@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/index.js

@@ -0,0 +1,79 @@
+// Plugin
+export { cedarPlugin } from "./plugin.js";
+// Serializer
+export { cedarSerializer, policyIdFromLogicalName, resolvePolicyId, cedarPolicyRecords } from "./serializer.js";
+export { CEDAR_POLICY_TYPE, CEDAR_JSON_FILENAME } from "./serializer.js";
+// Gate approval policy (chant#2508) — a cedar policy set as a gate's `approval.policy`.
+export { gatePolicy, evaluateGatePolicy, GATE_HUMAN_TYPE, GATE_AGENT_TYPE, GATE_ROLE_TYPE, GATE_RESOURCE_TYPE, PASS_GATE_ACTION, } from "./gate-policy.js";
+// Gate policy over the plan (chant#3182): the request's Cedar schema, with the
+// plan summary core puts in `context.plan`, and a starter policy pack over it.
+export { GATE_CEDAR_SCHEMA, GATE_PLAN_SUMMARY_CEDAR_TYPES, gateCedarSchema, validateGatePolicy, } from "./gate-schema.js";
+export { STATEFUL_TYPES, allowRegions, capDeletes, capReplacements, permitLowRiskAgents, permitTagOnlyAgents, protectStateful, requireCreateTags, starterGatePolicies, } from "./gate-policy-pack.js";
+// AVP embedding (#1652) — the typed statement an `AWS::VerifiedPermissions::Policy`
+// carries, without a dependency on the aws lexicon. See src/avp/embed.ts.
+export { avpStatement, avpStatementJSON, avpPolicyDefinition, avpPolicyResource, avpPolicySet, } from "./avp/embed.js";
+// The AVP ownership channel (#1652, chant #1348). Design record: src/avp/OWNERSHIP.md.
+export { AVP_OWNERSHIP_KEYS, AVP_POLICY_ID_KEY, AVP_DESCRIPTION_MAX, encodeOwnershipDescription, decodeOwnershipDescription, ownershipFromDescription, ownershipFromStoreTags, descriptionIsOwned, storeOwnershipTags, } from "./avp/ownership.js";
+// AVP lifecycle readers (#1652).
+export { describeAvpResources } from "./avp/describe-resources.js";
+export { observeAvpAmbient, AVP_AMBIENT_KINDS } from "./avp/ambient.js";
+export { exportAvpResources, policyToResourceIR } from "./avp/live-export.js";
+export { resolvePolicyStoreId, AVP_POLICY_STORE_ENV } from "./avp/store.js";
+export { policySetJSON, escapeCedarString } from "./serializer.js";
+// Import / reconcile (#1653) — `.cedar` text and the JSON policy-set envelope
+// in, authoring TypeScript out.
+export { CedarParser, isPolicySetEnvelope } from "./import/parser.js";
+export { CedarGenerator, loadActionConstants, sanitizeName, CEDAR_PACKAGE } from "./import/generator.js";
+export { CedarTemplateParser, CedarTemplateGenerator } from "./import/adapter.js";
+export { detectTemplate } from "./detect.js";
+// AgentCore embedding (#1660) — the typed statement an
+// `AWS::BedrockAgentCore::Policy` carries on either arm of its Definition
+// union, and the EnforcementMode dial that stages the rollout. Same
+// no-dependency rule as the AVP seam above. See src/agentcore/embed.ts.
+export { agentCoreStatement, agentCorePolicyDefinition, agentCorePolicyResource, agentCorePolicySet, agentCoreStagedPolicy, agentCorePolicyName, AGENTCORE_NAME_PATTERN, AGENTCORE_STATEMENT_MIN, AGENTCORE_STATEMENT_MAX, } from "./agentcore/embed.js";
+export { AGENTCORE_ENFORCEMENT, describeStage, enforcementMode, enforcementStage, isEnforcing, } from "./agentcore/enforcement.js";
+export { embeddedAgentCoreDefinitions, embeddedAgentCorePolicyStatements } from "./agentcore/scan.js";
+// The dogwood temporal dialect (#1658) — typed temporal builders, the `.dw`
+// serializer leg, `.dwschema` event schemas. Pre-release; see ./dogwood.
