@wbce/projen-d9 0.0.28 → 0.1.1

package/lib/cli/commands/cedar/cedar-to-d9.js

@@ -0,0 +1,221 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CedarToD9Manager = void 0;
+exports.cedarToD9 = cedarToD9;
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const cedar = require("@cedar-policy/cedar-wasm/nodejs");
+const cedar_to_d9_translations_1 = require("./cedar-to-d9-translations");
+const d9_permission_1 = require("./d9-permission");
+const roles_table_1 = require("./roles-table");
+const logger_1 = require("../../logger");
+const utils_1 = require("../save/utils");
+/** Map keyed by a tuple of strings (Map indexes arrays by identity, hence the join). */
+class TupleKeyMap {
+    /** `createValue` is required to use {@link getOrCreate}; omit it for a plain get/set map. */
+    constructor(createValue) {
+        this.createValue = createValue;
+        this.entries = new Map();
+    }
+    keyOf(parts) {
+        return parts.join(' ');
+    }
+    get(parts) {
+        return this.entries.get(this.keyOf(parts));
+    }
+    set(parts, value) {
+        this.entries.set(this.keyOf(parts), value);
+    }
+    delete(parts) {
+        this.entries.delete(this.keyOf(parts));
+    }
+    /** Return the value for `parts`, creating and storing it via the factory if absent. */
+    getOrCreate(parts) {
+        const key = this.keyOf(parts);
+        let value = this.entries.get(key);
+        if (value === undefined) {
+            if (!this.createValue) {
+                throw new Error('TupleKeyMap.getOrCreate called without a factory');
+            }
+            value = this.createValue(parts);
+            this.entries.set(key, value);
+        }
+        return value;
+    }
+    values() {
+        return [...this.entries.values()];
+    }
+}
+/**
+ * Reverse of d9-to-cedar: reads the per-role Cedar policy files back into D9
+ * permission rows and merges them into directus_permissions.csv. The original
+ * CSV stays the source of truth for the columns Cedar does not carry (`id`,
+ * `role` UUID, `presets`); only `permissions`/`fields`/`validation` are rewritten.
+ */
+class CedarToD9Manager {
+    constructor(opts) {
+        // Rows keyed by (role, collection, action); the map's values (insertion order)
+        // are what gets written back out, so it is the single source of truth for rows.
+        this.baseRowsByTuple = new TupleKeyMap();
+        this.header = [];
+        this.nextId = 0;
+        this.reconstructed = [];
+        this.permissionPath = opts?.permissionPath || './permissions';
+        this.sqlPath = opts?.sqlPath || './sql/data';
+        this.outputPath =
+            opts?.outputPath || `${this.sqlPath}/directus_permissions.csv`;
+    }
+    async readBasePermissionFile() {
+        const filePath = `${this.sqlPath}/directus_permissions.csv`;
+        const rows = await (0, utils_1.readCsvFile)(filePath);
+        const firstLine = await (0, utils_1.readFirstLineOfFile)(filePath);
+        this.header = firstLine.split(',').map((column) => column.trim());
+        for (const row of rows) {
+            this.baseRowsByTuple.set([row.role, row.collection, row.action], row);
+            const id = Number(row.id);
+            if (Number.isFinite(id) && id > this.nextId)
+                this.nextId = id;
+        }
+    }
+    async readRoleFile() {
+        this.roles = await roles_table_1.RolesTable.load(this.sqlPath);
+    }
+    /** Read one `.cedar` file into expanded (collection, action, conditions) tuples. */
+    async parseCedarFile(filePath) {
+        if (!(0, fs_1.existsSync)(filePath)) {
+            return []; // a role may not have every .cedar file (e.g. no validate.cedar)
+        }
+        const text = (await (0, promises_1.readFile)(filePath)).toString();
+        const parts = cedar.policySetTextToParts(text);
+        if (parts.type === 'failure') {
+            logger_1.logger.error(`failed to split policy set ${filePath}`);
+            throw new Error(parts.errors);
+        }
+        const tuples = [];
+        for (const policyText of parts.policies) {
+            const parsed = cedar.policyToJson(policyText);
+            if (parsed.type === 'failure') {
+                logger_1.logger.error({ policyText }, `failed to parse policy in ${filePath}`);
+                throw new Error(parsed.errors);
+            }
+            tuples.push(...(0, cedar_to_d9_translations_1.expandPolicy)(parsed.json));
+        }
+        return tuples;
+    }
+    async parseRoleFolder(roleName) {
+        // A (collection, action) tuple can appear across authorize/check-fields/validate,
+        // so the map creates one permission per tuple and we accumulate clauses onto it.
+        const byTuple = new TupleKeyMap(([collection, action]) => d9_permission_1.D9Permission.empty(roleName, collection, action));
+        const folder = `${this.permissionPath}/${roleName}`;
+        const authorizeTuples = await this.parseCedarFile(`${folder}/authorize.cedar`);
+        for (const tuple of authorizeTuples) {
+            byTuple.getOrCreate([tuple.collection, tuple.action]).permissions =
+                (0, cedar_to_d9_translations_1.exprToFilter)(tuple.conditions[0]?.body, 'resource');
+        }
+        const fieldTuples = await this.parseCedarFile(`${folder}/check-fields.cedar`);
+        for (const tuple of fieldTuples) {
+            if (tuple.conditions.length) {
+                byTuple.getOrCreate([tuple.collection, tuple.action]).fields =
+                    (0, cedar_to_d9_translations_1.extractFields)(tuple.conditions[0].body);
+            }
+        }
+        const validateTuples = await this.parseCedarFile(`${folder}/validate.cedar`);
+        for (const tuple of validateTuples) {
+            if (tuple.conditions.length) {
+                byTuple.getOrCreate([tuple.collection, tuple.action]).validation =
+                    (0, cedar_to_d9_translations_1.exprToFilter)(tuple.conditions[0].body, 'context.newValue');
+            }
+        }
+        return byTuple.values();
+    }
+    async parseAllFolders() {
+        const entries = await (0, promises_1.readdir)(this.permissionPath, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            this.reconstructed.push(...(await this.parseRoleFolder(entry.name)));
+        }
+    }
+    mergeIntoRows() {
+        let merged = 0;
+        let updated = 0;
+        let added = 0;
+        let removed = 0;
+        const seen = new TupleKeyMap();
+        for (const perm of this.reconstructed) {
+            const roleId = this.roles.getIdFromName(perm.roleName);
+            if (!roleId && perm.roleName !== 'Public') {
+                // In V2, instead of throwing an error, we could create a new role in the CSV.
+                // But for now, we expect the roles to be pre-defined in the CSV.
+                // This is a sanity check: the role should exist in the CSV, otherwise something is wrong.
+                throw new Error(`role "${perm.roleName}" (from ${this.permissionPath}) not found in directus_roles.csv`);
+            }
+            seen.set([roleId, perm.collection, perm.action], true);
+            const row = this.baseRowsByTuple.get([roleId, perm.collection, perm.action]);
+            if (!row) {
+                // New tuple added in the Cedar files; the role exists, so create a row.
+                const newRow = {
+                    id: String(++this.nextId),
+                    role: roleId,
+                    collection: perm.collection,
+                    action: perm.action,
+                    permissions: perm.permissionsCell(),
+                    validation: perm.validationCell(),
+                    fields: perm.fieldsCell(),
+                    presets: '',
+                };
+                this.baseRowsByTuple.set([roleId, perm.collection, perm.action], newRow);
+                logger_1.logger.info(`added ${perm.roleName}/${perm.collection}/${perm.action} (id ${newRow.id})`);
+                added++;
+                merged++;
+                continue;
+            }
+            // The Cedar policies are the source of truth: overwrite the three
+            // derivable columns directly (the round-trip is meaning-preserving, so
+            // this only reshapes representation, e.g. `{_and:[x]}` -> `x`).
+            row.permissions = perm.permissionsCell();
+            row.validation = perm.validationCell();
+            row.fields = perm.fieldsCell();
+            updated++;
+            merged++;
+        }
+        // Every row is written to authorize.cedar by d9-to-cedar, so a row no longer
+        // produced by the Cedar files has been removed from them.
+        for (const row of this.baseRowsByTuple.values()) {
+            const tuple = [row.role, row.collection, row.action];
+            if (seen.get(tuple))
+                continue;
+            this.baseRowsByTuple.delete(tuple);
+            const roleName = row.role ? this.roles.getNameFromId(row.role) : 'Public';
+            logger_1.logger.info(`removed ${roleName}/${row.collection}/${row.action} (id ${row.id})`);
