@intentius/chant-lexicon-cedar 0.44.9 → 0.44.12

package/README.md

@@ -126,7 +126,8 @@ import { OwnerCanManage, DenyByDefaultSet } from "@intentius/chant-lexicon-cedar
 
 ## Agent surface
 
-Three skills (`chant-cedar-authoring`, `chant-cedar-avp-embedding`, `chant-cedar-meta-policy`),
+Four skills (`chant-cedar-authoring`, `chant-cedar-avp-embedding`,
+`chant-cedar-meta-policy`, `chant-cedar-dogwood`),
 three `chant init` templates (`default`, `avp-embedding`,
 `gateway-policy-set`), and three MCP contributions:
 
@@ -215,6 +216,50 @@ says it is not intended for production use. The revision this is built against
 is recorded in `src/dogwood/upstream.ts`; full `.dw` validation shells to the
 `dogwood` binary and is deliberately not part of any gating check.
 
+Five pages in the docs site cover the dialect, and the skill
+`chant-cedar-dogwood` covers it for an agent:
+
+| Page | What it answers |
+|---|---|
+| [The Dogwood Dialect](docs/src/content/docs/dogwood.mdx) | What ships, what pre-release means, how upstream is governed |
+| [Temporal Policies](docs/src/content/docs/dogwood-temporal-policies.mdx) | The builders, the operators, and which of them are really macros |
+| [Event Schemas](docs/src/content/docs/dogwood-event-schemas.mdx) | The `.dwschema` surface and the `callerPrincipal` pin |
+| [Validation](docs/src/content/docs/dogwood-validation.mdx) | The DWD walls, the CLI-gated checks, and the binary knobs |
+| [Replay](docs/src/content/docs/dogwood-replay.mdx) | Typed traces, `PolicyReplayOp`, and the both-bags trap |
+
+## Bedrock AgentCore
+
+`AWS::BedrockAgentCore::Policy` is where a temporal policy is actually
+deployed, and its `Definition` is a two-arm `oneOf`: `Cedar.Statement` for plain
+Cedar, `Policy.Statement` for anything else. That second arm is what a `.dw`
+policy travels in.
+
+`agentCorePolicyDefinition(name, policy)` picks the arm from the policy — a
+`TemporalPolicy`, or any props carrying a temporal clause, goes to `Policy`;
+plain Cedar goes to `Cedar`. Same no-dependency rule as the AVP seam above: the
+seam is the data shape, not an import. Templates are refused, because
+AgentCore's union has no template-linked arm.
+
+`EnforcementMode` is the staging dial. `LOG_ONLY` is evaluated on every request
+and its decision is observed rather than returned, which is observe-before-
+enforce in the substrate, per policy — and it is how a temporal rule should
+start, since whether `formerly within 1h …` fires depends on traffic nobody has
+replayed:
+
+```ts
+new BedrockAgentCorePolicy({
+  PolicyEngineId: engine.ref(),
+  ...agentCoreStagedPolicy("writeNeedsApproval", writeNeedsApproval, "log-only"),
+});
+```
+
+Promotion is `"log-only"` → `"enforce"`. The resource carries a statement and
+nothing else, so the event schema has no property to live in and is registered
+with the engine separately; DWDC013 warns when a build embeds temporal text and
+emits no `.dwschema` beside it, because the deployed statement then matches
+nothing and fails open or closed without failing. See
+`examples/agentcore-policy/`.
+
 ## Commands
 
 ```bash
@@ -233,6 +278,7 @@ npm run docs:build  # build the Starlight site in docs/
 - `src/serializer.ts` — `.cedar` text and JSON policy-set output
 - `src/policy-text.ts` — policy-head rendering shared by every renderer
 - `src/avp/` — AVP embedding, the policy-store readers, and the ownership channel
+- `src/agentcore/` — the AgentCore `Definition` seam and the `EnforcementMode` dial
 - `src/dogwood/` — the temporal dialect: builders, `.dw`/`.dwschema` output
 - `src/import/` — `chant import` parser, generator and round-trip fixtures
 - `src/detect.ts` — which documents belong to this lexicon
@@ -242,7 +288,7 @@ npm run docs:build  # build the Starlight site in docs/
 - `src/lsp/` — LSP completions and hover over the generated registry
 - `src/mcp/` — MCP tools and resources, including policy coverage
 - `src/composites/` — `OwnerCanManage`, `DenyByDefaultSet`
-- `src/skills/` — the three agent skills
+- `src/skills/` — the four agent skills
 - `src/init-templates.ts` — `chant init --lexicon cedar --template …`
 - `src/generated/` — generated artifacts (do not edit)
 - `docs/` — the standalone Starlight site, generated by `npm run docs`

package/dist/agentcore/embed.d.ts

@@ -0,0 +1,189 @@
+/**
+ * Typed embedding of a cedar or dogwood policy into
+ * `AWS::BedrockAgentCore::Policy` (#1660).
