@atlasauth/pca-policy-bridge 0.0.0-stage → 0.1.0

package/dist/cedar.d.ts

@@ -0,0 +1,59 @@
+import type { BridgeResult } from './types';
+/**
+ * Cedar → PCA predicate translator.
+ *
+ * SUPPORTED SUBSET (documented boundary — everything else fails closed)
+ * --------------------------------------------------------------------
+ * A policy set is `permit`/`forbid (principal, action, resource) [when {…}] [unless {…}] ;` units,
+ * separated by `;`. `//` line comments and `@annotation(...)` heads are stripped.
+ *
+ * Scope (the parenthesised head):
+ *   - `principal`                     — unconstrained
+ *   - `principal == User::"alice"`    — subject.id == "User::alice"
+ *   - `principal in Group::"g"`       — member_of(subject.id, "Group::g")  (entity hierarchy)
+ *   - `principal is User`             — is_a(subject.id, "User")           (entity type test)
+ *   - `action`                        — any verb
+ *   - `action == Action::"view"`      — verb = "view"
+ *   - `action in [Action::"a", …]`    — verb = ["a", …]
+ *   - `resource`                      — any resource
+ *   - `resource == Photo::"p1"`       — resource = "Photo::p1"
+ *   - `resource in Folder::"f"`       — member_of(action.resource, "Folder::f")
+ *   - `resource is Photo`             — is_a(action.resource, "Photo")
+ *
+ * Conditions (inside `when` / `unless`): an arbitrary boolean expression over `&&`, `||` and
+ * parentheses whose atoms are:
+ *   - `<lhs> == <rhs>` | `<lhs> != <rhs>`           — eq / ne
+ *   - `<lhs> < | <= | > | >= <rhs>`                  — lt / lte / gt / gte (attribute comparisons)
+ *   - `<lhs> in [<lit>, …]`                          — in (membership in a LITERAL set)
+ *   - `<lhs> in <Entity>`                            — member_of (entity hierarchy, bounded closure)
+ *   - `<lhs> is <Type>`                              — is_a (entity type test)
+ *   - `<lhs> like "<glob>"`                          — like (Cedar `*` wildcard; `\*` literal star)
+ *   - `<lhs> has <attr>`                             — exists(<lhs>.<attr>)
+ *   where <lhs>/<rhs> name:
+ *     - `principal`         → subject.id        `principal.attr` → subject.attr
+ *     - `resource`          → action.resource   `resource.attr`  → env.resource.attr
+ *     - `action`            → action.verb
+ *     - `context` / `context.x.y`               → env / env.x.y
+ *   A right-hand side that is itself one of those paths becomes a `ref`.
+ *   Right-hand literals: "string", number, true/false, and `Type::"id"` (→ "Type::id").
+ *
+ *   `||` → an `any_of` grouping; `&&` → an `all_of` grouping.
+ *   `when { E }`   → the translated E is ANDed into the predicate's `where`.
+ *   `unless { E }` → `{ not: E }` is ANDed in (so a MULTI-condition `unless { A && B }` becomes
+ *                    `not(all_of[A,B])`, exact Cedar semantics).
+ *
+ * ENTITY HIERARCHY (`in` / member_of): the group/parent graph is supplied at evaluation time as a
+ * reflexive adjacency map at `env.entity_parents` — `{ "<child uid>": ["<parent uid>", …], … }`.
+ * `a in b` holds iff `b` is in the bounded, cycle-guarded transitive closure of `a` (an entity is in
+ * itself, matching Cedar). Supply the entities' `parents` closure under that key.
+ *
+ * Mapping of policy effect:
+ *   - `permit` → a permit predicate (`result.predicates`)
+ *   - `forbid` → a deny predicate (`result.denies`); consume with {@link decide} (deny-overrides).
+ *
+ * NOT MODELED (reported, fails closed) — the honest minimum:
+ *   - arithmetic in a comparison (`resource.a + 1 < 10`), the set operations `.contains()` /
+ *     `.containsAll()` / `.containsAny()`, `if-then-else`, record/set construction, and the
+ *     extension functions (`ip(...)`, `decimal(...)`, `.isInRange(...)`, …).
