@atlasauth/pca-policy-bridge 0.0.0-stage → 0.2.0

package/dist/cedar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar.js","sourceRoot":"","sources":["../src/cedar.ts"],"names":[],"mappings":";;AA4DA,gCAmBC;AA5ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,SAAgB,UAAU,CAAC,UAAkB;IAC3C,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,oGAAoG;AACpG,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,kGAAkG;AAElG,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAoB,EAAE,MAAmB,EAAE,MAAyB;IAC5G,wCAAwC;IACxC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,KAAK,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,KAAK;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,IAAI,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,KAAK,GAAgB,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IAEtD,gCAAgC;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,eAAe,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAClH,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC;IAE9C,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,CAAC,UAAU,CAAC,IAAI,CACpB,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,CAC7H,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,CAAC,UAAU,CAAC,IAAI,CACpB,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,gBAAgB,CAClI,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,SAAS,UAAU,CAAC,MAA2B,EAAE,IAAY,EAAE,MAAyB;IACtF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qFAAqF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAUD,SAAS,UAAU,CAAC,SAAiB;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE/D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,2DAA2D,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,iDAAiD;QAEpE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7B,IAAI,EAAE,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnG,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACnB,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;qBACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACxB,IAAI,EAAE,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;oBACnG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC;YACzE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC/B,IAAI,GAAG,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAC/F,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC/B,IAAI,GAAG,KAAK,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBAChG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,4BAA4B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC9C,IAAI,GAAG,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,2CAA2C,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9G,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,yBAAyB,CAAC;IACrC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAmB,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAmB,EAAE,CAAC;IACzC,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAEtB,gGAAgG;IAChG,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI;QACtB,CAAC,IAAI,EAAE,IAAI,CAAC;QACZ,CAAC,IAAI,EAAE,IAAI,CAAC;QACZ,CAAC,IAAI,EAAE,KAAK,CAAC;QACb,CAAC,IAAI,EAAE,KAAK,CAAC;QACb,CAAC,GAAG,EAAE,IAAI,CAAC;QACX,CAAC,GAAG,EAAE,IAAI,CAAC;KACH,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,MAAM,EAAE,GAAG,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAEpF,wFAAwF;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,EAAe,EAAE,MAAc;IACtE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC5E,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IAC/D,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,0DAA0D;QAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,+BAA+B;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,2FAA2F;QAC3F,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAE,CAAC,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,4DAA4D;IAC5D,OAAO,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAe;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAC5F,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IAC9C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,EAAE;QAAE,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,EAAE;QAAE,OAAO,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,EAAE;QAAE,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAElG,uDAAuD;AACvD,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,OAAO,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACd,GAAG,IAAI,KAAK,CAAC,CAAC,qBAAqB;gBACnC,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,GAAG,IAAI,MAAM,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW;YACvB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,OAAO,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kGAAkG;AAElG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC1D,CAAC;AAED,wDAAwD;AACxD,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACpD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC;YACb,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC/C,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;QACzD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,GAAG,EAAE,CAAC;YACT,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,CAAS,EAAE,CAAS;IAClE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,GAAG,IAAI,CAAC;aACxB,IAAI,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,CAAC;aACtB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @atlasauth/pca-policy-bridge
+ *
+ * Import external authorization policy into PCA so existing enterprise policy engines drive
+ * proof-carrying authority. Each translator compiles a policy source into PCA envelope
+ * predicates/caveats (the exact shapes from `@atlasauth/pca`) plus a report of what was and was
+ * not translated. Everything unmodeled fails closed (default deny).
+ *
+ *   - cedarToPca(policyText)      Cedar permit/forbid policies
+ *   - regoToPca(moduleText)       OPA/Rego allow-rule subset
+ *   - openfgaToPca(model, tuples) OpenFGA/Zanzibar ReBAC model + relationship tuples
+ *
+ * The emitted `predicates` plug straight into `Envelope.predicates`; `denies` (Cedar forbid) is
+ * applied via `decide` (deny-overrides-permit) built on the core `evaluatePredicates`.
