protect-mcp 0.9.6 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # Changelog
 
+## 0.10.0: receipts migrate to the draft-02 Acta envelope
+
+Receipts are now emitted in the envelope the IETF draft actually specifies
+(draft-farley-acta-signed-receipts-02): a two-field
+`{ payload, signature: { alg: "EdDSA", kid, sig } }` envelope, with the
+access-decision fields from section 3.1 (`type: "protectmcp:decision"`,
+`tool_name`, `decision`, `reason`, `policy_digest`), `issuer_id` equal to
+`signature.kid` (section 2.2), the signature computed as PureEdDSA directly
+over the JCS bytes of the payload with no pre-hash (section 5.6), and new
+keys defaulting to the section 2.1.1 recommended
+`sb:issuer:<base58-fingerprint>` kid format (existing key files keep their
+explicit kid). Previously the package emitted an internal envelope shape
+that predated the published draft.
+
+Receipt logs are now hash-chained per section 5.7: each receipt's
+`previousReceiptHash` is the bare-hex SHA-256 of the JCS bytes of the
+previous log line exactly as written, signature included. The hook server
+resumes the chain across restarts from the tail of the existing log, and
+signing-failure tombstones participate in the chain so an unsigned gap
+cannot be silently dropped.
+
+Verification is dual-shape everywhere (the `verify_receipt` MCP tool, the
+`serve --enforce` self-test, the embedded record viewer, and the exported
+`verifyReceipt` API): receipts written by protect-mcp 0.9.x and earlier
+(flat v1 artifacts and structured v2 envelopes with a top-level signature
+string) continue to verify, and a mixed pre/post-migration log replays
+cleanly, including the chain link that spans the boundary. Verified against
+3,352 real receipts from a production gate log: all verify. The published
+`@veritasacta/verify` CLI (0.9.2) verifies the new envelopes as-is via its
+passport path; no verifier upgrade is required.
+
+New module `acta-envelope` (exported from the package root):
+`createReceiptEnvelope`, `verifyReceipt`, `receiptHash`, `receiptIdentity`,
+`computeSbIssuerKid`. `signDecision` accepts an optional previous-chain-hash
+argument and returns the emitted receipt's chain hash. `@noble/curves` and
+`@noble/hashes` moved from optional to regular dependencies.
+
+Fixed: importing the package as a library no longer attaches the demo
+server's stdin JSON-RPC listener (it now only starts when demo-server is
+the process entry point). Previously any `require("protect-mcp")` kept the
+host process's event loop alive and answered JSON-RPC on stdout.
+
+Note for strict draft conformance: `decision` may be "require_approval" for
+held-for-co-sign flows, an extension value beyond the section 3.1 set
+(allow, deny, rate_limit), pending a revision of the draft.
+
+
+## 0.9.7: the gate as an MCP server
+
+`protect-mcp mcp` boots a stdio MCP server exposing the gate itself as four
+tools, so an agent can call the gate directly instead of only through the
+PreToolUse/PostToolUse hooks: `evaluate_action` (Cedar decision, fail-closed),
+`sign_decision` (Ed25519 receipt, byte-compatible with the runtime gate's),
+`verify_receipt` (offline check), and `self_test` (proves a known-forbidden
+action is denied and a signed receipt round-trips). All four are read-only
+and annotated with what they return. A bare-spawnable bin,
+`protect-mcp-mcp`, is included alongside the `mcp` subcommand so any MCP
+host or registry can point at either.
+
 ## 0.9.6: policy you can see and change
 
 The gate is default-deny and fail-closed, but a deny used to be a dead end: an

package/README.md

@@ -57,6 +57,36 @@ The dashboard binds to `127.0.0.1`, reads only local log/receipt files, and does
 not upload anything. Use `npx protect-mcp connect` only if you explicitly want a
 hosted ScopeBlind dashboard.
 
+## The gate as an MCP server
+
+If you would rather call the gate as tools than wire the Claude Code hooks, run
+it as an MCP server:
+
+```bash
+npx protect-mcp mcp
+```
+
+It speaks MCP over stdio and exposes four read-only tools, the whole loop:
+
+- **`evaluate_action`**: decide a proposed tool call against an inline Cedar policy, fail-closed (any policy error is DENY). Returns `{ allowed, decision, reason, policy_digest }`.
+- **`sign_decision`**: turn a decision into an Ed25519 signed receipt (a denial signs a `gateway_restraint`, an allow a `decision_receipt`). Returns the receipt and its public key; generates an ephemeral key if you do not supply one.
+- **`verify_receipt`**: verify a signed receipt offline against a public key. Returns `{ valid, error, type, kid, issuer }`.
+- **`self_test`**: prove it, no inputs. A known-forbidden action is denied, then a signed receipt round-trips and a tampered copy fails.
+
+Point any MCP host at it, for example Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "protect-mcp": { "command": "npx", "args": ["-y", "protect-mcp", "mcp"] }
+  }
+}
+```
+
+Receipts are byte-compatible with the ones the gate signs at runtime, so a
+receipt minted here verifies with [`@veritasacta/verify`](https://www.npmjs.com/package/@veritasacta/verify)
+and the browser verifier just the same.
+
 ### Local Action Dashboard
 
 `protect-mcp dashboard` is the operator view for moving from visibility to

package/dist/chunk-3AVIMUNP.mjs

@@ -0,0 +1,113 @@
+// src/acta-envelope.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils";
+function canonicalize(obj) {
+  return JSON.stringify(obj, (_key, value) => {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const sorted = {};
+      for (const k of Object.keys(value).sort()) {
+        if (!/^[\x20-\x7E]*$/.test(k)) {
+          throw new Error(`Non-ASCII key "${k}" in receipt payload. Only ASCII keys are permitted.`);
+        }
+        sorted[k] = value[k];
+      }
+      return sorted;
+    }
+    return value;
+  });
+}
+function receiptHash(obj) {
+  return bytesToHex(sha256(utf8ToBytes(canonicalize(obj))));
+}
+var B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58(bytes) {
+  let n = BigInt("0x" + bytesToHex(bytes));
+  let out = "";
+  while (n > 0n) {
+    out = B58_ALPHABET[Number(n % 58n)] + out;
+    n /= 58n;
+  }
+  for (const b of bytes) {
+    if (b === 0) out = "1" + out;
+    else break;
+  }
+  return out;
+}
+function computeSbIssuerKid(publicKeyHex) {
+  return `sb:issuer:${base58(hexToBytes(publicKeyHex)).slice(0, 12)}`;
+}
+function createReceiptEnvelope(fields, privateKeyHex, kid, issuedAt) {
+  if (!fields.type) throw new Error("receipt payload requires a type");
+  if (!kid) throw new Error("kid is required");
+  const payload = {
+    ...fields,
+    issued_at: fields.issued_at || issuedAt || (/* @__PURE__ */ new Date()).toISOString(),
+    issuer_id: kid
+  };
+  const sig = bytesToHex(ed25519.sign(utf8ToBytes(canonicalize(payload)), hexToBytes(privateKeyHex)));
+  const envelope = { payload, signature: { alg: "EdDSA", kid, sig } };
+  return { envelope, hash: receiptHash(envelope) };
+}
+function verifyReceipt(envelope, publicKeyHex) {
+  try {
+    if (!envelope || typeof envelope !== "object") {
+      return { valid: false, shape: null, error: "not_an_object" };
+    }
+    const env = envelope;
+    const signature = env.signature;
+    if (signature && typeof signature === "object" && !Array.isArray(signature)) {
+      const sigObj = signature;
+      if (sigObj.alg !== "EdDSA") {
+        return { valid: false, shape: "acta-02", error: `unsupported_alg:${String(sigObj.alg)}` };
+      }
+      if (typeof sigObj.sig !== "string" || !env.payload || typeof env.payload !== "object") {
+        return { valid: false, shape: "acta-02", error: "malformed_envelope" };
+      }
+      const message = utf8ToBytes(canonicalize(env.payload));
+      const valid = ed25519.verify(hexToBytes(sigObj.sig), message, hexToBytes(publicKeyHex));
+      return valid ? { valid: true, shape: "acta-02", hash: receiptHash(env) } : { valid: false, shape: "acta-02", error: "invalid_signature" };
+    }
+    if (typeof signature === "string") {
+      const rest = {};
+      for (const k of Object.keys(env)) if (k !== "signature") rest[k] = env[k];
+      const message = utf8ToBytes(canonicalize(rest));
+      const valid = ed25519.verify(hexToBytes(signature), message, hexToBytes(publicKeyHex));
+      const shape = env.v === 2 ? "legacy-v2" : "legacy-v1";
+      return valid ? { valid: true, shape, hash: receiptHash(env) } : { valid: false, shape, error: "invalid_signature" };
+    }
+    return { valid: false, shape: null, error: "missing_signature" };
+  } catch (err) {
+    return {
+      valid: false,
+      shape: null,
+      error: `verification_error:${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+function receiptIdentity(envelope) {
+  if (!envelope || typeof envelope !== "object") return { kid: null, issuer: null, type: null };
+  const env = envelope;
+  if (env.signature && typeof env.signature === "object") {
+    const payload = env.payload || {};
+    const sig = env.signature;
+    return {
+      kid: typeof sig.kid === "string" ? sig.kid : null,
+      issuer: typeof payload.issuer_id === "string" ? payload.issuer_id : typeof payload.issuer_name === "string" ? payload.issuer_name : null,
+      type: typeof payload.type === "string" ? payload.type : null
+    };
+  }
+  return {
+    kid: typeof env.kid === "string" ? env.kid : null,
+    issuer: typeof env.issuer === "string" ? env.issuer : null,
+    type: typeof env.type === "string" ? env.type : null
+  };
+}
+
+export {
+  receiptHash,
+  computeSbIssuerKid,
+  createReceiptEnvelope,
+  verifyReceipt,
+  receiptIdentity
+};