+ */
+export declare function cedarToPca(policyText: string): BridgeResult;

package/dist/cedar.js

@@ -0,0 +1,535 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cedarToPca = cedarToPca;
+/**
+ * Cedar → PCA predicate translator.
+ *
+ * SUPPORTED SUBSET (documented boundary — everything else fails closed)
+ * --------------------------------------------------------------------
+ * A policy set is `permit`/`forbid (principal, action, resource) [when {…}] [unless {…}] ;` units,
+ * separated by `;`. `//` line comments and `@annotation(...)` heads are stripped.
+ *
+ * Scope (the parenthesised head):
+ *   - `principal`                     — unconstrained
+ *   - `principal == User::"alice"`    — subject.id == "User::alice"
+ *   - `principal in Group::"g"`       — member_of(subject.id, "Group::g")  (entity hierarchy)
+ *   - `principal is User`             — is_a(subject.id, "User")           (entity type test)
+ *   - `action`                        — any verb
+ *   - `action == Action::"view"`      — verb = "view"
+ *   - `action in [Action::"a", …]`    — verb = ["a", …]
+ *   - `resource`                      — any resource
+ *   - `resource == Photo::"p1"`       — resource = "Photo::p1"
+ *   - `resource in Folder::"f"`       — member_of(action.resource, "Folder::f")
+ *   - `resource is Photo`             — is_a(action.resource, "Photo")
+ *
+ * Conditions (inside `when` / `unless`): an arbitrary boolean expression over `&&`, `||` and
+ * parentheses whose atoms are:
+ *   - `<lhs> == <rhs>` | `<lhs> != <rhs>`           — eq / ne
+ *   - `<lhs> < | <= | > | >= <rhs>`                  — lt / lte / gt / gte (attribute comparisons)
+ *   - `<lhs> in [<lit>, …]`                          — in (membership in a LITERAL set)
+ *   - `<lhs> in <Entity>`                            — member_of (entity hierarchy, bounded closure)
+ *   - `<lhs> is <Type>`                              — is_a (entity type test)
+ *   - `<lhs> like "<glob>"`                          — like (Cedar `*` wildcard; `\*` literal star)
+ *   - `<lhs> has <attr>`                             — exists(<lhs>.<attr>)
+ *   where <lhs>/<rhs> name:
+ *     - `principal`         → subject.id        `principal.attr` → subject.attr
+ *     - `resource`          → action.resource   `resource.attr`  → env.resource.attr
+ *     - `action`            → action.verb
+ *     - `context` / `context.x.y`               → env / env.x.y
+ *   A right-hand side that is itself one of those paths becomes a `ref`.
+ *   Right-hand literals: "string", number, true/false, and `Type::"id"` (→ "Type::id").
+ *
+ *   `||` → an `any_of` grouping; `&&` → an `all_of` grouping.
+ *   `when { E }`   → the translated E is ANDed into the predicate's `where`.
+ *   `unless { E }` → `{ not: E }` is ANDed in (so a MULTI-condition `unless { A && B }` becomes
+ *                    `not(all_of[A,B])`, exact Cedar semantics).
+ *
+ * ENTITY HIERARCHY (`in` / member_of): the group/parent graph is supplied at evaluation time as a
+ * reflexive adjacency map at `env.entity_parents` — `{ "<child uid>": ["<parent uid>", …], … }`.
+ * `a in b` holds iff `b` is in the bounded, cycle-guarded transitive closure of `a` (an entity is in
+ * itself, matching Cedar). Supply the entities' `parents` closure under that key.
+ *
+ * Mapping of policy effect:
+ *   - `permit` → a permit predicate (`result.predicates`)
+ *   - `forbid` → a deny predicate (`result.denies`); consume with {@link decide} (deny-overrides).
+ *
+ * NOT MODELED (reported, fails closed) — the honest minimum:
+ *   - arithmetic in a comparison (`resource.a + 1 < 10`), the set operations `.contains()` /
+ *     `.containsAll()` / `.containsAny()`, `if-then-else`, record/set construction, and the
+ *     extension functions (`ip(...)`, `decimal(...)`, `.isInRange(...)`, …).