+//
+// Namespaced rather than flattened: the temporal sub-language's builders are
+// named after its own grammar (`and`, `not`, `count`, `sum`, `str`, `field`,
+// `record`, `window`), and spilling those into the package root would collide
+// with a schema-generated entity class the moment someone declares one. The
+// three entity classes are re-exported flat because that is what a policy file
+// names.
+export * as dogwood from "./dogwood/index.js";
+export { DOGWOOD_EVENT_SCHEMA_FILENAME, DOGWOOD_EVENT_SCHEMA_TYPE, DOGWOOD_MACRO_FILENAME, DOGWOOD_MACRO_LIBRARY_TYPE, DOGWOOD_POLICY_FILENAME, DOGWOOD_POLICY_TYPE, TemporalEventSchema, TemporalMacroLibrary, TemporalPolicy, } from "./dogwood/policy.js";
+export { DOGWOOD_UPSTREAM } from "./dogwood/upstream.js";
+// The replay Op composite and its typed step builders (#1661). Flat, like
+// fly's `flyDeploy`: an Op factory is what a project's `ops/*.op.ts` names,
+// and it depends on no lexicon but this one — see ./dogwood/replay-op.ts for
+// why the composite ships from cedar.
+export { DEFAULT_REPLAY_REPORT_PATH, PolicyReplayOp, dogwoodReplayReportStep, dogwoodReplayStep, } from "./dogwood/replay-op.js";
+// Lint rules
+export { rules as cedarLintRules } from "./lint/rules/index.js";
+// Packaging pipeline (for external tooling)
+export { packageLexicon } from "./codegen/package.js";
+// The `cedar` config namespace (#1344). Importing this package is what brings
+// the key into ChantConfig, so a `chant.config.ts` that sets it compiles.
+export { cedarConfigSchema, loadCedarConfig, loadCedarProject, CEDAR_DEFAULT_SCHEMA_PATH, CEDAR_DEFAULT_OUT_DIR } from "./config.js";
+// Where `chant cedar generate` writes for a project (#1696).
+export { resolveGeneratedDir } from "./codegen/generate.js";
+// The project schema as a build artifact (#1697): authored by hand as
+// `new Schema({ text })`, or contributed automatically from `cedar.schema`.
+export { Schema, CEDAR_SCHEMA_TYPE, CEDAR_SCHEMA_FILENAME } from "./schema-artifact.js";
+// Upstream pin — the cedar-wasm package version and the Cedar language
+// version it implements (#1650).
+export { CEDAR_WASM_VERSION, CEDAR_LANG_VERSION } from "./spec/pin.js";
+// Schema coverage — is every schema declaration reachable from the generated
+// artifacts? Policy coverage below asks the other half.
+export { computeCedarCoverage, formatCedarCoverage, analyzeCedarCoverage } from "./coverage.js";
+// Policy coverage — which schema declarations the built policy set can apply
+// to. Backs the `cedar:coverage` MCP tool.
+export { computePolicyCoverage, formatPolicyCoverage } from "./mcp/policy-coverage.js";
+// Composites — the repeated policy shapes Cedar itself has nowhere to put.
+export * from "./composites/index.js";
+// `chant init --lexicon cedar --template <name>` scaffolds.
+export { cedarInitTemplates, CEDAR_INIT_TEMPLATES } from "./init-templates.js";
+// Generated entity types, actions and the Policy authoring class (#1650).
+export * from "./generated/index.js";

package/dist/init-templates.js

@@ -0,0 +1,330 @@
+/**
+ * `chant init --lexicon cedar --template <name>` scaffolds.
+ *
+ * Every template ships a `schema.cedarschema` at the project root. That is not
+ * decoration: cedar's codegen input is the project's own schema (epic #1645),
+ * and a scaffold without one generates against the bundled default — a project
+ * whose typed classes describe somebody else's entity model.
+ *
+ * The filename is fixed rather than configured because `schema.cedarschema` in
+ * the project root is step 2 of the resolution order in `spec/fetch.ts`, so a
+ * scaffolded project needs no `cedar.schema` key at all. It also has to be
+ * fixed: core writes `chant.config.ts` before a plugin's root files and
+ * `writeIfNotExists` keeps the first one, so a template that shipped its own
+ * config would be silently discarded. The README each template ships is where
+ * `requireProjectSchema` gets recommended, which is the honest place for advice
+ * a scaffold cannot enforce.
+ *
+ * The policy files use `entityType`-string scopes (`{ is: "App::Document" }`)
+ * and generated action constants, so a scaffolded project compiles the moment
+ * `chant cedar generate` has run against its own schema (#1696).
