@intentius/chant-lexicon-cedar 0.44.8

package/src/avp/describe-resources.test.ts

@@ -0,0 +1,316 @@
+/**
+ * The AVP observation, against a mocked client layer.
+ *
+ * Every scenario drives the real `listPolicies`/`getPolicy` code through an
+ * injected {@link AvpHttp}; nothing here touches the network, and nothing stubs
+ * the readers themselves. The conformance suite at the bottom is the part that
+ * matters most — it runs these same results through core's own
+ * `buildChangeSet`, so a well-shaped result that still proposes a spurious
+ * `create` fails here rather than in somebody's account.
+ */
+
+import { describe, expect, it } from "vitest";
+import { describeObservationConformance } from "@intentius/chant-test-utils";
+import { normalizeObservation } from "@intentius/chant/observation";
+import { CEDAR_POLICY_TYPE } from "../serializer";
+import { cedarPlugin } from "../plugin";
+import { describeAvpResources } from "./describe-resources";
+import {
+  markedDescription,
+  mockAvpTransport,
+  statementFor,
+  MOCK_ENV,
+  type MockStore,
+} from "./testdata/mock-transport";
+
+const STORE = "PS-abc123";
+
+function entities(names: Record<string, Record<string, unknown>>) {
+  return new Map(
+    Object.entries(names).map(([name, props]) => [name, { entityType: CEDAR_POLICY_TYPE, props }]),
+  );
+}
+
+function run(store: MockStore, options: Partial<Parameters<typeof describeAvpResources>[0]> = {}) {
+  const { http } = mockAvpTransport(store);
+  return describeAvpResources({
+    environment: "prod",
+    entityNames: ["ownerRead", "requireMfa"],
+    entities: entities({ ownerRead: {}, requireMfa: {} }),
+    policyStoreId: STORE,
+    client: { http, region: "us-west-2" },
+    env: MOCK_ENV,
+    ...options,
+  });
+}
+
+/** A store holding both declared policies, both chant-stamped. */
+const healthy: MockStore = {
+  policyStoreId: STORE,
+  policies: [
+    {
+      policyId: "p-1",
+      statement: statementFor("owner-read"),
+      description: markedDescription("owner-read", "Owners read their own documents."),
+      lastUpdatedDate: "2026-08-01T00:00:00Z",
+    },
+    {
+      policyId: "p-2",
+      statement: statementFor("require-mfa", "forbid (\n  principal,\n  action,\n  resource\n)"),
+      description: markedDescription("require-mfa"),
+    },
+  ],
+};
+
+describe("describeAvpResources", () => {
+  it("keys live policies by chant entity name, through the @id the serializer assigns", async () => {
+    const { resources } = normalizeObservation(await run(healthy));
+
+    expect(Object.keys(resources).sort()).toEqual(["ownerRead", "requireMfa"]);
+    expect(resources.ownerRead.physicalId).toBe("p-1");
+    expect(resources.ownerRead.type).toBe(CEDAR_POLICY_TYPE);
+    expect(resources.ownerRead.lastUpdated).toBe("2026-08-01T00:00:00Z");
+    expect(resources.ownerRead.attributes?.policyStoreId).toBe(STORE);
+  });
+
+  it("honours an explicit annotations.id over the derived one", async () => {
+    const store: MockStore = {
+      policyStoreId: STORE,
+      policies: [{ policyId: "p-9", statement: statementFor("legacy-name"), description: markedDescription("legacy-name") }],
+    };
+    const { resources } = normalizeObservation(
+      await run(store, {
+        entityNames: ["ownerRead"],
+        entities: entities({ ownerRead: { annotations: { id: "legacy-name" } } }),
+      }),
+    );
+    expect(resources.ownerRead?.physicalId).toBe("p-9");
+  });
+
+  it("says where it looked, including the region and the store", async () => {
+    const { queried } = normalizeObservation(await run(healthy));
+    expect(queried.ownerRead).toBe(
+      `avp://us-west-2/policy-store/${STORE}/policy?@id=owner-read`,
+    );
+  });
+
+  it("reports a policy the store does not hold as absent, not as a hole", async () => {
+    const partial: MockStore = { ...healthy, policies: [healthy.policies[0]] };
+    const { resources, unobserved, queried } = normalizeObservation(await run(partial));
+
+    expect(Object.keys(resources)).toEqual(["ownerRead"]);
+    expect(unobserved.requireMfa).toBeUndefined();
+    // Absence is spelled "in neither map", so `queried` is the only record it gets.
