@intentius/chant-lexicon-cedar 0.124.45 → 0.124.48

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4b9a7285e37af554faace1eb4f05a17d8115cc09072dbec081f89089362a332b",
+    "manifest.json": "f2ab912ed80876a89c3b584f19aefbc30019ea17872bf211e5e635658255a366",
     "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
     "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
     "rules/policy-shape.ts": "11377265f05ede594b77c2b6cc3d977a688e5e5712e7a706e7aa6fd6ea05d027",
@@ -30,5 +30,5 @@
     "skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a",
     "skills/chant-cedar-dogwood.md": "7e52d3f045c1c34e00fdef76014a05483fb9dd58cc41037621a76bc298776d8f"
   },
-  "composite": "34208718d0493b147ff4b3d904f41e9040d28642a50a086f2ff90a759277cc09"
+  "composite": "048ff8a8a452ce252b0faed532fd75e2a4e4084568122f94f8b7c3b640e20d17"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cedar",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "Cedar",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-cedar",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "description": "Cedar lexicon for chant — typed authoring for Cedar authorization policies",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,6 +74,6 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.124.45"
+    "@intentius/chant": "^0.124.48"
   }
 }

package/src/gate-policy.test.ts

@@ -30,9 +30,12 @@ const maintainers = new Policy({
   action: { eq: PASS_GATE },
 });
 
+// `roles` are the ones .chant/trust.json at base gives a proven approver
+// (#4324). Roles an approver claims with `chant approve --role` never reach
+// the request.
 function ask(kind: "human" | "agent", name: string, context: Record<string, unknown>, roles: string[] = []) {
   return gatePolicyRequest({
-    op: "release", gate: "ship", resolvedBy: name, approver: { kind, roles }, planDigest: PLAN, context,
+    op: "release", gate: "ship", resolvedBy: name, approver: { kind }, roles, planDigest: PLAN, context,
   });
 }
 
@@ -71,11 +74,18 @@ describe("evaluateGatePolicy (chant#2508)", () => {
     expect(evaluateGatePolicy(ref, ask("agent", "release-bot", { risk: "high" })).decision).toBe("deny");
   });
 
-  test("reads a claimed role as a parent entity", () => {
+  test("reads a proven role as a parent entity (#4324)", () => {
     expect(evaluateGatePolicy(ref, ask("human", "alex", {}, ["maintainer"])).determining).toEqual(["maintainers"]);
     expect(evaluateGatePolicy(ref, ask("human", "pat", {}, ["viewer"])).decision).toBe("deny");
   });
 
+  test("a role the approver only claims is not read (#4324)", () => {
+    const request = gatePolicyRequest({
+      op: "release", gate: "ship", resolvedBy: "alex", approver: { kind: "human", roles: ["maintainer"] }, planDigest: PLAN, context: {},
+    });
+    expect(evaluateGatePolicy(ref, request).decision).toBe("deny");
+  });
+
   test("a policy that errors on a request does not apply, and the error is reported", () => {
     // `context.risk` is absent, so the agent rule errors rather than matching.
     const answer = evaluateGatePolicy(ref, ask("agent", "release-bot", {}));