@intentius/chant-lexicon-cedar 0.44.8

package/dist/avp/ownership.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The ownership channel for Amazon Verified Permissions (#1652).
+ *
+ * AVP is the one target in chant where the obvious channel does not exist. A
+ * policy *store* is taggable — `TagResource` takes the same key/value map every
+ * other AWS resource does. An individual policy is not: `CreatePolicy` accepts
+ * a policy store id, a definition, and a client token, and there is no tag
+ * surface on it at all. So the store-level tags can say "this store is chant's"
+ * and nothing native can say "this policy is chant's" — which is the granularity
+ * `delete` needs, because a store holds policies from more than one source the
+ * moment somebody uses the console.
+ *
+ * The one durable, writable, readable per-policy field AVP has is
+ * `Definition.Static.Description`. That is the channel: chant's marker is
+ * encoded into a trailing bracketed segment of the description, ahead of which
+ * the author's own text is preserved. It is read back on `describeResources`
+ * and on `exportResources`, which is exactly what `ownershipChannel.reads`
+ * declares (chant #1348) — no third path claims a verdict it cannot resolve.
+ *
+ * See ./OWNERSHIP.md for the design record, including what this channel costs
+ * and the two alternatives that were rejected.
+ */
+import type { ChannelKeys, OwnershipMarker } from "@intentius/chant/ownership";
+/**
+ * The marker keys, shared by both AVP channels.
+ *
+ * The same three names serve the store's tag map and the per-policy description
+ * marker, because `ownershipChannel` declares one {@link ChannelKeys} and a
+ * lexicon whose two channels disagreed on key names would be two conventions
+ * wearing one declaration. AWS tag keys permit `:`, and the description
+ * encoding below quotes its values, so neither channel constrains the other.
+ */
+export declare const AVP_OWNERSHIP_KEYS: ChannelKeys;
+/**
+ * The Cedar policy id this AVP policy carries, recorded beside the marker.
+ *
+ * Deliberately *not* part of {@link AVP_OWNERSHIP_KEYS}: it is not an ownership
+ * claim and `hasOwnershipMarker` must not consult it. It is here because
+ * `ListPolicies` returns descriptions but not statements, so without it every
+ * live policy needs a second `GetPolicy` round trip just to learn which chant
+ * entity it belongs to.
+ */
+export declare const AVP_POLICY_ID_KEY = "chant:policy-id";
+/**
+ * AVP caps `Definition.Static.Description` at 150 characters.
+ *
+ * The marker is what makes a policy deletable, so when the author's own text
+ * plus the marker exceed the cap, the *text* is truncated and the marker is
+ * kept whole. Silently dropping the marker would turn an owned policy into a
+ * foreign one, and a foreign policy is never deleted — the estate would grow
+ * undeletable policies with no error anywhere.
+ */
+export declare const AVP_DESCRIPTION_MAX = 150;
+/** What {@link decodeOwnershipDescription} recovers from a live description. */
+export interface DecodedDescription {
+    /** The author's own description, marker segment removed. */
+    text: string;
+    /** Marker entries, keyed by {@link AVP_OWNERSHIP_KEYS} names, for the core ownership helpers. */
+    tags: Record<string, string>;
+    /** The Cedar policy id the marker recorded, when it carried one. */
+    policyId?: string;
+    /** Whether a marker segment was present at all. */
+    marked: boolean;
+}
+/**
+ * Encode the marker into a description.
+ *
+ * Values are percent-encoded, so a stack named `my stack` or an id holding a
+ * `]` round-trips instead of corrupting the segment. Reversed by
+ * {@link decodeOwnershipDescription}.
+ */
+export declare function encodeOwnershipDescription(text: string | undefined, marker: OwnershipMarker, policyId?: string): string;
+/** Recover the author's text and chant's marker from a live description. */
+export declare function decodeOwnershipDescription(description: string | undefined): DecodedDescription;
+/**
+ * The per-policy verdict, read off a live description.
+ *
+ * Two-valued on purpose: this function is only ever called where the
+ * description was actually read, and `unknown` is reserved for the paths that
+ * could not read it at all (the contract in core's `ownership.ts`).
+ */
+export declare function ownershipFromDescription(description: string | undefined): "owned" | "foreign";
+/** True when a live description carries chant's marker. */
+export declare function descriptionIsOwned(description: string | undefined): boolean;
+/**
+ * The store-level verdict, read off a policy store's tag map.
+ *
+ * The coarse channel: it answers "is this store chant's" and says nothing about
+ * any individual policy in it. Kept separate from
+ * {@link ownershipFromDescription} so a caller cannot accidentally treat a
+ * store's tags as a policy's marker — the mistake the whole design exists to
+ * avoid.
+ */
+export declare function ownershipFromStoreTags(tags: Record<string, unknown> | undefined): "owned" | "foreign";
+/** The tag entries to stamp onto a policy store. */
+export declare function storeOwnershipTags(marker: OwnershipMarker): Record<string, string>;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/avp/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../src/avp/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG/E;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,EAAE,OAAO,CAAC;CACjB;AAID;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,eAAe,EACvB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAeR;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,CA6B9F;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAE7F;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAErG;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAElF"}

