@intentius/chant-lexicon-cedar 0.124.31 → 0.124.33

package/dist/import/adapter.js

@@ -0,0 +1,54 @@
+/**
+ * The seam between the cedar-shaped parser/generator above and the core
+ * `TemplateParser` / `TypeScriptGenerator` that `chant import` drives.
+ *
+ * Core's pipeline speaks `TemplateIR` — a flat list of `ResourceIR` with a
+ * `type` string it may reorganize into category files. A Cedar policy maps
+ * cleanly onto one: the logical id is the policy id, and the type records
+ * whether Cedar read it as a static policy or as a template, so the mapping
+ * reverses without guessing.
+ */
+import { CedarParser } from "./parser.js";
+import { CedarGenerator, loadActionConstants } from "./generator.js";
+/** The `ResourceIR.type` each IR kind is filed under. */
+const TYPE_BY_KIND = {
+    policy: "Cedar::Policy",
+    template: "Cedar::Template",
+};
+const KIND_BY_TYPE = {
+    "Cedar::Policy": "policy",
+    "Cedar::Template": "template",
+};
+function toResource(entity) {
+    return {
+        logicalId: entity.name,
+        type: TYPE_BY_KIND[entity.kind],
+        properties: entity.props,
+    };
+}
+function toPolicyIR(resource) {
+    return {
+        kind: KIND_BY_TYPE[resource.type] ?? "policy",
+        name: resource.logicalId,
+        props: resource.properties,
+    };
+}
+/** `TemplateParser` over `.cedar` text and the JSON policy-set envelope. */
+export class CedarTemplateParser {
+    parse(content) {
+        const { entities, warnings } = new CedarParser().parse(content);
+        return {
+            resources: entities.map(toResource),
+            parameters: [],
+            ...(warnings.length > 0 ? { metadata: { warnings } } : {}),
+        };
+    }
+}
+/** `TypeScriptGenerator` emitting `new Policy({ … })` per imported policy. */
+export class CedarTemplateGenerator {
+    generate(ir) {
+        const generator = new CedarGenerator({ actionConstants: loadActionConstants() });
+        const { source } = generator.generate(ir.resources.map(toPolicyIR));
+        return [{ path: "main.ts", content: source }];
+    }
+}

package/dist/import/clause-text.js

@@ -0,0 +1,166 @@
+/**
+ * Recover the `when`/`unless` bodies of a policy exactly as they were written.
+ *
+ * The round-trip this lexicon promises is byte-identical `.cedar` output, and
+ * the JSON leg cannot deliver it: an expression that goes to `PolicyJson` and
+ * back comes out defensively parenthesized — `resource.owner == principal`
+ * returns as `(resource.owner) == principal` — and `formatPolicies` does not
+ * undo that. The tree is semantically lossless; the text is not preserved.
+ *
+ * So when there *is* source text, the condition bodies are lifted out of it
+ * verbatim, and the module still decides what they mean: every body this file
+ * hands back is re-parsed and compared against the tree `policyToJson` produced
+ * for the same clause before the importer trusts it (see `parser.ts`). A
+ * mismatch falls back to the rendered form.
+ *
+ * What is here is a *delimiter scanner*, not a Cedar parser. It knows three
+ * things — that a `"` starts a string with backslash escapes, that `//` runs
+ * to end of line, and that `@`, `(` and `{` have partners — and it knows the
+ * two clause keywords. It has no opinion about expressions, which remains the
+ * module's job. Anything it does not recognize returns `null`, and the caller
+ * uses the rendered bodies instead.
+ */
+const WHITESPACE = /\s/;
+const WORD_CHAR = /[A-Za-z0-9_]/;
+class Scanner {
+    constructor(text) {
+        this.text = text;
+        this.index = 0;
+    }
+    atEnd() {
+        return this.index >= this.text.length;
+    }
+    peek() {
+        return this.text[this.index] ?? "";
+    }
+    /** Consume whitespace and `//` line comments. */
+    skipTrivia() {
+        while (this.index < this.text.length) {
+            const ch = this.text[this.index];
+            if (WHITESPACE.test(ch)) {
+                this.index++;
+                continue;
+            }
+            if (ch === "/" && this.text[this.index + 1] === "/") {
+                while (this.index < this.text.length && this.text[this.index] !== "\n")
+                    this.index++;
+                continue;
+            }
+            return;
+        }
+    }
+    /** Consume one `[A-Za-z0-9_]+` run, or `null` if the cursor is not on one. */
+    word() {
+        const start = this.index;
+        while (this.index < this.text.length && WORD_CHAR.test(this.text[this.index]))
+            this.index++;
+        return this.index > start ? this.text.slice(start, this.index) : null;
+    }
+    /** Consume the single character `ch`, reporting whether it was there. */
+    expect(ch) {
+        if (this.text[this.index] !== ch)
+            return false;
+        this.index++;
+        return true;
+    }
+    /**
+     * Consume a balanced `open`…`close` run starting at the cursor and return
+     * what was between them.
