Pin new dependency: github.com/google/cel-go v0.9.0

vendor/github.com/google/cel-go/checker/BUILD.bazel

@@ -0,0 +1,57 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "checker.go",
+        "env.go",
+        "errors.go",
+        "mapping.go",
+        "printer.go",
+        "standard.go",
+        "types.go",
+    ],
+    importpath = "github.com/google/cel-go/checker",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//checker/decls:go_default_library",
+        "//common:go_default_library",
+        "//common/containers:go_default_library",
+        "//common/debug:go_default_library",
+        "//common/operators:go_default_library",
+        "//common/overloads:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/pb:go_default_library",
+        "//common/types/ref:go_default_library",
+        "//parser:go_default_library",
+        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
+        "@org_golang_google_protobuf//types/known/structpb:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    size = "small",
+    srcs = [
+        "checker_test.go",
+        "env_test.go",
+    ],
+    embed = [
+        ":go_default_library",
+    ],
+    deps = [
+        "//common/types:go_default_library",
+        "//parser:go_default_library",
+        "//test:go_default_library",
+        "//test/proto2pb:go_default_library",
+        "//test/proto3pb:go_default_library",
+        "@com_github_antlr//runtime/Go/antlr:go_default_library",
+        "@org_golang_google_protobuf//proto:go_default_library",
+    ],
+)