package/dist/avp/statement.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The two text-level facts the observation needs from a live Cedar statement
+ * (#1652): which `@id` it carries — the link back to a chant entity — and
+ * whether it permits or forbids.
+ *
+ * Both by regex, with no parser behind them, and that is the point. Reading a
+ * policy *properly* is `src/import/parser.ts`'s job and it goes through
+ * `cedar-wasm`, which is a 12 MB module; the observation path must not load it,
+ * because `plugin.ts` imports `ambientKinds()` eagerly and every `chant`
+ * invocation would pay for it. Live export, which is allowed to be slow and
+ * needs real fidelity, uses the import parser instead of anything here.
+ *
+ * Neither function is a judgement. `observeAmbient` reports the effect and
+ * stops; whether an ambient `permit` is a standing grant worth acting on is the
+ * consumer's call.
+ */
+import type { CedarEffect } from "../serializer.js";
+/** The `@id("…")` a chant-emitted statement always carries, or undefined. */
+export declare function policyIdFromStatement(statement: string): string | undefined;
+/** `permit` or `forbid`, scanned past any annotations. */
+export declare function effectFromStatement(statement: string): CedarEffect | undefined;
+//# sourceMappingURL=statement.d.ts.map

package/dist/avp/statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statement.d.ts","sourceRoot":"","sources":["../../src/avp/statement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI3E;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAG9E"}

