@intentius/chant-lexicon-cedar 0.44.8

package/dist/composites/owner-can-manage.d.ts

@@ -0,0 +1,48 @@
+/**
+ * OwnerCanManage — the ownership grant, written once.
+ *
+ * "The owner of a thing may act on it" is the most-repeated shape in every
+ * Cedar policy set, and hand-writing it per entity type is where the two
+ * classic mistakes get made: the `when` guard names an attribute the schema
+ * spells differently, or the grant is written wide and the scoping clause is
+ * forgotten. Cedar itself cannot help — it has no functions, no modules, and
+ * templates carry exactly two slots. A TypeScript factory is the only place
+ * this abstraction can live.
+ *
+ * The composite emits a permit whose resource scope is pinned with `is` and
+ * whose ownership test is a `when` clause, so both halves arrive together or
+ * neither does.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { EntityTypeName, PolicyRef, PolicyScope } from "../generated/index.js";
+export interface OwnerCanManageOpts {
+    /** The entity type owners act on, e.g. `"App::Document"`. */
+    entityType: EntityTypeName;
+    /**
+     * Actions the owner is granted. A single action is emitted as `== A`, several
+     * as `in [A, …]`, and none leaves the action position unconstrained — which
+     * is a wide grant, so it has to be asked for by omitting the field.
+     */
+    actions?: PolicyRef | PolicyRef[];
+    /**
+     * The attribute on the resource that holds the owner. Defaults to `owner`,
+     * the name the bundled schema and most Cedar examples use.
+     */
+    ownerAttribute?: string;
+    /**
+     * Narrow the principal beyond "anyone". A bare entity type string becomes
+     * `principal is T`; a full scope is passed through.
+     */
+    principal?: EntityTypeName | PolicyScope;
+    /** Extra `when` clauses, appended after the ownership test. */
+    when?: string[];
+    /** `unless` clauses. An MFA requirement is the usual one. */
+    unless?: string[];
+    /** Merged over the generated annotations; an explicit `id` wins. */
+    annotations?: Record<string, string>;
+}
+/**
+ * One permit: the owner of an `entityType` may take `actions` on it.
+ */
+export declare function OwnerCanManage(opts: OwnerCanManageOpts): Declarable;
+//# sourceMappingURL=owner-can-manage.d.ts.map

package/dist/composites/owner-can-manage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-can-manage.d.ts","sourceRoot":"","sources":["../../src/composites/owner-can-manage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjF,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IAClC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,WAAW,CAAC;IACzC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAeD;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAgBnE"}

