@intentius/chant-lexicon-cedar 0.44.8

package/dist/import/parser.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Cedar policy parser for `chant import`.
+ *
+ * Two surfaces come in and one IR goes out:
+ *
+ * - **`.cedar` policy text** — split by `policySetTextToParts`, then each
+ *   policy handed to `policyToJson` (or `templateToJson`, for one carrying a
+ *   slot). The Cedar grammar is never touched here; the module owns it.
+ * - **the JSON policy-set envelope** the serializer writes beside the text —
+ *   `{ staticPolicies, templates, templateLinks }`, whose values are already
+ *   in Cedar's JSON policy format.
+ *
+ * The IR is lossless with respect to the authoring model: effect, all three
+ * scopes, every `when`/`unless` clause in order, and every annotation. What is
+ * *not* in the model is not invented — Cedar comments are dropped by the
+ * module before this file sees them, and template links have no authoring
+ * shape yet, so they are reported as a warning rather than silently discarded.
+ *
+ * Unconstrained scopes are the one thing left out of `props`, because `{}` and
+ * absent are the same value to the serializer (`principal` with no constraint).
+ * Writing `principal: {}` into every imported policy would be noise, not
+ * fidelity.
+ */
+/**
+ * Whether Cedar read this as a static policy or as a template.
+ *
+ * The discriminant is not chant's: a policy is a template exactly when it
+ * carries a `?principal`/`?resource` slot, and `policyToJson` refuses one.
+ */
+export type CedarEntityKind = "policy" | "template";
+/** One imported Cedar policy, in the lossless intermediate shape. */
+export interface CedarPolicyIR {
+    kind: CedarEntityKind;
+    /** The Cedar policy id — its `@id`, or the envelope key it was filed under. */
+    name: string;
+    /** The `Cedar::Policy` props, ready to hand to the authoring class. */
+    props: Record<string, unknown>;
+}
+export interface CedarParseResult {
+    entities: CedarPolicyIR[];
+    warnings: string[];
+}
+/**
+ * Is this the JSON policy-set envelope?
+ *
+ * Deliberately strict about foreign keys: a CloudFormation template or a
+ * Kubernetes manifest must not walk in through a permissive shape test, and
+ * `detect.ts` leans on the same rule.
+ */
+export declare function isPolicySetEnvelope(data: unknown): data is Record<string, unknown>;
+export declare class CedarParser {
+    parse(content: string): CedarParseResult;
+    private parseText;
+    private parseEnvelope;
+    private toIR;
+}
+//# sourceMappingURL=parser.d.ts.map

package/dist/import/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/import/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAcH;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEpD,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,eAAe,CAAC;IACtB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAuKD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMlF;AAWD,qBAAa,WAAW;IACtB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB;IAWxC,OAAO,CAAC,SAAS;IA+BjB,OAAO,CAAC,aAAa;IAyCrB,OAAO,CAAC,IAAI;CAYb"}

