Iiz %SrSSKrSSKrSSKrSSKrSSKrSSKJrJr SSK J r J r J r J r JrJrJrJrJrJrJrJrJrJrJrJr SSKrSSKrSSKrSSKJr \\R@RB\ S\R@RD4\\R@RF4r$\RJ"S5r&"SS \'5r("S S \'5r)"S S \'5r*\\R@RD\*\R@RB4r+\ S\+4r,\\+\,4r-\\\.\\\.4r/\"S\,S9r0S\1S\/S\ \0/\044Sjr2S\ S\R@RD4S\ S\R@Rf44Sjr4S\+S\+S\+4Sjr5S\+S\+4Sjr60S\R@Rn_S\Rp_S\Rr_S\Rt_S\Rv_S\Rx_S \Rz_S!\4"\R|5_S"\4"\R~5_S#\4"\R5_S$\4"\R5_S%\4"\R5_S&\4"\R5_S'\5_S(\R@R_S)\R@R_S*\R@R_0S+\R_S,\6_S-S._S/S0_S1S2_S3S4_S5ShS6j_S7ShS8j_S9ShS:j_S;ShS<j_S=ShS>j_S?ShS@j_SAShSBj_SCShSDj_SEShSFj_SGShSHj_SI\R@Rf_E\R@R\R@R\R@R\R@R\R@R\R@R\N"S5\R@R\R@R\R@R\NSJ. ErR\\1\,4\SSK'"SLSM5rT\\1\\+SN44rUSOrV"SPSN\ \1\T45rW"SQSR5rX"SSST\RR5r[SU\ SV\R/\ 4S\ SV\R/\ 44SWjr]"SXSV\RR\+5r_\R"SY5raSZS[S\S]S^S_S`SaSbScSd. rbSe\RS\R@R4SfjrdSe\RS\R@R4Sgjreg)ia CEL Interpreter using the AST directly. The general idea is to map CEL operators to Python operators and push the real work off to Python objects defined by the :py:mod:`celpy.celtypes` module. CEL operator "+" is implemented by "_+_" function. We map this to :py:func:`operator.add`. This will then look for `__add__()` methods in the various :py:class:`celpy.celtypes.CELType` types. In order to deal gracefully with missing and incomplete data, exceptions are turned into first-class :py:class:`Result` objects. They're not raised directly, but instead saved as part of the evaluation so that short-circuit operators can ignore the exceptions. This means that Python exceptions like :exc:`TypeError`, :exc:`IndexError`, and :exc:`KeyError` are caught and transformed into :exc:`CELEvalError` objects. The :py:class:`Resut` type hint is a union of the various values that are encountered during evaluation. It's a union of the :py:class:`celpy.celtypes.CELTypes` type and the :exc:`CELEvalError` exception. N)reducewraps)AnyCallableDictIterableIteratorListMappingMatchOptionalSequenceSizedTupleTypeTypeVarUnioncast) tree_dump. evaluationc P^\rSrSrSrS S\S\\S\\SS4U4SjjjrS r U=r $) CELSyntaxErrorBz@CEL Syntax error -- the AST did not have the expected structure.Narglinecolumnreturnc<>[TU]U5 X lX0lgNsuper__init__rrselfrrr __class__s 6/venv/lib/python3.13/site-packages/celpy/evaluation.pyr"CELSyntaxError.__init__D   rrNN) __name__ __module__ __qualname____firstlineno____doc__rr intr"__static_attributes__ __classcell__r%s@r&rrBs5JCx}Xc]^br)rc@^\rSrSrSrS\S\S\SS4U4SjjrS rU=r $) CELUnsupportedErrorJz2Feature unsupported by this implementation of CEL.rrrrNc<>[TU]U5 X lX0lgrr r#s r&r"CELUnsupportedError.__init__Lr(r)r*) r,r-r.r/r0rr1r"r2r3r4s@r&r6r6Js,<CsCDr)r6c ^\rSrSrSrSSS.S\S\\RS\\RSS4U4S jjjr S\ 4S jr S \SS4U4S jjr S S jrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\SS4SjrS\S\4SjrS\SS4SjrSr U=r!$)! CELEvalErrorRaCEL evaluation problem. This can be saved as a temporary value for later use. This is politely ignored by logic operators to provide commutative short-circuit. We provide operator-like special methods so an instance of an error returns itself when operated on. N)treetokenargsr=r>rc>[TU]"U6 XlX lSUlSUlUR(aJURR RUlURR R UlUR(a7URRUlURR Ulggr)r!r"r=r>rrmeta)r$r=r>r?r%s r&r"CELEvalError.__init__Ys $  #' %) 99 ++DI))..//DK :: DI**++DK r)cxURRnUR(aHUR(a7USURS[ UR5<SUR<S3$UR(a)USURS[ UR5<S3$USURS3$)N(*z, tree=z, token=))r%r,r=r>r?r)r$clss r&__repr__CELEvalError.__repr__jsnn%% 99%r$))GIdii,@+C8DJJ>YZ[ YYU"TYYKwy/C.FaH HU"TYYKq) )r)tbc">[TU]U5$r)r!with_traceback)r$rIr%s r&rKCELEvalError.with_tracebackwsw%b))r)cU$rr$s r&__neg__CELEvalError.__neg__z r)othercU$rrNr$rSs r&__add__CELEvalError.__add__}rRr)cU$rrNrUs r&__sub__CELEvalError.__sub__rRr)cU$rrNrUs r&__mul__CELEvalError.__mul__rRr)cU$rrNrUs r& __truediv__CELEvalError.__truediv__rRr)cU$rrNrUs r& __floordiv__CELEvalError.__floordiv__rRr)cU$rrNrUs r&__mod__CELEvalError.__mod__rRr)cU$rrNrUs r&__pow__CELEvalError.__pow__rRr)cU$rrNrUs r&__radd__CELEvalError.__radd__rRr)cU$rrNrUs r&__rsub__CELEvalError.__rsub__rRr)cU$rrNrUs r&__rmul__CELEvalError.__rmul__rRr)cU$rrNrUs r& __rtruediv__CELEvalError.__rtruediv__rRr)cU$rrNrUs r& __rfloordiv__CELEvalError.__rfloordiv__rRr)cU$rrNrUs r&__rmod__CELEvalError.__rmod__rRr)cU$rrNrUs r&__rpow__CELEvalError.__rpow__rRr)cj[U[5(aURUR:H$[$r) isinstancer;r?NotImplementedrUs r&__eq__CELEvalError.__eq__s( e\ * *99 * *r)cU$rrN)r$r?s r&__call__CELEvalError.__call__rRr))rrr>r=)rr;)"r,r-r.r/r0rr larkTreeTokenr"strrGrKrPrVrYr\r_rbrerhrkrnrqrtrwrzr}boolrrr2r3r4s@r&r;r;Rs)-*. ,,499%,DJJ' ,48 ,," *# ****S^S^S^#.S^S^cncncn#.3>cncnCD cnr)r; TargetFunc)boundnew_text exc_classrc4^^S[S[4UU4SjjnU$)a Wrap a function to transform native Python exceptions to CEL CELEvalError values. Any exception of the given class is replaced with the new CELEvalError object. :param new_text: Text of the exception, e.g., "divide by zero", "no such overload") this is the return value if the :exc:`CELEvalError` becomes the result. :param exc_class: A Python exception class to match, e.g. ZeroDivisionError, or a sequence of exception classes (e.g. (ZeroDivisionError, ValueError)) :return: A decorator that can be applied to a function to map Python exceptions to :exc:`CELEvalError` instances. This is used in the ``all()`` and ``exists()`` macros to silently ignore TypeError exceptions. functionrc>^[T5S[RRS[RRS[4UUU4Sjj5n[ [ U5$)Nr?kwargsrc >T"U0UD6$!Tan[RTRSUSUSU35 [R"5u p4[ TUR UR5RU5nX%l UsSnA$SnAf[a* [RTRSUSUS35 ef=f)NrDz, **) --> rE) loggerdebugr,sysexc_infor;r%r?rK __cause__ Exceptionerror) r?rex_rIvaluerrrs r& new_function.concrete_decorator..new_functions 000   1 12"TF$vhfRDQR<<>1$Xr||RWWETTUWX"$    1 12"TF$vhaHI s CA9B C7C)rcelpyceltypesValueResultrr)rrrrs` r&concrete_decorator&eval_error..concrete_decoratorsW x  4 4 @T@T Y_    J --r))r)rrrs`` r& eval_errorrs#.Z.J.. r)rc^[T5S[RRS[RRS[RR4U4Sjj5nU$)z Wraps boolean operators to create CEL BoolType results. :param function: One of the operator.lt, operator.gt, etc. comparison