package/dist/config.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The `cedar` namespace in `chant.config.ts` (#1344, #1650).
+ *
+ * ```ts
+ * import type { ChantConfig } from "@intentius/chant/config";
+ * import "@intentius/chant-lexicon-cedar";   // brings the `cedar` key into ChantConfig
+ *
+ * export default {
+ *   lexicons: ["cedar"],
+ *   cedar: {
+ *     schema: "authz/app.cedarschema",
+ *     validation: { mode: "strict", warnings: "warn" },
+ *   },
+ * } satisfies ChantConfig;
+ * ```
+ *
+ * Cedar is the one lexicon whose codegen input is the *project's* file rather
+ * than a global upstream (epic #1645), so this namespace is not a convenience —
+ * it is where `generate()` is told what to read. A typo in the path is the
+ * difference between "your entity types" and "the bundled default schema",
+ * which is exactly the kind of silent fallback `z.strictObject` exists to stop
+ * one level down.
+ */
+import { z } from "zod";
+import type { ChantConfig } from "@intentius/chant/config";
+/**
+ * Where `generate()` looks when `cedar.schema` is unset.
+ *
+ * Relative to the project root (the directory holding `chant.config.ts`).
+ */
+export declare const CEDAR_DEFAULT_SCHEMA_PATH = "schema.cedarschema";
+/**
+ * `strictObject`, not `object`. Core applies `.strict()` to the top level of a
+ * declared namespace itself; `validation` is nested, and is the lexicon's own
+ * to close.
+ */
+export declare const cedarConfigSchema: z.ZodObject<{
+    /**
+     * Path to the project's human-readable Cedar schema, relative to the project
+     * root. Defaults to {@link CEDAR_DEFAULT_SCHEMA_PATH}; when neither the
+     * configured path nor the default exists, generation falls back to the
+     * schema bundled at `src/spec/default-schema.cedarschema` so a fresh
+     * checkout still produces artifacts.
+     */
+    schema: z.ZodOptional<z.ZodString>;
+    /**
+     * Knobs for the `cedar-wasm` validator. `mode` is a single-variant enum on
+     * purpose: `ValidationMode` in cedar-wasm 4.12.0 accepts `"strict"` and
+     * nothing else, and passing anything further throws (#1648 §5.7).
+     */
+    validation: z.ZodOptional<z.ZodObject<{
+        /** Validator mode. Only `"strict"` exists in this build of cedar-wasm. */
+        mode: z.ZodOptional<z.ZodLiteral<"strict">>;
+        /**
+         * What to do with `validationWarnings` — the validator reports things
+         * like "policy is impossible" here, separately from errors.
+         */
+        warnings: z.ZodOptional<z.ZodEnum<{
+            error: "error";
+            ignore: "ignore";
+            warn: "warn";
+        }>>;
+        /**
+         * Refuse to build when no project schema is found rather than falling
+         * back to the bundled default. Off by default so `chant init` works;
+         * worth turning on once a project has its own schema, because
+         * `checkParseSchema("")` succeeds and an empty schema validates
+         * everything clean (#1648 §1).
+         */
+        requireProjectSchema: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CedarConfig = z.infer<typeof cedarConfigSchema>;
+declare module "@intentius/chant/config" {
+    interface ChantConfig {
+        cedar?: CedarConfig;
+    }
+}
+/**
+ * Compile-time proof that the augmentation above reaches `ChantConfig` (#1344).
+ *
+ * Without it this line is `Property 'cedar' does not exist on type
+ * 'ChantConfig'`. It lives here rather than in a test because the root tsconfig
+ * excludes test files, so a compile-time claim asserted in one is checked by
+ * nothing.
+ */
+export type CedarConfigNamespace = NonNullable<ChantConfig["cedar"]>;
+/**
+ * Read the `cedar` namespace out of the project's config.
+ *
+ * Searches upward from `startDir`, so `chant generate` finds the config from a
+ * subdirectory the same way `chant build` does. A project with no config, or
+ * one with no `cedar` key, gets `{}` — the schema resolution order in
+ * `spec/fetch.ts` handles that case without needing to know why.
+ *
+ * Core has already validated the namespace against {@link cedarConfigSchema}
+ * by the time this reads it, so the parse here is a type narrowing rather than
+ * a second gate; it stays because a caller can point this at a directory core
+ * never loaded.
+ */
+export declare function loadCedarConfig(startDir: string): Promise<CedarConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B;;;;;;OAMG;;IAGH;;;;OAIG;;QAGC,0EAA0E;;QAE1E;;;WAGG;;;;;;QAEH;;;;;;WAMG;;;kBAIP,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,KAAK,CAAC,EAAE,WAAW,CAAC;KACrB;CACF;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAY5E"}