+ */
+export { cedarToPca } from './cedar';
+export { regoToPca } from './rego';
+export { openfgaToPca } from './openfga';
+export { decide } from './types';
+export type { BridgeResult, TranslationReport, PolicySource } from './types';

package/dist/index.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decide = exports.openfgaToPca = exports.regoToPca = exports.cedarToPca = void 0;
+/**
+ * @atlasauth/pca-policy-bridge
+ *
+ * Import external authorization policy into PCA so existing enterprise policy engines drive
+ * proof-carrying authority. Each translator compiles a policy source into PCA envelope
+ * predicates/caveats (the exact shapes from `@atlasauth/pca`) plus a report of what was and was
+ * not translated. Everything unmodeled fails closed (default deny).
+ *
+ *   - cedarToPca(policyText)      Cedar permit/forbid policies
+ *   - regoToPca(moduleText)       OPA/Rego allow-rule subset
+ *   - openfgaToPca(model, tuples) OpenFGA/Zanzibar ReBAC model + relationship tuples
+ *
+ * The emitted `predicates` plug straight into `Envelope.predicates`; `denies` (Cedar forbid) is
+ * applied via `decide` (deny-overrides-permit) built on the core `evaluatePredicates`.
+ */
+var cedar_1 = require("./cedar");
+Object.defineProperty(exports, "cedarToPca", { enumerable: true, get: function () { return cedar_1.cedarToPca; } });
+var rego_1 = require("./rego");
+Object.defineProperty(exports, "regoToPca", { enumerable: true, get: function () { return rego_1.regoToPca; } });
+var openfga_1 = require("./openfga");
+Object.defineProperty(exports, "openfgaToPca", { enumerable: true, get: function () { return openfga_1.openfgaToPca; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "decide", { enumerable: true, get: function () { return types_1.decide; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;GAcG;AACH,iCAAqC;AAA5B,mGAAA,UAAU,OAAA;AACnB,+BAAmC;AAA1B,iGAAA,SAAS,OAAA;AAClB,qCAAyC;AAAhC,uGAAA,YAAY,OAAA;AACrB,iCAAiC;AAAxB,+FAAA,MAAM,OAAA"}

package/dist/openfga.d.ts

@@ -0,0 +1,33 @@
+import type { BridgeResult } from './types';
+/**
+ * OpenFGA / Zanzibar ReBAC model + tuples → PCA predicate translator.
+ *
+ * The relation check "user U has relation R on object O" becomes a PCA permit:
+ *   { verb: R, resource: O, where: [{ field: 'subject.id', op: 'eq', value: U }] }
+ * so admitting verb R on resource O requires the acting subject to be exactly U. The translator
+ * evaluates the model against the supplied tuples and emits one permit per (user, object, relation)
+ * triple that HOLDS. Default deny: triples that don't hold emit nothing.
+ *
+ * SUPPORTED REWRITES (documented boundary)
+ * ----------------------------------------
+ *   - `this` ({})                direct relationship tuples
+ *   - `computedUserset`          "this relation is also granted by relation R on the same object"
+ *   - `union`                    OR of children (nested unions flattened)
+ *   - `intersection`             AND of children (→ an `all_of` of the per-child checks)
+ *   - `difference`               base AND NOT subtract (→ a `not` on the subtract check)
+ *   - `tupleToUserset`           userset rewrite "from" a related object (e.g. "viewer from parent"):
+ *                                follows the `tupleset` relation to each related object and checks the
+ *                                `computedUserset` relation there, as a BOUNDED, CYCLE-GUARDED closure
+ *
+ * All rewrites are resolved against the supplied tuple set at translation time (the whole tuple set is
+ * in hand), so intersection/difference/tupleToUserset produce exact concrete permits. Resolution is
+ * bounded by a maximum recursion depth and a per-(object, relation) visited set (so a cyclic model —
+ * e.g. mutually-referential parents — terminates and fails closed on the cycle).
+ *
+ * NOT MODELED (reported; fails closed — the relation grants nothing):
+ *   - userset-valued tuples (a tuple whose `user` is itself a userset, like "group:eng#member"):
+ *     expanding these to concrete users needs group-membership resolution of the userset, which the
+ *     concrete-user enumeration does not perform. Such tuples are reported and not expanded. (This is
+ *     the real remaining boundary: everything structural in the model is now resolved.)
