@wbce/projen-d9 0.0.28 → 0.1.0

package/lib/cli/commands/cedar/cedar-format.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyToCedarText = policyToCedarText;
+const cedar = require("@cedar-policy/cedar-wasm/nodejs");
+const logger_1 = require("../../logger");
+/** Width of one logical level: the operator column (`|| `) plus the base gap. */
+const LEVEL_INDENT = ' '.repeat(5);
+function booleanOperator(expr) {
+    const key = Object.keys(expr)[0];
+    return key === '&&' || key === '||' ? key : undefined;
+}
+/** Cedar's text for a policy with `All` scopes and a single `when` clause. */
+const LEAF_PREFIX = 'permit(principal, action, resource) when { ';
+const LEAF_SUFFIX = ' };';
+/** Any non-boolean expression, printed by Cedar itself. */
+function leafToText(expr) {
+    const result = cedar.policyToText({
+        effect: 'permit',
+        principal: { op: 'All' },
+        action: { op: 'All' },
+        resource: { op: 'All' },
+        conditions: [{ kind: 'when', body: expr }],
+    });
+    if (result.type === 'failure') {
+        logger_1.logger.error({ expr }, 'failed to transform expression into text');
+        throw new Error(result.errors);
+    }
+    return result.text.slice(LEAF_PREFIX.length, -LEAF_SUFFIX.length);
+}
+/**
+ * Lines of `expr` within a group of `parent`, each starting with a 3-character
+ * operator column; a nested group (other operator) goes one level deeper in parentheses.
+ */
+function toLines(expr, parent) {
+    const operator = booleanOperator(expr);
+    if (!operator)
+        return [`   ${leafToText(expr)}`];
+    // the top level (no parent) is a group without parentheses
+    if (parent && operator !== parent) {
+        return ['   (', ...toLines(expr, operator).map((line) => LEVEL_INDENT + line), '   )'];
+    }
+    // the operator joins the two sides, on the line where the right side starts
+    const [first, ...rest] = toLines(expr[operator].right, operator);
+    return [...toLines(expr[operator].left, operator), `${operator} ${first.slice(3)}`, ...rest];
+}
+/**
+ * Cedar's formatter for the policy head, our own layout for the conditions:
+ * operands of one logical level share an indentation, each nested level adds one,
+ * and the `&&` / `||` operator leads the line.
+ */
+function policyToCedarText(policy) {
+    const head = cedar.policyToText({ ...policy, conditions: [] });
+    if (head.type === 'failure') {
+        logger_1.logger.error({ policy }, 'failed to transform policy into text');
+        throw new Error(head.errors);
+    }
+    const formattedHead = cedar.formatPolicies({
+        policyText: head.text,
+        lineWidth: 100,
+        indentWidth: 2,
+    });
+    if (formattedHead.type === 'failure') {
+        throw new Error(formattedHead);
+    }
+    // a policy without conditions is formatted as `…;\n`
+    const lines = [formattedHead.formatted_policy.slice(0, -2)];
+    // translateToCedar writes at most one `when` clause
+    const [condition] = policy.conditions;
+    if (condition) {
+        const when = toLines(condition.body);
+        lines.push(['when {', ...when.map((line) => `  ${line}`), '}'].join('\n'));
+    }
+    return lines.join('\n') + ';';
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItZm9ybWF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NsaS9jb21tYW5kcy9jZWRhci9jZWRhci1mb3JtYXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFxREEsOENBeUJDO0FBOUVELHlEQUF5RDtBQUV6RCx5Q0FBc0M7QUFFdEMsaUZBQWlGO0FBQ2pGLE1BQU0sWUFBWSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFbkMsU0FBUyxlQUFlLENBQUMsSUFBUztJQUNoQyxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sR0FBRyxLQUFLLElBQUksSUFBSSxHQUFHLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUN4RCxDQUFDO0FBRUQsOEVBQThFO0FBQzlFLE1BQU0sV0FBVyxHQUFHLDZDQUE2QyxDQUFDO0FBQ2xFLE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQztBQUUxQiwyREFBMkQ7QUFDM0QsU0FBUyxVQUFVLENBQUMsSUFBUztJQUMzQixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxRQUFRO1FBQ2hCLFNBQVMsRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUU7UUFDeEIsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRTtRQUNyQixRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFO1FBQ3ZCLFVBQVUsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7S0FDM0MsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzlCLGVBQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSwwQ0FBMEMsQ0FBQyxDQUFDO1FBQ25FLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQWEsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDcEUsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsT0FBTyxDQUFDLElBQVMsRUFBRSxNQUFlO0lBQ3pDLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2QyxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU8sQ0FBQyxNQUFNLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDakQsMkRBQTJEO0lBQzNELElBQUksTUFBTSxJQUFJLFFBQVEsS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBQ0QsNEVBQTRFO0lBQzVFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNqRSxPQUFPLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsRUFBRSxHQUFHLFFBQVEsSUFBSSxLQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztBQUNoRyxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQWdCLGlCQUFpQixDQUFDLE1BQWtCO0lBQ2xELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMvRCxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDNUIsZUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLHNDQUFzQyxDQUFDLENBQUM7UUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBYSxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxjQUFjLENBQUM7UUFDekMsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ3JCLFNBQVMsRUFBRSxHQUFHO1FBQ2QsV0FBVyxFQUFFLENBQUM7S0FDZixDQUFDLENBQUM7SUFDSCxJQUFJLGFBQWEsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxhQUFvQixDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUNELHFEQUFxRDtJQUNyRCxNQUFNLEtBQUssR0FBRyxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RCxvREFBb0Q7SUFDcEQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7SUFDdEMsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNkLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckMsS0FBSyxDQUFDLElBQUksQ0FDUixDQUFDLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQy9ELENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEdBQUcsQ0FBQztBQUNoQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2VkYXIgZnJvbSAnQGNlZGFyLXBvbGljeS9jZWRhci13YXNtL25vZGVqcyc7XG5pbXBvcnQgdHlwZSB7IFBvbGljeUpzb24gfSBmcm9tICdAY2VkYXItcG9saWN5L2NlZGFyLXdhc20vbm9kZWpzJztcbmltcG9ydCB7IGxvZ2dlciB9IGZyb20gJy4uLy4uL2xvZ2dlcic7XG5cbi8qKiBXaWR0aCBvZiBvbmUgbG9naWNhbCBsZXZlbDogdGhlIG9wZXJhdG9yIGNvbHVtbiAoYHx8IGApIHBsdXMgdGhlIGJhc2UgZ2FwLiAqL1xuY29uc3QgTEVWRUxfSU5ERU5UID0gJyAnLnJlcGVhdCg1KTtcblxuZnVuY3Rpb24gYm9vbGVhbk9wZXJhdG9yKGV4cHI6IGFueSk6ICcmJicgfCAnfHwnIHwgdW5kZWZpbmVkIHtcbiAgY29uc3Qga2V5ID0gT2JqZWN0LmtleXMoZXhwcilbMF07XG4gIHJldHVybiBrZXkgPT09ICcmJicgfHwga2V5ID09PSAnfHwnID8ga2V5IDogdW5kZWZpbmVkO1xufVxuXG4vKiogQ2VkYXIncyB0ZXh0IGZvciBhIHBvbGljeSB3aXRoIGBBbGxgIHNjb3BlcyBhbmQgYSBzaW5nbGUgYHdoZW5gIGNsYXVzZS4gKi9cbmNvbnN0IExFQUZfUFJFRklYID0gJ3Blcm1pdChwcmluY2lwYWwsIGFjdGlvbiwgcmVzb3VyY2UpIHdoZW4geyAnO1xuY29uc3QgTEVBRl9TVUZGSVggPSAnIH07JztcblxuLyoqIEFueSBub24tYm9vbGVhbiBleHByZXNzaW9uLCBwcmludGVkIGJ5IENlZGFyIGl0c2VsZi4gKi9cbmZ1bmN0aW9uIGxlYWZUb1RleHQoZXhwcjogYW55KTogc3RyaW5nIHtcbiAgY29uc3QgcmVzdWx0ID0gY2VkYXIucG9saWN5VG9UZXh0KHtcbiAgICBlZmZlY3Q6ICdwZXJtaXQnLFxuICAgIHByaW5jaXBhbDogeyBvcDogJ0FsbCcgfSxcbiAgICBhY3Rpb246IHsgb3A6ICdBbGwnIH0sXG4gICAgcmVzb3VyY2U6IHsgb3A6ICdBbGwnIH0sXG4gICAgY29uZGl0aW9uczogW3sga2luZDogJ3doZW4nLCBib2R5OiBleHByIH1dLFxuICB9KTtcbiAgaWYgKHJlc3VsdC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICBsb2dnZXIuZXJyb3IoeyBleHByIH0sICdmYWlsZWQgdG8gdHJhbnNmb3JtIGV4cHJlc3Npb24gaW50byB0ZXh0Jyk7XG4gICAgdGhyb3cgbmV3IEVycm9yKHJlc3VsdC5lcnJvcnMgYXMgYW55KTtcbiAgfVxuICByZXR1cm4gcmVzdWx0LnRleHQuc2xpY2UoTEVBRl9QUkVGSVgubGVuZ3RoLCAtTEVBRl9TVUZGSVgubGVuZ3RoKTtcbn1cblxuLyoqXG4gKiBMaW5lcyBvZiBgZXhwcmAgd2l0aGluIGEgZ3JvdXAgb2YgYHBhcmVudGAsIGVhY2ggc3RhcnRpbmcgd2l0aCBhIDMtY2hhcmFjdGVyXG4gKiBvcGVyYXRvciBjb2x1bW47IGEgbmVzdGVkIGdyb3VwIChvdGhlciBvcGVyYXRvcikgZ29lcyBvbmUgbGV2ZWwgZGVlcGVyIGluIHBhcmVudGhlc2VzLlxuICovXG5mdW5jdGlvbiB0b0xpbmVzKGV4cHI6IGFueSwgcGFyZW50Pzogc3RyaW5nKTogc3RyaW5nW10ge1xuICBjb25zdCBvcGVyYXRvciA9IGJvb2xlYW5PcGVyYXRvcihleHByKTtcbiAgaWYgKCFvcGVyYXRvcikgcmV0dXJuIFtgICAgJHtsZWFmVG9UZXh0KGV4cHIpfWBdO1xuICAvLyB0aGUgdG9wIGxldmVsIChubyBwYXJlbnQpIGlzIGEgZ3JvdXAgd2l0aG91dCBwYXJlbnRoZXNlc1xuICBpZiAocGFyZW50ICYmIG9wZXJhdG9yICE9PSBwYXJlbnQpIHtcbiAgICByZXR1cm4gWycgICAoJywgLi4udG9MaW5lcyhleHByLCBvcGVyYXRvcikubWFwKChsaW5lKSA9PiBMRVZFTF9JTkRFTlQgKyBsaW5lKSwgJyAgICknXTtcbiAgfVxuICAvLyB0aGUgb3BlcmF0b3Igam9pbnMgdGhlIHR3byBzaWRlcywgb24gdGhlIGxpbmUgd2hlcmUgdGhlIHJpZ2h0IHNpZGUgc3RhcnRzXG4gIGNvbnN0IFtmaXJzdCwgLi4ucmVzdF0gPSB0b0xpbmVzKGV4cHJbb3BlcmF0b3JdLnJpZ2h0LCBvcGVyYXRvcik7XG4gIHJldHVybiBbLi4udG9MaW5lcyhleHByW29wZXJhdG9yXS5sZWZ0LCBvcGVyYXRvciksIGAke29wZXJhdG9yfSAke2ZpcnN0IS5zbGljZSgzKX1gLCAuLi5yZXN0XTtcbn1cblxuLyoqXG4gKiBDZWRhcidzIGZvcm1hdHRlciBmb3IgdGhlIHBvbGljeSBoZWFkLCBvdXIgb3duIGxheW91dCBmb3IgdGhlIGNvbmRpdGlvbnM6XG4gKiBvcGVyYW5kcyBvZiBvbmUgbG9naWNhbCBsZXZlbCBzaGFyZSBhbiBpbmRlbnRhdGlvbiwgZWFjaCBuZXN0ZWQgbGV2ZWwgYWRkcyBvbmUsXG4gKiBhbmQgdGhlIGAmJmAgLyBgfHxgIG9wZXJhdG9yIGxlYWRzIHRoZSBsaW5lLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcG9saWN5VG9DZWRhclRleHQocG9saWN5OiBQb2xpY3lKc29uKTogc3RyaW5nIHtcbiAgY29uc3QgaGVhZCA9IGNlZGFyLnBvbGljeVRvVGV4dCh7IC4uLnBvbGljeSwgY29uZGl0aW9uczogW10gfSk7XG4gIGlmIChoZWFkLnR5cGUgPT09ICdmYWlsdXJlJykge1xuICAgIGxvZ2dlci5lcnJvcih7IHBvbGljeSB9LCAnZmFpbGVkIHRvIHRyYW5zZm9ybSBwb2xpY3kgaW50byB0ZXh0Jyk7XG4gICAgdGhyb3cgbmV3IEVycm9yKGhlYWQuZXJyb3JzIGFzIGFueSk7XG4gIH1cbiAgY29uc3QgZm9ybWF0dGVkSGVhZCA9IGNlZGFyLmZvcm1hdFBvbGljaWVzKHtcbiAgICBwb2xpY3lUZXh0OiBoZWFkLnRleHQsXG4gICAgbGluZVdpZHRoOiAxMDAsXG4gICAgaW5kZW50V2lkdGg6IDIsXG4gIH0pO1xuICBpZiAoZm9ybWF0dGVkSGVhZC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoZm9ybWF0dGVkSGVhZCBhcyBhbnkpO1xuICB9XG4gIC8vIGEgcG9saWN5IHdpdGhvdXQgY29uZGl0aW9ucyBpcyBmb3JtYXR0ZWQgYXMgYOKApjtcXG5gXG4gIGNvbnN0IGxpbmVzID0gW2Zvcm1hdHRlZEhlYWQuZm9ybWF0dGVkX3BvbGljeS5zbGljZSgwLCAtMildO1xuICAvLyB0cmFuc2xhdGVUb0NlZGFyIHdyaXRlcyBhdCBtb3N0IG9uZSBgd2hlbmAgY2xhdXNlXG4gIGNvbnN0IFtjb25kaXRpb25dID0gcG9saWN5LmNvbmRpdGlvbnM7XG4gIGlmIChjb25kaXRpb24pIHtcbiAgICBjb25zdCB3aGVuID0gdG9MaW5lcyhjb25kaXRpb24uYm9keSk7XG4gICAgbGluZXMucHVzaChcbiAgICAgIFsnd2hlbiB7JywgLi4ud2hlbi5tYXAoKGxpbmUpID0+IGAgICR7bGluZX1gKSwgJ30nXS5qb2luKCdcXG4nKSxcbiAgICApO1xuICB9XG4gIHJldHVybiBsaW5lcy5qb2luKCdcXG4nKSArICc7Jztcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-to-d9-translations.d.ts

@@ -0,0 +1,12 @@
+import { ConditionSubject } from './cedar-translations';
+import type { Filter } from './d9-permission';
+/** Inverse of `addWhenClauses`: a Cedar Expr tree back into a D9 filter. */
+export declare function exprToFilter(expr?: any, subject?: ConditionSubject): Filter;
+/** Field list from a check-fields policy's `containsAll` clause. */
+export declare function extractFields(expr: any): string[];
+/** Inverse of `refactoPolicies`: expand `action in [...]` into one tuple each. */
+export declare function expandPolicy(policy: any): Array<{
+    collection: string;
+    action: string;
+    conditions: any[];
+}>;

package/lib/cli/commands/cedar/cedar-to-d9-translations.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exprToFilter = exprToFilter;
+exports.extractFields = extractFields;
+exports.expandPolicy = expandPolicy;
+function rightToValue(right) {
+    if (right?.Var === 'principal')
+        return '$CURRENT_USER';
+    if (right?.Value !== undefined)
+        return right.Value;
+    throw new Error(`Unsupported right-hand Cedar expression: ${JSON.stringify(right)}`);
+}
+function pathToFilter(node, subject, leaf) {
+    let acc = leaf;
+    let cur = node;
+    if (subject === 'context.newValue') {
+        while (cur && cur['.']) {
+            const { left, attr } = cur['.'];
+            // Reached the `context.newValue` base: stop without wrapping `newValue`.
+            if (attr === 'newValue' && left?.Var === 'context')
+                return acc;
+            acc = { [attr]: acc };
+            cur = left;
+        }
+        throw new Error(`Unexpected context.newValue base path: ${JSON.stringify(node)}`);
+    }
+    while (cur && cur['.']) {
+        acc = { [cur['.'].attr]: acc };
+        cur = cur['.'].left;
+    }
+    if (!(cur && cur.Var === 'resource')) {
+        throw new Error(`Unexpected resource base path: ${JSON.stringify(node)}`);
+    }
+    return acc;
+}
+function patternToOperation(pattern) {
+    // Cedar splits a `like` pattern into per-character Literal elements.
+    const value = pattern
+        .filter((p) => p !== 'Wildcard')
+        .map((p) => p.Literal)
+        .join('');
+    const startsWildcard = pattern[0] === 'Wildcard';
+    const endsWildcard = pattern[pattern.length - 1] === 'Wildcard';
+    if (startsWildcard && endsWildcard)
+        return { operator: '_contains', value };
+    if (endsWildcard)
+        return { operator: '_starts_with', value };
+    if (startsWildcard)
+        return { operator: '_ends_with', value };
+    throw new Error(`Unsupported like pattern: ${JSON.stringify(pattern)}`);
+}
+const COMPARISON_OPS = {
+    '==': '_eq',
+    '!=': '_neq',
+    '>': '_gt',
+    '>=': '_gte',
+    '<': '_lt',
+    '<=': '_lte',
+};
+/** Inverse of `addWhenClauses`: a Cedar Expr tree back into a D9 filter. */
+function exprToFilter(expr, subject = 'resource') {
+    if (!expr)
+        return {};
+    const key = Object.keys(expr)[0];
+    const node = expr[key];
+    if (key === '&&' || key === '||') {
+        const operator = key === '&&' ? '_and' : '_or';
+        const left = exprToFilter(node.left, subject);
+        const right = exprToFilter(node.right, subject);
+        const operands = [left[operator] ?? left, right[operator] ?? right].flat();
+        return { [operator]: operands };
+    }
+    if (key === 'has') {
+        return pathToFilter(node.left, subject, { [node.attr]: { _nnull: true } });
+    }
+    if (key === '!') {
+        const arg = node.arg;
+        if (arg && arg.has) {
+            return pathToFilter(arg.has.left, subject, {
+                [arg.has.attr]: { _null: true },
+            });
+        }
+        throw new Error(`Unsupported negation expression: ${JSON.stringify(expr)}`);
+    }
+    if (key === 'like') {
+        const { operator, value } = patternToOperation(node.pattern);
+        return pathToFilter(node.left, subject, { [operator]: value });
+    }
+    if (key in COMPARISON_OPS) {
+        return pathToFilter(node.left, subject, {
+            [COMPARISON_OPS[key]]: rightToValue(node.right),
+        });
+    }
+    throw new Error(`Unsupported Cedar expression operator: ${key}`);
+}
+/** Field list from a check-fields policy's `containsAll` clause. */
+function extractFields(expr) {
+    const left = expr?.containsAll?.left;
+    // A literal array is normalized by Cedar into a Set of Value elements.
+    if (Array.isArray(left?.Set))
+        return left.Set.map((e) => e.Value);
+    if (Array.isArray(left?.Value))
+        return left.Value;
+    throw new Error(`Unexpected check-fields policy shape: ${JSON.stringify(expr)}`);
+}
+/** Inverse of `refactoPolicies`: expand `action in [...]` into one tuple each. */
+function expandPolicy(policy) {
+    const action = policy.action;
+    let entities = [];
+    if (action.op === '==') {
+        entities = [action.entity];
+    }
+    else if (action.op === 'in') {
+        // Cedar parses a single-element `action in [X]` as `{ op: 'in', entity }`
+        entities = action.entities ?? [action.entity];
+    }
+    else {
+        // returning no tuple would silently remove the matching rows from the CSV
+        throw new Error(`Unexpected action constraint: ${JSON.stringify(action)}`);
+    }
+    return entities.map((e) => {
+        const ent = e;
+        return {
+            collection: ent.type.replace(/^Db::/, '').replace(/::Action$/, ''),
+            action: ent.id,
+            conditions: policy.conditions ?? [],
+        };
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItdG8tZDktdHJhbnNsYXRpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NsaS9jb21tYW5kcy9jZWRhci9jZWRhci10by1kOS10cmFuc2xhdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFvRUEsb0NBMENDO0FBR0Qsc0NBUUM7QUFHRCxvQ0FzQkM7QUE3SUQsU0FBUyxZQUFZLENBQUMsS0FBVTtJQUM5QixJQUFJLEtBQUssRUFBRSxHQUFHLEtBQUssV0FBVztRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ3ZELElBQUksS0FBSyxFQUFFLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQ25ELE1BQU0sSUFBSSxLQUFLLENBQ2IsNENBQTRDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDcEUsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FDbkIsSUFBUyxFQUNULE9BQXlCLEVBQ3pCLElBQXlCO0lBRXpCLElBQUksR0FBRyxHQUFRLElBQUksQ0FBQztJQUNwQixJQUFJLEdBQUcsR0FBRyxJQUFJLENBQUM7SUFFZixJQUFJLE9BQU8sS0FBSyxrQkFBa0IsRUFBRSxDQUFDO1FBQ25DLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2hDLHlFQUF5RTtZQUN6RSxJQUFJLElBQUksS0FBSyxVQUFVLElBQUksSUFBSSxFQUFFLEdBQUcsS0FBSyxTQUFTO2dCQUFFLE9BQU8sR0FBRyxDQUFDO1lBQy9ELEdBQUcsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUM7WUFDdEIsR0FBRyxHQUFHLElBQUksQ0FBQztRQUNiLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLDBDQUEwQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ2pFLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkIsR0FBRyxHQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUM7UUFDL0IsR0FBRyxHQUFHLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEIsQ0FBQztJQUNELElBQUksQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELFNBQVMsa0JBQWtCLENBQUMsT0FBYztJQUN4QyxxRUFBcUU7SUFDckUsTUFBTSxLQUFLLEdBQUcsT0FBTztTQUNsQixNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxVQUFVLENBQUM7U0FDL0IsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1NBQ3JCLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNaLE1BQU0sY0FBYyxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxVQUFVLENBQUM7SUFDakQsTUFBTSxZQUFZLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLEtBQUssVUFBVSxDQUFDO0lBQ2hFLElBQUksY0FBYyxJQUFJLFlBQVk7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM1RSxJQUFJLFlBQVk7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM3RCxJQUFJLGNBQWM7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM3RCxNQUFNLElBQUksS0FBSyxDQUFDLDZCQUE2QixJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQsTUFBTSxjQUFjLEdBQTJCO0lBQzdDLElBQUksRUFBRSxLQUFLO0lBQ1gsSUFBSSxFQUFFLE1BQU07SUFDWixHQUFHLEVBQUUsS0FBSztJQUNWLElBQUksRUFBRSxNQUFNO0lBQ1osR0FBRyxFQUFFLEtBQUs7SUFDVixJQUFJLEVBQUUsTUFBTTtDQUNiLENBQUM7QUFFRiw0RUFBNEU7QUFDNUUsU0FBZ0IsWUFBWSxDQUMxQixJQUFVLEVBQ1YsVUFBNEIsVUFBVTtJQUV0QyxJQUFJLENBQUMsSUFBSTtRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ3JCLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFFLENBQUM7SUFDbEMsTUFBTSxJQUFJLEdBQUksSUFBNEIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUVoRCxJQUFJLEdBQUcsS0FBSyxJQUFJLElBQUksR0FBRyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ2pDLE1BQU0sUUFBUSxHQUFHLEdBQUcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQy9DLE1BQU0sSUFBSSxHQUFHLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBd0IsQ0FBQztRQUNyRSxNQUFNLEtBQUssR0FBRyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQXdCLENBQUM7UUFDdkUsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksSUFBSSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMzRSxPQUFPLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEVBQVksQ0FBQztJQUM1QyxDQUFDO0lBRUQsSUFBSSxHQUFHLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDbEIsT0FBTyxZQUFZLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUVELElBQUksR0FBRyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDckIsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ25CLE9BQU8sWUFBWSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtnQkFDekMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRTthQUNoQyxDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUVELElBQUksR0FBRyxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdELE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCxJQUFJLEdBQUcsSUFBSSxjQUFjLEVBQUUsQ0FBQztRQUMxQixPQUFPLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtZQUN0QyxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUUsQ0FBQyxFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO1NBQ2pELENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0FBQ25FLENBQUM7QUFFRCxvRUFBb0U7QUFDcEUsU0FBZ0IsYUFBYSxDQUFDLElBQVM7SUFDckMsTUFBTSxJQUFJLEdBQUcsSUFBSSxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUM7SUFDckMsdUVBQXVFO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDO0lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQ2IseUNBQXlDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztBQUNKLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsU0FBZ0IsWUFBWSxDQUMxQixNQUFXO0lBRVgsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3QixJQUFJLFFBQVEsR0FBVSxFQUFFLENBQUM7SUFDekIsSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3ZCLFFBQVEsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM3QixDQUFDO1NBQU0sSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzlCLDBFQUEwRTtRQUMxRSxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNoRCxDQUFDO1NBQU0sQ0FBQztRQUNOLDBFQUEwRTtRQUMxRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7UUFDeEIsTUFBTSxHQUFHLEdBQUcsQ0FBYyxDQUFDO1FBQzNCLE9BQU87WUFDTCxVQUFVLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sRUFBRSxHQUFHLENBQUMsRUFBRTtZQUNkLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxJQUFJLEVBQUU7U0FDcEMsQ0FBQztJQUNKLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbmRpdGlvblN1YmplY3QgfSBmcm9tICcuL2NlZGFyLXRyYW5zbGF0aW9ucyc7XG5pbXBvcnQgdHlwZSB7IEZpbHRlciB9IGZyb20gJy4vZDktcGVybWlzc2lvbic7XG5cbnR5cGUgRW50aXR5UmVmID0geyB0eXBlOiBzdHJpbmc7IGlkOiBzdHJpbmcgfTtcblxuZnVuY3Rpb24gcmlnaHRUb1ZhbHVlKHJpZ2h0OiBhbnkpOiBhbnkge1xuICBpZiAocmlnaHQ/LlZhciA9PT0gJ3ByaW5jaXBhbCcpIHJldHVybiAnJENVUlJFTlRfVVNFUic7XG4gIGlmIChyaWdodD8uVmFsdWUgIT09IHVuZGVmaW5lZCkgcmV0dXJuIHJpZ2h0LlZhbHVlO1xuICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgYFVuc3VwcG9ydGVkIHJpZ2h0LWhhbmQgQ2VkYXIgZXhwcmVzc2lvbjogJHtKU09OLnN0cmluZ2lmeShyaWdodCl9YCxcbiAgKTtcbn1cblxuZnVuY3Rpb24gcGF0aFRvRmlsdGVyKFxuICBub2RlOiBhbnksXG4gIHN1YmplY3Q6IENvbmRpdGlvblN1YmplY3QsXG4gIGxlYWY6IFJlY29yZDxzdHJpbmcsIGFueT4sXG4pOiBGaWx0ZXIge1xuICBsZXQgYWNjOiBhbnkgPSBsZWFmO1xuICBsZXQgY3VyID0gbm9kZTtcblxuICBpZiAoc3ViamVjdCA9PT0gJ2NvbnRleHQubmV3VmFsdWUnKSB7XG4gICAgd2hpbGUgKGN1ciAmJiBjdXJbJy4nXSkge1xuICAgICAgY29uc3QgeyBsZWZ0LCBhdHRyIH0gPSBjdXJbJy4nXTtcbiAgICAgIC8vIFJlYWNoZWQgdGhlIGBjb250ZXh0Lm5ld1ZhbHVlYCBiYXNlOiBzdG9wIHdpdGhvdXQgd3JhcHBpbmcgYG5ld1ZhbHVlYC5cbiAgICAgIGlmIChhdHRyID09PSAnbmV3VmFsdWUnICYmIGxlZnQ/LlZhciA9PT0gJ2NvbnRleHQnKSByZXR1cm4gYWNjO1xuICAgICAgYWNjID0geyBbYXR0cl06IGFjYyB9O1xuICAgICAgY3VyID0gbGVmdDtcbiAgICB9XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYFVuZXhwZWN0ZWQgY29udGV4dC5uZXdWYWx1ZSBiYXNlIHBhdGg6ICR7SlNPTi5zdHJpbmdpZnkobm9kZSl9YCxcbiAgICApO1xuICB9XG5cbiAgd2hpbGUgKGN1ciAmJiBjdXJbJy4nXSkge1xuICAgIGFjYyA9IHsgW2N1clsnLiddLmF0dHJdOiBhY2MgfTtcbiAgICBjdXIgPSBjdXJbJy4nXS5sZWZ0O1xuICB9XG4gIGlmICghKGN1ciAmJiBjdXIuVmFyID09PSAncmVzb3VyY2UnKSkge1xuICAgIHRocm93IG5ldyBFcnJvcihgVW5leHBlY3RlZCByZXNvdXJjZSBiYXNlIHBhdGg6ICR7SlNPTi5zdHJpbmdpZnkobm9kZSl9YCk7XG4gIH1cbiAgcmV0dXJuIGFjYztcbn1cblxuZnVuY3Rpb24gcGF0dGVyblRvT3BlcmF0aW9uKHBhdHRlcm46IGFueVtdKTogeyBvcGVyYXRvcjogc3RyaW5nOyB2YWx1ZTogYW55IH0ge1xuICAvLyBDZWRhciBzcGxpdHMgYSBgbGlrZWAgcGF0dGVybiBpbnRvIHBlci1jaGFyYWN0ZXIgTGl0ZXJhbCBlbGVtZW50cy5cbiAgY29uc3QgdmFsdWUgPSBwYXR0ZXJuXG4gICAgLmZpbHRlcigocCkgPT4gcCAhPT0gJ1dpbGRjYXJkJylcbiAgICAubWFwKChwKSA9PiBwLkxpdGVyYWwpXG4gICAgLmpvaW4oJycpO1xuICBjb25zdCBzdGFydHNXaWxkY2FyZCA9IHBhdHRlcm5bMF0gPT09ICdXaWxkY2FyZCc7XG4gIGNvbnN0IGVuZHNXaWxkY2FyZCA9IHBhdHRlcm5bcGF0dGVybi5sZW5ndGggLSAxXSA9PT0gJ1dpbGRjYXJkJztcbiAgaWYgKHN0YXJ0c1dpbGRjYXJkICYmIGVuZHNXaWxkY2FyZCkgcmV0dXJuIHsgb3BlcmF0b3I6ICdfY29udGFpbnMnLCB2YWx1ZSB9O1xuICBpZiAoZW5kc1dpbGRjYXJkKSByZXR1cm4geyBvcGVyYXRvcjogJ19zdGFydHNfd2l0aCcsIHZhbHVlIH07XG4gIGlmIChzdGFydHNXaWxkY2FyZCkgcmV0dXJuIHsgb3BlcmF0b3I6ICdfZW5kc193aXRoJywgdmFsdWUgfTtcbiAgdGhyb3cgbmV3IEVycm9yKGBVbnN1cHBvcnRlZCBsaWtlIHBhdHRlcm46ICR7SlNPTi5zdHJpbmdpZnkocGF0dGVybil9YCk7XG59XG5cbmNvbnN0IENPTVBBUklTT05fT1BTOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0ge1xuICAnPT0nOiAnX2VxJyxcbiAgJyE9JzogJ19uZXEnLFxuICAnPic6ICdfZ3QnLFxuICAnPj0nOiAnX2d0ZScsXG4gICc8JzogJ19sdCcsXG4gICc8PSc6ICdfbHRlJyxcbn07XG5cbi8qKiBJbnZlcnNlIG9mIGBhZGRXaGVuQ2xhdXNlc2A6IGEgQ2VkYXIgRXhwciB0cmVlIGJhY2sgaW50byBhIEQ5IGZpbHRlci4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHByVG9GaWx0ZXIoXG4gIGV4cHI/OiBhbnksXG4gIHN1YmplY3Q6IENvbmRpdGlvblN1YmplY3QgPSAncmVzb3VyY2UnLFxuKTogRmlsdGVyIHtcbiAgaWYgKCFleHByKSByZXR1cm4ge307XG4gIGNvbnN0IGtleSA9IE9iamVjdC5rZXlzKGV4cHIpWzBdITtcbiAgY29uc3Qgbm9kZSA9IChleHByIGFzIFJlY29yZDxzdHJpbmcsIGFueT4pW2tleV07XG5cbiAgaWYgKGtleSA9PT0gJyYmJyB8fCBrZXkgPT09ICd8fCcpIHtcbiAgICBjb25zdCBvcGVyYXRvciA9IGtleSA9PT0gJyYmJyA/ICdfYW5kJyA6ICdfb3InO1xuICAgIGNvbnN0IGxlZnQgPSBleHByVG9GaWx0ZXIobm9kZS5sZWZ0LCBzdWJqZWN0KSBhcyBSZWNvcmQ8c3RyaW5nLCBhbnk+O1xuICAgIGNvbnN0IHJpZ2h0ID0gZXhwclRvRmlsdGVyKG5vZGUucmlnaHQsIHN1YmplY3QpIGFzIFJlY29yZDxzdHJpbmcsIGFueT47XG4gICAgY29uc3Qgb3BlcmFuZHMgPSBbbGVmdFtvcGVyYXRvcl0gPz8gbGVmdCwgcmlnaHRbb3BlcmF0b3JdID8/IHJpZ2h0XS5mbGF0KCk7XG4gICAgcmV0dXJuIHsgW29wZXJhdG9yXTogb3BlcmFuZHMgfSBhcyBGaWx0ZXI7XG4gIH1cblxuICBpZiAoa2V5ID09PSAnaGFzJykge1xuICAgIHJldHVybiBwYXRoVG9GaWx0ZXIobm9kZS5sZWZ0LCBzdWJqZWN0LCB7IFtub2RlLmF0dHJdOiB7IF9ubnVsbDogdHJ1ZSB9IH0pO1xuICB9XG5cbiAgaWYgKGtleSA9PT0gJyEnKSB7XG4gICAgY29uc3QgYXJnID0gbm9kZS5hcmc7XG4gICAgaWYgKGFyZyAmJiBhcmcuaGFzKSB7XG4gICAgICByZXR1cm4gcGF0aFRvRmlsdGVyKGFyZy5oYXMubGVmdCwgc3ViamVjdCwge1xuICAgICAgICBbYXJnLmhhcy5hdHRyXTogeyBfbnVsbDogdHJ1ZSB9LFxuICAgICAgfSk7XG4gICAgfVxuICAgIHRocm93IG5ldyBFcnJvcihgVW5zdXBwb3J0ZWQgbmVnYXRpb24gZXhwcmVzc2lvbjogJHtKU09OLnN0cmluZ2lmeShleHByKX1gKTtcbiAgfVxuXG4gIGlmIChrZXkgPT09ICdsaWtlJykge1xuICAgIGNvbnN0IHsgb3BlcmF0b3IsIHZhbHVlIH0gPSBwYXR0ZXJuVG9PcGVyYXRpb24obm9kZS5wYXR0ZXJuKTtcbiAgICByZXR1cm4gcGF0aFRvRmlsdGVyKG5vZGUubGVmdCwgc3ViamVjdCwgeyBbb3BlcmF0b3JdOiB2YWx1ZSB9KTtcbiAgfVxuXG4gIGlmIChrZXkgaW4gQ09NUEFSSVNPTl9PUFMpIHtcbiAgICByZXR1cm4gcGF0aFRvRmlsdGVyKG5vZGUubGVmdCwgc3ViamVjdCwge1xuICAgICAgW0NPTVBBUklTT05fT1BTW2tleV0hXTogcmlnaHRUb1ZhbHVlKG5vZGUucmlnaHQpLFxuICAgIH0pO1xuICB9XG5cbiAgdGhyb3cgbmV3IEVycm9yKGBVbnN1cHBvcnRlZCBDZWRhciBleHByZXNzaW9uIG9wZXJhdG9yOiAke2tleX1gKTtcbn1cblxuLyoqIEZpZWxkIGxpc3QgZnJvbSBhIGNoZWNrLWZpZWxkcyBwb2xpY3kncyBgY29udGFpbnNBbGxgIGNsYXVzZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHRyYWN0RmllbGRzKGV4cHI6IGFueSk6IHN0cmluZ1tdIHtcbiAgY29uc3QgbGVmdCA9IGV4cHI/LmNvbnRhaW5zQWxsPy5sZWZ0O1xuICAvLyBBIGxpdGVyYWwgYXJyYXkgaXMgbm9ybWFsaXplZCBieSBDZWRhciBpbnRvIGEgU2V0IG9mIFZhbHVlIGVsZW1lbnRzLlxuICBpZiAoQXJyYXkuaXNBcnJheShsZWZ0Py5TZXQpKSByZXR1cm4gbGVmdC5TZXQubWFwKChlOiBhbnkpID0+IGUuVmFsdWUpO1xuICBpZiAoQXJyYXkuaXNBcnJheShsZWZ0Py5WYWx1ZSkpIHJldHVybiBsZWZ0LlZhbHVlO1xuICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgYFVuZXhwZWN0ZWQgY2hlY2stZmllbGRzIHBvbGljeSBzaGFwZTogJHtKU09OLnN0cmluZ2lmeShleHByKX1gLFxuICApO1xufVxuXG4vKiogSW52ZXJzZSBvZiBgcmVmYWN0b1BvbGljaWVzYDogZXhwYW5kIGBhY3Rpb24gaW4gWy4uLl1gIGludG8gb25lIHR1cGxlIGVhY2guICovXG5leHBvcnQgZnVuY3Rpb24gZXhwYW5kUG9saWN5KFxuICBwb2xpY3k6IGFueSxcbik6IEFycmF5PHsgY29sbGVjdGlvbjogc3RyaW5nOyBhY3Rpb246IHN0cmluZzsgY29uZGl0aW9uczogYW55W10gfT4ge1xuICBjb25zdCBhY3Rpb24gPSBwb2xpY3kuYWN0aW9uO1xuICBsZXQgZW50aXRpZXM6IGFueVtdID0gW107XG4gIGlmIChhY3Rpb24ub3AgPT09ICc9PScpIHtcbiAgICBlbnRpdGllcyA9IFthY3Rpb24uZW50aXR5XTtcbiAgfSBlbHNlIGlmIChhY3Rpb24ub3AgPT09ICdpbicpIHtcbiAgICAvLyBDZWRhciBwYXJzZXMgYSBzaW5nbGUtZWxlbWVudCBgYWN0aW9uIGluIFtYXWAgYXMgYHsgb3A6ICdpbicsIGVudGl0eSB9YFxuICAgIGVudGl0aWVzID0gYWN0aW9uLmVudGl0aWVzID8/IFthY3Rpb24uZW50aXR5XTtcbiAgfSBlbHNlIHtcbiAgICAvLyByZXR1cm5pbmcgbm8gdHVwbGUgd291bGQgc2lsZW50bHkgcmVtb3ZlIHRoZSBtYXRjaGluZyByb3dzIGZyb20gdGhlIENTVlxuICAgIHRocm93IG5ldyBFcnJvcihgVW5leHBlY3RlZCBhY3Rpb24gY29uc3RyYWludDogJHtKU09OLnN0cmluZ2lmeShhY3Rpb24pfWApO1xuICB9XG4gIHJldHVybiBlbnRpdGllcy5tYXAoKGUpID0+IHtcbiAgICBjb25zdCBlbnQgPSBlIGFzIEVudGl0eVJlZjtcbiAgICByZXR1cm4ge1xuICAgICAgY29sbGVjdGlvbjogZW50LnR5cGUucmVwbGFjZSgvXkRiOjovLCAnJykucmVwbGFjZSgvOjpBY3Rpb24kLywgJycpLFxuICAgICAgYWN0aW9uOiBlbnQuaWQsXG4gICAgICBjb25kaXRpb25zOiBwb2xpY3kuY29uZGl0aW9ucyA/PyBbXSxcbiAgICB9O1xuICB9KTtcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-to-d9.d.ts

@@ -0,0 +1,57 @@
+import { D9Permission } from './d9-permission';
+import { RolesTable } from './roles-table';
+/** Map keyed by a tuple of strings (Map indexes arrays by identity, hence the join). */
+declare class TupleKeyMap<Value> {
+    private readonly createValue?;
+    private readonly entries;
+    /** `createValue` is required to use {@link getOrCreate}; omit it for a plain get/set map. */
+    constructor(createValue?: ((parts: string[]) => Value) | undefined);
+    private keyOf;
+    get(parts: string[]): Value | undefined;
+    set(parts: string[], value: Value): void;
+    delete(parts: string[]): void;
+    /** Return the value for `parts`, creating and storing it via the factory if absent. */
+    getOrCreate(parts: string[]): Value;
+    values(): Value[];
+}
+/**
+ * Reverse of d9-to-cedar: reads the per-role Cedar policy files back into D9
+ * permission rows and merges them into directus_permissions.csv. The original
+ * CSV stays the source of truth for the columns Cedar does not carry (`id`,
+ * `role` UUID, `presets`); only `permissions`/`fields`/`validation` are rewritten.
+ */
+export declare class CedarToD9Manager {
+    permissionPath: string;
+    sqlPath: string;
+    outputPath: string;
+    roles: RolesTable;
+    baseRowsByTuple: TupleKeyMap<Record<string, string>>;
+    header: string[];
+    nextId: number;
+    reconstructed: D9Permission[];
+    constructor(opts?: {
+        permissionPath?: string;
+        sqlPath?: string;
+        outputPath?: string;
+    });
+    readBasePermissionFile(): Promise<void>;
+    readRoleFile(): Promise<void>;
+    /** Read one `.cedar` file into expanded (collection, action, conditions) tuples. */
+    parseCedarFile(filePath: string): Promise<Array<{
+        collection: string;
+        action: string;
+        conditions: any[];
+    }>>;
+    parseRoleFolder(roleName: string): Promise<D9Permission[]>;
+    parseAllFolders(): Promise<void>;
+    mergeIntoRows(): void;
+    writeOutput(): Promise<void>;
+    readCedarAndWriteCsv(): Promise<void>;
+}
+/** CLI action: merge Cedar policies back into directus_permissions.csv. */
+export declare function cedarToD9(options?: {
+    permissionPath?: string;
+    sqlPath?: string;
+    outputPath?: string;
+}): Promise<void>;
+export {};

package/lib/cli/commands/cedar/cedar-to-d9.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CedarToD9Manager = void 0;
+exports.cedarToD9 = cedarToD9;
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const cedar = require("@cedar-policy/cedar-wasm/nodejs");
+const cedar_to_d9_translations_1 = require("./cedar-to-d9-translations");
+const d9_permission_1 = require("./d9-permission");
+const roles_table_1 = require("./roles-table");
+const logger_1 = require("../../logger");
+const utils_1 = require("../save/utils");
+/** Map keyed by a tuple of strings (Map indexes arrays by identity, hence the join). */
+class TupleKeyMap {
+    /** `createValue` is required to use {@link getOrCreate}; omit it for a plain get/set map. */
+    constructor(createValue) {
+        this.createValue = createValue;
+        this.entries = new Map();
+    }
+    keyOf(parts) {
+        return parts.join(' ');
+    }
+    get(parts) {
+        return this.entries.get(this.keyOf(parts));
+    }
+    set(parts, value) {
+        this.entries.set(this.keyOf(parts), value);
+    }
+    delete(parts) {
+        this.entries.delete(this.keyOf(parts));
+    }
+    /** Return the value for `parts`, creating and storing it via the factory if absent. */
+    getOrCreate(parts) {
+        const key = this.keyOf(parts);
+        let value = this.entries.get(key);
+        if (value === undefined) {
+            if (!this.createValue) {
+                throw new Error('TupleKeyMap.getOrCreate called without a factory');
+            }
+            value = this.createValue(parts);
+            this.entries.set(key, value);
+        }
+        return value;
+    }
+    values() {
+        return [...this.entries.values()];
+    }
+}
+/**
+ * Reverse of d9-to-cedar: reads the per-role Cedar policy files back into D9
+ * permission rows and merges them into directus_permissions.csv. The original
+ * CSV stays the source of truth for the columns Cedar does not carry (`id`,
+ * `role` UUID, `presets`); only `permissions`/`fields`/`validation` are rewritten.
+ */
+class CedarToD9Manager {
+    constructor(opts) {
+        // Rows keyed by (role, collection, action); the map's values (insertion order)
+        // are what gets written back out, so it is the single source of truth for rows.
+        this.baseRowsByTuple = new TupleKeyMap();
+        this.header = [];
+        this.nextId = 0;
+        this.reconstructed = [];
+        this.permissionPath = opts?.permissionPath || './permissions';
+        this.sqlPath = opts?.sqlPath || './sql/data';
+        this.outputPath =
+            opts?.outputPath || `${this.sqlPath}/directus_permissions.csv`;
+    }
+    async readBasePermissionFile() {
+        const filePath = `${this.sqlPath}/directus_permissions.csv`;
+        const rows = await (0, utils_1.readCsvFile)(filePath);
+        const firstLine = await (0, utils_1.readFirstLineOfFile)(filePath);
+        this.header = firstLine.split(',').map((column) => column.trim());
+        for (const row of rows) {
+            this.baseRowsByTuple.set([row.role, row.collection, row.action], row);
+            const id = Number(row.id);
+            if (Number.isFinite(id) && id > this.nextId)
+                this.nextId = id;
+        }
+    }
+    async readRoleFile() {
+        this.roles = await roles_table_1.RolesTable.load(this.sqlPath);
+    }
+    /** Read one `.cedar` file into expanded (collection, action, conditions) tuples. */
+    async parseCedarFile(filePath) {
+        if (!(0, fs_1.existsSync)(filePath)) {
+            return []; // a role may not have every .cedar file (e.g. no validate.cedar)
+        }
+        const text = (await (0, promises_1.readFile)(filePath)).toString();
+        const parts = cedar.policySetTextToParts(text);
+        if (parts.type === 'failure') {
+            logger_1.logger.error(`failed to split policy set ${filePath}`);
+            throw new Error(parts.errors);
+        }
+        const tuples = [];
+        for (const policyText of parts.policies) {
+            const parsed = cedar.policyToJson(policyText);
+            if (parsed.type === 'failure') {
+                logger_1.logger.error({ policyText }, `failed to parse policy in ${filePath}`);
+                throw new Error(parsed.errors);
+            }
+            tuples.push(...(0, cedar_to_d9_translations_1.expandPolicy)(parsed.json));
+        }
+        return tuples;
+    }
+    async parseRoleFolder(roleName) {
+        // A (collection, action) tuple can appear across authorize/check-fields/validate,
+        // so the map creates one permission per tuple and we accumulate clauses onto it.
