@intentius/chant-lexicon-cedar 0.44.14 → 0.46.0

package/src/codegen/generate-cli.ts

@@ -6,13 +6,15 @@
  * schema bundled at `src/spec/default-schema.cedarschema` when there is not
  * (#1650), so this always has something to generate from and no longer needs
  * the scaffold's swallow-and-continue guard.
+ *
+ * This script is the package's own build step, so the project root is the
+ * package root and the output is `src/generated/` (the monorepo case of
+ * `resolveGeneratedDir`). A consumer runs `chant generate --lexicon cedar`
+ * instead, which writes into the consumer's tree (#1696).
  */
-import { generate, writeGeneratedFiles } from "./generate";
-import { dirname } from "path";
-import { fileURLToPath } from "url";
+import { generate, packageDir, resolveGeneratedDir, writeGeneratedFiles } from "./generate";
 
-// <pkg>/src/codegen/generate-cli.ts → three levels up is the package root.
-const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const pkgDir = packageDir();
 
 const result = await generate({ verbose: true, projectRoot: pkgDir });
-writeGeneratedFiles(result, pkgDir);
+writeGeneratedFiles(result, resolveGeneratedDir({ projectRoot: pkgDir }));

package/src/codegen/generate.ts

@@ -16,8 +16,10 @@
 import { generatePipeline, writeGeneratedArtifacts } from "@intentius/chant/codegen/generate";
 import type { GenerateOptions, GenerateResult } from "@intentius/chant/codegen/generate";
 import type { NamingStrategy } from "@intentius/chant/codegen/naming";
-import { dirname } from "path";
+import { existsSync, realpathSync } from "fs";
+import { dirname, isAbsolute, resolve } from "path";
 import { fileURLToPath } from "url";
+import { CEDAR_DEFAULT_OUT_DIR } from "../config";
 import { createNaming } from "./naming";
 import {
   buildEmitModel,
@@ -34,11 +36,54 @@ import { assertPinnedLangVersion, assertPinnedSchema } from "../spec/pin";
 /** Filename of the generated registry. */
 export const LEXICON_JSON_FILENAME = "lexicon-cedar.json";
 
+/** The slice of the `cedar` config namespace generation reads. */
+export interface CedarGenerateConfig {
+  schema?: string;
+  outDir?: string;
+  validation?: { requireProjectSchema?: boolean };
+}
+
 export interface CedarGenerateOptions extends GenerateOptions {
   /** Project root the `cedar.schema` path is resolved against. Defaults to `process.cwd()`. */
   projectRoot?: string;
   /** The `cedar` config namespace, when the caller has already loaded it. */
-  config?: { schema?: string; validation?: { requireProjectSchema?: boolean } };
+  config?: CedarGenerateConfig;
+}
+
+/** This package's root. `<pkg>/src/codegen/generate.ts` is three levels down. */
+export function packageDir(): string {
+  return dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+}
+
+function samePath(a: string, b: string): boolean {
+  const real = (p: string): string => (existsSync(p) ? realpathSync(p) : resolve(p));
+  return real(a) === real(b);
+}
+
+/**
+ * Where generated artifacts go (#1696).
+ *
+ * Three cases, in order:
+ *
+ *   1. `cedar.outDir` is set: that directory, resolved against the project root.
+ *   2. The project root *is* this package (the monorepo checkout, `npm run
+ *      generate`, `chant dev check-lexicon`): `<pkg>/src/generated`, which
+ *      `src/index.ts` re-exports so the package's own surface stays whole.
+ *   3. Anything else is a consumer: `<project>/src/generated/cedar`.
+ *
+ * Case 2 is what the old code assumed everywhere. A consumer's project root
+ * and the installed package are different directories, and writing into the
+ * second means the output is gone after `npm ci`.
+ */
+export function resolveGeneratedDir(options: { projectRoot?: string; config?: CedarGenerateConfig } = {}): string {
+  const root = options.projectRoot ?? process.cwd();
+  const configured = options.config?.outDir;
+  if (configured) return isAbsolute(configured) ? configured : resolve(root, configured);
+
+  const pkg = packageDir();
+  if (samePath(root, pkg)) return resolve(pkg, "src", "generated");
+
+  return resolve(root, CEDAR_DEFAULT_OUT_DIR);
 }
 
