@intentius/chant-lexicon-cedar 0.44.8

package/dist/lint/post-synth/wasm-helpers.d.ts

@@ -0,0 +1,108 @@
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type * as CedarWasm from "@cedar-policy/cedar-wasm/nodejs";
+import { type CedarPolicySet } from "./cedar-helpers.js";
+type Wasm = typeof CedarWasm;
+/**
+ * The wasm module, loaded on first use.
+ *
+ * Lazy and `require`-based on purpose. The post-synth barrel is imported
+ * statically by `plugin.ts`, and every `chant lint`/`chant audit` run loads
+ * every active lexicon's plugin — a top-level import would pull 4 MB of wasm
+ * into any build that merely has cedar installed. `check()` is synchronous, so
+ * `await import()` is not available; `createRequire` is. The `/nodejs` flavor
+ * is CommonJS with a synchronous `readFileSync` init, so there is nothing to
+ * await anyway.
+ */
+export declare function loadWasm(): Wasm | undefined;
+/** Why the wasm could not be loaded, if it could not be. */
+export declare function wasmLoadError(): string | undefined;
+/** Reset the module cache. Test-only — lets a test exercise the load-failure path. */
+export declare function resetWasmCache(): void;
+export type WasmResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * Run a wasm call, turning a thrown serde error into a result rather than an
+ * exception (trap 3 above). The thrown message is deliberately not passed
+ * through verbatim: its positions point into the internal call struct.
+ */
+export declare function call<T>(what: string, fn: () => T): WasmResult<T>;
+/** The first line of a Cedar `DetailedError`, with its `help` when it has one. */
+export declare function describeError(error: {
+    message: string;
+    help?: string | null;
+}): string;
+/**
+ * chant's serializer carries a `when`/`unless` body as Cedar expression
+ * *source* under a `__expr` key, because the authored model holds expression
+ * strings until schema-driven codegen (#1650) makes them typed trees. `__expr`
+ * is not part of Cedar's JSON policy grammar — the deserializer rejects it
+ * ("unknown variant `__expr`") — so anything handed to the wasm has to have
+ * those bodies parsed into real expression JSON first.
+ *
+ * There is no expression-level entry point in the package, so the expression
+ * is parsed inside a throwaway policy and the resulting condition body lifted
+ * back out. A source expression that does not parse is the finding CEDC011
+ * reports.
+ */
+export declare const EXPR_KEY = "__expr";
+export interface ExpressionFailure {
+    /** The policy key the clause belongs to. */
+    key: string;
+    /** `when` or `unless`, as the document spelled it. */
+    kind: string;
+    /** The expression source that failed. */
+    expression: string;
+    message: string;
+}
+export interface NormalizedPolicySet {
+    /** A policy set the wasm will accept, keyed by chant's own policy ids. */
+    policySet: CedarWasm.PolicySet;
+    /** Condition bodies whose expression source did not parse. */
+    expressionFailures: ExpressionFailure[];
+}
+/** Replace every `__expr` body in a policy set with parsed expression JSON. */
+export declare function normalizePolicySet(wasm: Wasm, set: CedarPolicySet): NormalizedPolicySet;
+/** A Cedar schema found beside the policies in the build output. */
+export interface DiscoveredSchema {
+    /** Human-readable `.cedarschema` source, or a parsed JSON schema object. */
+    schema: CedarWasm.Schema;
+    /** The filename it came from. */
+    source: string;
+}
+/**
+ * The project's Cedar schema, if the build emitted one beside the policies.
+ *
+ * Two forms, both of which the wasm accepts — but only as the right JS type: a
+ * `string` is *always* read as human-readable `.cedarschema`, never as JSON, so
+ * a `.cedarschema.json` file has to be `JSON.parse`d into a live object first
+ * or the parser reports "unexpected token `{`" against perfectly valid JSON.
+ *
+ * Reads `ctx.outputs` only. Nothing emits a schema today — schema-driven
+ * codegen is #1650 — which is exactly why CEDE010 says so out loud instead of
+ * passing silently.
+ */
+export declare function findSchema(ctx: PostSynthContext): DiscoveredSchema | undefined;
+/** One validator finding, already flattened and safe to sort. */
+export interface ValidationFinding {
+    policyId: string;
+    message: string;
+}
+export interface ValidationOutcome {
+    /** Sorted by `policyId` then `message` — the wasm's own order is not stable. */
+    errors: ValidationFinding[];
+    /** Same sort. */
+    warnings: ValidationFinding[];
+    /** Set when the call itself failed (a parse error, a malformed call struct). */
+    failure?: string;
+}
+/** Validate a normalized policy set against a schema. Never throws. */
+export declare function validatePolicySet(wasm: Wasm, policySet: CedarWasm.PolicySet, schema: CedarWasm.Schema): ValidationOutcome;
+/** Parse-only gate, for when there is no schema to validate against. */
+export declare function parsePolicySet(wasm: Wasm, policySet: CedarWasm.PolicySet): WasmResult<string[]>;
+export {};
+//# sourceMappingURL=wasm-helpers.d.ts.map

