@intentius/chant-lexicon-cedar 0.56.0 → 0.58.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/dogwood/replay-activity.d.ts +3 -4
- package/dist/dogwood/replay-activity.d.ts.map +1 -1
- package/dist/dogwood/replay-op.d.ts +21 -21
- package/dist/dogwood/replay-op.d.ts.map +1 -1
- package/dist/integrity.json +3 -3
- package/dist/lint/audit-catalog.d.ts.map +1 -1
- package/dist/lint/audit-lineage.d.ts +10 -0
- package/dist/lint/audit-lineage.d.ts.map +1 -0
- package/dist/manifest.json +1 -1
- package/dist/op/activities/index.d.ts +2 -2
- package/dist/skills/chant-cedar-dogwood.md +5 -2
- package/package.json +2 -2
- package/src/dogwood/replay-activity.test.ts +1 -1
- package/src/dogwood/replay-activity.ts +3 -4
- package/src/dogwood/replay-op.ts +27 -26
- package/src/index.ts +2 -2
- package/src/lint/audit-catalog.ts +5 -1
- package/src/lint/audit-lineage.ts +32 -0
- package/src/op/activities/index.ts +2 -2
- package/src/skills/chant-cedar-dogwood.md +5 -2
|
@@ -5,9 +5,8 @@
|
|
|
5
5
|
* Contributed the way the fly lexicon contributes `flyApply`: a plain exported
|
|
6
6
|
* async function taking one args object, re-exported from
|
|
7
7
|
* `src/op/activities/index.ts`, resolved **by name** by core's activity
|
|
8
|
-
* registry when a project lists the `cedar` lexicon.
|
|
9
|
-
*
|
|
10
|
-
* runs it as-is, and a Temporal worker registers the same function.
|
|
8
|
+
* registry when a project lists the `cedar` lexicon. It imports no runtime of
|
|
9
|
+
* its own, so the local executor calls it as-is.
|
|
11
10
|
*
|
|
12
11
|
* What it does: takes a policy bundle (inline text or paths), an event trace
|
|
13
12
|
* (typed events, inline text, or a path) and a set of expectations, runs
|
|
@@ -80,7 +79,7 @@ export interface PolicyReplayReport {
|
|
|
80
79
|
/** Every decision point, in stream order. */
|
|
81
80
|
readonly verdicts: readonly DogwoodVerdict[];
|
|
82
81
|
readonly divergences: readonly ReplayDivergence[];
|
|
83
|
-
/** Divergence count — the number
|
|
82
|
+
/** Divergence count — the number an outcome attribute or a gate reads. */
|
|
84
83
|
readonly findings: number;
|
|
85
84
|
/** Trace weaknesses found by `auditTrace`, when typed events were supplied. */
|
|
86
85
|
readonly traceIssues: readonly TraceIssue[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"replay-activity.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-activity.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"replay-activity.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-activity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,EAA2B,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpF,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEnE,uDAAuD;AACvD,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClD,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,wEAAwE;IACxE,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,wBAAwB;IACxB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IAExB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC,CA+C9E;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,gBAAgB,EAAE,CA+GpB;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAAG,MAAM,CAqCvF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwCxF;AAED,wCAAwC;AACxC,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,iDAAiD;IACjD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiCtG"}
|
|
@@ -8,32 +8,28 @@
|
|
|
8
8
|
* against last week's traffic can decide differently against this week's, and
|
|
9
9
|
* the deterministic build cannot see that.
|
|
10
10
|
*
|
|
11
|
-
* ## Packaging: the composite ships from cedar
|
|
11
|
+
* ## Packaging: the composite ships from cedar
|
|
12
12
|
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
* reason to reach across — it imports `@intentius/chant/op` only, exactly as
|
|
17
|
-
* the fly lexicon's `flyDeploy` composite does. cedar therefore keeps zero
|
|
18
|
-
* runtime dependency on `@intentius/chant-lexicon-temporal`.
|
|
13
|
+
* It hands back an Op and nothing else, so it imports `@intentius/chant/op`
|
|
14
|
+
* only, exactly as the fly lexicon's `flyDeploy` composite does. cedar keeps
|
|
15
|
+
* zero runtime dependency on any hosting lexicon.
