@intentius/chant-lexicon-cedar 0.44.14 → 0.45.0

package/README.md

@@ -38,10 +38,15 @@ The policy id comes from the export's logical name (`allowAdminRead` →
 
 ## Where the types come from
 
-`chant generate` reads a `.cedarschema` and emits a class per entity type, a
-constant per action, and a UID type per entity — so `action: { eq: ReadAction }`
-is checked at compile time and a renamed entity type is a compiler-guided
-refactor.
+`chant cedar generate` reads a `.cedarschema` and emits a class per entity
+type, a constant per action, and a UID type per entity — so `action: { eq:
+ReadAction }` is checked at compile time and a renamed entity type is a
+compiler-guided refactor.
+
+The output goes into the project, at `src/generated/cedar/` or wherever
+`cedar.outDir` points, and policies import from there. It is never written
+under `node_modules` (#1696). In this package's own checkout the project is the
+package, so `npm run generate` writes `src/generated/` as before.
 
 Point it at your schema in `chant.config.ts`:
 
@@ -62,6 +67,10 @@ the small application-authorization schema bundled at
 surface. Set `cedar.validation.requireProjectSchema` to turn that fallback off
 once your project has its own schema.
 
+A project schema is also emitted by `chant build` as `dist/<name>.cedarschema`
+beside the policies (#1697), so CEDE010 validates the set against it and a
+dogwood bundle can carry it. The bundled default is never emitted.
+
 ## Pins
 
 Two, for two different things:

package/dist/avp/client.d.ts

@@ -45,6 +45,15 @@
  *     signing against one would make every local lane need credentials to read
  *     what it just deployed. `signEndpointOverride` opts back in for an
  *     override that *is* real AWS — a VPC endpoint, a signing proxy.
+ *
+ * What counts as an override is {@link resolveEndpointOverride}: the
+ * `endpoint` option, else `AWS_ENDPOINT_URL_VERIFIEDPERMISSIONS`, else
+ * `AWS_ENDPOINT_URL` — the AWS SDK's own precedence, and the same rule the aws
+ * lexicon's `api/read-client.ts` applies to every transport it owns (#1694).
+ * It is restated here rather than imported for the reason above: cedar does
+ * not depend on the aws lexicon, and a lexicon build compiles against the
+ * published core, so a helper hoisted into core would reach neither lexicon
+ * until the next core release.
  */
 /** Injectable HTTP, mirroring `AwsReadHttp` in the aws lexicon so tests avoid the network. */
 export type AvpHttp = (url: string, init: {
@@ -129,6 +138,15 @@ export interface AvpClientOptions {
 export declare function resolveAvpCredentials(source?: AvpCredentialSource, env?: Record<string, string | undefined>): AvpCredentials | undefined;
 /** Service host for AVP, honouring an endpoint override. */
 export declare function avpUrl(endpoint?: string, region?: string): string;
+/**
+ * The one rule for what an endpoint override is (#1694): the `endpoint`
+ * option when given, else `AWS_ENDPOINT_URL_VERIFIEDPERMISSIONS`, else the
+ * ambient `AWS_ENDPOINT_URL`. The result is both the target and, through
+ * {@link requestHeaders}, the fact that decides whether the request is signed.
+ * Returns `undefined` for real AWS. Mirrors the aws lexicon's
+ * `resolveEndpointOverride` for this one service.
+ */
+export declare function resolveEndpointOverride(endpoint: string | undefined, env?: Record<string, string | undefined>): string | undefined;
 /**
  * Whether this process has anything to authenticate with.
  *

package/dist/avp/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/avp/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAMH,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,8FAA8F;IACrF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG,MAAM,cAAc,GAAG,SAAS,CAAC;AAErE,yDAAyD;AACzD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEzE,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uDAAuD;IACvD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,kFAAkF;IAClF,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,cAAc,GAAG,SAAS,CAW5B;AAED,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAUnG;AAgED,iFAAiF;AACjF,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA4BlC;AAID,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQjC;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnG;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/avp/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAMH,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,8FAA8F;IACrF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG,MAAM,cAAc,GAAG,SAAS,CAAC;AAErE,yDAAyD;AACzD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEzE,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uDAAuD;IACvD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,kFAAkF;IAClF,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,cAAc,GAAG,SAAS,CAW5B;AAED,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAKD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAUnG;AAgED,iFAAiF;AACjF,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA4BlC;AAID,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQjC;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnG;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/dist/codegen/docs.d.ts

