protect-mcp 0.9.5 → 0.9.7

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.9.6: policy you can see and change
+
+The gate is default-deny and fail-closed, but a deny used to be a dead end: an
+empty reason and no pointer to the file that decides. This release makes the
+policy legible and editable from the terminal, and lets a running gate pick up
+a policy change without a restart.
+
+- **`policy` command.** `policy list` shows every tool named in the policy
+  (permit / forbid / default-deny) cross-referenced with how often the gate
+  actually allowed or denied it; `policy show` prints the active policy and its
+  digest; `policy allow <tool>` / `policy deny <tool>` append a Cedar rule and
+  print the digest change; `policy path` prints the file. Idempotent and
+  tool-name validated.
+- **Denies that teach.** A blocked call now says whether it was default-deny
+  (no permit matched) or an explicit forbid, names the policy directory, and
+  gives the exact fix: `npx protect-mcp policy allow <tool>`.
+- **Hot reload.** `protect-mcp serve` watches the .cedar files and reloads the
+  policy on an on-disk change, so `policy allow/deny` (or a hand edit) takes
+  effect without restarting the gate. Fail-closed: an unparseable edit keeps the
+  previous policy rather than opening the gate, and the reload is logged.
+
 ## 0.9.5: replayable from scratch
 
 The public demo film (legate.scopeblind.com/record) is now reproducible by

package/README.md

@@ -57,6 +57,36 @@ The dashboard binds to `127.0.0.1`, reads only local log/receipt files, and does
 not upload anything. Use `npx protect-mcp connect` only if you explicitly want a
 hosted ScopeBlind dashboard.
 
+## The gate as an MCP server
+
+If you would rather call the gate as tools than wire the Claude Code hooks, run
+it as an MCP server:
+
+```bash
+npx protect-mcp mcp
+```
+
+It speaks MCP over stdio and exposes four read-only tools, the whole loop:
+
+- **`evaluate_action`**: decide a proposed tool call against an inline Cedar policy, fail-closed (any policy error is DENY). Returns `{ allowed, decision, reason, policy_digest }`.
+- **`sign_decision`**: turn a decision into an Ed25519 signed receipt (a denial signs a `gateway_restraint`, an allow a `decision_receipt`). Returns the receipt and its public key; generates an ephemeral key if you do not supply one.
+- **`verify_receipt`**: verify a signed receipt offline against a public key. Returns `{ valid, error, type, kid, issuer }`.
+- **`self_test`**: prove it, no inputs. A known-forbidden action is denied, then a signed receipt round-trips and a tampered copy fails.
+
+Point any MCP host at it, for example Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "protect-mcp": { "command": "npx", "args": ["-y", "protect-mcp", "mcp"] }
+  }
+}
+```
+
+Receipts are byte-compatible with the ones the gate signs at runtime, so a
+receipt minted here verifies with [`@veritasacta/verify`](https://www.npmjs.com/package/@veritasacta/verify)
+and the browser verifier just the same.
+
 ### Local Action Dashboard
 
 `protect-mcp dashboard` is the operator view for moving from visibility to
@@ -187,6 +217,8 @@ reveals the shape, not the content.
 
 ## Try it in 60 seconds (no agent required)
 
+[![Watch the two-minute demo film](https://legate.scopeblind.com/media/scopeblind-demo-poster.jpg)](https://legate.scopeblind.com/record)
+
 Watch the two-minute film at [legate.scopeblind.com/record](https://legate.scopeblind.com/record), then replay it against your own copy:
 
 ```bash
@@ -387,6 +419,7 @@ To report a vulnerability, see [SECURITY.md](./SECURITY.md).
