@intentius/chant-lexicon-cedar 0.44.8

package/src/serializer.ts

@@ -0,0 +1,335 @@
+/**
+ * Cedar lexicon serializer.
+ *
+ * Emits two views of the same policy set:
+ *
+ * - `.cedar` policy text — the primary output, and the surface every Cedar
+ *   evaluator reads (AVP, cedar-agent, an embedded `cedar-wasm`).
+ * - the Cedar JSON policy format — a second file, written alongside, and the
+ *   parse source for import (#1653). It is produced by handing the emitted
+ *   `.cedar` text back to `cedar-wasm`, so what lands on disk is whatever
+ *   Cedar itself says that text means. Deriving it from the in-memory model
+ *   instead is what shipped first, and it wrote `when` bodies as
+ *   `{ "__expr": "<text>" }` — a key Cedar's JSON grammar does not have, which
+ *   every Cedar tool rejects with `unknown variant '__expr'`.
+ *
+ * The entity model this serializer reads is hand-shaped for now: one
+ * `Cedar::Policy` entity type whose `props` carry an effect, three scope
+ * constraints, and optional `when`/`unless` guards. Schema-driven codegen
+ * (#1650) generates typed classes onto exactly this shape, so nothing here
+ * changes when it lands — the guards become typed expressions rather than
+ * the opaque Cedar-expression strings they are today.
+ */
+
+import type { Declarable } from "@intentius/chant/declarable";
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import type { Serializer, SerializerResult } from "@intentius/chant/serializer";
+import type { LexiconOutput } from "@intentius/chant/lexicon-output";
+import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
+import { policyToJson, splitPolicySet, templateToJson, type PolicyJson } from "./spec/wasm";
+
+// ── The policy entity model ───────────────────────────────────────
+
+/** The `entityType` this serializer reads. */
+export const CEDAR_POLICY_TYPE = "Cedar::Policy";
+
+/** Filename of the JSON policy-set companion to the primary `.cedar` output. */
+export const CEDAR_JSON_FILENAME = "policies.cedar.json";
+
+/** A Cedar policy either permits or forbids; there is no third effect. */
+export type CedarEffect = "permit" | "forbid";
+
+/**
+ * One scope position (`principal`, `action`, `resource`).
+ *
+ * `{}` is "any" — the unconstrained form Cedar writes as a bare variable.
+ * The constrained forms mirror the grammar: `== E`, `in E`, `in [E, …]`,
+ * `is T`, and `is T in E`.
+ */
+export type CedarScope =
+  | Record<string, never>
+  | { eq: string; in?: never; is?: never }
+  | { in: string | string[]; eq?: never; is?: never }
+  | { is: string; in?: string | string[]; eq?: never };
+
+/** The `props` of a `Cedar::Policy` entity. */
+export interface CedarPolicyProps {
+  /** Defaults to `permit` when omitted. */
+  effect?: CedarEffect;
+  /** Defaults to unconstrained (`{}`) when omitted. */
+  principal?: CedarScope;
+  /** Defaults to unconstrained (`{}`) when omitted. */
+  action?: CedarScope;
+  /** Defaults to unconstrained (`{}`) when omitted. */
+  resource?: CedarScope;
+  /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+  when?: string[];
+  /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+  unless?: string[];
+  /**
+   * Emitted as `@key("value")` above the policy. An explicit `id` wins over
+   * the one derived from the logical name.
+   */
+  annotations?: Record<string, string>;
+}
+
+// ── Helpers ───────────────────────────────────────────────────────
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function getProps(entity: Declarable): Record<string, unknown> {
+  if (isResourceDeclarable(entity) && isRecord(entity.props)) {
+    return entity.props;
+  }
+  return {};
+}
+
+/** Escape a string for a double-quoted Cedar literal. */
+export function escapeCedarString(value: string): string {
+  return value
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, "\\n")
+    .replace(/\r/g, "\\r")
+    .replace(/\t/g, "\\t");
+}
+
+/**
+ * Derive a policy id from a logical name: `allowAdminRead` → `allow-admin-read`.
+ * Cedar ids are free-form strings; kebab-case keeps them readable in the
+ * `@id` annotation and stable across a rename-free refactor.
