cedar-mcp-server 1.0.0

package/dist/tools/advise.js

@@ -0,0 +1,258 @@
+/**
+ * cedar_advise — Cedar policy change planning context preparator.
+ *
+ * This tool returns deterministic, structured context for the calling LLM to
+ * produce a Cedar policy change plan natively. No MCP sampling, no client LLM
+ * round-trip. The bundle encodes Cedar/AVP knowledge that does not live in the
+ * policy files themselves (pattern classification, AVP UpdatePolicy mutability
+ * rules, intent-selected gotchas, sequencing rules) and is what makes the
+ * server load-bearing rather than substitutable by Read.
+ *
+ * Design v2, 2026-05-21: pivoted from sampling-based planner. See
+ * projects/cedar-mcp-server/02-technical-design.md "design v2".
+ */
+import { checkParseSchema, schemaToJsonWithResolvedTypes } from "@cedar-policy/cedar-wasm/nodejs";
+import { resolveStoreRef, buildStoreContext } from "./advise/context-builder.js";
+import { selectGotchas } from "./advise/gotchas.js";
+import { CEDAR_PATTERNS_SUMMARY } from "./advise/cedar-patterns.js";
+import { AVP_RULES_SUMMARY, AVP_VALIDATION_ERRORS } from "./advise/avp-rules.js";
+import { storeManager } from "../resources/store-manager.js";
+const SEQUENCING_GUIDANCE = [
+    "Schema changes that add new entity types, attributes, or actions MUST be deployed BEFORE policies that reference them. AVP validates each policy against the current schema at CreatePolicy/UpdatePolicy time.",
+    "Removing an entity type, action, or required attribute is BREAKING for any policy that references it. Update or delete dependent policies first, then remove the schema element.",
+    "Changing a required attribute to optional is safe; changing an optional attribute to required can silently skip policies that previously matched (Cedar drops policies that touch a missing required attribute via UnsafeOptionalAttributeAccess).",
+    "For renames (entity type, action id, attribute name), there is no atomic rename in AVP. Plan as: add the new name + dual-write policies, migrate consumers, then remove the old name.",
+];
+const AVP_UPDATE_POLICY_RULES = {
+    summary: AVP_RULES_SUMMARY,
+    in_place_via_update_policy: [
+        "Action scope (action == ... or action in [...])",
+        "When/unless condition clauses",
+        "Policy name / description metadata",
+    ],
+    requires_delete_recreate: [
+        "Effect (permit ↔ forbid)",
+        "Principal scope (head clause)",
+        "Resource scope (head clause)",
+        "Conversion between static and template-linked policy",
+    ],
+    new_via_create_policy: [
+        "Wholly new policy added to the store (no in-place path applies)",
+    ],
+    notes: [
+        "UpdatePolicy only updates STATIC policies. Template-linked policies use UpdatePolicyTemplate (or relink).",
+        "AVP error code for an attempted illegal change is ConflictException / ResourceNotFoundException depending on whether the policy still resolves under the new shape.",
+    ],
+};
+const CEDAR_PATTERNS_DETAIL = [
+    {
+        name: "Membership (RBAC)",
+        description: "Principal head clause uses `in Role::\"…\"` or similar group/role parent. Permissions follow group membership.",
+        example: 'permit (principal in App::Role::"editor", action in [App::Action::"read"], resource);',
+    },
+    {
+        name: "Relationship (ReBAC)",
+        description: "Conditions reference principal's relationship to the resource (often via an attribute on resource like `owners`, `viewers`, `team`).",
+        example: 'permit (principal is App::User, action in [App::Action::"read"], resource is App::Doc) when { principal in resource.owners };',
+    },
+    {
+        name: "Discretionary",
+        description: "Principal head clause uses `==` to grant access to a specific named entity (no group, no relationship — ad hoc).",
+        example: 'permit (principal == App::Service::"ingest", action == App::Action::"write", resource == App::Bucket::"raw");',
+    },
+    {
+        name: "Hybrid",
+        description: "Policy combines membership in the head clause with a relationship or ABAC predicate in the condition body. Common in production stores.",
+        example: 'permit (principal in App::Role::"editor", action in [App::Action::"write"], resource) when { principal in resource.team };',
+    },
+];
+const NEXT_STEPS_FOR_LLM = `Use this context to produce a Cedar policy change plan. Do not skip these steps:
+
+1. Identify the entity types, attributes, and actions in schema_summary that the user's intent touches. If schema_summary is absent (store_status != "loaded"), state the assumption you are making about the schema and ask the user to confirm. If store_status is "ambiguous", do NOT pick a store silently; ask the user which one from available_stores and re-invoke cedar_advise with an explicit store_ref. If store_status is "not_found" and available_stores is populated, the caller probably mistyped the store name; re-invoke with the corrected name from available_stores. If policy_inventory is empty even though the store loaded, state that the store has no policies yet and confirm with the user before proposing anything other than initial-state policies.