+     *
+     * Strings and line comments are skipped wholesale, so a `}` inside
+     * `"}; hi {"` or behind a `//` never closes anything.
+     */
+    delimited(open, close) {
+        if (!this.expect(open))
+            return null;
+        const start = this.index;
+        let depth = 1;
+        while (this.index < this.text.length) {
+            const ch = this.text[this.index];
+            if (ch === '"') {
+                if (!this.skipString())
+                    return null;
+                continue;
+            }
+            if (ch === "/" && this.text[this.index + 1] === "/") {
+                this.skipTrivia();
+                continue;
+            }
+            if (ch === open)
+                depth++;
+            if (ch === close) {
+                depth--;
+                if (depth === 0) {
+                    const body = this.text.slice(start, this.index);
+                    this.index++;
+                    return body;
+                }
+            }
+            this.index++;
+        }
+        return null;
+    }
+    /** Consume a double-quoted literal, honouring backslash escapes. */
+    skipString() {
+        this.index++; // opening quote
+        while (this.index < this.text.length) {
+            const ch = this.text[this.index];
+            if (ch === "\\") {
+                this.index += 2;
+                continue;
+            }
+            this.index++;
+            if (ch === '"')
+                return true;
+        }
+        return false;
+    }
+}
+/**
+ * Split one policy's source into its clause bodies.
+ *
+ * Returns `null` for anything that does not walk cleanly — an unbalanced
+ * brace, a keyword that is neither `when` nor `unless`, trailing text after
+ * the terminating `;`. `null` is not a diagnosis, only a decision to use the
+ * module's rendering instead.
+ */
+export function extractClauses(policyText) {
+    const scanner = new Scanner(policyText);
+    // Annotations: `@key( "value" )`, any number of them.
+    scanner.skipTrivia();
+    while (scanner.peek() === "@") {
+        scanner.expect("@");
+        if (scanner.word() === null)
+            return null;
+        scanner.skipTrivia();
+        if (scanner.delimited("(", ")") === null)
+            return null;
+        scanner.skipTrivia();
+    }
+    const effect = scanner.word();
+    if (effect !== "permit" && effect !== "forbid")
+        return null;
+    // The scope block. Its contents are of no interest here; skipping it is what
+    // keeps the `(` of `@id(` from being mistaken for the scope's own.
+    scanner.skipTrivia();
+    if (scanner.delimited("(", ")") === null)
+        return null;
+    const clauses = [];
+    for (;;) {
+        scanner.skipTrivia();
+        if (scanner.expect(";"))
+            break;
+        const keyword = scanner.word();
+        if (keyword !== "when" && keyword !== "unless")
+            return null;
+        scanner.skipTrivia();
+        const body = scanner.delimited("{", "}");
+        if (body === null)
+            return null;
+        clauses.push({ kind: keyword, body: body.trim() });
+    }
+    scanner.skipTrivia();
+    if (!scanner.atEnd())
+        return null;
+    return clauses;
+}

package/dist/import/generator.js

@@ -0,0 +1,178 @@
+/**
+ * TypeScript generator for `chant import`.
+ *
+ * Turns the parser's IR back into the authoring source it came from: one
+ * `import` line, then an `export const … = new Policy({ … })` per policy.
+ *
+ * `Policy` is the schema-driven class `chant generate` emits, and the scope
+ * refs it accepts are string-literal unions — so `action: { eq: 'App::Action::"read"' }`
+ * is already checked against the schema by the compiler, and an action the
+ * schema never declared is an error at the import site. Where the generated
+ * registry is on hand, an action UID is emitted as the generated *constant*
+ * (`ReadAction`) instead, which reads better and survives a rename; without a
+ * registry the literal is the fallback, and it typechecks just the same.