vendor/github.com/google/cel-go/checker/checker.go

@@ -0,0 +1,642 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package checker defines functions to type-checked a parsed expression
+// against a set of identifier and function declarations.
+package checker
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/types/ref"
+
+	"google.golang.org/protobuf/proto"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+type checker struct {
+	env                *Env
+	errors             *typeErrors
+	mappings           *mapping
+	freeTypeVarCounter int
+	sourceInfo         *exprpb.SourceInfo
+	types              map[int64]*exprpb.Type
+	references         map[int64]*exprpb.Reference
+}
+
+// Check performs type checking, giving a typed AST.
+// The input is a ParsedExpr proto and an env which encapsulates
+// type binding of variables, declarations of built-in functions,
+// descriptions of protocol buffers, and a registry for errors.
+// Returns a CheckedExpr proto, which might not be usable if
+// there are errors in the error registry.
+func Check(parsedExpr *exprpb.ParsedExpr,
+	source common.Source,
+	env *Env) (*exprpb.CheckedExpr, *common.Errors) {
+	c := checker{
+		env:                env,
+		errors:             &typeErrors{common.NewErrors(source)},
+		mappings:           newMapping(),
+		freeTypeVarCounter: 0,
+		sourceInfo:         parsedExpr.GetSourceInfo(),
+		types:              make(map[int64]*exprpb.Type),
+		references:         make(map[int64]*exprpb.Reference),
+	}
+	c.check(parsedExpr.GetExpr())
+
+	// Walk over the final type map substituting any type parameters either by their bound value or
+	// by DYN.
+	m := make(map[int64]*exprpb.Type)
+	for k, v := range c.types {
+		m[k] = substitute(c.mappings, v, true)
+	}
+
+	return &exprpb.CheckedExpr{
+		Expr:         parsedExpr.GetExpr(),
+		SourceInfo:   parsedExpr.GetSourceInfo(),
+		TypeMap:      m,
+		ReferenceMap: c.references,
+	}, c.errors.Errors
+}
+
+func (c *checker) check(e *exprpb.Expr) {
+	if e == nil {
+		return
+	}
+
+	switch e.ExprKind.(type) {
+	case *exprpb.Expr_ConstExpr:
+		literal := e.GetConstExpr()
+		switch literal.ConstantKind.(type) {
+		case *exprpb.Constant_BoolValue:
+			c.checkBoolLiteral(e)
+		case *exprpb.Constant_BytesValue:
+			c.checkBytesLiteral(e)
+		case *exprpb.Constant_DoubleValue:
+			c.checkDoubleLiteral(e)
+		case *exprpb.Constant_Int64Value:
+			c.checkInt64Literal(e)
+		case *exprpb.Constant_NullValue:
+			c.checkNullLiteral(e)
+		case *exprpb.Constant_StringValue:
+			c.checkStringLiteral(e)
+		case *exprpb.Constant_Uint64Value:
+			c.checkUint64Literal(e)
+		}
+	case *exprpb.Expr_IdentExpr:
+		c.checkIdent(e)
+	case *exprpb.Expr_SelectExpr:
+		c.checkSelect(e)
+	case *exprpb.Expr_CallExpr:
+		c.checkCall(e)
+	case *exprpb.Expr_ListExpr:
+		c.checkCreateList(e)
+	case *exprpb.Expr_StructExpr:
+		c.checkCreateStruct(e)
+	case *exprpb.Expr_ComprehensionExpr:
+		c.checkComprehension(e)
+	default:
+		c.errors.ReportError(
+			c.location(e), "Unrecognized ast type: %v", reflect.TypeOf(e))
+	}
+}
+
+func (c *checker) checkInt64Literal(e *exprpb.Expr) {
+	c.setType(e, decls.Int)
+}
+
+func (c *checker) checkUint64Literal(e *exprpb.Expr) {
+	c.setType(e, decls.Uint)
+}
+
+func (c *checker) checkStringLiteral(e *exprpb.Expr) {
+	c.setType(e, decls.String)
+}
+
+func (c *checker) checkBytesLiteral(e *exprpb.Expr) {
+	c.setType(e, decls.Bytes)
+}
+
+func (c *checker) checkDoubleLiteral(e *exprpb.Expr) {
+	c.setType(e, decls.Double)
+}
+
+func (c *checker) checkBoolLiteral(e *exprpb.Expr) {
+	c.setType(e, decls.Bool)
+}
+
+func (c *checker) checkNullLiteral(e *exprpb.Expr) {
+	c.setType(e, decls.Null)
+}
+
+func (c *checker) checkIdent(e *exprpb.Expr) {
+	identExpr := e.GetIdentExpr()
+	// Check to see if the identifier is declared.
+	if ident := c.env.LookupIdent(identExpr.GetName()); ident != nil {
+		c.setType(e, ident.GetIdent().Type)
+		c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().Value))
+		// Overwrite the identifier with its fully qualified name.
+		identExpr.Name = ident.GetName()
+		return
+	}
+
+	c.setType(e, decls.Error)
+	c.errors.undeclaredReference(
+		c.location(e), c.env.container.Name(), identExpr.GetName())
+}
+
+func (c *checker) checkSelect(e *exprpb.Expr) {
+	sel := e.GetSelectExpr()
+	// Before traversing down the tree, try to interpret as qualified name.
+	qname, found := containers.ToQualifiedName(e)
+	if found {
+		ident := c.env.LookupIdent(qname)
+		if ident != nil {
+			if sel.TestOnly {
+				c.errors.expressionDoesNotSelectField(c.location(e))
+				c.setType(e, decls.Bool)
+				return
+			}
+			// Rewrite the node to be a variable reference to the resolved fully-qualified
+			// variable name.
+			c.setType(e, ident.GetIdent().Type)
+			c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().Value))
+			identName := ident.GetName()
+			e.ExprKind = &exprpb.Expr_IdentExpr{
+				IdentExpr: &exprpb.Expr_Ident{
+					Name: identName,
+				},
+			}
+			return
+		}
+	}
+
+	// Interpret as field selection, first traversing down the operand.
+	c.check(sel.Operand)
+	targetType := c.getType(sel.Operand)
+	// Assume error type by default as most types do not support field selection.
+	resultType := decls.Error
+	switch kindOf(targetType) {
+	case kindMap:
+		// Maps yield their value type as the selection result type.
+		mapType := targetType.GetMapType()
+		resultType = mapType.ValueType
+	case kindObject:
+		// Objects yield their field type declaration as the selection result type, but only if
+		// the field is defined.
+		messageType := targetType
+		if fieldType, found := c.lookupFieldType(
+			c.location(e),
+			messageType.GetMessageType(),
+			sel.Field); found {
+			resultType = fieldType.Type
+		}
+	case kindTypeParam:
+		// Set the operand type to DYN to prevent assignment to a potentionally incorrect type
+		// at a later point in type-checking. The isAssignable call will update the type
+		// substitutions for the type param under the covers.
+		c.isAssignable(decls.Dyn, targetType)
+		// Also, set the result type to DYN.
+		resultType = decls.Dyn
+	default:
+		// Dynamic / error values are treated as DYN type. Errors are handled this way as well
+		// in order to allow forward progress on the check.
+		if isDynOrError(targetType) {
+			resultType = decls.Dyn
+		} else {
+			c.errors.typeDoesNotSupportFieldSelection(c.location(e), targetType)
+		}
+	}
+	if sel.TestOnly {
+		resultType = decls.Bool
+	}
+	c.setType(e, resultType)
+}
+
+func (c *checker) checkCall(e *exprpb.Expr) {
+	// Note: similar logic exists within the `interpreter/planner.go`. If making changes here
+	// please consider the impact on planner.go and consolidate implementations or mirror code
+	// as appropriate.
+	call := e.GetCallExpr()
+	target := call.GetTarget()
+	args := call.GetArgs()
+	fnName := call.GetFunction()
+
+	// Traverse arguments.
+	for _, arg := range args {
+		c.check(arg)
+	}
+
+	// Regular static call with simple name.
+	if target == nil {
+		// Check for the existence of the function.
+		fn := c.env.LookupFunction(fnName)
+		if fn == nil {
+			c.errors.undeclaredReference(
+				c.location(e), c.env.container.Name(), fnName)
+			c.setType(e, decls.Error)
+			return
+		}
+		// Overwrite the function name with its fully qualified resolved name.
+		call.Function = fn.GetName()
+		// Check to see whether the overload resolves.
+		c.resolveOverloadOrError(c.location(e), e, fn, nil, args)
+		return
+	}
+
+	// If a receiver 'target' is present, it may either be a receiver function, or a namespaced
+	// function, but not both. Given a.b.c() either a.b.c is a function or c is a function with
+	// target a.b.
+	//
+	// Check whether the target is a namespaced function name.
+	qualifiedPrefix, maybeQualified := containers.ToQualifiedName(target)
+	if maybeQualified {
+		maybeQualifiedName := qualifiedPrefix + "." + fnName
+		fn := c.env.LookupFunction(maybeQualifiedName)
+		if fn != nil {
+			// The function name is namespaced and so preserving the target operand would
+			// be an inaccurate representation of the desired evaluation behavior.
+			// Overwrite with fully-qualified resolved function name sans receiver target.
+			call.Target = nil
+			call.Function = fn.GetName()
+			c.resolveOverloadOrError(c.location(e), e, fn, nil, args)
+			return
+		}
+	}
+
+	// Regular instance call.
+	c.check(call.Target)
+	fn := c.env.LookupFunction(fnName)
+	// Function found, attempt overload resolution.
+	if fn != nil {
+		c.resolveOverloadOrError(c.location(e), e, fn, target, args)
+		return
+	}
+	// Function name not declared, record error.
+	c.errors.undeclaredReference(c.location(e), c.env.container.Name(), fnName)
+}
+
+func (c *checker) resolveOverloadOrError(
+	loc common.Location,
+	e *exprpb.Expr,
+	fn *exprpb.Decl, target *exprpb.Expr, args []*exprpb.Expr) {
+	// Attempt to resolve the overload.
+	resolution := c.resolveOverload(loc, fn, target, args)
+	// No such overload, error noted in the resolveOverload call, type recorded here.
+	if resolution == nil {
+		c.setType(e, decls.Error)
+		return
+	}
+	// Overload found.
+	c.setType(e, resolution.Type)
+	c.setReference(e, resolution.Reference)
+}
+
+func (c *checker) resolveOverload(
+	loc common.Location,
+	fn *exprpb.Decl, target *exprpb.Expr, args []*exprpb.Expr) *overloadResolution {
+
+	var argTypes []*exprpb.Type
+	if target != nil {
+		argTypes = append(argTypes, c.getType(target))
+	}
+	for _, arg := range args {
+		argTypes = append(argTypes, c.getType(arg))
+	}
+