+ */
+export function policyIdFromLogicalName(name: string): string {
+  return name
+    .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+    .replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2")
+    .replace(/[\s_]+/g, "-")
+    .toLowerCase();
+}
+
+// ── Walker visitor ────────────────────────────────────────────────
+
+/**
+ * Cedar has no intrinsic function syntax, so references collapse to the text
+ * a policy would name them by. Property names pass through verbatim.
+ */
+const cedarVisitor: SerializerVisitor = {
+  attrRef: (logicalName, attribute) => `${logicalName}.${attribute}`,
+  resourceRef: (logicalName) => logicalName,
+  propertyDeclarable: (entity, walk) => {
+    const out: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(getProps(entity))) {
+      if (key === "entityType" || key === "lexicon") continue;
+      if (value === undefined) continue;
+      out[key] = walk(value);
+    }
+    return out;
+  },
+};
+
+// ── Cedar policy text ─────────────────────────────────────────────
+
+function refText(value: unknown): string {
+  return String(value);
+}
+
+/** `principal`, `principal == User::"alice"`, `action in [ … ]`, `resource is Photo`. */
+function renderScope(variable: string, scope: unknown): string {
+  if (!isRecord(scope)) return variable;
+
+  const parts = [variable];
+  if (typeof scope.is === "string") parts.push(`is ${scope.is}`);
+  if (scope.eq !== undefined) parts.push(`== ${refText(scope.eq)}`);
+  if (scope.in !== undefined) {
+    parts.push(
+      Array.isArray(scope.in)
+        ? `in [${scope.in.map(refText).join(", ")}]`
+        : `in ${refText(scope.in)}`,
+    );
+  }
+  return parts.join(" ");
+}
+
+function conditionStrings(value: unknown): string[] {
+  if (value === undefined || value === null) return [];
+  if (Array.isArray(value)) return value.map(refText);
+  return [refText(value)];
+}
+
+/**
+ * One policy, as `.cedar` text.
+ *
+ * Exported because the AVP embedding (#1652) needs exactly this string and
+ * nothing else — `AWS::VerifiedPermissions::Policy` carries its policy as
+ * `Definition.Static.Statement`, a single Cedar policy rather than a set. Two
+ * renderers would be two dialects; there is one.
+ */
+export function renderPolicyText(id: string, props: Record<string, unknown>): string {
+  const lines: string[] = [];
+
+  // @id first, then the author's own annotations in declaration order.
+  const annotations = isRecord(props.annotations) ? props.annotations : {};
+  lines.push(`@id("${escapeCedarString(id)}")`);
+  for (const [key, value] of Object.entries(annotations)) {
+    if (key === "id" || value === undefined || value === null) continue;
+    lines.push(`@${key}("${escapeCedarString(refText(value))}")`);
+  }
+
+  const effect = props.effect === "forbid" ? "forbid" : "permit";
+  lines.push(`${effect} (`);
+  lines.push(`  ${renderScope("principal", props.principal)},`);
+  lines.push(`  ${renderScope("action", props.action)},`);
+  lines.push(`  ${renderScope("resource", props.resource)}`);
+  lines.push(")");
+
+  for (const clause of conditionStrings(props.when)) {
+    lines.push(`when { ${clause} }`);
+  }
+  for (const clause of conditionStrings(props.unless)) {
+    lines.push(`unless { ${clause} }`);
+  }
+
+  return lines.join("\n") + ";";
+}
+
+// ── Cedar JSON policy format ──────────────────────────────────────
+
+/** The JSON policy-set envelope, exactly as `cedar-wasm` accepts it. */
+export interface CedarPolicySetJSON {
+  staticPolicies: Record<string, PolicyJson>;
+  templates: Record<string, PolicyJson>;
+  templateLinks: unknown[];
+}
+
+/**
+ * Build the JSON companion from the emitted `.cedar` text.
+ *
+ * Two things fall out of going through the module rather than around it. The
+ * condition bodies become real expression trees, which is the whole reason the
+ * file is worth writing; and a policy carrying a `?principal`/`?resource` slot
+ * lands under `templates` rather than `staticPolicies`, because Cedar — not
+ * this serializer — is what decides which one it is.
+ *
+ * Ids come from each policy's own `@id`, not from the emission order, so the
+ * keys here cannot drift from the annotations in the text beside them.
