protect-mcp 0.9.7 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,107 @@
 # Changelog
 
+## 0.10.1: HTTP gateway mode enforces Cedar and emits chained receipts
+
+Three fixes found by running the cloud-gateway path end to end before
+documenting it:
+
+- Fail-open fixed: in `--http` mode, loaded Cedar policies were never
+  attached to the gateway (the stdio path attached them after the HTTP
+  branch returned), so a remote gate started with `--enforce` and a Cedar
+  policy silently allowed everything. Cedar policies are now attached
+  before the child starts, and a forbidden tool call over HTTP is denied.
+- Silent-unsigned fixed: a Cedar-mode gateway never read `signing` from
+  protect-mcp.json (only the JSON-policy branch did), so it emitted no
+  receipts while looking fully configured. Cedar mode now picks up signing
+  and credentials from protect-mcp.json when present and says so on stderr.
+- Gateway receipts now chain: the wrapped-server path (stdio and HTTP)
+  threads previousReceiptHash per draft s5.7 and resumes the chain across
+  restarts from the log tail, matching the hook server. Verified end to
+  end: a cloud-style client over Streamable HTTP, one allow and one deny,
+  chained draft-02 receipts, replayed offline with the published
+  @veritasacta/verify with zero chain breaks.
+
+
+## 0.10.0: receipts migrate to the draft-02 Acta envelope
+
+Also in this release, the policy digest becomes a recomputable commitment
+(prompted by public review of opaque policy identifiers):
+
+- One normative construction for every engine, `acta-policy-digest-v1`:
+  per-file SHA-256s into a sorted `{construction, engine, files}` manifest,
+  JCS, SHA-256, emitted as `"sha256:<64 hex>"`. Replaces two divergent
+  code-defined preimages that concatenated sources (ambiguous file
+  boundaries) and truncated to 16 hex characters with no prefix. Receipts
+  now carry the full-strength digest; pre-0.10 digests should be treated
+  as opaque labels.
+- `protect-mcp policy digest` prints the digest, the per-file hashes, and
+  the recompute rule (`--expect` for CI, `--json` for tooling).
+- `protect-mcp policy publish` writes the `acta.policy-bundle.v1` bundle
+  (policy bytes plus preimage spec, addressed by the digest) ready to host
+  at `.well-known/acta-policies/<hex>.json`; a verifier confirms which
+  policy governed a receipt from the bundle bytes alone, with no
+  communication with the issuer.
+- The construction is specified normatively in
+  draft-farley-acta-signed-receipts-03 (section 5.8), alongside
+  `require_approval` as a decision value.
+
+Receipts are now emitted in the envelope the IETF draft actually specifies
+(draft-farley-acta-signed-receipts-02): a two-field
+`{ payload, signature: { alg: "EdDSA", kid, sig } }` envelope, with the
+access-decision fields from section 3.1 (`type: "protectmcp:decision"`,
+`tool_name`, `decision`, `reason`, `policy_digest`), `issuer_id` equal to
+`signature.kid` (section 2.2), the signature computed as PureEdDSA directly
+over the JCS bytes of the payload with no pre-hash (section 5.6), and new
+keys defaulting to the section 2.1.1 recommended
+`sb:issuer:<base58-fingerprint>` kid format (existing key files keep their
+explicit kid). Previously the package emitted an internal envelope shape
+that predated the published draft.
+
+Receipt logs are now hash-chained per section 5.7: each receipt's
+`previousReceiptHash` is the bare-hex SHA-256 of the JCS bytes of the
+previous log line exactly as written, signature included. The hook server
+resumes the chain across restarts from the tail of the existing log, and
+signing-failure tombstones participate in the chain so an unsigned gap
+cannot be silently dropped.
+
+Verification is dual-shape everywhere (the `verify_receipt` MCP tool, the
+`serve --enforce` self-test, the embedded record viewer, and the exported
+`verifyReceipt` API): receipts written by protect-mcp 0.9.x and earlier
+(flat v1 artifacts and structured v2 envelopes with a top-level signature
+string) continue to verify, and a mixed pre/post-migration log replays
+cleanly, including the chain link that spans the boundary. Verified against
+3,352 real receipts from a production gate log: all verify. The published
+`@veritasacta/verify` CLI (0.9.2) verifies the new envelopes as-is via its
+passport path; no verifier upgrade is required.
+
+New module `acta-envelope` (exported from the package root):
+`createReceiptEnvelope`, `verifyReceipt`, `receiptHash`, `receiptIdentity`,
+`computeSbIssuerKid`. `signDecision` accepts an optional previous-chain-hash
+argument and returns the emitted receipt's chain hash. `@noble/curves` and
+`@noble/hashes` moved from optional to regular dependencies.
+
+Fixed: importing the package as a library no longer attaches the demo
+server's stdin JSON-RPC listener (it now only starts when demo-server is
+the process entry point). Previously any `require("protect-mcp")` kept the
+host process's event loop alive and answered JSON-RPC on stdout.
+
+Note for strict draft conformance: `decision` may be "require_approval" for
+held-for-co-sign flows, an extension value beyond the section 3.1 set
+(allow, deny, rate_limit), pending a revision of the draft.
+
+
+## 0.9.7: the gate as an MCP server
+
+`protect-mcp mcp` boots a stdio MCP server exposing the gate itself as four
+tools, so an agent can call the gate directly instead of only through the
+PreToolUse/PostToolUse hooks: `evaluate_action` (Cedar decision, fail-closed),
+`sign_decision` (Ed25519 receipt, byte-compatible with the runtime gate's),
+`verify_receipt` (offline check), and `self_test` (proves a known-forbidden
+action is denied and a signed receipt round-trips). All four are read-only
+and annotated with what they return. A bare-spawnable bin,
+`protect-mcp-mcp`, is included alongside the `mcp` subcommand so any MCP
+host or registry can point at either.
+
 ## 0.9.6: policy you can see and change
 