+ *
+ * The aws lexicon keeps the deployment vehicle, exactly as it does for AVP
+ * (#1652, `../avp/embed.ts`). What differs is the shape of the vehicle:
+ * AgentCore's `Definition` is a two-arm `oneOf`, not the single `Static` arm
+ * `AWS::VerifiedPermissions::Policy` has —
+ *
+ * ```jsonc
+ * "PolicyDefinition": {
+ *   "oneOf": [{ "required": ["Cedar"] }, { "required": ["Policy"] }]
+ * }
+ * ```
+ *
+ * — where `Cedar.Statement` is plain Cedar and `Policy.Statement` is the
+ * language-agnostic arm. That second arm is what makes AgentCore the
+ * deployment target for the dogwood dialect: a `.dw` policy is a Cedar policy
+ * with `when temporal { … }` clauses, which the `Cedar` arm has no business
+ * accepting, and the `Policy` arm exists precisely so a policy engine can be
+ * handed something that is not plain Cedar.
+ *
+ * A project that has both lexicons installed writes
+ *
+ * ```ts
+ * new BedrockAgentCorePolicy({
+ *   PolicyEngineId: engine.ref(),
+ *   Name: "writeNeedsApproval",
+ *   ...agentCoreStagedPolicy("writeNeedsApproval", writeNeedsApproval, "log-only"),
+ * });
+ * ```
+ *
+ * and the statement is the same text `chant build` writes to `policies.dw`,
+ * rendered by the same renderer, with `@id` intact.
+ *
+ * ### Why no dependency, and why the example uses plain objects
+ *
+ * Same rule as `../avp/embed.ts` and for the same reason: a cedar → aws
+ * dependency would invert the epic's decision that Cedar is vendor-neutral and
+ * make the cedar lexicon unbuildable without the aws one. Nothing here imports
+ * `@intentius/chant-lexicon-aws`. The seam is the data shape, which is stable
+ * CloudFormation, and the prop names below are the generated class's own
+ * (`PolicyEngineId`, `Name`, `Definition`, `EnforcementMode`, `Description`),
+ * so substituting the real class is a one-line edit. `examples/agentcore-policy/`
+ * demonstrates the pairing with a plain-object stand-in, because the shipped
+ * cedar examples build against the cedar serializer alone and an `AWS::*` entity
+ * declared in that tree would have no serializer to emit it.
+ *
+ * ### What this module refuses
+ *
+ * Templates. `AWS::VerifiedPermissions::Policy` has a `TemplateLinked` arm;
+ * AgentCore's `Definition` union does not, so a statement carrying a
+ * `?principal` or `?resource` slot has nowhere to go and would be rejected at
+ * deploy time with an error about the policy text rather than about the slot.
+ * {@link agentCoreStatement} throws instead, at authoring time, naming the
+ * declaration.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { type CedarPolicyProps } from "../serializer.js";
+import { type TemporalPolicyProps } from "../dogwood/policy.js";
+import { type AgentCoreEnforcementMode, type AgentCoreStage } from "./enforcement.js";
+/** `Definition.Cedar` — the plain-Cedar arm of the definition union. */
+export interface AgentCoreCedarDefinition {
+    Statement: string;
+}
+/** `Definition.Policy` — the language-agnostic arm, which carries `.dw` text. */
+export interface AgentCoreLanguageDefinition {
+    Statement: string;
+}
+/**
+ * The `Definition` property of `AWS::BedrockAgentCore::Policy`.
