@intentius/chant-lexicon-cedar 0.44.8 → 0.44.10

package/dist/dogwood/serialize.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The `.dw` serializer leg.
+ *
+ * Runs inside the cedar serializer, not beside it: `serializeDogwood` is
+ * called once the cedar policies have been rendered, and its files land in the
+ * same `SerializerResult`. That is the whole point of shipping dogwood as a
+ * dialect — a `.dw` file stripped of Cedar semantics is meaningless, and a
+ * project's temporal policies and its plain Cedar policies are one policy set
+ * with two halves.
+ *
+ * Nothing here re-implements Cedar rendering. The policy head comes from
+ * `../serializer`'s `renderPolicyHead`, the scope forms from its
+ * `renderScope`, and the `when`/`unless` bodies from its `conditionStrings`,
+ * so a change to how a scope is written moves both outputs at once.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+/** Files ending in this carry dogwood policy text. */
+export declare const DOGWOOD_POLICY_SUFFIX = ".dw";
+/** Files ending in this carry an event schema. */
+export declare const DOGWOOD_EVENT_SCHEMA_SUFFIX = ".dwschema";
+/** What the leg produced: files to write, and anything the build should say out loud. */
+export interface DogwoodSerializeResult {
+    files: Record<string, string>;
+    warnings: string[];
+}
+/**
+ * One policy, in `.dw` surface syntax.
+ *
+ * Clause order is fixed rather than authored: every `when` form, then every
+ * `unless` form. Cedar evaluates a policy's conditions as a conjunction, and
+ * so does dogwood, so the order carries no meaning — fixing it means a policy
+ * that gains a temporal clause does not reshuffle the ones already there.
+ */
+export declare function renderTemporalPolicyText(id: string, props: Record<string, unknown>): string;
+/**
+ * Render every dogwood entity in the build.
+ *
+ * Returns `undefined` when the build holds no temporal policies, event schemas
+ * or macro libraries at all — a cedar-only project sees no `.dw` output and no
+ * behaviour change.
+ *
+ * Ids come from `resolvePolicyId`, the same rule `cedarPolicyRecords` uses, so
+ * a policy's `@id` does not depend on which leg rendered it.
+ */
+export declare function serializeDogwood(entities: Map<string, Declarable>): DogwoodSerializeResult | undefined;
+/** One declared temporal policy, resolved: chant name, policy id, walked props. */
+export interface DogwoodPolicyRecord {
+    /** The chant entity name — the export name on the `*.ts` file. */
+    name: string;
+    /** The policy id, as it appears in `@id(…)`. */
+    id: string;
+    /** Props with references resolved, ready for `renderTemporalPolicyText`. */
+    props: Record<string, unknown>;
+}
+/**
+ * Every `Dogwood::TemporalPolicy` in a build, with references walked and ids
+ * resolved — the temporal counterpart of `cedarPolicyRecords` (#1660).
+ *
+ * `serializeDogwood` above renders whole *files*; the AgentCore embedding needs
+ * the policies one at a time, because `AWS::BedrockAgentCore::Policy` carries a
+ * single statement and `EnforcementMode` is set per policy. Both paths walk
+ * references through the same visitor, so a scope that names another declared
+ * entity resolves identically whichever one rendered it.
+ */
+export declare function dogwoodPolicyRecords(entities: Map<string, Declarable>): DogwoodPolicyRecord[];
+//# sourceMappingURL=serialize.d.ts.map

package/dist/dogwood/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/dogwood/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgB9D,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,yFAAyF;AACzF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAgB3F;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,sBAAsB,GAAG,SAAS,CAgGtG;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,mBAAmB,EAAE,CAe7F"}

package/dist/dogwood/temporal.d.ts

@@ -0,0 +1,259 @@
+/**
+ * Typed builders for dogwood's temporal sub-language.
