFIX
+      + createHmac("sha256", signingKey).update(digest).digest("hex");
+    if (!safeEqual(expected, seal)) return null;
+    const bundle = bundleFrom(claims, digest, seal);
+    if (bundle.isExpired(now())) return null;
+    if (isRevoked(digest)) return null;
+    return bundle;
+  }
+
+  function attestation() {
+    return active;
+  }
+
+  function activeDigest() {
+    const digest = active && typeof active.digest === "string" ? active.digest : null;
+    return digest || null;
+  }
+
+  function emergencyDeny() {
+    if (active && typeof active.digest === "string") lastGood = active;
+    active = {
+      digest: EMERGENCY_DIGEST,
+      activated_at: now(),
+      previous: active && typeof active.digest === "string" ? active.digest : null,
+      emergency: true,
+      bundle: {
+        v: POLICY_BUNDLE_VERSION,
+        denials: { operations: [EMERGENCY_DENY] },
+        expires: 0,
+        id: EMERGENCY_DIGEST,
+        issued: now(),
+      },
+    };
+  }
+
+  function activateBundle(bundle) {
+    if (!canSeal() || !bundle) return null;
+    if (active && typeof active.digest === "string") lastGood = active;
+    const previous = active && typeof active.digest === "string" ? active.digest : null;
+    active = {
+      digest: bundle.digest,
+      activated_at: now(),
+      previous,
+      bundle: bundle.toArray(),
+    };
+    return {
+      digest: bundle.digest,
+      activated_at: active.activated_at,
+      previous,
+    };
+  }
+
+  /**
+   * Verify then activate a portable document. This is the agent hook.
+   *
+   * @param {object} document
+   * @returns {{ok: boolean, digest?: string, attested?: boolean, reason?: string}}
+   */
+  function activate(document) {
+    const bundle = verify(document);
+    if (!bundle) return { ok: false, reason: "unverified" };
+    const result = activateBundle(bundle);
+    if (!result) return { ok: false, reason: "cannot_activate" };
+    return { ok: true, digest: result.digest, attested: true };
+  }
+
+  function simulate(operation, localDenies, candidate = null) {
+    const digest = candidate?.digest ?? activeDigest();
+    if (localDenies) {
+      return { allow: false, reason: "local_deny", digest };
+    }
+    if (candidate === null && active && active.emergency) {
+      return {
+        allow: false,
+        reason: "emergency_deny",
+        digest: digest ?? EMERGENCY_DIGEST,
+      };
+    }
+    let bundle = candidate;
+    if (bundle === null) {
+      const document = active?.bundle ?? null;
+      bundle = document ? verify(document) : null;
+      if (bundle === null && digest) {
+        return { allow: false, reason: "bundle_unverified", digest };
+      }
+    }
+    if (bundle && (bundle.denies(operation) || bundle.denies(EMERGENCY_DENY))) {
+      return { allow: false, reason: "bundle_deny", digest: bundle.digest };
+    }
+    return { allow: true, reason: "allow", digest };
+  }
+
+  function revoke(digest) {
+    if (typeof digest !== "string" || !digest) return;
+    revoked.set(digest, now());
+    if (activeDigest() === digest) emergencyDeny();
+  }
+
+  function rollback() {
+    if (!lastGood || typeof lastGood.digest !== "string") return null;
+    if (isRevoked(lastGood.digest)) return null;
+    active = lastGood;
+    return lastGood;
+  }
+
+  return {
+    canSeal,
+    mint,
+    verify,
+    activate,
+    activateBundle,
+    attestation,
+    activeDigest,
+    simulate,
+    revoke,
+    rollback,
+    emergencyDeny,
+    isRevoked,
+  };
+}