+ */
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+/** The package this generated source imports from. */
+export const CEDAR_PACKAGE = "@intentius/chant-lexicon-cedar";
+/** The authoring class every imported policy is emitted against. */
+const POLICY_CLASS = "Policy";
+// ── Identifier sanitization ───────────────────────────────────────
+/**
+ * A word no export may be called. Not the full reserved list — only the ones a
+ * policy id plausibly reduces to.
+ */
+const RESERVED = new Set([
+    "break", "case", "catch", "class", "const", "continue", "debugger", "default", "delete", "do",
+    "else", "enum", "export", "extends", "false", "finally", "for", "function", "if", "import",
+    "in", "instanceof", "new", "null", "return", "super", "switch", "this", "throw", "true", "try",
+    "typeof", "var", "void", "while", "with", "yield", "let", "static", "await", "interface",
+    "package", "private", "protected", "public", "implements",
+]);
+/**
+ * A Cedar policy id as a JavaScript identifier.
+ *
+ * `allow-alice-read` → `allowAliceRead`, `legacy_policy` → `legacyPolicy`,
+ * `SOC2-AC-3` → `soc2AC3`. A leading segment that is already mixed case keeps
+ * its shape apart from the first letter; one that is all caps is lowered whole,
+ * so an id like `SOC2` does not come back as `sOC2`.
+ */
+export function sanitizeName(id) {
+    const segments = id.split(/[^A-Za-z0-9]+/).filter(Boolean);
+    if (segments.length === 0)
+        return "policy";
+    const [first, ...rest] = segments;
+    const head = /[a-z]/.test(first) ? first[0].toLowerCase() + first.slice(1) : first.toLowerCase();
+    const tail = rest.map((segment) => segment[0].toUpperCase() + segment.slice(1)).join("");
+    let name = head + tail;
+    if (/^[0-9]/.test(name))
+        name = `policy${name[0].toUpperCase()}${name.slice(1)}`;
+    if (RESERVED.has(name))
+        name = `${name}Policy`;
+    return name;
+}
+/** Give every export a distinct name, in a way a second run reproduces. */
+function uniqueNames(entities) {
+    const taken = new Set();
+    return entities.map((entity) => {
+        const base = sanitizeName(entity.name);
+        let candidate = base;
+        let n = 2;
+        while (taken.has(candidate))
+            candidate = `${base}${n++}`;
+        taken.add(candidate);
+        return candidate;
+    });
+}
+// ── Props emission ────────────────────────────────────────────────
+/**
+ * A marker no Cedar value can contain, so a substitution cannot be confused
+ * for content. The props go through `JSON.stringify` as data; identifiers are
+ * swapped in afterwards by matching the encoded marker exactly.
+ */
+const MARKER = "\u0000chant:";
+const SCOPE_KEYS = ["principal", "action", "resource"];
+/**
+ * Swap recognized action UIDs for their generated constant, in scope positions
+ * only.
+ *
+ * Not inside `when`/`unless`: those are Cedar expression text, where the UID is
+ * part of a larger expression the compiler never sees as a ref.
+ */
+function markScopeConstants(props, actionConstants, used) {
+    if (Object.keys(actionConstants).length === 0)
+        return props;
+    const mark = (value) => {
+        if (typeof value !== "string")
+            return value;
+        const constant = actionConstants[value];
+        if (!constant)
+            return value;
+        used.add(constant);
+        return `${MARKER}${constant}`;
+    };
+    const out = { ...props };
+    for (const key of SCOPE_KEYS) {
+        const scope = out[key];
+        if (!scope || typeof scope !== "object")
+            continue;
+        const marked = { ...scope };
+        if ("eq" in marked)
+            marked.eq = mark(marked.eq);
+        if (Array.isArray(marked.in))
+            marked.in = marked.in.map(mark);
+        else if ("in" in marked)
+            marked.in = mark(marked.in);
+        out[key] = marked;
+    }
+    return out;
+}
+/** `{"effect": "permit"}` → `{ effect: "permit" }`, and markers → identifiers. */
+function emitProps(props) {
+    const json = JSON.stringify(props, null, 2)
+        // Unquote keys that are already valid identifiers. A quote inside a string
+        // value is escaped as `\"` by `JSON.stringify`, so no value can present the
+        // `"ident":` shape this matches.