package/dist/index.d.ts

@@ -0,0 +1,34 @@
+export { cedarPlugin } from "./plugin.js";
+export { cedarSerializer, policyIdFromLogicalName, resolvePolicyId, cedarPolicyRecords } from "./serializer.js";
+export { CEDAR_POLICY_TYPE, CEDAR_JSON_FILENAME } from "./serializer.js";
+export type { CedarEffect, CedarScope, CedarPolicyProps, CedarPolicyRecord } from "./serializer.js";
+export { avpStatement, avpStatementJSON, avpPolicyDefinition, avpPolicyResource, avpPolicySet, } from "./avp/embed.js";
+export type { AvpEmbedOptions, AvpPolicyDefinition, AvpPolicyResource, AvpStaticDefinition, } from "./avp/embed.js";
+export { AVP_OWNERSHIP_KEYS, AVP_POLICY_ID_KEY, AVP_DESCRIPTION_MAX, encodeOwnershipDescription, decodeOwnershipDescription, ownershipFromDescription, ownershipFromStoreTags, descriptionIsOwned, storeOwnershipTags, } from "./avp/ownership.js";
+export type { DecodedDescription } from "./avp/ownership.js";
+export { describeAvpResources } from "./avp/describe-resources.js";
+export { observeAvpAmbient, AVP_AMBIENT_KINDS } from "./avp/ambient.js";
+export { exportAvpResources, policyToResourceIR } from "./avp/live-export.js";
+export { resolvePolicyStoreId, AVP_POLICY_STORE_ENV } from "./avp/store.js";
+export { policySetJSON, escapeCedarString } from "./serializer.js";
+export type { CedarPolicySetJSON } from "./serializer.js";
+export { CedarParser, isPolicySetEnvelope } from "./import/parser.js";
+export type { CedarParseResult, CedarPolicyIR, CedarEntityKind } from "./import/parser.js";
+export { CedarGenerator, loadActionConstants, sanitizeName, CEDAR_PACKAGE } from "./import/generator.js";
+export type { CedarGenerateOptions, CedarGenerateResult } from "./import/generator.js";
+export { CedarTemplateParser, CedarTemplateGenerator } from "./import/adapter.js";
+export { detectTemplate } from "./detect.js";
+export { rules as cedarLintRules } from "./lint/rules/index.js";
+export { packageLexicon } from "./codegen/package.js";
+export type { PackageOptions, PackageResult } from "./codegen/package.js";
+export { cedarConfigSchema, loadCedarConfig, CEDAR_DEFAULT_SCHEMA_PATH } from "./config.js";
+export type { CedarConfig } from "./config.js";
+export { CEDAR_WASM_VERSION, CEDAR_LANG_VERSION } from "./spec/pin.js";
+export { computeCedarCoverage, formatCedarCoverage, analyzeCedarCoverage } from "./coverage.js";
+export type { CedarCoverageReport, CedarCoverageItem } from "./coverage.js";
+export { computePolicyCoverage, formatPolicyCoverage } from "./mcp/policy-coverage.js";
+export type { CedarPolicyCoverageReport, CedarPolicyCoverageItem, CedarPolicyCoverageOptions, } from "./mcp/policy-coverage.js";
+export * from "./composites/index.js";
+export { cedarInitTemplates, CEDAR_INIT_TEMPLATES } from "./init-templates.js";
+export * from "./generated/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIjG,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtG,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAG1C,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIvE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACzF,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIpE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC7F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIzE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACpF,YAAY,EACV,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAG5E,cAAc,mBAAmB,CAAC"}

package/dist/init-templates.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `chant init --lexicon cedar --template <name>` scaffolds.
+ *
+ * Every template ships a `schema.cedarschema` at the project root. That is not
+ * decoration: cedar's codegen input is the project's own schema (epic #1645),
+ * and a scaffold without one generates against the bundled default — a project
+ * whose typed classes describe somebody else's entity model.
+ *
+ * The filename is fixed rather than configured because `schema.cedarschema` in
+ * the project root is step 2 of the resolution order in `spec/fetch.ts`, so a
+ * scaffolded project needs no `cedar.schema` key at all. It also has to be
+ * fixed: core writes `chant.config.ts` before a plugin's root files and
+ * `writeIfNotExists` keeps the first one, so a template that shipped its own
+ * config would be silently discarded. The README each template ships is where
+ * `requireProjectSchema` gets recommended, which is the honest place for advice
+ * a scaffold cannot enforce.
+ *
+ * The policy files use `entityType`-string scopes (`{ is: "App::Document" }`)
+ * and generated action constants, so a scaffolded project compiles the moment
+ * `chant generate` has run against its own schema.
+ */
+import type { InitTemplateSet } from "@intentius/chant/lexicon";
+/**
+ * Scaffolds for `chant init`.
+ *
+ * An unrecognized name falls through to the default rather than throwing —
+ * the same behaviour every other lexicon's `initTemplates` has.
+ */
+export declare function cedarInitTemplates(template?: string): InitTemplateSet;
+/** Every template name this lexicon scaffolds, for docs and tests. */
+export declare const CEDAR_INIT_TEMPLATES: readonly ["default", "avp-embedding", "gateway-policy-set"];
+//# sourceMappingURL=init-templates.d.ts.map

package/dist/init-templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../src/init-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA8QhE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAwDrE;AAED,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,6DAA8D,CAAC"}