+ */
+export function policySetJSON(text: string): { doc?: CedarPolicySetJSON; error?: string } {
+  const parts = splitPolicySet(text);
+  if (!parts.ok) return { error: parts.error };
+
+  const doc: CedarPolicySetJSON = { staticPolicies: {}, templates: {}, templateLinks: [] };
+
+  const collect = (
+    sources: string[],
+    convert: (source: string) => ReturnType<typeof policyToJson>,
+    into: Record<string, PolicyJson>,
+    fallbackPrefix: string,
+  ): string | undefined => {
+    for (const [index, source] of sources.entries()) {
+      const converted = convert(source);
+      if (!converted.ok) return converted.error;
+      const id = converted.value.annotations?.id;
+      into[typeof id === "string" && id.length > 0 ? id : `${fallbackPrefix}${index}`] = converted.value;
+    }
+    return undefined;
+  };
+
+  const policyError = collect(parts.value.policies, policyToJson, doc.staticPolicies, "policy");
+  if (policyError) return { error: policyError };
+
+  const templateError = collect(parts.value.templates, templateToJson, doc.templates, "template");
+  if (templateError) return { error: templateError };
+
+  return { doc };
+}
+
+// ── The shared policy model ───────────────────────────────────────
+
+/** One declared policy, resolved: its chant name, its Cedar id, and its walked props. */
+export interface CedarPolicyRecord {
+  /** The chant entity name — the export name on the `*.ts` file. */
+  name: string;
+  /** The Cedar policy id, as it appears in `@id(…)`. */
+  id: string;
+  /** Props with references resolved, ready for either renderer. */
+  props: Record<string, unknown>;
+}
+
+/**
+ * The Cedar id for a policy: an explicit `annotations.id` when the author gave
+ * one, else derived from the logical name.
+ *
+ * This is the only rule that links a chant entity to a policy in a live AVP
+ * store (#1652) — the observation resolves the same id from the same props and
+ * matches it against the `@id` annotation the statement carries. Two copies of
+ * this rule would be a mapping that drifts silently, so there is one.
+ */
+export function resolvePolicyId(logicalName: string, props: Record<string, unknown>): string {
+  const explicit = isRecord(props.annotations) ? props.annotations.id : undefined;
+  return typeof explicit === "string" && explicit.length > 0
+    ? explicit
+    : policyIdFromLogicalName(logicalName);
+}
+
+/**
+ * Every `Cedar::Policy` in a build, with references walked and ids resolved.
+ *
+ * The serializer's own first pass, exported so the AVP embedding (#1652)
+ * renders from the same model rather than re-deriving it.
+ */
+export function cedarPolicyRecords(entities: Map<string, Declarable>): CedarPolicyRecord[] {
+  // Reverse map first: walkValue resolves a Declarable reference by identity,
+  // so every entity has to be known before any of them is walked.
+  const entityNames = new Map<Declarable, string>();
+  for (const [name, entity] of entities) {
+    entityNames.set(entity, name);
+  }
+
+  const records: CedarPolicyRecord[] = [];
+  for (const [name, entity] of entities) {
+    if (isPropertyDeclarable(entity)) continue;
+    if (entity.entityType !== CEDAR_POLICY_TYPE) continue;
+
+    const props = walkValue(getProps(entity), entityNames, cedarVisitor) as Record<string, unknown>;
+    records.push({ name, id: resolvePolicyId(name, props), props });
+  }
+  return records;
+}
+
+// ── Serializer ────────────────────────────────────────────────────
+
+export const cedarSerializer: Serializer = {
+  name: "cedar",
+  rulePrefix: "CED",
+
+  serialize(entities: Map<string, Declarable>, _outputs?: LexiconOutput[]): string | SerializerResult {
+    const policyText: string[] = [];
+
+    for (const { id, props } of cedarPolicyRecords(entities)) {
+      policyText.push(renderPolicyText(id, props));
+    }
+
+    if (policyText.length === 0) return "";
+
+    const primary = policyText.join("\n\n") + "\n";
+    const { doc, error } = policySetJSON(primary);
+
+    // A policy set Cedar cannot read is a real defect, but it is the lint and
+    // post-synth surface's to report (#1651) — the text is still the artifact
+    // every evaluator consumes, so it is emitted either way, with the module's
+    // own message carried out as a build warning rather than swallowed.
