@intentius/chant-lexicon-cedar 0.44.9 → 0.44.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +48 -2
- package/dist/agentcore/embed.d.ts +189 -0
- package/dist/agentcore/embed.d.ts.map +1 -0
- package/dist/agentcore/enforcement.d.ts +76 -0
- package/dist/agentcore/enforcement.d.ts.map +1 -0
- package/dist/agentcore/scan.d.ts +46 -0
- package/dist/agentcore/scan.d.ts.map +1 -0
- package/dist/codegen/docs-dogwood.d.ts +21 -0
- package/dist/codegen/docs-dogwood.d.ts.map +1 -0
- package/dist/codegen/docs.d.ts.map +1 -1
- package/dist/dogwood/cli.d.ts +41 -0
- package/dist/dogwood/cli.d.ts.map +1 -1
- package/dist/dogwood/index.d.ts +10 -4
- package/dist/dogwood/index.d.ts.map +1 -1
- package/dist/dogwood/replay-activity.d.ts +196 -0
- package/dist/dogwood/replay-activity.d.ts.map +1 -0
- package/dist/dogwood/replay-op.d.ts +165 -0
- package/dist/dogwood/replay-op.d.ts.map +1 -0
- package/dist/dogwood/serialize.d.ts +20 -0
- package/dist/dogwood/serialize.d.ts.map +1 -1
- package/dist/dogwood/trace.d.ts +215 -0
- package/dist/dogwood/trace.d.ts.map +1 -0
- package/dist/index.d.ts +8 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/integrity.json +5 -3
- package/dist/lint/audit-catalog.d.ts.map +1 -1
- package/dist/lint/post-synth/dwdc013.d.ts +33 -0
- package/dist/lint/post-synth/dwdc013.d.ts.map +1 -0
- package/dist/lint/post-synth/index.d.ts.map +1 -1
- package/dist/manifest.json +1 -1
- package/dist/okf/index.md +1 -0
- package/dist/okf/rules/DWDC013.md +15 -0
- package/dist/okf/types/Policy.md +1 -0
- package/dist/op/activities/index.d.ts +18 -0
- package/dist/op/activities/index.d.ts.map +1 -0
- package/dist/plugin.d.ts.map +1 -1
- package/dist/rules/dwdc013.ts +64 -0
- package/dist/skills/chant-cedar-dogwood.md +327 -0
- package/package.json +7 -2
- package/src/agentcore/embed.test.ts +254 -0
- package/src/agentcore/embed.ts +399 -0
- package/src/agentcore/enforcement.test.ts +43 -0
- package/src/agentcore/enforcement.ts +92 -0
- package/src/agentcore/scan.ts +119 -0
- package/src/codegen/docs-dogwood.ts +1119 -0
- package/src/codegen/docs.ts +66 -1
- package/src/dogwood/cli.test.ts +122 -1
- package/src/dogwood/cli.ts +122 -1
- package/src/dogwood/index.ts +74 -1
- package/src/dogwood/replay-activity.test.ts +481 -0
- package/src/dogwood/replay-activity.ts +506 -0
- package/src/dogwood/replay-op.ts +242 -0
- package/src/dogwood/serialize.ts +37 -0
- package/src/dogwood/trace.test.ts +231 -0
- package/src/dogwood/trace.ts +471 -0
- package/src/index.ts +52 -0
- package/src/lint/audit-catalog.ts +8 -0
- package/src/lint/post-synth/dwd-post-synth.test.ts +119 -1
- package/src/lint/post-synth/dwdc013.ts +64 -0
- package/src/lint/post-synth/dwde-post-synth.test.ts +1 -1
- package/src/lint/post-synth/index.ts +2 -0
- package/src/op/activities/index.ts +27 -0
- package/src/plugin.test.ts +3 -2
- package/src/plugin.ts +30 -0
- package/src/skills/chant-cedar-dogwood.md +327 -0
package/dist/dogwood/index.d.ts
CHANGED
|
@@ -23,11 +23,17 @@ export { concrete, declaredEventKinds, defaultEventSchema, eventDeclaration, eve
|
|
|
23
23
|
export type { EventDeclaration, EventField, EventFieldType, EventSchema, EventSelector, NamedField, PinTarget, SpreadField, } from "./event-schema.js";
|
|
24
24
|
export { DOGWOOD_EVENT_SCHEMA_FILENAME, DOGWOOD_EVENT_SCHEMA_TYPE, DOGWOOD_LEXICON, DOGWOOD_MACRO_FILENAME, DOGWOOD_MACRO_LIBRARY_TYPE, DOGWOOD_POLICY_FILENAME, DOGWOOD_POLICY_TYPE, TemporalEventSchema, TemporalMacroLibrary, TemporalPolicy, } from "./policy.js";
|
|
25
25
|
export type { EventSchemaProps, MacroLibraryProps, TemporalPolicyProps } from "./policy.js";
|
|
26
|
-
export { DOGWOOD_EVENT_SCHEMA_SUFFIX, DOGWOOD_POLICY_SUFFIX, renderTemporalPolicyText, serializeDogwood, } from "./serialize.js";
|
|
27
|
-
export type { DogwoodSerializeResult } from "./serialize.js";
|
|
26
|
+
export { DOGWOOD_EVENT_SCHEMA_SUFFIX, DOGWOOD_POLICY_SUFFIX, dogwoodPolicyRecords, renderTemporalPolicyText, serializeDogwood, } from "./serialize.js";
