@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/lint/post-synth/cedc010.js

@@ -0,0 +1,59 @@
+import { CEDAR_LEXICON, policySets } from "./cedar-helpers.js";
+import { loadWasm, normalizePolicySet, parsePolicySet, wasmLoadError } from "./wasm-helpers.js";
+export const cedc010 = {
+    id: "CEDC010",
+    description: "The emitted Cedar policy set must parse as Cedar (checkParsePolicySet)",
+    check(ctx) {
+        const diagnostics = [];
+        const sets = policySets(ctx);
+        if (sets.length === 0)
+            return diagnostics;
+        const wasm = loadWasm();
+        if (!wasm) {
+            // The only place the missing-validator condition is reported. The other
+            // wasm-backed checks stay quiet rather than repeating it four times.
+            return [
+                {
+                    checkId: "CEDC010",
+                    severity: "warning",
+                    message: `Cedar policies were emitted but @cedar-policy/cedar-wasm could not be loaded, so none of them were parsed or validated: ${wasmLoadError()}`,
+                    lexicon: CEDAR_LEXICON,
+                },
+            ];
+        }
+        for (const set of sets) {
+            if (set.doc === undefined) {
+                diagnostics.push({
+                    checkId: "CEDC010",
+                    severity: "error",
+                    message: `Cedar policy set "${set.source}" is not readable as JSON: ${set.parseError}`,
+                    entity: set.source,
+                    lexicon: set.lexicon,
+                });
+                continue;
+            }
+            const { policySet } = normalizePolicySet(wasm, set);
+            const parsed = parsePolicySet(wasm, policySet);
+            if (!parsed.ok) {
+                diagnostics.push({
+                    checkId: "CEDC010",
+                    severity: "error",
+                    message: `Cedar policy set "${set.source}" could not be parsed: ${parsed.message}`,
+                    entity: set.source,
+                    lexicon: set.lexicon,
+                });
+                continue;
+            }
+            for (const message of parsed.value) {
+                diagnostics.push({
+                    checkId: "CEDC010",
+                    severity: "error",
+                    message: `Cedar policy set "${set.source}" does not parse as Cedar: ${message}`,
+                    entity: set.source,
+                    lexicon: set.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cedc011.js

@@ -0,0 +1,29 @@
+import { CEDAR_LEXICON, parsedPolicySets } from "./cedar-helpers.js";
+import { loadWasm, normalizePolicySet } from "./wasm-helpers.js";
+export const cedc011 = {
+    id: "CEDC011",
+    description: "Every when/unless condition expression in an emitted policy must parse as a Cedar expression",
+    check(ctx) {
+        const diagnostics = [];
+        const sets = parsedPolicySets(ctx);
+        if (sets.length === 0)
+            return diagnostics;
+        // A missing validator is CEDC010's finding to report, not this one's.
+        const wasm = loadWasm();
+        if (!wasm)
+            return diagnostics;
+        for (const set of sets) {
+            const { expressionFailures } = normalizePolicySet(wasm, set);
+            for (const failure of expressionFailures) {
+                diagnostics.push({
+                    checkId: "CEDC011",
+                    severity: "error",
+                    message: `Policy "${failure.key}" has a ${failure.kind} clause whose expression does not parse: ${failure.expression} — ${failure.message}`,
+                    entity: failure.key,
+                    lexicon: set.lexicon || CEDAR_LEXICON,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cedc012.js

