@intentius/chant-lexicon-cedar 0.44.8 → 0.44.10

package/dist/dogwood/policy.d.ts

@@ -0,0 +1,120 @@
+/**
+ * The dogwood entity model: a temporal policy, an event schema, a macro library.
+ *
+ * `Dogwood::TemporalPolicy` is `Cedar::Policy` plus the two clause forms
+ * upstream's policy grammar adds. Its head — annotations, effect, the three
+ * scope positions — is Cedar's, byte for byte, which is why `./serialize.ts`
+ * renders it with the cedar serializer's own `renderPolicyHead` rather than a
+ * copy of it. Only the `cond` rule differs:
+ *
+ * ```
+ * cond = { cond_kw ~ (extension_marker | guardrails_tag? ~ "{" ~ expr ~ "}") }
+ * ```
+ *
+ * — so a clause is `when { … }`, `when guardrails { … }`, or
+ * `when temporal { … }`, and the same three under `unless`. `guardrails` is
+ * transparent sugar for a bare Cedar expression (upstream discards the tag
+ * during lowering); `temporal { … }` is a genuine sub-language dispatched to a
+ * different parser.
+ *
+ * These are not schema-driven the way `Cedar::Policy`'s generated class is.
+ * Codegen's input is the project's `.cedarschema`, which says nothing about
+ * event kinds or temporal operators, so the dialect's classes are written here
+ * and typed against the builders in `./temporal.ts`.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { CedarEffect, CedarScope } from "../serializer.js";
+import type { TemporalCondition } from "./temporal.js";
+import type { EventSchema } from "./event-schema.js";
+import type { MacroDefinition } from "./macros.js";
+/** The lexicon these entities belong to — dogwood is a dialect of cedar, not a lexicon. */
+export declare const DOGWOOD_LEXICON = "cedar";
+/** The `entityType` of a temporal policy. */
+export declare const DOGWOOD_POLICY_TYPE = "Dogwood::TemporalPolicy";
+/** The `entityType` of an event schema. */
+export declare const DOGWOOD_EVENT_SCHEMA_TYPE = "Dogwood::EventSchema";
+/** The `entityType` of a macro library. */
+export declare const DOGWOOD_MACRO_LIBRARY_TYPE = "Dogwood::MacroLibrary";
+/** The `.dw` policy set written beside the cedar outputs. */
+export declare const DOGWOOD_POLICY_FILENAME = "policies.dw";
+/** The `.dwschema` event schema — what `dogwood validate --event-schema` reads. */
+export declare const DOGWOOD_EVENT_SCHEMA_FILENAME = "events.dwschema";
+/** The macro library — what `dogwood validate --macros` reads. */
+export declare const DOGWOOD_MACRO_FILENAME = "macros.dw";
+/**
+ * The props of a `Dogwood::TemporalPolicy`.
+ *
+ * The first six mirror `CedarPolicyProps` exactly. The rest are the dialect's.
+ */
+export interface TemporalPolicyProps {
+    /** Defaults to `permit` when omitted. */
+    effect?: CedarEffect;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    principal?: CedarScope;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    action?: CedarScope;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    resource?: CedarScope;
+    /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+    when?: string[];
+    /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+    unless?: string[];
+    /** Emitted as `@key("value")`; an explicit `id` wins over the logical name. */
+    annotations?: Record<string, string>;
+    /** Each emitted as its own `when temporal { … }` clause. */
+    whenTemporal?: TemporalCondition[];
+    /** Each emitted as its own `unless temporal { … }` clause. */
+    unlessTemporal?: TemporalCondition[];
+    /**
+     * Cedar expression strings emitted as `when guardrails { … }`.
+     *
+     * The tag carries no separate grammar — upstream parses the body as an
+     * ordinary Cedar expression and discards the tag when lowering. It marks a
+     * clause as a guardrail for a human reader and for whatever reads the source
+     * after chant; it does not change what the policy means.