+	var resultType *exprpb.Type
+	var checkedRef *exprpb.Reference
+	for _, overload := range fn.GetFunction().Overloads {
+		if (target == nil && overload.IsInstanceFunction) ||
+			(target != nil && !overload.IsInstanceFunction) {
+			// not a compatible call style.
+			continue
+		}
+
+		overloadType := decls.NewFunctionType(overload.ResultType, overload.Params...)
+		if len(overload.TypeParams) > 0 {
+			// Instantiate overload's type with fresh type variables.
+			substitutions := newMapping()
+			for _, typePar := range overload.TypeParams {
+				substitutions.add(decls.NewTypeParamType(typePar), c.newTypeVar())
+			}
+			overloadType = substitute(substitutions, overloadType, false)
+		}
+
+		candidateArgTypes := overloadType.GetFunction().ArgTypes
+		if c.isAssignableList(argTypes, candidateArgTypes) {
+			if checkedRef == nil {
+				checkedRef = newFunctionReference(overload.OverloadId)
+			} else {
+				checkedRef.OverloadId = append(checkedRef.OverloadId, overload.OverloadId)
+			}
+
+			// First matching overload, determines result type.
+			fnResultType := substitute(c.mappings,
+				overloadType.GetFunction().ResultType,
+				false)
+			if resultType == nil {
+				resultType = fnResultType
+			} else if !isDyn(resultType) && !proto.Equal(fnResultType, resultType) {
+				resultType = decls.Dyn
+			}
+		}
+	}
+
+	if resultType == nil {
+		c.errors.noMatchingOverload(loc, fn.GetName(), argTypes, target != nil)
+		resultType = decls.Error
+		return nil
+	}
+
+	return newResolution(checkedRef, resultType)
+}
+
+func (c *checker) checkCreateList(e *exprpb.Expr) {
+	create := e.GetListExpr()
+	var elemType *exprpb.Type
+	for _, e := range create.Elements {
+		c.check(e)
+		elemType = c.joinTypes(c.location(e), elemType, c.getType(e))
+	}
+	if elemType == nil {
+		// If the list is empty, assign free type var to elem type.
+		elemType = c.newTypeVar()
+	}
+	c.setType(e, decls.NewListType(elemType))
+}
+
+func (c *checker) checkCreateStruct(e *exprpb.Expr) {
+	str := e.GetStructExpr()
+	if str.MessageName != "" {
+		c.checkCreateMessage(e)
+	} else {
+		c.checkCreateMap(e)
+	}
+}
+
+func (c *checker) checkCreateMap(e *exprpb.Expr) {
+	mapVal := e.GetStructExpr()
+	var keyType *exprpb.Type
+	var valueType *exprpb.Type
+	for _, ent := range mapVal.GetEntries() {
+		key := ent.GetMapKey()
+		c.check(key)
+		keyType = c.joinTypes(c.location(key), keyType, c.getType(key))
+
+		c.check(ent.Value)
+		valueType = c.joinTypes(c.location(ent.Value), valueType, c.getType(ent.Value))
+	}
+	if keyType == nil {
+		// If the map is empty, assign free type variables to typeKey and value type.
+		keyType = c.newTypeVar()
+		valueType = c.newTypeVar()
+	}
+	c.setType(e, decls.NewMapType(keyType, valueType))
+}
+
+func (c *checker) checkCreateMessage(e *exprpb.Expr) {
+	msgVal := e.GetStructExpr()
+	// Determine the type of the message.
+	messageType := decls.Error
+	decl := c.env.LookupIdent(msgVal.MessageName)
+	if decl == nil {
+		c.errors.undeclaredReference(
+			c.location(e), c.env.container.Name(), msgVal.MessageName)
+		return
+	}
+	// Ensure the type name is fully qualified in the AST.
+	msgVal.MessageName = decl.GetName()
+	c.setReference(e, newIdentReference(decl.GetName(), nil))
+	ident := decl.GetIdent()
+	identKind := kindOf(ident.Type)
+	if identKind != kindError {
+		if identKind != kindType {
+			c.errors.notAType(c.location(e), ident.Type)
+		} else {
+			messageType = ident.Type.GetType()
+			if kindOf(messageType) != kindObject {
+				c.errors.notAMessageType(c.location(e), messageType)
+				messageType = decls.Error
+			}
+		}
+	}
+	if isObjectWellKnownType(messageType) {
+		c.setType(e, getObjectWellKnownType(messageType))
+	} else {
+		c.setType(e, messageType)
+	}
+
+	// Check the field initializers.
+	for _, ent := range msgVal.GetEntries() {
+		field := ent.GetFieldKey()
+		value := ent.Value
+		c.check(value)
+
+		fieldType := decls.Error
+		if t, found := c.lookupFieldType(
+			c.locationByID(ent.Id),
+			messageType.GetMessageType(),
+			field); found {
+			fieldType = t.Type
+		}
+		if !c.isAssignable(fieldType, c.getType(value)) {
+			c.errors.fieldTypeMismatch(
+				c.locationByID(ent.Id), field, fieldType, c.getType(value))
+		}
+	}
+}
+
+func (c *checker) checkComprehension(e *exprpb.Expr) {
+	comp := e.GetComprehensionExpr()
+	c.check(comp.IterRange)
+	c.check(comp.AccuInit)
+	accuType := c.getType(comp.AccuInit)
+	rangeType := c.getType(comp.IterRange)
+	var varType *exprpb.Type
+
+	switch kindOf(rangeType) {
+	case kindList:
+		varType = rangeType.GetListType().ElemType
+	case kindMap:
+		// Ranges over the keys.
+		varType = rangeType.GetMapType().KeyType
+	case kindDyn, kindError, kindTypeParam:
+		// Set the range type to DYN to prevent assignment to a potentionally incorrect type
+		// at a later point in type-checking. The isAssignable call will update the type
+		// substitutions for the type param under the covers.
+		c.isAssignable(decls.Dyn, rangeType)
+		// Set the range iteration variable to type DYN as well.
+		varType = decls.Dyn
+	default:
+		c.errors.notAComprehensionRange(c.location(comp.IterRange), rangeType)
+		varType = decls.Error
+	}
+
+	// Create a scope for the comprehension since it has a local accumulation variable.
+	// This scope will contain the accumulation variable used to compute the result.
+	c.env = c.env.enterScope()
+	c.env.Add(decls.NewVar(comp.AccuVar, accuType))
+	// Create a block scope for the loop.
+	c.env = c.env.enterScope()
+	c.env.Add(decls.NewVar(comp.IterVar, varType))
+	// Check the variable references in the condition and step.
+	c.check(comp.LoopCondition)
+	c.assertType(comp.LoopCondition, decls.Bool)
+	c.check(comp.LoopStep)
+	c.assertType(comp.LoopStep, accuType)
+	// Exit the loop's block scope before checking the result.
+	c.env = c.env.exitScope()
+	c.check(comp.Result)
+	// Exit the comprehension scope.
+	c.env = c.env.exitScope()
+	c.setType(e, c.getType(comp.Result))
+}
+
+// Checks compatibility of joined types, and returns the most general common type.
+func (c *checker) joinTypes(loc common.Location,
+	previous *exprpb.Type,
+	current *exprpb.Type) *exprpb.Type {
+	if previous == nil {
+		return current
+	}
+	if c.isAssignable(previous, current) {
+		return mostGeneral(previous, current)
+	}
+	if c.dynAggregateLiteralElementTypesEnabled() {
+		return decls.Dyn
+	}
+	c.errors.typeMismatch(loc, previous, current)
+	return decls.Error
+}
+
+func (c *checker) dynAggregateLiteralElementTypesEnabled() bool {
+	return c.env.aggLitElemType == dynElementType
+}
+
+func (c *checker) newTypeVar() *exprpb.Type {
+	id := c.freeTypeVarCounter
+	c.freeTypeVarCounter++
+	return decls.NewTypeParamType(fmt.Sprintf("_var%d", id))
+}
+
+func (c *checker) isAssignable(t1 *exprpb.Type, t2 *exprpb.Type) bool {
+	subs := isAssignable(c.mappings, t1, t2)
+	if subs != nil {
+		c.mappings = subs
+		return true
+	}
+
+	return false
+}
+
+func (c *checker) isAssignableList(l1 []*exprpb.Type, l2 []*exprpb.Type) bool {
+	subs := isAssignableList(c.mappings, l1, l2)
+	if subs != nil {
+		c.mappings = subs
+		return true
+	}
+
+	return false
+}
+
+func (c *checker) lookupFieldType(l common.Location, messageType string, fieldName string) (*ref.FieldType, bool) {
+	if _, found := c.env.provider.FindType(messageType); !found {
+		// This should not happen, anyway, report an error.
+		c.errors.unexpectedFailedResolution(l, messageType)
+		return nil, false
+	}
+
+	if ft, found := c.env.provider.FindFieldType(messageType, fieldName); found {
+		return ft, found
+	}
+
+	c.errors.undefinedField(l, fieldName)
+	return nil, false
+}
+
+func (c *checker) setType(e *exprpb.Expr, t *exprpb.Type) {
+	if old, found := c.types[e.Id]; found && !proto.Equal(old, t) {
+		c.errors.ReportError(c.location(e),
+			"(Incompatible) Type already exists for expression: %v(%d) old:%v, new:%v", e, e.GetId(), old, t)
+		return
+	}
+	c.types[e.Id] = t
+}
+
+func (c *checker) getType(e *exprpb.Expr) *exprpb.Type {
+	return c.types[e.Id]
+}
+
+func (c *checker) setReference(e *exprpb.Expr, r *exprpb.Reference) {
+	if old, found := c.references[e.Id]; found && !proto.Equal(old, r) {
+		c.errors.ReportError(c.location(e),
+			"Reference already exists for expression: %v(%d) old:%v, new:%v", e, e.Id, old, r)
+		return
+	}
+	c.references[e.Id] = r
+}
+
+func (c *checker) assertType(e *exprpb.Expr, t *exprpb.Type) {
+	if !c.isAssignable(t, c.getType(e)) {
+		c.errors.typeMismatch(c.location(e), t, c.getType(e))
+	}
+}
+
+type overloadResolution struct {
+	Reference *exprpb.Reference
+	Type      *exprpb.Type
+}
+
+func newResolution(checkedRef *exprpb.Reference, t *exprpb.Type) *overloadResolution {
+	return &overloadResolution{
+		Reference: checkedRef,
+		Type:      t,
+	}
+}
+
+func (c *checker) location(e *exprpb.Expr) common.Location {
+	return c.locationByID(e.Id)
+}
+
+func (c *checker) locationByID(id int64) common.Location {
+	positions := c.sourceInfo.GetPositions()
+	var line = 1
+	if offset, found := positions[id]; found {
+		col := int(offset)
+		for _, lineOffset := range c.sourceInfo.LineOffsets {
+			if lineOffset < offset {
+				line++
+				col = int(offset - lineOffset)
+			} else {
+				break
+			}
+		}
+		return common.NewLocation(line, col)
+	}
+	return common.NoLocation
+}
+
+func newIdentReference(name string, value *exprpb.Constant) *exprpb.Reference {
+	return &exprpb.Reference{Name: name, Value: value}
+}
+
+func newFunctionReference(overloads ...string) *exprpb.Reference {
+	return &exprpb.Reference{OverloadId: overloads}
+}