+ *
+ * A union rather than a record with two optional keys, because upstream's
+ * schema is a `oneOf`: a definition carrying both arms is rejected, and a type
+ * that can express it is a type that lets a caller build one.
+ */
+export type AgentCorePolicyDefinition = {
+    Cedar: AgentCoreCedarDefinition;
+    Policy?: never;
+} | {
+    Policy: AgentCoreLanguageDefinition;
+    Cedar?: never;
+};
+/** The props of `AWS::BedrockAgentCore::Policy` this module can fill. */
+export interface AgentCorePolicyResource {
+    PolicyEngineId: string;
+    Name: string;
+    Definition: AgentCorePolicyDefinition;
+    EnforcementMode?: AgentCoreEnforcementMode;
+    Description?: string;
+}
+/**
+ * A policy paired with its rollout stage — everything but the engine id.
+ *
+ * Spreadable into the generated class, which is the point: the caller supplies
+ * `PolicyEngineId` (an AttrRef this module has no type for) and this supplies
+ * the three props that come from the declaration.
+ */
+export interface AgentCoreStagedPolicy {
+    Name: string;
+    Definition: AgentCorePolicyDefinition;
+    EnforcementMode: AgentCoreEnforcementMode;
+    Description?: string;
+}
+/** `Statement` minLength, on both arms of the union. */
+export declare const AGENTCORE_STATEMENT_MIN = 35;
+/** `Statement` maxLength, on both arms of the union. */
+export declare const AGENTCORE_STATEMENT_MAX = 10000;
+/** `Name` — an identifier, and create-only, so a rename replaces the policy. */
+export declare const AGENTCORE_NAME_PATTERN: RegExp;
+/** What a caller can hand the embedding: one policy, or a whole build's worth. */
+export type AgentCorePolicySource = Declarable | CedarPolicyProps | TemporalPolicyProps | Record<string, unknown> | Map<string, Declarable>;
+export interface AgentCoreEmbedOptions {
+    /** Override the policy id. Defaults to the serializer's own derivation. */
+    policyId?: string;
+    /**
+     * Force an arm of the `Definition` union.
+     *
+     * The default reads the policy: temporal clauses take the `Policy` arm, plain
+     * Cedar takes the `Cedar` arm. Forcing `"dogwood"` on plain Cedar is
+     * legitimate — dogwood embeds Cedar, so the `Policy` arm accepts it, and a
+     * policy set that will grow temporal clauses need not change arms later.
+     * Forcing `"cedar"` on temporal text is not, and throws.
+     */
+    language?: "cedar" | "dogwood";
+    /** `Description` on the resource. Free prose; AgentCore does nothing with it. */
+    description?: string;
+}
+/**
+ * The policy text for one AgentCore policy — the exact string a `Statement`
+ * wants, on whichever arm it lands.
+ *
+ * `name` is the chant entity name; the `@id` annotation the statement carries
+ * is derived from it the same way the serializer derives it, so the statement
+ * in the policy engine can be matched back to the declaration that produced it.
+ */
+export declare function agentCoreStatement(name: string, source: AgentCorePolicySource, options?: AgentCoreEmbedOptions): string;
+/**
+ * The `Definition` property of `AWS::BedrockAgentCore::Policy`.
+ *
+ * The arm is chosen by what the policy is: a `Dogwood::TemporalPolicy`, or any
+ * props carrying a temporal clause, lands in `Definition.Policy`; plain Cedar
+ * lands in `Definition.Cedar`. `options.language` overrides in the one
+ * direction that is safe (see {@link AgentCoreEmbedOptions.language}).
+ */
+export declare function agentCorePolicyDefinition(name: string, source: AgentCorePolicySource, options?: AgentCoreEmbedOptions): AgentCorePolicyDefinition;
+/**
+ * A policy and its rollout stage, ready to spread into the generated class.
+ *
+ * The staged-rollout pattern in one call, which is the point (#1660, and the
+ * loomster#171 showcase seam): shipping log-only and promoting to enforcing is
+ * a one-token diff, not a hand-edited `EnforcementMode` string somewhere else
+ * in the template. See ./enforcement.ts for why observe-before-enforce is the
+ * default reading of a temporal policy rather than an optional nicety.