+ *
+ * These target the **parser primitives**, not the named aggregates. The #1657
+ * verification (and the correction comment on epic #1646) is explicit about
+ * why: `formerly`, `previous`, `since`, `exists`, `tp()`, `count for … where`
+ * and `sum … for … where` are the only temporal keywords in upstream's
+ * `extension/temporal/grammar.pest`. `count_within`, `sum_within`,
+ * `count_distinct_within` and `bind` are macros in `default_macros.dw` — a
+ * swappable standard library that a caller passing `--macros` replaces
+ * wholesale — and `once` is not even in that library, only in the examples.
+ *
+ * So the aggregates are expressible here as macro *calls* ({@link call}, and
+ * the convenience wrappers in `./macros.ts`), never as first-class operators.
+ * A call that resolves to nothing at the other end is a missing macro, which
+ * is a comprehensible failure; a first-class builder that silently emits a
+ * name the callee's library does not define is not.
+ *
+ * Everything below renders to the surface syntax the pest grammar accepts.
+ * Where the grammar's precedence would bind differently from the tree the
+ * author built, the renderer parenthesises — it never relies on the reader
+ * knowing that `!` binds tighter than `since`, or that an aggregate's `where`
+ * body is greedy.
+ */
+import { type TemporalWindow, type WindowLike, type WindowParam, type WindowValue } from "./window.js";
+/** What the three past-only operators accept: a window, or a macro's `?w`. */
+export type WindowArgument = WindowLike | WindowParam;
+/**
+ * A binder position: a plain identifier, or a macro sigil.
+ *
+ * The sigils are legal only inside a macro body; upstream's well-formedness
+ * pass rejects them elsewhere. `./macros.ts` is where they belong, and it is
+ * what carries that warning to the author.
+ */
+export declare function binderName(value: string): string;
+/** `(x: T)` — a declaration site in an `exists` or a `for` list. */
+export interface TypedBinder {
+    readonly name: string;
+    readonly type: string;
+}
+/** `(t: Timepoint)`, `(amount: Long)`, `($t: Timepoint)` inside a macro. */
+export declare function typedBinder(name: string, type: string): TypedBinder;
+/** Anything that renders in term position. */
+export type TemporalTerm = TermText | ArrayTerm | CountTerm | SumTerm | CallNode;
+/** A leaf term already in its surface form (a literal, a path, an entity UID). */
+export interface TermText {
+    readonly op: "term";
+    readonly text: string;
+}
+/** `[a, b, c]`. */
+export interface ArrayTerm {
+    readonly op: "array";
+    readonly items: readonly TemporalTerm[];
+}
+/** `count for (t: Timepoint). where φ`. */
+export interface CountTerm {
+    readonly op: "count";
+    readonly binders: readonly TypedBinder[];
+    readonly where: TemporalCondition;
+}
+/** `sum a for (a: Long), (t: Timepoint). where φ`. */
+export interface SumTerm {
+    readonly op: "sum";
+    readonly over: string;
+    readonly binders: readonly TypedBinder[];
+    readonly where: TemporalCondition;
+}
+/**
+ * What a builder accepts in term position.
+ *
+ * Numbers and booleans lift to literals because there is only one thing they
+ * can mean. A bare `string` deliberately does not: `"alice"` is a Cedar string
+ * literal and `alice` is a binder reference, and guessing which one the author
+ * meant is how a policy silently stops matching. Say which with {@link str},
+ * {@link varRef}, {@link ctx} or {@link entityUid}.
+ */
+export type TermInput = TemporalTerm | number | boolean;
+/** A raw term, emitted verbatim. The escape hatch for a shape not modelled here. */
+export declare function term(text: string): TermText;
+/** A Cedar string literal: `"alice"`. */
+export declare function str(value: string): TermText;
+/** An integer literal. Upstream's grammar admits a leading `-`. */
+export declare function int(value: number): TermText;
+/** `true` / `false`. */
+export declare function bool(value: boolean): TermText;
+/** `decimal("1.50")` — Cedar's decimal constructor, which dogwood admits as a term. */
+export declare function decimalOf(value: string): TermText;
+/** `context.input.user` — a field of the request context record. */
+export declare function ctx(path: string): TermText;
+/** `principal`, `resource`, `principal.dept` — the request scope entities. */
+export declare function scopeRef(root: "principal" | "resource", ...attrs: string[]): TermText;
+/** `Drupe::OAuthUser::"alice"` — an entity UID literal. */
+export declare function entityUid(uid: string): TermText;
+/** A bare binder reference — a `for`-declared variable, or a macro sigil. */
+export declare function varRef(name: string): TermText;
+/** `*` — the grammar's wildcard term. */
+export declare function wildcard(): TermText;
+/** `[a, b]`. */
+export declare function arrayOf(...items: TermInput[]): ArrayTerm;
+/**
+ * `count for (t: Timepoint). where φ` — the primitive behind `count_within`.
