@intentius/chant-lexicon-cedar 0.44.8

package/src/lint/post-synth/cedar-helpers.ts

@@ -0,0 +1,209 @@
+/**
+ * Shared reading helpers for the cedar post-synth checks.
+ *
+ * Every check in this directory judges the same artifact: the JSON policy-set
+ * envelope the serializer writes beside the `.cedar` text
+ * (`policies.cedar.json` — see `../../serializer.ts`). The text and the JSON
+ * are rendered from one in-memory model, so a finding against the JSON is a
+ * finding against both; the JSON is the one with structure worth walking.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter
+ * (`listRuleFiles` in core's `lint/discover.ts`).
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+/** Files carrying a Cedar JSON policy set end with this. */
+export const CEDAR_JSON_SUFFIX = ".cedar.json";
+
+/** The lexicon name stamped on every diagnostic from this directory. */
+export const CEDAR_LEXICON = "cedar";
+
+// ── The shape of what we read ─────────────────────────────────────
+//
+// Deliberately loose: these checks also run over a policy set that chant did
+// not write (`chant audit` over a checked-in `policies.cedar.json`), so every
+// field is `unknown` until a narrowing helper has looked at it.
+
+/** One scope position of a policy in Cedar's JSON policy format. */
+export interface CedarScopeJson {
+  op?: unknown;
+  entity?: unknown;
+  entities?: unknown;
+  entity_type?: unknown;
+  in?: unknown;
+}
+
+/** One `when`/`unless` clause. */
+export interface CedarConditionJson {
+  kind?: unknown;
+  body?: unknown;
+}
+
+/** A single policy in Cedar's JSON policy format. */
+export interface CedarPolicyJson {
+  effect?: unknown;
+  principal?: unknown;
+  action?: unknown;
+  resource?: unknown;
+  conditions?: unknown;
+  annotations?: unknown;
+}
+
+/** The policy-set envelope: what `policies.cedar.json` holds. */
+export interface CedarPolicySetDoc {
+  staticPolicies?: unknown;
+  templates?: unknown;
+  templateLinks?: unknown;
+}
+
+/** One `[key, policy]` pair out of a policy set, with its origin. */
+export interface CedarPolicyEntry {
+  /** The key under `staticPolicies` — the id Cedar will report diagnostics against. */
+  key: string;
+  policy: CedarPolicyJson;
+  /** True when the entry came from `templates` rather than `staticPolicies`. */
+  template: boolean;
+}
+
+/** A policy set found in the build output, with everything needed to name it. */
+export interface CedarPolicySet {
+  /** The lexicon output it came from. */
+  lexicon: string;
+  /** A human-readable origin: the filename, or the lexicon name for a bare string output. */
+  source: string;
+  /** The raw JSON text, for handing straight to the wasm. */
+  raw: string;
+  /** Parsed envelope, or undefined when `raw` is not JSON at all. */
+  doc?: CedarPolicySetDoc;
+  /** The JSON parse error, when there is one. */
+  parseError?: string;
+  /** Static policies and templates, flattened in document order. */
+  entries: CedarPolicyEntry[];
+}
+
+// ── Narrowing ─────────────────────────────────────────────────────
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** `permit` / `forbid` / whatever else the document claims. */
+export function effectOf(policy: CedarPolicyJson): string | undefined {
+  return typeof policy.effect === "string" ? policy.effect : undefined;
+}
+
+/** The three scope positions, in Cedar's own order. */
+export function scopesOf(policy: CedarPolicyJson): Array<{ variable: string; scope: CedarScopeJson }> {
+  const out: Array<{ variable: string; scope: CedarScopeJson }> = [];
+  for (const variable of ["principal", "action", "resource"] as const) {
+    const scope = policy[variable];
+    if (isRecord(scope)) out.push({ variable, scope: scope as CedarScopeJson });
+  }
+  return out;
+}
+
+/** True when a scope position is Cedar's unconstrained "any" (`op: "All"`). */
+export function scopeIsAll(scope: unknown): boolean {
+  return isRecord(scope) && scope.op === "All";
+}
+
+/** Every `when`/`unless` clause, or `[]` when the policy is unconditioned. */
+export function conditionsOf(policy: CedarPolicyJson): CedarConditionJson[] {
+  if (!Array.isArray(policy.conditions)) return [];
+  return policy.conditions.filter(isRecord) as CedarConditionJson[];
+}
+
+/** The policy's annotation map, narrowed to the string-valued entries Cedar allows. */
+export function annotationsOf(policy: CedarPolicyJson): Record<string, unknown> {
+  return isRecord(policy.annotations) ? policy.annotations : {};
+}
+
+/** The `@id` annotation, when it is a string. */
+export function annotatedId(policy: CedarPolicyJson): string | undefined {
+  const id = annotationsOf(policy).id;
+  return typeof id === "string" ? id : undefined;
+}
+
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * `PostSynthContext#env`) is production-like, for the checks whose severity is
+ * env-gated. Same seam and same vocabulary as the aws lexicon's
+ * `isFullTierEnv`: an unset or unrecognized env is treated as non-production,
+ * so a project that never passes `--env` is never unexpectedly hard-failed.
