@intentius/chant-lexicon-cedar 0.44.8 → 0.44.9

package/dist/rules/dogwood-helpers.ts

@@ -0,0 +1,139 @@
+/**
+ * Turning a build's emitted files into `dogwood` CLI invocations (#1659).
+ *
+ * The DWDE checks both need the same thing: which of the emitted `.dw` files
+ * is a policy set, which is a macro library, which `.cedarschema` backs
+ * `--policy-schema`, and which `.dwschema` backs `--event-schema`. Planning
+ * that once here keeps the two checks from disagreeing about what they ran —
+ * DWDE010 validates a bundle and DWDE011 lowers the *same* bundle, and a
+ * finding from one that names different inputs than the other would be a
+ * puzzle rather than a report.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { blankComments, dogwoodPolicyFiles, dogwoodSchemaFiles, type DogwoodArtifact } from "../../dogwood/scan";
+import type { DogwoodBundle } from "../../dogwood/cli";
+
+/** One planned invocation: the files, and the names to blame in a finding. */
+export interface PreparedBundle {
+  lexicon: string;
+  /** The `.dw` policy set filename. */
+  source: string;
+  /** The `.cedarschema` filename passed as `--policy-schema`. */
+  policySchemaSource: string;
+  /** The `.dwschema` filename passed as `--event-schema`, when one was emitted. */
+  eventSchemaSource?: string;
+  bundle: DogwoodBundle;
+}
+
+/** What the CLI-gated checks should do with this build. */
+export interface DogwoodRunPlan {
+  /** True when the build emitted a `.dw` policy set at all. */
+  hasPolicies: boolean;
+  /** Every invocation to make. Empty when {@link blocked} is set. */
+  bundles: PreparedBundle[];
+  /** Why nothing can be run, when policies exist but a required input does not. */
+  blocked?: string;
+  /** The lexicon the `.dw` output came from, for a finding that names no file. */
+  lexicon?: string;
+}
+
+/**
+ * A `.dw` file holding only `def` declarations is a macro library, not a
+ * policy set.
+ *
+ * By structure rather than by filename: the serializer's default is
+ * `macros.dw`, but `MacroLibraryProps.filename` overrides it, and `chant
+ * audit` runs over trees chant never wrote. A policy set is a file with a
+ * `permit` or `forbid` head in it — upstream's policy grammar has no third
+ * effect — and a set with inlined macros still has one.
+ */
+export function looksLikeMacroLibrary(text: string): boolean {
+  return !/\b(permit|forbid)\s*\(/.test(blankComments(text));
+}
+
+function byName(a: DogwoodArtifact, b: DogwoodArtifact): number {
+  return a.source.localeCompare(b.source);
+}
+
+/**
+ * The Cedar action schema the CLI needs, as text.
+ *
+ * `--policy-schema` reads a human-readable `.cedarschema`; a `.cedarschema.json`
+ * is not a substitute, so it is not offered as one. Sorted by filename so a
+ * build emitting several picks the same one on every run.
+ */
+function findPolicySchema(ctx: PostSynthContext): DogwoodArtifact | undefined {
+  const found: DogwoodArtifact[] = [];
+  for (const [lexicon, output] of ctx.outputs) {
+    if (typeof output === "string") continue;
+    for (const [source, text] of Object.entries(output.files ?? {})) {
+      if (typeof text !== "string") continue;
+      if (!source.endsWith(".cedarschema")) continue;
+      found.push({ lexicon, source, text });
+    }
+  }
+  return found.sort(byName)[0];
+}
+
+/**
+ * Plan every `dogwood` invocation this build calls for.
+ *
+ * One bundle per policy set per emitted event schema. A build with several
+ * `.dwschema` files means several services, and `--event-schema` takes exactly
+ * one file, so the set is run against each and every finding names the schema
+ * it was found under — the alternative is picking one silently and reporting
+ * against a schema the reader did not choose. Macro libraries do combine: a
+ * library is a sequence of `def`s, so several concatenate into the one file
+ * `--macros` accepts.
+ */
+export function planDogwoodRuns(ctx: PostSynthContext): DogwoodRunPlan {
+  const files = dogwoodPolicyFiles(ctx).sort(byName);
+  const policySets = files.filter((f) => !looksLikeMacroLibrary(f.text));
+  if (policySets.length === 0) return { hasPolicies: false, bundles: [] };
+
+  const lexicon = policySets[0].lexicon;
+  const libraries = files.filter((f) => looksLikeMacroLibrary(f.text));
+  const macros = libraries.length > 0 ? libraries.map((f) => f.text).join("\n") : undefined;
+
+  const policySchema = findPolicySchema(ctx);
+  if (!policySchema) {
+    return {
+      hasPolicies: true,
+      bundles: [],
+      lexicon,
+      blocked:
+        "no Cedar action schema (.cedarschema) was emitted beside them, and `dogwood validate` requires one via --policy-schema",
+    };
+  }
+
+  const eventSchemas = dogwoodSchemaFiles(ctx).sort(byName);
+  const bundles: PreparedBundle[] = [];
+
+  for (const set of policySets) {
+    for (const events of eventSchemas.length > 0 ? eventSchemas : [undefined]) {
+      bundles.push({
+        lexicon: set.lexicon,
+        source: set.source,
+        policySchemaSource: policySchema.source,
+        ...(events ? { eventSchemaSource: events.source } : {}),
+        bundle: {
+          policies: set.text,
+          policySchema: policySchema.text,
+          ...(events ? { eventSchema: events.text } : {}),
+          ...(macros !== undefined ? { macros } : {}),
+        },
+      });
+    }
+  }
+
+  return { hasPolicies: true, bundles, lexicon };
+}
+
+/** How a finding names the inputs a run was made with. */
+export function describeBundle(prepared: PreparedBundle): string {
+  const parts = [`"${prepared.source}"`, `against "${prepared.policySchemaSource}"`];
+  if (prepared.eventSchemaSource) parts.push(`with "${prepared.eventSchemaSource}"`);
+  return parts.join(" ");
+}

