@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/serializer.js

@@ -0,0 +1,203 @@
+/**
+ * Cedar lexicon serializer.
+ *
+ * Emits two views of the same policy set:
+ *
+ * - `.cedar` policy text — the primary output, and the surface every Cedar
+ *   evaluator reads (AVP, cedar-agent, an embedded `cedar-wasm`).
+ * - the Cedar JSON policy format — a second file, written alongside, and the
+ *   parse source for import (#1653). It is produced by handing the emitted
+ *   `.cedar` text back to `cedar-wasm`, so what lands on disk is whatever
+ *   Cedar itself says that text means. Deriving it from the in-memory model
+ *   instead is what shipped first, and it wrote `when` bodies as
+ *   `{ "__expr": "<text>" }` — a key Cedar's JSON grammar does not have, which
+ *   every Cedar tool rejects with `unknown variant '__expr'`.
+ *
+ * The entity model this serializer reads is hand-shaped for now: one
+ * `Cedar::Policy` entity type whose `props` carry an effect, three scope
+ * constraints, and optional `when`/`unless` guards. Schema-driven codegen
+ * (#1650) generates typed classes onto exactly this shape, so nothing here
+ * changes when it lands — the guards become typed expressions rather than
+ * the opaque Cedar-expression strings they are today.
+ *
+ * A third view arrives when the build holds dogwood entities (#1658): `.dw`
+ * policy text and its `.dwschema`/`macros.dw` companions, rendered by
+ * `./dogwood/serialize.ts` and returned in the same result. Both legs share
+ * `./policy-text.ts` rather than a copy of it, because a `.dw` policy's head
+ * *is* a Cedar policy's head.
+ */
+import { isPropertyDeclarable } from "@intentius/chant/declarable";
+import { walkValue } from "@intentius/chant/serializer-walker";
+import { policyToJson, splitPolicySet, templateToJson } from "./spec/wasm.js";
+import { serializeDogwood } from "./dogwood/serialize.js";
+import { schemaEntities } from "./schema-artifact.js";
+import { conditionStrings, getProps, renderPolicyHead, resolvePolicyId, } from "./policy-text.js";
+// ── The policy entity model ───────────────────────────────────────
+/** The `entityType` this serializer reads. */
+export const CEDAR_POLICY_TYPE = "Cedar::Policy";
+/** Filename of the JSON policy-set companion to the primary `.cedar` output. */
+export const CEDAR_JSON_FILENAME = "policies.cedar.json";
+// ── Helpers ───────────────────────────────────────────────────────
+//
+// Rendering the dogwood dialect shares lives in `./policy-text.ts`, along with
+// `resolvePolicyId` — the one rule linking a chant entity to a policy id, which
+// #1652 extracted for the AVP observation and the `.dw` leg needs for the same
+// reason. Re-exported here so this module stays the one import a caller needs.
+export { conditionStrings, escapeCedarString, getProps, isRecord, policyIdFromLogicalName, renderPolicyHead, renderScope, resolvePolicyId, } from "./policy-text.js";
+// ── Walker visitor ────────────────────────────────────────────────
+/**
+ * Cedar has no intrinsic function syntax, so references collapse to the text
+ * a policy would name them by. Property names pass through verbatim.
+ */
+const cedarVisitor = {
+    attrRef: (logicalName, attribute) => `${logicalName}.${attribute}`,
+    resourceRef: (logicalName) => logicalName,
+    propertyDeclarable: (entity, walk) => {
+        const out = {};
+        for (const [key, value] of Object.entries(getProps(entity))) {
+            if (key === "entityType" || key === "lexicon")
+                continue;
+            if (value === undefined)
+                continue;
+            out[key] = walk(value);
+        }
+        return out;
+    },
+};
+// ── Cedar policy text ─────────────────────────────────────────────
+/**
+ * One policy, as `.cedar` text.
+ *
+ * Exported because the AVP embedding (#1652) needs exactly this string and
+ * nothing else — `AWS::VerifiedPermissions::Policy` carries its policy as
+ * `Definition.Static.Statement`, a single Cedar policy rather than a set. Two
+ * renderers would be two dialects; there is one.
+ *
+ * The head comes from `renderPolicyHead`, which the dogwood dialect's `.dw`
+ * leg also calls: three surfaces, one rendering of an annotation and a scope.