+ */
+export function isProdLikeEnv(env: string | undefined): boolean {
+  return env === "prod" || env === "production" || env === "full";
+}
+
+// ── Reading policy sets out of the build output ───────────────────
+
+/** Every candidate policy-set document in the build, parsed or not. */
+export function policySets(ctx: PostSynthContext): CedarPolicySet[] {
+  const sets: CedarPolicySet[] = [];
+
+  for (const [lexicon, output] of ctx.outputs) {
+    if (typeof output === "string") {
+      // A bare string output. `createPostSynthContext` and `chant audit` over a
+      // standalone file both land here; only JSON is a policy set, `.cedar`
+      // text is the human-facing twin and carries nothing the JSON does not.
+      //
+      // Every lexicon's output shares this map, and several of them are JSON,
+      // so "is it JSON" is not enough to claim one: take it when it came from
+      // the cedar output (where even unparseable content is a cedar finding —
+      // CEDC010 reports it) or when it is unmistakably a policy-set envelope.
+      if (!looksLikeJson(output)) continue;
+      const set = readSet(lexicon, lexicon, output);
+      if (lexicon === CEDAR_LEXICON || isPolicySetEnvelope(set.doc)) sets.push(set);
+      continue;
+    }
+    for (const [filename, content] of Object.entries(output.files ?? {})) {
+      if (!filename.endsWith(CEDAR_JSON_SUFFIX)) continue;
+      if (typeof content !== "string") continue;
+      sets.push(readSet(lexicon, filename, content));
+    }
+  }
+
+  return sets;
+}
+
+/** The subset of {@link policySets} that parsed as JSON. */
+export function parsedPolicySets(ctx: PostSynthContext): CedarPolicySet[] {
+  return policySets(ctx).filter((set) => set.doc !== undefined);
+}
+
+function looksLikeJson(text: string): boolean {
+  return text.trimStart().startsWith("{");
+}
+
+/** The `PolicySet` envelope has one of these two keys; nothing else does. */
+function isPolicySetEnvelope(doc: CedarPolicySetDoc | undefined): boolean {
+  return doc !== undefined && (isRecord(doc.staticPolicies) || isRecord(doc.templates));
+}
+
+function readSet(lexicon: string, source: string, raw: string): CedarPolicySet {
+  let doc: CedarPolicySetDoc | undefined;
+  let parseError: string | undefined;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (isRecord(parsed)) doc = parsed as CedarPolicySetDoc;
+    else parseError = "policy set is not a JSON object";
+  } catch (err) {
+    parseError = err instanceof Error ? err.message : String(err);
+  }
+
+  return { lexicon, source, raw, doc, parseError, entries: doc ? flatten(doc) : [] };
+}
+
+function flatten(doc: CedarPolicySetDoc): CedarPolicyEntry[] {
+  const entries: CedarPolicyEntry[] = [];
+  for (const [group, template] of [
+    [doc.staticPolicies, false],
+    [doc.templates, true],
+  ] as const) {
+    if (!isRecord(group)) continue;
+    for (const [key, policy] of Object.entries(group)) {
+      if (isRecord(policy)) entries.push({ key, policy: policy as CedarPolicyJson, template });
+    }
+  }
+  return entries;
+}

package/src/lint/post-synth/cedc010.ts

@@ -0,0 +1,80 @@
+/**
+ * CEDC010: the emitted policy set must parse as Cedar
+ *
+ * The floor every other check stands on. `policies.cedar.json` is Cedar's own
+ * JSON policy format inside the `PolicySet` envelope the wasm accepts, which
+ * means Cedar's own deserializer is the authority on whether it is well formed
+ * — not a hand-written shape test. A set that does not parse cannot be loaded
+ * by any evaluator (AVP, cedar-agent, an embedded `cedar-wasm`), so this is an
+ * error everywhere, in every environment.