@@ -1,15 +1,11 @@
 /**
  * The cedar lexicon's Starlight site.
  *
- * Pages are declared as `extraPages` rather than left as hand-written files in
- * docs/. The pipeline rebuilds the sidebar from the pages it knows about on
- * every run, and Starlight does not auto-discover, so a page the config has
- * never heard of exists on disk and is reachable only by typing its URL
- * (chant #1312).
- *
- * Two more pages come out of the pipeline itself: the generated rules table
- * (`rules`) and the serialization reference. Both are linked from the sidebar
- * automatically.
+ * Prose pages are authored under `docs/pages/*.mdx`, each tagged with a
+ * Diátaxis quadrant (chant #1731/#1733); the pipeline builds the sidebar from
+ * that tag. Two more pages come out of the pipeline itself: the generated
+ * rules table (`rules`) and the serialization reference. Both are linked from
+ * the sidebar automatically.
  *
  * Cross-namespace links are written as full `/chant/...` paths. This site's
  * base is `/chant/lexicons/cedar/`, so a bare `/guide/...` would be rewritten

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAqxBH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+HjF"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAoGH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BjF"}

package/dist/codegen/generate.d.ts

@@ -15,23 +15,50 @@
 import type { GenerateOptions, GenerateResult } from "@intentius/chant/codegen/generate";
 /** Filename of the generated registry. */
 export declare const LEXICON_JSON_FILENAME = "lexicon-cedar.json";
+/** The slice of the `cedar` config namespace generation reads. */
+export interface CedarGenerateConfig {
+    schema?: string;
+    outDir?: string;
+    validation?: {
+        requireProjectSchema?: boolean;
+    };
+}
 export interface CedarGenerateOptions extends GenerateOptions {
     /** Project root the `cedar.schema` path is resolved against. Defaults to `process.cwd()`. */
     projectRoot?: string;
     /** The `cedar` config namespace, when the caller has already loaded it. */
-    config?: {
-        schema?: string;
-        validation?: {
-            requireProjectSchema?: boolean;
-        };
-    };
+    config?: CedarGenerateConfig;
 }
+/** This package's root. `<pkg>/src/codegen/generate.ts` is three levels down. */
+export declare function packageDir(): string;
+/**
+ * Where generated artifacts go (#1696).
+ *
+ * Three cases, in order:
+ *
+ *   1. `cedar.outDir` is set: that directory, resolved against the project root.
+ *   2. The project root *is* this package (the monorepo checkout, `npm run
+ *      generate`, `chant dev check-lexicon`): `<pkg>/src/generated`, which
+ *      `src/index.ts` re-exports so the package's own surface stays whole.
+ *   3. Anything else is a consumer: `<project>/src/generated/cedar`.
+ *
+ * Case 2 is what the old code assumed everywhere. A consumer's project root
+ * and the installed package are different directories, and writing into the
+ * second means the output is gone after `npm ci`.
+ */
+export declare function resolveGeneratedDir(options?: {
+    projectRoot?: string;
+    config?: CedarGenerateConfig;
+}): string;
 /**
  * Run the code generation pipeline.
  */
 export declare function generate(options?: CedarGenerateOptions): Promise<GenerateResult>;
+/** The files one generate run produces, keyed by filename. */
+export declare function generatedFiles(result: GenerateResult): Record<string, string>;
 /**
- * Write generated files to the package directory.
+ * Write generated files into `outDir`. With no directory given, writes where
+ * {@link resolveGeneratedDir} says for the current working directory.
  */
-export declare function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void;
+export declare function writeGeneratedFiles(result: GenerateResult, outDir?: string): void;
 //# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAiBzF,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/E;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0D1F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAajF"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAmBzF,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACjD;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,iFAAiF;AACjF,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAA;CAAO,GAAG,MAAM,CAShH;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0D1F;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMjF"}