functions :return: Decorated function with type coercion. abrc>T"X5nU[:Xa$[[RRU5$[RR [ U55$r)rrrrBoolTyper)rrresultrs r& bool_functionboolean..bool_functionsD! ^ #//8 8~~&&tF|44r))rrrrr)rrs` r&booleanrsV 8_5--5%..2F2F55>>KbKb55 r)item containerc [RRS5n[[[ U5H*nX0:Xa![RRS5s $M, [RSU<SU<SU<35 U$![ aJn[RSUSUSU35 [SURUR5nSnAMSnAff=f) a7 CEL contains test; ignores type errors. During evaluation of ``'elem' in [1, 'elem', 2]``, CEL will raise internal exceptions for ``'elem' == 1`` and ``'elem' == 2``. The :exc:`TypeError` exceptions are gracefully ignored. During evaluation of ``'elem' in [1u, 'str', 2, b'bytes']``, however, CEL will raise internal exceptions every step of the way, and an exception value is the final result. (Not ``False`` from the one non-exceptional comparison.) It would be nice to make use of the following:: eq_test = eval_error("no such overload", TypeError)(lambda x, y: x == y) It seems like ``next(iter(filter(lambda x: eq_test(c, x) for c in container))))`` would do it. But. It's not quite right for the job. There need to be three results, something :py:func:`filter` doesn't handle. These are the chocies: - True. There was a item found. Exceptions may or may not have been found. - False. No item found AND no expceptions. - CELEvalError. No item found AND at least one exception. To an extent this is a little like the ``exists()`` macro. We can think of ``container.contains(item)`` as ``container.exists(r, r == item)``. However, exists() tends to silence exceptions, where this can expost them. .. todo:: This may be better done as ``reduce(logical_or, (item == c for c in container), BoolType(False))`` FTz operator_in(, rno such overloadN) = ) rrrrrr TypeErrorrrr;r%r?)rrrcrs r& operator_inrsD^^,,U3F (6"I . My~~..t44/ LL<xr)d6*EF M  M LL<vR {&E F!"4bllBGGLF Ms#B C?CCcUc[RRS5$[[U5n[RR[ U55n[ RSU<SU<35 U$)a The size() function applied to a Value. Delegate to Python's :py:func:`len`. (string) -> int string length (bytes) -> int bytes length (list(A)) -> int list size (map(A, B)) -> int map size For other types, this will raise a Python :exc:`TypeError`. (This is captured and becomes an :exc:`CELEvalError` Result.) .. todo:: check container type for celpy.celtypes.StringType, celpy.celtypes.BytesType, celpy.celtypes.ListType and celpy.celtypes.MapType rzfunction_size(r)rrIntTyperrlenrr)rsized_containerrs r& function_sizer(sb~~%%a((5),O ^^ # #C$8 9F LL>)d6*=> Mr)!_-__+__-__*__/__%__<__<=__>=__>__==__!=__in__||__&&__?_:__[_]sizeendsWithc^[RRURU55$r)rrrendswithstexts r&rUs 7 7 48H Ir) startsWithc^[RRURU55$r)rrr startswithrs r&rrVs%.."9"9!,,t:L"Mr)matchescl[RR[R"X5SL5$r)rrrresearch)rpatterns r&rrWs"%.."9"9"))G:OW[:["\r)containscD[RRX;5$r)rrrrs r&rrXs 7 7 Br)getDatec^[RRURU55$r)rrrrtstz_names r&rrZs(>(>rzz'?R(Sr) getDayOfMonthc^[RRURU55$r)rrrrrs r&rr[senn.D.DREUEUV]E^._r) getDayOfWeekc^[RRURU55$r)rrrrrs r&rr\U^^-C-CBOOT[D\-]r) getDayOfYearc^[RRURU55$r)rrrrrs r&rr]rr) getFullYearc^[RRURU55$r)rrrrrs r&rr^sENN,B,B2>>RYCZ,[r)getMonthc^[RRURU55$r)rrrrrs r&rr_)?)? G@T)Ur)getHoursc^[RRURU55$r)rrrrrs r&rrarr)getMillisecondsc^[RRURU55$r)rrrrrs r&rrbs0F0FrGYGYZaGb0cr) getMinutesc^[RRURU55$r)rrrrrs r&rrc5>>+A+A"--PWBX+Yr) getSecondsc^[RRURU55$r)rrrrrs r&rrdrr)r) bytesdoubledurationr1listmap null_typestring timestampuinttypebase_functionsc\rSrSrSrS S\\SS4SjjrS\4Sjr \ S\ \\ RR\\S44S j5r\R$S\ \\ RR\\S4SS4S j5rSS jrS rg)Referentiua8 A Name can refer to any of the following things: - Annotations -- initially most names are these or a CELFunction that may implement a type. Must be provided as part of the initialization. - NameContainer -- some names are these. This is true when the name is *not* provided as part of the initialization because we discovered the name during type or environment binding. - celpy.celtypes.Value -- many annotations also have values. These are provided **after** Annotations, and require them. - CELEvalError -- This seems unlikely, but we include it because it's possible. - Functions -- All of the type conversion functions are names in a NameContainer. A name can be ambiguous and refer to both a nested ``NameContainer`` as well as a ``celpy.celtypes.Value`` (usually a MapType instance.) Object ``b`` has two possible meanings: - ``b.c`` is a NameContainer for ``c``, a string. - ``b`` is a mapping, and ``b.c`` is syntax sugar for ``b['c']``. The "longest name" rule means that the useful value is the "c" object in the nested ``NameContainer``. The syntax sugar interpretation is done in the rare case we can't find the ``NameContainer``. >>> nc = NameContainer("c", celpy.celtypes.StringType) >>> b = Referent(celpy.celtypes.MapType) >>> b.value = celpy.celtypes.MapType({"c": "oops"}) >>> b.value == celpy.celtypes.MapType({"c": "oops"}) True >>> b.container = nc >>> b.value == nc True In effect, this class is :: Referent = Union[ Annotation, celpy.celtypes.Value, CELEvalError, CELFunction, ] Nref_torcXSUlSUlSUlSUlU(aXlgg)NF) annotationr_value _value_setr$r s r&r"Referent.__init__s41548 $   $O r)cURRSUR<SUR<SUR<S3$)Nz (annotation=z , container=z , _value=rE)r%r,r rrrOs r&rGReferent.