@@ -0,0 +1,34 @@
+import { annotatedId, parsedPolicySets } from "./cedar-helpers.js";
+export const cedc012 = {
+    id: "CEDC012",
+    description: "No two emitted Cedar policies may claim the same policy id",
+    check(ctx) {
+        const claims = new Map();
+        for (const set of parsedPolicySets(ctx)) {
+            for (const entry of set.entries) {
+                // The key and the `@id` annotation are two ways of claiming the same
+                // id; a policy claiming both only counts once.
+                const ids = new Set([entry.key, annotatedId(entry.policy)].filter((id) => !!id));
+                for (const id of ids) {
+                    const existing = claims.get(id) ?? [];
+                    existing.push({ lexicon: set.lexicon, source: set.source, key: entry.key });
+                    claims.set(id, existing);
+                }
+            }
+        }
+        const diagnostics = [];
+        for (const [id, holders] of [...claims].sort(([a], [b]) => a.localeCompare(b))) {
+            if (holders.length < 2)
+                continue;
+            const where = holders.map((h) => `${h.source}:${h.key}`).join(", ");
+            diagnostics.push({
+                checkId: "CEDC012",
+                severity: "error",
+                message: `Cedar policy id "${id}" is claimed by ${holders.length} policies (${where}). Ids must be unique across the policy set — rename one of the declarations or give it an explicit, distinct @id annotation.`,
+                entity: id,
+                lexicon: holders[0].lexicon,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cedc013.js

@@ -0,0 +1,45 @@
+import { annotationsOf, parsedPolicySets } from "./cedar-helpers.js";
+export const cedc013 = {
+    id: "CEDC013",
+    description: "An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings",
+    check(ctx) {
+        const diagnostics = [];
+        for (const set of parsedPolicySets(ctx)) {
+            for (const entry of set.entries) {
+                const annotations = annotationsOf(entry.policy);
+                for (const [key, value] of Object.entries(annotations)) {
+                    if (typeof value !== "string") {
+                        diagnostics.push({
+                            checkId: "CEDC013",
+                            severity: "warning",
+                            message: `Policy "${entry.key}" has a non-string @${key} annotation (${JSON.stringify(value)}). Cedar annotations are strings.`,
+                            entity: entry.key,
+                            lexicon: set.lexicon,
+                        });
+                        continue;
+                    }
+                    if (value.trim() === "") {
+                        diagnostics.push({
+                            checkId: "CEDC013",
+                            severity: "warning",
+                            message: `Policy "${entry.key}" has an empty @${key} annotation. Give it a value or drop it — an empty annotation reads as documentation and carries none.`,
+                            entity: entry.key,
+                            lexicon: set.lexicon,
+                        });
+                        continue;
+                    }
+                    if (key === "id" && value !== entry.key) {
+                        diagnostics.push({
+                            checkId: "CEDC013",
+                            severity: "warning",
+                            message: `Policy filed under id "${entry.key}" annotates @id("${value}"). The .cedar text and the JSON policy set would name this policy differently — make the annotation match, or remove it and let chant derive the id.`,
+                            entity: entry.key,
+                            lexicon: set.lexicon,
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cedc014.js

@@ -0,0 +1,54 @@
+import { isRecord, parsedPolicySets, scopesOf } from "./cedar-helpers.js";
+/** Every entity reference a scope position carries, in document order. */
+function scopeEntities(scope) {
+    const found = [];
+    const collect = (holder) => {
+        if (!isRecord(holder))
+            return;
+        if (holder.entity !== undefined)
+            found.push(holder.entity);
+        if (Array.isArray(holder.entities))
+            found.push(...holder.entities);
+    };
+    collect(scope);
+    // `is T in E` nests the `in` constraint under the `is`.
+    collect(scope.in);
+    return found;
+}
+export const cedc014 = {
+    id: "CEDC014",
+    description: "An entity reference in a policy scope must be a well-formed Namespace::Type::\"id\" UID",
+    check(ctx) {
+        const diagnostics = [];
+        for (const set of parsedPolicySets(ctx)) {
+            for (const entry of set.entries) {
+                for (const { variable, scope } of scopesOf(entry.policy)) {
+                    for (const ref of scopeEntities(scope)) {
+                        if (!isRecord(ref)) {
+                            diagnostics.push({
+                                checkId: "CEDC014",
+                                severity: "error",
+                                message: `Policy "${entry.key}" has a ${variable} constraint whose entity reference is not an entity UID (${JSON.stringify(ref)}).`,
+                                entity: entry.key,
+                                lexicon: set.lexicon,
+                            });
+                            continue;
+                        }
+                        const type = typeof ref.type === "string" ? ref.type : "";
+                        const id = typeof ref.id === "string" ? ref.id : undefined;
+                        if (type === "" || id === undefined || id === "") {
+                            diagnostics.push({
+                                checkId: "CEDC014",
+                                severity: "error",
+                                message: `Policy "${entry.key}" constrains ${variable} against "${type}" with no entity id. Write the reference as a full UID — Namespace::Type::"id" — so it resolves to an entity rather than to a bare type name.`,
+                                entity: entry.key,
+                                lexicon: set.lexicon,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cede010.js

