@intentius/chant-lexicon-cedar 0.106.4 → 0.108.0

package/dist/gate-policy-pack.d.ts

@@ -0,0 +1,130 @@
+/**
+ * A starter policy pack for gates (chant#3182): rules a platform team writes
+ * once and puts on every gate, the way Sentinel or OPA policies run against a
+ * Terraform plan. Each builder returns one cedar `Policy` over the plan
+ * summary core puts in `context.plan` (`GatePlanSummary`, declared by
+ * `GATE_CEDAR_SCHEMA`), so an Op needs no context code of its own.
+ *
+ * ```ts
+ * import { gatePolicy, protectStateful, capDeletes, permitLowRiskAgents } from "@intentius/chant-lexicon-cedar";
+ *
+ * export const prodGate = gatePolicy("prod", [
+ *   protectStateful(),
+ *   capDeletes({ max: 5 }),
+ *   permitLowRiskAgents({ maxChanges: 10 }),
+ * ]);
+ *
+ * gate("approve-prod", { plan: plan.out.planDigest, approval: { policy: prodGate, mode: "log-only" } });
+ * ```
+ *
+ * How the rules combine is Cedar's: a `forbid` beats every `permit`, and with
+ * no permit the answer is deny. The pack's forbids are the limits and its
+ * permits say when an agent may pass a gate on its own. A gate's quorum is
+ * unchanged by any of it, since a deny never removes a human's approval
+ * (`tallyGateApprovals`), and in `log-only` mode, the default, every decision
+ * is recorded and none binds, so a team can watch a rule against real plans
+ * before switching the gate to `enforce`.
+ *
+ * Every forbid fails closed: on a gate whose context has no `plan` (no change
+ * set behind the gate's `plan`), it applies. A limit nobody can check is not
+ * a reason to let an agent through.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+/**
+ * Resource types whose delete or replacement loses data: databases, buckets,
+ * volumes, queues with retention, and keys. Terraform-provider type names
+ * and the CloudFormation names the aws lexicon plans with.
+ */
+export declare const STATEFUL_TYPES: readonly string[];
+/** Who a rule speaks about: agent principals only, or every approver. */
+export type GatePackAppliesTo = "agents" | "everyone";
+interface RuleBase {
+    /** The policy's `@id`, recorded in every decision it determines. Each builder has a default. */
+    id?: string;
+    /** Default `"everyone"` for a forbid. A human's approval still counts toward the quorum whatever a forbid says. */
+    appliesTo?: GatePackAppliesTo;
+}
+export interface CapDeletesOptions extends RuleBase {
+    /** The most deletes a plan may carry. Default 0. */
+    max?: number;
+}
+/** Forbid a plan that deletes more than `max` resources. Default id `cap-deletes`. */
+export declare function capDeletes(options?: CapDeletesOptions): Declarable;
+export interface CapReplacementsOptions extends RuleBase {
+    /** The most replacements a plan may carry. Default 0. */
+    max?: number;
+}
+/** Forbid a plan that replaces more than `max` resources. Default id `cap-replacements`. */
+export declare function capReplacements(options?: CapReplacementsOptions): Declarable;
+export interface ProtectStatefulOptions extends RuleBase {
+    /** The types that hold state. Default {@link STATEFUL_TYPES}. */
+    types?: readonly string[];
+    /** Forbid deletes of these types. Default true. */
+    deletes?: boolean;
+    /** Forbid replacements of these types, which delete the old object too. Default true. */
+    replacements?: boolean;
+}
+/**
+ * Forbid a plan that deletes or replaces a resource of a stateful type: an
+ * RDS instance, a DynamoDB table, a bucket. Default id `protect-stateful`.
+ */
+export declare function protectStateful(options?: ProtectStatefulOptions): Declarable;
+export interface AllowRegionsOptions extends RuleBase {
+    regions: readonly string[];
+}
+/** Forbid a plan that changes anything outside these regions. Default id `allow-regions`. */
+export declare function allowRegions(options: AllowRegionsOptions): Declarable;
+export interface RequireCreateTagsOptions extends RuleBase {
+    /** Tag (or label) keys every created resource must carry. */
+    keys: readonly string[];
+    /**
+     * Also forbid creates that carry no tags attribute at all. Default false,
+     * because many types have no tags (an IAM policy attachment, a route), and
+     * a create with tags left unset reads the same.
+     */
+    strict?: boolean;
+}
+/**
+ * Forbid a plan whose tagged creates do not all carry `keys`. Reads
+ * `tags`, `tags_all` and `labels`. Default id `require-create-tags`.
+ */
+export declare function requireCreateTags(options: RequireCreateTagsOptions): Declarable;
+export interface PermitLowRiskAgentsOptions {
+    /** Default id `permit-low-risk-agents`. */
+    id?: string;
+    /** The most changes (creates, updates, replaces, deletes) a low-risk plan has. Default 10. */
+    maxChanges?: number;
+}
+/**
+ * Permit an agent to pass a gate on its own for a plan that deletes and
+ * replaces nothing, changes at most `maxChanges` resources, and planned
+ * every member in full (no failed member, no hole). In `enforce` mode that
+ * permit passes the gate; any forbid in the same set still wins.
+ */
+export declare function permitLowRiskAgents(options?: PermitLowRiskAgentsOptions): Declarable;
+/** Permit an agent to pass a plan that only changes tags or labels. Default id `permit-tag-only-agents`. */
+export declare function permitTagOnlyAgents(options?: {
+    id?: string;
+}): Declarable;
+export interface StarterGatePoliciesOptions {
+    /** {@link capDeletes}'s max. Default 0. */
+    maxDeletes?: number;
+    /** {@link capReplacements}'s max. Default: no cap beyond {@link protectStateful}. */
+    maxReplacements?: number;
+    /** {@link protectStateful}'s types. Default {@link STATEFUL_TYPES}. */
+    statefulTypes?: readonly string[];
+    /** {@link allowRegions}. Absent, regions are not limited. */
+    regions?: readonly string[];
+    /** {@link requireCreateTags}. Absent, tags are not required. */
+    requiredTags?: readonly string[];
+    /** {@link permitLowRiskAgents}'s maxChanges. Default 10. */
+    agentMaxChanges?: number;
+}
+/**
+ * The pack as one record for `gatePolicy(name, starterGatePolicies(...))`:
+ * stateful types protected, deletes capped, regions and tags when given,
+ * and the two agent permits.