 The gate is default-deny and fail-closed, but a deny used to be a dead end: an

package/dist/{chunk-AUUAVWQM.mjs → chunk-3FSKOGGK.mjs}

@@ -1,9 +1,11 @@
 import {
   buildEnrichment
-} from "./chunk-WWPQNIVF.mjs";
+} from "./chunk-KRKZ2YX7.mjs";
 import {
   ReceiptBuffer,
-  buildActionReadback,
+  buildActionReadback
+} from "./chunk-CIWIK6BT.mjs";
+import {
   checkRateLimit,
   getSignerInfo,
   getToolPolicy,
@@ -12,12 +14,15 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-G6X763MH.mjs";
+} from "./chunk-WMIWQ6TS.mjs";
 import {
   evaluateCedar,
   isCedarAvailable,
   loadCedarPolicies
-} from "./chunk-MWXDXYWH.mjs";
+} from "./chunk-FGCNKEEW.mjs";
+import {
+  receiptHash
+} from "./chunk-XOP3PEBM.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -181,6 +186,16 @@ var DEFAULT_PORT = 9377;
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var RECEIPTS_FILE = ".protect-mcp-receipts.jsonl";
 var PAYLOAD_HASH_THRESHOLD = 1024;
+function resumeReceiptChain(receiptFilePath) {
+  try {
+    if (!existsSync(receiptFilePath)) return null;
+    const lines = readFileSync(receiptFilePath, "utf-8").split("\n").filter((l) => l.trim());
+    if (lines.length === 0) return null;
+    return receiptHash(JSON.parse(lines[lines.length - 1]));
+  } catch {
+    return null;
+  }
+}
 function detectSwarmContext() {
   const teamName = process.env.CLAUDE_CODE_TEAM_NAME;
   const agentId = process.env.CLAUDE_CODE_AGENT_ID;
@@ -683,10 +698,11 @@ function emitDecisionLog(state, entry) {
   } catch {
   }
   if (isSigningEnabled()) {
-    const signed = signDecision(log);
+    const signed = signDecision(log, state.lastReceiptHash || void 0);
     if (signed.signed) {
       try {
         appendFileSync(state.receiptFilePath, signed.signed + "\n");
+        if (signed.receipt_hash) state.lastReceiptHash = signed.receipt_hash;
       } catch {
       }
       state.receiptBuffer.add(log.request_id, signed.signed);
@@ -701,16 +717,19 @@ function emitDecisionLog(state, entry) {
 `);
       }
     } else if (signed.error) {
-      const tombstone = JSON.stringify({
+      const tombstoneObj = {
         type: "scopeblind.signing_failure.v1",
         request_id: log.request_id,
         tool: log.tool,
         decision: log.decision,
         error: signed.error,
-        at: new Date(log.timestamp).toISOString()
-      });
+        at: new Date(log.timestamp).toISOString(),
+        ...state.lastReceiptHash ? { previousReceiptHash: state.lastReceiptHash } : {}
+      };
+      const tombstone = JSON.stringify(tombstoneObj);
       try {
         appendFileSync(state.receiptFilePath, tombstone + "\n");
+        state.lastReceiptHash = receiptHash(tombstoneObj);
       } catch {
       }
       process.stderr.write(`[PROTECT_MCP_SIGNING_FAILURE] ${tombstone}
@@ -826,6 +845,7 @@ async function startHookServer(options = {}) {
     policyDigest,
     logFilePath: join(process.cwd(), LOG_FILE),
     receiptFilePath: join(process.cwd(), RECEIPTS_FILE),
+    lastReceiptHash: resumeReceiptChain(join(process.cwd(), RECEIPTS_FILE)),
     permissionSuggestions: /* @__PURE__ */ new Map(),
     configAlerts: []
   };