package/dist/coverage.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Schema coverage for the cedar lexicon.
+ *
+ * Core's `computeCoverage` measures CloudFormation-shaped dimensions —
+ * property constraints, create-only/write-only lifecycle, return attributes —
+ * none of which a Cedar schema has. Reporting 0% across four axes that cannot
+ * apply would be worse than reporting nothing, so this asks the question that
+ * does mean something here: **is every entity type and every action in the
+ * schema reachable from the generated artifacts?**
+ *
+ * A gap is a real defect, not a nice-to-have. An action with no generated
+ * constant is an action a policy can only name as a hand-typed string, which
+ * is the exact failure mode the lexicon exists to remove.
+ */
+import { type ResolveSchemaOptions } from "./spec/fetch.js";
+export interface CedarCoverageItem {
+    /** Fully-qualified declaration name from the schema. */
+    name: string;
+    kind: "entity" | "action";
+    /** True when a registry entry names this declaration. */
+    covered: boolean;
+    /** True when the record type beside it (attributes / context) is present too. */
+    recordCovered: boolean;
+    /** Attributes the schema declares for it. */
+    attributes: number;
+}
+export interface CedarCoverageReport {
+    /** Where the schema came from. */
+    schemaPath: string;
+    /** True when the bundled default schema was used. */
+    isDefaultSchema: boolean;
+    entityTypes: number;
+    entityTypesCovered: number;
+    actions: number;
+    actionsCovered: number;
+    recordTypes: number;
+    recordTypesCovered: number;
+    entityPct: number;
+    actionPct: number;
+    recordPct: number;
+    overallPct: number;
+    items: CedarCoverageItem[];
+}
+export interface CedarCoverageOptions extends ResolveSchemaOptions {
+    /** Directory holding the generated artifacts. Defaults to `<package>/src/generated`. */
+    generatedDir?: string;
+    verbose?: boolean;
+    /** Fail when `overallPct` falls below this. */
+    minOverall?: number;
+}
+/** Compute schema coverage against the artifacts already on disk. */
+export declare function computeCedarCoverage(options?: CedarCoverageOptions): CedarCoverageReport;
+/** Human-readable summary. */
+export declare function formatCedarCoverage(report: CedarCoverageReport, verbose?: boolean): string;
+/**
+ * Print the report, and throw when it falls below `minOverall`.
+ */
+export declare function analyzeCedarCoverage(options?: CedarCoverageOptions): CedarCoverageReport;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../src/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAG3E,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,yDAAyD;IACzD,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAUD,qEAAqE;AACrE,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CAsD5F;AAED,8BAA8B;AAC9B,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,UAAQ,GAAG,MAAM,CAwBxF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,oBAAyB,GAAG,mBAAmB,CAS5F"}

package/dist/detect.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Edge-safe template detection for cedar (#426, #1653).
+ *
+ * Two documents belong to this lexicon: the JSON policy-set envelope the
+ * serializer writes, and `.cedar` policy text. The first is recognized by its
+ * shape and then confirmed by `checkParsePolicySet`; the second only by asking
+ * the module to split it.
+ *
+ * The shape test is strict on purpose. `chant import` walks every loaded
+ * plugin's `detectTemplate` in turn, so a lexicon that answers `true` for
+ * someone else's JSON steals the file. `staticPolicies`/`templates`/
+ * `templateLinks` and nothing else is a document no other lexicon writes, and
+ * a policy set with no policies in it is not claimed at all — `{}` parses
+ * perfectly well as an empty Cedar policy set, and matching it would swallow
+ * every empty JSON object in the repo.
+ */
+export declare function detectTemplate(data: unknown): boolean;
+//# sourceMappingURL=detect.d.ts.map

package/dist/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../src/detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAuBH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAoBrD"}