+    expect(queried.requireMfa).toContain("@id=require-mfa");
+  });
+
+  it("resolves an unmarked policy by reading its statement", async () => {
+    const consoleEdited: MockStore = {
+      policyStoreId: STORE,
+      policies: [
+        { policyId: "p-1", statement: statementFor("owner-read") },
+        { policyId: "p-2", statement: statementFor("require-mfa") },
+      ],
+    };
+    const { resources } = normalizeObservation(await run(consoleEdited));
+
+    expect(Object.keys(resources).sort()).toEqual(["ownerRead", "requireMfa"]);
+    expect(resources.ownerRead.ownership).toBe("foreign");
+  });
+
+  it("does not pay for a GetPolicy on a policy whose marker already names it", async () => {
+    const { http, calls } = mockAvpTransport(healthy);
+    await describeAvpResources({
+      environment: "prod",
+      entityNames: ["ownerRead", "requireMfa"],
+      entities: entities({ ownerRead: {}, requireMfa: {} }),
+      policyStoreId: STORE,
+      client: { http },
+      env: MOCK_ENV,
+    });
+    expect(calls.filter((c) => c.operation === "GetPolicy")).toHaveLength(0);
+  });
+
+  it("paginates the enumeration to exhaustion", async () => {
+    const many: MockStore = {
+      policyStoreId: STORE,
+      pageSize: 1,
+      policies: healthy.policies,
+    };
+    const { resources } = normalizeObservation(await run(many));
+    expect(Object.keys(resources).sort()).toEqual(["ownerRead", "requireMfa"]);
+  });
+
+  it("reports a store that does not exist yet as an empty estate", async () => {
+    const missing = await run({ ...healthy, policyStoreId: "PS-other" });
+    const { resources, unobserved } = normalizeObservation(missing);
+    expect(resources).toEqual({});
+    expect(unobserved).toEqual({});
+  });
+
+  it("marks every entity not-observed when the enumeration fails on credentials", async () => {
+    const denied: MockStore = {
+      ...healthy,
+      listFails: { code: "AccessDeniedException", message: "not authorized to perform ListPolicies", status: 403 },
+    };
+    const { unobserved } = normalizeObservation(await run(denied));
+
+    expect(Object.keys(unobserved).sort()).toEqual(["ownerRead", "requireMfa"]);
+    expect(unobserved.ownerRead.reason).toBe("no-credentials");
+  });
+
+  it("distinguishes a throttle from a credential problem", async () => {
+    const throttled: MockStore = {
+      ...healthy,
+      listFails: { code: "ThrottlingException", message: "Rate exceeded", status: 429 },
+    };
+    const { unobserved } = normalizeObservation(await run(throttled));
+    expect(unobserved.ownerRead.reason).toBe("read-failed");
+  });
+
+  it("never throws when there are no credentials at all", async () => {
+    const { http } = mockAvpTransport(healthy);
+    const result = await describeAvpResources({
+      environment: "prod",
+      entityNames: ["ownerRead", "requireMfa"],
+      entities: entities({ ownerRead: {}, requireMfa: {} }),
+      policyStoreId: STORE,
+      client: { http },
+      env: {},
+    });
+    const { resources, unobserved } = normalizeObservation(result);
+    expect(resources).toEqual({});
+    expect(unobserved.ownerRead.reason).toBe("no-credentials");
+    expect(unobserved.requireMfa.reason).toBe("no-credentials");
+  });
+
+  it("reports no-binding when nothing names a policy store", async () => {
+    const { http } = mockAvpTransport(healthy);
+    const result = await describeAvpResources({
+      environment: "prod",
+      entityNames: ["ownerRead"],
+      entities: entities({ ownerRead: {} }),
+      client: { http },
+      env: MOCK_ENV,
+    });
+    expect(normalizeObservation(result).unobserved.ownerRead.reason).toBe("no-binding");
+  });
+
+  it("takes the store from an entity prop when the caller names none", async () => {
+    const { http } = mockAvpTransport(healthy);
+    const result = await describeAvpResources({
+      environment: "prod",
+      entityNames: ["ownerRead"],
+      entities: entities({ ownerRead: { policyStoreId: STORE } }),
+      client: { http },
+      env: MOCK_ENV,
+    });
+    expect(Object.keys(normalizeObservation(result).resources)).toEqual(["ownerRead"]);
+  });
+