+ *
+ * The `for` list is the aggregation domain and is mandatory in the grammar,
+ * so it is a required argument here too.
+ */
+export declare function count(binders: TypedBinder[], where: TemporalCondition): CountTerm;
+/** `sum a for (a: Long), (t: Timepoint). where φ` — the primitive behind `sum_within`. */
+export declare function sum(over: string, binders: TypedBinder[], where: TemporalCondition): SumTerm;
+/** Anything that renders in condition position. */
+export type TemporalCondition = PredicateNode | FormerlyNode | PreviousNode | SinceNode | ExistsNode | TpNode | AndNode | NotNode | ComparisonNode | CallNode | SigilCondition | RawCondition;
+/** `Drupe::Action::"Login"::response{ input.user: context.input.user }`. */
+export interface PredicateNode {
+    readonly op: "predicate";
+    readonly action: string;
+    readonly kind: string;
+    readonly args: ReadonlyArray<{
+        readonly path: string;
+        readonly value: TemporalTerm;
+    }>;
+}
+/** `formerly within 1h φ`. */
+export interface FormerlyNode {
+    readonly op: "formerly";
+    readonly window: WindowValue;
+    readonly body: TemporalCondition;
+}
+/** `previous within 30s φ`. */
+export interface PreviousNode {
+    readonly op: "previous";
+    readonly window: WindowValue;
+    readonly body: TemporalCondition;
+}
+/** `φ since within 1h ψ` — infix, with the window on the operator. */
+export interface SinceNode {
+    readonly op: "since";
+    readonly left: TemporalCondition;
+    readonly window: WindowValue;
+    readonly right: TemporalCondition;
+}
+/** `exists (total: Long). φ`. */
+export interface ExistsNode {
+    readonly op: "exists";
+    readonly binder: TypedBinder;
+    readonly body: TemporalCondition;
+}
+/** `tp(t)` — binds the timepoint under evaluation. */
+export interface TpNode {
+    readonly op: "tp";
+    readonly binder: string;
+}
+/** `φ && ψ`. */
+export interface AndNode {
+    readonly op: "and";
+    readonly operands: readonly TemporalCondition[];
+}
+/** `!φ`. */
+export interface NotNode {
+    readonly op: "not";
+    readonly body: TemporalCondition;
+}
+/** `a == b`, `0 < count …`. */
+export interface ComparisonNode {
+    readonly op: "compare";
+    readonly left: TemporalTerm;
+    readonly operator: ComparisonOperator;
+    readonly right: TemporalTerm;
+}
+/** The six operators `cmp_op` admits. */
+export type ComparisonOperator = "==" | "!=" | "<" | "<=" | ">" | ">=";
+/** A macro invocation — `once(1h, φ)`. Legal in both condition and term position. */
+export interface CallNode {
+    readonly op: "call";
+    readonly name: string;
+    readonly args: readonly MacroArg[];
+}
+/** `1h` as a macro-call argument — bare, with no `within` keyword. */
+export interface IntervalArg {
+    readonly op: "interval";
+    readonly window: TemporalWindow;
+}
+/** What a macro call takes: an interval, a condition, or a term. */
+export type MacroArg = IntervalArg | TemporalCondition | TemporalTerm;
+/**
+ * Temporal source text emitted verbatim.
+ *
+ * The one builder that can produce something the walls exist to catch — a
+ * `formerly` with no window, an event kind the schema never declared. That is
+ * deliberate: an escape hatch nobody can reach makes the walls untestable, and
+ * DWDC012 reads the serialized text precisely because this exists.