+ */
+function cedarToPca(policyText) {
+    const report = { source: 'cedar', translated: [], skipped: [], errors: [] };
+    const predicates = [];
+    const denies = [];
+    const cleaned = stripComments(policyText);
+    const statements = splitTopLevel(cleaned, ';')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    for (const stmt of statements) {
+        try {
+            translateStatement(stmt, predicates, denies, report);
+        }
+        catch (e) {
+            report.errors.push(`policy "${truncate(stmt)}": ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    return { predicates, denies, caveats: [], report };
+}
+/** The reflexive adjacency map (child uid -> parent uid[]) that `in`/member_of resolves against. */
+const ENTITY_PARENTS = 'env.entity_parents';
+// --- statement ---------------------------------------------------------------------------------
+function translateStatement(stmt, permits, denies, report) {
+    // Strip leading @annotation(...) heads.
+    let body = stmt;
+    const annot = /^\s*(@[A-Za-z_][\w]*\s*\([^)]*\)\s*)+/.exec(body);
+    if (annot)
+        body = body.slice(annot[0].length);
+    const head = /^\s*(permit|forbid)\s*\(/i.exec(body);
+    if (!head) {
+        report.skipped.push(`unrecognized statement: "${truncate(stmt)}"`);
+        return;
+    }
+    const effect = head[1]?.toLowerCase() === 'forbid' ? 'forbid' : 'permit';
+    const openIdx = body.indexOf('(', head.index);
+    const closeIdx = matchParen(body, openIdx);
+    if (closeIdx < 0)
+        throw new Error('unterminated scope parentheses');
+    const scopeText = body.slice(openIdx + 1, closeIdx);
+    const rest = body.slice(closeIdx + 1);
+    const scope = parseScope(scopeText);
+    const where = [...scope.scopeConditions];
+    // Collect when / unless blocks.
+    const blocks = parseConditionBlocks(rest);
+    for (const block of blocks) {
+        const parsed = parseExpr(block.text);
+        if (parsed === null) {
+            report.skipped.push(`unmodeled ${block.kind}-condition "${truncate(block.text)}" — policy dropped (fail closed)`);
+            dropPolicy(effect, stmt, report);
+            return;
+        }
+        where.push(block.kind === 'when' ? parsed : { not: parsed });
+    }
+    const predicate = { verb: scope.verb };
+    if (scope.resource !== undefined)
+        predicate.resource = scope.resource;
+    if (where.length > 0)
+        predicate.where = where;
+    if (effect === 'permit') {
+        permits.push(predicate);
+        report.translated.push(`permit → verb ${JSON.stringify(scope.verb)}${scope.resource ? ` on ${scope.resource}` : ''} (${where.length} condition(s))`);
+    }
+    else {
+        denies.push(predicate);
+        report.translated.push(`forbid → deny verb ${JSON.stringify(scope.verb)}${scope.resource ? ` on ${scope.resource}` : ''} (${where.length} condition(s))`);
+    }
+}
+/** A dropped `permit` simply grants nothing; a dropped `forbid` is unsafe, so it is an ERROR. */
+function dropPolicy(effect, stmt, report) {
+    if (effect === 'forbid') {
+        report.errors.push(`forbid could not be fully modeled and was dropped — treat result as fail-closed: "${truncate(stmt)}"`);
+    }
+}
+function parseScope(scopeText) {
+    const clauses = splitTopLevel(scopeText, ',')
+        .map((c) => c.trim())
+        .filter((c) => c.length > 0);
+    const result = { verb: '*', scopeConditions: [] };
+    for (const clause of clauses) {
+        const m = /^(principal|action|resource)\b\s*(==|in|is)?\s*([\s\S]*)$/.exec(clause);
+        if (!m)
+            throw new Error(`unparseable scope clause "${truncate(clause)}"`);
+        const variable = m[1];
+        const op = m[2];
+        const operand = (m[3] ?? '').trim();
+        if (!op)
+            continue; // unconstrained (bare principal/action/resource)
+        if (variable === 'action') {
+            if (op === '==') {
+                const id = entityId(operand);
+                if (id === null)
+                    throw new Error(`action == expects an Action entity, got "${truncate(operand)}"`);
+                result.verb = id;
+            }
+            else if (op === 'in' && operand.startsWith('[')) {
+                const items = splitTopLevel(operand.slice(1, -1), ',')
+                    .map((x) => x.trim())
+                    .filter((x) => x.length > 0);
+                const verbs = [];
+                for (const it of items) {
