@highflame/policy 1.1.3 → 1.2.1

package/dist/parser.js

@@ -0,0 +1,393 @@
+/**
+ * Cedar Policy Parser
+ *
+ * Converts Cedar policy text to structured PolicyRule format using the
+ * official Cedar engine (cedar-wasm) for parsing.
+ *
+ * Architecture:
+ * 1. Cedar text → Cedar JSON (via cedar-wasm policyToJson)
+ * 2. Cedar JSON → PolicyRule (simple JSON mapping)
+ */
+import * as cedar from "@cedar-policy/cedar-wasm/nodejs";
+import { ParserError, ErrorCodes } from "./errors.js";
+/**
+ * Normalize entity reference to simple { type, id } format
+ */
+function normalizeEntityRef(ref) {
+    if ("__entity" in ref) {
+        return ref.__entity;
+    }
+    return ref;
+}
+/**
+ * Parse Cedar policy text and convert to PolicyRule format.
+ *
+ * Uses the official cedar-wasm engine for parsing, ensuring correctness.
+ * Policies with features that can't be represented as PolicyRule (e.g.,
+ * unless clauses, complex expressions) are returned in the unstructured array.
+ *
+ * @param cedarText - Cedar policy text to parse
+ * @returns ParseResult with structured rules, unstructured policies, and errors
+ */
+export function parseCedarToRules(cedarText) {
+    const result = {
+        rules: [],
+        unstructured: [],
+        errors: [],
+    };
+    try {
+        // Split the policy set into individual policies and templates
+        const partsResult = cedar.policySetTextToParts(cedarText);
+        if (partsResult.type === "failure") {
+            for (const error of partsResult.errors) {
+                result.errors.push(error.message);
+            }
+            return result;
+        }
+        // Process each policy
+        let index = 0;
+        for (const policyText of partsResult.policies) {
+            // Convert individual policy to JSON using cedar-wasm
+            const jsonResult = cedar.policyToJson(policyText);
+            if (jsonResult.type === "failure") {
+                for (const error of jsonResult.errors) {
+                    result.errors.push(`Policy ${index}: ${error.message}`);
+                }
+                index++;
+                continue;
+            }
+            const policy = jsonResult.json;
+            const policyId = policy.annotations?.id || `policy${index}`;
+            const conversion = cedarJsonToRule(policy, policyId, index, policyText);
+            if (conversion.error) {
+                result.errors.push(`Policy ${policyId}: ${conversion.error}`);
+            }
+            if (conversion.rule) {
+                result.rules.push(conversion.rule);
+            }
+            else if (conversion.raw) {
+                result.unstructured.push(conversion.raw);
+            }
+            index++;
+        }
+        // Templates can't be represented as PolicyRule
+        for (const templateText of partsResult.policy_templates) {
+            result.unstructured.push(templateText);
+        }
+    }
+    catch (e) {
+        result.errors.push(`Parse error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // Check for duplicate policy IDs and add warnings
+    const idOccurrences = new Map();
+    result.rules.forEach((rule, idx) => {
+        if (rule.id) {
+            const indices = idOccurrences.get(rule.id) || [];
+            indices.push(idx);
+            idOccurrences.set(rule.id, indices);
+        }
+    });
+    for (const [id, indices] of idOccurrences) {
+        if (indices.length > 1) {
+            result.errors.push(`[${ErrorCodes.PARSE_DUPLICATE_ID}] Duplicate policy ID '${id}' found at indices [${indices.join(", ")}]`);
+        }
+    }
+    return result;
+}
+/**
+ * Convert Cedar JSON policy to PolicyRule.
+ * This is pure JSON mapping - no parsing logic.
