@wbce/projen-d9 0.0.28 → 0.1.1

package/lib/cli/atlas.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ATLAS_VERSION = void 0;
+exports.atlasFileName = atlasFileName;
+exports.ensureAtlas = ensureAtlas;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const logger_1 = require("./logger");
+const plumbing_config_1 = require("./plumbing-config");
+exports.DEFAULT_ATLAS_VERSION = '1.3.3';
+const RELEASE_SERVER = 'https://release.ariga.io/atlas';
+// resolved at startup: check-unsaved changes the cwd to a worktree without node_modules
+const CACHE_DIR = (0, path_1.resolve)('./node_modules/.cache/d9-plumbing');
+const PLATFORMS = { darwin: 'darwin', linux: 'linux' };
+const ARCHS = { x64: 'amd64', arm64: 'arm64' };
+/**
+ * Name of the Atlas release file, e.g. atlas-community-linux-amd64-v1.3.3
+ */
+function atlasFileName(version, platform = process.platform, arch = process.arch) {
+    const os = PLATFORMS[platform];
+    const cpu = ARCHS[arch];
+    if (!os || !cpu) {
+        throw new Error(`atlas is not available for ${platform}-${arch} (supported: darwin/linux, x64/arm64)`);
+    }
+    return `atlas-community-${os}-${cpu}-v${version}`;
+}
+async function download(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`failed to download ${url}: ${response.status} ${response.statusText}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+/**
+ * Downloads the Atlas Community Edition binary (Apache 2.0) in the version configured in d9-plumbing.json and returns its path.
+ * The binary is cached in node_modules/.cache/d9-plumbing.
+ */
+async function ensureAtlas() {
+    const config = (0, plumbing_config_1.readPlumbingConfig)();
+    const fileName = atlasFileName(config.atlasVersion ?? exports.DEFAULT_ATLAS_VERSION);
+    const binPath = (0, path_1.join)(CACHE_DIR, fileName);
+    if ((0, fs_1.existsSync)(binPath)) {
+        return binPath;
+    }
+    logger_1.logger.info(`Downloading ${fileName}`);
+    const [binary, checksumFile] = await Promise.all([
+        download(`${RELEASE_SERVER}/${fileName}`),
+        download(`${RELEASE_SERVER}/${fileName}.sha256`),
+    ]);
+    const expected = checksumFile.toString().trim().split(/\s+/)[0];
+    const actual = (0, crypto_1.createHash)('sha256').update(binary).digest('hex');
+    if (actual !== expected) {
+        throw new Error(`checksum mismatch for ${fileName}: expected ${expected}, got ${actual}`);
+    }
+    await (0, promises_1.mkdir)(CACHE_DIR, { recursive: true });
+    // written then renamed, so an interrupted download never leaves a broken binary in the cache
+    const tmpPath = `${binPath}.tmp`;
+    await (0, promises_1.writeFile)(tmpPath, binary);
+    await (0, promises_1.chmod)(tmpPath, 0o755);
+    await (0, promises_1.rename)(tmpPath, binPath);
+    return binPath;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXRsYXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY2xpL2F0bGFzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQW1CQSxzQ0FPQztBQWNELGtDQTBCQztBQWxFRCxtQ0FBb0M7QUFDcEMsMkJBQWdDO0FBQ2hDLDBDQUE4RDtBQUM5RCwrQkFBcUM7QUFDckMscUNBQWtDO0FBQ2xDLHVEQUF1RDtBQUUxQyxRQUFBLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztBQUU3QyxNQUFNLGNBQWMsR0FBRyxnQ0FBZ0MsQ0FBQztBQUN4RCx3RkFBd0Y7QUFDeEYsTUFBTSxTQUFTLEdBQUcsSUFBQSxjQUFPLEVBQUMsbUNBQW1DLENBQUMsQ0FBQztBQUUvRCxNQUFNLFNBQVMsR0FBMkIsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMvRSxNQUFNLEtBQUssR0FBMkIsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUV2RTs7R0FFRztBQUNILFNBQWdCLGFBQWEsQ0FBQyxPQUFlLEVBQUUsV0FBbUIsT0FBTyxDQUFDLFFBQVEsRUFBRSxPQUFlLE9BQU8sQ0FBQyxJQUFJO0lBQzdHLE1BQU0sRUFBRSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMvQixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDeEIsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sSUFBSSxLQUFLLENBQUMsOEJBQThCLFFBQVEsSUFBSSxJQUFJLHVDQUF1QyxDQUFDLENBQUM7SUFDekcsQ0FBQztJQUNELE9BQU8sbUJBQW1CLEVBQUUsSUFBSSxHQUFHLEtBQUssT0FBTyxFQUFFLENBQUM7QUFDcEQsQ0FBQztBQUVELEtBQUssVUFBVSxRQUFRLENBQUMsR0FBVztJQUNqQyxNQUFNLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLEdBQUcsS0FBSyxRQUFRLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxRQUFRLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztBQUNuRCxDQUFDO0FBRUQ7OztHQUdHO0FBQ0ksS0FBSyxVQUFVLFdBQVc7SUFDL0IsTUFBTSxNQUFNLEdBQUcsSUFBQSxvQ0FBa0IsR0FBRSxDQUFDO0lBQ3BDLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLDZCQUFxQixDQUFDLENBQUM7SUFDN0UsTUFBTSxPQUFPLEdBQUcsSUFBQSxXQUFJLEVBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQzFDLElBQUksSUFBQSxlQUFVLEVBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN4QixPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsZUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDdkMsTUFBTSxDQUFDLE1BQU0sRUFBRSxZQUFZLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDL0MsUUFBUSxDQUFDLEdBQUcsY0FBYyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ3pDLFFBQVEsQ0FBQyxHQUFHLGNBQWMsSUFBSSxRQUFRLFNBQVMsQ0FBQztLQUNqRCxDQUFDLENBQUM7SUFDSCxNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLElBQUEsbUJBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pFLElBQUksTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLFFBQVEsY0FBYyxRQUFRLFNBQVMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBRUQsTUFBTSxJQUFBLGdCQUFLLEVBQUMsU0FBUyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUMsNkZBQTZGO0lBQzdGLE1BQU0sT0FBTyxHQUFHLEdBQUcsT0FBTyxNQUFNLENBQUM7SUFDakMsTUFBTSxJQUFBLG9CQUFTLEVBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sSUFBQSxnQkFBSyxFQUFDLE9BQU8sRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM1QixNQUFNLElBQUEsaUJBQU0sRUFBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDL0IsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGNyZWF0ZUhhc2ggfSBmcm9tICdjcnlwdG8nO1xuaW1wb3J0IHsgZXhpc3RzU3luYyB9IGZyb20gJ2ZzJztcbmltcG9ydCB7IGNobW9kLCBta2RpciwgcmVuYW1lLCB3cml0ZUZpbGUgfSBmcm9tICdmcy9wcm9taXNlcyc7XG5pbXBvcnQgeyBqb2luLCByZXNvbHZlIH0gZnJvbSAncGF0aCc7XG5pbXBvcnQgeyBsb2dnZXIgfSBmcm9tICcuL2xvZ2dlcic7XG5pbXBvcnQgeyByZWFkUGx1bWJpbmdDb25maWcgfSBmcm9tICcuL3BsdW1iaW5nLWNvbmZpZyc7XG5cbmV4cG9ydCBjb25zdCBERUZBVUxUX0FUTEFTX1ZFUlNJT04gPSAnMS4zLjMnO1xuXG5jb25zdCBSRUxFQVNFX1NFUlZFUiA9ICdodHRwczovL3JlbGVhc2UuYXJpZ2EuaW8vYXRsYXMnO1xuLy8gcmVzb2x2ZWQgYXQgc3RhcnR1cDogY2hlY2stdW5zYXZlZCBjaGFuZ2VzIHRoZSBjd2QgdG8gYSB3b3JrdHJlZSB3aXRob3V0IG5vZGVfbW9kdWxlc1xuY29uc3QgQ0FDSEVfRElSID0gcmVzb2x2ZSgnLi9ub2RlX21vZHVsZXMvLmNhY2hlL2Q5LXBsdW1iaW5nJyk7XG5cbmNvbnN0IFBMQVRGT1JNUzogUmVjb3JkPHN0cmluZywgc3RyaW5nPiA9IHsgZGFyd2luOiAnZGFyd2luJywgbGludXg6ICdsaW51eCcgfTtcbmNvbnN0IEFSQ0hTOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0geyB4NjQ6ICdhbWQ2NCcsIGFybTY0OiAnYXJtNjQnIH07XG5cbi8qKlxuICogTmFtZSBvZiB0aGUgQXRsYXMgcmVsZWFzZSBmaWxlLCBlLmcuIGF0bGFzLWNvbW11bml0eS1saW51eC1hbWQ2NC12MS4zLjNcbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGF0bGFzRmlsZU5hbWUodmVyc2lvbjogc3RyaW5nLCBwbGF0Zm9ybTogc3RyaW5nID0gcHJvY2Vzcy5wbGF0Zm9ybSwgYXJjaDogc3RyaW5nID0gcHJvY2Vzcy5hcmNoKSB7XG4gIGNvbnN0IG9zID0gUExBVEZPUk1TW3BsYXRmb3JtXTtcbiAgY29uc3QgY3B1ID0gQVJDSFNbYXJjaF07XG4gIGlmICghb3MgfHwgIWNwdSkge1xuICAgIHRocm93IG5ldyBFcnJvcihgYXRsYXMgaXMgbm90IGF2YWlsYWJsZSBmb3IgJHtwbGF0Zm9ybX0tJHthcmNofSAoc3VwcG9ydGVkOiBkYXJ3aW4vbGludXgsIHg2NC9hcm02NClgKTtcbiAgfVxuICByZXR1cm4gYGF0bGFzLWNvbW11bml0eS0ke29zfS0ke2NwdX0tdiR7dmVyc2lvbn1gO1xufVxuXG5hc3luYyBmdW5jdGlvbiBkb3dubG9hZCh1cmw6IHN0cmluZykge1xuICBjb25zdCByZXNwb25zZSA9IGF3YWl0IGZldGNoKHVybCk7XG4gIGlmICghcmVzcG9uc2Uub2spIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGZhaWxlZCB0byBkb3dubG9hZCAke3VybH06ICR7cmVzcG9uc2Uuc3RhdHVzfSAke3Jlc3BvbnNlLnN0YXR1c1RleHR9YCk7XG4gIH1cbiAgcmV0dXJuIEJ1ZmZlci5mcm9tKGF3YWl0IHJlc3BvbnNlLmFycmF5QnVmZmVyKCkpO1xufVxuXG4vKipcbiAqIERvd25sb2FkcyB0aGUgQXRsYXMgQ29tbXVuaXR5IEVkaXRpb24gYmluYXJ5IChBcGFjaGUgMi4wKSBpbiB0aGUgdmVyc2lvbiBjb25maWd1cmVkIGluIGQ5LXBsdW1iaW5nLmpzb24gYW5kIHJldHVybnMgaXRzIHBhdGguXG4gKiBUaGUgYmluYXJ5IGlzIGNhY2hlZCBpbiBub2RlX21vZHVsZXMvLmNhY2hlL2Q5LXBsdW1iaW5nLlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZW5zdXJlQXRsYXMoKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgY29uZmlnID0gcmVhZFBsdW1iaW5nQ29uZmlnKCk7XG4gIGNvbnN0IGZpbGVOYW1lID0gYXRsYXNGaWxlTmFtZShjb25maWcuYXRsYXNWZXJzaW9uID8/IERFRkFVTFRfQVRMQVNfVkVSU0lPTik7XG4gIGNvbnN0IGJpblBhdGggPSBqb2luKENBQ0hFX0RJUiwgZmlsZU5hbWUpO1xuICBpZiAoZXhpc3RzU3luYyhiaW5QYXRoKSkge1xuICAgIHJldHVybiBiaW5QYXRoO1xuICB9XG5cbiAgbG9nZ2VyLmluZm8oYERvd25sb2FkaW5nICR7ZmlsZU5hbWV9YCk7XG4gIGNvbnN0IFtiaW5hcnksIGNoZWNrc3VtRmlsZV0gPSBhd2FpdCBQcm9taXNlLmFsbChbXG4gICAgZG93bmxvYWQoYCR7UkVMRUFTRV9TRVJWRVJ9LyR7ZmlsZU5hbWV9YCksXG4gICAgZG93bmxvYWQoYCR7UkVMRUFTRV9TRVJWRVJ9LyR7ZmlsZU5hbWV9LnNoYTI1NmApLFxuICBdKTtcbiAgY29uc3QgZXhwZWN0ZWQgPSBjaGVja3N1bUZpbGUudG9TdHJpbmcoKS50cmltKCkuc3BsaXQoL1xccysvKVswXTtcbiAgY29uc3QgYWN0dWFsID0gY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKGJpbmFyeSkuZGlnZXN0KCdoZXgnKTtcbiAgaWYgKGFjdHVhbCAhPT0gZXhwZWN0ZWQpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoYGNoZWNrc3VtIG1pc21hdGNoIGZvciAke2ZpbGVOYW1lfTogZXhwZWN0ZWQgJHtleHBlY3RlZH0sIGdvdCAke2FjdHVhbH1gKTtcbiAgfVxuXG4gIGF3YWl0IG1rZGlyKENBQ0hFX0RJUiwgeyByZWN1cnNpdmU6IHRydWUgfSk7XG4gIC8vIHdyaXR0ZW4gdGhlbiByZW5hbWVkLCBzbyBhbiBpbnRlcnJ1cHRlZCBkb3dubG9hZCBuZXZlciBsZWF2ZXMgYSBicm9rZW4gYmluYXJ5IGluIHRoZSBjYWNoZVxuICBjb25zdCB0bXBQYXRoID0gYCR7YmluUGF0aH0udG1wYDtcbiAgYXdhaXQgd3JpdGVGaWxlKHRtcFBhdGgsIGJpbmFyeSk7XG4gIGF3YWl0IGNobW9kKHRtcFBhdGgsIDBvNzU1KTtcbiAgYXdhaXQgcmVuYW1lKHRtcFBhdGgsIGJpblBhdGgpO1xuICByZXR1cm4gYmluUGF0aDtcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-format.d.ts

@@ -0,0 +1,7 @@
+import type { PolicyJson } from '@cedar-policy/cedar-wasm/nodejs';
+/**
+ * Cedar's formatter for the policy head, our own layout for the conditions:
+ * operands of one logical level share an indentation, each nested level adds one,
+ * and the `&&` / `||` operator leads the line.