+ */
+export interface RawCondition {
+    readonly op: "raw";
+    readonly text: string;
+}
+/**
+ * `?s` — a macro parameter standing for an entire condition.
+ *
+ * Its own node rather than a {@link RawCondition} because the grammar treats
+ * it as an atom (`refinable = (predicate | sigil_cond) ~ field_block*`), so
+ * `formerly within ?w ?s` needs no parentheses where arbitrary raw text would.
+ * Build one with `macroCondition()` in `./macros.ts`, which is where the rule
+ * that sigils are legal only inside a macro body is documented.
+ */
+export interface SigilCondition {
+    readonly op: "sigil";
+    readonly param: string;
+}
+/**
+ * `Ns::Action::"Name"::kind{ field: term, … }`.
+ *
+ * The event kind is mandatory in the grammar and author-defined in practice —
+ * `request`/`response`/`error` are the conventional kinds the default event
+ * schema declares, not a fixed set. Which kinds are legal for a given policy
+ * set is the emitted `.dwschema`'s business, and DWDC010's.
+ */
+export declare function predicate(action: string, kind: string, args?: Record<string, TermInput>): PredicateNode;
+/** `formerly within <w> φ` — held at some point in the window. */
+export declare function formerly(w: WindowArgument, body: TemporalCondition): FormerlyNode;
+/** `previous within <w> φ` — held at the immediately preceding timepoint in the window. */
+export declare function previous(w: WindowArgument, body: TemporalCondition): PreviousNode;
+/** `φ since within <w> ψ` — φ has held continuously since ψ, inside the window. */
+export declare function since(left: TemporalCondition, w: WindowArgument, right: TemporalCondition): SinceNode;
+/** `exists (name: Type). φ`. */
+export declare function exists(binder: TypedBinder, body: TemporalCondition): ExistsNode;
+/** `tp(t)`. */
+export declare function tp(binder: string): TpNode;
+/** `φ && ψ && …`. A single operand collapses to itself. */
+export declare function and(...operands: TemporalCondition[]): TemporalCondition;
+/** `!φ`. */
+export declare function not(body: TemporalCondition): NotNode;
+/** `a <op> b`. */
+export declare function compare(left: TermInput, operator: ComparisonOperator, right: TermInput): ComparisonNode;
+/**
+ * A macro invocation.
+ *
+ * Nothing here checks that the macro exists: the library is `--macros`, chosen
+ * by whoever runs `dogwood validate`, and chant is not that. `./macros.ts`
+ * carries typed wrappers for the four the default library ships.
+ */
+export declare function call(name: string, args?: MacroArg[]): CallNode;
+/** `1h` in macro-call argument position — the interval without the `within`. */
+export declare function interval(w: WindowLike): IntervalArg;
+/** Temporal source text, passed through untouched. See {@link RawCondition}. */
+export declare function raw(text: string): RawCondition;
+/** `?s` in condition position. See {@link SigilCondition}. */
+export declare function sigilCondition(param: string): SigilCondition;
+/** Render a term. */
+export declare function renderTerm(t: TemporalTerm): string;
+/** Render a temporal condition to the surface syntax the pest grammar accepts. */
+export declare function renderCondition(node: TemporalCondition): string;
+/**
+ * `temporal { … }` — the extension marker.
+ *
+ * It is a `primary` in the Cedar expression grammar as well as a clause tag,
+ * so this is also how a temporal condition is embedded mid-expression:
+ * `when { is_small(context.input.shares) && temporal { once(1h, …) } }`.