|
|
27
|
+
export type { DogwoodPolicyRecord, DogwoodSerializeResult } from "./serialize.js";
|
|
28
28
|
export { blankComments, dogwoodPolicyFiles, dogwoodSchemaFiles, effectiveMaxWindowSeconds, readEventSchema, scanPredicates, scanWindowlessOperators, scanWindows, temporalRegions, } from "./scan.js";
|
|
29
29
|
export type { DogwoodArtifact, EventSchemaFacts, TemporalPredicateRef, WindowRef } from "./scan.js";
|
|
30
30
|
export { DOGWOOD_UPSTREAM } from "./upstream.js";
|
|
31
|
-
export { DOGWOOD_BINARY_ENV, DOGWOOD_BINARY_NAME, DOGWOOD_SEARCH_ORDER, configureDogwoodCli, findDogwoodBinary, formatDogwoodDiagnostic, parseLowerOutput, parseValidateOutput, resetDogwoodCli, runDogwoodLower, runDogwoodValidate, } from "./cli.js";
|
|
32
|
-
export type { DogwoodBinary, DogwoodBinarySource, DogwoodBundle, DogwoodDiagnostic, DogwoodFatal, DogwoodLabel, DogwoodLowerResult, DogwoodLowered, DogwoodRun, DogwoodRunner, DogwoodUnusable, DogwoodValidateResult, } from "./cli.js";
|
|
31
|
+
export { DOGWOOD_BINARY_ENV, DOGWOOD_BINARY_NAME, DOGWOOD_SEARCH_ORDER, configureDogwoodCli, findDogwoodBinary, formatDogwoodDiagnostic, parseLowerOutput, parseReplayOutput, parseValidateOutput, resetDogwoodCli, runDogwoodLower, runDogwoodReplay, runDogwoodValidate, } from "./cli.js";
|
|
32
|
+
export type { DogwoodBinary, DogwoodBinarySource, DogwoodBundle, DogwoodDiagnostic, DogwoodFatal, DogwoodLabel, DogwoodLowerResult, DogwoodLowered, DogwoodReplayResult, DogwoodRun, DogwoodRunner, DogwoodUnusable, DogwoodValidateResult, DogwoodVerdict, } from "./cli.js";
|
|
33
|
+
export { auditTrace, decimalValue, entityRef, rawValue, renderTrace, renderTraceFields, renderTraceLine, renderTraceValue, traceEntity, traceEvent, traceFixture, } from "./trace.js";
|
|
34
|
+
export type { TraceAuditOptions, TraceBags, TraceDecimal, TraceEntityDecl, TraceEntityRef, TraceEvent, TraceEventInput, TraceFields, TraceFixture, TraceFixtureOptions, TraceIssue, TraceIssueKind, TraceRaw, TraceScope, TraceTagged, TraceValue, } from "./trace.js";
|
|
35
|
+
export { compareVerdicts, dogwoodReplay, dogwoodReplayReport, renderReplaySummary, resolveReplayInputs, } from "./replay-activity.js";
|
|
36
|
+
export type { DogwoodReplayArgs, DogwoodReplayReportArgs, ExpectedVerdict, PolicyReplayDispatch, PolicyReplayMode, PolicyReplayReport, ReplayDivergence, ReplayExpectation, } from "./replay-activity.js";
|
|
37
|
+
export { DEFAULT_REPLAY_REPORT_PATH, PolicyReplayOp, dogwoodReplayReportStep, dogwoodReplayStep, } from "./replay-op.js";
|
|
38
|
+
export type { DogwoodReplayReportStepOpts, DogwoodReplayStepOpts, PolicyReplayOpConfig, PolicyReplayOpResources, } from "./replay-op.js";
|
|
33
39
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dogwood/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE/F,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,GAAG,EACH,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,GAAG,EACH,QAAQ,EACR,GAAG,EACH,SAAS,EACT,QAAQ,EACR,GAAG,EACH,eAAe,EACf,UAAU,EACV,QAAQ,EACR,cAAc,EACd,KAAK,EACL,GAAG,EACH,GAAG,EACH,cAAc,EACd,IAAI,EACJ,EAAE,EACF,WAAW,EACX,MAAM,EACN,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,OAAO,EACP,SAAS,EACT,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,OAAO,EACP,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,EACN,WAAW,EACX,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,IAAI,EACJ,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,GACV,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,aAAa,EACb,MAAM,EACN,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,WAAW,EACX,aAAa,EACb,UAAU,EACV,SAAS,EACT,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dogwood/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE/F,OAAO,EACL,GAAG,EACH,OAAO,EACP,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,KAAK,EACL,GAAG,EACH,SAAS,EACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,GAAG,EACH,QAAQ,EACR,GAAG,EACH,SAAS,EACT,QAAQ,EACR,GAAG,EACH,eAAe,EACf,UAAU,EACV,QAAQ,EACR,cAAc,EACd,KAAK,EACL,GAAG,EACH,GAAG,EACH,cAAc,EACd,IAAI,EACJ,EAAE,EACF,WAAW,EACX,MAAM,EACN,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,OAAO,EACP,SAAS,EACT,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,OAAO,EACP,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,SAAS,EACT,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,MAAM,EACN,WAAW,EACX,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,IAAI,EACJ,mBAAmB,EACnB,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,WAAW,EACX,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,GACV,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,EACX,KAAK,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,aAAa,EACb,MAAM,EACN,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,WAAW,EACX,aAAa,EACb,UAAU,EACV,SAAS,EACT,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,GACf,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEzF,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE/E,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,eAAe,GAChB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,OAAO,CAAC;AACf,YAAY,EACV,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,eAAe,EACf,qBAAqB,EACrB,cAAc,GACf,MAAM,OAAO,CAAC;AAIf,OAAO,EACL,UAAU,EACV,YAAY,EACZ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,eAAe,EACf,cAAc,EACd,UAAU,EACV,eAAe,EACf,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,cAAc,EACd,QAAQ,EACR,UAAU,EACV,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AAIjB,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}
|
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `dogwoodReplay` / `dogwoodReplayReport` — the replay half of PolicyReplayOp
|
|
3
|
+
* (#1661, epic #1646).
|
|
4
|
+
*
|
|
5
|
+
* Contributed the way the fly lexicon contributes `flyApply`: a plain exported
|
|
6
|
+
* async function taking one args object, re-exported from
|
|
7
|
+
* `src/op/activities/index.ts`, resolved **by name** by core's activity
|
|
8
|
+
* registry when a project lists the `cedar` lexicon. There is no Temporal
|
|
9
|
+
* import here and no Temporal dependency in the package — the local executor
|
|
10
|
+
* runs it as-is, and a Temporal worker registers the same function.
|
|
11
|
+
*
|
|
12
|
+
* What it does: takes a policy bundle (inline text or paths), an event trace
|
|
13
|
+
* (typed events, inline text, or a path) and a set of expectations, runs
|
|
14
|
+
* `dogwood replay --format json` through the existing CLI adapter in
|
|
15
|
+
* `./cli.ts`, and returns a typed divergence report — expected versus actual
|
|
16
|
+
* verdict per decision point, with the determining rules and per-evaluation
|
|
17
|
+
* errors carried through.
|
|
18
|
+
*
|
|
19
|
+
* Three contract details from the #1657 verification shape the code:
|
|
20
|
+
*
|
|
21
|
+
* - **Replay exits 0 even when every verdict is DENY.** A nonzero exit means
|
|
22
|
+
* the trace or the policy set failed to load. `./cli.ts` already refuses to
|
|
23
|
+
* read exit codes as verdicts; this module refuses to read a DENY as a
|
|
24
|
+
* failure.
|
|
25
|
+
* - **A run that could not happen is not a run that found nothing.** An
|
|
26
|
+
* unusable invocation or a fatal (a malformed trace line, an unparseable
|
|
27
|
+
* policy set) throws, so the step fails instead of reporting zero
|
|
28
|
+
* divergences.
|
|
29
|
+
* - **`index` is the decision-stream position, not the trace line number.** A
|
|
30
|
+
* history-only event contributes history and no verdict, so expectations
|
|
31
|
+
* written against trace lines would silently address the wrong decision.
|
|
32
|
+
* Expectations therefore match on `timestamp` by default, and on `index`
|
|
33
|
+
* only when the caller says so.
|
|
34
|
+
*
|
|
35
|
+
* The trace input is deliberately generic. An AgentCore session/decision
|
|
36
|
+
* history is the follow-on source (it needs the aws lexicon's activity
|
|
37
|
+
* surface, out of scope here) — a trace is a trace, wherever it came from.