+ */
+export declare function policyToCedarText(policy: PolicyJson): string;

package/lib/cli/commands/cedar/cedar-format.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyToCedarText = policyToCedarText;
+const cedar = require("@cedar-policy/cedar-wasm/nodejs");
+const logger_1 = require("../../logger");
+/** Width of one logical level: the operator column (`|| `) plus the base gap. */
+const LEVEL_INDENT = ' '.repeat(5);
+function booleanOperator(expr) {
+    const key = Object.keys(expr)[0];
+    return key === '&&' || key === '||' ? key : undefined;
+}
+/** Cedar's text for a policy with `All` scopes and a single `when` clause. */
+const LEAF_PREFIX = 'permit(principal, action, resource) when { ';
+const LEAF_SUFFIX = ' };';
+/** Any non-boolean expression, printed by Cedar itself. */
+function leafToText(expr) {
+    const result = cedar.policyToText({
+        effect: 'permit',
+        principal: { op: 'All' },
+        action: { op: 'All' },
+        resource: { op: 'All' },
+        conditions: [{ kind: 'when', body: expr }],
+    });
+    if (result.type === 'failure') {
+        logger_1.logger.error({ expr }, 'failed to transform expression into text');
+        throw new Error(result.errors);
+    }
+    return result.text.slice(LEAF_PREFIX.length, -LEAF_SUFFIX.length);
+}
+/**
+ * Lines of `expr` within a group of `parent`, each starting with a 3-character
+ * operator column; a nested group (other operator) goes one level deeper in parentheses.
+ */
+function toLines(expr, parent) {
+    const operator = booleanOperator(expr);
+    if (!operator)
+        return [`   ${leafToText(expr)}`];
+    // the top level (no parent) is a group without parentheses
+    if (parent && operator !== parent) {
+        return ['   (', ...toLines(expr, operator).map((line) => LEVEL_INDENT + line), '   )'];
+    }
+    // the operator joins the two sides, on the line where the right side starts
+    const [first, ...rest] = toLines(expr[operator].right, operator);
+    return [...toLines(expr[operator].left, operator), `${operator} ${first.slice(3)}`, ...rest];
+}
+/**
+ * Cedar's formatter for the policy head, our own layout for the conditions:
+ * operands of one logical level share an indentation, each nested level adds one,
+ * and the `&&` / `||` operator leads the line.
+ */
+function policyToCedarText(policy) {
+    const head = cedar.policyToText({ ...policy, conditions: [] });
+    if (head.type === 'failure') {
+        logger_1.logger.error({ policy }, 'failed to transform policy into text');
+        throw new Error(head.errors);
+    }
+    const formattedHead = cedar.formatPolicies({
+        policyText: head.text,
+        lineWidth: 100,
+        indentWidth: 2,
+    });
+    if (formattedHead.type === 'failure') {
+        throw new Error(formattedHead);
+    }
+    // a policy without conditions is formatted as `…;\n`
+    const lines = [formattedHead.formatted_policy.slice(0, -2)];
+    // translateToCedar writes at most one `when` clause
+    const [condition] = policy.conditions;
+    if (condition) {
+        const when = toLines(condition.body);
+        lines.push(['when {', ...when.map((line) => `  ${line}`), '}'].join('\n'));
+    }
+    return lines.join('\n') + ';';
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItZm9ybWF0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NsaS9jb21tYW5kcy9jZWRhci9jZWRhci1mb3JtYXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFxREEsOENBeUJDO0FBOUVELHlEQUF5RDtBQUV6RCx5Q0FBc0M7QUFFdEMsaUZBQWlGO0FBQ2pGLE1BQU0sWUFBWSxHQUFHLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFbkMsU0FBUyxlQUFlLENBQUMsSUFBUztJQUNoQyxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sR0FBRyxLQUFLLElBQUksSUFBSSxHQUFHLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUN4RCxDQUFDO0FBRUQsOEVBQThFO0FBQzlFLE1BQU0sV0FBVyxHQUFHLDZDQUE2QyxDQUFDO0FBQ2xFLE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQztBQUUxQiwyREFBMkQ7QUFDM0QsU0FBUyxVQUFVLENBQUMsSUFBUztJQUMzQixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ2hDLE1BQU0sRUFBRSxRQUFRO1FBQ2hCLFNBQVMsRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUU7UUFDeEIsTUFBTSxFQUFFLEVBQUUsRUFBRSxFQUFFLEtBQUssRUFBRTtRQUNyQixRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFO1FBQ3ZCLFVBQVUsRUFBRSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUM7S0FDM0MsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzlCLGVBQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSwwQ0FBMEMsQ0FBQyxDQUFDO1FBQ25FLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQWEsQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUM7QUFDcEUsQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQVMsT0FBTyxDQUFDLElBQVMsRUFBRSxNQUFlO0lBQ3pDLE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2QyxJQUFJLENBQUMsUUFBUTtRQUFFLE9BQU8sQ0FBQyxNQUFNLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDakQsMkRBQTJEO0lBQzNELElBQUksTUFBTSxJQUFJLFFBQVEsS0FBSyxNQUFNLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBQ0QsNEVBQTRFO0lBQzVFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNqRSxPQUFPLENBQUMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsRUFBRSxHQUFHLFFBQVEsSUFBSSxLQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsR0FBRyxJQUFJLENBQUMsQ0FBQztBQUNoRyxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQWdCLGlCQUFpQixDQUFDLE1BQWtCO0lBQ2xELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxVQUFVLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUMvRCxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDNUIsZUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLHNDQUFzQyxDQUFDLENBQUM7UUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBYSxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxjQUFjLENBQUM7UUFDekMsVUFBVSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQ3JCLFNBQVMsRUFBRSxHQUFHO1FBQ2QsV0FBVyxFQUFFLENBQUM7S0FDZixDQUFDLENBQUM7SUFDSCxJQUFJLGFBQWEsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxhQUFvQixDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUNELHFEQUFxRDtJQUNyRCxNQUFNLEtBQUssR0FBRyxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