+ */
+export declare function starterGatePolicies(options?: StarterGatePoliciesOptions): Record<string, Declarable>;
+export {};
+//# sourceMappingURL=gate-policy-pack.d.ts.map

package/dist/gate-policy-pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-policy-pack.d.ts","sourceRoot":"","sources":["../src/gate-policy-pack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAK9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAwB3C,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEtD,UAAU,QAAQ;IAChB,gGAAgG;IAChG,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mHAAmH;IACnH,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAwCD,MAAM,WAAW,iBAAkB,SAAQ,QAAQ;IACjD,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,sFAAsF;AACtF,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAOtE;AAED,MAAM,WAAW,sBAAuB,SAAQ,QAAQ;IACtD,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,UAAU,CAOhF;AAED,MAAM,WAAW,sBAAuB,SAAQ,QAAQ;IACtD,iEAAiE;IACjE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,yFAAyF;IACzF,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,UAAU,CAchF;AAED,MAAM,WAAW,mBAAoB,SAAQ,QAAQ;IACnD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,UAAU,CAOrE;AAED,MAAM,WAAW,wBAAyB,SAAQ,QAAQ;IACxD,6DAA6D;IAC7D,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,UAAU,CAQ/E;AAED,MAAM,WAAW,0BAA0B;IACzC,2CAA2C;IAC3C,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,UAAU,CAgBxF;AAED,4GAA4G;AAC5G,wBAAgB,mBAAmB,CAAC,OAAO,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,UAAU,CAW7E;AAED,MAAM,WAAW,0BAA0B;IACzC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,6DAA6D;IAC7D,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,gEAAgE;IAChE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAUxG"}

package/dist/gate-policy.d.ts

@@ -26,6 +26,7 @@
  */
 import type { Declarable } from "@intentius/chant/declarable";
 import { type GatePolicyAnswer, type GatePolicyRef, type GatePolicyRequest } from "@intentius/chant/op";
+import { loadWasm } from "./lint/post-synth/wasm-helpers.js";
 export declare const GATE_HUMAN_TYPE = "Chant::Human";
 export declare const GATE_AGENT_TYPE = "Chant::Agent";
 export declare const GATE_ROLE_TYPE = "Chant::Role";
@@ -56,6 +57,13 @@ export type GatePolicies = Declarable | readonly Declarable[] | Readonly<Record<
  * ```
  */
 export declare function gatePolicy(name: string, policies: GatePolicies): GatePolicyRef;
+/**
+ * The set as a record keyed by each policy's `@id`. Handed the text whole,
+ * cedar-wasm names policies by position (`policy0`), and a recorded decision
+ * would then name a rule nobody wrote. A policy with no `@id` keeps its
+ * positional name. Exported for `./gate-schema.ts`, so validation names rules the same way.
+ */
+export declare function keyedById(wasm: NonNullable<ReturnType<typeof loadWasm>>, policy: GatePolicyRef): Record<string, string>;
 /**
  * Evaluate one `PassGate` request. Called by core through
  * `loadGatePolicyEvaluator("cedar")`; see the module doc for the entity model.

package/dist/gate-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-policy.d.ts","sourceRoot":"","sources":["../src/gate-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAK7B,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAC9C,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAC9C,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAChD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,gCAA8B,CAAC;AAE5D,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAcrG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,aAAa,CA0B9E;AA0CD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA+BtG"}
+{"version":3,"file":"gate-policy.d.ts","sourceRoot":"","sources":["../src/gate-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAiB,QAAQ,EAAiB,MAAM,gCAAgC,CAAC;AAExF,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAC9C,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAC9C,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAChD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,gCAA8B,CAAC;AAE5D,iHAAiH;AACjH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAcrG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,aAAa,CA0B9E;AAsBD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYvH;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CA+BtG"}

package/dist/gate-schema.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The Cedar schema of a gate's `PassGate` request (chant#3182).
+ *
+ * {@link GATE_CEDAR_SCHEMA} declares the `Chant` namespace `evaluateGatePolicy`
+ * builds requests in (`./gate-policy.ts`), with the plan summary core puts in
+ * `context.plan` (`@intentius/chant/op`'s `GatePlanSummary`) as the common type
+ * `Chant::PlanSummary`. Two uses:
+ *
+ * - {@link validateGatePolicy} checks a gate policy set against it, so a rule
+ *   that reads `context.plan.deleteCount` (a field that does not exist) fails
+ *   where it is written rather than erroring on every request.
+ * - A project that writes gate policies with typed `Policy` scopes puts this
+ *   text in its own `.cedarschema` (or hands {@link gateCedarSchema}'s output
+ *   to `new Schema({ text })`), and the generated scope types then name
+ *   `Chant::Agent` and `Chant::Action::"PassGate"` without a cast.
+ *
+ * A gate's own `approval.context` keys differ per gate, so the schema declares
+ * only `planDigest` and `plan` unless {@link gateCedarSchema} is told the rest.
+ * Every context attribute is optional: a gate with no plan, or a plan step
+ * that returned no change set, has neither.
+ */
+import type { GatePlanSummary, GatePolicyRef } from "@intentius/chant/op";
+import { type ValidationFinding } from "./lint/post-synth/wasm-helpers.js";
+/**
+ * Each `GatePlanSummary` field as a Cedar type. Typed as a record over the
+ * summary's keys, so a field added to the summary in core fails to compile
+ * here until the schema says what it is.
+ */
+export declare const GATE_PLAN_SUMMARY_CEDAR_TYPES: {
+    readonly [K in keyof GatePlanSummary]: string;
+};
+export interface GateCedarSchemaOptions {
+    /**
+     * The gate's own `approval.context` attributes, as Cedar types
+     * (`{ risk: "String", paths: "Set<String>" }`). Each is declared optional,
+     * since a step-output reference that resolves to nothing is left out.
+     */
+    context?: Readonly<Record<string, string>>;
+}
+/** The schema text, with the gate's own context attributes when given. */
+export declare function gateCedarSchema(options?: GateCedarSchemaOptions): string;
+/** The schema with no gate-specific context: `planDigest` and `plan` only. */
+export declare const GATE_CEDAR_SCHEMA: string;
+export interface GatePolicyValidation {
+    errors: ValidationFinding[];
+    warnings: ValidationFinding[];
+}
+/**
+ * Validate a gate policy set against the gate schema. Throws when the wasm
+ * cannot be loaded or validation cannot run at all (a schema that does not
+ * parse); findings come back sorted.