package/dist/generated/index.d.ts

@@ -0,0 +1,251 @@
+import type { Declarable } from "@intentius/chant/declarable";
+/**
+ * Entity UID of `App::Application`.
+ */
+export type ApplicationUid = `App::Application::"${string}"`;
+export interface ApplicationAttributesProps {
+    name: string;
+    owner: TeamUid;
+}
+/**
+ * Entity UID of `App::Document`.
+ * Member of: App::Folder.
+ */
+export type DocumentUid = `App::Document::"${string}"`;
+export interface DocumentAttributesProps {
+    classification: string;
+    folder: FolderUid;
+    owner: UserUid;
+    public: boolean;
+    tags: string[];
+    title: string;
+}
+/**
+ * Entity UID of `App::Folder`.
+ */
+export type FolderUid = `App::Folder::"${string}"`;
+export interface FolderAttributesProps {
+    name: string;
+    owner: UserUid;
+    tags: string[];
+}
+/**
+ * Entity UID of `App::Group`.
+ */
+export type GroupUid = `App::Group::"${string}"`;
+export interface GroupAttributesProps {
+    description?: string;
+    name: string;
+}
+/**
+ * Entity UID of `App::ServiceAccount`.
+ * Member of: App::Group.
+ */
+export type ServiceAccountUid = `App::ServiceAccount::"${string}"`;
+export interface ServiceAccountAttributesProps {
+    name: string;
+    owner: UserUid;
+    rotatedAt?: string;
+}
+/**
+ * Entity UID of `App::Team`.
+ * Member of: App::Group.
+ */
+export type TeamUid = `App::Team::"${string}"`;
+export interface TeamAttributesProps {
+    costCenter?: string;
+    name: string;
+}
+/**
+ * Entity UID of `App::User`.
+ * Member of: App::Group, App::Team.
+ */
+export type UserUid = `App::User::"${string}"`;
+export interface UserAttributesProps {
+    department: string;
+    email: string;
+    level: number;
+    manager?: UserUid;
+    mfaEnabled: boolean;
+    roles: string[];
+}
+export interface AdminContextProps {
+    breakGlass?: boolean;
+    mfa: boolean;
+}
+export interface ApproveContextProps {
+    mfa: boolean;
+}
+export interface CommentContextProps {
+    mfa: boolean;
+    reason?: string;
+}
+export interface CreateContextProps {
+    mfa: boolean;
+    reason?: string;
+}
+export interface DeleteContextProps {
+    approvedBy?: UserUid;
+    mfa: boolean;
+}
+export interface ListContextProps {
+    mfa: boolean;
+    sourceIp?: string;
+}
+export interface ReadContextProps {
+    mfa: boolean;
+    sourceIp?: string;
+}
+export interface ShareContextProps {
+    approvedBy?: UserUid;
+    mfa: boolean;
+}
+export interface WriteContextProps {
+    mfa: boolean;
+    reason?: string;
+}
+/** Every entity type name the schema declares, as Cedar writes it. */
+export type EntityTypeName = "App::Application" | "App::Document" | "App::Folder" | "App::Group" | "App::ServiceAccount" | "App::Team" | "App::User";
+/** Every entity UID the schema can produce. */
+export type EntityUid = ApplicationUid | DocumentUid | FolderUid | GroupUid | ServiceAccountUid | TeamUid | UserUid;
+/** Every action UID the schema declares. */
+export type ActionUid = "App::Action::\"admin\"" | "App::Action::\"approve\"" | "App::Action::\"comment\"" | "App::Action::\"create\"" | "App::Action::\"delete\"" | "App::Action::\"list\"" | "App::Action::\"read\"" | "App::Action::\"share\"" | "App::Action::\"write\"";
+/** Anything a policy scope may name. */
+export type PolicyRef = EntityUid | ActionUid;
+/** A Cedar policy either permits or forbids; there is no third effect. */
+export type PolicyEffect = "permit" | "forbid";
+/**
+ * One scope position (`principal`, `action`, `resource`).
+ *
+ * `{}` is the unconstrained form Cedar writes as a bare variable. The
+ * constrained forms mirror the grammar: `== E`, `in E`, `in [E, …]`,
+ * `is T`, and `is T in E`.
+ */
+export type PolicyScope = Record<string, never> | {
+    eq: PolicyRef;
+    in?: never;
+    is?: never;
+} | {
+    in: PolicyRef | PolicyRef[];
+    eq?: never;
+    is?: never;
+} | {
+    is: EntityTypeName;
+    in?: PolicyRef | PolicyRef[];
+    eq?: never;
+};
+/**
+ * The props of a `Cedar::Policy`.
+ *
+ * `when`/`unless` carry Cedar expression text. They stay strings because
+ * Cedar's expression grammar is the policy language itself — typing it in
+ * TypeScript is import/reconcile's problem (epic #1645 sub-issue 6), not
+ * codegen's.
+ */
+export interface PolicyProps {
+    /** Defaults to `permit` when omitted. */
+    effect?: PolicyEffect;