|
|
38
|
+
*/
|
|
39
|
+
import { type DogwoodBundle, type DogwoodVerdict } from "./cli.js";
|
|
40
|
+
import { type TraceEvent, type TraceIssue } from "./trace.js";
|
|
41
|
+
/** What a replay produces on divergence, mirroring `WorkflowAuditOp`'s modes. */
|
|
42
|
+
export type PolicyReplayMode = "report" | "issue" | "pull-request";
|
|
43
|
+
/** A verdict a decision point is expected to reach. */
|
|
44
|
+
export type ExpectedVerdict = "allow" | "deny";
|
|
45
|
+
/**
|
|
46
|
+
* One expectation against the decision stream.
|
|
47
|
+
*
|
|
48
|
+
* Give a `timestamp` (the `@<n>` of the line) or an `index` (the 0-based
|
|
49
|
+
* position in the decision stream). Prefer `timestamp`: it survives a trace
|
|
50
|
+
* gaining a history-only event, which shifts every later index.
|
|
51
|
+
*/
|
|
52
|
+
export interface ReplayExpectation {
|
|
53
|
+
readonly timestamp?: number;
|
|
54
|
+
readonly index?: number;
|
|
55
|
+
readonly verdict: ExpectedVerdict;
|
|
56
|
+
/** When set, the `.dw` rule indices the decision must be determined by. */
|
|
57
|
+
readonly determiningRules?: readonly number[];
|
|
58
|
+
/** What this decision point is proving, carried into the report. */
|
|
59
|
+
readonly note?: string;
|
|
60
|
+
}
|
|
61
|
+
/** One expected-versus-actual mismatch. */
|
|
62
|
+
export interface ReplayDivergence {
|
|
63
|
+
/** Decision-stream index. `-1` when the expected decision point never occurred. */
|
|
64
|
+
readonly index: number;
|
|
65
|
+
readonly timestamp: number;
|
|
66
|
+
/** Absent when the replay produced a decision nothing expected. */
|
|
67
|
+
readonly expected?: ExpectedVerdict;
|
|
68
|
+
/** Absent when an expected decision point produced no verdict at all. */
|
|
69
|
+
readonly actual?: ExpectedVerdict;
|
|
70
|
+
readonly determiningRules: readonly number[];
|
|
71
|
+
readonly errors: readonly string[];
|
|
72
|
+
readonly detail: string;
|
|
73
|
+
readonly note?: string;
|
|
74
|
+
}
|
|
75
|
+
/** What `dogwoodReplay` returns and `dogwoodReplayReport` reads back. */
|
|
76
|
+
export interface PolicyReplayReport {
|
|
77
|
+
/** True when nothing diverged and no decision point errored. */
|
|
78
|
+
readonly ok: boolean;
|
|
79
|
+
readonly mode: PolicyReplayMode;
|
|
80
|
+
/** Every decision point, in stream order. */
|
|
81
|
+
readonly verdicts: readonly DogwoodVerdict[];
|
|
82
|
+
readonly divergences: readonly ReplayDivergence[];
|
|
83
|
+
/** Divergence count — the number a search attribute or a gate reads. */
|
|
84
|
+
readonly findings: number;
|
|
85
|
+
/** Trace weaknesses found by `auditTrace`, when typed events were supplied. */
|
|
86
|
+
readonly traceIssues: readonly TraceIssue[];
|
|
87
|
+
/** Markdown, used as the report body or an issue/PR body. */
|
|
88
|
+
readonly summary: string;
|
|
89
|
+
}
|
|
90
|
+
/** What `dogwoodReplay` takes. Every artifact is inline text or a path. */
|
|
91
|
+
export interface DogwoodReplayArgs {
|
|
92
|
+
/** `.dw` policy set text. */
|
|
93
|
+
policies?: string;
|
|
94
|
+
/** …or a path to it. Relative paths resolve against {@link cwd}. */
|
|
95
|
+
policiesPath?: string;
|
|
96
|
+
/** Cedar action schema text (`--policy-schema`). Not optional to the CLI. */
|
|
97
|
+
policySchema?: string;
|
|
98
|
+
policySchemaPath?: string;
|
|
99
|
+
/** `.dwschema` event schema text (`--event-schema`). */
|
|
100
|
+
eventSchema?: string;
|
|
101
|
+
eventSchemaPath?: string;
|
|
102
|
+
/** `.dw` macro library text (`--macros`). */
|
|
103
|
+
macros?: string;
|
|
104
|
+
macrosPath?: string;
|
|
105
|
+
/** `providers.json` text (`--providers`). Rhai must be inlined under `implementation.script`. */
|
|
106
|
+
providers?: string;
|
|
107
|
+
providersPath?: string;
|
|
108
|
+
/** Typed events — rendered here, and audited for the both-bags trap. */
|
|
109
|
+
traceEvents?: readonly TraceEvent[];
|
|
110
|
+
/** …or the trace text as it would appear in a `.log`. */
|
|
111
|
+
trace?: string;
|
|
112
|
+
/** …or a path to it. */
|
|
113
|
+
tracePath?: string;
|
|
114
|
+
/**
|
|
115
|
+
* Event kinds that decide, for the trace audit. Default `["request"]` — the
|
|
116
|
+
* truth is whichever kinds the `.dwschema` marks `decision`.
