@intentius/chant-lexicon-cedar 0.44.8

package/dist/serializer.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Cedar lexicon serializer.
+ *
+ * Emits two views of the same policy set:
+ *
+ * - `.cedar` policy text — the primary output, and the surface every Cedar
+ *   evaluator reads (AVP, cedar-agent, an embedded `cedar-wasm`).
+ * - the Cedar JSON policy format — a second file, written alongside, and the
+ *   parse source for import (#1653). It is produced by handing the emitted
+ *   `.cedar` text back to `cedar-wasm`, so what lands on disk is whatever
+ *   Cedar itself says that text means. Deriving it from the in-memory model
+ *   instead is what shipped first, and it wrote `when` bodies as
+ *   `{ "__expr": "<text>" }` — a key Cedar's JSON grammar does not have, which
+ *   every Cedar tool rejects with `unknown variant '__expr'`.
+ *
+ * The entity model this serializer reads is hand-shaped for now: one
+ * `Cedar::Policy` entity type whose `props` carry an effect, three scope
+ * constraints, and optional `when`/`unless` guards. Schema-driven codegen
+ * (#1650) generates typed classes onto exactly this shape, so nothing here
+ * changes when it lands — the guards become typed expressions rather than
+ * the opaque Cedar-expression strings they are today.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { Serializer } from "@intentius/chant/serializer";
+import { type PolicyJson } from "./spec/wasm.js";
+/** The `entityType` this serializer reads. */
+export declare const CEDAR_POLICY_TYPE = "Cedar::Policy";
+/** Filename of the JSON policy-set companion to the primary `.cedar` output. */
+export declare const CEDAR_JSON_FILENAME = "policies.cedar.json";
+/** A Cedar policy either permits or forbids; there is no third effect. */
+export type CedarEffect = "permit" | "forbid";
+/**
+ * One scope position (`principal`, `action`, `resource`).
+ *
+ * `{}` is "any" — the unconstrained form Cedar writes as a bare variable.
+ * The constrained forms mirror the grammar: `== E`, `in E`, `in [E, …]`,
+ * `is T`, and `is T in E`.
+ */
+export type CedarScope = Record<string, never> | {
+    eq: string;
+    in?: never;
+    is?: never;
+} | {
+    in: string | string[];
+    eq?: never;
+    is?: never;
+} | {
+    is: string;
+    in?: string | string[];
+    eq?: never;
+};
+/** The `props` of a `Cedar::Policy` entity. */
+export interface CedarPolicyProps {
+    /** Defaults to `permit` when omitted. */
+    effect?: CedarEffect;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    principal?: CedarScope;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    action?: CedarScope;
+    /** Defaults to unconstrained (`{}`) when omitted. */
+    resource?: CedarScope;
+    /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+    when?: string[];
+    /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+    unless?: string[];
+    /**
+     * Emitted as `@key("value")` above the policy. An explicit `id` wins over
+     * the one derived from the logical name.
+     */
+    annotations?: Record<string, string>;
+}
+/** Escape a string for a double-quoted Cedar literal. */
+export declare function escapeCedarString(value: string): string;
+/**
+ * Derive a policy id from a logical name: `allowAdminRead` → `allow-admin-read`.
+ * Cedar ids are free-form strings; kebab-case keeps them readable in the
+ * `@id` annotation and stable across a rename-free refactor.
+ */
+export declare function policyIdFromLogicalName(name: string): string;
+/**
+ * One policy, as `.cedar` text.
+ *
+ * Exported because the AVP embedding (#1652) needs exactly this string and
+ * nothing else — `AWS::VerifiedPermissions::Policy` carries its policy as
+ * `Definition.Static.Statement`, a single Cedar policy rather than a set. Two
+ * renderers would be two dialects; there is one.
+ */
+export declare function renderPolicyText(id: string, props: Record<string, unknown>): string;
+/** The JSON policy-set envelope, exactly as `cedar-wasm` accepts it. */
+export interface CedarPolicySetJSON {
+    staticPolicies: Record<string, PolicyJson>;
+    templates: Record<string, PolicyJson>;
+    templateLinks: unknown[];
+}
+/**
+ * Build the JSON companion from the emitted `.cedar` text.
+ *
+ * Two things fall out of going through the module rather than around it. The
+ * condition bodies become real expression trees, which is the whole reason the
+ * file is worth writing; and a policy carrying a `?principal`/`?resource` slot
+ * lands under `templates` rather than `staticPolicies`, because Cedar — not
+ * this serializer — is what decides which one it is.
+ *
+ * Ids come from each policy's own `@id`, not from the emission order, so the
+ * keys here cannot drift from the annotations in the text beside them.
+ */
+export declare function policySetJSON(text: string): {
+    doc?: CedarPolicySetJSON;
+    error?: string;
+};
+/** One declared policy, resolved: its chant name, its Cedar id, and its walked props. */
+export interface CedarPolicyRecord {
+    /** The chant entity name — the export name on the `*.ts` file. */
+    name: string;
+    /** The Cedar policy id, as it appears in `@id(…)`. */
+    id: string;
+    /** Props with references resolved, ready for either renderer. */
+    props: Record<string, unknown>;
+}
+/**
+ * The Cedar id for a policy: an explicit `annotations.id` when the author gave
+ * one, else derived from the logical name.
+ *
+ * This is the only rule that links a chant entity to a policy in a live AVP
+ * store (#1652) — the observation resolves the same id from the same props and
+ * matches it against the `@id` annotation the statement carries. Two copies of
+ * this rule would be a mapping that drifts silently, so there is one.
+ */
+export declare function resolvePolicyId(logicalName: string, props: Record<string, unknown>): string;
+/**
+ * Every `Cedar::Policy` in a build, with references walked and ids resolved.
+ *
+ * The serializer's own first pass, exported so the AVP embedding (#1652)
+ * renders from the same model rather than re-deriving it.
+ */
+export declare function cedarPolicyRecords(entities: Map<string, Declarable>): CedarPolicyRecord[];
+export declare const cedarSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,6BAA6B,CAAC;AAGhF,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAI5F,8CAA8C;AAC9C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAClB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qDAAqD;IACrD,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,qDAAqD;IACrD,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAeD,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM5D;AAmDD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CA0BnF;AAID,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACtC,aAAa,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,kBAAkB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CA4BxF;AAID,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK3F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,EAAE,CAiBzF;AAID,eAAO,MAAM,eAAe,EAAE,UAgC7B,CAAC"}

