@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/spec/wasm.js

@@ -0,0 +1,194 @@
+/**
+ * The one place `@cedar-policy/cedar-wasm` is called from.
+ *
+ * Three findings from the 4.12.0 verification (#1648) are encoded here rather
+ * than left to each caller to remember:
+ *
+ * 1. **Only the `/nodejs` flavor.** The root ESM build imports the `.wasm` as
+ *    an ES module, which Bun cannot start (`wasm.__wbindgen_start is not a
+ *    function`) and Node only supports behind an experimental warning printed
+ *    on every run. `/nodejs` loads the binary with `readFileSync` and works
+ *    under node CJS, node ESM, vitest and bun alike.
+ *
+ * 2. **`schemaToJsonWithResolvedTypes` takes a string and means it.** A JS
+ *    object traps the wasm with `memory access out of bounds` — not a failure
+ *    answer, a memory fault. The `typeof === "string"` guard below is the
+ *    difference between a readable error and a trap.
+ *
+ * 3. **The `Answer` union is not the whole error channel.** Malformed input
+ *    throws a bare serde `Error` from inside the wasm instead of returning
+ *    `{type:"failure"}`, and the `line 1 column N` in those messages refers to
+ *    the internal call struct, not to anything the user wrote. Both channels
+ *    are normalized into one result type here.
+ */
+import { createRequire } from "module";
+/**
+ * Loaded on first use, not at import.
+ *
+ * The wasm binary is 4.2 MB and costs ~13 MB RSS to instantiate. Importing
+ * this package is something a user's `chant.config.ts` does purely to bring
+ * the `cedar` key into `ChantConfig`, and every `chant build` in a project
+ * with a policy set loads the serializer — neither touches the validator. A
+ * top-level import would charge all of them for it.
+ */
+let wasm;
+function cedar() {
+    if (!wasm) {
+        // `require`, not `import()`: the `/nodejs` flavor is CommonJS, and this
+        // keeps the call sites synchronous, which is what every consumer here
+        // wants. See the flavor note above for why the root ESM build is not an
+        // option.
+        wasm = createRequire(import.meta.url)("@cedar-policy/cedar-wasm/nodejs");
+    }
+    return wasm;
+}
+/** The Cedar *language* version this build of the package implements. */
+export function langVersion() {
+    return cedar().getCedarLangVersion();
+}
+/** The `@cedar-policy/cedar-wasm` package version. */
+export function packageVersion() {
+    return cedar().getCedarVersion();
+}
+/**
+ * Resolve a human-readable `.cedarschema` into fully-qualified schema JSON.
+ *
+ * Returns a result rather than throwing so a bad project schema reads as a
+ * message about the project schema, not as a stack trace out of a wasm module.
+ */
+export function resolveSchema(schemaText) {
+    if (typeof schemaText !== "string") {
+        // Guarded, not attempted: a non-string traps the instance rather than
+        // returning a failure answer (#1648 §5.4).
+        return {
+            ok: false,
+            error: `schemaToJsonWithResolvedTypes takes the human-readable schema as a string; got ${typeof schemaText}`,
+        };
+    }
+    let answer;
+    try {
+        answer = cedar().schemaToJsonWithResolvedTypes(schemaText);
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+    if (!answer || typeof answer !== "object") {
+        return { ok: false, error: "cedar-wasm returned no answer" };
+    }
+    const record = answer;
+    if (record.type !== "success") {
+        return { ok: false, error: formatWasmErrors(record.errors) };
+    }
+    if (!record.json || typeof record.json !== "object") {
+        return { ok: false, error: "cedar-wasm reported success with no schema JSON" };
+    }
+    return { ok: true, value: record.json };
+}
+/**
+ * Run one wasm call and collapse both of its error channels into a result.
+ *
+ * The `Answer` union is not the whole error channel — malformed input throws a
+ * bare serde `Error` from inside the module, and the `line 1 column N` those
+ * messages carry points at the internal call struct rather than at anything