package/dist/integrity.json

@@ -0,0 +1,22 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "a3b6314f19c537ad8c8bcc2953e4a944540fb2cbf364b7bacb00e9725a2363f0",
+    "meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
+    "types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
+    "rules/policy-shape.ts": "1654730d188b7163dbad3051c75a562198a96eda6d36ce35701f2b729bf45194",
+    "rules/cedar-helpers.ts": "5a6e414c4726686d1220e532ed0e384c6b57ee07f8774e40f4eac62fdc2202e6",
+    "rules/cedc010.ts": "471f25026ff52682b09fb73818874dbe5ade58ab33bf55855d23745c2d4a9f06",
+    "rules/cedc011.ts": "ea3d6ba2987348caf9585e07a95a096b0b28df8b0000a281a2abcc5a639f821e",
+    "rules/cedc012.ts": "0b69e938c9d7a5f4605e9985e9c7dace35718d9280c1bce63edfec87a8e77c21",
+    "rules/cedc013.ts": "cc91a3036aefb467827d35c61119d6d48377169a2ca08e4dd6decd088371a294",
+    "rules/cedc014.ts": "6d35587d13e3c686c8447bf3b069a60b2ee1700a8d48a3de75e36e49701c115f",
+    "rules/cede010.ts": "17311a6bcb44187d57f7c3363d1b3a9a055378b8d7963d785b7b713f7ef9a078",
+    "rules/cede011.ts": "4ada79ed88ce09a66ff08abd5bc236691014a2d5954afdb6e0f19364e8ed3931",
+    "rules/ceds010.ts": "215e14de2b84d935ad9551d37c3c06374e5452a5b3f1d7408dc59cd8c2ef1b33",
+    "rules/ceds011.ts": "07984e364b431203a34b42de481fad4fc16d2b838f3fa358726759f4a3ebbfe5",
+    "rules/ceds012.ts": "a447c6114d36abf2eca6f90143b06c4b20ede111c777cb04c70024fc4ad93172",
+    "rules/wasm-helpers.ts": "c4c3def1669a1818d19ff1864e78bdcbf956da31ca1a6adde7751830765dad6a"
+  },
+  "composite": "050414f43e9bfd30e46d4249e5493401c0dcbb7de270eb28980dbf7ec83ea9b7"
+}

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The cedar lexicon's `chant audit` catalog — metadata for every CED check,
+ * contributed via `cedarPlugin.auditCatalog()` (#687, #1346).
+ *
+ * A check's own definition says what it looks for. It does not say how severe
+ * the finding is, whether the fix is mechanical, what backs the rule, or what
+ * to title it in a report. `resolveAuditCatalog` merges this map over core's
+ * static catalog to answer all four — and it skips a lexicon that omits the
+ * method *silently*, which is how fly's and temporal's checks reached the
+ * report with no metadata at all. A repo-level test fails on a gap in either
+ * direction, so this map and the shipped checks move together.
+ *
+ * Every entry here is `yamlBased: true`: each check reads `ctx.outputs` — the
+ * emitted policy set — and nothing reads `ctx.entities`, so all of them fire
+ * on an audit of a standalone `policies.cedar.json` exactly as they do on a
+ * `chant build`. `auditRule()` hardcodes that, so it is used throughout rather
+ * than constructing `RuleMeta` by hand the way fly and fountain must.
+ *
+ * `authority` is left off deliberately. The catalog test treats a citation as
+ * proof that a finding is `security`, and Cedar's own docs are a language
+ * reference rather than a benchmark like CIS or OSSF Scorecard; citing them
+ * would be dressing up chant's own opinion. The one place a citation would be
+ * honest — the bare-permit wall — is chant's convention, not upstream's, and
+ * the verification report is explicit that Cedar's validator says nothing
+ * about it.
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const cedarAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1E,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAoGtD,CAAC"}