package/dist/avp/store.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Binding a chant environment to an AVP policy store, and reading it (#1652).
+ *
+ * Everything that talks to a store needs the same two things first: which store
+ * this environment means, and the store's policies indexed by the Cedar id a
+ * chant entity resolves to. Both live here so `describeResources`,
+ * `observeAmbient` and `exportResources` cannot disagree about either.
+ */
+import { type AvpClientOptions, type AvpPolicySummary } from "./client.js";
+/** The env var an environment's policy store is named in when config does not name it. */
+export declare const AVP_POLICY_STORE_ENV = "CEDAR_AVP_POLICY_STORE_ID";
+/** Per-environment override: `CEDAR_AVP_POLICY_STORE_ID_PROD`. */
+export declare function policyStoreEnvKey(environment: string): string;
+export interface StoreBindingOptions {
+    environment: string;
+    /** Explicit store id from the caller — wins over everything. */
+    policyStoreId?: string;
+    /** Declared entities, read for a `policyStoreId` prop (the entity-prop pass-through). */
+    entities?: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+    env?: Record<string, string | undefined>;
+}
+/**
+ * Which policy store this environment means.
+ *
+ * Resolution order, most specific first:
+ *
+ *   1. an explicit `policyStoreId` from the caller;
+ *   2. a `policyStoreId` prop on a declared policy — the entity-prop
+ *      pass-through the observation guide recommends for finding the cloud-side
+ *      identifier, and the form a project uses when it declares the store in the
+ *      same build;
+ *   3. `CEDAR_AVP_POLICY_STORE_ID_<ENV>`, then `CEDAR_AVP_POLICY_STORE_ID`.
+ *
+ * `undefined` means no binding, and every caller turns that into `no-binding`
+ * rather than an empty read. An empty read would say the store holds nothing,
+ * which is a claim about an estate nobody looked at.
+ */
+export declare function resolvePolicyStoreId(options: StoreBindingOptions): string | undefined;
+/** One live policy, with whatever chant could learn about which entity it belongs to. */
+export interface AvpLivePolicy extends AvpPolicySummary {
+    /** The Cedar `@id` — the link back to a chant entity. Undefined when unrecoverable. */
+    cedarPolicyId?: string;
+    /** The policy text, when it was fetched (see `withStatements`). */
+    statement?: string;
+    /** The author's description, marker segment removed. */
+    authoredDescription: string;
+    /** Whether the description carried chant's ownership marker. */
+    marked: boolean;
+}
+export interface LoadPoliciesOptions {
+    policyStoreId: string;
+    client?: AvpClientOptions;
+    /**
+     * Fetch each policy's statement.
+     *
+     * The thin observation does not need one: a marked policy's description
+     * already names its Cedar id, and `describeResources` returns scrubbed
+     * metadata rather than config. Ambient discovery and live export both do, so
+     * they ask for them.
+     */
+    withStatements?: boolean;
+}
+/**
+ * Every policy in the store, each resolved to its Cedar id where possible.
+ *
+ * The marker is the cheap path: `ListPolicies` returns descriptions, so a
+ * chant-stamped policy is identified in the enumeration itself. Anything
+ * unmarked — a console edit, another tool's policy — costs one `GetPolicy` to
+ * read the `@id` out of its statement, run through the shared bounded pool so a
+ * store of two hundred policies is not two hundred serial round trips.
+ *
+ * A per-policy `GetPolicy` failure leaves that policy without a statement and
+ * without a Cedar id rather than sinking the enumeration: the caller then treats
+ * the entity it would have matched as not-observed, which is the honest verdict.
+ */
+export declare function loadLivePolicies(options: LoadPoliciesOptions): Promise<AvpLivePolicy[]>;
+/** Index live policies by the Cedar id a chant entity resolves to. */
+export declare function indexByCedarId(policies: readonly AvpLivePolicy[]): Map<string, AvpLivePolicy>;
+//# sourceMappingURL=store.d.ts.map

package/dist/avp/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/avp/store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,UAAU,CAAC;AAIlB,0FAA0F;AAC1F,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAYrF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAiC7F;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAU7F"}

package/dist/avp/testdata/mock-transport.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A fake AVP wire, for the tests of every reader in ../ .
+ *
+ * Mocks the *client layer*, never the network: it implements {@link AvpHttp},
+ * the same injection point `lexicons/aws/src/api/read-client.ts` exposes, so a
+ * test drives real `avpCall` / `listPolicies` / `getPolicy` code — the
+ * pagination loop, the `__type` error mapping, the description decoding — with
+ * only the socket replaced.
+ */
+import type { AvpHttp } from "../client.js";
+/** One policy the fake store holds. */
+export interface MockPolicy {
+    policyId: string;
+    statement: string;
+    description?: string;
+    policyType?: string;
+    createdDate?: string;
+    lastUpdatedDate?: string;
+    /** Make `GetPolicy` fail for this one, to exercise a per-policy hole. */
+    getFails?: boolean;
+}
+export interface MockStore {
+    policyStoreId: string;
+    policies: MockPolicy[];
+    /** Page size, so the pagination loop is actually exercised. */
+    pageSize?: number;
+    /** Fail `ListPolicies` with this AWS error code. */
+    listFails?: {
+        code: string;
+        message: string;
+        status?: number;
+    };
+    tags?: Record<string, string>;
+    arn?: string;
+}
+/** A chant-stamped description for a policy the fake store should read as owned. */
+export declare function markedDescription(policyId: string, text?: string, marker?: {
+    stack: string;
+    env?: string;
+}): string;
+/** A statement carrying the `@id` a chant entity resolves to. */
+export declare function statementFor(policyId: string, body?: string): string;
+export interface MockTransport {
+    http: AvpHttp;
+    /** Every operation issued, in order — for asserting round-trip counts. */
+    calls: Array<{
+        operation: string;
+        payload: Record<string, unknown>;
+    }>;
+}
+/** Build an {@link AvpHttp} over one fake store. */
+export declare function mockAvpTransport(store: MockStore): MockTransport;
+/** The env a reader needs to consider itself credentialed against a fake endpoint. */
+export declare const MOCK_ENV: Record<string, string | undefined>;
+//# sourceMappingURL=mock-transport.d.ts.map

