cedar-mcp-server 1.0.0

package/dist/tools/authorize.d.ts

@@ -0,0 +1,115 @@
+import type { Policy, PolicyId } from "@cedar-policy/cedar-wasm/nodejs";
+export interface AuthorizeInput {
+    /** Concatenated Cedar policy text. Mutually exclusive with policiesMap. */
+    policies?: string;
+    /**
+     * Map of policy id -> policy text. Each key becomes the WASM policy_id and
+     * surfaces in determining_policies (overridden by an `@id` annotation when
+     * present). Use this when the caller knows the source filename per policy.
+     */
+    policiesMap?: Record<string, string>;
+    principal: string | Record<string, unknown>;
+    action: string | Record<string, unknown>;
+    resource: string | Record<string, unknown>;
+    entities: string;
+    schema?: string;
+    context?: string;
+    /**
+     * Optional store name to disambiguate workspace auto-discovery (10d) at the
+     * MCP layer. handleAuthorize itself does not consult the StoreManager; the
+     * server.ts handler resolves this and supplies inputs before calling in.
+     */
+    store?: string;
+}
+export type AuthorizeDecisionReason = "permit_policy_fired" | "forbid_policy_fired" | "default_deny_no_permit_matched" | "evaluation_error";
+export interface AuthorizeResult {
+    decision: "Allow" | "Deny";
+    determining_policies: string[];
+    errors: string[];
+    decision_reason?: AuthorizeDecisionReason;
+    format_detected?: string;
+    format_note?: string;
+    error?: string;
+    /**
+     * 10d workspace auto-discovery: populated by the server.ts MCP handler when
+     * one or more inputs were resolved from a loaded MCP root rather than from
+     * inline params. Each subfield names the store that satisfied the missing
+     * input. Surfaces so the caller can trace which store the decision used.
+     */
+    auto_discovered?: {
+        policies_from?: string;
+        schema_from?: string;
+        entities_from?: string;
+    };
+}
+/**
+ * Build a Record<policyId, Policy> from caller input.
+ *
+ * Resolution order for each policy's id:
+ *   1. The @id("name") annotation on the policy (highest priority)
+ *   2. The caller-provided basename (key in policiesMap)
+ *   3. positional "policy<index>" fallback
+ *
+ * For a flat policies string, we split it via policySetTextToParts so each
+ * policy gets its own id rather than collapsing into a single anonymous blob.
+ *
+ * Exported so cedar_authorize_batch can apply the same H1 resolution and
+ * surface the same stable IDs as the single-request handler (kickoff-14 14a).
+ */
+export declare function buildStaticPolicies(input: Pick<AuthorizeInput, "policies" | "policiesMap">): {
+    record: Record<PolicyId, Policy>;
+} | {
+    error: string;
+};
+export declare function handleAuthorize(input: AuthorizeInput): Promise<AuthorizeResult>;
+/**
+ * Inputs accepted by the MCP-level authorize entry point. Wider than
+ * `AuthorizeInput` because it also accepts the `_ref` shapes the MCP layer
+ * resolves before reaching `handleAuthorize`. Kept distinct so the WASM-level
+ * handler does not need to know about MCP plumbing.
+ */
+export interface AuthorizeMcpInput {
+    policies?: string;
+    policy_ref?: string;
+    policiesMap?: Record<string, string>;
+    principal: string | Record<string, unknown>;
+    action: string | Record<string, unknown>;
+    resource: string | Record<string, unknown>;
+    entities?: string;
+    entities_ref?: string;
+    schema?: string;
+    schema_ref?: string;
+    context?: string;
+    store?: string;
+}
+/**
+ * 10d workspace auto-discovery wrapper for `cedar_authorize`.
+ *
+ * Resolves missing policies / schema / entities from the loaded MCP roots,
+ * then delegates to `handleAuthorize`. A single store backs all three so a
+ * call never mixes policies from one workspace with entities from another.
+ *
+ * Multi-store deployments with no explicit `store` parameter surface an
+ * ambiguity error in the `{ error }` envelope. None-loaded falls through to
+ * the "policies / entities required" errors that the MCP layer already used.
