@intentius/chant-lexicon-cedar 0.44.8 → 0.44.9

package/dist/dogwood/window.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Temporal windows — the one thing dogwood's past-only operators cannot omit.
+ *
+ * `formerly`, `previous` and `since` all take a mandatory `within <n><unit>`
+ * clause; the unit is one of `s`, `m`, `h`, `d` and nothing else. Upstream's
+ * `temporal/grammar.pest` spells that out:
+ *
+ * ```
+ * within         = { "within" ~ within_payload }
+ * within_payload = { param_ref | (integer ~ time_unit) }
+ * time_unit      = { "s" | "m" | "h" | "d" }
+ * ```
+ *
+ * Typing the window as a value rather than as free text is what makes
+ * "a `formerly` without a window" unrepresentable in the builders (#1658's
+ * third lint wall) — you cannot call {@link formerly} without one.
+ *
+ * The `param_ref` arm (`within ?w`) is legal only inside a macro body; it is
+ * modelled by {@link MacroWindow} rather than by this type, so an ordinary
+ * policy cannot accidentally emit a sigil the expander would reject.
+ */
+/** The four units upstream's grammar admits. Anything else does not parse. */
+export type TimeUnit = "s" | "m" | "h" | "d";
+/** A `within` payload: a positive integer and one of the four units. */
+export interface TemporalWindow {
+    readonly value: number;
+    readonly unit: TimeUnit;
+}
+/**
+ * A window as written in a `.dw` file (`"1h"`, `"30m"`, `"7d"`).
+ *
+ * The template-literal arm means `formerly("1h", …)` type-checks and
+ * `formerly("1w", …)` does not, without anyone writing a runtime check first.
+ */
+export type WindowLike = TemporalWindow | `${number}${TimeUnit}`;
+/**
+ * `within ?w` — a window a macro takes as a parameter.
+ *
+ * The other arm of upstream's `within_payload`. Legal only inside a macro
+ * body; the expander resolves it against the call site's bare interval
+ * argument (`once(1h, …)`), which is why the call side has no `within`.
+ */
+export interface WindowParam {
+    readonly param: string;
+}
+/** Either a concrete window or a macro parameter standing in for one. */
+export type WindowValue = TemporalWindow | WindowParam;
+/** True when the payload is `?w` rather than `1h`. */
+export declare function isWindowParam(value: WindowValue): value is WindowParam;
+/**
+ * `within ?w` inside a macro body.
+ *
+ * Exported from `./macros.ts` too, which is where the sigil rules are
+ * documented and where a reader looking for it will be.
+ */
+export declare function windowParam(param: string): WindowParam;
+/** Narrow a {@link WindowLike} to the structured form, validating as it goes. */
+export declare function window(value: WindowLike): TemporalWindow;
+/** `1h` — the surface form, in a `within` clause or as a macro-call argument. */
+export declare function renderWindow(value: WindowLike): string;
+/** A `within` payload: `1h`, or the `?w` a macro body defers to its call site. */
+export declare function renderWindowValue(value: WindowValue): string;
+/** Narrow a window argument, letting a `?w` parameter through unchanged. */
+export declare function windowValue(value: WindowLike | WindowParam): WindowValue;
+/** The window in seconds, so `90m` and `1h` are comparable to a `max_window`. */
+export declare function windowSeconds(value: WindowLike): number;
+/**
+ * Upstream's fallback cap. `ServiceSchema::defaults()` and an event schema
+ * with no `max_window` directive both look back at most 24 hours, per the
+ * comment atop `event_schema/grammar.pest` ("absent → a 24h default").
+ */
+export declare const DEFAULT_MAX_WINDOW: TemporalWindow;
+//# sourceMappingURL=window.d.ts.map

package/dist/dogwood/window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"window.d.ts","sourceRoot":"","sources":["../../src/dogwood/window.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAE7C,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,WAAW,CAAC;AAKvD,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,IAAI,WAAW,CAEtE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAKtD;AAKD,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CAgBxD;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGtD;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAE5D;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,CAExE;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAGvD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,cAAyC,CAAC"}