+            removed++;
+        }
+        logger_1.logger.info(`merged ${merged} permissions, ${updated} row(s) updated, ${added} new row(s) added, ${removed} row(s) removed`);
+    }
+    async writeOutput() {
+        await (0, utils_1.writeCsvFile)(this.outputPath, this.header, this.baseRowsByTuple.values());
+        logger_1.logger.info(`wrote ${this.outputPath}`);
+    }
+    async readCedarAndWriteCsv() {
+        logger_1.logger.info('reading base permission file');
+        await this.readBasePermissionFile();
+        logger_1.logger.info(`found ${this.baseRowsByTuple.values().length} base permissions`);
+        logger_1.logger.info('reading role file');
+        await this.readRoleFile();
+        logger_1.logger.info('parsing cedar policy folders');
+        await this.parseAllFolders();
+        logger_1.logger.info(`reconstructed ${this.reconstructed.length} permissions from cedar`);
+        logger_1.logger.info('merging into base rows');
+        this.mergeIntoRows();
+        logger_1.logger.info('writing csv');
+        await this.writeOutput();
+        logger_1.logger.info('done');
+    }
+}
+exports.CedarToD9Manager = CedarToD9Manager;
+/** CLI action: merge Cedar policies back into directus_permissions.csv. */
+async function cedarToD9(options) {
+    const manager = new CedarToD9Manager(options);
+    await manager.readCedarAndWriteCsv();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItdG8tZDkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvY2xpL2NvbW1hbmRzL2NlZGFyL2NlZGFyLXRvLWQ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQWdSQSw4QkFPQztBQXZSRCwyQkFBZ0M7QUFDaEMsMENBQWdEO0FBQ2hELHlEQUF5RDtBQUN6RCx5RUFJb0M7QUFDcEMsbURBQStDO0FBQy9DLCtDQUEyQztBQUMzQyx5Q0FBc0M7QUFDdEMseUNBQStFO0FBRS9FLHdGQUF3RjtBQUN4RixNQUFNLFdBQVc7SUFHZiw2RkFBNkY7SUFDN0YsWUFBNkIsV0FBd0M7UUFBeEMsZ0JBQVcsR0FBWCxXQUFXLENBQTZCO1FBSHBELFlBQU8sR0FBRyxJQUFJLEdBQUcsRUFBaUIsQ0FBQztJQUdvQixDQUFDO0lBRWpFLEtBQUssQ0FBQyxLQUFlO1FBQzNCLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUN6QixDQUFDO0lBRU0sR0FBRyxDQUFDLEtBQWU7UUFDeEIsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVNLEdBQUcsQ0FBQyxLQUFlLEVBQUUsS0FBWTtRQUN0QyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQzdDLENBQUM7SUFFTSxNQUFNLENBQUMsS0FBZTtRQUMzQixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVELHVGQUF1RjtJQUNoRixXQUFXLENBQUMsS0FBZTtRQUNoQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLElBQUksS0FBSyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2xDLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7Z0JBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUN0RSxDQUFDO1lBQ0QsS0FBSyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDaEMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9CLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFTSxNQUFNO1FBQ1gsT0FBTyxDQUFDLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7Q0FDRjtBQUVEOzs7OztHQUtHO0FBQ0gsTUFBYSxnQkFBZ0I7SUFhM0IsWUFBWSxJQUlYO1FBWEQsK0VBQStFO1FBQy9FLGdGQUFnRjtRQUN6RSxvQkFBZSxHQUFHLElBQUksV0FBVyxFQUEwQixDQUFDO1FBQzVELFdBQU0sR0FBYSxFQUFFLENBQUM7UUFDdEIsV0FBTSxHQUFHLENBQUMsQ0FBQztRQUNYLGtCQUFhLEdBQW1CLEVBQUUsQ0FBQztRQU94QyxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksRUFBRSxjQUFjLElBQUksZUFBZSxDQUFDO1FBQzlELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxFQUFFLE9BQU8sSUFBSSxZQUFZLENBQUM7UUFDN0MsSUFBSSxDQUFDLFVBQVU7WUFDYixJQUFJLEVBQUUsVUFBVSxJQUFJLEdBQUcsSUFBSSxDQUFDLE9BQU8sMkJBQTJCLENBQUM7SUFDbkUsQ0FBQztJQUVNLEtBQUssQ0FBQyxzQkFBc0I7UUFDakMsTUFBTSxRQUFRLEdBQUcsR0FBRyxJQUFJLENBQUMsT0FBTywyQkFBMkIsQ0FBQztRQUM1RCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUEsbUJBQVcsRUFBQyxRQUFRLENBQUMsQ0FBQztRQUN6QyxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUEsMkJBQW1CLEVBQUMsUUFBUSxDQUFDLENBQUM7UUFDdEQsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFFbEUsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDdEUsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMxQixJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxHQUFHLElBQUksQ0FBQyxNQUFNO2dCQUFFLElBQUksQ0FBQyxNQUFNLEdBQUcsRUFBRSxDQUFDO1FBQ2hFLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLFlBQVk7UUFDdkIsSUFBSSxDQUFDLEtBQUssR0FBRyxNQUFNLHdCQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsb0ZBQW9GO0lBQzdFLEtBQUssQ0FBQyxjQUFjLENBQ3pCLFFBQWdCO1FBRWhCLElBQUksQ0FBQyxJQUFBLGVBQVUsRUFBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sRUFBRSxDQUFDLENBQUMsaUVBQWlFO1FBQzlFLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sSUFBQSxtQkFBUSxFQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDbkQsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxDQUFDO1FBQy9DLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUM3QixlQUFNLENBQUMsS0FBSyxDQUFDLDhCQUE4QixRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQWEsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FJUCxFQUFFLENBQUM7UUFDUixLQUFLLE1BQU0sVUFBVSxJQUFJLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN4QyxNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzlDLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDOUIsZUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLDZCQUE2QixRQUFRLEVBQUUsQ0FBQyxDQUFDO2dCQUN0RSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFhLENBQUMsQ0FBQztZQUN4QyxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUEsdUNBQVksRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVNLEtBQUssQ0FBQyxlQUFlLENBQUMsUUFBZ0I7UUFDM0Msa0ZBQWtGO1FBQ2xGLGlGQUFpRjtRQUNqRixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsQ0FBZSxDQUFDLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FDckUsNEJBQVksQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FDakQsQ0FBQztRQUVGLE1BQU0sTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUVwRCxNQUFNLGVBQWUsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQy9DLEdBQUcsTUFBTSxrQkFBa0IsQ0FDNUIsQ0FBQztRQUNGLEtBQUssTUFBTSxLQUFLLElBQUksZUFBZSxFQUFFLENBQUM7WUFDcEMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsV0FBVztnQkFDL0QsSUFBQSx1Q0FBWSxFQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFFRCxNQUFNLFdBQVcsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxNQUFNLHFCQUFxQixDQUFDLENBQUM7UUFDOUUsS0FBSyxNQUFNLEtBQUssSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzVCLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU07b0JBQzFELElBQUEsd0NBQWEsRUFBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVDLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQyxDQUFDO1FBQzdFLEtBQUssTUFBTSxLQUFLLElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkMsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QixPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxVQUFVO29CQUM5RCxJQUFBLHVDQUFZLEVBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztZQUMvRCxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFTSxLQUFLLENBQUMsZUFBZTtRQUMxQixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUEsa0JBQU8sRUFBQyxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDNUUsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRTtnQkFBRSxTQUFTO1lBQ25DLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2RSxDQUFDO0lBQ0gsQ0FBQztJQUVNLGFBQWE7UUFDbEIsSUFBSSxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQ2YsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBQ2hCLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztRQUNkLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQztRQUNoQixNQUFNLElBQUksR0FBRyxJQUFJLFdBQVcsRUFBUSxDQUFDO1FBRXJDLEtBQUssTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN2RCxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzFDLDhFQUE4RTtnQkFDOUUsaUVBQWlFO2dCQUNqRSwwRkFBMEY7Z0JBQzFGLE1BQU0sSUFBSSxLQUFLLENBQ2IsU0FBUyxJQUFJLENBQUMsUUFBUSxXQUFXLElBQUksQ0FBQyxjQUFjLG1DQUFtQyxDQUN4RixDQUFDO1lBQ0osQ0FBQztZQUVELElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFPLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDeEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFPLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztZQUM5RSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7Z0JBQ1Qsd0VBQXdFO2dCQUN4RSxNQUFNLE1BQU0sR0FBMkI7b0JBQ3JDLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDO29CQUN6QixJQUFJLEVBQUUsTUFBTztvQkFDYixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7b0JBQzNCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtvQkFDbkIsV0FBVyxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUU7b0JBQ25DLFVBQVUsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFO29CQUNqQyxNQUFNLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRTtvQkFDekIsT0FBTyxFQUFFLEVBQUU7aUJBQ1osQ0FBQztnQkFDRixJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU8sRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztnQkFDMUUsZUFBTSxDQUFDLElBQUksQ0FDVCxTQUFTLElBQUksQ0FBQyxRQUFRLElBQUksSUFBSSxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsTUFBTSxRQUFRLE1BQU0sQ0FBQyxFQUFFLEdBQUcsQ0FDN0UsQ0FBQztnQkFDRixLQUFLLEVBQUUsQ0FBQztnQkFDUixNQUFNLEVBQUUsQ0FBQztnQkFDVCxTQUFTO1lBQ1gsQ0FBQztZQUVELGtFQUFrRTtZQUNsRSx1RUFBdUU7WUFDdkUsZ0VBQWdFO1lBQ2hFLEdBQUcsQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQ3pDLEdBQUcsQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3ZDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQy9CLE9BQU8sRUFBRSxDQUFDO1lBQ1YsTUFBTSxFQUFFLENBQUM7UUFDWCxDQUFDO1FBRUQsNkVBQTZFO1FBQzdFLDBEQUEwRDtRQUMxRCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUNoRCxNQUFNLEtBQUssR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDckQsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztnQkFBRSxTQUFTO1lBQzlCLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ25DLE1BQU0sUUFBUSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDO1lBQzFFLGVBQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLElBQUksR0FBRyxDQUFDLFVBQVUsSUFBSSxHQUFHLENBQUMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ2xGLE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztRQUVELGVBQU0sQ0FBQyxJQUFJLENBQ1QsVUFBVSxNQUFNLGlCQUFpQixPQUFPLG9CQUFvQixLQUFLLHNCQUFzQixPQUFPLGlCQUFpQixDQUNoSCxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sSUFBQSxvQkFBWSxFQUNoQixJQUFJLENBQUMsVUFBVSxFQUNmLElBQUksQ0FBQyxNQUFNLEVBQ1gsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FDOUIsQ0FBQztRQUNGLGVBQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLG9CQUFvQjtRQUMvQixlQUFNLENBQUMsSUFBSSxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDNUMsTUFBTSxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztRQUNwQyxlQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxNQUFNLG1CQUFtQixDQUFDLENBQUM7UUFDOUUsZUFBTSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ2pDLE1BQU0sSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQzFCLGVBQU0sQ0FBQyxJQUFJLENBQUMsOEJBQThCLENBQUMsQ0FBQztRQUM1QyxNQUFNLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUM3QixlQUFNLENBQUMsSUFBSSxDQUNULGlCQUFpQixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0seUJBQXlCLENBQ3BFLENBQUM7UUFDRixlQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixDQUFDLENBQUM7UUFDdEMsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLGVBQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0IsTUFBTSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDekIsZUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN0QixDQUFDO0NBRUY7QUFoTkQsNENBZ05DO0FBRUQsMkVBQTJFO0FBQ3BFLEtBQUssVUFBVSxTQUFTLENBQUMsT0FJL0I7SUFDQyxNQUFNLE9BQU8sR0FBRyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzlDLE1BQU0sT0FBTyxDQUFDLG9CQUFvQixFQUFFLENBQUM7QUFDdkMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IGV4aXN0c1N5bmMgfSBmcm9tICdmcyc7XG5pbXBvcnQgeyByZWFkRmlsZSwgcmVhZGRpciB9IGZyb20gJ2ZzL3Byb21pc2VzJztcbmltcG9ydCAqIGFzIGNlZGFyIGZyb20gJ0BjZWRhci1wb2xpY3kvY2VkYXItd2FzbS9ub2RlanMnO1xuaW1wb3J0IHtcbiAgZXhwYW5kUG9saWN5LFxuICBleHByVG9GaWx0ZXIsXG4gIGV4dHJhY3RGaWVsZHMsXG59IGZyb20gJy4vY2VkYXItdG8tZDktdHJhbnNsYXRpb25zJztcbmltcG9ydCB7IEQ5UGVybWlzc2lvbiB9IGZyb20gJy4vZDktcGVybWlzc2lvbic7XG5pbXBvcnQgeyBSb2xlc1RhYmxlIH0gZnJvbSAnLi9yb2xlcy10YWJsZSc7XG5pbXBvcnQgeyBsb2dnZXIgfSBmcm9tICcuLi8uLi9sb2dnZXInO1xuaW1wb3J0IHsgcmVhZENzdkZpbGUsIHJlYWRGaXJzdExpbmVPZkZpbGUsIHdyaXRlQ3N2RmlsZSB9IGZyb20gJy4uL3NhdmUvdXRpbHMnO1xuXG4vKiogTWFwIGtleWVkIGJ5IGEgdHVwbGUgb2Ygc3RyaW5ncyAoTWFwIGluZGV4ZXMgYXJyYXlzIGJ5IGlkZW50aXR5LCBoZW5jZSB0aGUgam9pbikuICovXG5jbGFzcyBUdXBsZUtleU1hcDxWYWx1ZT4ge1xuICBwcml2YXRlIHJlYWRvbmx5IGVudHJpZXMgPSBuZXcgTWFwPHN0cmluZywgVmFsdWU+KCk7XG5cbiAgLyoqIGBjcmVhdGVWYWx1ZWAgaXMgcmVxdWlyZWQgdG8gdXNlIHtAbGluayBnZXRPckNyZWF0ZX07IG9taXQgaXQgZm9yIGEgcGxhaW4gZ2V0L3NldCBtYXAuICovXG4gIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgY3JlYXRlVmFsdWU/OiAocGFydHM6IHN0cmluZ1tdKSA9PiBWYWx1ZSkge31cblxuICBwcml2YXRlIGtleU9mKHBhcnRzOiBzdHJpbmdbXSk6IHN0cmluZyB7XG4gICAgcmV0dXJuIHBhcnRzLmpvaW4oJyAnKTtcbiAgfVxuXG4gIHB1YmxpYyBnZXQocGFydHM6IHN0cmluZ1tdKSB7XG4gICAgcmV0dXJuIHRoaXMuZW50cmllcy5nZXQodGhpcy5rZXlPZihwYXJ0cykpO1xuICB9XG5cbiAgcHVibGljIHNldChwYXJ0czogc3RyaW5nW10sIHZhbHVlOiBWYWx1ZSk6IHZvaWQge1xuICAgIHRoaXMuZW50cmllcy5zZXQodGhpcy5rZXlPZihwYXJ0cyksIHZhbHVlKTtcbiAgfVxuXG4gIHB1YmxpYyBkZWxldGUocGFydHM6IHN0cmluZ1tdKTogdm9pZCB7XG4gICAgdGhpcy5lbnRyaWVzLmRlbGV0ZSh0aGlzLmtleU9mKHBhcnRzKSk7XG4gIH1cblxuICAvKiogUmV0dXJuIHRoZSB2YWx1ZSBmb3IgYHBhcnRzYCwgY3JlYXRpbmcgYW5kIHN0b3JpbmcgaXQgdmlhIHRoZSBmYWN0b3J5IGlmIGFic2VudC4gKi9cbiAgcHVibGljIGdldE9yQ3JlYXRlKHBhcnRzOiBzdHJpbmdbXSk6IFZhbHVlIHtcbiAgICBjb25zdCBrZXkgPSB0aGlzLmtleU9mKHBhcnRzKTtcbiAgICBsZXQgdmFsdWUgPSB0aGlzLmVudHJpZXMuZ2V0KGtleSk7XG4gICAgaWYgKHZhbHVlID09PSB1bmRlZmluZWQpIHtcbiAgICAgIGlmICghdGhpcy5jcmVhdGVWYWx1ZSkge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ1R1cGxlS2V5TWFwLmdldE9yQ3JlYXRlIGNhbGxlZCB3aXRob3V0IGEgZmFjdG9yeScpO1xuICAgICAgfVxuICAgICAgdmFsdWUgPSB0aGlzLmNyZWF0ZVZhbHVlKHBhcnRzKTtcbiAgICAgIHRoaXMuZW50cmllcy5zZXQoa2V5LCB2YWx1ZSk7XG4gICAgfVxuICAgIHJldHVybiB2YWx1ZTtcbiAgfVxuXG4gIHB1YmxpYyB2YWx1ZXMoKTogVmFsdWVbXSB7XG4gICAgcmV0dXJuIFsuLi50aGlzLmVudHJpZXMudmFsdWVzKCldO1xuICB9XG59XG5cbi8qKlxuICogUmV2ZXJzZSBvZiBkOS10by1jZWRhcjogcmVhZHMgdGhlIHBlci1yb2xlIENlZGFyIHBvbGljeSBmaWxlcyBiYWNrIGludG8gRDlcbiAqIHBlcm1pc3Npb24gcm93cyBhbmQgbWVyZ2VzIHRoZW0gaW50byBkaXJlY3R1c19wZXJtaXNzaW9ucy5jc3YuIFRoZSBvcmlnaW5hbFxuICogQ1NWIHN0YXlzIHRoZSBzb3VyY2Ugb2YgdHJ1dGggZm9yIHRoZSBjb2x1bW5zIENlZGFyIGRvZXMgbm90IGNhcnJ5IChgaWRgLFxuICogYHJvbGVgIFVVSUQsIGBwcmVzZXRzYCk7IG9ubHkgYHBlcm1pc3Npb25zYC9gZmllbGRzYC9gdmFsaWRhdGlvbmAgYXJlIHJld3JpdHRlbi5cbiAqL1xuZXhwb3J0IGNsYXNzIENlZGFyVG9EOU1hbmFnZXIge1xuICBwdWJsaWMgcGVybWlzc2lvblBhdGg6IHN0cmluZztcbiAgcHVibGljIHNxbFBhdGg6IHN0cmluZztcbiAgcHVibGljIG91dHB1dFBhdGg6IHN0cmluZztcblxuICBwdWJsaWMgcm9sZXMhOiBSb2xlc1RhYmxlO1xuICAvLyBSb3dzIGtleWVkIGJ5IChyb2xlLCBjb2xsZWN0aW9uLCBhY3Rpb24pOyB0aGUgbWFwJ3MgdmFsdWVzIChpbnNlcnRpb24gb3JkZXIpXG4gIC8vIGFyZSB3aGF0IGdldHMgd3JpdHRlbiBiYWNrIG91dCwgc28gaXQgaXMgdGhlIHNpbmdsZSBzb3VyY2Ugb2YgdHJ1dGggZm9yIHJvd3MuXG4gIHB1YmxpYyBiYXNlUm93c0J5VHVwbGUgPSBuZXcgVHVwbGVLZXlNYXA8UmVjb3JkPHN0cmluZywgc3RyaW5nPj4oKTtcbiAgcHVibGljIGhlYWRlcjogc3RyaW5nW10gPSBbXTtcbiAgcHVibGljIG5leHRJZCA9IDA7XG4gIHB1YmxpYyByZWNvbnN0cnVjdGVkOiBEOVBlcm1pc3Npb25bXSA9IFtdO1xuXG4gIGNvbnN0cnVjdG9yKG9wdHM/OiB7XG4gICAgcGVybWlzc2lvblBhdGg/OiBzdHJpbmc7XG4gICAgc3FsUGF0aD86IHN0cmluZztcbiAgICBvdXRwdXRQYXRoPzogc3RyaW5nO1xuICB9KSB7XG4gICAgdGhpcy5wZXJtaXNzaW9uUGF0aCA9IG9wdHM/LnBlcm1pc3Npb25QYXRoIHx8ICcuL3Blcm1pc3Npb25zJztcbiAgICB0aGlzLnNxbFBhdGggPSBvcHRzPy5zcWxQYXRoIHx8ICcuL3NxbC9kYXRhJztcbiAgICB0aGlzLm91dHB1dFBhdGggPVxuICAgICAgb3B0cz8ub3V0cHV0UGF0aCB8fCBgJHt0aGlzLnNxbFBhdGh9L2RpcmVjdHVzX3Blcm1pc3Npb25zLmNzdmA7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcmVhZEJhc2VQZXJtaXNzaW9uRmlsZSgpIHtcbiAgICBjb25zdCBmaWxlUGF0aCA9IGAke3RoaXMuc3FsUGF0aH0vZGlyZWN0dXNfcGVybWlzc2lvbnMuY3N2YDtcbiAgICBjb25zdCByb3dzID0gYXdhaXQgcmVhZENzdkZpbGUoZmlsZVBhdGgpO1xuICAgIGNvbnN0IGZpcnN0TGluZSA9IGF3YWl0IHJlYWRGaXJzdExpbmVPZkZpbGUoZmlsZVBhdGgpO1xuICAgIHRoaXMuaGVhZGVyID0gZmlyc3RMaW5lLnNwbGl0KCcsJykubWFwKChjb2x1bW4pID0+IGNvbHVtbi50cmltKCkpO1xuXG4gICAgZm9yIChjb25zdCByb3cgb2Ygcm93cykge1xuICAgICAgdGhpcy5iYXNlUm93c0J5VHVwbGUuc2V0KFtyb3cucm9sZSwgcm93LmNvbGxlY3Rpb24sIHJvdy5hY3Rpb25dLCByb3cpO1xuICAgICAgY29uc3QgaWQgPSBOdW1iZXIocm93LmlkKTtcbiAgICAgIGlmIChOdW1iZXIuaXNGaW5pdGUoaWQpICYmIGlkID4gdGhpcy5uZXh0SWQpIHRoaXMubmV4dElkID0gaWQ7XG4gICAgfVxuICB9XG5cbiAgcHVibGljIGFzeW5jIHJlYWRSb2xlRmlsZSgpIHtcbiAgICB0aGlzLnJvbGVzID0gYXdhaXQgUm9sZXNUYWJsZS5sb2FkKHRoaXMuc3FsUGF0aCk7XG4gIH1cblxuICAvKiogUmVhZCBvbmUgYC5jZWRhcmAgZmlsZSBpbnRvIGV4cGFuZGVkIChjb2xsZWN0aW9uLCBhY3Rpb24sIGNvbmRpdGlvbnMpIHR1cGxlcy4gKi9cbiAgcHVibGljIGFzeW5jIHBhcnNlQ2VkYXJGaWxlKFxuICAgIGZpbGVQYXRoOiBzdHJpbmcsXG4gICk6IFByb21pc2U8QXJyYXk8eyBjb2xsZWN0aW9uOiBzdHJpbmc7IGFjdGlvbjogc3RyaW5nOyBjb25kaXRpb25zOiBhbnlbXSB9Pj4ge1xuICAgIGlmICghZXhpc3RzU3luYyhmaWxlUGF0aCkpIHtcbiAgICAgIHJldHVybiBbXTsgLy8gYSByb2xlIG1heSBub3QgaGF2ZSBldmVyeSAuY2VkYXIgZmlsZSAoZS5nLiBubyB2YWxpZGF0ZS5jZWRhcilcbiAgICB9XG4gICAgY29uc3QgdGV4dCA9IChhd2FpdCByZWFkRmlsZShmaWxlUGF0aCkpLnRvU3RyaW5nKCk7XG4gICAgY29uc3QgcGFydHMgPSBjZWRhci5wb2xpY3lTZXRUZXh0VG9QYXJ0cyh0ZXh0KTtcbiAgICBpZiAocGFydHMudHlwZSA9PT0gJ2ZhaWx1cmUnKSB7XG4gICAgICBsb2dnZXIuZXJyb3IoYGZhaWxlZCB0byBzcGxpdCBwb2xpY3kgc2V0ICR7ZmlsZVBhdGh9YCk7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IocGFydHMuZXJyb3JzIGFzIGFueSk7XG4gICAgfVxuICAgIGNvbnN0IHR1cGxlczogQXJyYXk8e1xuICAgICAgY29sbGVjdGlvbjogc3RyaW5nO1xuICAgICAgYWN0aW9uOiBzdHJpbmc7XG4gICAgICBjb25kaXRpb25zOiBhbnlbXTtcbiAgICB9PiA9IFtdO1xuICAgIGZvciAoY29uc3QgcG9saWN5VGV4dCBvZiBwYXJ0cy5wb2xpY2llcykge1xuICAgICAgY29uc3QgcGFyc2VkID0gY2VkYXIucG9saWN5VG9Kc29uKHBvbGljeVRleHQpO1xuICAgICAgaWYgKHBhcnNlZC50eXBlID09PSAnZmFpbHVyZScpIHtcbiAgICAgICAgbG9nZ2VyLmVycm9yKHsgcG9saWN5VGV4dCB9LCBgZmFpbGVkIHRvIHBhcnNlIHBvbGljeSBpbiAke2ZpbGVQYXRofWApO1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IocGFyc2VkLmVycm9ycyBhcyBhbnkpO1xuICAgICAgfVxuICAgICAgdHVwbGVzLnB1c2goLi4uZXhwYW5kUG9saWN5KHBhcnNlZC5qc29uKSk7XG4gICAgfVxuICAgIHJldHVybiB0dXBsZXM7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcGFyc2VSb2xlRm9sZGVyKHJvbGVOYW1lOiBzdHJpbmcpOiBQcm9taXNlPEQ5UGVybWlzc2lvbltdPiB7XG4gICAgLy8gQSAoY29sbGVjdGlvbiwgYWN0aW9uKSB0dXBsZSBjYW4gYXBwZWFyIGFjcm9zcyBhdXRob3JpemUvY2hlY2stZmllbGRzL3ZhbGlkYXRlLFxuICAgIC8vIHNvIHRoZSBtYXAgY3JlYXRlcyBvbmUgcGVybWlzc2lvbiBwZXIgdHVwbGUgYW5kIHdlIGFjY3VtdWxhdGUgY2xhdXNlcyBvbnRvIGl0LlxuICAgIGNvbnN0IGJ5VHVwbGUgPSBuZXcgVHVwbGVLZXlNYXA8RDlQZXJtaXNzaW9uPigoW2NvbGxlY3Rpb24sIGFjdGlvbl0pID0+XG4gICAgICBEOVBlcm1pc3Npb24uZW1wdHkocm9sZU5hbWUsIGNvbGxlY3Rpb24sIGFjdGlvbiksXG4gICAgKTtcblxuICAgIGNvbnN0IGZvbGRlciA