+ */
+export declare function validateGatePolicy(policy: GatePolicyRef, options?: GateCedarSchemaOptions): GatePolicyValidation;
+//# sourceMappingURL=gate-schema.d.ts.map

package/dist/gate-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-schema.d.ts","sourceRoot":"","sources":["../src/gate-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGpH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,eAAe,GAAG,MAAM;CA8B1F,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5C;AAID,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAyC5E;AAED,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,QAAoB,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,sBAA2B,GAAG,oBAAoB,CAMpH"}

package/dist/index.d.ts

@@ -3,6 +3,10 @@ export { cedarSerializer, policyIdFromLogicalName, resolvePolicyId, cedarPolicyR
 export { CEDAR_POLICY_TYPE, CEDAR_JSON_FILENAME } from "./serializer.js";
 export { gatePolicy, evaluateGatePolicy, GATE_HUMAN_TYPE, GATE_AGENT_TYPE, GATE_ROLE_TYPE, GATE_RESOURCE_TYPE, PASS_GATE_ACTION, } from "./gate-policy.js";
 export type { GatePolicies } from "./gate-policy.js";
+export { GATE_CEDAR_SCHEMA, GATE_PLAN_SUMMARY_CEDAR_TYPES, gateCedarSchema, validateGatePolicy, } from "./gate-schema.js";
+export type { GateCedarSchemaOptions, GatePolicyValidation } from "./gate-schema.js";
+export { STATEFUL_TYPES, allowRegions, capDeletes, capReplacements, permitLowRiskAgents, permitTagOnlyAgents, protectStateful, requireCreateTags, starterGatePolicies, } from "./gate-policy-pack.js";
+export type { AllowRegionsOptions, CapDeletesOptions, CapReplacementsOptions, GatePackAppliesTo, PermitLowRiskAgentsOptions, ProtectStatefulOptions, RequireCreateTagsOptions, StarterGatePoliciesOptions, } from "./gate-policy-pack.js";
 export type { CedarEffect, CedarScope, CedarPolicyProps, CedarPolicyRecord } from "./serializer.js";
 export { avpStatement, avpStatementJSON, avpPolicyDefinition, avpPolicyResource, avpPolicySet, } from "./avp/embed.js";
 export type { AvpEmbedOptions, AvpPolicyDefinition, AvpPolicyResource, AvpStaticDefinition, } from "./avp/embed.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACL,UAAU,EAAE,kBAAkB,EAC9B,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,GACvF,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACnG,YAAY,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAWhG,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAClI,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACL,UAAU,EAAE,kBAAkB,EAC9B,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,GACvF,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,EACL,iBAAiB,EAAE,6BAA6B,EAAE,eAAe,EAAE,kBAAkB,GACtF,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EACL,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,EACnG,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,GACxD,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAC7G,sBAAsB,EAAE,wBAAwB,EAAE,0BAA0B,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACnG,YAAY,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAWhG,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAClI,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2287d1c3821e927277333d5629f063c6715cdeb6c715b401ea2d67792f95bc22",
+    "manifest.json": "06acb88938cb2c036ad5d0031b53a01387657ebac95c6a50507f3c027362f5cf",
     "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
     "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
     "rules/policy-shape.ts": "1654730d188b7163dbad3051c75a562198a96eda6d36ce35701f2b729bf45194",
@@ -30,5 +30,5 @@
     "skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a",
     "skills/chant-cedar-dogwood.md": "7e52d3f045c1c34e00fdef76014a05483fb9dd58cc41037621a76bc298776d8f"
   },
-  "composite": "223788241153175ea325822184fcd10ed7dd6926904fadd5a8702f7bded1d592"
+  "composite": "80f662a22726fff34698a908c0bc926ec8abbd36226baa5eed1c07df4a64e119"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cedar",
-  "version": "0.106.4",
+  "version": "0.108.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Cedar",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-cedar",
-  "version": "0.106.4",
+  "version": "0.108.0",
   "description": "Cedar lexicon for chant — typed authoring for Cedar authorization policies",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.106.4",
+    "@intentius/chant": "^0.108.0",
     "typescript": "^5.9.3"
   }
 }

package/src/gate-policy-pack.test.ts

@@ -0,0 +1,262 @@
+/**
+ * The starter gate policy pack and the gate's Cedar schema (chant#3182),
+ * evaluated by the real cedar-wasm against plan summaries core builds from
+ * change sets. The Done-when of #3182 is the first describe: a gate denies an
+ * agent's approval of a plan that deletes an RDS instance, with no context
+ * code in the Op, using a policy from the pack.
+ */
+import { describe, test, expect } from "vitest";
+import {
+  gatePlanSummary, gatePolicyRequest, loadGatePolicyEvaluator, runOpLocally, stepOutput,
+  type ActivityFn, type GateApproval, type GateLedgerPort, type GatePolicyDecision, type OpConfig,
+} from "@intentius/chant/op";
+import type { ChangeSetEntry, ChangeSetPart } from "@intentius/chant/change-set";
+import type { GateResolutionRecord, PendingGateRecord } from "@intentius/chant/lifecycle/gate-ledger";
+import { Policy } from "./generated/index";
+import { evaluateGatePolicy, gatePolicy } from "./gate-policy";
+import {
+  allowRegions, capDeletes, capReplacements, permitLowRiskAgents, permitTagOnlyAgents, protectStateful,
+  requireCreateTags, starterGatePolicies,
+} from "./gate-policy-pack";
+import { GATE_CEDAR_SCHEMA, GATE_PLAN_SUMMARY_CEDAR_TYPES, gateCedarSchema, validateGatePolicy } from "./gate-schema";
+
+const DIGEST = `sha256:${"b".repeat(64)}`;
+
+function entry(address: string, action: ChangeSetEntry["action"], extra: Partial<ChangeSetEntry> = {}): ChangeSetEntry {
+  return { member: "estate", lexicon: "terraform", planner: "terraform", address, type: address.split(".")[0], action, attributes: [], ...extra };
+}
+
+function part(entries: ChangeSetEntry[]): ChangeSetPart {
+  return {
+    member: { member: "estate", lexicon: "terraform", planner: "terraform", status: "planned", planDigest: DIGEST, holes: [] },
+    entries,
+  };
+}
+
+const DELETES_RDS = part([
+  entry("aws_db_instance.orders", "delete", { disruption: "destroy", region: "us-east-1" }),
+  entry("aws_security_group.db", "update", { disruption: "in-place", region: "us-east-1", attributes: [{ path: "description", after: "x" }] }),
+]);
+const ADDS_A_BUCKET = part([
+  entry("aws_s3_bucket.assets", "create", { region: "us-east-1", attributes: [{ path: "tags", after: { owner: "web", env: "prod" } }] }),
+]);
+
+function ask(kind: "human" | "agent", plan: ChangeSetPart | undefined, extra: Record<string, unknown> = {}) {
+  return gatePolicyRequest({
+    op: "estate-apply", gate: "approve", resolvedBy: kind === "agent" ? "deploy-bot" : "alex",
+    approver: { kind, roles: [] }, planDigest: DIGEST,
+    context: { ...extra, ...(plan ? { plan: gatePlanSummary({ members: [plan.member], entries: plan.entries }) } : {}) },
+  });
+}
+
+/** A ledger in memory that a test appends approvals to between runs. */
+function memoryLedger() {
+  const resolutions: GateResolutionRecord[] = [];
+  const pending: PendingGateRecord[] = [];
+  const port: GateLedgerPort = {
+    async read() { return { resolutions: [...resolutions], pending: [...pending] }; },
+    async appendPending(input) {
+      const record: PendingGateRecord = { version: 1, kind: "pending", ...input };
+      pending.push(record);
+      return { record, pushed: true };
+    },
+  };
+  return { port, resolutions, pending };
+}
+
+/** An Op a team writes once: plan, a gate on the plan with the pack, apply. Nothing in it computes context. */
+function estateApply(approval: GateApproval): OpConfig {
+  return {
+    name: "estate-apply",
+    overview: "",
+    phases: [
+      { name: "Plan", steps: [{ kind: "activity", fn: "planEstate", id: "plan", args: {} }] },
+      { name: "Gate", steps: [{ kind: "gate", gate: "approve", plan: stepOutput("plan", "planDigest"), approval }] },
+      { name: "Apply", steps: [{ kind: "activity", fn: "applyEstate", args: {} }] },
+    ],
+  };
+}
+
+/**
+ * What `chant approve --actor deploy-bot --agent` does for a gate with a
+ * policy: evaluate it against the context the gated run recorded, through the
+ * same loader, and record the decision next to the approval.
