@intentius/chant-lexicon-cedar 0.124.30 → 0.124.32

package/dist/codegen/naming.js

@@ -0,0 +1,90 @@
+import { NamingStrategy } from "@intentius/chant/codegen/naming";
+/**
+ * The name of the policy resource every generated bundle carries.
+ *
+ * It is not schema-derived — a Cedar schema declares entity types and actions,
+ * never policies — so it is claimed as a priority name before any schema type
+ * gets to contest a short name. A project whose schema declares its own
+ * `Policy` entity type therefore gets `AppPolicy` (or whatever its namespace
+ * is), and the authoring class keeps the name users import.
+ */
+export const POLICY_TS_NAME = "Policy";
+/** The `entityType` of the policy resource, matching the serializer. */
+export const POLICY_TYPE = "Cedar::Policy";
+/** `read` → `Read`; `service-account` → `ServiceAccount`. */
+export function pascalCase(value) {
+    return value
+        .split(/[^a-zA-Z0-9]+/)
+        .filter(Boolean)
+        .map((part) => part[0].toUpperCase() + part.slice(1))
+        .join("");
+}
+/** Split `App::Action::"read"` into its action id, or null for a non-action. */
+export function actionIdOf(typeName) {
+    const match = /(?:^|::)Action::"(.*)"$/.exec(typeName);
+    return match ? match[1] : null;
+}
+/**
+ * Naming configuration for the cedar lexicon.
+ *
+ * Two shapes go through this rather than one: `App::User` (an entity type) and
+ * `App::Action::"read"` (an action). Both are entities in Cedar's model, so
+ * both are contested in the same pool — a schema with an entity type called
+ * `Read` and an action called `read` collides, and phase 4 qualifies the loser
+ * with its namespace rather than one silently overwriting the other.
+ */
+export const namingConfig = {
+    priorityNames: {
+        [POLICY_TYPE]: POLICY_TS_NAME,
+    },
+    priorityAliases: {},
+    priorityPropertyAliases: {},
+    serviceAbbreviations: {},
+    /**
+     * Actions get an `Action` suffix. Without it `read`/`write`/`delete` become
+     * `Read`/`Write`/`Delete`, which read as entity types at the import site and
+     * collide with them in schemas that have both.
+     */
+    shortName: (typeName) => {
+        const actionId = actionIdOf(typeName);
+        if (actionId !== null)
+            return `${pascalCase(actionId)}Action`;
+        return pascalCase(typeName.split("::").pop() ?? typeName);
+    },
+    /** The namespace — `App::User` → `App`, and the empty namespace → `Cedar`. */
+    serviceName: (typeName) => {
+        const segments = typeName.split("::");
+        return segments.length > 1 ? segments[0] : "Cedar";
+    },
+};
+/**
+ * Create a NamingStrategy instance from parsed results.
+ *
+ * `Cedar::Policy` is injected as an input because it has to be *in* the contest
+ * to win it: `priorityNames` is applied over the input type names, so a policy
+ * type that never appears there cannot claim `Policy` before a schema's own
+ * `Policy` entity type takes it in the short-name phase.
+ */
+export function createNaming(inputs) {
+    return new NamingStrategy([{ typeName: POLICY_TYPE, propertyTypes: [] }, ...inputs], namingConfig);
+}
+/**
+ * The names derived from a primary name — the entity's attribute record and
+ * the action's context record.
+ *
+ * These are not contested by `NamingStrategy` (it only names the primary
+ * declarations), so they are de-duplicated against everything already taken.
+ * The suffix loop is deliberately boring: a schema that manages to collide
+ * `UserAttributes` twice gets `UserAttributes2`, which is ugly and correct,
+ * rather than one entry silently overwriting the other in the registry.
+ */
+export function deriveName(base, suffix, taken) {
+    let candidate = `${base}${suffix}`;
+    let n = 2;
+    while (taken.has(candidate)) {
+        candidate = `${base}${suffix}${n}`;
+        n++;
+    }
+    taken.add(candidate);
+    return candidate;
+}