+ */
+export declare function agentCoreStagedPolicy(name: string, source: AgentCorePolicySource, stage: AgentCoreStage, options?: AgentCoreEmbedOptions): AgentCoreStagedPolicy;
+/**
+ * Every required prop of `AWS::BedrockAgentCore::Policy`, plus the stage.
+ *
+ * `PolicyEngineId` is a string here rather than an AttrRef because this module
+ * does not know the aws lexicon's reference types. A project passes
+ * `engine.ref()` in place of the literal and TypeScript is satisfied by the
+ * generated class's own prop type, not by this one.
+ */
+export declare function agentCorePolicyResource(name: string, source: AgentCorePolicySource, policyEngineId: string, options?: AgentCoreEmbedOptions & {
+    stage?: AgentCoreStage;
+}): AgentCorePolicyResource;
+/**
+ * Every policy in a build, as one AgentCore `Definition` each, keyed by chant
+ * entity name.
+ *
+ * The whole-set form, and the one that walks references between declared
+ * entities — that is what `cedarPolicyRecords`/`dogwoodPolicyRecords` do. One
+ * definition per policy rather than one merged statement, because
+ * `EnforcementMode` is a per-policy dial and merging would throw it away; hand
+ * the map to {@link agentCorePolicyDefinition} instead when a single AgentCore
+ * policy really should carry the whole set.
+ */
+export declare function agentCorePolicySet(entities: Map<string, Declarable>, options?: AgentCoreEmbedOptions): Record<string, AgentCorePolicyDefinition>;
+/**
+ * The chant entity name as an AgentCore `Name`.
+ *
+ * `Name` is create-only and matches `^[A-Za-z][A-Za-z0-9_]*$` — no hyphens,
+ * which is why it is not the kebab-case policy id the `@id` annotation carries.
+ * Checked rather than coerced: silently rewriting a name that is create-only
+ * would mean a later rename replaces the policy without anyone having asked.
+ */
+export declare function agentCorePolicyName(name: string): string;
+//# sourceMappingURL=embed.d.ts.map

package/dist/agentcore/embed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.d.ts","sourceRoot":"","sources":["../../src/agentcore/embed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAuB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAmB,KAAK,wBAAwB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpG,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,KAAK,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,MAAM,EAAE,2BAA2B,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC;AAE3D,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,yBAAyB,CAAC;IACtC,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,yBAAyB,CAAC;IACtC,eAAe,EAAE,wBAAwB,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,QAAQ,CAAC;AAE7C,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,QAA4B,CAAC;AAiBhE,kFAAkF;AAClF,MAAM,MAAM,qBAAqB,GAC7B,UAAU,GACV,gBAAgB,GAChB,mBAAmB,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAgGD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAIR;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,qBAAqB,EAC7B,OAAO,GAAE,qBAA0B,GAClC,yBAAyB,CAY3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,qBAA0B,GAClC,qBAAqB,CAOvB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,qBAAqB,EAC7B,cAAc,EAAE,MAAM,EACtB,OAAO,GAAE,qBAAqB,GAAG;IAAE,KAAK,CAAC,EAAE,cAAc,CAAA;CAAO,GAC/D,uBAAuB,CASzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,OAAO,GAAE,qBAA0B,GAClC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAW3C;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUxD"}

package/dist/agentcore/enforcement.d.ts

@@ -0,0 +1,76 @@
+/**
+ * `EnforcementMode` — the dial that makes a policy rollout observable before it
+ * is binding (#1660).
+ *
+ * `AWS::BedrockAgentCore::Policy` carries an optional `EnforcementMode` with
+ * exactly two values, and the CloudFormation schema says what they mean:
+ *
+ * > Whether the policy contributes to the enforce decision returned to Gateway.
+ * > LOG_ONLY policies are still evaluated but their decisions are observed
+ * > only, allowing customers to validate a policy against real traffic before
+ * > promoting it.
+ *
+ * That is observe-before-enforce, in the substrate, per policy — the same shape
+ * chant already has at the ops layer, and the reason epic #1646 picked
+ * AgentCore as the deployment target for the temporal dialect rather than
+ * inventing a staging mechanism. A temporal policy is the case that needs it
+ * most: `formerly within 24h …` cannot be reasoned about from the source alone,
+ * because whether it fires depends on traffic nobody has replayed yet.