|
|
117
|
+
*/
|
|
118
|
+
traceDecisionKinds?: readonly string[];
|
|
119
|
+
/** What each decision point must decide. An empty list replays and reports. */
|
|
120
|
+
expect?: readonly ReplayExpectation[];
|
|
121
|
+
/** Default `report`. */
|
|
122
|
+
mode?: PolicyReplayMode;
|
|
123
|
+
/** Explicit binary path. Otherwise resolved by {@link findDogwoodBinary}. */
|
|
124
|
+
binary?: string;
|
|
125
|
+
/** Base directory for every relative path. Default `process.cwd()`. */
|
|
126
|
+
cwd?: string;
|
|
127
|
+
/** When set, the report is written here as JSON for the Report phase to read. */
|
|
128
|
+
reportPath?: string;
|
|
129
|
+
}
|
|
130
|
+
/**
|
|
131
|
+
* Assemble the bundle and the trace from whichever form the caller supplied.
|
|
132
|
+
*
|
|
133
|
+
* Exported because the composite's Artifacts phase writes files and the Replay
|
|
134
|
+
* phase names them: resolving the same way in a test as in the Op is the point
|
|
135
|
+
* of having one function do it.
|
|
136
|
+
*/
|
|
137
|
+
export declare function resolveReplayInputs(args: DogwoodReplayArgs): Promise<{
|
|
138
|
+
bundle: DogwoodBundle;
|
|
139
|
+
trace: string;
|
|
140
|
+
traceIssues: TraceIssue[];
|
|
141
|
+
}>;
|
|
142
|
+
/**
|
|
143
|
+
* Match expectations against the decision stream.
|
|
144
|
+
*
|
|
145
|
+
* Timestamp matching consumes verdicts left to right, so two expectations at
|
|
146
|
+
* the same `@n` address the first and second decision there rather than both
|
|
147
|
+
* addressing the first. A verdict nothing expected is reported too — a policy
|
|
148
|
+
* set that starts deciding somewhere new is drift, and the usual reason a
|
|
149
|
+
* replay is being run at all.
|
|
150
|
+
*/
|
|
151
|
+
export declare function compareVerdicts(verdicts: readonly DogwoodVerdict[], expectations: readonly ReplayExpectation[]): ReplayDivergence[];
|
|
152
|
+
/** The markdown body — printed in `report` mode, posted in the other two. */
|
|
153
|
+
export declare function renderReplaySummary(report: Omit<PolicyReplayReport, "summary">): string;
|
|
154
|
+
/**
|
|
155
|
+
* Replay a policy bundle against a trace and report divergence.
|
|
156
|
+
*
|
|
157
|
+
* Throws when the CLI could not be used or the run was fatal. That is the
|
|
158
|
+
* distinction `./cli.ts` draws and this preserves: a replay that did not
|
|
159
|
+
* happen must fail the step, never report zero divergences.
|
|
160
|
+
*/
|
|
161
|
+
export declare function dogwoodReplay(args: DogwoodReplayArgs): Promise<PolicyReplayReport>;
|
|
162
|
+
/** What `dogwoodReplayReport` takes. */
|
|
163
|
+
export interface DogwoodReplayReportArgs {
|
|
164
|
+
/** The JSON `dogwoodReplay` wrote. Relative paths resolve against {@link cwd}. */
|
|
165
|
+
reportPath?: string;
|
|
166
|
+
/** …or the report itself, for a caller holding it already. */
|
|
167
|
+
report?: PolicyReplayReport;
|
|
168
|
+
/** Overrides the mode recorded in the report. */
|
|
169
|
+
mode?: PolicyReplayMode;
|
|
170
|
+
/** Title for the issue or pull request. */
|
|
171
|
+
title?: string;
|
|
172
|
+
cwd?: string;
|
|
173
|
+
/** Fail the step when the replay diverged. Default false — the mode decides. */
|
|
174
|
+
failOnDivergence?: boolean;
|
|
175
|
+
}
|
|
176
|
+
/** What the Report phase produces. */
|
|
177
|
+
export interface PolicyReplayDispatch {
|
|
178
|
+
readonly mode: PolicyReplayMode;
|
|
179
|
+
readonly findings: number;
|
|
180
|
+
readonly title: string;
|
|
181
|
+
/** The markdown to print, or to use as an issue/PR body. */
|
|
182
|
+
readonly body: string;
|
|
183
|
+
/** True when there is something to say — an issue/PR is only worth opening then. */
|
|
184
|
+
readonly actionable: boolean;
|
|
185
|
+
}
|
|
186
|
+
/**
|
|
187
|
+
* Turn a written replay report into the thing the finding mode calls for.