package/dist/rules/dwdc010.ts

@@ -0,0 +1,62 @@
+/**
+ * DWDC010: a temporal predicate must name an event kind the schema declares
+ *
+ * Upstream rejects this outright — a predicate naming an undeclared kind fails
+ * `dogwood validate` with code `extension`: "predicate
+ * `Drupe::Action::\"Read\"::nosuchkind` does not name a declared event (no
+ * event kind `nosuchkind` derived for action `Read`)". Catching it in
+ * TypeScript is the point of the split epic #1646 drew: everything answerable
+ * without the binary runs always and gates, and this one is answerable.
+ *
+ * The check is on the event *kind*, not the action, and that is not a
+ * shortcut. Upstream's `.dwschema` grammar declares events against a symbolic
+ * action binder — `decision event <A>::request { … }` — so the file names no
+ * actions at all and cannot be asked whether one exists. The action half of
+ * that upstream error comes from the Cedar action schema
+ * (`--policy-schema`), which is #1659's CLI-gated leg.
+ *
+ * Silent when no `.dwschema` was emitted: with none supplied,
+ * `ServiceSchema::defaults()` decides the kinds at the far end, and guessing
+ * that a project's out-of-band schema matches upstream's default would fail
+ * builds for a policy set that is fine.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { dogwoodPolicyFiles, dogwoodSchemaFiles, readEventSchema, scanPredicates } from "../../dogwood/scan";
+
+export const dwdc010: PostSynthCheck = {
+  id: "DWDC010",
+  description: "A dogwood temporal predicate names an event kind the emitted .dwschema declares",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const schemas = dogwoodSchemaFiles(ctx);
+    if (schemas.length === 0) return [];
+
+    const declared = new Set<string>();
+    for (const schema of schemas) {
+      for (const kind of readEventSchema(schema.text).kinds) declared.add(kind);
+    }
+    if (declared.size === 0) return [];
+
+    const known = [...declared].sort().join(", ");
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const policies of dogwoodPolicyFiles(ctx)) {
+      const seen = new Set<string>();
+      for (const ref of scanPredicates(policies.text)) {
+        if (declared.has(ref.kind)) continue;
+        const key = `${ref.action}::${ref.kind}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        diagnostics.push({
+          checkId: "DWDC010",
+          severity: "error",
+          message: `Dogwood policy set "${policies.source}" has a temporal predicate on ${key}, but the emitted event schema declares no event kind "${ref.kind}" (declared: ${known}).`,
+          entity: policies.source,
+          lexicon: policies.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/dwdc011.ts