@@ -0,0 +1,51 @@
+import { parsedPolicySets } from "./cedar-helpers.js";
+import { findSchema, loadWasm, normalizePolicySet, validatePolicySet } from "./wasm-helpers.js";
+export const cede010 = {
+    id: "CEDE010",
+    description: "Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)",
+    check(ctx) {
+        const diagnostics = [];
+        const sets = parsedPolicySets(ctx);
+        if (sets.length === 0)
+            return diagnostics;
+        // A missing validator is CEDC010's finding to report, not this one's.
+        const wasm = loadWasm();
+        if (!wasm)
+            return diagnostics;
+        const schema = findSchema(ctx);
+        if (!schema) {
+            return [
+                {
+                    checkId: "CEDE010",
+                    severity: "info",
+                    message: `No Cedar schema was emitted with the ${sets.length} policy set(s) in this build, so they were checked for parseability only — nothing verified that the entity types, actions, and attributes they name exist. Emit a .cedarschema (or .cedarschema.json) alongside the policies to turn this into real validation.`,
+                    lexicon: sets[0].lexicon,
+                },
+            ];
+        }
+        for (const set of sets) {
+            const { policySet } = normalizePolicySet(wasm, set);
+            const outcome = validatePolicySet(wasm, policySet, schema.schema);
+            if (outcome.failure) {
+                diagnostics.push({
+                    checkId: "CEDE010",
+                    severity: "error",
+                    message: `Cedar policy set "${set.source}" could not be validated against "${schema.source}": ${outcome.failure}`,
+                    entity: set.source,
+                    lexicon: set.lexicon,
+                });
+                continue;
+            }
+            for (const finding of outcome.errors) {
+                diagnostics.push({
+                    checkId: "CEDE010",
+                    severity: "error",
+                    message: `Policy "${finding.policyId}" fails Cedar validation against "${schema.source}": ${finding.message}`,
+                    entity: finding.policyId,
+                    lexicon: set.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cede011.js

@@ -0,0 +1,36 @@
+import { parsedPolicySets } from "./cedar-helpers.js";
+import { findSchema, loadWasm, normalizePolicySet, validatePolicySet } from "./wasm-helpers.js";
+export const cede011 = {
+    id: "CEDE011",
+    description: "Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set",
+    check(ctx) {
+        const diagnostics = [];
+        const sets = parsedPolicySets(ctx);
+        if (sets.length === 0)
+            return diagnostics;
+        // Both "no validator" and "no schema" are already reported once by
+        // CEDC010/CEDE010; repeating them here would triple the same line.
+        const wasm = loadWasm();
+        if (!wasm)
+            return diagnostics;
+        const schema = findSchema(ctx);
+        if (!schema)
+            return diagnostics;
+        for (const set of sets) {
+            const { policySet } = normalizePolicySet(wasm, set);
+            const outcome = validatePolicySet(wasm, policySet, schema.schema);
+            if (outcome.failure)
+                continue; // CEDE010 reports the failed call
+            for (const finding of outcome.warnings) {
+                diagnostics.push({
+                    checkId: "CEDE011",
+                    severity: "warning",
+                    message: `Policy "${finding.policyId}" validates but Cedar warns about it: ${finding.message}`,
+                    entity: finding.policyId,
+                    lexicon: set.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ceds010.js