+ */
+async function agentApproves(ledger: ReturnType<typeof memoryLedger>, at: string): Promise<GatePolicyDecision> {
+  const standing = ledger.pending[ledger.pending.length - 1];
+  const approval = standing.approval!;
+  const evaluator = await loadGatePolicyEvaluator(approval.policy!.lexicon);
+  const answer = await evaluator.evaluateGatePolicy(approval.policy!, gatePolicyRequest({
+    op: standing.op, gate: standing.gate, resolvedBy: "deploy-bot", approver: { kind: "agent" },
+    ...(standing.planDigest ? { planDigest: standing.planDigest } : {}),
+    ...(approval.context ? { context: approval.context } : {}),
+  }));
+  const policyDecision: GatePolicyDecision = { policy: approval.policy!.name, version: approval.policy!.version, mode: approval.mode, ...answer };
+  ledger.resolutions.push({
+    version: 1, op: standing.op, gate: standing.gate, resolvedBy: "deploy-bot", timestamp: at,
+    approver: { kind: "agent" }, policyDecision, ...(standing.planDigest ? { planDigest: standing.planDigest } : {}),
+  });
+  return policyDecision;
+}
+
+describe("#3182 Done when: a gate denies an agent's approval of a plan that deletes an RDS instance", () => {
+  const policy = gatePolicy("prod", starterGatePolicies());
+
+  function activitiesFor(plan: ChangeSetPart, applied: string[]) {
+    return new Map<string, ActivityFn>([
+      // terraformPlan's result shape: the digest the gate binds, and the root's change-set part.
+      ["planEstate", async () => ({ planDigest: plan.member.planDigest, changeSet: plan })],
+      ["applyEstate", async () => { applied.push("apply"); return {}; }],
+    ]);
+  }
+
+  test("enforce: the agent's approval is denied by protect-stateful and the run stays gated", async () => {
+    const ledger = memoryLedger();
+    const applied: string[] = [];
+    const op = estateApply({ policy, mode: "enforce" });
+
+    const first = await runOpLocally(op, activitiesFor(DELETES_RDS, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:00:00.000Z" });
+    expect(first.status).toBe("gated");
+    const recorded = ledger.pending[0].approval?.context?.plan as { deletedTypes: string[] };
+    expect(recorded.deletedTypes).toEqual(["aws_db_instance"]);
+
+    const decision = await agentApproves(ledger, "2026-10-06T12:01:00.000Z");
+    expect(decision.decision).toBe("deny");
+    expect(decision.determining).toEqual(["cap-deletes", "protect-stateful"]);
+
+    const second = await runOpLocally(op, activitiesFor(DELETES_RDS, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:02:00.000Z" });
+    expect(second.status).toBe("gated");
+    expect(applied).toEqual([]);
+  });
+
+  test("enforce: the same Op and pack let the agent through a plan that only adds a bucket", async () => {
+    const ledger = memoryLedger();
+    const applied: string[] = [];
+    const op = estateApply({ policy, mode: "enforce" });
+
+    await runOpLocally(op, activitiesFor(ADDS_A_BUCKET, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:00:00.000Z" });
+    const decision = await agentApproves(ledger, "2026-10-06T12:01:00.000Z");
+    expect(decision).toMatchObject({ decision: "allow", determining: ["permit-low-risk-agents"] });
+
+    const second = await runOpLocally(op, activitiesFor(ADDS_A_BUCKET, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:02:00.000Z" });
+    expect(second.status).toBe("ok");
+    expect(second.records.find((r) => r.fn === "gate:approve")?.approval).toMatchObject({ resolvedBy: "deploy-bot", via: "policy" });
+    expect(applied).toEqual(["apply"]);
+  });
+
+  test("log-only: the deny is recorded and nothing binds, so the agent alone does not pass and the team sees why", async () => {
+    const ledger = memoryLedger();
+    const applied: string[] = [];
+    const op = estateApply({ policy, mode: "log-only" });
+    await runOpLocally(op, activitiesFor(ADDS_A_BUCKET, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:00:00.000Z" });
+    const decision = await agentApproves(ledger, "2026-10-06T12:01:00.000Z");
+    expect(decision).toMatchObject({ decision: "allow", mode: "log-only" });
+    const second = await runOpLocally(op, activitiesFor(ADDS_A_BUCKET, applied), {}, undefined, { gates: ledger.port, now: "2026-10-06T12:02:00.000Z" });
+    expect(second.status).toBe("gated");
+  });
+});
+
+describe("the pack's rules (#3182)", () => {
+  const evaluate = (policies: Parameters<typeof gatePolicy>[1], kind: "human" | "agent", plan: ChangeSetPart | undefined) =>
+    evaluateGatePolicy(gatePolicy("pack", policies), ask(kind, plan));
+  const permitAll = permitLowRiskAgents({ maxChanges: 1000 });
+
+  test("protectStateful forbids deleting or replacing a stateful type, and lets other changes by", () => {
+    expect(evaluate([protectStateful(), permitAll], "agent", DELETES_RDS)).toMatchObject({ decision: "deny", determining: ["protect-stateful"] });
+    const replacesDynamo = part([entry("aws_dynamodb_table.t", "replace", { disruption: "destroy" })]);
+    expect(evaluate([protectStateful(), permitLowRiskAgents()], "agent", replacesDynamo).decision).toBe("deny");
+    expect(evaluate([protectStateful({ replacements: false }), capReplacements({ max: 5 })], "agent", replacesDynamo).determining).toEqual([]);
+    expect(evaluate([protectStateful(), permitAll], "agent", ADDS_A_BUCKET).decision).toBe("allow");
+  });
+
+  test("protectStateful reads the aws lexicon's CloudFormation type names too", () => {
+    const cfn = part([entry("OrdersDb", "delete", { type: "AWS::RDS::DBInstance", lexicon: "aws", planner: "chant" })]);
+    expect(evaluate([protectStateful(), permitAll], "agent", cfn).determining).toEqual(["protect-stateful"]);
+  });
+
+  test("capDeletes and capReplacements forbid past their max", () => {
+    const twoDeletes = part([entry("aws_route.a", "delete"), entry("aws_route.b", "delete")]);
+    expect(evaluate([capDeletes({ max: 1 })], "agent", twoDeletes).determining).toEqual(["cap-deletes"]);
+    expect(evaluate([capDeletes({ max: 2 })], "agent", twoDeletes).determining).toEqual([]);
+    const replace = part([entry("aws_instance.web", "replace")]);
+    expect(evaluate([capReplacements()], "agent", replace).determining).toEqual(["cap-replacements"]);
+    expect(() => capDeletes({ max: -1 })).toThrow("at least 0");
+  });
+
+  test("allowRegions forbids a change outside the list", () => {
+    const eu = part([entry("aws_instance.web", "create", { region: "eu-west-1" })]);
+    const rule = allowRegions({ regions: ["us-east-1", "us-west-2"] });
+    expect(evaluate([rule], "agent", eu).determining).toEqual(["allow-regions"]);
+    expect(evaluate([rule], "agent", ADDS_A_BUCKET).determining).toEqual([]);
+  });
+