package/dist/{chunk-MOXINIMB.mjs → chunk-BXZUS6HS.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-YM6SOJBR.mjs";
+} from "./chunk-NQOKPBSQ.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-G6X763MH.mjs";
+} from "./chunk-WMIWQ6TS.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-G6X763MH.mjs → chunk-CIWIK6BT.mjs}

@@ -1,244 +1,6 @@
-// src/policy.ts
-import { createHash } from "crypto";
-import { readFileSync } from "fs";
-function loadPolicy(path) {
-  const raw = readFileSync(path, "utf-8");
-  const parsed = JSON.parse(raw);
-  if (!parsed.tools || typeof parsed.tools !== "object") {
-    throw new Error(`Invalid policy file: missing "tools" object in ${path}`);
-  }
-  const policy = {
-    tools: parsed.tools,
-    default_tier: parsed.default_tier || "unknown",
-    policy_engine: parsed.policy_engine || "built-in",
-    ...parsed.external ? { external: parsed.external } : {}
-  };
-  const digest = computePolicyDigest(policy);
-  return {
-    policy,
-    digest,
-    credentials: parsed.credentials,
-    signing: parsed.signing
-  };
-}
-function computePolicyDigest(policy) {
-  const canonical = JSON.stringify(sortKeysDeep(policy));
-  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
-}
-function sortKeysDeep(obj) {
-  if (obj === null || typeof obj !== "object") return obj;
-  if (Array.isArray(obj)) return obj.map(sortKeysDeep);
-  const sorted = {};
-  for (const key of Object.keys(obj).sort()) {
-    sorted[key] = sortKeysDeep(obj[key]);
-  }
-  return sorted;
-}
-function getToolPolicy(toolName, policy) {
-  if (!policy) {
-    return { require: "any" };
-  }
-  if (policy.tools[toolName]) {
-    return policy.tools[toolName];
-  }
-  if (policy.tools["*"]) {
-    return policy.tools["*"];
-  }
-  return { require: "any" };
-}
-function parseRateLimit(spec) {
-  const match = spec.match(/^(\d+)\/(second|minute|hour|day)$/);
-  if (!match) {
-    throw new Error(`Invalid rate limit format: "${spec}". Expected "N/unit" (e.g. "5/hour")`);
-  }
-  const count = parseInt(match[1], 10);
-  const unit = match[2];
-  const windowMs = {
-    second: 1e3,
-    minute: 6e4,
-    hour: 36e5,
-    day: 864e5
-  };
-  return { count, windowMs: windowMs[unit] };
-}
-function checkRateLimit(key, limit, store) {
-  const now = Date.now();
-  const windowStart = now - limit.windowMs;
-  const timestamps = (store.get(key) || []).filter((t) => t > windowStart);
-  if (timestamps.length >= limit.count) {
-    store.set(key, timestamps);
-    return { allowed: false, remaining: 0 };
-  }
-  timestamps.push(now);
-  store.set(key, timestamps);
-  return { allowed: true, remaining: limit.count - timestamps.length };
-}
-
-// src/signing.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-var signerState = null;
-var artifactsModule = null;
-var signingConfigured = false;
-var signingInitError = null;
-async function initSigning(config) {
-  const warnings = [];
-  signerState = null;
-  artifactsModule = null;
-  signingConfigured = Boolean(config && config.enabled !== false);
-  signingInitError = null;
-  if (!config || config.enabled === false) {
-    return warnings;
-  }
-  if (!config.key_path) {
-    signingInitError = "signing enabled but key_path is not configured";
-    warnings.push(`signing: ${signingInitError}`);
-    return warnings;
-  }
-  if (!existsSync(config.key_path)) {
-    signingInitError = `key file not found at ${config.key_path}`;
-    warnings.push(`signing: ${signingInitError} \u2014 run "protect-mcp init" to generate`);
-    return warnings;
-  }
-  let keyData;
-  try {
-    keyData = JSON.parse(readFileSync2(config.key_path, "utf-8"));
-    if (!keyData.privateKey || !keyData.publicKey) {
-      signingInitError = "key file missing privateKey or publicKey fields";
-      warnings.push(`signing: ${signingInitError}`);
-      return warnings;
-    }
-  } catch (err) {
-    signingInitError = `failed to load key file: ${err instanceof Error ? err.message : err}`;
-    warnings.push(`signing: ${signingInitError}`);
-    return warnings;
-  }
-  try {
-    const moduleName = "@veritasacta/artifacts";
-    artifactsModule = await import(
-      /* @vite-ignore */
-      moduleName
-    );
-  } catch {
-    signingInitError = "@veritasacta/artifacts not available";
-    warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
-    return warnings;
-  }
-  try {
-    signerState = {
-      privateKey: keyData.privateKey,
-      publicKey: keyData.publicKey,
-      kid: keyData.kid || artifactsModule.computeKid(keyData.publicKey),
-      issuer: config.issuer || keyData.issuer || "protect-mcp"