+     */
+    whenGuardrails?: string[];
+    /** As {@link whenGuardrails}, negated. */
+    unlessGuardrails?: string[];
+}
+/**
+ * A temporal policy. Declare one per policy, the same way as `Cedar::Policy`:
+ *
+ * ```ts
+ * export const readAfterLogin = new TemporalPolicy({
+ *   action: { eq: 'Drupe::Action::"Read"' },
+ *   whenTemporal: [
+ *     formerly("1h", predicate('Drupe::Action::"Login"', "response", {
+ *       "input.user": ctx("input.user"),
+ *     })),
+ *   ],
+ * });
+ * ```
+ */
+export declare const TemporalPolicy: new (props: TemporalPolicyProps) => Declarable;
+/** The props of a `Dogwood::EventSchema`. */
+export interface EventSchemaProps {
+    /** Built with `eventSchema()` or `defaultEventSchema()`. */
+    schema: EventSchema;
+    /** Defaults to {@link DOGWOOD_EVENT_SCHEMA_FILENAME}. */
+    filename?: string;
+}
+/** The service half of the schema, emitted as `.dwschema` text. */
+export declare const TemporalEventSchema: new (props: EventSchemaProps) => Declarable;
+/** The props of a `Dogwood::MacroLibrary`. */
+export interface MacroLibraryProps {
+    macros: MacroDefinition[];
+    /** Defaults to {@link DOGWOOD_MACRO_FILENAME}. Ignored when `inline` is set. */
+    filename?: string;
+    /**
+     * Emit the definitions at the top of the policy set instead of into their own
+     * file.
+     *
+     * A policy set's own `def` shadows a same-named library macro, so inlining is
+     * how a project stops depending on whoever runs the CLI passing `--macros`.
+     */
+    inline?: boolean;
+}
+/** A `def cedar` / `def temporal` library, emitted as `.dw` text. */
+export declare const TemporalMacroLibrary: new (props: MacroLibraryProps) => Declarable;
+//# sourceMappingURL=policy.d.ts.map

package/dist/dogwood/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/dogwood/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD,2FAA2F;AAC3F,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,2CAA2C;AAC3C,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAElE,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,oBAAoB,CAAC;AAE/D,kEAAkE;AAClE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACnC,8DAA8D;IAC9D,cAAc,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,EAA0E,KACnG,KAAK,EAAE,mBAAmB,KACvB,UAAU,CAAC;AAEhB,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,WAAW,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAgF,KAC9G,KAAK,EAAE,gBAAgB,KACpB,UAAU,CAAC;AAEhB,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,EAAiF,KAChH,KAAK,EAAE,iBAAiB,KACrB,UAAU,CAAC"}

package/dist/dogwood/replay-activity.d.ts

@@ -0,0 +1,196 @@
+/**
+ * `dogwoodReplay` / `dogwoodReplayReport` — the replay half of PolicyReplayOp
+ * (#1661, epic #1646).
+ *
+ * Contributed the way the fly lexicon contributes `flyApply`: a plain exported
+ * async function taking one args object, re-exported from
+ * `src/op/activities/index.ts`, resolved **by name** by core's activity
+ * registry when a project lists the `cedar` lexicon. There is no Temporal
+ * import here and no Temporal dependency in the package — the local executor
+ * runs it as-is, and a Temporal worker registers the same function.
+ *
+ * What it does: takes a policy bundle (inline text or paths), an event trace
+ * (typed events, inline text, or a path) and a set of expectations, runs
+ * `dogwood replay --format json` through the existing CLI adapter in
+ * `./cli.ts`, and returns a typed divergence report — expected versus actual
+ * verdict per decision point, with the determining rules and per-evaluation
+ * errors carried through.
+ *
+ * Three contract details from the #1657 verification shape the code:
+ *
+ * - **Replay exits 0 even when every verdict is DENY.** A nonzero exit means
+ *   the trace or the policy set failed to load. `./cli.ts` already refuses to
+ *   read exit codes as verdicts; this module refuses to read a DENY as a
+ *   failure.
+ * - **A run that could not happen is not a run that found nothing.** An
+ *   unusable invocation or a fatal (a malformed trace line, an unparseable
+ *   policy set) throws, so the step fails instead of reporting zero
+ *   divergences.
+ * - **`index` is the decision-stream position, not the trace line number.** A
+ *   history-only event contributes history and no verdict, so expectations
+ *   written against trace lines would silently address the wrong decision.
+ *   Expectations therefore match on `timestamp` by default, and on `index`
+ *   only when the caller says so.