+  it("takes the store from a per-environment env var", async () => {
+    const { http } = mockAvpTransport(healthy);
+    const result = await describeAvpResources({
+      environment: "prod",
+      entityNames: ["ownerRead"],
+      entities: entities({ ownerRead: {} }),
+      client: { http },
+      env: { ...MOCK_ENV, CEDAR_AVP_POLICY_STORE_ID_PROD: STORE, CEDAR_AVP_POLICY_STORE_ID: "PS-wrong" },
+    });
+    expect(Object.keys(normalizeObservation(result).resources)).toEqual(["ownerRead"]);
+  });
+
+  it("calls a non-policy entity type unsupported, never absent", async () => {
+    const { http } = mockAvpTransport(healthy);
+    const result = await describeAvpResources({
+      environment: "prod",
+      entityNames: ["appUser"],
+      entities: new Map([["appUser", { entityType: "App::User", props: {} }]]),
+      policyStoreId: STORE,
+      client: { http },
+      env: MOCK_ENV,
+    });
+    expect(normalizeObservation(result).unobserved.appUser.reason).toBe("unsupported-kind");
+  });
+
+  it("withholds a foreign policy under owned:true rather than calling it absent", async () => {
+    const mixed: MockStore = {
+      policyStoreId: STORE,
+      policies: [
+        { policyId: "p-1", statement: statementFor("owner-read"), description: markedDescription("owner-read") },
+        { policyId: "p-2", statement: statementFor("require-mfa"), description: "added in the console" },
+      ],
+    };
+    const { resources, unobserved } = normalizeObservation(await run(mixed, { owned: true }));
+
+    expect(Object.keys(resources)).toEqual(["ownerRead"]);
+    expect(resources.ownerRead.ownership).toBe("owned");
+    expect(unobserved.requireMfa.reason).toBe("filtered");
+  });
+
+  it("leaves a policy whose GetPolicy failed unmatched, not misattributed", async () => {
+    const flaky: MockStore = {
+      policyStoreId: STORE,
+      policies: [
+        { policyId: "p-1", statement: statementFor("owner-read"), getFails: true },
+        { policyId: "p-2", statement: statementFor("require-mfa"), description: markedDescription("require-mfa") },
+      ],
+    };
+    const { resources } = normalizeObservation(await run(flaky));
+    // p-1's `@id` was unreadable, so ownerRead is absent rather than being
+    // matched onto whichever policy happened to be next in the list.
+    expect(Object.keys(resources)).toEqual(["requireMfa"]);
+  });
+});
+
+describeObservationConformance({
+  lexicon: "cedar",
+  ownershipChannel: cedarPlugin.ownershipChannel,
+  scenarios: [
+    {
+      name: "a healthy policy store",
+      declared: ["ownerRead", "requireMfa"],
+      expectPresent: ["ownerRead", "requireMfa"],
+      run: () => run(healthy),
+    },
+    {
+      name: "a store missing one declared policy",
+      declared: ["ownerRead", "requireMfa"],
+      expectPresent: ["ownerRead"],
+      expectAbsent: ["requireMfa"],
+      run: () => run({ ...healthy, policies: [healthy.policies[0]] }),
+    },
+    {
+      name: "an enumeration that fails on credentials",
+      declared: ["ownerRead", "requireMfa"],
+      expectUnobserved: ["ownerRead", "requireMfa"],
+      run: () =>
+        run({
+          ...healthy,
+          listFails: { code: "AccessDeniedException", message: "not authorized", status: 403 },
+        }),
+    },
+    {
+      name: "an environment bound to no policy store",
+      declared: ["ownerRead", "requireMfa"],
+      expectUnobserved: ["ownerRead", "requireMfa"],
+      run: () => {
+        const { http } = mockAvpTransport(healthy);
+        return describeAvpResources({
+          environment: "prod",
+          entityNames: ["ownerRead", "requireMfa"],
+          entities: entities({ ownerRead: {}, requireMfa: {} }),
+          client: { http },
+          env: MOCK_ENV,
+        });
+      },
+    },
+    {
+      name: "an owned read on the path that declares a marker channel",
+      declared: ["ownerRead", "requireMfa"],
+      expectPresent: ["ownerRead", "requireMfa"],
+      owned: true,
+      run: () => run(healthy, { owned: true }),
+    },
+  ],
+});

package/src/avp/describe-resources.ts

@@ -0,0 +1,215 @@
+/**
+ * `describeResources()` against an AVP policy store (#1652).