 /**
@@ -104,20 +149,24 @@ export async function generate(options: CedarGenerateOptions = {}): Promise<Gene
   return result;
 }
 
+/** The files one generate run produces, keyed by filename. */
+export function generatedFiles(result: GenerateResult): Record<string, string> {
+  return {
+    [LEXICON_JSON_FILENAME]: result.lexiconJSON,
+    "index.d.ts": result.typesDTS,
+    "index.ts": result.indexTS,
+    ...(result.extraArtifacts ?? {}),
+  };
+}
+
 /**
- * Write generated files to the package directory.
+ * Write generated files into `outDir`. With no directory given, writes where
+ * {@link resolveGeneratedDir} says for the current working directory.
  */
-export function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void {
-  // This module lives at <pkg>/src/codegen/generate.ts, so the package root is
-  // three levels up — the scaffold's two-level default wrote into src/src/.
-  const dir = pkgDir ?? dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+export function writeGeneratedFiles(result: GenerateResult, outDir?: string): void {
   writeGeneratedArtifacts({
-    baseDir: dir,
-    files: {
-      [LEXICON_JSON_FILENAME]: result.lexiconJSON,
-      "index.d.ts": result.typesDTS,
-      "index.ts": result.indexTS,
-      ...(result.extraArtifacts ?? {}),
-    },
+    baseDir: outDir ?? resolveGeneratedDir(),
+    generatedSubdir: ".",
+    files: generatedFiles(result),
   });
 }

