cedar-mcp-server 1.0.0

package/dist/parser/policy-ast.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Shared utilities for walking the PolicyJson AST returned by policyToJson / templateToJson.
+ *
+ * AST shape proven in spike (2026-05-19):
+ *   - principal/action/resource: { op: "All" | "==" | "in", entity?, entities?, slot? }
+ *   - "in" with single entity  → entity key (singular)
+ *   - "in" with multiple       → entities key (plural)
+ *   - conditions: [{ kind: "when"|"unless", body: ExprTree }]
+ *   - ExprTree: operator-as-key encoding ("==", "&&", "||", "has", ".", "Var", "Value")
+ *   - Entity literals in scope: { type, id }
+ *   - Entity literals in conditions: { "Value": { "__entity": { type, id } } }
+ *
+ * like operator shape (proven in spike 2026-05-20):
+ *   - { "like": { "left": Expr, "pattern": PatternElem[] } }
+ *   - PatternElem = "Wildcard" | { Literal: string }
+ *   - CRITICAL: pattern is CHARACTER-LEVEL — "/api/v1/*" produces one {Literal} per char,
+ *     not one {Literal: "/api/v1/"} node. Reconstruct by joining all Literal chars,
+ *     substituting "Wildcard" positions with the desired value.
+ *   - Negated like: { "!": { "arg": { "like": { ... } } } }
+ *   - Cedar wildcard matches any char sequence INCLUDING "/". Depth-limiting works via TWO wildcards:
+ *     "like X/WILDCARD" matches any depth; "like X/WILDCARD/WILDCARD" also matches — negation limits to one segment.
+ */
+import type { PolicyJson, Clause } from "@cedar-policy/cedar-wasm/nodejs";
+export declare function describePrincipal(principal: PolicyJson["principal"]): string;
+export declare function describeAction(action: PolicyJson["action"]): string;
+export declare function describeResource(resource: PolicyJson["resource"]): string;
+export declare function describeCondition(clause: Clause): string;
+export declare function detectPatterns(json: PolicyJson): string[];
+export type PatternElem = "Wildcard" | {
+    Literal: string;
+};
+export interface LikeConstraint {
+    variable: "principal" | "resource" | "context";
+    attr: string;
+    pattern: PatternElem[];
+    negated: boolean;
+}
+/**
+ * Reconstructs a string from a PatternElem array.
+ * Each Wildcard is replaced by wildcardValue.
+ * Pattern is character-level (one Literal node per char) — join them all.
+ */
+export declare function patternToString(pattern: PatternElem[], wildcardValue: string): string;
+/**
+ * Walks condition bodies and extracts all `like` constraints (positive and negated).
+ * Returns constraints keyed by variable.attr so callers can decide which to use.
+ */
+export declare function extractLikeConstraints(conditions: PolicyJson["conditions"]): LikeConstraint[];
+//# sourceMappingURL=policy-ast.d.ts.map

package/dist/parser/policy-ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-ast.d.ts","sourceRoot":"","sources":["../../src/parser/policy-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAQ,MAAM,iCAAiC,CAAC;AAIhF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,CAsB5E;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,MAAM,CAiBnE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,MAAM,CAmBzE;AAID,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIxD;AAuFD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CA0CzD;AA2BD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAIrF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC,GAAG,cAAc,EAAE,CAM7F"}

package/dist/parser/policy-ast.js

@@ -0,0 +1,311 @@
+/**
+ * Shared utilities for walking the PolicyJson AST returned by policyToJson / templateToJson.
+ *
+ * AST shape proven in spike (2026-05-19):
+ *   - principal/action/resource: { op: "All" | "==" | "in", entity?, entities?, slot? }
+ *   - "in" with single entity  → entity key (singular)
+ *   - "in" with multiple       → entities key (plural)
+ *   - conditions: [{ kind: "when"|"unless", body: ExprTree }]
+ *   - ExprTree: operator-as-key encoding ("==", "&&", "||", "has", ".", "Var", "Value")
+ *   - Entity literals in scope: { type, id }
+ *   - Entity literals in conditions: { "Value": { "__entity": { type, id } } }
+ *
+ * like operator shape (proven in spike 2026-05-20):
+ *   - { "like": { "left": Expr, "pattern": PatternElem[] } }
+ *   - PatternElem = "Wildcard" | { Literal: string }
+ *   - CRITICAL: pattern is CHARACTER-LEVEL — "/api/v1/*" produces one {Literal} per char,
+ *     not one {Literal: "/api/v1/"} node. Reconstruct by joining all Literal chars,
+ *     substituting "Wildcard" positions with the desired value.