 | `serve` | Start the HTTP hook server for Claude Code (port 9377). `--enforce` runs the restraint self-test first; `--cedar <dir>` and `--policy <path>` select the policy. |
 | `init` | Generate an Ed25519 keypair (`keys/gateway.json`), a config template, and a sample policy. |
 | `sample` | Seed a clearly-labeled sample record (8 decisions: one blocked call, two payments; kid `sample-demo`) plus a tampered copy, so `record`, `claim`, `verify-claim`, and `anchor-record` are replayable from scratch before wiring an agent. Refuses to touch an existing record; `--force` overrides. |
+| `policy` | See and change the Cedar policy from the terminal: `policy list` (permit / forbid / default-deny per tool, with how often the gate allowed or denied it), `policy show`, `policy allow <tool>`, `policy deny <tool>`, `policy path`. A running `serve` hot-reloads on the change. |
 | `wrap` | Print a protected MCP command or patch Claude Desktop MCP servers. Dry-run by default; use `--write` to update Claude Desktop config. |
 | `dashboard` | Start a local-only dashboard on `127.0.0.1` showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
 | `recommend` | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use `--write` to create `protect-mcp.recommended.json`. |

package/dist/{chunk-H332ZNJ6.mjs → chunk-AUUAVWQM.mjs}

@@ -5,22 +5,24 @@ import {
   ReceiptBuffer,
   buildActionReadback,
   checkRateLimit,
-  evaluateCedar,
   getSignerInfo,
   getToolPolicy,
   initSigning,
-  isCedarAvailable,
   isSigningEnabled,
-  loadCedarPolicies,
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
+import {
+  evaluateCedar,
+  isCedarAvailable,
+  loadCedarPolicies
+} from "./chunk-MWXDXYWH.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
 import { createHash, randomUUID, randomBytes } from "crypto";
-import { appendFileSync, readFileSync, existsSync, readdirSync } from "fs";
+import { appendFileSync, readFileSync, existsSync, readdirSync, statSync } from "fs";
 import { join } from "path";
 
 // src/scopeblind-bridge.ts
@@ -256,6 +258,7 @@ async function handlePreToolUse(input, state) {
     ...input.teamName && { team_name: input.teamName },
     ...input.agentType && { agent_type: input.agentType }
   };
+  maybeReloadCedar(state);
   if (state.cedarPolicies) {
     try {
       const cedarDecision = await evaluateCedar(state.cedarPolicies, {
@@ -293,10 +296,13 @@ async function handlePreToolUse(input, state) {
           sandbox_state: detectSandboxState(),
           plan_receipt_id: state.activePlanReceiptId || void 0
         });
+        const isDefaultDeny = !reason || reason === "cedar_deny" || /reason":\[\]/.test(reason);
+        const policyRef = state.cedarDir ? ` Policy: ${state.cedarDir}.` : "";
+        const howTo = isDefaultDeny ? ` No permit matched (default-deny, fail-closed).${policyRef} Allow it: npx protect-mcp policy allow ${toolName}` : ` Blocked by an explicit forbid rule.${policyRef} Review: npx protect-mcp policy show`;
         if (denyCount === 1) {
           process.stderr.write(
-            `[PROTECT_MCP] No Cedar permit for "${toolName}" \u2014 suggest:
-  ${suggestion}
+            `[PROTECT_MCP] Denied "${toolName}" (${isDefaultDeny ? "default-deny" : "forbid"}).