+ */
+/** Filename every template writes its schema to — see spec/fetch.ts step 2. */
+const SCHEMA_FILE = "schema.cedarschema";
+function readme(title, body) {
+    return `# ${title}
+
+\`\`\`bash
+npm install
+npx chant cedar generate   # schema.cedarschema -> src/generated/cedar/
+npx chant build            # emits .cedar text, policies.cedar.json, and the schema
+\`\`\`
+
+Generate first. The classes and action constants \`src/policies.ts\` imports
+from \`./generated/cedar\` do not exist until \`chant cedar generate\` has read
+\`${SCHEMA_FILE}\`. The output is yours: it lives in this project, not in
+\`node_modules\`, so commit it (or regenerate it in CI before \`chant build\`)
+and re-run generate whenever the schema changes. \`cedar.outDir\` in
+\`chant.config.ts\` moves it.
+
+${body}
+
+## Before this is real
+
+Add \`requireProjectSchema\` once you are past the scaffold:
+
+\`\`\`typescript
+// chant.config.ts
+export default {
+  lexicons: ["cedar"],
+  cedar: {
+    validation: { mode: "strict", requireProjectSchema: true },
+  },
+} satisfies ChantConfig;
+\`\`\`
+
+Without it, deleting or renaming \`${SCHEMA_FILE}\` falls back to the schema
+bundled with the lexicon and the build still succeeds — against an entity model
+this project never declared.
+
+## What comes out
+
+| File | Who reads it |
+|------|--------------|
+| \`dist/*.cedar\` | Every Cedar evaluator — AVP, cedar-agent, an embedded cedar-wasm |
+| \`dist/policies.cedar.json\` | The Cedar JSON policy format; also the parse source for import |
+| \`dist/${SCHEMA_FILE}\` | Your schema, beside the policies, so the build validates against it and a bundle can carry it |
+`;
+}
+// ── default ───────────────────────────────────────────────────────
+const DEFAULT_SCHEMA = `// The entity model your policies are typed against.
+//
+// \`chant cedar generate\` turns every declaration below into a
+// TypeScript class or constant, so a renamed entity type becomes a
+// compiler-guided refactor rather than a runtime validation failure.
+
+namespace App {
+  entity User = {
+    "email": String,
+    "department": String,
+  };
+
+  entity Document = {
+    "title": String,
+    "owner": User,
+    "classification": String,
+  };
+
+  action read, write appliesTo {
+    principal: [User],
+    resource: [Document],
+    context: {
+      "mfa": Bool,
+    }
+  };
+}
+`;
+const DEFAULT_POLICIES = `import { Policy, ReadAction, WriteAction } from "./generated/cedar";
+
+/**
+ * A permit and a forbid — the smallest policy set worth deploying.
+ *
+ * Cedar is default-deny, so the permit is what grants anything at all. The
+ * forbid is not the absence of a grant: it beats every permit in the set
+ * unconditionally, which is what makes it survive a wider grant added later.
+ */
+
+/** Owners read and write their own documents. */
+export const ownerAccess = new Policy({
+  effect: "permit",
+  principal: { is: "App::User" },
+  action: { in: [ReadAction, WriteAction] },
+  resource: { is: "App::Document" },
+  when: ["resource.owner == principal"],
+});
+
+/** Nothing confidential moves without MFA, owner or not. */
+export const requireMfaOnConfidential = new Policy({
+  effect: "forbid",
+  principal: { is: "App::User" },
+  resource: { is: "App::Document" },
+  when: ['resource.classification == "confidential"'],
+  unless: ["context.mfa == true"],
+});
+`;
+// ── avp-embedding ─────────────────────────────────────────────────
+const AVP_SCHEMA = `// The entity model behind an Amazon Verified Permissions policy store.
+//
+// AVP is one deployment vehicle for Cedar; the schema and the policies are
+// ordinary Cedar either way, and the same emitted \`.cedar\` file is read by any
+// other evaluator with no AWS involved.