+2. Pick the most appropriate cedar_patterns_reference pattern for the change. If the store already uses a dominant pattern (see patterns_detected_in_store), prefer it for consistency unless the intent requires otherwise.
+3. Sequence steps per sequencing_guidance. Schema changes that add a referenced attribute MUST precede policy changes that read it.
+4. For each step that modifies an existing policy, classify it against avp_update_policy_rules. Effect / principal / resource changes require delete-and-recreate; action and when/unless changes are in-place.
+5. Address every applicable_gotcha in the plan (either by structuring the snippet to avoid it, or by surfacing it as a warning to the user).
+6. After drafting Cedar snippets, call cedar_validate on each to confirm syntax + schema-typing before recommending them. Reading a snippet does not tell you whether the Cedar parser accepts it.
+7. For each modification to an existing policy, call cedar_check_policy_change with the old and new text to confirm the AVP UpdatePolicy classification you assigned.
+8. If the change spans two stores (current vs. proposed), call cedar_diff_policy_stores to check for behavioral drift before recommending deployment.`;
+/**
+ * Build the cedar_advise context bundle.
+ *
+ * Pure function — no sampler, no LLM round-trip. The calling MCP client's
+ * conversation LLM is expected to interpret this bundle and produce the plan.
+ */
+export function handleAdvise(input, manager = storeManager) {
+    const gotchas = selectGotchas(input.intent).map(gotchaToAdvise);
+    const storeView = resolveStoreView(input.store_ref, manager);
+    const bundle = {
+        tool: "cedar_advise",
+        bundle_version: "v2",
+        intent: input.intent,
+        store_name: storeView.store_name,
+        store_status: storeView.store_status,
+        schema_summary: storeView.schema_summary,
+        policy_inventory: storeView.policy_inventory,
+        patterns_detected_in_store: storeView.patterns_detected,
+        applicable_gotchas: gotchas,
+        avp_update_policy_rules: AVP_UPDATE_POLICY_RULES,
+        avp_validation_error_catalog: AVP_VALIDATION_ERRORS.map(e => ({ id: e.id, description: e.description })),
+        cedar_patterns_reference: {
+            summary: CEDAR_PATTERNS_SUMMARY,
+            patterns: CEDAR_PATTERNS_DETAIL,
+        },
+        sequencing_guidance: SEQUENCING_GUIDANCE,
+        next_steps_for_llm: NEXT_STEPS_FOR_LLM,
+    };
+    if (storeView.available_stores)
+        bundle.available_stores = storeView.available_stores;
+    if (storeView.auto_discovered)
+        bundle.auto_discovered = storeView.auto_discovered;
+    return bundle;
+}
+function resolveStoreView(storeRef, manager) {
+    if (!storeRef) {
+        // Round 4 dogfood (Scenario A): with no store_ref, the calling LLM has no
+        // way to learn what stores are loaded short of making a separate tool call
+        // and reading `auto_discovered` off the response. Auto-resolve when the
+        // resolution is unambiguous; surface candidate names otherwise so the
+        // caller can retry with an explicit `store_ref`.
+        const names = manager.listStoreNames();
+        if (names.length === 0) {
+            return { store_status: "not_provided", policy_inventory: [], patterns_detected: [] };
+        }
+        if (names.length === 1) {
+            const onlyStoreName = names[0];
+            const ctx = buildStoreContext(onlyStoreName, manager);
+            if (!ctx) {
+                // 11d audit finding: the single loaded store exists in StoreManager but
+                // cannot be grounded (most often: workspace has policies/ but no
+                // schema.cedarschema or schema.json, so `buildStoreContext` throws
+                // inside readSchema and returns null). Returning `not_found` with the
+                // candidate name is self-referential and triggers the next_steps_for_llm
+                // "re-invoke with corrected name from available_stores" advice, which
+                // loops. Degrade to `not_provided` instead: the bundle still carries
+                // the universal Cedar/AVP context, and the LLM treats it as
+                // store-less rather than as a typo'd ref.