package/dist/{chunk-PB3TC7E3.mjs → chunk-622KQ4KW.mjs}

@@ -2,13 +2,15 @@ import {
   ReceiptBuffer,
   buildActionReadback,
   checkRateLimit,
-  evaluateCedar,
   getToolPolicy,
   isSigningEnabled,
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-VWGRAUWI.mjs";
+import {
+  evaluateCedar
+} from "./chunk-MWXDXYWH.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";

package/dist/{chunk-JQDVKZBN.mjs → chunk-HULPW5WR.mjs}

@@ -1,3 +1,7 @@
+import {
+  receiptIdentity
+} from "./chunk-3AVIMUNP.mjs";
+
 // src/report.ts
 import { readFileSync, existsSync } from "fs";
 function generateReport(logPath, receiptPath, periodDays) {
@@ -34,8 +38,9 @@ function generateReport(logPath, receiptPath, periodDays) {
         const parsed = JSON.parse(trimmed);
         if (parsed.signature) {
           receiptsSigned++;
-          if (parsed.kid && !signerKid) signerKid = parsed.kid;
-          if (parsed.issuer && !signerIssuer) signerIssuer = parsed.issuer;
+          const identity = receiptIdentity(parsed);
+          if (identity.kid && !signerKid) signerKid = identity.kid;
+          if (identity.issuer && !signerIssuer) signerIssuer = identity.issuer;
         }
       } catch {
       }

package/dist/{chunk-UWB5ALVO.mjs → chunk-K7AEEQWW.mjs}

@@ -1,22 +1,11 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  ed25519
-} from "./chunk-FFVJL3KQ.mjs";
-import {
-  Hash,
-  abytes,
-  aexists,
-  ahash,
-  bytesToHex,
-  clean,
-  hexToBytes,
-  randomBytes,
-  toBytes
-} from "./chunk-D733KAPG.mjs";
+// src/signing-committed.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3, randomBytes as randomBytes2 } from "@noble/hashes/utils";
 
 // src/commitments/merkle.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
 var DOMAIN_LEAF = 0;
 var DOMAIN_INTERNAL = 1;
 function hashLeaf(leafBytes) {
@@ -127,75 +116,10 @@ function largestPowerOfTwoLessThan(n) {
   return k;
 }
 