+ *
+ * Two failure modes reach here: the file is not JSON at all, and the JSON is
+ * not a Cedar policy set. Both are reported against the file, since neither
+ * has a single implicated policy.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { CEDAR_LEXICON, policySets } from "./cedar-helpers";
+import { loadWasm, normalizePolicySet, parsePolicySet, wasmLoadError } from "./wasm-helpers";
+
+export const cedc010: PostSynthCheck = {
+  id: "CEDC010",
+  description: "The emitted Cedar policy set must parse as Cedar (checkParsePolicySet)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const sets = policySets(ctx);
+    if (sets.length === 0) return diagnostics;
+
+    const wasm = loadWasm();
+    if (!wasm) {
+      // The only place the missing-validator condition is reported. The other
+      // wasm-backed checks stay quiet rather than repeating it four times.
+      return [
+        {
+          checkId: "CEDC010",
+          severity: "warning",
+          message: `Cedar policies were emitted but @cedar-policy/cedar-wasm could not be loaded, so none of them were parsed or validated: ${wasmLoadError()}`,
+          lexicon: CEDAR_LEXICON,
+        },
+      ];
+    }
+
+    for (const set of sets) {
+      if (set.doc === undefined) {
+        diagnostics.push({
+          checkId: "CEDC010",
+          severity: "error",
+          message: `Cedar policy set "${set.source}" is not readable as JSON: ${set.parseError}`,
+          entity: set.source,
+          lexicon: set.lexicon,
+        });
+        continue;
+      }
+
+      const { policySet } = normalizePolicySet(wasm, set);
+      const parsed = parsePolicySet(wasm, policySet);
+      if (!parsed.ok) {
+        diagnostics.push({
+          checkId: "CEDC010",
+          severity: "error",
+          message: `Cedar policy set "${set.source}" could not be parsed: ${parsed.message}`,
+          entity: set.source,
+          lexicon: set.lexicon,
+        });
+        continue;
+      }
+
+      for (const message of parsed.value) {
+        diagnostics.push({
+          checkId: "CEDC010",
+          severity: "error",
+          message: `Cedar policy set "${set.source}" does not parse as Cedar: ${message}`,
+          entity: set.source,
+          lexicon: set.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cedc011.ts

@@ -0,0 +1,47 @@
+/**
+ * CEDC011: every `when`/`unless` condition expression must parse
+ *
+ * A policy's guard is the part that does the work — `when { context.mfa }`,
+ * `unless { resource.public }` — and until schema-driven codegen (#1650) makes
+ * those typed trees, the authored model carries them as Cedar expression
+ * *source*. Source that does not parse turns into a policy no evaluator will
+ * load, and the failure surfaces a long way from the typo: the whole policy set
+ * is rejected, naming a byte offset in a generated file.
+ *
+ * So the clause is parsed on its own and reported on its own, with the
+ * expression text and Cedar's own message (which carries a "did you mean"
+ * suggestion often enough to be worth passing through).