+    if (!doc) {
+      return {
+        primary,
+        warnings: [`cedar: the emitted policy text did not parse, so ${CEDAR_JSON_FILENAME} was not written — ${error}`],
+      };
+    }
+
+    return {
+      primary,
+      files: { [CEDAR_JSON_FILENAME]: JSON.stringify(doc, null, 2) + "\n" },
+    };
+  },
+};

package/src/skills/chant-cedar-authoring.md

@@ -0,0 +1,180 @@
+---
+skill: chant-cedar-authoring
+description: Author Cedar authorization policies as typed chant resources — schema to generated classes to .cedar and JSON outputs
+user-invocable: true
+---
+
+# Cedar Policies as Typed Resources
+
+## What this lexicon covers
+
+Cedar is an authorization policy language. Its toolchain validates and evaluates
+policies; it does not help you write them. There are no functions, no modules,
+no loops, and templates carry exactly two slots (`?principal`, `?resource`), so
+teams managing large policy sets generate `.cedar` text with string templating.
+This lexicon replaces that with typed TypeScript.
+
+Two artifacts come out of every build:
+
+- `<name>.cedar` — the policy text every Cedar evaluator reads (Amazon Verified
+  Permissions, cedar-agent, an embedded `cedar-wasm`).
+- `policies.cedar.json` — the same set in the Cedar JSON policy format, beside
+  it. This is also the parse source for import.
+
+chant is nowhere in either. An emitted policy set is consumed by any evaluator.
+
+## The three steps
+
+### 1. Declare a schema
+
+The schema is *your* file, not a global upstream — it is the input codegen
+reads. Write it in Cedar's human-readable syntax and point the config at it:
+
+```typescript
+// chant.config.ts
+import type { ChantConfig } from "@intentius/chant";
+import "@intentius/chant-lexicon-cedar";
+
+export default {
+  lexicons: ["cedar"],
+  cedar: {
+    schema: "authz/app.cedarschema",
+    validation: { mode: "strict", requireProjectSchema: true },
+  },
+} satisfies ChantConfig;
+```
+
+Turn `requireProjectSchema` on once the project has its own schema. Without it a
+missing file silently falls back to the bundled default, and the difference
+between "your entity types" and "somebody else's" is invisible.
+
+### 2. Run generate
+
+```bash
+npx chant generate --lexicon cedar
+```
+
+That produces, per declaration in the schema:
+
+| Schema declaration | Generated |
+|---|---|
+| `entity Document in [Folder] = { … }` | `Document` class, `DocumentAttributes` property class, `DocumentUid` template-literal type |
+| `action read appliesTo { … }` | `ReadAction` constant, `ReadContext` property class |
+| — | `Policy` class, `EntityTypeName`, `ActionUid`, `PolicyScope`, `ALL_ACTIONS`, `ALL_ENTITY_TYPES` |
+
+`DocumentUid` is `` `App::Document::"${string}"` `` — a typo'd namespace is a
+compile error, not a validation error hours later.
+
+### 3. Write policies
+
+```typescript
+import { Policy, ReadAction, WriteAction, type UserUid } from "@intentius/chant-lexicon-cedar";
+
+const archivist: UserUid = 'App::User::"archivist"';
+
+export const ownerRead = new Policy({
+  effect: "permit",
+  principal: { is: "App::User" },
+  action: { in: [ReadAction, WriteAction] },
+  resource: { is: "App::Document" },
+  when: ["resource.owner == principal"],
+  annotations: { doc: "Owners always read their own documents." },
+});
+
+export const restrictDelete = new Policy({
+  effect: "forbid",
+  resource: { is: "App::Document" },
+  when: ['resource.classification == "confidential"'],
+  unless: [`principal == ${archivist}`],
+});
+```
+
+## Policy props
+
+| Prop | Meaning |
+|------|---------|
+| `effect` | `"permit"` or `"forbid"`. Defaults to `permit` |
+| `principal`, `action`, `resource` | Scope constraints. Omit for unconstrained |
+| `when` | Cedar expression strings, one `when { … }` clause each |
+| `unless` | Cedar expression strings, one `unless { … }` clause each |
+| `annotations` | `Record<string, string>`, emitted as `@key("value")` |
+
+### Scope forms
+
+| Written | Emitted |
+|---|---|
+| `{}` or omitted | `principal` |
+| `{ eq: X }` | `principal == X` |
+| `{ in: X }` | `principal in X` |
+| `{ in: [X, Y] }` | `principal in [X, Y]` |
+| `{ is: "App::User" }` | `principal is App::User` |
+| `{ is: "App::User", in: X }` | `principal is App::User in X` |
+
+`when`/`unless` stay strings. Cedar's expression grammar *is* the policy
+language; typing it in TypeScript is a separate problem, and the escape hatch
+would leak either way.