@@ -0,0 +1,31 @@
+import { conditionsOf, effectOf, isProdLikeEnv, parsedPolicySets, scopeIsAll } from "./cedar-helpers.js";
+export const ceds010 = {
+    id: "CEDS010",
+    description: "A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything",
+    check(ctx) {
+        const diagnostics = [];
+        const prod = isProdLikeEnv(ctx.env);
+        const severity = prod ? "error" : "warning";
+        for (const set of parsedPolicySets(ctx)) {
+            for (const entry of set.entries) {
+                if (effectOf(entry.policy) !== "permit")
+                    continue;
+                const policy = entry.policy;
+                const bare = scopeIsAll(policy.principal) &&
+                    scopeIsAll(policy.action) &&
+                    scopeIsAll(policy.resource) &&
+                    conditionsOf(policy).length === 0;
+                if (!bare)
+                    continue;
+                diagnostics.push({
+                    checkId: "CEDS010",
+                    severity,
+                    message: `Policy "${entry.key}" is a bare permit(principal, action, resource) — every principal may take every action on every resource.${prod ? "" : " This is an error in a production build."} Constrain a scope or add a when/unless guard.`,
+                    entity: entry.key,
+                    lexicon: set.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ceds011.js

@@ -0,0 +1,22 @@
+import { effectOf, parsedPolicySets } from "./cedar-helpers.js";
+export const ceds011 = {
+    id: "CEDS011",
+    description: "A policy set built entirely from permits carries no forbid to bound them",
+    check(ctx) {
+        const diagnostics = [];
+        for (const set of parsedPolicySets(ctx)) {
+            if (set.entries.length === 0)
+                continue;
+            if (set.entries.some((entry) => effectOf(entry.policy) === "forbid"))
+                continue;
+            diagnostics.push({
+                checkId: "CEDS011",
+                severity: "warning",
+                message: `Cedar policy set "${set.source}" has ${set.entries.length} policy/policies and no forbid. A forbid beats every permit regardless of order, so it is the only way to state an invariant a later grant cannot widen — add one for whatever this set must never allow.`,
+                entity: set.source,
+                lexicon: set.lexicon,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ceds012.js

@@ -0,0 +1,31 @@
+import { conditionsOf, effectOf, parsedPolicySets, scopeIsAll } from "./cedar-helpers.js";
+export const ceds012 = {
+    id: "CEDS012",
+    description: "A permit that leaves the action scope unconstrained grants every action, including future ones",
+    check(ctx) {
+        const diagnostics = [];
+        for (const set of parsedPolicySets(ctx)) {
+            for (const entry of set.entries) {
+                const policy = entry.policy;
+                if (effectOf(policy) !== "permit")
+                    continue;
+                if (!scopeIsAll(policy.action))
+                    continue;
+                // The everything-permit belongs to CEDS010.
+                const narrowedElsewhere = !scopeIsAll(policy.principal) ||
+                    !scopeIsAll(policy.resource) ||
+                    conditionsOf(policy).length > 0;
+                if (!narrowedElsewhere)
+                    continue;
+                diagnostics.push({
+                    checkId: "CEDS012",
+                    severity: "warning",
+                    message: `Policy "${entry.key}" permits every action — the action scope is unconstrained, so the grant widens on its own as the schema gains actions. Name the actions it needs (action == Action::"read", or action in [ … ]).`,
+                    entity: entry.key,
+                    lexicon: set.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dogwood-helpers.js