__repr__sG~~&&'|DOO3FG*+kk_A ' r) NameContainercURb UR$UR(a UR$UR$)z The longest-path rule means we prefer ``NameContainer`` over any locally defined value. Otherwise, we'll provide a value if there is one. Finally, we'll provide the annotation if there's no value. :return: )rrrr rOs r&rReferent.values5 >> %>> ! __;; ?? "r)cXlSUlg)NT)rrrs r&rrs  r)c[UR5nURUlURUlURUlU$r)r r rrr)r$news r&cloneReferent.clones6t' [[  r))rrr rr)rr )r,r-r.r/r0r Annotationr"rrGpropertyrrrrr; CELFunctionrsetterrr2rNr)r&r r us1h,0%Z(% %" # #u ,,lK XZ##  \\ENN00, _\^  r)r rz[_a-zA-Z][_a-zA-Z0-9]*c ^\rSrSrSr\R "\5r\R "S\S\S35r \ R"S5r SS\ \S\ \S \ SS S4U4S jjjrS \\\4S S4S jrS\S S4Sjr"SS\5r\S\\\4S\\S \4Sj5rS\\S \S\44SjrS \S4Sjr S\ \S\S \4Sjr!SSjr"S \4Sjr#Sr$U=r%$)ria A namespace that fulfills the CEL name resolution requirement. :: Scenario: "qualified_identifier_resolution_unchecked" "namespace resolution should try to find the longest prefix for the evaluator." NameContainer instances can be chained (via parent) to create a sequence of searchable locations for a name. - Local-most is an Activation with local variables within a macro. These are part of a nested chain of Activations for each macro. Each local activation is a child with a reference to the parent Activation. - Parent of any local Activation is the overall Activation for this CEL evaluation. The overall Activation contains a number of NameContainers: - The global variable bindings. - Bindings of function definitions. This is the default set of functions for CEL plus any add-on functions introduced by C7N. - The run-time annotations from the environment. There are two kinds: - Protobuf message definitions. These are types, really. - Annotations for global variables. The annotations tend to be hidden by the values. They're in the lookup chain to simplify access to protobuf messages. - The environment also provides the built-in type names and aliases for the :mod:`celtypes` package of built-in types. This means name resolution marches from local-most to remote-most, searching for a binding. The global variable bindings have a local-most value and a more remote annotation. The annotations (i.e. protobuf message types) have only a fairly remote annotation without a value. Structure. A NameContainer is a mapping from names to Referents. A Referent can be one of three things. - A NameContainer further down the path - An Annotation - An Annotation with a value. Loading Names. There are several "phases" to building the chain of ``NameContainer`` instances. 1. The ``Activation`` creates the initial ``name : annotation`` bindings. Generally, the names are type names, like "int", bound to :py:class:`celtypes.IntType`. In some cases, the name is a future variable name, "resource", bound to :py:class:`celtypes.MapType`. 2. The ``Activation`` creates a second ``NameContainer`` that has variable names. This has a reference back to the parent to resolve names that are types. This involves decomposing the paths of names to make a tree of nested ``NameContainers``. Upper-level containers don't (necessarily) have types or values -- they're merely ``NameContainer`` along the path to the target names. Resolving Names. See https://github.com/google/cel-spec/blob/master/doc/langdef.md#name-resolution There are three cases required in the :py:class:`Evaluator` engine. - Variables and Functions. These are ``Result_Function`` instances: i.e., ordinary values. - ``Name.Name`` can be navigation into a protobuf package, when ``Name`` is protobuf package. The idea is to locate the longest possible match. If a.b is a name to be resolved in the context of a protobuf declaration with scope A.B, then resolution is attempted, in order, as A.B.a.b, A.a.b, and finally a.b. To override this behavior, one can use .a.b; this name will only be attempted to be resolved in the root scope, i.e. as a.b. - ``Name.Name`` can be syntactic sugar for indexing into a mapping when ``Name`` is a value of ``MapType`` or a ``MessageType``. It's evaluated as if it was ``Name["Name"]``. This is a fall-back plan if the previous resolution failed. The longest chain of nested packages *should* be resolved first. This will happen when each name is a ``NameContainer`` object containing other ``NameContainer`` objects. The chain of evaluations for ``IDENT . IDENT . IDENT`` is (in effect) :: member_dot(member_dot(primary(IDENT), IDENT), IDENT) This makes the ``member_dot` processing left associative. The ``primary(IDENT)`` resolves to a CEL object of some kind. Once the ``primary(IDENT)`` has been resolved, it establishes a context for subsequent ``member_dot`` methods. - If this is a ``MapType`` or a ``MessageType`` with an object, then ``member_dot`` will pluck out a field value and return this. - If this is a ``NameContainer`` or a ``PackageType`` then the ``member_dot`` will pluck out a sub-package or ``EnumType`` or ``MessageType`` and return the type object instead of a value. At some point a ``member_object`` production will build an object from the type. The evaluator's :meth:`ident_value` method resolves the identifier into the ``Referent``. Acceptance Test Case We have two names - `a.b` -> NameContainer in which c = "yeah". (i.e., a.b.c : "yeah") - `a.b` -> Mapping with {"c": "oops"}. This means any given name can have as many as three meanings: - Primarily as a NameContainer. This resolves name.name.name to find the longest namespace possible. - Secondarily as a Mapping. This will be a fallback when name.name.name is really syntactic sugar for name.name['name']. - Finally as a type annotation. z^\.?z(?:\.z)*$Nnamer parentrcl>U(aU(a[TU]X05 O[TU]5 X0lgr)r!r"r")r$r!r r"r%s r&r"NameContainer.__init__os) F G d^ , G  /5 r)namescUR5Hup#URRSU<SU<35 URR U5(d[ SU35eUnUR RU5GtpVUHNnURU[55nURc[URS9Ul URnMP URU[U55 M g)a Used by an ``Activation`` to build a container used to resolve long path names into nested NameContainers. Sets annotations for all supplied identifiers. ``{"name1.name2": annotation}`` becomes two things: 1. nc2 = NameContainer({"name2" : Referent(annotation)}) 2. nc1 = NameContainer({"name1" : Referent(nc2)}) :param names: A dictionary of {"name1.name1....": Referent, ...