@@ -0,0 +1,61 @@
+/**
+ * DWDC011: a temporal window must fit inside the schema's `max_window`
+ *
+ * `formerly within 48h` under a 24h cap is an upstream validation error —
+ * "temporal window `48h` exceeds the maximum allowed window `24h` set by the
+ * event schema's `max_window`" — and it is arithmetic, so it needs no binary.
+ *
+ * Unlike DWDC010 this fires with no `.dwschema` emitted, because the cap
+ * applies either way: `ServiceSchema::defaults()` caps look-back at 24h, and
+ * so does an emitted schema that omits the directive. Where several schemas
+ * are emitted the tightest cap wins — a window one consumer accepts and
+ * another rejects is still a window that will be rejected.
+ *
+ * Macro-call intervals count. `once(48h, …)` expands to `formerly within 48h`
+ * through the default library's `within ?w`, so it looks back exactly as far.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  dogwoodPolicyFiles,
+  dogwoodSchemaFiles,
+  effectiveMaxWindowSeconds,
+  readEventSchema,
+  scanWindows,
+} from "../../dogwood/scan";
+
+export const dwdc011: PostSynthCheck = {
+  id: "DWDC011",
+  description: "A dogwood temporal window stays inside the event schema's max_window cap",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const policyFiles = dogwoodPolicyFiles(ctx);
+    if (policyFiles.length === 0) return [];
+
+    const schemas = dogwoodSchemaFiles(ctx).map((s) => readEventSchema(s.text));
+    const cap = effectiveMaxWindowSeconds(schemas);
+    const source =
+      schemas.length === 0
+        ? "upstream's default cap (no event schema was emitted)"
+        : `the emitted event schema's max_window`;
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const policies of policyFiles) {
+      const reported = new Set<string>();
+      for (const window of scanWindows(policies.text)) {
+        if (window.seconds <= cap.seconds) continue;
+        if (reported.has(window.text)) continue;
+        reported.add(window.text);
+        diagnostics.push({
+          checkId: "DWDC011",
+          severity: "error",
+          message: `Dogwood policy set "${policies.source}" looks back ${window.text}, past the ${cap.text} allowed by ${source}. Raise max_window in the event schema, or shorten the window.`,
+          entity: policies.source,
+          lexicon: policies.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/dwdc012.ts

@@ -0,0 +1,46 @@
+/**
+ * DWDC012: `formerly`, `previous` and `since` carry a mandatory window
+ *
+ * Upstream's grammar makes `within` non-optional on all three:
+ *
+ * ```
+ * once_op     = { "formerly" ~ within ~ atom }
+ * previous_op = { "previous" ~ within ~ atom }
+ * conjunct_or_since = { neg_conjunct ~ ("since" ~ within ~ atom)? }
+ * ```
+ *
+ * The typed builders make this unrepresentable — `formerly(window, body)` has
+ * nowhere to put a missing window — which is most of the fix. This check is
+ * the other part: `raw()` exists as an escape hatch, a hand-written `.dw` can
+ * be built by any other tool, and `chant audit` runs over files chant never
+ * emitted. A wall that only holds for the path that cannot breach it is not
+ * a wall.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { dogwoodPolicyFiles, scanWindowlessOperators } from "../../dogwood/scan";
+
+export const dwdc012: PostSynthCheck = {
+  id: "DWDC012",
+  description: "A dogwood formerly/previous/since operator carries its mandatory within window",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const policies of dogwoodPolicyFiles(ctx)) {
+      const seen = new Set<string>();
+      for (const operator of scanWindowlessOperators(policies.text)) {
+        if (seen.has(operator)) continue;
+        seen.add(operator);
+        diagnostics.push({
+          checkId: "DWDC012",
+          severity: "error",
+          message: `Dogwood policy set "${policies.source}" uses \`${operator}\` with no \`within\` window. All three past-only operators require one — write \`${operator} within <n><s|m|h|d> …\`.`,
+          entity: policies.source,
+          lexicon: policies.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/dwde010.ts