+ *
+ * The tri-state matters more here than it does for most substrates. A Cedar
+ * policy that chant declares and the store does not have is a *missing
+ * authorization rule*: reporting it absent proposes a create, which is right.
+ * Reporting it absent because the store id was wrong, or because the read
+ * failed, proposes creating a permit that already exists — duplicating a grant.
+ * So every path that did not actually look says so.
+ *
+ * Built on core's observer harness (`observeEntities`), which owns the shape:
+ * bind-or-not-observe-all with a typed reason, bounded concurrency, a per-entity
+ * throw degrading to `read-failed` rather than a silent absence, and collection
+ * of the `queried` addresses.
+ */
+
+import type { ObservationResult, ResourceMetadata } from "@intentius/chant/lexicon";
+import {
+  observation,
+  observeEntities,
+  unobservedAll,
+  type DeclaredEntity,
+  type EntityObservation,
+  type ObserverAdapter,
+  type UnobservedReason,
+} from "@intentius/chant/observation";
+import { CEDAR_POLICY_TYPE, resolvePolicyId } from "../serializer";
+import {
+  classifyAvpFailure,
+  credentialsAvailable,
+  policyAddress,
+  storeAddress,
+  storeDoesNotExist,
+  type AvpClientOptions,
+} from "./client";
+import { ownershipFromDescription } from "./ownership";
+import {
+  indexByCedarId,
+  loadLivePolicies,
+  resolvePolicyStoreId,
+  type AvpLivePolicy,
+} from "./store";
+
+export interface DescribeAvpOptions {
+  environment: string;
+  entityNames: string[];
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
+  /** Restrict to policies carrying chant's description marker. */
+  owned?: boolean;
+  /** Explicit store id; otherwise resolved per {@link resolvePolicyStoreId}. */
+  policyStoreId?: string;
+  client?: AvpClientOptions;
+  /** Environment to read the binding and credentials from. Injectable for tests. */
+  env?: Record<string, string | undefined>;
+}
+
+/** What `bind()` hands each read: the store, its policies, and the address prefix. */
+interface AvpBinding {
+  policyStoreId: string;
+  byCedarId: Map<string, AvpLivePolicy>;
+  region?: string;
+}
+
+/** A bind failure that already knows its verdict. */
+class AvpBindFailure extends Error {
+  constructor(
+    readonly reason: UnobservedReason,
+    readonly detail: string,
+  ) {
+    super(detail);
+    this.name = "AvpBindFailure";
+  }
+}
+
+function metadataFor(policy: AvpLivePolicy, ownership: "owned" | "foreign"): ResourceMetadata {
+  return {
+    type: CEDAR_POLICY_TYPE,
+    physicalId: policy.policyId,
+    // AVP has no lifecycle state on a policy: it exists or it does not. The
+    // policy type is the most useful thing to show, and a template-linked
+    // policy differing from a static one IS drift worth seeing.
+    status: policy.policyType || "STATIC",
+    ...(policy.lastUpdatedDate ? { lastUpdated: policy.lastUpdatedDate } : {}),
+    ownership,
+    attributes: {
+      policyStoreId: policy.policyStoreId,
+      policyId: policy.policyId,
+      policyType: policy.policyType,
+      ...(policy.cedarPolicyId ? { cedarPolicyId: policy.cedarPolicyId } : {}),
+      ...(policy.authoredDescription ? { description: policy.authoredDescription } : {}),
+      ...(policy.createdDate ? { createdDate: policy.createdDate } : {}),
+    },
+  };
+}
+
+/**
+ * Observe the declared policy set against a live AVP store.
+ *
+ * Never throws for a transport or binding problem — a throw is the
+ * whole-lexicon failure and core would mark every entity `read-failed`, which
+ * is a worse-shaped version of what this returns directly with the right
+ * reason on it.