RCxvREFBb0Q7SUFDcEQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7SUFDdEMsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNkLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDckMsS0FBSyxDQUFDLElBQUksQ0FDUixDQUFDLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQy9ELENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEdBQUcsQ0FBQztBQUNoQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2VkYXIgZnJvbSAnQGNlZGFyLXBvbGljeS9jZWRhci13YXNtL25vZGVqcyc7XG5pbXBvcnQgdHlwZSB7IFBvbGljeUpzb24gfSBmcm9tICdAY2VkYXItcG9saWN5L2NlZGFyLXdhc20vbm9kZWpzJztcbmltcG9ydCB7IGxvZ2dlciB9IGZyb20gJy4uLy4uL2xvZ2dlcic7XG5cbi8qKiBXaWR0aCBvZiBvbmUgbG9naWNhbCBsZXZlbDogdGhlIG9wZXJhdG9yIGNvbHVtbiAoYHx8IGApIHBsdXMgdGhlIGJhc2UgZ2FwLiAqL1xuY29uc3QgTEVWRUxfSU5ERU5UID0gJyAnLnJlcGVhdCg1KTtcblxuZnVuY3Rpb24gYm9vbGVhbk9wZXJhdG9yKGV4cHI6IGFueSk6ICcmJicgfCAnfHwnIHwgdW5kZWZpbmVkIHtcbiAgY29uc3Qga2V5ID0gT2JqZWN0LmtleXMoZXhwcilbMF07XG4gIHJldHVybiBrZXkgPT09ICcmJicgfHwga2V5ID09PSAnfHwnID8ga2V5IDogdW5kZWZpbmVkO1xufVxuXG4vKiogQ2VkYXIncyB0ZXh0IGZvciBhIHBvbGljeSB3aXRoIGBBbGxgIHNjb3BlcyBhbmQgYSBzaW5nbGUgYHdoZW5gIGNsYXVzZS4gKi9cbmNvbnN0IExFQUZfUFJFRklYID0gJ3Blcm1pdChwcmluY2lwYWwsIGFjdGlvbiwgcmVzb3VyY2UpIHdoZW4geyAnO1xuY29uc3QgTEVBRl9TVUZGSVggPSAnIH07JztcblxuLyoqIEFueSBub24tYm9vbGVhbiBleHByZXNzaW9uLCBwcmludGVkIGJ5IENlZGFyIGl0c2VsZi4gKi9cbmZ1bmN0aW9uIGxlYWZUb1RleHQoZXhwcjogYW55KTogc3RyaW5nIHtcbiAgY29uc3QgcmVzdWx0ID0gY2VkYXIucG9saWN5VG9UZXh0KHtcbiAgICBlZmZlY3Q6ICdwZXJtaXQnLFxuICAgIHByaW5jaXBhbDogeyBvcDogJ0FsbCcgfSxcbiAgICBhY3Rpb246IHsgb3A6ICdBbGwnIH0sXG4gICAgcmVzb3VyY2U6IHsgb3A6ICdBbGwnIH0sXG4gICAgY29uZGl0aW9uczogW3sga2luZDogJ3doZW4nLCBib2R5OiBleHByIH1dLFxuICB9KTtcbiAgaWYgKHJlc3VsdC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICBsb2dnZXIuZXJyb3IoeyBleHByIH0sICdmYWlsZWQgdG8gdHJhbnNmb3JtIGV4cHJlc3Npb24gaW50byB0ZXh0Jyk7XG4gICAgdGhyb3cgbmV3IEVycm9yKHJlc3VsdC5lcnJvcnMgYXMgYW55KTtcbiAgfVxuICByZXR1cm4gcmVzdWx0LnRleHQuc2xpY2UoTEVBRl9QUkVGSVgubGVuZ3RoLCAtTEVBRl9TVUZGSVgubGVuZ3RoKTtcbn1cblxuLyoqXG4gKiBMaW5lcyBvZiBgZXhwcmAgd2l0aGluIGEgZ3JvdXAgb2YgYHBhcmVudGAsIGVhY2ggc3RhcnRpbmcgd2l0aCBhIDMtY2hhcmFjdGVyXG4gKiBvcGVyYXRvciBjb2x1bW47IGEgbmVzdGVkIGdyb3VwIChvdGhlciBvcGVyYXRvcikgZ29lcyBvbmUgbGV2ZWwgZGVlcGVyIGluIHBhcmVudGhlc2VzLlxuICovXG5mdW5jdGlvbiB0b0xpbmVzKGV4cHI6IGFueSwgcGFyZW50Pzogc3RyaW5nKTogc3RyaW5nW10ge1xuICBjb25zdCBvcGVyYXRvciA9IGJvb2xlYW5PcGVyYXRvcihleHByKTtcbiAgaWYgKCFvcGVyYXRvcikgcmV0dXJuIFtgICAgJHtsZWFmVG9UZXh0KGV4cHIpfWBdO1xuICAvLyB0aGUgdG9wIGxldmVsIChubyBwYXJlbnQpIGlzIGEgZ3JvdXAgd2l0aG91dCBwYXJlbnRoZXNlc1xuICBpZiAocGFyZW50ICYmIG9wZXJhdG9yICE9PSBwYXJlbnQpIHtcbiAgICByZXR1cm4gWycgICAoJywgLi4udG9MaW5lcyhleHByLCBvcGVyYXRvcikubWFwKChsaW5lKSA9PiBMRVZFTF9JTkRFTlQgKyBsaW5lKSwgJyAgICknXTtcbiAgfVxuICAvLyB0aGUgb3BlcmF0b3Igam9pbnMgdGhlIHR3byBzaWRlcywgb24gdGhlIGxpbmUgd2hlcmUgdGhlIHJpZ2h0IHNpZGUgc3RhcnRzXG4gIGNvbnN0IFtmaXJzdCwgLi4ucmVzdF0gPSB0b0xpbmVzKGV4cHJbb3BlcmF0b3JdLnJpZ2h0LCBvcGVyYXRvcik7XG4gIHJldHVybiBbLi4udG9MaW5lcyhleHByW29wZXJhdG9yXS5sZWZ0LCBvcGVyYXRvciksIGAke29wZXJhdG9yfSAke2ZpcnN0IS5zbGljZSgzKX1gLCAuLi5yZXN0XTtcbn1cblxuLyoqXG4gKiBDZWRhcidzIGZvcm1hdHRlciBmb3IgdGhlIHBvbGljeSBoZWFkLCBvdXIgb3duIGxheW91dCBmb3IgdGhlIGNvbmRpdGlvbnM6XG4gKiBvcGVyYW5kcyBvZiBvbmUgbG9naWNhbCBsZXZlbCBzaGFyZSBhbiBpbmRlbnRhdGlvbiwgZWFjaCBuZXN0ZWQgbGV2ZWwgYWRkcyBvbmUsXG4gKiBhbmQgdGhlIGAmJmAgLyBgfHxgIG9wZXJhdG9yIGxlYWRzIHRoZSBsaW5lLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcG9saWN5VG9DZWRhclRleHQocG9saWN5OiBQb2xpY3lKc29uKTogc3RyaW5nIHtcbiAgY29uc3QgaGVhZCA9IGNlZGFyLnBvbGljeVRvVGV4dCh7IC4uLnBvbGljeSwgY29uZGl0aW9uczogW10gfSk7XG4gIGlmIChoZWFkLnR5cGUgPT09ICdmYWlsdXJlJykge1xuICAgIGxvZ2dlci5lcnJvcih7IHBvbGljeSB9LCAnZmFpbGVkIHRvIHRyYW5zZm9ybSBwb2xpY3kgaW50byB0ZXh0Jyk7XG4gICAgdGhyb3cgbmV3IEVycm9yKGhlYWQuZXJyb3JzIGFzIGFueSk7XG4gIH1cbiAgY29uc3QgZm9ybWF0dGVkSGVhZCA9IGNlZGFyLmZvcm1hdFBvbGljaWVzKHtcbiAgICBwb2xpY3lUZXh0OiBoZWFkLnRleHQsXG4gICAgbGluZVdpZHRoOiAxMDAsXG4gICAgaW5kZW50V2lkdGg6IDIsXG4gIH0pO1xuICBpZiAoZm9ybWF0dGVkSGVhZC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoZm9ybWF0dGVkSGVhZCBhcyBhbnkpO1xuICB9XG4gIC8vIGEgcG9saWN5IHdpdGhvdXQgY29uZGl0aW9ucyBpcyBmb3JtYXR0ZWQgYXMgYOKApjtcXG5gXG4gIGNvbnN0IGxpbmVzID0gW2Zvcm1hdHRlZEhlYWQuZm9ybWF0dGVkX3BvbGljeS5zbGljZSgwLCAtMildO1xuICAvLyB0cmFuc2xhdGVUb0NlZGFyIHdyaXRlcyBhdCBtb3N0IG9uZSBgd2hlbmAgY2xhdXNlXG4gIGNvbnN0IFtjb25kaXRpb25dID0gcG9saWN5LmNvbmRpdGlvbnM7XG4gIGlmIChjb25kaXRpb24pIHtcbiAgICBjb25zdCB3aGVuID0gdG9MaW5lcyhjb25kaXRpb24uYm9keSk7XG4gICAgbGluZXMucHVzaChcbiAgICAgIFsnd2hlbiB7JywgLi4ud2hlbi5tYXAoKGxpbmUpID0+IGAgICR7bGluZX1gKSwgJ30nXS5qb2luKCdcXG4nKSxcbiAgICApO1xuICB9XG4gIHJldHVybiBsaW5lcy5qb2luKCdcXG4nKSArICc7Jztcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-to-d9-translations.d.ts

@@ -0,0 +1,12 @@
+import { ConditionSubject } from './cedar-translations';
+import type { Filter } from './d9-permission';
+/** Inverse of `addWhenClauses`: a Cedar Expr tree back into a D9 filter. */
+export declare function exprToFilter(expr?: any, subject?: ConditionSubject): Filter;
+/** Field list from a check-fields policy's `containsAll` clause. */
+export declare function extractFields(expr: any): string[];
+/** Inverse of `refactoPolicies`: expand `action in [...]` into one tuple each. */
+export declare function expandPolicy(policy: any): Array<{
+    collection: string;
+    action: string;
+    conditions: any[];
+}>;

package/lib/cli/commands/cedar/cedar-to-d9-translations.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exprToFilter = exprToFilter;
+exports.extractFields = extractFields;
+exports.expandPolicy = expandPolicy;
+function rightToValue(right) {
+    if (right?.Var === 'principal')
+        return '$CURRENT_USER';
+    if (right?.Value !== undefined)
+        return right.Value;
+    throw new Error(`Unsupported right-hand Cedar expression: ${JSON.stringify(right)}`);
+}
+function pathToFilter(node, subject, leaf) {
+    let acc = leaf;
+    let cur = node;
+    if (subject === 'context.newValue') {
+        while (cur && cur['.']) {
+            const { left, attr } = cur['.'];
+            // Reached the `context.newValue` base: stop without wrapping `newValue`.