+
+namespace Store {
+  entity Tenant = {
+    "name": String,
+  };
+
+  entity User in [Tenant] = {
+    "email": String,
+    "tenant": Tenant,
+    "admin": Bool,
+  };
+
+  entity Record in [Tenant] = {
+    "tenant": Tenant,
+    "owner": User,
+    "sensitive": Bool,
+  };
+
+  action view, edit appliesTo {
+    principal: [User],
+    resource: [Record],
+    context: {
+      "mfa": Bool,
+    }
+  };
+}
+`;
+const AVP_POLICIES = `import { Policy, EditAction, ViewAction } from "./generated/cedar";
+
+/**
+ * Policies destined for an AVP policy store.
+ *
+ * The statement each of these serializes to is what goes in a
+ * \`AWS::VerifiedPermissions::Policy\`'s \`definition.static.statement\` — the
+ * same bytes as the emitted \`.cedar\` file, so the deployed policy and the
+ * reviewed file cannot disagree.
+ *
+ * The typed handoff (a VerifiedPermissionsPolicy whose statement accepts a
+ * Policy value directly, plus the policy-store lifecycle and the ownership
+ * channel) is landing with INTENTIUS/chant#1652. Until it does, emit the
+ * \`.cedar\` file and reference its text; do not hand-type a statement string.
+ */
+
+/** Tenancy: nobody touches a record outside their own tenant. */
+export const tenantIsolation = new Policy({
+  effect: "forbid",
+  principal: { is: "Store::User" },
+  resource: { is: "Store::Record" },
+  unless: ["resource.tenant == principal.tenant"],
+});
+
+/** Members view records in their tenant. */
+export const tenantView = new Policy({
+  effect: "permit",
+  principal: { is: "Store::User" },
+  action: { eq: ViewAction },
+  resource: { is: "Store::Record" },
+  when: ["resource.tenant == principal.tenant"],
+});
+
+/** Owners and tenant admins edit; sensitive records also demand MFA. */
+export const ownerEdit = new Policy({
+  effect: "permit",
+  principal: { is: "Store::User" },
+  action: { eq: EditAction },
+  resource: { is: "Store::Record" },
+  when: ["resource.owner == principal || principal.admin == true"],
+  unless: ["resource.sensitive == true && context.mfa == false"],
+});
+`;
+// ── gateway-policy-set ────────────────────────────────────────────
+const GATEWAY_SCHEMA = `// An API gateway's authorization model.
+//
+// The principal is a caller identity, the resource is a route, and the action
+// is an HTTP method. Modelling routes as entities rather than strings is what
+// lets a policy say \`resource.public == true\` instead of matching paths.
+
+namespace Gateway {
+  entity Scope = {
+    "name": String,
+  };
+
+  entity Caller in [Scope] = {
+    "clientId": String,
+    "internal": Bool,
+  };
+
+  entity Route = {
+    "path": String,
+    "public": Bool,
+    "deprecated": Bool,
+  };
+
+  action get, post, delete appliesTo {
+    principal: [Caller],
+    resource: [Route],
+    context: {
+      "sourceIp": String,
+      "authenticated": Bool,
+    }
+  };
+}
+`;
+const GATEWAY_POLICIES = `import { DenyByDefaultSet } from "@intentius/chant-lexicon-cedar";
+import { DeleteAction, GetAction, Policy, PostAction } from "./generated/cedar";
+
+/**
+ * A gateway policy set with an explicit deny floor.
+ *
+ * \`DenyByDefaultSet\` returns the forbid and the permits it governs from one
+ * call, so the floor cannot be deleted in a refactor while the grants survive.
+ * A forbid beats every permit unconditionally — that is the whole reason to
+ * write one under a default-deny engine.
+ */
+
+/** Anonymous callers reach public routes, read-only. */
+const publicRead = new Policy({
+  effect: "permit",
+  principal: { is: "Gateway::Caller" },
+  action: { eq: GetAction },
+  resource: { is: "Gateway::Route" },
+  when: ["resource.public == true"],
+});
+
+/** Authenticated callers may write. */
+const authenticatedWrite = new Policy({
+  effect: "permit",
+  principal: { is: "Gateway::Caller" },
+  action: { in: [PostAction, DeleteAction] },
+  resource: { is: "Gateway::Route" },
+  when: ["context.authenticated == true"],
+});
+
+/** Deprecated routes are closed to everyone but internal callers. */
+const guarded = DenyByDefaultSet({
+  policies: [publicRead, authenticatedWrite],
+  entityType: "Gateway::Route",
+  when: ["resource.deprecated == true"],
+  unless: ["principal.internal == true"],
+  annotations: { id: "deprecated-route-floor" },
+});
+
+export const deprecatedRouteFloor = guarded.floor;
+export const publicReadGrant = guarded.members[0];
+export const authenticatedWriteGrant = guarded.members[1];
+`;
+// ── The template set ──────────────────────────────────────────────
+/**
+ * Scaffolds for `chant init`.