9IGAke3RoaXMucGVybWlzc2lvblBhdGh9LyR7cm9sZU5hbWV9YDtcblxuICAgIGNvbnN0IGF1dGhvcml6ZVR1cGxlcyA9IGF3YWl0IHRoaXMucGFyc2VDZWRhckZpbGUoXG4gICAgICBgJHtmb2xkZXJ9L2F1dGhvcml6ZS5jZWRhcmAsXG4gICAgKTtcbiAgICBmb3IgKGNvbnN0IHR1cGxlIG9mIGF1dGhvcml6ZVR1cGxlcykge1xuICAgICAgYnlUdXBsZS5nZXRPckNyZWF0ZShbdHVwbGUuY29sbGVjdGlvbiwgdHVwbGUuYWN0aW9uXSkucGVybWlzc2lvbnMgPVxuICAgICAgICBleHByVG9GaWx0ZXIodHVwbGUuY29uZGl0aW9uc1swXT8uYm9keSwgJ3Jlc291cmNlJyk7XG4gICAgfVxuXG4gICAgY29uc3QgZmllbGRUdXBsZXMgPSBhd2FpdCB0aGlzLnBhcnNlQ2VkYXJGaWxlKGAke2ZvbGRlcn0vY2hlY2stZmllbGRzLmNlZGFyYCk7XG4gICAgZm9yIChjb25zdCB0dXBsZSBvZiBmaWVsZFR1cGxlcykge1xuICAgICAgaWYgKHR1cGxlLmNvbmRpdGlvbnMubGVuZ3RoKSB7XG4gICAgICAgIGJ5VHVwbGUuZ2V0T3JDcmVhdGUoW3R1cGxlLmNvbGxlY3Rpb24sIHR1cGxlLmFjdGlvbl0pLmZpZWxkcyA9XG4gICAgICAgICAgZXh0cmFjdEZpZWxkcyh0dXBsZS5jb25kaXRpb25zWzBdLmJvZHkpO1xuICAgICAgfVxuICAgIH1cblxuICAgIGNvbnN0IHZhbGlkYXRlVHVwbGVzID0gYXdhaXQgdGhpcy5wYXJzZUNlZGFyRmlsZShgJHtmb2xkZXJ9L3ZhbGlkYXRlLmNlZGFyYCk7XG4gICAgZm9yIChjb25zdCB0dXBsZSBvZiB2YWxpZGF0ZVR1cGxlcykge1xuICAgICAgaWYgKHR1cGxlLmNvbmRpdGlvbnMubGVuZ3RoKSB7XG4gICAgICAgIGJ5VHVwbGUuZ2V0T3JDcmVhdGUoW3R1cGxlLmNvbGxlY3Rpb24sIHR1cGxlLmFjdGlvbl0pLnZhbGlkYXRpb24gPVxuICAgICAgICAgIGV4cHJUb0ZpbHRlcih0dXBsZS5jb25kaXRpb25zWzBdLmJvZHksICdjb250ZXh0Lm5ld1ZhbHVlJyk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgcmV0dXJuIGJ5VHVwbGUudmFsdWVzKCk7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcGFyc2VBbGxGb2xkZXJzKCkge1xuICAgIGNvbnN0IGVudHJpZXMgPSBhd2FpdCByZWFkZGlyKHRoaXMucGVybWlzc2lvblBhdGgsIHsgd2l0aEZpbGVUeXBlczogdHJ1ZSB9KTtcbiAgICBmb3IgKGNvbnN0IGVudHJ5IG9mIGVudHJpZXMpIHtcbiAgICAgIGlmICghZW50cnkuaXNEaXJlY3RvcnkoKSkgY29udGludWU7XG4gICAgICB0aGlzLnJlY29uc3RydWN0ZWQucHVzaCguLi4oYXdhaXQgdGhpcy5wYXJzZVJvbGVGb2xkZXIoZW50cnkubmFtZSkpKTtcbiAgICB9XG4gIH1cblxuICBwdWJsaWMgbWVyZ2VJbnRvUm93cygpIHtcbiAgICBsZXQgbWVyZ2VkID0gMDtcbiAgICBsZXQgdXBkYXRlZCA9IDA7XG4gICAgbGV0IGFkZGVkID0gMDtcbiAgICBsZXQgcmVtb3ZlZCA9IDA7XG4gICAgY29uc3Qgc2VlbiA9IG5ldyBUdXBsZUtleU1hcDx0cnVlPigpO1xuXG4gICAgZm9yIChjb25zdCBwZXJtIG9mIHRoaXMucmVjb25zdHJ1Y3RlZCkge1xuICAgICAgY29uc3Qgcm9sZUlkID0gdGhpcy5yb2xlcy5nZXRJZEZyb21OYW1lKHBlcm0ucm9sZU5hbWUpO1xuICAgICAgaWYgKCFyb2xlSWQgJiYgcGVybS5yb2xlTmFtZSAhPT0gJ1B1YmxpYycpIHtcbiAgICAgICAgLy8gSW4gVjIsIGluc3RlYWQgb2YgdGhyb3dpbmcgYW4gZXJyb3IsIHdlIGNvdWxkIGNyZWF0ZSBhIG5ldyByb2xlIGluIHRoZSBDU1YuXG4gICAgICAgIC8vIEJ1dCBmb3Igbm93LCB3ZSBleHBlY3QgdGhlIHJvbGVzIHRvIGJlIHByZS1kZWZpbmVkIGluIHRoZSBDU1YuXG4gICAgICAgIC8vIFRoaXMgaXMgYSBzYW5pdHkgY2hlY2s6IHRoZSByb2xlIHNob3VsZCBleGlzdCBpbiB0aGUgQ1NWLCBvdGhlcndpc2Ugc29tZXRoaW5nIGlzIHdyb25nLlxuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgYHJvbGUgXCIke3Blcm0ucm9sZU5hbWV9XCIgKGZyb20gJHt0aGlzLnBlcm1pc3Npb25QYXRofSkgbm90IGZvdW5kIGluIGRpcmVjdHVzX3JvbGVzLmNzdmAsXG4gICAgICAgICk7XG4gICAgICB9XG5cbiAgICAgIHNlZW4uc2V0KFtyb2xlSWQhLCBwZXJtLmNvbGxlY3Rpb24sIHBlcm0uYWN0aW9uXSwgdHJ1ZSk7XG4gICAgICBjb25zdCByb3cgPSB0aGlzLmJhc2VSb3dzQnlUdXBsZS5nZXQoW3JvbGVJZCEsIHBlcm0uY29sbGVjdGlvbiwgcGVybS5hY3Rpb25dKTtcbiAgICAgIGlmICghcm93KSB7XG4gICAgICAgIC8vIE5ldyB0dXBsZSBhZGRlZCBpbiB0aGUgQ2VkYXIgZmlsZXM7IHRoZSByb2xlIGV4aXN0cywgc28gY3JlYXRlIGEgcm93LlxuICAgICAgICBjb25zdCBuZXdSb3c6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7XG4gICAgICAgICAgaWQ6IFN0cmluZygrK3RoaXMubmV4dElkKSxcbiAgICAgICAgICByb2xlOiByb2xlSWQhLFxuICAgICAgICAgIGNvbGxlY3Rpb246IHBlcm0uY29sbGVjdGlvbixcbiAgICAgICAgICBhY3Rpb246IHBlcm0uYWN0aW9uLFxuICAgICAgICAgIHBlcm1pc3Npb25zOiBwZXJtLnBlcm1pc3Npb25zQ2VsbCgpLFxuICAgICAgICAgIHZhbGlkYXRpb246IHBlcm0udmFsaWRhdGlvbkNlbGwoKSxcbiAgICAgICAgICBmaWVsZHM6IHBlcm0uZmllbGRzQ2VsbCgpLFxuICAgICAgICAgIHByZXNldHM6ICcnLFxuICAgICAgICB9O1xuICAgICAgICB0aGlzLmJhc2VSb3dzQnlUdXBsZS5zZXQoW3JvbGVJZCEsIHBlcm0uY29sbGVjdGlvbiwgcGVybS5hY3Rpb25dLCBuZXdSb3cpO1xuICAgICAgICBsb2dnZXIuaW5mbyhcbiAgICAgICAgICBgYWRkZWQgJHtwZXJtLnJvbGVOYW1lfS8ke3Blcm0uY29sbGVjdGlvbn0vJHtwZXJtLmFjdGlvbn0gKGlkICR7bmV3Um93LmlkfSlgLFxuICAgICAgICApO1xuICAgICAgICBhZGRlZCsrO1xuICAgICAgICBtZXJnZWQrKztcbiAgICAgICAgY29udGludWU7XG4gICAgICB9XG5cbiAgICAgIC8vIFRoZSBDZWRhciBwb2xpY2llcyBhcmUgdGhlIHNvdXJjZSBvZiB0cnV0aDogb3ZlcndyaXRlIHRoZSB0aHJlZVxuICAgICAgLy8gZGVyaXZhYmxlIGNvbHVtbnMgZGlyZWN0bHkgKHRoZSByb3VuZC10cmlwIGlzIG1lYW5pbmctcHJlc2VydmluZywgc29cbiAgICAgIC8vIHRoaXMgb25seSByZXNoYXBlcyByZXByZXNlbnRhdGlvbiwgZS5nLiBge19hbmQ6W3hdfWAgLT4gYHhgKS5cbiAgICAgIHJvdy5wZXJtaXNzaW9ucyA9IHBlcm0ucGVybWlzc2lvbnNDZWxsKCk7XG4gICAgICByb3cudmFsaWRhdGlvbiA9IHBlcm0udmFsaWRhdGlvbkNlbGwoKTtcbiAgICAgIHJvdy5maWVsZHMgPSBwZXJtLmZpZWxkc0NlbGwoKTtcbiAgICAgIHVwZGF0ZWQrKztcbiAgICAgIG1lcmdlZCsrO1xuICAgIH1cblxuICAgIC8vIEV2ZXJ5IHJvdyBpcyB3cml0dGVuIHRvIGF1dGhvcml6ZS5jZWRhciBieSBkOS10by1jZWRhciwgc28gYSByb3cgbm8gbG9uZ2VyXG4gICAgLy8gcHJvZHVjZWQgYnkgdGhlIENlZGFyIGZpbGVzIGhhcyBiZWVuIHJlbW92ZWQgZnJvbSB0aGVtLlxuICAgIGZvciAoY29uc3Qgcm93IG9mIHRoaXMuYmFzZVJvd3NCeVR1cGxlLnZhbHVlcygpKSB7XG4gICAgICBjb25zdCB0dXBsZSA9IFtyb3cucm9sZSwgcm93LmNvbGxlY3Rpb24sIHJvdy5hY3Rpb25dO1xuICAgICAgaWYgKHNlZW4uZ2V0KHR1cGxlKSkgY29udGludWU7XG4gICAgICB0aGlzLmJhc2VSb3dzQnlUdXBsZS5kZWxldGUodHVwbGUpO1xuICAgICAgY29uc3Qgcm9sZU5hbWUgPSByb3cucm9sZSA/IHRoaXMucm9sZXMuZ2V0TmFtZUZyb21JZChyb3cucm9sZSkgOiAnUHVibGljJztcbiAgICAgIGxvZ2dlci5pbmZvKGByZW1vdmVkICR7cm9sZU5hbWV9LyR7cm93LmNvbGxlY3Rpb259LyR7cm93LmFjdGlvbn0gKGlkICR7cm93LmlkfSlgKTtcbiAgICAgIHJlbW92ZWQrKztcbiAgICB9XG5cbiAgICBsb2dnZXIuaW5mbyhcbiAgICAgIGBtZXJnZWQgJHttZXJnZWR9IHBlcm1pc3Npb25zLCAke3VwZGF0ZWR9IHJvdyhzKSB1cGRhdGVkLCAke2FkZGVkfSBuZXcgcm93KHMpIGFkZGVkLCAke3JlbW92ZWR9IHJvdyhzKSByZW1vdmVkYCxcbiAgICApO1xuICB9XG5cbiAgcHVibGljIGFzeW5jIHdyaXRlT3V0cHV0KCkge1xuICAgIGF3YWl0IHdyaXRlQ3N2RmlsZShcbiAgICAgIHRoaXMub3V0cHV0UGF0aCxcbiAgICAgIHRoaXMuaGVhZGVyLFxuICAgICAgdGhpcy5iYXNlUm93c0J5VHVwbGUudmFsdWVzKCksXG4gICAgKTtcbiAgICBsb2dnZXIuaW5mbyhgd3JvdGUgJHt0aGlzLm91dHB1dFBhdGh9YCk7XG4gIH1cblxuICBwdWJsaWMgYXN5bmMgcmVhZENlZGFyQW5kV3JpdGVDc3YoKSB7XG4gICAgbG9nZ2VyLmluZm8oJ3JlYWRpbmcgYmFzZSBwZXJtaXNzaW9uIGZpbGUnKTtcbiAgICBhd2FpdCB0aGlzLnJlYWRCYXNlUGVybWlzc2lvbkZpbGUoKTtcbiAgICBsb2dnZXIuaW5mbyhgZm91bmQgJHt0aGlzLmJhc2VSb3dzQnlUdXBsZS52YWx1ZXMoKS5sZW5ndGh9IGJhc2UgcGVybWlzc2lvbnNgKTtcbiAgICBsb2dnZXIuaW5mbygncmVhZGluZyByb2xlIGZpbGUnKTtcbiAgICBhd2FpdCB0aGlzLnJlYWRSb2xlRmlsZSgpO1xuICAgIGxvZ2dlci5pbmZvKCdwYXJzaW5nIGNlZGFyIHBvbGljeSBmb2xkZXJzJyk7XG4gICAgYXdhaXQgdGhpcy5wYXJzZUFsbEZvbGRlcnMoKTtcbiAgICBsb2dnZXIuaW5mbyhcbiAgICAgIGByZWNvbnN0cnVjdGVkICR7dGhpcy5yZWNvbnN0cnVjdGVkLmxlbmd0aH0gcGVybWlzc2lvbnMgZnJvbSBjZWRhcmAsXG4gICAgKTtcbiAgICBsb2dnZXIuaW5mbygnbWVyZ2luZyBpbnRvIGJhc2Ugcm93cycpO1xuICAgIHRoaXMubWVyZ2VJbnRvUm93cygpO1xuICAgIGxvZ2dlci5pbmZvKCd3cml0aW5nIGNzdicpO1xuICAgIGF3YWl0IHRoaXMud3JpdGVPdXRwdXQoKTtcbiAgICBsb2dnZXIuaW5mbygnZG9uZScpO1xuICB9XG5cbn1cblxuLyoqIENMSSBhY3Rpb246IG1lcmdlIENlZGFyIHBvbGljaWVzIGJhY2sgaW50byBkaXJlY3R1c19wZXJtaXNzaW9ucy5jc3YuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gY2VkYXJUb0Q5KG9wdGlvbnM/OiB7XG4gIHBlcm1pc3Npb25QYXRoPzogc3RyaW5nO1xuICBzcWxQYXRoPzogc3RyaW5nO1xuICBvdXRwdXRQYXRoPzogc3RyaW5nO1xufSk6IFByb21pc2U8dm9pZD4ge1xuICBjb25zdCBtYW5hZ2VyID0gbmV3IENlZGFyVG9EOU1hbmFnZXIob3B0aW9ucyk7XG4gIGF3YWl0IG1hbmFnZXIucmVhZENlZGFyQW5kV3JpdGVDc3YoKTtcbn1cbiJdfQ==

package/lib/cli/commands/cedar/cedar-translations.d.ts

@@ -0,0 +1,9 @@
+import type { PolicyJson } from '@cedar-policy/cedar-wasm/nodejs';
+import { D9Permission, Filter } from './d9-permission';
+export type ConditionSubject = 'resource' | 'context.newValue';
+export declare function addWhenClauses(filter: Filter, subject?: ConditionSubject): any;
+export declare function translateToCedar(permission: D9Permission): {
+    mainPolicy: PolicyJson;
+    fieldPolicy?: PolicyJson;
+    validationPolicy?: PolicyJson;
+};

package/lib/cli/commands/cedar/cedar-translations.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addWhenClauses = addWhenClauses;
+exports.translateToCedar = translateToCedar;
+/** Local stand-in for lodash's `isPlainObject`, which this package does not depend on. */
+function isPlainObject(value) {
+    if (Object.prototype.toString.call(value) !== '[object Object]')
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === null || proto === Object.prototype;
+}
+function getOperation(key, value) {
+    if (key.startsWith('_') && !['_and', '_or', '_none', '_some'].includes(key)) {
+        return { operator: key, value };
+    }
+    else if (isPlainObject(value) === false) {
+        return { operator: '_eq', value };
+    }
+    return getOperation(Object.keys(value)[0], Object.values(value)[0]);
+}
+function getFilterPath(key, value) {
+    const path = [key];
+    const childKey = Object.keys(value)[0];
+    if (typeof childKey === 'string' &&
+        childKey.startsWith('_') === true &&
+        !['_none', '_some'].includes(childKey)) {
+        return path;
+    }
+    if (isPlainObject(value)) {
+        path.push(...getFilterPath(childKey, Object.values(value)[0]));
+    }
+    return path;
+}
+function addWhenClauses(filter, subject = 'resource') {
+    const entries = Object.entries(filter);
+    if (!entries.length)
+        return;
+    const key = entries[0][0];
+    const value = entries[0][1];
+    if (key === '_or' || key === '_and') {
+        if (key === '_or' &&
+            value.some((subFilter) => Object.keys(subFilter).length === 0)) {