|
|
188
|
+
*
|
|
189
|
+
* It renders and returns; it does not open anything. Same as
|
|
190
|
+
* `workflowSupplyChainAudit`, and for the same reason — the cedar lexicon has
|
|
191
|
+
* no forge client and should not grow one to reach GitHub, GitLab or Forgejo.
|
|
192
|
+
* `report` mode prints the body; `issue` and `pull-request` hand back the
|
|
193
|
+
* title and body for whatever step opens them.
|
|
194
|
+
*/
|
|
195
|
+
export declare function dogwoodReplayReport(args: DogwoodReplayReportArgs): Promise<PolicyReplayDispatch>;
|
|
196
|
+
//# sourceMappingURL=replay-activity.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"replay-activity.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-activity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,EAA2B,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpF,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEnE,uDAAuD;AACvD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,wBAAwB;IACxB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CA+C9E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,gBAAgB,EAAE,CA+GpB;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,MAAM,CAqCvF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwCxF;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,iDAAiD;IACjD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiCtG"}
|
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `PolicyReplayOp` — replay a declared `.dw` set against a recorded event
|
|
3
|
+
* trace and report divergence (#1661, epic #1646).
|
|
4
|
+
*
|
|
5
|
+
* Shape follows `WorkflowAuditOp`: an observe-dial Op whose last phase is a
|
|
6
|
+
* finding mode (`report | issue | pull-request`). What it observes is not a
|
|
7
|
+
* moving upstream but a moving *history* — a policy set that was correct
|
|
8
|
+
* against last week's traffic can decide differently against this week's, and
|
|
9
|
+
* the deterministic build cannot see that.
|
|
10
|
+
*
|
|
11
|
+
* ## Packaging: the composite ships from cedar, not from temporal
|
|
12
|
+
*
|
|
13
|
+
* `WorkflowAuditOp` and `PipelineAuditOp` live in the temporal lexicon because
|
|
14
|
+
* they hand back a `TemporalSchedule` alongside the Op, and that resource is
|
|
15
|
+
* temporal's. This composite hands back an Op and nothing else, so it has no
|
|
16
|
+
* reason to reach across — it imports `@intentius/chant/op` only, exactly as
|
|
17
|
+
* the fly lexicon's `flyDeploy` composite does. cedar therefore keeps zero
|
|
18
|
+
* runtime dependency on `@intentius/chant-lexicon-temporal`.
|
|
19
|
+
*
|
|
20
|
+
* The scheduled form is a two-line project-side pairing rather than a config
|
|
21
|
+
* flag, and that is the deliberate cost of the decision:
|
|
22
|
+
*
|
|
23
|
+
* ```ts
|
|
24
|
+
* import { TemporalSchedule } from "@intentius/chant-lexicon-temporal";
|
|
25
|
+
*
|
|
26
|
+
* export const { op } = PolicyReplayOp({ name: "policy-replay", … });
|
|
27
|
+
* export const schedule = new TemporalSchedule({
|
|
28
|
+
* scheduleId: "policy-replay-schedule",
|
|
29
|
+
* spec: { cronExpressions: ["0 6 * * *"] },
|
|
30
|
+
* action: { workflowType: "policyReplayWorkflow", taskQueue: "policy-replay" },
|
|
31
|
+
* });
|
|
32
|
+
* ```
|
|
33
|
+
*
|
|
34
|
+
* A project that wants that already installs the temporal lexicon; a project
|
|
35
|
+
* that only wants `chant run policy-replay` on the local executor should not
|
|
36
|
+
* have to. `examples/policy-replay` is the worked recipe for both.
|
|
37
|
+
*
|
|
38
|
+
* ## Phases
|
|
39
|
+
*
|
|
40
|
+
* ```
|
|
41
|
+
* Artifacts chantBuild — emit policies.dw, the .cedarschema and the
|
|
42
|
+
* .dwschema the replay reads (skippable when they are checked in)
|
|
43
|
+
* Replay dogwoodReplay — run `dogwood replay --format json` over the
|
|
44
|
+
* bundle and the trace, write the divergence report
|
|
45
|
+
* Report dogwoodReplayReport — read that report and act on the mode
|
|
46
|
+
* ```
|
|
47
|
+
*
|
|
48
|
+
* The report file is the seam between the last two phases, the same way
|
|
49
|
+
* `dist/fly.json` is the seam between `build:fly` and `flyApply`: Op steps do
|
|
50
|
+
* not pass return values to one another, so a phase boundary needs an artifact
|
|
51
|
+
* to be a real boundary rather than a cosmetic one.
