@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/lsp/hover.js

@@ -0,0 +1,56 @@
+import { lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+import { cedarIndex, cedarRegistry } from "./registry.js";
+/**
+ * Hover over a generated declaration.
+ *
+ * Core's default formatter reports CloudFormation-shaped facts (primary
+ * identifier, create-only, write-only) a Cedar declaration does not have. The
+ * facts that matter here are the Cedar ones: what a `Policy` prop means, which
+ * groups an entity type is `in`, and what an action applies to.
+ */
+export function hover(ctx) {
+    return lexiconHover(ctx, cedarIndex(), formatCedarHover);
+}
+function formatCedarHover(className, indexed) {
+    const entry = cedarRegistry()[className];
+    if (!entry)
+        return undefined;
+    const lines = [`**${className}**`, "", `Cedar type: \`${entry.resourceType}\``];
+    if (entry.description) {
+        lines.push("", entry.description);
+    }
+    if (entry.resourceType === "Cedar::Policy") {
+        lines.push("", "The unit this lexicon serializes — one `.cedar` policy plus its entry in the JSON policy set.", "", "| Prop | Meaning |", "|------|---------|", "| `effect` | `permit` or `forbid`; defaults to `permit` |", "| `principal`, `action`, `resource` | scope constraints — `{}`, `{ eq }`, `{ in }`, `{ is }` |", "| `when`, `unless` | Cedar expression strings, one clause each |", "| `annotations` | emitted as `@key(\"value\")` above the policy |");
+        return { contents: lines.join("\n") };
+    }
+    if (entry.resourceType.includes("::Action::")) {
+        if (entry.principalTypes?.length) {
+            lines.push("", `**Principals:** ${entry.principalTypes.map((t) => `\`${t}\``).join(", ")}`);
+        }
+        if (entry.resourceTypes?.length) {
+            lines.push("", `**Resources:** ${entry.resourceTypes.map((t) => `\`${t}\``).join(", ")}`);
+        }
+        const context = Object.entries(entry.properties ?? {});
+        if (context.length > 0) {
+            lines.push("", "**Context:**");
+            for (const [name, spec] of context) {
+                lines.push(`- \`${name}\`${spec.required ? "" : "?"} — \`${spec.type}\``);
+            }
+        }
+        return { contents: lines.join("\n") };
+    }
+    if (entry.memberOfTypes?.length) {
+        lines.push("", `**Member of:** ${entry.memberOfTypes.map((t) => `\`${t}\``).join(", ")}`);
+    }
+    if (entry.enumValues?.length) {
+        lines.push("", `**Enum values:** ${entry.enumValues.map((v) => `\`${v}\``).join(", ")}`);
+    }
+    const attributes = Object.entries(entry.properties ?? {});
+    if (attributes.length > 0) {
+        lines.push("", indexed.kind === "property" ? "**Fields:**" : "**Attributes:**");
+        for (const [name, spec] of attributes) {
+            lines.push(`- \`${name}\`${spec.required ? "" : "?"} — \`${spec.type}\``);
+        }
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/lsp/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/lsp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAqB,MAAM,wCAAwC,CAAC;AAKzF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK/D,yEAAyE;AACzE,wBAAgB,aAAa,IAAI,aAAa,CAI7C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,IAAI,YAAY,CAazC;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/lsp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,YAAY,EAAqB,MAAM,wCAAwC,CAAC;AAKzF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK/D,yEAAyE;AACzE,wBAAgB,aAAa,IAAI,aAAa,CAI7C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,IAAI,YAAY,CAazC;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/lsp/registry.js