+                return { store_status: "not_provided", policy_inventory: [], patterns_detected: [] };
+            }
+            return {
+                store_name: ctx.store_name,
+                store_status: "loaded",
+                schema_summary: summarizeSchema(ctx.schema_text),
+                policy_inventory: ctx.policy_inventory,
+                patterns_detected: countPatterns(ctx.policy_inventory),
+                auto_discovered: { store_from: "single_loaded_store" },
+            };
+        }
+        return {
+            store_status: "ambiguous",
+            policy_inventory: [],
+            patterns_detected: [],
+            available_stores: names,
+        };
+    }
+    const storeName = resolveStoreRef(storeRef);
+    const ctx = buildStoreContext(storeName, manager);
+    if (!ctx) {
+        const available = manager.listStoreNames();
+        const view = {
+            store_name: storeName,
+            store_status: "not_found",
+            policy_inventory: [],
+            patterns_detected: [],
+        };
+        if (available.length > 0)
+            view.available_stores = available;
+        return view;
+    }
+    return {
+        store_name: ctx.store_name,
+        store_status: "loaded",
+        schema_summary: summarizeSchema(ctx.schema_text),
+        policy_inventory: ctx.policy_inventory,
+        patterns_detected: countPatterns(ctx.policy_inventory),
+    };
+}
+function summarizeSchema(schemaText) {
+    const parsed = parseSchemaInput(schemaText);
+    const answer = checkParseSchema(parsed.schema);
+    if (answer.type === "failure") {
+        return {
+            valid: false,
+            format: parsed.format,
+            namespaces: [],
+            entity_type_count: 0,
+            action_count: 0,
+            raw_text: schemaText,
+            errors: answer.errors.map(e => e.message),
+        };
+    }
+    if (parsed.format === "json") {
+        const counts = summarizeJsonSchema(parsed.schema);
+        return { valid: true, format: parsed.format, raw_text: schemaText, ...counts };
+    }
+    // For cedarschema text, translate to JSON form to derive structural counts.
+    try {
+        const jsonAnswer = schemaToJsonWithResolvedTypes(schemaText);
+        if (jsonAnswer.type === "success") {
+            const counts = summarizeJsonSchema(jsonAnswer.json);
+            return { valid: true, format: parsed.format, raw_text: schemaText, ...counts };
+        }
+    }
+    catch {
+        // fall through to summary-less success
+    }
+    return {
+        valid: true,
+        format: parsed.format,
+        namespaces: [],
+        entity_type_count: 0,
+        action_count: 0,
+        raw_text: schemaText,
+    };
+}
+function parseSchemaInput(schemaStr) {
+    try {
+        return { schema: JSON.parse(schemaStr), format: "json" };
+    }
+    catch {
+        return { schema: schemaStr, format: "cedarschema" };
+    }
+}
+function summarizeJsonSchema(json) {
+    const empty = { namespaces: [], entity_type_count: 0, action_count: 0 };
+    if (!json || typeof json !== "object")
+        return empty;
+    const shape = json;
+    const namespaces = Object.keys(shape);
+    let entity_type_count = 0;
+    let action_count = 0;
+    for (const ns of namespaces) {
+        const block = shape[ns];
+        if (block.entityTypes)
+            entity_type_count += Object.keys(block.entityTypes).length;
+        if (block.actions)
+            action_count += Object.keys(block.actions).length;
+    }
+    return { namespaces, entity_type_count, action_count };
+}
+function countPatterns(inventory) {
+    const counts = new Map();
+    for (const entry of inventory) {
+        counts.set(entry.pattern, (counts.get(entry.pattern) ?? 0) + 1);
+    }
+    return Array.from(counts.entries()).map(([pattern, count]) => ({ pattern, count }));
+}
+function gotchaToAdvise(g) {
+    const advise = {
+        id: g.id,
+        severity: g.severity,
+        description: g.description,
+    };
+    if (g.avp_error_category) {
+        advise.avp_error_category = g.avp_error_category;
+    }
+    return advise;
+}
+//# sourceMappingURL=advise.js.map