package/src/codegen/output-dir.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Where `generate()` writes (#1696).
+ *
+ * The bug: the output went into this package's `src/generated/` no matter who
+ * ran it, so a consumer's classes lived in `node_modules` and vanished on
+ * `npm ci`. These tests generate into a throwaway project and check that
+ * nothing lands under the package or under any `node_modules`.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { generate, generatedFiles, packageDir, resolveGeneratedDir, writeGeneratedFiles } from "./generate";
+import { CEDAR_DEFAULT_OUT_DIR } from "../config";
+
+const pkgDir = packageDir();
+
+const PROJECT_SCHEMA = `namespace Shop {
+  entity Customer = { "email": String };
+  entity Order = { "owner": Customer, "total": Long };
+  action view, cancel appliesTo {
+    principal: [Customer],
+    resource: [Order],
+    context: { "mfa": Bool }
+  };
+}
+`;
+
+/** Every file under `dir`, relative, sorted. */
+function tree(dir: string): string[] {
+  if (!existsSync(dir)) return [];
+  const out: string[] = [];
+  const walk = (d: string, prefix: string): void => {
+    for (const entry of readdirSync(d).sort()) {
+      const full = join(d, entry);
+      const rel = prefix ? `${prefix}/${entry}` : entry;
+      if (statSync(full).isDirectory()) walk(full, rel);
+      else out.push(rel);
+    }
+  };
+  walk(dir, "");
+  return out;
+}
+
+/** Modification times of the package's own generated files, to prove they were not touched. */
+function packageGeneratedMtimes(): Map<string, number> {
+  const dir = join(pkgDir, "src", "generated");
+  return new Map(tree(dir).map((f) => [f, statSync(join(dir, f)).mtimeMs]));
+}
+
+describe("resolveGeneratedDir", () => {
+  it("keeps the package's own output at src/generated when the project is the package", () => {
+    expect(resolveGeneratedDir({ projectRoot: pkgDir })).toBe(resolve(pkgDir, "src", "generated"));
+  });
+
+  it("sends a consumer project to src/generated/cedar under its own root", () => {
+    const root = join(tmpdir(), "some-consumer");
+    expect(resolveGeneratedDir({ projectRoot: root })).toBe(resolve(root, CEDAR_DEFAULT_OUT_DIR));
+  });
+
+  it("honours cedar.outDir, relative to the project root", () => {
+    const root = join(tmpdir(), "some-consumer");
+    expect(resolveGeneratedDir({ projectRoot: root, config: { outDir: "authz/generated" } })).toBe(
+      resolve(root, "authz", "generated"),
+    );
+  });
+
+  it("honours an absolute cedar.outDir as given", () => {
+    const abs = join(tmpdir(), "elsewhere");
+    expect(resolveGeneratedDir({ projectRoot: pkgDir, config: { outDir: abs } })).toBe(abs);
+  });
+
+  it("never resolves a consumer into the installed package", () => {
+    // The shape of the bug: a consumer whose node_modules holds this package.
+    const root = join(tmpdir(), "consumer");
+    const dir = resolveGeneratedDir({ projectRoot: root });
+    expect(dir.startsWith(root)).toBe(true);
+    expect(dir.includes("node_modules")).toBe(false);
+    expect(dir.startsWith(pkgDir)).toBe(false);
+  });
+});
+
+describe("writeGeneratedFiles into a consumer project", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "cedar-consumer-"));
+    mkdirSync(join(root, "node_modules", "@intentius", "chant-lexicon-cedar", "src"), { recursive: true });
+    writeFileSync(join(root, "schema.cedarschema"), PROJECT_SCHEMA);
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("writes the project's classes under the project, and nothing under node_modules or the package", async () => {
+    const before = packageGeneratedMtimes();
+
+    const result = await generate({ projectRoot: root });
+    const outDir = resolveGeneratedDir({ projectRoot: root });
+    writeGeneratedFiles(result, outDir);
+
+    expect(tree(outDir)).toEqual(["index.d.ts", "index.ts", "lexicon-cedar.json", "runtime.ts"]);
+    expect(tree(join(root, "node_modules"))).toEqual([]);
+    expect(packageGeneratedMtimes()).toEqual(before);
+
+    // And what was written is the project's schema, not the bundled default.
+    const index = readFileSync(join(outDir, "index.ts"), "utf-8");
+    expect(index).toContain('"Shop::Order"');
+    expect(index).toContain("CancelAction");
+    expect(index).not.toContain('"App::Document"');
+  });
+
+  it("is self-contained: the generated tree imports only from @intentius/chant", async () => {
+    // A consumer's copy cannot reach back into this package by relative path.
+    const result = await generate({ projectRoot: root });
+    for (const [name, content] of Object.entries(generatedFiles(result))) {
+      if (!name.endsWith(".ts")) continue;
+      const specifiers = [...content.matchAll(/from\s+"([^"]+)"/g)].map((m) => m[1]);
+      for (const spec of specifiers) {
+        expect(spec === "./runtime" || spec.startsWith("@intentius/chant/"), `${name} imports ${spec}`).toBe(true);
+      }
+    }
+  });
+
+  it("follows cedar.outDir when the config sets one", async () => {
+    const config = { schema: "schema.cedarschema", outDir: "src/authz/generated" };
+    const result = await generate({ projectRoot: root, config });
+    const outDir = resolveGeneratedDir({ projectRoot: root, config });
+    writeGeneratedFiles(result, outDir);
+
+    expect(outDir).toBe(join(root, "src", "authz", "generated"));
+    expect(existsSync(join(outDir, "index.ts"))).toBe(true);
+    expect(existsSync(join(root, CEDAR_DEFAULT_OUT_DIR))).toBe(false);
+  });
+});