} items. zload_annotations  : Invalid name Nr") itemsrinfoextended_name_pathmatch ValueError ident_patfindall setdefaultr rrr")r$r%r! refers_tocontextpathfinalrefs r&load_annotationsNameContainer.load_annotations{s" %{{}OD KK  0I=I J**0066 =!788G >>11$7LT((xz:==($1$ECM--    uhy&9 : -r)valuescUR5Hup#URRSU<SU<35 URR U5(d[ SU35eUnUR RU5GtpVUHNnURU[55nURc[URS9Ul URnMP URU[55 X4Ul M g)z&Update annotations with actual values.z load_values r'r(Nr))r*rr+r,r-r.r/r0r1r rrr"r)r$r9r!r2r3r4r5r6s r& load_valuesNameContainer.load_valuess%||~OD KK  |D83ymD E**0066 =!788G >>11$7LT((xz:==($1$ECM--    uhj 1#,EN ! .r)c\rSrSrSrSrg)NameContainer.NotFoundiz Raised locally when a name is not found in the middle of package search. We can't return ``None`` from find_name because that's a valid value. rNN)r,r-r.r/r0r2rNr)r&NotFoundr>s   r)r? some_dictr4cJU(a7Utp#[R[[[[ 4X5U5$[[U5$![ aI [RRU<SUR535 [RU5ef=f)z Extension to navgiate into mappings, messages, and packages. :param some_dict: An instance of a MapType, MessageType, or PackageType. :param path: names to follow into the structure. :returns: Value found down inside the structure.  not found in ) rdict_find_namerrrr KeyErrorrrkeysr?r)r@r4headtails r&rCNameContainer.dict_find_names KD 3$33c8m,io> * *  3$$**dX^INNDTCU+VW#,,T22 3s 2AAB"cpU(aUtp#XRn[U[ 5(aURU5$[U[RR[RR[RR[45(a3[ R[!["[$[&4U5U5nU$[![ U5$U$![aE URRU<SUR 535 [ R U5ef=f)z Find the name by searching down through nested packages or raise NotFound. This is a kind of in-order tree walk of contained packages. rB)rrDrrrErr?r find_namerr MessageTypeMapType PackageTypedictrCrrrr )r$r4rFrG sub_contextrs r&rJNameContainer.find_names KD 3"j.. +}55",,T22^^//1G1G^^//78E7S7Sc8m,k:8 M;77K- 3 !!THN499;-"HI#,,T22 3s C&&AD5c#x# Uv URb#URR5ShvN ggN7f)zFYield this NameContainer and all of its parents to create a flat list.N)r" parent_iterrOs r&rRNameContainer.parent_iters2 ;; "{{..0 0 0 # 0s /:8:packagec URRSU<SU<SUR5SUR35 U(a URR U5S/-nOS/n/nU(dU(azUSSnUR 5H,nX2/-nURU5nURXg45 M. URRSUS U<S U35 U(d U(aMzU(d [U5e[US S 9up[[U 5$![Ra Mf=f) a Search with less and less package prefix until we find the thing. Resolution works as follows. If a.b is a name to be resolved in the context of a protobuf declaration with scope A.B, then resolution is attempted, in order, as 1. A.B.a.b. (Search for "a" in paackage "A.B"; the ".b" is handled separately.) 2. A.a.b. (Search for "a" in paackage "A"; the ".b" is handled separately.) 3. (finally) a.b. (Search for "a" in paackage None; the ".b" is handled separately.) To override this behavior, one can use .a.b; this name will only be attempted to be resolved in the root scope, i.e. as a.b. We Start with the longest package name, a ``List[str]`` assigned to ``target``. Given a target, search through this ``NameContainer`` and all parents in the :meth:`parent_iter` iterable. The first name we find in the parent sequence is the goal. This is because values are first, type annotations are laast. If we can't find the identifier with given package target, truncate the package name from the end to create a new target and try again. This is a bottom-up look that favors the longest name. :param package: Prefix string "name.name.name" :param name: The variable we're looking for :return: Name resolution as a Rereferent, often a value, but maybe a package or an annotation. z resolve_name(.z) in , parent=Nzresolve_name: target=z+[z ], matches=c[US5$Nr)r) path_values r&r,NameContainer.resolve_name..2s #jm:Lr))key)rr+rEr"r/r0rRrJappendrr?rrDmaxrr ) r$rTr!targetrp package_identr-r4rs r& resolve_nameNameContainer.resolve_names1J G;axuTYY[M4;;- X  ^^++G4t;FTFJLfCR[F%%'/5M<=KK ? ?    ( ( .r)cz[5nURUlURR5UlU$)zH Create a clone of this activation with a deep copy of the identifiers. )rtrTrzr)r$rs r&rActivation.clones2    ,,224 r)c2[UUUURS9nU$)a= Create a nested sub-Activation that chains to the current activation. The sub-activations don't have the same implied package context, :param annotations: Variable type annotations :param vars: Variables with literals to be converted to the desired types. :return: An ``Activation`` that chains to this Activation. )rurvr"rT)rtrT)r$rurvrs r&nested_activationActivation.nested_activations%#LL    r)r!cURRUR[U55n[ [ [ [4U5$)a0Find the object referred to by the name. An Activation usually has a chain of NameContainers to be searched. A variable can refer to an annotation and/or a value and/or a nested container. Most of the time, we want the `value` attribute of the Referent. This can be a Result (a Union[Value, CelType]) )rzrdrTrrrrr)r$r!container_or_values r&resolve_variableActivation.resolve_variables="--::4<<TSE&-/02DEEr)c URRSURR<SUR<SUR<SURRS3 $)Nz (annotations=rxryrWrE)r%r,rzr"rTrOs r&rGActivation.__repr__si~~&&'D,,3367||&'$$'(&&--.a  1 r))rzrT)NNNN)rrtr+)r,r-r.r/r0r r rrrqr"rrrrrrrGr2rNr)r&rtrt?s?F?C%)&*-1 +/!'#z/":;+/c]+/7# +/ \* +/  +/Z?C&*!'#z/":;7#  * FS FU6=3H-I F # r)rtc\rSrSrSrS SjrS\RSS4Sjr\ S\ SS\RS\ \ 4S j5r S rg) FindIdentizLocate the ident token at the bottom of an AST. This is needed to find the bind variable for macros. It works by doing a "visit" on the entire tree, but saving the details of the ``ident`` nodes only. rNcSUlgr ident_tokenrOs r&r"FindIdent.__init__s *.r)r=ct[[RURS5nURUlgr[)rrrchildrenrr)r$r=rs r&identFindIdent.idents)4::t}}Q'78 &,,r)rFcP[5nURU5 UR$r)rvisitr)rFr=fis r&in_treeFindIdent.in_trees [ ~~r)r)rN)r,r-r.r/r0r"rrr classmethodrr rrr2rNr)r&rrsY/-$))--T+&diiHSMr)rmethod Evaluatorcd^[T5SSS[RS[4U4Sjj5nU$)z Decorator to create consistent evaluation trace logging. This only works for a class with a ``level`` attribute. This is generally applied to the methods matching rule names. r$rr=rc>URRURS-U<35 T"X5nURRURS-URSU<35 U$)Nz| z -> )rr+leveldata)r$r=rrs r&concrete_methodtrace..concrete_methodsd DJJtO,TH56# DJJtO,TYYKtF:FG r))rrrr)rrs` r&tracers< 6]ks r)c N^\rSrSrSr\R "S5rS/S\RS\ S\ \ \ \\\ 4S4SS4SjjrS\RSS4S jrS \SS4S jrS0S \S \S\4SjjrS\R0R24SjrS\RS\\4U4SjjrS/S\R<S\\ \S\4Sjjr!S/S\S\R<S\\ \S\4Sjjr"S\RS\R0RF4Sjr$\%S\RS\4Sj5r&\%S\RS\4Sj5r'\%S\RS\4Sj5r(\%S\RS\4Sj5r)\%S\RS\4Sj5r*\%S\RS\4Sj5r+\%S\RS\4Sj5r,S \RS\-\R0R2/\.44S!jr/S \RS\-\R0R2/\.44S"jr0S \RS\1\-\\/\4\R44S#jr2\%S\RS\4S$j5r3\%S\RS\4S%j5r4\%S\RS\4S&j5r5\%S\RS\4S'j5r6\%S\RS\4S(j5r7\%S\RS\4S)j5r8\%S\RS\4S*j5r9\%S\RS\4S+j5r:\%S\RS\4S,j5r;\%S\RS\4S-j5r$)1ria Evaluate an AST in the context of a specific Activation. See https://github.com/google/cel-go/blob/master/examples/README.md General Evaluation. An AST node must call ``self.visit_children(tree)`` explicitly to build the values for all the children of this node. Exceptions. To handle ``2 / 0 || true``, the ``||``, ``&&``, and ``?:`` operators do not trivially evaluate and raise exceptions. They bottle up the exceptions and treat them as a kind of undecided value. Identifiers. Identifiers have three meanings: - An object. This is either a variable provided in the activation or a function provided when building an execution. Objects also have type annotations. - A type annotation without an object, This is used to build protobuf messages. - A macro name. The ``member_dot_arg`` construct may have a macro. Plus the ``ident_arg`` construct may also have a ``dyn()`` or ``has()`` macro. See below for more. Other than macros, a name maps to an ``Referent`` instance. This will have an annotation and -- perhaps -- an associated object. Names have nested paths. ``a.b.c`` is a mapping, ``a``, that contains a mapping, ``b``, that contains ``c``. **MACROS ARE SPECIAL**. The macros do not **all** simply visit their children to perform evaluation. There are three cases: - ``dyn()`` does effectively nothing. It visits it's children, but also provides progressive type resolution through annotation of the AST. - ``has()`` attempts to visit the child and does a boolean transformation on the result. This is a macro because it doesn't raise an exception for a missing member item reference, but instead maps an exception to False. It doesn't return the value found, for a member item reference; instead, it maps this to True. - The various ``member.macro()`` constructs do **NOT** visit children. They create a nested evaluation environment for the child variable name and expression. The :py:meth:`member` method implements the macro evaluation behavior. It does not **always** trivially descend into the children. In the case of macros, the member evaluates one child tree in the presence of values from another child tree using specific variable binding in a kind of stack frame. Nast activation functionsrc6XlX lURUlU [U[5(aFU=(d /Vs0sHoDR U_M nn[ R"U[5Ul OA[U[5(a![ R"U[5Ul O [Ul SUl URRSUR<35 URRSUR<35 gs snf)af Create an evaluator for an AST with specific variables and functions. :param ast: The AST to evaluate. :param activation: The variable bindings to use. :param functions: The functions to use. If nothing is supplied, the default global `base_functions` are used. Otherwise a ChainMap is created so these local functions override the base functions. rz activation: functions: N)rbase_activationrrrr, collectionsChainMaprrr rrr+)r$rrrflocal_functionss r&r"Evaluator.__init__Hs).. i * *'0B'6! A  )11/>RDN  7 + +(11)^LDN+DN  <':;< ;t~~&89:sDc>[XRURS9$)z Build an evaluator for a sub-expression in a macro. :param ast: The AST for the expression in the macro. :return: A new `Evaluator` instance. )rr)rrr)r$rs r& sub_evaluatorEvaluator.sub_evaluatoris DNNSSr)r9cURR5UlURRR U5 UR R SUR<35 U$)z Chain a new activation using the given Context. This is used for two things: 1. Bind external variables like command-line arguments or environment variables. 2. Build local variable(s) for macro evaluation. z Activation: )rrrrzr;rr+)r$r9s r&set_activationEvaluator.set_activationqsU..446 ##//7 <':;< r)r! root_scopec[[URRU55$![a UR Us$f=f)aResolve names in the current activation. This includes variables, functions, the type registry for conversions, and protobuf packages, as well as protobuf types. We may be limited to root scope, which prevents searching through alternative protobuf package definitions. )rrrrrDr)r$r!rs r& ident_valueEvaluator.ident_valuesA ( @ @ FG G (>>$' ' (s(+AAcURUR5n[U[5(aUe[ [ R RU5$)a0 Evaluate this AST and return the value or raise an exception. There are two variant use cases. - External clients want the value or the exception. - Internally, we sometimes want to silence CELEvalError exceptions so that we can apply short-circuit logic and choose a non-exceptional result. )rrrr;rrrr)r$rs r&evaluateEvaluator.evaluates? 488$ e\ * *KENN((%00r)r=cz>U=RS- sl[TU] U5nU=RS-slU$)zOExtend the superclass to track nesting and current evaluation context. )rr!visit_children)r$r=rr%s r&rEvaluator.visit_childrens3 a '- a  r) name_tokenexprlistc URURn[U[5(aU$[[[U=(d /5nU"U6$![aDnSUSURS3n[ XTR UR US9nXFlUsSnA$SnAff=f![a2n[ SUR UR US9nXFlUsSnA$SnAf[[4aWnURR!SU<SUS U35 [ S UR UR US9nXFlUsSnA$SnAff=f) z| Function evaluation. - Object creation and type conversions. - Other built-in functions like size() - Extension functions undeclared reference to '' (in activation '')r>Nreturn error for overflowzfunction_eval(rrr)rrrDrr;r%r?rrrr rr.rAttributeErrorrr)r$rrrrerrr list_exprlists r& function_evalEvaluator.function_evals9 ~~j&6&67H h - -O  fx~2>M]+ + +J<8##'??"327 !llBGG:NE OL   +R\\277*VE OL>*  KK  znBxjrdS T "BLL"''ME OL  sMA$B) B&"9B!B&!B&) E 3'C E  E 3A E?E E object method_identc URURn[U[ 5(aU$[U[ 5(aU$[[[U=(d /5nU"U/UQ76$![anURR SU<SU<SUSU<35 URR SUR35 SUR<SUR S3n[ XeRURUS9nXWl UsS nA$S nAff=f![a2n[ S URURUS9nXWl UsS nA$S nAf[[ 4a\nURR SU<SU<SUSU<35 [ S URURUS9nXWl UsS nA$S nAff=f) z Method evaluation. While are (nominally) attached to an object, the only thing actually special is that the object is the first parameter to a function. z method_eval(rrrzundeclared reference to z (in activation 'rrNrr)rrrDrrrr;r%r?rrrr rr.rr) r$rrrrrrrrs r& method_evalEvaluator.method_evals ~~l&8&89H fl + +M , / /O  fx~2>MF3]3 3%  KK   VJb8H8*TZ[]Z`a b KK   DNN+;< =*<+=+=*@A##'??"327 !llBGG<PE OL &  +R\\277,XE OL>*  KK   VJb8H8*TZ[]Z`a b !3R\\277R^_E OL  sOA3 (D!3 D=BDDD! G+'EGG+AG<GGcURU5n[RR[ US[ 5(+5$)a The has(e.f) macro. https://github.com/google/cel-spec/blob/master/doc/langdef.md#field-selection 1. If e evaluates to a map, then has(e.f) indicates whether the string f is a key in the map (note that f must syntactically be an identifier). 