+ */
+export function renderPolicyText(id, props) {
+    const lines = renderPolicyHead(id, props);
+    for (const clause of conditionStrings(props.when)) {
+        lines.push(`when { ${clause} }`);
+    }
+    for (const clause of conditionStrings(props.unless)) {
+        lines.push(`unless { ${clause} }`);
+    }
+    return lines.join("\n") + ";";
+}
+/**
+ * Build the JSON companion from the emitted `.cedar` text.
+ *
+ * Two things fall out of going through the module rather than around it. The
+ * condition bodies become real expression trees, which is the whole reason the
+ * file is worth writing; and a policy carrying a `?principal`/`?resource` slot
+ * lands under `templates` rather than `staticPolicies`, because Cedar — not
+ * this serializer — is what decides which one it is.
+ *
+ * Ids come from each policy's own `@id`, not from the emission order, so the
+ * keys here cannot drift from the annotations in the text beside them.
+ */
+export function policySetJSON(text) {
+    const parts = splitPolicySet(text);
+    if (!parts.ok)
+        return { error: parts.error };
+    const doc = { staticPolicies: {}, templates: {}, templateLinks: [] };
+    const collect = (sources, convert, into, fallbackPrefix) => {
+        for (const [index, source] of sources.entries()) {
+            const converted = convert(source);
+            if (!converted.ok)
+                return converted.error;
+            const id = converted.value.annotations?.id;
+            into[typeof id === "string" && id.length > 0 ? id : `${fallbackPrefix}${index}`] = converted.value;
+        }
+        return undefined;
+    };
+    const policyError = collect(parts.value.policies, policyToJson, doc.staticPolicies, "policy");
+    if (policyError)
+        return { error: policyError };
+    const templateError = collect(parts.value.templates, templateToJson, doc.templates, "template");
+    if (templateError)
+        return { error: templateError };
+    return { doc };
+}
+/**
+ * Every `Cedar::Policy` in a build, with references walked and ids resolved.
+ *
+ * The serializer's own first pass, exported so the AVP embedding (#1652)
+ * renders from the same model rather than re-deriving it.
+ */
+export function cedarPolicyRecords(entities) {
+    // Reverse map first: walkValue resolves a Declarable reference by identity,
+    // so every entity has to be known before any of them is walked.
+    const entityNames = new Map();
+    for (const [name, entity] of entities) {
+        entityNames.set(entity, name);
+    }
+    const records = [];
+    for (const [name, entity] of entities) {
+        if (isPropertyDeclarable(entity))
+            continue;
+        if (entity.entityType !== CEDAR_POLICY_TYPE)
+            continue;
+        const props = walkValue(getProps(entity), entityNames, cedarVisitor);
+        records.push({ name, id: resolvePolicyId(name, props), props });
+    }
+    return records;
+}
+// ── Serializer ────────────────────────────────────────────────────
+export const cedarSerializer = {
+    name: "cedar",
+    rulePrefix: "CED",
+    // The dogwood temporal dialect ships inside this lexicon (epic #1646): a
+    // `.dw` file stripped of Cedar semantics is meaningless, so its checks are
+    // this serializer's, under their own published id family.
+    extraRulePrefixes: ["DWD"],
+    serialize(entities, _outputs) {
+        const policyText = [];
+        for (const { id, props } of cedarPolicyRecords(entities)) {
+            policyText.push(renderPolicyText(id, props));
+        }
+        // The dogwood dialect's own entities (#1658). Emitted from here rather
+        // than from a second serializer because they are one policy set with two
+        // halves — the `.dw` text and the `.cedar` text describe the same system,
+        // and a project holding only temporal policies still gets its files.
+        const dogwood = serializeDogwood(entities);
+        // The project schema, as a file beside the policies (#1697). This is what
+        // turns CEDE010's parse-only advisory into validation: `findSchema` in
+        // lint/post-synth/wasm-helpers.ts reads it straight back out of `files`.