+ *
+ * An unrecognized name falls through to the default rather than throwing —
+ * the same behaviour every other lexicon's `initTemplates` has.
+ */
+export function cedarInitTemplates(template) {
+    const scripts = {
+        generate: "chant cedar generate",
+        build: "chant build",
+    };
+    if (template === "avp-embedding") {
+        return {
+            src: { "policies.ts": AVP_POLICIES },
+            root: {
+                [SCHEMA_FILE]: AVP_SCHEMA,
+                "README.md": readme("Cedar policies for a Verified Permissions store", "The `Store` namespace models a multi-tenant record store. `tenantIsolation` is a\n" +
+                    "`forbid`, deliberately: a forbid beats every permit in the set unconditionally,\n" +
+                    "so a tenancy boundary written that way survives a wider grant added later.\n\n" +
+                    "The statement each policy serializes to is what goes in an\n" +
+                    "`AWS::VerifiedPermissions::Policy`. The typed handoff is landing with\n" +
+                    "INTENTIUS/chant#1652 — until then, reference the emitted `.cedar` text rather\n" +
+                    "than hand-typing a statement string."),
+            },
+            scripts,
+        };
+    }
+    if (template === "gateway-policy-set") {
+        return {
+            src: { "policies.ts": GATEWAY_POLICIES },
+            root: {
+                [SCHEMA_FILE]: GATEWAY_SCHEMA,
+                "README.md": readme("Cedar policies for an API gateway", "Routes are entities, not path strings, which is what lets a policy say\n" +
+                    "`resource.public == true` instead of matching globs. The `DenyByDefaultSet`\n" +
+                    "composite returns the deprecated-route floor and the grants it governs from one\n" +
+                    "call, so a refactor cannot delete the floor and leave the grants behind."),
+            },
+            scripts,
+        };
+    }
+    return {
+        src: { "policies.ts": DEFAULT_POLICIES },
+        root: {
+            [SCHEMA_FILE]: DEFAULT_SCHEMA,
+            "README.md": readme("Cedar policies", "One permit and one forbid. Cedar is default-deny, so the permit is what grants\n" +
+                "anything at all; the forbid is not the absence of a grant but an override that\n" +
+                "beats every permit in the set."),
+        },
+        scripts,
+    };
+}
+/** Every template name this lexicon scaffolds, for docs and tests. */
+export const CEDAR_INIT_TEMPLATES = ["default", "avp-embedding", "gateway-policy-set"];

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "11976605ad43097e4868665930ee06f2a23a1d7183e9ef20e5cb3a855a12eea2",
+    "manifest.json": "eaf723654b33eea3ec3378b6efb10697767a39f43e5849712c683faf6978233d",
     "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
     "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
     "rules/policy-shape.ts": "11377265f05ede594b77c2b6cc3d977a688e5e5712e7a706e7aa6fd6ea05d027",
@@ -30,5 +30,5 @@
     "skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a",
     "skills/chant-cedar-dogwood.md": "7e52d3f045c1c34e00fdef76014a05483fb9dd58cc41037621a76bc298776d8f"
   },
-  "composite": "e152d1bb86fad76e95d95979ac20331797a8de22e4247a338f15c395c4e6ea46"
+  "composite": "81189c85f84ffb6ed2fac31e166e712fa16f2a97cbf39826ced2704663de1728"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,65 @@
+/**
+ * The cedar lexicon's `chant audit` catalog — metadata for every CED check,
+ * contributed via `cedarPlugin.auditCatalog()` (#687, #1346).
+ *
+ * A check's own definition says what it looks for. It does not say how severe
+ * the finding is, whether the fix is mechanical, what backs the rule, or what
+ * to title it in a report. `resolveAuditCatalog` merges this map over core's
+ * static catalog to answer all four — and it skips a lexicon that omits the
+ * method *silently*, which is how fly's and temporal's checks reached the
+ * report with no metadata at all. A repo-level test fails on a gap in either
+ * direction, so this map and the shipped checks move together.