+ *   - Negated like: { "!": { "arg": { "like": { ... } } } }
+ *   - Cedar wildcard matches any char sequence INCLUDING "/". Depth-limiting works via TWO wildcards:
+ *     "like X/WILDCARD" matches any depth; "like X/WILDCARD/WILDCARD" also matches — negation limits to one segment.
+ */
+// ─── Scope description ───────────────────────────────────────────────────────
+export function describePrincipal(principal) {
+    // Check for slot first — applies to both "==" and "in" ops in templates
+    if ("slot" in principal) {
+        const slot = principal["slot"];
+        return `principal bound to slot ${slot}`;
+    }
+    switch (principal.op) {
+        case "All":
+            return "any principal";
+        case "==": {
+            const e = "entity" in principal ? principal.entity : null;
+            if (e && "type" in e)
+                return `exactly ${e.type}::"${e.id}"`;
+            return "exactly (unknown)";
+        }
+        case "in": {
+            const entities = resolveInEntities(principal);
+            if (entities.length === 1)
+                return `principal in ${formatEntity(entities[0])}`;
+            return `principal in [${entities.map(formatEntity).join(", ")}]`;
+        }
+        default:
+            return "principal (unknown constraint)";
+    }
+}
+export function describeAction(action) {
+    switch (action.op) {
+        case "All":
+            return "any action";
+        case "==": {
+            const e = "entity" in action ? action.entity : null;
+            if (e && "type" in e)
+                return `action ${formatEntity(e)}`;
+            return "exactly (unknown action)";
+        }
+        case "in": {
+            const entities = resolveInEntities(action);
+            if (entities.length === 1)
+                return `action in ${formatEntity(entities[0])}`;
+            return `action in [${entities.map(formatEntity).join(", ")}]`;
+        }
+        default:
+            return "action (unknown constraint)";
+    }
+}
+export function describeResource(resource) {
+    switch (resource.op) {
+        case "All":
+            return "any resource";
+        case "==": {
+            const e = "entity" in resource ? resource.entity : null;
+            const s = "slot" in resource ? resource.slot : null;
+            if (s)
+                return `resource bound to slot ${s}`;
+            if (e && "type" in e)
+                return `exactly ${e.type}::"${e.id}"`;
+            return "exactly (unknown)";
+        }
+        case "in": {
+            const entities = resolveInEntities(resource);
+            if (entities.length === 1)
+                return `resource in ${formatEntity(entities[0])}`;
+            return `resource in [${entities.map(formatEntity).join(", ")}]`;
+        }
+        default:
+            return "resource (unknown constraint)";
+    }
+}
+// ─── Condition rendering ──────────────────────────────────────────────────────
+export function describeCondition(clause) {
+    const kindLabel = clause.kind === "when" ? "WHEN" : "UNLESS";
+    const bodyDesc = describeExpr(clause.body);
+    return `${kindLabel} ${bodyDesc}`;
+}
+function describeExpr(expr) {
+    if (typeof expr !== "object" || expr === null)
+        return String(expr);
+    // Var node: { "Var": "principal" | "action" | "resource" | "context" }
+    if ("Var" in expr)
+        return String(expr["Var"]);
+    // Value node: { "Value": <cedar-value> }
+    if ("Value" in expr)
+        return formatValue(expr["Value"]);
+    // Attribute access: { ".": { left, attr } }
+    if ("." in expr) {
+        const node = expr["."];
+        return `${describeExpr(node.left)}.${node.attr}`;
+    }
+    // Equality: { "==": { left, right } }
+    if ("==" in expr) {
+        const node = expr["=="];
+        return `${describeExpr(node.left)} == ${describeExpr(node.right)}`;
+    }
+    // Inequality
+    if ("!=" in expr) {
+        const node = expr["!="];
+        return `${describeExpr(node.left)} != ${describeExpr(node.right)}`;
+    }
+    // Logical AND: { "&&": { left, right } }
+    if ("&&" in expr) {
+        const node = expr["&&"];
+        return `${describeExpr(node.left)} AND ${describeExpr(node.right)}`;
+    }
+    // Logical OR: { "||": { left, right } }
+    if ("||" in expr) {
+        const node = expr["||"];
+        return `(${describeExpr(node.left)} OR ${describeExpr(node.right)})`;
+    }
+    // Has (optional attribute check): { "has": { left, attr } }