+ */
+function cedarJsonToRule(policy, policyId, index, originalText) {
+    // Check if this policy can be represented as PolicyRule
+    if (!canRepresentAsRule(policy)) {
+        // Return original text if available, otherwise convert back from JSON
+        const raw = originalText || getRawCedar(policyId, policy);
+        return { raw };
+    }
+    try {
+        const rule = {
+            id: policy.annotations?.id || policyId,
+            name: policy.annotations?.name || policy.annotations?.id || policyId,
+            effect: policy.effect,
+            principal: mapScopeToEntity(policy.principal, "principal"),
+            action: mapActionScope(policy.action),
+            resource: mapScopeToEntity(policy.resource, "resource"),
+            conditions: [],
+            enabled: true,
+            order: index,
+        };
+        // Map description from annotations
+        if (policy.annotations?.description) {
+            rule.description = policy.annotations.description;
+        }
+        // Map conditions
+        const { conditions, rawCondition } = mapConditions(policy.conditions);
+        rule.conditions = conditions;
+        if (rawCondition) {
+            rule.rawCondition = rawCondition;
+        }
+        return { rule };
+    }
+    catch (e) {
+        const error = e instanceof Error ? e.message : String(e);
+        const raw = originalText || getRawCedar(policyId, policy);
+        return { raw, error };
+    }
+}
+/**
+ * Check if a Cedar policy can be represented as PolicyRule
+ */
+function canRepresentAsRule(policy) {
+    // Unless clauses can't be represented
+    for (const cond of policy.conditions) {
+        if (cond.kind === "unless") {
+            return false;
+        }
+    }
+    // Template slots can't be represented
+    if (hasSlot(policy.principal) || hasSlot(policy.resource)) {
+        return false;
+    }
+    // Multiple entity "in" constraints are complex
+    const action = policy.action;
+    if (action.op === "in" && "entities" in action && action.entities.length > 1) {
+        // Multiple actions are OK, we handle those
+    }
+    return true;
+}
+/**
+ * Check if a scope constraint uses a slot (template)
+ */
+function hasSlot(scope) {
+    if (scope.op === "All" || scope.op === "is") {
+        return false;
+    }
+    return "slot" in scope;
+}
+/**
+ * Get raw Cedar text for a policy that can't be represented as PolicyRule
+ */
+function getRawCedar(policyId, policy) {
+    try {
+        // policyToText accepts Policy which is string | PolicyJson
+        const textResult = cedar.policyToText(policy);
+        if (textResult.type === "success") {
+            return textResult.text;
+        }
+    }
+    catch {
+        // Ignore conversion errors
+    }
+    // Sanitize policyId to prevent newline injection attacks
+    const safeId = policyId.replace(/[\n\r]/g, " ");
+    return `// Complex policy: ${safeId}`;
+}
+/**
+ * Map Cedar scope constraint to PolicyEntity
+ *
+ * Returns null for unconstrained ("All") scopes.
+ * Throws ParserError for malformed constraints to prevent silent misinterpretation.
+ *
+ * @param scope - The Cedar scope constraint
+ * @param field - The field name ("principal" or "resource") for error context
+ */
+function mapScopeToEntity(scope, field) {
+    if (scope.op === "All") {
+        return null;
+    }
+    if (scope.op === "==") {
+        if ("entity" in scope) {
+            const entity = normalizeEntityRef(scope.entity);
+            return { type: entity.type, id: entity.id };
+        }
+        if ("slot" in scope) {
+            throw ParserError.scopeSlotNotSupported("==", field);
+        }
+        throw ParserError.scopeMissingEntity("==", field);
+    }
+    if (scope.op === "is") {
+        if (scope.entity_type) {
+            return { type: scope.entity_type };
+        }
+        throw ParserError.scopeMissingEntityType(field);
+    }
+    if (scope.op === "in") {
+        if ("entity" in scope) {
+            const entity = normalizeEntityRef(scope.entity);
+            return { type: entity.type, id: entity.id };
+        }
+        if ("slot" in scope) {
+            throw ParserError.scopeSlotNotSupported("in", field);
+        }
+        throw ParserError.scopeMissingEntityList(field);
+    }
+    throw ParserError.scopeUnsupportedOp(scope.op, field);
+}
+/**
+ * Map action scope to action string(s)
+ *
+ * Throws ParserError for malformed constraints to prevent silent misinterpretation.
+ */
+function mapActionScope(scope) {
+    if (scope.op === "All") {
+        return "*";
+    }
+    if (scope.op === "==") {
+        if ("entity" in scope) {
+            const entity = normalizeEntityRef(scope.entity);
+            return entity.id;
+        }
+        throw ParserError.actionMissingEntity("==");
+    }
+    if (scope.op === "in") {
+        if ("entities" in scope) {
+            const actions = scope.entities.map(e => normalizeEntityRef(e).id);
+            return actions.length === 1 ? actions[0] : actions;
+        }
+        if ("entity" in scope) {
+            const entity = normalizeEntityRef(scope.entity);
+            return entity.id;
+        }
+        throw ParserError.actionMissingEntities();
+    }
+    throw ParserError.actionUnsupportedOp(scope.op);
+}
+/**
+ * Map Cedar conditions to PolicyCondition array
+ */
+function mapConditions(conditions) {
+    const result = [];
+    const rawParts = [];
+    for (const cond of conditions) {
+        if (cond.kind !== "when") {
+            continue;
+        }
+        const parsed = mapConditionBody(cond.body);
+        if (parsed.condition) {
+            result.push(parsed.condition);
+        }
+        else if (parsed.raw) {
+            rawParts.push(parsed.raw);
+        }
+    }
+    // Store raw conditions as a valid JSON array instead of joining with " && "
+    // This ensures downstream systems can parse the rawCondition field
+    return {
+        conditions: result,
+        rawCondition: rawParts.length > 0 ? `[${rawParts.join(",")}]` : undefined,
+    };
+}
+/**
+ * Map a Cedar expression body to PolicyCondition
+ *
+ * Cedar JSON expressions use nested objects with operator keys.