+ */
+export declare function openfgaToPca(model: unknown, tuples: unknown): BridgeResult;

package/dist/openfga.js

@@ -0,0 +1,319 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openfgaToPca = openfgaToPca;
+/**
+ * OpenFGA / Zanzibar ReBAC model + tuples → PCA predicate translator.
+ *
+ * The relation check "user U has relation R on object O" becomes a PCA permit:
+ *   { verb: R, resource: O, where: [{ field: 'subject.id', op: 'eq', value: U }] }
+ * so admitting verb R on resource O requires the acting subject to be exactly U. The translator
+ * evaluates the model against the supplied tuples and emits one permit per (user, object, relation)
+ * triple that HOLDS. Default deny: triples that don't hold emit nothing.
+ *
+ * SUPPORTED REWRITES (documented boundary)
+ * ----------------------------------------
+ *   - `this` ({})                direct relationship tuples
+ *   - `computedUserset`          "this relation is also granted by relation R on the same object"
+ *   - `union`                    OR of children (nested unions flattened)
+ *   - `intersection`             AND of children (→ an `all_of` of the per-child checks)
+ *   - `difference`               base AND NOT subtract (→ a `not` on the subtract check)
+ *   - `tupleToUserset`           userset rewrite "from" a related object (e.g. "viewer from parent"):
+ *                                follows the `tupleset` relation to each related object and checks the
+ *                                `computedUserset` relation there, as a BOUNDED, CYCLE-GUARDED closure
+ *
+ * All rewrites are resolved against the supplied tuple set at translation time (the whole tuple set is
+ * in hand), so intersection/difference/tupleToUserset produce exact concrete permits. Resolution is
+ * bounded by a maximum recursion depth and a per-(object, relation) visited set (so a cyclic model —
+ * e.g. mutually-referential parents — terminates and fails closed on the cycle).
+ *
+ * NOT MODELED (reported; fails closed — the relation grants nothing):
+ *   - userset-valued tuples (a tuple whose `user` is itself a userset, like "group:eng#member"):
+ *     expanding these to concrete users needs group-membership resolution of the userset, which the
+ *     concrete-user enumeration does not perform. Such tuples are reported and not expanded. (This is
+ *     the real remaining boundary: everything structural in the model is now resolved.)
+ */
+function openfgaToPca(model, tuples) {
+    const report = { source: 'openfga', translated: [], skipped: [], errors: [] };
+    const predicates = [];
+    const typeRelations = parseModel(model, report);
+    const tupleList = parseTuples(tuples, report);
+    if (typeRelations === null)
+        return { predicates, denies: [], caveats: [], report };
+    // Index direct tuples: `${object}\u0000${relation}` -> Set<user>. Userset-valued users are noted.
+    const direct = new Map();
+    const usersSeen = new Set();
+    const objectsSeen = new Set();
+    let usersetTuples = 0;
+    for (const t of tupleList) {
+        objectsSeen.add(t.object);
+        const key = `${t.object}\u0000${t.relation}`;
+        let set = direct.get(key);
+        if (!set) {
+            set = new Set();
+            direct.set(key, set);
+        }
+        set.add(t.user);
+        if (t.user.includes('#'))
+            usersetTuples++;
+        else
+            usersSeen.add(t.user);
+    }
+    if (usersetTuples > 0) {
+        report.skipped.push(`${usersetTuples} userset-valued tuple(s) (user contains '#') not expanded to concrete users`);
+    }
+    // Build a resolution plan per (type, relation); report unsupported ones.
