Upgrade caddy to 2.9.1

145 files changed, 19568 insertions, 7745 deletions

diff --git a/vendor/github.com/google/cel-go/cel/BUILD.bazel b/vendor/github.com/google/cel-go/cel/BUILD.bazel
index ddddbd2..81549fb 100644
--- a/vendor/github.com/google/cel-go/cel/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/cel/BUILD.bazel
@@ -10,11 +10,15 @@ go_library(
         "cel.go",
         "decls.go",
         "env.go",
+        "folding.go",
         "io.go",
+        "inlining.go",
         "library.go",
         "macro.go",
+        "optimizer.go",
         "options.go",
         "program.go",
+        "validator.go",
     ],
     importpath = "github.com/google/cel-go/cel",
     visibility = ["//visibility:public"],
@@ -22,17 +26,21 @@ go_library(
         "//checker:go_default_library",
         "//checker/decls:go_default_library",
         "//common:go_default_library",
+        "//common/ast:go_default_library",
         "//common/containers:go_default_library",
+        "//common/decls:go_default_library",
+        "//common/functions:go_default_library",
         "//common/operators:go_default_library",
         "//common/overloads:go_default_library",
+        "//common/stdlib:go_default_library",
         "//common/types:go_default_library",
         "//common/types/pb:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
         "//interpreter:go_default_library",
-        "//interpreter/functions:go_default_library",
         "//parser:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@dev_cel_expr//:expr",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protodesc:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
@@ -52,7 +60,11 @@ go_test(
         "cel_test.go",
         "decls_test.go",
         "env_test.go",
+        "folding_test.go",
         "io_test.go",
+        "inlining_test.go",
+        "optimizer_test.go",
+        "validator_test.go",
     ],
     data = [
         "//cel/testdata:gen_test_fds",
@@ -66,12 +78,14 @@ go_test(
         "//common/types:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
+        "//ext:go_default_library",
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
-        "@io_bazel_rules_go//proto/wkt:descriptor_go_proto",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
+        "@org_golang_google_protobuf//types/known/wrapperspb:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/cel/decls.go b/vendor/github.com/google/cel-go/cel/decls.go
index c0624d1..4188060 100644
--- a/vendor/github.com/google/cel-go/cel/decls.go
+++ b/vendor/github.com/google/cel-go/cel/decls.go
@@ -16,341 +16,134 @@ package cel
 
 import (
 	"fmt"
-	"strings"
 
-	"github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/decls"
+	"github.com/google/cel-go/common/functions"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
-	"github.com/google/cel-go/interpreter/functions"
 
+	celpb "cel.dev/expr"
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // Kind indicates a CEL type's kind which is used to differentiate quickly between simple and complex types.
-type Kind uint
+type Kind = types.Kind
 
 const (
 	// DynKind represents a dynamic type. This kind only exists at type-check time.
-	DynKind Kind = iota
+	DynKind Kind = types.DynKind
 
 	// AnyKind represents a google.protobuf.Any type. This kind only exists at type-check time.
-	AnyKind
+	AnyKind = types.AnyKind
 
 	// BoolKind represents a boolean type.
-	BoolKind
+	BoolKind = types.BoolKind
 
 	// BytesKind represents a bytes type.
-	BytesKind
+	BytesKind = types.BytesKind
 
 	// DoubleKind represents a double type.
-	DoubleKind
+	DoubleKind = types.DoubleKind
 
 	// DurationKind represents a CEL duration type.
-	DurationKind
+	DurationKind = types.DurationKind
 
 	// IntKind represents an integer type.
-	IntKind
+	IntKind = types.IntKind
 
 	// ListKind represents a list type.
-	ListKind
+	ListKind = types.ListKind
 
 	// MapKind represents a map type.
-	MapKind
+	MapKind = types.MapKind
 
 	// NullTypeKind represents a null type.
-	NullTypeKind
+	NullTypeKind = types.NullTypeKind
 