+                    const id = entityId(it);
+                    if (id === null)
+                        throw new Error(`action in [...] expects Action entities, got "${truncate(it)}"`);
+                    verbs.push(id);
+                }
+                result.verb = verbs;
+            }
+            else {
+                throw new Error(`unsupported action scope operator "${op}"`);
+            }
+        }
+        else {
+            const field = variable === 'resource' ? 'action.resource' : 'subject.id';
+            if (op === '==') {
+                if (variable === 'resource') {
+                    const eid = entityUid(operand);
+                    if (eid === null)
+                        throw new Error(`resource == expects an entity, got "${truncate(operand)}"`);
+                    result.resource = eid;
+                }
+                else {
+                    const eid = entityUid(operand);
+                    if (eid === null)
+                        throw new Error(`principal == expects an entity, got "${truncate(operand)}"`);
+                    result.scopeConditions.push({ field, op: 'eq', value: eid });
+                }
+            }
+            else if (op === 'is') {
+                const type = typeName(operand);
+                if (type === null)
+                    throw new Error(`${variable} is expects a type, got "${truncate(operand)}"`);
+                result.scopeConditions.push({ field, op: 'is_a', value: type });
+            }
+            else {
+                // op === 'in' : entity-hierarchy membership
+                const mem = memberOfCondition(field, operand);
+                if (mem === null)
+                    throw new Error(`${variable} in expects an entity (hierarchy), got "${truncate(operand)}"`);
+                result.scopeConditions.push(mem);
+            }
+        }
+    }
+    return result;
+}
+function parseConditionBlocks(rest) {
+    const blocks = [];
+    const re = /\b(when|unless)\b\s*\{/g;
+    let m;
+    while ((m = re.exec(rest)) !== null) {
+        const kind = m[1] === 'unless' ? 'unless' : 'when';
+        const open = rest.indexOf('{', m.index);
+        const close = matchBrace(rest, open);
+        if (close < 0)
+            throw new Error(`unterminated ${kind} block`);
+        blocks.push({ kind, text: rest.slice(open + 1, close) });
+        re.lastIndex = close + 1;
+    }
+    return blocks;
+}
+/**
+ * Parse a boolean expression: `||` (lowest precedence, → any_of) over `&&` (→ all_of) over
+ * parenthesised groups over single comparison atoms. Returns null if any atom is outside the subset.
+ */
+function parseExpr(text) {
+    const t = text.trim();
+    if (t.length === 0)
+        return null;
+    const ors = splitTopLevel(t, '||')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    if (ors.length > 1) {
+        const subs = ors.map(parseExpr);
+        if (subs.some((s) => s === null))
+            return null;
+        return { any_of: subs };
+    }
+    const ands = splitTopLevel(t, '&&')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+    if (ands.length > 1) {
+        const subs = ands.map(parseExpr);
+        if (subs.some((s) => s === null))
+            return null;
+        return { all_of: subs };
+    }
+    // Single term: strip a fully-enclosing parenthesis, else parse one atom.
+    if (t.startsWith('(') && matchParen(t, 0) === t.length - 1)
+        return parseExpr(t.slice(1, -1));
+    return parseAtom(t);
+}
+/** Parse one comparison atom → a leaf Condition, or null if outside the subset. */
+function parseAtom(text) {
+    const t = text.trim();
+    // Symbolic comparison operators, longest token first (so `<=`/`>=`/`==`/`!=` win over `<`/`>`).
+    for (const [tok, op] of [
+        ['==', 'eq'],
+        ['!=', 'ne'],
+        ['<=', 'lte'],
+        ['>=', 'gte'],
+        ['<', 'lt'],
+        ['>', 'gt'],
+    ]) {
+        const idx = indexOfTopLevel(t, tok);
+        if (idx >= 0) {
+            const lhs = t.slice(0, idx).trim();
+            const rhs = t.slice(idx + tok.length).trim();
+            return buildComparison(lhs, op, rhs);
+        }
+    }
+    // Word operators: `in`, `is`, `like`, `has`.
+    const wm = /^([\s\S]+?)\s+(in|is|like|has)\s+([\s\S]+)$/.exec(t);
+    if (wm)
+        return buildWordOp((wm[1] ?? '').trim(), wm[2] ?? '', (wm[3] ?? '').trim());
+    // A bare expression (`resource.flag`, `principal.foo.contains("x")`, …) is not modeled.