-// node_modules/@noble/hashes/esm/hmac.js
-var HMAC = class extends Hash {
-  constructor(hash, _key) {
-    super();
-    this.finished = false;
-    this.destroyed = false;
-    ahash(hash);
-    const key = toBytes(_key);
-    this.iHash = hash.create();
-    if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
-    this.blockLen = this.iHash.blockLen;
-    this.outputLen = this.iHash.outputLen;
-    const blockLen = this.blockLen;
-    const pad = new Uint8Array(blockLen);
-    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54;
-    this.iHash.update(pad);
-    this.oHash = hash.create();
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
-    this.oHash.update(pad);
-    clean(pad);
-  }
-  update(buf) {
-    aexists(this);
-    this.iHash.update(buf);
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    abytes(out, this.outputLen);
-    this.finished = true;
-    this.iHash.digestInto(out);
-    this.oHash.update(out);
-    this.oHash.digestInto(out);
-    this.destroy();
-  }
-  digest() {
-    const out = new Uint8Array(this.oHash.outputLen);
-    this.digestInto(out);
-    return out;
-  }
-  _cloneInto(to) {
-    to || (to = Object.create(Object.getPrototypeOf(this), {}));
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-    to = to;
-    to.finished = finished;
-    to.destroyed = destroyed;
-    to.blockLen = blockLen;
-    to.outputLen = outputLen;
-    to.oHash = oHash._cloneInto(to.oHash);
-    to.iHash = iHash._cloneInto(to.iHash);
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-  destroy() {
-    this.destroyed = true;
-    this.oHash.destroy();
-    this.iHash.destroy();
-  }
-};
-var hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new HMAC(hash, key);
-
 // src/commitments/primitives.ts
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { hmac } from "@noble/hashes/hmac";
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2, randomBytes } from "@noble/hashes/utils";
 function jcs(value) {
   if (value === null || value === void 0) return "null";
   if (typeof value === "boolean" || typeof value === "number")
@@ -257,7 +181,7 @@ function leavesFromFields(fields) {
 
 // src/signing-committed.ts
 function freshSalt() {
-  return randomBytes(32);
+  return randomBytes2(32);
 }
 function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey, kid, issuer) {
   const allFields = {
@@ -297,7 +221,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     const { sorted, leafBytes } = leavesFromFields(committedFields);
     const leafHashes = leafBytes.map(hashLeaf);
     const root = merkleRoot(leafHashes);
-    committedFieldsRoot = bytesToHex(root);
+    committedFieldsRoot = bytesToHex3(root);
     sorted.forEach((f, i) => {
       openings[f.name] = { name: f.name, value: f.value, salt: f.salt, index: i };
     });
@@ -314,8 +238,8 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     payload.committed_field_names = committedFields.map((f) => f.name);
   }
   const canonical = jcs(payload);
-  const messageHash = sha256(new TextEncoder().encode(canonical));
-  const signatureBytes = ed25519.sign(messageHash, hexToBytes(signingKey));
+  const messageHash = sha2563(new TextEncoder().encode(canonical));
+  const signatureBytes = ed25519.sign(messageHash, hexToBytes3(signingKey));
   const signedReceipt = {
     ...payload,
     signature: {
@@ -328,7 +252,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     }
   };
   const signedJson = JSON.stringify(signedReceipt);
-  const receiptHash = bytesToHex(sha256(new TextEncoder().encode(jcs(signedReceipt))));
+  const receiptHash = bytesToHex3(sha2563(new TextEncoder().encode(jcs(signedReceipt))));
   return {
     signed: signedJson,
     artifact_type: "decision_receipt_committed_v1",
@@ -457,7 +381,7 @@ function committedFieldNamesFromReceipt(receipt, openings) {
   return Array.from(new Set(names)).sort();
 }
 function receiptHashHex(receipt) {
-  return bytesToHex(sha256(new TextEncoder().encode(jcs(receipt))));
+  return bytesToHex3(sha2563(new TextEncoder().encode(jcs(receipt))));
 }
 function verifyCommittedReceiptSignature(receipt) {
   const signature = receipt.signature;
@@ -467,16 +391,15 @@ function verifyCommittedReceiptSignature(receipt) {
     return null;
   }
   const { signature: _signature, ...payloadWithoutSig } = receipt;
-  const messageHash = sha256(new TextEncoder().encode(jcs(payloadWithoutSig)));
+  const messageHash = sha2563(new TextEncoder().encode(jcs(payloadWithoutSig)));
   try {
-    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes(sig.public_key));
+    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes3(sig.public_key));
   } catch {
     return false;
   }
 }
 
 export {
-  hmac,
   signCommittedDecision,
   discloseField,
   createSelectiveDisclosurePackage,

package/dist/{chunk-WWPQNIVF.mjs → chunk-KRKZ2YX7.mjs}

@@ -1,11 +1,6 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  bytesToHex
-} from "./chunk-D733KAPG.mjs";
-
 // src/receipt-enrichment.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
 var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();