package/dist/spec/fetch.d.ts

@@ -0,0 +1,71 @@
+/**
+ * "Fetch" the Cedar schema — which for this lexicon means reading a file.
+ *
+ * Every other lexicon downloads one global upstream spec. Cedar's interesting
+ * spec is the *project's* schema (epic #1645), so there is nothing to fetch,
+ * nothing to cache, and no network at all. What replaces it is a small
+ * resolution order:
+ *
+ *   1. `cedar.schema` from the project's `chant.config.ts`
+ *   2. `schema.cedarschema` in the project root
+ *   3. the schema bundled at `./default-schema.cedarschema`
+ *
+ * Step 3 is the one that needs defending. Without it `generate()` has nothing
+ * to read in a checkout that has not written a schema yet — which is every
+ * fresh clone, `just check-lexicons`, and this lexicon's own examples — and a
+ * lexicon whose generate step only works after the user does something is a
+ * lexicon whose generate step is never gated. The default is a real
+ * application-authorization schema, not a stub, so the surface it produces is
+ * worth exercising.
+ *
+ * `requireProjectSchema` turns step 3 off for projects that have moved past it.
+ */
+/** Filename the bundled fallback schema ships under. */
+export declare const DEFAULT_SCHEMA_FILENAME = "default-schema.cedarschema";
+/** Map key used for the single schema entry, so `parseSchema` can tell them apart. */
+export declare const DEFAULT_SCHEMA_KEY = "<bundled-default>";
+/** Absolute path to the schema bundled with this package. */
+export declare function defaultSchemaPath(): string;
+export interface SchemaSource {
+    /** Absolute path the text came from. */
+    path: string;
+    /** The `.cedarschema` text. */
+    text: string;
+    /** True when the bundled fallback was used rather than a project schema. */
+    isDefault: boolean;
+}
+export interface ResolveSchemaOptions {
+    /** Project root to resolve a relative `cedar.schema` against. Defaults to `process.cwd()`. */
+    projectRoot?: string;
+    /** Already-loaded `cedar` config namespace, if the caller has one. */
+    config?: {
+        schema?: string;
+        validation?: {
+            requireProjectSchema?: boolean;
+        };
+    };
+}
+/**
+ * Resolve which schema `generate()` should read, without loading it.
+ *
+ * Separated from {@link fetchSchemas} so tests and `coverage()` can ask the
+ * question without reading the file.
+ */
+export declare function resolveSchemaPath(options?: ResolveSchemaOptions): {
+    path: string;
+    isDefault: boolean;
+};
+/** Read the resolved schema. */
+export declare function readSchemaSource(options?: ResolveSchemaOptions): SchemaSource;
+/**
+ * The `fetchSchemas` callback for `generatePipeline`.
+ *
+ * Keyed by `<bundled-default>` or by the project schema's absolute path, which
+ * is how `parseSchema` knows whether the content pin applies.
+ */
+export declare function fetchSchemas(options?: {
+    force?: boolean;
+    projectRoot?: string;
+    config?: ResolveSchemaOptions["config"];
+}): Promise<Map<string, Buffer>>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/spec/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AAEpE,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAItD,6DAA6D;AAC7D,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoB1G;AAED,gCAAgC;AAChC,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAGjF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAK/B"}