+ */
+export declare function temporalMarker(condition: TemporalCondition): string;
+//# sourceMappingURL=temporal.d.ts.map

package/dist/dogwood/temporal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temporal.d.ts","sourceRoot":"","sources":["../../src/dogwood/temporal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,UAAU,CAAC;AAElB,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;AAoBtD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD;AAID,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEnE;AAED,8CAA8C;AAC9C,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEjF,kFAAkF;AAClF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,mBAAmB;AACnB,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;CACzC;AAED,2CAA2C;AAC3C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,sDAAsD;AACtD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC;AAQxD,oFAAoF;AACpF,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE3C;AAED,yCAAyC;AACzC,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAE3C;AAED,mEAAmE;AACnE,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAK3C;AAED,wBAAwB;AACxB,wBAAgB,IAAI,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAE7C;AAED,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAEjD;AAED,oEAAoE;AACpE,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAG1C;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAGrF;AAED,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAG/C;AAED,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE7C;AAED,yCAAyC;AACzC,wBAAgB,QAAQ,IAAI,QAAQ,CAEnC;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,SAAS,CAGjF;AAED,0FAA0F;AAC1F,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAG3F;AAID,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,SAAS,GACT,UAAU,GACV,MAAM,GACN,OAAO,GACP,OAAO,GACP,cAAc,GACd,QAAQ,GACR,cAAc,GACd,YAAY,CAAC;AAEjB,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;CACvF;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,sDAAsD;AACtD,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,gBAAgB;AAChB,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AAED,YAAY;AACZ,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,yCAAyC;AACzC,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;AAEvE,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CACpC;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,oEAAoE;AACpE,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,iBAAiB,GAAG,YAAY,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAID;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAM,GACnC,aAAa,CAYf;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,GAAG,YAAY,CAEjF;AAED,2FAA2F;AAC3F,wBAAgB,QAAQ,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,GAAG,YAAY,CAEjF;AAED,mFAAmF;AACnF,wBAAgB,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,GAAG,SAAS,CAErG;AAED,gCAAgC;AAChC,wBAAgB,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,iBAAiB,GAAG,UAAU,CAE/E;AAED,eAAe;AACf,wBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,2DAA2D;AAC3D,wBAAgB,GAAG,CAAC,GAAG,QAAQ,EAAE,iBAAiB,EAAE,GAAG,iBAAiB,CAIvE;AAED,YAAY;AACZ,wBAAgB,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAEpD;AAED,kBAAkB;AAClB,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,SAAS,GAAG,cAAc,CAEvG;AAED;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,QAAQ,EAAO,GAAG,QAAQ,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,CAAC,EAAE,UAAU,GAAG,WAAW,CAEnD;AAED,gFAAgF;AAChF,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAE9C;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAG5D;AAYD,qBAAqB;AACrB,wBAAgB,UAAU,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAalD;AAiFD,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAwC/D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAEnE"}

package/dist/dogwood/trace.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Typed construction of dogwood replay traces (#1661, epic #1646).
+ *
+ * A trace is one event per line, and the line grammar recorded by the #1657
+ * verification (§6, read from `dogwood-language/src/interpreter/log_parse.rs`
+ * at the pinned SHA) is:
+ *
+ * ```
+ * @<timestamp> [scope(principal: <uid>, resource: <uid>)]
+ *              [entities(<uid>: { <attrs> } [in [<uid>, …]], …)]
+ *              [request_context(<group>: { … }, …)]
+ *              <Ns>::Action::"<Name>"::<kind>(<field>: <value>, …)
+ * ```
+ *
+ * The three envelopes are optional and must appear in that order; the trailing
+ * group is the logged record. There is no comment syntax — a `//` is an
+ * ordinary part of a value, so URLs survive — blank lines are skipped, and a
+ * leading BOM is stripped.
+ *
+ * Two things in that format silently weaken a replay rather than failing it,
+ * and both are what this module exists to make hard:
+ *
+ * 1. **`request_context(…)` and the logged record are different bags.** The
+ *    Cedar request is built from the first; temporal predicates match against
+ *    the second. A field needed by both and supplied to only one weakens
+ *    either the Cedar check or the temporal check, and the replay still exits
+ *    0 with a verdict that looks authoritative. So {@link traceEvent} writes a
+ *    `context` group into *both* bags by default, and dropping one is an
+ *    explicit per-event `bags` opt-out that has to be typed out.
+ * 2. **Actions must be fully qualified.** `Drupe::Action::"Transfer"`, never
+ *    `Transfer` — a short name leaves the temporal predicate unmatched while
+ *    Cedar still authorizes. {@link traceEvent} rejects anything that is not
+ *    `Ns::…::"Name"` at construction.