+ *
+ * The trace input is deliberately generic. An AgentCore session/decision
+ * history is the follow-on source (it needs the aws lexicon's activity
+ * surface, out of scope here) — a trace is a trace, wherever it came from.
+ */
+import { type DogwoodBundle, type DogwoodVerdict } from "./cli.js";
+import { type TraceEvent, type TraceIssue } from "./trace.js";
+/** What a replay produces on divergence, mirroring `WorkflowAuditOp`'s modes. */
+export type PolicyReplayMode = "report" | "issue" | "pull-request";
+/** A verdict a decision point is expected to reach. */
+export type ExpectedVerdict = "allow" | "deny";
+/**
+ * One expectation against the decision stream.
+ *
+ * Give a `timestamp` (the `@<n>` of the line) or an `index` (the 0-based
+ * position in the decision stream). Prefer `timestamp`: it survives a trace
+ * gaining a history-only event, which shifts every later index.
+ */
+export interface ReplayExpectation {
+    readonly timestamp?: number;
+    readonly index?: number;
+    readonly verdict: ExpectedVerdict;
+    /** When set, the `.dw` rule indices the decision must be determined by. */
+    readonly determiningRules?: readonly number[];
+    /** What this decision point is proving, carried into the report. */
+    readonly note?: string;
+}
+/** One expected-versus-actual mismatch. */
+export interface ReplayDivergence {
+    /** Decision-stream index. `-1` when the expected decision point never occurred. */
+    readonly index: number;
+    readonly timestamp: number;
+    /** Absent when the replay produced a decision nothing expected. */
+    readonly expected?: ExpectedVerdict;
+    /** Absent when an expected decision point produced no verdict at all. */
+    readonly actual?: ExpectedVerdict;
+    readonly determiningRules: readonly number[];
+    readonly errors: readonly string[];
+    readonly detail: string;
+    readonly note?: string;
+}
+/** What `dogwoodReplay` returns and `dogwoodReplayReport` reads back. */
+export interface PolicyReplayReport {
+    /** True when nothing diverged and no decision point errored. */
+    readonly ok: boolean;
+    readonly mode: PolicyReplayMode;
+    /** Every decision point, in stream order. */
+    readonly verdicts: readonly DogwoodVerdict[];
+    readonly divergences: readonly ReplayDivergence[];
+    /** Divergence count — the number a search attribute or a gate reads. */
+    readonly findings: number;
+    /** Trace weaknesses found by `auditTrace`, when typed events were supplied. */
+    readonly traceIssues: readonly TraceIssue[];
+    /** Markdown, used as the report body or an issue/PR body. */
+    readonly summary: string;
+}
+/** What `dogwoodReplay` takes. Every artifact is inline text or a path. */
+export interface DogwoodReplayArgs {
+    /** `.dw` policy set text. */
+    policies?: string;
+    /** …or a path to it. Relative paths resolve against {@link cwd}. */
+    policiesPath?: string;
+    /** Cedar action schema text (`--policy-schema`). Not optional to the CLI. */
+    policySchema?: string;
+    policySchemaPath?: string;
+    /** `.dwschema` event schema text (`--event-schema`). */
+    eventSchema?: string;
+    eventSchemaPath?: string;
+    /** `.dw` macro library text (`--macros`). */
+    macros?: string;
+    macrosPath?: string;
+    /** `providers.json` text (`--providers`). Rhai must be inlined under `implementation.script`. */
+    providers?: string;
+    providersPath?: string;
+    /** Typed events — rendered here, and audited for the both-bags trap. */
+    traceEvents?: readonly TraceEvent[];
+    /** …or the trace text as it would appear in a `.log`. */
+    trace?: string;
+    /** …or a path to it. */
+    tracePath?: string;
+    /**
+     * Event kinds that decide, for the trace audit. Default `["request"]` — the
+     * truth is whichever kinds the `.dwschema` marks `decision`.
+     */
+    traceDecisionKinds?: readonly string[];
+    /** What each decision point must decide. An empty list replays and reports. */
+    expect?: readonly ReplayExpectation[];
+    /** Default `report`. */
+    mode?: PolicyReplayMode;
+    /** Explicit binary path. Otherwise resolved by {@link findDogwoodBinary}. */
+    binary?: string;
+    /** Base directory for every relative path. Default `process.cwd()`. */
+    cwd?: string;
+    /** When set, the report is written here as JSON for the Report phase to read. */
+    reportPath?: string;
+}
+/**
+ * Assemble the bundle and the trace from whichever form the caller supplied.