+ *
+ * ### The two names, and why chant does not reuse AWS's
+ *
+ * The wire values are `LOG_ONLY` and `ACTIVE`. `ACTIVE` is a poor name for
+ * "enforcing" — it reads as "not disabled", and `LOG_ONLY` is active too; it is
+ * evaluated on every request. So the authoring vocabulary here is
+ * `"log-only"` / `"enforce"`, and {@link enforcementMode} is the one place the
+ * translation happens. The wire values are exported as well, for a caller that
+ * has one in hand from a live read.
+ *
+ * ### The showcase seam (loomster#171)
+ *
+ * loomster#171 wants a staged policy rollout it can demonstrate end to end:
+ * ship the policy log-only, watch what it would have denied, promote it. This
+ * module is that seam. The whole rollout is one argument —
+ * `agentCoreStagedPolicy(name, policy, stage)` — so the promotion is a
+ * one-token diff a reviewer can see, rather than a hand-edited string in a
+ * CloudFormation resource. Anything more elaborate (which environments are
+ * promoted, who decides) belongs to the caller's own config; this module's job
+ * is to make the two states nameable and the transition legible.
+ */
+/**
+ * The wire values `EnforcementMode` takes, keyed by the stage they implement.
+ *
+ * A typed constant pair rather than a bare union so a caller reads
+ * `AGENTCORE_ENFORCEMENT.logOnly` at the call site and cannot typo the string.
+ */
+export declare const AGENTCORE_ENFORCEMENT: {
+    /** Evaluated on every request; its decision is observed, never returned. */
+    readonly logOnly: "LOG_ONLY";
+    /** Contributes to the decision Gateway returns. AWS's own default. */
+    readonly enforce: "ACTIVE";
+};
+/** The `EnforcementMode` property value, as CloudFormation spells it. */
+export type AgentCoreEnforcementMode = (typeof AGENTCORE_ENFORCEMENT)[keyof typeof AGENTCORE_ENFORCEMENT];
+/** The stage of a rollout, in the vocabulary the seam is authored in. */
+export type AgentCoreStage = "log-only" | "enforce";
+/**
+ * The `EnforcementMode` a stage deploys as.
+ *
+ * Omitting `EnforcementMode` entirely is legal and means `ACTIVE` — AWS's
+ * schema declares that default. This helper never returns `undefined`, so a
+ * policy that went through it says which stage it is in on the face of the
+ * template, and a diff that promotes one shows the change.
+ */
+export declare function enforcementMode(stage: AgentCoreStage): AgentCoreEnforcementMode;
+/** The stage a wire value came from — the inverse of {@link enforcementMode}. */
+export declare function enforcementStage(mode: AgentCoreEnforcementMode | undefined): AgentCoreStage;
+/** True when the policy's decision reaches Gateway rather than only the log. */
+export declare function isEnforcing(mode: AgentCoreEnforcementMode | undefined): boolean;
+/**
+ * One line of prose for a stage, for a description or a plan summary.
+ *
+ * Kept here rather than at the call sites so every surface that explains a
+ * staged policy explains it the same way.
+ */
+export declare function describeStage(stage: AgentCoreStage): string;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/agentcore/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../../src/agentcore/enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;IAChC,4EAA4E;;IAE5E,sEAAsE;;CAE9D,CAAC;AAEX,yEAAyE;AACzE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAE1G,yEAAyE;AACzE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,wBAAwB,CAE/E;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,GAAG,cAAc,CAE3F;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAI3D"}

package/dist/agentcore/scan.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Finding embedded AgentCore policy statements in a build's emitted output
+ * (#1660).
+ *
+ * The DWD walls read emitted *text* rather than the in-memory model, for the
+ * reason `../dogwood/scan.ts` sets out: `chant audit` runs over artifacts chant
+ * did not write, and a wall that only fires on chant's own output is not a
+ * wall. An embedded statement is the same situation one lexicon further out —
+ * the statement lands in whatever the aws lexicon emitted, so this reads the
+ * emitted template rather than reaching for a resource class the cedar lexicon
+ * deliberately does not import.