package/dist/spec/parse.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Turn a `.cedarschema` into the flat declaration list the emitters read.
+ *
+ * The canonical input is the human-readable syntax and the canonical
+ * intermediate is `schemaToJsonWithResolvedTypes`' output (#1648 §4). That
+ * choice buys one thing that matters here: `schemaToJson` emits
+ * `{type:"EntityOrCommon", name}` for every named type, which cannot
+ * distinguish an entity reference from a primitive from a common-type alias,
+ * so an emitter reading it would have to re-implement Cedar's own name
+ * resolution. The resolved form hands back `{type:"Entity", name:"App::User"}`
+ * for references and bare primitives for the rest.
+ *
+ * What it does *not* resolve is common types in attribute position: those come
+ * back as a bare qualified name (`{type:"App::TagSet"}`) with the definition
+ * still in `commonTypes`. {@link resolveTypeRef} closes that last hop, so
+ * nothing downstream ever sees an alias.
+ *
+ * One declaration per entity type and one per action, each carrying its own
+ * fully-qualified `typeName` — which is what lets `NamingStrategy` contest
+ * short names across namespaces the same way it does for every other lexicon.
+ */
+import type { ParsedResult } from "@intentius/chant/codegen/generate";
+import { type ResolvedSchemaJson, type ResolvedType } from "./wasm.js";
+/** A Cedar type, with common-type aliases already collapsed. */
+export type CedarTypeRef = {
+    kind: "primitive";
+    cedar: "String" | "Long" | "Bool";
+    ts: "string" | "number" | "boolean";
+} | {
+    kind: "entity";
+    entityType: string;
+} | {
+    kind: "set";
+    element: CedarTypeRef;
+} | {
+    kind: "record";
+    attributes: CedarAttribute[];
+}
+/** `ipaddr`, `decimal`, `datetime`, `duration` — carried as strings in TS. */
+ | {
+    kind: "extension";
+    name: string;
+}
+/** An enumerated entity type, or anything the resolver left unrecognized. */
+ | {
+    kind: "opaque";
+    name: string;
+};
+export interface CedarAttribute {
+    name: string;
+    required: boolean;
+    type: CedarTypeRef;
+}
+interface CedarDeclBase extends ParsedResult {
+    /** Fully-qualified: `App::User`, or `App::Action::"read"`. */
+    typeName: string;
+    /** Namespace the declaration lives in; `""` for the empty namespace. */
+    namespace: string;
+    propertyTypes: Array<{
+        name: string;
+    }>;
+    enums: unknown[];
+}
+export interface CedarEntityDecl extends CedarDeclBase {
+    kind: "entity";
+    /** Unqualified name as written in the schema. */
+    shortName: string;
+    /** Fully-qualified parents from `in [...]`. */
+    memberOfTypes: string[];
+    attributes: CedarAttribute[];
+    /** Present for an enumerated entity (`entity Env enum ["prod","dev"]`). */
+    enumValues?: string[];
+}
+export interface CedarActionDecl extends CedarDeclBase {
+    kind: "action";
+    /** The action id as written (`read`). */
+    actionId: string;
+    principalTypes: string[];
+    resourceTypes: string[];
+    context: CedarAttribute[];
+}
+export type CedarDecl = CedarEntityDecl | CedarActionDecl;
+export interface ParsedSchema {
+    decls: CedarDecl[];
+    /** The resolved JSON, kept for the content pin and for coverage reporting. */
+    resolved: ResolvedSchemaJson;
+}
+/**
+ * Parse a `.cedarschema` into declarations plus the resolved JSON it came from.
+ *
+ * Throws with the wasm's own message on a schema that does not parse — which
+ * is the right failure for a project schema that is malformed, and reads far
+ * better than the alternative, since Cedar's parse errors carry `did you mean`
+ * suggestions.
+ */
+export declare function parseCedarSchema(schemaText: string): ParsedSchema;
+/**
+ * `parseSchema` for `generatePipeline`. One buffer in, many declarations out.
+ */
+export declare function parseSchema(_typeName: string, data: Buffer): CedarDecl[];
+/** `App` + `User` → `App::User`; the empty namespace yields the bare name. */
+export declare function qualify(namespace: string, shortName: string): string;
+/** The entity UID form an action is referenced by in a policy. */
+export declare function actionUid(namespace: string, actionId: string): string;
+/**
+ * Collapse one resolved type node, following common-type aliases.
+ *
+ * `seen` guards a schema whose common types reference each other — Cedar
+ * rejects true cycles, but a malformed one should not spin here.
+ */
+export declare function resolveTypeRef(node: ResolvedType, commonTypes: Record<string, ResolvedType>, namespace: string, seen?: ReadonlySet<string>): CedarTypeRef;
+export {};
+//# sourceMappingURL=parse.d.ts.map