package/src/commands.test.ts

@@ -0,0 +1,93 @@
+/**
+ * `chant cedar generate` / `chant cedar coverage` (#1696).
+ *
+ * Runs the handlers against a throwaway project, with `process.cwd()` pointed
+ * at it the way core's dispatcher would, and checks the output lands in the
+ * project tree.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { RESERVED_COMMAND_NAMES } from "@intentius/chant/cli/command-group";
+import { cedarCommandGroup } from "./commands";
+import { cedarPlugin } from "./plugin";
+import { packageDir } from "./codegen/generate";
+
+const SCHEMA = `namespace Shop {
+  entity Customer = { "email": String };
+  entity Order = { "owner": Customer };
+  action view appliesTo {
+    principal: [Customer],
+    resource: [Order],
+    context: { "mfa": Bool }
+  };
+}
+`;
+
+function verb(name: string) {
+  const command = cedarCommandGroup().commands.find((c) => c.name === name);
+  if (!command) throw new Error(`no verb ${name}`);
+  return command;
+}
+
+describe("the cedar command group", () => {
+  it("mounts under a name core does not reserve, with generate and coverage", () => {
+    const group = cedarCommandGroup();
+    expect(group.name).toBe("cedar");
+    expect(RESERVED_COMMAND_NAMES.has(group.name)).toBe(false);
+    expect(group.commands.map((c) => c.name)).toEqual(["generate", "coverage"]);
+    expect(cedarPlugin.commands?.().name).toBe("cedar");
+  });
+
+  it("rejects flags it does not know, naming the ones it does", async () => {
+    await expect(verb("generate").handler({ verb: "generate", rawArgs: ["--bogus"] })).rejects.toThrow(
+      /Unknown flag: --bogus[\s\S]*--out-dir/,
+    );
+  });
+});
+
+describe("chant cedar generate in a consumer project", () => {
+  let root: string;
+  const cwd = process.cwd();
+  let stderr: ReturnType<typeof vi.spyOn>;
+
+  beforeEach(() => {
+    root = realpathSync(mkdtempSync(join(tmpdir(), "cedar-cli-")));
+    writeFileSync(join(root, "schema.cedarschema"), SCHEMA);
+    writeFileSync(join(root, "chant.config.json"), JSON.stringify({ lexicons: ["cedar"] }));
+    process.chdir(root);
+    stderr = vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.chdir(cwd);
+    stderr.mockRestore();
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("writes src/generated/cedar under the project and leaves the package alone", async () => {
+    const pkgIndex = join(packageDir(), "src", "generated", "index.ts");
+    const before = readFileSync(pkgIndex, "utf-8");
+
+    expect(await verb("generate").handler({ verb: "generate", rawArgs: [] })).toBe(0);
+
+    const index = join(root, "src", "generated", "cedar", "index.ts");
+    expect(existsSync(index)).toBe(true);
+    expect(readFileSync(index, "utf-8")).toContain('"Shop::Order"');
+    expect(readFileSync(pkgIndex, "utf-8")).toBe(before);
+    expect(existsSync(join(root, "node_modules"))).toBe(false);
+  });
+
+  it("takes --out-dir over the default", async () => {
+    expect(await verb("generate").handler({ verb: "generate", rawArgs: ["--out-dir=authz/gen"] })).toBe(0);
+    expect(existsSync(join(root, "authz", "gen", "index.ts"))).toBe(true);
+    expect(existsSync(join(root, "src", "generated"))).toBe(false);
+  });
+
+  it("reports coverage against what generate wrote", async () => {
+    await verb("generate").handler({ verb: "generate", rawArgs: [] });
+    expect(await verb("coverage").handler({ verb: "coverage", rawArgs: ["--min-overall", "100"] })).toBe(0);
+  });
+});