-    };
-  } catch (err) {
-    signingInitError = `failed to initialize signer: ${err instanceof Error ? err.message : err}`;
-    artifactsModule = null;
-    warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
-  }
-  return warnings;
-}
-function signDecision(entry) {
-  const artifactType = entry.decision === "deny" ? "gateway_restraint" : "decision_receipt";
-  if (signingConfigured && signingInitError) {
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: `signing initialization failed: ${signingInitError}`,
-      error: signingInitError
-    };
-  }
-  if (signingConfigured && (!signerState || !artifactsModule)) {
-    const error = "signing was configured but no signer is ready";
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: error,
-      error
-    };
-  }
-  if (!signerState || !artifactsModule) {
-    return { ok: false, signed: null, artifact_type: "none" };
-  }
-  try {
-    const payload = {
-      tool: entry.tool,
-      decision: entry.decision,
-      reason_code: entry.reason_code,
-      policy_digest: entry.policy_digest,
-      scope: entry.request_id,
-      // request scope
-      mode: entry.mode,
-      request_id: entry.request_id,
-      // Spec version: ties every receipt to the IETF standard
-      spec: "draft-farley-acta-signed-receipts-01",
-      // Issuer certification: distinguishes VOPRF-backed receipts from self-signed ones
-      // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
-      // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
-      // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified",
-      // The signer's PUBLIC key, inside the signed payload, so a receipt is
-      // self-contained: any verifier (including the record viewer, in-browser)
-      // can check the signature without a side channel. Binding the key inside
-      // the signature means it cannot be swapped without breaking the signature;
-      // authenticity (that the key is YOUR gate's) still comes from pinning it.
-      public_key: signerState.publicKey
-    };
-    if (entry.tier) payload.tier = entry.tier;
-    if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
-    if (entry.rate_limit_remaining !== void 0) {
-      payload.rate_limit_remaining = entry.rate_limit_remaining;
-    }
-    if (entry.policy_engine) payload.policy_engine = entry.policy_engine;
-    if (entry.hook_event) payload.hook_event = entry.hook_event;
-    if (entry.sandbox_state) payload.sandbox_state = entry.sandbox_state;
-    if (entry.timing) payload.timing = entry.timing;
-    if (entry.swarm) payload.swarm = entry.swarm;
-    if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
-    if (entry.enrichment) payload.enrichment = entry.enrichment;
-    if (entry.action_readback) payload.action_readback = entry.action_readback;
-    if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
-    const result = artifactsModule.createSignedArtifact(
-      artifactType,
-      payload,
-      signerState.privateKey,
-      {
-        kid: signerState.kid,
-        issuer: signerState.issuer
-      }
-    );
-    return {
-      ok: true,
-      signed: JSON.stringify(result.artifact),
-      artifact_type: artifactType
-    };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "unknown error";
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: `signing failed: ${message}`,
-      error: message
-    };
-  }
-}
-function getSignerInfo() {
-  if (!signerState) return null;
-  return {
-    publicKey: signerState.publicKey,
-    kid: signerState.kid,
-    issuer: signerState.issuer
-  };
-}
-function isSigningEnabled() {
-  return signingConfigured && signingInitError === null && signerState !== null && artifactsModule !== null;
-}
-
 // src/http-server.ts
 import { createServer } from "http";
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { readFileSync, existsSync } from "fs";
 import { join } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var MAX_RECEIPTS = 100;
@@ -333,12 +95,12 @@ function handleHealth(res, startTime, config) {
 }
 function handleStatus(res, logDir) {
   const logPath = join(logDir, LOG_FILE);
-  if (!existsSync2(logPath)) {
+  if (!existsSync(logPath)) {
     res.writeHead(200);
     res.end(JSON.stringify({ entries: 0, message: "no log file yet" }));
     return;
   }
-  const raw = readFileSync3(logPath, "utf-8");
+  const raw = readFileSync(logPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   const entries = [];
   for (const line of lines) {
@@ -462,7 +224,7 @@ function handleListApprovals(res, approvalStore) {
 }
 