@@ -0,0 +1,94 @@
+import { blankComments, dogwoodPolicyFiles, dogwoodSchemaFiles } from "../../dogwood/scan.js";
+/**
+ * A `.dw` file holding only `def` declarations is a macro library, not a
+ * policy set.
+ *
+ * By structure rather than by filename: the serializer's default is
+ * `macros.dw`, but `MacroLibraryProps.filename` overrides it, and `chant
+ * audit` runs over trees chant never wrote. A policy set is a file with a
+ * `permit` or `forbid` head in it — upstream's policy grammar has no third
+ * effect — and a set with inlined macros still has one.
+ */
+export function looksLikeMacroLibrary(text) {
+    return !/\b(permit|forbid)\s*\(/.test(blankComments(text));
+}
+function byName(a, b) {
+    return a.source.localeCompare(b.source);
+}
+/**
+ * The Cedar action schema the CLI needs, as text.
+ *
+ * `--policy-schema` reads a human-readable `.cedarschema`; a `.cedarschema.json`
+ * is not a substitute, so it is not offered as one. Sorted by filename so a
+ * build emitting several picks the same one on every run.
+ */
+function findPolicySchema(ctx) {
+    const found = [];
+    for (const [lexicon, output] of ctx.outputs) {
+        if (typeof output === "string")
+            continue;
+        for (const [source, text] of Object.entries(output.files ?? {})) {
+            if (typeof text !== "string")
+                continue;
+            if (!source.endsWith(".cedarschema"))
+                continue;
+            found.push({ lexicon, source, text });
+        }
+    }
+    return found.sort(byName)[0];
+}
+/**
+ * Plan every `dogwood` invocation this build calls for.
+ *
+ * One bundle per policy set per emitted event schema. A build with several
+ * `.dwschema` files means several services, and `--event-schema` takes exactly
+ * one file, so the set is run against each and every finding names the schema
+ * it was found under — the alternative is picking one silently and reporting
+ * against a schema the reader did not choose. Macro libraries do combine: a
+ * library is a sequence of `def`s, so several concatenate into the one file
+ * `--macros` accepts.
+ */
+export function planDogwoodRuns(ctx) {
+    const files = dogwoodPolicyFiles(ctx).sort(byName);
+    const policySets = files.filter((f) => !looksLikeMacroLibrary(f.text));
+    if (policySets.length === 0)
+        return { hasPolicies: false, bundles: [] };
+    const lexicon = policySets[0].lexicon;
+    const libraries = files.filter((f) => looksLikeMacroLibrary(f.text));
+    const macros = libraries.length > 0 ? libraries.map((f) => f.text).join("\n") : undefined;
+    const policySchema = findPolicySchema(ctx);
+    if (!policySchema) {
+        return {
+            hasPolicies: true,
+            bundles: [],
+            lexicon,
+            blocked: "no Cedar action schema (.cedarschema) was emitted beside them, and `dogwood validate` requires one via --policy-schema",
+        };
+    }
+    const eventSchemas = dogwoodSchemaFiles(ctx).sort(byName);
+    const bundles = [];
+    for (const set of policySets) {
+        for (const events of eventSchemas.length > 0 ? eventSchemas : [undefined]) {
+            bundles.push({
+                lexicon: set.lexicon,
+                source: set.source,
+                policySchemaSource: policySchema.source,
+                ...(events ? { eventSchemaSource: events.source } : {}),
+                bundle: {
+                    policies: set.text,
+                    policySchema: policySchema.text,
+                    ...(events ? { eventSchema: events.text } : {}),
+                    ...(macros !== undefined ? { macros } : {}),
+                },
+            });
+        }
+    }
+    return { hasPolicies: true, bundles, lexicon };
+}
+/** How a finding names the inputs a run was made with. */
+export function describeBundle(prepared) {
+    const parts = [`"${prepared.source}"`, `against "${prepared.policySchemaSource}"`];
+    if (prepared.eventSchemaSource)
+        parts.push(`with "${prepared.eventSchemaSource}"`);
+    return parts.join(" ");
+}

package/dist/lint/post-synth/dwdc010.js

@@ -0,0 +1,38 @@
+import { dogwoodPolicyFiles, dogwoodSchemaFiles, readEventSchema, scanPredicates } from "../../dogwood/scan.js";
+export const dwdc010 = {
+    id: "DWDC010",
+    description: "A dogwood temporal predicate names an event kind the emitted .dwschema declares",
+    check(ctx) {
+        const schemas = dogwoodSchemaFiles(ctx);
+        if (schemas.length === 0)
+            return [];
+        const declared = new Set();
+        for (const schema of schemas) {
+            for (const kind of readEventSchema(schema.text).kinds)
+                declared.add(kind);
+        }
+        if (declared.size === 0)
+            return [];
+        const known = [...declared].sort().join(", ");
+        const diagnostics = [];
+        for (const policies of dogwoodPolicyFiles(ctx)) {
+            const seen = new Set();
+            for (const ref of scanPredicates(policies.text)) {
+                if (declared.has(ref.kind))
+                    continue;
+                const key = `${ref.action}::${ref.kind}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                diagnostics.push({
+                    checkId: "DWDC010",
+                    severity: "error",
+                    message: `Dogwood policy set "${policies.source}" has a temporal predicate on ${key}, but the emitted event schema declares no event kind "${ref.kind}" (declared: ${known}).`,
+                    entity: policies.source,
+                    lexicon: policies.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dwdc011.js