+        const schemas = schemaEntities(entities);
+        if (policyText.length === 0 && !dogwood && schemas.length === 0)
+            return "";
+        const files = {};
+        const warnings = [...(dogwood?.warnings ?? [])];
+        for (const schema of schemas) {
+            if (files[schema.filename] !== undefined) {
+                warnings.push(`cedar: schema "${schema.name}" targets ${schema.filename}, which another schema already wrote; give one of them an explicit \`filename\``);
+                continue;
+            }
+            files[schema.filename] = schema.text;
+        }
+        let primary = "";
+        if (policyText.length > 0) {
+            primary = policyText.join("\n\n") + "\n";
+            const { doc, error } = policySetJSON(primary);
+            // A policy set Cedar cannot read is a real defect, but it is the lint and
+            // post-synth surface's to report (#1651) — the text is still the artifact
+            // every evaluator consumes, so it is emitted either way, with the module's
+            // own message carried out as a build warning rather than swallowed.
+            if (doc) {
+                files[CEDAR_JSON_FILENAME] = JSON.stringify(doc, null, 2) + "\n";
+            }
+            else {
+                warnings.push(`cedar: the emitted policy text did not parse, so ${CEDAR_JSON_FILENAME} was not written — ${error}`);
+            }
+        }
+        Object.assign(files, dogwood?.files ?? {});
+        return {
+            primary,
+            ...(Object.keys(files).length > 0 ? { files } : {}),
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
+    },
+};

package/dist/spec/fetch.js

@@ -0,0 +1,96 @@
+/**
+ * "Fetch" the Cedar schema — which for this lexicon means reading a file.
+ *
+ * Every other lexicon downloads one global upstream spec. Cedar's interesting
+ * spec is the *project's* schema (epic #1645), so there is nothing to fetch,
+ * nothing to cache, and no network at all. What replaces it is a small
+ * resolution order:
+ *
+ *   1. `cedar.schema` from the project's `chant.config.ts`
+ *   2. `schema.cedarschema` in the project root
+ *   3. the schema bundled at `./default-schema.cedarschema`
+ *
+ * Step 3 is the one that needs defending. Without it `generate()` has nothing
+ * to read in a checkout that has not written a schema yet — which is every
+ * fresh clone, `just check-lexicons`, and this lexicon's own examples — and a
+ * lexicon whose generate step only works after the user does something is a
+ * lexicon whose generate step is never gated. The default is a real
+ * application-authorization schema, not a stub, so the surface it produces is
+ * worth exercising.
+ *
+ * `requireProjectSchema` turns step 3 off for projects that have moved past it.
+ */
+import { existsSync, readFileSync } from "fs";
+import { isAbsolute, join, resolve } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { CEDAR_DEFAULT_SCHEMA_PATH } from "../config.js";
+/** Filename the bundled fallback schema ships under. */
+export const DEFAULT_SCHEMA_FILENAME = "default-schema.cedarschema";
+/** Map key used for the single schema entry, so `parseSchema` can tell them apart. */
+export const DEFAULT_SCHEMA_KEY = "<bundled-default>";
+let specDir;
+/**
+ * Directory this module lives in, resolved on first use.
+ *
+ * Kept lazy so importing the module never touches `import.meta.url`; edge
+ * bundles that pull this file in through the lint barrel have no such URL and
+ * would crash at module init otherwise.
+ */
+function resolveSpecDir() {
+    if (specDir !== undefined)
+        return specDir;
+    try {
+        specDir = moduleSourceDir(import.meta.url);
+    }
+    catch {
+        return undefined;
+    }
+    return specDir;
+}
+/** Absolute path to the schema bundled with this package. */
+export function defaultSchemaPath() {
+    const dir = resolveSpecDir();
+    if (dir === undefined) {
+        throw new Error("cedar: the bundled default schema is not reachable from this runtime (no module URL).");
+    }
+    return join(dir, DEFAULT_SCHEMA_FILENAME);
+}
+/**
+ * Resolve which schema `generate()` should read, without loading it.
+ *
+ * Separated from {@link fetchSchemas} so tests and `coverage()` can ask the
+ * question without reading the file.