package/dist/codegen/package.js

@@ -0,0 +1,33 @@
+/**
+ * Cedar lexicon packaging — delegates to core's packagePipeline.
+ */
+import { cedarPlugin } from "../plugin.js";
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { collectSkills, packagePipeline, } from "@intentius/chant/codegen/package";
+import { generate } from "./generate.js";
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
+/**
+ * Package the Cedar lexicon into a distributable BundleSpec.
+ */
+export async function packageLexicon(opts = {}) {
+    const pkgJson = JSON.parse(readFileSync(join(pkgDir, "..", "package.json"), "utf-8"));
+    return packagePipeline({
+        // Codegen reads this package's own directory as the project root, so
+        // bundling produces the default-schema surface no matter where the
+        // command is run from (#1650).
+        generate: (genOpts) => generate({ ...genOpts, projectRoot: pkgDir }),
+        buildManifest: () => ({
+            name: "cedar",
+            version: pkgJson.version ?? "0.0.0",
+            chantVersion: ">=0.1.0",
+            namespace: "Cedar",
+            intrinsics: [],
+            pseudoParameters: {},
+        }),
+        srcDir: pkgDir,
+        collectSkills: () => collectSkills(cedarPlugin.skills?.() ?? []),
+        version: pkgJson.version ?? "0.0.0",
+    }, opts);
+}

package/dist/commands.js

@@ -0,0 +1,86 @@
+/**
+ * `chant cedar <verb>` — the consumer-facing surface over this lexicon's
+ * codegen (#1696), mounted through the command-group seam (#1078).
+ *
+ * `chant dev generate` exists, but it is lexicon development: it runs every
+ * configured lexicon's generate, validate and coverage in turn, and for a
+ * project that also lists `aws` that means fetching the CloudFormation spec.
+ * A consumer regenerating its own Cedar classes after a schema edit wants one
+ * lexicon, one step, and an output path it can see.
+ */
+import { splitJoinedFlags, unknownFlagError } from "@intentius/chant/cli/command-group";
+function parseFlags(verb, raw, accept) {
+    const args = splitJoinedFlags(raw, new Set(["--verbose", "-v"]));
+    const flags = { verbose: false };
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if ((a === "--verbose" || a === "-v") && accept.has("--verbose")) {
+            flags.verbose = true;
+        }
+        else if (a === "--out-dir" && accept.has("--out-dir")) {
+            const value = args[++i];
+            if (!value)
+                throw new Error(`--out-dir needs a directory.`);
+            flags.outDir = value;
+        }
+        else if (a === "--min-overall" && accept.has("--min-overall")) {
+            const value = Number(args[++i]);
+            if (!Number.isFinite(value))
+                throw new Error(`--min-overall needs a number.`);
+            flags.minOverall = value;
+        }
+        else {
+            const hint = `"chant cedar ${verb}" accepts ${[...accept].join(", ")}.`;
+            throw unknownFlagError(a, hint);
+        }
+    }
+    return flags;
+}
+async function generateHandler(ctx) {
+    const flags = parseFlags("generate", ctx.rawArgs, new Set(["--out-dir", "--verbose"]));
+    const { generate, resolveGeneratedDir, writeGeneratedFiles } = await import("./codegen/generate.js");
+    const { loadCedarProject } = await import("./config.js");
+    const project = await loadCedarProject(process.cwd());
+    // A flag beats the config, and both beat the default — the same order
+    // `cedar.schema` follows one level down.
+    const config = flags.outDir ? { ...project.config, outDir: flags.outDir } : project.config;
+    const result = await generate({ verbose: flags.verbose, projectRoot: project.projectRoot, config });
+    const outDir = resolveGeneratedDir({ projectRoot: project.projectRoot, config });
+    writeGeneratedFiles(result, outDir);
+    console.error(`cedar: generated ${result.resources} declaration(s) into ${outDir}`);
+    return 0;
+}
+async function coverageHandler(ctx) {
+    const flags = parseFlags("coverage", ctx.rawArgs, new Set(["--min-overall", "--verbose"]));
+    const { analyzeCedarCoverage } = await import("./coverage.js");
+    const { resolveGeneratedDir } = await import("./codegen/generate.js");
+    const { loadCedarProject } = await import("./config.js");
+    const { projectRoot, config } = await loadCedarProject(process.cwd());
+    analyzeCedarCoverage({
+        projectRoot,
+        config,
+        generatedDir: resolveGeneratedDir({ projectRoot, config }),
+        verbose: flags.verbose,
+        minOverall: flags.minOverall,
+    });
+    return 0;
+}
+/** The `chant cedar` verb group. */
+export function cedarCommandGroup() {
+    return {
+        name: "cedar",
+        description: "Schema-driven codegen for a project's Cedar policies: generate typed classes into the project, check schema coverage",
+        commands: [
+            {
+                name: "generate",
+                description: "Read the project's .cedarschema and write typed classes into cedar.outDir (default src/generated/cedar)",
+                handler: generateHandler,
+            },
+            {
+                name: "coverage",
+                description: "Report which schema declarations the generated classes cover",
+                handler: coverageHandler,
+            },
+        ],
+    };
+}