package/src/commands.ts

@@ -0,0 +1,95 @@
+/**
+ * `chant cedar <verb>` — the consumer-facing surface over this lexicon's
+ * codegen (#1696), mounted through the command-group seam (#1078).
+ *
+ * `chant dev generate` exists, but it is lexicon development: it runs every
+ * configured lexicon's generate, validate and coverage in turn, and for a
+ * project that also lists `aws` that means fetching the CloudFormation spec.
+ * A consumer regenerating its own Cedar classes after a schema edit wants one
+ * lexicon, one step, and an output path it can see.
+ */
+
+import type { CommandGroup, CommandGroupContext } from "@intentius/chant/cli/command-group";
+import { splitJoinedFlags, unknownFlagError } from "@intentius/chant/cli/command-group";
+
+interface ParsedFlags {
+  outDir?: string;
+  verbose: boolean;
+  minOverall?: number;
+}
+
+function parseFlags(verb: string, raw: string[], accept: ReadonlySet<string>): ParsedFlags {
+  const args = splitJoinedFlags(raw, new Set(["--verbose", "-v"]));
+  const flags: ParsedFlags = { verbose: false };
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if ((a === "--verbose" || a === "-v") && accept.has("--verbose")) {
+      flags.verbose = true;
+    } else if (a === "--out-dir" && accept.has("--out-dir")) {
+      const value = args[++i];
+      if (!value) throw new Error(`--out-dir needs a directory.`);
+      flags.outDir = value;
+    } else if (a === "--min-overall" && accept.has("--min-overall")) {
+      const value = Number(args[++i]);
+      if (!Number.isFinite(value)) throw new Error(`--min-overall needs a number.`);
+      flags.minOverall = value;
+    } else {
+      const hint = `"chant cedar ${verb}" accepts ${[...accept].join(", ")}.`;
+      throw unknownFlagError(a, hint);
+    }
+  }
+  return flags;
+}
+
+async function generateHandler(ctx: CommandGroupContext): Promise<number> {
+  const flags = parseFlags("generate", ctx.rawArgs, new Set(["--out-dir", "--verbose"]));
+  const { generate, resolveGeneratedDir, writeGeneratedFiles } = await import("./codegen/generate");
+  const { loadCedarProject } = await import("./config");
+
+  const project = await loadCedarProject(process.cwd());
+  // A flag beats the config, and both beat the default — the same order
+  // `cedar.schema` follows one level down.
+  const config = flags.outDir ? { ...project.config, outDir: flags.outDir } : project.config;
+  const result = await generate({ verbose: flags.verbose, projectRoot: project.projectRoot, config });
+  const outDir = resolveGeneratedDir({ projectRoot: project.projectRoot, config });
+  writeGeneratedFiles(result, outDir);
+  console.error(`cedar: generated ${result.resources} declaration(s) into ${outDir}`);
+  return 0;
+}
+
+async function coverageHandler(ctx: CommandGroupContext): Promise<number> {
+  const flags = parseFlags("coverage", ctx.rawArgs, new Set(["--min-overall", "--verbose"]));
+  const { analyzeCedarCoverage } = await import("./coverage");
+  const { resolveGeneratedDir } = await import("./codegen/generate");
+  const { loadCedarProject } = await import("./config");
+
+  const { projectRoot, config } = await loadCedarProject(process.cwd());
+  analyzeCedarCoverage({
+    projectRoot,
+    config,
+    generatedDir: resolveGeneratedDir({ projectRoot, config }),
+    verbose: flags.verbose,
+    minOverall: flags.minOverall,
+  });
+  return 0;
+}
+
+/** The `chant cedar` verb group. */
+export function cedarCommandGroup(): CommandGroup {
+  return {
+    name: "cedar",
+    description: "Schema-driven codegen for a project's Cedar policies: generate typed classes into the project, check schema coverage",
+    commands: [
+      {
+        name: "generate",
+        description: "Read the project's .cedarschema and write typed classes into cedar.outDir (default src/generated/cedar)",
+        handler: generateHandler,
+      },
+      {
+        name: "coverage",
+        description: "Report which schema declarations the generated classes cover",
+        handler: coverageHandler,
+      },
+    ],
+  };
+}

package/src/config.ts

@@ -32,6 +32,17 @@ import type { ChantConfig } from "@intentius/chant/config";
  */
 export const CEDAR_DEFAULT_SCHEMA_PATH = "schema.cedarschema";
 