+ *
+ * Every entry here is `yamlBased: true`: each check reads `ctx.outputs` — the
+ * emitted policy set — and nothing reads `ctx.entities`, so all of them fire
+ * on an audit of a standalone `policies.cedar.json` exactly as they do on a
+ * `chant build`. `auditRule()` hardcodes that, so it is used throughout rather
+ * than constructing `RuleMeta` by hand the way fly and fountain must.
+ *
+ * `authority` is left off deliberately. The catalog test treats a citation as
+ * proof that a finding is `security`, and Cedar's own docs are a language
+ * reference rather than a benchmark like CIS or OSSF Scorecard; citing them
+ * would be dressing up chant's own opinion. The one place a citation would be
+ * honest — the bare-permit wall — is chant's convention, not upstream's, and
+ * the verification report is explicit that Cedar's validator says nothing
+ * about it.
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { cedarAuditLineage } from "./audit-lineage.js";
+export const cedarAuditCatalog = {
+    // ── Pre-synth lint rule ────────────────────────────────────────
+    //
+    // Not a post-synth check, and so not required by the coverage test — but a
+    // reader who hits CEDC001 wants the same metadata as one who hits CEDC010,
+    // which is the reason fountain catalogs FTN001.
+    CEDC001: auditRule("CEDC001", "merge-worthy", "guidance", "Cedar policy has an unusable effect or an empty guard", 'Use effect: "permit" or "forbid" — anything else is emitted as a permit — and remove empty when/unless entries.', { category: "correctness" }),
+    // ── Correctness ────────────────────────────────────────────────
+    CEDC010: auditRule("CEDC010", "merge-worthy", "guidance", "Cedar policy set does not parse", "Fix the policy set so Cedar's own parser accepts it — no evaluator can load it as it stands.", { category: "correctness" }),
+    CEDC011: auditRule("CEDC011", "merge-worthy", "guidance", "Cedar condition expression does not parse", "Correct the when/unless expression source named in the finding; the rest of the policy set cannot load until it parses.", { category: "correctness" }),
+    CEDC012: auditRule("CEDC012", "merge-worthy", "guidance", "Duplicate Cedar policy id", "Rename one of the colliding declarations, or give it an explicit and distinct @id annotation — the JSON policy set keeps only one of them.", { category: "correctness" }),
+    CEDC013: auditRule("CEDC013", "report-only", "guidance", "Cedar policy annotation is empty or disagrees with the policy id", "Make @id match the policy's id (or drop it and let chant derive one), and give every other annotation a real value.", { category: "best-practice" }),
+    CEDC014: auditRule("CEDC014", "merge-worthy", "guidance", "Cedar scope constraint names a bare type instead of an entity", 'Write the reference as a full UID — Namespace::Type::"id" — so it resolves to an entity rather than degrading to a type name with an empty id.', { category: "correctness" }),
+    // ── Evaluability (the validator) ───────────────────────────────
+    CEDE010: auditRule("CEDE010", "merge-worthy", "guidance", "Cedar policy fails validation against the schema", "Fix the entity type, action, or attribute the validator names — a policy the validator rejects can never grant anything. If the finding is the advisory, emit a .cedarschema beside the policies so validation can run at all.", { category: "correctness" }),
+    CEDE011: auditRule("CEDE011", "report-only", "guidance", "Cedar validator warns about a policy", "Read the validator's warning — an impossible policy evaluates to false for every valid request, so the access it was written to grant does not exist.", { category: "correctness" }),
+    // ── Security ───────────────────────────────────────────────────
+    CEDS010: auditRule("CEDS010", "merge-worthy", "guidance", "Bare permit(principal, action, resource) grants everything", "Constrain a scope or add a when/unless guard. Cedar's validator does not flag this policy; a production build fails on it.", { category: "security" }),
+    CEDS011: auditRule("CEDS011", "report-only", "guidance", "Cedar policy set has no forbid", "Add a forbid for whatever the set must never allow — a forbid beats every permit, so it is the only invariant a later grant cannot widen.", { category: "security" }),
+    CEDS012: auditRule("CEDS012", "report-only", "guidance", "Cedar permit leaves the action scope unconstrained", 'Name the actions the grant needs (action == Action::"read", or action in [ … ]) so it does not widen as the schema gains actions.', { category: "security" }),
+    // ── The dogwood dialect (DWD) ──────────────────────────────────
+    //
+    // A second id family under the same lexicon, declared on the serializer as
+    // `extraRulePrefixes` (#1349's mechanism, the way k8s owns ARGO and FLUX).