+ *
+ * Returns either:
+ *  - `{ result }` -- the AuthorizeResult, with `auto_discovered` set when any
+ *    input was sourced from the workspace.
+ *  - `{ error }`  -- a string error suitable for the standard `{ error: ... }`
+ *    MCP envelope.
+ *
+ * The server.ts handler wraps this and serializes the result back to MCP.
+ * Tests can call it directly after setting up the `storeManager` singleton
+ * with `loadFromRoots([...])`.
+ */
+export declare function handleAuthorizeMcp(input: AuthorizeMcpInput, resolveRef: (uri: string) => {
+    content: string;
+} | {
+    error: string;
+}): Promise<{
+    result: AuthorizeResult;
+} | {
+    error: string;
+}>;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/tools/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../src/tools/authorize.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAIV,MAAM,EACN,QAAQ,EAET,MAAM,iCAAiC,CAAC;AASzC,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,uBAAuB,GAC/B,qBAAqB,GACrB,qBAAqB,GACrB,gCAAgC,GAChC,kBAAkB,CAAC;AAEvB,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,eAAe,CAAC,EAAE;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,GAAG,aAAa,CAAC,GACtD;IAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA4C1D;AA+BD,wBAAsB,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA2GrF;AAID;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,iBAAiB,EACxB,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACnE,OAAO,CAAC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAkI1D"}

package/dist/tools/authorize.js

@@ -0,0 +1,373 @@
+import { isAuthorized, policySetTextToParts, policyToJson } from "@cedar-policy/cedar-wasm/nodejs";
+import { detectFormat, normalizeEntities, normalizePrincipalRef, } from "../utils/format-detector.js";
+import { storeManager } from "../resources/store-manager.js";
+const DENY_RESULT = (error, detection) => ({
+    decision: "Deny",
+    determining_policies: [],
+    errors: [],
+    ...(detection ? { format_detected: detection.format, format_note: detection.note } : {}),
+    error,
+});
+/**
+ * Extract the @id annotation from a single Cedar policy text, if present.
+ * Returns undefined when the policy fails to parse OR when no @id is set.
+ */
+function readIdAnnotation(policyText) {
+    const parsed = policyToJson(policyText);
+    if (parsed.type !== "success")
+        return undefined;
+    const id = parsed.json.annotations?.id;
+    return typeof id === "string" && id.length > 0 ? id : undefined;
+}
+/**
+ * Build a Record<policyId, Policy> from caller input.
+ *
+ * Resolution order for each policy's id:
+ *   1. The @id("name") annotation on the policy (highest priority)
+ *   2. The caller-provided basename (key in policiesMap)
+ *   3. positional "policy<index>" fallback
+ *
+ * For a flat policies string, we split it via policySetTextToParts so each
+ * policy gets its own id rather than collapsing into a single anonymous blob.
+ *
+ * Exported so cedar_authorize_batch can apply the same H1 resolution and
+ * surface the same stable IDs as the single-request handler (kickoff-14 14a).
+ */
+export function buildStaticPolicies(input) {
+    const record = {};
+    const usedIds = new Set();
+    const assignId = (preferredId, fallbackBase) => {
+        let id = preferredId;
+        if (usedIds.has(id)) {
+            // Disambiguate duplicates so the WASM call does not collide.
+            let suffix = 2;
+            while (usedIds.has(`${fallbackBase}-${suffix}`))
+                suffix++;
+            id = `${fallbackBase}-${suffix}`;
+        }
+        usedIds.add(id);
+        return id;
+    };
+    if (input.policiesMap) {
+        for (const [basename, text] of Object.entries(input.policiesMap)) {
+            const annotation = readIdAnnotation(text);
+            const preferred = annotation ?? basename;
+            const id = assignId(preferred, basename);
+            record[id] = text;
+        }
+        return { record };
+    }
+    const text = input.policies ?? "";
+    const parts = policySetTextToParts(text);
+    if (parts.type === "failure") {
+        // Fall through with a single positional entry; downstream isAuthorized
+        // will surface the parse error in the standard errors[] channel.