+ *
+ * Structural, not CloudFormation-specific. The thing being looked for is an
+ * object with a `Definition.Policy.Statement` string, which is AgentCore's
+ * language-agnostic arm wherever it appears — in a CFN template's
+ * `Resources.<id>.Properties`, in a plan JSON, in a fixture. The nearest
+ * enclosing key is carried along as the name to blame, which for a CFN template
+ * is the logical id.
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+/** One `Definition.Policy.Statement` found in an emitted artifact. */
+export interface EmbeddedAgentCoreStatement {
+    /** The lexicon whose output carried it. */
+    lexicon: string;
+    /** The filename, or the lexicon's primary output when it had no name. */
+    source: string;
+    /** The nearest enclosing key — a CloudFormation logical id, in practice. */
+    logicalId?: string;
+    /** The statement text, verbatim. */
+    statement: string;
+}
+/** The `Cedar` arm as well, for a check that needs to tell the two apart. */
+export interface EmbeddedAgentCoreDefinition extends EmbeddedAgentCoreStatement {
+    arm: "Cedar" | "Policy";
+}
+/**
+ * Every AgentCore policy definition embedded in a build's emitted output.
+ *
+ * Non-JSON output is skipped rather than reported: most emitted files are not
+ * JSON, and a parse failure here says nothing about whether a statement is
+ * there.
+ */
+export declare function embeddedAgentCoreDefinitions(ctx: PostSynthContext): EmbeddedAgentCoreDefinition[];
+/** Only the language-agnostic arm — the one a `.dw` statement travels in. */
+export declare function embeddedAgentCorePolicyStatements(ctx: PostSynthContext): EmbeddedAgentCoreStatement[];
+//# sourceMappingURL=scan.d.ts.map

package/dist/agentcore/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/agentcore/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAGzE,sEAAsE;AACtE,MAAM,WAAW,0BAA0B;IACzC,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,2BAA4B,SAAQ,0BAA0B;IAC7E,GAAG,EAAE,OAAO,GAAG,QAAQ,CAAC;CACzB;AAgDD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,gBAAgB,GAAG,2BAA2B,EAAE,CAoBjG;AAED,6EAA6E;AAC7E,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,gBAAgB,GAAG,0BAA0B,EAAE,CAErG"}

package/dist/avp/client.d.ts

@@ -14,14 +14,37 @@
  *
  * ## Signing
  *
- * Requests are unsigned, exactly like the aws lexicon's read client. Real AWS
- * rejects them; an emulator with an endpoint override does not. This is
- * therefore an emulator-and-test transport today, and the honest consequence is
- * encoded in {@link credentialsAvailable}: with no credentials and no endpoint
- * override, the observation reports every entity NOT-OBSERVED with
- * `no-credentials` rather than issuing a request that will fail. The signed
- * path lands when SigV4 lands in `lexicons/aws/src/api/read-client.ts`, which
- * is where it belongs — one implementation, not two.
+ * SigV4 lives once, in `lexicons/aws/src/api/sigv4.ts` (#1686). This module
+ * does not import it. A cedar → aws dependency edge would make the vendor-
+ * neutral lexicon unbuildable without the AWS one, which is the same rule that
+ * kept `src/avp/embed.ts` free of the aws lexicon: the seam is the data shape.
+ * So the signer arrives as a function on {@link AvpClientOptions}, typed here
+ * structurally against what the aws lexicon exports, and a project holding both
+ * lexicons wires them in one line:
+ *
+ * ```ts
+ * import { signRequest } from "@intentius/chant-lexicon-aws";
+ * import { describeAvpResources } from "@intentius/chant-lexicon-cedar";
+ *
+ * await describeAvpResources({
+ *   environment,
+ *   entityNames,
+ *   entities,
+ *   client: { region: "us-west-2", signer: signRequest },
+ * });
+ * ```
+ *
+ * Three cases go out unsigned, byte for byte as they did before signing
+ * existed — the credential scope of {@link regionScope} and nothing more:
+ *
+ *   - **No signer.** The default, and the reason `credentialsAvailable` still
+ *     gates the readers: a caller that wires nothing in is still an
+ *     emulator-and-test transport, and real AWS still rejects it.
+ *   - **No credentials.** A signer with nothing to sign with does not run.