package/dist/spec/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAyC,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAI3G,gEAAgE;AAChE,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,UAAU,EAAE,cAAc,EAAE,CAAA;CAAE;AAClD,8EAA8E;GAC5E;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACrC,6EAA6E;GAC3E;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,UAAU,aAAc,SAAQ,YAAY;IAC1C,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvC,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,IAAI,EAAE,QAAQ,CAAC;IACf,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,IAAI,EAAE,QAAQ,CAAC;IACf,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAcjE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAExE;AA+CD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AA8BD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACzC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,WAAW,CAAC,MAAM,CAAa,GACpC,YAAY,CA4Cd"}

package/dist/spec/pin.d.ts

@@ -0,0 +1,116 @@
+/**
+ * What this lexicon pins, and why it pins two different things (#1650, #1390).
+ *
+ * ## The version pin
+ *
+ * `@cedar-policy/cedar-wasm` and the Cedar *language* move independently: the
+ * package is 4.12.0, the grammar it implements is 4.5 (#1648 §0). A package
+ * bump that leaves the language at 4.5 cannot change what parses, so the
+ * language version is the value worth asserting at generation time and the
+ * package version is the one `upstreamPin` bumps. Both are recorded.
+ *
+ * The runtime assert is chant #1390's spirit applied to a dependency rather
+ * than to a downloaded spec: generation refuses when the installed package
+ * implements a different language version than the one whose resolved output
+ * produced the committed artifacts. Releases are roughly monthly, so this will
+ * fire — and when it does, the answer is to look at the new resolved JSON, not
+ * to publish types generated from a grammar nobody checked.
+ *
+ * ## The content pin
+ *
+ * The bundled default schema (`default-schema.cedarschema`) is what generation
+ * reads in this repo and in a fresh checkout, so it decides the published
+ * surface. There is no upstream URL to pin, so the pin is over content: a
+ * sha256 over the *resolved* JSON — the thing the emitters actually read —
+ * plus the covered entity-type and action names committed beside it.
+ *
+ * Resolved-JSON serialization is byte-deterministic (Rust `BTreeMap` ordering,
+ * 1 distinct serialization over 25 runs, #1648 §5.2), so the digest is stable.
+ * It moves when the default schema is edited, and — the case the pin exists for
+ * — when a cedar-wasm upgrade resolves the same schema differently. Both change
+ * the generated types, and neither is visible in a diff otherwise, because
+ * `src/generated/` is not committed.
+ *
+ * A user's own project schema is not pinned. It is their input, they own its
+ * churn, and refusing to generate because they edited their own schema would be
+ * absurd.
+ */
+/** The pinned `@cedar-policy/cedar-wasm` version — what `upstreamPin` bumps. */
+export declare const CEDAR_WASM_VERSION = "4.12.0";
+/** The Cedar *language* version that package implements (`getCedarLangVersion()`). */
+export declare const CEDAR_LANG_VERSION = "4.5";
+/** Env var that proceeds past a language-version mismatch for one run. */
+export declare const ACCEPT_LANG_ENV = "CHANT_ACCEPT_CEDAR_LANG";
+/** Env var that accepts a moved default-schema digest, printing the new pin. */
+export declare const ACCEPT_SCHEMA_ENV = "CHANT_ACCEPT_CEDAR_SCHEMA";
+/**
+ * The entity types and action UIDs the pinned default schema resolved to.
+ *
+ * Committed beside the digest for the same reason aws commits its type names:
+ * without the list, accepting a new pin is one opaque hash replacing another,
+ * and the generated artifacts cannot stand in because they are gitignored.
+ */
+export declare const PINNED_SCHEMA_NAMES: readonly string[];
+export interface SchemaPin {
+    /** `sha256:…` over the resolved schema JSON. */
+    readonly digest: string;
+    /** How many entity types and actions the pinned schema declared. */
+    readonly declarations: number;
+    /** ISO date the pin was accepted, so a diff reads as a decision. */
+    readonly accepted: string;
+}
+/**
+ * The accepted default schema.
+ *
+ * To move it: run generation, read the refusal, confirm the delta is one you
+ * want, and paste the printed block here in its own commit.
+ */
+export declare const CEDAR_SCHEMA_PIN: SchemaPin;
+/**
+ * Digest the resolved schema JSON.
+ *
+ * Hashes the canonical serialization the wasm produced, not the authored
+ * `.cedarschema` text: reformatting a schema, or reordering its entity types,
+ * changes the text and not one byte of what the emitters read.
+ */
+export declare function resolvedSchemaDigest(resolved: unknown): string;
+/** What moved between the pinned schema and the one just resolved. */
+export interface SchemaDrift {
+    digest: string;
+    declarations: number;
+    added: string[];
+    removed: string[];
+}
+/** Compare a freshly resolved schema against a pin. `null` when it matches. */
+export declare function schemaDrift(resolved: unknown, names: readonly string[], pinnedNamesList?: readonly string[], pin?: SchemaPin): SchemaDrift | null;
+/** The report a mismatch produces. */
+export declare function schemaDriftMessage(drift: SchemaDrift, pin?: SchemaPin): string;
+/**
+ * Refuse a default schema whose resolved JSON does not match the pin.
+ *
+ * Unlike aws, this one refuses on any digest move rather than only on a
+ * declaration-set change. It can afford to: the input is a file in this repo
+ * and a dependency at a pinned version, neither of which changes under the
+ * build's feet the way a republished CloudFormation archive does.
+ */
+export declare function assertPinnedSchema(resolved: unknown, names: readonly string[], options?: {
+    pin?: SchemaPin;
+    pinnedNames?: readonly string[];
+    env?: NodeJS.ProcessEnv;
+    warn?: (message: string) => void;
+}): void;
+/**
+ * Refuse to generate against a Cedar language version other than the pinned one.
+ *
+ * chant #1390's rule, one level up the supply chain: a lexicon does not emit
+ * types derived from a grammar nobody chose. `getCedarLangVersion()` is the
+ * right probe because it is the number that decides what parses — the package
+ * version moves monthly and mostly does not.
+ */
+export declare function assertPinnedLangVersion(options?: {
+    actual?: string;
+    expected?: string;
+    env?: NodeJS.ProcessEnv;
+    warn?: (message: string) => void;
+}): void;
+//# sourceMappingURL=pin.d.ts.map