+        const byTuple = new TupleKeyMap(([collection, action]) => d9_permission_1.D9Permission.empty(roleName, collection, action));
+        const folder = `${this.permissionPath}/${roleName}`;
+        const authorizeTuples = await this.parseCedarFile(`${folder}/authorize.cedar`);
+        for (const tuple of authorizeTuples) {
+            byTuple.getOrCreate([tuple.collection, tuple.action]).permissions =
+                (0, cedar_to_d9_translations_1.exprToFilter)(tuple.conditions[0]?.body, 'resource');
+        }
+        const fieldTuples = await this.parseCedarFile(`${folder}/check-fields.cedar`);
+        for (const tuple of fieldTuples) {
+            if (tuple.conditions.length) {
+                byTuple.getOrCreate([tuple.collection, tuple.action]).fields =
+                    (0, cedar_to_d9_translations_1.extractFields)(tuple.conditions[0].body);
+            }
+        }
+        const validateTuples = await this.parseCedarFile(`${folder}/validate.cedar`);
+        for (const tuple of validateTuples) {
+            if (tuple.conditions.length) {
+                byTuple.getOrCreate([tuple.collection, tuple.action]).validation =
+                    (0, cedar_to_d9_translations_1.exprToFilter)(tuple.conditions[0].body, 'context.newValue');
+            }
+        }
+        return byTuple.values();
+    }
+    async parseAllFolders() {
+        const entries = await (0, promises_1.readdir)(this.permissionPath, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            this.reconstructed.push(...(await this.parseRoleFolder(entry.name)));
+        }
+    }
+    mergeIntoRows() {
+        let merged = 0;
+        let updated = 0;
+        let added = 0;
+        let removed = 0;
+        const seen = new TupleKeyMap();
+        for (const perm of this.reconstructed) {
+            const roleId = this.roles.getIdFromName(perm.roleName);
+            if (!roleId && perm.roleName !== 'Public') {
+                // In V2, instead of throwing an error, we could create a new role in the CSV.
+                // But for now, we expect the roles to be pre-defined in the CSV.
+                // This is a sanity check: the role should exist in the CSV, otherwise something is wrong.
+                throw new Error(`role "${perm.roleName}" (from ${this.permissionPath}) not found in directus_roles.csv`);
+            }
+            seen.set([roleId, perm.collection, perm.action], true);
+            const row = this.baseRowsByTuple.get([roleId, perm.collection, perm.action]);
+            if (!row) {
+                // New tuple added in the Cedar files; the role exists, so create a row.
+                const newRow = {
+                    id: String(++this.nextId),
+                    role: roleId,
+                    collection: perm.collection,
+                    action: perm.action,
+                    permissions: perm.permissionsCell(),
+                    validation: perm.validationCell(),
+                    fields: perm.fieldsCell(),
+                    presets: '',
+                };
+                this.baseRowsByTuple.set([roleId, perm.collection, perm.action], newRow);
+                logger_1.logger.info(`added ${perm.roleName}/${perm.collection}/${perm.action} (id ${newRow.id})`);
+                added++;
+                merged++;
+                continue;
+            }
+            // The Cedar policies are the source of truth: overwrite the three
+            // derivable columns directly (the round-trip is meaning-preserving, so
+            // this only reshapes representation, e.g. `{_and:[x]}` -> `x`).
+            row.permissions = perm.permissionsCell();
+            row.validation = perm.validationCell();
+            row.fields = perm.fieldsCell();
+            updated++;
+            merged++;
+        }
+        // Every row is written to authorize.cedar by d9-to-cedar, so a row no longer
+        // produced by the Cedar files has been removed from them.
+        for (const row of this.baseRowsByTuple.values()) {
+            const tuple = [row.role, row.collection, row.action];
+            if (seen.get(tuple))
+                continue;
+            this.baseRowsByTuple.delete(tuple);
+            const roleName = row.role ? this.roles.getNameFromId(row.role) : 'Public';
+            logger_1.logger.info(`removed ${roleName}/${row.collection}/${row.action} (id ${row.id})`);
+            removed++;
+        }
+        logger_1.logger.info(`merged ${merged} permissions, ${updated} row(s) updated, ${added} new row(s) added, ${removed} row(s) removed`);
+    }
+    async writeOutput() {
+        await (0, utils_1.writeCsvFile)(this.outputPath, this.header, this.baseRowsByTuple.values());
+        logger_1.logger.info(`wrote ${this.outputPath}`);
+    }
+    async readCedarAndWriteCsv() {
+        logger_1.logger.info('reading base permission file');
+        await this.readBasePermissionFile();
+        logger_1.logger.info(`found ${this.baseRowsByTuple.values().length} base permissions`);
+        logger_1.logger.info('reading role file');
+        await this.readRoleFile();
+        logger_1.logger.info('parsing cedar policy folders');
+        await this.parseAllFolders();
+        logger_1.logger.info(`reconstructed ${this.reconstructed.length} permissions from cedar`);
+        logger_1.logger.info('merging into base rows');
+        this.mergeIntoRows();
+        logger_1.logger.info('writing csv');
+        await this.writeOutput();
+        logger_1.logger.info('done');
+    }
+}
+exports.CedarToD9Manager = CedarToD9Manager;
+/** CLI action: merge Cedar policies back into directus_permissions.csv. */
+async function cedarToD9(options) {
+    const manager = new CedarToD9Manager(options);
+    await manager.readCedarAndWriteCsv();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItdG8tZDkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvY2xpL2NvbW1hbmRzL2NlZGFyL2NlZGFyLXRvLWQ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWdSQSw4QkFPQztBQXZSRCwyQkFBZ0M7QUFDaEMsMENBQWdEO0FBQ2hELHlEQUF5RDtBQUN6RCx5RUFJb0M7QUFDcEMsbURBQStDO0FBQy9DLCtDQUEyQztBQUMzQyx5Q0FBc0M7QUFDdEMseUNBQStFO0FBRS9FLHdGQUF3RjtBQUN4RixNQUFNLFdBQVc7SUFHZiw2RkFBNkY7SUFDN0YsWUFBNkIsV0FBd0M7UUFBeEMsZ0JBQVcsR0FBWCxXQUFXLENBQTZCO1FBSHBELFlBQU8sR0FBRyxJQUFJLEdBQUcsRUFBaUIsQ0FBQztJQUdvQixDQUFDO0lBRWpFLEtBQUssQ0FBQyxLQUFlO1FBQzNCLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QixDQUFDO0lBRU0sR0FBRyxDQUFDLEtBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVNLEdBQUcsQ0FBQyxLQUFlLEVBQUUsS0FBWTtRQUN0QyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBZTtRQUMzQixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVELHVGQUF1RjtJQUNoRixXQUFXLENBQUMsS0FBZTtRQUNoQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLElBQUksS0FBSyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUN0RSxDQUFDO1lBQ0QsS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDaEMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9CLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFTSxNQUFNO1FBQ1gsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7Q0FDRjtBQUVEOzs7OztHQUtHO0FBQ0gsTUFBYSxnQkFBZ0I7SUFhM0IsWUFBWSxJQUlYO1FBWEQsK0VBQStFO1FBQy9FLGdGQUFnRjtRQUN6RSxvQkFBZSxHQUFHLElBQUksV0FBVyxFQUEwQixDQUFDO1FBQzVELFdBQU0sR0FBYSxFQUFFLENBQUM7UUFDdEIsV0FBTSxHQUFHLENBQUMsQ0FBQztRQUNYLGtCQUFhLEdBQW1CLEVBQUUsQ0FBQztRQU94QyxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksRUFBRSxjQUFjLElBQUksZUFBZSxDQUFDO1FBQzlELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxFQUFFLE9BQU8sSUFBSSxZQUFZLENBQUM7UUFDN0MsSUFBSSxDQUFDLFVBQVU7WUFDYixJQUFJLEVBQUUsVUFBVSxJQUFJLEdBQUcsSUFBSSxDQUFDLE9BQU8sMkJBQTJCLENBQUM7SUFDbkUsQ0FBQztJQUVNLEtBQUssQ0FBQyxzQkFBc0I7UUFDakMsTUFBTSxRQUFRLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTywyQkFBMkIsQ0FBQztRQUM1RCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUEsbUJBQVcsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUN6QyxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsMkJBQW1CLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDdEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFFbEUsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDdEUsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMxQixJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxNQUFNO2dCQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsRUFBRSxDQUFDO1FBQ2hFLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLFlBQVk7UUFDdkIsSUFBSSxDQUFDLEtBQUssR0FBRyxNQUFNLHdCQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsb0ZBQW9GO0lBQzdFLEtBQUssQ0FBQyxjQUFjLENBQ3pCLFFBQWdCO1FBRWhCLElBQUksQ0FBQyxJQUFBLGVBQVUsRUFBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sRUFBRSxDQUFDLENBQUMsaUVBQWlFO1FBQzlFLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sSUFBQSxtQkFBUSxFQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDbkQsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQy9DLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUM3QixlQUFNLENBQUMsS0FBSyxDQUFDLDhCQUE4QixRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQWEsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FJUCxFQUFFLENBQUM7UUFDUixLQUFLLE1BQU0sVUFBVSxJQUFJLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN4QyxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzlDLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDOUIsZUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLDZCQUE2QixRQUFRLEVBQUUsQ0FBQyxDQUFDO2dCQUN0RSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFhLENBQUMsQ0FBQztZQUN4QyxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsdUNBQVksRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxlQUFlLENBQUMsUUFBZ0I7UUFDM0Msa0ZBQWtGO1FBQ2xGLGlGQUFpRjtRQUNqRixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsQ0FBZSxDQUFDLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FDckUsNEJBQVksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FDakQsQ0FBQztRQUVGLE1BQU0sTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUVwRCxNQUFNLGVBQWUsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQy9DLEdBQUcsTUFBTSxrQkFBa0IsQ0FDNUIsQ0FBQztRQUNGLEtBQUssTUFBTSxLQUFLLElBQUksZUFBZSxFQUFFLENBQUM7WUFDcEMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsV0FBVztnQkFDL0QsSUFBQSx1Q0FBWSxFQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxNQUFNLHFCQUFxQixDQUFDLENBQUM7UUFDOUUsS0FBSyxNQUFNLEtBQUssSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzVCLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU07b0JBQzFELElBQUEsd0NBQWEsRUFBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxDQUFDO1FBQzdFLEtBQUssTUFBTSxLQUFLLElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkMsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QixPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxVQUFVO29CQUM5RCxJQUFBLHVDQUFZLEVBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztZQUMvRCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsZUFBZTtRQUMxQixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsa0JBQU8sRUFBQyxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDNUUsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRTtnQkFBRSxTQUFTO1lBQ25DLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2RSxDQUFDO0lBQ0gsQ0FBQztJQUVNLGFBQWE7UUFDbEIsSUFBSSxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQ2YsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBQ2hCLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztRQUNkLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQztRQUNoQixNQUFNLElBQUksR0FBRyxJQUFJLFdBQVcsRUFBUSxDQUFDO1FBRXJDLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN2RCxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzFDLDhFQUE4RTtnQkFDOUUsaUVBQWlFO2dCQUNqRSwwRkFBMEY7Z0JBQzFGLE1BQU0sSUFBSSxLQUFLLENBQ2IsU0FBUyxJQUFJLENBQUMsUUFBUSxXQUFXLElBQUksQ0FBQyxjQUFjLG1DQUFtQyxDQUN4RixDQUFDO1lBQ0osQ0FBQztZQUVELElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFPLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDeEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFPLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztZQUM5RSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7Z0JBQ1Qsd0VBQXdFO2dCQUN4RSxNQUFNLE1BQU0sR0FBMkI7b0JBQ3JDLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDO29CQUN6QixJQUFJLEVBQUUsTUFBTztvQkFDYixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7b0JBQzNCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtvQkFDbkIsV0FBVyxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUU7b0JBQ25DLFVBQVUsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFO29CQUNqQyxNQUFNLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRTtvQkFDekIsT0FBTyxFQUFFLEVBQUU7aUJBQ1osQ0FBQztnQkFDRixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU8sRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDMUUsZUFBTSxDQUFDLElBQUksQ0FDVCxTQUFTLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsTUFBTSxRQUFRLE1BQU0sQ0FBQyxFQUFFLEdBQUcsQ0FDN0UsQ0FBQztnQkFDRixLQUFLLEVBQUUsQ0FBQztnQkFDUixNQUFNLEVBQUUsQ0FBQztnQkFDVCxTQUFTO1lBQ1gsQ0FBQztZQUVELGtFQUFrRTtZQUNsRSx1RUFBdUU7WUFDdkUsZ0VBQWdFO1lBQ2hFLEdBQUcsQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQ3pDLEdBQUcsQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3ZDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQy9CLE9BQU8sRUFBRSxDQUFDO1lBQ1YsTUFBTSxFQUFFLENBQUM7UUFDWCxDQUFDO1FBRUQsNkVBQTZFO1FBQzdFLDBEQUEwRDtRQUMxRCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNoRCxNQUFNLEtBQUssR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDckQsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztnQkFBRSxTQUFTO1lBQzlCLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ25DLE1BQU0sUUFBUSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO1lBQzFFLGVBQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLElBQUksR0FBRyxDQUFDLFVBQVUsSUFBSSxHQUFHLENBQUMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ2xGLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUVELGVBQU0sQ0FBQyxJQUFJLENBQ1QsVUFBVSxNQUFNLGlCQUFpQixPQUFPLG9CQUFvQixLQUFLLHNCQUFzQixPQUFPLGlCQUFpQixDQUNoSCxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sSUFBQSxvQkFBWSxFQUNoQixJQUFJLENBQUMsVUFBVSxFQUNmLElBQUksQ0FBQyxNQUFNLEVBQ1gsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FDOUIsQ0FBQztRQUNGLGVBQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLG9CQUFvQjtRQUMvQixlQUFNLENBQUMsSUFBSSxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDNUMsTUFBTSxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztRQUNwQyxlQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxNQUFNLG1CQUFtQixDQUFDLENBQUM7UUFDOUUsZUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ2pDLE1BQU0sSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzFCLGVBQU0sQ0FBQyxJQUFJLENBQUMsOEJBQThCLENBQUMsQ0FBQztRQUM1QyxNQUFNLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUM3QixlQUFNLENBQUMsSUFBSSxDQUNULGlCQUFpQixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0seUJBQXlCLENBQ3BFLENBQUM7UUFDRixlQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDdEMsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLGVBQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsTUFBTSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDekIsZUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBRUY7QUFoTkQsNENBZ05DO0FBRUQsMkVBQTJFO0FBQ3BFLEtBQUssVUFBVSxTQUFTLENBQUMsT0FJL0I7SUFDQyxNQUFNLE9BQU8sR0FBRyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlDLE1BQU0sT0FBTyxDQUFDLG9CQUFvQixFQUFFLENBQUM7QUFDdkMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4aXN0c1N5bmMgfSBmcm9tICdmcyc7XG5pbXBvcnQgeyByZWFkRmlsZSwgcmVhZGRpciB9IGZyb20gJ2ZzL3Byb21pc2VzJztcbmltcG9ydCAqIGFzIGNlZGFyIGZyb20gJ0BjZWRhci1wb2xpY3kvY2VkYXItd2FzbS9ub2RlanMnO1xuaW1wb3J0IHtcbiAgZXhwYW5kUG9saWN5LFxuICBleHByVG9GaWx0ZXIsXG4gIGV4dHJhY3RGaWVsZHMsXG59IGZyb20gJy4vY2VkYXItdG8tZDktdHJhbnNsYXRpb25zJztcbmltcG9ydCB7IEQ5UGVybWlzc2lvbiB9IGZyb20gJy4vZDktcGVybWlzc2lvbic7XG5pbXBvcnQgeyBSb2xlc1RhYmxlIH0gZnJvbSAnLi9yb2xlcy10YWJsZSc7XG5pbXBvcnQgeyBsb2dnZXIgfSBmcm9tICcuLi8uLi9sb2dnZXInO1xuaW1wb3J0IHsgcmVhZENzdkZpbGUsIHJlYWRGaXJzdExpbmVPZkZpbGUsIHdyaXRlQ3N2RmlsZSB9IGZyb20gJy4uL3NhdmUvdXRpbHMnO1xuXG4vKiogTWFwIGtleWVkIGJ5IGEgdHVwbGUgb2Ygc3RyaW5ncyAoTWFwIGluZGV4ZXMgYXJyYXlzIGJ5IGlkZW50aXR5LCBoZW5jZSB0aGUgam9pbikuICovXG5jbGFzcyBUdXBsZUtleU1hcDxWYWx1ZT4ge1xuICBwcml2YXRlIHJlYWRvbmx5IGVudHJpZXMgPSBuZXcgTWFwPHN0cmluZywgVmFsdWU+KCk7XG5cbiAgLyoqIGBjcmVhdGVWYWx1ZWAgaXMgcmVxdWlyZWQgdG8gdXNlIHtAbGluayBnZXRPckNyZWF0ZX07IG9taXQgaXQgZm9yIGEgcGxhaW4gZ2V0L3NldCBtYXAuICovXG4gIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgY3JlYXRlVmFsdWU/OiAocGFydHM6IHN0cmluZ1tdKSA9PiBWYWx1ZSkge31cblxuICBwcml2YXRlIGtleU9mKHBhcnRzOiBzdHJpbmdbXSk6IHN0cmluZyB7XG4gICAgcmV0dXJuIHBhcnRzLmpvaW4oJyAnKTtcbiAgfVxuXG4gIHB1YmxpYyBnZXQocGFydHM6IHN0cmluZ1tdKSB7XG4gICAgcmV0dXJuIHRoaXMuZW50cmllcy5nZXQodGhpcy5rZXlPZihwYXJ0cykpO1xuICB9XG5cbiAgcHVibGljIHNldChwYXJ0czogc3RyaW5nW10sIHZhbHVlOiBWYWx1ZSk6IHZvaWQge1xuICAgIHRoaXMuZW50cmllcy5zZXQodGhpcy5rZXlPZihwYXJ0cyksIHZhbHVlKTtcbiAgfVxuXG4gIHB1YmxpYyBkZWxldGUocGFydHM6IHN0cmluZ1tdKTogdm9pZCB7XG4gICAgdGhpcy5lbnRyaWVzLmRlbGV0ZSh0aGlzLmtleU9mKHBhcnRzKSk7XG4gIH1cblxuICAvKiogUmV0dXJuIHRoZSB2YWx1ZSBmb3IgYHBhcnRzYCwgY3JlYXRpbmcgYW5kIHN0b3JpbmcgaXQgdmlhIHRoZSBmYWN0b3J5IGlmIGFic2VudC4gKi9cbiAgcHVibGljIGdldE9yQ3JlYXRlKHBhcnRzOiBzdHJpbmdbXSk6IFZhbHVlIHtcbiAgICBjb25zdCBrZXkgPSB0aGlzLmtleU9mKHBhcnRzKTtcbiAgICBsZXQgdmFsdWUgPSB0aGlzLmVudHJpZXMuZ2V0KGtleSk7XG4gICAgaWYgKHZhbHVlID09PSB1bmRlZmluZWQpIHtcbiAgICAgIGlmICghdGhpcy5jcmVhdGVWYWx1ZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ1R1cGxlS2V5TWFwLmdldE9yQ3JlYXRlIGNhbGxlZCB3aXRob3V0IGEgZmFjdG9yeScpO1xuICAgICAgfVxuICAgICAgdmFsdWUgPSB0aGlzLmNyZWF0ZVZhbHVlKHBhcnRzKTtcbiAgICAgIHRoaXMuZW50cmllcy5zZXQoa2V5LCB2YWx1ZSk7XG4gICAgfVxuICAgIHJldHVybiB2YWx1ZTtcbiAgfVxuXG4gIHB1YmxpYyB2YWx1ZXMoKTogVmFsdWVbXSB7XG4gICAgcmV0dXJuIFsuLi50aGlzLmVudHJpZXMudmFsdWVzKCldO1xuICB9XG59XG5cbi8qKlxuICogUmV2ZXJzZSBvZiBkOS10by1jZWRhcjogcmVhZHMgdGhlIHBlci1yb2xlIENlZGFyIHBvbGljeSBmaWxlcyBiYWNrIGludG8gRDlcbiAqIHBlcm1pc3Npb24gcm93cyBhbmQgbWVyZ2VzIHRoZW0gaW50byBkaXJlY3R1c19wZXJtaXNzaW9ucy5jc3YuIFRoZSBvcmlnaW5hbFxuICogQ1NWIHN0YXlzIHRoZSBzb3VyY2Ugb2YgdHJ1dGggZm9yIHRoZSBjb2x1bW5zIENlZGFyIGRvZXMgbm90IGNhcnJ5IChgaWRgLFxuICogYHJvbGVgIFVVSUQsIGBwcmVzZXRzYCk7IG9ubHkgYHBlcm1pc3Npb25zYC9gZmllbGRzYC9gdmFsaWRhdGlvbmAgYXJlIHJld3JpdHRlbi5cbiAqL1xuZXhwb3J0IGNsYXNzIENlZGFyVG9EOU1hbmFnZXIge1xuICBwdWJsaWMgcGVybWlzc2lvblBhdGg6IHN0cmluZztcbiAgcHVibGljIHNxbFBhdGg6IHN0cmluZztcbiAgcHVibGljIG91dHB1dFBhdGg6IHN0cmluZztcblxuICBwdWJsaWMgcm9sZXMhOiBSb2xlc1RhYmxlO1xuICAvLyBSb3dzIGtleWVkIGJ5IChyb2xlLCBjb2xsZWN0aW9uLCBhY3Rpb24pOyB0aGUgbWFwJ3MgdmFsdWVzIChpbnNlcnRpb24gb3JkZXIpXG4gIC8vIGFyZSB3aGF0IGdldHMgd3JpdHRlbiBiYWNrIG91dCwgc28gaXQgaXMgdGhlIHNpbmdsZSBzb3VyY2Ugb2YgdHJ1dGggZm9yIHJvd3MuXG4gIHB1YmxpYyBiYXNlUm93c0J5VHVwbGUgPSBuZXcgVHVwbGVLZXlNYXA8UmVjb3JkPHN0cmluZywgc3RyaW5nPj4oKTtcbiAgcHVibGljIGhlYWRlcjogc3RyaW5nW10gPSBbXTtcbiAgcHVibGljIG5leHRJZCA9IDA7XG4gIHB1YmxpYyByZWNvbnN0cnVjdGVkOiBEOVBlcm1pc3Npb25bXSA9IFtdO1xuXG4gIGNvbnN0cnVjdG9yKG9wdHM/OiB7XG4gICAgcGVybWlzc2lvblBhdGg/OiBzdHJpbmc7XG4gICAgc3FsUGF0aD86IHN0cmluZztcbiAgICBvdXRwdXRQYXRoPzogc3RyaW5nO1xuICB9KSB7XG4gICAgdGhpcy5wZXJtaXNzaW9uUGF0aCA9IG9wdHM/LnBlcm1pc3Npb25QYXRoIHx8ICcuL3Blcm1pc3Npb25zJztcbiAgICB0aGlzLnNxbFBhdGggPSBvcHRzPy5zcWxQYXRoIHx8ICcuL3NxbC9kYXRhJztcbiAgICB0aGlzLm91dHB1dFBhdGggPVxuICAgICAgb3B0cz8ub3V0cHV0UGF0aCB8fCBgJHt0aGlzLnNxbFBhdGh9L2RpcmVjdHVzX3Blcm1pc3Npb25zLmNzdmA7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcmVhZEJhc2VQZXJtaXNzaW9uRmlsZSgpIHtcbiAgICBjb25zdCBmaWxlUGF0aCA9IGAke3RoaXMuc3FsUGF0aH0vZGlyZWN0dXNfcGVybWlzc2lvbnMuY3N2YDtcbiAgICBjb25zdCByb3dzID0gYXdhaXQgcmVhZENzdkZpbGUoZmlsZVBhdGgpO1xuICAgIGNvbnN0IGZpcnN0TGluZSA9IGF3YWl0IHJlYWRGaXJzdExpbmVPZkZpbGUoZmlsZVBhdGgpO1xuICAgIHRoaXMuaGVhZGVyID0gZmlyc3RMaW5lLnNwbGl0KCcsJykubWFwKChjb2x1bW4pID0+IGNvbHVtbi50cmltKCkpO1xuXG4gICAgZm9yIChjb25zdCByb3cgb2Ygcm93cykge1xuICAgICAgdGhpcy5iYXNlUm93c0J5VHVwbGUuc2V0KFtyb3cucm9sZSwgcm93LmNvbGxlY3Rpb24sIHJvdy5hY3Rpb25dLCByb3cpO1xuICAgICAgY29uc3QgaWQgPSBOdW1iZXIocm93LmlkKTtcbiAgICAgIGlmIChOdW1iZXIuaXNGaW5pdGUoaWQpICYmIGlkID4gdGhpcy5uZXh0SWQpIHRoaXMubmV4dElkID0gaWQ7XG4gICAgfVxuICB9XG5cbiAgcHVibGljIGFzeW5jIHJlYWRSb2xlRmlsZSgpIHtcbiAgICB0aGlzLnJvbGVzID0gYXdhaXQgUm9sZXNUYWJsZS5sb2FkKHRoaXMuc3FsUGF0aCk7XG4gIH1cblxuICAvKiogUmVhZCBvbmUgYC5jZWRhcmAgZmlsZSBpbnRvIGV4cGFuZGVkIChjb2xsZWN0aW9uLCBhY3Rpb24sIGNvbmRpdGlvbnMpIHR1cGxlcy4gKi9cbiAgcHVibGljIGFzeW5jIHBhcnNlQ2VkYXJGaWxlKFxuICAgIGZpbGVQYXRoOiBzdHJpbmcsXG4gICk6IFByb21pc2U8QXJyYXk8eyBjb2xsZWN0aW9uOiBzdHJpbmc7IGFjdGlvbjogc3RyaW5nOyBjb25kaXRpb25zOiBhbnlbXSB9Pj4ge1xuICAgIGlmICghZXhpc3RzU3luYyhmaWxlUGF0aCkpIHtcbiAgICAgIHJldHVybiBbXTsgLy8gYSByb2xlIG1heSBub3QgaGF2ZSBldmVyeSAuY2VkYXIgZmlsZSAoZS5nLiBubyB2YWxpZGF0ZS5jZWRhcilcbiAgICB9XG4gICAgY29uc3QgdGV4dCA9IChhd2FpdCByZWFkRmlsZShmaWxlUGF0aCkpLnRvU3RyaW5nKCk7XG4gICAgY29uc3QgcGFydHMgPSBjZWRhci5wb2xpY3lTZXRUZXh0VG9QYXJ0cyh0ZXh0KTtcbiAgICBpZiAocGFydHMudHlwZSA9PT0gJ2ZhaWx1cmUnKSB7XG4gICAgICBsb2dnZXIuZXJyb3IoYGZhaWxlZCB0byBzcGxpdCBwb2xpY3kgc2V0ICR7ZmlsZVBhdGh9YCk7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IocGFydHMuZXJyb3JzIGFzIGFueSk7XG4gICAgfVxuICAgIGNvbnN0IHR1cGxlczogQXJyYXk8e1xuICAgICAgY29sbGVjdGlvbjogc3RyaW5nO1xuICAgICAgYWN0aW9uOiBzdHJpbmc7XG4gICAgICBjb25kaXRpb25zOiBhbnlbXTtcbiAgICB9PiA9IFtdO1xuICAgIGZvciAoY29uc3QgcG9saWN5VGV4dCBvZiBwYXJ0cy5wb2xpY2llcykge1xuICAgICAgY29uc3QgcGFyc2VkID0gY2VkYXIucG9saWN5VG9Kc29uKHBvbGljeVRleHQpO1xuICAgICAgaWYgKHBhcnNlZC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICAgICAgbG9nZ2VyLmVycm9yKHsgcG9saWN5VGV4dCB9LCBgZmFpbGVkIHRvIHBhcnNlIHBvbGljeSBpbiAke2ZpbGVQYXRofWApO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IocGFyc2VkLmVycm9ycyBhcyBhbnkpO1xuICAgICAgfVxuICAgICAgdHVwbGVzLnB1c2goLi4uZXhwYW5kUG9saWN5KHBhcnNlZC5qc29uKSk7XG4gICAgfVxuICAgIHJldHVybiB0dXBsZXM7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcGFyc2VSb2xlRm9sZGVyKHJvbGVOYW1lOiBzdHJpbmcpOiBQcm9taXNlPEQ5UGVybWlzc2lvbltdPiB7XG4gICAgLy8gQSAoY29sbGVjdGlvbiwgYWN0aW9uKSB0dXBsZSBjYW4gYXBwZWFyIGFjcm9zcyBhdXRob3JpemUvY2hlY2stZmllbGRzL3ZhbGlkYXRlLFxuICAgIC8vIHNvIHRoZSBtYXAgY3JlYXRlcyBvbmUgcGVybWlzc2lvbiBwZXIgdHVwbGUgYW5kIHdlIGFjY3VtdWxhdGUgY2xhdXNlcyBvbnRvIGl0LlxuICAgIGNvbnN0IGJ5VHVwbGUgPSBuZXcgVHVwbGVLZXlNYXA8RDlQZXJtaXNzaW9uPigoW2NvbGxlY3Rpb24sIGFjdGlvbl0pID0+XG4gICAgICBEOVBlcm1pc3Npb24uZW1wdHkocm9sZU5hbWUsIGNvbGxlY3Rpb24sIGFjdGlvbiksXG4gICAgKTtcblxuICAgIGNvbnN0IGZvbGRlciA9IGAke3RoaXMucGVybWlzc2lvblBhdGh9LyR7cm9sZU5hbWV9YDtcblxuICAgIGNvbnN0IGF1dGhvcml6ZVR1cGxlcyA9IGF3YWl0IHRoaXMucGFyc2VDZWRhckZpbGUoXG4gICAgICBgJHtmb2xkZXJ9L2F1dGhvcml6ZS5jZWRhcmAsXG4gICAgKTtcbiAgICBmb3IgKGNvbnN0IHR1cGxlIG9mIGF1dGhvcml6ZVR1cGxlcykge1xuICAgICAgYnlUdXBsZS5nZXRPckNyZWF0ZShbdHVwbGUuY29sbGVjdGlvbiwgdHVwbGUuYWN0aW9uXSkucGVybWlzc2lvbnMgPVxuICAgICAgICBleHByVG9GaWx0ZXIodHVwbGUuY29uZGl0aW9uc1swXT8uYm9keSwgJ3Jlc291cmNlJyk7XG4gICAgfVxuXG4gICAgY29uc3QgZmllbGRUdXBsZXMgPSBhd2FpdCB0aGlzLnBhcnNlQ2VkYXJGaWxlKGAke2ZvbGRlcn0vY2hlY2stZmllbGRzLmNlZGFyYCk7XG4gICAgZm9yIChjb25zdCB0dXBsZSBvZiBmaWVsZFR1cGxlcykge1xuICAgICAgaWYgKHR1cGxlLmNvbmRpdGlvbnMubGVuZ3RoKSB7XG4gICAgICAgIGJ5VHVwbGUuZ2V0T3JDcmVhdGUoW3R1cGxlLmNvbGxlY3Rpb24sIHR1cGxlLmFjdGlvbl0pLmZpZWxkcyA9XG4gICAgICAgICAgZXh0cmFjdEZpZWxkcyh0dXBsZS5jb25kaXRpb25zWzBdLmJvZHkpO1xuICAgICAgfVxuICAgIH1cblxuICAgIGNvbnN0IHZhbGlkYXRlVHVwbGVzID0gYXdhaXQgdGhpcy5wYXJzZUNlZGFyRmlsZShgJHtmb2xkZXJ9L3ZhbGlkYXRlLmNlZGFyYCk7XG4gICAgZm9yIChjb25zdCB0dXBsZSBvZiB2YWxpZGF0ZVR1cGxlcykge1xuICAgICAgaWYgKHR1cGxlLmNvbmRpdGlvbnMubGVuZ3RoKSB7XG4gICAgICAgIGJ5VHVwbGUuZ2V0T3JDcmVhdGUoW3R1cGxlLmNvbGxlY3Rpb24sIHR1cGxlLmFjdGlvbl0pLnZhbGlkYXRpb24gPVxuICAgICAgICAgIGV4cHJUb0ZpbHRlcih0dXBsZS5jb25kaXRpb25zWzBdLmJvZHksICdjb250ZXh0Lm5ld1ZhbHVlJyk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIGJ5VHVwbGUudmFsdWVzKCk7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcGFyc2VBbGxGb2xkZXJzKCkge1xuICAgIGNvbnN0IGVudHJpZXMgPSBhd2FpdCByZWFkZGlyKHRoaXMucGVybWlzc2lvblBhdGgsIHsgd2l0aEZpbGVUeXBlczogdHJ1ZSB9KTtcbiAgICBmb3IgKGNvbnN0IGVudHJ5IG9mIGVudHJpZXMpIHtcbiAgICAgIGlmICghZW50cnkuaXNEaXJlY3RvcnkoKSkgY29udGludWU7XG4gICAgICB0aGlzLnJlY29uc3RydWN0ZWQucHVzaCguLi4oYXdhaXQgdGhpcy5wYXJzZVJvbGVGb2xkZXIoZW50cnkubmFtZSkpKTtcbiAgICB9XG4gIH1cblxuICBwdWJsaWMgbWVyZ2VJbnRvUm93cygpIHtcbiAgICBsZXQgbWVyZ2VkID0gMDtcbiAgICBsZXQgdXBkYXRlZCA9IDA7XG4gICAgbGV0IGFkZGVkID0gMDtcbiAgICBsZXQgcmVtb3ZlZCA9IDA7XG4gICAgY29uc3Qgc2VlbiA9IG5ldyBUdXBsZUtleU1hcDx0cnVlPigpO1xuXG4gICAgZm9yIChjb25zdCBwZXJtIG9mIHRoaXMucmVjb25zdHJ1Y3RlZCkge1xuICAgICAgY29uc3Qgcm9sZUlkID0gdGhpcy5yb2xlcy5nZXRJZEZyb21OYW1lKHBlcm0ucm9sZU5hbWUpO1xuICAgICAgaWYgKCFyb2xlSWQgJiYgcGVybS5yb2xlTmFtZSAhPT0gJ1B1YmxpYycpIHtcbiAgICAgICAgLy8gSW4gVjIsIGluc3RlYWQgb2YgdGhyb3dpbmcgYW4gZXJyb3IsIHdlIGNvdWxkIGNyZWF0ZSBhIG5ldyByb2xlIGluIHRoZSBDU1YuXG4gICAgICAgIC8vIEJ1dCBmb3Igbm93LCB3ZSBleHBlY3QgdGhlIHJvbGVzIHRvIGJlIHByZS1kZWZpbmVkIGluIHRoZSBDU1YuXG4gICAgICAgIC8vIFRoaXMgaXMgYSBzYW5pdHkgY2hlY2s6IHRoZSByb2xlIHNob3VsZCBleGlzdCBpbiB0aGUgQ1NWLCBvdGhlcndpc2Ugc29tZXRoaW5nIGlzIHdyb25nLlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgYHJvbGUgXCIke3Blcm0ucm9sZU5hbWV9XCIgKGZyb20gJHt0aGlzLnBlcm1pc3Npb25QYXRofSkgbm90IGZvdW5kIGluIGRpcmVjdHVzX3JvbGVzLmNzdmAsXG4gICAgICAgICk7XG4gICAgICB9XG5cbiAgICAgIHNlZW4uc2V0KFtyb2xlSWQhLCBwZXJtLmNvbGxlY3Rpb24sIHBlcm0uYWN0aW9uXSwgdHJ1ZSk7XG4gICAgICBjb25zdCByb3cgPSB0aGlzLmJhc2VSb3dzQnlUdXBsZS5nZXQoW3JvbGVJZCEsIHBlcm0uY29sbGVjdGlvbiwgcGVybS5hY3Rpb25dKTtcbiAgICAgIGlmICghcm93KSB7XG4gICAgICAgIC8vIE5ldyB0dXBsZSBhZGRlZCBpbiB0aGUgQ2VkYXIgZmlsZXM7IHRoZSByb2xlIGV4aXN0cywgc28gY3JlYXRlIGEgcm93LlxuICAgICAgICBjb25zdCBuZXdSb3c6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7XG4gICAgICAgICAgaWQ6IFN0cmluZygrK3RoaXMubmV4dElkKSxcbiAgICAgICAgICByb2xlOiByb2xlSWQhLFxuICAgICAgICAgIGNvbGxlY3Rpb246IHBlcm0uY29sbGVjdGlvbixcbiAgICAgICAgICBhY3Rpb246IHBlcm0uYWN0aW9uLFxuICAgICAgICAgIHBlcm1pc3Npb25zOiBwZXJtLnBlcm1pc3Npb25zQ2VsbCgpLFxuICAgICAgICAgIHZhbGlkYXRpb246IHBlcm0udmFsaWRhdGlvbkNlbGwoKSxcbiAgICAgICAgICBmaWVsZHM6IHBlcm0uZmllbGRzQ2VsbCgpLFxuICAgICAgICAgIHByZXNldHM6ICcnLFxuICAgICAgICB9O1xuICAgICAgICB0aGlzLmJhc2VSb3dzQnlUdXBsZS5zZXQoW3JvbGVJZCEsIHBlcm0uY29sbGVjdGlvbiwgcGVybS5hY3Rpb25dLCBuZXdSb3cpO1xuICAgICAgICBsb2dnZXIuaW5mbyhcbiAgICAgICAgICBgYWRkZWQgJHtwZXJtLnJvbGVOYW1lfS8ke3Blcm0uY29sbGVjdGlvbn0vJHtwZXJtLmFjdGlvbn0gKGlkICR7bmV3Um93LmlkfSlgLFxuICAgICAgICApO1xuICAgICAgICBhZGRlZCsrO1xuICAgICAgICBtZXJnZWQrKztcbiAgICAgICAgY29udGludWU7XG4gICAgICB9XG5cbiAgICAgIC8vIFRoZSBDZWRhciBwb2xpY2llcyBhcmUgdGhlIHNvdXJjZSBvZiB0cnV0aDogb3ZlcndyaXRlIHRoZSB0aHJlZVxuICAgICAgLy8gZGVyaXZhYmxlIGNvbHVtbnMgZGlyZWN0bHkgKHRoZSByb3VuZC10cmlwIGlzIG1lYW5pbmctcHJlc2VydmluZywgc29cbiAgICAgIC8vIHRoaXMgb25seSByZXNoYXBlcyByZXByZXNlbnRhdGlvbiwgZS5nLiBge19hbmQ6W3hdfWAgLT4gYHhgKS5cbiAgICAgIHJvdy5wZXJtaXNzaW9ucyA9IHBlcm0ucGVybWlzc2lvbnNDZWxsKCk7XG4gICAgICByb3cudmFsaWRhdGlvbiA9IHBlcm0udmFsaWRhdGlvbkNlbGwoKTtcbiAgICAgIHJvdy5maWVsZHMgPSBwZXJtLmZpZWxkc0NlbGwoKTtcbiAgICAgIHVwZGF0ZWQrKztcbiAgICAgIG1lcmdlZCsrO1xuICAgIH1cblxuICAgIC8vIEV2ZXJ5IHJvdyBpcyB3cml0dGVuIHRvIGF1dGhvcml6ZS5jZWRhciBieSBkOS10by1jZWRhciwgc28gYSByb3cgbm8gbG9uZ2VyXG4gICAgLy8gcHJvZHVjZWQgYnkgdGhlIENlZGFyIGZpbGVzIGhhcyBiZWVuIHJlbW92ZWQgZnJvbSB0aGVtLlxuICAgIGZvciAoY29uc3Qgcm93IG9mIHRoaXMuYmFzZVJvd3NCeVR1cGxlLnZhbHVlcygpKSB7XG4gICAgICBjb25zdCB0dXBsZSA9IFtyb3cucm9sZSwgcm93LmNvbGxlY3Rpb24sIHJvdy5hY3Rpb25dO1xuICAgICAgaWYgKHNlZW4uZ2V0KHR1cGxlKSkgY29udGludWU7XG4gICAgICB0aGlzLmJhc2VSb3dzQnlUdXBsZS5kZWxldGUodHVwbGUpO1xuICAgICAgY29uc3Qgcm9sZU5hbWUgPSByb3cucm9sZSA/IHRoaXMucm9sZXMuZ2V0TmFtZUZyb21JZChyb3cucm9sZSkgOiAnUHVibGljJztcbiAgICAgIGxvZ2dlci5pbmZvKGByZW1vdmVkICR7cm9sZU5hbWV9LyR7cm93LmNvbGxlY3Rpb259LyR7cm93LmFjdGlvbn0gKGlkICR7cm93LmlkfSlgKTtcbiAgICAgIHJlbW92ZWQrKztcbiAgICB9XG5cbiAgICBsb2dnZXIuaW5mbyhcbiAgICAgIGBtZXJnZWQgJHttZXJnZWR9IHBlcm1pc3Npb25zLCAke3VwZGF0ZWR9IHJvdyhzKSB1cGRhdGVkLCAke2FkZGVkfSBuZXcgcm93KHMpIGFkZGVkLCAke3JlbW92ZWR9IHJvdyhzKSByZW1vdmVkYCxcbiAgICApO1xuICB9XG5cbiAgcHVibGljIGFzeW5jIHdyaXRlT3V0cHV0KCkge1xuICAgIGF3YWl0IHdyaXRlQ3N2RmlsZShcbiAgICAgIHRoaXMub3V0cHV0UGF0aCxcbiAgICAgIHRoaXMuaGVhZGVyLFxuICAgICAgdGhpcy5iYXNlUm93c0J5VHVwbGUudmFsdWVzKCksXG4gICAgKTtcbiAgICBsb2dnZXIuaW5mbyhgd3JvdGUgJHt0aGlzLm91dHB1dFBhdGh9YCk7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcmVhZENlZGFyQW5kV3JpdGVDc3YoKSB7XG4gICAgbG9nZ2VyLmluZm8oJ3JlYWRpbmcgYmFzZSBwZXJtaXNzaW9uIGZpbGUnKTtcbiAgICBhd2FpdCB0aGlzLnJlYWRCYXNlUGVybWlzc2lvbkZpbGUoKTtcbiAgICBsb2dnZXIuaW5mbyhgZm91bmQgJHt0aGlzLmJhc2VSb3dzQnlUdXBsZS52YWx1ZXMoKS5sZW5ndGh9IGJhc2UgcGVybWlzc2lvbnNgKTtcbiAgICBsb2dnZXIuaW5mbygncmVhZGluZyByb2xlIGZpbGUnKTtcbiAgICBhd2FpdCB0aGlzLnJlYWRSb2xlRmlsZSgpO1xuICAgIGxvZ2dlci5pbmZvKCdwYXJzaW5nIGNlZGFyIHBvbGljeSBmb2xkZXJzJyk7XG4gICAgYXdhaXQgdGhpcy5wYXJzZUFsbEZvbGRlcnMoKTtcbiAgICBsb2dnZXIuaW5mbyhcbiAgICAgIGByZWNvbnN0cnVjdGVkICR7dGhpcy5yZWNvbnN0cnVjdGVkLmxlbmd0aH0gcGVybWlzc2lvbnMgZnJvbSBjZWRhcmAsXG4gICAgKTtcbiAgICBsb2dnZXIuaW5mbygnbWVyZ2luZyBpbnRvIGJhc2Ugcm93cycpO1xuICAgIHRoaXMubWVyZ2VJbnRvUm93cygpO1xuICAgIGxvZ2dlci5pbmZvKCd3cml0aW5nIGNzdicpO1xuICAgIGF3YWl0IHRoaXMud3JpdGVPdXRwdXQoKTtcbiAgICBsb2dnZXIuaW5mbygnZG9uZScpO1xuICB9XG5cbn1cblxuLyoqIENMSSBhY3Rpb246IG1lcmdlIENlZGFyIHBvbGljaWVzIGJhY2sgaW50byBkaXJlY3R1c19wZXJtaXNzaW9ucy5jc3YuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY2VkYXJUb0Q5KG9wdGlvbnM/OiB7XG4gIHBlcm1pc3Npb25QYXRoPzogc3RyaW5nO1xuICBzcWxQYXRoPzogc3RyaW5nO1xuICBvdXRwdXRQYXRoPzogc3RyaW5nO1xufSk6IFByb21pc2U8dm9pZD4ge1xuICBjb25zdCBtYW5hZ2VyID0gbmV3IENlZGFyVG9EOU1hbmFnZXIob3B0aW9ucyk7XG4gIGF3YWl0IG1hbmFnZXIucmVhZENlZGFyQW5kV3JpdGVDc3YoKTtcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-translations.d.ts

@@ -0,0 +1,9 @@
+import type { PolicyJson } from '@cedar-policy/cedar-wasm/nodejs';
+import { D9Permission, Filter } from './d9-permission';
+export type ConditionSubject = 'resource' | 'context.newValue';
+export declare function addWhenClauses(filter: Filter, subject?: ConditionSubject): any;
+export declare function translateToCedar(permission: D9Permission): {
+    mainPolicy: PolicyJson;
+    fieldPolicy?: PolicyJson;
+    validationPolicy?: PolicyJson;
+};