+    principal?: PolicyScope;
+    action?: PolicyScope;
+    resource?: PolicyScope;
+    /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+    when?: string[];
+    /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+    unless?: string[];
+    /** Emitted as `@key("value")`; an explicit `id` wins over the logical name. */
+    annotations?: Record<string, string>;
+}
+/**
+ * The policy resource. Declare one per policy:
+ *
+ * ```ts
+ * export const allowOwnerRead = new Policy({
+ *   principal: { is: "App::User" },
+ *   action: { eq: ReadAction },
+ *   when: ['resource.owner == principal'],
+ * });
+ * ```
+ */
+export declare const Policy: new (props: PolicyProps) => Declarable;
+export declare const Application: new (props: ApplicationAttributesProps) => Declarable;
+export declare const ApplicationAttributes: new (props: ApplicationAttributesProps) => Declarable;
+export declare const Document: new (props: DocumentAttributesProps) => Declarable;
+export declare const DocumentAttributes: new (props: DocumentAttributesProps) => Declarable;
+export declare const Folder: new (props: FolderAttributesProps) => Declarable;
+export declare const FolderAttributes: new (props: FolderAttributesProps) => Declarable;
+export declare const Group: new (props: GroupAttributesProps) => Declarable;
+export declare const GroupAttributes: new (props: GroupAttributesProps) => Declarable;
+export declare const ServiceAccount: new (props: ServiceAccountAttributesProps) => Declarable;
+export declare const ServiceAccountAttributes: new (props: ServiceAccountAttributesProps) => Declarable;
+export declare const Team: new (props: TeamAttributesProps) => Declarable;
+export declare const TeamAttributes: new (props: TeamAttributesProps) => Declarable;
+export declare const User: new (props: UserAttributesProps) => Declarable;
+export declare const UserAttributes: new (props: UserAttributesProps) => Declarable;
+/**
+ * `App::Action::"admin"`.
+ * Principals: App::User.
+ * Resources: App::Application.
+ */
+export declare const AdminAction: "App::Action::\"admin\"";
+export declare const AdminContext: new (props: AdminContextProps) => Declarable;
+/**
+ * `App::Action::"approve"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export declare const ApproveAction: "App::Action::\"approve\"";
+export declare const ApproveContext: new (props: ApproveContextProps) => Declarable;
+/**
+ * `App::Action::"comment"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export declare const CommentAction: "App::Action::\"comment\"";
+export declare const CommentContext: new (props: CommentContextProps) => Declarable;
+/**
+ * `App::Action::"create"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export declare const CreateAction: "App::Action::\"create\"";
+export declare const CreateContext: new (props: CreateContextProps) => Declarable;
+/**
+ * `App::Action::"delete"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export declare const DeleteAction: "App::Action::\"delete\"";
+export declare const DeleteContext: new (props: DeleteContextProps) => Declarable;
+/**
+ * `App::Action::"list"`.
+ * Principals: App::ServiceAccount, App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export declare const ListAction: "App::Action::\"list\"";
+export declare const ListContext: new (props: ListContextProps) => Declarable;
+/**
+ * `App::Action::"read"`.
+ * Principals: App::ServiceAccount, App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export declare const ReadAction: "App::Action::\"read\"";
+export declare const ReadContext: new (props: ReadContextProps) => Declarable;
+/**
+ * `App::Action::"share"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export declare const ShareAction: "App::Action::\"share\"";
+export declare const ShareContext: new (props: ShareContextProps) => Declarable;
+/**
+ * `App::Action::"write"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export declare const WriteAction: "App::Action::\"write\"";
+export declare const WriteContext: new (props: WriteContextProps) => Declarable;
+/** Every generated action constant, for exhaustive iteration. */
+export declare const ALL_ACTIONS: readonly ActionUid[];
+/** Every entity type name the schema declares. */
+export declare const ALL_ENTITY_TYPES: readonly EntityTypeName[];
+//# sourceMappingURL=index.d.ts.map