package/dist/lint/post-synth/cedar-helpers.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Shared reading helpers for the cedar post-synth checks.
+ *
+ * Every check in this directory judges the same artifact: the JSON policy-set
+ * envelope the serializer writes beside the `.cedar` text
+ * (`policies.cedar.json` — see `../../serializer.ts`). The text and the JSON
+ * are rendered from one in-memory model, so a finding against the JSON is a
+ * finding against both; the JSON is the one with structure worth walking.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter
+ * (`listRuleFiles` in core's `lint/discover.ts`).
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+/** Files carrying a Cedar JSON policy set end with this. */
+export declare const CEDAR_JSON_SUFFIX = ".cedar.json";
+/** The lexicon name stamped on every diagnostic from this directory. */
+export declare const CEDAR_LEXICON = "cedar";
+/** One scope position of a policy in Cedar's JSON policy format. */
+export interface CedarScopeJson {
+    op?: unknown;
+    entity?: unknown;
+    entities?: unknown;
+    entity_type?: unknown;
+    in?: unknown;
+}
+/** One `when`/`unless` clause. */
+export interface CedarConditionJson {
+    kind?: unknown;
+    body?: unknown;
+}
+/** A single policy in Cedar's JSON policy format. */
+export interface CedarPolicyJson {
+    effect?: unknown;
+    principal?: unknown;
+    action?: unknown;
+    resource?: unknown;
+    conditions?: unknown;
+    annotations?: unknown;
+}
+/** The policy-set envelope: what `policies.cedar.json` holds. */
+export interface CedarPolicySetDoc {
+    staticPolicies?: unknown;
+    templates?: unknown;
+    templateLinks?: unknown;
+}
+/** One `[key, policy]` pair out of a policy set, with its origin. */
+export interface CedarPolicyEntry {
+    /** The key under `staticPolicies` — the id Cedar will report diagnostics against. */
+    key: string;
+    policy: CedarPolicyJson;
+    /** True when the entry came from `templates` rather than `staticPolicies`. */
+    template: boolean;
+}
+/** A policy set found in the build output, with everything needed to name it. */
+export interface CedarPolicySet {
+    /** The lexicon output it came from. */
+    lexicon: string;
+    /** A human-readable origin: the filename, or the lexicon name for a bare string output. */
+    source: string;
+    /** The raw JSON text, for handing straight to the wasm. */
+    raw: string;
+    /** Parsed envelope, or undefined when `raw` is not JSON at all. */
+    doc?: CedarPolicySetDoc;
+    /** The JSON parse error, when there is one. */
+    parseError?: string;
+    /** Static policies and templates, flattened in document order. */
+    entries: CedarPolicyEntry[];
+}
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** `permit` / `forbid` / whatever else the document claims. */
+export declare function effectOf(policy: CedarPolicyJson): string | undefined;
+/** The three scope positions, in Cedar's own order. */
+export declare function scopesOf(policy: CedarPolicyJson): Array<{
+    variable: string;
+    scope: CedarScopeJson;
+}>;
+/** True when a scope position is Cedar's unconstrained "any" (`op: "All"`). */
+export declare function scopeIsAll(scope: unknown): boolean;
+/** Every `when`/`unless` clause, or `[]` when the policy is unconditioned. */
+export declare function conditionsOf(policy: CedarPolicyJson): CedarConditionJson[];
+/** The policy's annotation map, narrowed to the string-valued entries Cedar allows. */
+export declare function annotationsOf(policy: CedarPolicyJson): Record<string, unknown>;
+/** The `@id` annotation, when it is a string. */
+export declare function annotatedId(policy: CedarPolicyJson): string | undefined;
+/**
+ * Whether a build's `env` (from `--env` or the project's `ownership.env`, see
+ * `PostSynthContext#env`) is production-like, for the checks whose severity is
+ * env-gated. Same seam and same vocabulary as the aws lexicon's
+ * `isFullTierEnv`: an unset or unrecognized env is treated as non-production,
+ * so a project that never passes `--env` is never unexpectedly hard-failed.
+ */
+export declare function isProdLikeEnv(env: string | undefined): boolean;
+/** Every candidate policy-set document in the build, parsed or not. */
+export declare function policySets(ctx: PostSynthContext): CedarPolicySet[];
+/** The subset of {@link policySets} that parsed as JSON. */
+export declare function parsedPolicySets(ctx: PostSynthContext): CedarPolicySet[];
+//# sourceMappingURL=cedar-helpers.d.ts.map