+            if (attr === 'newValue' && left?.Var === 'context')
+                return acc;
+            acc = { [attr]: acc };
+            cur = left;
+        }
+        throw new Error(`Unexpected context.newValue base path: ${JSON.stringify(node)}`);
+    }
+    while (cur && cur['.']) {
+        acc = { [cur['.'].attr]: acc };
+        cur = cur['.'].left;
+    }
+    if (!(cur && cur.Var === 'resource')) {
+        throw new Error(`Unexpected resource base path: ${JSON.stringify(node)}`);
+    }
+    return acc;
+}
+function patternToOperation(pattern) {
+    // Cedar splits a `like` pattern into per-character Literal elements.
+    const value = pattern
+        .filter((p) => p !== 'Wildcard')
+        .map((p) => p.Literal)
+        .join('');
+    const startsWildcard = pattern[0] === 'Wildcard';
+    const endsWildcard = pattern[pattern.length - 1] === 'Wildcard';
+    if (startsWildcard && endsWildcard)
+        return { operator: '_contains', value };
+    if (endsWildcard)
+        return { operator: '_starts_with', value };
+    if (startsWildcard)
+        return { operator: '_ends_with', value };
+    throw new Error(`Unsupported like pattern: ${JSON.stringify(pattern)}`);
+}
+const COMPARISON_OPS = {
+    '==': '_eq',
+    '!=': '_neq',
+    '>': '_gt',
+    '>=': '_gte',
+    '<': '_lt',
+    '<=': '_lte',
+};
+/** Inverse of `addWhenClauses`: a Cedar Expr tree back into a D9 filter. */
+function exprToFilter(expr, subject = 'resource') {
+    if (!expr)
+        return {};
+    const key = Object.keys(expr)[0];
+    const node = expr[key];
+    if (key === '&&' || key === '||') {
+        const operator = key === '&&' ? '_and' : '_or';
+        const left = exprToFilter(node.left, subject);
+        const right = exprToFilter(node.right, subject);
+        const operands = [left[operator] ?? left, right[operator] ?? right].flat();
+        return { [operator]: operands };
+    }
+    if (key === 'has') {
+        return pathToFilter(node.left, subject, { [node.attr]: { _nnull: true } });
+    }
+    if (key === '!') {
+        const arg = node.arg;
+        if (arg && arg.has) {
+            return pathToFilter(arg.has.left, subject, {
+                [arg.has.attr]: { _null: true },
+            });
+        }
+        throw new Error(`Unsupported negation expression: ${JSON.stringify(expr)}`);
+    }
+    if (key === 'like') {
+        const { operator, value } = patternToOperation(node.pattern);
+        return pathToFilter(node.left, subject, { [operator]: value });
+    }
+    if (key in COMPARISON_OPS) {
+        return pathToFilter(node.left, subject, {
+            [COMPARISON_OPS[key]]: rightToValue(node.right),
+        });
+    }
+    throw new Error(`Unsupported Cedar expression operator: ${key}`);
+}
+/** Field list from a check-fields policy's `containsAll` clause. */
+function extractFields(expr) {
+    const left = expr?.containsAll?.left;
+    // A literal array is normalized by Cedar into a Set of Value elements.
+    if (Array.isArray(left?.Set))
+        return left.Set.map((e) => e.Value);
+    if (Array.isArray(left?.Value))
+        return left.Value;
+    throw new Error(`Unexpected check-fields policy shape: ${JSON.stringify(expr)}`);
+}
+/** Inverse of `refactoPolicies`: expand `action in [...]` into one tuple each. */
+function expandPolicy(policy) {
+    const action = policy.action;
+    let entities = [];
+    if (action.op === '==') {
+        entities = [action.entity];
+    }
+    else if (action.op === 'in') {
+        // Cedar parses a single-element `action in [X]` as `{ op: 'in', entity }`
+        entities = action.entities ?? [action.entity];
+    }
+    else {
+        // returning no tuple would silently remove the matching rows from the CSV
+        throw new Error(`Unexpected action constraint: ${JSON.stringify(action)}`);
+    }
+    return entities.map((e) => {
+        const ent = e;
+        return {
+            collection: ent.type.replace(/^Db::/, '').replace(/::Action$/, ''),
+            action: ent.id,
+            conditions: policy.conditions ?? [],
+        };