package/dist/composites/deny-by-default-set.js

@@ -0,0 +1,51 @@
+/**
+ * DenyByDefaultSet — a forbid floor under a group of permits.
+ *
+ * Cedar is already default-deny, so a floor is not about the absence of a
+ * permit; it is about the presence of a bad one. A `forbid` beats every
+ * `permit` in the same set unconditionally, which makes a forbid the only
+ * construct that survives a later, wider grant. The pattern teams write by hand
+ * is a guarded forbid at the top of a file and a pile of permits under it, with
+ * nothing tying the two together — delete the forbid and the permits keep
+ * working, wider than anyone intended.
+ *
+ * This composite returns both halves from one call, so the floor cannot be
+ * dropped without dropping the members with it.
+ */
+import { Policy } from "../generated/index.js";
+function scope(value) {
+    if (value === undefined)
+        return {};
+    return typeof value === "string" ? { is: value } : value;
+}
+function actionScope(actions) {
+    if (actions === undefined)
+        return {};
+    if (Array.isArray(actions)) {
+        return actions.length === 1 ? { eq: actions[0] } : { in: actions };
+    }
+    return { eq: actions };
+}
+/**
+ * A guarded `forbid` plus the permits it governs.
+ */
+export function DenyByDefaultSet(opts) {
+    if (opts.when.length === 0) {
+        throw new Error("DenyByDefaultSet: `when` must carry at least one condition. An unguarded forbid " +
+            "overrides every permit in the set, so the result would authorize nothing.");
+    }
+    const floor = new Policy({
+        effect: "forbid",
+        principal: scope(opts.principal),
+        action: actionScope(opts.actions),
+        resource: scope(opts.entityType),
+        when: opts.when,
+        ...(opts.unless && opts.unless.length > 0 ? { unless: opts.unless } : {}),
+        annotations: {
+            composite: "DenyByDefaultSet",
+            members: String(opts.policies.length),
+            ...(opts.annotations ?? {}),
+        },
+    });
+    return { floor, members: [...opts.policies], all: [floor, ...opts.policies] };
+}

package/dist/composites/index.js

@@ -0,0 +1,9 @@
+/**
+ * Cedar lexicon composites.
+ *
+ * Cedar has no functions, no modules, no loops, and templates with exactly two
+ * slots — so every repeated policy shape is copy-paste in `.cedar` text. These
+ * factories are where that repetition goes instead.
+ */
+export { OwnerCanManage } from "./owner-can-manage.js";
+export { DenyByDefaultSet } from "./deny-by-default-set.js";