 // src/action-readback.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
 var DESTINATION_KEYS = [
   "path",
@@ -542,7 +304,7 @@ function buildActionReadback(tool, input) {
     action,
     destination,
     payload_preview: payloadPreview,
-    payload_hash: createHash2("sha256").update(canonical).digest("hex"),
+    payload_hash: createHash("sha256").update(canonical).digest("hex"),
     payload_bytes: Buffer.byteLength(canonical, "utf-8"),
     disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
     redacted_fields: [...new Set(redactedFields)].slice(0, 80),
@@ -551,14 +313,6 @@ function buildActionReadback(tool, input) {
 }
 
 export {
-  loadPolicy,
-  getToolPolicy,
-  parseRateLimit,
-  checkRateLimit,
-  initSigning,
-  signDecision,
-  getSignerInfo,
-  isSigningEnabled,
   ReceiptBuffer,
   startStatusServer,
   buildActionReadback

package/dist/{chunk-MWXDXYWH.mjs → chunk-FGCNKEEW.mjs}

@@ -1,7 +1,80 @@
-// src/cedar-evaluator.ts
+import {
+  canonicalize
+} from "./chunk-XOP3PEBM.mjs";
+
+// src/policy-digest.ts
 import { createHash } from "crypto";
 import { readFileSync, readdirSync, existsSync } from "fs";
 import { join, extname } from "path";
+var POLICY_DIGEST_CONSTRUCTION = "acta-policy-digest-v1";
+var POLICY_BUNDLE_SCHEMA = "acta.policy-bundle.v1";
+var sha256hex = (data) => createHash("sha256").update(data).digest("hex");
+function digestPolicyFiles(engine, files) {
+  if (files.length === 0) throw new Error("policy digest requires at least one file");
+  const names = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    if (!f.name) throw new Error("policy file entries require a name");
+    if (names.has(f.name)) throw new Error(`duplicate policy file name: ${f.name}`);
+    names.add(f.name);
+  }
+  const entries = files.map((f) => ({ name: f.name, sha256: sha256hex(Buffer.from(f.content, "utf-8")) })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const manifest = { construction: POLICY_DIGEST_CONSTRUCTION, engine, files: entries };
+  return {
+    policy_digest: `sha256:${sha256hex(Buffer.from(canonicalize(manifest), "utf-8"))}`,
+    construction: POLICY_DIGEST_CONSTRUCTION,
+    engine,
+    files: entries
+  };
+}
+function digestCedarDir(dirPath) {
+  if (!existsSync(dirPath)) throw new Error(`Cedar policy directory not found: ${dirPath}`);
+  const names = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  if (names.length === 0) throw new Error(`No .cedar files found in: ${dirPath}`);
+  const files = names.map((name) => ({ name, content: readFileSync(join(dirPath, name), "utf-8") }));
+  return { ...digestPolicyFiles("cedar", files), dir: dirPath };
+}
+function digestCedarSource(source) {
+  return digestPolicyFiles("cedar", [{ name: "policy.cedar", content: source }]);
+}
+function digestBuiltinPolicy(policy) {
+  return digestPolicyFiles("builtin", [{ name: "policy.json", content: canonicalize(policy) }]);
+}
+function shortPolicyLabel(result) {
+  return `${result.engine}:${result.policy_digest.replace(/^sha256:/, "").slice(0, 16)}`;
+}
+function buildPolicyBundle(engine, files, generatedAt) {
+  const d = digestPolicyFiles(engine, files);
+  const byName = new Map(files.map((f) => [f.name, f.content]));