+        .replace(/"([A-Za-z_$][A-Za-z0-9_$]*)":/g, "$1:");
+    return json.replace(/"\\u0000chant:([A-Za-z_$][A-Za-z0-9_$]*)"/g, "$1");
+}
+// ── Generator ─────────────────────────────────────────────────────
+export class CedarGenerator {
+    constructor(options = {}) {
+        this.actionConstants = options.actionConstants ?? {};
+    }
+    generate(entities) {
+        const warnings = [];
+        const imports = new Set([POLICY_CLASS]);
+        const names = uniqueNames(entities);
+        const blocks = [];
+        for (const [index, entity] of entities.entries()) {
+            const props = markScopeConstants(entity.props, this.actionConstants, imports);
+            if (entity.kind === "template") {
+                blocks.push("/** Cedar template — its `?principal`/`?resource` slots are filled at link time. */");
+            }
+            blocks.push(`export const ${names[index]} = new ${POLICY_CLASS}(${emitProps(props)});`);
+            blocks.push("");
+        }
+        if (entities.length === 0)
+            warnings.push("no Cedar policies were found in this document");
+        const importLine = `import { ${[...imports].sort().join(", ")} } from "${CEDAR_PACKAGE}";`;
+        const source = [importLine, "", ...blocks].join("\n");
+        return { source: source.endsWith("\n") ? source : `${source}\n`, warnings };
+    }
+}
+// ── Generated registry lookup ─────────────────────────────────────
+/** Filename of the registry `chant generate` writes beside the typed classes. */
+const REGISTRY_FILE = "lexicon-cedar.json";
+/**
+ * Read `App::Action::"read"` → `ReadAction` out of the generated registry.
+ *
+ * Best-effort by design: a project that has not run `chant generate` has no
+ * registry, and the generator falls back to emitting UID literals — which the
+ * `Policy` class accepts and the compiler still checks.
+ */
+export function loadActionConstants(packageDir) {
+    const base = packageDir ?? dirname(moduleSourceDir(import.meta.url));
+    const path = join(base, "generated", REGISTRY_FILE);
+    if (!existsSync(path))
+        return {};
+    try {
+        const registry = JSON.parse(readFileSync(path, "utf-8"));
+        const constants = {};
+        for (const [tsName, entry] of Object.entries(registry)) {
+            if (entry.kind !== "resource")
+                continue;
+            if (typeof entry.resourceType !== "string")
+                continue;
+            if (!/::Action::"/.test(entry.resourceType))
+                continue;
+            constants[entry.resourceType] = tsName;
+        }
+        return constants;
+    }
+    catch {
+        return {};
+    }
+}

package/dist/import/parser.js

@@ -0,0 +1,273 @@
+/**
+ * Cedar policy parser for `chant import`.
+ *
+ * Two surfaces come in and one IR goes out:
+ *
+ * - **`.cedar` policy text** — split by `policySetTextToParts`, then each
+ *   policy handed to `policyToJson` (or `templateToJson`, for one carrying a
+ *   slot). The Cedar grammar is never touched here; the module owns it.
+ * - **the JSON policy-set envelope** the serializer writes beside the text —
+ *   `{ staticPolicies, templates, templateLinks }`, whose values are already
+ *   in Cedar's JSON policy format.
+ *
+ * The IR is lossless with respect to the authoring model: effect, all three
+ * scopes, every `when`/`unless` clause in order, and every annotation. What is
+ * *not* in the model is not invented — Cedar comments are dropped by the
+ * module before this file sees them, and template links have no authoring
+ * shape yet, so they are reported as a warning rather than silently discarded.
+ *
+ * Unconstrained scopes are the one thing left out of `props`, because `{}` and
+ * absent are the same value to the serializer (`principal` with no constraint).
+ * Writing `principal: {}` into every imported policy would be noise, not
+ * fidelity.
+ */
+import { policyToJson, policyToText, splitPolicySet, templateToJson, } from "../spec/wasm.js";
+import { escapeCedarString } from "../serializer.js";
+import { extractClauses } from "./clause-text.js";
+/** `{ type: "App::User", id: "alice" }` → `App::User::"alice"`. */
+function uidText(uid) {
+    const parts = "__entity" in uid ? uid.__entity : uid;
+    return `${parts.type}::"${escapeCedarString(parts.id)}"`;
+}
+/**
+ * One scope constraint, back to the authoring form.
+ *
+ * `undefined` is the unconstrained case — see the note at the top of the file
+ * about why it is omitted rather than written as `{}`.