package/dist/chunk-MWXDXYWH.mjs

@@ -0,0 +1,210 @@
+// src/cedar-evaluator.ts
+import { createHash } from "crypto";
+import { readFileSync, readdirSync, existsSync } from "fs";
+import { join, extname } from "path";
+var cedarWasm = null;
+var loadAttempted = false;
+async function ensureCedarWasm() {
+  if (cedarWasm) return true;
+  if (loadAttempted) return false;
+  loadAttempted = true;
+  try {
+    const moduleName = "@cedar-policy/cedar-wasm";
+    cedarWasm = await import(
+      /* @vite-ignore */
+      moduleName
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function loadCedarPolicies(dirPath) {
+  if (!existsSync(dirPath)) {
+    throw new Error(`Cedar policy directory not found: ${dirPath}`);
+  }
+  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  if (entries.length === 0) {
+    throw new Error(`No .cedar files found in: ${dirPath}`);
+  }
+  const sources = [];
+  for (const file of entries) {
+    const content = readFileSync(join(dirPath, file), "utf-8");
+    sources.push(content);
+  }
+  const concatenated = sources.join("\n\n");
+  const digest = createHash("sha256").update(concatenated).digest("hex").slice(0, 16);
+  return {
+    source: concatenated,
+    digest,
+    fileCount: entries.length,
+    files: entries
+  };
+}
+function buildEntities(req) {
+  const agentId = req.agentId || req.tier;
+  return [
+    {
+      uid: { type: "Agent", id: agentId },
+      attrs: {
+        tier: req.tier,
+        ...req.agentId ? { agent_id: req.agentId } : {}
+      },
+      parents: []
+    },
+    {
+      uid: { type: "Tool", id: req.tool },
+      attrs: {},
+      parents: []
+    }
+  ];
+}
+function onEvalError(reason, failClosed, extra) {
+  return {
+    allowed: !failClosed,
+    reason: failClosed ? reason : `${reason} (observe mode; would DENY under enforcement)`,
+    metadata: { error: true, fail_closed: failClosed, would_deny: true, ...extra || {} }
+  };
+}
+async function evaluateCedar(policySet, req, schema, options) {
+  const failClosed = options?.failClosed ?? true;
+  const available = await ensureCedarWasm();
+  if (!available) {
+    return onEvalError("cedar_wasm_not_available", failClosed, { fallback: true });
+  }
+  try {
+    const agentId = req.agentId || req.tier;
+    const context = {
+      tier: req.tier,
+      ...req.context || {}
+    };
+    if (req.toolInput && Object.keys(req.toolInput).length > 0) {
+      context.input = req.toolInput;
+    }
+    const authRequest = {
+      principal: { type: "Agent", id: agentId },
+      action: { type: "Action", id: "MCP::Tool::call" },
+      resource: { type: "Tool", id: req.tool },
+      context
+    };
+    const entities = buildEntities(req);
+    const cedarSchema = schema?.schemaJson ?? null;
+    let result;
+    if (typeof cedarWasm.isAuthorized === "function") {
+      result = cedarWasm.isAuthorized({
+        policies: { staticPolicies: policySet.source },
+        entities,
+        principal: authRequest.principal,
+        action: authRequest.action,
+        resource: authRequest.resource,
+        context: authRequest.context,
+        schema: cedarSchema
+      });
+    } else if (typeof cedarWasm.checkAuthorization === "function") {
+      result = cedarWasm.checkAuthorization(
+        policySet.source,
+        JSON.stringify(entities),
+        JSON.stringify(authRequest)
+      );
+    } else {
+      const cedarEngine = cedarWasm.default || cedarWasm;
+      if (typeof cedarEngine.isAuthorized === "function") {
+        result = cedarEngine.isAuthorized({
+          policies: { staticPolicies: policySet.source },
+          entities,
+          principal: authRequest.principal,
+          action: authRequest.action,
+          resource: authRequest.resource,
+          context: authRequest.context,
+          schema: cedarSchema
+        });
+      } else {
+        return onEvalError("cedar_wasm_api_unsupported", failClosed, { exports: Object.keys(cedarWasm) });
+      }
+    }
+    const parsed = parseWasmResult(result);
+    const policyErrors = extractPolicyErrors(result);
+    if (parsed.kind === "error") {
+      return onEvalError(`cedar_unparseable_result: ${parsed.diagnostics}`, failClosed);