package/dist/spec/pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pin.d.ts","sourceRoot":"","sources":["../../src/spec/pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,WAAW,CAAC;AAE3C,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,0EAA0E;AAC1E,eAAO,MAAM,eAAe,4BAA4B,CAAC;AAEzD,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,8BAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAE9E,MAAM,WAAW,SAAS;IACxB,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAI9B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE9D;AAED,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,eAAe,GAAE,SAAS,MAAM,EAAwB,EACxD,GAAG,GAAE,SAA4B,GAChC,WAAW,GAAG,IAAI,CAYpB;AAED,sCAAsC;AACtC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,GAAE,SAA4B,GAAG,MAAM,CAuChG;AAMD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GACL,IAAI,CAcN;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GACL,IAAI,CAyBN"}

package/dist/spec/pinned-names.json

@@ -0,0 +1,18 @@
+[
+    "App::Action::\"admin\"",
+    "App::Action::\"approve\"",
+    "App::Action::\"comment\"",
+    "App::Action::\"create\"",
+    "App::Action::\"delete\"",
+    "App::Action::\"list\"",
+    "App::Action::\"read\"",
+    "App::Action::\"share\"",
+    "App::Action::\"write\"",
+    "App::Application",
+    "App::Document",
+    "App::Folder",
+    "App::Group",
+    "App::ServiceAccount",
+    "App::Team",
+    "App::User"
+]