vendor/github.com/google/cel-go/checker/decls/BUILD.bazel

@@ -0,0 +1,20 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "decls.go",
+        "scopes.go",
+    ],
+    importpath = "github.com/google/cel-go/checker/decls",
+    deps = [
+        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
+        "@org_golang_google_protobuf//types/known/structpb:go_default_library",
+    ],
+)

vendor/github.com/google/cel-go/checker/decls/decls.go

@@ -0,0 +1,231 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package decls provides helpers for creating variable and function declarations.
+package decls
+
+import (
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+var (
+	// Error type used to communicate issues during type-checking.
+	Error = &exprpb.Type{
+		TypeKind: &exprpb.Type_Error{
+			Error: &emptypb.Empty{}}}
+
+	// Dyn is a top-type used to represent any value.
+	Dyn = &exprpb.Type{
+		TypeKind: &exprpb.Type_Dyn{
+			Dyn: &emptypb.Empty{}}}
+)
+
+// Commonly used types.
+var (
+	Bool   = NewPrimitiveType(exprpb.Type_BOOL)
+	Bytes  = NewPrimitiveType(exprpb.Type_BYTES)
+	Double = NewPrimitiveType(exprpb.Type_DOUBLE)
+	Int    = NewPrimitiveType(exprpb.Type_INT64)
+	Null   = &exprpb.Type{
+		TypeKind: &exprpb.Type_Null{
+			Null: structpb.NullValue_NULL_VALUE}}
+	String = NewPrimitiveType(exprpb.Type_STRING)
+	Uint   = NewPrimitiveType(exprpb.Type_UINT64)
+)
+
+// Well-known types.
+// TODO: Replace with an abstract type registry.
+var (
+	Any       = NewWellKnownType(exprpb.Type_ANY)
+	Duration  = NewWellKnownType(exprpb.Type_DURATION)
+	Timestamp = NewWellKnownType(exprpb.Type_TIMESTAMP)
+)
+
+// NewAbstractType creates an abstract type declaration which references a proto
+// message name and may also include type parameters.
+func NewAbstractType(name string, paramTypes ...*exprpb.Type) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_AbstractType_{
+			AbstractType: &exprpb.Type_AbstractType{
+				Name:           name,
+				ParameterTypes: paramTypes}}}
+}
+
+// NewFunctionType creates a function invocation contract, typically only used
+// by type-checking steps after overload resolution.
+func NewFunctionType(resultType *exprpb.Type,
+	argTypes ...*exprpb.Type) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_Function{
+			Function: &exprpb.Type_FunctionType{
+				ResultType: resultType,
+				ArgTypes:   argTypes}}}
+}
+
+// NewFunction creates a named function declaration with one or more overloads.
+func NewFunction(name string,
+	overloads ...*exprpb.Decl_FunctionDecl_Overload) *exprpb.Decl {
+	return &exprpb.Decl{
+		Name: name,
+		DeclKind: &exprpb.Decl_Function{
+			Function: &exprpb.Decl_FunctionDecl{
+				Overloads: overloads}}}
+}
+
+// NewIdent creates a named identifier declaration with an optional literal
+// value.
+//
+// Literal values are typically only associated with enum identifiers.
+//
+// Deprecated: Use NewVar or NewConst instead.
+func NewIdent(name string, t *exprpb.Type, v *exprpb.Constant) *exprpb.Decl {
+	return &exprpb.Decl{
+		Name: name,
+		DeclKind: &exprpb.Decl_Ident{
+			Ident: &exprpb.Decl_IdentDecl{
+				Type:  t,
+				Value: v}}}
+}
+
+// NewConst creates a constant identifier with a CEL constant literal value.
+func NewConst(name string, t *exprpb.Type, v *exprpb.Constant) *exprpb.Decl {
+	return NewIdent(name, t, v)
+}
+
+// NewVar creates a variable identifier.
+func NewVar(name string, t *exprpb.Type) *exprpb.Decl {
+	return NewIdent(name, t, nil)
+}
+
+// NewInstanceOverload creates a instance function overload contract.
+// First element of argTypes is instance.
+func NewInstanceOverload(id string, argTypes []*exprpb.Type,
+	resultType *exprpb.Type) *exprpb.Decl_FunctionDecl_Overload {
+	return &exprpb.Decl_FunctionDecl_Overload{
+		OverloadId:         id,
+		ResultType:         resultType,
+		Params:             argTypes,
+		IsInstanceFunction: true}
+}
+
+// NewListType generates a new list with elements of a certain type.
+func NewListType(elem *exprpb.Type) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_ListType_{
+			ListType: &exprpb.Type_ListType{
+				ElemType: elem}}}
+}
+
+// NewMapType generates a new map with typed keys and values.
+func NewMapType(key *exprpb.Type, value *exprpb.Type) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_MapType_{
+			MapType: &exprpb.Type_MapType{
+				KeyType:   key,
+				ValueType: value}}}
+}
+
+// NewObjectType creates an object type for a qualified type name.
+func NewObjectType(typeName string) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_MessageType{
+			MessageType: typeName}}
+}
+
+// NewOverload creates a function overload declaration which contains a unique
+// overload id as well as the expected argument and result types. Overloads
+// must be aggregated within a Function declaration.
+func NewOverload(id string, argTypes []*exprpb.Type,
+	resultType *exprpb.Type) *exprpb.Decl_FunctionDecl_Overload {
+	return &exprpb.Decl_FunctionDecl_Overload{
+		OverloadId:         id,
+		ResultType:         resultType,
+		Params:             argTypes,
+		IsInstanceFunction: false}
+}
+
+// NewParameterizedInstanceOverload creates a parametric function instance overload type.
+func NewParameterizedInstanceOverload(id string,
+	argTypes []*exprpb.Type,
+	resultType *exprpb.Type,
+	typeParams []string) *exprpb.Decl_FunctionDecl_Overload {
+	return &exprpb.Decl_FunctionDecl_Overload{
+		OverloadId:         id,
+		ResultType:         resultType,
+		Params:             argTypes,
+		TypeParams:         typeParams,
+		IsInstanceFunction: true}
+}
+
+// NewParameterizedOverload creates a parametric function overload type.
+func NewParameterizedOverload(id string,
+	argTypes []*exprpb.Type,
+	resultType *exprpb.Type,
+	typeParams []string) *exprpb.Decl_FunctionDecl_Overload {
+	return &exprpb.Decl_FunctionDecl_Overload{
+		OverloadId:         id,
+		ResultType:         resultType,
+		Params:             argTypes,
+		TypeParams:         typeParams,
+		IsInstanceFunction: false}
+}
+
+// NewPrimitiveType creates a type for a primitive value. See the var declarations
+// for Int, Uint, etc.
+func NewPrimitiveType(primitive exprpb.Type_PrimitiveType) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_Primitive{
+			Primitive: primitive}}
+}
+
+// NewTypeType creates a new type designating a type.
+func NewTypeType(nested *exprpb.Type) *exprpb.Type {
+	if nested == nil {
+		// must set the nested field for a valid oneof option
+		nested = &exprpb.Type{}
+	}
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_Type{
+			Type: nested}}
+}
+
+// NewTypeParamType creates a type corresponding to a named, contextual parameter.
+func NewTypeParamType(name string) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_TypeParam{
+			TypeParam: name}}
+}
+
+// NewWellKnownType creates a type corresponding to a protobuf well-known type
+// value.
+func NewWellKnownType(wellKnown exprpb.Type_WellKnownType) *exprpb.Type {
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_WellKnown{
+			WellKnown: wellKnown}}
+}
+
+// NewWrapperType creates a wrapped primitive type instance. Wrapped types
+// are roughly equivalent to a nullable, or optionally valued type.
+func NewWrapperType(wrapped *exprpb.Type) *exprpb.Type {
+	primitive := wrapped.GetPrimitive()
+	if primitive == exprpb.Type_PRIMITIVE_TYPE_UNSPECIFIED {
+		// TODO: return an error
+		panic("Wrapped type must be a primitive")
+	}
+	return &exprpb.Type{
+		TypeKind: &exprpb.Type_Wrapper{
+			Wrapper: primitive}}
+}