+    if ("has" in expr) {
+        const node = expr["has"];
+        return `${describeExpr(node.left)} has '${node.attr}'`;
+    }
+    // In (membership): { "in": { left, right } }
+    if ("in" in expr) {
+        const node = expr["in"];
+        return `${describeExpr(node.left)} in ${describeExpr(node.right)}`;
+    }
+    // Set literal: { "Set": Expr[] }
+    if ("Set" in expr) {
+        const items = expr["Set"];
+        return `[${items.map(describeExpr).join(", ")}]`;
+    }
+    // Negation: { "!": { arg } }
+    if ("!" in expr) {
+        const node = expr["!"];
+        return `NOT(${describeExpr(node.arg)})`;
+    }
+    // like: { "like": { left: Expr, pattern: PatternElem[] } }
+    // Reconstruct pattern with * for wildcards so it reads as Cedar syntax
+    if ("like" in expr) {
+        const node = expr["like"];
+        const patternStr = patternToString(node.pattern, "*");
+        return `${describeExpr(node.left)} like "${patternStr}"`;
+    }
+    // contains() call appears as an ExtFuncCall: { "contains": [left, right] }
+    // ExtFuncCall is {} & Record<string, Expr[]> — operator is the key, value is args array
+    const keys = Object.keys(expr);
+    if (keys.length === 1 && Array.isArray(expr[keys[0]])) {
+        const fn = keys[0];
+        const args = expr[fn];
+        return `${describeExpr(args[0])}.${fn}(${args.slice(1).map(describeExpr).join(", ")})`;
+    }
+    return "complex condition";
+}
+// ─── Pattern detection ────────────────────────────────────────────────────────
+export function detectPatterns(json) {
+    const patterns = [];
+    if (json.effect === "forbid")
+        patterns.push("forbid_policy");
+    // Principal scope patterns
+    const principalHasSlot = "slot" in json.principal;
+    if (principalHasSlot) {
+        patterns.push("template_policy", "slot_principal");
+    }
+    else if (json.principal.op === "in") {
+        patterns.push("role_based_access");
+    }
+    if (json.principal.op === "All")
+        patterns.push("any_principal");
+    // Action scope patterns
+    if (json.action.op === "All")
+        patterns.push("unrestricted_action");
+    // Resource scope patterns
+    if (json.resource.op === "All")
+        patterns.push("unrestricted_resource");
+    if (json.resource.op === "==" && "slot" in json.resource) {
+        if (!patterns.includes("template_policy"))
+            patterns.push("template_policy");
+        patterns.push("slot_resource");
+    }
+    // Condition patterns
+    const allConditionText = json.conditions.map((c) => JSON.stringify(c)).join(" ");
+    if (json.conditions.some((c) => c.kind === "unless"))
+        patterns.push("role_exemption");
+    if (allConditionText.includes('"has"'))
+        patterns.push("optional_attribute_guard");
+    if (allConditionText.includes("contains"))
+        patterns.push("attribute_containment_check");
+    // Name-based identity: principal.name == "..."
+    if (allConditionText.includes('"name"') && allConditionText.includes('"Var":"principal"')) {
+        patterns.push("name_based_identity");
+    }
+    // Attribute-based conditions (when clause present and non-trivial)
+    if (json.conditions.length > 0 && !patterns.includes("role_exemption")) {
+        patterns.push("attribute_condition");
+    }
+    return [...new Set(patterns)];
+}
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+/** Handles the entity vs entities asymmetry from policyToJson */
+function resolveInEntities(constraint) {
+    if ("entities" in constraint && Array.isArray(constraint["entities"])) {
+        return constraint["entities"];
+    }
+    if ("entity" in constraint && constraint["entity"]) {
+        return [constraint["entity"]];
+    }
+    return [];
+}
+function formatEntity(e) {
+    if (e && typeof e === "object" && "type" in e && "id" in e) {
+        const entity = e;
+        return `${entity.type}::"${entity.id}"`;
+    }
+    return JSON.stringify(e);
+}
+/**
+ * Reconstructs a string from a PatternElem array.
+ * Each Wildcard is replaced by wildcardValue.
+ * Pattern is character-level (one Literal node per char) — join them all.
+ */
+export function patternToString(pattern, wildcardValue) {
+    return pattern
+        .map((e) => (e === "Wildcard" ? wildcardValue : e.Literal))
+        .join("");
+}
+/**
+ * Walks condition bodies and extracts all `like` constraints (positive and negated).
+ * Returns constraints keyed by variable.attr so callers can decide which to use.