+ *
+ * {@link auditTrace} is the same two checks applied to a trace this module did
+ * not build — the AgentCore session history #1661 leaves to the aws lexicon,
+ * or a `.log` recorded by hand. A trace is a trace, wherever it came from.
+ */
+/** `Ns::Type::"id"` in value position. */
+export interface TraceEntityRef {
+    readonly traceValue: "entity";
+    readonly uid: string;
+}
+/** `1.50` — Cedar's decimal surface form, which a JS number cannot carry. */
+export interface TraceDecimal {
+    readonly traceValue: "decimal";
+    readonly text: string;
+}
+/** Surface text passed through untouched — the escape hatch, used sparingly. */
+export interface TraceRaw {
+    readonly traceValue: "raw";
+    readonly text: string;
+}
+/** A tagged value: one this module renders specially rather than by JS type. */
+export type TraceTagged = TraceEntityRef | TraceDecimal | TraceRaw;
+/** Anything that can sit in a trace field, in Cedar surface forms. */
+export type TraceValue = string | number | boolean | TraceTagged | readonly TraceValue[] | {
+    readonly [key: string]: TraceValue;
+};
+/** A named group of fields — what one `request_context` envelope entry holds. */
+export type TraceFields = {
+    readonly [key: string]: TraceValue;
+};
+/** `Ns::Type::"id"`. Validated at construction, so a short name cannot slip through. */
+export declare function entityRef(uid: string): TraceEntityRef;
+/** A Cedar decimal, written as it should appear (`"1.50"`). */
+export declare function decimalValue(text: string): TraceDecimal;
+/** Surface text, rendered verbatim. For values this module has no shape for. */
+export declare function rawValue(text: string): TraceRaw;
+/** Render one value in the Cedar surface form the trace parser reads. */
+export declare function renderTraceValue(value: TraceValue): string;
+/** `{ a: 1, b: "x" }` — a record body, braces included. */
+export declare function renderTraceFields(fields: TraceFields): string;
+/** The `scope(principal: …, resource: …)` envelope. Both are entity uids. */
+export interface TraceScope {
+    readonly principal: string;
+    readonly resource: string;
+}
+/** One `entities(…)` entry: a uid, its attributes, and its parents. */
+export interface TraceEntityDecl {
+    readonly uid: string;
+    readonly attrs?: TraceFields;
+    /** `in [<uid>, …]` — the entity's parents in the hierarchy. */
+    readonly parents?: readonly string[];
+}
+/** `Ns::Type::"id": { … } in [ … ]`. */
+export declare function traceEntity(uid: string, attrs?: TraceFields, parents?: readonly string[]): TraceEntityDecl;
+/**
+ * One trace line, fully resolved: every envelope decided, both bags settled.
+ *
+ * Built by {@link traceEvent} rather than by hand — the constructor is where
+ * the both-bags default and the qualified-action check live. The type stays
+ * public because a trace fetched from somewhere else (an AgentCore session
+ * history, a recorded `.log`) is normalized into it and then handed to
+ * {@link auditTrace}.
+ */
+export interface TraceEvent {
+    /** The `i64` after `@`. */
+    readonly timestamp: number;
+    /** Fully qualified: `Ns::Action::"Name"`. */
+    readonly action: string;
+    /** `request`, `response`, `error` conventionally — author-defined in truth. */
+    readonly kind: string;
+    /** The trailing logged record — what temporal predicates match against. */
+    readonly record: TraceFields;
+    /** The `request_context(…)` envelope — what the Cedar request is built from. */
+    readonly requestContext?: TraceFields;
+    readonly scope?: TraceScope;
+    readonly entities?: readonly TraceEntityDecl[];
+}
+/**
+ * Which bags a `context` group lands in.
+ *
+ * `both` is the default and the only one that keeps a replay honest. The other
+ * two exist so a test can *demonstrate* the weakening rather than only
+ * describe it, and so a trace that genuinely has no Cedar-side counterpart for
+ * a field can say so out loud instead of by omission.