@@ -0,0 +1,130 @@
+/**
+ * DWDE010: the emitted `.dw` set validates clean under `dogwood validate`
+ *
+ * The CLI-gated half of the epic's validation split. Everything the DWDC walls
+ * ask is answerable in TypeScript and gates unconditionally; everything else —
+ * macro expansion, the temporal type checker, the Cedar body checked against
+ * the action schema *through upstream's own frontend* — needs upstream's Rust
+ * frontend, which ships as a binary and nothing else. No npm package, no wasm
+ * build, no bindings.
+ *
+ * So this check has two modes and says which one it is in:
+ *
+ * - **Binary present.** Runs `dogwood validate --format json` over each
+ *   emitted policy set and reports every finding as an error. Byte-offset
+ *   labels come through as byte offsets — see `../../dogwood/cli.ts` for why
+ *   they are not converted to line/column.
+ * - **Binary absent.** Exactly one `info` finding naming the binary, where
+ *   chant looked, and this issue. The epic's words are "an explicit,
+ *   issue-linked exception, not a silent one" — a check that quietly passes
+ *   when it could not run is claiming a guarantee it did not make, which is
+ *   the same failure CEDE010's no-schema advisory exists to avoid.
+ *
+ * A run that could not be made at all — a spawn failure, an unknown flag, JSON
+ * in a shape this adapter does not know — is `warning`, not `error`. Upstream
+ * is a read-only squash-sync mirror with no tags and no changelog, and a flag
+ * rename in a sync would otherwise fail every build that has the binary
+ * installed. The adapter never reads exit 2 as "rejected" on its own for the
+ * same reason: clap spends that code on usage errors too.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  DOGWOOD_BINARY_NAME,
+  DOGWOOD_SEARCH_ORDER,
+  findDogwoodBinary,
+  formatDogwoodDiagnostic,
+  runDogwoodValidate,
+} from "../../dogwood/cli";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers";
+
+export const dwde010: PostSynthCheck = {
+  id: "DWDE010",
+  description: "Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const plan = planDogwoodRuns(ctx);
+    if (!plan.hasPolicies) return [];
+
+    const binary = findDogwoodBinary();
+    if (!binary) {
+      return [
+        {
+          checkId: "DWDE010",
+          severity: "info",
+          message: `This build emitted dogwood .dw policies, but no \`${DOGWOOD_BINARY_NAME}\` binary was found, so full .dw validation did not run — the DWDC walls checked what TypeScript can answer and nothing checked macro expansion, the temporal type check, or the Cedar body against the action schema. chant looked at ${DOGWOOD_SEARCH_ORDER}. See chant #1659.`,
+          lexicon: plan.lexicon,
+        },
+      ];
+    }
+
+    if (plan.blocked) {
+      return [
+        {
+          checkId: "DWDE010",
+          severity: "info",
+          message: `This build emitted dogwood .dw policies and \`${DOGWOOD_BINARY_NAME}\` is available, but ${plan.blocked}, so full .dw validation did not run. See chant #1659.`,
+          lexicon: plan.lexicon,
+        },
+      ];
+    }
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const prepared of plan.bundles) {
+      const where = describeBundle(prepared);
+      const result = runDogwoodValidate(binary.path, prepared.bundle);
+
+      if (result.kind === "unusable") {
+        diagnostics.push({
+          checkId: "DWDE010",
+          severity: "warning",
+          message: `Dogwood policy set ${where} could not be validated — ${result.reason}. The policy set was neither accepted nor rejected.`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      if (result.kind === "fatal") {
+        for (const finding of [result.error, ...result.related]) {
+          diagnostics.push({
+            checkId: "DWDE010",
+            severity: "error",
+            message: `Dogwood policy set ${where} could not be parsed or lowered: ${formatDogwoodDiagnostic(finding)}`,
+            entity: prepared.source,
+            lexicon: prepared.lexicon,
+          });
+        }
+        continue;
+      }
+
+      if (result.kind === "rejected") {
+        for (const finding of result.errors) {
+          diagnostics.push({
+            checkId: "DWDE010",
+            severity: "error",
+            message: `Dogwood policy set ${where} fails \`dogwood validate\`: ${formatDogwoodDiagnostic(finding)}`,
+            entity: prepared.source,
+            lexicon: prepared.lexicon,
+          });
+        }
+      }
+
+      // Upstream's own warnings ride along at warning severity. They do not
+      // fail `dogwood validate` (`passed` ignores them), and they should not
+      // fail a build either — but dropping them would throw away the half of
+      // the report that says a policy is legal and pointless.
+      for (const finding of result.warnings) {
+        diagnostics.push({
+          checkId: "DWDE010",
+          severity: "warning",
+          message: `Dogwood policy set ${where} draws a \`dogwood validate\` warning: ${formatDogwoodDiagnostic(finding)}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/dwde011.ts