+ */
+export async function describeAvpResources(options: DescribeAvpOptions): Promise<ObservationResult> {
+  const env = options.env ?? process.env;
+  const typesByName: Record<string, string> = {};
+  for (const name of options.entityNames) {
+    typesByName[name] = options.entities.get(name)?.entityType ?? CEDAR_POLICY_TYPE;
+  }
+
+  const policyStoreId = resolvePolicyStoreId({
+    environment: options.environment,
+    ...(options.policyStoreId ? { policyStoreId: options.policyStoreId } : {}),
+    entities: options.entities,
+    env,
+  });
+
+  if (!policyStoreId) {
+    return observation(
+      {},
+      unobservedAll(
+        options.entityNames,
+        "no-binding",
+        `no AVP policy store for environment "${options.environment}" — set ${"CEDAR_AVP_POLICY_STORE_ID"} or declare policyStoreId on a policy`,
+        typesByName,
+      ),
+    );
+  }
+
+  if (!credentialsAvailable(env)) {
+    return observation(
+      {},
+      unobservedAll(
+        options.entityNames,
+        "no-credentials",
+        "no AWS credentials and no endpoint override — the AVP store was not queried",
+        typesByName,
+      ),
+    );
+  }
+
+  const region = options.client?.region;
+  const declared: DeclaredEntity[] = options.entityNames.map((name) => {
+    const entity = options.entities.get(name);
+    return {
+      name,
+      type: entity?.entityType ?? CEDAR_POLICY_TYPE,
+      props: entity?.props ?? {},
+    };
+  });
+
+  const adapter: ObserverAdapter<AvpBinding> = {
+    async bind(): Promise<AvpBinding> {
+      try {
+        const policies = await loadLivePolicies({
+          policyStoreId,
+          ...(options.client ? { client: options.client } : {}),
+        });
+        return { policyStoreId, byCedarId: indexByCedarId(policies), ...(region ? { region } : {}) };
+      } catch (err) {
+        // A store that is not there yet is the pre-first-apply state: nothing
+        // is deployed, so every declared policy is genuinely absent and
+        // `create` is the right proposal.
+        if (storeDoesNotExist(err)) {
+          return { policyStoreId, byCedarId: new Map(), ...(region ? { region } : {}) };
+        }
+        const { reason, detail } = classifyAvpFailure(err);
+        throw new AvpBindFailure(reason, `ListPolicies failed for store ${policyStoreId}: ${detail}`);
+      }
+    },
+
+    classifyBindFailure(err: unknown) {
+      if (err instanceof AvpBindFailure) return { reason: err.reason, detail: err.detail };
+      const { reason, detail } = classifyAvpFailure(err);
+      return { reason, detail: `${storeAddress(policyStoreId, region)}: ${detail}` };
+    },
+
+    async read(binding: AvpBinding, entity: DeclaredEntity): Promise<EntityObservation> {
+      if (entity.type !== CEDAR_POLICY_TYPE) {
+        // Cedar declares one deployable kind. Anything else is a schema entity
+        // or action constant, which has no AVP counterpart at all — saying so
+        // per entity keeps it out of `lifecycle plan` as a create.
+        return {
+          unobserved: {
+            reason: "unsupported-kind",
+            detail: `no AVP reader for ${entity.type} — only ${CEDAR_POLICY_TYPE} is deployed to a policy store`,
+          },
+        };
+      }
+
+      const cedarPolicyId = resolvePolicyId(entity.name, entity.props);
+      const queried = policyAddress(binding.policyStoreId, cedarPolicyId, binding.region);
+      const policy = binding.byCedarId.get(cedarPolicyId);
+
+      // The store was enumerated and this `@id` is not in it. That is an
+      // absence, and the only shape allowed to become a create.