+  Allow with: npx protect-mcp policy allow ${toolName}
 `
           );
         }
@@ -304,7 +310,7 @@ async function handlePreToolUse(input, state) {
           hookSpecificOutput: {
             hookEventName: "PreToolUse",
             permissionDecision: "deny",
-            permissionDecisionReason: `[ScopeBlind] Denied by Cedar policy. ${reason}. Forbidden: "${toolName}" is not permitted. Try a read-only alternative.` + (denyCount > 1 ? ` (attempt ${denyCount})` : "")
+            permissionDecisionReason: `[ScopeBlind] Denied "${toolName}".${howTo}` + (denyCount > 1 ? ` (attempt ${denyCount})` : "")
           }
         };
       }
@@ -803,6 +809,9 @@ async function startHookServer(options = {}) {
   }
   const state = {
     cedarPolicies,
+    cedarDir: cedarDir || null,
+    cedarMtimeMs: cedarDir ? newestCedarMtime(cedarDir) : 0,
+    cedarCheckedMs: 0,
     jsonPolicy,
     rateLimitStore: /* @__PURE__ */ new Map(),
     receiptBuffer: new ReceiptBuffer(),
@@ -993,6 +1002,40 @@ async function startHookServer(options = {}) {
   process.on("SIGTERM", shutdown);
   return server;
 }
+function newestCedarMtime(dir) {
+  try {
+    let newest = 0;
+    for (const f of readdirSync(dir)) {
+      if (!f.endsWith(".cedar")) continue;
+      const m = statSync(join(dir, f)).mtimeMs;
+      if (m > newest) newest = m;
+    }
+    return newest;
+  } catch {
+    return 0;
+  }
+}
+var CEDAR_CHECK_THROTTLE_MS = 2e3;
+function maybeReloadCedar(state) {
+  if (!state.cedarDir) return;
+  const nowMs = Date.now();
+  if (nowMs - state.cedarCheckedMs < CEDAR_CHECK_THROTTLE_MS) return;
+  state.cedarCheckedMs = nowMs;
+  const m = newestCedarMtime(state.cedarDir);
+  if (m <= state.cedarMtimeMs) return;
+  try {
+    const reloaded = loadCedarPolicies(state.cedarDir);
+    state.cedarPolicies = reloaded;
+    state.policyDigest = reloaded.digest;
+    state.cedarMtimeMs = m;
+    process.stderr.write(`[PROTECT_MCP] Cedar policy reloaded (digest: ${reloaded.digest}) after on-disk change.
+`);
+  } catch (err) {
+    process.stderr.write(`[PROTECT_MCP] Cedar reload failed, keeping the previous policy: ${err instanceof Error ? err.message : err}
+`);
+    state.cedarMtimeMs = m;
+  }
+}
 function findCedarDir() {
   for (const candidate of ["cedar", "policies", "."]) {
     try {

package/dist/{chunk-XLJUZ4WO.mjs → chunk-G6X763MH.mjs}

@@ -236,213 +236,10 @@ function isSigningEnabled() {
   return signingConfigured && signingInitError === null && signerState !== null && artifactsModule !== null;
 }
 
-// src/cedar-evaluator.ts
-import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync3, readdirSync, existsSync as existsSync2 } from "fs";
-import { join, extname } from "path";
-var cedarWasm = null;
-var loadAttempted = false;
-async function ensureCedarWasm() {
-  if (cedarWasm) return true;
-  if (loadAttempted) return false;
-  loadAttempted = true;
-  try {
-    const moduleName = "@cedar-policy/cedar-wasm";
-    cedarWasm = await import(
-      /* @vite-ignore */
-      moduleName
-    );
-    return true;
-  } catch {
-    return false;
-  }
-}
-function loadCedarPolicies(dirPath) {
-  if (!existsSync2(dirPath)) {
-    throw new Error(`Cedar policy directory not found: ${dirPath}`);
-  }
-  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
-  if (entries.length === 0) {
-    throw new Error(`No .cedar files found in: ${dirPath}`);
-  }
-  const sources = [];
-  for (const file of entries) {
-    const content = readFileSync3(join(dirPath, file), "utf-8");
-    sources.push(content);
-  }
-  const concatenated = sources.join("\n\n");
-  const digest = createHash2("sha256").update(concatenated).digest("hex").slice(0, 16);
-  return {
-    source: concatenated,
-    digest,
-    fileCount: entries.length,
-    files: entries
-  };
-}
-function buildEntities(req) {
-  const agentId = req.agentId || req.tier;
-  return [
-    {
-      uid: { type: "Agent", id: agentId },
-      attrs: {
-        tier: req.tier,