+    return null;
+}
+function buildComparison(lhsRaw, op, rhsRaw) {
+    const field = toFieldPath(lhsRaw);
+    if (field === null)
+        return null; // arithmetic / method-call LHS not modeled
+    if (isPathExpr(rhsRaw)) {
+        const refPath = toFieldPath(rhsRaw);
+        if (refPath !== null)
+            return { field, op, ref: refPath };
+    }
+    const lit = toLiteral(rhsRaw);
+    if (!lit.ok)
+        return null;
+    return { field, op, value: lit.value };
+}
+function buildWordOp(lhsRaw, kind, rhsRaw) {
+    if (kind === 'has') {
+        // `principal has department` → exists(subject.department)
+        if (!/^[A-Za-z_][\w]*$/.test(rhsRaw))
+            return null;
+        const field = toFieldPath(`${lhsRaw}.${rhsRaw}`);
+        return field === null ? null : { field, op: 'exists' };
+    }
+    const field = toFieldPath(lhsRaw);
+    if (field === null)
+        return null;
+    if (kind === 'is') {
+        const type = typeName(rhsRaw);
+        return type === null ? null : { field, op: 'is_a', value: type };
+    }
+    if (kind === 'like') {
+        const str = /^"([\s\S]*)"$/.exec(rhsRaw);
+        if (!str)
+            return null;
+        return { field, op: 'like', value: cedarLikeToGlob(str[1] ?? '') };
+    }
+    // kind === 'in'
+    if (rhsRaw.startsWith('[')) {
+        // Membership in a LITERAL set.
+        const inner = rhsRaw.endsWith(']') ? rhsRaw.slice(1, -1) : rhsRaw.slice(1);
+        const items = splitTopLevel(inner, ',')
+            .map((x) => x.trim())
+            .filter((x) => x.length > 0);
+        // A set of entities (`[Group::"a", Group::"b"]`) is still a hierarchy membership (any-of).
+        if (items.every((it) => entityUid(it) !== null) && items.length > 0) {
+            const uids = items.map((it) => entityUid(it));
+            return { field, op: 'member_of', value: uids, collection: ENTITY_PARENTS };
+        }
+        const values = [];
+        for (const it of items) {
+            const lit = toLiteral(it);
+            if (!lit.ok)
+                return null;
+            values.push(lit.value);
+        }
+        return { field, op: 'in', value: values };
+    }
+    // `lhs in Entity` → hierarchy membership (bounded closure).
+    return memberOfCondition(field, rhsRaw);
+}
+/** A `member_of` condition for `<field> in <entity|path>` (entity literal → value; path → ref). */
+function memberOfCondition(field, operand) {
+    const eid = entityUid(operand);
+    if (eid !== null)
+        return { field, op: 'member_of', value: eid, collection: ENTITY_PARENTS };
+    if (isPathExpr(operand)) {
+        const ref = toFieldPath(operand);
+        if (ref !== null)
+            return { field, op: 'member_of', ref, collection: ENTITY_PARENTS };
+    }
+    return null;
+}
+/** Does an expression refer to a Cedar scope variable (principal/resource/action/context)? */
+function isPathExpr(expr) {
+    return /^(principal|resource|action|context)\b/.test(expr);
+}
+/** Map a Cedar scope-variable expression to a PCA dotted field path; null if not a path. */
+function toFieldPath(expr) {
+    if (expr === 'principal')
+        return 'subject.id';
+    if (expr === 'resource')
+        return 'action.resource';
+    if (expr === 'action')
+        return 'action.verb';
+    if (expr === 'context')
+        return 'env';
+    const mp = /^principal\.([A-Za-z_][\w.]*)$/.exec(expr);
+    if (mp)
+        return `subject.${mp[1]}`;
+    const mr = /^resource\.([A-Za-z_][\w.]*)$/.exec(expr);
+    if (mr)
+        return `env.resource.${mr[1]}`;
+    const mc = /^context\.([A-Za-z_][\w.]*)$/.exec(expr);
+    if (mc)
+        return `env.${mc[1]}`;
+    return null;
+}
+// --- literals / entities -----------------------------------------------------------------------
+/** A Cedar type name (`User`, `Ns::User`), or null. */
+function typeName(expr) {
+    const s = expr.trim();
+    return /^[A-Za-z_][\w]*(::[A-Za-z_][\w]*)*$/.test(s) ? s : null;
+}
+/** The quoted id of an entity reference `Ns::Type::"id"`, or null. */
+function entityId(expr) {
+    const m = /^.+::"([^"]*)"$/.exec(expr.trim());
+    return m ? (m[1] ?? '') : null;
+}
+/** An entity reference rendered as its UID with quotes dropped: `Type::"id"` → `Type::id`. */
+function entityUid(expr) {
+    const m = /^(.+)::"([^"]*)"$/.exec(expr.trim());
+    if (!m)
+        return null;
+    return `${m[1]}::${m[2] ?? ''}`;
+}
+function toLiteral(expr) {
+    const s = expr.trim();
+    const str = /^"([^"]*)"$/.exec(s);
+    if (str)
+        return { ok: true, value: str[1] ?? '' };
+    if (s === 'true')
+        return { ok: true, value: true };
+    if (s === 'false')