+ */
+export function resolveSchemaPath(options = {}) {
+    const root = options.projectRoot ?? process.cwd();
+    const configured = options.config?.schema;
+    const candidates = configured
+        ? [isAbsolute(configured) ? configured : resolve(root, configured)]
+        : [resolve(root, CEDAR_DEFAULT_SCHEMA_PATH)];
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return { path: candidate, isDefault: false };
+    }
+    if (options.config?.validation?.requireProjectSchema) {
+        throw new Error(`cedar: no schema found at ${candidates.join(", ")}. ` +
+            "`cedar.validation.requireProjectSchema` is on, so the bundled default schema is not used.");
+    }
+    return { path: defaultSchemaPath(), isDefault: true };
+}
+/** Read the resolved schema. */
+export function readSchemaSource(options = {}) {
+    const { path, isDefault } = resolveSchemaPath(options);
+    return { path, text: readFileSync(path, "utf-8"), isDefault };
+}
+/**
+ * The `fetchSchemas` callback for `generatePipeline`.
+ *
+ * Keyed by `<bundled-default>` or by the project schema's absolute path, which
+ * is how `parseSchema` knows whether the content pin applies.
+ */
+export async function fetchSchemas(options) {
+    const source = readSchemaSource({ projectRoot: options?.projectRoot, config: options?.config });
+    return new Map([
+        [source.isDefault ? DEFAULT_SCHEMA_KEY : source.path, Buffer.from(source.text, "utf-8")],
+    ]);
+}

package/dist/spec/parse.js

@@ -0,0 +1,164 @@
+/**
+ * Turn a `.cedarschema` into the flat declaration list the emitters read.
+ *
+ * The canonical input is the human-readable syntax and the canonical
+ * intermediate is `schemaToJsonWithResolvedTypes`' output (#1648 §4). That
+ * choice buys one thing that matters here: `schemaToJson` emits
+ * `{type:"EntityOrCommon", name}` for every named type, which cannot
+ * distinguish an entity reference from a primitive from a common-type alias,
+ * so an emitter reading it would have to re-implement Cedar's own name
+ * resolution. The resolved form hands back `{type:"Entity", name:"App::User"}`
+ * for references and bare primitives for the rest.
+ *
+ * What it does *not* resolve is common types in attribute position: those come
+ * back as a bare qualified name (`{type:"App::TagSet"}`) with the definition
+ * still in `commonTypes`. {@link resolveTypeRef} closes that last hop, so
+ * nothing downstream ever sees an alias.
+ *
+ * One declaration per entity type and one per action, each carrying its own
+ * fully-qualified `typeName` — which is what lets `NamingStrategy` contest
+ * short names across namespaces the same way it does for every other lexicon.
+ */
+import { resolveSchema } from "./wasm.js";
+// ── Parsing ───────────────────────────────────────────────────────
+/**
+ * Parse a `.cedarschema` into declarations plus the resolved JSON it came from.
+ *
+ * Throws with the wasm's own message on a schema that does not parse — which
+ * is the right failure for a project schema that is malformed, and reads far
+ * better than the alternative, since Cedar's parse errors carry `did you mean`
+ * suggestions.
+ */
+export function parseCedarSchema(schemaText) {
+    const result = resolveSchema(schemaText);
+    if (!result.ok) {
+        throw new Error(`cedar: schema did not resolve — ${result.error}`);
+    }
+    const resolved = result.value;
+    const decls = [];
+    for (const namespace of Object.keys(resolved).sort()) {
+        decls.push(...declarationsFor(namespace, resolved[namespace]));
+    }
+    return { decls, resolved };
+}
+/**
+ * `parseSchema` for `generatePipeline`. One buffer in, many declarations out.
+ */
+export function parseSchema(_typeName, data) {
+    return parseCedarSchema(data.toString("utf-8")).decls;
+}
+function declarationsFor(namespace, body) {
+    if (!body)
+        return [];
+    const commonTypes = body.commonTypes ?? {};
+    const decls = [];
+    for (const shortName of Object.keys(body.entityTypes ?? {}).sort()) {
+        const entity = body.entityTypes[shortName];
+        const typeName = qualify(namespace, shortName);
+        const attributes = recordAttributes(entity.shape, commonTypes, namespace);
+        decls.push({
+            kind: "entity",
+            typeName,
+            namespace,
+            shortName,
+            memberOfTypes: [...(entity.memberOfTypes ?? [])].sort(),
+            attributes,
+            ...(entity.enum ? { enumValues: [...entity.enum] } : {}),
+            // One "property type" per entity: its attribute record. Nested anonymous
+            // records are inlined rather than named, so this stays 1:1.