+ *
+ * Exported because the composite's Artifacts phase writes files and the Replay
+ * phase names them: resolving the same way in a test as in the Op is the point
+ * of having one function do it.
+ */
+export declare function resolveReplayInputs(args: DogwoodReplayArgs): Promise<{
+    bundle: DogwoodBundle;
+    trace: string;
+    traceIssues: TraceIssue[];
+}>;
+/**
+ * Match expectations against the decision stream.
+ *
+ * Timestamp matching consumes verdicts left to right, so two expectations at
+ * the same `@n` address the first and second decision there rather than both
+ * addressing the first. A verdict nothing expected is reported too — a policy
+ * set that starts deciding somewhere new is drift, and the usual reason a
+ * replay is being run at all.
+ */
+export declare function compareVerdicts(verdicts: readonly DogwoodVerdict[], expectations: readonly ReplayExpectation[]): ReplayDivergence[];
+/** The markdown body — printed in `report` mode, posted in the other two. */
+export declare function renderReplaySummary(report: Omit<PolicyReplayReport, "summary">): string;
+/**
+ * Replay a policy bundle against a trace and report divergence.
+ *
+ * Throws when the CLI could not be used or the run was fatal. That is the
+ * distinction `./cli.ts` draws and this preserves: a replay that did not
+ * happen must fail the step, never report zero divergences.
+ */
+export declare function dogwoodReplay(args: DogwoodReplayArgs): Promise<PolicyReplayReport>;
+/** What `dogwoodReplayReport` takes. */
+export interface DogwoodReplayReportArgs {
+    /** The JSON `dogwoodReplay` wrote. Relative paths resolve against {@link cwd}. */
+    reportPath?: string;
+    /** …or the report itself, for a caller holding it already. */
+    report?: PolicyReplayReport;
+    /** Overrides the mode recorded in the report. */
+    mode?: PolicyReplayMode;
+    /** Title for the issue or pull request. */
+    title?: string;
+    cwd?: string;
+    /** Fail the step when the replay diverged. Default false — the mode decides. */
+    failOnDivergence?: boolean;
+}
+/** What the Report phase produces. */
+export interface PolicyReplayDispatch {
+    readonly mode: PolicyReplayMode;
+    readonly findings: number;
+    readonly title: string;
+    /** The markdown to print, or to use as an issue/PR body. */
+    readonly body: string;
+    /** True when there is something to say — an issue/PR is only worth opening then. */
+    readonly actionable: boolean;
+}
+/**
+ * Turn a written replay report into the thing the finding mode calls for.
+ *
+ * It renders and returns; it does not open anything. Same as
+ * `workflowSupplyChainAudit`, and for the same reason — the cedar lexicon has
+ * no forge client and should not grow one to reach GitHub, GitLab or Forgejo.
+ * `report` mode prints the body; `issue` and `pull-request` hand back the
+ * title and body for whatever step opens them.
+ */
+export declare function dogwoodReplayReport(args: DogwoodReplayReportArgs): Promise<PolicyReplayDispatch>;
+//# sourceMappingURL=replay-activity.d.ts.map

package/dist/dogwood/replay-activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-activity.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-activity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,EAA2B,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpF,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEnE,uDAAuD;AACvD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,wBAAwB;IACxB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CA+C9E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,gBAAgB,EAAE,CA+GpB;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,MAAM,CAqCvF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwCxF;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,iDAAiD;IACjD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiCtG"}

package/dist/dogwood/replay-op.d.ts

@@ -0,0 +1,165 @@
+/**
+ * `PolicyReplayOp` — replay a declared `.dw` set against a recorded event
+ * trace and report divergence (#1661, epic #1646).
+ *
+ * Shape follows `WorkflowAuditOp`: an observe-dial Op whose last phase is a
+ * finding mode (`report | issue | pull-request`). What it observes is not a
+ * moving upstream but a moving *history* — a policy set that was correct
+ * against last week's traffic can decide differently against this week's, and
+ * the deterministic build cannot see that.