package/dist/commands.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `chant cedar <verb>` — the consumer-facing surface over this lexicon's
+ * codegen (#1696), mounted through the command-group seam (#1078).
+ *
+ * `chant dev generate` exists, but it is lexicon development: it runs every
+ * configured lexicon's generate, validate and coverage in turn, and for a
+ * project that also lists `aws` that means fetching the CloudFormation spec.
+ * A consumer regenerating its own Cedar classes after a schema edit wants one
+ * lexicon, one step, and an output path it can see.
+ */
+import type { CommandGroup } from "@intentius/chant/cli/command-group";
+/** The `chant cedar` verb group. */
+export declare function cedarCommandGroup(): CommandGroup;
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAiE5F,oCAAoC;AACpC,wBAAgB,iBAAiB,IAAI,YAAY,CAiBhD"}

package/dist/config.d.ts

@@ -29,6 +29,16 @@ import type { ChantConfig } from "@intentius/chant/config";
  * Relative to the project root (the directory holding `chant.config.ts`).
  */
 export declare const CEDAR_DEFAULT_SCHEMA_PATH = "schema.cedarschema";
+/**
+ * Where `generate()` writes when `cedar.outDir` is unset and the project is a
+ * consumer of the published package (#1696).
+ *
+ * Relative to the project root. Inside this lexicon's own checkout the
+ * package directory *is* the project root, and the output stays at
+ * `src/generated/` so `src/index.ts` can re-export it; see
+ * `resolveGeneratedDir` in `codegen/generate.ts`.
+ */
+export declare const CEDAR_DEFAULT_OUT_DIR = "src/generated/cedar";
 /**
  * `strictObject`, not `object`. Core applies `.strict()` to the top level of a
  * declared namespace itself; `validation` is nested, and is the lexicon's own
@@ -43,6 +53,18 @@ export declare const cedarConfigSchema: z.ZodObject<{
      * checkout still produces artifacts.
      */
     schema: z.ZodOptional<z.ZodString>;
+    /**
+     * Directory `generate()` writes the typed classes into, relative to the
+     * project root. Defaults to {@link CEDAR_DEFAULT_OUT_DIR}.
+     *
+     * The output used to land in the installed package's own `src/generated/`,
+     * which `npm ci` wipes (#1696). It is the project's artifact — the classes
+     * describe the project's schema, not the package's — so it lives in the
+     * project tree, and `src/policies.ts` imports from it rather than from
+     * `@intentius/chant-lexicon-cedar`. Commit it or regenerate it in CI; either
+     * way it is never under `node_modules`.
+     */
+    outDir: z.ZodOptional<z.ZodString>;
     /**
      * Knobs for the `cedar-wasm` validator. `mode` is a single-variant enum on
      * purpose: `ValidationMode` in cedar-wasm 4.12.0 accepts `"strict"` and
@@ -57,8 +79,8 @@ export declare const cedarConfigSchema: z.ZodObject<{
          */
         warnings: z.ZodOptional<z.ZodEnum<{
             error: "error";
-            ignore: "ignore";
             warn: "warn";
+            ignore: "ignore";
         }>>;
         /**
          * Refuse to build when no project schema is found rather than falling
@@ -113,7 +135,7 @@ export type CedarConfigNamespace = NonNullable<ChantConfig["cedar"]>;
 /**
  * Read the `cedar` namespace out of the project's config.
  *
- * Searches upward from `startDir`, so `chant generate` finds the config from a
+ * Searches upward from `startDir`, so `chant cedar generate` finds the config from a
  * subdirectory the same way `chant build` does. A project with no config, or
  * one with no `cedar` key, gets `{}` — the schema resolution order in
  * `spec/fetch.ts` handles that case without needing to know why.
@@ -124,4 +146,18 @@ export type CedarConfigNamespace = NonNullable<ChantConfig["cedar"]>;
  * never loaded.
  */
 export declare function loadCedarConfig(startDir: string): Promise<CedarConfig>;
+/** A project as cedar's commands see it: the root paths resolve against, and the namespace. */
+export interface CedarProject {
+    /** The directory holding `chant.config.*`, or `startDir` when there is none. */
+    projectRoot: string;
+    config: CedarConfig;
+}
+/**
+ * {@link loadCedarConfig}, plus the directory the config was found in.
+ *
+ * `cedar.schema` and `cedar.outDir` are relative to the config file, not to
+ * wherever the command was run (#1696) — `chant cedar generate` from a subdirectory
+ * has to write to the same place as the same command from the root.
+ */
+export declare function loadCedarProject(startDir: string): Promise<CedarProject>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;;;;;OAMG;;IAGH;;;;OAIG;;QAGC,0EAA0E;;QAE1E;;;WAGG;;;;;;QAEH;;;;;;WAMG;;;IAKP;;;;;;OAMG;;QAGC;;;;;;;;;;;;;;WAcG;;;kBAIP,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,KAAK,CAAC,EAAE,WAAW,CAAC;KACrB;CACF;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAY5E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;;;;;OAMG;;IAGH;;;;;;;;;;OAUG;;IAGH;;;;OAIG;;QAGC,0EAA0E;;QAE1E;;;WAGG;;;;;;QAEH;;;;;;WAMG;;;IAKP;;;;;;OAMG;;QAGC;;;;;;;;;;;;;;WAcG;;;kBAIP,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,KAAK,CAAC,EAAE,WAAW,CAAC;KACrB;CACF;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5E;AAED,+FAA+F;AAC/F,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAgB9E"}