+            propertyTypes: [{ name: `${shortName}_Attributes` }],
+            enums: entity.enum ? [entity.enum] : [],
+        });
+    }
+    for (const actionId of Object.keys(body.actions ?? {}).sort()) {
+        const action = body.actions[actionId];
+        const appliesTo = action.appliesTo ?? {};
+        decls.push({
+            kind: "action",
+            typeName: actionUid(namespace, actionId),
+            namespace,
+            actionId,
+            principalTypes: [...(appliesTo.principalTypes ?? [])].sort(),
+            resourceTypes: [...(appliesTo.resourceTypes ?? [])].sort(),
+            context: recordAttributes(appliesTo.context, commonTypes, namespace),
+            propertyTypes: [{ name: `${actionId}_Context` }],
+            enums: [],
+        });
+    }
+    return decls;
+}
+/** `App` + `User` → `App::User`; the empty namespace yields the bare name. */
+export function qualify(namespace, shortName) {
+    return namespace ? `${namespace}::${shortName}` : shortName;
+}
+/** The entity UID form an action is referenced by in a policy. */
+export function actionUid(namespace, actionId) {
+    return namespace ? `${namespace}::Action::"${actionId}"` : `Action::"${actionId}"`;
+}
+function recordAttributes(shape, commonTypes, namespace) {
+    if (!shape || shape.type !== "Record" || !shape.attributes)
+        return [];
+    return Object.keys(shape.attributes)
+        .sort()
+        .map((name) => {
+        const attr = shape.attributes[name];
+        return {
+            name,
+            // Cedar attributes are required unless the schema says otherwise, so
+            // `required` absent means required — the opposite of JSON Schema.
+            required: attr.required !== false,
+            type: resolveTypeRef(attr, commonTypes, namespace),
+        };
+    });
+}
+const PRIMITIVES = {
+    String: { cedar: "String", ts: "string" },
+    Long: { cedar: "Long", ts: "number" },
+    Bool: { cedar: "Bool", ts: "boolean" },
+};
+const EXTENSIONS = new Set(["ipaddr", "decimal", "datetime", "duration"]);
+/**
+ * Collapse one resolved type node, following common-type aliases.
+ *
+ * `seen` guards a schema whose common types reference each other — Cedar
+ * rejects true cycles, but a malformed one should not spin here.
+ */
+export function resolveTypeRef(node, commonTypes, namespace, seen = new Set()) {
+    const primitive = PRIMITIVES[node.type];
+    if (primitive)
+        return { kind: "primitive", ...primitive };
+    if (node.type === "Entity") {
+        return { kind: "entity", entityType: node.name ?? "" };
+    }
+    if (node.type === "Set") {
+        const element = node.element
+            ? resolveTypeRef(node.element, commonTypes, namespace, seen)
+            : { kind: "opaque", name: "Set" };
+        return { kind: "set", element };
+    }
+    if (node.type === "Record") {
+        const attributes = Object.keys(node.attributes ?? {})
+            .sort()
+            .map((name) => {
+            const attr = node.attributes[name];
+            return {
+                name,
+                required: attr.required !== false,
+                type: resolveTypeRef(attr, commonTypes, namespace, seen),
+            };
+        });
+        return { kind: "record", attributes };
+    }
+    if (EXTENSIONS.has(node.type)) {
+        return { kind: "extension", name: node.type };
+    }
+    // `EntityOrCommon` should not survive resolution, but a defensive branch
+    // costs nothing and keeps a future wasm version from emitting `unknown`.
+    const named = node.type === "EntityOrCommon" ? (node.name ?? "") : node.type;
+    const commonKey = named.startsWith(`${namespace}::`) ? named.slice(namespace.length + 2) : named;
+    const definition = commonTypes[commonKey];
+    if (definition && !seen.has(named)) {
+        return resolveTypeRef(definition, commonTypes, namespace, new Set([...seen, named]));
+    }
+    return { kind: "opaque", name: named };
+}

package/dist/spec/pin.js

@@ -0,0 +1,170 @@
+/**
+ * What this lexicon pins, and why it pins two different things (#1650, #1390).
+ *
+ * ## The version pin
+ *
+ * `@cedar-policy/cedar-wasm` and the Cedar *language* move independently: the
+ * package is 4.12.0, the grammar it implements is 4.5 (#1648 §0). A package
+ * bump that leaves the language at 4.5 cannot change what parses, so the
+ * language version is the value worth asserting at generation time and the
+ * package version is the one `upstreamPin` bumps. Both are recorded.