package/dist/spec/wasm.d.ts

@@ -0,0 +1,143 @@
+/**
+ * The one place `@cedar-policy/cedar-wasm` is called from.
+ *
+ * Three findings from the 4.12.0 verification (#1648) are encoded here rather
+ * than left to each caller to remember:
+ *
+ * 1. **Only the `/nodejs` flavor.** The root ESM build imports the `.wasm` as
+ *    an ES module, which Bun cannot start (`wasm.__wbindgen_start is not a
+ *    function`) and Node only supports behind an experimental warning printed
+ *    on every run. `/nodejs` loads the binary with `readFileSync` and works
+ *    under node CJS, node ESM, vitest and bun alike.
+ *
+ * 2. **`schemaToJsonWithResolvedTypes` takes a string and means it.** A JS
+ *    object traps the wasm with `memory access out of bounds` — not a failure
+ *    answer, a memory fault. The `typeof === "string"` guard below is the
+ *    difference between a readable error and a trap.
+ *
+ * 3. **The `Answer` union is not the whole error channel.** Malformed input
+ *    throws a bare serde `Error` from inside the wasm instead of returning
+ *    `{type:"failure"}`, and the `line 1 column N` in those messages refers to
+ *    the internal call struct, not to anything the user wrote. Both channels
+ *    are normalized into one result type here.
+ */
+import type * as CedarWasm from "@cedar-policy/cedar-wasm/nodejs";
+/** A namespace body in the resolved schema JSON. */
+export interface ResolvedNamespace {
+    commonTypes?: Record<string, ResolvedType>;
+    entityTypes?: Record<string, ResolvedEntityType>;
+    actions?: Record<string, ResolvedAction>;
+    annotations?: Record<string, string>;
+}
+export interface ResolvedEntityType {
+    memberOfTypes?: string[];
+    shape?: ResolvedType;
+    tags?: ResolvedType;
+    enum?: string[];
+    annotations?: Record<string, string>;
+}
+export interface ResolvedAction {
+    memberOf?: Array<{
+        id: string;
+        type?: string;
+    }>;
+    appliesTo?: {
+        principalTypes?: string[];
+        resourceTypes?: string[];
+        context?: ResolvedType;
+    };
+    annotations?: Record<string, string>;
+}
+/**
+ * A type in the *resolved* schema JSON.
+ *
+ * `schemaToJson` emits `{type:"EntityOrCommon", name}` for every named type,
+ * which cannot tell an entity reference from a primitive from a common-type
+ * alias. `schemaToJsonWithResolvedTypes` collapses that to `{type:"Entity"}`
+ * for entity references and to the primitive name otherwise — except for
+ * common types, which stay as a bare qualified `{type:"App::TagSet"}` and are
+ * resolved against `commonTypes` by the emitter.
+ */
+export interface ResolvedType {
+    type: string;
+    name?: string;
+    element?: ResolvedType;
+    attributes?: Record<string, ResolvedType>;
+    required?: boolean;
+    enum?: string[];
+}
+/** The `SchemaJson` shape, keyed by namespace (`""` is the empty namespace). */
+export type ResolvedSchemaJson = Record<string, ResolvedNamespace>;
+export type WasmResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: string;
+};
+/** The Cedar *language* version this build of the package implements. */
+export declare function langVersion(): string;
+/** The `@cedar-policy/cedar-wasm` package version. */
+export declare function packageVersion(): string;
+/**
+ * Resolve a human-readable `.cedarschema` into fully-qualified schema JSON.
+ *
+ * Returns a result rather than throwing so a bad project schema reads as a
+ * message about the project schema, not as a stack trace out of a wasm module.
+ */
+export declare function resolveSchema(schemaText: unknown): WasmResult<ResolvedSchemaJson>;
+/** One Cedar policy in Cedar's own JSON policy format. */