+ *   - **An endpoint override.** An emulator does not verify signatures, and
+ *     signing against one would make every local lane need credentials to read
+ *     what it just deployed. `signEndpointOverride` opts back in for an
+ *     override that *is* real AWS — a VPC endpoint, a signing proxy.
  */
 /** Injectable HTTP, mirroring `AwsReadHttp` in the aws lexicon so tests avoid the network. */
 export type AvpHttp = (url: string, init: {
@@ -40,6 +63,38 @@ export declare class AvpReadError extends Error {
     /** The service's own error code (`ResourceNotFoundException`, `AccessDeniedException`, …). */
     code?: string | undefined);
 }
+/**
+ * A resolved credential set — the aws lexicon's `AwsCredentials`, restated so
+ * that this file compiles without it. `sessionToken` is present for STS/role
+ * credentials.
+ */
+export interface AvpCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+/** A function that decides what to sign with; `undefined` means "nothing to". */
+export type AvpCredentialResolver = () => AvpCredentials | undefined;
+/** Either literal credentials or a resolver for them. */
+export type AvpCredentialSource = AvpCredentials | AvpCredentialResolver;
+/** One request to sign — the aws lexicon's `SigV4Request`, restated. */
+export interface AvpSignableRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+    service: string;
+    region: string;
+    credentials: AvpCredentials;
+    /** Signing clock. Injected by tests; otherwise now. */
+    now?: Date;
+}
+/**
+ * The signing seam. `signRequest` from `@intentius/chant-lexicon-aws` satisfies
+ * this as it stands — the shapes above are its own, restated rather than
+ * imported, so cedar keeps no edge to the aws lexicon.
+ */
+export type AvpSigner = (request: AvpSignableRequest) => Record<string, string>;
 export interface AvpClientOptions {
     /** Endpoint override (an emulator, or a VPC endpoint). Omit for real AWS hosts. */
     endpoint?: string;
@@ -49,7 +104,29 @@ export interface AvpClientOptions {
     signal?: AbortSignal;
     /** Environment to read credentials from. Defaults to `process.env`; injectable for tests. */
     env?: Record<string, string | undefined>;
+    /** SigV4, injected. Omitted, every request goes out unsigned as it always did. */
+    signer?: AvpSigner;
+    /**
+     * What to sign with: literal credentials, or a resolver that decides. Omitted,
+     * the environment answers; when it has nothing, no signature is produced.
+     */
+    credentials?: AvpCredentialSource;
+    /** Sign even against an endpoint override — for an override that is real AWS. */
+    signEndpointOverride?: boolean;
+    /** Signing clock. Injected by tests so a signature is reproducible. */
+    now?: Date;
 }
+/**
+ * Credentials for a request: explicit → environment → absent.
+ *
+ * The same rule the aws lexicon's `resolveCredentials` applies, and for the same
+ * reasons: an injected resolver is authoritative and its refusal is not
+ * second-guessed against the environment, and a half-set environment is absent
+ * rather than a signature that cannot verify. A caller with a profile file, IMDS
+ * or a container credential endpoint resolves those itself and passes the result
+ * in — that is what the resolver form is for.
+ */
+export declare function resolveAvpCredentials(source?: AvpCredentialSource, env?: Record<string, string | undefined>): AvpCredentials | undefined;
 /** Service host for AVP, honouring an endpoint override. */
 export declare function avpUrl(endpoint?: string, region?: string): string;
 /**

package/dist/avp/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/avp/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,8FAA8F;IACrF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAUnG;AAyBD,iFAAiF;AACjF,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8BlC;AAID,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQjC;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnG;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/avp/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAMH,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,mFAAmF;AACnF,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,8FAA8F;IACrF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,GAAG,MAAM,cAAc,GAAG,SAAS,CAAC;AAErE,yDAAyD;AACzD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEzE,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uDAAuD;IACvD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,kBAAkB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,kFAAkF;IAClF,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,CAAC,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,cAAc,GAAG,SAAS,CAW5B;AAED,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAEzE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,OAAO,CAUnG;AAgED,iFAAiF;AACjF,wBAAsB,OAAO,CAC3B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA4BlC;AAID,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAgBD,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgB7B;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAS1B;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,cAAc,CAAC,CASzB;AAED,6EAA6E;AAC7E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQjC;AAID,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGvD;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnG;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAE3E"}