-        ...req.agentId ? { agent_id: req.agentId } : {}
-      },
-      parents: []
-    },
-    {
-      uid: { type: "Tool", id: req.tool },
-      attrs: {},
-      parents: []
-    }
-  ];
-}
-function onEvalError(reason, failClosed, extra) {
-  return {
-    allowed: !failClosed,
-    reason: failClosed ? reason : `${reason} (observe mode; would DENY under enforcement)`,
-    metadata: { error: true, fail_closed: failClosed, would_deny: true, ...extra || {} }
-  };
-}
-async function evaluateCedar(policySet, req, schema, options) {
-  const failClosed = options?.failClosed ?? true;
-  const available = await ensureCedarWasm();
-  if (!available) {
-    return onEvalError("cedar_wasm_not_available", failClosed, { fallback: true });
-  }
-  try {
-    const agentId = req.agentId || req.tier;
-    const context = {
-      tier: req.tier,
-      ...req.context || {}
-    };
-    if (req.toolInput && Object.keys(req.toolInput).length > 0) {
-      context.input = req.toolInput;
-    }
-    const authRequest = {
-      principal: { type: "Agent", id: agentId },
-      action: { type: "Action", id: "MCP::Tool::call" },
-      resource: { type: "Tool", id: req.tool },
-      context
-    };
-    const entities = buildEntities(req);
-    const cedarSchema = schema?.schemaJson ?? null;
-    let result;
-    if (typeof cedarWasm.isAuthorized === "function") {
-      result = cedarWasm.isAuthorized({
-        policies: { staticPolicies: policySet.source },
-        entities,
-        principal: authRequest.principal,
-        action: authRequest.action,
-        resource: authRequest.resource,
-        context: authRequest.context,
-        schema: cedarSchema
-      });
-    } else if (typeof cedarWasm.checkAuthorization === "function") {
-      result = cedarWasm.checkAuthorization(
-        policySet.source,
-        JSON.stringify(entities),
-        JSON.stringify(authRequest)
-      );
-    } else {
-      const cedarEngine = cedarWasm.default || cedarWasm;
-      if (typeof cedarEngine.isAuthorized === "function") {
-        result = cedarEngine.isAuthorized({
-          policies: { staticPolicies: policySet.source },
-          entities,
-          principal: authRequest.principal,
-          action: authRequest.action,
-          resource: authRequest.resource,
-          context: authRequest.context,
-          schema: cedarSchema
-        });
-      } else {
-        return onEvalError("cedar_wasm_api_unsupported", failClosed, { exports: Object.keys(cedarWasm) });
-      }
-    }
-    const parsed = parseWasmResult(result);
-    const policyErrors = extractPolicyErrors(result);
-    if (parsed.kind === "error") {
-      return onEvalError(`cedar_unparseable_result: ${parsed.diagnostics}`, failClosed);
-    }
-    if (policyErrors.length > 0) {
-      return onEvalError(
-        `cedar_policy_errored: ${policyErrors.length} policy error(s); decision is unsound`,
-        failClosed,
-        { policy_errors: policyErrors.slice(0, 5), policy_digest: policySet.digest }
-      );
-    }
-    return {
-      allowed: parsed.kind === "allow",
-      reason: parsed.kind === "allow" ? void 0 : `cedar_deny${parsed.diagnostics ? ": " + parsed.diagnostics : ""}`,
-      metadata: {
-        policy_digest: policySet.digest,
-        ...parsed.matchedPolicies ? { matched_policies: parsed.matchedPolicies } : {}
-      }
-    };
-  } catch (err) {
-    return onEvalError(`cedar_eval_error: ${err instanceof Error ? err.message : "unknown"}`, failClosed);
-  }
-}
-function parseWasmResult(result) {
-  if (!result) return { kind: "error", diagnostics: "null result from Cedar WASM" };
-  if (result.type === "failure") {
-    return { kind: "error", diagnostics: `cedar failure: ${JSON.stringify(result.errors ?? [])}` };
-  }
-  if (result.type === "success" && result.response) {
-    const dec = result.response.decision;
-    const reasons = result.response.diagnostics?.reason;
-    if (dec === "allow" || dec === "Allow") return { kind: "allow", matchedPolicies: reasons };