|
|
52
|
+
*/
|
|
53
|
+
import { type ActivityStep, type OpResource } from "@intentius/chant/op";
|
|
54
|
+
import type { PolicyReplayMode, ReplayExpectation } from "./replay-activity.js";
|
|
55
|
+
/** Where the Replay phase writes its report by default. */
|
|
56
|
+
export declare const DEFAULT_REPLAY_REPORT_PATH = "dist/dogwood-replay.json";
|
|
57
|
+
/** Options for {@link dogwoodReplayStep}. Mirrors `DogwoodReplayArgs`. */
|
|
58
|
+
export interface DogwoodReplayStepOpts {
|
|
59
|
+
policies?: string;
|
|
60
|
+
policiesPath?: string;
|
|
61
|
+
policySchema?: string;
|
|
62
|
+
policySchemaPath?: string;
|
|
63
|
+
eventSchema?: string;
|
|
64
|
+
eventSchemaPath?: string;
|
|
65
|
+
macros?: string;
|
|
66
|
+
macrosPath?: string;
|
|
67
|
+
providers?: string;
|
|
68
|
+
providersPath?: string;
|
|
69
|
+
trace?: string;
|
|
70
|
+
tracePath?: string;
|
|
71
|
+
expect?: readonly ReplayExpectation[];
|
|
72
|
+
mode?: PolicyReplayMode;
|
|
73
|
+
binary?: string;
|
|
74
|
+
cwd?: string;
|
|
75
|
+
reportPath?: string;
|
|
76
|
+
profile?: ActivityStep["profile"];
|
|
77
|
+
}
|
|
78
|
+
/**
|
|
79
|
+
* Replay a policy bundle against a trace — the typed twin of `flyApplyStep`.
|
|
80
|
+
*
|
|
81
|
+
* Resolves to the `dogwoodReplay` activity by name, which `loadActivities`
|
|
82
|
+
* binds when the project lists the `cedar` lexicon. Defaults to the
|
|
83
|
+
* `policyCheck` profile.
|
|
84
|
+
*/
|
|
85
|
+
export declare const dogwoodReplayStep: (opts: DogwoodReplayStepOpts) => ActivityStep;
|
|
86
|
+
/** Options for {@link dogwoodReplayReportStep}. */
|
|
87
|
+
export interface DogwoodReplayReportStepOpts {
|
|
88
|
+
reportPath?: string;
|
|
89
|
+
mode?: PolicyReplayMode;
|
|
90
|
+
title?: string;
|
|
91
|
+
cwd?: string;
|
|
92
|
+
failOnDivergence?: boolean;
|
|
93
|
+
profile?: ActivityStep["profile"];
|
|
94
|
+
}
|
|
95
|
+
/** Read a written replay report and act on its finding mode. */
|
|
96
|
+
export declare const dogwoodReplayReportStep: (opts?: DogwoodReplayReportStepOpts) => ActivityStep;
|
|
97
|
+
/** Options for {@link PolicyReplayOp}. */
|
|
98
|
+
export interface PolicyReplayOpConfig {
|
|
99
|
+
/** Op name (kebab-case) — the `chant run <name>` target and the task queue base. */
|
|
100
|
+
name: string;
|
|
101
|
+
overview?: string;
|
|
102
|
+
/** Defaults to {@link name}. */
|
|
103
|
+
taskQueue?: string;
|
|
104
|
+
/**
|
|
105
|
+
* Directory every relative path below resolves against, and the one the
|
|
106
|
+
* build script runs in. Default `.`.
|
|
107
|
+
*/
|
|
108
|
+
path?: string;
|
|
109
|
+
/**
|
|
110
|
+
* npm script that emits the `.dw` bundle. Default `build`. Pass `false` when
|
|
111
|
+
* the artifacts are checked in — the Artifacts phase is then omitted rather
|
|
112
|
+
* than run as a no-op, so the Op's phase list says what it really does.
|
|
113
|
+
*/
|
|
114
|
+
buildScript?: string | false;
|
|
115
|
+
/** Emitted `.dw` policy set. Default `dist/policies.dw`. */
|
|
116
|
+
policiesPath?: string;
|
|
117
|
+
/** Emitted Cedar action schema. Required by the CLI; default `dist/app.cedarschema`. */
|
|
118
|
+
policySchemaPath?: string;
|
|
119
|
+
/** Emitted `.dwschema`, when the project declares one. */
|
|
120
|
+
eventSchemaPath?: string;
|
|
121
|
+
/** Emitted macro library, when the project ships one out of line. */
|
|
122
|
+
macrosPath?: string;
|
|
123
|
+
/** `providers.json`, with the Rhai inlined under `implementation.script`. */
|
|
124
|
+
providersPath?: string;
|
|
125
|
+
/** The recorded trace to replay. Required — there is nothing to replay without one. */
|
|
126
|
+
tracePath: string;
|
|
127
|
+
/** What each decision point must decide. Empty replays and reports verdicts. */
|
|
128
|
+
expect?: readonly ReplayExpectation[];
|
|
129
|
+
/** What to produce on divergence. Default `report`. */
|
|
130
|
+
onFinding?: PolicyReplayMode;
|
|
131
|
+
/** Title for the issue or pull request the finding mode calls for. */
|
|
132
|
+
title?: string;
|
|
133
|
+
/**
|
|
134
|
+
* Fail the Op when the replay diverged. Default false — an observe-dial Op
|
|
135
|
+
* reports by default, and a red run is a decision the caller makes.