+    // Dogwood is a dialect of Cedar rather than a peer language — a `.dw` file
+    // stripped of Cedar semantics is meaningless — so its checks ship here, and
+    // its ids are their own family so a reader can tell which surface bit them.
+    DWDC010: auditRule("DWDC010", "merge-worthy", "guidance", "Dogwood temporal predicate names an undeclared event kind", "Declare the event kind in the emitted .dwschema, or correct the predicate to a kind the schema derives — upstream rejects the policy set otherwise.", { category: "correctness" }),
+    DWDC011: auditRule("DWDC011", "merge-worthy", "guidance", "Dogwood temporal window exceeds the event schema's max_window", "Shorten the window, or raise max_window in the event schema. With no schema emitted the cap is upstream's 24h default.", { category: "correctness" }),
+    DWDC012: auditRule("DWDC012", "merge-worthy", "guidance", "Dogwood formerly/previous/since is missing its window", "Give the operator a `within <n><s|m|h|d>` window — all three past-only operators require one. The typed builders take it as an argument.", { category: "correctness" }),
+    DWDC013: auditRule("DWDC013", "report-only", "guidance", "AgentCore policy embeds temporal text with no event schema emitted", "Declare a TemporalEventSchema so the .dwschema ships with the policy, or record where the service schema is registered — AWS::BedrockAgentCore::Policy has no property to carry it, and until the engine has it every temporal predicate in the statement matches nothing.", { category: "correctness" }),
+    DWDE010: auditRule("DWDE010", "merge-worthy", "guidance", "Dogwood policy set fails `dogwood validate`", "Fix what upstream's frontend names — a macro, a temporal type error, or a Cedar body the action schema rejects. If the finding is the advisory, install the dogwood binary (or set cedar.dogwood.binary) so full .dw validation can run at all; without it only the DWDC walls apply.", { category: "correctness" }),
+    DWDE011: auditRule("DWDE011", "merge-worthy", "guidance", "Cedar lowered from a dogwood policy set fails Cedar validation", "Fix the entity type, action, or attribute Cedar's validator names in the lowered body — the temporal clauses became context slots, so everything the finding points at is ordinary Cedar the policy wrote.", { category: "correctness" }),
+    DWDS010: auditRule("DWDS010", "report-only", "guidance", "Dogwood event schema pins nothing, widening every temporal predicate", "Pin a field to the deciding request (pin callerPrincipal: principalType(A) = principal), or record that cross-principal correlation is the intent — supplying any event schema opts out of upstream's default pin.", { category: "security" }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(cedarAuditCatalog, cedarAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,23 @@
+export const cedarAuditLineage = {
+    CEDC001: [
+        { tool: "cedar-docs", rule: "effect", url: "https://docs.cedarpolicy.com/policies/json-format.html#effect", relation: "overlaps" },
+    ],
+    CEDC010: [
+        { tool: "cedar-cli", rule: "check-parse", url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli", relation: "equivalent" },
+    ],
+    CEDC011: [
+        { tool: "cedar-cli", rule: "check-parse", url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli", relation: "overlaps" },
+    ],
+    CEDC012: [
+        { tool: "cedar-policy-crate", rule: "PolicySetError::AlreadyDefined", url: "https://docs.rs/cedar-policy/latest/cedar_policy/enum.PolicySetError.html#variant.AlreadyDefined", relation: "overlaps" },
+    ],
+    CEDE010: [
+        { tool: "cedar-validator", rule: "supported-validation-checks (errors)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "equivalent" },
+    ],
+    CEDE011: [
+        { tool: "cedar-validator", rule: "supported-validation-checks (warnings)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "equivalent" },
+    ],
+    DWDE011: [
+        { tool: "cedar-validator", rule: "supported-validation-checks (errors)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/cedar-helpers.js

@@ -0,0 +1,123 @@
+/** Files carrying a Cedar JSON policy set end with this. */
+export const CEDAR_JSON_SUFFIX = ".cedar.json";
+/** The lexicon name stamped on every diagnostic from this directory. */
+export const CEDAR_LEXICON = "cedar";
+// ── Narrowing ─────────────────────────────────────────────────────
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** `permit` / `forbid` / whatever else the document claims. */
