@intentius/chant-lexicon-cedar 0.44.8

package/dist/okf/index.md

@@ -0,0 +1,37 @@
+---
+okf_version: '0.2'
+---
+
+# Resource types
+
+* [AdminAction](/types/AdminAction.md) - App::Action::"admin"
+* [Application](/types/Application.md) - App::Application
+* [ApproveAction](/types/ApproveAction.md) - App::Action::"approve"
+* [CommentAction](/types/CommentAction.md) - App::Action::"comment"
+* [CreateAction](/types/CreateAction.md) - App::Action::"create"
+* [DeleteAction](/types/DeleteAction.md) - App::Action::"delete"
+* [Document](/types/Document.md) - App::Document
+* [Folder](/types/Folder.md) - App::Folder
+* [Group](/types/Group.md) - App::Group
+* [ListAction](/types/ListAction.md) - App::Action::"list"
+* [Policy](/types/Policy.md) - Cedar::Policy
+* [ReadAction](/types/ReadAction.md) - App::Action::"read"
+* [ServiceAccount](/types/ServiceAccount.md) - App::ServiceAccount
+* [ShareAction](/types/ShareAction.md) - App::Action::"share"
+* [Team](/types/Team.md) - App::Team
+* [User](/types/User.md) - App::User
+* [WriteAction](/types/WriteAction.md) - App::Action::"write"
+
+# Rules
+
+* [CEDC001](/rules/CEDC001.md) - a Cedar policy declaration must have a usable effect and no empty guard
+* [CEDC010](/rules/CEDC010.md) - The emitted Cedar policy set must parse as Cedar (checkParsePolicySet)
+* [CEDC011](/rules/CEDC011.md) - Every when/unless condition expression in an emitted policy must parse as a Cedar expression
+* [CEDC012](/rules/CEDC012.md) - No two emitted Cedar policies may claim the same policy id
+* [CEDC013](/rules/CEDC013.md) - An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings
+* [CEDC014](/rules/CEDC014.md) - An entity reference in a policy scope must be a well-formed Namespace::Type::\
+* [CEDE010](/rules/CEDE010.md) - Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)
+* [CEDE011](/rules/CEDE011.md) - Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set
+* [CEDS010](/rules/CEDS010.md) - A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything
+* [CEDS011](/rules/CEDS011.md) - A policy set built entirely from permits carries no forbid to bound them
+* [CEDS012](/rules/CEDS012.md) - A permit that leaves the action scope unconstrained grants every action, including future ones

package/dist/okf/rules/CEDC001.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: CEDC001
+description: a Cedar policy declaration must have a usable effect and no empty guard
+id: CEDC001
+severity: error
+category: correctness
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+a Cedar policy declaration must have a usable effect and no empty guard

package/dist/okf/rules/CEDC010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: CEDC010
+description: The emitted Cedar policy set must parse as Cedar (checkParsePolicySet)
+id: CEDC010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+The emitted Cedar policy set must parse as Cedar (checkParsePolicySet)

package/dist/okf/rules/CEDC011.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDC011
+description: Every when/unless condition expression in an emitted policy must parse as a Cedar expression
+id: CEDC011
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+Every when/unless condition expression in an emitted policy must parse as a Cedar expression
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDC012.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: CEDC012
+description: No two emitted Cedar policies may claim the same policy id
+id: CEDC012
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+No two emitted Cedar policies may claim the same policy id

package/dist/okf/rules/CEDC013.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDC013
+description: An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings
+id: CEDC013
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDC014.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDC014
+description: An entity reference in a policy scope must be a well-formed Namespace::Type::\
+id: CEDC014
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+An entity reference in a policy scope must be a well-formed Namespace::Type::\
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDE010.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDE010
+description: Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)
+id: CEDE010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDE011.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDE011
+description: Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set
+id: CEDE011
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDS010.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDS010
+description: A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything
+id: CEDS010
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/rules/CEDS011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: CEDS011
+description: A policy set built entirely from permits carries no forbid to bound them
+id: CEDS011
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A policy set built entirely from permits carries no forbid to bound them

package/dist/okf/rules/CEDS012.md

@@ -0,0 +1,15 @@
+---
+type: post-synth-check
+title: CEDS012
+description: A permit that leaves the action scope unconstrained grants every action, including future ones
+id: CEDS012
+severity: error
+category: post-synth
+lexicon: cedar
+docs: https://intentius.io/chant/lexicons/cedar/rules/
+---
+A permit that leaves the action scope unconstrained grants every action, including future ones
+
+## Applies to
+
+- [Policy](/types/Policy.md)

package/dist/okf/types/AdminAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: AdminAction
+description: cedar resource type App::Action::"admin"
+name: AdminAction
+lexicon: cedar
+resource_type: App::Action::"admin"
+---
+`App::Action::"admin"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `breakGlass` (`Bool`)
+- `mfa` (`Bool`)

package/dist/okf/types/Application.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Application
+description: cedar resource type App::Application
+name: Application
+lexicon: cedar
+resource_type: App::Application
+---
+`App::Application`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `name` (`String`)
+- `owner` (`App::Team`)

package/dist/okf/types/ApproveAction.md

@@ -0,0 +1,13 @@
+---
+type: resource-type
+title: ApproveAction
+description: cedar resource type App::Action::"approve"
+name: ApproveAction
+lexicon: cedar
+resource_type: App::Action::"approve"
+---
+`App::Action::"approve"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)

package/dist/okf/types/CommentAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CommentAction
+description: cedar resource type App::Action::"comment"
+name: CommentAction
+lexicon: cedar
+resource_type: App::Action::"comment"
+---
+`App::Action::"comment"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)
+- `reason` (`String`)