2. If e evaluates to a message and f is not a declared field for the message, has(e.f) raises a no_such_field error. 3. If e evaluates to a protocol buffers version 2 message and f is a defined field: - If f is a repeated field or map field, has(e.f) indicates whether the field is non-empty. - If f is a singular or oneof field, has(e.f) indicates whether the field is set. 4. If e evaluates to a protocol buffers version 3 message and f is a defined field: - If f is a repeated field or map field, has(e.f) indicates whether the field is non-empty. - If f is a oneof or singular message field, has(e.f) indicates whether the field is set. - If f is some other singular field, has(e.f) indicates whether the field's value is its default value (zero for numeric fields, false for booleans, empty for strings and bytes). 5. In all other cases, has(e.f) evaluates to an error. r)rrrrrr;)r$r has_valuess r&macro_has_evalEvaluator.macro_has_evals8D((2 ~~&&:jm\+R'RSSr)c [UR5S:XaURU5nUS$[UR5S:XaMURSn[ [ [ [ [ 4URU55upEnU"XEU5$[!UR"S URS 3UR$R&UR$R(S9e![anURRURSUSUSU35 S[U5S[U5S[U5S 3n[XRURUS 9n XylU sS nA$S nAff=f)z expr : conditionalor ["?" conditionalor ":" expr] The default implementation short-circuits and can ignore an CELEvalError in a sub-expression. rrrrkrrz2found no matching overload for _?_:_ applied to '()'r=N z: bad expr noderrrrrrrrrrrrr,rr;r%r?rrrrArr) r$r=r9func cond_valueleftrightrrrs r&exprEvaluator.exprs[ t}}  "((.F!9   1 $>>'*D&*51G+H$J]J]^bJc&d #Je Je44!99+Qt}}o_=YY^^yy''   !!T]]O1TF"UG6""NO$$($4#5RT |2d5k]RTV%S,,dK"$  s C## E5-A=E0*E50E5c [UR5S:XaURU5nUS$[UR5S:XaFURSn[ [ [ [ 4URU55upEU"XE5$[!UR"S URS 3UR$R&UR$R(S9e![a|nURRURSUSUSU35 S[U5S[U5S 3n[XvRURUS 9nXhlUsS nA$S nAff=f)z conditionalor : [conditionalor "||"] conditionaland The default implementation short-circuits and can ignore an CELEvalError in a sub-expression. rrrrkrrz1found no matching overload for _||_ applied to '(rrNr: bad conditionalor noderr r$r=r9rrrrrrs r& conditionalorEvaluator.conditionalor@F t}}  "((.F!9   1 $>>&)DuVV^4d6I6I$6OPKD D((!99+Qt}}o-EFYY^^yy''   !!T]]O1TF"UG6""NO$$(J" relation_ge : relation ">=" relation_eq : relation "==" relation_ne : relation "!=" relation_in : relation "in" This could be refactored into separate methods to skip the lookup. Ideally:: values = self.visit_children(tree) func = functions[op_name_map[tree.data]] result = func(*values) The AST doesn't provide a flat list of values, however. rrrrrrrrrr) relation_lt relation_le relation_ge relation_gt relation_eq relation_ne relation_inz relation rrkrrfound no matching overload for  applied to '(rrNz: bad relation noder)rrrrrrrrrr rrrrr,rr;r%r?rrrArr r$r=r9left_op right_treeop_namerrrrrrrs r&relationEvaluator.relations0 t}}  "((.F!9   1 $"&uTYY -A'BDMM"R G$%%$%%%llG>>'*D $U4<+?%@$BUBUVZB[ \ JT KK   $7)1UIF G D((!99+Qt}}o-@AYY^^yy''   !!T]]O1TF"UG6""NO5gll5EF$$(J>'*D $U4<+?%@$BUBUVZB[ \ JT KK   $7)1UIF G D(("!99+Qt}}o-@AYY^^yy'' !  !!T]]O1TF"UG6""NO5gll5EF$$(J>'*D $U4<+?%@$BUBUVZB[ \ JT KK  xq 5)L M D((,!99+Qt}}o-FGYY^^yy'' +  !!T]]O1TF"UG6""NO5gll5EF$$(JK K c[UR5S:XaURU5nUS$[UR5S:Xa[[[ R [ R 4UR5up4SSS.URnURUn[[[[[4URU55upxURRSUSU<35 U"U5$[+URSURS3UR,R.UR,R0S9e![a{n URRURS US U 35 S UR<S [U5S 3n [!XR"U R$US9n XlU sSn A $Sn A f[(a_n URRURS US U 35 [!SU R"U R$US9n XlU sSn A $Sn A ff=f)aK unary : [unary_not | unary_neg] member unary_not : "!" unary_neg : "-" This should be refactored into separate methods to skip the lookup. ideally:: values = self.visit_children(tree) func = functions[op_name_map[tree.data]] result = func(*values) But, values has the structure ``[[], right]`` rrrrr) unary_not unary_negzunary rrkrrrrrNrz: bad unary noder)rrrrrrrrrr rrrrr,rr;r%r?rr.rrArr) r$r=r9op_treerrrrrrrrs r&unaryEvaluator.unary;s$ t}}  "((.F!9   1 $"&uTYY -A'BDMM"R G!!llG>>'*DuT&\6%9:DYY^^yy'' !  !!T]]O1UG6""FG5gll5EF$$(K=4%S,,dK"$   !!T]]O1UG6""FG$%@",,PRPWPW^bc"$  s2?E IA0GI I!AH;5I;Ichildc ^^[[RURS5n[[[R[R4UR5up4[ R U5mTcM[URSURS3URRURRS9eURUS9mS[RRS[ 4UU4SjjnU$) a Builds macro function. For example ``[1, 2, 3].map(n, n/2)`` Builds the function = ``lambda n: n/2``. The function will expose exceptions, disabling short-circuit ``||`` and ``&&``. The `child` is a `member_dot_arg` construct: - [0] is the expression to the left of the '.' - [1] is the function, `map`, to the right of the `.` - [2] is the arguments in ()'s. Within this, there are two children: a variable and an expression. rr: bad macro noderrrhrcb>TR[[T5U05R5$rrrrr)rh identifier nested_evals r&sub_expr,Evaluator.build_macro_eval..sub_exprs)--tC/Da.HIRRT Tr)rrrrrrrrrrArrrrrrrr$rr?var_tree expr_treerrrs @@r&build_macro_evalEvaluator.build_macro_evalvs*DIIu~~a01"5DII)=#> N&&x0   ::,a//?@ZZ__zz((  ((Y(7  U,, U U Ur)c ^^[[RURS5n[[[R[R4UR5up4[ R U5mTcM[URSURS3URRURRS9eURUS9mS[RRS[ 4UU4SjjnU$) a  Builds macro function for short-circuit logical evaluation ignoring exception values. For example ``[1, 2, 'hello'].exists(n, n >= 2)`` Builds the function = ``lambda n: n >= 2``. The function will swallow exceptions, enabling short-circuit ``||`` and ``&&``. rrrrrrhrc>TR[[T5U05R5$![a nUsSnA$SnAff=fr)rrrrr;)rhrrrs r&r/Evaluator.build_ss_macro_eval..sub_exprsC "114Z3H!2LMVVXX   s.2 AAAArrs @@r&build_ss_macro_evalEvaluator.build_ss_macro_evalsDIIu~~a01"5DII)=#> N&&x0   ::,a//?