|
|
19
16
|
*
|
|
20
|
-
* The
|
|
21
|
-
*
|
|
17
|
+
* The cadence is a `schedule` on the Op itself (#2120) — runtime-neutral data
|
|
18
|
+
* the reader decides what to do with, the same field `WatchOp` and
|
|
19
|
+
* `ConvergeOp` set:
|
|
22
20
|
*
|
|
23
21
|
* ```ts
|
|
24
|
-
*
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
* scheduleId: "policy-replay-schedule",
|
|
29
|
-
* spec: { cronExpressions: ["0 6 * * *"] },
|
|
30
|
-
* action: { workflowType: "policyReplayWorkflow", taskQueue: "policy-replay" },
|
|
22
|
+
* export const { op } = PolicyReplayOp({
|
|
23
|
+
* name: "policy-replay",
|
|
24
|
+
* schedule: "0 6 * * *",
|
|
25
|
+
* …
|
|
31
26
|
* });
|
|
32
27
|
* ```
|
|
33
28
|
*
|
|
34
|
-
*
|
|
35
|
-
*
|
|
36
|
-
*
|
|
29
|
+
* `chant operator` ticks it locally, the github/gitlab/forgejo lexicons render
|
|
30
|
+
* it as a CI cron, a hosting lexicon hands it to its own scheduler, and the
|
|
31
|
+
* one-shot executor behind `chant run policy-replay` ignores it.
|
|
32
|
+
* `examples/policy-replay` is the worked recipe.
|
|
37
33
|
*
|
|
38
34
|
* ## Phases
|
|
39
35
|
*
|
|
@@ -99,8 +95,6 @@ export interface PolicyReplayOpConfig {
|
|
|
99
95
|
/** Op name (kebab-case) — the `chant run <name>` target and the task queue base. */
|
|
100
96
|
name: string;
|
|
101
97
|
overview?: string;
|
|
102
|
-
/** Defaults to {@link name}. */
|
|
103
|
-
taskQueue?: string;
|
|
104
98
|
/**
|
|
105
99
|
* Directory every relative path below resolves against, and the one the
|
|
106
100
|
* build script runs in. Default `.`.
|
|
@@ -139,6 +133,12 @@ export interface PolicyReplayOpConfig {
|
|
|
139
133
|
reportPath?: string;
|
|
140
134
|
/** Explicit `dogwood` binary path, for a runner that knows where it built one. */
|
|
141
135
|
binary?: string;
|
|
136
|
+
/**
|
|
137
|
+
* Cron expression. When set, it lands on the Op as `schedule` — the cadence
|
|
138
|
+
* a reader picks up (`chant operator`'s tick, a CI cron, a hosting lexicon's
|
|
139
|
+
* own scheduler). The one-shot `chant run` path ignores it.
|
|
140
|
+
*/
|
|
141
|
+
schedule?: string;
|
|
142
142
|
}
|
|
143
143
|
/** What {@link PolicyReplayOp} hands back. */
|
|
144
144
|
export interface PolicyReplayOpResources {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"replay-op.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-op.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"replay-op.d.ts","sourceRoot":"","sources":["../../src/dogwood/replay-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,6BAA6B,CAAC;AAErE,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,qBAAqB,KAAG,YAG/D,CAAC;AAEF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;CACnC;AAED,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,GAAI,OAAM,2BAAgC,KAAG,YAGhF,CAAC;AAEF,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAE7B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAElB,gFAAgF;IAChF,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAEtC,uDAAuD;IACvD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,uBAAuB,CA0DpF"}
|
package/dist/integrity.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"algorithm": "sha256",
|
|
3
3
|
"artifacts": {
|
|
4
|
-
"manifest.json": "
|
|
4
|
+
"manifest.json": "f3c5aad2daf99d71f9b698c117f27efb29dcdec7e0387ed567c944d2b700021d",
|
|
5
5
|
"meta.json": "b218779260169a193882aeee76e5ac559588f1682657a001fb0982cffb5843fc",
|
|
6
6
|
"types/index.d.ts": "9e53a1cb3c9ee38f9de2f3c0db9cc28a0b67c3649be410c341e2451b9b0076cd",
|
|
7
7
|
"rules/policy-shape.ts": "1654730d188b7163dbad3051c75a562198a96eda6d36ce35701f2b729bf45194",
|
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
"skills/chant-cedar-authoring.md": "2eaefdc6f0fb1ba1fed980759d693886dbb7f0197f3eab3330fe518937045831",
|
|
29
29
|
"skills/chant-cedar-avp-embedding.md": "1096cc318374dc0683fae289040b089ffc0c7fa029c6b07d4acc19ebcd118b54",
|
|
30
30
|
"skills/chant-cedar-meta-policy.md": "050b310a87196a48c827f1129698e4c6bbcd96dc963782e22bf1a640bbc20a1a",
|
|
31
|
-
"skills/chant-cedar-dogwood.md": "
|
|
31
|
+
"skills/chant-cedar-dogwood.md": "7e52d3f045c1c34e00fdef76014a05483fb9dd58cc41037621a76bc298776d8f"
|
|
32
32
|
},
|
|
33
|
-
"composite": "
|
|
33
|
+
"composite": "599dec20f51679350833ffc75a5fe867d61688d254e2edb0119f9c578ee0b2c2"
|
|
34
34
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,QAAQ,
|
|
1
|
+
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAa,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGxF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAoKtD,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
export declare const cedarAuditLineage: Record<string, Lineage[]>;
|
|
10
|
+
//# sourceMappingURL=audit-lineage.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAsBvD,CAAC"}
|
package/dist/manifest.json
CHANGED
|
@@ -10,8 +10,8 @@
|
|
|
10
10
|
* being registered as activities nobody would ever name in a step.