package/dist/lint/post-synth/wasm-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm-helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wasm-helpers.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,KAAK,KAAK,SAAS,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AAIzB,KAAK,IAAI,GAAG,OAAO,SAAS,CAAC;AAK7B;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,IAAI,IAAI,GAAG,SAAS,CAS3C;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAGlD;AAED,sFAAsF;AACtF,wBAAgB,cAAc,IAAI,IAAI,CAGrC;AAID,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpF;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAUhE;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,CAEtF;AAID;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,QAAQ,WAAW,CAAC;AAEjC,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;IAC/B,8DAA8D;IAC9D,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;CACzC;AAgBD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,GAAG,mBAAmB,CAkBvF;AAoCD,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC;IACzB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,SAAS,CAkB9E;AAID,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,iBAAiB;IACjB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAYD,uEAAuE;AACvE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,SAAS,CAAC,SAAS,EAC9B,MAAM,EAAE,SAAS,CAAC,MAAM,GACvB,iBAAiB,CAiBnB;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAO/F"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,10 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export { cedarPolicyShapeRule, CEDAR_EFFECTS } from "./policy-shape.js";
+/**
+ * All lint rules provided by this lexicon (imported by plugin.ts's lintRules()).
+ *
+ * Pre-synth rules are wired by hand — unlike post-synth checks, they are not
+ * auto-discovered. Add the import above and the entry below.
+ */
+export declare const rules: LintRule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAG3D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,QAAQ,EAA2B,CAAC"}

package/dist/lint/rules/policy-shape.d.ts

@@ -0,0 +1,31 @@
+/**
+ * CEDC001: a Cedar policy declaration must have a usable effect and no empty guard
+ *
+ * Two authoring mistakes that the serializer cannot report and the emitted
+ * artifact hides:
+ *
+ * - **An effect that is not `permit` or `forbid`.** Cedar has exactly two, and
+ *   the serializer coerces anything that is not the literal string `"forbid"`
+ *   into `permit`. So `effect: "deny"` — the word every other policy language
+ *   in the world uses, and the one a reader will reach for — silently emits a
+ *   *grant*. There is no downstream stage that can catch this: by the time the
+ *   policy set exists, the mistake looks like a deliberate permit.
+ * - **An empty `when`/`unless` entry.** `when: ["", "context.mfa"]` emits
+ *   `when {  }`, which is not a Cedar expression; the policy set then fails to
+ *   parse and the error arrives as a byte offset into a generated file. The
+ *   typo is here, in the source, and so is the line number worth printing.
+ *
+ * Source-level because both are visible only before serialization, and both
+ * are about a literal the author typed. A guard built from a variable or a
+ * template expression is out of reach of an AST rule and is left alone —
+ * CEDC011 covers the emitted form.
+ *
+ * Scoped by import: only calls to bindings imported from this lexicon are
+ * considered, so an unrelated `{ effect: "deny" }` in a file that has nothing
+ * to do with Cedar is never flagged.
+ */
+import type { LintRule } from "@intentius/chant/lint/rule";
+/** The two effects Cedar has. */
+export declare const CEDAR_EFFECTS: readonly ["permit", "forbid"];
+export declare const cedarPolicyShapeRule: LintRule;
+//# sourceMappingURL=policy-shape.d.ts.map