@@ -0,0 +1,51 @@
+/**
+ * The generated registry, adapted to what core's `LexiconIndex` reads.
+ *
+ * `lexicon-cedar.json` describes every declaration the project's schema
+ * produced (#1650): the `Policy` authoring class, one entry per entity type,
+ * one per action, and the attribute/context record types beside them. Its
+ * property table is keyed `properties`, while `LexiconIndex.getPropertyNames`
+ * looks at `propertyConstraints` — the CloudFormation-shaped name the class was
+ * written against. Renaming the generated key to match would put a
+ * CloudFormation word in a Cedar artifact; translating here does not, and it is
+ * the only reason this module exists.
+ *
+ * The require is lazy and cached. `generate()` writes the registry, so a
+ * checkout that has not run it yet must still be able to import this file —
+ * the LSP tests skip on exactly that condition.
+ */
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex } from "@intentius/chant/lsp/lexicon-providers";
+import { LEXICON_JSON_FILENAME } from "../codegen/generate.js";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedRegistry = null;
+let cachedIndex = null;
+/** The raw registry, for the hover formatter's Cedar-specific fields. */
+export function cedarRegistry() {
+    if (cachedRegistry)
+        return cachedRegistry;
+    cachedRegistry = require(`../generated/${LEXICON_JSON_FILENAME}`);
+    return cachedRegistry;
+}
+/** The same registry as a `LexiconIndex`, with the property table translated. */
+export function cedarIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const entries = {};
+    for (const [className, entry] of Object.entries(cedarRegistry())) {
+        entries[className] = {
+            resourceType: entry.resourceType,
+            kind: entry.kind,
+            lexicon: entry.lexicon,
+            propertyConstraints: entry.properties ?? {},
+        };
+    }
+    cachedIndex = new LexiconIndex(entries);
+    return cachedIndex;
+}
+/** Reset the caches. Tests that swap the registry on disk need this; nothing else does. */
+export function resetCedarIndexCache() {
+    cachedRegistry = null;
+    cachedIndex = null;
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cedar",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "Cedar",
   "intrinsics": [],

package/dist/mcp/index.js

@@ -0,0 +1,82 @@
+/**
+ * The cedar lexicon's MCP contributions.
+ *
+ * Two of the three are the conventional pair every lexicon ships, built from
+ * core's shared helpers: `cedar:diff` and `chant://cedar/resource-catalog`.
+ * The third is the one only this lexicon can answer — see
+ * ./policy-coverage.ts.
+ *
+ * Names are written as bare verbs and single-segment URIs. Core namespaces both
+ * (`cedar:<verb>`, `chant://cedar/<path>`), and applying the prefix is
+ * idempotent, so the helpers' pre-namespaced output and the bare `coverage`
+ * below both register as exactly one well-formed identifier (chant #1341).
+ */
+import { createDiffTool, createCatalogResource } from "@intentius/chant/lexicon-plugin-helpers";
+import { cedarSerializer } from "../serializer.js";
+import { computePolicyCoverage, formatPolicyCoverage } from "./policy-coverage.js";
+/**
+ * `cedar:coverage` — which schema declarations the built policy set reaches.
+ *
+ * Builds the project the same way `chant build` does rather than reading a
+ * committed `.cedar` file, so the answer is about the policies in source, not
+ * about whatever was last written to disk.
+ */
+export const cedarCoverageTool = {
+    name: "coverage",
+    description: "Report which Cedar schema entity types and actions the project's policy set can apply to, " +
+        "which are reachable only from a forbid, and which no policy covers at all.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            path: {
+                type: "string",
+                description: "Path to the infrastructure project directory (defaults to the current directory)",
+            },
+            format: {
+                type: "string",
+                enum: ["json", "text"],
+                description: "Return the full report as JSON (default) or a human-readable summary",
+            },
+        },
+    },
+    async handler(params) {
+        const { join } = await import("path");
+        const { existsSync } = await import("fs");
+        const { build } = await import("@intentius/chant/build");
+        const { loadCedarConfig } = await import("../config.js");
+        const projectRoot = params.path ?? ".";
+        const srcDir = existsSync(join(projectRoot, "src")) ? join(projectRoot, "src") : projectRoot;
+        const result = await build(srcDir, [cedarSerializer]);
+        if (result.errors.length > 0) {
+            return { error: "build failed", details: result.errors.map((e) => String(e)) };
+        }
+        const output = result.outputs.get("cedar");
+        const policySetText = typeof output === "string" ? output : (output?.primary ?? "");
+        const report = computePolicyCoverage({
+            policySetText,
+            projectRoot,
+            config: await loadCedarConfig(projectRoot),
+        });
+        return params.format === "text" ? formatPolicyCoverage(report) : report;
+    },
+};
+/** Every MCP tool this lexicon contributes. */
+export function cedarMcpTools() {
+    return [
+        createDiffTool(cedarSerializer, "Compare the current Cedar policy set against the previous build's output", "cedar"),
+        cedarCoverageTool,
+    ];
+}
+/**
+ * Every MCP resource this lexicon contributes.
+ *
+ * `createCatalogResource` locates the registry relative to the module URL it is
+ * given, resolving `<dir>/generated/lexicon-cedar.json`. That has to be
+ * `src/`, not `src/mcp/`, so the caller in plugin.ts passes its own
+ * `import.meta.url` rather than this file deriving one by walking up.
+ */
+export function cedarMcpResources(pluginUrl) {
+    return [
+        createCatalogResource(pluginUrl, "Cedar Resource Catalog", "Every declaration generated from the project's Cedar schema — entity types, actions, and the Policy class", "lexicon-cedar.json", "cedar"),
+    ];
+}