|
|
11
11
|
*
|
|
12
12
|
* Contributed the `flyApply` way: a plain async function taking one args
|
|
13
|
-
* object,
|
|
14
|
-
*
|
|
13
|
+
* object, depending on no runtime beyond node, so the local executor
|
|
14
|
+
* (`packages/core/src/op/local-executor.ts`) calls it directly.
|
|
15
15
|
*/
|
|
16
16
|
export { dogwoodReplay, dogwoodReplayReport } from "../../dogwood/replay-activity.js";
|
|
17
17
|
export type { DogwoodReplayArgs, DogwoodReplayReportArgs, ExpectedVerdict, PolicyReplayDispatch, PolicyReplayMode, PolicyReplayReport, ReplayDivergence, ReplayExpectation, } from "../../dogwood/replay-activity.js";
|
|
@@ -282,8 +282,11 @@ Three phases — Artifacts (`chantBuild`, skippable with `buildScript: false`),
|
|
|
282
282
|
Replay (`dogwoodReplay`, writes `dist/dogwood-replay.json`), Report
|
|
283
283
|
(`dogwoodReplayReport`, acts on `report | issue | pull-request`).
|
|
284
284
|
`failOnDivergence` defaults to false: an observe-dial Op reports. The composite
|
|
285
|
-
ships from cedar
|
|
286
|
-
|
|
285
|
+
ships from cedar; it imports `@intentius/chant/op` and nothing else. Cadence is
|
|
286
|
+
a `schedule` on the Op itself (#2120): pass `schedule: "0 6 * * *"` and it lands
|
|
287
|
+
as `schedule: { cron, overlap: "skip" }`, which `chant operator` ticks locally
|
|
288
|
+
and the github/gitlab/forgejo lexicons render as a CI cron. The one-shot
|
|
289
|
+
executor behind `chant run` ignores it.
|
|
287
290
|
|
|
288
291
|
Build traces with `dogwood.traceEvent()` rather than by hand. Two traps it
|
|
289
292
|
exists to close, and both are worth naming whenever a user assembles a fixture:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intentius/chant-lexicon-cedar",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.58.0",
|
|
4
4
|
"description": "Cedar lexicon for chant — typed authoring for Cedar authorization policies",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://intentius.io/chant",
|
|
@@ -74,7 +74,7 @@
|
|
|
74
74
|
},
|
|
75
75
|
"peerDependencies": {
|
|
76
76
|
"zod": "^4.3.6",
|
|
77
|
-
"@intentius/chant": "^0.