package/dist/lint/rules/policy-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-shape.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/policy-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAMxF,iCAAiC;AACjC,eAAO,MAAM,aAAa,+BAAgC,CAAC;AA+C3D,eAAO,MAAM,oBAAoB,EAAE,QAmElC,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,24 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * Completions over the schema-derived registry.
+ *
+ * Two shapes come out of core's generic provider: class names after `new `,
+ * and property names inside a constructor's object literal. Both are useful
+ * here — `new Policy({` completes `effect`/`principal`/`action`/…, and
+ * `new Doc` completes `Document`.
+ *
+ * The third shape is Cedar's own: a scope names an *action constant*, not a
+ * class, and those are plain `const` exports rather than constructors, so no
+ * `new ` ever precedes them. {@link actionCompletions} covers that position.
+ */
+export declare function completions(ctx: CompletionContext): CompletionItem[];
+/**
+ * Action constants in a scope position.
+ *
+ * `action: { eq: <cursor> }` and `action: { in: [<cursor>` are where an action
+ * is named, and the generated constants (`ReadAction`, `WriteAction`, …) are
+ * the only correct values. Matching on the surrounding text rather than on a
+ * parsed AST keeps this cheap and is what the other lexicons' providers do.
+ */
+export declare function actionCompletions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIpF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAIpE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAwB1E"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,11 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/**
+ * Hover over a generated declaration.
+ *
+ * Core's default formatter reports CloudFormation-shaped facts (primary
+ * identifier, create-only, write-only) a Cedar declaration does not have. The
+ * facts that matter here are the Cedar ones: what a `Policy` prop means, which
+ * groups an entity type is `in`, and what an action applies to.
+ */
+export declare function hover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAI1E;;;;;;;GAOG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/lsp/registry.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The generated registry, adapted to what core's `LexiconIndex` reads.
+ *
+ * `lexicon-cedar.json` describes every declaration the project's schema
+ * produced (#1650): the `Policy` authoring class, one entry per entity type,
+ * one per action, and the attribute/context record types beside them. Its
+ * property table is keyed `properties`, while `LexiconIndex.getPropertyNames`
+ * looks at `propertyConstraints` — the CloudFormation-shaped name the class was
+ * written against. Renaming the generated key to match would put a
+ * CloudFormation word in a Cedar artifact; translating here does not, and it is
+ * the only reason this module exists.
+ *
+ * The require is lazy and cached. `generate()` writes the registry, so a
+ * checkout that has not run it yet must still be able to import this file —
+ * the LSP tests skip on exactly that condition.
+ */
+import { LexiconIndex } from "@intentius/chant/lsp/lexicon-providers";
+/** One `lexicon-cedar.json` entry, as {@link generateRegistry} writes it. */
+export interface CedarRegistryEntry {
+    resourceType: string;
+    kind: "resource" | "property";
+    lexicon: string;
+    description?: string;
+    /** Cedar namespace the declaration came from, e.g. `App`. */
+    namespace?: string;
+    /** Entity types this one is `in`, for an entity declaration. */
+    memberOfTypes?: string[];
+    /** `appliesTo.principal`, for an action declaration. */
+    principalTypes?: string[];
+    /** `appliesTo.resource`, for an action declaration. */
+    resourceTypes?: string[];
+    enumValues?: string[];
+    properties?: Record<string, {
+        type: string;
+        required: boolean;
+    }>;
+}
+export type CedarRegistry = Record<string, CedarRegistryEntry>;
+/** The raw registry, for the hover formatter's Cedar-specific fields. */
+export declare function cedarRegistry(): CedarRegistry;
+/** The same registry as a `LexiconIndex`, with the property table translated. */
+export declare function cedarIndex(): LexiconIndex;
+/** Reset the caches. Tests that swap the registry on disk need this; nothing else does. */
+export declare function resetCedarIndexCache(): void;
+//# sourceMappingURL=registry.d.ts.map

package/dist/lsp/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/lsp/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAqB,MAAM,wCAAwC,CAAC;AAKzF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAK/D,yEAAyE;AACzE,wBAAgB,aAAa,IAAI,aAAa,CAI7C;AAED,iFAAiF;AACjF,wBAAgB,UAAU,IAAI,YAAY,CAazC;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/manifest.json

@@ -0,0 +1,8 @@
+{
+  "name": "cedar",
+  "version": "0.44.8",
+  "chantVersion": ">=0.1.0",
+  "namespace": "Cedar",
+  "intrinsics": [],
+  "pseudoParameters": {}
+}

package/dist/mcp/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The cedar lexicon's MCP contributions.
+ *
+ * Two of the three are the conventional pair every lexicon ships, built from
+ * core's shared helpers: `cedar:diff` and `chant://cedar/resource-catalog`.
+ * The third is the one only this lexicon can answer — see
+ * ./policy-coverage.ts.
+ *
+ * Names are written as bare verbs and single-segment URIs. Core namespaces both
+ * (`cedar:<verb>`, `chant://cedar/<path>`), and applying the prefix is
+ * idempotent, so the helpers' pre-namespaced output and the bare `coverage`
+ * below both register as exactly one well-formed identifier (chant #1341).
+ */
+import type { McpToolContribution, McpResourceContribution } from "@intentius/chant/mcp/types";
+/**
+ * `cedar:coverage` — which schema declarations the built policy set reaches.
+ *
+ * Builds the project the same way `chant build` does rather than reading a
+ * committed `.cedar` file, so the answer is about the policies in source, not
+ * about whatever was last written to disk.
+ */
+export declare const cedarCoverageTool: McpToolContribution;
+/** Every MCP tool this lexicon contributes. */
+export declare function cedarMcpTools(): McpToolContribution[];
+/**
+ * Every MCP resource this lexicon contributes.
+ *
+ * `createCatalogResource` locates the registry relative to the module URL it is
+ * given, resolving `<dir>/generated/lexicon-cedar.json`. That has to be
+ * `src/`, not `src/mcp/`, so the caller in plugin.ts passes its own
+ * `import.meta.url` rather than this file deriving one by walking up.
+ */
+export declare function cedarMcpResources(pluginUrl: string): McpResourceContribution[];
+//# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAI/F;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,mBA4C/B,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,aAAa,IAAI,mBAAmB,EAAE,CASrD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAU9E"}