package/dist/okf/types/CreateAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: CreateAction
+description: cedar resource type App::Action::"create"
+name: CreateAction
+lexicon: cedar
+resource_type: App::Action::"create"
+---
+`App::Action::"create"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)
+- `reason` (`String`)

package/dist/okf/types/DeleteAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: DeleteAction
+description: cedar resource type App::Action::"delete"
+name: DeleteAction
+lexicon: cedar
+resource_type: App::Action::"delete"
+---
+`App::Action::"delete"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `approvedBy` (`App::User`)
+- `mfa` (`Bool`)

package/dist/okf/types/Document.md

@@ -0,0 +1,18 @@
+---
+type: resource-type
+title: Document
+description: cedar resource type App::Document
+name: Document
+lexicon: cedar
+resource_type: App::Document
+---
+`App::Document`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `classification` (`String`)
+- `folder` (`App::Folder`)
+- `owner` (`App::User`)
+- `public` (`Bool`)
+- `tags` (`Set<String>`)
+- `title` (`String`)

package/dist/okf/types/Folder.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Folder
+description: cedar resource type App::Folder
+name: Folder
+lexicon: cedar
+resource_type: App::Folder
+---
+`App::Folder`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `name` (`String`)
+- `owner` (`App::User`)
+- `tags` (`Set<String>`)

package/dist/okf/types/Group.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Group
+description: cedar resource type App::Group
+name: Group
+lexicon: cedar
+resource_type: App::Group
+---
+`App::Group`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `description` (`String`)
+- `name` (`String`)

package/dist/okf/types/ListAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ListAction
+description: cedar resource type App::Action::"list"
+name: ListAction
+lexicon: cedar
+resource_type: App::Action::"list"
+---
+`App::Action::"list"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)
+- `sourceIp` (`String`)

package/dist/okf/types/Policy.md

@@ -0,0 +1,29 @@
+---
+type: resource-type
+title: Policy
+description: A Cedar policy — the unit this lexicon serializes to .cedar text and the JSON policy format.
+name: Policy
+lexicon: cedar
+resource_type: Cedar::Policy
+---
+A Cedar policy — the unit this lexicon serializes to .cedar text and the JSON policy format.
+
+## Properties
+
+- `effect` (`permit | forbid`)
+- `principal` (`scope`)
+- `action` (`scope`)
+- `resource` (`scope`)
+- `when` (`Set<expression>`)
+- `unless` (`Set<expression>`)
+- `annotations` (`Record<String, String>`)
+
+## Governed by
+
+- [CEDC011](/rules/CEDC011.md): Every when/unless condition expression in an emitted policy must parse as a Cedar expression
+- [CEDC013](/rules/CEDC013.md): An emitted policy's @id annotation must match its policy id, and annotation values must be non-empty strings
+- [CEDC014](/rules/CEDC014.md): An entity reference in a policy scope must be a well-formed Namespace::Type::\
+- [CEDE010](/rules/CEDE010.md): Every emitted Cedar policy set validates clean against the project schema (cedar-wasm validate)
+- [CEDE011](/rules/CEDE011.md): Cedar validation warnings (impossible policies, shadowed conditions) on an emitted policy set
+- [CEDS010](/rules/CEDS010.md): A bare permit(principal, action, resource) with no scope constraints and no conditions grants everything
+- [CEDS012](/rules/CEDS012.md): A permit that leaves the action scope unconstrained grants every action, including future ones

package/dist/okf/types/ReadAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ReadAction
+description: cedar resource type App::Action::"read"
+name: ReadAction
+lexicon: cedar
+resource_type: App::Action::"read"
+---
+`App::Action::"read"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)
+- `sourceIp` (`String`)

package/dist/okf/types/ServiceAccount.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: ServiceAccount
+description: cedar resource type App::ServiceAccount
+name: ServiceAccount
+lexicon: cedar
+resource_type: App::ServiceAccount
+---
+`App::ServiceAccount`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `name` (`String`)
+- `owner` (`App::User`)
+- `rotatedAt` (`String`)

package/dist/okf/types/ShareAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: ShareAction
+description: cedar resource type App::Action::"share"
+name: ShareAction
+lexicon: cedar
+resource_type: App::Action::"share"
+---
+`App::Action::"share"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `approvedBy` (`App::User`)
+- `mfa` (`Bool`)

package/dist/okf/types/Team.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: Team
+description: cedar resource type App::Team
+name: Team
+lexicon: cedar
+resource_type: App::Team
+---
+`App::Team`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `costCenter` (`String`)
+- `name` (`String`)

package/dist/okf/types/User.md

@@ -0,0 +1,18 @@
+---
+type: resource-type
+title: User
+description: cedar resource type App::User
+name: User
+lexicon: cedar
+resource_type: App::User
+---
+`App::User`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `department` (`String`)
+- `email` (`String`)
+- `level` (`Long`)
+- `manager` (`App::User`)
+- `mfaEnabled` (`Bool`)
+- `roles` (`Set<String>`)

package/dist/okf/types/WriteAction.md

@@ -0,0 +1,14 @@
+---
+type: resource-type
+title: WriteAction
+description: cedar resource type App::Action::"write"
+name: WriteAction
+lexicon: cedar
+resource_type: App::Action::"write"
+---
+`App::Action::"write"`, a resource type of the cedar lexicon.
+
+## Properties
+
+- `mfa` (`Bool`)
+- `reason` (`String`)

package/dist/package-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../src/package-cli.ts"],"names":[],"mappings":""}

package/dist/plugin.d.ts

@@ -0,0 +1,8 @@
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+/**
+ * cedar lexicon plugin.
+ *
+ * Implements all required LexiconPlugin lifecycle methods.
+ */
+export declare const cedarPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,aA2RzB,CAAC"}