package/dist/index.d.ts

@@ -18,6 +18,10 @@ export { CedarGenerator, loadActionConstants, sanitizeName, CEDAR_PACKAGE } from
 export type { CedarGenerateOptions, CedarGenerateResult } from "./import/generator.js";
 export { CedarTemplateParser, CedarTemplateGenerator } from "./import/adapter.js";
 export { detectTemplate } from "./detect.js";
+export * as dogwood from "./dogwood/index.js";
+export { DOGWOOD_EVENT_SCHEMA_FILENAME, DOGWOOD_EVENT_SCHEMA_TYPE, DOGWOOD_MACRO_FILENAME, DOGWOOD_MACRO_LIBRARY_TYPE, DOGWOOD_POLICY_FILENAME, DOGWOOD_POLICY_TYPE, TemporalEventSchema, TemporalMacroLibrary, TemporalPolicy, } from "./dogwood/policy.js";
+export type { EventSchemaProps, MacroLibraryProps, TemporalPolicyProps } from "./dogwood/policy.js";
+export { DOGWOOD_UPSTREAM } from "./dogwood/upstream.js";
 export { rules as cedarLintRules } from "./lint/rules/index.js";
 export { packageLexicon } from "./codegen/package.js";
 export type { PackageOptions, PackageResult } from "./codegen/package.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAW1C,OAAO,KAAK,OAAO,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "a3b6314f19c537ad8c8bcc2953e4a944540fb2cbf364b7bacb00e9725a2363f0",
+    "manifest.json": "a31995290dbdfa02707ab4fb8aa614bc83ec443cbf7860221138f2335192f9bd",
     "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
     "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
     "rules/policy-shape.ts": "1654730d188b7163dbad3051c75a562198a96eda6d36ce35701f2b729bf45194",
@@ -16,7 +16,17 @@
     "rules/ceds010.ts": "215e14de2b84d935ad9551d37c3c06374e5452a5b3f1d7408dc59cd8c2ef1b33",
     "rules/ceds011.ts": "07984e364b431203a34b42de481fad4fc16d2b838f3fa358726759f4a3ebbfe5",
     "rules/ceds012.ts": "a447c6114d36abf2eca6f90143b06c4b20ede111c777cb04c70024fc4ad93172",
-    "rules/wasm-helpers.ts": "c4c3def1669a1818d19ff1864e78bdcbf956da31ca1a6adde7751830765dad6a"
+    "rules/dogwood-helpers.ts": "7f24a385396255ccfdf85b3e493a48b4d7d3d191a28e0ff0341a5dd47b8cff2c",
+    "rules/dwdc010.ts": "0c619de07981b4b11bfa425bf4032142af1f90f255d3058a71551956124123f2",
+    "rules/dwdc011.ts": "88919f0d7460993b58e1883d0bfd48f6a8c8f4bc2d22c71902f9b0ee7b9edd07",
+    "rules/dwdc012.ts": "15434083488c5e617835e0ac3027cf92657c734076463abd526332f460cc7e8d",
+    "rules/dwde010.ts": "b39ecb0427fc19d9548a26dcd2b9e99d4eab289f57196da24374743c85553fb1",
+    "rules/dwde011.ts": "5e7f7dbcd9c581bba614fd5c17dcf1282a0b59caef931997c954cea46522251c",
+    "rules/dwds010.ts": "4939f7eb012998d7e27238db777ed7fec2721c2e25df0daec457ff2c62bfa648",
+    "rules/wasm-helpers.ts": "c4c3def1669a1818d19ff1864e78bdcbf956da31ca1a6adde7751830765dad6a",
+    "skills/chant-cedar-authoring.md": "1b036a72ef13342d402d0de1a68bec0a6f32365ab8485b95f63a971277fd249f",
+    "skills/chant-cedar-avp-embedding.md": "1096cc318374dc0683fae289040b089ffc0c7fa029c6b07d4acc19ebcd118b54",
+    "skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a"
   },
-  "composite": "050414f43e9bfd30e46d4249e5493401c0dcbb7de270eb28980dbf7ec83ea9b7"
+  "composite": "82bb53355858c8565563d0daf80a5357904c0d4d0152ea0b64c3310805cee16a"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAoGtD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4JtD,CAAC"}