+        record["policy0"] = text;
+        return { record };
+    }
+    parts.policies.forEach((policyText, idx) => {
+        const annotation = readIdAnnotation(policyText);
+        const fallback = `policy${idx}`;
+        const preferred = annotation ?? fallback;
+        const id = assignId(preferred, fallback);
+        record[id] = policyText;
+    });
+    return { record };
+}
+/**
+ * Classify the authorization outcome into one of four reason codes.
+ * See AuthorizeDecisionReason for the contract.
+ */
+function classifyDecisionReason(decision, determining, errors, staticPolicies) {
+    if (errors.length > 0)
+        return "evaluation_error";
+    if (decision === "Allow")
+        return "permit_policy_fired";
+    // Deny path.
+    if (determining.length === 0)
+        return "default_deny_no_permit_matched";
+    // At least one determining policy fired on a Deny -> a forbid policy.
+    // Verify defensively by checking the policy's effect; if any determining
+    // entry parses as forbid, classify as forbid_policy_fired.
+    for (const id of determining) {
+        const text = staticPolicies[id];
+        if (typeof text !== "string")
+            continue;
+        const parsed = policyToJson(text);
+        if (parsed.type === "success" && parsed.json.effect === "forbid") {
+            return "forbid_policy_fired";
+        }
+    }
+    // Fallback: a determining policy exists on Deny but is not a parseable forbid.
+    return "forbid_policy_fired";
+}
+export async function handleAuthorize(input) {
+    // Parse entities first so we can run format detection.
+    // Also unwrap the AVP SDK entity_list/entityList envelope:
+    //   Ruby SDK:    { entity_list: [...] }
+    //   Python/JS:   { entityList: [...] }
+    //   Official API: { entityList: [...] }
+    // Users sometimes copy the full SDK entities parameter value rather than just the array.
+    let rawEntities;
+    try {
+        const parsed = JSON.parse(input.entities);
+        if (Array.isArray(parsed)) {
+            rawEntities = parsed;
+        }
+        else if (typeof parsed === "object" && parsed !== null) {
+            const obj = parsed;
+            const list = obj["entity_list"] ?? obj["entityList"] ?? obj["EntityList"];
+            if (Array.isArray(list)) {
+                rawEntities = list;
+            }
+            else {
+                throw new Error("not an array");
+            }
+        }
+        else {
+            throw new Error("not an array");
+        }
+    }
+    catch {
+        return DENY_RESULT("entities must be a valid JSON array or an AVP entity_list object");
+    }
+    // Detect format across all inputs together
+    const detection = detectFormat(rawEntities, input.principal, input.action, input.resource);
+    // Normalize entities and principal/action/resource to WASM format
+    const normalizedEntities = normalizeEntities(rawEntities, detection.format);
+    const principalRef = normalizePrincipalRef(input.principal);
+    if ("error" in principalRef)
+        return DENY_RESULT(principalRef.error, detection);
+    const actionRef = normalizePrincipalRef(input.action);
+    if ("error" in actionRef)
+        return DENY_RESULT(actionRef.error, detection);
+    const resourceRef = normalizePrincipalRef(input.resource);
+    if ("error" in resourceRef)
+        return DENY_RESULT(resourceRef.error, detection);
+    if (!input.policies && !input.policiesMap) {
+        return DENY_RESULT("policies or policiesMap is required", detection);
+    }
+    const built = buildStaticPolicies(input);
+    if ("error" in built)
+        return DENY_RESULT(built.error, detection);
+    const staticPolicies = built.record;
+    let schema;
+    if (input.schema) {
+        try {
+            schema = JSON.parse(input.schema);
+        }
+        catch {
+            schema = input.schema;
+        }
+    }
+    let context = {};
+    if (input.context) {
+        try {
+            context = JSON.parse(input.context);
+        }
+        catch {
+            return DENY_RESULT("context must be a valid JSON object", detection);
+        }
+    }
+    const call = {
+        principal: principalRef,
+        action: actionRef,
+        resource: resourceRef,
+        context,
+        policies: { staticPolicies },
+        entities: normalizedEntities,
+        ...(schema ? { schema, validateRequest: true } : {}),
+    };
+    // per spike-report-wasm-api.md §1: type field is "success"|"failure" for WASM health,
+    // decision is "allow"|"deny" for the authorization result
+    const answer = isAuthorized(call);
+    if (answer.type === "failure") {
+        const errorMessages = answer.errors.map((e) => e.message);
+        return {
+            decision: "Deny",
+            determining_policies: [],
+            errors: errorMessages,
+            decision_reason: "evaluation_error",
+            format_detected: detection.format,
+            format_note: detection.note,
+        };
+    }
+    const { decision, diagnostics } = answer.response;
+    const normalizedDecision = decision === "allow" ? "Allow" : "Deny";
+    const determining = diagnostics.reason;
+    const errorMessages = diagnostics.errors.map((e) => e.error.message);
+    return {
+        decision: normalizedDecision,
+        determining_policies: determining,
+        errors: errorMessages,
+        decision_reason: classifyDecisionReason(normalizedDecision, determining, errorMessages, staticPolicies),
+        format_detected: detection.format,
+        format_note: detection.note,
+    };
+}
+/**
+ * 10d workspace auto-discovery wrapper for `cedar_authorize`.