+ * the user wrote (#1648 §5.3). Both land here as `{ ok: false }`.
+ */
+function wasmCall(what, run, extract) {
+    let answer;
+    try {
+        answer = run();
+    }
+    catch (err) {
+        return { ok: false, error: `${what}: ${err instanceof Error ? err.message : String(err)}` };
+    }
+    if (!answer || typeof answer !== "object") {
+        return { ok: false, error: `${what}: cedar-wasm returned no answer` };
+    }
+    const record = answer;
+    if (record.type !== "success") {
+        return { ok: false, error: formatWasmErrors(record.errors) };
+    }
+    const value = extract(answer);
+    if (value === undefined) {
+        return { ok: false, error: `${what}: cedar-wasm reported success with no result` };
+    }
+    return { ok: true, value };
+}
+/**
+ * Split a `.cedar` document into its policies and its templates.
+ *
+ * The strings that come back are the **verbatim source** of each policy —
+ * annotations, line breaks and all — in source order, which is what lets the
+ * importer recover a condition body exactly as it was written rather than as
+ * the JSON leg would re-render it. Comments are dropped: they are not part of
+ * any grammar the module round-trips.
+ */
+export function splitPolicySet(text) {
+    if (typeof text !== "string") {
+        return { ok: false, error: `policySetTextToParts takes policy text as a string; got ${typeof text}` };
+    }
+    return wasmCall("policySetTextToParts", () => cedar().policySetTextToParts(text), (answer) => {
+        const { policies, policy_templates: templates } = answer;
+        if (!Array.isArray(policies) || !Array.isArray(templates))
+            return undefined;
+        return { policies: policies, templates: templates };
+    });
+}
+/** Convert one *static* policy (text or JSON) into Cedar's JSON policy format. */
+export function policyToJson(policy) {
+    return wasmCall("policyToJson", () => cedar().policyToJson(policy), (answer) => answer.json);
+}
+/**
+ * Convert one *template* (text or JSON) into Cedar's JSON policy format.
+ *
+ * A policy carrying `?principal`/`?resource` is a template, and `policyToJson`
+ * refuses it outright ("expected a static policy, got a template containing
+ * the slot ?resource") — the two entry points are not interchangeable.
+ */
+export function templateToJson(template) {
+    return wasmCall("templateToJson", () => cedar().templateToJson(template), (answer) => answer.json);
+}
+/**
+ * Render one policy's JSON back to Cedar text.
+ *
+ * Only ever used to recover an *expression* body that has no source text to
+ * quote — an imported JSON policy set. The output is single-line and defensively
+ * parenthesized (`((context.mfa) == true)`), and `formatPolicies` does not undo
+ * that, so it is never the source of a human-facing `.cedar` artifact: those are
+ * laid out by the serializer.
+ */
+export function policyToText(policy) {
+    return wasmCall("policyToText", () => cedar().policyToText(policy), (answer) => answer.text);
+}
+/**
+ * Does this value parse as a Cedar policy set?
+ *
+ * `checkParsePolicySet` throws — rather than answering `failure` — for a
+ * document carrying keys it does not know, which is precisely the shape a
+ * foreign lexicon's JSON has, so the throw is a match rejection here.
+ */
+export function parsesAsPolicySet(value) {
+    try {
+        return cedar().checkParsePolicySet(value).type === "success";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Flatten a `DetailedError[]` into one line.
+ *
+ * `code`, `url` and `severity` are `null` on every error this package emits
+ * (#1648 §5.6), so only `message` and `help` carry anything.
+ */
+export function formatWasmErrors(errors) {
+    if (!Array.isArray(errors) || errors.length === 0)
+        return "cedar-wasm reported a failure with no detail";
+    return errors
+        .map((e) => {
+        if (typeof e === "string")
+            return e;
+        const detail = e;
+        return detail.help ? `${detail.message} (${detail.help})` : String(detail.message ?? e);
+    })
+        .join("; ");
+}