package/dist/generated/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generated/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,sBAAsB,MAAM,GAAG,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,mBAAmB,MAAM,GAAG,CAAC;AAEvD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,MAAM,GAAG,CAAC;AAEnD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,gBAAgB,MAAM,GAAG,CAAC;AAEjD,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,yBAAyB,MAAM,GAAG,CAAC;AAEnE,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,eAAe,MAAM,GAAG,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,eAAe,MAAM,GAAG,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,OAAO,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sEAAsE;AACtE,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,eAAe,GAAG,aAAa,GAAG,YAAY,GAAG,qBAAqB,GAAG,WAAW,GAAG,WAAW,CAAC;AAErJ,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEpH,4CAA4C;AAC5C,MAAM,MAAM,SAAS,GAAG,wBAAwB,GAAG,0BAA0B,GAAG,0BAA0B,GAAG,yBAAyB,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,wBAAwB,GAAG,wBAAwB,CAAC;AAE7Q,wCAAwC;AACxC,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9C,0EAA0E;AAC1E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GACnB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,GACvD;IAAE,EAAE,EAAE,cAAc,CAAC;IAAC,EAAE,CAAC,EAAE,SAAS,GAAG,SAAS,EAAE,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,WAAW,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,EAA8D,KAAK,KAAK,EAAE,WAAW,KAAK,UAAU,CAAC;AAExH,eAAO,MAAM,WAAW,EAAiE,KAAK,KAAK,EAAE,0BAA0B,KAAK,UAAU,CAAC;AAC/I,eAAO,MAAM,qBAAqB,EAAwE,KAAK,KAAK,EAAE,0BAA0B,KAAK,UAAU,CAAC;AAChK,eAAO,MAAM,QAAQ,EAA8D,KAAK,KAAK,EAAE,uBAAuB,KAAK,UAAU,CAAC;AACtI,eAAO,MAAM,kBAAkB,EAAqE,KAAK,KAAK,EAAE,uBAAuB,KAAK,UAAU,CAAC;AACvJ,eAAO,MAAM,MAAM,EAA4D,KAAK,KAAK,EAAE,qBAAqB,KAAK,UAAU,CAAC;AAChI,eAAO,MAAM,gBAAgB,EAAmE,KAAK,KAAK,EAAE,qBAAqB,KAAK,UAAU,CAAC;AACjJ,eAAO,MAAM,KAAK,EAA2D,KAAK,KAAK,EAAE,oBAAoB,KAAK,UAAU,CAAC;AAC7H,eAAO,MAAM,eAAe,EAAkE,KAAK,KAAK,EAAE,oBAAoB,KAAK,UAAU,CAAC;AAC9I,eAAO,MAAM,cAAc,EAAoE,KAAK,KAAK,EAAE,6BAA6B,KAAK,UAAU,CAAC;AACxJ,eAAO,MAAM,wBAAwB,EAA2E,KAAK,KAAK,EAAE,6BAA6B,KAAK,UAAU,CAAC;AACzK,eAAO,MAAM,IAAI,EAA0D,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AAC1H,eAAO,MAAM,cAAc,EAAiE,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AAC3I,eAAO,MAAM,IAAI,EAA0D,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AAC1H,eAAO,MAAM,cAAc,EAAiE,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AAE3I;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAC;AAC7D,eAAO,MAAM,YAAY,EAA2E,KAAK,KAAK,EAAE,iBAAiB,KAAK,UAAU,CAAC;AACjJ;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAG,0BAAmC,CAAC;AACjE,eAAO,MAAM,cAAc,EAA6E,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AACvJ;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAG,0BAAmC,CAAC;AACjE,eAAO,MAAM,cAAc,EAA6E,KAAK,KAAK,EAAE,mBAAmB,KAAK,UAAU,CAAC;AACvJ;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAG,yBAAkC,CAAC;AAC/D,eAAO,MAAM,aAAa,EAA4E,KAAK,KAAK,EAAE,kBAAkB,KAAK,UAAU,CAAC;AACpJ;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAG,yBAAkC,CAAC;AAC/D,eAAO,MAAM,aAAa,EAA4E,KAAK,KAAK,EAAE,kBAAkB,KAAK,UAAU,CAAC;AACpJ;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAG,uBAAgC,CAAC;AAC3D,eAAO,MAAM,WAAW,EAA0E,KAAK,KAAK,EAAE,gBAAgB,KAAK,UAAU,CAAC;AAC9I;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAG,uBAAgC,CAAC;AAC3D,eAAO,MAAM,WAAW,EAA0E,KAAK,KAAK,EAAE,gBAAgB,KAAK,UAAU,CAAC;AAC9I;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAC;AAC7D,eAAO,MAAM,YAAY,EAA2E,KAAK,KAAK,EAAE,iBAAiB,KAAK,UAAU,CAAC;AACjJ;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAC;AAC7D,eAAO,MAAM,YAAY,EAA2E,KAAK,KAAK,EAAE,iBAAiB,KAAK,UAAU,CAAC;AAEjJ,iEAAiE;AACjE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAA8H,CAAC;AAE3K,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAwH,CAAC"}