-    if (dec === "deny" || dec === "Deny") {
-      return { kind: "deny", diagnostics: result.response.diagnostics ? JSON.stringify(result.response.diagnostics) : void 0, matchedPolicies: reasons };
-    }
-  }
-  if (result.type === "allow" || result.decision === "Allow") return { kind: "allow" };
-  if (result.type === "deny" || result.decision === "Deny") return { kind: "deny" };
-  if (typeof result === "boolean") return result ? { kind: "allow" } : { kind: "deny" };
-  return { kind: "error", diagnostics: `unknown result format: ${JSON.stringify(result)}` };
-}
-function extractPolicyErrors(result) {
-  if (!result || typeof result !== "object") return [];
-  const raw = result.errors ?? result.response?.diagnostics?.errors ?? result.diagnostics?.errors ?? [];
-  if (!Array.isArray(raw)) return [];
-  return raw.map((e) => typeof e === "string" ? e : e?.message ?? e?.error ?? JSON.stringify(e)).filter(Boolean);
-}
-async function isCedarAvailable() {
-  return ensureCedarWasm();
-}
-function policySetFromSource(source, name = "inline") {
-  const digest = createHash2("sha256").update(source).digest("hex").slice(0, 16);
-  return { source, digest, fileCount: 1, files: [name] };
-}
-async function runEvaluatorSelfTest() {
-  const wasmAvailable = await isCedarAvailable();
-  const cases = [];
-  const run = async (name, expected, policy, context) => {
-    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
-    const actual = d.allowed ? "ALLOW" : "DENY";
-    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
-  };
-  if (!wasmAvailable) {
-    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
-    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
-  }
-  const correct = policySetFromSource(
-    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
-  );
-  await run("forbid denies rm", "DENY", correct, { command: "rm" });
-  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
-  const broken = policySetFromSource(
-    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
-  );
-  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
-  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
-}
-
 // src/http-server.ts
 import { createServer } from "http";
-import { readFileSync as readFileSync4, existsSync as existsSync3 } from "fs";
-import { join as join2 } from "path";
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { join } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var MAX_RECEIPTS = 100;
 var ReceiptBuffer = class {
@@ -535,13 +332,13 @@ function handleHealth(res, startTime, config) {
   }));
 }
 function handleStatus(res, logDir) {
-  const logPath = join2(logDir, LOG_FILE);
-  if (!existsSync3(logPath)) {
+  const logPath = join(logDir, LOG_FILE);
+  if (!existsSync2(logPath)) {
     res.writeHead(200);
     res.end(JSON.stringify({ entries: 0, message: "no log file yet" }));
     return;
   }
-  const raw = readFileSync4(logPath, "utf-8");
+  const raw = readFileSync3(logPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   const entries = [];
   for (const line of lines) {
@@ -665,7 +462,7 @@ function handleListApprovals(res, approvalStore) {
 }
 
 // src/action-readback.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
 var DESTINATION_KEYS = [
   "path",
@@ -745,7 +542,7 @@ function buildActionReadback(tool, input) {
     action,
     destination,
     payload_preview: payloadPreview,
-    payload_hash: createHash3("sha256").update(canonical).digest("hex"),
+    payload_hash: createHash2("sha256").update(canonical).digest("hex"),
     payload_bytes: Buffer.byteLength(canonical, "utf-8"),
     disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
     redacted_fields: [...new Set(redactedFields)].slice(0, 80),
@@ -762,11 +559,6 @@ export {
   signDecision,
   getSignerInfo,
   isSigningEnabled,
-  loadCedarPolicies,
-  evaluateCedar,
-  isCedarAvailable,
-  policySetFromSource,
-  runEvaluatorSelfTest,
   ReceiptBuffer,
   startStatusServer,
   buildActionReadback

package/dist/{chunk-7MHK5RF4.mjs → chunk-MOXINIMB.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-PB3TC7E3.mjs";
+} from "./chunk-YM6SOJBR.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-G6X763MH.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/chunk-MWXDXYWH.mjs

@@ -0,0 +1,210 @@
+// src/cedar-evaluator.ts
+import { createHash } from "crypto";
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { join, extname } from "path";
+var cedarWasm = null;
+var loadAttempted = false;
+async function ensureCedarWasm() {
+  if (cedarWasm) return true;
+  if (loadAttempted) return false;
+  loadAttempted = true;
+  try {
+    const moduleName = "@cedar-policy/cedar-wasm";
+    cedarWasm = await import(
+      /* @vite-ignore */
+      moduleName
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function loadCedarPolicies(dirPath) {
+  if (!existsSync(dirPath)) {
+    throw new Error(`Cedar policy directory not found: ${dirPath}`);
+  }
+  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  if (entries.length === 0) {
+    throw new Error(`No .cedar files found in: ${dirPath}`);
+  }
+  const sources = [];
+  for (const file of entries) {
+    const content = readFileSync(join(dirPath, file), "utf-8");
+    sources.push(content);
+  }
+  const concatenated = sources.join("\n\n");
+  const digest = createHash("sha256").update(concatenated).digest("hex").slice(0, 16);
+  return {
+    source: concatenated,
+    digest,
+    fileCount: entries.length,
+    files: entries
+  };
+}
+function buildEntities(req) {
+  const agentId = req.agentId || req.tier;
+  return [
+    {
+      uid: { type: "Agent", id: agentId },
+      attrs: {
+        tier: req.tier,
+        ...req.agentId ? { agent_id: req.agentId } : {}
+      },
+      parents: []
+    },
+    {
+      uid: { type: "Tool", id: req.tool },
+      attrs: {},
+      parents: []
+    }
+  ];
+}
+function onEvalError(reason, failClosed, extra) {
+  return {
+    allowed: !failClosed,
+    reason: failClosed ? reason : `${reason} (observe mode; would DENY under enforcement)`,
+    metadata: { error: true, fail_closed: failClosed, would_deny: true, ...extra || {} }
+  };
+}
+async function evaluateCedar(policySet, req, schema, options) {
+  const failClosed = options?.failClosed ?? true;
+  const available = await ensureCedarWasm();
+  if (!available) {
+    return onEvalError("cedar_wasm_not_available", failClosed, { fallback: true });
+  }
+  try {
+    const agentId = req.agentId || req.tier;
+    const context = {
+      tier: req.tier,
+      ...req.context || {}
+    };
+    if (req.toolInput && Object.keys(req.toolInput).length > 0) {
+      context.input = req.toolInput;
+    }
+    const authRequest = {
+      principal: { type: "Agent", id: agentId },
+      action: { type: "Action", id: "MCP::Tool::call" },
+      resource: { type: "Tool", id: req.tool },
+      context
+    };
+    const entities = buildEntities(req);
+    const cedarSchema = schema?.schemaJson ?? null;
+    let result;
+    if (typeof cedarWasm.isAuthorized === "function") {
+      result = cedarWasm.isAuthorized({
+        policies: { staticPolicies: policySet.source },
+        entities,
+        principal: authRequest.principal,
+        action: authRequest.action,
+        resource: authRequest.resource,
+        context: authRequest.context,
+        schema: cedarSchema
+      });
+    } else if (typeof cedarWasm.checkAuthorization === "function") {
+      result = cedarWasm.checkAuthorization(
+        policySet.source,
+        JSON.stringify(entities),
+        JSON.stringify(authRequest)
+      );
+    } else {
+      const cedarEngine = cedarWasm.default || cedarWasm;
+      if (typeof cedarEngine.isAuthorized === "function") {
+        result = cedarEngine.isAuthorized({
+          policies: { staticPolicies: policySet.source },
+          entities,
+          principal: authRequest.principal,
+          action: authRequest.action,
+          resource: authRequest.resource,