@@ -0,0 +1,108 @@
+/**
+ * DWDE011: the lowered Cedar body validates clean under Cedar's own validator
+ *
+ * The epic's stated design for the non-temporal half: chant does not
+ * re-implement lowering — `dogwood lower` produces the analyzable plain-Cedar
+ * form, and a reimplementation would drift — but once that form exists, Cedar's
+ * own validator is the thing that judges it. The #1657 verification put all 86
+ * upstream example bundles through this exact path and every one parsed and
+ * validated clean in strict mode, which is what makes a finding here mean
+ * something: the lowered output is genuinely plain Cedar, so a validation error
+ * is the policy's, not the pipeline's.
+ *
+ * What this catches that DWDE010 does not is narrow but real. `dogwood
+ * validate` type-checks through upstream's vendored Cedar; this runs the
+ * *published* `@cedar-policy/cedar-wasm` over the same artifacts. A body that
+ * upstream's pinned Cedar accepts and the Cedar the rest of chant validates
+ * against rejects is exactly the drift the pin exists to make visible — and the
+ * augmented schema, with its hoisted `context.*` temporal slots, is the form a
+ * downstream Cedar policy store will actually receive.
+ *
+ * The cedar-wasm traps from #1648 all apply and are handled in
+ * `./wasm-helpers.ts`: `type: "success"` means validation *ran*, not that it
+ * passed; `validationErrors` comes back in a different order almost every call
+ * and is sorted before anything reads it; a malformed call throws rather than
+ * returning a failure answer.
+ *
+ * Silent when `lower` did not run — the binary is absent, or no action schema
+ * was emitted. Both cases are DWDE010's advisory to report, once, rather than
+ * twice in different words.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { findDogwoodBinary, runDogwoodLower } from "../../dogwood/cli";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers";
+import { loadWasm, validatePolicySet } from "./wasm-helpers";
+
+export const dwde011: PostSynthCheck = {
+  id: "DWDE011",
+  description: "The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const plan = planDogwoodRuns(ctx);
+    if (!plan.hasPolicies || plan.blocked || plan.bundles.length === 0) return [];
+
+    const binary = findDogwoodBinary();
+    if (!binary) return [];
+
+    // A missing validator is not this check's finding to report; the cedar leg
+    // says so already through CEDC010.
+    const wasm = loadWasm();
+    if (!wasm) return [];
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const prepared of plan.bundles) {
+      const where = describeBundle(prepared);
+      const lowered = runDogwoodLower(binary.path, prepared.bundle);
+
+      if (lowered.kind === "unusable") {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "warning",
+          message: `Dogwood policy set ${where} could not be lowered to Cedar — ${lowered.reason}. Its non-temporal body was not checked by Cedar's validator.`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      if (lowered.kind === "fatal") {
+        // The same fatal DWDE010 reports from its own run. Saying it twice
+        // helps nobody, so this arm stays quiet and lets the validate leg own
+        // the parse/lower channel.
+        continue;
+      }
+
+      const { cedarPolicies, cedarSchema } = lowered.value;
+
+      // The lowered policies go in as Cedar text. cedar-wasm synthesizes ids
+      // (`policy0`, `policy1`) for a bare-string set and does not read `@id`
+      // annotations as ids (#1648), so a finding names the .dw file it came
+      // from as well as the id the validator used.
+      const outcome = validatePolicySet(wasm, { staticPolicies: cedarPolicies }, cedarSchema);
+
+      if (outcome.failure) {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "error",
+          message: `The Cedar lowered from dogwood policy set ${where} could not be validated: ${outcome.failure}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      for (const finding of outcome.errors) {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "error",
+          message: `The Cedar lowered from dogwood policy set ${where} fails Cedar validation (lowered policy "${finding.policyId}"): ${finding.message}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/dwds010.ts