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { CEDAR_LEXICON, parsedPolicySets } from "./cedar-helpers";
+import { loadWasm, normalizePolicySet } from "./wasm-helpers";
+
+export const cedc011: PostSynthCheck = {
+  id: "CEDC011",
+  description: "Every when/unless condition expression in an emitted policy must parse as a Cedar expression",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const sets = parsedPolicySets(ctx);
+    if (sets.length === 0) return diagnostics;
+
+    // A missing validator is CEDC010's finding to report, not this one's.
+    const wasm = loadWasm();
+    if (!wasm) return diagnostics;
+
+    for (const set of sets) {
+      const { expressionFailures } = normalizePolicySet(wasm, set);
+      for (const failure of expressionFailures) {
+        diagnostics.push({
+          checkId: "CEDC011",
+          severity: "error",
+          message: `Policy "${failure.key}" has a ${failure.kind} clause whose expression does not parse: ${failure.expression} — ${failure.message}`,
+          entity: failure.key,
+          lexicon: set.lexicon || CEDAR_LEXICON,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cedc012.ts

@@ -0,0 +1,64 @@
+/**
+ * CEDC012: no two policies may claim the same id
+ *
+ * A Cedar policy id is the handle everything downstream uses: the validator
+ * reports against it, AVP's `CreatePolicy` stores it, a drift check diffs on
+ * it. chant derives one from the logical name (`allowAdminRead` →
+ * `allow-admin-read`) unless the author sets `annotations.id` explicitly, and
+ * two policies can land on the same string either way — a rename that
+ * kebab-cases to something already taken, or the same explicit `@id` pasted
+ * twice.
+ *
+ * The consequence is silent. The `.cedar` text gets two policies carrying
+ * `@id("same")`, while the JSON envelope is keyed by id and keeps only the last
+ * one — a policy that exists in the artifact a human reviews and not in the one
+ * a machine loads. Ids are collected from every policy set in the build, from
+ * both the envelope key and the `@id` annotation, so a collision is caught
+ * whichever of the two forms it takes.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { annotatedId, parsedPolicySets } from "./cedar-helpers";
+
+interface Claim {
+  lexicon: string;
+  source: string;
+  /** The envelope key the claim was made under. */
+  key: string;
+}
+
+export const cedc012: PostSynthCheck = {
+  id: "CEDC012",
+  description: "No two emitted Cedar policies may claim the same policy id",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const claims = new Map<string, Claim[]>();
+
+    for (const set of parsedPolicySets(ctx)) {
+      for (const entry of set.entries) {
+        // The key and the `@id` annotation are two ways of claiming the same
+        // id; a policy claiming both only counts once.
+        const ids = new Set([entry.key, annotatedId(entry.policy)].filter((id): id is string => !!id));
+        for (const id of ids) {
+          const existing = claims.get(id) ?? [];
+          existing.push({ lexicon: set.lexicon, source: set.source, key: entry.key });
+          claims.set(id, existing);
+        }
+      }
+    }
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [id, holders] of [...claims].sort(([a], [b]) => a.localeCompare(b))) {
+      if (holders.length < 2) continue;
+      const where = holders.map((h) => `${h.source}:${h.key}`).join(", ");
+      diagnostics.push({
+        checkId: "CEDC012",
+        severity: "error",
+        message: `Cedar policy id "${id}" is claimed by ${holders.length} policies (${where}). Ids must be unique across the policy set — rename one of the declarations or give it an explicit, distinct @id annotation.`,
+        entity: id,
+        lexicon: holders[0].lexicon,
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cedc013.ts

@@ -0,0 +1,68 @@
+/**
+ * CEDC013: annotation hygiene on an emitted policy
+ *
+ * Annotations are Cedar's only metadata channel — no comments survive the JSON
+ * grammar, and `policyToText` drops them — so `@id`, `@doc`, and friends are
+ * the whole audit trail a policy carries into AVP or a review. Three things
+ * make that trail useless:
+ *
+ * - an `@id` annotation that disagrees with the key the policy is filed under,
+ *   so the text artifact and the JSON artifact name the same policy differently;
+ * - an annotation whose value is empty, which reads as documented and is not;
+ * - an annotation whose value is not a string, which Cedar's `Annotations`
+ *   (`Record<string, string>`) does not admit.
