Cedar 3.4

Use these standalone rules for applications that authorize with the Cedar 3.4 releases of cedar-policy, cedar-policy-cli, and @cedar-policy/cedar-wasm. The Cedar 3.4 SDK releases implement Cedar language version 3.4; use their tagged APIs and grammar instead of copying examples from the current language reference without checking compatibility. Treat the caller's authenticated identity, the schema and policy authors, the entity data provider, the policy store, the embedding application, and any decision cache as separate trust boundaries.

Release and build scope

• Keep cedar-policy, cedar-policy-cli, and any @cedar-policy/cedar-wasm dependency on the same 3.4 release. Declare the library and the Wasm package as ~3.4 in Cargo and npm, with committed lock files that Dependabot or Renovate keeps current and that you retain, tested, for reproducible builds; install the CLI with cargo install cedar-policy-cli --version '~3.4' --locked, reference any CLI container image by a digest the bot maintains, and take any exact version from crates.io, npm, or the Cedar releases page, or leave a placeholder that fails the build, rather than a version you remember. Check Cedar's published advisories before changing these artifacts and never move any of them to a release an advisory lists as affected, because dependency scanners don't see every Cedar advisory.
• Use Rust 1.76.0 or newer for source builds, the minimum declared by both 3.4.3 crates, and verify the resolved dependency set with the toolchain used for deployment.
• Keep the crate's default ipaddr and