Importing

llms.txt lists every page for an agent

Optional: hand this page to your coding agentThe steps work by hand too.

Read https://intentius.io/chant/lexicons/cedar/importing/.
Convert the existing Cedar policy set I name to the JSON policy format with `cedar-wasm` (`policySetTextToParts`, `policyToJson`) and write the matching typed policies in src/ against the project schema.
Run `npx chant cedar generate`, `npx chant build` and `npx chant lint src`, compare the emitted `.cedar` text with the original, and open a pull request with each difference listed.
Report any permit found in a policy store that no source declares as a finding for me; do not remove or change it in the store.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Show the whole prompt

Read https://intentius.io/chant/lexicons/cedar/importing/.
Convert the existing Cedar policy set I name to the JSON policy format with `cedar-wasm` (`policySetTextToParts`, `policyToJson`) and write the matching typed policies in src/ against the project schema.
Run `npx chant cedar generate`, `npx chant build` and `npx chant lint src`, compare the emitted `.cedar` text with the original, and open a pull request with each difference listed.
Report any permit found in a policy store that no source declares as a finding for me; do not remove or change it in the store.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Optional: hand this page to your coding agent

Read https://intentius.io/chant/lexicons/cedar/importing/.
Convert the existing Cedar policy set I name to the JSON policy format with `cedar-wasm` (`policySetTextToParts`, `policyToJson`) and write the matching typed policies in src/ against the project schema.
Run `npx chant cedar generate`, `npx chant build` and `npx chant lint src`, compare the emitted `.cedar` text with the original, and open a pull request with each difference listed.
Report any permit found in a policy store that no source declares as a finding for me; do not remove or change it in the store.
Never deploy to a real cloud account or shared environment (with `chant run`, `chant components` or a platform's own CLI), approve (a pull request review, `chant approve` or `chant run approve`), override a policy denial (`chant approve policy-override`), or merge; never cut or publish a release (`chant release cut --yes` or `chant release publish`), push or delete a `ci/*` tag (`chant ci tick` pushes them), or change the value of an existing flag; never touch `.chant/allowed_signers` or `chant/lifecycle`.

Bringing an existing Cedar policy set into typed source, and pulling console edits back.

The round trip

.cedar text  ->  JSON policy format  ->  TypeScript  ->  .cedar text

The JSON policy format is the parse source, not the .cedar text. That is why the serializer produces it from the same structured model rather than by re-parsing what it just wrote: the two views cannot drift, and the import path reads a format with an actual grammar rather than doing a second parse of the surface syntax.

cedar-wasm converts in both directions (policyToJson, policyToText, policySetTextToParts), so a set that exists only as .cedar text is one call away from the importable form.

What round-tripping has to preserve

Carried	Notes
Effect	`permit` / `forbid`
All three scope positions	Including `is T in E`
`when` / `unless` clauses	In order
Annotations	Including `@id`, which becomes the export name’s override

The one asymmetry today is condition bodies. The JSON policy format wants an expression tree; the model carries expression text, written as { "__expr": "…" }, Cedar’s own escape for a source-given expression. Producing real trees means parsing Cedar expression text, which is precisely the work the import path has to do anyway.

Reconcile

The case that matters most is the policy somebody edited in a console: a ReconcileOp pulls it back into source, and the diff is reviewable.

An ambient permit (one found in a policy store that no source file declares) is a standing grant somebody made outside review, and it is a security finding.

Ownership

AVP policy stores are taggable; individual policies are not. The ownership channel is store-scoped until finer granularity is proven, and no channel is declared until its read paths are implemented; chant dev check-lexicon has a tier-2 gate for exactly the failure of declaring a marker channel on a path the plugin does not implement.

Status

The JSON policy-format parser, the TypeScript generator, and the ReconcileOp example are INTENTIUS/chant#1653. The serializer already emits the format they read, which is why it is a supported output rather than a debugging aid.

chant