package/dist/composites/owner-can-manage.js

@@ -0,0 +1,48 @@
+/**
+ * OwnerCanManage — the ownership grant, written once.
+ *
+ * "The owner of a thing may act on it" is the most-repeated shape in every
+ * Cedar policy set, and hand-writing it per entity type is where the two
+ * classic mistakes get made: the `when` guard names an attribute the schema
+ * spells differently, or the grant is written wide and the scoping clause is
+ * forgotten. Cedar itself cannot help — it has no functions, no modules, and
+ * templates carry exactly two slots. A TypeScript factory is the only place
+ * this abstraction can live.
+ *
+ * The composite emits a permit whose resource scope is pinned with `is` and
+ * whose ownership test is a `when` clause, so both halves arrive together or
+ * neither does.
+ */
+import { Policy } from "../generated/index.js";
+function actionScope(actions) {
+    if (actions === undefined)
+        return {};
+    if (Array.isArray(actions)) {
+        return actions.length === 1 ? { eq: actions[0] } : { in: actions };
+    }
+    return { eq: actions };
+}
+function principalScope(principal) {
+    if (principal === undefined)
+        return {};
+    return typeof principal === "string" ? { is: principal } : principal;
+}
+/**
+ * One permit: the owner of an `entityType` may take `actions` on it.
+ */
+export function OwnerCanManage(opts) {
+    const ownerAttribute = opts.ownerAttribute ?? "owner";
+    return new Policy({
+        effect: "permit",
+        principal: principalScope(opts.principal),
+        action: actionScope(opts.actions),
+        resource: { is: opts.entityType },
+        when: [`resource.${ownerAttribute} == principal`, ...(opts.when ?? [])],
+        ...(opts.unless && opts.unless.length > 0 ? { unless: opts.unless } : {}),
+        annotations: {
+            composite: "OwnerCanManage",
+            scopedTo: opts.entityType,
+            ...(opts.annotations ?? {}),
+        },
+    });
+}