package/dist/tools/advise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advise.js","sourceRoot":"","sources":["../../src/tools/advise.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAElG,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEjF,OAAO,EAAE,aAAa,EAAe,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAgB,MAAM,+BAA+B,CAAC;AA6E3E,MAAM,mBAAmB,GAAa;IACpC,gNAAgN;IAChN,kLAAkL;IAClL,oPAAoP;IACpP,uLAAuL;CACxL,CAAC;AAEF,MAAM,uBAAuB,GAAyB;IACpD,OAAO,EAAE,iBAAiB;IAC1B,0BAA0B,EAAE;QAC1B,iDAAiD;QACjD,+BAA+B;QAC/B,oCAAoC;KACrC;IACD,wBAAwB,EAAE;QACxB,0BAA0B;QAC1B,+BAA+B;QAC/B,8BAA8B;QAC9B,sDAAsD;KACvD;IACD,qBAAqB,EAAE;QACrB,iEAAiE;KAClE;IACD,KAAK,EAAE;QACL,2GAA2G;QAC3G,qKAAqK;KACtK;CACF,CAAC;AAEF,MAAM,qBAAqB,GAA8B;IACvD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gHAAgH;QAC7H,OAAO,EAAE,uFAAuF;KACjG;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,sIAAsI;QACnJ,OAAO,EAAE,+HAA+H;KACzI;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kHAAkH;QAC/H,OAAO,EAAE,+GAA+G;KACzH;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,yIAAyI;QACtJ,OAAO,EAAE,4HAA4H;KACtI;CACF,CAAC;AAEF,MAAM,kBAAkB,GAAG;;;;;;;;;sJAS2H,CAAC;AAEvJ;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAkB,EAClB,UAAwB,YAAY;IAEpC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAwB;QAClC,IAAI,EAAE,cAAc;QACpB,cAAc,EAAE,IAAI;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,0BAA0B,EAAE,SAAS,CAAC,iBAAiB;QACvD,kBAAkB,EAAE,OAAO;QAC3B,uBAAuB,EAAE,uBAAuB;QAChD,4BAA4B,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACxG,wBAAwB,EAAE;YACxB,OAAO,EAAE,sBAAsB;YAC/B,QAAQ,EAAE,qBAAqB;SAChC;QACD,mBAAmB,EAAE,mBAAmB;QACxC,kBAAkB,EAAE,kBAAkB;KACvC,CAAC;IACF,IAAI,SAAS,CAAC,gBAAgB;QAAE,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC,gBAAgB,CAAC;IACrF,IAAI,SAAS,CAAC,eAAe;QAAE,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAYD,SAAS,gBAAgB,CAAC,QAA4B,EAAE,OAAqB;IAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,iDAAiD;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,wEAAwE;gBACxE,iEAAiE;gBACjE,mEAAmE;gBACnE,sEAAsE;gBACtE,yEAAyE;gBACzE,sEAAsE;gBACtE,qEAAqE;gBACrE,4DAA4D;gBAC5D,0CAA0C;gBAC1C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;YACvF,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,YAAY,EAAE,QAAQ;gBACtB,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;gBAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACtD,eAAe,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;aACvD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,EAAE;YACpB,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAc;YACtB,UAAU,EAAE,SAAS;YACrB,YAAY,EAAE,WAAW;YACzB,gBAAgB,EAAE,EAAE;YACpB,iBAAiB,EAAE,EAAE;SACtB,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC;QAChD,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,iBAAiB,EAAE,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,EAAE;YACd,iBAAiB,EAAE,CAAC;YACpB,YAAY,EAAE,CAAC;YACf,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IACjF,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;QACjF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,EAAE;QACd,iBAAiB,EAAE,CAAC;QACpB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,UAAU;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AASD,SAAS,mBAAmB,CAAC,IAAa;IAKxC,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,IAAuB,CAAC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,WAAW;YAAE,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAClF,IAAI,KAAK,CAAC,OAAO;YAAE,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,SAAiC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC;IACF,IAAI,CAAC,CAAC,kBAAkB,EAAE,CAAC;QACzB,MAAM,CAAC,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tools/authorize-batch.d.ts

@@ -0,0 +1,35 @@
+export interface AuthorizeBatchInput {
+    policies?: string;
+    policy_ref?: string;
+    /**
+     * Map of policy id -> policy text. Each key becomes the WASM policy_id and
+     * surfaces in `determining_policies` (overridden by an `@id` annotation when
+     * present). The MCP wrapper populates this from `cedar://policies/{store}`
+     * refs so determining_policies reports file basenames (`admin`, `editor`)
+     * instead of positional placeholders (kickoff-14 14a).