+    const plans = new Map();
+    for (const [type, relations] of typeRelations) {
+        for (const [relation, node] of relations) {
+            const built = buildPlan(node);
+            const key = `${type}\u0000${relation}`;
+            if (!built.ok || built.plan === undefined) {
+                report.skipped.push(`relation ${type}#${relation}: ${built.reason ?? 'unsupported rewrite'} — skipped`);
+                continue;
+            }
+            if (built.partial) {
+                report.skipped.push(`relation ${type}#${relation}: some union children unsupported and dropped (under-approximated)`);
+            }
+            plans.set(key, built.plan);
+            report.translated.push(`relation ${type}#${relation} (${describePlan(built.plan)})`);
+        }
+    }
+    const typeOf = (object) => {
+        const i = object.indexOf(':');
+        return i < 0 ? object : object.slice(0, i);
+    };
+    const objectOfUserset = (p) => {
+        const i = p.indexOf('#');
+        return i < 0 ? p : p.slice(0, i);
+    };
+    const MAX_DEPTH = 32;
+    const holdsRel = (user, object, relation, depth, visited) => {
+        const key = `${object}\u0000${relation}`;
+        if (depth > MAX_DEPTH || visited.has(key))
+            return false;
+        const plan = plans.get(`${typeOf(object)}\u0000${relation}`);
+        if (plan === undefined)
+            return false;
+        const next = new Set(visited);
+        next.add(key);
+        return evalPlan(user, object, relation, plan, depth, next);
+    };
+    const evalPlan = (user, object, relation, plan, depth, visited) => {
+        switch (plan.kind) {
+            case 'direct':
+                return direct.get(`${object}\u0000${relation}`)?.has(user) ?? false;
+            case 'computed':
+                return holdsRel(user, object, plan.relation, depth + 1, visited);
+            case 'union':
+                return plan.children.some((c) => evalPlan(user, object, relation, c, depth, visited));
+            case 'intersection':
+                return plan.children.every((c) => evalPlan(user, object, relation, c, depth, visited));
+            case 'difference':
+                return (evalPlan(user, object, relation, plan.base, depth, visited) &&
+                    !evalPlan(user, object, relation, plan.subtract, depth, visited));
+            case 'ttu': {
+                const related = direct.get(`${object}\u0000${plan.tupleset}`);
+                if (!related)
+                    return false;
+                for (const p of related) {
+                    if (holdsRel(user, objectOfUserset(p), plan.computed, depth + 1, visited))
+                        return true;
+                }
+                return false;
+            }
+        }
+    };
+    // Enumerate every (user, object, relation-defined-on-that-object's-type) triple that holds.
+    const sortedUsers = [...usersSeen].sort();
+    const sortedObjects = [...objectsSeen].sort();
+    for (const object of sortedObjects) {
+        const type = typeOf(object);
+        const relations = typeRelations.get(type);
+        if (!relations) {
+            report.skipped.push(`object ${object}: type "${type}" not defined in model — ignored`);
+            continue;
+        }
+        for (const relation of [...relations.keys()].sort()) {
+            if (!plans.has(`${type}\u0000${relation}`))
+                continue; // unsupported relation
+            for (const user of sortedUsers) {
+                if (holdsRel(user, object, relation, 0, new Set())) {
+                    predicates.push({ verb: relation, resource: object, where: [{ field: 'subject.id', op: 'eq', value: user }] });
+                }
+            }
+        }
+    }
+    return { predicates, denies: [], caveats: [], report };
+}
+function describePlan(plan) {
+    switch (plan.kind) {
+        case 'direct':
+            return 'direct';
+        case 'computed':
+            return `computed ${plan.relation}`;
+        case 'union':
+            return `union[${plan.children.map(describePlan).join(', ')}]`;
+        case 'intersection':
+            return `intersection[${plan.children.map(describePlan).join(', ')}]`;
+        case 'difference':
+            return `difference(${describePlan(plan.base)} - ${describePlan(plan.subtract)})`;
+        case 'ttu':
+            return `${plan.computed} from ${plan.tupleset}`;
+    }
+}
+function childNodes(container) {
+    if (container === null || typeof container !== 'object')
+        return null;
+    const child = container.child;
+    return Array.isArray(child) ? child : null;
+}
+/** Build a resolution plan from a userset-rewrite node. */
+function buildPlan(node) {
+    if (hasOwn(node, 'this'))
+        return { ok: true, plan: { kind: 'direct' }, partial: false };
+    if (hasOwn(node, 'computedUserset')) {
+        const cu = node.computedUserset;
+        const rel = cu && typeof cu === 'object' ? cu.relation : undefined;
+        if (typeof rel !== 'string' || rel.length === 0) {
+            return { ok: false, partial: false, reason: 'computedUserset without a relation' };
+        }
+        return { ok: true, plan: { kind: 'computed', relation: rel }, partial: false };
+    }
+    if (hasOwn(node, 'union')) {
+        const children = childNodes(node.union);
+        if (children === null)
+            return { ok: false, partial: false, reason: 'union without children' };
+        const subs = [];
+        let partial = false;
+        for (const child of children) {
+            if (!isRewrite(child)) {
+                partial = true;
+                continue;
+            }
+            const sub = buildPlan(child);
+            if (!sub.ok || sub.plan === undefined) {
+                partial = true; // OR under-approximates safely: drop the unmodeled child
+                continue;
+            }
+            if (sub.partial)
+                partial = true;
+            subs.push(sub.plan);
+        }
+        if (subs.length === 0)
+            return { ok: false, partial, reason: 'union with no modeled children' };
+        return { ok: true, plan: { kind: 'union', children: subs }, partial };
+    }
+    if (hasOwn(node, 'intersection')) {
+        const children = childNodes(node.intersection);
+        if (children === null)
+            return { ok: false, partial: false, reason: 'intersection without children' };
+        const subs = [];
+        for (const child of children) {
+            // An AND cannot drop a child without OVER-granting: every conjunct must be modeled.