+            return;
+        }
+        const left = value[0];
+        const rightVal = value[1];
+        const operator = key === '_or' ? '||' : '&&';
+        if (rightVal) {
+            return {
+                [operator]: {
+                    left: addWhenClauses(left, subject),
+                    right: addWhenClauses({ [key]: value.slice(1) }, subject),
+                },
+            };
+        }
+        else {
+            return addWhenClauses(left, subject);
+        }
+    }
+    const filterPath = getFilterPath(key, value);
+    const { operator: filterOperator, value: filterValue } = getOperation(key, value);
+    if (entries.length > 1) {
+        delete filter[key];
+        return {
+            '&&': {
+                left: applyFilterToQuery(filterPath, filterOperator, filterValue, subject),
+                right: addWhenClauses(filter, subject),
+            },
+        };
+    }
+    else {
+        return applyFilterToQuery(filterPath, filterOperator, filterValue, subject);
+    }
+    function applyFilterToQuery(path, operator, compareValue, subjectVar = 'resource') {
+        function buildLeft(pathSegments, subj) {
+            let node = subj === 'context.newValue'
+                ? { '.': { left: { Var: 'context' }, attr: 'newValue' } }
+                : { Var: 'resource' };
+            for (const attr of pathSegments) {
+                node = { '.': { left: node, attr } };
+            }
+            return node;
+        }
+        const buildRight = (v) => v === '$CURRENT_USER' ? { Var: 'principal' } : { Value: v };
+        const left = buildLeft(path, subjectVar);
+        const right = buildRight(compareValue);
+        let expr = null;
+        const baseForParent = path.length <= 1
+            ? subjectVar === 'context.newValue'
+                ? { '.': { left: { Var: 'context' }, attr: 'newValue' } }
+                : { Var: 'resource' }
+            : buildLeft(path.slice(0, -1), subjectVar);
+        if (operator === '_null' ||
+            (operator === '_nnull' && compareValue === false)) {
+            expr = {
+                '!': {
+                    arg: { has: { left: baseForParent, attr: path[path.length - 1] } },
+                },
+            };
+        }
+        if (operator === '_nnull' ||
+            (operator === '_null' && compareValue === false)) {
+            expr = { has: { left: baseForParent, attr: path[path.length - 1] } };
+        }
+        if (compareValue !== undefined && expr === null) {
+            if (operator === '_eq')
+                expr = { '==': { left, right } };
+            if (operator === '_neq')
+                expr = { '!=': { left, right } };
+            if (operator === '_gt')
+                expr = { '>': { left, right } };
+            if (operator === '_gte')
+                expr = { '>=': { left, right } };
+            if (operator === '_lt')
+                expr = { '<': { left, right } };
+            if (operator === '_lte')
+                expr = { '<=': { left, right } };
+            if (operator === '_icontains') {
+                // Cedar has no case-insensitive matching. Normalize the stored data and use
+                // _contains — https://docs.cedarpolicy.com/bestpractices/bp-normalize-data-input.html
+                throw new Error('_icontains is not supported in Cedar policies: normalize the data (e.g. lowercase) and use _contains instead');
+            }
+            if (operator === '_contains') {
+                expr = {
+                    like: {
+                        left,
+                        pattern: ['Wildcard', { Literal: compareValue }, 'Wildcard'],
+                    },
+                };
+            }
+            if (operator === '_starts_with') {
+                expr = { like: { left, pattern: [{ Literal: compareValue }, 'Wildcard'] } };
+            }
+            if (operator === '_ends_with') {
+                expr = { like: { left, pattern: ['Wildcard', { Literal: compareValue }] } };
+            }
+        }
+        if (expr === null)
+            return;
+        return expr;
+    }
+}
+function translateToCedar(permission) {
+    const principalConstraint = {
+        op: 'in',
+        entity: {
+            type: 'd9::UserGroup',
+            id: permission.roleName,
+        },
+    };
+    const action = {
+        op: '==',
+        entity: {
+            type: `Db::${permission.collection}::Action`,
+            id: permission.action,
+        },
+    };
+    const mainConditionBody = addWhenClauses(permission.permissions || {});
+    const mainConditions = mainConditionBody
+        ? [{ kind: 'when', body: mainConditionBody }]
+        : [];
+    const mainPolicy = {
+        effect: 'permit',
+        principal: principalConstraint,
+        action: action,
+        resource: { op: 'All' },
+        conditions: mainConditions,
+    };
+    // Field-level policy only when there is a fields restriction and/or validation
+    const fields = permission.fields ?? [];
+    const hasFields = fields.length > 0;
+    const hasValidationCond = permission.validation && Object.entries(permission.validation).length > 0;
+    let fieldPolicy;
+    let validationPolicy;
+    if (hasFields) {
+        const fieldConditions = [];
+        fieldConditions.push({
+            kind: 'when',
+            body: {
+                containsAll: {
+                    left: { Value: fields },
+                    right: {
+                        '.': {
+                            left: { Var: 'context' },
+                            attr: 'requestedFields',
+                        },
+                    },
+                },
+            },
+        });
+        fieldPolicy = {
+            effect: 'permit',
+            principal: principalConstraint,
+            action: action,
+            resource: { op: 'All' },
+            conditions: fieldConditions,
+        };
+    }
+    if (hasValidationCond) {
+        const validationConditions = [];
+        const validationBody = addWhenClauses(permission.validation || {}, 'context.newValue');
+        validationConditions.push({ kind: 'when', body: validationBody });
+        validationPolicy = {
+            effect: 'permit',
+            principal: principalConstraint,
+            action: action,
+            resource: { op: 'All' },
+            conditions: validationConditions,
+        };
+    }
+    return { mainPolicy, fieldPolicy, validationPolicy };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VkYXItdHJhbnNsYXRpb25zLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NsaS9jb21tYW5kcy9jZWRhci9jZWRhci10cmFuc2xhdGlvbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUE0Q0Esd0NBcUlDO0FBRUQsNENBd0ZDO0FBeFFELDBGQUEwRjtBQUMxRixTQUFTLGFBQWEsQ0FBQyxLQUFVO0lBQy9CLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLGlCQUFpQjtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQzlFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDM0MsT0FBTyxLQUFLLEtBQUssSUFBSSxJQUFJLEtBQUssS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDO0FBQ3RELENBQUM7QUFFRCxTQUFTLFlBQVksQ0FDbkIsR0FBVyxFQUNYLEtBQTBCO0lBRTFCLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxHQUFhLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFDNUMsQ0FBQztTQUFNLElBQUksYUFBYSxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQzFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFFRCxPQUFPLFlBQVksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBRSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN2RSxDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsR0FBVyxFQUFFLEtBQTBCO0lBQzVELE1BQU0sSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkIsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUUsQ0FBQztJQUV4QyxJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7UUFDNUIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxJQUFJO1FBQ2pDLENBQUMsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUN0QyxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsSUFBSSxhQUFhLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsYUFBYSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBRUQsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDO0FBSUQsU0FBZ0IsY0FBYyxDQUM1QixNQUFjLEVBQ2QsVUFBNEIsVUFBVTtJQUV0QyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTTtRQUFFLE9BQU87SUFDNUIsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUU1QixJQUFJLEdBQUcsS0FBSyxLQUFLLElBQUksR0FBRyxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3BDLElBQ0UsR0FBRyxLQUFLLEtBQUs7WUFDYixLQUFLLENBQUMsSUFBSSxDQUNSLENBQUMsU0FBOEIsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUN4RSxFQUNELENBQUM7WUFDRCxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0QixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUIsTUFBTSxRQUFRLEdBQUcsR0FBRyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7UUFDN0MsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLE9BQU87Z0JBQ0wsQ0FBQyxRQUFRLENBQUMsRUFBRTtvQkFDVixJQUFJLEVBQUUsY0FBYyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7b0JBQ25DLEtBQUssRUFBRSxjQUFjLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxPQUFPLENBQUM7aUJBQzFEO2FBQ0YsQ0FBQztRQUNKLENBQUM7YUFBTSxDQUFDO1lBQ04sT0FBTyxjQUFjLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7SUFDSCxDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsYUFBYSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM3QyxNQUFNLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLEdBQUcsWUFBWSxDQUNuRSxHQUFHLEVBQ0gsS0FBSyxDQUNOLENBQUM7SUFFRixJQUFJLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdkIsT0FBTyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbkIsT0FBTztZQUNMLElBQUksRUFBRTtnQkFDSixJQUFJLEVBQUUsa0JBQWtCLENBQUMsVUFBVSxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDO2dCQUMxRSxLQUFLLEVBQUUsY0FBYyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUM7YUFDdkM7U0FDRixDQUFDO0lBQ0osQ0FBQztTQUFNLENBQUM7UUFDTixPQUFPLGtCQUFrQixDQUFDLFVBQVUsRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFFRCxTQUFTLGtCQUFrQixDQUN6QixJQUFjLEVBQ2QsUUFBZ0IsRUFDaEIsWUFBaUIsRUFDakIsYUFBK0IsVUFBVTtRQUV6QyxTQUFTLFNBQVMsQ0FBQyxZQUFzQixFQUFFLElBQXNCO1lBQy9ELElBQUksSUFBSSxHQUNOLElBQUksS0FBSyxrQkFBa0I7Z0JBQ3pCLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxTQUFrQixFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFO2dCQUNsRSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsVUFBbUIsRUFBRSxDQUFDO1lBQ25DLEtBQUssTUFBTSxJQUFJLElBQUksWUFBWSxFQUFFLENBQUM7Z0JBQ2hDLElBQUksR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUN2QyxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBRUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxDQUFNLEVBQUUsRUFBRSxDQUM1QixDQUFDLEtBQUssZUFBZSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxXQUFvQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBRXZFLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDekMsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBRXZDLElBQUksSUFBSSxHQUFRLElBQUksQ0FBQztRQUVyQixNQUFNLGFBQWEsR0FDakIsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDO1lBQ2QsQ0FBQyxDQUFDLFVBQVUsS0FBSyxrQkFBa0I7Z0JBQ2pDLENBQUMsQ0FBQyxFQUFFLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxTQUFrQixFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxFQUFFO2dCQUNsRSxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsVUFBbUIsRUFBRTtZQUNoQyxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFL0MsSUFDRSxRQUFRLEtBQUssT0FBTztZQUNwQixDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksWUFBWSxLQUFLLEtBQUssQ0FBQyxFQUNqRCxDQUFDO1lBQ0QsSUFBSSxHQUFHO2dCQUNMLEdBQUcsRUFBRTtvQkFDSCxHQUFHLEVBQUUsRUFBRSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUUsRUFBRSxFQUFFO2lCQUNwRTthQUNGLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFDRSxRQUFRLEtBQUssUUFBUTtZQUNyQixDQUFDLFFBQVEsS0FBSyxPQUFPLElBQUksWUFBWSxLQUFLLEtBQUssQ0FBQyxFQUNoRCxDQUFDO1lBQ0QsSUFBSSxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUUsSUFBSSxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFFLEVBQUUsRUFBRSxDQUFDO1FBQ3hFLENBQUM7UUFFRCxJQUFJLFlBQVksS0FBSyxTQUFTLElBQUksSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2hELElBQUksUUFBUSxLQUFLLEtBQUs7Z0JBQUUsSUFBSSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDekQsSUFBSSxRQUFRLEtBQUssTUFBTTtnQkFBRSxJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUMxRCxJQUFJLFFBQVEsS0FBSyxLQUFLO2dCQUFFLElBQUksR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3hELElBQUksUUFBUSxLQUFLLE1BQU07Z0JBQUUsSUFBSSxHQUFHLEVBQUUsSUFBSSxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDMUQsSUFBSSxRQUFRLEtBQUssS0FBSztnQkFBRSxJQUFJLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUN4RCxJQUFJLFFBQVEsS0FBSyxNQUFNO2dCQUFFLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQzFELElBQUksUUFBUSxLQUFLLFlBQVksRUFBRSxDQUFDO2dCQUM5Qiw0RUFBNEU7Z0JBQzVFLHNGQUFzRjtnQkFDdEYsTUFBTSxJQUFJLEtBQUssQ0FDYiw4R0FBOEcsQ0FDL0csQ0FBQztZQUNKLENBQUM7WUFDRCxJQUFJLFFBQVEsS0FBSyxXQUFXLEVBQUUsQ0FBQztnQkFDN0IsSUFBSSxHQUFHO29CQUNMLElBQUksRUFBRTt3QkFDSixJQUFJO3dCQUNKLE9BQU8sRUFBRSxDQUFDLFVBQVUsRUFBRSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsRUFBRSxVQUFVLENBQUM7cUJBQzdEO2lCQUNGLENBQUM7WUFDSixDQUFDO1lBQ0QsSUFBSSxRQUFRLEtBQUssY0FBYyxFQUFFLENBQUM7Z0JBQ2hDLElBQUksR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsRUFBRSxVQUFVLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDOUUsQ0FBQztZQUNELElBQUksUUFBUSxLQUFLLFlBQVksRUFBRSxDQUFDO2dCQUM5QixJQUFJLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsVUFBVSxFQUFFLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQzlFLENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxJQUFJLEtBQUssSUFBSTtZQUFFLE9BQU87UUFDMUIsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQWdCLGdCQUFnQixDQUFDLFVBQXdCO0lBS3ZELE1BQU0sbUJBQW1CLEdBQUc7UUFDMUIsRUFBRSxFQUFFLElBQUk7UUFDUixNQUFNLEVBQUU7WUFDTixJQUFJLEVBQUUsZUFBZTtZQUNyQixFQUFFLEVBQUUsVUFBVSxDQUFDLFFBQVE7U0FDeEI7S0FDRixDQUFDO0lBRUYsTUFBTSxNQUFNLEdBQUc7UUFDYixFQUFFLEVBQUUsSUFBSTtRQUNSLE1BQU0sRUFBRTtZQUNOLElBQUksRUFBRSxPQUFPLFVBQVUsQ0FBQyxVQUFVLFVBQVU7WUFDNUMsRUFBRSxFQUFFLFVBQVUsQ0FBQyxNQUFNO1NBQ3RCO0tBQ0YsQ0FBQztJQUVGLE1BQU0saUJBQWlCLEdBQUcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxXQUFXLElBQUksRUFBRSxDQUFDLENBQUM7SUFFdkUsTUFBTSxjQUFjLEdBQUcsaUJBQWlCO1FBQ3RDLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQWUsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsQ0FBQztRQUN0RCxDQUFDLENBQUMsRUFBRSxDQUFDO0lBRVAsTUFBTSxVQUFVLEdBQWU7UUFDN0IsTUFBTSxFQUFFLFFBQVE7UUFDaEIsU0FBUyxFQUFFLG1CQUEwQjtRQUNyQyxNQUFNLEVBQUUsTUFBYTtRQUNyQixRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFO1FBQ3ZCLFVBQVUsRUFBRSxjQUFxQjtLQUNsQyxDQUFDO0lBRUYsK0VBQStFO0lBQy9FLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDO0lBQ3ZDLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0saUJBQWlCLEdBQ3JCLFVBQVUsQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztJQUU1RSxJQUFJLFdBQW1DLENBQUM7SUFDeEMsSUFBSSxnQkFBd0MsQ0FBQztJQUM3QyxJQUFJLFNBQVMsRUFBRSxDQUFDO1FBQ2QsTUFBTSxlQUFlLEdBQXVDLEVBQUUsQ0FBQztRQUUvRCxlQUFlLENBQUMsSUFBSSxDQUFDO1lBQ25CLElBQUksRUFBRSxNQUFNO1lBQ1osSUFBSSxFQUFFO2dCQUNKLFdBQVcsRUFBRTtvQkFDWCxJQUFJLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFO29CQUN2QixLQUFLLEVBQUU7d0JBQ0wsR0FBRyxFQUFFOzRCQUNILElBQUksRUFBRSxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUU7NEJBQ3hCLElBQUksRUFBRSxpQkFBaUI7eUJBQ3hCO3FCQUNGO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7UUFDSCxXQUFXLEdBQUc7WUFDWixNQUFNLEVBQUUsUUFBUTtZQUNoQixTQUFTLEVBQUUsbUJBQTBCO1lBQ3JDLE1BQU0sRUFBRSxNQUFhO1lBQ3JCLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUU7WUFDdkIsVUFBVSxFQUFFLGVBQWU7U0FDNUIsQ0FBQztJQUNKLENBQUM7SUFFRCxJQUFJLGlCQUFpQixFQUFFLENBQUM7UUFDdEIsTUFBTSxvQkFBb0IsR0FBdUMsRUFBRSxDQUFDO1FBRXBFLE1BQU0sY0FBYyxHQUFHLGNBQWMsQ0FDbkMsVUFBVSxDQUFDLFVBQVUsSUFBSSxFQUFFLEVBQzNCLGtCQUFrQixDQUNuQixDQUFDO1FBQ0Ysb0JBQW9CLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQztRQUVsRSxnQkFBZ0IsR0FBRztZQUNqQixNQUFNLEVBQUUsUUFBUTtZQUNoQixTQUFTLEVBQUUsbUJBQTBCO1lBQ3JDLE1BQU0sRUFBRSxNQUFhO1lBQ3JCLFFBQVEsRUFBRSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUU7WUFDdkIsVUFBVSxFQUFFLG9CQUEyQjtTQUN4QyxDQUFDO0lBQ0osQ0FBQztJQUVELE9BQU8sRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLENBQUM7QUFDdkQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgUG9saWN5SnNvbiB9IGZyb20gJ0BjZWRhci1wb2xpY3kvY2VkYXItd2FzbS9ub2RlanMnO1xuaW1wb3J0IHsgRDlQZXJtaXNzaW9uLCBGaWx0ZXIgfSBmcm9tICcuL2Q5LXBlcm1pc3Npb24nO1xuXG4vKiogTG9jYWwgc3RhbmQtaW4gZm9yIGxvZGFzaCdzIGBpc1BsYWluT2JqZWN0YCwgd2hpY2ggdGhpcyBwYWNrYWdlIGRvZXMgbm90IGRlcGVuZCBvbi4gKi9cbmZ1bmN0aW9uIGlzUGxhaW5PYmplY3QodmFsdWU6IGFueSk6IGJvb2xlYW4ge1xuICBpZiAoT2JqZWN0LnByb3RvdHlwZS50b1N0cmluZy5jYWxsKHZhbHVlKSAhPT0gJ1tvYmplY3QgT2JqZWN0XScpIHJldHVybiBmYWxzZTtcbiAgY29uc3QgcHJvdG8gPSBPYmplY3QuZ2V0UHJvdG90eXBlT2YodmFsdWUpO1xuICByZXR1cm4gcHJvdG8gPT09IG51bGwgfHwgcHJvdG8gPT09IE9iamVjdC5wcm90b3R5cGU7XG59XG5cbmZ1bmN0aW9uIGdldE9wZXJhdGlvbihcbiAga2V5OiBzdHJpbmcsXG4gIHZhbHVlOiBSZWNvcmQ8c3RyaW5nLCBhbnk+LFxuKTogeyBvcGVyYXRvcjogc3RyaW5nOyB2YWx1ZTogYW55IH0ge1xuICBpZiAoa2V5LnN0YXJ0c1dpdGgoJ18nKSAmJiAhWydfYW5kJywgJ19vcicsICdfbm9uZScsICdfc29tZSddLmluY2x1ZGVzKGtleSkpIHtcbiAgICByZXR1cm4geyBvcGVyYXRvcjoga2V5IGFzIHN0cmluZywgdmFsdWUgfTtcbiAgfSBlbHNlIGlmIChpc1BsYWluT2JqZWN0KHZhbHVlKSA9PT0gZmFsc2UpIHtcbiAgICByZXR1cm4geyBvcGVyYXRvcjogJ19lcScsIHZhbHVlIH07XG4gIH1cblxuICByZXR1cm4gZ2V0T3BlcmF0aW9uKE9iamVjdC5rZXlzKHZhbHVlKVswXSEsIE9iamVjdC52YWx1ZXModmFsdWUpWzBdKTtcbn1cblxuZnVuY3Rpb24gZ2V0RmlsdGVyUGF0aChrZXk6IHN0cmluZywgdmFsdWU6IFJlY29yZDxzdHJpbmcsIGFueT4pIHtcbiAgY29uc3QgcGF0aCA9IFtrZXldO1xuICBjb25zdCBjaGlsZEtleSA9IE9iamVjdC5rZXlzKHZhbHVlKVswXSE7XG5cbiAgaWYgKFxuICAgIHR5cGVvZiBjaGlsZEtleSA9PT0gJ3N0cmluZycgJiZcbiAgICBjaGlsZEtleS5zdGFydHNXaXRoKCdfJykgPT09IHRydWUgJiZcbiAgICAhWydfbm9uZScsICdfc29tZSddLmluY2x1ZGVzKGNoaWxkS2V5KVxuICApIHtcbiAgICByZXR1cm4gcGF0aDtcbiAgfVxuXG4gIGlmIChpc1BsYWluT2JqZWN0KHZhbHVlKSkge1xuICAgIHBhdGgucHVzaCguLi5nZXRGaWx0ZXJQYXRoKGNoaWxkS2V5LCBPYmplY3QudmFsdWVzKHZhbHVlKVswXSkpO1xuICB9XG5cbiAgcmV0dXJuIHBhdGg7XG59XG5cbmV4cG9ydCB0eXBlIENvbmRpdGlvblN1YmplY3QgPSAncmVzb3VyY2UnIHwgJ2NvbnRleHQubmV3VmFsdWUnO1xuXG5leHBvcnQgZnVuY3Rpb24gYWRkV2hlbkNsYXVzZXMoXG4gIGZpbHRlcjogRmlsdGVyLFxuICBzdWJqZWN0OiBDb25kaXRpb25TdWJqZWN0ID0gJ3Jlc291cmNlJyxcbik6IGFueSB7XG4gIGNvbnN0IGVudHJpZXMgPSBPYmplY3QuZW50cmllcyhmaWx0ZXIpO1xuICBpZiAoIWVudHJpZXMubGVuZ3RoKSByZXR1cm47XG4gIGNvbnN0IGtleSA9IGVudHJpZXNbMF1bMF07XG4gIGNvbnN0IHZhbHVlID0gZW50cmllc1swXVsxXTtcblxuICBpZiAoa2V5ID09PSAnX29yJyB8fCBrZXkgPT09ICdfYW5kJykge1xuICAgIGlmIChcbiAgICAgIGtleSA9PT0gJ19vcicgJiZcbiAgICAgIHZhbHVlLnNvbWUoXG4gICAgICAgIChzdWJGaWx0ZXI6IFJlY29yZDxzdHJpbmcsIGFueT4pID0+IE9iamVjdC5rZXlzKHN1YkZpbHRlcikubGVuZ3RoID09PSAwLFxuICAgICAgKVxuICAgICkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBjb25zdCBsZWZ0ID0gdmFsdWVbMF07XG4gICAgY29uc3QgcmlnaHRWYWwgPSB2YWx1ZVsxXTtcbiAgICBjb25zdCBvcGVyYXRvciA9IGtleSA9PT0gJ19vcicgPyAnfHwnIDogJyYmJztcbiAgICBpZiAocmlnaHRWYWwpIHtcbiAgICAgIHJldHVybiB7XG4gICAgICAgIFtvcGVyYXRvcl06IHtcbiAgICAgICAgICBsZWZ0OiBhZGRXaGVuQ2xhdXNlcyhsZWZ0LCBzdWJqZWN0KSxcbiAgICAgICAgICByaWdodDogYWRkV2hlbkNsYXVzZXMoeyBba2V5XTogdmFsdWUuc2xpY2UoMSkgfSwgc3ViamVjdCksXG4gICAgICAgIH0sXG4gICAgICB9O1xuICAgIH0gZWxzZSB7XG4gICAgICByZXR1cm4gYWRkV2hlbkNsYXVzZXMobGVmdCwgc3ViamVjdCk7XG4gICAgfVxuICB9XG5cbiAgY29uc3QgZmlsdGVyUGF0aCA9IGdldEZpbHRlclBhdGgoa2V5LCB2YWx1ZSk7XG4gIGNvbnN0IHsgb3BlcmF0b3I6IGZpbHRlck9wZXJhdG9yLCB2YWx1ZTogZmlsdGVyVmFsdWUgfSA9IGdldE9wZXJhdGlvbihcbiAgICBrZXksXG4gICAgdmFsdWUsXG4gICk7XG5cbiAgaWYgKGVudHJpZXMubGVuZ3RoID4gMSkge1xuICAgIGRlbGV0ZSBmaWx0ZXJba2V5XTtcbiAgICByZXR1cm4ge1xuICAgICAgJyYmJzoge1xuICAgICAgICBsZWZ0OiBhcHBseUZpbHRlclRvUXVlcnkoZmlsdGVyUGF0aCwgZmlsdGVyT3BlcmF0b3IsIGZpbHRlclZhbHVlLCBzdWJqZWN0KSxcbiAgICAgICAgcmlnaHQ6IGFkZFdoZW5DbGF1c2VzKGZpbHRlciwgc3ViamVjdCksXG4gICAgICB9LFxuICAgIH07XG4gIH0gZWxzZSB7XG4gICAgcmV0dXJuIGFwcGx5RmlsdGVyVG9RdWVyeShmaWx0ZXJQYXRoLCBmaWx0ZXJPcGVyYXRvciwgZmlsdGVyVmFsdWUsIHN1YmplY3QpO1xuICB9XG5cbiAgZnVuY3Rpb24gYXBwbHlGaWx0ZXJUb1F1ZXJ5KFxuICAgIHBhdGg6IHN0cmluZ1tdLFxuICAgIG9wZXJhdG9yOiBzdHJpbmcsXG4gICAgY29tcGFyZVZhbHVlOiBhbnksXG4gICAgc3ViamVjdFZhcjogQ29uZGl0aW9uU3ViamVjdCA9ICdyZXNvdXJjZScsXG4gICkge1xuICAgIGZ1bmN0aW9uIGJ1aWxkTGVmdChwYXRoU2VnbWVudHM6IHN0cmluZ1tdLCBzdWJqOiBDb25kaXRpb25TdWJqZWN0KTogYW55IHtcbiAgICAgIGxldCBub2RlOiBhbnkgPVxuICAgICAgICBzdWJqID09PSAnY29udGV4dC5uZXdWYWx1ZSdcbiAgICAgICAgICA/IHsgJy4nOiB7IGxlZnQ6IHsgVmFyOiAnY29udGV4dCcgYXMgY29uc3QgfSwgYXR0cjogJ25ld1ZhbHVlJyB9IH1cbiAgICAgICAgICA6IHsgVmFyOiAncmVzb3VyY2UnIGFzIGNvbnN0IH07XG4gICAgICBmb3IgKGNvbnN0IGF0dHIgb2YgcGF0aFNlZ21lbnRzKSB7XG4gICAgICAgIG5vZGUgPSB7ICcuJzogeyBsZWZ0OiBub2RlLCBhdHRyIH0gfTtcbiAgICAgIH1cbiAgICAgIHJldHVybiBub2RlO1xuICAgIH1cblxuICAgIGNvbnN0IGJ1aWxkUmlnaHQgPSAodjogYW55KSA9PlxuICAgICAgdiA9PT0gJyRDVVJSRU5UX1VTRVInID8geyBWYXI6ICdwcmluY2lwYWwnIGFzIGNvbnN0IH0gOiB7IFZhbHVlOiB2IH07XG5cbiAgICBjb25zdCBsZWZ0ID0gYnVpbGRMZWZ0KHBhdGgsIHN1YmplY3RWYXIpO1xuICAgIGNvbnN0IHJpZ2h0ID0gYnVpbGRSaWdodChjb21wYXJlVmFsdWUpO1xuXG4gICAgbGV0IGV4cHI6IGFueSA9IG51bGw7XG5cbiAgICBjb25zdCBiYXNlRm9yUGFyZW50ID1cbiAgICAgIHBhdGgubGVuZ3RoIDw9IDFcbiAgICAgICAgPyBzdWJqZWN0VmFyID09PSAnY29udGV4dC5uZXdWYWx1ZSdcbiAgICAgICAgICA/IHsgJy4nOiB7IGxlZnQ6IHsgVmFyOiAnY29udGV4dCcgYXMgY29uc3QgfSwgYXR0cjogJ25ld1ZhbHVlJyB9IH1cbiAgICAgICAgICA6IHsgVmFyOiAncmVzb3VyY2UnIGFzIGNvbnN0IH1cbiAgICAgICAgOiBidWlsZExlZnQocGF0aC5zbGljZSgwLCAtMSksIHN1YmplY3RWYXIpO1xuXG4gICAgaWYgKFxuICAgICAgb3BlcmF0b3IgPT09ICdfbnVsbCcgfHxcbiAgICAgIChvcGVyYXRvciA9PT0gJ19ubnVsbCcgJiYgY29tcGFyZVZhbHVlID09PSBmYWxzZSlcbiAgICApIHtcbiAgICAgIGV4cHIgPSB7XG4gICAgICAgICchJzoge1xuICAgICAgICAgIGFyZzogeyBoYXM6IHsgbGVmdDogYmFzZUZvclBhcmVudCwgYXR0cjogcGF0aFtwYXRoLmxlbmd0aCAtIDFdISB9IH0sXG4gICAgICAgIH0sXG4gICAgICB9O1xuICAgIH1cbiAgICBpZiAoXG4gICAgICBvcGVyYXRvciA9PT0gJ19ubnVsbCcgfHxcbiAgICAgIChvcGVyYXRvciA9PT0gJ19udWxsJyAmJiBjb21wYXJlVmFsdWUgPT09IGZhbHNlKVxuICAgICkge1xuICAgICAgZXhwciA9IHsgaGFzOiB7IGxlZnQ6IGJhc2VGb3JQYXJlbnQsIGF0dHI6IHBhdGhbcGF0aC5sZW5ndGggLSAxXSEgfSB9O1xuICAgIH1cblxuICAgIGlmIChjb21wYXJlVmFsdWUgIT09IHVuZGVmaW5lZCAmJiBleHByID09PSBudWxsKSB7XG4gICAgICBpZiAob3BlcmF0b3IgPT09ICdfZXEnKSBleHByID0geyAnPT0nOiB7IGxlZnQsIHJpZ2h0IH0gfTtcbiAgICAgIGlmIChvcGVyYXRvciA9PT0gJ19uZXEnKSBleHByID0geyAnIT0nOiB7IGxlZnQsIHJpZ2h0IH0gfTtcbiAgICAgIGlmIChvcGVyYXRvciA9PT0gJ19ndCcpIGV4cHIgPSB7ICc+JzogeyBsZWZ0LCByaWdodCB9IH07XG4gICAgICBpZiAob3BlcmF0b3IgPT09ICdfZ3RlJykgZXhwciA9IHsgJz49JzogeyBsZWZ0LCByaWdodCB9IH07XG4gICAgICBpZiAob3BlcmF0b3IgPT09ICdfbHQnKSBleHByID0geyAnPCc6IHsgbGVmdCwgcmlnaHQgfSB9O1xuICAgICAgaWYgKG9wZXJhdG9yID09PSAnX2x0ZScpIGV4cHIgPSB7ICc8PSc6IHsgbGVmdCwgcmlnaHQgfSB9O1xuICAgICAgaWYgKG9wZXJhdG9yID09PSAnX2ljb250YWlucycpIHtcbiAgICAgICAgLy8gQ2VkYXIgaGFzIG5vIGNhc2UtaW5zZW5zaXRpdmUgbWF0Y2hpbmcuIE5vcm1hbGl6ZSB0aGUgc3RvcmVkIGRhdGEgYW5kIHVzZVxuICAgICAgICAvLyBfY29udGFpbnMg4oCUIGh0dHBzOi8vZG9jcy5jZWRhcnBvbGljeS5jb20vYmVzdHByYWN0aWNlcy9icC1ub3JtYWxpemUtZGF0YS1pbnB1dC5odG1sXG4gICAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgICAnX2ljb250YWlucyBpcyBub3Qgc3VwcG9ydGVkIGluIENlZGFyIHBvbGljaWVzOiBub3JtYWxpemUgdGhlIGRhdGEgKGUuZy4gbG93ZXJjYXNlKSBhbmQgdXNlIF9jb250YWlucyBpbnN0ZWFkJyxcbiAgICAgICAgKTtcbiAgICAgIH1cbiAgICAgIGlmIChvcGVyYXRvciA9PT0gJ19jb250YWlucycpIHtcbiAgICAgICAgZXhwciA9IHtcbiAgICAgICAgICBsaWtlOiB7XG4gICAgICAgICAgICBsZWZ0LFxuICAgICAgICAgICAgcGF0dGVybjogWydXaWxkY2FyZCcsIHsgTGl0ZXJhbDogY29tcGFyZVZhbHVlIH0sICdXaWxkY2FyZCddLFxuICAgICAgICAgIH0sXG4gICAgICAgIH07XG4gICAgICB9XG4gICAgICBpZiAob3BlcmF0b3IgPT09ICdfc3RhcnRzX3dpdGgnKSB7XG4gICAgICAgIGV4cHIgPSB7IGxpa2U6IHsgbGVmdCwgcGF0dGVybjogW3sgTGl0ZXJhbDogY29tcGFyZVZhbHVlIH0sICdXaWxkY2FyZCddIH0gfTtcbiAgICAgIH1cbiAgICAgIGlmIChvcGVyYXRvciA9PT0gJ19lbmRzX3dpdGgnKSB7XG4gICAgICAgIGV4cHIgPSB7IGxpa2U6IHsgbGVmdCwgcGF0dGVybjogWydXaWxkY2FyZCcsIHsgTGl0ZXJhbDogY29tcGFyZVZhbHVlIH1dIH0gfTtcbiAgICAgIH1cbiAgICB9XG5cbiAgICBpZiAoZXhwciA9PT0gbnVsbCkgcmV0dXJuO1xuICAgIHJldHVybiBleHByO1xuICB9XG59XG5cbmV4cG9ydCBmdW5jdGlvbiB0cmFuc2xhdGVUb0NlZGFyKHBlcm1pc3Npb246IEQ5UGVybWlzc2lvbik6IHtcbiAgbWFpblBvbGljeTogUG9saWN5SnNvbjtcbiAgZmllbGRQb2xpY3k/OiBQb2xpY3lKc29uO1xuICB2YWxpZGF0aW9uUG9saWN5PzogUG9saWN5SnNvbjtcbn0ge1xuICBjb25zdCBwcmluY2lwYWxDb25zdHJhaW50ID0ge1xuICAgIG9wOiAnaW4nLFxuICAgIGVudGl0eToge1xuICAgICAgdHlwZTogJ2Q5OjpVc2VyR3JvdXAnLFxuICAgICAgaWQ6IHBlcm1pc3Npb24ucm9sZU5hbWUsXG4gICAgfSxcbiAgfTtcblxuICBjb25zdCBhY3Rpb24gPSB7XG4gICAgb3A6ICc9PScsXG4gICAgZW50aXR5OiB7XG4gICAgICB0eXBlOiBgRGI6OiR7cGVybWlzc2lvbi5jb2xsZWN0aW9ufTo6QWN0aW9uYCxcbiAgICAgIGlkOiBwZXJtaXNzaW9uLmFjdGlvbixcbiAgICB9LFxuICB9O1xuXG4gIGNvbnN0IG1haW5Db25kaXRpb25Cb2R5ID0gYWRkV2hlbkNsYXVzZXMocGVybWlzc2lvbi5wZXJtaXNzaW9ucyB8fCB7fSk7XG5cbiAgY29uc3QgbWFpbkNvbmRpdGlvbnMgPSBtYWluQ29uZGl0aW9uQm9keVxuICAgID8gW3sga2luZDogJ3doZW4nIGFzIGNvbnN0LCBib2R5OiBtYWluQ29uZGl0aW9uQm9keSB9XVxuICAgIDogW107XG5cbiAgY29uc3QgbWFpblBvbGljeTogUG9saWN5SnNvbiA9IHtcbiAgICBlZmZlY3Q6ICdwZXJtaXQnLFxuICAgIHByaW5jaXBhbDogcHJpbmNpcGFsQ29uc3RyYWludCBhcyBhbnksXG4gICAgYWN0aW9uOiBhY3Rpb24gYXMgYW55LFxuICAgIHJlc291cmNlOiB7IG9wOiAnQWxsJyB9LFxuICAgIGNvbmRpdGlvbnM6IG1haW5Db25kaXRpb25zIGFzIGFueSxcbiAgfTtcblxuICAvLyBGaWVsZC1sZXZlbCBwb2xpY3kgb25seSB3aGVuIHRoZXJlIGlzIGEgZmllbGRzIHJlc3RyaWN0aW9uIGFuZC9vciB2YWxpZGF0aW9uXG4gIGNvbnN0IGZpZWxkcyA9IHBlcm1pc3Npb24uZmllbGRzID8/IFtdO1xuICBjb25zdCBoYXNGaWVsZHMgPSBmaWVsZHMubGVuZ3RoID4gMDtcbiAgY29uc3QgaGFzVmFsaWRhdGlvbkNvbmQgPVxuICAgIHBlcm1pc3Npb24udmFsaWRhdGlvbiAmJiBPYmplY3QuZW50cmllcyhwZXJtaXNzaW9uLnZhbGlkYXRpb24pLmxlbmd0aCA+IDA7XG5cbiAgbGV0IGZpZWxkUG9saWN5OiBQb2xpY3lKc29uIHwgdW5kZWZpbmVkO1xuICBsZXQgdmFsaWRhdGlvblBvbGljeTogUG9saWN5SnNvbiB8IHVuZGVmaW5lZDtcbiAgaWYgKGhhc0ZpZWxkcykge1xuICAgIGNvbnN0IGZpZWxkQ29uZGl0aW9uczogQXJyYXk8eyBraW5kOiAnd2hlbic7IGJvZHk6IGFueSB9PiA9IFtdO1xuXG4gICAgZmllbGRDb25kaXRpb25zLnB1c2goe1xuICAgICAga2luZDogJ3doZW4nLFxuICAgICAgYm9keToge1xuICAgICAgICBjb250YWluc0FsbDoge1xuICAgICAgICAgIGxlZnQ6IHsgVmFsdWU6IGZpZWxkcyB9LFxuICAgICAgICAgIHJpZ2h0OiB7XG4gICAgICAgICAgICAnLic6IHtcbiAgICAgICAgICAgICAgbGVmdDogeyBWYXI6ICdjb250ZXh0JyB9LFxuICAgICAgICAgICAgICBhdHRyOiAncmVxdWVzdGVkRmllbGRzJyxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgZmllbGRQb2xpY3kgPSB7XG4gICAgICBlZmZlY3Q6ICdwZXJtaXQnLFxuICAgICAgcHJpbmNpcGFsOiBwcmluY2lwYWxDb25zdHJhaW50IGFzIGFueSxcbiAgICAgIGFjdGlvbjogYWN0aW9uIGFzIGFueSxcbiAgICAgIHJlc291cmNlOiB7IG9wOiAnQWxsJyB9LFxuICAgICAgY29uZGl0aW9uczogZmllbGRDb25kaXRpb25zLFxuICAgIH07XG4gIH1cblxuICBpZiAoaGFzVmFsaWRhdGlvbkNvbmQpIHtcbiAgICBjb25zdCB2YWxpZGF0aW9uQ29uZGl0aW9uczogQXJyYXk8eyBraW5kOiAnd2hlbic7IGJvZHk6IGFueSB9PiA9IFtdO1xuXG4gICAgY29uc3QgdmFsaWRhdGlvbkJvZHkgPSBhZGRXaGVuQ2xhdXNlcyhcbiAgICAgIHBlcm1pc3Npb24udmFsaWRhdGlvbiB8fCB7fSxcbiAgICAgICdjb250ZXh0Lm5ld1ZhbHVlJyxcbiAgICApO1xuICAgIHZhbGlkYXRpb25Db25kaXRpb25zLnB1c2goeyBraW5kOiAnd2hlbicsIGJvZHk6IHZhbGlkYXRpb25Cb2R5IH0pO1xuXG4gICAgdmFsaWRhdGlvblBvbGljeSA9IHtcbiAgICAgIGVmZmVjdDogJ3Blcm1pdCcsXG4gICAgICBwcmluY2lwYWw6IHByaW5jaXBhbENvbnN0cmFpbnQgYXMgYW55LFxuICAgICAgYWN0aW9uOiBhY3Rpb24gYXMgYW55LFxuICAgICAgcmVzb3VyY2U6IHsgb3A6ICdBbGwnIH0sXG4gICAgICBjb25kaXRpb25zOiB2YWxpZGF0aW9uQ29uZGl0aW9ucyBhcyBhbnksXG4gICAgfTtcbiAgfVxuXG4gIHJldHVybiB7IG1haW5Qb2xpY3ksIGZpZWxkUG9saWN5LCB2YWxpZGF0aW9uUG9saWN5IH07XG59XG4iXX0=

package/lib/cli/commands/cedar/d9-permission.d.ts

@@ -0,0 +1,27 @@
+/** The `Filter` type of `@wbce-d9/types`, inlined so the CLI does not depend on it. */
+export type Filter = Record<string, any>;
+/**
+ * A d9 permission, shared by both translation directions:
+ *  - forward (d9-to-cedar): `new D9Permission(row)` parses a CSV row;
+ *  - reverse (cedar-to-d9): `D9Permission.empty(...)` starts a blank permission that
+ *    is filled as each `.cedar` file is parsed, then rendered back via `*Cell()`.