+ */
+export function extractLikeConstraints(conditions) {
+    const result = [];
+    for (const clause of conditions) {
+        walkLikeExpr(clause.body, false, result);
+    }
+    return result;
+}
+function walkLikeExpr(expr, insideNot, acc) {
+    if (typeof expr !== "object" || expr === null)
+        return;
+    const e = expr;
+    if ("&&" in e || "||" in e) {
+        const key = "&&" in e ? "&&" : "||";
+        const node = e[key];
+        walkLikeExpr(node.left, insideNot, acc);
+        walkLikeExpr(node.right, insideNot, acc);
+        return;
+    }
+    if ("!" in e) {
+        const node = e["!"];
+        walkLikeExpr(node.arg, !insideNot, acc);
+        return;
+    }
+    if ("like" in e) {
+        const node = e["like"];
+        const attrAccess = extractAttrFromLike(node.left);
+        if (attrAccess) {
+            acc.push({
+                variable: attrAccess.variable,
+                attr: attrAccess.attr,
+                pattern: node.pattern,
+                negated: insideNot,
+            });
+        }
+        return;
+    }
+}
+function extractAttrFromLike(expr) {
+    if (typeof expr !== "object" || expr === null)
+        return null;
+    const e = expr;
+    if ("." in e) {
+        const node = e["."];
+        const v = node.left?.["Var"];
+        if (v === "principal" || v === "resource" || v === "context") {
+            return { variable: v, attr: node.attr };
+        }
+    }
+    return null;
+}
+function formatValue(v) {
+    if (v === null)
+        return "null";
+    if (typeof v === "string")
+        return `"${v}"`;
+    if (typeof v === "boolean" || typeof v === "number")
+        return String(v);
+    // Entity literal inside condition body: { __entity: { type, id } }
+    if (typeof v === "object" && v !== null && "__entity" in v) {
+        const entity = v["__entity"];
+        return formatEntity(entity);
+    }
+    if (Array.isArray(v))
+        return `[${v.map(formatValue).join(", ")}]`;
+    return JSON.stringify(v);
+}
+//# sourceMappingURL=policy-ast.js.map

package/dist/parser/policy-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-ast.js","sourceRoot":"","sources":["../../src/parser/policy-ast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB,CAAC,SAAkC;IAClE,wEAAwE;IACxE,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,GAAI,SAAqC,CAAC,MAAM,CAAW,CAAC;QACtE,OAAO,2BAA2B,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC;QACzB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5D,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,gBAAgB,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC/E,OAAO,iBAAiB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnE,CAAC;QACD;YACE,OAAO,gCAAgC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,QAAQ,MAAM,CAAC,EAAE,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,YAAY,CAAC;QACtB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,CAAC,GAAG,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACpD,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC;gBAAE,OAAO,UAAU,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,aAAa,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC5E,OAAO,cAAc,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChE,CAAC;QACD;YACE,OAAO,6BAA6B,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgC;IAC/D,QAAQ,QAAQ,CAAC,EAAE,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,OAAO,cAAc,CAAC;QACxB,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,CAAC,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,MAAM,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACpD,IAAI,CAAC;gBAAE,OAAO,0BAA0B,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC;gBAAE,OAAO,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5D,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,eAAe,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAC9E,OAAO,gBAAgB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAClE,CAAC;QACD;YACE,OAAO,+BAA+B,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAU;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IAEnE,uEAAuE;IACvE,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,MAAM,CAAE,IAAgC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE3E,yCAAyC;IACzC,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,WAAW,CAAE,IAAgC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpF,4CAA4C;IAC5C,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,GAAI,IAAgC,CAAC,GAAG,CAAiC,CAAC;QACpF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED,sCAAsC;IACtC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAgC,CAAC;QACpF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,aAAa;IACb,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAgC,CAAC;QACpF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAgC,CAAC;QACpF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,wCAAwC;IACxC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAgC,CAAC;QACpF,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;IACvE,CAAC;IAED,4DAA4D;IAC5D,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,GAAI,IAAgC,CAAC,KAAK,CAAiC,CAAC;QACtF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC;IACzD,CAAC;IAED,6CAA6C;IAC7C,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAI,IAAgC,CAAC,IAAI,CAAgC,CAAC;QACpF,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,iCAAiC;IACjC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAI,IAAgC,CAAC,KAAK,CAAW,CAAC;QACjE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACnD,CAAC;IAED,6BAA6B;IAC7B,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,GAAI,IAAgC,CAAC,GAAG,CAAkB,CAAC;QACrE,OAAO,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,CAAC;IAED,2DAA2D;IAC3D,uEAAuE;IACvE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAI,IAAgC,CAAC,MAAM,CAA2C,CAAC;QACjG,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,GAAG,CAAC;IAC3D,CAAC;IAED,2EAA2E;IAC3E,wFAAwF;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,IAAI,GAAI,IAAgC,CAAC,EAAE,CAAW,CAAC;QAC7D,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC1F,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE7D,2BAA2B;IAC3B,MAAM,gBAAgB,GAAG,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;IAClD,IAAI,gBAAgB,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAEhE,wBAAwB;IACxB,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAEnE,0BAA0B;IAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5E,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IAED,qBAAqB;IACrB,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEjF,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtF,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClF,IAAI,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAExF,+CAA+C;IAC/C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1F,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;IAED,mEAAmE;IACnE,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,iFAAiF;AAEjF,iEAAiE;AACjE,SAAS,iBAAiB,CACxB,UAAmC;IAEnC,IAAI,UAAU,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,UAAU,CAAwC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,IAAI,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAiC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,CAAyC;IAC7D,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,CAAiC,CAAC;QACjD,OAAO,GAAG,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE,aAAqB;IAC3E,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAE,CAAyB,CAAC,OAAO,CAAC,CAAC;SACnF,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAoC;IACzE,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,SAAkB,EAAE,GAAqB;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO;IACtD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAE1C,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAsC,CAAC;QACzD,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAqB,CAAC;QACxC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAA8C,CAAC;QACpE,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,SAAS;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAa;IAEb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAoC,CAAC;QACvD,MAAM,CAAC,GAAI,IAAI,CAAC,IAAgC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,CAAyC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,mEAAmE;IACnE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAI,CAA6B,CAAC,UAAU,CAAiC,CAAC;QAC1F,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAClE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}

package/dist/prompts/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * MCP Prompt definitions for cedar-mcp-server.