package/dist/lint/post-synth/dogwood-helpers.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Turning a build's emitted files into `dogwood` CLI invocations (#1659).
+ *
+ * The DWDE checks both need the same thing: which of the emitted `.dw` files
+ * is a policy set, which is a macro library, which `.cedarschema` backs
+ * `--policy-schema`, and which `.dwschema` backs `--event-schema`. Planning
+ * that once here keeps the two checks from disagreeing about what they ran —
+ * DWDE010 validates a bundle and DWDE011 lowers the *same* bundle, and a
+ * finding from one that names different inputs than the other would be a
+ * puzzle rather than a report.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { DogwoodBundle } from "../../dogwood/cli.js";
+/** One planned invocation: the files, and the names to blame in a finding. */
+export interface PreparedBundle {
+    lexicon: string;
+    /** The `.dw` policy set filename. */
+    source: string;
+    /** The `.cedarschema` filename passed as `--policy-schema`. */
+    policySchemaSource: string;
+    /** The `.dwschema` filename passed as `--event-schema`, when one was emitted. */
+    eventSchemaSource?: string;
+    bundle: DogwoodBundle;
+}
+/** What the CLI-gated checks should do with this build. */
+export interface DogwoodRunPlan {
+    /** True when the build emitted a `.dw` policy set at all. */
+    hasPolicies: boolean;
+    /** Every invocation to make. Empty when {@link blocked} is set. */
+    bundles: PreparedBundle[];
+    /** Why nothing can be run, when policies exist but a required input does not. */
+    blocked?: string;
+    /** The lexicon the `.dw` output came from, for a finding that names no file. */
+    lexicon?: string;
+}
+/**
+ * A `.dw` file holding only `def` declarations is a macro library, not a
+ * policy set.
+ *
+ * By structure rather than by filename: the serializer's default is
+ * `macros.dw`, but `MacroLibraryProps.filename` overrides it, and `chant
+ * audit` runs over trees chant never wrote. A policy set is a file with a
+ * `permit` or `forbid` head in it — upstream's policy grammar has no third
+ * effect — and a set with inlined macros still has one.
+ */
+export declare function looksLikeMacroLibrary(text: string): boolean;
+/**
+ * Plan every `dogwood` invocation this build calls for.
+ *
+ * One bundle per policy set per emitted event schema. A build with several
+ * `.dwschema` files means several services, and `--event-schema` takes exactly
+ * one file, so the set is run against each and every finding names the schema
+ * it was found under — the alternative is picking one silently and reporting
+ * against a schema the reader did not choose. Macro libraries do combine: a
+ * library is a sequence of `def`s, so several concatenate into the one file
+ * `--macros` accepts.
+ */
+export declare function planDogwoodRuns(ctx: PostSynthContext): DogwoodRunPlan;
+/** How a finding names the inputs a run was made with. */
+export declare function describeBundle(prepared: PreparedBundle): string;
+//# sourceMappingURL=dogwood-helpers.d.ts.map

package/dist/lint/post-synth/dogwood-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dogwood-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dogwood-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AA0BD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,cAAc,CAyCrE;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAI/D"}

package/dist/lint/post-synth/dwdc010.d.ts

@@ -0,0 +1,25 @@
+/**
+ * DWDC010: a temporal predicate must name an event kind the schema declares
+ *
+ * Upstream rejects this outright — a predicate naming an undeclared kind fails
+ * `dogwood validate` with code `extension`: "predicate
+ * `Drupe::Action::\"Read\"::nosuchkind` does not name a declared event (no
+ * event kind `nosuchkind` derived for action `Read`)". Catching it in
+ * TypeScript is the point of the split epic #1646 drew: everything answerable
+ * without the binary runs always and gates, and this one is answerable.
+ *
+ * The check is on the event *kind*, not the action, and that is not a
+ * shortcut. Upstream's `.dwschema` grammar declares events against a symbolic
+ * action binder — `decision event <A>::request { … }` — so the file names no
+ * actions at all and cannot be asked whether one exists. The action half of
+ * that upstream error comes from the Cedar action schema
+ * (`--policy-schema`), which is #1659's CLI-gated leg.
+ *
+ * Silent when no `.dwschema` was emitted: with none supplied,
+ * `ServiceSchema::defaults()` decides the kinds at the far end, and guessing
+ * that a project's out-of-band schema matches upstream's default would fail
+ * builds for a policy set that is fine.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwdc010: PostSynthCheck;
+//# sourceMappingURL=dwdc010.d.ts.map

package/dist/lint/post-synth/dwdc010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwdc010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwdc010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAoCrB,CAAC"}