+     */
+    policiesMap?: Record<string, string>;
+    schema?: string;
+    schema_ref?: string;
+    requests: string;
+    entities?: string;
+}
+export interface BatchDecision {
+    index: number;
+    principal: string;
+    action: string;
+    resource: string;
+    decision: "Allow" | "Deny" | "Error";
+    determining_policies?: string[];
+    error?: string;
+}
+export interface AuthorizeBatchResult {
+    total: number;
+    allowed: number;
+    denied: number;
+    errored: number;
+    decisions: BatchDecision[];
+    summary: string;
+}
+export declare function handleAuthorizeBatch(input: AuthorizeBatchInput): Promise<AuthorizeBatchResult>;
+//# sourceMappingURL=authorize-batch.d.ts.map

package/dist/tools/authorize-batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-batch.d.ts","sourceRoot":"","sources":["../../src/tools/authorize-batch.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAmN/B"}

package/dist/tools/authorize-batch.js

@@ -0,0 +1,262 @@
+import { isAuthorized } from "@cedar-policy/cedar-wasm/nodejs";
+import { detectFormat, normalizeEntities, normalizePrincipalRef, } from "../utils/format-detector.js";
+import { resolveRef } from "../resources/ref-resolver.js";
+import { buildStaticPolicies } from "./authorize.js";
+// ─── Main handler ──────────────────────────────────────────────────────────────
+export async function handleAuthorizeBatch(input) {
+    // 1. Resolve policies into a Record<PolicyId, Policy> map so determining_policies
+    // returns stable IDs (file basename, @id annotation, or `policy<idx>` fallback)
+    // the same way cedar_authorize already does. policiesMap (populated by the MCP
+    // wrapper from cedar://policies/{store} refs) wins; inline policies text falls
+    // back through buildStaticPolicies' string-split path.
+    let policiesText;
+    let policiesMap = input.policiesMap;
+    if (policiesMap === undefined) {
+        if (input.policies) {
+            policiesText = input.policies;
+        }
+        else if (input.policy_ref) {
+            const resolved = resolveRef(input.policy_ref);
+            if ("error" in resolved) {
+                return zeroResult(`Failed to resolve policy_ref: ${resolved.error}`);
+            }
+            policiesText = resolved.content;
+        }
+        else {
+            return zeroResult("Either policies, policy_ref, or policiesMap is required.");
+        }
+    }
+    const built = buildStaticPolicies({ policies: policiesText, policiesMap });
+    if ("error" in built) {
+        return zeroResult(built.error);
+    }
+    const staticPolicies = built.record;
+    // 2. Resolve schema (optional)
+    let schema;
+    if (input.schema_ref) {
+        const resolved = resolveRef(input.schema_ref);
+        if ("error" in resolved) {
+            return zeroResult(`Failed to resolve schema_ref: ${resolved.error}`);
+        }
+        schema = parseSchema(resolved.content);
+    }
+    else if (input.schema) {
+        schema = parseSchema(input.schema);
+    }
+    // 3. Parse the shared entities (optional baseline; individual requests may override)
+    let sharedEntitiesArray = null;
+    if (input.entities) {
+        const parsed = parseEntitiesString(input.entities);
+        if (parsed === null) {
+            return zeroResult("shared entities must be a valid JSON array or AVP entity_list object");
+        }
+        sharedEntitiesArray = parsed;
+    }
+    // 4. Parse the requests array
+    let rawRequests;
+    try {
+        const parsed = JSON.parse(input.requests);
+        if (!Array.isArray(parsed)) {
+            return zeroResult("requests must be a JSON array");
+        }
+        rawRequests = parsed;
+    }
+    catch {
+        return zeroResult("requests is not valid JSON");
+    }
+    if (rawRequests.length === 0) {
+        return {
+            total: 0,
+            allowed: 0,
+            denied: 0,
+            errored: 0,
+            decisions: [],
+            summary: "0 requests: no requests to evaluate.",
+        };
+    }
+    // 5. Evaluate each request individually
+    const decisions = [];
+    let allowed = 0;
+    let denied = 0;
+    let errored = 0;
+    for (let i = 0; i < rawRequests.length; i++) {
+        const req = rawRequests[i];
+        const principalStr = refToString(req.principal);
+        const actionStr = refToString(req.action);
+        const resourceStr = refToString(req.resource);
+        // 5a. Normalize principal / action / resource refs
+        const principalRef = normalizePrincipalRef(req.principal);
+        if ("error" in principalRef) {
+            decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, principalRef.error));
+            errored++;
+            continue;
+        }
+        const actionRef = normalizePrincipalRef(req.action);
+        if ("error" in actionRef) {
+            decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, actionRef.error));
+            errored++;
+            continue;
+        }
+        const resourceRef = normalizePrincipalRef(req.resource);
+        if ("error" in resourceRef) {
+            decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, resourceRef.error));
+            errored++;
+            continue;
+        }
+        // 5b. Resolve entities: per-request entities take priority over shared entities.