package/dist/index.d.ts

@@ -33,8 +33,11 @@ export type { DogwoodReplayReportStepOpts, DogwoodReplayStepOpts, PolicyReplayOp
 export { rules as cedarLintRules } from "./lint/rules/index.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";
-export { cedarConfigSchema, loadCedarConfig, CEDAR_DEFAULT_SCHEMA_PATH } from "./config.js";
-export type { CedarConfig } from "./config.js";
+export { cedarConfigSchema, loadCedarConfig, loadCedarProject, CEDAR_DEFAULT_SCHEMA_PATH, CEDAR_DEFAULT_OUT_DIR } from "./config.js";
+export type { CedarConfig, CedarProject } from "./config.js";
+export { resolveGeneratedDir } from "./codegen/generate.js";
+export { Schema, CEDAR_SCHEMA_TYPE, CEDAR_SCHEMA_FILENAME } from "./schema-artifact.js";
+export type { SchemaProps } from "./schema-artifact.js";
 export { CEDAR_WASM_VERSION, CEDAR_LANG_VERSION } from "./spec/pin.js";
 export { computeCedarCoverage, formatCedarCoverage, analyzeCedarCoverage } from "./coverage.js";
 export type { CedarCoverageReport, CedarCoverageItem } from "./coverage.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACnG,YAAY,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAWhG,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,GACZ,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,4BAA4B,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AACnG,YAAY,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAWhG,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAMtD,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAClI,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}

package/dist/init-templates.d.ts

@@ -17,7 +17,7 @@
  *
  * The policy files use `entityType`-string scopes (`{ is: "App::Document" }`)
  * and generated action constants, so a scaffolded project compiles the moment
- * `chant generate` has run against its own schema.
+ * `chant cedar generate` has run against its own schema (#1696).
  */
 import type { InitTemplateSet } from "@intentius/chant/lexicon";
 /**