+            if (!isRewrite(child))
+                return { ok: false, partial: false, reason: 'intersection child is not a rewrite' };
+            const sub = buildPlan(child);
+            if (!sub.ok || sub.plan === undefined) {
+                return { ok: false, partial: false, reason: `intersection child unmodeled (${sub.reason ?? 'unsupported'})` };
+            }
+            subs.push(sub.plan);
+        }
+        if (subs.length === 0)
+            return { ok: false, partial: false, reason: 'intersection with no children' };
+        return { ok: true, plan: { kind: 'intersection', children: subs }, partial: false };
+    }
+    if (hasOwn(node, 'difference')) {
+        const diff = node.difference;
+        if (diff === null || typeof diff !== 'object')
+            return { ok: false, partial: false, reason: 'malformed difference' };
+        const baseNode = diff.base;
+        const subNode = diff.subtract;
+        if (!isRewrite(baseNode) || !isRewrite(subNode)) {
+            return { ok: false, partial: false, reason: 'difference needs both base and subtract' };
+        }
+        const base = buildPlan(baseNode);
+        const subtract = buildPlan(subNode);
+        // Both halves must be modeled: dropping `base` or `subtract` would change the result unsafely.
+        if (!base.ok || base.plan === undefined)
+            return { ok: false, partial: false, reason: `difference base unmodeled (${base.reason ?? '?'})` };
+        if (!subtract.ok || subtract.plan === undefined)
+            return { ok: false, partial: false, reason: `difference subtract unmodeled (${subtract.reason ?? '?'})` };
+        return { ok: true, plan: { kind: 'difference', base: base.plan, subtract: subtract.plan }, partial: base.partial || subtract.partial };
+    }
+    if (hasOwn(node, 'tupleToUserset')) {
+        const ttu = node.tupleToUserset;
+        if (ttu === null || typeof ttu !== 'object')
+            return { ok: false, partial: false, reason: 'malformed tupleToUserset' };
+        const tuplesetRel = relationOf(ttu.tupleset);
+        const computedRel = relationOf(ttu.computedUserset);
+        if (tuplesetRel === null)
+            return { ok: false, partial: false, reason: 'tupleToUserset without a tupleset relation' };
+        if (computedRel === null)
+            return { ok: false, partial: false, reason: 'tupleToUserset without a computedUserset relation' };
+        return { ok: true, plan: { kind: 'ttu', tupleset: tuplesetRel, computed: computedRel }, partial: false };
+    }
+    return { ok: false, partial: false, reason: 'unknown rewrite node' };
+}
+/** The `.relation` string of a `{ relation }` object, or null. */
+function relationOf(v) {
+    if (v === null || typeof v !== 'object')
+        return null;
+    const rel = v.relation;
+    return typeof rel === 'string' && rel.length > 0 ? rel : null;
+}
+function hasOwn(o, k) {
+    return Object.prototype.hasOwnProperty.call(o, k);
+}
+function isRewrite(v) {
+    return v !== null && typeof v === 'object';
+}
+/** Parse the authorization model into type -> (relation -> rewrite node). Null if unusable. */
+function parseModel(model, report) {
+    if (model === null || typeof model !== 'object') {
+        report.errors.push('model is not an object');
+        return null;
+    }
+    const defs = model.type_definitions;
+    if (!Array.isArray(defs)) {
+        report.errors.push('model.type_definitions is missing or not an array');
+        return null;
+    }
+    const out = new Map();
+    for (const def of defs) {
+        if (def === null || typeof def !== 'object')
+            continue;
+        const type = def.type;
+        if (typeof type !== 'string' || type.length === 0)
+            continue;
+        const rels = def.relations;
+        const relMap = new Map();
+        if (rels !== null && typeof rels === 'object') {
+            for (const [name, node] of Object.entries(rels)) {
+                if (isRewrite(node))
+                    relMap.set(name, node);
+            }
+        }
+        out.set(type, relMap);
+    }
+    return out;
+}
+function parseTuples(tuples, report) {
+    if (!Array.isArray(tuples)) {
+        if (tuples !== undefined)