+ * Comparison format: { "==": { left: { ".": { left: { Var: "context" }, attr: "field" } }, right: { Value: "x" } } }
+ */
+function mapConditionBody(body) {
+    const expr = body;
+    // Check comparison operators
+    for (const op of ["==", "!=", "<", "<=", ">", ">="]) {
+        const comparison = expr[op];
+        if (comparison) {
+            const condition = mapComparison(op, comparison);
+            if (condition)
+                return { condition };
+        }
+    }
+    // Check contains
+    if (expr.contains) {
+        const condition = mapContains(expr.contains);
+        if (condition)
+            return { condition };
+    }
+    // Check like
+    if (expr.like) {
+        const condition = mapLike(expr.like);
+        if (condition)
+            return { condition };
+    }
+    // Can't map - return as raw JSON
+    return { raw: JSON.stringify(body) };
+}
+function mapComparison(op, args) {
+    const field = extractContextField(args.left);
+    if (!field)
+        return null;
+    const value = extractLiteralValue(args.right);
+    if (value === undefined)
+        return null;
+    const operator = mapOperator(op);
+    if (!operator)
+        return null;
+    return { field, operator, value };
+}
+function mapContains(args) {
+    const field = extractContextField(args.left);
+    if (!field)
+        return null;
+    const value = extractLiteralValue(args.right);
+    if (value === undefined)
+        return null;
+    return { field, operator: "contains", value };
+}
+function mapLike(args) {
+    const field = extractContextField(args.left);
+    if (!field)
+        return null;
+    // Convert pattern to string (e.g., ["Wildcard", { Literal: "foo" }, "Wildcard"] -> "*foo*")
+    // Escape literal * characters to distinguish from wildcards on round-trip
+    const patternStr = args.pattern.map(p => {
+        if (p === "Wildcard")
+            return "*";
+        if (typeof p === "object" && "Literal" in p)
+            return p.Literal.replace(/\*/g, "\\*");
+        return "";
+    }).join("");
+    return { field, operator: "like", value: patternStr };
+}
+/**
+ * Extract field name from context.field access pattern
+ * Pattern: { ".": { left: { Var: "context" }, attr: "field_name" } }
+ */
+function extractContextField(expr) {
+    const dotAccess = expr["."];
+    if (!dotAccess)
+        return null;
+    // Check if accessing context variable
+    const leftExpr = dotAccess.left;
+    if (leftExpr.Var !== "context")
+        return null;
+    return dotAccess.attr;
+}
+/**
+ * Extract literal value from Cedar JSON
+ * Pattern: { Value: <literal> }
+ */
+function extractLiteralValue(expr) {
+    if (!("Value" in expr))
+        return undefined;
+    const value = expr.Value;
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+        return value;
+    }
+    if (Array.isArray(value) && value.every(v => typeof v === "string")) {
+        return value;
+    }
+    return undefined;
+}
+/**
+ * Map Cedar operator to ConditionOperator
+ */
+function mapOperator(cedarOp) {
+    const mapping = {
+        "==": "eq",
+        "!=": "neq",
+        "<": "lt",
+        "<=": "lte",
+        ">": "gt",
+        ">=": "gte",
+    };
+    return mapping[cedarOp] || null;
+}
+//# sourceMappingURL=parser.js.map

package/dist/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,KAAK,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqDtD;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAmB;IAC7C,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,MAAM,MAAM,GAAgB;QAC1B,KAAK,EAAE,EAAE;QACT,YAAY,EAAE,EAAE;QAChB,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,sBAAsB;QACtB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAC9C,qDAAqD;YACrD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAElD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,KAAK,EAAE,CAAC;gBACR,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,IAAuB,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,SAAS,KAAK,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAExE,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,QAAQ,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;iBAAM,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC1B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;YAED,KAAK,EAAE,CAAC;QACV,CAAC;QAED,+CAA+C;QAC/C,KAAK,MAAM,YAAY,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;YACxD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;IAEH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,kDAAkD;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,IAAI,UAAU,CAAC,kBAAkB,0BAA0B,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,MAAuB,EACvB,QAAgB,EAChB,KAAa,EACb,YAAqB;IAGrB,wDAAwD;IACxD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,sEAAsE;QACtE,MAAM,GAAG,GAAG,YAAY,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,QAAQ;YACtC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,QAAQ;YACpE,MAAM,EAAE,MAAM,CAAC,MAAsB;YACrC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;YAC1D,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;YACvD,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;SACb,CAAC;QAEF,mCAAmC;QACnC,IAAI,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;QACpD,CAAC;QAED,iBAAiB;QACjB,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACnC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,MAAuB;IACjD,sCAAsC;IACtC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,UAAU,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,2CAA2C;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,OAAO,CAAC,KAA2B;IAC1C,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,IAAI,KAAK,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAuB;IAC5D,IAAI,CAAC;QACH,2DAA2D;QAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,MAA0B,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,yDAAyD;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,sBAAsB,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,KAA2B,EAAE,KAAa;IAClE,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,WAAW,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,WAAW,CAAC,kBAAkB,CAAE,KAAwB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAA4B;IAClD,IAAI,KAAK,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,CAAC;QACD,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,WAAW,CAAC,qBAAqB,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,WAAW,CAAC,mBAAmB,CAAE,KAAwB,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,UAA4B;IAIjD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,mEAAmE;IACnE,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KAC1E,CAAC;AACJ,CAAC;AAmBD;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAA6B;IAIrD,MAAM,IAAI,GAAG,IAAiB,CAAC;IAE/B,6BAA6B;IAC7B,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAU,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAED,aAAa;IACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACtC,CAAC;IAED,iCAAiC;IACjC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,EAAU,EAAE,IAA2C;IAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,IAA2C;IAC9D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,IAA2E;IAC1F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,4FAA4F;IAC5F,0EAA0E;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACtC,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,GAAG,CAAC;QACjC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpF,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAe;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,sCAAsC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC;IAChC,IAAI,QAAQ,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5C,OAAO,SAAS,CAAC,IAAI,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,IAAe;IAC1C,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,KAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,OAAO,GAAsC;QACjD,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;AAClC,CAAC"}

package/dist/parser.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Parser unit tests
+ *
+ * Tests the Cedar text → PolicyRule conversion using the official Cedar engine.
+ * These tests demonstrate how a client like highflame-authz would use the parser.
+ */
+export {};
+//# sourceMappingURL=parser.test.d.ts.map

package/dist/parser.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.test.d.ts","sourceRoot":"","sources":["../src/parser.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/parser.test.js

@@ -0,0 +1,143 @@
+/**
+ * Parser unit tests
+ *
+ * Tests the Cedar text → PolicyRule conversion using the official Cedar engine.
+ * These tests demonstrate how a client like highflame-authz would use the parser.
+ */
+import { describe, it, expect } from 'vitest';
+import { parseCedarToRules } from './parser.js';
+describe('parseCedarToRules', () => {
+    it('should parse a simple permit policy', () => {
+        const cedarText = `
+      @id("allow-read-files")
+      permit(
+        principal is User,
+        action == Action::"read_file",
+        resource is FilePath
+      );
+    `;
+        const result = parseCedarToRules(cedarText);
+        expect(result.errors).toHaveLength(0);
+        expect(result.rules).toHaveLength(1);
+        expect(result.unstructured).toHaveLength(0);
+        const rule = result.rules[0];
+        expect(rule.id).toBe('allow-read-files');
+        expect(rule.effect).toBe('permit');
+        expect(rule.principal).toEqual({ type: 'User' });
+        expect(rule.action).toBe('read_file');
+        expect(rule.resource).toEqual({ type: 'FilePath' });
+        expect(rule.enabled).toBe(true);
+    });
+    it('should parse a policy with when conditions', () => {
+        const cedarText = `
+      @id("block-high-risk")
+      forbid(
+        principal,
+        action == Action::"execute_tool",
+        resource
+      )
+      when {
+        context.threat_level == "high"
+      };
+    `;
+        const result = parseCedarToRules(cedarText);
+        expect(result.errors).toHaveLength(0);
+        expect(result.rules).toHaveLength(1);
+        const rule = result.rules[0];
+        expect(rule.id).toBe('block-high-risk');
+        expect(rule.effect).toBe('forbid');
+        expect(rule.action).toBe('execute_tool');
+        // Check condition was parsed
+        expect(rule.conditions.length).toBeGreaterThanOrEqual(0);