@ZZ__zz((  ((Y(7  ,,    r)cd^^ ^ [[RURS5n[[[R[R[R[R4UR5up4pV[ R U5m [ R U5mT bTcM[URSURS3URRURRS9eURUS9m S[S[S[4UU U 4S jjnXu4$) a Builds macro function and intiial expression for reduce(). For example ``[0, 1, 2].reduce(r, i, 0, r + 2*i+1)`` Builds the function = ``lambda r, i: r + 2*i+1`` and initial value = 0. The `child` is a `member_dot_arg` construct: - [0] is the expression to the left of the '.' - [1] is the function, `reduce`, to the right of the `.` - [2] is the arguments in ()'s. Within this, there are four children: two variables and two expressions. rrrrrrirc>TR[[T5U[[T5U05R5$rr)r%r& iter_identr reduce_idents r&r3Evaluator.build_reduce_macro_eval..sub_exprs9--c<(!T#z-BAFHHP  Sr))rrrrrrrrrrArrrr) r$rr?reduce_var_tree iter_var_treeinit_expr_treerrr(rr)s @@@r&build_reduce_macro_eval!Evaluator.build_reduce_macro_evals*DIIu~~a01 tyy$))TYY ABDMM R B!((9 &&}5  :#5 ::,a//?@ZZ__zz((  ((Y(7  S S6 Sf S S''r)c.URU5nUS$)aO member : member_dot | member_dot_arg | member_item | member_object | primary member_dot : member "." IDENT member_dot_arg : member "." IDENT "(" [exprlist] ")" member_item : member "[" expr "]" member_object : member "{" [fieldinits] "}" https://github.com/google/cel-spec/blob/master/doc/langdef.md#field-selection r)r)r$r=r9s r&memberEvaluator.members$$T*ayr)cX[[[R[R4UR 5up#UR U5nURn[U[5(aUnU$[U[5(aHXT;aXERnU$SU<S[UR553n[U[SUS9nU$[U[RR 5(a7UR"R%SU<SU<S35 UR'U5nU$[U[RR(5(aXEnU$U<S [+U5S 3n[U[,SUS9nU$![a SU<3n[U[SUS9nU$f=f) a member : member_dot | member_dot_arg | member_item | member_object | primary member_dot : member "." IDENT member_dot_arg : member "." IDENT "(" [exprlist] ")" member_item : member "[" expr "]" member_object : member "{" [fieldinits] "}" https://github.com/google/cel-spec/blob/master/doc/langdef.md#name-resolution - ``primary``: Variables and Functions: some simple names refer to variables in the execution context, standard functions, or other name bindings provided by the CEL application. - ``member_dot``: Field selection: appending a period and identifier to an expression could indicate that we're accessing a field within a protocol buffer or map. See below for **Field Selection**. - ``member_dot``: Protocol buffer package names: a simple or qualified name could represent an absolute or relative name in the protocol buffer package namespace. Package names must be followed by a message type, enum type, or enum constant. - ``member_dot``: Protocol buffer message types, enum types, and enum constants: following an optional protocol buffer package name, a simple or qualified name could refer to a message type, and enum type, or an enum constant in the package's namespace. Field Selection. There are four cases. https://github.com/google/cel-spec/blob/master/doc/langdef.md#field-selection - If e evaluates to a message and f is not declared in this message, the runtime error no_such_field is raised. - If e evaluates to a message and f is declared, but the field is not set, the default value of the field's type will be produced. - If e evaluates to a map, then e.f is equivalent to e['f']. - In all other cases, e.f evaluates to an error. TODO: implement member "." IDENT for messages. zNo z in bindings Nrz member_dot(rrEzno such member in mapping: z with type: 'z"' does not support field selection)rrrrrrrrrr;rsortedrErDrrrKrr+getrLrr)r$r= member_treeproperty_name_tokenr1 property_namerrs r& member_dotEvaluator.member_dots\,0dii6K0Ldmm+\( K(+11 fl + +F< ; . .&.442 /M,M&:O9PQ%c8TE, ) : : ; ; KK  {6*B}6GqI JZZ .F$  6 6 7 7 F. JmDL>9[\C!#y$TBF  F3M3DE%c8TE  FsF F)(F)c ^[[RR[/[RR4n[ [ [R[R4URSS5up4URS:Xa[ [RRURU55nURU5m[ [[RR [#TU55n[RRU5nU$URS:Xao[ [RRURU55nURU5m[RR[%TU55nU$URS:Xa[ [RRURU55n[ U['S[(5"[RR*55nUR-U5m[/U[#TU5[RRS55n U $URS:Xa[ [RRURU55n[ U['S[(5"[RR055n UR-U5m[/U [#TU5[RRS 55n U $URS :Xa{[ [RRURU55nURU5m[3U4S jU55n [RRU S :H5$URS :Xae[ [RRURU55nUR5U5upURU 5n[/XU5n U $URS:XaA[ [RRURU55n[7U5n U $[AUR5S:XaM[ [ [[R4URCU55unnUREUU5nU$[ [ [[R[[4URCU55unnnUREUUU5nU$![8a-nSn[;UUR<UR>US9n SnAU $SnAff=f)aq member : member_dot | member_dot_arg | member_item | member_object | primary member_dot : member "." IDENT member_dot_arg : member "." IDENT "(" [exprlist] ")" member_item : member "[" expr "]" member_object : member "{" [fieldinits] "}" https://github.com/google/cel-spec/blob/master/doc/langdef.md#field-selection Method or macro? We Distinguish between these three similar cases. - Macros: https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros - member "." IDENT "(" [exprlist] ")" -- used for string operations - member "." IDENT "(" ")" -- used for a several timestamp operations. NrrfilterallrTexistsF exists_onec3X># UHn[T"U55(dMSv M! g7f)rN)r).0rrs r& +Evaluator.member_dot_arg..sL{ed8E?6K{s* *rrminzCAttempt to reduce an empty sequence or a sequence with a None valuer)#rrrrrrrrrrrrListTyperrrrrr<rr logical_andr"r logical_orsumr.rDr.r;r%r?rrr)r$r=CELBoolFunctionr6method_name_token member_listmappingrand_oper reductionor_opercount reduce_exprr- initial_valuerrr1r expr_iterrs @r&member_dot_argEvaluator.member_dot_argKsM.#ENN$;$;V#DennF]F]#]^)-eDIItzz4I.JDMMZ\[\L])^&  " "e +u~~66 ;8OPK,,T2H8ENN$8$893x;UVG^^,,W5FM  $ $ 0u~~66 ;8OPK,,T2H^^,,VHk-JKFM  $ $ -u~~66 ;8OPK-y9NN..0H //5HxX{)CU^^E\E\]aEbcI   $ $ 0u~~66 ;8OPK-y9NN--/G //5HwHk(BENND[D[\aDbcI   $ $ 4u~~66 ;8OPK,,T2HL{LLE>>**5A:6 6  $ $ 0u~~66 ;8OPK*.*F*Ft*L 'K JJ~6M{GI   $ $ -u~~66 ;8OPK P ,   4==!Q& $&$**,-''-! ))&%8M ,0&$**hv.>>?''