+            report.errors.push('tuples is not an array');
+        return [];
+    }
+    const out = [];
+    for (const t of tuples) {
+        if (t === null || typeof t !== 'object')
+            continue;
+        const user = t.user;
+        const relation = t.relation;
+        const object = t.object;
+        if (typeof user === 'string' && typeof relation === 'string' && typeof object === 'string') {
+            out.push({ user, relation, object });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=openfga.js.map

package/dist/openfga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../src/openfga.ts"],"names":[],"mappings":";;AAkCA,oCA0HC;AAzJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,YAAY,CAAC,KAAc,EAAE,MAAe;IAC1D,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjG,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAEnF,kGAAkG;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,aAAa,EAAE,CAAC;;YACrC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,aAAa,6EAA6E,CAAC,CAAC;IACrH,CAAC;IAED,yEAAyE;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,QAAQ,KAAK,KAAK,CAAC,MAAM,IAAI,qBAAqB,YAAY,CAAC,CAAC;gBACxG,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,QAAQ,oEAAoE,CAAC,CAAC;YACxH,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,CAAS,EAAU,EAAE;QAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,EAAE,CAAC;IAErB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAoB,EAAW,EAAE;QAChH,MAAM,GAAG,GAAG,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC;QACzC,IAAI,KAAK,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CACf,IAAY,EACZ,MAAc,EACd,QAAgB,EAChB,IAAU,EACV,KAAa,EACb,OAAoB,EACX,EAAE;QACX,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YACtE,KAAK,UAAU;gBACb,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACnE,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACxF,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACzF,KAAK,YAAY;gBACf,OAAO,CACL,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;oBAC3D,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CACjE,CAAC;YACJ,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,OAAO,KAAK,CAAC;gBAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,IAAI,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACzF,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,WAAW,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,MAAM,WAAW,IAAI,kCAAkC,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,QAAQ,EAAE,CAAC;gBAAE,SAAS,CAAC,uBAAuB;YAC7E,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;oBACnD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAmBD,SAAS,YAAY,CAAC,IAAU;IAC9B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,KAAK,OAAO;YACV,OAAO,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAChE,KAAK,cAAc;YACjB,OAAO,gBAAgB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACvE,KAAK,YAAY;YACf,OAAO,cAAc,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnF,KAAK,KAAK;YACR,OAAO,GAAG,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,SAAkB;IACpC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,KAAK,GAAI,SAAiC,CAAC,KAAK,CAAC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,2DAA2D;AAC3D,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAExF,IAAI,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAChC,MAAM,GAAG,GAAG,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,EAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC9F,MAAM,IAAI,GAAW,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO,GAAG,IAAI,CAAC;gBACf,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,GAAG,IAAI,CAAC,CAAC,yDAAyD;gBACzE,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACrG,MAAM,IAAI,GAAW,EAAE,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,oFAAoF;YACpF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;YAC3G,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,GAAG,CAAC,MAAM,IAAI,aAAa,GAAG,EAAE,CAAC;YAChH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACpH,MAAM,QAAQ,GAAI,IAA2B,CAAC,IAAI,CAAC;QACnD,MAAM,OAAO,GAAI,IAA+B,CAAC,QAAQ,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,+FAA+F;QAC/F,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QAC3I,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,QAAQ,CAAC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