+
+## Policy ids
+
+The id comes from the export's logical name, kebab-cased: `allowAdminRead`
+becomes `@id("allow-admin-read")`. Set `annotations.id` to pin one explicitly —
+worth doing for a policy whose id something downstream references.
+
+## Composites
+
+Repeated policy shapes go in a factory, because Cedar has nowhere to put them.
+
+```typescript
+import {
+  DeleteAction,
+  DenyByDefaultSet,
+  OwnerCanManage,
+  ReadAction,
+  WriteAction,
+} from "@intentius/chant-lexicon-cedar";
+
+const docOwner = OwnerCanManage({
+  entityType: "App::Document",
+  actions: [ReadAction, WriteAction],
+  principal: "App::User",
+});
+
+const guarded = DenyByDefaultSet({
+  policies: [docOwner],
+  entityType: "App::Document",
+  actions: DeleteAction,
+  when: ['resource.classification == "confidential"'],
+  unless: ['principal == App::User::"archivist"'],
+});
+
+export const [confidentialFloor, documentOwnerGrant] = guarded.all;
+```
+
+`DenyByDefaultSet` returns the `forbid` floor and its members from one call, so
+deleting the floor deletes the grants with it. A `forbid` beats every `permit`
+in the set unconditionally — it is the only construct that survives a later,
+wider grant.
+
+## Checking the result
+
+```bash
+npx chant build                         # emits both artifacts, runs the CED rules
+npx chant coverage --lexicon cedar      # is every schema declaration generated?
+```
+
+The MCP tool `cedar:coverage` answers the other question: which schema entity
+types and actions the *policy set* can reach, which are reachable only from a
+`forbid`, and which no policy touches at all. An entity type nothing covers is
+inert under Cedar's default-deny — either the intent or a hole.
+
+## Things that will bite
+
+- **An empty schema validates everything clean.** `checkParseSchema("")`
+  succeeds. Set `requireProjectSchema: true`.
+- **`Group` and `Team`-shaped container entities appear in no `appliesTo`.**
+  They exist to be `in`, so no policy — not even `permit (principal, action,
+  resource)` — resolves to them. `cedar:coverage` reports that honestly rather
+  than rounding it up.
+- **A policy naming an entity type outside the schema still parses.** It
+  resolves to an empty request envelope and never fires. `cedar:coverage`
+  reports it under `inert`.

package/src/skills/chant-cedar-avp-embedding.md

@@ -0,0 +1,125 @@
+---
+skill: chant-cedar-avp-embedding
+description: Embed a typed cedar-lexicon policy into an AWS Verified Permissions policy resource instead of a hand-written string
+user-invocable: true
+---
+
+# Cedar Policies Inside Verified Permissions
+
+## The seam
+
+Amazon Verified Permissions is one deployment vehicle for Cedar, and chant
+already ships it: `AWS::VerifiedPermissions::Policy` in the aws lexicon carries
+its policy text in a `definition.static.statement` field typed `CedarPolicy` —
+which is to say, `string`.
+
+That string is the seam. Everything upstream of it — the schema, the entity
+types, the actions, the scope constraints — is what the cedar lexicon owns.
+Everything downstream — the policy store, the CloudFormation `ApplyOp`, the IAM
+around it — is the aws lexicon's, and already works.
+
+```
+cedar lexicon                       aws lexicon
+schema → Policy → .cedar text  →   VerifiedPermissionsPolicy.definition.static.statement
+```
+
+The walk-away test holds on both sides. The emitted `.cedar` file is read by any
+evaluator with no AWS involved; the AVP resource deploys through the same
+CloudFormation path every other AWS resource does.
+
+## The typed handoff
+
+`avpPolicyDefinition(name, props)` returns exactly the `Definition` property
+`AWS::VerifiedPermissions::Policy` takes, rendered by the same renderer that
+writes the `.cedar` file — so the deployed policy and the reviewed file cannot
+disagree.