package/dist/avp/testdata/mock-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-transport.d.ts","sourceRoot":"","sources":["../../../src/avp/testdata/mock-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,SAAK,EACT,MAAM,GAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAoC,GACxE,MAAM,CAER;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,SAAqD,GAAG,MAAM,CAEhH;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,0EAA0E;IAC1E,KAAK,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACvE;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa,CAoFhE;AAED,sFAAsF;AACtF,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEvD,CAAC"}

package/dist/codegen/docs-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=docs-cli.d.ts.map

package/dist/codegen/docs-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/docs-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/docs.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The cedar lexicon's Starlight site.
+ *
+ * Pages are declared as `extraPages` rather than left as hand-written files in
+ * docs/. The pipeline rebuilds the sidebar from the pages it knows about on
+ * every run, and Starlight does not auto-discover, so a page the config has
+ * never heard of exists on disk and is reachable only by typing its URL
+ * (chant #1312).
+ *
+ * Two more pages come out of the pipeline itself: the generated rules table
+ * (`rules`) and the serialization reference. Both are linked from the sidebar
+ * automatically.
+ *
+ * Cross-namespace links are written as full `/chant/...` paths. This site's
+ * base is `/chant/lexicons/cedar/`, so a bare `/guide/...` would be rewritten
+ * to `/chant/lexicons/cedar/guide/...`; the rehype plugin's idempotency check
+ * leaves an already-project-rooted path alone. Sibling pages use `../slug/`,
+ * because `./slug` from an MDX body resolves as a child.
+ */
+/**
+ * Generate the docs site for the cedar lexicon.
+ */
+export declare function generateDocs(options?: {
+    verbose?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/codegen/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAuwBH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EjF"}