+          context: authRequest.context,
+          schema: cedarSchema
+        });
+      } else {
+        return onEvalError("cedar_wasm_api_unsupported", failClosed, { exports: Object.keys(cedarWasm) });
+      }
+    }
+    const parsed = parseWasmResult(result);
+    const policyErrors = extractPolicyErrors(result);
+    if (parsed.kind === "error") {
+      return onEvalError(`cedar_unparseable_result: ${parsed.diagnostics}`, failClosed);
+    }
+    if (policyErrors.length > 0) {
+      return onEvalError(
+        `cedar_policy_errored: ${policyErrors.length} policy error(s); decision is unsound`,
+        failClosed,
+        { policy_errors: policyErrors.slice(0, 5), policy_digest: policySet.digest }
+      );
+    }
+    return {
+      allowed: parsed.kind === "allow",
+      reason: parsed.kind === "allow" ? void 0 : `cedar_deny${parsed.diagnostics ? ": " + parsed.diagnostics : ""}`,
+      metadata: {
+        policy_digest: policySet.digest,
+        ...parsed.matchedPolicies ? { matched_policies: parsed.matchedPolicies } : {}
+      }
+    };
+  } catch (err) {
+    return onEvalError(`cedar_eval_error: ${err instanceof Error ? err.message : "unknown"}`, failClosed);
+  }
+}
+function parseWasmResult(result) {
+  if (!result) return { kind: "error", diagnostics: "null result from Cedar WASM" };
+  if (result.type === "failure") {
+    return { kind: "error", diagnostics: `cedar failure: ${JSON.stringify(result.errors ?? [])}` };
+  }
+  if (result.type === "success" && result.response) {
+    const dec = result.response.decision;
+    const reasons = result.response.diagnostics?.reason;
+    if (dec === "allow" || dec === "Allow") return { kind: "allow", matchedPolicies: reasons };
+    if (dec === "deny" || dec === "Deny") {
+      return { kind: "deny", diagnostics: result.response.diagnostics ? JSON.stringify(result.response.diagnostics) : void 0, matchedPolicies: reasons };
+    }
+  }
+  if (result.type === "allow" || result.decision === "Allow") return { kind: "allow" };
+  if (result.type === "deny" || result.decision === "Deny") return { kind: "deny" };
+  if (typeof result === "boolean") return result ? { kind: "allow" } : { kind: "deny" };
+  return { kind: "error", diagnostics: `unknown result format: ${JSON.stringify(result)}` };
+}
+function extractPolicyErrors(result) {
+  if (!result || typeof result !== "object") return [];
+  const raw = result.errors ?? result.response?.diagnostics?.errors ?? result.diagnostics?.errors ?? [];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((e) => typeof e === "string" ? e : e?.message ?? e?.error ?? JSON.stringify(e)).filter(Boolean);
+}
+async function isCedarAvailable() {
+  return ensureCedarWasm();
+}
+function policySetFromSource(source, name = "inline") {
+  const digest = createHash("sha256").update(source).digest("hex").slice(0, 16);
+  return { source, digest, fileCount: 1, files: [name] };
+}
+async function runEvaluatorSelfTest() {
+  const wasmAvailable = await isCedarAvailable();
+  const cases = [];
+  const run = async (name, expected, policy, context) => {
+    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
+    const actual = d.allowed ? "ALLOW" : "DENY";
+    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
+  };
+  if (!wasmAvailable) {
+    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
+    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+  }
+  const correct = policySetFromSource(
+    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
+  );
+  await run("forbid denies rm", "DENY", correct, { command: "rm" });
+  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
+  const broken = policySetFromSource(
+    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
+  );
+  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
+  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+}
+
+export {
+  loadCedarPolicies,
+  evaluateCedar,
+  isCedarAvailable,
+  policySetFromSource,
+  runEvaluatorSelfTest
+};