+/**
+ * Where `generate()` writes when `cedar.outDir` is unset and the project is a
+ * consumer of the published package (#1696).
+ *
+ * Relative to the project root. Inside this lexicon's own checkout the
+ * package directory *is* the project root, and the output stays at
+ * `src/generated/` so `src/index.ts` can re-export it; see
+ * `resolveGeneratedDir` in `codegen/generate.ts`.
+ */
+export const CEDAR_DEFAULT_OUT_DIR = "src/generated/cedar";
+
 /**
  * `strictObject`, not `object`. Core applies `.strict()` to the top level of a
  * declared namespace itself; `validation` is nested, and is the lexicon's own
@@ -47,6 +58,19 @@ export const cedarConfigSchema = z.strictObject({
    */
   schema: z.string().optional(),
 
+  /**
+   * Directory `generate()` writes the typed classes into, relative to the
+   * project root. Defaults to {@link CEDAR_DEFAULT_OUT_DIR}.
+   *
+   * The output used to land in the installed package's own `src/generated/`,
+   * which `npm ci` wipes (#1696). It is the project's artifact — the classes
+   * describe the project's schema, not the package's — so it lives in the
+   * project tree, and `src/policies.ts` imports from it rather than from
+   * `@intentius/chant-lexicon-cedar`. Commit it or regenerate it in CI; either
+   * way it is never under `node_modules`.
+   */
+  outDir: z.string().optional(),
+
   /**
    * Knobs for the `cedar-wasm` validator. `mode` is a single-variant enum on
    * purpose: `ValidationMode` in cedar-wasm 4.12.0 accepts `"strict"` and
@@ -122,7 +146,7 @@ export type CedarConfigNamespace = NonNullable<ChantConfig["cedar"]>;
 /**
  * Read the `cedar` namespace out of the project's config.
  *
- * Searches upward from `startDir`, so `chant generate` finds the config from a
+ * Searches upward from `startDir`, so `chant cedar generate` finds the config from a
  * subdirectory the same way `chant build` does. A project with no config, or
  * one with no `cedar` key, gets `{}` — the schema resolution order in
  * `spec/fetch.ts` handles that case without needing to know why.
@@ -133,15 +157,37 @@ export type CedarConfigNamespace = NonNullable<ChantConfig["cedar"]>;
  * never loaded.
  */
 export async function loadCedarConfig(startDir: string): Promise<CedarConfig> {
+  return (await loadCedarProject(startDir)).config;
+}
+
+/** A project as cedar's commands see it: the root paths resolve against, and the namespace. */
+export interface CedarProject {
+  /** The directory holding `chant.config.*`, or `startDir` when there is none. */
+  projectRoot: string;
+  config: CedarConfig;
+}
+
+/**
+ * {@link loadCedarConfig}, plus the directory the config was found in.
+ *
+ * `cedar.schema` and `cedar.outDir` are relative to the config file, not to
+ * wherever the command was run (#1696) — `chant cedar generate` from a subdirectory
+ * has to write to the same place as the same command from the root.
+ */
+export async function loadCedarProject(startDir: string): Promise<CedarProject> {
   const { loadChantConfigUpward } = await import("@intentius/chant/config");
+  const { dirname } = await import("path");
   try {
-    const { config } = await loadChantConfigUpward(startDir);
+    const { config, configPath } = await loadChantConfigUpward(startDir);
     const parsed = cedarConfigSchema.safeParse(config.cedar ?? {});
-    return parsed.success ? parsed.data : {};
+    return {
+      projectRoot: configPath ? dirname(configPath) : startDir,
+      config: parsed.success ? parsed.data : {},
+    };
   } catch {
     // A project whose config does not load is not this function's problem to
     // report — every other command reports it first, and generation falling
     // back to the bundled schema is the same behaviour as having no config.
-    return {};
+    return { projectRoot: startDir, config: {} };
   }
 }

package/src/index.ts

@@ -139,8 +139,16 @@ export type { PackageOptions, PackageResult } from "./codegen/package";
 