|
|
77
|
+
"@intentius/chant": "^0.58.0",
|
|
78
78
|
"typescript": "^5.9.3"
|
|
79
79
|
}
|
|
80
80
|
}
|
|
@@ -410,7 +410,7 @@ describe("PolicyReplayOp", () => {
|
|
|
410
410
|
expect(report.steps[0].fn).toBe("dogwoodReplayReport");
|
|
411
411
|
});
|
|
412
412
|
|
|
413
|
-
test("the divergence count rides out as a
|
|
413
|
+
test("the divergence count rides out as a run outcome", () => {
|
|
414
414
|
const { op } = PolicyReplayOp({ name: "policy-replay", tracePath: "trace/t.log" });
|
|
415
415
|
expect(phasesOf(op)[1].steps[0].outcomeAttribute).toEqual({ name: "Divergences", from: "findings" });
|
|
416
416
|
});
|
|
@@ -5,9 +5,8 @@
|
|
|
5
5
|
* Contributed the way the fly lexicon contributes `flyApply`: a plain exported
|
|
6
6
|
* async function taking one args object, re-exported from
|
|
7
7
|
* `src/op/activities/index.ts`, resolved **by name** by core's activity
|
|
8
|
-
* registry when a project lists the `cedar` lexicon.
|
|
9
|
-
*
|
|
10
|
-
* runs it as-is, and a Temporal worker registers the same function.
|
|
8
|
+
* registry when a project lists the `cedar` lexicon. It imports no runtime of
|
|
9
|
+
* its own, so the local executor calls it as-is.
|
|
11
10
|
*
|
|
12
11
|
* What it does: takes a policy bundle (inline text or paths), an event trace
|
|
13
12
|
* (typed events, inline text, or a path) and a set of expectations, runs
|
|
@@ -95,7 +94,7 @@ export interface PolicyReplayReport {
|
|
|
95
94
|
/** Every decision point, in stream order. */
|
|
96
95
|
readonly verdicts: readonly DogwoodVerdict[];
|
|
97
96
|
readonly divergences: readonly ReplayDivergence[];
|
|
98
|
-
/** Divergence count — the number
|
|
97
|
+
/** Divergence count — the number an outcome attribute or a gate reads. */
|
|
99
98
|
readonly findings: number;
|
|
100
99
|
/** Trace weaknesses found by `auditTrace`, when typed events were supplied. */
|
|
101
100
|
readonly traceIssues: readonly TraceIssue[];
|
package/src/dogwood/replay-op.ts
CHANGED
|
@@ -8,32 +8,28 @@
|
|
|
8
8
|
* against last week's traffic can decide differently against this week's, and
|
|
9
9
|
* the deterministic build cannot see that.
|
|
10
10
|
*
|
|
11
|
-
* ## Packaging: the composite ships from cedar
|
|
11
|
+
* ## Packaging: the composite ships from cedar
|
|
12
12
|
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
* reason to reach across — it imports `@intentius/chant/op` only, exactly as
|
|
17
|
-
* the fly lexicon's `flyDeploy` composite does. cedar therefore keeps zero
|
|
18
|
-
* runtime dependency on `@intentius/chant-lexicon-temporal`.
|
|
13
|
+
* It hands back an Op and nothing else, so it imports `@intentius/chant/op`
|
|
14
|
+
* only, exactly as the fly lexicon's `flyDeploy` composite does. cedar keeps
|
|
15
|
+
* zero runtime dependency on any hosting lexicon.
|
|
19
16
|
*
|
|
20
|
-
* The
|
|
21
|
-
*
|
|
17
|
+
* The cadence is a `schedule` on the Op itself (#2120) — runtime-neutral data
|
|
18
|
+
* the reader decides what to do with, the same field `WatchOp` and
|
|
19
|
+
* `ConvergeOp` set:
|
|
22
20
|
*
|
|
23
21
|
* ```ts
|
|
24
|
-
*
|
|
25
|
-
*
|
|
26
|
-
*
|
|
27
|
-
*
|
|
28
|
-
* scheduleId: "policy-replay-schedule",
|
|
29
|
-
* spec: { cronExpressions: ["0 6 * * *"] },
|
|
30
|
-
* action: { workflowType: "policyReplayWorkflow", taskQueue: "policy-replay" },
|
|
22
|
+
* export const { op } = PolicyReplayOp({
|
|
23
|
+
* name: "policy-replay",
|
|
24
|
+
* schedule: "0 6 * * *",
|
|
25
|
+
* …
|
|
31
26
|
* });
|
|
32
27
|
* ```
|
|
33
28
|
*
|
|
34
|
-
*
|
|
35
|
-
*
|
|
36
|
-
*
|
|
29
|
+
* `chant operator` ticks it locally, the github/gitlab/forgejo lexicons render
|
|
30
|
+
* it as a CI cron, a hosting lexicon hands it to its own scheduler, and the
|
|
31
|
+
* one-shot executor behind `chant run policy-replay` ignores it.