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItdG8tZDktdHJhbnNsYXRpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NsaS9jb21tYW5kcy9jZWRhci9jZWRhci10by1kOS10cmFuc2xhdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFvRUEsb0NBMENDO0FBR0Qsc0NBUUM7QUFHRCxvQ0FzQkM7QUE3SUQsU0FBUyxZQUFZLENBQUMsS0FBVTtJQUM5QixJQUFJLEtBQUssRUFBRSxHQUFHLEtBQUssV0FBVztRQUFFLE9BQU8sZUFBZSxDQUFDO0lBQ3ZELElBQUksS0FBSyxFQUFFLEtBQUssS0FBSyxTQUFTO1FBQUUsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDO0lBQ25ELE1BQU0sSUFBSSxLQUFLLENBQ2IsNENBQTRDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FDcEUsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLFlBQVksQ0FDbkIsSUFBUyxFQUNULE9BQXlCLEVBQ3pCLElBQXlCO0lBRXpCLElBQUksR0FBRyxHQUFRLElBQUksQ0FBQztJQUNwQixJQUFJLEdBQUcsR0FBRyxJQUFJLENBQUM7SUFFZixJQUFJLE9BQU8sS0FBSyxrQkFBa0IsRUFBRSxDQUFDO1FBQ25DLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEdBQUcsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2hDLHlFQUF5RTtZQUN6RSxJQUFJLElBQUksS0FBSyxVQUFVLElBQUksSUFBSSxFQUFFLEdBQUcsS0FBSyxTQUFTO2dCQUFFLE9BQU8sR0FBRyxDQUFDO1lBQy9ELEdBQUcsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUM7WUFDdEIsR0FBRyxHQUFHLElBQUksQ0FBQztRQUNiLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLDBDQUEwQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ2pFLENBQUM7SUFDSixDQUFDO0lBRUQsT0FBTyxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkIsR0FBRyxHQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxFQUFFLENBQUM7UUFDL0IsR0FBRyxHQUFHLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDdEIsQ0FBQztJQUNELElBQUksQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQztBQUVELFNBQVMsa0JBQWtCLENBQUMsT0FBYztJQUN4QyxxRUFBcUU7SUFDckUsTUFBTSxLQUFLLEdBQUcsT0FBTztTQUNsQixNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxVQUFVLENBQUM7U0FDL0IsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDO1NBQ3JCLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNaLE1BQU0sY0FBYyxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxVQUFVLENBQUM7SUFDakQsTUFBTSxZQUFZLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLEtBQUssVUFBVSxDQUFDO0lBQ2hFLElBQUksY0FBYyxJQUFJLFlBQVk7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM1RSxJQUFJLFlBQVk7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM3RCxJQUFJLGNBQWM7UUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUM3RCxNQUFNLElBQUksS0FBSyxDQUFDLDZCQUE2QixJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQsTUFBTSxjQUFjLEdBQTJCO0lBQzdDLElBQUksRUFBRSxLQUFLO0lBQ1gsSUFBSSxFQUFFLE1BQU07SUFDWixHQUFHLEVBQUUsS0FBSztJQUNWLElBQUksRUFBRSxNQUFNO0lBQ1osR0FBRyxFQUFFLEtBQUs7SUFDVixJQUFJLEVBQUUsTUFBTTtDQUNiLENBQUM7QUFFRiw0RUFBNEU7QUFDNUUsU0FBZ0IsWUFBWSxDQUMxQixJQUFVLEVBQ1YsVUFBNEIsVUFBVTtJQUV0QyxJQUFJLENBQUMsSUFBSTtRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ3JCLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFFLENBQUM7SUFDbEMsTUFBTSxJQUFJLEdBQUksSUFBNEIsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUVoRCxJQUFJLEdBQUcsS0FBSyxJQUFJLElBQUksR0FBRyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ2pDLE1BQU0sUUFBUSxHQUFHLEdBQUcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQy9DLE1BQU0sSUFBSSxHQUFHLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBd0IsQ0FBQztRQUNyRSxNQUFNLEtBQUssR0FBRyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQXdCLENBQUM7UUFDdkUsTUFBTSxRQUFRLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksSUFBSSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMzRSxPQUFPLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxRQUFRLEVBQVksQ0FBQztJQUM1QyxDQUFDO0lBRUQsSUFBSSxHQUFHLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDbEIsT0FBTyxZQUFZLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUVELElBQUksR0FBRyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ2hCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDckIsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ25CLE9BQU8sWUFBWSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtnQkFDekMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRTthQUNoQyxDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQ0FBb0MsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUVELElBQUksR0FBRyxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzdELE9BQU8sWUFBWSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFFRCxJQUFJLEdBQUcsSUFBSSxjQUFjLEVBQUUsQ0FBQztRQUMxQixPQUFPLFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRTtZQUN0QyxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUUsQ0FBQyxFQUFFLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDO1NBQ2pELENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0FBQ25FLENBQUM7QUFFRCxvRUFBb0U7QUFDcEUsU0FBZ0IsYUFBYSxDQUFDLElBQVM7SUFDckMsTUFBTSxJQUFJLEdBQUcsSUFBSSxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUM7SUFDckMsdUVBQXVFO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZFLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDO0lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQ2IseUNBQXlDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDaEUsQ0FBQztBQUNKLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsU0FBZ0IsWUFBWSxDQUMxQixNQUFXO0lBRVgsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3QixJQUFJLFFBQVEsR0FBVSxFQUFFLENBQUM7SUFDekIsSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3ZCLFFBQVEsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM3QixDQUFDO1NBQU0sSUFBSSxNQUFNLENBQUMsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQzlCLDBFQUEwRTtRQUMxRSxRQUFRLEdBQUcsTUFBTSxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNoRCxDQUFDO1NBQU0sQ0FBQztRQUNOLDBFQUEwRTtRQUMxRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7UUFDeEIsTUFBTSxHQUFHLEdBQUcsQ0FBYyxDQUFDO1FBQzNCLE9BQU87WUFDTCxVQUFVLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sRUFBRSxHQUFHLENBQUMsRUFBRTtZQUNkLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxJQUFJLEVBQUU7U0FDcEMsQ0FBQztJQUNKLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbmRpdGlvblN1YmplY3QgfSBmcm9tICcuL2NlZGFyLXRyYW5zbGF0aW9ucyc7XG5pbXBvcnQgdHlwZSB7IEZpbHRlciB9IGZyb20gJy4vZDktcGVybWlzc2lvbic7XG5cbnR5cGUgRW50aXR5UmVmID0geyB0eXBlOiBzdHJpbmc7IGlkOiBzdHJpbmcgfTtcblxuZnVuY3Rpb24gcmlnaHRUb1ZhbHVlKHJpZ2h0OiBhbnkpOiBhbnkge1xuICBpZiAocmlnaHQ/LlZhciA9PT0gJ3ByaW5jaXBhbCcpIHJldHVybiAnJENVUlJFTlRfVVNFUic7XG4gIGlmIChyaWdodD8uVmFsdWUgIT09IHVuZGVmaW5lZCkgcmV0dXJuIHJpZ2h0LlZhbHVlO1xuICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgYFVuc3VwcG9ydGVkIHJpZ2h0LWhhbmQgQ2VkYXIgZXhwcmVzc2lvbjogJHtKU09OLnN0cmluZ2lmeShyaWdodCl9YCxcbiAgKTtcbn1cblxuZnVuY3Rpb24gcGF0aFRvRmlsdGVyKFxuICBub2RlOiBhbnksXG4gIHN1YmplY3Q6IENvbmRpdGlvblN1YmplY3QsXG4gIGxlYWY6IFJlY29yZDxzdHJpbmcsIGFueT4sXG4pOiBGaWx0ZXIge1xuICBsZXQgYWNjOiBhbnkgPSBsZWFmO1xuICBsZXQgY3VyID0gbm9kZTtcblxuICBpZiAoc3ViamVjdCA9PT0gJ2NvbnRleHQubmV3VmFsdWUnKSB7XG4gICAgd2hpbGUgKGN1ciAmJiBjdXJbJy4nXSkge1xuICAgICAgY29uc3QgeyBsZWZ0LCBhdHRyIH0gPSBjdXJbJy4nXTtcbiAgICAgIC8vIFJlYWNoZWQgdGhlIGBjb250ZXh0Lm5ld1ZhbHVlYCBiYXNlOiBzdG9wIHdpdGhvdXQgd3JhcHBpbmcgYG5ld1ZhbHVlYC5cbiAgICAgIGlmIChhdHRyID09PSAnbmV3VmFsdWUnICYmIGxlZnQ/LlZhciA9PT0gJ2NvbnRleHQnKSByZXR1cm4gYWNjO1xuICAgICAgYWNjID0geyBbYXR0cl06IGFjYyB9O1xuICAgICAgY3VyID0gbGVmdDtcbiAgICB9XG4gICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgYFVuZXhwZWN0ZWQgY29udGV4dC5uZXdWYWx1ZSBiYXNlIHBhdGg6ICR7SlNPTi5zdHJpbmdpZnkobm9kZSl9YCxcbiAgICApO1xuICB9XG5cbiAgd2hpbGUgKGN1ciAmJiBjdXJbJy4nXSkge1xuICAgIGFjYyA9IHsgW2N1clsnLiddLmF0dHJdOiBhY2MgfTtcbiAgICBjdXIgPSBjdXJbJy4nXS5sZWZ0O1xuICB9XG4gIGlmICghKGN1ciAmJiBjdXIuVmFyID09PSAncmVzb3VyY2UnKSkge1xuICAgIHRocm93IG5ldyBFcnJvcihgVW5leHBlY3RlZCByZXNvdXJjZSBiYXNlIHBhdGg6ICR7SlNPTi5zdHJpbmdpZnkobm9kZSl9YCk7XG4gIH1cbiAgcmV0dXJuIGFjYztcbn1cblxuZnVuY3Rpb24gcGF0dGVyblRvT3BlcmF0aW9uKHBhdHRlcm46IGFueVtdKTogeyBvcGVyYXRvcjogc3RyaW5nOyB2YWx1ZTogYW55IH0ge1xuICAvLyBDZWRhciBzcGxpdHMgYSBgbGlrZWAgcGF0dGVybiBpbnRvIHBlci1jaGFyYWN0ZXIgTGl0ZXJhbCBlbGVtZW50cy5cbiAgY29uc3QgdmFsdWUgPSBwYXR0ZXJuXG4gICAgLmZpbHRlcigocCkgPT4gcCAhPT0gJ1dpbGRjYXJkJylcbiAgICAubWFwKChwKSA9PiBwLkxpdGVyYWwpXG4gICAgLmpvaW4oJycpO1xuICBjb25zdCBzdGFydHNXaWxkY2FyZCA9IHBhdHRlcm5bMF0gPT09ICdXaWxkY2FyZCc7XG4gIGNvbnN0IGVuZHNXaWxkY2FyZCA9IHBhdHRlcm5bcGF0dGVybi5sZW5ndGggLSAxXSA9PT0gJ1dpbGRjYXJkJztcbiAgaWYgKHN0YXJ0c1dpbGRjYXJkICYmIGVuZHNXaWxkY2FyZCkgcmV0dXJuIHsgb3BlcmF0b3I6ICdfY29udGFpbnMnLCB2YWx1ZSB9O1xuICBpZiAoZW5kc1dpbGRjYXJkKSByZXR1cm4geyBvcGVyYXRvcjogJ19zdGFydHNfd2l0aCcsIHZhbHVlIH07XG4gIGlmIChzdGFydHNXaWxkY2FyZCkgcmV0dXJuIHsgb3BlcmF0b3I6ICdfZW5kc193aXRoJywgdmFsdWUgfTtcbiAgdGhyb3cgbmV3IEVycm9yKGBVbnN1cHBvcnRlZCBsaWtlIHBhdHRlcm46ICR7SlNPTi5zdHJpbmdpZnkocGF0dGVybil9YCk7XG59XG5cbmNvbnN0IENPTVBBUklTT05fT1BTOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+ID0ge1xuICAnPT0nOiAnX2VxJyxcbiAgJyE9JzogJ19uZXEnLFxuICAnPic6ICdfZ3QnLFxuICAnPj0nOiAnX2d0ZScsXG4gICc8JzogJ19sdCcsXG4gICc8PSc6ICdfbHRlJyxcbn07XG5cbi8qKiBJbnZlcnNlIG9mIGBhZGRXaGVuQ2xhdXNlc2A6IGEgQ2VkYXIgRXhwciB0cmVlIGJhY2sgaW50byBhIEQ5IGZpbHRlci4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHByVG9GaWx0ZXIoXG4gIGV4cHI/OiBhbnksXG4gIHN1YmplY3Q6IENvbmRpdGlvblN1YmplY3QgPSAncmVzb3VyY2UnLFxuKTogRmlsdGVyIHtcbiAgaWYgKCFleHByKSByZXR1cm4ge307XG4gIGNvbnN0IGtleSA9IE9iamVjdC5rZXlzKGV4cHIpWzBdITtcbiAgY29uc3Qgbm9kZSA9IChleHByIGFzIFJlY29yZDxzdHJpbmcsIGFueT4pW2tleV07XG5cbiAgaWYgKGtleSA9PT0gJyYmJyB8fCBrZXkgPT09ICd8fCcpIHtcbiAgICBjb25zdCBvcGVyYXRvciA9IGtleSA9PT0gJyYmJyA/ICdfYW5kJyA6ICdfb3InO1xuICAgIGNvbnN0IGxlZnQgPSBleHByVG9GaWx0ZXIobm9kZS5sZWZ0LCBzdWJqZWN0KSBhcyBSZWNvcmQ8c3RyaW5nLCBhbnk+O1xuICAgIGNvbnN0IHJpZ2h0ID0gZXhwclRvRmlsdGVyKG5vZGUucmlnaHQsIHN1YmplY3QpIGFzIFJlY29yZDxzdHJpbmcsIGFueT47XG4gICAgY29uc3Qgb3BlcmFuZHMgPSBbbGVmdFtvcGVyYXRvcl0gPz8gbGVmdCwgcmlnaHRbb3BlcmF0b3JdID8/IHJpZ2h0XS5mbGF0KCk7XG4gICAgcmV0dXJuIHsgW29wZXJhdG9yXTogb3BlcmFuZHMgfSBhcyBGaWx0ZXI7XG4gIH1cblxuICBpZiAoa2V5ID09PSAnaGFzJykge1xuICAgIHJldHVybiBwYXRoVG9GaWx0ZXIobm9kZS5sZWZ0LCBzdWJqZWN0LCB7IFtub2RlLmF0dHJdOiB7IF9ubnVsbDogdHJ1ZSB9IH0pO1xuICB9XG5cbiAgaWYgKGtleSA9PT0gJyEnKSB7XG4gICAgY29uc3QgYXJnID0gbm9kZS5hcmc7XG4gICAgaWYgKGFyZyAmJiBhcmcuaGFzKSB7XG4gICAgICByZXR1cm4gcGF0aFRvRmlsdGVyKGFyZy5oYXMubGVmdCwgc3ViamVjdCwge1xuICAgICAgICBbYXJnLmhhcy5hdHRyXTogeyBfbnVsbDogdHJ1ZSB9LFxuICAgICAgfSk7XG4gICAgfVxuICAgIHRocm93IG5ldyBFcnJvcihgVW5zdXBwb3J0ZWQgbmVnYXRpb24gZXhwcmVzc2lvbjogJHtKU09OLnN0cmluZ2lmeShleHByKX1gKTtcbiAgfVxuXG4gIGlmIChrZXkgPT09ICdsaWtlJykge1xuICAgIGNvbnN0IHsgb3BlcmF0b3IsIHZhbHVlIH0gPSBwYXR0ZXJuVG9PcGVyYXRpb24obm9kZS5wYXR0ZXJuKTtcbiAgICByZXR1cm4gcGF0aFRvRmlsdGVyKG5vZGUubGVmdCwgc3ViamVjdCwgeyBbb3BlcmF0b3JdOiB2YWx1ZSB9KTtcbiAgfVxuXG4gIGlmIChrZXkgaW4gQ09NUEFSSVNPTl9PUFMpIHtcbiAgICByZXR1cm4gcGF0aFRvRmlsdGVyKG5vZGUubGVmdCwgc3ViamVjdCwge1xuICAgICAgW0NPTVBBUklTT05fT1BTW2tleV0hXTogcmlnaHRUb1ZhbHVlKG5vZGUucmlnaHQpLFxuICAgIH0pO1xuICB9XG5cbiAgdGhyb3cgbmV3IEVycm9yKGBVbnN1cHBvcnRlZCBDZWRhciBleHByZXNzaW9uIG9wZXJhdG9yOiAke2tleX1gKTtcbn1cblxuLyoqIEZpZWxkIGxpc3QgZnJvbSBhIGNoZWNrLWZpZWxkcyBwb2xpY3kncyBgY29udGFpbnNBbGxgIGNsYXVzZS4gKi9cbmV4cG9ydCBmdW5jdGlvbiBleHRyYWN0RmllbGRzKGV4cHI6IGFueSk6IHN0cmluZ1tdIHtcbiAgY29uc3QgbGVmdCA9IGV4cHI/LmNvbnRhaW5zQWxsPy5sZWZ0O1xuICAvLyBBIGxpdGVyYWwgYXJyYXkgaXMgbm9ybWFsaXplZCBieSBDZWRhciBpbnRvIGEgU2V0IG9mIFZhbHVlIGVsZW1lbnRzLlxuICBpZiAoQXJyYXkuaXNBcnJheShsZWZ0Py5TZXQpKSByZXR1cm4gbGVmdC5TZXQubWFwKChlOiBhbnkpID0+IGUuVmFsdWUpO1xuICBpZiAoQXJyYXkuaXNBcnJheShsZWZ0Py5WYWx1ZSkpIHJldHVybiBsZWZ0LlZhbHVlO1xuICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgYFVuZXhwZWN0ZWQgY2hlY2stZmllbGRzIHBvbGljeSBzaGFwZTogJHtKU09OLnN0cmluZ2lmeShleHByKX1gLFxuICApO1xufVxuXG4vKiogSW52ZXJzZSBvZiBgcmVmYWN0b1BvbGljaWVzYDogZXhwYW5kIGBhY3Rpb24gaW4gWy4uLl1gIGludG8gb25lIHR1cGxlIGVhY2guICovXG5leHBvcnQgZnVuY3Rpb24gZXhwYW5kUG9saWN5KFxuICBwb2xpY3k6IGFueSxcbik6IEFycmF5PHsgY29sbGVjdGlvbjogc3RyaW5nOyBhY3Rpb246IHN0cmluZzsgY29uZGl0aW9uczogYW55W10gfT4ge1xuICBjb25zdCBhY3Rpb24gPSBwb2xpY3kuYWN0aW9uO1xuICBsZXQgZW50aXRpZXM6IGFueVtdID0gW107XG4gIGlmIChhY3Rpb24ub3AgPT09ICc9PScpIHtcbiAgICBlbnRpdGllcyA9IFthY3Rpb24uZW50aXR5XTtcbiAgfSBlbHNlIGlmIChhY3Rpb24ub3AgPT09ICdpbicpIHtcbiAgICAvLyBDZWRhciBwYXJzZXMgYSBzaW5nbGUtZWxlbWVudCBgYWN0aW9uIGluIFtYXWAgYXMgYHsgb3A6ICdpbicsIGVudGl0eSB9YFxuICAgIGVudGl0aWVzID0gYWN0aW9uLmVudGl0aWVzID8/IFthY3Rpb24uZW50aXR5XTtcbiAgfSBlbHNlIHtcbiAgICAvLyByZXR1cm5pbmcgbm8gdHVwbGUgd291bGQgc2lsZW50bHkgcmVtb3ZlIHRoZSBtYXRjaGluZyByb3dzIGZyb20gdGhlIENTVlxuICAgIHRocm93IG5ldyBFcnJvcihgVW5leHBlY3RlZCBhY3Rpb24gY29uc3RyYWludDogJHtKU09OLnN0cmluZ2lmeShhY3Rpb24pfWApO1xuICB9XG4gIHJldHVybiBlbnRpdGllcy5tYXAoKGUpID0+IHtcbiAgICBjb25zdCBlbnQgPSBlIGFzIEVudGl0eVJlZjtcbiAgICByZXR1cm4ge1xuICAgICAgY29sbGVjdGlvbjogZW50LnR5cGUucmVwbGFjZSgvXkRiOjovLCAnJykucmVwbGFjZSgvOjpBY3Rpb24kLywgJycpLFxuICAgICAgYWN0aW9uOiBlbnQuaWQsXG4gICAgICBjb25kaXRpb25zOiBwb2xpY3kuY29uZGl0aW9ucyA/PyBbXSxcbiAgICB9O1xuICB9KTtcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-to-d9.d.ts

@@ -0,0 +1,57 @@
+import { D9Permission } from './d9-permission';
+import { RolesTable } from './roles-table';
+/** Map keyed by a tuple of strings (Map indexes arrays by identity, hence the join). */
+declare class TupleKeyMap<Value> {
+    private readonly createValue?;
+    private readonly entries;
+    /** `createValue` is required to use {@link getOrCreate}; omit it for a plain get/set map. */
+    constructor(createValue?: ((parts: string[]) => Value) | undefined);
+    private keyOf;
+    get(parts: string[]): Value | undefined;
+    set(parts: string[], value: Value): void;
+    delete(parts: string[]): void;
+    /** Return the value for `parts`, creating and storing it via the factory if absent. */
+    getOrCreate(parts: string[]): Value;
+    values(): Value[];
+}
+/**
+ * Reverse of d9-to-cedar: reads the per-role Cedar policy files back into D9
+ * permission rows and merges them into directus_permissions.csv. The original
+ * CSV stays the source of truth for the columns Cedar does not carry (`id`,
+ * `role` UUID, `presets`); only `permissions`/`fields`/`validation` are rewritten.
+ */
+export declare class CedarToD9Manager {
+    permissionPath: string;
+    sqlPath: string;
+    outputPath: string;
+    roles: RolesTable;
+    baseRowsByTuple: TupleKeyMap<Record<string, string>>;
+    header: string[];
+    nextId: number;
+    reconstructed: D9Permission[];
+    constructor(opts?: {
+        permissionPath?: string;
+        sqlPath?: string;
+        outputPath?: string;
+    });
+    readBasePermissionFile(): Promise<void>;
+    readRoleFile(): Promise<void>;
+    /** Read one `.cedar` file into expanded (collection, action, conditions) tuples. */
+    parseCedarFile(filePath: string): Promise<Array<{
+        collection: string;
+        action: string;
+        conditions: any[];
+    }>>;
+    parseRoleFolder(roleName: string): Promise<D9Permission[]>;
+    parseAllFolders(): Promise<void>;
+    mergeIntoRows(): void;
+    writeOutput(): Promise<void>;
+    readCedarAndWriteCsv(): Promise<void>;
+}
+/** CLI action: merge Cedar policies back into directus_permissions.csv. */
+export declare function cedarToD9(options?: {
+    permissionPath?: string;
+    sqlPath?: string;
+    outputPath?: string;
+}): Promise<void>;
+export {};