 // The `cedar` config namespace (#1344). Importing this package is what brings
 // the key into ChantConfig, so a `chant.config.ts` that sets it compiles.
-export { cedarConfigSchema, loadCedarConfig, CEDAR_DEFAULT_SCHEMA_PATH } from "./config";
-export type { CedarConfig } from "./config";
+export { cedarConfigSchema, loadCedarConfig, loadCedarProject, CEDAR_DEFAULT_SCHEMA_PATH, CEDAR_DEFAULT_OUT_DIR } from "./config";
+export type { CedarConfig, CedarProject } from "./config";
+
+// Where `chant cedar generate` writes for a project (#1696).
+export { resolveGeneratedDir } from "./codegen/generate";
+
+// The project schema as a build artifact (#1697): authored by hand as
+// `new Schema({ text })`, or contributed automatically from `cedar.schema`.
+export { Schema, CEDAR_SCHEMA_TYPE, CEDAR_SCHEMA_FILENAME } from "./schema-artifact";
+export type { SchemaProps } from "./schema-artifact";
 
 // Upstream pin — the cedar-wasm package version and the Cedar language
 // version it implements (#1650).

package/src/init-templates.test.ts

@@ -48,10 +48,13 @@ function generatedNames(schemaText: string): Set<string> {
   return names;
 }
 
-/** Identifiers a policy file imports from the lexicon package (any subpath). */
+/**
+ * Identifiers a policy file imports from the lexicon package (any subpath) or
+ * from the project's generated tree, `./generated/cedar` (#1696).
+ */
 function importedNames(source: string): string[] {
   const names: string[] = [];
-  const importRe = /import\s+(?:type\s+)?\{([^}]+)\}\s+from\s+"@intentius\/chant-lexicon-cedar[^"]*"/g;
+  const importRe = /import\s+(?:type\s+)?\{([^}]+)\}\s+from\s+"(?:@intentius\/chant-lexicon-cedar[^"]*|\.\/generated\/cedar)"/g;
   for (const match of source.matchAll(importRe)) {
     for (const raw of match[1].split(",")) {
       const name = raw.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0].trim();
@@ -101,14 +104,29 @@ describe("cedarInitTemplates", () => {
 
       it("ships a policy file and a README", () => {
         expect(policies).toContain("export const");
-        expect(set.root?.["README.md"]).toContain("chant generate --lexicon cedar");
+        expect(set.root?.["README.md"]).toContain("chant cedar generate");
       });
 
       it("wires the generate and build scripts into package.json", () => {
-        expect(set.scripts?.generate).toBe("chant generate --lexicon cedar");
+        expect(set.scripts?.generate).toBe("chant cedar generate");
         expect(set.scripts?.build).toBe("chant build");
       });
 
+      it("imports its schema-derived names from the project tree, not the package (#1696)", () => {
+        // The package's own `src/generated` describes the bundled default
+        // schema. A scaffold typed against that would compile with no
+        // generate step and be wrong about its own entity model.
+        const available = generatedNames(schemaText);
+        const fromPackage = /import\s+(?:type\s+)?\{([^}]+)\}\s+from\s+"@intentius\/chant-lexicon-cedar[^"]*"/g;
+        for (const match of policies.matchAll(fromPackage)) {
+          for (const raw of match[1].split(",")) {
+            const name = raw.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0].trim();
+            expect(available.has(name), `${template}: ${name} should come from ./generated/cedar`).toBe(false);
+          }
+        }
+        expect(policies).toMatch(/from "\.\/generated\/cedar"/);
+      });
+
       it("imports only names its own schema generates", () => {
         const available = generatedNames(schemaText);
         const missing = importedNames(policies).filter(