+export function effectOf(policy) {
+    return typeof policy.effect === "string" ? policy.effect : undefined;
+}
+/** The three scope positions, in Cedar's own order. */
+export function scopesOf(policy) {
+    const out = [];
+    for (const variable of ["principal", "action", "resource"]) {
+        const scope = policy[variable];
+        if (isRecord(scope))
+            out.push({ variable, scope: scope });
+    }
+    return out;
+}
+/** True when a scope position is Cedar's unconstrained "any" (`op: "All"`). */
+export function scopeIsAll(scope) {
+    return isRecord(scope) && scope.op === "All";
+}
+/** Every `when`/`unless` clause, or `[]` when the policy is unconditioned. */
+export function conditionsOf(policy) {
+    if (!Array.isArray(policy.conditions))
+        return [];
+    return policy.conditions.filter(isRecord);
+}
+/** The policy's annotation map, narrowed to the string-valued entries Cedar allows. */
+export function annotationsOf(policy) {
+    return isRecord(policy.annotations) ? policy.annotations : {};
+}
+/** The `@id` annotation, when it is a string. */
+export function annotatedId(policy) {
+    const id = annotationsOf(policy).id;
+    return typeof id === "string" ? id : undefined;
+}
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * `PostSynthContext#env`) is production-like, for the checks whose severity is
+ * env-gated. Same seam and same vocabulary as the aws lexicon's
+ * `isFullTierEnv`: an unset or unrecognized env is treated as non-production,
+ * so a project that never passes `--env` is never unexpectedly hard-failed.
+ */
+export function isProdLikeEnv(env) {
+    return env === "prod" || env === "production" || env === "full";
+}
+// ── Reading policy sets out of the build output ───────────────────
+/** Every candidate policy-set document in the build, parsed or not. */
+export function policySets(ctx) {
+    const sets = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        if (typeof output === "string") {
+            // A bare string output. `createPostSynthContext` and `chant audit` over a
+            // standalone file both land here; only JSON is a policy set, `.cedar`
+            // text is the human-facing twin and carries nothing the JSON does not.
+            //
+            // Every lexicon's output shares this map, and several of them are JSON,
+            // so "is it JSON" is not enough to claim one: take it when it came from
+            // the cedar output (where even unparseable content is a cedar finding —
+            // CEDC010 reports it) or when it is unmistakably a policy-set envelope.
+            if (!looksLikeJson(output))
+                continue;
+            const set = readSet(lexicon, lexicon, output);
+            if (lexicon === CEDAR_LEXICON || isPolicySetEnvelope(set.doc))
+                sets.push(set);
+            continue;
+        }
+        for (const [filename, content] of Object.entries(output.files ?? {})) {
+            if (!filename.endsWith(CEDAR_JSON_SUFFIX))
+                continue;
+            if (typeof content !== "string")
+                continue;
+            sets.push(readSet(lexicon, filename, content));
+        }
+    }
+    return sets;
+}
+/** The subset of {@link policySets} that parsed as JSON. */
+export function parsedPolicySets(ctx) {
+    return policySets(ctx).filter((set) => set.doc !== undefined);
+}
+function looksLikeJson(text) {
+    return text.trimStart().startsWith("{");
+}
+/** The `PolicySet` envelope has one of these two keys; nothing else does. */
+function isPolicySetEnvelope(doc) {
+    return doc !== undefined && (isRecord(doc.staticPolicies) || isRecord(doc.templates));
+}
+function readSet(lexicon, source, raw) {
+    let doc;
+    let parseError;
+    try {
+        const parsed = JSON.parse(raw);
+        if (isRecord(parsed))
+            doc = parsed;
+        else
+            parseError = "policy set is not a JSON object";
+    }
+    catch (err) {
+        parseError = err instanceof Error ? err.message : String(err);
+    }
+    return { lexicon, source, raw, doc, parseError, entries: doc ? flatten(doc) : [] };
+}
+function flatten(doc) {
+    const entries = [];
+    for (const [group, template] of [
+        [doc.staticPolicies, false],
+        [doc.templates, true],
+    ]) {
+        if (!isRecord(group))
+            continue;
+        for (const [key, policy] of Object.entries(group)) {
+            if (isRecord(policy))
+                entries.push({ key, policy: policy, template });
+        }
+    }
+    return entries;
+}