-,(y))&%CM+ P[(bllBGG$O   Ps4 U U9 "U44U9c URSnURU5nUupEU"XE5$![a|nURR UR SUSUSU35 S[ U5S[ U5S3n[XvRURUS9nXhl UsSnA$SnAf[abnURR UR SUSUSU35 [S URURUS9nXhl UsSnA$SnAf[abnURR UR SUSUSU35 [S URURUS9nXhl UsSnA$SnAff=f) av member : member_dot | member_dot_arg | member_item | member_object | primary member_dot : member "." IDENT member_dot_arg : member "." IDENT "(" [exprlist] ")" member_item : member "[" expr "]" member_object : member "{" [fieldinits] "}" https://github.com/google/cel-spec/blob/master/doc/langdef.md#field-selection Locating an item in a Mapping or List rrkrrz1found no matching overload for _[_] applied to '(rrNz no such keyinvalid_argument) rrrrrr,rr;r%r?rrD IndexError) r$r=rr9r1indexrrrs r& member_indexEvaluator.member_indexso~~f%$$T*  & &  KK  q5'tL M $V ~RU }B@ !llBGG$GE OL  KK  q5'tL M  bggDQE OL  KK  q5'tL M !3R\\277QUVE OL  sA. FA1B/)F/ F[[2[R([R4UR5upgOM[URSURS3URR URR S9eUR.S:XaUR5U5$UR.S:XaURU5nUS$URU5nUR7U[[8[RR:U55$URS:XaS[[R(URS5n[[*UR-UR.55nU$[URSURS3URR URR S9e![a8n[!UR"SUR$UR"US 9nS nAU$S nAf[&a8n[!UR"SUR$UR"US 9nS nAU$S nAff=f![0a8n[!UR"SUR$UR"US 9nS nAU$S nAff=f![0a=nSUSUR<S3n [!XR$UR"US 9nS nAU$S nAff=f)a primary : dot_ident_arg | dot_ident | ident_arg | ident | paren_expr | list_lit | map_lit | literal dot_ident_arg : "." IDENT "(" [exprlist] ")" dot_ident : "." IDENT ident_arg : IDENT "(" [exprlist] ")" ident : IDENT paren_expr : "(" expr ")" list_lit : "[" [exprlist] "]" map_lit : "{" [mapinits] "}" TODO: Refactor into separate methods to skip this complex elif chain. top-level :py:meth:`primary` is similar to :py:meth:`method`. Each of the individual rules then works with a tree instead of a child of the primary tree. This includes function-like macros: has() and dyn(). These are special cases and cannot be overridden. rrz: bad primary noderrliteral paren_exprlist_litmap_litrN) dot_ident dot_ident_argT)r ident_argr)rrrhasdynrrrr)rrrrrArrrrrrrrrErLr.r;r?r%rrrrrrDrrrrrr) r$r=rr9rrrr dyn_valuesrs r&r]Evaluator.primarys0 t}}  " 99+Qt}}o-?@YY^^yy''  TYY a 01 :: "((.F!9  ZZ< '((/F!9  ZZ: %5>>"a'002 M,,U3M ZZ9 $5>>"a'//1MX!007F#AYF M ZZ9 9 ((/Fdjj&)4J Tfd&6&6z7G7GTX&6&YZM ZZ; &5>>"a'!$**ennQ.?@ 99*rBU^^$)'+E$**dii2G,H%..'Y$ H$yyk4==/1CD99++5(**844!!U*!00: !!}$,,X6))*d8ENNDXDX;Y[a6bcc ZZ7 "djj%..*;.sCVz!\'B!!Vs( () rnext StopIterationrrrErr r)r$r=r9errorsrs r&rEvaluator.exprlistsp $$T*CVC <    ((d5>>3G3G.H&)QR s ' 44c 0n[[[[R[R 4[ URSSS2URSSS255nUH_upEURn[[RRURU5S5nXb;a[SU<35eXrU'Ma [RR"S0UD6$)a6 fieldinits : IDENT ":" expr ("," IDENT ":" expr)* The even items, children[0::2] are identifiers, nothing to evaluate. The odd items, childnre[1::2] are expressions. This creates a mapping, used by the :meth:`member_object` method to create and populate a protobuf object. Duplicate names are an error. rNrrzDuplicate field label rN)rrrrrrziprrrrrrr.rK)r$r=fieldspairs ident_node expr_noderrs r&r`Evaluator.fieldinitss"$ U4::tyy01 2  add#T]]14a4%8 9 &+ !J$$E,,d.A.A).LQ.OPD #9%!CDD 5M &+ ~~))3F33r)c,[RR5n[[[RR UR U55n[USSS2USSS25nUHupVXR;a[SU<35eXbU'M U$)a mapinits : expr ":" expr ("," expr ":" expr)* Extract the key expr's and value expr's to a list of pairs. This raises an exception on a duplicate key. TODO: Is ``{'a': 1, 'b': 2/0}['a']`` a meaningful result in CEL? Or is this an error because the entire member is erroneous? rNrrzDuplicate key ) rrrLrr rrrr.)r$r=r keys_valuesrr^rs r&mapinitsEvaluator.mapinits s'')4 4 45t7J7J47PQ K1%{14a4'89JC} >#!9::3K  r))rrrrrr)F)?r,r-r.r/r0rorprrrrtrrrr rr"rrqrrResult_Functionrrrrrr rrrr rrrrrrrrrrrrr rrrr"rr.r1r9rTrZrar]rdrr`rr2r3r4s@r&rrs<z  { +F X\ ;;#;Xk2GC499>> >@ 8$))88 8t%dii%Henn>R>R=SUX=X4Y%NxAUAU@VX[@[7\B)()( x(&01499< =)(V  499     PtyyPVP Pd j499jj jX $$v$ $L ;$));; ;z JDIIJ&J JX /DII/&/ /b  TYY 6    4tyy4V4 4. TYY6 r)zO\\[abfnrtv"'\\]|\\\d{3}|\\x[0-9a-fA-F]{2}|\\u[0-9a-fA-F]{4}|\\U[0-9a-fA-F]{8}|.     "'\) z\az\bz\fz\nz\rz\tz\vz\"z\'z\\r>cS[[[S[[4SjnURnUSSS;aUSSS:Xd USSS :XaUSS nO`US S nOZUS SS:Xd US SS :Xa[ R USS 5nO[ R USS 5nSRU"U55n[RRU5$)a) Evaluate a CEL string literal, expanding escapes to create a Python string. It may be that built-in ``eval()`` might work for some of this, but the octal escapes aren't really viable. :param token: CEL token value :return: str .. todo:: This can be refactored into celpy.celtypes.StringType. match_iterrc3l# SU5Hn[U5S:XaUnOUSSS:Xa[[USSS55nOhUSSS;a[[USSS55nOFUSSS:Xa([U5S:Xa[[USSS 55nO[R X5nUv M g7f) Nc3@# UHoR5v M g7frgrouprAms r&rB)celstr..expand..6 4Aggiirr\x>\U\ur)rchrr1 CEL_ESCAPESr5)rr-expandeds r&expandcelstr..expand5 s44E5zQ re#s59b12rn,s59b12rd"s5zQs59a01&??58N5sB2B4Nr)Rr%r"""'''rrYrrrX) rr rr rCEL_ESCAPES_PATfinditerjoinrr StringTyper>rrrrs r&r}r}) s 8E#J/ HSM  ;;D BQx: !9 ae!3AbzHAbzH !9 ae!3(11$q*=J)11$q*=J776*-. >> $ $X ..r)cS[[[S[[4SjnUR nUSSR 5S:XaiUSSS:Xd USSS :Xa+[RRS USS 55nU$[RRS US S55nU$USSR 5S:XajUSSS:Xd USSS :Xa[RUSS 5nO[RUSS5n[RRU"U55nU$[SUR <35e)z Evaluate a CEL bytes literal, expanding escapes to create a Python bytes object. :param token: CEL token value :return: bytes .. todo:: This can be refactored into celpy.celtypes.BytesType. rrc3# SU5Hn[U5S:XaURS5ShvN M-USSS:Xa[USSS5v MIUSSS:Xa[USSS5v MeUSSS:Xa"[U5S :Xa[USSS 5v M[[R X55v M gN7f) Nc3@# UHoR5v M g7frrrs r&rB+celbytes..expand..b rrrzutf-8rrrrrrr)rencoder1ordrr5)rr-s r&rcelbytes..expanda s44E5zQ <<000re#%)R((re#%)R((rd"s5zQ%)Q''+//%78850s0CCBCNrbrrrc38# UHn[U5v M g7frrrArs r&rBcelbytes..s /K 1A rc38# UHn[U5v M g7frrrs r&rBrv rrrrYrrrzInvalid bytes literal ) rr rr r1rr{rr BytesTyperrr.rs r&r~r~X sF 98E#J/ 9HSM 9 ;;D BQx~~4 !9 ae!3~~///KQr /KKH O~~///KQr /KKH O bq S !9 ae!3(11$q*=J)11$q*=J>>++F:,>? O1%++ABBr)r)fr0rrooperatorrr functoolsrrtypingrrrrr r r r r rrrrrrrr lark.visitorscelpy.celtypesrcelpy.celparserrrCELTyperr^rrprrrr6r;rrr BaseExceptionException_Filterrrrrrrr logical_notnegaddsubmultruedivmodltlegegteqnerGrFlogical_conditiongetitemrrz DurationTyperrErLrr TimestampTyper|r__annotations__r rqrnrrtvisitorsVisitor_Recursiverrr Interpreterrrmrrrr}r~rNr)r&rs , #!!!!! % NN S%..&& &' $ $%'    < (Y)[9[B  NN NN sF{#   m,htM7J.KKL \ 5 )9h |U_G_>`@3 4 445:B3H_H_C_:`"+f++F+\V02-%.. $ $2-(,,2- 8<<2- 8<< 2-  8<< 2-  8   2- 8<<2- 78;; 2- GHKK 2- GHKK 2- 78;; 2- GHKK 2- GHKK 2- K2- ENN % %2-  ENN & &!2-" U^^ - -#2-$ H  %2-& M'2-*I+2-,M-2-.\/2-0B12-4S52-6_72-8]92-:];2-<[=2->U?2-BUC2-DcE2-FYG2-HYI2-L ENN # #M2-N^^ % %nn''++ >> ! ! NN # # >> ! !dnn''-- NN # # c2-[()2jjj^ #uV_455 6 "QPDh'QPh ` ` F //, +tyy1367 >#;#;*r)