+ *
+ * ## Packaging: the composite ships from cedar, not from temporal
+ *
+ * `WorkflowAuditOp` and `PipelineAuditOp` live in the temporal lexicon because
+ * they hand back a `TemporalSchedule` alongside the Op, and that resource is
+ * temporal's. This composite hands back an Op and nothing else, so it has no
+ * reason to reach across — it imports `@intentius/chant/op` only, exactly as
+ * the fly lexicon's `flyDeploy` composite does. cedar therefore keeps zero
+ * runtime dependency on `@intentius/chant-lexicon-temporal`.
+ *
+ * The scheduled form is a two-line project-side pairing rather than a config
+ * flag, and that is the deliberate cost of the decision:
+ *
+ * ```ts
+ * import { TemporalSchedule } from "@intentius/chant-lexicon-temporal";
+ *
+ * export const { op } = PolicyReplayOp({ name: "policy-replay", … });
+ * export const schedule = new TemporalSchedule({
+ *   scheduleId: "policy-replay-schedule",
+ *   spec: { cronExpressions: ["0 6 * * *"] },
+ *   action: { workflowType: "policyReplayWorkflow", taskQueue: "policy-replay" },
+ * });
+ * ```
+ *
+ * A project that wants that already installs the temporal lexicon; a project
+ * that only wants `chant run policy-replay` on the local executor should not
+ * have to. `examples/policy-replay` is the worked recipe for both.
+ *
+ * ## Phases
+ *
+ * ```
+ * Artifacts  chantBuild — emit policies.dw, the .cedarschema and the
+ *            .dwschema the replay reads (skippable when they are checked in)
+ * Replay     dogwoodReplay — run `dogwood replay --format json` over the
+ *            bundle and the trace, write the divergence report
+ * Report     dogwoodReplayReport — read that report and act on the mode
+ * ```
+ *
+ * The report file is the seam between the last two phases, the same way
+ * `dist/fly.json` is the seam between `build:fly` and `flyApply`: Op steps do
+ * not pass return values to one another, so a phase boundary needs an artifact
+ * to be a real boundary rather than a cosmetic one.
+ */
+import { type ActivityStep, type OpResource } from "@intentius/chant/op";
+import type { PolicyReplayMode, ReplayExpectation } from "./replay-activity.js";
+/** Where the Replay phase writes its report by default. */
+export declare const DEFAULT_REPLAY_REPORT_PATH = "dist/dogwood-replay.json";
+/** Options for {@link dogwoodReplayStep}. Mirrors `DogwoodReplayArgs`. */
+export interface DogwoodReplayStepOpts {
+    policies?: string;
+    policiesPath?: string;
+    policySchema?: string;
+    policySchemaPath?: string;
+    eventSchema?: string;
+    eventSchemaPath?: string;
+    macros?: string;
+    macrosPath?: string;
+    providers?: string;
+    providersPath?: string;
+    trace?: string;
+    tracePath?: string;
+    expect?: readonly ReplayExpectation[];
+    mode?: PolicyReplayMode;
+    binary?: string;
+    cwd?: string;
+    reportPath?: string;
+    profile?: ActivityStep["profile"];
+}
+/**
+ * Replay a policy bundle against a trace — the typed twin of `flyApplyStep`.
+ *
+ * Resolves to the `dogwoodReplay` activity by name, which `loadActivities`
+ * binds when the project lists the `cedar` lexicon. Defaults to the
+ * `policyCheck` profile.
+ */
+export declare const dogwoodReplayStep: (opts: DogwoodReplayStepOpts) => ActivityStep;
+/** Options for {@link dogwoodReplayReportStep}. */
+export interface DogwoodReplayReportStepOpts {
+    reportPath?: string;
+    mode?: PolicyReplayMode;
+    title?: string;
+    cwd?: string;
+    failOnDivergence?: boolean;
+    profile?: ActivityStep["profile"];
+}
+/** Read a written replay report and act on its finding mode. */
+export declare const dogwoodReplayReportStep: (opts?: DogwoodReplayReportStepOpts) => ActivityStep;
+/** Options for {@link PolicyReplayOp}. */
+export interface PolicyReplayOpConfig {
+    /** Op name (kebab-case) — the `chant run <name>` target and the task queue base. */
+    name: string;
+    overview?: string;
+    /** Defaults to {@link name}. */
+    taskQueue?: string;
+    /**
+     * Directory every relative path below resolves against, and the one the
+     * build script runs in. Default `.`.