+ *
+ * Resolves missing policies / schema / entities from the loaded MCP roots,
+ * then delegates to `handleAuthorize`. A single store backs all three so a
+ * call never mixes policies from one workspace with entities from another.
+ *
+ * Multi-store deployments with no explicit `store` parameter surface an
+ * ambiguity error in the `{ error }` envelope. None-loaded falls through to
+ * the "policies / entities required" errors that the MCP layer already used.
+ *
+ * Returns either:
+ *  - `{ result }` -- the AuthorizeResult, with `auto_discovered` set when any
+ *    input was sourced from the workspace.
+ *  - `{ error }`  -- a string error suitable for the standard `{ error: ... }`
+ *    MCP envelope.
+ *
+ * The server.ts handler wraps this and serializes the result back to MCP.
+ * Tests can call it directly after setting up the `storeManager` singleton
+ * with `loadFromRoots([...])`.
+ */
+export async function handleAuthorizeMcp(input, resolveRef) {
+    const needsAuto = (!input.policies && !input.policy_ref && !input.policiesMap) ||
+        (!input.schema && !input.schema_ref) ||
+        (!input.entities && !input.entities_ref);
+    let autoStore;
+    if (needsAuto) {
+        if (input.store) {
+            if (!storeManager.getStore(input.store)) {
+                const available = storeManager.listStoreNames().join(", ") || "none";
+                return { error: `Store not found: "${input.store}". Available stores: ${available}.` };
+            }
+            autoStore = input.store;
+        }
+        else {
+            const def = storeManager.getDefaultStore();
+            if (def.kind === "single")
+                autoStore = def.store.name;
+            else if (def.kind === "ambiguous") {
+                return { error: `Multiple stores are loaded (${def.names.join(", ")}). Pass store: "<name>" to choose.` };
+            }
+            // def.kind === "none": leave autoStore undefined and let the
+            // "Either X or X_ref is required" branches below fire.
+        }
+    }
+    // Resolve policy_ref / policies. The cedar://policies/{store} loop pattern
+    // keeps each policy's basename as its determining-policies id rather than
+    // collapsing the set into a single blob.
+    let policies = input.policies;
+    let policiesMap = input.policiesMap;
+    let policiesFrom;
+    if (!policies && !policiesMap && input.policy_ref) {
+        const storeMatch = input.policy_ref.match(/^cedar:\/\/policies\/([^/]+)$/);
+        const singleMatch = input.policy_ref.match(/^cedar:\/\/policies\/([^/]+)\/([^/]+)$/);
+        if (storeMatch) {
+            const storeName = storeMatch[1];
+            try {
+                const ids = storeManager.listPolicies(storeName);
+                policiesMap = {};
+                for (const id of ids)
+                    policiesMap[id] = storeManager.readPolicy(storeName, id);
+            }
+            catch (e) {
+                return { error: e instanceof Error ? e.message : String(e) };
+            }
+        }
+        else if (singleMatch) {
+            const storeName = singleMatch[1];
+            const policyId = singleMatch[2];
+            try {
+                policiesMap = { [policyId]: storeManager.readPolicy(storeName, policyId) };
+            }
+            catch (e) {
+                return { error: e instanceof Error ? e.message : String(e) };
+            }
+        }
+        else {
+            const resolved = resolveRef(input.policy_ref);
+            if ("error" in resolved)
+                return { error: resolved.error };
+            policies = resolved.content;
+        }
+    }
+    if (!policies && !policiesMap && autoStore) {
+        try {
+            const ids = storeManager.listPolicies(autoStore);
+            policiesMap = {};
+            for (const id of ids)
+                policiesMap[id] = storeManager.readPolicy(autoStore, id);
+            policiesFrom = autoStore;
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    if (!policies && !policiesMap)
+        return { error: "Either policies or policy_ref is required" };
+    let schema = input.schema;
+    let schemaFrom;
+    if (!schema && input.schema_ref) {
+        const resolved = resolveRef(input.schema_ref);
+        if ("error" in resolved)
+            return { error: resolved.error };
+        schema = resolved.content;
+    }
+    if (!schema && autoStore) {
+        try {
+            schema = storeManager.readSchema(autoStore);
+            schemaFrom = autoStore;
+        }
+        catch {
+            // Store has no schema file; schema stays undefined (it is optional).