vendor/github.com/google/cel-go/checker/decls/scopes.go

@@ -0,0 +1,115 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package decls
+
+import exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+
+// Scopes represents nested Decl sets where the Scopes value contains a Groups containing all
+// identifiers in scope and an optional parent representing outer scopes.
+// Each Groups value is a mapping of names to Decls in the ident and function namespaces.
+// Lookups are performed such that bindings in inner scopes shadow those in outer scopes.
+type Scopes struct {
+	parent *Scopes
+	scopes *Group
+}
+
+// NewScopes creates a new, empty Scopes.
+// Some operations can't be safely performed until a Group is added with Push.
+func NewScopes() *Scopes {
+	return &Scopes{
+		scopes: newGroup(),
+	}
+}
+
+// Push creates a new Scopes value which references the current Scope as its parent.
+func (s *Scopes) Push() *Scopes {
+	return &Scopes{
+		parent: s,
+		scopes: newGroup(),
+	}
+}
+
+// Pop returns the parent Scopes value for the current scope, or the current scope if the parent
+// is nil.
+func (s *Scopes) Pop() *Scopes {
+	if s.parent != nil {
+		return s.parent
+	}
+	// TODO: Consider whether this should be an error / panic.
+	return s
+}
+
+// AddIdent adds the ident Decl in the current scope.
+// Note: If the name collides with an existing identifier in the scope, the Decl is overwritten.
+func (s *Scopes) AddIdent(decl *exprpb.Decl) {
+	s.scopes.idents[decl.Name] = decl
+}
+
+// FindIdent finds the first ident Decl with a matching name in Scopes, or nil if one cannot be
+// found.
+// Note: The search is performed from innermost to outermost.
+func (s *Scopes) FindIdent(name string) *exprpb.Decl {
+	if ident, found := s.scopes.idents[name]; found {
+		return ident
+	}
+	if s.parent != nil {
+		return s.parent.FindIdent(name)
+	}
+	return nil
+}
+
+// FindIdentInScope finds the first ident Decl with a matching name in the current Scopes value, or
+// nil if one does not exist.
+// Note: The search is only performed on the current scope and does not search outer scopes.
+func (s *Scopes) FindIdentInScope(name string) *exprpb.Decl {
+	if ident, found := s.scopes.idents[name]; found {
+		return ident
+	}
+	return nil
+}
+
+// AddFunction adds the function Decl to the current scope.
+// Note: Any previous entry for a function in the current scope with the same name is overwritten.
+func (s *Scopes) AddFunction(fn *exprpb.Decl) {
+	s.scopes.functions[fn.Name] = fn
+}
+
+// FindFunction finds the first function Decl with a matching name in Scopes.
+// The search is performed from innermost to outermost.
+// Returns nil if no such function in Scopes.
+func (s *Scopes) FindFunction(name string) *exprpb.Decl {
+	if fn, found := s.scopes.functions[name]; found {
+		return fn
+	}
+	if s.parent != nil {
+		return s.parent.FindFunction(name)
+	}
+	return nil
+}
+
+// Group is a set of Decls that is pushed on or popped off a Scopes as a unit.
+// Contains separate namespaces for idenifier and function Decls.
+// (Should be named "Scope" perhaps?)
+type Group struct {
+	idents    map[string]*exprpb.Decl
+	functions map[string]*exprpb.Decl
+}
+
+func newGroup() *Group {
+	return &Group{
+		idents:    make(map[string]*exprpb.Decl),
+		functions: make(map[string]*exprpb.Decl),
+	}
+}

vendor/github.com/google/cel-go/checker/env.go

@@ -0,0 +1,346 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/pb"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/parser"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+type aggregateLiteralElementType int
+
+const (
+	dynElementType        aggregateLiteralElementType = iota
+	homogenousElementType aggregateLiteralElementType = 1 << iota
+)
+
+// Env is the environment for type checking.
+//
+// The Env is comprised of a container, type provider, declarations, and other related objects
+// which can be used to assist with type-checking.
+type Env struct {
+	container      *containers.Container
+	provider       ref.TypeProvider
+	declarations   *decls.Scopes
+	aggLitElemType aggregateLiteralElementType
+}
+
+// NewEnv returns a new *Env with the given parameters.
+func NewEnv(container *containers.Container, provider ref.TypeProvider) *Env {
+	declarations := decls.NewScopes()
+	declarations.Push()
+
+	return &Env{
+		container:    container,
+		provider:     provider,
+		declarations: declarations,
+	}
+}
+
+// NewStandardEnv returns a new *Env with the given params plus standard declarations.
+func NewStandardEnv(container *containers.Container, provider ref.TypeProvider) *Env {
+	e := NewEnv(container, provider)
+	if err := e.Add(StandardDeclarations()...); err != nil {
+		// The standard declaration set should never have duplicate declarations.
+		panic(err)
+	}
+	// TODO: isolate standard declarations from the custom set which may be provided layer.
+	return e
+}
+
+// EnableDynamicAggregateLiterals detmerines whether list and map literals may support mixed
+// element types at check-time. This does not preclude the presence of a dynamic list or map
+// somewhere in the CEL evaluation process.
+func (e *Env) EnableDynamicAggregateLiterals(enabled bool) *Env {
+	e.aggLitElemType = dynElementType
+	if !enabled {
+		e.aggLitElemType = homogenousElementType
+	}
+	return e
+}
+
+// Add adds new Decl protos to the Env.
+// Returns an error for identifier redeclarations.
+func (e *Env) Add(decls ...*exprpb.Decl) error {
+	errMsgs := make([]errorMsg, 0)
+	for _, decl := range decls {
+		switch decl.DeclKind.(type) {
+		case *exprpb.Decl_Ident:
+			errMsgs = append(errMsgs, e.addIdent(sanitizeIdent(decl)))
+		case *exprpb.Decl_Function:
+			errMsgs = append(errMsgs, e.addFunction(sanitizeFunction(decl))...)
+		}
+	}
+	return formatError(errMsgs)
+}
+
+// LookupIdent returns a Decl proto for typeName as an identifier in the Env.
+// Returns nil if no such identifier is found in the Env.
+func (e *Env) LookupIdent(name string) *exprpb.Decl {
+	for _, candidate := range e.container.ResolveCandidateNames(name) {
+		if ident := e.declarations.FindIdent(candidate); ident != nil {
+			return ident
+		}
+
+		// Next try to import the name as a reference to a message type. If found,
+		// the declaration is added to the outest (global) scope of the
+		// environment, so next time we can access it faster.
+		if t, found := e.provider.FindType(candidate); found {
+			decl := decls.NewVar(candidate, t)
+			e.declarations.AddIdent(decl)
+			return decl
+		}
+
+		// Next try to import this as an enum value by splitting the name in a type prefix and
+		// the enum inside.
+		if enumValue := e.provider.EnumValue(candidate); enumValue.Type() != types.ErrType {
+			decl := decls.NewIdent(candidate,
+				decls.Int,
+				&exprpb.Constant{
+					ConstantKind: &exprpb.Constant_Int64Value{
+						Int64Value: int64(enumValue.(types.Int))}})
+			e.declarations.AddIdent(decl)
+			return decl
+		}
+	}
+	return nil
+}
+
+// LookupFunction returns a Decl proto for typeName as a function in env.
+// Returns nil if no such function is found in env.
+func (e *Env) LookupFunction(name string) *exprpb.Decl {
+	for _, candidate := range e.container.ResolveCandidateNames(name) {
+		if fn := e.declarations.FindFunction(candidate); fn != nil {
+			return fn
+		}
+	}
+	return nil
+}
+
+// addOverload adds overload to function declaration f.
+// Returns one or more errorMsg values if the overload overlaps with an existing overload or macro.
+func (e *Env) addOverload(f *exprpb.Decl, overload *exprpb.Decl_FunctionDecl_Overload) []errorMsg {
+	errMsgs := make([]errorMsg, 0)
+	function := f.GetFunction()
+	emptyMappings := newMapping()
+	overloadFunction := decls.NewFunctionType(overload.GetResultType(),
+		overload.GetParams()...)
+	overloadErased := substitute(emptyMappings, overloadFunction, true)
+	for _, existing := range function.GetOverloads() {
+		existingFunction := decls.NewFunctionType(existing.GetResultType(),
+			existing.GetParams()...)
+		existingErased := substitute(emptyMappings, existingFunction, true)
+		overlap := isAssignable(emptyMappings, overloadErased, existingErased) != nil ||
+			isAssignable(emptyMappings, existingErased, overloadErased) != nil
+		if overlap &&
+			overload.GetIsInstanceFunction() == existing.GetIsInstanceFunction() {
+			errMsgs = append(errMsgs,
+				overlappingOverloadError(f.Name,
+					overload.GetOverloadId(), overloadFunction,
+					existing.GetOverloadId(), existingFunction))
+		}
+	}
+
+	for _, macro := range parser.AllMacros {
+		if macro.Function() == f.Name &&
+			macro.IsReceiverStyle() == overload.GetIsInstanceFunction() &&
+			macro.ArgCount() == len(overload.GetParams()) {
+			errMsgs = append(errMsgs, overlappingMacroError(f.Name, macro.ArgCount()))
+		}
+	}
+	if len(errMsgs) > 0 {
+		return errMsgs
+	}
+	function.Overloads = append(function.GetOverloads(), overload)
+	return errMsgs
+}
+
+// addFunction adds the function Decl to the Env.
+// Adds a function decl if one doesn't already exist, then adds all overloads from the Decl.
+// If overload overlaps with an existing overload, adds to the errors  in the Env instead.
+func (e *Env) addFunction(decl *exprpb.Decl) []errorMsg {
+	current := e.declarations.FindFunction(decl.Name)
+	if current == nil {
+		//Add the function declaration without overloads and check the overloads below.
+		current = decls.NewFunction(decl.Name)
+		e.declarations.AddFunction(current)
+	}
+
+	errorMsgs := make([]errorMsg, 0)
+	for _, overload := range decl.GetFunction().GetOverloads() {
+		errorMsgs = append(errorMsgs, e.addOverload(current, overload)...)
+	}
+	return errorMsgs
+}
+
+// addIdent adds the Decl to the declarations in the Env.
+// Returns a non-empty errorMsg if the identifier is already declared in the scope.
+func (e *Env) addIdent(decl *exprpb.Decl) errorMsg {
+	current := e.declarations.FindIdentInScope(decl.Name)
+	if current != nil {
+		return overlappingIdentifierError(decl.Name)
+	}
+	e.declarations.AddIdent(decl)
+	return ""
+}
+
+// sanitizeFunction replaces well-known types referenced by message name with their equivalent
+// CEL built-in type instances.
+func sanitizeFunction(decl *exprpb.Decl) *exprpb.Decl {
+	fn := decl.GetFunction()
+	// Determine whether the declaration requires replacements from proto-based message type
+	// references to well-known CEL type references.
+	var needsSanitizing bool
+	for _, o := range fn.GetOverloads() {
+		if isObjectWellKnownType(o.GetResultType()) {
+			needsSanitizing = true
+			break
+		}
+		for _, p := range o.GetParams() {
+			if isObjectWellKnownType(p) {
+				needsSanitizing = true
+				break
+			}
+		}
+	}
+
+	// Early return if the declaration requires no modification.
+	if !needsSanitizing {
+		return decl
+	}
+
+	// Sanitize all of the overloads if any overload requires an update to its type references.
+	overloads := make([]*exprpb.Decl_FunctionDecl_Overload, len(fn.GetOverloads()))
+	for i, o := range fn.GetOverloads() {
+		rt := o.GetResultType()
+		if isObjectWellKnownType(rt) {
+			rt = getObjectWellKnownType(rt)
+		}
+		params := make([]*exprpb.Type, len(o.GetParams()))
+		copy(params, o.GetParams())
+		for j, p := range params {
+			if isObjectWellKnownType(p) {
+				params[j] = getObjectWellKnownType(p)
+			}
+		}
+		// If sanitized, replace the overload definition.
+		if o.IsInstanceFunction {
+			overloads[i] =
+				decls.NewInstanceOverload(o.GetOverloadId(), params, rt)
+		} else {
+			overloads[i] =
+				decls.NewOverload(o.GetOverloadId(), params, rt)
+		}
+	}
+	return decls.NewFunction(decl.GetName(), overloads...)
+}
+
+// sanitizeIdent replaces the identifier's well-known types referenced by message name with
+// references to CEL built-in type instances.
+func sanitizeIdent(decl *exprpb.Decl) *exprpb.Decl {
+	id := decl.GetIdent()
+	t := id.GetType()
+	if !isObjectWellKnownType(t) {
+		return decl
+	}
+	return decls.NewIdent(decl.GetName(), getObjectWellKnownType(t), id.GetValue())
+}
+
+// isObjectWellKnownType returns true if the input type is an OBJECT type with a message name
+// that corresponds the message name of a built-in CEL type.
+func isObjectWellKnownType(t *exprpb.Type) bool {
+	if kindOf(t) != kindObject {
+		return false
+	}
+	_, found := pb.CheckedWellKnowns[t.GetMessageType()]
+	return found
+}
+
+// getObjectWellKnownType returns the built-in CEL type declaration for input type's message name.
+func getObjectWellKnownType(t *exprpb.Type) *exprpb.Type {
+	return pb.CheckedWellKnowns[t.GetMessageType()]
+}
+
+// enterScope creates a new Env instance with a new innermost declaration scope.
+func (e *Env) enterScope() *Env {
+	childDecls := e.declarations.Push()
+	return &Env{
+		declarations:   childDecls,
+		container:      e.container,
+		provider:       e.provider,
+		aggLitElemType: e.aggLitElemType,
+	}
+}
+
+// exitScope creates a new Env instance with the nearest outer declaration scope.
+func (e *Env) exitScope() *Env {
+	parentDecls := e.declarations.Pop()
+	return &Env{
+		declarations:   parentDecls,
+		container:      e.container,
+		provider:       e.provider,
+		aggLitElemType: e.aggLitElemType,
+	}
+}
+
+// errorMsg is a type alias meant to represent error-based return values which
+// may be accumulated into an error at a later point in execution.
+type errorMsg string
+
+func overlappingIdentifierError(name string) errorMsg {
+	return errorMsg(fmt.Sprintf("overlapping identifier for name '%s'", name))
+}
+
+func overlappingOverloadError(name string,
+	overloadID1 string, f1 *exprpb.Type,
+	overloadID2 string, f2 *exprpb.Type) errorMsg {
+	return errorMsg(fmt.Sprintf(
+		"overlapping overload for name '%s' (type '%s' with overloadId: '%s' "+
+			"cannot be distinguished from '%s' with overloadId: '%s')",
+		name,
+		FormatCheckedType(f1),
+		overloadID1,
+		FormatCheckedType(f2),
+		overloadID2))
+}
+
+func overlappingMacroError(name string, argCount int) errorMsg {
+	return errorMsg(fmt.Sprintf(
+		"overlapping macro for name '%s' with %d args", name, argCount))
+}
+
+func formatError(errMsgs []errorMsg) error {
+	errStrs := make([]string, 0)
+	if len(errMsgs) > 0 {
+		for i := 0; i < len(errMsgs); i++ {
+			if errMsgs[i] != "" {
+				errStrs = append(errStrs, string(errMsgs[i]))
+			}
+		}
+	}
+	if len(errStrs) > 0 {
+		return fmt.Errorf("%s", strings.Join(errStrs, "\n"))
+	}
+	return nil
+}