package/dist/config.js

@@ -0,0 +1,159 @@
+/**
+ * The `cedar` namespace in `chant.config.ts` (#1344, #1650).
+ *
+ * ```ts
+ * import type { ChantConfig } from "@intentius/chant/config";
+ * import "@intentius/chant-lexicon-cedar";   // brings the `cedar` key into ChantConfig
+ *
+ * export default {
+ *   lexicons: ["cedar"],
+ *   cedar: {
+ *     schema: "authz/app.cedarschema",
+ *     validation: { mode: "strict", warnings: "warn" },
+ *   },
+ * } satisfies ChantConfig;
+ * ```
+ *
+ * Cedar is the one lexicon whose codegen input is the *project's* file rather
+ * than a global upstream (epic #1645), so this namespace is not a convenience —
+ * it is where `generate()` is told what to read. A typo in the path is the
+ * difference between "your entity types" and "the bundled default schema",
+ * which is exactly the kind of silent fallback `z.strictObject` exists to stop
+ * one level down.
+ */
+import { z } from "zod";
+/**
+ * Where `generate()` looks when `cedar.schema` is unset.
+ *
+ * Relative to the project root (the directory holding `chant.config.ts`).
+ */
+export const CEDAR_DEFAULT_SCHEMA_PATH = "schema.cedarschema";
+/**
+ * Where `generate()` writes when `cedar.outDir` is unset and the project is a
+ * consumer of the published package (#1696).
+ *
+ * Relative to the project root. Inside this lexicon's own checkout the
+ * package directory *is* the project root, and the output stays at
+ * `src/generated/` so `src/index.ts` can re-export it; see
+ * `resolveGeneratedDir` in `codegen/generate.ts`.
+ */
+export const CEDAR_DEFAULT_OUT_DIR = "src/generated/cedar";
+/**
+ * `strictObject`, not `object`. Core applies `.strict()` to the top level of a
+ * declared namespace itself; `validation` is nested, and is the lexicon's own
+ * to close.
+ */
+export const cedarConfigSchema = z.strictObject({
+    /**
+     * Path to the project's human-readable Cedar schema, relative to the project
+     * root. Defaults to {@link CEDAR_DEFAULT_SCHEMA_PATH}; when neither the
+     * configured path nor the default exists, generation falls back to the
+     * schema bundled at `src/spec/default-schema.cedarschema` so a fresh
+     * checkout still produces artifacts.
+     */
+    schema: z.string().optional(),
+    /**
+     * Directory `generate()` writes the typed classes into, relative to the
+     * project root. Defaults to {@link CEDAR_DEFAULT_OUT_DIR}.
+     *
+     * The output used to land in the installed package's own `src/generated/`,
+     * which `npm ci` wipes (#1696). It is the project's artifact — the classes
+     * describe the project's schema, not the package's — so it lives in the
+     * project tree, and `src/policies.ts` imports from it rather than from
+     * `@intentius/chant-lexicon-cedar`. Commit it or regenerate it in CI; either
+     * way it is never under `node_modules`.
+     */
+    outDir: z.string().optional(),
+    /**
+     * Knobs for the `cedar-wasm` validator. `mode` is a single-variant enum on
+     * purpose: `ValidationMode` in cedar-wasm 4.12.0 accepts `"strict"` and
+     * nothing else, and passing anything further throws (#1648 §5.7).
+     */
+    validation: z
+        .strictObject({
+        /** Validator mode. Only `"strict"` exists in this build of cedar-wasm. */
+        mode: z.literal("strict").optional(),
+        /**
+         * What to do with `validationWarnings` — the validator reports things
+         * like "policy is impossible" here, separately from errors.
+         */
+        warnings: z.enum(["ignore", "warn", "error"]).optional(),
+        /**
+         * Refuse to build when no project schema is found rather than falling
+         * back to the bundled default. Off by default so `chant init` works;
+         * worth turning on once a project has its own schema, because
+         * `checkParseSchema("")` succeeds and an empty schema validates
+         * everything clean (#1648 §1).
+         */
+        requireProjectSchema: z.boolean().optional(),
+    })
+        .optional(),
+    /**
+     * The dogwood dialect's CLI-gated leg (#1659).
+     *
+     * `strictObject` again, for the reason the outer one is: a typo here is the
+     * difference between "full .dw validation ran" and "DWDE010 said it could
+     * not run", and the second is easy to skim past.
+     */
+    dogwood: z
+        .strictObject({
+        /**
+         * Path to the `dogwood` binary, absolute or relative to the config file.
+         *
+         * Optional, and its absence is not an error: DWDE010 warns-and-skips
+         * with an issue-linked advisory when no binary is found, which is the
+         * epic's explicit exception. Set this when the binary is built somewhere
+         * `PATH` does not reach — the on-demand harness shape the epic borrows
+         * from forgejo-runtime-e2e.
+         *
+         * A `chant.config.ts` cannot be read from inside a post-synth check —
+         * `check()` is synchronous and evaluating project code is not — so this
+         * key is honoured from `chant.config.json` and the `CHANT_DOGWOOD_BINARY`
+         * environment variable covers the TypeScript-config case. See
+         * `src/dogwood/cli.ts`.
+         */
+        binary: z.string().optional(),
+    })
+        .optional(),
+});
+/**
+ * Read the `cedar` namespace out of the project's config.
+ *
+ * Searches upward from `startDir`, so `chant cedar generate` finds the config from a
+ * subdirectory the same way `chant build` does. A project with no config, or
+ * one with no `cedar` key, gets `{}` — the schema resolution order in
+ * `spec/fetch.ts` handles that case without needing to know why.
+ *
+ * Core has already validated the namespace against {@link cedarConfigSchema}
+ * by the time this reads it, so the parse here is a type narrowing rather than
+ * a second gate; it stays because a caller can point this at a directory core
+ * never loaded.
+ */
+export async function loadCedarConfig(startDir) {
+    return (await loadCedarProject(startDir)).config;
+}
+/**
+ * {@link loadCedarConfig}, plus the directory the config was found in.
+ *
+ * `cedar.schema` and `cedar.outDir` are relative to the config file, not to
+ * wherever the command was run (#1696) — `chant cedar generate` from a subdirectory
+ * has to write to the same place as the same command from the root.
+ */
+export async function loadCedarProject(startDir) {
+    const { loadChantConfigUpward } = await import("@intentius/chant/config");
+    const { dirname } = await import("path");
+    try {
+        const { config, configPath } = await loadChantConfigUpward(startDir);
+        const parsed = cedarConfigSchema.safeParse(config.cedar ?? {});
+        return {
+            projectRoot: configPath ? dirname(configPath) : startDir,
+            config: parsed.success ? parsed.data : {},
+        };
+    }
+    catch {
+        // A project whose config does not load is not this function's problem to
+        // report — every other command reports it first, and generation falling
+        // back to the bundled schema is the same behaviour as having no config.
+        return { projectRoot: startDir, config: {} };
+    }
+}