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0a757e80b60657560dad1ec74976755944e1309a6165bf40643513f04c0e6e15",
+    "manifest.json": "fe3e59e9ab89d64fca5f56bc462bc061a88316b67558b696379a356a126a6f55",
     "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
     "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
     "rules/policy-shape.ts": "1654730d188b7163dbad3051c75a562198a96eda6d36ce35701f2b729bf45194",
@@ -11,7 +11,7 @@
     "rules/cedc012.ts": "0b69e938c9d7a5f4605e9985e9c7dace35718d9280c1bce63edfec87a8e77c21",
     "rules/cedc013.ts": "cc91a3036aefb467827d35c61119d6d48377169a2ca08e4dd6decd088371a294",
     "rules/cedc014.ts": "6d35587d13e3c686c8447bf3b069a60b2ee1700a8d48a3de75e36e49701c115f",
-    "rules/cede010.ts": "17311a6bcb44187d57f7c3363d1b3a9a055378b8d7963d785b7b713f7ef9a078",
+    "rules/cede010.ts": "05b9fb4645ccd04c8213a81184dd312d29c139dbc6884f226f32667bc5648e04",
     "rules/cede011.ts": "4ada79ed88ce09a66ff08abd5bc236691014a2d5954afdb6e0f19364e8ed3931",
     "rules/ceds010.ts": "215e14de2b84d935ad9551d37c3c06374e5452a5b3f1d7408dc59cd8c2ef1b33",
     "rules/ceds011.ts": "07984e364b431203a34b42de481fad4fc16d2b838f3fa358726759f4a3ebbfe5",
@@ -25,10 +25,10 @@
     "rules/dwde011.ts": "5e7f7dbcd9c581bba614fd5c17dcf1282a0b59caef931997c954cea46522251c",
     "rules/dwds010.ts": "4939f7eb012998d7e27238db777ed7fec2721c2e25df0daec457ff2c62bfa648",
     "rules/wasm-helpers.ts": "c4c3def1669a1818d19ff1864e78bdcbf956da31ca1a6adde7751830765dad6a",
-    "skills/chant-cedar-authoring.md": "1b036a72ef13342d402d0de1a68bec0a6f32365ab8485b95f63a971277fd249f",
+    "skills/chant-cedar-authoring.md": "2eaefdc6f0fb1ba1fed980759d693886dbb7f0197f3eab3330fe518937045831",
     "skills/chant-cedar-avp-embedding.md": "1096cc318374dc0683fae289040b089ffc0c7fa029c6b07d4acc19ebcd118b54",
     "skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a",
     "skills/chant-cedar-dogwood.md": "fc8c9a2ea9cd7bf87037c156b0b419397d46fbf5cd201c09be721249ac91b8da"
   },
-  "composite": "6b519f99d43df0788686d348139b605896f9d9b3e436b6d3aaa97567d567dbbf"
+  "composite": "29b82fe2b0b570781eeb64668f3b8ec56b0371f53d26f132f84715ad07275374"
 }

package/dist/lint/post-synth/cede010.d.ts

@@ -24,10 +24,11 @@
  * When the build emits no schema there is nothing to validate against, and
  * `validate()` cannot be called at all — it has no optional-schema mode, and an
  * empty schema is legal Cedar that reports every policy as inapplicable, which
- * would be worse than useless. Schema-driven codegen is #1650; until a schema
- * is emitted beside the policies, this check says so once, as an advisory,
- * rather than passing silently and claiming a guarantee it did not check.
- * CEDC010's parse gate still applies in that state.
+ * would be worse than useless. A project schema is emitted beside the policies
+ * by the plugin's `buildRoots` hook (#1697, `src/schema-artifact.ts`), so the
+ * no-schema state is now the project with no schema of its own; there this
+ * check says so once, as an advisory, rather than passing silently and
+ * claiming a guarantee it did not check. CEDC010's parse gate still applies.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 export declare const cede010: PostSynthCheck;

package/dist/lint/post-synth/cede010.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cede010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cede010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cAqDrB,CAAC"}
+{"version":3,"file":"cede010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cede010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cAqDrB,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cedar",
-  "version": "0.44.14",
+  "version": "0.45.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Cedar",
   "intrinsics": [],

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,aAyTzB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAwB9G;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,aAiVzB,CAAC"}

package/dist/rules/cede010.ts

@@ -24,10 +24,11 @@
  * When the build emits no schema there is nothing to validate against, and
  * `validate()` cannot be called at all — it has no optional-schema mode, and an
  * empty schema is legal Cedar that reports every policy as inapplicable, which
- * would be worse than useless. Schema-driven codegen is #1650; until a schema
- * is emitted beside the policies, this check says so once, as an advisory,
- * rather than passing silently and claiming a guarantee it did not check.
- * CEDC010's parse gate still applies in that state.
+ * would be worse than useless. A project schema is emitted beside the policies
+ * by the plugin's `buildRoots` hook (#1697, `src/schema-artifact.ts`), so the
+ * no-schema state is now the project with no schema of its own; there this
+ * check says so once, as an advisory, rather than passing silently and
+ * claiming a guarantee it did not check. CEDC010's parse gate still applies.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { parsedPolicySets } from "./cedar-helpers";