package/dist/lint/post-synth/cedar-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedar-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,wEAAwE;AACxE,eAAO,MAAM,aAAa,UAAU,CAAC;AAQrC,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED,kCAAkC;AAClC,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qDAAqD;AACrD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,+CAA+C;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAID,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,+DAA+D;AAC/D,wBAAgB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,uDAAuD;AACvD,wBAAgB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,CAAC,CAOpG;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,kBAAkB,EAAE,CAG1E;AAED,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9D;AAID,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,cAAc,EAAE,CA0BlE;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAExE"}

package/dist/lint/post-synth/cedc010.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CEDC010: the emitted policy set must parse as Cedar
+ *
+ * The floor every other check stands on. `policies.cedar.json` is Cedar's own
+ * JSON policy format inside the `PolicySet` envelope the wasm accepts, which
+ * means Cedar's own deserializer is the authority on whether it is well formed
+ * — not a hand-written shape test. A set that does not parse cannot be loaded
+ * by any evaluator (AVP, cedar-agent, an embedded `cedar-wasm`), so this is an
+ * error everywhere, in every environment.
+ *
+ * Two failure modes reach here: the file is not JSON at all, and the JSON is
+ * not a Cedar policy set. Both are reported against the file, since neither
+ * has a single implicated policy.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cedc010: PostSynthCheck;
+//# sourceMappingURL=cedc010.d.ts.map

package/dist/lint/post-synth/cedc010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedc010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedc010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cA6DrB,CAAC"}

package/dist/lint/post-synth/cedc011.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CEDC011: every `when`/`unless` condition expression must parse
+ *
+ * A policy's guard is the part that does the work — `when { context.mfa }`,
+ * `unless { resource.public }` — and until schema-driven codegen (#1650) makes
+ * those typed trees, the authored model carries them as Cedar expression
+ * *source*. Source that does not parse turns into a policy no evaluator will
+ * load, and the failure surfaces a long way from the typo: the whole policy set
+ * is rejected, naming a byte offset in a generated file.
+ *
+ * So the clause is parsed on its own and reported on its own, with the
+ * expression text and Cedar's own message (which carries a "did you mean"
+ * suggestion often enough to be worth passing through).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cedc011: PostSynthCheck;
+//# sourceMappingURL=cedc011.d.ts.map

package/dist/lint/post-synth/cedc011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedc011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedc011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cA4BrB,CAAC"}

package/dist/lint/post-synth/cedc012.d.ts

@@ -0,0 +1,21 @@
+/**
+ * CEDC012: no two policies may claim the same id
+ *
+ * A Cedar policy id is the handle everything downstream uses: the validator
+ * reports against it, AVP's `CreatePolicy` stores it, a drift check diffs on
+ * it. chant derives one from the logical name (`allowAdminRead` →
+ * `allow-admin-read`) unless the author sets `annotations.id` explicitly, and
+ * two policies can land on the same string either way — a rename that
+ * kebab-cases to something already taken, or the same explicit `@id` pasted
+ * twice.
+ *
+ * The consequence is silent. The `.cedar` text gets two policies carrying
+ * `@id("same")`, while the JSON envelope is keyed by id and keeps only the last
+ * one — a policy that exists in the artifact a human reviews and not in the one
+ * a machine loads. Ids are collected from every policy set in the build, from
+ * both the envelope key and the `@id` annotation, so a collision is caught
+ * whichever of the two forms it takes.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cedc012: PostSynthCheck;
+//# sourceMappingURL=cedc012.d.ts.map

package/dist/lint/post-synth/cedc012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedc012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedc012.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAU9G,eAAO,MAAM,OAAO,EAAE,cAmCrB,CAAC"}

package/dist/lint/post-synth/cedc013.d.ts

@@ -0,0 +1,20 @@
+/**
+ * CEDC013: annotation hygiene on an emitted policy
+ *
+ * Annotations are Cedar's only metadata channel — no comments survive the JSON
+ * grammar, and `policyToText` drops them — so `@id`, `@doc`, and friends are
+ * the whole audit trail a policy carries into AVP or a review. Three things
+ * make that trail useless:
+ *
+ * - an `@id` annotation that disagrees with the key the policy is filed under,
+ *   so the text artifact and the JSON artifact name the same policy differently;
+ * - an annotation whose value is empty, which reads as documented and is not;
+ * - an annotation whose value is not a string, which Cedar's `Annotations`
+ *   (`Record<string, string>`) does not admit.
+ *
+ * A *missing* `@id` is not a finding: chant derives one from the logical name,
+ * which is the normal case and the one the serializer is built around.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cedc013: PostSynthCheck;
+//# sourceMappingURL=cedc013.d.ts.map