package/dist/mcp/policy-coverage.d.ts

@@ -0,0 +1,81 @@
+/**
+ * "Which policies cover this resource?" — answered from a build (epic #1645).
+ *
+ * `src/coverage.ts` next door asks a different question: is every schema
+ * declaration reachable from the *generated artifacts*. This one asks whether
+ * every schema declaration is reachable from the *policy set*, which is the
+ * authorization question. An entity type no policy can ever apply to is a
+ * resource nothing grants and nothing denies — under Cedar's default-deny it is
+ * inert, and that is either the intent or a hole.
+ *
+ * The answer comes from `getValidRequestEnvsPolicy`, Cedar's own resolver: it
+ * takes one policy and the schema and returns every (principal, action,
+ * resource) triple the policy could apply to, having already expanded `is`,
+ * `in`, action groups, and `appliesTo`. Reimplementing that against the parsed
+ * scope would be a second, worse Cedar; this is why the wasm package is a
+ * runtime dependency rather than a dev one.
+ */
+import { type ResolveSchemaOptions } from "../spec/fetch.js";
+export interface CedarPolicyCoverageItem {
+    /** `App::Document` or `App::Action::"read"`. */
+    name: string;
+    kind: "entity" | "action";
+    /** How many policies in the set can apply to it. */
+    policies: number;
+    /** Ids of the policies that can, in declaration order. */
+    policyIds: string[];
+    /** True when at least one of those policies is a `permit`. */
+    permitted: boolean;
+    /** True when at least one of those policies is a `forbid`. */
+    forbidden: boolean;
+}
+export interface CedarPolicyCoverageReport {
+    /** Where the schema came from. */
+    schemaPath: string;
+    isDefaultSchema: boolean;
+    /** Policies the set parsed into. */
+    policyCount: number;
+    entityTypes: number;
+    entityTypesCovered: number;
+    actions: number;
+    actionsCovered: number;
+    /** Declarations no policy in the set can apply to. */
+    uncovered: string[];
+    /** Declarations reachable only from a `forbid` — nothing ever grants them. */
+    forbidOnly: string[];
+    items: CedarPolicyCoverageItem[];
+    /** Policies the resolver could not place, with its reason. */
+    unresolved: Array<{
+        policyId: string;
+        error: string;
+    }>;
+    /**
+     * Ids of policies whose valid request envelope is empty — no request can ever
+     * match them.
+     *
+     * A scope naming an entity type the schema does not declare lands here rather
+     * than in {@link unresolved}: `getValidRequestEnvsPolicy` answers "success,
+     * nothing" rather than failing, and a policy that can never fire is a real
+     * finding either way. It is usually a typo'd entity type.
+     */
+    inert: string[];
+    /**
+     * Why the policy set could not be split into policies, when it could not.
+     *
+     * Without this a set that fails to parse reports zero policies and every
+     * declaration uncovered — the same numbers as a project with no policies at
+     * all, and the opposite diagnosis.
+     */
+    parseErrors: string[];
+}
+export interface CedarPolicyCoverageOptions extends ResolveSchemaOptions {
+    /** The emitted `.cedar` policy set text. */
+    policySetText: string;
+}
+/**
+ * Report which schema declarations the policy set can reach.
+ */
+export declare function computePolicyCoverage(options: CedarPolicyCoverageOptions): CedarPolicyCoverageReport;
+/** Human-readable summary, for the CLI-shaped callers. */
+export declare function formatPolicyCoverage(report: CedarPolicyCoverageReport): string;
+//# sourceMappingURL=policy-coverage.d.ts.map

package/dist/mcp/policy-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-coverage.d.ts","sourceRoot":"","sources":["../../src/mcp/policy-coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAG5E,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC,8DAA8D;IAC9D,UAAU,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;;;;;;OAQG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;CACvB;AA0BD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,0BAA0B,GAAG,yBAAyB,CAmEpG;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAyB9E"}