|
|
136
|
+
*/
|
|
137
|
+
failOnDivergence?: boolean;
|
|
138
|
+
/** Where the Replay phase writes its report. Default {@link DEFAULT_REPLAY_REPORT_PATH}. */
|
|
139
|
+
reportPath?: string;
|
|
140
|
+
/** Explicit `dogwood` binary path, for a runner that knows where it built one. */
|
|
141
|
+
binary?: string;
|
|
142
|
+
}
|
|
143
|
+
/** What {@link PolicyReplayOp} hands back. */
|
|
144
|
+
export interface PolicyReplayOpResources {
|
|
145
|
+
/** The Op — discovered by `chant run <name>`, emitted by `chant build`. */
|
|
146
|
+
op: InstanceType<typeof OpResource>;
|
|
147
|
+
}
|
|
148
|
+
/**
|
|
149
|
+
* Assemble the replay Op: emit the artifacts, replay them, act on the finding.
|
|
150
|
+
*
|
|
151
|
+
* @example
|
|
152
|
+
* ```typescript
|
|
153
|
+
* export const { op } = PolicyReplayOp({
|
|
154
|
+
* name: "policy-replay",
|
|
155
|
+
* tracePath: "trace/read-after-login.log",
|
|
156
|
+
* expect: [
|
|
157
|
+
* { timestamp: 10, verdict: "allow", determiningRules: [0] },
|
|
158
|
+
* { timestamp: 7200, verdict: "deny", note: "the login is two hours stale" },
|
|
159
|
+
* ],
|
|
160
|
+
* onFinding: "issue",
|
|
161
|
+
* });
|
|
162
|
+
* ```
|
|
163
|
+
*/
|
|
164
|
+
export declare function PolicyReplayOp(config: PolicyReplayOpConfig): PolicyReplayOpResources;
|
|
165
|
+
//# sourceMappingURL=replay-op.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"replay-op.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,qBAAqB,KAAG,YAG/D,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,GAAI,OAAM,2BAAgC,KAAG,YAGhF,CAAC;AAEF,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE7B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAEtC,uDAAuD;IACvD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,CAyDpF"}
|
|
@@ -43,4 +43,24 @@ export declare function renderTemporalPolicyText(id: string, props: Record<strin
|
|
|
43
43
|
* a policy's `@id` does not depend on which leg rendered it.
|
|
44
44
|
*/
|
|
45
45
|
export declare function serializeDogwood(entities: Map<string, Declarable>): DogwoodSerializeResult | undefined;
|
|
46
|
+
/** One declared temporal policy, resolved: chant name, policy id, walked props. */
|
|
47
|
+
export interface DogwoodPolicyRecord {
|
|
48
|
+
/** The chant entity name — the export name on the `*.ts` file. */
|
|
49
|
+
name: string;
|
|
50
|
+
/** The policy id, as it appears in `@id(…)`. */
|
|
51
|
+
id: string;
|
|
52
|
+
/** Props with references resolved, ready for `renderTemporalPolicyText`. */
|
|
53
|
+
props: Record<string, unknown>;
|
|
54
|
+
}
|
|
55
|
+
/**
|
|
56
|
+
* Every `Dogwood::TemporalPolicy` in a build, with references walked and ids
|
|
57
|
+
* resolved — the temporal counterpart of `cedarPolicyRecords` (#1660).
|
|
58
|
+
*
|
|
59
|
+
* `serializeDogwood` above renders whole *files*; the AgentCore embedding needs
|
|
60
|
+
* the policies one at a time, because `AWS::BedrockAgentCore::Policy` carries a
|
|
61
|
+
* single statement and `EnforcementMode` is set per policy. Both paths walk
|
|
62
|
+
* references through the same visitor, so a scope that names another declared
|
|
63
|
+
* entity resolves identically whichever one rendered it.
|
|
64
|
+
*/
|
|
65
|
+
export declare function dogwoodPolicyRecords(entities: Map<string, Declarable>): DogwoodPolicyRecord[];
|
|
46
66
|
//# sourceMappingURL=serialize.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/dogwood/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgB9D,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,yFAAyF;AACzF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAgB3F;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,sBAAsB,GAAG,SAAS,CAgGtG"}
|
|
1
|
+
{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/dogwood/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgB9D,sDAAsD;AACtD,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,yFAAyF;AACzF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAgB3F;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,sBAAsB,GAAG,SAAS,CAgGtG;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,mBAAmB,EAAE,CAe7F"}
|