+      if (!policy) return { absent: true, queried };
+
+      const ownership = ownershipFromDescription(policy.description);
+      if (options.owned && ownership !== "owned") {
+        return {
+          unobserved: {
+            reason: "filtered",
+            detail: "live policy carries no chant description marker",
+          },
+          queried,
+        };
+      }
+
+      return { present: metadataFor(policy, ownership), queried };
+    },
+  };
+
+  return observeEntities(declared, adapter);
+}

package/src/avp/embed.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from "vitest";
+import { checkParsePolicySet } from "@cedar-policy/cedar-wasm/nodejs";
+import { build } from "@intentius/chant/build";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  avpPolicyDefinition,
+  avpPolicyResource,
+  avpPolicySet,
+  avpStatement,
+  avpStatementJSON,
+} from "./embed";
+import { decodeOwnershipDescription, descriptionIsOwned } from "./ownership";
+import { cedarSerializer, type CedarPolicyProps } from "../serializer";
+
+const ownerRead: CedarPolicyProps = {
+  effect: "permit",
+  principal: { is: "App::User" },
+  action: { eq: 'App::Action::"read"' },
+  resource: { is: "App::Document" },
+  when: ["resource.owner == principal"],
+};
+
+describe("the AVP statement", () => {
+  it("is Cedar the real parser accepts", () => {
+    const statement = avpStatement("ownerRead", ownerRead);
+    expect(checkParsePolicySet({ staticPolicies: statement }).type).toBe("success");
+  });
+
+  it("carries the @id a live policy is matched back on", () => {
+    expect(avpStatement("ownerRead", ownerRead)).toContain('@id("owner-read")');
+    expect(avpStatement("ownerRead", { ...ownerRead, annotations: { id: "explicit" } })).toContain(
+      '@id("explicit")',
+    );
+    expect(avpStatement("ownerRead", ownerRead, { policyId: "override" })).toContain('@id("override")');
+  });
+
+  it("is byte-identical to what the serializer writes to .cedar", async () => {
+    const dir = join(dirname(fileURLToPath(import.meta.url)), "../../examples/getting-started/src");
+    const result = await build(dir, [cedarSerializer]);
+    const output = result.outputs.get("cedar");
+    const text = typeof output === "string" ? output : (output?.primary ?? "");
+
+    // One renderer, not two: every statement the embedding emits appears
+    // verbatim in the .cedar file the same build produced.
+    for (const statement of Object.values(avpPolicySet(result.entities))) {
+      expect(text).toContain(statement.Static.Statement);
+    }
+  });
+
+  it("also emits the Cedar JSON form, for evaluators that take JSON", () => {
+    const json = avpStatementJSON("ownerRead", ownerRead);
+    expect(json.effect).toBe("permit");
+    expect(json.annotations?.id).toBe("owner-read");
+    // Cedar's own reading, so a condition is an expression tree — not the
+    // `{ __expr: "…" }` escape the model-derived encoder used to write.
+    expect(JSON.stringify(json)).not.toContain("__expr");
+    expect(json.conditions?.[0]?.kind).toBe("when");
+  });
+
+  it("refuses to hand back JSON for a policy Cedar cannot read", () => {
+    expect(() => avpStatementJSON("broken", { when: ["this is not an expression"] })).toThrow(
+      /did not parse/,
+    );
+  });
+});
+
+describe("the AVP Definition envelope", () => {
+  it("is the Static shape AWS::VerifiedPermissions::Policy declares", () => {
+    const definition = avpPolicyDefinition("ownerRead", ownerRead);
+    expect(Object.keys(definition)).toEqual(["Static"]);
+    expect(typeof definition.Static.Statement).toBe("string");
+    expect(definition.Static.Description).toBeUndefined();
+  });
+
+  it("stamps the ownership marker into the description when asked", () => {
+    const definition = avpPolicyDefinition("ownerRead", ownerRead, {
+      description: "Owners read their own documents.",
+      ownership: { stack: "authz", env: "prod" },
+    });
+
+    expect(descriptionIsOwned(definition.Static.Description)).toBe(true);
+    const decoded = decodeOwnershipDescription(definition.Static.Description);
+    expect(decoded.text).toBe("Owners read their own documents.");
+    expect(decoded.policyId).toBe("owner-read");
+  });
+
+  it("keeps a plain description untouched when no marker is requested", () => {
+    const definition = avpPolicyDefinition("ownerRead", ownerRead, { description: "just prose" });
+    expect(definition.Static.Description).toBe("just prose");
+  });
+
+  it("fills both required props of the generated class", () => {
+    const resource = avpPolicyResource("ownerRead", ownerRead, "store-123");
+    expect(resource.PolicyStoreId).toBe("store-123");
+    expect(resource.Definition.Static.Statement).toContain("permit");
+  });
+});
+
+describe("the whole-set form", () => {
+  it("keys definitions by chant entity name", async () => {
+    const dir = join(dirname(fileURLToPath(import.meta.url)), "../../examples/getting-started/src");
+    const result = await build(dir, [cedarSerializer]);
+
+    const set = avpPolicySet(result.entities, {
+      ownership: { stack: "authz", env: "prod" },
+    });
+    expect(Object.keys(set).sort()).toEqual(["ownerRead", "requireMfa"]);
+    for (const definition of Object.values(set)) {
+      expect(descriptionIsOwned(definition.Static.Description)).toBe(true);
+      expect(checkParsePolicySet({ staticPolicies: definition.Static.Statement }).type).toBe("success");
+    }
+  });
+});