+ *
+ * Registration in src/server.ts:
+ *   import { PROMPT_DEFINITIONS } from "./prompts/index.js";
+ *   for (const p of PROMPT_DEFINITIONS) {
+ *     server.prompt(p.name, p.description, p.argsSchema, p.handler);
+ *   }
+ *
+ * Each PromptDefinition is built via definePrompt(), which captures the Zod
+ * raw shape generically so TypeScript preserves the concrete arg types through
+ * the handler. The array is typed as PromptDefinition<ZodRawShape> for the
+ * export; the SDK's server.prompt() overload accepts the same shape.
+ */
+import { z } from "zod";
+import type { GetPromptResult } from "@modelcontextprotocol/sdk/types.js";
+import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
+import type { ServerRequest, ServerNotification } from "@modelcontextprotocol/sdk/types.js";
+type ZodRawShape = Record<string, z.ZodTypeAny>;
+type ShapeOutput<S extends ZodRawShape> = {
+    [K in keyof S]: z.infer<S[K]>;
+};
+type PromptExtra = RequestHandlerExtra<ServerRequest, ServerNotification>;
+/**
+ * PromptDefinition is intentionally generic so handler arg types are preserved
+ * internally. At the export boundary the array is cast to the widened union
+ * via definePrompt() which uses `as unknown as` once, in one place.
+ */
+export interface PromptDefinition<Args extends ZodRawShape = ZodRawShape> {
+    name: string;
+    description: string;
+    argsSchema: Args;
+    handler: (args: ShapeOutput<Args>, extra: PromptExtra) => GetPromptResult | Promise<GetPromptResult>;
+}
+type AnyPromptDefinition = PromptDefinition<any>;
+export declare const PROMPT_DEFINITIONS: AnyPromptDefinition[];
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/prompts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE5F,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;AAChD,KAAK,WAAW,CAAC,CAAC,SAAS,WAAW,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAC5E,KAAK,WAAW,GAAG,mBAAmB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,WAAW,GAAG,WAAW;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,KAAK,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACtG;AAGD,KAAK,mBAAmB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;AA+KjD,eAAO,MAAM,kBAAkB,EAAE,mBAAmB,EAInD,CAAC"}

package/dist/prompts/index.js

@@ -0,0 +1,172 @@
+/**
+ * MCP Prompt definitions for cedar-mcp-server.
+ *
+ * Registration in src/server.ts:
+ *   import { PROMPT_DEFINITIONS } from "./prompts/index.js";
+ *   for (const p of PROMPT_DEFINITIONS) {
+ *     server.prompt(p.name, p.description, p.argsSchema, p.handler);
+ *   }
+ *
+ * Each PromptDefinition is built via definePrompt(), which captures the Zod
+ * raw shape generically so TypeScript preserves the concrete arg types through
+ * the handler. The array is typed as PromptDefinition<ZodRawShape> for the
+ * export; the SDK's server.prompt() overload accepts the same shape.
+ */
+import { z } from "zod";
+function definePrompt(def) {
+    return def;
+}
+// ---------------------------------------------------------------------------
+// 1. cedar-review-policy-diff
+//
+// UX assumption: the user has two named policy stores ("blue" = production,
+// "green" = candidate) and wants a structured review before promoting. They
+// expect the prompt to drive all Cedar tool calls and produce a clear verdict.
+//
+// Falsifiability check: would this be useless? Yes, if it skipped the schema
+// diff step. A promoter who misses schema diff will hit breaking changes only
+// at query time. Fixed: schema diff is an explicit step with BREAKING/
+// NON-BREAKING classification.