@@ -0,0 +1,46 @@
+/**
+ * DWDS010: an emitted event schema with no pinned field widens every predicate
+ *
+ * The #1657 verification is specific about this one. `ServiceSchema::defaults()`
+ * — what runs when nobody passes `--event-schema` — uses
+ * `configuration/event-schemas/pinned.dwschema`, which carries
+ * `pin callerPrincipal: principalType(A) = principal` on every kind. Every
+ * temporal predicate is therefore correlated to the deciding request's
+ * principal, and events from other principals are invisible.
+ *
+ * Supplying any event schema opts out of that default wholesale. So a schema
+ * emitted without a pin does not merely "not add" a correlation: it removes
+ * one the policy author very likely assumed, and every `formerly` in the set
+ * starts matching other principals' events. That is a legitimate design —
+ * cross-principal correlation is the reason to write your own schema — but it
+ * is a decision, and a decision nobody can see in a diff is one nobody made.
+ *
+ * Report-only: chant does not know which the author wanted, only that it
+ * should be said out loud. `defaultEventSchema({ pinCallerPrincipal: false })`
+ * also stamps the reasoning into the emitted file.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { dogwoodSchemaFiles, readEventSchema } from "../../dogwood/scan";
+
+export const dwds010: PostSynthCheck = {
+  id: "DWDS010",
+  description: "An emitted dogwood event schema pins its temporal predicates to a request-side value",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const schema of dogwoodSchemaFiles(ctx)) {
+      const facts = readEventSchema(schema.text);
+      if (facts.kinds.length === 0 || facts.hasPin) continue;
+      diagnostics.push({
+        checkId: "DWDS010",
+        severity: "warning",
+        message: `Dogwood event schema "${schema.source}" declares no pinned field, so temporal predicates correlate across every principal — wider than upstream's default, which pins callerPrincipal to the deciding request's principal. Add a pinned field, or record why cross-principal correlation is wanted.`,
+        entity: schema.source,
+        lexicon: schema.lexicon,
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts

@@ -19,6 +19,12 @@
  * (#1650) generates typed classes onto exactly this shape, so nothing here
  * changes when it lands — the guards become typed expressions rather than
  * the opaque Cedar-expression strings they are today.
+ *
+ * A third view arrives when the build holds dogwood entities (#1658): `.dw`
+ * policy text and its `.dwschema`/`macros.dw` companions, rendered by
+ * `./dogwood/serialize.ts` and returned in the same result. Both legs share
+ * `./policy-text.ts` rather than a copy of it, because a `.dw` policy's head
+ * *is* a Cedar policy's head.
  */
 import type { Declarable } from "@intentius/chant/declarable";
 import type { Serializer } from "@intentius/chant/serializer";
@@ -69,14 +75,7 @@ export interface CedarPolicyProps {
      */
     annotations?: Record<string, string>;
 }
-/** Escape a string for a double-quoted Cedar literal. */
-export declare function escapeCedarString(value: string): string;
-/**
- * Derive a policy id from a logical name: `allowAdminRead` → `allow-admin-read`.
- * Cedar ids are free-form strings; kebab-case keeps them readable in the
- * `@id` annotation and stable across a rename-free refactor.
- */
-export declare function policyIdFromLogicalName(name: string): string;
+export { conditionStrings, escapeCedarString, getProps, isRecord, policyIdFromLogicalName, renderPolicyHead, renderScope, resolvePolicyId, } from "./policy-text.js";
 /**
  * One policy, as `.cedar` text.
  *
@@ -84,6 +83,9 @@ export declare function policyIdFromLogicalName(name: string): string;
  * nothing else — `AWS::VerifiedPermissions::Policy` carries its policy as
  * `Definition.Static.Statement`, a single Cedar policy rather than a set. Two
  * renderers would be two dialects; there is one.
+ *
+ * The head comes from `renderPolicyHead`, which the dogwood dialect's `.dw`
+ * leg also calls: three surfaces, one rendering of an annotation and a scope.
  */
 export declare function renderPolicyText(id: string, props: Record<string, unknown>): string;
 /** The JSON policy-set envelope, exactly as `cedar-wasm` accepts it. */
@@ -117,16 +119,6 @@ export interface CedarPolicyRecord {
     /** Props with references resolved, ready for either renderer. */
     props: Record<string, unknown>;
 }
-/**
- * The Cedar id for a policy: an explicit `annotations.id` when the author gave
- * one, else derived from the logical name.
- *
- * This is the only rule that links a chant entity to a policy in a live AVP
- * store (#1652) — the observation resolves the same id from the same props and
- * matches it against the `@id` annotation the statement carries. Two copies of
- * this rule would be a mapping that drifts silently, so there is one.
- */
-export declare function resolvePolicyId(logicalName: string, props: Record<string, unknown>): string;
 /**
  * Every `Cedar::Policy` in a build, with references walked and ids resolved.
  *

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAI5F,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAeD,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AAmDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA0BnF;AAID,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,aAAa,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BxF;AAID,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAiBzF;AAID,eAAO,MAAM,eAAe,EAAE,UAgC7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAY5F,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AASD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,QAAQ,EACR,uBAAuB,EACvB,gBAAgB,EAChB,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AAwBvB;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAWnF;AAID,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,aAAa,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BxF;AAID,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAiBzF;AAID,eAAO,MAAM,eAAe,EAAE,UAqD7B,CAAC"}