|
|
32
|
+
* `examples/policy-replay` is the worked recipe.
|
|
37
33
|
*
|
|
38
34
|
* ## Phases
|
|
39
35
|
*
|
|
@@ -112,9 +108,6 @@ export interface PolicyReplayOpConfig {
|
|
|
112
108
|
/** Op name (kebab-case) — the `chant run <name>` target and the task queue base. */
|
|
113
109
|
name: string;
|
|
114
110
|
overview?: string;
|
|
115
|
-
/** Defaults to {@link name}. */
|
|
116
|
-
taskQueue?: string;
|
|
117
|
-
|
|
118
111
|
/**
|
|
119
112
|
* Directory every relative path below resolves against, and the one the
|
|
120
113
|
* build script runs in. Default `.`.
|
|
@@ -158,6 +151,13 @@ export interface PolicyReplayOpConfig {
|
|
|
158
151
|
reportPath?: string;
|
|
159
152
|
/** Explicit `dogwood` binary path, for a runner that knows where it built one. */
|
|
160
153
|
binary?: string;
|
|
154
|
+
|
|
155
|
+
/**
|
|
156
|
+
* Cron expression. When set, it lands on the Op as `schedule` — the cadence
|
|
157
|
+
* a reader picks up (`chant operator`'s tick, a CI cron, a hosting lexicon's
|
|
158
|
+
* own scheduler). The one-shot `chant run` path ignores it.
|
|
159
|
+
*/
|
|
160
|
+
schedule?: string;
|
|
161
161
|
}
|
|
162
162
|
|
|
163
163
|
/** What {@link PolicyReplayOp} hands back. */
|
|
@@ -209,8 +209,9 @@ export function PolicyReplayOp(config: PolicyReplayOpConfig): PolicyReplayOpReso
|
|
|
209
209
|
...(config.binary ? { binary: config.binary } : {}),
|
|
210
210
|
reportPath,
|
|
211
211
|
}),
|
|
212
|
-
// The divergence count as
|
|
213
|
-
// replays that found something
|
|
212
|
+
// The divergence count as the run's `Divergences` outcome on the run
|
|
213
|
+
// ledger, so the replays that found something are readable from the
|
|
214
|
+
// ledger rather than out of a log.
|
|
214
215
|
outcomeAttribute: { name: "Divergences", from: "findings" },
|
|
215
216
|
},
|
|
216
217
|
]),
|
|
@@ -231,11 +232,11 @@ export function PolicyReplayOp(config: PolicyReplayOpConfig): PolicyReplayOpReso
|
|
|
231
232
|
overview:
|
|
232
233
|
config.overview ??
|
|
233
234
|
"Replay the declared dogwood policy set against a recorded event trace and report divergence",
|
|
234
|
-
|
|
235
|
-
searchAttributes: {
|
|
235
|
+
labels: {
|
|
236
236
|
Audit: "true",
|
|
237
237
|
Surface: "cedar-dogwood",
|
|
238
238
|
},
|
|
239
|
+
...(config.schedule ? { schedule: { cron: config.schedule, overlap: "skip" as const } } : {}),
|
|
239
240
|
phases,
|
|
240
241
|
}),
|
|
241
242
|
};
|
package/src/index.ts
CHANGED
|
@@ -115,8 +115,8 @@ export { DOGWOOD_UPSTREAM } from "./dogwood/upstream";
|
|
|
115
115
|
|
|
116
116
|
// The replay Op composite and its typed step builders (#1661). Flat, like
|
|
117
117
|
// fly's `flyDeploy`: an Op factory is what a project's `ops/*.op.ts` names,
|
|
118
|
-
// and it
|
|
119
|
-
//
|
|
118
|
+
// and it depends on no lexicon but this one — see ./dogwood/replay-op.ts for
|
|
119
|
+
// why the composite ships from cedar.
|
|
120
120
|
export {
|
|
121
121
|
DEFAULT_REPLAY_REPORT_PATH,
|
|
122
122
|
PolicyReplayOp,
|
|
@@ -25,7 +25,8 @@
|
|
|
25
25
|
* about it.