+        // If condition parsing works, it should have the condition
+        // If not, it should be in rawCondition
+        if (rule.conditions.length > 0) {
+            expect(rule.conditions[0].field).toBe('threat_level');
+            expect(rule.conditions[0].operator).toBe('eq');
+            expect(rule.conditions[0].value).toBe('high');
+        }
+        else {
+            expect(rule.rawCondition).toBeDefined();
+        }
+    });
+    it('should return errors for invalid Cedar syntax', () => {
+        const invalidCedar = `
+      permit(
+        principal is User
+        // missing comma and rest of policy
+    `;
+        const result = parseCedarToRules(invalidCedar);
+        expect(result.errors.length).toBeGreaterThan(0);
+    });
+    it('should handle multiple policies', () => {
+        const cedarText = `
+      @id("rule-1")
+      permit(principal, action == Action::"read", resource);
+
+      @id("rule-2")
+      forbid(principal, action == Action::"delete", resource);
+    `;
+        const result = parseCedarToRules(cedarText);
+        expect(result.errors).toHaveLength(0);
+        expect(result.rules).toHaveLength(2);
+        expect(result.rules[0].effect).toBe('permit');
+        expect(result.rules[1].effect).toBe('forbid');
+    });
+    it('should put policies with unless clauses in unstructured', () => {
+        const cedarText = `
+      permit(principal, action, resource)
+      unless {
+        context.is_blocked == true
+      };
+    `;
+        const result = parseCedarToRules(cedarText);
+        // Unless clauses can't be represented as PolicyRule
+        expect(result.rules).toHaveLength(0);
+        expect(result.unstructured.length).toBeGreaterThan(0);
+    });
+    it('should store complex conditions as valid JSON array in rawCondition', () => {
+        // Use a condition with boolean AND that can't be mapped to structured format
+        const cedarText = `
+      @id("complex-condition")
+      permit(principal, action, resource)
+      when {
+        context.a == "x" && context.b == "y"
+      };
+    `;
+        const result = parseCedarToRules(cedarText);
+        expect(result.errors).toHaveLength(0);
+        expect(result.rules).toHaveLength(1);
+        const rule = result.rules[0];
+        // The complex && condition should be in rawCondition as valid JSON array
+        if (rule.rawCondition) {
+            // Verify it's valid JSON (should not throw)
+            const parsed = JSON.parse(rule.rawCondition);
+            expect(Array.isArray(parsed)).toBe(true);
+            expect(parsed.length).toBeGreaterThan(0);
+        }
+        // Either conditions were mapped or rawCondition contains valid JSON
+        expect(rule.conditions.length > 0 || rule.rawCondition).toBeTruthy();
+    });
+    it('should warn about duplicate policy IDs', () => {
+        const cedarText = `
+      @id("duplicate-id")
+      permit(principal, action, resource);
+
+      @id("unique-id")
+      forbid(principal, action, resource);
+
+      @id("duplicate-id")
+      permit(principal is User, action, resource);
+    `;
+        const result = parseCedarToRules(cedarText);
+        // All policies should still be parsed
+        expect(result.rules).toHaveLength(3);
+        // Should have a warning about duplicate ID
+        const duplicateError = result.errors.find(e => e.includes("HFP-PARSE-005"));
+        expect(duplicateError).toBeDefined();
+        expect(duplicateError).toContain("duplicate-id");
+        expect(duplicateError).toContain("[0"); // First occurrence at index 0
+        expect(duplicateError).toContain("2"); // Second occurrence at index 2
+    });
+});
+//# sourceMappingURL=parser.test.js.map

package/dist/parser.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.test.js","sourceRoot":"","sources":["../src/parser.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,SAAS,GAAG;;;;;;;KAOjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,SAAS,GAAG;;;;;;;;;;KAUjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEzC,6BAA6B;QAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACzD,2DAA2D;QAC3D,uCAAuC;QACvC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,YAAY,GAAG;;;;KAIpB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAE/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,SAAS,GAAG;;;;;;KAMjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,SAAS,GAAG;;;;;KAKjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,oDAAoD;QACpD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,6EAA6E;QAC7E,MAAM,SAAS,GAAG;;;;;;KAMjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7B,yEAAyE;QACzE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,4CAA4C;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,oEAAoE;QACpE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,SAAS,GAAG;;;;;;;;;KASjB,CAAC;QAEF,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAE5C,sCAAsC;QACtC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAErC,2CAA2C;QAC3C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,8BAA8B;QACvE,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAG,+BAA+B;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}