package/dist/codegen/emit.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The three generated artifacts, all built from one model.
+ *
+ * `lexicon-cedar.json`, `index.ts` and `index.d.ts` describe the same set of
+ * declarations, and the only way they cannot skew is if they are derived from
+ * the same pass — which is what {@link buildEmitModel} is for. Nothing here
+ * reads the clock or a random source: keys come out of the resolved schema
+ * already sorted (Rust `BTreeMap`, #1648 §5.2), everything else is sorted
+ * explicitly, so regenerating twice produces identical bytes.
+ */
+import type { NamingStrategy } from "@intentius/chant/codegen/naming";
+import type { CedarAttribute, CedarDecl, CedarTypeRef } from "../spec/parse.js";
+export declare const LEXICON_NAME = "cedar";
+export interface EmitEntity {
+    tsName: string;
+    /** `App::User` */
+    typeName: string;
+    namespace: string;
+    /** TS name of the attribute-record property class, e.g. `UserAttributes`. */
+    attributesTsName: string;
+    /** TS name of the entity-UID string type, e.g. `UserUid`. */
+    uidTsName: string;
+    memberOfTypes: string[];
+    attributes: CedarAttribute[];
+    enumValues?: string[];
+}
+export interface EmitAction {
+    tsName: string;
+    /** `App::Action::"read"` */
+    typeName: string;
+    namespace: string;
+    actionId: string;
+    /** TS name of the context-record property class, e.g. `ReadContext`. */
+    contextTsName: string;
+    principalTypes: string[];
+    resourceTypes: string[];
+    context: CedarAttribute[];
+}
+export interface EmitModel {
+    entities: EmitEntity[];
+    actions: EmitAction[];
+    /** entityType → the UID type name, for rendering `{type:"Entity"}` references. */
+    uidTypeByEntityType: Map<string, string>;
+}
+/**
+ * Assign every generated name, once.
+ *
+ * `NamingStrategy` names the primary declarations; the derived record names
+ * are de-duplicated against the same pool so a `UserAttributes` entity type in
+ * the schema cannot quietly take the name `User`'s attribute record wants.
+ */
+export declare function buildEmitModel(decls: CedarDecl[], naming: NamingStrategy): EmitModel;
+/**
+ * Render one Cedar type as a TypeScript type expression.
+ *
+ * Extension types (`ipaddr`, `decimal`, `datetime`, `duration`) render as
+ * `string`: Cedar constructs them from string literals in policy text, and
+ * inventing branded TS types for values chant never evaluates would be
+ * decoration.
+ */
+export declare function renderType(type: CedarTypeRef, model: EmitModel): string;
+/** Quote an attribute name that is not a bare identifier — Cedar allows both. */
+export declare function propertyKey(name: string): string;
+/** The Cedar surface syntax for a type, for doc comments and the registry. */
+export declare function cedarTypeText(type: CedarTypeRef): string;
+/** `App::User` → `App::User.Attributes`, the record type's own spec name. */
+export declare function attributesTypeName(entityTypeName: string): string;
+/** `App::Action::"read"` → `App::Action::"read".Context`. */
+export declare function contextTypeName(actionTypeName: string): string;
+/** Build `lexicon-cedar.json`. */
+export declare function generateRegistry(model: EmitModel): string;
+/** Build the runtime `index.ts`. */
+export declare function generateRuntimeIndex(model: EmitModel): string;
+/**
+ * Build the declaration-only `index.d.ts`.
+ *
+ * It is validated standalone by core's `typecheckDTS`, which runs tsc in a
+ * temp directory with no `node_modules` beyond a stub for
+ * `@intentius/chant/declarable` — so this file may import that and nothing
+ * else, and every other type it uses has to be declared here.
+ */
+export declare function generateTypes(model: EmitModel): string;
+/** The tiny re-export module `index.ts` imports its factories from. */
+export declare const RUNTIME_TS = "// Code generated by chant generate. DO NOT EDIT.\nexport { createProperty, createResource } from \"@intentius/chant/runtime\";\n";
+//# sourceMappingURL=emit.d.ts.map

package/dist/codegen/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/codegen/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7E,eAAO,MAAM,YAAY,UAAU,CAAC;AAIpC,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,kFAAkF;IAClF,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,SAAS,CA4DpF;AAWD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,GAAG,MAAM,CAmBvE;AAID,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAexD;AAWD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE9D;AAUD,kCAAkC;AAClC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CA6DzD;AAmHD,oCAAoC;AACpC,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAqD7D;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAiCtD;AAID,uEAAuE;AACvE,eAAO,MAAM,UAAU,sIAEtB,CAAC"}

package/dist/codegen/generate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=generate-cli.d.ts.map