+ *
+ * A *missing* `@id` is not a finding: chant derives one from the logical name,
+ * which is the normal case and the one the serializer is built around.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { annotationsOf, parsedPolicySets } from "./cedar-helpers";
+
+export const cedc013: PostSynthCheck = {
+  id: "CEDC013",
+  description: "An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const set of parsedPolicySets(ctx)) {
+      for (const entry of set.entries) {
+        const annotations = annotationsOf(entry.policy);
+
+        for (const [key, value] of Object.entries(annotations)) {
+          if (typeof value !== "string") {
+            diagnostics.push({
+              checkId: "CEDC013",
+              severity: "warning",
+              message: `Policy "${entry.key}" has a non-string @${key} annotation (${JSON.stringify(value)}). Cedar annotations are strings.`,
+              entity: entry.key,
+              lexicon: set.lexicon,
+            });
+            continue;
+          }
+          if (value.trim() === "") {
+            diagnostics.push({
+              checkId: "CEDC013",
+              severity: "warning",
+              message: `Policy "${entry.key}" has an empty @${key} annotation. Give it a value or drop it — an empty annotation reads as documentation and carries none.`,
+              entity: entry.key,
+              lexicon: set.lexicon,
+            });
+            continue;
+          }
+          if (key === "id" && value !== entry.key) {
+            diagnostics.push({
+              checkId: "CEDC013",
+              severity: "warning",
+              message: `Policy filed under id "${entry.key}" annotates @id("${value}"). The .cedar text and the JSON policy set would name this policy differently — make the annotation match, or remove it and let chant derive the id.`,
+              entity: entry.key,
+              lexicon: set.lexicon,
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cedc014.ts

@@ -0,0 +1,73 @@
+/**
+ * CEDC014: a scope constraint's entity reference must be a real entity UID
+ *
+ * Cedar names an entity as `Namespace::Type::"id"` — a type path and a quoted
+ * id. chant's serializer splits an authored reference on that grammar, and a
+ * reference that does not match it degrades rather than fails: the whole string
+ * becomes the type and the id becomes empty. `principal: { eq: "alice" }`
+ * therefore emits `{"op":"==","entity":{"type":"alice","id":""}}` — a policy
+ * that parses, validates against a schema that happens to define no such type
+ * only as an "unrecognized entity type", and silently matches nothing at
+ * runtime if it ever does.
+ *
+ * An empty entity id is the fingerprint of that degradation, and there is no
+ * legitimate reason to author one, so it is flagged wherever it appears in a
+ * scope: `== E`, `in E`, `in [E, …]`, and the `in` of an `is T in E`.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { isRecord, parsedPolicySets, scopesOf, type CedarScopeJson } from "./cedar-helpers";
+
+/** Every entity reference a scope position carries, in document order. */
+function scopeEntities(scope: CedarScopeJson): unknown[] {
+  const found: unknown[] = [];
+  const collect = (holder: unknown): void => {
+    if (!isRecord(holder)) return;
+    if (holder.entity !== undefined) found.push(holder.entity);
+    if (Array.isArray(holder.entities)) found.push(...holder.entities);
+  };
+  collect(scope);
+  // `is T in E` nests the `in` constraint under the `is`.