+  test("requireCreateTags forbids a tagged create missing a key, and strict also forbids untagged creates", () => {
+    const rule = requireCreateTags({ keys: ["owner", "env"] });
+    expect(evaluate([rule], "agent", ADDS_A_BUCKET).determining).toEqual([]);
+    const noEnv = part([entry("aws_s3_bucket.b", "create", { attributes: [{ path: "tags", after: { owner: "web" } }] })]);
+    expect(evaluate([rule], "agent", noEnv).determining).toEqual(["require-create-tags"]);
+    const untagged = part([entry("aws_s3_bucket.c", "create")]);
+    expect(evaluate([rule], "agent", untagged).determining).toEqual([]);
+    expect(evaluate([requireCreateTags({ keys: ["owner"], strict: true })], "agent", untagged).determining).toEqual(["require-create-tags"]);
+  });
+
+  test("permitLowRiskAgents permits an agent only, and only within its limits", () => {
+    expect(evaluate([permitLowRiskAgents()], "agent", ADDS_A_BUCKET).decision).toBe("allow");
+    expect(evaluate([permitLowRiskAgents()], "human", ADDS_A_BUCKET).decision).toBe("deny");
+    expect(evaluate([permitLowRiskAgents()], "agent", DELETES_RDS).decision).toBe("deny");
+    const many = part(Array.from({ length: 4 }, (_, i) => entry(`aws_route.r${i}`, "create")));
+    expect(evaluate([permitLowRiskAgents({ maxChanges: 3 })], "agent", many).decision).toBe("deny");
+  });
+
+  test("permitTagOnlyAgents permits a plan that only retags", () => {
+    const retag = part([entry("aws_instance.web", "update", { attributes: [{ path: "tags", before: { a: "1" }, after: { a: "2" } }] })]);
+    expect(evaluate([permitTagOnlyAgents()], "agent", retag)).toMatchObject({ decision: "allow", determining: ["permit-tag-only-agents"] });
+    expect(evaluate([permitTagOnlyAgents()], "agent", ADDS_A_BUCKET).decision).toBe("deny");
+  });
+
+  test("every forbid fails closed on a request with no plan summary, and the permits do not apply", () => {
+    for (const rule of [protectStateful(), capDeletes(), capReplacements(), allowRegions({ regions: ["us-east-1"] }), requireCreateTags({ keys: ["owner"] })]) {
+      const answer = evaluate([rule, permitTagOnlyAgents()], "agent", undefined);
+      expect(answer.decision).toBe("deny");
+      expect(answer.determining).toHaveLength(1);
+      expect(answer.errors).toEqual([]);
+    }
+    expect(evaluate([permitLowRiskAgents()], "agent", undefined)).toMatchObject({ decision: "deny", determining: [], errors: [] });
+  });
+
+  test("appliesTo agents leaves a human's decision alone", () => {
+    expect(evaluate([capDeletes({ appliesTo: "agents" }), permitLowRiskAgents()], "human", DELETES_RDS).determining).toEqual([]);
+    expect(evaluate([capDeletes(), permitLowRiskAgents()], "human", DELETES_RDS).determining).toEqual(["cap-deletes"]);
+  });
+});
+
+describe("the gate's Cedar schema (#3182)", () => {
+  test("declares every field of the plan summary core builds", () => {
+    const summary = gatePlanSummary({ members: [DELETES_RDS.member], entries: DELETES_RDS.entries });
+    expect(Object.keys(GATE_PLAN_SUMMARY_CEDAR_TYPES).sort()).toEqual(Object.keys(summary).sort());
+    for (const key of Object.keys(summary)) expect(GATE_CEDAR_SCHEMA).toContain(`"${key}": `);
+  });
+
+  test("every rule in the pack validates against it", () => {
+    const all = gatePolicy("all", {
+      ...starterGatePolicies({ maxReplacements: 2, regions: ["us-east-1"], requiredTags: ["owner"] }),
+      strictTags: requireCreateTags({ id: "strict-tags", keys: ["owner"], strict: true }),
+      agentDeletes: capDeletes({ id: "agent-deletes", appliesTo: "agents" }),
+    });
+    expect(validateGatePolicy(all)).toEqual({ errors: [], warnings: [] });
+  });
+
+  test("a rule that reads a field the summary does not have fails validation", () => {
+    const typo = gatePolicy("typo", { typo: new Policy({ effect: "forbid", when: ["context has plan && context.plan.deleteCount > 0"] }) });
+    expect(validateGatePolicy(typo).errors.map((e) => e.policyId)).toEqual(["typo"]);
+  });
+
+  test("a gate's own context attributes are declared when given", () => {
+    const risky = gatePolicy("risk", { risk: new Policy({ effect: "forbid", when: ['context has risk && context.risk == "high"'] }) });
+    // Undeclared, the validator reports the rule (as an error or as an impossible policy).
+    const undeclared = validateGatePolicy(risky);
+    expect(undeclared.errors.length + undeclared.warnings.length).toBeGreaterThan(0);
+    expect(validateGatePolicy(risky, { context: { risk: "String" } })).toEqual({ errors: [], warnings: [] });
+    expect(() => gateCedarSchema({ context: { plan: "String" } })).toThrow("chant's own");
+  });
+});

package/src/gate-policy-pack.ts

@@ -0,0 +1,290 @@
+/**
+ * A starter policy pack for gates (chant#3182): rules a platform team writes
+ * once and puts on every gate, the way Sentinel or OPA policies run against a
+ * Terraform plan. Each builder returns one cedar `Policy` over the plan
+ * summary core puts in `context.plan` (`GatePlanSummary`, declared by
+ * `GATE_CEDAR_SCHEMA`), so an Op needs no context code of its own.
+ *
+ * ```ts
+ * import { gatePolicy, protectStateful, capDeletes, permitLowRiskAgents } from "@intentius/chant-lexicon-cedar";
+ *
+ * export const prodGate = gatePolicy("prod", [
+ *   protectStateful(),
+ *   capDeletes({ max: 5 }),
+ *   permitLowRiskAgents({ maxChanges: 10 }),
+ * ]);
+ *
+ * gate("approve-prod", { plan: plan.out.planDigest, approval: { policy: prodGate, mode: "log-only" } });
+ * ```
+ *
+ * How the rules combine is Cedar's: a `forbid` beats every `permit`, and with
+ * no permit the answer is deny. The pack's forbids are the limits and its
+ * permits say when an agent may pass a gate on its own. A gate's quorum is
+ * unchanged by any of it, since a deny never removes a human's approval
+ * (`tallyGateApprovals`), and in `log-only` mode, the default, every decision
+ * is recorded and none binds, so a team can watch a rule against real plans
+ * before switching the gate to `enforce`.
+ *
+ * Every forbid fails closed: on a gate whose context has no `plan` (no change
+ * set behind the gate's `plan`), it applies. A limit nobody can check is not
+ * a reason to let an agent through.
+ */
+
+import type { Declarable } from "@intentius/chant/declarable";
+import { Policy, type EntityTypeName, type PolicyRef, type PolicyScope } from "./generated/index";
+import { escapeCedarString } from "./policy-text";
+import { GATE_AGENT_TYPE, PASS_GATE_ACTION } from "./gate-policy";
+
+/**
+ * Resource types whose delete or replacement loses data: databases, buckets,
+ * volumes, queues with retention, and keys. Terraform-provider type names
+ * and the CloudFormation names the aws lexicon plans with.