package/dist/lint/post-synth/dwdc011.d.ts

@@ -0,0 +1,19 @@
+/**
+ * DWDC011: a temporal window must fit inside the schema's `max_window`
+ *
+ * `formerly within 48h` under a 24h cap is an upstream validation error —
+ * "temporal window `48h` exceeds the maximum allowed window `24h` set by the
+ * event schema's `max_window`" — and it is arithmetic, so it needs no binary.
+ *
+ * Unlike DWDC010 this fires with no `.dwschema` emitted, because the cap
+ * applies either way: `ServiceSchema::defaults()` caps look-back at 24h, and
+ * so does an emitted schema that omits the directive. Where several schemas
+ * are emitted the tightest cap wins — a window one consumer accepts and
+ * another rejects is still a window that will be rejected.
+ *
+ * Macro-call intervals count. `once(48h, …)` expands to `formerly within 48h`
+ * through the default library's `within ?w`, so it looks back exactly as far.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwdc011: PostSynthCheck;
+//# sourceMappingURL=dwdc011.d.ts.map

package/dist/lint/post-synth/dwdc011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwdc011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwdc011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAS9G,eAAO,MAAM,OAAO,EAAE,cAmCrB,CAAC"}

package/dist/lint/post-synth/dwdc012.d.ts

@@ -0,0 +1,21 @@
+/**
+ * DWDC012: `formerly`, `previous` and `since` carry a mandatory window
+ *
+ * Upstream's grammar makes `within` non-optional on all three:
+ *
+ * ```
+ * once_op     = { "formerly" ~ within ~ atom }
+ * previous_op = { "previous" ~ within ~ atom }
+ * conjunct_or_since = { neg_conjunct ~ ("since" ~ within ~ atom)? }
+ * ```
+ *
+ * The typed builders make this unrepresentable — `formerly(window, body)` has
+ * nowhere to put a missing window — which is most of the fix. This check is
+ * the other part: `raw()` exists as an escape hatch, a hand-written `.dw` can
+ * be built by any other tool, and `chant audit` runs over files chant never
+ * emitted. A wall that only holds for the path that cannot breach it is not
+ * a wall.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwdc012: PostSynthCheck;
+//# sourceMappingURL=dwdc012.d.ts.map

package/dist/lint/post-synth/dwdc012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwdc012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwdc012.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAwBrB,CAAC"}

package/dist/lint/post-synth/dwde010.d.ts

@@ -0,0 +1,32 @@
+/**
+ * DWDE010: the emitted `.dw` set validates clean under `dogwood validate`
+ *
+ * The CLI-gated half of the epic's validation split. Everything the DWDC walls
+ * ask is answerable in TypeScript and gates unconditionally; everything else —
+ * macro expansion, the temporal type checker, the Cedar body checked against
+ * the action schema *through upstream's own frontend* — needs upstream's Rust
+ * frontend, which ships as a binary and nothing else. No npm package, no wasm
+ * build, no bindings.
+ *
+ * So this check has two modes and says which one it is in:
+ *
+ * - **Binary present.** Runs `dogwood validate --format json` over each
+ *   emitted policy set and reports every finding as an error. Byte-offset
+ *   labels come through as byte offsets — see `../../dogwood/cli.ts` for why
+ *   they are not converted to line/column.
+ * - **Binary absent.** Exactly one `info` finding naming the binary, where
+ *   chant looked, and this issue. The epic's words are "an explicit,
+ *   issue-linked exception, not a silent one" — a check that quietly passes
+ *   when it could not run is claiming a guarantee it did not make, which is
+ *   the same failure CEDE010's no-schema advisory exists to avoid.
+ *
+ * A run that could not be made at all — a spawn failure, an unknown flag, JSON
+ * in a shape this adapter does not know — is `warning`, not `error`. Upstream
+ * is a read-only squash-sync mirror with no tags and no changelog, and a flag
+ * rename in a sync would otherwise fail every build that has the binary
+ * installed. The adapter never reads exit 2 as "rejected" on its own for the
+ * same reason: clap spends that code on usage errors too.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwde010: PostSynthCheck;
+//# sourceMappingURL=dwde010.d.ts.map

package/dist/lint/post-synth/dwde010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwde010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwde010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,OAAO,EAAE,cA0FrB,CAAC"}