+        return { ok: true, value: false };
+    if (/^-?\d+(\.\d+)?$/.test(s))
+        return { ok: true, value: Number(s) };
+    const eid = entityUid(s);
+    if (eid !== null)
+        return { ok: true, value: eid };
+    return { ok: false };
+}
+/**
+ * Convert a Cedar `like` pattern (only `*` is a wildcard; `\*` is a literal star) to the PCA glob the
+ * `like` op understands (`*`/`?` wildcards, `\` escapes). Cedar's literal `?` and `\` are escaped so
+ * they stay literal.
+ */
+function cedarLikeToGlob(inner) {
+    let out = '';
+    for (let i = 0; i < inner.length; i++) {
+        const ch = inner[i];
+        if (ch === '\\') {
+            const n = inner[i + 1];
+            if (n === '*') {
+                out += '\\*'; // Cedar literal star
+                i++;
+                continue;
+            }
+            if (n !== undefined) {
+                out += escapeGlobLiteral(n);
+                i++;
+                continue;
+            }
+            out += '\\\\';
+            continue;
+        }
+        if (ch === '*') {
+            out += '*'; // wildcard
+            continue;
+        }
+        out += escapeGlobLiteral(ch);
+    }
+    return out;
+}
+function escapeGlobLiteral(ch) {
+    return ch === '*' || ch === '?' || ch === '\\' ? '\\' + ch : ch;
+}
+// --- text helpers ------------------------------------------------------------------------------
+function stripComments(text) {
+    return text.replace(/\/\/[^\n]*/g, '');
+}
+function truncate(s) {
+    const one = s.replace(/\s+/g, ' ').trim();
+    return one.length > 80 ? `${one.slice(0, 77)}...` : one;
+}
+/** Index of `token` at bracket/quote depth 0, or -1. */
+function indexOfTopLevel(text, token) {
+    let depth = 0;
+    let inStr = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i] ?? '';
+        if (inStr) {
+            if (ch === '"')
+                inStr = false;
+            continue;
+        }
+        if (ch === '"') {
+            inStr = true;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === ')' || ch === ']' || ch === '}')
+            depth--;
+        else if (depth === 0 && text.startsWith(token, i))
+            return i;
+    }
+    return -1;
+}
+/** Split on a delimiter at bracket/quote depth 0. `delim` is 1 or 2 chars. */
+function splitTopLevel(text, delim) {
+    const out = [];
+    let depth = 0;
+    let inStr = false;
+    let buf = '';
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i] ?? '';
+        if (inStr) {
+            buf += ch;
+            if (ch === '"')
+                inStr = false;
+            continue;
+        }
+        if (ch === '"') {
+            inStr = true;
+            buf += ch;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === ')' || ch === ']' || ch === '}')
+            depth--;
+        if (depth === 0 && text.startsWith(delim, i)) {
+            out.push(buf);
+            buf = '';
+            i += delim.length - 1;
+            continue;
+        }
+        buf += ch;
+    }
+    out.push(buf);
+    return out;
+}
+function matchParen(text, open) {
+    return matchDelim(text, open, '(', ')');
+}
+function matchBrace(text, open) {
+    return matchDelim(text, open, '{', '}');
+}
+function matchDelim(text, open, o, c) {
+    let depth = 0;
+    let inStr = false;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i] ?? '';
+        if (inStr) {
+            if (ch === '"')
+                inStr = false;
+            continue;
+        }
+        if (ch === '"')
+            inStr = true;
+        else if (ch === o)
+            depth++;
+        else if (ch === c) {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+//# sourceMappingURL=cedar.js.map

package/dist/cedar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar.js","sourceRoot":"","sources":["../src/cedar.ts"],"names":[],"mappings":";;AA4DA,gCAmBC;AA5ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,SAAgB,UAAU,CAAC,UAAkB;IAC3C,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,oGAAoG;AACpG,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,kGAAkG;AAElG,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAoB,EAAE,MAAmB,EAAE,MAAyB;IAC5G,wCAAwC;IACxC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,KAAK;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAgB,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IAEtD,gCAAgC;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,eAAe,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAClH,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IAE9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,CAAC,UAAU,CAAC,IAAI,CACpB,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