package/dist/codegen/generate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/generate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Schema-driven code generation for the cedar lexicon (#1650).
+ *
+ * The pipeline is core's; what is unusual is its input. Every other lexicon
+ * fetches one global upstream spec, so `fetchSchemas` is an HTTP call and a
+ * cache. Cedar's spec-of-interest is the project's own `.cedarschema` (epic
+ * #1645), so `fetchSchemas` is a file read with a fallback, and the pinned
+ * upstream is the *grammar* — `@cedar-policy/cedar-wasm`, whose language
+ * version is asserted before anything is emitted.
+ *
+ * Order matters in {@link generate}: the language-version assert runs before
+ * the schema is resolved, because resolution is the thing whose output shape a
+ * grammar change would move.
+ */
+import type { GenerateOptions, GenerateResult } from "@intentius/chant/codegen/generate";
+/** Filename of the generated registry. */
+export declare const LEXICON_JSON_FILENAME = "lexicon-cedar.json";
+export interface CedarGenerateOptions extends GenerateOptions {
+    /** Project root the `cedar.schema` path is resolved against. Defaults to `process.cwd()`. */
+    projectRoot?: string;
+    /** The `cedar` config namespace, when the caller has already loaded it. */
+    config?: {
+        schema?: string;
+        validation?: {
+            requireProjectSchema?: boolean;
+        };
+    };
+}
+/**
+ * Run the code generation pipeline.
+ */
+export declare function generate(options?: CedarGenerateOptions): Promise<GenerateResult>;
+/**
+ * Write generated files to the package directory.
+ */
+export declare function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void;
+//# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAiBzF,0CAA0C;AAC1C,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAE1D,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;CAC/E;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0D1F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAajF"}

package/dist/codegen/naming.d.ts

@@ -0,0 +1,48 @@
+import { NamingStrategy, type NamingConfig, type NamingInput } from "@intentius/chant/codegen/naming";
+/**
+ * The name of the policy resource every generated bundle carries.
+ *
+ * It is not schema-derived — a Cedar schema declares entity types and actions,
+ * never policies — so it is claimed as a priority name before any schema type
+ * gets to contest a short name. A project whose schema declares its own
+ * `Policy` entity type therefore gets `AppPolicy` (or whatever its namespace
+ * is), and the authoring class keeps the name users import.
+ */
+export declare const POLICY_TS_NAME = "Policy";
+/** The `entityType` of the policy resource, matching the serializer. */
+export declare const POLICY_TYPE = "Cedar::Policy";
+/** `read` → `Read`; `service-account` → `ServiceAccount`. */
+export declare function pascalCase(value: string): string;
+/** Split `App::Action::"read"` into its action id, or null for a non-action. */
+export declare function actionIdOf(typeName: string): string | null;
+/**
+ * Naming configuration for the cedar lexicon.
+ *
+ * Two shapes go through this rather than one: `App::User` (an entity type) and
+ * `App::Action::"read"` (an action). Both are entities in Cedar's model, so
+ * both are contested in the same pool — a schema with an entity type called
+ * `Read` and an action called `read` collides, and phase 4 qualifies the loser
+ * with its namespace rather than one silently overwriting the other.
+ */
+export declare const namingConfig: NamingConfig;
+/**
+ * Create a NamingStrategy instance from parsed results.
+ *
+ * `Cedar::Policy` is injected as an input because it has to be *in* the contest
+ * to win it: `priorityNames` is applied over the input type names, so a policy
+ * type that never appears there cannot claim `Policy` before a schema's own
+ * `Policy` entity type takes it in the short-name phase.
+ */
+export declare function createNaming(inputs: NamingInput[]): NamingStrategy;
+/**
+ * The names derived from a primary name — the entity's attribute record and
+ * the action's context record.
+ *
+ * These are not contested by `NamingStrategy` (it only names the primary
+ * declarations), so they are de-duplicated against everything already taken.
+ * The suffix loop is deliberately boring: a schema that manages to collide
+ * `UserAttributes` twice gets `UserAttributes2`, which is ugly and correct,
+ * rather than one entry silently overwriting the other in the registry.
+ */
+export declare function deriveName(base: string, suffix: string, taken: Set<string>): string;
+//# sourceMappingURL=naming.d.ts.map

package/dist/codegen/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/codegen/naming.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEtG;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,wEAAwE;AACxE,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAE3C,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhD;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,EAAE,YA2B1B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CASnF"}