package/dist/lint/post-synth/dwde011.d.ts

@@ -0,0 +1,33 @@
+/**
+ * DWDE011: the lowered Cedar body validates clean under Cedar's own validator
+ *
+ * The epic's stated design for the non-temporal half: chant does not
+ * re-implement lowering — `dogwood lower` produces the analyzable plain-Cedar
+ * form, and a reimplementation would drift — but once that form exists, Cedar's
+ * own validator is the thing that judges it. The #1657 verification put all 86
+ * upstream example bundles through this exact path and every one parsed and
+ * validated clean in strict mode, which is what makes a finding here mean
+ * something: the lowered output is genuinely plain Cedar, so a validation error
+ * is the policy's, not the pipeline's.
+ *
+ * What this catches that DWDE010 does not is narrow but real. `dogwood
+ * validate` type-checks through upstream's vendored Cedar; this runs the
+ * *published* `@cedar-policy/cedar-wasm` over the same artifacts. A body that
+ * upstream's pinned Cedar accepts and the Cedar the rest of chant validates
+ * against rejects is exactly the drift the pin exists to make visible — and the
+ * augmented schema, with its hoisted `context.*` temporal slots, is the form a
+ * downstream Cedar policy store will actually receive.
+ *
+ * The cedar-wasm traps from #1648 all apply and are handled in
+ * `./wasm-helpers.ts`: `type: "success"` means validation *ran*, not that it
+ * passed; `validationErrors` comes back in a different order almost every call
+ * and is sorted before anything reads it; a malformed call throws rather than
+ * returning a failure answer.
+ *
+ * Silent when `lower` did not run — the binary is absent, or no action schema
+ * was emitted. Both cases are DWDE010's advisory to report, once, rather than
+ * twice in different words.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwde011: PostSynthCheck;
+//# sourceMappingURL=dwde011.d.ts.map

package/dist/lint/post-synth/dwde011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwde011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwde011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,OAAO,EAAE,cAwErB,CAAC"}

package/dist/lint/post-synth/dwds010.d.ts

@@ -0,0 +1,24 @@
+/**
+ * DWDS010: an emitted event schema with no pinned field widens every predicate
+ *
+ * The #1657 verification is specific about this one. `ServiceSchema::defaults()`
+ * — what runs when nobody passes `--event-schema` — uses
+ * `configuration/event-schemas/pinned.dwschema`, which carries
+ * `pin callerPrincipal: principalType(A) = principal` on every kind. Every
+ * temporal predicate is therefore correlated to the deciding request's
+ * principal, and events from other principals are invisible.
+ *
+ * Supplying any event schema opts out of that default wholesale. So a schema
+ * emitted without a pin does not merely "not add" a correlation: it removes
+ * one the policy author very likely assumed, and every `formerly` in the set
+ * starts matching other principals' events. That is a legitimate design —
+ * cross-principal correlation is the reason to write your own schema — but it
+ * is a decision, and a decision nobody can see in a diff is one nobody made.
+ *
+ * Report-only: chant does not know which the author wanted, only that it
+ * should be said out loud. `defaultEventSchema({ pinCallerPrincipal: false })`
+ * also stamps the reasoning into the emitted file.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const dwds010: PostSynthCheck;
+//# sourceMappingURL=dwds010.d.ts.map

package/dist/lint/post-synth/dwds010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dwds010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/dwds010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAqBrB,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAYvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAW3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAkBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAiB3C,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cedar",
-  "version": "0.44.8",
+  "version": "0.44.9",
   "chantVersion": ">=0.1.0",
   "namespace": "Cedar",
   "intrinsics": [],

package/dist/okf/index.md

@@ -35,3 +35,9 @@ okf_version: '0.2'
 * [CEDS010](/rules/CEDS010.md) - A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything
 * [CEDS011](/rules/CEDS011.md) - A policy set built entirely from permits carries no forbid to bound them
 * [CEDS012](/rules/CEDS012.md) - A permit that leaves the action scope unconstrained grants every action, including future ones
+* [DWDC010](/rules/DWDC010.md) - A dogwood temporal predicate names an event kind the emitted .dwschema declares
+* [DWDC011](/rules/DWDC011.md) - A dogwood temporal window stays inside the event schema's max_window cap
+* [DWDC012](/rules/DWDC012.md) - A dogwood formerly/previous/since operator carries its mandatory within window
+* [DWDE010](/rules/DWDE010.md) - Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available
+* [DWDE011](/rules/DWDE011.md) - The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)
+* [DWDS010](/rules/DWDS010.md) - An emitted dogwood event schema pins its temporal predicates to a request-side value