+// ---------------------------------------------------------------------------
+const reviewPolicyDiff = definePrompt({
+    name: "cedar-review-policy-diff",
+    description: "Drive a structured Cedar policy store promotion review: diff policies, diff schema, summarize breaking risk, and produce a go/no-go recommendation.",
+    argsSchema: {
+        blue_store: z.string().describe("Name of the baseline (production) policy store"),
+        green_store: z.string().describe("Name of the candidate policy store to review"),
+        focus: z
+            .string()
+            .optional()
+            .describe("Optional: narrows review attention, e.g. 'AVP immutability' or 'forbid rules only'"),
+    },
+    handler: (args) => {
+        const focusNote = args.focus
+            ? `\n\nFocus area for this review: ${args.focus}. Apply extra scrutiny to anything touching that area.`
+            : "";
+        const text = `You are reviewing a Cedar policy store promotion from "${args.blue_store}" (baseline) to "${args.green_store}" (candidate).` +
+            `${focusNote}` +
+            `\n\nWork through the following steps in order.\n\n` +
+            `Step 1: Structural diff.\n` +
+            `Call cedar_diff_policy_stores with blue="${args.blue_store}" and green="${args.green_store}". ` +
+            `List every added, removed, and modified policy. Note the policy IDs and whether each change is additive or restrictive.\n\n` +
+            `Step 2: Schema diff.\n` +
+            `Call cedar_diff_schema with schemas from both stores (cedar://schema/${args.blue_store} and cedar://schema/${args.green_store}). ` +
+            `If the diff is non-trivial (any entity type added, removed, or attribute changed), classify each change as BREAKING or NON-BREAKING. ` +
+            `A schema change is BREAKING if existing valid Cedar requests could become invalid or if attribute types narrow.\n\n` +
+            `Step 3: Behavioral drift summary.\n` +
+            `If behavioral_test_requests are available in either store, note any decisions that differ between blue and green. ` +
+            `Flag any new Deny decisions that did not exist in blue as HIGH risk.\n\n` +
+            `Step 4: Recommendation.\n` +
+            `Produce a plain-English summary covering: (a) structural changes, (b) breaking schema risk items, ` +
+            `(c) behavioral drift if present, and (d) a clear PROMOTE / DO NOT PROMOTE / PROMOTE WITH CAUTION verdict with reasoning. ` +
+            `No marketing language. Use semicolons instead of dashes for lists. Be specific about which policy IDs drive the verdict.`;
+        return {
+            messages: [{ role: "user", content: { type: "text", text } }],
+        };
+    },
+});
+// ---------------------------------------------------------------------------
+// 2. cedar-explain-denial
+//
+// UX assumption: a developer got an unexpected Deny (or Allow) and wants a
+// plain-English explanation without needing to know which tools to call or
+// in what order.
+// ---------------------------------------------------------------------------
+const explainDenial = definePrompt({
+    name: "cedar-explain-denial",
+    description: "Explain why a Cedar authorization request was allowed or denied, in plain English, by evaluating the request and examining the deciding policies.",
+    argsSchema: {
+        principal: z.string().describe('Principal entity reference, e.g. MyApp::User::"alice"'),
+        action: z.string().describe('Action entity reference, e.g. MyApp::Action::"read"'),
+        resource: z.string().describe('Resource entity reference, e.g. MyApp::Document::"doc-1"'),
+        store: z.string().describe("Name of the policy store to evaluate against"),
+    },
+    handler: (args) => {
+        const text = `Explain why the following Cedar authorization request was decided the way it was.\n\n` +
+            `Principal: ${args.principal}\n` +
+            `Action:    ${args.action}\n` +
+            `Resource:  ${args.resource}\n` +
+            `Store:     ${args.store}\n\n` +
+            `Work through the following steps.\n\n` +
+            `Step 1: Evaluate.\n` +
+            `Call cedar_authorize with:\n` +
+            `  policy_ref  = "cedar://policies/${args.store}"\n` +
+            `  schema_ref  = "cedar://schema/${args.store}"\n` +
+            `  principal   = "${args.principal}"\n` +
+            `  action      = "${args.action}"\n` +
+            `  resource    = "${args.resource}"\n` +
+            `  entities    = load from "cedar://entities/${args.store}" if available, otherwise use []\n\n` +
+            `Step 2: Explain deciding policies.\n` +
+            `Take the policy IDs returned in determining_policies from Step 1. ` +
+            `Call cedar_explain on those policy IDs so you have the human-readable logic for each one.\n\n` +
+            `Step 3: Plain-English explanation.\n` +
+            `Write a clear explanation covering:\n` +
+            `  (a) The decision (Allow or Deny) and which policy or policies drove it.\n` +
+            `  (b) Why this principal, action, and resource matched or did not match each determining policy.\n` +
+            `  (c) What would need to change for the opposite decision: either a policy edit, an entity attribute change, or a context value.\n\n` +
+            `Keep the explanation factual and specific. Avoid jargon beyond standard Cedar terms (permit, forbid, principal, action, resource, context).`;
+        return {
+            messages: [{ role: "user", content: { type: "text", text } }],
+        };
+    },
+});
+// ---------------------------------------------------------------------------
+// 3. cedar-avp-migration-checklist
+//
+// UX assumption: the user is preparing to move a local Cedar policy set into
+// Amazon Verified Permissions and wants a guided checklist to avoid easy-to-miss
+// steps (schema format, single-namespace constraint, entity validation).