+ */
+export type TraceBags = "both" | "record-only" | "context-only";
+/** What {@link traceEvent} takes. */
+export interface TraceEventInput {
+    readonly timestamp: number;
+    /** Fully qualified: `Ns::Action::"Name"`. A short name throws. */
+    readonly action: string;
+    /** Default `request` — the only kind the default event schema decides on. */
+    readonly kind?: string;
+    /**
+     * Named field groups (`input`, `output`, …). Each lands in **both** the
+     * `request_context` envelope and the logged record unless {@link bags} says
+     * otherwise.
+     */
+    readonly context?: {
+        readonly [group: string]: TraceFields;
+    };
+    /**
+     * Fields that belong to the logged record only — `callerPrincipal`,
+     * `callerResource`, `requestId`, `sessionId` and the rest of the event
+     * schema's own injections. These are never part of the Cedar request.
+     */
+    readonly record?: TraceFields;
+    readonly scope?: TraceScope;
+    readonly entities?: readonly TraceEntityDecl[];
+    /** Explicit opt-out of both-bag population. See {@link TraceBags}. */
+    readonly bags?: TraceBags;
+}
+/**
+ * Build one trace event with both bags populated.
+ *
+ * Every `context` group is written to the `request_context` envelope *and*
+ * merged into the logged record, because that is the only combination in which
+ * the Cedar check and the temporal check both see the field. Dropping one is a
+ * typed decision (`bags`), not an omission.
+ */
+export declare function traceEvent(input: TraceEventInput): TraceEvent;
+/** One event as the single line the trace parser reads. Never ends in a newline. */
+export declare function renderTraceLine(event: TraceEvent): string;
+/** A whole trace, one event per line, newline-terminated. */
+export declare function renderTrace(events: readonly TraceEvent[]): string;
+/** What {@link auditTrace} can find. */
+export type TraceIssueKind = "single-bag" | "no-request-context" | "empty-record" | "out-of-order";
+/** One finding against a trace, indexed by its position in the event list. */
+export interface TraceIssue {
+    readonly kind: TraceIssueKind;
+    /** 0-based position in the event list — a trace has no line numbers of its own. */
+    readonly index: number;
+    readonly timestamp: number;
+    readonly message: string;
+}
+/** Options for {@link auditTrace} and {@link traceFixture}. */
+export interface TraceAuditOptions {
+    /**
+     * Event kinds that produce a decision, and so build a Cedar request.
+     *
+     * Default `["request"]`, which is the convention the default event schema
+     * follows — the truth is whichever kinds the project's `.dwschema` marks
+     * `decision`, and that file is not visible from here. A history-only event
+     * never becomes a Cedar request, so an absent `request_context` on one is
+     * not a weakening and is not reported.
+     */
+    readonly decisionKinds?: readonly string[];
+}
+/**
+ * The both-bags and ordering checks, applied to any trace.
+ *
+ * Every finding here is something that makes a replay *weaker* rather than
+ * something that makes it fail — which is exactly the class a green replay run
+ * hides. A trace built by {@link traceEvent} produces none of them unless a
+ * `bags` opt-out was taken deliberately.
+ */
+export declare function auditTrace(events: readonly TraceEvent[], options?: TraceAuditOptions): TraceIssue[];
+/** Options for {@link traceFixture}. */
+export interface TraceFixtureOptions extends TraceAuditOptions {
+    /**
+     * Issue kinds to tolerate. Empty by default: a fixture that weakens its own
+     * replay throws at build time rather than producing a green run that proves
+     * nothing.
+     */
+    readonly allow?: readonly TraceIssueKind[];
+}
+/** A built trace: the events, the text, and whatever the audit tolerated. */
+export interface TraceFixture {
+    readonly events: readonly TraceEvent[];
+    readonly text: string;
+    readonly issues: readonly TraceIssue[];
+}
+/**
+ * Assemble events into trace text, refusing to produce a weakened one.
+ *
+ * The inversion of the trap: the default is a trace that populates both bags,
+ * and every way of getting a weaker one — a `bags` opt-out on an event, a
+ * hand-normalized event with an empty record — has to be named in `allow`
+ * before this will hand it back.