+  collect(scope.in);
+  return found;
+}
+
+export const cedc014: PostSynthCheck = {
+  id: "CEDC014",
+  description: "An entity reference in a policy scope must be a well-formed Namespace::Type::\"id\" UID",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const set of parsedPolicySets(ctx)) {
+      for (const entry of set.entries) {
+        for (const { variable, scope } of scopesOf(entry.policy)) {
+          for (const ref of scopeEntities(scope)) {
+            if (!isRecord(ref)) {
+              diagnostics.push({
+                checkId: "CEDC014",
+                severity: "error",
+                message: `Policy "${entry.key}" has a ${variable} constraint whose entity reference is not an entity UID (${JSON.stringify(ref)}).`,
+                entity: entry.key,
+                lexicon: set.lexicon,
+              });
+              continue;
+            }
+            const type = typeof ref.type === "string" ? ref.type : "";
+            const id = typeof ref.id === "string" ? ref.id : undefined;
+            if (type === "" || id === undefined || id === "") {
+              diagnostics.push({
+                checkId: "CEDC014",
+                severity: "error",
+                message: `Policy "${entry.key}" constrains ${variable} against "${type}" with no entity id. Write the reference as a full UID — Namespace::Type::"id" — so it resolves to an entity rather than to a bare type name.`,
+                entity: entry.key,
+                lexicon: set.lexicon,
+              });
+            }
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cede010.ts

@@ -0,0 +1,89 @@
+/**
+ * CEDE010: every emitted policy set validates clean against its schema
+ *
+ * The epic's "native tool is the test" clause: not "the text is well formed"
+ * but "Cedar's own validator, run in-process against the project's schema, has
+ * nothing to say about it." This is what catches the second meta-policy wall —
+ * a policy naming an entity type or an action the schema does not define — and
+ * it catches it everywhere, in every environment, because such a policy can
+ * never grant anything.
+ *
+ * Two things about `validate()` decide how this is written, both measured
+ * against 4.12.0 (chant #1648):
+ *
+ * - `type: "success"` means validation *ran*, not that it passed. The findings
+ *   are in `validationErrors`, and a check written as `if (answer.type ===
+ *   "failure")` passes every type error in the corpus. `validatePolicySet`
+ *   asserts `success && validationErrors.length === 0`.
+ * - `validationErrors` comes back in a different order almost every call — the
+ *   validator parallelizes across policies and does not re-sort. Forty
+ *   identical calls produced six orderings. `validatePolicySet` sorts by
+ *   `policyId` then message, so this check's output is stable enough to assert
+ *   on.
+ *
+ * When the build emits no schema there is nothing to validate against, and
+ * `validate()` cannot be called at all — it has no optional-schema mode, and an
+ * empty schema is legal Cedar that reports every policy as inapplicable, which
+ * would be worse than useless. Schema-driven codegen is #1650; until a schema
+ * is emitted beside the policies, this check says so once, as an advisory,
+ * rather than passing silently and claiming a guarantee it did not check.
+ * CEDC010's parse gate still applies in that state.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parsedPolicySets } from "./cedar-helpers";
+import { findSchema, loadWasm, normalizePolicySet, validatePolicySet } from "./wasm-helpers";
+
+export const cede010: PostSynthCheck = {
+  id: "CEDE010",
+  description: "Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const sets = parsedPolicySets(ctx);
+    if (sets.length === 0) return diagnostics;
+
+    // A missing validator is CEDC010's finding to report, not this one's.
+    const wasm = loadWasm();
+    if (!wasm) return diagnostics;
+
+    const schema = findSchema(ctx);
+    if (!schema) {
+      return [
+        {
+          checkId: "CEDE010",
+          severity: "info",
+          message: `No Cedar schema was emitted with the ${sets.length} policy set(s) in this build, so they were checked for parseability only — nothing verified that the entity types, actions, and attributes they name exist. Emit a .cedarschema (or .cedarschema.json) alongside the policies to turn this into real validation.`,
+          lexicon: sets[0].lexicon,
+        },
+      ];
+    }
+
+    for (const set of sets) {
+      const { policySet } = normalizePolicySet(wasm, set);
+      const outcome = validatePolicySet(wasm, policySet, schema.schema);
+
+      if (outcome.failure) {
+        diagnostics.push({
+          checkId: "CEDE010",
+          severity: "error",
+          message: `Cedar policy set "${set.source}" could not be validated against "${schema.source}": ${outcome.failure}`,
+          entity: set.source,
+          lexicon: set.lexicon,
+        });
+        continue;
+      }
+
+      for (const finding of outcome.errors) {
+        diagnostics.push({
+          checkId: "CEDE010",
+          severity: "error",
+          message: `Policy "${finding.policyId}" fails Cedar validation against "${schema.source}": ${finding.message}`,
+          entity: finding.policyId,
+          lexicon: set.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};