+ */
+export const STATEFUL_TYPES: readonly string[] = [
+  // AWS, terraform
+  "aws_db_instance", "aws_rds_cluster", "aws_rds_cluster_instance", "aws_rds_global_cluster",
+  "aws_dynamodb_table", "aws_dynamodb_global_table", "aws_s3_bucket", "aws_efs_file_system",
+  "aws_ebs_volume", "aws_elasticache_cluster", "aws_elasticache_replication_group",
+  "aws_docdb_cluster", "aws_neptune_cluster", "aws_redshift_cluster", "aws_opensearch_domain",
+  "aws_elasticsearch_domain", "aws_msk_cluster", "aws_kinesis_stream", "aws_sqs_queue",
+  "aws_kms_key", "aws_secretsmanager_secret", "aws_backup_vault", "aws_fsx_lustre_file_system",
+  // AWS, CloudFormation
+  "AWS::RDS::DBInstance", "AWS::RDS::DBCluster", "AWS::RDS::GlobalCluster", "AWS::DynamoDB::Table",
+  "AWS::DynamoDB::GlobalTable", "AWS::S3::Bucket", "AWS::EFS::FileSystem", "AWS::EC2::Volume",
+  "AWS::ElastiCache::CacheCluster", "AWS::ElastiCache::ReplicationGroup", "AWS::DocDB::DBCluster",
+  "AWS::Neptune::DBCluster", "AWS::Redshift::Cluster", "AWS::OpenSearchService::Domain",
+  "AWS::MSK::Cluster", "AWS::Kinesis::Stream", "AWS::SQS::Queue", "AWS::KMS::Key",
+  "AWS::SecretsManager::Secret", "AWS::Backup::BackupVault",
+  // Google Cloud
+  "google_sql_database_instance", "google_sql_database", "google_storage_bucket",
+  "google_bigquery_dataset", "google_bigquery_table", "google_spanner_instance",
+  "google_spanner_database", "google_compute_disk", "google_filestore_instance",
+  "google_redis_instance", "google_kms_crypto_key", "google_bigtable_instance",
+  // Azure
+  "azurerm_mssql_server", "azurerm_mssql_database", "azurerm_postgresql_flexible_server",
+  "azurerm_mysql_flexible_server", "azurerm_storage_account", "azurerm_cosmosdb_account",
+  "azurerm_managed_disk", "azurerm_redis_cache", "azurerm_key_vault",
+];
+
+/** Who a rule speaks about: agent principals only, or every approver. */
+export type GatePackAppliesTo = "agents" | "everyone";
+
+interface RuleBase {
+  /** The policy's `@id`, recorded in every decision it determines. Each builder has a default. */
+  id?: string;
+  /** Default `"everyone"` for a forbid. A human's approval still counts toward the quorum whatever a forbid says. */
+  appliesTo?: GatePackAppliesTo;
+}
+
+// The generated scope types are narrowed to the project's own schema; these
+// names are the gate schema's (`GATE_CEDAR_SCHEMA`).
+const AGENT = GATE_AGENT_TYPE as EntityTypeName;
+const PASS_GATE = PASS_GATE_ACTION as unknown as PolicyRef;
+
+const set = (values: readonly string[]): string => `[${values.map((v) => `"${escapeCedarString(v)}"`).join(", ")}]`;
+
+function count(name: string, value: number | undefined, fallback: number): number {
+  const n = value ?? fallback;
+  if (!Number.isInteger(n) || n < 0) throw new Error(`${name} must be a whole number of at least 0, got ${n}`);
+  return n;
+}
+
+function nonEmpty(name: string, values: readonly string[] | undefined): readonly string[] {
+  if (!values || values.length === 0 || values.some((v) => typeof v !== "string" || v === "")) {
+    throw new Error(`${name} needs at least one non-empty name`);
+  }
+  return values;
+}
+
+function principal(appliesTo: GatePackAppliesTo | undefined, fallback: GatePackAppliesTo): PolicyScope {
+  return (appliesTo ?? fallback) === "agents" ? { is: AGENT } : {};
+}
+
+/** A forbid on `PassGate` that applies when there is no plan summary, or when `condition` holds. `condition` reads `context.plan`. */
+function forbid(id: string, appliesTo: GatePackAppliesTo | undefined, condition: string, description: string): Declarable {
+  return new Policy({
+    effect: "forbid",
+    principal: principal(appliesTo, "everyone"),
+    action: { eq: PASS_GATE },
+    // Written as `unless`, so the validator sees `context has plan` guard the
+    // read of it (it tracks a `has` through `&&`): the forbid applies unless
+    // there is a plan and the condition does not hold.
+    unless: [`context has plan && !(${condition})`],
+    annotations: { id, description },
+  });
+}
+
+export interface CapDeletesOptions extends RuleBase {
+  /** The most deletes a plan may carry. Default 0. */
+  max?: number;
+}
+
+/** Forbid a plan that deletes more than `max` resources. Default id `cap-deletes`. */
+export function capDeletes(options: CapDeletesOptions = {}): Declarable {
+  const max = count("capDeletes: max", options.max, 0);
+  return forbid(
+    options.id ?? "cap-deletes", options.appliesTo,
+    `context.plan.deletes > ${max}`,
+    `A plan may delete at most ${max} resources.`,
+  );
+}
+
+export interface CapReplacementsOptions extends RuleBase {
+  /** The most replacements a plan may carry. Default 0. */
+  max?: number;
+}
+
+/** Forbid a plan that replaces more than `max` resources. Default id `cap-replacements`. */
+export function capReplacements(options: CapReplacementsOptions = {}): Declarable {
+  const max = count("capReplacements: max", options.max, 0);
+  return forbid(
+    options.id ?? "cap-replacements", options.appliesTo,
+    `context.plan.replaces > ${max}`,
+    `A plan may replace at most ${max} resources.`,
+  );
+}
+
+export interface ProtectStatefulOptions extends RuleBase {
+  /** The types that hold state. Default {@link STATEFUL_TYPES}. */
+  types?: readonly string[];
+  /** Forbid deletes of these types. Default true. */
+  deletes?: boolean;
+  /** Forbid replacements of these types, which delete the old object too. Default true. */
+  replacements?: boolean;
+}
+
+/**
+ * Forbid a plan that deletes or replaces a resource of a stateful type: an
+ * RDS instance, a DynamoDB table, a bucket. Default id `protect-stateful`.