vendor/github.com/google/cel-go/checker/errors.go

@@ -0,0 +1,100 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"github.com/google/cel-go/common"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+// typeErrors is a specialization of Errors.
+type typeErrors struct {
+	*common.Errors
+}
+
+func (e *typeErrors) undeclaredReference(l common.Location, container string, name string) {
+	e.ReportError(l, "undeclared reference to '%s' (in container '%s')", name, container)
+}
+
+func (e *typeErrors) expressionDoesNotSelectField(l common.Location) {
+	e.ReportError(l, "expression does not select a field")
+}
+
+func (e *typeErrors) typeDoesNotSupportFieldSelection(l common.Location, t *exprpb.Type) {
+	e.ReportError(l, "type '%s' does not support field selection", t)
+}
+
+func (e *typeErrors) undefinedField(l common.Location, field string) {
+	e.ReportError(l, "undefined field '%s'", field)
+}
+
+func (e *typeErrors) noMatchingOverload(l common.Location, name string, args []*exprpb.Type, isInstance bool) {
+	signature := formatFunction(nil, args, isInstance)
+	e.ReportError(l, "found no matching overload for '%s' applied to '%s'", name, signature)
+}
+
+func (e *typeErrors) notAType(l common.Location, t *exprpb.Type) {
+	e.ReportError(l, "'%s(%v)' is not a type", FormatCheckedType(t), t)
+}
+
+func (e *typeErrors) notAMessageType(l common.Location, t *exprpb.Type) {
+	e.ReportError(l, "'%s' is not a message type", FormatCheckedType(t))
+}
+
+func (e *typeErrors) fieldTypeMismatch(l common.Location, name string, field *exprpb.Type, value *exprpb.Type) {
+	e.ReportError(l, "expected type of field '%s' is '%s' but provided type is '%s'",
+		name, FormatCheckedType(field), FormatCheckedType(value))
+}
+
+func (e *typeErrors) unexpectedFailedResolution(l common.Location, typeName string) {
+	e.ReportError(l, "[internal] unexpected failed resolution of '%s'", typeName)
+}
+
+func (e *typeErrors) notAComprehensionRange(l common.Location, t *exprpb.Type) {
+	e.ReportError(l, "expression of type '%s' cannot be range of a comprehension (must be list, map, or dynamic)",
+		FormatCheckedType(t))
+}
+
+func (e *typeErrors) typeMismatch(l common.Location, expected *exprpb.Type, actual *exprpb.Type) {
+	e.ReportError(l, "expected type '%s' but found '%s'",
+		FormatCheckedType(expected), FormatCheckedType(actual))
+}
+
+func formatFunction(resultType *exprpb.Type, argTypes []*exprpb.Type, isInstance bool) string {
+	result := ""
+	if isInstance {
+		target := argTypes[0]
+		argTypes = argTypes[1:]
+
+		result += FormatCheckedType(target)
+		result += "."
+	}
+
+	result += "("
+	for i, arg := range argTypes {
+		if i > 0 {
+			result += ", "
+		}
+		result += FormatCheckedType(arg)
+	}
+	result += ")"
+	if resultType != nil {
+		result += " -> "
+		result += FormatCheckedType(resultType)
+	}
+
+	return result
+}

vendor/github.com/google/cel-go/checker/mapping.go

@@ -0,0 +1,49 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+type mapping struct {
+	mapping map[string]*exprpb.Type
+}
+
+func newMapping() *mapping {
+	return &mapping{
+		mapping: make(map[string]*exprpb.Type),
+	}
+}
+
+func (m *mapping) add(from *exprpb.Type, to *exprpb.Type) {
+	m.mapping[typeKey(from)] = to
+}
+
+func (m *mapping) find(from *exprpb.Type) (*exprpb.Type, bool) {
+	if r, found := m.mapping[typeKey(from)]; found {
+		return r, found
+	}
+	return nil, false
+}
+
+func (m *mapping) copy() *mapping {
+	c := newMapping()
+
+	for k, v := range m.mapping {
+		c.mapping[k] = v
+	}
+	return c
+}

vendor/github.com/google/cel-go/checker/printer.go

@@ -0,0 +1,71 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"github.com/google/cel-go/common/debug"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+type semanticAdorner struct {
+	checks *exprpb.CheckedExpr
+}
+
+var _ debug.Adorner = &semanticAdorner{}
+
+func (a *semanticAdorner) GetMetadata(elem interface{}) string {
+	result := ""
+	e, isExpr := elem.(*exprpb.Expr)
+	if !isExpr {
+		return result
+	}
+	t := a.checks.TypeMap[e.Id]
+	if t != nil {
+		result += "~"
+		result += FormatCheckedType(t)
+	}
+
+	switch e.ExprKind.(type) {
+	case *exprpb.Expr_IdentExpr,
+		*exprpb.Expr_CallExpr,
+		*exprpb.Expr_StructExpr,
+		*exprpb.Expr_SelectExpr:
+		if ref, found := a.checks.ReferenceMap[e.Id]; found {
+			if len(ref.GetOverloadId()) == 0 {
+				result += "^" + ref.Name
+			} else {
+				for i, overload := range ref.OverloadId {
+					if i == 0 {
+						result += "^"
+					} else {
+						result += "|"
+					}
+					result += overload
+				}
+			}
+		}
+	}
+
+	return result
+}
+
+// Print returns a string representation of the Expr message,
+// annotated with types from the CheckedExpr.  The Expr must
+// be a sub-expression embedded in the CheckedExpr.
+func Print(e *exprpb.Expr, checks *exprpb.CheckedExpr) string {
+	a := &semanticAdorner{checks: checks}
+	return debug.ToAdornedDebugString(e, a)
+}