+
+```typescript
+import { Policy, ReadAction, avpPolicyDefinition } from "@intentius/chant-lexicon-cedar";
+import { VerifiedPermissionsPolicy } from "@intentius/chant-lexicon-aws";
+
+const ownerReadProps = {
+  effect: "permit",
+  principal: { is: "App::User" },
+  action: { eq: ReadAction },
+  resource: { is: "App::Document" },
+  when: ["resource.owner == principal"],
+} as const;
+
+/** The evaluator-agnostic artifact: this is what lands in the `.cedar` file. */
+export const ownerRead = new Policy(ownerReadProps);
+
+/** The AVP deployment view of the same policy. */
+export const ownerReadAvp = new VerifiedPermissionsPolicy({
+  PolicyStoreId: policyStore.ref(),
+  Definition: avpPolicyDefinition("ownerRead", ownerReadProps, {
+    ownership: { stack: "authz", env: "prod" },
+    description: "Owners read their own documents.",
+  }),
+});
+```
+
+Beside it: `avpStatement()` for the bare string, `avpStatementJSON()` for
+evaluators that take the JSON policy format, and `avpPolicySet(entities)` to
+render a whole build's policies at once, keyed by chant entity name.
+
+**The cedar lexicon does not depend on the aws lexicon.** The seam is the data
+shape, which is stable CloudFormation. `examples/avp-embedding/` shows the
+pairing with a plain-object stand-in, because the shipped cedar examples build
+against the cedar serializer alone.
+
+## The lifecycle surface
+
+`describeResources()`, `observeAmbient()` and `exportResources()` read a live
+policy store. Point them at one with `CEDAR_AVP_POLICY_STORE_ID` (or
+`CEDAR_AVP_POLICY_STORE_ID_<ENV>`), or a `policyStoreId` prop on a declared
+policy.
+
+The link from a chant entity to a live policy is the Cedar `@id` annotation,
+which is derived from the export name (`ownerRead` → `owner-read`) unless
+`annotations.id` overrides it. Rename an export and the observation follows it;
+rename it *and* pin `annotations.id` and the live policy stays matched.
+
+## Rules
+
+- **Do not write the statement as prose.** A hand-typed
+  `"permit(principal, action, resource);"` in an AVP resource is the exact thing
+  this lexicon exists to remove, and the meta-policy wall (see the
+  `chant-cedar-meta-policy` skill) fails a bare permit in a prod build.
+- **Do not try to tag an individual policy.** AVP policy *stores* are taggable;
+  individual policies are not — `CreatePolicy` has no tag surface and a policy
+  has no ARN. chant's per-policy marker therefore rides in the policy
+  description, stamped by passing `ownership` to `avpPolicyDefinition` and read
+  back by `describeResources`/`exportResources`. Store tags remain the coarse
+  channel. The design record, including what the choice costs, is
+  `src/avp/OWNERSHIP.md`.
+- **Do not hand-write the description when you want ownership.** Pass
+  `ownership` and let the marker be encoded; the description is capped at 150
+  characters and the encoder truncates prose rather than the marker, which is
+  what keeps a chant-owned policy from silently reading as foreign.
+- **Do not treat an ambient permit as housekeeping.** A permit found in a store
+  that no source file declares is a standing grant somebody made outside review.
+  It is a security finding. `observeAmbient()` reports the statement and its
+  effect and stops short of the verdict — the judgement is yours.
+
+## Non-AVP evaluators
+
+AVP is not the only target, and the lexicon does not privilege it. The same
+emitted `.cedar` and `policies.cedar.json` feed:
+
+- **cedar-agent** — a standalone Cedar decision service; point it at the policy
+  file and the entity store.
+- **An embedded `cedar-wasm`** — the package this lexicon already depends on.
+  Load the policy text in-process and call `isAuthorized`.
+- **Cloudflare-style embeddings** — the same file, read at the edge.
+
+If the deployment target is anything other than AVP, there is no embedding step
+at all. Emit the files and ship them.
+
+## Cedar-for-Kubernetes
+
+The CNCF push includes Cedar as a Kubernetes authorizer, with policies as CRDs.
+Those kinds belong to the k8s lexicon's CRD sources — the same rule that kept
+`helm.cattle.io` out of the k3s lexicon. What the cedar lexicon does there is
+lint the policy *text* embedded in those kinds, which is the pattern the ARGO
+rules already use.