package/dist/codegen/package.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Cedar lexicon packaging — delegates to core's packagePipeline.
+ */
+import { type PackageOptions, type PackageResult } from "@intentius/chant/codegen/package";
+export type { PackageOptions, PackageResult };
+/**
+ * Package the Cedar lexicon into a distributable BundleSpec.
+ */
+export declare function packageLexicon(opts?: PackageOptions): Promise<PackageResult>;
+//# sourceMappingURL=package.d.ts.map

package/dist/codegen/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/codegen/package.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAG1C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAI9C;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BtF"}

package/dist/composites/deny-by-default-set.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DenyByDefaultSet — a forbid floor under a group of permits.
+ *
+ * Cedar is already default-deny, so a floor is not about the absence of a
+ * permit; it is about the presence of a bad one. A `forbid` beats every
+ * `permit` in the same set unconditionally, which makes a forbid the only
+ * construct that survives a later, wider grant. The pattern teams write by hand
+ * is a guarded forbid at the top of a file and a pile of permits under it, with
+ * nothing tying the two together — delete the forbid and the permits keep
+ * working, wider than anyone intended.
+ *
+ * This composite returns both halves from one call, so the floor cannot be
+ * dropped without dropping the members with it.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { EntityTypeName, PolicyRef, PolicyScope } from "../generated/index.js";
+export interface DenyByDefaultSetOpts {
+    /**
+     * The permits the floor sits under. They are returned unchanged — the floor
+     * constrains them at evaluation time, not at construction time.
+     */
+    policies: Declarable[];
+    /**
+     * The entity type the floor covers. Omit to make it apply to every resource,
+     * which is the strongest form and worth stating deliberately.
+     */
+    entityType?: EntityTypeName;
+    /**
+     * Actions the floor forbids. Defaults to every action, i.e. an unconstrained
+     * action position.
+     */
+    actions?: PolicyRef | PolicyRef[];
+    /**
+     * The conditions under which the denial applies. Required: a forbid with no
+     * guard denies everything unconditionally and no permit can lift it, which
+     * is a policy set that authorizes nothing.
+     */
+    when: string[];
+    /** Carve-outs from the denial. The break-glass principal usually lives here. */
+    unless?: string[];
+    /** Narrow the floor's principal. A bare entity type becomes `principal is T`. */
+    principal?: EntityTypeName | PolicyScope;
+    /** Merged over the generated annotations; an explicit `id` wins. */
+    annotations?: Record<string, string>;
+}
+export interface DenyByDefaultSetResources {
+    /** The `forbid` policy. Emitted first in declaration order. */
+    floor: Declarable;
+    /** The permits, unchanged and in the order given. */
+    members: Declarable[];
+    /** `[floor, ...members]`, for `export const … = DenyByDefaultSet(…).all`. */
+    all: Declarable[];
+}
+/**
+ * A guarded `forbid` plus the permits it governs.
+ */
+export declare function DenyByDefaultSet(opts: DenyByDefaultSetOpts): DenyByDefaultSetResources;
+//# sourceMappingURL=deny-by-default-set.d.ts.map

package/dist/composites/deny-by-default-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-by-default-set.d.ts","sourceRoot":"","sources":["../../src/composites/deny-by-default-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IAClC;;;;OAIG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iFAAiF;IACjF,SAAS,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC;IACzC,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,KAAK,EAAE,UAAU,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,6EAA6E;IAC7E,GAAG,EAAE,UAAU,EAAE,CAAC;CACnB;AAeD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,yBAAyB,CAuBtF"}

package/dist/composites/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Cedar lexicon composites.
+ *
+ * Cedar has no functions, no modules, no loops, and templates with exactly two
+ * slots — so every repeated policy shape is copy-paste in `.cedar` text. These
+ * factories are where that repetition goes instead.
+ */
+export { OwnerCanManage } from "./owner-can-manage.js";
+export type { OwnerCanManageOpts } from "./owner-can-manage.js";
+export { DenyByDefaultSet } from "./deny-by-default-set.js";
+export type { DenyByDefaultSetOpts, DenyByDefaultSetResources } from "./deny-by-default-set.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC"}