package/dist/generated/runtime.d.ts

@@ -0,0 +1,2 @@
+export { createProperty, createResource } from "@intentius/chant/runtime";
+//# sourceMappingURL=runtime.d.ts.map

package/dist/generated/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/generated/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/import/adapter.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The seam between the cedar-shaped parser/generator above and the core
+ * `TemplateParser` / `TypeScriptGenerator` that `chant import` drives.
+ *
+ * Core's pipeline speaks `TemplateIR` — a flat list of `ResourceIR` with a
+ * `type` string it may reorganize into category files. A Cedar policy maps
+ * cleanly onto one: the logical id is the policy id, and the type records
+ * whether Cedar read it as a static policy or as a template, so the mapping
+ * reverses without guessing.
+ */
+import type { TemplateIR, TemplateParser } from "@intentius/chant/import/parser";
+import type { GeneratedFile, TypeScriptGenerator } from "@intentius/chant/import/generator";
+/** `TemplateParser` over `.cedar` text and the JSON policy-set envelope. */
+export declare class CedarTemplateParser implements TemplateParser {
+    parse(content: string): TemplateIR;
+}
+/** `TypeScriptGenerator` emitting `new Policy({ … })` per imported policy. */
+export declare class CedarTemplateGenerator implements TypeScriptGenerator {
+    generate(ir: TemplateIR): GeneratedFile[];
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/import/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/import/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAc,MAAM,gCAAgC,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AA+B5F,4EAA4E;AAC5E,qBAAa,mBAAoB,YAAW,cAAc;IACxD,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;CAQnC;AAED,8EAA8E;AAC9E,qBAAa,sBAAuB,YAAW,mBAAmB;IAChE,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE;CAK1C"}