QAC3J,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzI,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QACtH,MAAM,WAAW,GAAG,UAAU,CAAE,GAA8B,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,UAAU,CAAE,GAAqC,CAAC,eAAe,CAAC,CAAC;QACvF,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QACrH,IAAI,WAAW,KAAK,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;QAC5H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;AACvE,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAI,CAA4B,CAAC,QAAQ,CAAC;IACnD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAkBD,SAAS,MAAM,CAAmB,CAAS,EAAE,CAAI;IAC/C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AAC7C,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,KAAc,EAAE,MAAyB;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAI,KAAwC,CAAC,gBAAgB,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAI,GAA+B,CAAC,SAAS,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;gBAC3E,IAAI,SAAS,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,MAAe,EAAE,MAAyB;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,IAAI,GAAI,CAAwB,CAAC,IAAI,CAAC;QAC5C,MAAM,QAAQ,GAAI,CAA4B,CAAC,QAAQ,CAAC;QACxD,MAAM,MAAM,GAAI,CAA0B,CAAC,MAAM,CAAC;QAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rego.d.ts

@@ -0,0 +1,44 @@
+import type { BridgeResult } from './types';
+/**
+ * OPA/Rego → PCA predicate translator.
+ *
+ * Rego is Turing-complete. This translator models ONLY the ubiquitous "allow-rule as a conjunction
+ * of input comparisons" idiom and fails closed on everything else — an unmodeled construct never
+ * widens an allow.
+ *
+ * SUPPORTED SUBSET (documented boundary)
+ * --------------------------------------
+ *   package <name>                     — recorded, otherwise ignored
+ *   default allow = false              — the only safe default; anything else is reported & ignored
+ *   allow { <body> }                   — also `allow = true { }`, `allow := true { }`, `allow if { }`
+ *
+ * Each `allow` rule body is a conjunction of statements (one per line or `;`). Each `allow` rule is
+ * an independent predicate (rules OR together — Rego's multiple-definition semantics).
+ *
+ * Statements, where a path is `input.<dotted>`:
+ *   - `input.action == "x"`            — sets the predicate VERB (special field)
+ *   - `input.action in {"a","b"}`      — verb = ["a","b"]
+ *   - `input.resource == "r"`          — sets the predicate RESOURCE (special field)
+ *   - `input.<p> == <lit>` / `!=`      — eq / ne condition on env.<p>
+ *   - `input.<p> in {set}` / `[array]` — in condition (membership in a literal set)
+ *   - `input.<p> < <num>` `<=` `>` `>=`— numeric comparison (lt/lte/gt/gte)
+ *   - `input.<p> == input.<q>`         — ref comparison (env.<p> == env.<q>)
+ *   - `not <stmt>`                     — negation (→ a `not` grouping); the inner must itself be a
+ *                                        modeled CONDITION (not a verb/resource selector)
+ *   - `startswith(input.<p>, "pre")`   — prefix condition (exact: startswith is anchored-at-start)
+ *   - `glob.match("pat", [], input.<p>)` / `glob.match("pat", null, input.<p>)` — like condition
+ *     (glob.match is whole-string/anchored; with empty/null delimiters `*` spans everything)
+ * Literals: "string", number, true/false.
+ *
+ * NOT MODELED (reported; the ENTIRE containing rule is dropped — a conjunct we cannot model could
+ * only be dropped by WIDENING the allow, which is unsafe). This is the honest minimum, all of it
+ * genuinely beyond a finite predicate:
+ *   - `:=` local assignment; `some`/`every`, comprehensions, iteration/wildcards (`input.xs[_]`) —
+ *     bounded quantification / iteration with side conditions;
+ *   - arbitrary function/builtin calls other than the pure anchored matchers above (`count(...)`,
+ *     `regex.match(...)` — unanchored, so not faithfully an anchored `matches` — `endswith(...)` —
+ *     no suffix op — `net.cidr_contains(...)`, …);
+ *   - references to other rules, object/set construction in the body, bare truthiness (`input.flag`),
+ *     and reverse membership `"lit" in input.coll` (a literal inside an input collection).
+ */
+export declare function regoToPca(moduleText: string): BridgeResult;