@@ -0,0 +1,34 @@
+import { dogwoodPolicyFiles, dogwoodSchemaFiles, effectiveMaxWindowSeconds, readEventSchema, scanWindows, } from "../../dogwood/scan.js";
+export const dwdc011 = {
+    id: "DWDC011",
+    description: "A dogwood temporal window stays inside the event schema's max_window cap",
+    check(ctx) {
+        const policyFiles = dogwoodPolicyFiles(ctx);
+        if (policyFiles.length === 0)
+            return [];
+        const schemas = dogwoodSchemaFiles(ctx).map((s) => readEventSchema(s.text));
+        const cap = effectiveMaxWindowSeconds(schemas);
+        const source = schemas.length === 0
+            ? "upstream's default cap (no event schema was emitted)"
+            : `the emitted event schema's max_window`;
+        const diagnostics = [];
+        for (const policies of policyFiles) {
+            const reported = new Set();
+            for (const window of scanWindows(policies.text)) {
+                if (window.seconds <= cap.seconds)
+                    continue;
+                if (reported.has(window.text))
+                    continue;
+                reported.add(window.text);
+                diagnostics.push({
+                    checkId: "DWDC011",
+                    severity: "error",
+                    message: `Dogwood policy set "${policies.source}" looks back ${window.text}, past the ${cap.text} allowed by ${source}. Raise max_window in the event schema, or shorten the window.`,
+                    entity: policies.source,
+                    lexicon: policies.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dwdc012.js

@@ -0,0 +1,24 @@
+import { dogwoodPolicyFiles, scanWindowlessOperators } from "../../dogwood/scan.js";
+export const dwdc012 = {
+    id: "DWDC012",
+    description: "A dogwood formerly/previous/since operator carries its mandatory within window",
+    check(ctx) {
+        const diagnostics = [];
+        for (const policies of dogwoodPolicyFiles(ctx)) {
+            const seen = new Set();
+            for (const operator of scanWindowlessOperators(policies.text)) {
+                if (seen.has(operator))
+                    continue;
+                seen.add(operator);
+                diagnostics.push({
+                    checkId: "DWDC012",
+                    severity: "error",
+                    message: `Dogwood policy set "${policies.source}" uses \`${operator}\` with no \`within\` window. All three past-only operators require one — write \`${operator} within <n><s|m|h|d> …\`.`,
+                    entity: policies.source,
+                    lexicon: policies.lexicon,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/dwdc013.js

@@ -0,0 +1,29 @@
+import { embeddedAgentCorePolicyStatements } from "../../agentcore/scan.js";
+import { dogwoodSchemaFiles, temporalRegions } from "../../dogwood/scan.js";
+export const dwdc013 = {
+    id: "DWDC013",
+    description: "An embedded AgentCore temporal statement has its event schema emitted beside it",
+    check(ctx) {
+        if (dogwoodSchemaFiles(ctx).length > 0)
+            return [];
+        const diagnostics = [];
+        const seen = new Set();
+        for (const embedded of embeddedAgentCorePolicyStatements(ctx)) {
+            if (temporalRegions(embedded.statement).length === 0)
+                continue;
+            const named = embedded.logicalId ?? embedded.source;
+            const key = `${embedded.lexicon}:${embedded.source}:${named}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            diagnostics.push({
+                checkId: "DWDC013",
+                severity: "warning",
+                message: `AgentCore policy "${named}" in "${embedded.source}" carries temporal text in Definition.Policy.Statement, but the build emitted no .dwschema event schema. The policy engine needs the event kinds and their pins registered before any temporal predicate can match; without them the clause never fires and the policy silently stops doing its job. Declare a TemporalEventSchema, or record where the service schema is registered.`,
+                entity: named,
+                lexicon: embedded.lexicon,
+            });
+        }
+        return diagnostics;
+    },
+};