+ */
+function scopeProps(constraint) {
+    if (!constraint || typeof constraint !== "object")
+        return undefined;
+    const scope = constraint;
+    const inTarget = (value) => {
+        if (!value || typeof value !== "object")
+            return undefined;
+        const target = value;
+        if (typeof target.slot === "string")
+            return target.slot;
+        if (Array.isArray(target.entities))
+            return target.entities.map((e) => uidText(e));
+        if (target.entity)
+            return uidText(target.entity);
+        return undefined;
+    };
+    switch (scope.op) {
+        case "is": {
+            if (typeof scope.entity_type !== "string")
+                return undefined;
+            const within = inTarget(scope.in);
+            return within === undefined ? { is: scope.entity_type } : { is: scope.entity_type, in: within };
+        }
+        case "==":
+            if (typeof scope.slot === "string")
+                return { eq: scope.slot };
+            return scope.entity ? { eq: uidText(scope.entity) } : undefined;
+        case "in": {
+            const within = inTarget(scope);
+            return within === undefined ? undefined : { in: within };
+        }
+        default:
+            // `All`, and anything a later Cedar version adds that this does not know.
+            return undefined;
+    }
+}
+/**
+ * Render one condition body back to Cedar text through the module.
+ *
+ * There is no entry point that renders an expression on its own, so the body
+ * is wrapped in the most boring policy that can hold it and the wrapper is
+ * sliced back off. The wrapper is the module's own output, so its shape is
+ * fixed: `permit(principal, action, resource) when { … };`.
+ */
+function renderConditionBody(kind, body) {
+    const probe = {
+        effect: "permit",
+        principal: { op: "All" },
+        action: { op: "All" },
+        resource: { op: "All" },
+        conditions: [{ kind, body }],
+    };
+    const rendered = policyToText(probe);
+    if (!rendered.ok)
+        return undefined;
+    const opening = `${kind} { `;
+    const start = rendered.value.indexOf(opening);
+    if (start < 0 || !rendered.value.endsWith(" };"))
+        return undefined;
+    return rendered.value.slice(start + opening.length, -3);
+}
+/** Re-parse one clause body and return the tree the module makes of it. */
+function parseConditionBody(body) {
+    const parsed = policyToJson(`permit (principal, action, resource) when { ${body} };`);
+    return parsed.ok ? parsed.value.conditions[0]?.body : undefined;
+}
+/**
+ * The `when` and `unless` clause texts, in order.
+ *
+ * Verbatim source wins when there is source to quote and the module agrees it
+ * means the same thing; otherwise the rendered form is used. `policyToJson`
+ * serializes deterministically with sorted keys (#1648 §5.2), so comparing two
+ * of its trees by their JSON text is sound.
+ */
+function conditionProps(json, sourceText) {
+    const conditions = json.conditions ?? [];
+    const warnings = [];
+    const source = sourceText ? extractClauses(sourceText) : null;
+    const usable = source !== null && source.length === conditions.length ? source : null;
+    const when = [];
+    const unless = [];
+    for (const [index, condition] of conditions.entries()) {
+        const candidate = usable?.[index];
+        let text;
+        if (candidate &&
+            candidate.kind === condition.kind &&
+            JSON.stringify(parseConditionBody(candidate.body)) === JSON.stringify(condition.body)) {
+            text = candidate.body;
+        }
+        else {
+            text = renderConditionBody(condition.kind, condition.body);
+        }
+        if (text === undefined) {
+            warnings.push(`a ${condition.kind} clause could not be rendered back to Cedar text and was dropped`);
+            continue;
+        }
+        (condition.kind === "when" ? when : unless).push(text);
+    }
+    return { when, unless, warnings };
+}
+/**
+ * One `PolicyJson` as `Cedar::Policy` props.
+ *
+ * Key order matches the props interface, so the generator's `JSON.stringify`
+ * emits policies that read the way they would have been written.
+ */
+function policyProps(json, sourceText) {
+    const props = { effect: json.effect === "forbid" ? "forbid" : "permit" };
+    const principal = scopeProps(json.principal);
+    if (principal)
+        props.principal = principal;
+    const action = scopeProps(json.action);
+    if (action)
+        props.action = action;
+    const resource = scopeProps(json.resource);
+    if (resource)
+        props.resource = resource;
+    const { when, unless, warnings } = conditionProps(json, sourceText);
+    if (when.length > 0)
+        props.when = when;
+    if (unless.length > 0)
+        props.unless = unless;
+    const annotations = json.annotations ?? {};
+    if (Object.keys(annotations).length > 0)
+        props.annotations = { ...annotations };
+    return { props, warnings };
+}
+/** The id a policy answers to: its own `@id` first, then where it was filed. */
+function policyId(json, fallback) {
+    const annotated = json.annotations?.id;
+    return typeof annotated === "string" && annotated.length > 0 ? annotated : fallback;
+}
+// ── Envelope shape ────────────────────────────────────────────────
+const ENVELOPE_KEYS = new Set(["staticPolicies", "templates", "templateLinks"]);
+/**
+ * Is this the JSON policy-set envelope?