+ */
+export function protectStateful(options: ProtectStatefulOptions = {}): Declarable {
+  const types = set(nonEmpty("protectStateful: types", options.types ?? STATEFUL_TYPES));
+  const deletes = options.deletes ?? true;
+  const replacements = options.replacements ?? true;
+  if (!deletes && !replacements) throw new Error("protectStateful: deletes and replacements are both off, so the rule forbids nothing");
+  const conditions = [
+    ...(deletes ? [`context.plan.deletedTypes.containsAny(${types})`] : []),
+    ...(replacements ? [`context.plan.replacedTypes.containsAny(${types})`] : []),
+  ];
+  return forbid(
+    options.id ?? "protect-stateful", options.appliesTo,
+    conditions.length === 1 ? conditions[0] : `(${conditions.join(" || ")})`,
+    `A plan may not ${[deletes ? "delete" : "", replacements ? "replace" : ""].filter(Boolean).join(" or ")} a resource that holds state.`,
+  );
+}
+
+export interface AllowRegionsOptions extends RuleBase {
+  regions: readonly string[];
+}
+
+/** Forbid a plan that changes anything outside these regions. Default id `allow-regions`. */
+export function allowRegions(options: AllowRegionsOptions): Declarable {
+  const regions = nonEmpty("allowRegions: regions", options.regions);
+  return forbid(
+    options.id ?? "allow-regions", options.appliesTo,
+    `!${set(regions)}.containsAll(context.plan.regions)`,
+    `A plan may change resources only in ${regions.join(", ")}.`,
+  );
+}
+
+export interface RequireCreateTagsOptions extends RuleBase {
+  /** Tag (or label) keys every created resource must carry. */
+  keys: readonly string[];
+  /**
+   * Also forbid creates that carry no tags attribute at all. Default false,
+   * because many types have no tags (an IAM policy attachment, a route), and
+   * a create with tags left unset reads the same.
+   */
+  strict?: boolean;
+}
+
+/**
+ * Forbid a plan whose tagged creates do not all carry `keys`. Reads
+ * `tags`, `tags_all` and `labels`. Default id `require-create-tags`.
+ */
+export function requireCreateTags(options: RequireCreateTagsOptions): Declarable {
+  const keys = nonEmpty("requireCreateTags: keys", options.keys);
+  const missing = `(context.plan.taggedCreates > 0 && !context.plan.createTagKeys.containsAll(${set(keys)}))`;
+  return forbid(
+    options.id ?? "require-create-tags", options.appliesTo,
+    options.strict ? `(${missing} || context.plan.untaggedCreates > 0)` : missing,
+    `Every created resource carries the tags ${keys.join(", ")}.`,
+  );
+}
+
+export interface PermitLowRiskAgentsOptions {
+  /** Default id `permit-low-risk-agents`. */
+  id?: string;
+  /** The most changes (creates, updates, replaces, deletes) a low-risk plan has. Default 10. */
+  maxChanges?: number;
+}
+
+/**
+ * Permit an agent to pass a gate on its own for a plan that deletes and
+ * replaces nothing, changes at most `maxChanges` resources, and planned
+ * every member in full (no failed member, no hole). In `enforce` mode that
+ * permit passes the gate; any forbid in the same set still wins.
+ */
+export function permitLowRiskAgents(options: PermitLowRiskAgentsOptions = {}): Declarable {
+  const max = count("permitLowRiskAgents: maxChanges", options.maxChanges, 10);
+  return new Policy({
+    effect: "permit",
+    principal: { is: AGENT },
+    action: { eq: PASS_GATE },
+    when: [
+      "context has plan && " +
+        `context.plan.deletes == 0 && context.plan.replaces == 0 && context.plan.changes <= ${max} && ` +
+        "context.plan.failed == 0 && context.plan.holes == 0",
+    ],
+    annotations: {
+      id: options.id ?? "permit-low-risk-agents",
+      description: `An agent may pass a plan that deletes and replaces nothing and changes at most ${max} resources.`,
+    },
+  });
+}
+
+/** Permit an agent to pass a plan that only changes tags or labels. Default id `permit-tag-only-agents`. */
+export function permitTagOnlyAgents(options: { id?: string } = {}): Declarable {
+  return new Policy({
+    effect: "permit",
+    principal: { is: AGENT },
+    action: { eq: PASS_GATE },
+    when: ["context has plan && context.plan.tagOnly && context.plan.failed == 0 && context.plan.holes == 0"],
+    annotations: {
+      id: options.id ?? "permit-tag-only-agents",
+      description: "An agent may pass a plan that only changes tags or labels.",
+    },
+  });
+}
+
+export interface StarterGatePoliciesOptions {
+  /** {@link capDeletes}'s max. Default 0. */
+  maxDeletes?: number;
+  /** {@link capReplacements}'s max. Default: no cap beyond {@link protectStateful}. */
+  maxReplacements?: number;
+  /** {@link protectStateful}'s types. Default {@link STATEFUL_TYPES}. */
+  statefulTypes?: readonly string[];
+  /** {@link allowRegions}. Absent, regions are not limited. */
+  regions?: readonly string[];
+  /** {@link requireCreateTags}. Absent, tags are not required. */
+  requiredTags?: readonly string[];
+  /** {@link permitLowRiskAgents}'s maxChanges. Default 10. */
+  agentMaxChanges?: number;
+}
+
+/**
+ * The pack as one record for `gatePolicy(name, starterGatePolicies(...))`:
+ * stateful types protected, deletes capped, regions and tags when given,
+ * and the two agent permits.
+ */
+export function starterGatePolicies(options: StarterGatePoliciesOptions = {}): Record<string, Declarable> {
+  return {
+    protectStateful: protectStateful(options.statefulTypes ? { types: options.statefulTypes } : {}),
+    capDeletes: capDeletes({ max: options.maxDeletes ?? 0 }),
+    ...(options.maxReplacements !== undefined ? { capReplacements: capReplacements({ max: options.maxReplacements }) } : {}),
+    ...(options.regions ? { allowRegions: allowRegions({ regions: options.regions }) } : {}),
+    ...(options.requiredTags ? { requireCreateTags: requireCreateTags({ keys: options.requiredTags }) } : {}),
+    permitLowRiskAgents: permitLowRiskAgents(options.agentMaxChanges !== undefined ? { maxChanges: options.agentMaxChanges } : {}),
+    permitTagOnlyAgents: permitTagOnlyAgents(),
+  };
+}

package/src/gate-policy.ts

@@ -131,9 +131,9 @@ function cedarValue(value: unknown): CedarValue | undefined {
  * The set as a record keyed by each policy's `@id`. Handed the text whole,
  * cedar-wasm names policies by position (`policy0`), and a recorded decision
  * would then name a rule nobody wrote. A policy with no `@id` keeps its
- * positional name.
+ * positional name. Exported for `./gate-schema.ts`, so validation names rules the same way.
  */
-function keyedById(wasm: NonNullable<ReturnType<typeof loadWasm>>, policy: GatePolicyRef): Record<string, string> {
+export function keyedById(wasm: NonNullable<ReturnType<typeof loadWasm>>, policy: GatePolicyRef): Record<string, string> {
   const parts = wasm.policySetTextToParts(policy.text);
   if (parts.type === "failure") {
     throw new Error(`policy "${policy.name}" does not parse: ${parts.errors.map(describeError).join("; ")}`);

package/src/gate-schema.ts

@@ -0,0 +1,138 @@
+/**
+ * The Cedar schema of a gate's `PassGate` request (chant#3182).