,CAC7H,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,IAAI,CACpB,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,CAClI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,MAA2B,EAAE,IAAY,EAAE,MAAyB;IACtF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qFAAqF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAUD,SAAS,UAAU,CAAC,SAAiB;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,2DAA2D,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,iDAAiD;QAEpE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7B,IAAI,EAAE,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnG,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACnB,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;qBACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACxB,IAAI,EAAE,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;oBACnG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;YACzE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC/B,IAAI,GAAG,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC/F,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC/B,IAAI,GAAG,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,4BAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,GAAG,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,2CAA2C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9G,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,yBAAyB,CAAC;IACrC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAmB,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAmB,EAAE,CAAC;IACzC,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEtB,gGAAgG;IAChG,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI;QACtB,CAAC,IAAI,EAAE,IAAI,CAAC;QACZ,CAAC,IAAI,EAAE,IAAI,CAAC;QACZ,CAAC,IAAI,EAAE,KAAK,CAAC;QACb,CAAC,IAAI,EAAE,KAAK,CAAC;QACb,CAAC,GAAG,EAAE,IAAI,CAAC;QACX,CAAC,GAAG,EAAE,IAAI,CAAC;KACH,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,EAAE,GAAG,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpF,wFAAwF;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,EAAe,EAAE,MAAc;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC5E,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC/D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,0DAA0D;QAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,2FAA2F;QAC3F,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAE,CAAC,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,4DAA4D;IAC5D,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAe;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAC5F,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IAC9C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE;QAAE,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,EAAE;QAAE,OAAO,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAElG,uDAAuD;AACvD,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,GAAG,IAAI,KAAK,CAAC,CAAC,qBAAqB;gBACnC,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,GAAG,IAAI,MAAM,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW;YACvB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,OAAO,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kGAAkG;AAElG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,wDAAwD;AACxD,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACpD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC;YACb,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,GAAG,EAAE,CAAC;YACT,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,CAAS,EAAE,CAAS;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,IAAI,CAAC;aACxB,IAAI,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,CAAC;aACtB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @atlasauth/pca-policy-bridge
+ *
+ * Import external authorization policy into PCA so existing enterprise policy engines drive
+ * proof-carrying authority. Each translator compiles a policy source into PCA envelope
+ * predicates/caveats (the exact shapes from `@atlasauth/pca`) plus a report of what was and was
+ * not translated. Everything unmodeled fails closed (default deny).
+ *
+ *   - cedarToPca(policyText)      Cedar permit/forbid policies
+ *   - regoToPca(moduleText)       OPA/Rego allow-rule subset
+ *   - openfgaToPca(model, tuples) OpenFGA/Zanzibar ReBAC model + relationship tuples
+ *
+ * The emitted `predicates` plug straight into `Envelope.predicates`; `denies` (Cedar forbid) is
+ * applied via `decide` (deny-overrides-permit) built on the core `evaluatePredicates`.
+ */
+export { cedarToPca } from './cedar';
+export { regoToPca } from './rego';
+export { openfgaToPca } from './openfga';
+export { decide } from './types';
+export type { BridgeResult, TranslationReport, PolicySource } from './types';