package/dist/import/clause-text.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Recover the `when`/`unless` bodies of a policy exactly as they were written.
+ *
+ * The round-trip this lexicon promises is byte-identical `.cedar` output, and
+ * the JSON leg cannot deliver it: an expression that goes to `PolicyJson` and
+ * back comes out defensively parenthesized — `resource.owner == principal`
+ * returns as `(resource.owner) == principal` — and `formatPolicies` does not
+ * undo that. The tree is semantically lossless; the text is not preserved.
+ *
+ * So when there *is* source text, the condition bodies are lifted out of it
+ * verbatim, and the module still decides what they mean: every body this file
+ * hands back is re-parsed and compared against the tree `policyToJson` produced
+ * for the same clause before the importer trusts it (see `parser.ts`). A
+ * mismatch falls back to the rendered form.
+ *
+ * What is here is a *delimiter scanner*, not a Cedar parser. It knows three
+ * things — that a `"` starts a string with backslash escapes, that `//` runs
+ * to end of line, and that `@`, `(` and `{` have partners — and it knows the
+ * two clause keywords. It has no opinion about expressions, which remains the
+ * module's job. Anything it does not recognize returns `null`, and the caller
+ * uses the rendered bodies instead.
+ */
+/** One `when`/`unless` clause, with its body as the author typed it. */
+export interface SourceClause {
+    kind: "when" | "unless";
+    /** The text between the braces, trimmed. */
+    body: string;
+}
+/**
+ * Split one policy's source into its clause bodies.
+ *
+ * Returns `null` for anything that does not walk cleanly — an unbalanced
+ * brace, a keyword that is neither `when` nor `unless`, trailing text after
+ * the terminating `;`. `null` is not a diagnosis, only a decision to use the
+ * module's rendering instead.
+ */
+export declare function extractClauses(policyText: string): SourceClause[] | null;
+//# sourceMappingURL=clause-text.d.ts.map

package/dist/import/clause-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clause-text.d.ts","sourceRoot":"","sources":["../../src/import/clause-text.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd;AAqGD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE,GAAG,IAAI,CAwCxE"}

package/dist/import/generator.d.ts

@@ -0,0 +1,53 @@
+/**
+ * TypeScript generator for `chant import`.
+ *
+ * Turns the parser's IR back into the authoring source it came from: one
+ * `import` line, then an `export const … = new Policy({ … })` per policy.
+ *
+ * `Policy` is the schema-driven class `chant generate` emits, and the scope
+ * refs it accepts are string-literal unions — so `action: { eq: 'App::Action::"read"' }`
+ * is already checked against the schema by the compiler, and an action the
+ * schema never declared is an error at the import site. Where the generated
+ * registry is on hand, an action UID is emitted as the generated *constant*
+ * (`ReadAction`) instead, which reads better and survives a rename; without a
+ * registry the literal is the fallback, and it typechecks just the same.
+ */
+import type { CedarPolicyIR } from "./parser.js";
+/** The package this generated source imports from. */
+export declare const CEDAR_PACKAGE = "@intentius/chant-lexicon-cedar";
+export interface CedarGenerateOptions {
+    /**
+     * `App::Action::"read"` → `ReadAction`, from the generated registry.
+     *
+     * Empty by default: the generator is a pure function of its IR, and the
+     * adapter is what goes looking for a registry to fill this in.
+     */
+    actionConstants?: Record<string, string>;
+}
+export interface CedarGenerateResult {
+    source: string;
+    warnings: string[];
+}
+/**
+ * A Cedar policy id as a JavaScript identifier.
+ *
+ * `allow-alice-read` → `allowAliceRead`, `legacy_policy` → `legacyPolicy`,
+ * `SOC2-AC-3` → `soc2AC3`. A leading segment that is already mixed case keeps
+ * its shape apart from the first letter; one that is all caps is lowered whole,
+ * so an id like `SOC2` does not come back as `sOC2`.
+ */
+export declare function sanitizeName(id: string): string;
+export declare class CedarGenerator {
+    private readonly actionConstants;
+    constructor(options?: CedarGenerateOptions);
+    generate(entities: CedarPolicyIR[]): CedarGenerateResult;
+}
+/**
+ * Read `App::Action::"read"` → `ReadAction` out of the generated registry.
+ *
+ * Best-effort by design: a project that has not run `chant generate` has no
+ * registry, and the generator falls back to emitting UID literals — which the
+ * `Policy` class accepts and the compiler still checks.
+ */
+export declare function loadActionConstants(packageDir?: string): Record<string, string>;
+//# sourceMappingURL=generator.d.ts.map

package/dist/import/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/import/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,aAAa,mCAAmC,CAAC;AAK9D,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAgBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAY/C;AA0ED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;gBAE7C,OAAO,GAAE,oBAAyB;IAI9C,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,mBAAmB;CAyBzD;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB/E"}