package/dist/lint/post-synth/cedc013.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedc013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedc013.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cA+CrB,CAAC"}

package/dist/lint/post-synth/cedc014.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CEDC014: a scope constraint's entity reference must be a real entity UID
+ *
+ * Cedar names an entity as `Namespace::Type::"id"` — a type path and a quoted
+ * id. chant's serializer splits an authored reference on that grammar, and a
+ * reference that does not match it degrades rather than fails: the whole string
+ * becomes the type and the id becomes empty. `principal: { eq: "alice" }`
+ * therefore emits `{"op":"==","entity":{"type":"alice","id":""}}` — a policy
+ * that parses, validates against a schema that happens to define no such type
+ * only as an "unrecognized entity type", and silently matches nothing at
+ * runtime if it ever does.
+ *
+ * An empty entity id is the fingerprint of that degradation, and there is no
+ * legitimate reason to author one, so it is flagged wherever it appears in a
+ * scope: `== E`, `in E`, `in [E, …]`, and the `in` of an `is T in E`.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cedc014: PostSynthCheck;
+//# sourceMappingURL=cedc014.d.ts.map

package/dist/lint/post-synth/cedc014.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedc014.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cedc014.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAiB9G,eAAO,MAAM,OAAO,EAAE,cAuCrB,CAAC"}

package/dist/lint/post-synth/cede010.d.ts

@@ -0,0 +1,34 @@
+/**
+ * CEDE010: every emitted policy set validates clean against its schema
+ *
+ * The epic's "native tool is the test" clause: not "the text is well formed"
+ * but "Cedar's own validator, run in-process against the project's schema, has
+ * nothing to say about it." This is what catches the second meta-policy wall —
+ * a policy naming an entity type or an action the schema does not define — and
+ * it catches it everywhere, in every environment, because such a policy can
+ * never grant anything.
+ *
+ * Two things about `validate()` decide how this is written, both measured
+ * against 4.12.0 (chant #1648):
+ *
+ * - `type: "success"` means validation *ran*, not that it passed. The findings
+ *   are in `validationErrors`, and a check written as `if (answer.type ===
+ *   "failure")` passes every type error in the corpus. `validatePolicySet`
+ *   asserts `success && validationErrors.length === 0`.
+ * - `validationErrors` comes back in a different order almost every call — the
+ *   validator parallelizes across policies and does not re-sort. Forty
+ *   identical calls produced six orderings. `validatePolicySet` sorts by
+ *   `policyId` then message, so this check's output is stable enough to assert
+ *   on.
+ *
+ * When the build emits no schema there is nothing to validate against, and
+ * `validate()` cannot be called at all — it has no optional-schema mode, and an
+ * empty schema is legal Cedar that reports every policy as inapplicable, which
+ * would be worse than useless. Schema-driven codegen is #1650; until a schema
+ * is emitted beside the policies, this check says so once, as an advisory,
+ * rather than passing silently and claiming a guarantee it did not check.
+ * CEDC010's parse gate still applies in that state.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cede010: PostSynthCheck;
+//# sourceMappingURL=cede010.d.ts.map

package/dist/lint/post-synth/cede010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cede010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cede010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cAqDrB,CAAC"}