+     */
+    path?: string;
+    /**
+     * npm script that emits the `.dw` bundle. Default `build`. Pass `false` when
+     * the artifacts are checked in — the Artifacts phase is then omitted rather
+     * than run as a no-op, so the Op's phase list says what it really does.
+     */
+    buildScript?: string | false;
+    /** Emitted `.dw` policy set. Default `dist/policies.dw`. */
+    policiesPath?: string;
+    /** Emitted Cedar action schema. Required by the CLI; default `dist/app.cedarschema`. */
+    policySchemaPath?: string;
+    /** Emitted `.dwschema`, when the project declares one. */
+    eventSchemaPath?: string;
+    /** Emitted macro library, when the project ships one out of line. */
+    macrosPath?: string;
+    /** `providers.json`, with the Rhai inlined under `implementation.script`. */
+    providersPath?: string;
+    /** The recorded trace to replay. Required — there is nothing to replay without one. */
+    tracePath: string;
+    /** What each decision point must decide. Empty replays and reports verdicts. */
+    expect?: readonly ReplayExpectation[];
+    /** What to produce on divergence. Default `report`. */
+    onFinding?: PolicyReplayMode;
+    /** Title for the issue or pull request the finding mode calls for. */
+    title?: string;
+    /**
+     * Fail the Op when the replay diverged. Default false — an observe-dial Op
+     * reports by default, and a red run is a decision the caller makes.
+     */
+    failOnDivergence?: boolean;
+    /** Where the Replay phase writes its report. Default {@link DEFAULT_REPLAY_REPORT_PATH}. */
+    reportPath?: string;
+    /** Explicit `dogwood` binary path, for a runner that knows where it built one. */
+    binary?: string;
+}
+/** What {@link PolicyReplayOp} hands back. */
+export interface PolicyReplayOpResources {
+    /** The Op — discovered by `chant run <name>`, emitted by `chant build`. */
+    op: InstanceType<typeof OpResource>;
+}
+/**
+ * Assemble the replay Op: emit the artifacts, replay them, act on the finding.
+ *
+ * @example
+ * ```typescript
+ * export const { op } = PolicyReplayOp({
+ *   name: "policy-replay",
+ *   tracePath: "trace/read-after-login.log",
+ *   expect: [
+ *     { timestamp: 10, verdict: "allow", determiningRules: [0] },
+ *     { timestamp: 7200, verdict: "deny", note: "the login is two hours stale" },
+ *   ],
+ *   onFinding: "issue",
+ * });
+ * ```
+ */
+export declare function PolicyReplayOp(config: PolicyReplayOpConfig): PolicyReplayOpResources;
+//# sourceMappingURL=replay-op.d.ts.map

package/dist/dogwood/replay-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-op.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,qBAAqB,KAAG,YAG/D,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,GAAI,OAAM,2BAAgC,KAAG,YAGhF,CAAC;AAEF,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE7B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAEtC,uDAAuD;IACvD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,CAyDpF"}

package/dist/dogwood/scan.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Reading the emitted dogwood artifacts back, for the DWD post-synth checks.
+ *
+ * The checks judge the *text*, not the in-memory model, for the same reason
+ * the CED checks judge `policies.cedar.json`: `chant audit` runs over a
+ * checked-in artifact chant did not write, and a wall that only fires on
+ * chant's own output is not a wall. It also means the typed builders and the
+ * walls are independent — DWDC012 catches a windowless `formerly` even though
+ * the builders cannot construct one, because `raw()` and a hand-written `.dw`
+ * both can.