+        let entitiesForCall;
+        const perRequestEntitiesRaw = req.entities !== undefined ? req.entities : null;
+        if (perRequestEntitiesRaw !== null) {
+            const perArr = parseEntitiesValue(perRequestEntitiesRaw);
+            if (perArr === null) {
+                decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, "Invalid entities: must be a JSON array or AVP entity_list object"));
+                errored++;
+                continue;
+            }
+            // Format-detect against the per-request entities
+            const detection = detectFormat(perArr, req.principal, req.action, req.resource);
+            const normalized = normalizeEntities(perArr, detection.format);
+            entitiesForCall = normalized;
+        }
+        else if (sharedEntitiesArray !== null) {
+            // Reuse shared entities — format-detect against this request's refs
+            const detection = detectFormat(sharedEntitiesArray, req.principal, req.action, req.resource);
+            const normalized = normalizeEntities(sharedEntitiesArray, detection.format);
+            entitiesForCall = normalized;
+        }
+        else {
+            // No entities at all — pass empty array (Cedar will evaluate without entity data)
+            entitiesForCall = [];
+        }
+        // 5c. Resolve per-request schema override (rare; falls back to batch schema)
+        let callSchema = schema;
+        if (req.schema !== undefined) {
+            if (typeof req.schema === "string") {
+                callSchema = parseSchema(req.schema);
+            }
+            else {
+                callSchema = req.schema;
+            }
+        }
+        // 5d. Parse context
+        let context = {};
+        if (req.context !== undefined) {
+            if (typeof req.context === "string") {
+                try {
+                    context = JSON.parse(req.context);
+                }
+                catch {
+                    decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, "context is not valid JSON"));
+                    errored++;
+                    continue;
+                }
+            }
+            else if (typeof req.context === "object" && req.context !== null) {
+                context = req.context;
+            }
+        }
+        // 5e. Build the authorization call
+        const call = {
+            principal: principalRef,
+            action: actionRef,
+            resource: resourceRef,
+            context,
+            policies: { staticPolicies },
+            entities: entitiesForCall,
+            ...(callSchema ? { schema: callSchema, validateRequest: true } : {}),
+        };
+        // 5f. Call Cedar WASM
+        const answer = isAuthorized(call);
+        if (answer.type === "failure") {
+            // Cedar returned a hard failure (e.g. schema validation error, entity deserialization error).
+            // This maps to decision "Error" — not a policy Deny.
+            const msg = answer.errors.map((e) => e.message).join("; ");
+            decisions.push(errorDecision(i, principalStr, actionStr, resourceStr, msg));
+            errored++;
+            continue;
+        }
+        const { decision, diagnostics } = answer.response;
+        const isAllow = decision === "allow";
+        decisions.push({
+            index: i,
+            principal: principalStr,
+            action: actionStr,
+            resource: resourceStr,
+            decision: isAllow ? "Allow" : "Deny",
+            determining_policies: diagnostics.reason,
+        });
+        if (isAllow) {
+            allowed++;
+        }
+        else {
+            denied++;
+        }
+    }
+    const total = rawRequests.length;
+    const summary = `${total} request${total === 1 ? "" : "s"}: ${allowed} Allow, ${denied} Deny, ${errored} Error`;
+    return { total, allowed, denied, errored, decisions, summary };
+}
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function parseSchema(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * Parse entities from a JSON string, unwrapping AVP entity_list envelopes.
+ * Returns null on parse failure.
+ */
+function parseEntitiesString(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    return extractEntityArray(parsed);
+}
+/**
+ * Parse entities from an already-parsed value (used for per-request entities
+ * that may be a string or an already-parsed array/object).