+export type PolicyJson = CedarWasm.PolicyJson;
+/** The two halves `policySetTextToParts` splits a `.cedar` document into. */
+export interface PolicySetParts {
+    /** Verbatim source text of each static policy, in source order. */
+    policies: string[];
+    /** Verbatim source text of each template, in source order. */
+    templates: string[];
+}
+/**
+ * Split a `.cedar` document into its policies and its templates.
+ *
+ * The strings that come back are the **verbatim source** of each policy —
+ * annotations, line breaks and all — in source order, which is what lets the
+ * importer recover a condition body exactly as it was written rather than as
+ * the JSON leg would re-render it. Comments are dropped: they are not part of
+ * any grammar the module round-trips.
+ */
+export declare function splitPolicySet(text: unknown): WasmResult<PolicySetParts>;
+/** Convert one *static* policy (text or JSON) into Cedar's JSON policy format. */
+export declare function policyToJson(policy: string | PolicyJson): WasmResult<PolicyJson>;
+/**
+ * Convert one *template* (text or JSON) into Cedar's JSON policy format.
+ *
+ * A policy carrying `?principal`/`?resource` is a template, and `policyToJson`
+ * refuses it outright ("expected a static policy, got a template containing
+ * the slot ?resource") — the two entry points are not interchangeable.
+ */
+export declare function templateToJson(template: string | PolicyJson): WasmResult<PolicyJson>;
+/**
+ * Render one policy's JSON back to Cedar text.
+ *
+ * Only ever used to recover an *expression* body that has no source text to
+ * quote — an imported JSON policy set. The output is single-line and defensively
+ * parenthesized (`((context.mfa) == true)`), and `formatPolicies` does not undo
+ * that, so it is never the source of a human-facing `.cedar` artifact: those are
+ * laid out by the serializer.
+ */
+export declare function policyToText(policy: PolicyJson): WasmResult<string>;
+/**
+ * Does this value parse as a Cedar policy set?
+ *
+ * `checkParsePolicySet` throws — rather than answering `failure` — for a
+ * document carrying keys it does not know, which is precisely the shape a
+ * foreign lexicon's JSON has, so the throw is a match rejection here.
+ */
+export declare function parsesAsPolicySet(value: unknown): boolean;
+/**
+ * Flatten a `DetailedError[]` into one line.
+ *
+ * `code`, `url` and `severity` are `null` on every error this package emits
+ * (#1648 §5.6), so only `message` and `help` carry anything.
+ */
+export declare function formatWasmErrors(errors: unknown): string;
+//# sourceMappingURL=wasm.d.ts.map

package/dist/spec/wasm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.d.ts","sourceRoot":"","sources":["../../src/spec/wasm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAwBlE,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,SAAS,CAAC,EAAE;QACV,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,EAAE,YAAY,CAAC;KACxB,CAAC;IACF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAEnE,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,yEAAyE;AACzE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,sDAAsD;AACtD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CA8BjF;AAID,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;AAE9C,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAsCD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC,CAYxE;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAMpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAEnE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMzD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CASxD"}