+ *
+ * Deliberately strict about foreign keys: a CloudFormation template or a
+ * Kubernetes manifest must not walk in through a permissive shape test, and
+ * `detect.ts` leans on the same rule.
+ */
+export function isPolicySetEnvelope(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        return false;
+    const keys = Object.keys(data);
+    if (keys.length === 0)
+        return false;
+    if (!keys.every((key) => ENVELOPE_KEYS.has(key)))
+        return false;
+    return "staticPolicies" in data || "templates" in data;
+}
+/** Normalize the three shapes `staticPolicies` is allowed to take into pairs. */
+function envelopeEntries(value, fallbackPrefix) {
+    if (Array.isArray(value))
+        return value.map((entry, index) => [`${fallbackPrefix}${index}`, entry]);
+    if (value && typeof value === "object")
+        return Object.entries(value);
+    return [];
+}
+// ── Parser ────────────────────────────────────────────────────────
+export class CedarParser {
+    parse(content) {
+        if (!content.trim())
+            return { entities: [], warnings: [] };
+        const asJSON = tryParseJSON(content);
+        if (isPolicySetEnvelope(asJSON))
+            return this.parseEnvelope(asJSON);
+        return this.parseText(content);
+    }
+    // ── `.cedar` text ───────────────────────────────────────────────
+    parseText(content) {
+        const parts = splitPolicySet(content);
+        if (!parts.ok)
+            throw new Error(`cedar: could not parse the policy document — ${parts.error}`);
+        const entities = [];
+        const warnings = [];
+        const collect = (sources, kind, convert, fallbackPrefix) => {
+            for (const [index, source] of sources.entries()) {
+                const converted = convert(source);
+                if (!converted.ok) {
+                    warnings.push(`skipped a ${kind} that did not convert: ${converted.error}`);
+                    continue;
+                }
+                entities.push(this.toIR(kind, converted.value, `${fallbackPrefix}${index}`, source, warnings));
+            }
+        };
+        collect(parts.value.policies, "policy", policyToJson, "policy");
+        collect(parts.value.templates, "template", templateToJson, "template");
+        return { entities, warnings };
+    }
+    // ── JSON policy-set envelope ────────────────────────────────────
+    parseEnvelope(envelope) {
+        // `staticPolicies` is allowed to be one blob of `.cedar` text, in which
+        // case the whole envelope is the text surface wearing a wrapper — templates
+        // and all, since the text is what says which is which.
+        const asText = typeof envelope.staticPolicies === "string" ? this.parseText(envelope.staticPolicies) : null;
+        const entities = [...(asText?.entities ?? [])];
+        const warnings = [...(asText?.warnings ?? [])];
+        const collect = (value, kind, convert, fallbackPrefix) => {
+            for (const [key, entry] of envelopeEntries(value, fallbackPrefix)) {
+                const converted = convert(entry);
+                if (!converted.ok) {
+                    warnings.push(`skipped ${kind} \`${key}\`: ${converted.error}`);
+                    continue;
+                }
+                // A policy given as text carries its own layout; one given as JSON has
+                // none to quote, and its conditions come back as the module renders them.
+                const source = typeof entry === "string" ? entry : undefined;
+                entities.push(this.toIR(kind, converted.value, key, source, warnings));
+            }
+        };
+        if (!asText)
+            collect(envelope.staticPolicies, "policy", policyToJson, "policy");
+        collect(envelope.templates, "template", templateToJson, "template");
+        const links = envelope.templateLinks;
+        if (Array.isArray(links) && links.length > 0) {
+            warnings.push(`${links.length} template link(s) were not imported — a linked template has no authoring shape in this lexicon yet`);
+        }
+        return { entities, warnings };
+    }
+    toIR(kind, json, fallbackId, sourceText, warnings) {
+        const name = policyId(json, fallbackId);
+        const { props, warnings: propWarnings } = policyProps(json, sourceText);
+        for (const warning of propWarnings)
+            warnings.push(`${name}: ${warning}`);
+        return { kind, name, props };
+    }
+}
+function tryParseJSON(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return undefined;
+    }
+}