+ *
+ * This is scanning, not parsing. Upstream owns the parser and #1659 owns
+ * shelling to it; what is here is the subset of the surface that answers the
+ * three questions the walls ask, plus enough comment handling not to be fooled
+ * by a commented-out clause.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+/** One emitted artifact, with everything needed to name it in a finding. */
+export interface DogwoodArtifact {
+    /** The lexicon output it came from. */
+    lexicon: string;
+    /** The filename, which is what a finding points the reader at. */
+    source: string;
+    /** The file's text. */
+    text: string;
+}
+/** Every `.dw` policy file in the build output. */
+export declare function dogwoodPolicyFiles(ctx: PostSynthContext): DogwoodArtifact[];
+/** Every `.dwschema` event-schema file in the build output. */
+export declare function dogwoodSchemaFiles(ctx: PostSynthContext): DogwoodArtifact[];
+/**
+ * Blank out `//` comments, leaving string literals intact.
+ *
+ * String literals stay because a predicate's action id lives inside one
+ * (`Drupe::Action::"Read"`), and blanking those would blind every scan below.
+ * The walk is string-aware in the other direction too: a `//` inside a quoted
+ * value (a URL, say) is not a comment.
+ *
+ * Comment bytes become spaces so every offset in the result still lines up
+ * with the original file.
+ */
+export declare function blankComments(text: string): string;
+/**
+ * The stretches of a `.dw` file that the temporal sub-parser reads: every
+ * `temporal { … }` marker body, and every `def temporal … { … }` macro body.
+ *
+ * Scanning only these is what keeps a Cedar `when { … }` clause from being
+ * mistaken for temporal source — `context.retryWindow == 3` should not read as
+ * a window, and a Cedar attribute named `since` is not the `since` operator.
+ */
+export declare function temporalRegions(text: string): string[];
+/** One `Ns::Action::"Name"::kind` predicate head found in temporal source. */
+export interface TemporalPredicateRef {
+    /** The qualified action, quoted id and all. */
+    action: string;
+    /** The event kind segment after the quoted id. */
+    kind: string;
+}
+/** Every temporal predicate head in a `.dw` file, in source order. */
+export declare function scanPredicates(text: string): TemporalPredicateRef[];
+/** One window literal found in temporal source. */
+export interface WindowRef {
+    /** As written: `48h`. */
+    text: string;
+    seconds: number;
+    /** `within` for an operator's window, `argument` for a bare macro-call interval. */
+    position: "within" | "argument";
+}
+/**
+ * Every window literal in a `.dw` file's temporal source.
+ *
+ * Both shapes count against `max_window`: a macro-call interval is the window
+ * a `within ?w` in the macro body resolves to, so `once(48h, …)` looks back
+ * exactly as far as `formerly within 48h` does.
+ */
+export declare function scanWindows(text: string): WindowRef[];
+/**
+ * Every `formerly` / `previous` / `since` that is not followed by a `within`.
+ *
+ * Unrepresentable through the builders — {@link formerly} and its siblings all
+ * take the window as an argument — but reachable through `raw()`, through a
+ * hand-written `.dw`, and through an audit of a file chant never wrote.
+ */
+export declare function scanWindowlessOperators(text: string): string[];
+/** What a `.dwschema` file says, as far as the walls need to know. */
+export interface EventSchemaFacts {
+    /** Every declared event kind. */
+    kinds: string[];
+    /** The `max_window` directive in seconds, or upstream's 24h default when absent. */
+    maxWindowSeconds: number;
+    /** As written (`30d`), or undefined when the directive is absent. */
+    maxWindowText?: string;
+    /** True when at least one field carries a `pin … = …`. */
+    hasPin: boolean;
+}
+/** Read a `.dwschema` file's declarations. */
+export declare function readEventSchema(text: string): EventSchemaFacts;
+/**
+ * The look-back cap in force for a build.
+ *
+ * With no emitted schema, `ServiceSchema::defaults()` applies and the cap is
+ * 24h. With several, the tightest one wins — a window legal under one schema
+ * and not another is a window some consumer will reject.
+ */
+export declare function effectiveMaxWindowSeconds(schemas: EventSchemaFacts[]): {
+    seconds: number;
+    text: string;
+};
+//# sourceMappingURL=scan.d.ts.map

package/dist/dogwood/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/dogwood/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAIzE,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mDAAmD;AACnD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,eAAe,EAAE,CAE3E;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,eAAe,EAAE,CAE3E;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAyBlD;AAID;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBtD;AAyBD,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAID,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CASnE;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,oFAAoF;IACpF,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAAC;CACjC;AAMD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAarD;AAOD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9D;AAID,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAkB9D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAaxG"}