package/dist/mcp/policy-coverage.js

@@ -0,0 +1,134 @@
+/**
+ * "Which policies cover this resource?" — answered from a build (epic #1645).
+ *
+ * `src/coverage.ts` next door asks a different question: is every schema
+ * declaration reachable from the *generated artifacts*. This one asks whether
+ * every schema declaration is reachable from the *policy set*, which is the
+ * authorization question. An entity type no policy can ever apply to is a
+ * resource nothing grants and nothing denies — under Cedar's default-deny it is
+ * inert, and that is either the intent or a hole.
+ *
+ * The answer comes from `getValidRequestEnvsPolicy`, Cedar's own resolver: it
+ * takes one policy and the schema and returns every (principal, action,
+ * resource) triple the policy could apply to, having already expanded `is`,
+ * `in`, action groups, and `appliesTo`. Reimplementing that against the parsed
+ * scope would be a second, worse Cedar; this is why the wasm package is a
+ * runtime dependency rather than a dev one.
+ */
+import { getValidRequestEnvsPolicy, policySetTextToParts, policyToJson, } from "@cedar-policy/cedar-wasm/nodejs";
+import { readSchemaSource } from "../spec/fetch.js";
+import { parseCedarSchema } from "../spec/parse.js";
+/**
+ * A policy's id and effect, read from Cedar's own parse rather than from the
+ * text.
+ *
+ * The regex version of this worked on the serializer's output and only on the
+ * serializer's output: a hand-formatted policy, an annotation whose value
+ * contains the word `forbid`, or an escaped quote inside `@id` each break it.
+ * `policyToJson` is already in the package, so there is no reason to guess.
+ *
+ * `index` supplies the fallback id, because a Cedar policy is not required to
+ * annotate one and a report keyed by "" would collapse them together.
+ */
+function identify(text, index) {
+    const parsed = policyToJson(text);
+    if (parsed.type !== "success") {
+        return { id: `policy-${index + 1}`, effect: "permit" };
+    }
+    const annotated = parsed.json.annotations?.id;
+    return {
+        id: typeof annotated === "string" && annotated.length > 0 ? annotated : `policy-${index + 1}`,
+        effect: parsed.json.effect === "forbid" ? "forbid" : "permit",
+    };
+}
+/**
+ * Report which schema declarations the policy set can reach.
+ */
+export function computePolicyCoverage(options) {
+    const source = readSchemaSource(options);
+    const { decls } = parseCedarSchema(source.text);
+    const parts = policySetTextToParts(options.policySetText);
+    const policies = parts.type === "success" ? parts.policies : [];
+    const parseErrors = parts.type === "success" ? [] : parts.errors.map((e) => e.message);
+    const hits = new Map();
+    const unresolved = [];
+    const inert = [];
+    policies.forEach((text, index) => {
+        const { id, effect } = identify(text, index);
+        const envs = getValidRequestEnvsPolicy(text, source.text);
+        if (envs.type !== "success") {
+            unresolved.push({ policyId: id, error: envs.error });
+            return;
+        }
+        const reached = [...envs.principals, ...envs.actions, ...envs.resources];
+        if (reached.length === 0) {
+            inert.push(id);
+            return;
+        }
+        for (const name of reached) {
+            const hit = hits.get(name) ?? { ids: [], permitted: false, forbidden: false };
+            if (!hit.ids.includes(id))
+                hit.ids.push(id);
+            if (effect === "permit")
+                hit.permitted = true;
+            else
+                hit.forbidden = true;
+            hits.set(name, hit);
+        }
+    });
+    const items = decls
+        .map((decl) => {
+        const hit = hits.get(decl.typeName);
+        return {
+            name: decl.typeName,
+            kind: decl.kind,
+            policies: hit?.ids.length ?? 0,
+            policyIds: hit?.ids ?? [],
+            permitted: hit?.permitted ?? false,
+            forbidden: hit?.forbidden ?? false,
+        };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+    const entities = items.filter((i) => i.kind === "entity");
+    const actions = items.filter((i) => i.kind === "action");
+    return {
+        schemaPath: source.path,
+        isDefaultSchema: source.isDefault,
+        policyCount: policies.length,
+        entityTypes: entities.length,
+        entityTypesCovered: entities.filter((i) => i.policies > 0).length,
+        actions: actions.length,
+        actionsCovered: actions.filter((i) => i.policies > 0).length,
+        uncovered: items.filter((i) => i.policies === 0).map((i) => i.name),
+        forbidOnly: items.filter((i) => i.policies > 0 && !i.permitted).map((i) => i.name),
+        items,
+        unresolved,
+        inert,
+        parseErrors,
+    };
+}
+/** Human-readable summary, for the CLI-shaped callers. */
+export function formatPolicyCoverage(report) {
+    const lines = [
+        `Cedar policy coverage — ${report.policyCount} policy/policies against ` +
+            `${report.isDefaultSchema ? "the bundled default schema" : report.schemaPath}`,
+        `  Entity types: ${report.entityTypesCovered}/${report.entityTypes}`,
+        `  Actions:      ${report.actionsCovered}/${report.actions}`,
+    ];
+    for (const error of report.parseErrors) {
+        lines.push(`  Parse error:  ${error}`);
+    }
+    if (report.uncovered.length > 0) {
+        lines.push(`  Uncovered:    ${report.uncovered.join(", ")}`);
+    }
+    if (report.forbidOnly.length > 0) {
+        lines.push(`  Forbid only:  ${report.forbidOnly.join(", ")}`);
+    }
+    if (report.inert.length > 0) {
+        lines.push(`  Never fires:  ${report.inert.join(", ")}`);
+    }
+    for (const problem of report.unresolved) {
+        lines.push(`  Unresolved:   ${problem.policyId} — ${problem.error}`);
+    }
+    return lines.join("\n");
+}