vendor/github.com/google/cel-go/checker/standard.go

@@ -0,0 +1,440 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+// StandardDeclarations returns the Decls for all functions and constants in the evaluator.
+func StandardDeclarations() []*exprpb.Decl {
+	// Some shortcuts we use when building declarations.
+	paramA := decls.NewTypeParamType("A")
+	typeParamAList := []string{"A"}
+	listOfA := decls.NewListType(paramA)
+	paramB := decls.NewTypeParamType("B")
+	typeParamABList := []string{"A", "B"}
+	mapOfAB := decls.NewMapType(paramA, paramB)
+
+	var idents []*exprpb.Decl
+	for _, t := range []*exprpb.Type{
+		decls.Int, decls.Uint, decls.Bool,
+		decls.Double, decls.Bytes, decls.String} {
+		idents = append(idents,
+			decls.NewVar(FormatCheckedType(t), decls.NewTypeType(t)))
+	}
+	idents = append(idents,
+		decls.NewVar("list", decls.NewTypeType(listOfA)),
+		decls.NewVar("map", decls.NewTypeType(mapOfAB)),
+		decls.NewVar("null_type", decls.NewTypeType(decls.Null)),
+		decls.NewVar("type", decls.NewTypeType(decls.NewTypeType(nil))))
+
+	// Booleans
+	// TODO: allow the conditional to return a heterogenous type.
+	return append(idents, []*exprpb.Decl{
+		decls.NewFunction(operators.Conditional,
+			decls.NewParameterizedOverload(overloads.Conditional,
+				[]*exprpb.Type{decls.Bool, paramA, paramA}, paramA,
+				typeParamAList)),
+
+		decls.NewFunction(operators.LogicalAnd,
+			decls.NewOverload(overloads.LogicalAnd,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool)),
+
+		decls.NewFunction(operators.LogicalOr,
+			decls.NewOverload(overloads.LogicalOr,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool)),
+
+		decls.NewFunction(operators.LogicalNot,
+			decls.NewOverload(overloads.LogicalNot,
+				[]*exprpb.Type{decls.Bool}, decls.Bool)),
+
+		decls.NewFunction(operators.NotStrictlyFalse,
+			decls.NewOverload(overloads.NotStrictlyFalse,
+				[]*exprpb.Type{decls.Bool}, decls.Bool)),
+
+		// Relations.
+
+		decls.NewFunction(operators.Less,
+			decls.NewOverload(overloads.LessBool,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
+			decls.NewOverload(overloads.LessInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
+			decls.NewOverload(overloads.LessUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
+			decls.NewOverload(overloads.LessDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
+			decls.NewOverload(overloads.LessString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
+			decls.NewOverload(overloads.LessBytes,
+				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
+			decls.NewOverload(overloads.LessTimestamp,
+				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
+			decls.NewOverload(overloads.LessDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
+
+		decls.NewFunction(operators.LessEquals,
+			decls.NewOverload(overloads.LessEqualsBool,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsBytes,
+				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsTimestamp,
+				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
+			decls.NewOverload(overloads.LessEqualsDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
+
+		decls.NewFunction(operators.Greater,
+			decls.NewOverload(overloads.GreaterBool,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
+			decls.NewOverload(overloads.GreaterInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
+			decls.NewOverload(overloads.GreaterUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
+			decls.NewOverload(overloads.GreaterDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
+			decls.NewOverload(overloads.GreaterString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
+			decls.NewOverload(overloads.GreaterBytes,
+				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
+			decls.NewOverload(overloads.GreaterTimestamp,
+				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
+			decls.NewOverload(overloads.GreaterDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
+
+		decls.NewFunction(operators.GreaterEquals,
+			decls.NewOverload(overloads.GreaterEqualsBool,
+				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsBytes,
+				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsTimestamp,
+				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
+			decls.NewOverload(overloads.GreaterEqualsDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
+
+		decls.NewFunction(operators.Equals,
+			decls.NewParameterizedOverload(overloads.Equals,
+				[]*exprpb.Type{paramA, paramA}, decls.Bool,
+				typeParamAList)),
+
+		decls.NewFunction(operators.NotEquals,
+			decls.NewParameterizedOverload(overloads.NotEquals,
+				[]*exprpb.Type{paramA, paramA}, decls.Bool,
+				typeParamAList)),
+
+		// Algebra.
+
+		decls.NewFunction(operators.Subtract,
+			decls.NewOverload(overloads.SubtractInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
+			decls.NewOverload(overloads.SubtractUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
+			decls.NewOverload(overloads.SubtractDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double),
+			decls.NewOverload(overloads.SubtractTimestampTimestamp,
+				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Duration),
+			decls.NewOverload(overloads.SubtractTimestampDuration,
+				[]*exprpb.Type{decls.Timestamp, decls.Duration}, decls.Timestamp),
+			decls.NewOverload(overloads.SubtractDurationDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Duration)),
+
+		decls.NewFunction(operators.Multiply,
+			decls.NewOverload(overloads.MultiplyInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
+			decls.NewOverload(overloads.MultiplyUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
+			decls.NewOverload(overloads.MultiplyDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double)),
+
+		decls.NewFunction(operators.Divide,
+			decls.NewOverload(overloads.DivideInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
+			decls.NewOverload(overloads.DivideUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
+			decls.NewOverload(overloads.DivideDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double)),
+
+		decls.NewFunction(operators.Modulo,
+			decls.NewOverload(overloads.ModuloInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
+			decls.NewOverload(overloads.ModuloUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint)),
+
+		decls.NewFunction(operators.Add,
+			decls.NewOverload(overloads.AddInt64,
+				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
+			decls.NewOverload(overloads.AddUint64,
+				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
+			decls.NewOverload(overloads.AddDouble,
+				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double),
+			decls.NewOverload(overloads.AddString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.String),
+			decls.NewOverload(overloads.AddBytes,
+				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bytes),
+			decls.NewParameterizedOverload(overloads.AddList,
+				[]*exprpb.Type{listOfA, listOfA}, listOfA,
+				typeParamAList),
+			decls.NewOverload(overloads.AddTimestampDuration,
+				[]*exprpb.Type{decls.Timestamp, decls.Duration}, decls.Timestamp),
+			decls.NewOverload(overloads.AddDurationTimestamp,
+				[]*exprpb.Type{decls.Duration, decls.Timestamp}, decls.Timestamp),
+			decls.NewOverload(overloads.AddDurationDuration,
+				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Duration)),
+
+		decls.NewFunction(operators.Negate,
+			decls.NewOverload(overloads.NegateInt64,
+				[]*exprpb.Type{decls.Int}, decls.Int),
+			decls.NewOverload(overloads.NegateDouble,
+				[]*exprpb.Type{decls.Double}, decls.Double)),
+
+		// Index.
+
+		decls.NewFunction(operators.Index,
+			decls.NewParameterizedOverload(overloads.IndexList,
+				[]*exprpb.Type{listOfA, decls.Int}, paramA,
+				typeParamAList),
+			decls.NewParameterizedOverload(overloads.IndexMap,
+				[]*exprpb.Type{mapOfAB, paramA}, paramB,
+				typeParamABList)),
+		//decls.NewOverload(overloads.IndexMessage,
+		//	[]*expr.Type{decls.Dyn, decls.String}, decls.Dyn)),
+
+		// Collections.
+
+		decls.NewFunction(overloads.Size,
+			decls.NewInstanceOverload(overloads.SizeStringInst,
+				[]*exprpb.Type{decls.String}, decls.Int),
+			decls.NewInstanceOverload(overloads.SizeBytesInst,
+				[]*exprpb.Type{decls.Bytes}, decls.Int),
+			decls.NewParameterizedInstanceOverload(overloads.SizeListInst,
+				[]*exprpb.Type{listOfA}, decls.Int, typeParamAList),
+			decls.NewParameterizedInstanceOverload(overloads.SizeMapInst,
+				[]*exprpb.Type{mapOfAB}, decls.Int, typeParamABList),
+			decls.NewOverload(overloads.SizeString,
+				[]*exprpb.Type{decls.String}, decls.Int),
+			decls.NewOverload(overloads.SizeBytes,
+				[]*exprpb.Type{decls.Bytes}, decls.Int),
+			decls.NewParameterizedOverload(overloads.SizeList,
+				[]*exprpb.Type{listOfA}, decls.Int, typeParamAList),
+			decls.NewParameterizedOverload(overloads.SizeMap,
+				[]*exprpb.Type{mapOfAB}, decls.Int, typeParamABList)),
+
+		decls.NewFunction(operators.In,
+			decls.NewParameterizedOverload(overloads.InList,
+				[]*exprpb.Type{paramA, listOfA}, decls.Bool,
+				typeParamAList),
+			decls.NewParameterizedOverload(overloads.InMap,
+				[]*exprpb.Type{paramA, mapOfAB}, decls.Bool,
+				typeParamABList)),
+
+		// Deprecated 'in()' function.
+
+		decls.NewFunction(overloads.DeprecatedIn,
+			decls.NewParameterizedOverload(overloads.InList,
+				[]*exprpb.Type{paramA, listOfA}, decls.Bool,
+				typeParamAList),
+			decls.NewParameterizedOverload(overloads.InMap,
+				[]*exprpb.Type{paramA, mapOfAB}, decls.Bool,
+				typeParamABList)),
+		//decls.NewOverload(overloads.InMessage,
+		//	[]*expr.Type{Dyn, decls.String},decls.Bool)),
+
+		// Conversions to type.
+
+		decls.NewFunction(overloads.TypeConvertType,
+			decls.NewParameterizedOverload(overloads.TypeConvertType,
+				[]*exprpb.Type{paramA}, decls.NewTypeType(paramA), typeParamAList)),
+
+		// Conversions to int.
+
+		decls.NewFunction(overloads.TypeConvertInt,
+			decls.NewOverload(overloads.IntToInt, []*exprpb.Type{decls.Int}, decls.Int),
+			decls.NewOverload(overloads.UintToInt, []*exprpb.Type{decls.Uint}, decls.Int),
+			decls.NewOverload(overloads.DoubleToInt, []*exprpb.Type{decls.Double}, decls.Int),
+			decls.NewOverload(overloads.StringToInt, []*exprpb.Type{decls.String}, decls.Int),
+			decls.NewOverload(overloads.TimestampToInt, []*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewOverload(overloads.DurationToInt, []*exprpb.Type{decls.Duration}, decls.Int)),
+
+		// Conversions to uint.
+
+		decls.NewFunction(overloads.TypeConvertUint,
+			decls.NewOverload(overloads.UintToUint, []*exprpb.Type{decls.Uint}, decls.Uint),
+			decls.NewOverload(overloads.IntToUint, []*exprpb.Type{decls.Int}, decls.Uint),
+			decls.NewOverload(overloads.DoubleToUint, []*exprpb.Type{decls.Double}, decls.Uint),
+			decls.NewOverload(overloads.StringToUint, []*exprpb.Type{decls.String}, decls.Uint)),
+
+		// Conversions to double.
+
+		decls.NewFunction(overloads.TypeConvertDouble,
+			decls.NewOverload(overloads.DoubleToDouble, []*exprpb.Type{decls.Double}, decls.Double),
+			decls.NewOverload(overloads.IntToDouble, []*exprpb.Type{decls.Int}, decls.Double),
+			decls.NewOverload(overloads.UintToDouble, []*exprpb.Type{decls.Uint}, decls.Double),
+			decls.NewOverload(overloads.StringToDouble, []*exprpb.Type{decls.String}, decls.Double)),
+
+		// Conversions to bool.
+
+		decls.NewFunction(overloads.TypeConvertBool,
+			decls.NewOverload(overloads.BoolToBool, []*exprpb.Type{decls.Bool}, decls.Bool),
+			decls.NewOverload(overloads.StringToBool, []*exprpb.Type{decls.String}, decls.Bool)),
+
+		// Conversions to string.
+
+		decls.NewFunction(overloads.TypeConvertString,
+			decls.NewOverload(overloads.StringToString, []*exprpb.Type{decls.String}, decls.String),
+			decls.NewOverload(overloads.BoolToString, []*exprpb.Type{decls.Bool}, decls.String),
+			decls.NewOverload(overloads.IntToString, []*exprpb.Type{decls.Int}, decls.String),
+			decls.NewOverload(overloads.UintToString, []*exprpb.Type{decls.Uint}, decls.String),
+			decls.NewOverload(overloads.DoubleToString, []*exprpb.Type{decls.Double}, decls.String),
+			decls.NewOverload(overloads.BytesToString, []*exprpb.Type{decls.Bytes}, decls.String),
+			decls.NewOverload(overloads.TimestampToString, []*exprpb.Type{decls.Timestamp}, decls.String),
+			decls.NewOverload(overloads.DurationToString, []*exprpb.Type{decls.Duration}, decls.String)),
+
+		// Conversions to bytes.
+
+		decls.NewFunction(overloads.TypeConvertBytes,
+			decls.NewOverload(overloads.BytesToBytes, []*exprpb.Type{decls.Bytes}, decls.Bytes),
+			decls.NewOverload(overloads.StringToBytes, []*exprpb.Type{decls.String}, decls.Bytes)),
+
+		// Conversions to timestamps.
+
+		decls.NewFunction(overloads.TypeConvertTimestamp,
+			decls.NewOverload(overloads.TimestampToTimestamp,
+				[]*exprpb.Type{decls.Timestamp}, decls.Timestamp),
+			decls.NewOverload(overloads.StringToTimestamp,
+				[]*exprpb.Type{decls.String}, decls.Timestamp),
+			decls.NewOverload(overloads.IntToTimestamp,
+				[]*exprpb.Type{decls.Int}, decls.Timestamp)),
+
+		// Conversions to durations.
+
+		decls.NewFunction(overloads.TypeConvertDuration,
+			decls.NewOverload(overloads.DurationToDuration,
+				[]*exprpb.Type{decls.Duration}, decls.Duration),
+			decls.NewOverload(overloads.StringToDuration,
+				[]*exprpb.Type{decls.String}, decls.Duration),
+			decls.NewOverload(overloads.IntToDuration,
+				[]*exprpb.Type{decls.Int}, decls.Duration)),
+
+		// Conversions to Dyn.
+
+		decls.NewFunction(overloads.TypeConvertDyn,
+			decls.NewParameterizedOverload(overloads.ToDyn,
+				[]*exprpb.Type{paramA}, decls.Dyn,
+				typeParamAList)),
+
+		// String functions.
+
+		decls.NewFunction(overloads.Contains,
+			decls.NewInstanceOverload(overloads.ContainsString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
+		decls.NewFunction(overloads.EndsWith,
+			decls.NewInstanceOverload(overloads.EndsWithString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
+		decls.NewFunction(overloads.Matches,
+			decls.NewInstanceOverload(overloads.MatchesString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
+		decls.NewFunction(overloads.StartsWith,
+			decls.NewInstanceOverload(overloads.StartsWithString,
+				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
+
+		// Date/time functions.
+
+		decls.NewFunction(overloads.TimeGetFullYear,
+			decls.NewInstanceOverload(overloads.TimestampToYear,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToYearWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetMonth,
+			decls.NewInstanceOverload(overloads.TimestampToMonth,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToMonthWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetDayOfYear,
+			decls.NewInstanceOverload(overloads.TimestampToDayOfYear,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToDayOfYearWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetDayOfMonth,
+			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthZeroBased,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthZeroBasedWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetDate,
+			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthOneBased,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthOneBasedWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetDayOfWeek,
+			decls.NewInstanceOverload(overloads.TimestampToDayOfWeek,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToDayOfWeekWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetHours,
+			decls.NewInstanceOverload(overloads.TimestampToHours,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToHoursWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
+			decls.NewInstanceOverload(overloads.DurationToHours,
+				[]*exprpb.Type{decls.Duration}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetMinutes,
+			decls.NewInstanceOverload(overloads.TimestampToMinutes,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToMinutesWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
+			decls.NewInstanceOverload(overloads.DurationToMinutes,
+				[]*exprpb.Type{decls.Duration}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetSeconds,
+			decls.NewInstanceOverload(overloads.TimestampToSeconds,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToSecondsWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
+			decls.NewInstanceOverload(overloads.DurationToSeconds,
+				[]*exprpb.Type{decls.Duration}, decls.Int)),
+
+		decls.NewFunction(overloads.TimeGetMilliseconds,
+			decls.NewInstanceOverload(overloads.TimestampToMilliseconds,
+				[]*exprpb.Type{decls.Timestamp}, decls.Int),
+			decls.NewInstanceOverload(overloads.TimestampToMillisecondsWithTz,
+				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
+			decls.NewInstanceOverload(overloads.DurationToMilliseconds,
+				[]*exprpb.Type{decls.Duration}, decls.Int))}...)
+}