|
|
26
26
|
*/
|
|
27
27
|
|
|
28
|
-
import { auditRule, type RuleMeta } from "@intentius/chant/audit/catalog";
|
|
28
|
+
import { auditRule, type RuleMeta, applyLineage } from "@intentius/chant/audit/catalog";
|
|
29
|
+
import { cedarAuditLineage } from "./audit-lineage";
|
|
29
30
|
|
|
30
31
|
export const cedarAuditCatalog: Record<string, RuleMeta> = {
|
|
31
32
|
// ── Pre-synth lint rule ────────────────────────────────────────
|
|
@@ -192,3 +193,6 @@ export const cedarAuditCatalog: Record<string, RuleMeta> = {
|
|
|
192
193
|
{ category: "security" },
|
|
193
194
|
),
|
|
194
195
|
};
|
|
196
|
+
|
|
197
|
+
// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
|
|
198
|
+
applyLineage(cedarAuditCatalog, cedarAuditLineage);
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
|
|
10
|
+
export const cedarAuditLineage: Record<string, Lineage[]> = {
|
|
11
|
+
CEDC001: [
|
|
12
|
+
{ tool: "cedar-docs", rule: "effect", url: "https://docs.cedarpolicy.com/policies/json-format.html#effect", relation: "overlaps" },
|
|
13
|
+
],
|
|
14
|
+
CEDC010: [
|
|
15
|
+
{ tool: "cedar-cli", rule: "check-parse", url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli", relation: "equivalent" },
|
|
16
|
+
],
|
|
17
|
+
CEDC011: [
|
|
18
|
+
{ tool: "cedar-cli", rule: "check-parse", url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli", relation: "overlaps" },
|
|
19
|
+
],
|
|
20
|
+
CEDC012: [
|
|
21
|
+
{ tool: "cedar-policy-crate", rule: "PolicySetError::AlreadyDefined", url: "https://docs.rs/cedar-policy/latest/cedar_policy/enum.PolicySetError.html#variant.AlreadyDefined", relation: "overlaps" },
|
|
22
|
+
],
|
|
23
|
+
CEDE010: [
|
|
24
|
+
{ tool: "cedar-validator", rule: "supported-validation-checks (errors)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "equivalent" },
|
|
25
|
+
],
|
|
26
|
+
CEDE011: [
|
|
27
|
+
{ tool: "cedar-validator", rule: "supported-validation-checks (warnings)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "equivalent" },
|
|
28
|
+
],
|
|
29
|
+
DWDE011: [
|
|
30
|
+
{ tool: "cedar-validator", rule: "supported-validation-checks (errors)", url: "https://docs.cedarpolicy.com/policies/validation.html#supported-validation-checks", relation: "overlaps" },
|
|
31
|
+
],
|
|
32
|
+
};
|
|
@@ -10,8 +10,8 @@
|
|
|
10
10
|
* being registered as activities nobody would ever name in a step.
|
|
11
11
|
*
|
|
12
12
|
* Contributed the `flyApply` way: a plain async function taking one args
|
|
13
|
-
* object,
|
|
14
|
-
*
|
|
13
|
+
* object, depending on no runtime beyond node, so the local executor
|
|
14
|
+
* (`packages/core/src/op/local-executor.ts`) calls it directly.
|
|
15
15
|
*/
|
|
16
16
|
|
|
17
17
|
export { dogwoodReplay, dogwoodReplayReport } from "../../dogwood/replay-activity";
|
|
@@ -282,8 +282,11 @@ Three phases — Artifacts (`chantBuild`, skippable with `buildScript: false`),
|
|
|
282
282
|
Replay (`dogwoodReplay`, writes `dist/dogwood-replay.json`), Report
|
|
283
283
|
(`dogwoodReplayReport`, acts on `report | issue | pull-request`).
|
|
284
284
|
`failOnDivergence` defaults to false: an observe-dial Op reports. The composite
|
|
285
|
-
ships from cedar
|
|
286
|
-
|
|
285
|
+
ships from cedar; it imports `@intentius/chant/op` and nothing else. Cadence is
|
|
286
|
+
a `schedule` on the Op itself (#2120): pass `schedule: "0 6 * * *"` and it lands
|
|
287
|
+
as `schedule: { cron, overlap: "skip" }`, which `chant operator` ticks locally
|
|
288
|
+
and the github/gitlab/forgejo lexicons render as a CI cron. The one-shot
|
|
289
|
+
executor behind `chant run` ignores it.
|
|
287
290
|
|
|
288
291
|
Build traces with `dogwood.traceEvent()` rather than by hand. Two traps it
|
|
289
292
|
exists to close, and both are worth naming whenever a user assembles a fixture:
|