package/dist/lint/post-synth/cede011.d.ts

@@ -0,0 +1,22 @@
+/**
+ * CEDE011: surface the Cedar validator's warnings
+ *
+ * `validate()` returns two arrays, and the second one is the interesting one
+ * for a policy nobody has noticed is dead. The validator's warnings are the
+ * findings that do not make the set invalid but do mean it is not doing what it
+ * says: "policy is impossible: the policy expression evaluates to false for all
+ * valid requests" is the one that matters most — a guard whose attribute
+ * comparison can never hold, so the grant it wraps never fires and the access
+ * it was written to give quietly does not exist.
+ *
+ * Split from CEDE010 rather than folded into it because the two mean different
+ * things: an error is a policy no evaluator will accept, a warning is a policy
+ * that will be accepted and will not work. They deserve different severities
+ * and, in a report, different lines.
+ *
+ * Same two traps as CEDE010 — findings live under `type: "success"`, and their
+ * order is not stable, so `validatePolicySet` sorts before returning.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const cede011: PostSynthCheck;
+//# sourceMappingURL=cede011.d.ts.map

package/dist/lint/post-synth/cede011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cede011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cede011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,OAAO,EAAE,cAkCrB,CAAC"}

package/dist/lint/post-synth/ceds010.d.ts

@@ -0,0 +1,24 @@
+/**
+ * CEDS010: a bare `permit(principal, action, resource);` is a standing grant
+ *
+ * The one policy that permits everything to everyone on everything. It is
+ * valid Cedar, it is what a scaffolded policy looks like before anyone has
+ * written the real one, and the Cedar validator says nothing about it — checked
+ * directly against 4.12.0 (chant #1648): a schema-clean run over exactly this
+ * policy returns zero errors, zero warnings, zero other warnings. There is no
+ * upstream tool that will catch it, which is why the epic names this wall as a
+ * definition-of-done item and why it lives here.
+ *
+ * The shape is unambiguous in the JSON: all three scopes unconstrained
+ * (`op: "All"`) and no `when`/`unless` clause to narrow it. Anything with even
+ * one constraint or one guard is somebody's deliberate decision and is not this
+ * check's business (an unconstrained *action* alone is CEDS012).
+ *
+ * Severity is env-gated on the same `ctx.env` seam the k8s org-policy example
+ * and the aws tier checks use: a production build fails, everything else warns,
+ * so the scaffold-and-iterate loop stays workable while the thing that ships
+ * cannot carry it.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const ceds010: PostSynthCheck;
+//# sourceMappingURL=ceds010.d.ts.map

package/dist/lint/post-synth/ceds010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceds010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ceds010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAgCrB,CAAC"}

package/dist/lint/post-synth/ceds011.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CEDS011: a policy set with no `forbid` has no floor
+ *
+ * Cedar's evaluation order is fixed and is the reason `forbid` exists: a
+ * `forbid` that matches beats every `permit`, no matter how the permits are
+ * written or in what order. That makes a `forbid` the only construct in the
+ * language that states an invariant — "never outside the corporate network",
+ * "never on a resource marked frozen" — which no later grant can widen.
+ *
+ * A set built only from permits has none. Every future policy is additive, and
+ * the blast radius of a careless one is bounded by nothing. This is a
+ * convention rather than a bug, so it warns; the fix is one `forbid` carrying
+ * whatever the set's real invariant is.
+ *
+ * Reported once per policy set, not once per permit.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const ceds011: PostSynthCheck;
+//# sourceMappingURL=ceds011.d.ts.map

package/dist/lint/post-synth/ceds011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceds011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ceds011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAsBrB,CAAC"}

package/dist/lint/post-synth/ceds012.d.ts

@@ -0,0 +1,17 @@
+/**
+ * CEDS012: a `permit` over every action is IAM's `"Action": "*"`
+ *
+ * A permit that names a principal or a resource but leaves `action`
+ * unconstrained grants every action Cedar's schema defines on that target —
+ * including the ones added next quarter, which is what makes it different from
+ * a wide-but-enumerated grant. The author almost always meant a specific verb
+ * or a group (`action in [Action::"read", Action::"list"]`).
+ *
+ * Scoped deliberately narrow so it does not double-report: a policy with *no*
+ * constraint anywhere and no guard is a bare permit, which is CEDS010's
+ * finding and a more serious one. This check speaks only to a policy that
+ * constrained something and then left the verb open.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const ceds012: PostSynthCheck;
+//# sourceMappingURL=ceds012.d.ts.map

package/dist/lint/post-synth/ceds012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ceds012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/ceds012.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,OAAO,EAAE,cAgCrB,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAYvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAW3C,CAAC"}