vendor/github.com/google/cel-go/checker/types.go

@@ -0,0 +1,505 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/google/cel-go/checker/decls"
+
+	"google.golang.org/protobuf/proto"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+const (
+	kindUnknown = iota + 1
+	kindError
+	kindFunction
+	kindDyn
+	kindPrimitive
+	kindWellKnown
+	kindWrapper
+	kindNull
+	kindAbstract
+	kindType
+	kindList
+	kindMap
+	kindObject
+	kindTypeParam
+)
+
+// FormatCheckedType converts a type message into a string representation.
+func FormatCheckedType(t *exprpb.Type) string {
+	switch kindOf(t) {
+	case kindDyn:
+		return "dyn"
+	case kindFunction:
+		return formatFunction(t.GetFunction().GetResultType(),
+			t.GetFunction().GetArgTypes(),
+			false)
+	case kindList:
+		return fmt.Sprintf("list(%s)", FormatCheckedType(t.GetListType().ElemType))
+	case kindObject:
+		return t.GetMessageType()
+	case kindMap:
+		return fmt.Sprintf("map(%s, %s)",
+			FormatCheckedType(t.GetMapType().KeyType),
+			FormatCheckedType(t.GetMapType().ValueType))
+	case kindNull:
+		return "null"
+	case kindPrimitive:
+		switch t.GetPrimitive() {
+		case exprpb.Type_UINT64:
+			return "uint"
+		case exprpb.Type_INT64:
+			return "int"
+		}
+		return strings.Trim(strings.ToLower(t.GetPrimitive().String()), " ")
+	case kindType:
+		if t.GetType() == nil {
+			return "type"
+		}
+		return fmt.Sprintf("type(%s)", FormatCheckedType(t.GetType()))
+	case kindWellKnown:
+		switch t.GetWellKnown() {
+		case exprpb.Type_ANY:
+			return "any"
+		case exprpb.Type_DURATION:
+			return "duration"
+		case exprpb.Type_TIMESTAMP:
+			return "timestamp"
+		}
+	case kindWrapper:
+		return fmt.Sprintf("wrapper(%s)",
+			FormatCheckedType(decls.NewPrimitiveType(t.GetWrapper())))
+	case kindError:
+		return "!error!"
+	}
+	return t.String()
+}
+
+// isDyn returns true if the input t is either type DYN or a well-known ANY message.
+func isDyn(t *exprpb.Type) bool {
+	// Note: object type values that are well-known and map to a DYN value in practice
+	// are sanitized prior to being added to the environment.
+	switch kindOf(t) {
+	case kindDyn:
+		return true
+	case kindWellKnown:
+		return t.GetWellKnown() == exprpb.Type_ANY
+	default:
+		return false
+	}
+}
+
+// isDynOrError returns true if the input is either an Error, DYN, or well-known ANY message.
+func isDynOrError(t *exprpb.Type) bool {
+	switch kindOf(t) {
+	case kindError:
+		return true
+	default:
+		return isDyn(t)
+	}
+}
+
+// isEqualOrLessSpecific checks whether one type is equal or less specific than the other one.
+// A type is less specific if it matches the other type using the DYN type.
+func isEqualOrLessSpecific(t1 *exprpb.Type, t2 *exprpb.Type) bool {
+	kind1, kind2 := kindOf(t1), kindOf(t2)
+	// The first type is less specific.
+	if isDyn(t1) || kind1 == kindTypeParam {
+		return true
+	}
+	// The first type is not less specific.
+	if isDyn(t2) || kind2 == kindTypeParam {
+		return false
+	}
+	// Types must be of the same kind to be equal.
+	if kind1 != kind2 {
+		return false
+	}
+
+	// With limited exceptions for ANY and JSON values, the types must agree and be equivalent in
+	// order to return true.
+	switch kind1 {
+	case kindAbstract:
+		a1 := t1.GetAbstractType()
+		a2 := t2.GetAbstractType()
+		if a1.GetName() != a2.GetName() ||
+			len(a1.GetParameterTypes()) != len(a2.GetParameterTypes()) {
+			return false
+		}
+		for i, p1 := range a1.GetParameterTypes() {
+			if !isEqualOrLessSpecific(p1, a2.GetParameterTypes()[i]) {
+				return false
+			}
+		}
+		return true
+	case kindFunction:
+		fn1 := t1.GetFunction()
+		fn2 := t2.GetFunction()
+		if len(fn1.ArgTypes) != len(fn2.ArgTypes) {
+			return false
+		}
+		if !isEqualOrLessSpecific(fn1.ResultType, fn2.ResultType) {
+			return false
+		}
+		for i, a1 := range fn1.ArgTypes {
+			if !isEqualOrLessSpecific(a1, fn2.ArgTypes[i]) {
+				return false
+			}
+		}
+		return true
+	case kindList:
+		return isEqualOrLessSpecific(t1.GetListType().ElemType, t2.GetListType().ElemType)
+	case kindMap:
+		m1 := t1.GetMapType()
+		m2 := t2.GetMapType()
+		return isEqualOrLessSpecific(m1.KeyType, m2.KeyType) &&
+			isEqualOrLessSpecific(m1.ValueType, m2.ValueType)
+	case kindType:
+		return true
+	default:
+		return proto.Equal(t1, t2)
+	}
+}
+
+/// internalIsAssignable returns true if t1 is assignable to t2.
+func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
+	// A type is always assignable to itself.
+	// Early terminate the call to avoid cases of infinite recursion.
+	if proto.Equal(t1, t2) {
+		return true
+	}
+	// Process type parameters.
+	kind1, kind2 := kindOf(t1), kindOf(t2)
+	if kind2 == kindTypeParam {
+		if t2Sub, found := m.find(t2); found {
+			// If the types are compatible, pick the more general type and return true
+			if !internalIsAssignable(m, t1, t2Sub) {
+				return false
+			}
+			m.add(t2, mostGeneral(t1, t2Sub))
+			return true
+		}
+		if notReferencedIn(m, t2, t1) {
+			m.add(t2, t1)
+			return true
+		}
+	}
+	if kind1 == kindTypeParam {
+		// For the lower type bound, we currently do not perform adjustment. The restricted
+		// way we use type parameters in lower type bounds, it is not necessary, but may
+		// become if we generalize type unification.
+		if t1Sub, found := m.find(t1); found {
+			// If the types are compatible, pick the more general type and return true
+			if !internalIsAssignable(m, t1Sub, t2) {
+				return false
+			}
+			m.add(t1, mostGeneral(t1Sub, t2))
+			return true
+		}
+		if notReferencedIn(m, t1, t2) {
+			m.add(t1, t2)
+			return true
+		}
+	}
+
+	// Next check for wildcard types.
+	if isDynOrError(t1) || isDynOrError(t2) {
+		return true
+	}
+
+	// Test for when the types do not need to agree, but are more specific than dyn.
+	switch kind1 {
+	case kindNull:
+		return internalIsAssignableNull(t2)
+	case kindPrimitive:
+		return internalIsAssignablePrimitive(t1.GetPrimitive(), t2)
+	case kindWrapper:
+		return internalIsAssignable(m, decls.NewPrimitiveType(t1.GetWrapper()), t2)
+	default:
+		if kind1 != kind2 {
+			return false
+		}
+	}
+
+	// Test for when the types must agree.
+	switch kind1 {
+	// ERROR, TYPE_PARAM, and DYN handled above.
+	case kindAbstract:
+		return internalIsAssignableAbstractType(m, t1.GetAbstractType(), t2.GetAbstractType())
+	case kindFunction:
+		return internalIsAssignableFunction(m, t1.GetFunction(), t2.GetFunction())
+	case kindList:
+		return internalIsAssignable(m, t1.GetListType().GetElemType(), t2.GetListType().GetElemType())
+	case kindMap:
+		return internalIsAssignableMap(m, t1.GetMapType(), t2.GetMapType())
+	case kindObject:
+		return t1.GetMessageType() == t2.GetMessageType()
+	case kindType:
+		// A type is a type is a type, any additional parameterization of the
+		// type cannot affect method resolution or assignability.
+		return true
+	case kindWellKnown:
+		return t1.GetWellKnown() == t2.GetWellKnown()
+	default:
+		return false
+	}
+}
+
+// internalIsAssignableAbstractType returns true if the abstract type names agree and all type
+// parameters are assignable.
+func internalIsAssignableAbstractType(m *mapping,
+	a1 *exprpb.Type_AbstractType,
+	a2 *exprpb.Type_AbstractType) bool {
+	if a1.GetName() != a2.GetName() {
+		return false
+	}
+	if internalIsAssignableList(m, a1.GetParameterTypes(), a2.GetParameterTypes()) {
+		return true
+	}
+	return false
+}
+
+// internalIsAssignableFunction returns true if the function return type and arg types are
+// assignable.
+func internalIsAssignableFunction(m *mapping,
+	f1 *exprpb.Type_FunctionType,
+	f2 *exprpb.Type_FunctionType) bool {
+	f1ArgTypes := flattenFunctionTypes(f1)
+	f2ArgTypes := flattenFunctionTypes(f2)
+	if internalIsAssignableList(m, f1ArgTypes, f2ArgTypes) {
+		return true
+	}
+	return false
+}
+
+// internalIsAssignableList returns true if the element types at each index in the list are
+// assignable from l1[i] to l2[i]. The list lengths must also agree for the lists to be
+// assignable.
+func internalIsAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type) bool {
+	if len(l1) != len(l2) {
+		return false
+	}
+	for i, t1 := range l1 {
+		if !internalIsAssignable(m, t1, l2[i]) {
+			return false
+		}
+	}
+	return true
+}
+
+// internalIsAssignableMap returns true if map m1 may be assigned to map m2.
+func internalIsAssignableMap(m *mapping, m1 *exprpb.Type_MapType, m2 *exprpb.Type_MapType) bool {
+	if internalIsAssignableList(m,
+		[]*exprpb.Type{m1.GetKeyType(), m1.GetValueType()},
+		[]*exprpb.Type{m2.GetKeyType(), m2.GetValueType()}) {
+		return true
+	}
+	return false
+}
+
+// internalIsAssignableNull returns true if the type is nullable.
+func internalIsAssignableNull(t *exprpb.Type) bool {
+	switch kindOf(t) {
+	case kindAbstract, kindObject, kindNull, kindWellKnown, kindWrapper:
+		return true
+	default:
+		return false
+	}
+}
+
+// internalIsAssignablePrimitive returns true if the target type is the same or if it is a wrapper
+// for the primitive type.
+func internalIsAssignablePrimitive(p exprpb.Type_PrimitiveType, target *exprpb.Type) bool {
+	switch kindOf(target) {
+	case kindPrimitive:
+		return p == target.GetPrimitive()
+	case kindWrapper:
+		return p == target.GetWrapper()
+	default:
+		return false
+	}
+}
+
+// isAssignable returns an updated type substitution mapping if t1 is assignable to t2.
+func isAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) *mapping {
+	mCopy := m.copy()
+	if internalIsAssignable(mCopy, t1, t2) {
+		return mCopy
+	}
+	return nil
+}
+
+// isAssignableList returns an updated type substitution mapping if l1 is assignable to l2.
+func isAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type) *mapping {
+	mCopy := m.copy()
+	if internalIsAssignableList(mCopy, l1, l2) {
+		return mCopy
+	}
+	return nil
+}
+
+// kindOf returns the kind of the type as defined in the checked.proto.
+func kindOf(t *exprpb.Type) int {
+	if t == nil || t.TypeKind == nil {
+		return kindUnknown
+	}
+	switch t.TypeKind.(type) {
+	case *exprpb.Type_Error:
+		return kindError
+	case *exprpb.Type_Function:
+		return kindFunction
+	case *exprpb.Type_Dyn:
+		return kindDyn
+	case *exprpb.Type_Primitive:
+		return kindPrimitive
+	case *exprpb.Type_WellKnown:
+		return kindWellKnown
+	case *exprpb.Type_Wrapper:
+		return kindWrapper
+	case *exprpb.Type_Null:
+		return kindNull
+	case *exprpb.Type_Type:
+		return kindType
+	case *exprpb.Type_ListType_:
+		return kindList
+	case *exprpb.Type_MapType_:
+		return kindMap
+	case *exprpb.Type_MessageType:
+		return kindObject
+	case *exprpb.Type_TypeParam:
+		return kindTypeParam
+	case *exprpb.Type_AbstractType_:
+		return kindAbstract
+	}
+	return kindUnknown
+}
+
+// mostGeneral returns the more general of two types which are known to unify.
+func mostGeneral(t1 *exprpb.Type, t2 *exprpb.Type) *exprpb.Type {
+	if isEqualOrLessSpecific(t1, t2) {
+		return t1
+	}
+	return t2
+}
+
+// notReferencedIn checks whether the type doesn't appear directly or transitively within the other
+// type. This is a standard requirement for type unification, commonly referred to as the "occurs
+// check".
+func notReferencedIn(m *mapping, t *exprpb.Type, withinType *exprpb.Type) bool {
+	if proto.Equal(t, withinType) {
+		return false
+	}
+	withinKind := kindOf(withinType)
+	switch withinKind {
+	case kindTypeParam:
+		wtSub, found := m.find(withinType)
+		if !found {
+			return true
+		}
+		return notReferencedIn(m, t, wtSub)
+	case kindAbstract:
+		for _, pt := range withinType.GetAbstractType().GetParameterTypes() {
+			if !notReferencedIn(m, t, pt) {
+				return false
+			}
+		}
+		return true
+	case kindFunction:
+		fn := withinType.GetFunction()
+		types := flattenFunctionTypes(fn)
+		for _, a := range types {
+			if !notReferencedIn(m, t, a) {
+				return false
+			}
+		}
+		return true
+	case kindList:
+		return notReferencedIn(m, t, withinType.GetListType().ElemType)
+	case kindMap:
+		mt := withinType.GetMapType()
+		return notReferencedIn(m, t, mt.KeyType) && notReferencedIn(m, t, mt.ValueType)
+	case kindWrapper:
+		return notReferencedIn(m, t, decls.NewPrimitiveType(withinType.GetWrapper()))
+	default:
+		return true
+	}
+}
+
+// substitute replaces all direct and indirect occurrences of bound type parameters. Unbound type
+// parameters are replaced by DYN if typeParamToDyn is true.
+func substitute(m *mapping, t *exprpb.Type, typeParamToDyn bool) *exprpb.Type {
+	if tSub, found := m.find(t); found {
+		return substitute(m, tSub, typeParamToDyn)
+	}
+	kind := kindOf(t)
+	if typeParamToDyn && kind == kindTypeParam {
+		return decls.Dyn
+	}
+	switch kind {
+	case kindAbstract:
+		// TODO: implement!
+		at := t.GetAbstractType()
+		params := make([]*exprpb.Type, len(at.GetParameterTypes()))
+		for i, p := range at.GetParameterTypes() {
+			params[i] = substitute(m, p, typeParamToDyn)
+		}
+		return decls.NewAbstractType(at.GetName(), params...)
+	case kindFunction:
+		fn := t.GetFunction()
+		rt := substitute(m, fn.ResultType, typeParamToDyn)
+		args := make([]*exprpb.Type, len(fn.ArgTypes))
+		for i, a := range fn.ArgTypes {
+			args[i] = substitute(m, a, typeParamToDyn)
+		}
+		return decls.NewFunctionType(rt, args...)
+	case kindList:
+		return decls.NewListType(substitute(m, t.GetListType().ElemType, typeParamToDyn))
+	case kindMap:
+		mt := t.GetMapType()
+		return decls.NewMapType(substitute(m, mt.KeyType, typeParamToDyn),
+			substitute(m, mt.ValueType, typeParamToDyn))
+	case kindType:
+		if t.GetType() != nil {
+			return decls.NewTypeType(substitute(m, t.GetType(), typeParamToDyn))
+		}
+		return t
+	default:
+		return t
+	}
+}
+
+func typeKey(t *exprpb.Type) string {
+	return FormatCheckedType(t)
+}
+
+// flattenFunctionTypes takes a function with arg types T1, T2, ..., TN and result type TR
+// and returns a slice containing {T1, T2, ..., TN, TR}.
+func flattenFunctionTypes(f *exprpb.Type_FunctionType) []*exprpb.Type {
+	argTypes := f.GetArgTypes()
+	if len(argTypes) == 0 {
+		return []*exprpb.Type{f.GetResultType()}
+	}
+	flattend := make([]*exprpb.Type, len(argTypes)+1, len(argTypes)+1)
+	for i, at := range argTypes {
+		flattend[i] = at
+	}
+	flattend[len(argTypes)] = f.GetResultType()
+	return flattend
+}