+// This is purely informational; no tool calls are issued inside the prompt body.
+//
+// Design for "no required args": namespace is optional. When supplied it is
+// substituted into the checklist where AVP requires a single namespace. When
+// omitted a placeholder is used so the checklist is still complete and actionable.
+// ---------------------------------------------------------------------------
+const avpMigrationChecklist = definePrompt({
+    name: "cedar-avp-migration-checklist",
+    description: "Provide a guided checklist for migrating a local Cedar policy set into Amazon Verified Permissions, covering schema format, namespace constraints, entity validation, and behavioral diff.",
+    argsSchema: {
+        namespace: z
+            .string()
+            .optional()
+            .describe("Optional: the single Cedar namespace your AVP policy store will use, e.g. MyApp"),
+    },
+    handler: (args) => {
+        const ns = args.namespace ?? "<YourNamespace>";
+        const text = `AVP migration checklist for namespace: ${ns}\n\n` +
+            `Work through each item before moving policies or schema into Amazon Verified Permissions.\n\n` +
+            `1. Schema format detection.\n` +
+            `Call cedar_validate_schema on your existing schema file. Note whether it is in Cedar JSON format or .cedarschema (human-readable) format. ` +
+            `AVP accepts both, but they have different upload paths. Confirm which format you have before proceeding.\n\n` +
+            `2. Single-namespace constraint.\n` +
+            `AVP enforces a single namespace per policy store. All entity types, actions, and attributes must live under "${ns}". ` +
+            `If your local Cedar schema uses multiple namespaces, flatten them now. cedar_validate_schema will surface any namespace collisions.\n\n` +
+            `3. Entity format auto-detection.\n` +
+            `Cedar WASM accepts a relaxed entity format; AVP is stricter. Run cedar_validate_entities against your entity set with the schema attached. ` +
+            `Fix any entities missing required attributes or using incorrect UID formats before upload.\n\n` +
+            `4. Template-linked policies.\n` +
+            `If you use policy templates, call cedar_link_template for each template-principal-resource combination to confirm links are valid. ` +
+            `AVP supports template-linked policies but each link must reference a template that already exists in the store.\n\n` +
+            `5. Schema diff before PutSchema.\n` +
+            `If you are updating an existing AVP store schema (not a fresh store), call cedar_diff_schema between your local schema and the current AVP schema. ` +
+            `Classify every change as BREAKING or NON-BREAKING before calling PutSchema. ` +
+            `AVP does not roll back schema changes automatically; a BREAKING change can silently invalidate existing policies.\n\n` +
+            `6. Behavioral diff before traffic shift.\n` +
+            `After loading policies into the AVP store, use cedar_diff_policy_stores to compare local (blue) with AVP (green). ` +
+            `Run any behavioral test cases you have. Confirm no new Deny decisions appear for requests that should be allowed. ` +
+            `Only shift production traffic after this step passes.\n\n` +
+            `All steps must pass before tagging the migration as complete.`;
+        return {
+            messages: [{ role: "user", content: { type: "text", text } }],
+        };
+    },
+});
+// ---------------------------------------------------------------------------
+// Export
+// ---------------------------------------------------------------------------
+export const PROMPT_DEFINITIONS = [
+    reviewPolicyDiff,
+    explainDenial,
+    avpMigrationChecklist,
+];
+//# sourceMappingURL=index.js.map