+        }
+    }
+    let entities = input.entities;
+    let entitiesFrom;
+    if (!entities && input.entities_ref) {
+        const resolved = resolveRef(input.entities_ref);
+        if ("error" in resolved)
+            return { error: resolved.error };
+        entities = resolved.content;
+    }
+    if (!entities && autoStore) {
+        // Only claim entities_from if the store actually has an entities/
+        // subdirectory with files. readAllEntities returns "[]" when the
+        // directory is missing, which would otherwise have us lie in
+        // auto_discovered.entities_from about the source of zero entities.
+        try {
+            const entityFiles = storeManager.listEntities(autoStore);
+            if (entityFiles.length > 0) {
+                entities = storeManager.readAllEntities(autoStore);
+                entitiesFrom = autoStore;
+            }
+            else {
+                entities = "[]";
+            }
+        }
+        catch (e) {
+            return { error: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    if (!entities)
+        return { error: "Either entities or entities_ref is required" };
+    const result = await handleAuthorize({
+        policies,
+        policiesMap,
+        principal: input.principal,
+        action: input.action,
+        resource: input.resource,
+        entities,
+        schema,
+        context: input.context,
+    });
+    const autoDiscovered = {};
+    if (policiesFrom)
+        autoDiscovered.policies_from = policiesFrom;
+    if (schemaFrom)
+        autoDiscovered.schema_from = schemaFrom;
+    if (entitiesFrom)
+        autoDiscovered.entities_from = entitiesFrom;
+    if (Object.keys(autoDiscovered).length > 0) {
+        result.auto_discovered = autoDiscovered;
+    }
+    return { result };
+}
+//# sourceMappingURL=authorize.js.map

package/dist/tools/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/tools/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AASnG,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAoD7D,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,SAAiC,EAAmB,EAAE,CAAC,CAAC;IAC1F,QAAQ,EAAE,MAAM;IAChB,oBAAoB,EAAE,EAAE;IACxB,MAAM,EAAE,EAAE;IACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,KAAK;CACN,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAuD;IAEvD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,YAAoB,EAAU,EAAE;QACrE,IAAI,EAAE,GAAG,WAAW,CAAC;QACrB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,6DAA6D;YAC7D,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,MAAM,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;YAC1D,EAAE,GAAG,GAAG,YAAY,IAAI,MAAM,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,UAAU,IAAI,QAAQ,CAAC;YACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,UAAkB,EAAE,GAAW,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,SAAS,GAAG,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,UAAU,IAAI,QAAQ,CAAC;QACzC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,QAA0B,EAC1B,WAAqB,EACrB,MAAgB,EAChB,cAAwC;IAExC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACjD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC;IACvD,aAAa;IACb,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,2DAA2D;IAC3D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QACvC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjE,OAAO,qBAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAqB;IACzD,uDAAuD;IACvD,2DAA2D;IAC3D,wCAAwC;IACxC,uCAAuC;IACvC,wCAAwC;IACxC,yFAAyF;IACzF,IAAI,WAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAkB,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,WAAW,GAAG,MAAM,CAAC;QACvB,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC,kEAAkE,CAAC,CAAC;IACzF,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAE3F,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5E,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,OAAO,IAAI,YAAY;QAAE,OAAO,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE/E,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAEzE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,OAAO,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE7E,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,WAAW,CAAC,qCAAqC,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;IAEpC,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAgB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,KAAK,CAAC,MAAgB,CAAC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAmC,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,WAAW,CAAC,qCAAqC,EAAE,SAAS,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAsB;QAC9B,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,WAAW;QACrB,OAAO;QACP,QAAQ,EAAE,EAAE,cAAc,EAAE;QAC5B,QAAQ,EAAE,kBAA8B;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IAEF,sFAAsF;IACtF,0DAA0D;IAC1D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,aAAa;YACrB,eAAe,EAAE,kBAAkB;YACnC,eAAe,EAAE,SAAS,CAAC,MAAM;YACjC,WAAW,EAAE,SAAS,CAAC,IAAI;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAClD,MAAM,kBAAkB,GAAqB,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC;IACvC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAErE,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,oBAAoB,EAAE,WAAW;QACjC,MAAM,EAAE,aAAa;QACrB,eAAe,EAAE,sBAAsB,CAAC,kBAAkB,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC;QACvG,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,WAAW,EAAE,SAAS,CAAC,IAAI;KAC5B,CAAC;AACJ,CAAC;AAyBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,UAAoE;IAEpE,MAAM,SAAS,GACb,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QAC5D,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QACpC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAA6B,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;gBACrE,OAAO,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,KAAK,wBAAwB,SAAS,GAAG,EAAE,CAAC;YACzF,CAAC;YACD,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;iBACjD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,+BAA+B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,EAAE,CAAC;YAC5G,CAAC;YACD,6DAA6D;YAC7D,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,yCAAyC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACpC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACrF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;gBACjD,WAAW,GAAG,EAAE,CAAC;gBACjB,KAAK,MAAM,EAAE,IAAI,GAAG;oBAAE,WAAW,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,OAAO,IAAI,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC1D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACjD,WAAW,GAAG,EAAE,CAAC;YACjB,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,WAAW,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC/E,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IAE7F,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC5C,UAAU,GAAG,SAAS,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC1D,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC3B,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;gBACnD,YAAY,GAAG,SAAS,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;IAE/E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,QAAQ;QACR,WAAW;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ;QACR,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,cAAc,GAA6E,EAAE,CAAC;IACpG,IAAI,YAAY;QAAE,cAAc,CAAC,aAAa,GAAG,YAAY,CAAC;IAC9D,IAAI,UAAU;QAAE,cAAc,CAAC,WAAW,GAAG,UAAU,CAAC;IACxD,IAAI,YAAY;QAAE,cAAc,CAAC,aAAa,GAAG,YAAY,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,eAAe,GAAG,cAAc,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}

package/dist/tools/check-change.d.ts

@@ -0,0 +1,19 @@
+export interface CheckChangeInput {
+    old_policy: string;
+    new_policy: string;
+}
+export interface PolicyChange {
+    field: "effect" | "principal" | "resource" | "action" | "conditions";
+    old_value?: string;
+    new_value?: string;
+    in_place_allowed: boolean;
+    reason: string;
+}
+export interface CheckChangeResult {
+    can_update_in_place: boolean;
+    changes: PolicyChange[];
+    recommendation: string;
+    error?: string;
+}
+export declare function handleCheckChange(input: CheckChangeInput): Promise<CheckChangeResult>;
+//# sourceMappingURL=check-change.d.ts.map

package/dist/tools/check-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-change.d.ts","sourceRoot":"","sources":["../../src/tools/check-change.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAC;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA2CD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsD3F"}

package/dist/tools/check-change.js

@@ -0,0 +1,91 @@
+import { policyToJson } from "@cedar-policy/cedar-wasm/nodejs";
+const IN_PLACE_RULES = {
+    effect: {
+        allowed: false,
+        reason: "Changing effect (permit ↔ forbid) requires deleting and recreating the policy.",
+    },
+    principal: {
+        allowed: false,
+        reason: "Changing the principal clause requires deleting and recreating the policy.",
+    },
+    resource: {
+        allowed: false,
+        reason: "Changing the resource clause requires deleting and recreating the policy.",
+    },
+    action: {
+        allowed: true,
+        reason: "Action clause changes can be applied in-place.",
+    },
+    conditions: {
+        allowed: true,
+        reason: "Condition clause (when/unless) changes can be applied in-place.",
+    },
+};
+function parsePolicy(text) {
+    const result = policyToJson(text);
+    if (result.type === "failure") {
+        throw new Error(result.errors.map((e) => e.message).join("; "));
+    }
+    return result.json;
+}
+function stringify(v) {
+    return JSON.stringify(v);
+}
+const EMPTY_RESULT = {
+    can_update_in_place: false,
+    changes: [],
+    recommendation: "",
+};
+export async function handleCheckChange(input) {
+    let oldJson;
+    let newJson;
+    try {
+        oldJson = parsePolicy(input.old_policy);
+    }
+    catch (e) {
+        return { ...EMPTY_RESULT, error: `Failed to parse old_policy: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    try {
+        newJson = parsePolicy(input.new_policy);
+    }
+    catch (e) {
+        return { ...EMPTY_RESULT, error: `Failed to parse new_policy: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const changes = [];
+    // Compare each field. Effect is a string; others are structured objects.