+ *
+ * The runtime assert is chant #1390's spirit applied to a dependency rather
+ * than to a downloaded spec: generation refuses when the installed package
+ * implements a different language version than the one whose resolved output
+ * produced the committed artifacts. Releases are roughly monthly, so this will
+ * fire — and when it does, the answer is to look at the new resolved JSON, not
+ * to publish types generated from a grammar nobody checked.
+ *
+ * ## The content pin
+ *
+ * The bundled default schema (`default-schema.cedarschema`) is what generation
+ * reads in this repo and in a fresh checkout, so it decides the published
+ * surface. There is no upstream URL to pin, so the pin is over content: a
+ * sha256 over the *resolved* JSON — the thing the emitters actually read —
+ * plus the covered entity-type and action names committed beside it.
+ *
+ * Resolved-JSON serialization is byte-deterministic (Rust `BTreeMap` ordering,
+ * 1 distinct serialization over 25 runs, #1648 §5.2), so the digest is stable.
+ * It moves when the default schema is edited, and — the case the pin exists for
+ * — when a cedar-wasm upgrade resolves the same schema differently. Both change
+ * the generated types, and neither is visible in a diff otherwise, because
+ * `src/generated/` is not committed.
+ *
+ * A user's own project schema is not pinned. It is their input, they own its
+ * churn, and refusing to generate because they edited their own schema would be
+ * absurd.
+ */
+import { createHash } from "crypto";
+import pinnedNames from "./pinned-names.json" with { type: "json" };
+import { langVersion } from "./wasm.js";
+/** The pinned `@cedar-policy/cedar-wasm` version — what `upstreamPin` bumps. */
+export const CEDAR_WASM_VERSION = "4.12.0";
+/** The Cedar *language* version that package implements (`getCedarLangVersion()`). */
+export const CEDAR_LANG_VERSION = "4.5";
+/** Env var that proceeds past a language-version mismatch for one run. */
+export const ACCEPT_LANG_ENV = "CHANT_ACCEPT_CEDAR_LANG";
+/** Env var that accepts a moved default-schema digest, printing the new pin. */
+export const ACCEPT_SCHEMA_ENV = "CHANT_ACCEPT_CEDAR_SCHEMA";
+/**
+ * The entity types and action UIDs the pinned default schema resolved to.
+ *
+ * Committed beside the digest for the same reason aws commits its type names:
+ * without the list, accepting a new pin is one opaque hash replacing another,
+ * and the generated artifacts cannot stand in because they are gitignored.
+ */
+export const PINNED_SCHEMA_NAMES = pinnedNames;
+/**
+ * The accepted default schema.
+ *
+ * To move it: run generation, read the refusal, confirm the delta is one you
+ * want, and paste the printed block here in its own commit.
+ */
+export const CEDAR_SCHEMA_PIN = {
+    digest: "sha256:8f86a4e4fd6845c245c84d226277741c41d29da6a173f01477bda3a662dd3ec9",
+    declarations: 16,
+    accepted: "2026-08-10",
+};
+/**
+ * Digest the resolved schema JSON.
+ *
+ * Hashes the canonical serialization the wasm produced, not the authored
+ * `.cedarschema` text: reformatting a schema, or reordering its entity types,
+ * changes the text and not one byte of what the emitters read.