package/dist/op/activities/index.js

@@ -0,0 +1,16 @@
+/**
+ * cedar Op activities — resolved by the core activity registry when a
+ * project's `chant.config.ts` lists the `cedar` lexicon.
+ *
+ * The registry keys every exported *function* in this module by its name
+ * (`loadActivities` → `collectActivities`), which is why only the activities
+ * themselves are exported here. `dogwoodReplay`'s helpers — the input
+ * resolver, the verdict comparison, the summary renderer — stay importable
+ * from `@intentius/chant-lexicon-cedar/dogwood/replay-activity` rather than
+ * being registered as activities nobody would ever name in a step.
+ *
+ * Contributed the `flyApply` way: a plain async function taking one args
+ * object, depending on no runtime beyond node, so the local executor
+ * (`packages/core/src/op/local-executor.ts`) calls it directly.
+ */
+export { dogwoodReplay, dogwoodReplayReport } from "../../dogwood/replay-activity.js";

package/dist/package-cli.js

@@ -0,0 +1,18 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run bundle` in lexicon-cedar.
+ *
+ * Unlike the other lexicons this does not generate `src/generated/` first —
+ * codegen is schema-driven and per-project, and lands in #1650. Until then
+ * the bundle carries the manifest, rules and integrity over an empty registry.
+ */
+import { packageLexicon } from "./codegen/package.js";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const { spec, stats } = await packageLexicon({ verbose: true });
+const distDir = join(pkgDir, "dist");
+writeBundleSpec(spec, distDir);
+console.error(`Packaged ${stats.resources} entities, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+console.error(`dist/ written to ${distDir}`);