+  return {
+    schema: POLICY_BUNDLE_SCHEMA,
+    construction: POLICY_DIGEST_CONSTRUCTION,
+    engine,
+    policy_digest: d.policy_digest,
+    files: d.files.map((e) => ({ ...e, content: byName.get(e.name) })),
+    generated_at: generatedAt || (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifyPolicyBundle(bundle) {
+  try {
+    const b = bundle;
+    if (!b || b.schema !== POLICY_BUNDLE_SCHEMA) return { valid: false, error: "unknown_schema" };
+    if (b.construction !== POLICY_DIGEST_CONSTRUCTION) return { valid: false, error: "unknown_construction" };
+    if (!Array.isArray(b.files) || b.files.length === 0) return { valid: false, error: "missing_files" };
+    for (const f of b.files) {
+      if (sha256hex(Buffer.from(f.content, "utf-8")) !== f.sha256) {
+        return { valid: false, error: `file_hash_mismatch:${f.name}` };
+      }
+    }
+    const recomputed = digestPolicyFiles(b.engine, b.files.map((f) => ({ name: f.name, content: f.content }))).policy_digest;
+    return recomputed === b.policy_digest ? { valid: true, recomputed } : { valid: false, recomputed, error: "digest_mismatch" };
+  } catch (err) {
+    return { valid: false, error: `verify_error:${err instanceof Error ? err.message : "unknown"}` };
+  }
+}
+
+// src/cedar-evaluator.ts
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
+import { join as join2, extname as extname2 } from "path";
 var cedarWasm = null;
 var loadAttempted = false;
 async function ensureCedarWasm() {
@@ -20,20 +93,19 @@ async function ensureCedarWasm() {
   }
 }
 function loadCedarPolicies(dirPath) {
-  if (!existsSync(dirPath)) {
+  if (!existsSync2(dirPath)) {
     throw new Error(`Cedar policy directory not found: ${dirPath}`);
   }
-  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  const entries = readdirSync2(dirPath).filter((f) => extname2(f) === ".cedar").sort();
   if (entries.length === 0) {
     throw new Error(`No .cedar files found in: ${dirPath}`);
   }
-  const sources = [];
+  const files = [];
   for (const file of entries) {
-    const content = readFileSync(join(dirPath, file), "utf-8");
-    sources.push(content);
+    files.push({ name: file, content: readFileSync2(join2(dirPath, file), "utf-8") });
   }
-  const concatenated = sources.join("\n\n");
-  const digest = createHash("sha256").update(concatenated).digest("hex").slice(0, 16);
+  const concatenated = files.map((f) => f.content).join("\n\n");
+  const digest = digestPolicyFiles("cedar", files).policy_digest;
   return {
     source: concatenated,
     digest,
@@ -174,7 +246,7 @@ async function isCedarAvailable() {
   return ensureCedarWasm();
 }
 function policySetFromSource(source, name = "inline") {
-  const digest = createHash("sha256").update(source).digest("hex").slice(0, 16);
+  const digest = digestCedarSource(source).policy_digest;
   return { source, digest, fileCount: 1, files: [name] };
 }
 async function runEvaluatorSelfTest() {
@@ -202,6 +274,11 @@ async function runEvaluatorSelfTest() {
 }
 
 export {
+  digestCedarDir,
+  digestBuiltinPolicy,
+  shortPolicyLabel,
+  buildPolicyBundle,
+  verifyPolicyBundle,
   loadCedarPolicies,
   evaluateCedar,
   isCedarAvailable,