+ */
+function parseEntitiesValue(raw) {
+    if (typeof raw === "string") {
+        return parseEntitiesString(raw);
+    }
+    return extractEntityArray(raw);
+}
+/** Unwrap AVP entity_list / entityList / EntityList envelope, or return array as-is. */
+function extractEntityArray(parsed) {
+    if (Array.isArray(parsed))
+        return parsed;
+    if (typeof parsed === "object" && parsed !== null) {
+        const obj = parsed;
+        const list = obj["entity_list"] ?? obj["entityList"] ?? obj["EntityList"];
+        if (Array.isArray(list))
+            return list;
+    }
+    return null;
+}
+function refToString(ref) {
+    if (typeof ref === "string")
+        return ref;
+    return JSON.stringify(ref);
+}
+function errorDecision(index, principal, action, resource, error) {
+    return { index, principal, action, resource, decision: "Error", error };
+}
+function zeroResult(error) {
+    return {
+        total: 0,
+        allowed: 0,
+        denied: 0,
+        errored: 0,
+        decisions: [],
+        summary: error,
+    };
+}
+//# sourceMappingURL=authorize-batch.js.map

package/dist/tools/authorize-batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-batch.js","sourceRoot":"","sources":["../../src/tools/authorize-batch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAiDrD,kFAAkF;AAElF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B;IAE1B,kFAAkF;IAClF,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,uDAAuD;IACvD,IAAI,YAAgC,CAAC;IACrC,IAAI,WAAW,GAAuC,KAAK,CAAC,WAAW,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,OAAO,UAAU,CAAC,iCAAiC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,UAAU,CAAC,0DAA0D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,cAAc,GAA6B,KAAK,CAAC,MAAM,CAAC;IAE9D,+BAA+B;IAC/B,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO,UAAU,CAAC,iCAAiC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,qFAAqF;IACrF,IAAI,mBAAmB,GAAqB,IAAI,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,UAAU,CACf,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,mBAAmB,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED,8BAA8B;IAC9B,IAAI,WAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QACD,WAAW,GAAG,MAAsB,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAE5B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9C,mDAAmD;QACnD,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACxF,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1F,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,iFAAiF;QACjF,IAAI,eAAyB,CAAC;QAC9B,MAAM,qBAAqB,GACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAEnD,IAAI,qBAAqB,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,SAAS,CAAC,IAAI,CACZ,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kEAAkE,CAAC,CAC3H,CAAC;gBACF,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,iDAAiD;YACjD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChF,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/D,eAAe,GAAG,UAAsB,CAAC;QAC3C,CAAC;aAAM,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACxC,oEAAoE;YACpE,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7F,MAAM,UAAU,GAAG,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YAC5E,eAAe,GAAG,UAAsB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,kFAAkF;YAClF,eAAe,GAAG,EAAyB,CAAC;QAC9C,CAAC;QAED,6EAA6E;QAC7E,IAAI,UAAU,GAAuB,MAAM,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,GAAG,CAAC,MAAgB,CAAC;YACpC,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,IAAI,OAAO,GAAmC,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAmC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CACZ,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,CAAC,CACpF,CAAC;oBACF,OAAO,EAAE,CAAC;oBACV,SAAS;gBACX,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACnE,OAAO,GAAG,GAAG,CAAC,OAAyC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,MAAM,IAAI,GAAsB;YAC9B,SAAS,EAAE,YAAY;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,WAAW;YACrB,OAAO;YACP,QAAQ,EAAE,EAAE,cAAc,EAAE;YAC5B,QAAQ,EAAE,eAAe;YACzB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC;QAEF,sBAAsB;QACtB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAElC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,8FAA8F;YAC9F,qDAAqD;YACrD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5E,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,KAAK,OAAO,CAAC;QAErC,SAAS,CAAC,IAAI,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,YAAY;YACvB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACpC,oBAAoB,EAAE,WAAW,CAAC,MAAM;SACzC,CAAC,CAAC;QAEH,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,GAAG,KAAK,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,WAAW,MAAM,UAAU,OAAO,QAAQ,CAAC;IAEhH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC;AAED,iFAAiF;AAEjF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAwB,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAY;IACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CACpB,KAAa,EACb,SAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,KAAa;IAEb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO;QACL,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}