+ * `id`/`role`/`presets` are CSV-only columns, populated only on the forward side.
+ */
+export declare class D9Permission {
+    /** Blank permission to accumulate reconstructed Cedar clauses onto (reverse direction). */
+    static empty(roleName: string, collection: string, action: string): D9Permission;
+    roleName: string;
+    collection: string;
+    action: string;
+    permissions?: Filter;
+    validation?: Filter;
+    fields?: string[];
+    id?: number;
+    role?: string;
+    presets?: Record<string, any>;
+    /** Parse a `directus_permissions.csv` row. `roleName` is resolved separately from the role UUID. */
+    constructor(row: Record<string, string>);
+    permissionsCell(): string;
+    validationCell(): string;
+    fieldsCell(): string;
+}

package/lib/cli/commands/cedar/d9-permission.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.D9Permission = void 0;
+function parseStringFieldToJSON(field) {
+    return field?.length ? JSON.parse(field) : undefined;
+}
+/**
+ * A d9 permission, shared by both translation directions:
+ *  - forward (d9-to-cedar): `new D9Permission(row)` parses a CSV row;
+ *  - reverse (cedar-to-d9): `D9Permission.empty(...)` starts a blank permission that
+ *    is filled as each `.cedar` file is parsed, then rendered back via `*Cell()`.
+ * `id`/`role`/`presets` are CSV-only columns, populated only on the forward side.
+ */
+class D9Permission {
+    /** Blank permission to accumulate reconstructed Cedar clauses onto (reverse direction). */
+    static empty(roleName, collection, action) {
+        const perm = Object.create(D9Permission.prototype);
+        perm.roleName = roleName;
+        perm.collection = collection;
+        perm.action = action;
+        return perm;
+    }
+    /** Parse a `directus_permissions.csv` row. `roleName` is resolved separately from the role UUID. */
+    constructor(row) {
+        this.collection = row.collection;
+        this.action = row.action;
+        this.id = Number(row.id);
+        this.role = row.role;
+        this.permissions = parseStringFieldToJSON(row.permissions);
+        this.validation = parseStringFieldToJSON(row.validation);
+        this.fields = row.fields?.split(',') || [];
+        this.presets = parseStringFieldToJSON(row.presets);
+    }
+    permissionsCell() {
+        return JSON.stringify(this.permissions ?? {});
+    }
+    validationCell() {
+        return JSON.stringify(this.validation ?? {});
+    }
+    fieldsCell() {
+        return this.fields ? this.fields.join(',') : '*';
+    }
+}
+exports.D9Permission = D9Permission;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZDktcGVybWlzc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9jbGkvY29tbWFuZHMvY2VkYXIvZDktcGVybWlzc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFHQSxTQUFTLHNCQUFzQixDQUFDLEtBQWM7SUFDNUMsT0FBTyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDdkQsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQWEsWUFBWTtJQUN2QiwyRkFBMkY7SUFDcEYsTUFBTSxDQUFDLEtBQUssQ0FDakIsUUFBZ0IsRUFDaEIsVUFBa0IsRUFDbEIsTUFBYztRQUVkLE1BQU0sSUFBSSxHQUFpQixNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNqRSxJQUFJLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztRQUN6QixJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztRQUM3QixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFhRCxvR0FBb0c7SUFDcEcsWUFBWSxHQUEyQjtRQUNyQyxJQUFJLENBQUMsVUFBVSxHQUFHLEdBQUcsQ0FBQyxVQUFVLENBQUM7UUFDakMsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxDQUFDO1FBQ3pCLElBQUksQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6QixJQUFJLENBQUMsSUFBSSxHQUFHLEdBQUcsQ0FBQyxJQUFJLENBQUM7UUFDckIsSUFBSSxDQUFDLFdBQVcsR0FBRyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLFVBQVUsR0FBRyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDM0MsSUFBSSxDQUFDLE9BQU8sR0FBRyxzQkFBc0IsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUVNLGVBQWU7UUFDcEIsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLElBQUksRUFBRSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUVNLGNBQWM7UUFDbkIsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxVQUFVLElBQUksRUFBRSxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVNLFVBQVU7UUFDZixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFDbkQsQ0FBQztDQUNGO0FBaERELG9DQWdEQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKiBUaGUgYEZpbHRlcmAgdHlwZSBvZiBgQHdiY2UtZDkvdHlwZXNgLCBpbmxpbmVkIHNvIHRoZSBDTEkgZG9lcyBub3QgZGVwZW5kIG9uIGl0LiAqL1xuZXhwb3J0IHR5cGUgRmlsdGVyID0gUmVjb3JkPHN0cmluZywgYW55PjtcblxuZnVuY3Rpb24gcGFyc2VTdHJpbmdGaWVsZFRvSlNPTihmaWVsZD86IHN0cmluZykge1xuICByZXR1cm4gZmllbGQ/Lmxlbmd0aCA/IEpTT04ucGFyc2UoZmllbGQpIDogdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIEEgZDkgcGVybWlzc2lvbiwgc2hhcmVkIGJ5IGJvdGggdHJhbnNsYXRpb24gZGlyZWN0aW9uczpcbiAqICAtIGZvcndhcmQgKGQ5LXRvLWNlZGFyKTogYG5ldyBEOVBlcm1pc3Npb24ocm93KWAgcGFyc2VzIGEgQ1NWIHJvdztcbiAqICAtIHJldmVyc2UgKGNlZGFyLXRvLWQ5KTogYEQ5UGVybWlzc2lvbi5lbXB0eSguLi4pYCBzdGFydHMgYSBibGFuayBwZXJtaXNzaW9uIHRoYXRcbiAqICAgIGlzIGZpbGxlZCBhcyBlYWNoIGAuY2VkYXJgIGZpbGUgaXMgcGFyc2VkLCB0aGVuIHJlbmRlcmVkIGJhY2sgdmlhIGAqQ2VsbCgpYC5cbiAqIGBpZGAvYHJvbGVgL2BwcmVzZXRzYCBhcmUgQ1NWLW9ubHkgY29sdW1ucywgcG9wdWxhdGVkIG9ubHkgb24gdGhlIGZvcndhcmQgc2lkZS5cbiAqL1xuZXhwb3J0IGNsYXNzIEQ5UGVybWlzc2lvbiB7XG4gIC8qKiBCbGFuayBwZXJtaXNzaW9uIHRvIGFjY3VtdWxhdGUgcmVjb25zdHJ1Y3RlZCBDZWRhciBjbGF1c2VzIG9udG8gKHJldmVyc2UgZGlyZWN0aW9uKS4gKi9cbiAgcHVibGljIHN0YXRpYyBlbXB0eShcbiAgICByb2xlTmFtZTogc3RyaW5nLFxuICAgIGNvbGxlY3Rpb246IHN0cmluZyxcbiAgICBhY3Rpb246IHN0cmluZyxcbiAgKTogRDlQZXJtaXNzaW9uIHtcbiAgICBjb25zdCBwZXJtOiBEOVBlcm1pc3Npb24gPSBPYmplY3QuY3JlYXRlKEQ5UGVybWlzc2lvbi5wcm90b3R5cGUpO1xuICAgIHBlcm0ucm9sZU5hbWUgPSByb2xlTmFtZTtcbiAgICBwZXJtLmNvbGxlY3Rpb24gPSBjb2xsZWN0aW9uO1xuICAgIHBlcm0uYWN0aW9uID0gYWN0aW9uO1xuICAgIHJldHVybiBwZXJtO1xuICB9XG5cbiAgcHVibGljIHJvbGVOYW1lITogc3RyaW5nO1xuICBwdWJsaWMgY29sbGVjdGlvbjogc3RyaW5nO1xuICBwdWJsaWMgYWN0aW9uOiBzdHJpbmc7XG4gIHB1YmxpYyBwZXJtaXNzaW9ucz86IEZpbHRlcjtcbiAgcHVibGljIHZhbGlkYXRpb24/OiBGaWx0ZXI7XG4gIHB1YmxpYyBmaWVsZHM/OiBzdHJpbmdbXTtcblxuICBwdWJsaWMgaWQ/OiBudW1iZXI7XG4gIHB1YmxpYyByb2xlPzogc3RyaW5nO1xuICBwdWJsaWMgcHJlc2V0cz86IFJlY29yZDxzdHJpbmcsIGFueT47XG5cbiAgLyoqIFBhcnNlIGEgYGRpcmVjdHVzX3Blcm1pc3Npb25zLmNzdmAgcm93LiBgcm9sZU5hbWVgIGlzIHJlc29sdmVkIHNlcGFyYXRlbHkgZnJvbSB0aGUgcm9sZSBVVUlELiAqL1xuICBjb25zdHJ1Y3Rvcihyb3c6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4pIHtcbiAgICB0aGlzLmNvbGxlY3Rpb24gPSByb3cuY29sbGVjdGlvbjtcbiAgICB0aGlzLmFjdGlvbiA9IHJvdy5hY3Rpb247XG4gICAgdGhpcy5pZCA9IE51bWJlcihyb3cuaWQpO1xuICAgIHRoaXMucm9sZSA9IHJvdy5yb2xlO1xuICAgIHRoaXMucGVybWlzc2lvbnMgPSBwYXJzZVN0cmluZ0ZpZWxkVG9KU09OKHJvdy5wZXJtaXNzaW9ucyk7XG4gICAgdGhpcy52YWxpZGF0aW9uID0gcGFyc2VTdHJpbmdGaWVsZFRvSlNPTihyb3cudmFsaWRhdGlvbik7XG4gICAgdGhpcy5maWVsZHMgPSByb3cuZmllbGRzPy5zcGxpdCgnLCcpIHx8IFtdO1xuICAgIHRoaXMucHJlc2V0cyA9IHBhcnNlU3RyaW5nRmllbGRUb0pTT04ocm93LnByZXNldHMpO1xuICB9XG5cbiAgcHVibGljIHBlcm1pc3Npb25zQ2VsbCgpOiBzdHJpbmcge1xuICAgIHJldHVybiBKU09OLnN0cmluZ2lmeSh0aGlzLnBlcm1pc3Npb25zID8/IHt9KTtcbiAgfVxuXG4gIHB1YmxpYyB2YWxpZGF0aW9uQ2VsbCgpOiBzdHJpbmcge1xuICAgIHJldHVybiBKU09OLnN0cmluZ2lmeSh0aGlzLnZhbGlkYXRpb24gPz8ge30pO1xuICB9XG5cbiAgcHVibGljIGZpZWxkc0NlbGwoKTogc3RyaW5nIHtcbiAgICByZXR1cm4gdGhpcy5maWVsZHMgPyB0aGlzLmZpZWxkcy5qb2luKCcsJykgOiAnKic7XG4gIH1cbn1cbiJdfQ==

package/lib/cli/commands/cedar/d9-to-cedar.d.ts

@@ -0,0 +1,33 @@
+import type { PolicyJson } from '@cedar-policy/cedar-wasm/nodejs';
+import { D9Permission } from './d9-permission';
+import { RolesTable } from './roles-table';
+export declare class CedarManager {
+    permissionPath: string;
+    sqlPath: string;
+    fieldsPolicies: Map<string, PolicyJson[]>;
+    mainPolicies: Map<string, PolicyJson[]>;
+    validationPolicies: Map<string, PolicyJson[]>;
+    roles: RolesTable;
+    d9Permissions: D9Permission[];
+    constructor(opts?: {
+        permissionPath?: string;
+        sqlPath?: string;
+    });
+    readPermissionFile(): Promise<void>;
+    readRoleFile(): Promise<void>;
+    refactoPolicies(policyKey: 'mainPolicies' | 'fieldsPolicies' | 'validationPolicies'): void;
+    sortPolicies(policyKey: 'mainPolicies' | 'fieldsPolicies' | 'validationPolicies'): void;
+    translateAndSortPermission(): Promise<void>;
+    writePoliciesToFile(roleName: string, fileTitle: string, policies: PolicyJson[]): Promise<void>;
+    writePolicies(policyKey: 'mainPolicies' | 'fieldsPolicies' | 'validationPolicies', fileName: string): Promise<void>;
+    readCsvAndWriteAllFiles(): Promise<void>;
+}
+/**
+ * CLI action: regenerate the Cedar policy folders from directus_permissions.csv.
+ * The folder is wiped first, reproducing what `formatePermission` does in app-api2,
+ * so a role removed from the CSV leaves no orphan files.
+ */
+export declare function d9ToCedar(options?: {
+    permissionPath?: string;
+    sqlPath?: string;
+}): Promise<void>;