+    const fields = [
+        "effect",
+        "principal",
+        "resource",
+        "action",
+        "conditions",
+    ];
+    for (const field of fields) {
+        const oldVal = field === "effect" ? oldJson.effect : oldJson[field];
+        const newVal = field === "effect" ? newJson.effect : newJson[field];
+        if (stringify(oldVal) !== stringify(newVal)) {
+            const rule = IN_PLACE_RULES[field];
+            changes.push({
+                field: field,
+                old_value: stringify(oldVal),
+                new_value: stringify(newVal),
+                in_place_allowed: rule.allowed,
+                reason: rule.reason,
+            });
+        }
+    }
+    const can_update_in_place = changes.every((c) => c.in_place_allowed);
+    let recommendation;
+    if (changes.length === 0) {
+        recommendation = "No changes detected.";
+    }
+    else if (can_update_in_place) {
+        recommendation = "All changes can be applied as an in-place policy update.";
+    }
+    else {
+        const blocking = changes.filter((c) => !c.in_place_allowed).map((c) => c.field);
+        recommendation = `Delete the existing policy and create a new one. The following fields cannot be changed in-place: ${blocking.join(", ")}.`;
+    }
+    return { can_update_in_place, changes, recommendation };
+}
+//# sourceMappingURL=check-change.js.map

package/dist/tools/check-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-change.js","sourceRoot":"","sources":["../../src/tools/check-change.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAuB/D,MAAM,cAAc,GAAyD;IAC3E,MAAM,EAAE;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,gFAAgF;KACzF;IACD,SAAS,EAAE;QACT,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,4EAA4E;KACrF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,2EAA2E;KACpF;IACD,MAAM,EAAE;QACN,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,gDAAgD;KACzD;IACD,UAAU,EAAE;QACV,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,iEAAiE;KAC1E;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,YAAY,GAAqC;IACrD,mBAAmB,EAAE,KAAK;IAC1B,OAAO,EAAE,EAAE;IACX,cAAc,EAAE,EAAE;CACnB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAuB;IAC7D,IAAI,OAAmB,CAAC;IACxB,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,yEAAyE;IACzE,MAAM,MAAM,GAAuC;QACjD,QAAQ;QACR,WAAW;QACX,UAAU;QACV,QAAQ;QACR,YAAY;KACb,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,OAA8C,CAAC,KAAK,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAE,OAA8C,CAAC,KAAK,CAAC,CAAC;QAE5G,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,KAA8B;gBACrC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;gBAC5B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;gBAC5B,gBAAgB,EAAE,IAAI,CAAC,OAAO;gBAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IAErE,IAAI,cAAsB,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,cAAc,GAAG,sBAAsB,CAAC;IAC1C,CAAC;SAAM,IAAI,mBAAmB,EAAE,CAAC;QAC/B,cAAc,GAAG,0DAA0D,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChF,cAAc,GAAG,qGAAqG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/I,CAAC;IAED,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1D,CAAC"}