+ */
+export function resolvedSchemaDigest(resolved) {
+    return `sha256:${createHash("sha256").update(JSON.stringify(resolved)).digest("hex")}`;
+}
+/** Compare a freshly resolved schema against a pin. `null` when it matches. */
+export function schemaDrift(resolved, names, pinnedNamesList = PINNED_SCHEMA_NAMES, pin = CEDAR_SCHEMA_PIN) {
+    const digest = resolvedSchemaDigest(resolved);
+    if (digest === pin.digest)
+        return null;
+    const current = new Set(names);
+    const pinned = new Set(pinnedNamesList);
+    return {
+        digest,
+        declarations: current.size,
+        added: [...current].filter((n) => !pinned.has(n)).sort(),
+        removed: [...pinned].filter((n) => !current.has(n)).sort(),
+    };
+}
+/** The report a mismatch produces. */
+export function schemaDriftMessage(drift, pin = CEDAR_SCHEMA_PIN) {
+    const delta = drift.declarations - pin.declarations;
+    const countLine = delta === 0
+        ? `${drift.declarations} declarations, unchanged in count`
+        : `${drift.declarations} declarations, ${delta > 0 ? "+" : ""}${delta} against the pin`;
+    const lines = [
+        "The bundled default Cedar schema no longer resolves to the pinned JSON.",
+        "",
+        `  pinned    ${pin.digest}  (${pin.declarations} declarations, accepted ${pin.accepted})`,
+        `  resolved  ${drift.digest}  (${countLine})`,
+    ];
+    if (drift.added.length > 0) {
+        lines.push(`  added     ${summarize(drift.added)}`);
+    }
+    if (drift.removed.length > 0) {
+        lines.push(`  removed   ${summarize(drift.removed)}`);
+    }
+    lines.push("", "Either the schema was edited or cedar-wasm resolves it differently than", "the version the committed surface was generated from. Both rewrite the", "generated types, and src/generated/ is not committed, so neither shows up", "in a diff on its own.", "", "Confirm the delta is one you want and update lexicons/cedar/src/spec/pin.ts", "and pinned-names.json, in their own commit:", "", `  digest: "${drift.digest}",`, `  declarations: ${drift.declarations},`, `  accepted: "<today>",`, "", `Or re-run with ${ACCEPT_SCHEMA_ENV}=1 to proceed this once and print the same block.`);
+    return lines.join("\n");
+}
+function summarize(names) {
+    return `${names.slice(0, 5).join(", ")}${names.length > 5 ? ` (+${names.length - 5} more)` : ""}`;
+}
+/**
+ * Refuse a default schema whose resolved JSON does not match the pin.
+ *
+ * Unlike aws, this one refuses on any digest move rather than only on a
+ * declaration-set change. It can afford to: the input is a file in this repo
+ * and a dependency at a pinned version, neither of which changes under the
+ * build's feet the way a republished CloudFormation archive does.
+ */
+export function assertPinnedSchema(resolved, names, options = {}) {
+    const pin = options.pin ?? CEDAR_SCHEMA_PIN;
+    const drift = schemaDrift(resolved, names, options.pinnedNames ?? PINNED_SCHEMA_NAMES, pin);
+    if (!drift)
+        return;
+    const env = options.env ?? process.env;
+    const warn = options.warn ?? ((m) => console.error(m));
+    const message = schemaDriftMessage(drift, pin);
+    if (env[ACCEPT_SCHEMA_ENV]) {
+        warn(message);
+        return;
+    }
+    throw new Error(message);
+}
+/**
+ * Refuse to generate against a Cedar language version other than the pinned one.
+ *
+ * chant #1390's rule, one level up the supply chain: a lexicon does not emit
+ * types derived from a grammar nobody chose. `getCedarLangVersion()` is the
+ * right probe because it is the number that decides what parses — the package
+ * version moves monthly and mostly does not.
+ */
+export function assertPinnedLangVersion(options = {}) {
+    const expected = options.expected ?? CEDAR_LANG_VERSION;
+    const actual = options.actual ?? langVersion();
+    if (actual === expected)
+        return;
+    const message = [
+        `Cedar language version mismatch: cedar-wasm reports ${actual}, this lexicon pins ${expected}.`,
+        "",
+        "The installed @cedar-policy/cedar-wasm implements a different grammar than",
+        "the one the generated entity and action types were derived from. Generation",
+        "refuses rather than emitting a surface nobody reviewed.",
+        "",
+        "To accept it: check the resolved schema JSON for shape changes, update",
+        `CEDAR_LANG_VERSION (and CEDAR_WASM_VERSION) in lexicons/cedar/src/spec/pin.ts,`,
+        "and refresh the schema pin in the same commit.",
+        "",
+        `Or re-run with ${ACCEPT_LANG_ENV}=1 to proceed this once.`,
+    ].join("\n");
+    const env = options.env ?? process.env;
+    if (env[ACCEPT_LANG_ENV]) {
+        (options.warn ?? ((m) => console.error(m)))(message);
+        return;
+    }
+    throw new Error(message);
+}