package/dist/prompts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,SAAS,YAAY,CACnB,GAA2B;IAE3B,OAAO,GAA0B,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,+BAA+B;AAC/B,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,YAAY,CAAC;IACpC,IAAI,EAAE,0BAA0B;IAChC,WAAW,EACT,qJAAqJ;IACvJ,UAAU,EAAE;QACV,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;QACjF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QAChF,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,oFAAoF,CACrF;KACJ;IACD,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK;YAC1B,CAAC,CAAC,mCAAmC,IAAI,CAAC,KAAK,wDAAwD;YACvG,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,IAAI,GACR,0DAA0D,IAAI,CAAC,UAAU,oBAAoB,IAAI,CAAC,WAAW,gBAAgB;YAC7H,GAAG,SAAS,EAAE;YACd,oDAAoD;YACpD,4BAA4B;YAC5B,4CAA4C,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,WAAW,KAAK;YAChG,6HAA6H;YAC7H,wBAAwB;YACxB,wEAAwE,IAAI,CAAC,UAAU,uBAAuB,IAAI,CAAC,WAAW,KAAK;YACnI,uIAAuI;YACvI,qHAAqH;YACrH,qCAAqC;YACrC,oHAAoH;YACpH,0EAA0E;YAC1E,2BAA2B;YAC3B,oGAAoG;YACpG,2HAA2H;YAC3H,0HAA0H,CAAC;QAE7H,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,0BAA0B;AAC1B,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,iBAAiB;AACjB,8EAA8E;AAC9E,MAAM,aAAa,GAAG,YAAY,CAAC;IACjC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,mJAAmJ;IACrJ,UAAU,EAAE;QACV,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QACvF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0DAA0D,CAAC;QACzF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;KAC3E;IACD,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,IAAI,GACR,uFAAuF;YACvF,cAAc,IAAI,CAAC,SAAS,IAAI;YAChC,cAAc,IAAI,CAAC,MAAM,IAAI;YAC7B,cAAc,IAAI,CAAC,QAAQ,IAAI;YAC/B,cAAc,IAAI,CAAC,KAAK,MAAM;YAC9B,uCAAuC;YACvC,qBAAqB;YACrB,8BAA8B;YAC9B,qCAAqC,IAAI,CAAC,KAAK,KAAK;YACpD,mCAAmC,IAAI,CAAC,KAAK,KAAK;YAClD,oBAAoB,IAAI,CAAC,SAAS,KAAK;YACvC,oBAAoB,IAAI,CAAC,MAAM,KAAK;YACpC,oBAAoB,IAAI,CAAC,QAAQ,KAAK;YACtC,+CAA+C,IAAI,CAAC,KAAK,sCAAsC;YAC/F,sCAAsC;YACtC,oEAAoE;YACpE,+FAA+F;YAC/F,sCAAsC;YACtC,uCAAuC;YACvC,6EAA6E;YAC7E,oGAAoG;YACpG,sIAAsI;YACtI,6IAA6I,CAAC;QAEhJ,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AACzE,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,YAAY,CAAC;IACzC,IAAI,EAAE,+BAA+B;IACrC,WAAW,EACT,4LAA4L;IAC9L,UAAU,EAAE;QACV,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,iFAAiF,CAClF;KACJ;IACD,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;QAE/C,MAAM,IAAI,GACR,0CAA0C,EAAE,MAAM;YAClD,+FAA+F;YAC/F,+BAA+B;YAC/B,4IAA4I;YAC5I,8GAA8G;YAC9G,mCAAmC;YACnC,gHAAgH,EAAE,KAAK;YACvH,yIAAyI;YACzI,oCAAoC;YACpC,6IAA6I;YAC7I,gGAAgG;YAChG,gCAAgC;YAChC,qIAAqI;YACrI,qHAAqH;YACrH,oCAAoC;YACpC,qJAAqJ;YACrJ,8EAA8E;YAC9E,uHAAuH;YACvH,4CAA4C;YAC5C,oHAAoH;YACpH,oHAAoH;YACpH,2DAA2D;YAC3D,+DAA+D,CAAC;QAElE,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC;SAChF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAA0B;IACvD,gBAAgB;IAChB,aAAa;IACb,qBAAqB;CACtB,CAAC"}

package/dist/resources/ref-resolver.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Resolves cedar:// resource references to their content.
+ * Allows tools to accept policy_ref / schema_ref as alternatives to inline text.
+ *
+ * URI patterns:
+ *   cedar://policies/{store}                → all policies in store concatenated
+ *   cedar://policies/{store}/{id}           → single policy content
+ *   cedar://schema/{store}                  → schema content
+ *   cedar://templates/{store}               → template ID list as JSON array
+ *   cedar://templates/{store}/{template_id} → single template content
+ *   cedar://template-links/{store}          → link ID list as JSON array
+ *   cedar://template-links/{store}/{link_id}→ single template-link JSON content
+ *   cedar://entities/{store}                → merged entity arrays as JSON
+ *   cedar://entities/{store}/{file_id}      → single entity file content
+ */
+export type RefResolution = {
+    content: string;
+    resolved_from: string;
+} | {
+    error: string;
+};
+export declare function resolveRef(ref: string): RefResolution;
+//# sourceMappingURL=ref-resolver.d.ts.map

package/dist/resources/ref-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-resolver.d.ts","sourceRoot":"","sources":["../../src/resources/ref-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtB,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA+GrD"}