package/dist/validate-cli.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+import { validate } from "./validate.js";
+import { printValidationResult } from "@intentius/chant/codegen/validate";
+// `validate` returns a result; printing it is what turns a failed check into a
+// non-zero exit. The scaffold called it and discarded the answer, so a missing
+// registry exited 0.
+printValidationResult(await validate());

package/dist/validate.js

@@ -0,0 +1,74 @@
+/**
+ * Validate the generated lexicon-cedar artifacts.
+ *
+ * The required-name list below is the surface this package publishes when it
+ * generates from its own bundled default schema, which is what `prepack`,
+ * `just check-lexicons` and CI all do. It is not a claim about a user's
+ * project schema — theirs produces their own names, and `coverage()` is the
+ * check that answers whether their schema is fully reachable.
+ *
+ * Listing them explicitly is the point: `src/generated/` is gitignored, so
+ * without this list nothing in the repository records what the default schema
+ * is supposed to produce, and a codegen change that quietly dropped every
+ * action would still pass "the registry parses".
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+/**
+ * Names the default schema must produce: the policy authoring class, one class
+ * per entity type, one per action, and the record type beside each.
+ */
+const REQUIRED_NAMES = [
+    // The authoring surface, present regardless of schema.
+    "Policy",
+    // Entity types.
+    "Application",
+    "Document",
+    "Folder",
+    "Group",
+    "ServiceAccount",
+    "Team",
+    "User",
+    // Entity attribute records.
+    "ApplicationAttributes",
+    "DocumentAttributes",
+    "FolderAttributes",
+    "GroupAttributes",
+    "ServiceAccountAttributes",
+    "TeamAttributes",
+    "UserAttributes",
+    // Actions.
+    "AdminAction",
+    "ApproveAction",
+    "CommentAction",
+    "CreateAction",
+    "DeleteAction",
+    "ListAction",
+    "ReadAction",
+    "ShareAction",
+    "WriteAction",
+    // Action context records.
+    "AdminContext",
+    "ApproveContext",
+    "CommentContext",
+    "CreateContext",
+    "DeleteContext",
+    "ListContext",
+    "ReadContext",
+    "ShareContext",
+    "WriteContext",
+];
+/** Exposed so tests can assert the list stays above the tier-3 bar. */
+export const requiredNames = REQUIRED_NAMES;
+/**
+ * Validate the generated lexicon-cedar artifacts.
+ */
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-cedar.json",
+        requiredNames: REQUIRED_NAMES,
+        basePath,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-cedar",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "description": "Cedar lexicon for chant — typed authoring for Cedar authorization policies",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -33,22 +33,22 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./op/activities": {
       "development": "./src/op/activities/index.ts",
       "types": "./dist/op/activities/index.d.ts",
-      "default": "./src/op/activities/index.ts"
+      "default": "./dist/op/activities/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -62,7 +62,7 @@
     "docs:dev": "cd docs && npm run dev",
     "docs:build": "cd docs && npm install && npm run build",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
     "@cedar-policy/cedar-wasm": "4.12.0"
@@ -74,6 +74,6 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.30"
+    "@intentius/chant": "^0.124.32"
   }
 }

package/src/codegen/package.ts

@@ -5,7 +5,7 @@
 import { cedarPlugin } from "../plugin";
 import { readFileSync } from "fs";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import {
   collectSkills,
   packagePipeline,
@@ -16,7 +16,7 @@ import { generate } from "./generate";
 
 export type { PackageOptions, PackageResult };
 
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Package the Cedar lexicon into a distributable BundleSpec.

package/src/coverage.ts

@@ -15,7 +15,7 @@
 
 import { existsSync, readFileSync } from "fs";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { LEXICON_JSON_FILENAME } from "./codegen/generate";
 import { attributesTypeName, contextTypeName } from "./codegen/emit";
 import { readSchemaSource, type ResolveSchemaOptions } from "./spec/fetch";
@@ -60,7 +60,7 @@ export interface CedarCoverageOptions extends ResolveSchemaOptions {
 }
 
 function defaultGeneratedDir(): string {
-  return join(dirname(fileURLToPath(import.meta.url)), "generated");
+  return join(moduleSourceDir(import.meta.url), "generated");
 }
 
 function pct(covered: number, total: number): number {

package/src/import/generator.ts

@@ -15,7 +15,7 @@
 
 import { existsSync, readFileSync } from "fs";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import type { CedarPolicyIR } from "./parser";
 
 /** The package this generated source imports from. */
@@ -199,7 +199,7 @@ interface RegistryEntry {
  * `Policy` class accepts and the compiler still checks.
  */
 export function loadActionConstants(packageDir?: string): Record<string, string> {
-  const base = packageDir ?? dirname(dirname(fileURLToPath(import.meta.url)));
+  const base = packageDir ?? dirname(moduleSourceDir(import.meta.url));
   const path = join(base, "generated", REGISTRY_FILE);
   if (!existsSync(path)) return {};
 

package/src/lsp/registry.ts

@@ -16,10 +16,11 @@
  */
 
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import { LexiconIndex, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
 import { LEXICON_JSON_FILENAME } from "../codegen/generate";
 
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 /** One `lexicon-cedar.json` entry, as {@link generateRegistry} writes it. */
 export interface CedarRegistryEntry {

package/src/spec/fetch.ts

@@ -23,7 +23,7 @@
 
 import { existsSync, readFileSync } from "fs";
 import { dirname, isAbsolute, join, resolve } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { CEDAR_DEFAULT_SCHEMA_PATH } from "../config";
 
 /** Filename the bundled fallback schema ships under. */
@@ -44,7 +44,7 @@ let specDir: string | undefined;
 function resolveSpecDir(): string | undefined {
   if (specDir !== undefined) return specDir;
   try {
-    specDir = dirname(fileURLToPath(import.meta.url));
+    specDir = moduleSourceDir(import.meta.url);
   } catch {
     return undefined;
   }