package/dist/schema-artifact.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The project schema as a build artifact (#1697).
+ *
+ * CEDE010 can only validate a policy set against a schema the build emitted
+ * beside it, and until now nothing emitted one: the `.cedarschema` drove
+ * codegen and then stayed in the source tree, so every consumer build got the
+ * parse-only advisory. This module closes that gap from two directions.
+ *
+ * `Schema` is a declarable a project can author by hand when it wants a
+ * particular filename or a schema that is not the one in `chant.config.ts`.
+ * `schemaBuildRoot` is the automatic path: the plugin's `buildRoots` hook
+ * contributes one `Schema` entity per build, holding the resolved project
+ * schema, so a project with a `cedar.schema` gets `dist/schema.cedarschema`
+ * and full validation without declaring anything.
+ *
+ * The bundled default schema is never emitted. A project without its own
+ * schema has policies the default may well reject, and CEDE010 failing a
+ * build against a schema the project never wrote would be a worse surprise
+ * than the advisory it replaces.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { BuildRootContext, BuildRootContribution } from "@intentius/chant/lexicon";
+/** The entity type of a {@link Schema}. */
+export declare const CEDAR_SCHEMA_TYPE = "Cedar::Schema";
+/** The logical name the build-root contribution uses. */
+export declare const CEDAR_SCHEMA_ENTITY_NAME = "cedarSchema";
+/** Filename the schema is emitted under when `filename` is unset. */
+export declare const CEDAR_SCHEMA_FILENAME = "schema.cedarschema";
+export interface SchemaProps {
+    /** Human-readable Cedar schema text, emitted verbatim. */
+    text: string;
+    /** Defaults to {@link CEDAR_SCHEMA_FILENAME}. Must end in `.cedarschema`. */
+    filename?: string;
+}
+/** A `.cedarschema` emitted with the policy set, so post-synth validation has something to validate against. */
+export declare const Schema: new (props: SchemaProps) => Declarable;
+/** One schema file the serializer should write. */
+export interface SchemaFile {
+    name: string;
+    filename: string;
+    text: string;
+}
+/** Every `Cedar::Schema` in the entity map, with its props read. */
+export declare function schemaEntities(entities: Map<string, Declarable>): SchemaFile[];
+/**
+ * The `buildRoots` contribution: the project's resolved schema as one
+ * {@link Schema} entity, or nothing when only the bundled default applies.
+ */
+export declare function schemaBuildRoot(ctx: BuildRootContext): Promise<BuildRootContribution>;
+//# sourceMappingURL=schema-artifact.d.ts.map

package/dist/schema-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-artifact.d.ts","sourceRoot":"","sources":["../src/schema-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAQxF,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gHAAgH;AAChH,eAAO,MAAM,MAAM,EAAgE,KAAK,KAAK,EAAE,WAAW,KAAK,UAAU,CAAC;AAE1H,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,UAAU,EAAE,CAc9E;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAQ3F"}

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAY5F,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AASD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACR,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AAwBvB;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAWnF;AAID,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,aAAa,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BxF;AAID,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAiBzF;AAID,eAAO,MAAM,eAAe,EAAE,UAqD7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAa5F,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AASD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACR,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AAwBvB;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAWnF;AAID,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,aAAa,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BxF;AAID,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAiBzF;AAID,eAAO,MAAM,eAAe,EAAE,UAoE7B,CAAC"}

package/dist/skills/chant-cedar-authoring.md

@@ -51,9 +51,15 @@ between "your entity types" and "somebody else's" is invisible.
 ### 2. Run generate
 
 ```bash
-npx chant generate --lexicon cedar
+npx chant cedar generate
 ```
 
+The output is written into the project, at `src/generated/cedar/` (or
+`cedar.outDir`), never into `node_modules`. Commit it or regenerate it in CI;
+re-run it whenever the schema changes. Policies import from that directory,
+not from `@intentius/chant-lexicon-cedar`, whose own `Policy` and classes
+describe the package's bundled sample schema.
+
 That produces, per declaration in the schema:
 
 | Schema declaration | Generated |
@@ -68,7 +74,7 @@ compile error, not a validation error hours later.
 ### 3. Write policies
 
 ```typescript
-import { Policy, ReadAction, WriteAction, type UserUid } from "@intentius/chant-lexicon-cedar";
+import { Policy, ReadAction, WriteAction, type UserUid } from "./generated/cedar";
 
 const archivist: UserUid = 'App::User::"archivist"';
 
@@ -159,7 +165,7 @@ wider grant.
 