package/dist/coverage.js

@@ -0,0 +1,112 @@
+/**
+ * Schema coverage for the cedar lexicon.
+ *
+ * Core's `computeCoverage` measures CloudFormation-shaped dimensions —
+ * property constraints, create-only/write-only lifecycle, return attributes —
+ * none of which a Cedar schema has. Reporting 0% across four axes that cannot
+ * apply would be worse than reporting nothing, so this asks the question that
+ * does mean something here: **is every entity type and every action in the
+ * schema reachable from the generated artifacts?**
+ *
+ * A gap is a real defect, not a nice-to-have. An action with no generated
+ * constant is an action a policy can only name as a hand-typed string, which
+ * is the exact failure mode the lexicon exists to remove.
+ */
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { LEXICON_JSON_FILENAME } from "./codegen/generate.js";
+import { attributesTypeName, contextTypeName } from "./codegen/emit.js";
+import { readSchemaSource } from "./spec/fetch.js";
+import { parseCedarSchema } from "./spec/parse.js";
+function defaultGeneratedDir() {
+    return join(moduleSourceDir(import.meta.url), "generated");
+}
+function pct(covered, total) {
+    return total === 0 ? 100 : Math.round((covered / total) * 100);
+}
+/** Compute schema coverage against the artifacts already on disk. */
+export function computeCedarCoverage(options = {}) {
+    const generatedDir = options.generatedDir ?? defaultGeneratedDir();
+    const registryPath = join(generatedDir, LEXICON_JSON_FILENAME);
+    const covered = new Set();
+    if (existsSync(registryPath)) {
+        const registry = JSON.parse(readFileSync(registryPath, "utf-8"));
+        for (const entry of Object.values(registry)) {
+            if (entry.resourceType)
+                covered.add(entry.resourceType);
+        }
+    }
+    const source = readSchemaSource(options);
+    const { decls } = parseCedarSchema(source.text);
+    const items = decls
+        .map((decl) => {
+        const recordName = decl.kind === "entity" ? attributesTypeName(decl.typeName) : contextTypeName(decl.typeName);
+        return {
+            name: decl.typeName,
+            kind: decl.kind,
+            covered: covered.has(decl.typeName),
+            recordCovered: covered.has(recordName),
+            attributes: decl.kind === "entity" ? decl.attributes.length : decl.context.length,
+        };
+    })
+        .sort((a, b) => a.name.localeCompare(b.name));
+    const entities = items.filter((i) => i.kind === "entity");
+    const actions = items.filter((i) => i.kind === "action");
+    const entityTypesCovered = entities.filter((i) => i.covered).length;
+    const actionsCovered = actions.filter((i) => i.covered).length;
+    const recordTypesCovered = items.filter((i) => i.recordCovered).length;
+    const entityPct = pct(entityTypesCovered, entities.length);
+    const actionPct = pct(actionsCovered, actions.length);
+    const recordPct = pct(recordTypesCovered, items.length);
+    return {
+        schemaPath: source.path,
+        isDefaultSchema: source.isDefault,
+        entityTypes: entities.length,
+        entityTypesCovered,
+        actions: actions.length,
+        actionsCovered,
+        recordTypes: items.length,
+        recordTypesCovered,
+        entityPct,
+        actionPct,
+        recordPct,
+        overallPct: Math.round((entityPct + actionPct + recordPct) / 3),
+        items,
+    };
+}
+/** Human-readable summary. */
+export function formatCedarCoverage(report, verbose = false) {
+    const lines = [
+        `Cedar schema coverage — ${report.isDefaultSchema ? "bundled default schema" : report.schemaPath}`,
+        `  Entity types: ${report.entityTypesCovered}/${report.entityTypes} (${report.entityPct}%)`,
+        `  Actions:      ${report.actionsCovered}/${report.actions} (${report.actionPct}%)`,
+        `  Record types: ${report.recordTypesCovered}/${report.recordTypes} (${report.recordPct}%)`,
+        `  Overall:      ${report.overallPct}%`,
+    ];
+    if (verbose) {
+        lines.push("");
+        for (const item of report.items) {
+            const gaps = [];
+            if (!item.covered)
+                gaps.push("no generated declaration");
+            if (!item.recordCovered)
+                gaps.push(item.kind === "entity" ? "no attributes type" : "no context type");
+            lines.push(gaps.length === 0
+                ? `  ${item.name}: covered (${item.attributes} attribute(s))`
+                : `  ${item.name}: ${gaps.join(", ")}`);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * Print the report, and throw when it falls below `minOverall`.
+ */
+export function analyzeCedarCoverage(options = {}) {
+    const report = computeCedarCoverage(options);
+    console.error(formatCedarCoverage(report, options.verbose));
+    if (options.minOverall !== undefined && report.overallPct < options.minOverall) {
+        throw new Error(`Cedar schema coverage ${report.overallPct}% is below the ${options.minOverall}% minimum`);
+    }
+    return report;
+}