package/dist/okf/rules/DWDC010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDC010
+description: A dogwood temporal predicate names an event kind the emitted .dwschema declares
+id: DWDC010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A dogwood temporal predicate names an event kind the emitted .dwschema declares

package/dist/okf/rules/DWDC011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDC011
+description: A dogwood temporal window stays inside the event schema's max_window cap
+id: DWDC011
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A dogwood temporal window stays inside the event schema's max_window cap

package/dist/okf/rules/DWDC012.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDC012
+description: A dogwood formerly/previous/since operator carries its mandatory within window
+id: DWDC012
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A dogwood formerly/previous/since operator carries its mandatory within window

package/dist/okf/rules/DWDE010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDE010
+description: Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available
+id: DWDE010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available

package/dist/okf/rules/DWDE011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDE011
+description: The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)
+id: DWDE011
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)

package/dist/okf/rules/DWDS010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DWDS010
+description: An emitted dogwood event schema pins its temporal predicates to a request-side value
+id: DWDS010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+An emitted dogwood event schema pins its temporal predicates to a request-side value

package/dist/policy-text.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Cedar policy-text rendering, shared by the `.cedar` serializer, the AVP
+ * statement renderer, and the dogwood dialect's `.dw` leg.
+ *
+ * Upstream's dogwood policy grammar is Cedar's shape — `annotation* effect
+ * "(" scope ")" cond* ";"` — and only the `cond` rule differs, gaining
+ * `guardrails { … }` and `temporal { … }` forms. So everything above the first
+ * clause is common, and it lives here rather than being copied into
+ * `./dogwood/serialize.ts`, where a change to how a scope constraint is
+ * written would have had to be made twice.
+ *
+ * `resolvePolicyId` is here for the same reason it was extracted from
+ * `serialize()` by #1652: it is the only rule linking a chant entity to a
+ * policy id, the AVP observation matches against it, and the `.dw` leg has to
+ * derive ids the same way the `.cedar` leg does. One copy, three callers.
+ *
+ * This module is a leaf on purpose: `./serializer.ts` and `./dogwood/*` both
+ * import it, and neither imports the other's rendering.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+/** A plain object — not null, not an array. */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** The `props` of a resource-kind Declarable, or `{}` for anything else. */
+export declare function getProps(entity: Declarable): Record<string, unknown>;
+/** Escape a string for a double-quoted Cedar literal. */
+export declare function escapeCedarString(value: string): string;
+/**
+ * Derive a policy id from a logical name: `allowAdminRead` → `allow-admin-read`.
+ * Cedar ids are free-form strings; kebab-case keeps them readable in the
+ * `@id` annotation and stable across a rename-free refactor.
+ */
+export declare function policyIdFromLogicalName(name: string): string;
+/**
+ * The Cedar id for a policy: an explicit `annotations.id` when the author gave
+ * one, else derived from the logical name.
+ *
+ * This is the only rule that links a chant entity to a policy in a live AVP
+ * store (#1652) — the observation resolves the same id from the same props and
+ * matches it against the `@id` annotation the statement carries — and it is
+ * also what gives a `.dw` policy the id its `.cedar` sibling would have had.
+ * Two copies of this rule would be a mapping that drifts silently.
+ */
+export declare function resolvePolicyId(logicalName: string, props: Record<string, unknown>): string;
+/** `principal`, `principal == User::"alice"`, `action in [ … ]`, `resource is Photo`. */
+export declare function renderScope(variable: string, scope: unknown): string;
+/** A `when`/`unless` prop as a list of clause bodies — one string, or several. */
+export declare function conditionStrings(value: unknown): string[];
+/**
+ * Everything above the first clause: the annotations, the effect, and the
+ * three scope positions.
+ */
+export declare function renderPolicyHead(id: string, props: Record<string, unknown>): string[];
+//# sourceMappingURL=policy-text.d.ts.map

package/dist/policy-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-text.d.ts","sourceRoot":"","sources":["../src/policy-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,+CAA+C;AAC/C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKpE;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3F;AAMD,yFAAyF;AACzF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAcpE;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAIzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAmBrF"}