 ```bash
 npx chant build                         # emits both artifacts, runs the CED rules
-npx chant coverage --lexicon cedar      # is every schema declaration generated?
+npx chant cedar coverage                # is every schema declaration generated?
 ```
 
 The MCP tool `cedar:coverage` answers the other question: which schema entity

package/dist/spec/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AAEpE,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAItD,6DAA6D;AAC7D,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoB1G;AAED,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAGjF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAK/B"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AAEpE,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAqBtD,6DAA6D;AAC7D,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoB1G;AAED,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAGjF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAK/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-cedar",
-  "version": "0.44.14",
+  "version": "0.45.0",
   "description": "Cedar lexicon for chant — typed authoring for Cedar authorization policies",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.44.14",
+    "@intentius/chant": "^0.45.0",
     "typescript": "^5.9.3"
   }
 }

package/src/avp/OWNERSHIP.md

@@ -127,7 +127,10 @@ trade the decoupling buys, and it is why the two files name each other in prose.
 Unsigned stays the default, and three cases stay unsigned regardless: no signer wired
 in, no credentials resolved, and an endpoint override without `signEndpointOverride`
 (an emulator does not verify signatures, and signing against one would make every local
-lane need credentials to read what it just deployed). `credentialsAvailable` therefore
+lane need credentials to read what it just deployed). An override is the `endpoint`
+option, else `AWS_ENDPOINT_URL_VERIFIEDPERMISSIONS`, else `AWS_ENDPOINT_URL` — the SDK's
+precedence, and the rule the aws lexicon's read client applies (#1694); it is restated
+in `resolveEndpointOverride` for the same reason the signer shapes are. `credentialsAvailable` therefore
 still gates the readers exactly as before — a caller that wires nothing in gets every
 entity NOT-OBSERVED with `no-credentials` rather than a request that was never going to
 work.

package/src/avp/client.test.ts

@@ -11,6 +11,7 @@ import { createHmac } from "node:crypto";
 import { describe, expect, test } from "vitest";
 import {
   avpCall,
+  resolveEndpointOverride,
   resolveAvpCredentials,
   type AvpClientOptions,
   type AvpHttp,
@@ -225,6 +226,40 @@ describe("endpoint overrides", () => {
     expect(signed).toHaveLength(0);
   });
 
+  test("AWS_ENDPOINT_URL_VERIFIEDPERMISSIONS wins over AWS_ENDPOINT_URL, and the option over both (#1694)", async () => {
+    const { http, calls } = recording();
+    const { signer, signed } = stubSigner();
+    const env = { AWS_ENDPOINT_URL: "http://all:1", AWS_ENDPOINT_URL_VERIFIEDPERMISSIONS: "http://avp:2" };
+    await avpCall("ListPolicies", { policyStoreId: "PS-abc" }, { region: "us-west-2", credentials, signer, http, env });
+    await avpCall("ListPolicies", { policyStoreId: "PS-abc" }, {
+      endpoint: "http://opt:3",
+      region: "us-west-2",
+      credentials,
+      signer,
+      http,
+      env,
+    });
+    expect(calls.map((c) => c.url)).toEqual(["http://avp:2/", "http://opt:3/"]);
+    expect(signed).toHaveLength(0);
+    expect(resolveEndpointOverride(undefined, {})).toBeUndefined();
+  });
+
+  test("signEndpointOverride signs against an override the environment named", async () => {
+    const { http, calls } = recording();
+    const { signer, signed } = stubSigner();
+    await avpCall("ListPolicies", { policyStoreId: "PS-abc" }, {
+      region: "us-west-2",
+      credentials,
+      signer,
+      signEndpointOverride: true,
+      now,
+      http,
+      env: { AWS_ENDPOINT_URL: "https://vpce-1234.verifiedpermissions.us-west-2.vpce.amazonaws.com" },
+    });
+    expect(calls[0]!.headers.authorization).toMatch(/Signature=[0-9a-f]{64}$/);
+    expect(signed[0]!.url).toBe("https://vpce-1234.verifiedpermissions.us-west-2.vpce.amazonaws.com/");
+  });
+
   test("signEndpointOverride signs one anyway — for an override that is real AWS", async () => {
     const { http, calls } = recording();
     const { signer, signed } = stubSigner();