+ */
+export declare function traceFixture(events: readonly TraceEvent[], options?: TraceFixtureOptions): TraceFixture;
+//# sourceMappingURL=trace.d.ts.map

package/dist/dogwood/trace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/dogwood/trace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAyBH,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEnE,sEAAsE;AACtE,MAAM,MAAM,UAAU,GAClB,MAAM,GACN,MAAM,GACN,OAAO,GACP,WAAW,GACX,SAAS,UAAU,EAAE,GACrB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE3C,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAEjE,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAErD;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAKvD;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE/C;AAMD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAkB1D;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAK7D;AAID,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAM1G;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,aAAa,GAAG,cAAc,CAAC;AAEhE,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,CAAA;KAAE,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC/C,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA+B7D;AAwBD,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAkBzD;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAEjE;AAID,wCAAwC;AACxC,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,oBAAoB,GACpB,cAAc,GACd,cAAc,CAAC;AAEnB,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,OAAO,GAAE,iBAAsB,GAAG,UAAU,EAAE,CA+DvG;AAID,wCAAwC;AACxC,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C;AAED,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAcd"}

package/dist/dogwood/upstream.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The dogwood upstream pin.
+ *
+ * Not a `upstreamPin` on the plugin: that slot belongs to the cedar grammar
+ * (`@cedar-policy/cedar-wasm`, see `../spec/pin.ts`), and self-upgrade tooling
+ * bumps exactly one thing per lexicon. Dogwood's pin is a git SHA recorded by
+ * #1657, because upstream has no version to key off — zero tags, zero
+ * releases, and a workspace version of `1.0.0` that is an Amazon-internal
+ * package artifact every future sync will also report.
+ *
+ * The blob hashes are the narrow content pin the #1657 report recommends. The
+ * whole tree hash moves on every sync including docs-only ones, which makes it
+ * too noisy to gate on; these seven files are the surface chant actually
+ * depends on. The three `.pest` grammars pin the language, `default_macros.dw`
+ * pins the standard aggregate library (which is a file a sync can edit and a
+ * caller can replace with `--macros`), and the three `dogwood-cli/src` files
+ * pin the JSON report structs that are #1659's integration surface.
+ *
+ * Movement risk is structural, not incidental: content arrives as squashed
+ * "Sync from internal source" commits from a publish bot, against a repository
+ * nobody outside Amazon can see, with no changelog and no version bump.
+ */
+/** The pinned upstream revision and the files chant's surface is built against. */
+export declare const DOGWOOD_UPSTREAM: {
+    readonly owner: "dogwood-policy";
+    readonly repo: "dogwood";
+    /** Default-branch SHA verified in #1657 (committed 2026-08-06). */
+    readonly revision: "5063bcc2d6d6cf5024d1b0498e6cc8ef52cbcf0c";
+    readonly license: "Apache-2.0";
+    /** Git blob hashes at {@link revision} — the narrow content pin. */
+    readonly contents: {
+        readonly "dogwood-language/src/parser/grammar.pest": "adb0801303ee1b735585fe22a5d85175ecf6772c";
+        readonly "dogwood-language/src/extension/temporal/grammar.pest": "dc31fe1634b5c37173f0a999619e9834069b7a22";
+        readonly "dogwood-language/src/event_schema/grammar.pest": "bd3b064447dc0d09cc2f8eb28a7c657e746cc8a2";
+        readonly "dogwood-language/configuration/default_macros.dw": "ecd67e5edcd566aa66b05ad51bc472afbaf22a7a";
+        readonly "dogwood-cli/src/ops.rs": "2924c7eb0e569a745ff19c2d84cbba782fc56502";
+        readonly "dogwood-cli/src/main.rs": "bfd68c9ff05883ed48e5738f658b5925542d817d";
+        readonly "dogwood-cli/src/error.rs": "43f12afbbf25ad94e25130c83227eefd86f8d516";
+    };
+};
+//# sourceMappingURL=upstream.d.ts.map

package/dist/dogwood/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../../src/dogwood/upstream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mFAAmF;AACnF,eAAO,MAAM,gBAAgB;;;IAG3B,mEAAmE;;;IAGnE,oEAAoE;;;;;;;;;;CAU5D,CAAC"}