+    }
+    if (policyErrors.length > 0) {
+      return onEvalError(
+        `cedar_policy_errored: ${policyErrors.length} policy error(s); decision is unsound`,
+        failClosed,
+        { policy_errors: policyErrors.slice(0, 5), policy_digest: policySet.digest }
+      );
+    }
+    return {
+      allowed: parsed.kind === "allow",
+      reason: parsed.kind === "allow" ? void 0 : `cedar_deny${parsed.diagnostics ? ": " + parsed.diagnostics : ""}`,
+      metadata: {
+        policy_digest: policySet.digest,
+        ...parsed.matchedPolicies ? { matched_policies: parsed.matchedPolicies } : {}
+      }
+    };
+  } catch (err) {
+    return onEvalError(`cedar_eval_error: ${err instanceof Error ? err.message : "unknown"}`, failClosed);
+  }
+}
+function parseWasmResult(result) {
+  if (!result) return { kind: "error", diagnostics: "null result from Cedar WASM" };
+  if (result.type === "failure") {
+    return { kind: "error", diagnostics: `cedar failure: ${JSON.stringify(result.errors ?? [])}` };
+  }
+  if (result.type === "success" && result.response) {
+    const dec = result.response.decision;
+    const reasons = result.response.diagnostics?.reason;
+    if (dec === "allow" || dec === "Allow") return { kind: "allow", matchedPolicies: reasons };
+    if (dec === "deny" || dec === "Deny") {
+      return { kind: "deny", diagnostics: result.response.diagnostics ? JSON.stringify(result.response.diagnostics) : void 0, matchedPolicies: reasons };
+    }
+  }
+  if (result.type === "allow" || result.decision === "Allow") return { kind: "allow" };
+  if (result.type === "deny" || result.decision === "Deny") return { kind: "deny" };
+  if (typeof result === "boolean") return result ? { kind: "allow" } : { kind: "deny" };
+  return { kind: "error", diagnostics: `unknown result format: ${JSON.stringify(result)}` };
+}
+function extractPolicyErrors(result) {
+  if (!result || typeof result !== "object") return [];
+  const raw = result.errors ?? result.response?.diagnostics?.errors ?? result.diagnostics?.errors ?? [];
+  if (!Array.isArray(raw)) return [];
+  return raw.map((e) => typeof e === "string" ? e : e?.message ?? e?.error ?? JSON.stringify(e)).filter(Boolean);
+}
+async function isCedarAvailable() {
+  return ensureCedarWasm();
+}
+function policySetFromSource(source, name = "inline") {
+  const digest = createHash("sha256").update(source).digest("hex").slice(0, 16);
+  return { source, digest, fileCount: 1, files: [name] };
+}
+async function runEvaluatorSelfTest() {
+  const wasmAvailable = await isCedarAvailable();
+  const cases = [];
+  const run = async (name, expected, policy, context) => {
+    const d = await evaluateCedar(policy, { tool: "Bash", tier: "unknown", context }, void 0, { failClosed: true });
+    const actual = d.allowed ? "ALLOW" : "DENY";
+    cases.push({ name, expected, actual, pass: actual === expected, reason: d.reason });
+  };
+  if (!wasmAvailable) {
+    await run("engine unavailable denies", "DENY", policySetFromSource("permit(principal, action, resource);"), {});
+    return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+  }
+  const correct = policySetFromSource(
+    'forbid(principal, action, resource) when { ["rm", "dd", "mkfs"].contains(context.command) };\npermit(principal, action, resource);'
+  );
+  await run("forbid denies rm", "DENY", correct, { command: "rm" });
+  await run("permit allows ls", "ALLOW", correct, { command: "ls" });
+  const broken = policySetFromSource(
+    'forbid(principal, action, resource) when { context.command in ["rm", "dd"] };\npermit(principal, action, resource);'
+  );
+  await run("in-on-String forbid does not permit-all", "DENY", broken, { command: "rm" });
+  return { wasmAvailable, passed: cases.every((c) => c.pass), cases };
+}
+
+export {
+  loadCedarPolicies,
+  evaluateCedar,
+  isCedarAvailable,
+  policySetFromSource,
+  runEvaluatorSelfTest
+};

package/dist/{chunk-7MHK5RF4.mjs → chunk-SPDIFFGP.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-PB3TC7E3.mjs";
+} from "./chunk-622KQ4KW.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-XLJUZ4WO.mjs";
+} from "./chunk-VWGRAUWI.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";