+ *
+ * {@link GATE_CEDAR_SCHEMA} declares the `Chant` namespace `evaluateGatePolicy`
+ * builds requests in (`./gate-policy.ts`), with the plan summary core puts in
+ * `context.plan` (`@intentius/chant/op`'s `GatePlanSummary`) as the common type
+ * `Chant::PlanSummary`. Two uses:
+ *
+ * - {@link validateGatePolicy} checks a gate policy set against it, so a rule
+ *   that reads `context.plan.deleteCount` (a field that does not exist) fails
+ *   where it is written rather than erroring on every request.
+ * - A project that writes gate policies with typed `Policy` scopes puts this
+ *   text in its own `.cedarschema` (or hands {@link gateCedarSchema}'s output
+ *   to `new Schema({ text })`), and the generated scope types then name
+ *   `Chant::Agent` and `Chant::Action::"PassGate"` without a cast.
+ *
+ * A gate's own `approval.context` keys differ per gate, so the schema declares
+ * only `planDigest` and `plan` unless {@link gateCedarSchema} is told the rest.
+ * Every context attribute is optional: a gate with no plan, or a plan step
+ * that returned no change set, has neither.
+ */
+
+import type { GatePlanSummary, GatePolicyRef } from "@intentius/chant/op";
+import { loadWasm, validatePolicySet, wasmLoadError, type ValidationFinding } from "./lint/post-synth/wasm-helpers";
+import { keyedById } from "./gate-policy";
+
+/**
+ * Each `GatePlanSummary` field as a Cedar type. Typed as a record over the
+ * summary's keys, so a field added to the summary in core fails to compile
+ * here until the schema says what it is.
+ */
+export const GATE_PLAN_SUMMARY_CEDAR_TYPES: { readonly [K in keyof GatePlanSummary]: string } = {
+  members: "Set<String>",
+  membersChanged: "Set<String>",
+  failedMembers: "Set<String>",
+  failed: "Long",
+  holes: "Long",
+  entries: "Long",
+  changes: "Long",
+  creates: "Long",
+  updates: "Long",
+  replaces: "Long",
+  deletes: "Long",
+  reads: "Long",
+  noOps: "Long",
+  forgets: "Long",
+  types: "Set<String>",
+  createdTypes: "Set<String>",
+  updatedTypes: "Set<String>",
+  replacedTypes: "Set<String>",
+  deletedTypes: "Set<String>",
+  deleted: "Set<String>",
+  replaced: "Set<String>",
+  regions: "Set<String>",
+  scopes: "Set<String>",
+  lexicons: "Set<String>",
+  taggedCreates: "Long",
+  untaggedCreates: "Long",
+  createTagKeys: "Set<String>",
+  tagOnly: "Bool",
+  truncated: "Bool",
+};
+
+export interface GateCedarSchemaOptions {
+  /**
+   * The gate's own `approval.context` attributes, as Cedar types
+   * (`{ risk: "String", paths: "Set<String>" }`). Each is declared optional,
+   * since a step-output reference that resolves to nothing is left out.
+   */
+  context?: Readonly<Record<string, string>>;
+}
+
+const IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+/** The schema text, with the gate's own context attributes when given. */
+export function gateCedarSchema(options: GateCedarSchemaOptions = {}): string {
+  const extra = Object.entries(options.context ?? {});
+  for (const [key, type] of extra) {
+    if (!IDENT.test(key)) throw new Error(`gateCedarSchema: context attribute "${key}" is not a Cedar identifier`);
+    if (key === "plan" || key === "planDigest") throw new Error(`gateCedarSchema: context attribute "${key}" is chant's own`);
+    if (type.trim() === "") throw new Error(`gateCedarSchema: context attribute "${key}" has no type`);
+  }
+  const summary = Object.entries(GATE_PLAN_SUMMARY_CEDAR_TYPES)
+    .map(([k, t]) => `    "${k}": ${t},`)
+    .join("\n");
+  const context = [
+    `      "planDigest"?: String,`,
+    `      "plan"?: PlanSummary,`,
+    ...extra.map(([k, t]) => `      "${k}"?: ${t},`),
+  ].join("\n");
+  return `// The request chant builds for a gate approval (chant#2508, #3182).
+namespace Chant {
+  // context.plan: the plan's change-set summary (GatePlanSummary).
+  type PlanSummary = {
+${summary}
+  };
+
+  // A role a human or agent claimed when approving.
+  entity Role;
+  entity Human in [Role];
+  entity Agent in [Role];
+  // "<op>/<gate>".
+  entity Gate = {
+    "op": String,
+    "gate": String,
+  };
+
+  action PassGate appliesTo {
+    principal: [Human, Agent],
+    resource: [Gate],
+    context: {
+${context}
+    }
+  };
+}
+`;
+}
+
+/** The schema with no gate-specific context: `planDigest` and `plan` only. */
+export const GATE_CEDAR_SCHEMA = gateCedarSchema();
+
+export interface GatePolicyValidation {
+  errors: ValidationFinding[];
+  warnings: ValidationFinding[];
+}
+
+/**
+ * Validate a gate policy set against the gate schema. Throws when the wasm
+ * cannot be loaded or validation cannot run at all (a schema that does not
+ * parse); findings come back sorted.
+ */
+export function validateGatePolicy(policy: GatePolicyRef, options: GateCedarSchemaOptions = {}): GatePolicyValidation {
+  const wasm = loadWasm();
+  if (!wasm) throw new Error(`@cedar-policy/cedar-wasm could not be loaded: ${wasmLoadError()}`);
+  const outcome = validatePolicySet(wasm, { staticPolicies: keyedById(wasm, policy) }, gateCedarSchema(options));
+  if (outcome.failure) throw new Error(`policy "${policy.name}" could not be validated: ${outcome.failure}`);
+  return { errors: outcome.errors, warnings: outcome.warnings };
+}

package/src/index.ts

@@ -11,6 +11,21 @@ export {
   GATE_HUMAN_TYPE, GATE_AGENT_TYPE, GATE_ROLE_TYPE, GATE_RESOURCE_TYPE, PASS_GATE_ACTION,
 } from "./gate-policy";
 export type { GatePolicies } from "./gate-policy";
+
+// Gate policy over the plan (chant#3182): the request's Cedar schema, with the
+// plan summary core puts in `context.plan`, and a starter policy pack over it.
+export {
+  GATE_CEDAR_SCHEMA, GATE_PLAN_SUMMARY_CEDAR_TYPES, gateCedarSchema, validateGatePolicy,
+} from "./gate-schema";
+export type { GateCedarSchemaOptions, GatePolicyValidation } from "./gate-schema";
+export {
+  STATEFUL_TYPES, allowRegions, capDeletes, capReplacements, permitLowRiskAgents, permitTagOnlyAgents,
+  protectStateful, requireCreateTags, starterGatePolicies,
+} from "./gate-policy-pack";
+export type {
+  AllowRegionsOptions, CapDeletesOptions, CapReplacementsOptions, GatePackAppliesTo, PermitLowRiskAgentsOptions,
+  ProtectStatefulOptions, RequireCreateTagsOptions, StarterGatePoliciesOptions,
+} from "./gate-policy-pack";
 export type { CedarEffect, CedarScope, CedarPolicyProps, CedarPolicyRecord } from "./serializer";
 
 // AVP embedding (#1652) — the typed statement an `AWS::VerifiedPermissions::Policy`