package/dist/detect.js

@@ -0,0 +1,61 @@
+/**
+ * Edge-safe template detection for cedar (#426, #1653).
+ *
+ * Two documents belong to this lexicon: the JSON policy-set envelope the
+ * serializer writes, and `.cedar` policy text. The first is recognized by its
+ * shape and then confirmed by `checkParsePolicySet`; the second only by asking
+ * the module to split it.
+ *
+ * The shape test is strict on purpose. `chant import` walks every loaded
+ * plugin's `detectTemplate` in turn, so a lexicon that answers `true` for
+ * someone else's JSON steals the file. `staticPolicies`/`templates`/
+ * `templateLinks` and nothing else is a document no other lexicon writes, and
+ * a policy set with no policies in it is not claimed at all — `{}` parses
+ * perfectly well as an empty Cedar policy set, and matching it would swallow
+ * every empty JSON object in the repo.
+ */
+import { isPolicySetEnvelope } from "./import/parser.js";
+import { parsesAsPolicySet, splitPolicySet } from "./spec/wasm.js";
+/** Does the envelope actually carry a policy or a template? */
+function hasContent(envelope) {
+    const count = (value) => {
+        if (Array.isArray(value))
+            return value.length;
+        if (value && typeof value === "object")
+            return Object.keys(value).length;
+        if (typeof value === "string")
+            return value.trim().length > 0 ? 1 : 0;
+        return 0;
+    };
+    return count(envelope.staticPolicies) + count(envelope.templates) > 0;
+}
+/** Is this text a Cedar policy document with at least one policy in it? */
+function isPolicyText(content) {
+    if (!content.trim())
+        return false;
+    const parts = splitPolicySet(content);
+    return parts.ok && parts.value.policies.length + parts.value.templates.length > 0;
+}
+export function detectTemplate(data) {
+    if (typeof data === "string") {
+        const trimmed = data.trim();
+        if (!trimmed)
+            return false;
+        // A string may still be the envelope — `chant import` hands the parsed
+        // object around, but the audit discovery path passes raw file contents.
+        if (trimmed.startsWith("{")) {
+            try {
+                return detectTemplate(JSON.parse(trimmed));
+            }
+            catch {
+                return false;
+            }
+        }
+        return isPolicyText(trimmed);
+    }
+    if (!isPolicySetEnvelope(data))
+        return false;
+    if (!hasContent(data))
+        return false;
+    return parsesAsPolicySet(data);
+}