 	// OpaqueKind represents an abstract type which has no accessible fields.
-	OpaqueKind
+	OpaqueKind = types.OpaqueKind
 
 	// StringKind represents a string type.
-	StringKind
+	StringKind = types.StringKind
 
 	// StructKind represents a structured object with typed fields.
-	StructKind
+	StructKind = types.StructKind
 
 	// TimestampKind represents a a CEL time type.
-	TimestampKind
+	TimestampKind = types.TimestampKind
 
 	// TypeKind represents the CEL type.
-	TypeKind
+	TypeKind = types.TypeKind
 
 	// TypeParamKind represents a parameterized type whose type name will be resolved at type-check time, if possible.
-	TypeParamKind
+	TypeParamKind = types.TypeParamKind
 
 	// UintKind represents a uint type.
-	UintKind
+	UintKind = types.UintKind
 )
 
 var (
 	// AnyType represents the google.protobuf.Any type.
-	AnyType = &Type{
-		kind:        AnyKind,
-		runtimeType: types.NewTypeValue("google.protobuf.Any"),
-	}
+	AnyType = types.AnyType
 	// BoolType represents the bool type.
-	BoolType = &Type{
-		kind:        BoolKind,
-		runtimeType: types.BoolType,
-	}
+	BoolType = types.BoolType
 	// BytesType represents the bytes type.
-	BytesType = &Type{
-		kind:        BytesKind,
-		runtimeType: types.BytesType,
-	}
+	BytesType = types.BytesType
 	// DoubleType represents the double type.
-	DoubleType = &Type{
-		kind:        DoubleKind,
-		runtimeType: types.DoubleType,
-	}
+	DoubleType = types.DoubleType
 	// DurationType represents the CEL duration type.
-	DurationType = &Type{
-		kind:        DurationKind,
-		runtimeType: types.DurationType,
-	}
+	DurationType = types.DurationType
 	// DynType represents a dynamic CEL type whose type will be determined at runtime from context.
-	DynType = &Type{
-		kind:        DynKind,
-		runtimeType: types.NewTypeValue("dyn"),
-	}
+	DynType = types.DynType
 	// IntType represents the int type.
-	IntType = &Type{
-		kind:        IntKind,
-		runtimeType: types.IntType,
-	}
+	IntType = types.IntType
 	// NullType represents the type of a null value.
-	NullType = &Type{
-		kind:        NullTypeKind,
-		runtimeType: types.NullType,
-	}
+	NullType = types.NullType
 	// StringType represents the string type.
-	StringType = &Type{
-		kind:        StringKind,
-		runtimeType: types.StringType,
-	}
+	StringType = types.StringType
 	// TimestampType represents the time type.
-	TimestampType = &Type{
-		kind:        TimestampKind,
-		runtimeType: types.TimestampType,
-	}
+	TimestampType = types.TimestampType
 	// TypeType represents a CEL type
-	TypeType = &Type{
-		kind:        TypeKind,
-		runtimeType: types.TypeType,
-	}
+	TypeType = types.TypeType
 	// UintType represents a uint type.
-	UintType = &Type{
-		kind:        UintKind,
-		runtimeType: types.UintType,
-	}
+	UintType = types.UintType
+
+	// function references for instantiating new types.
+
+	// ListType creates an instances of a list type value with the provided element type.
+	ListType = types.NewListType
+	// MapType creates an instance of a map type value with the provided key and value types.
+	MapType = types.NewMapType
+	// NullableType creates an instance of a nullable type with the provided wrapped type.
+	//
+	// Note: only primitive types are supported as wrapped types.
+	NullableType = types.NewNullableType
+	// OptionalType creates an abstract parameterized type instance corresponding to CEL's notion of optional.
+	OptionalType = types.NewOptionalType
+	// OpaqueType creates an abstract parameterized type with a given name.
+	OpaqueType = types.NewOpaqueType
+	// ObjectType creates a type references to an externally defined type, e.g. a protobuf message type.
+	ObjectType = types.NewObjectType
+	// TypeParamType creates a parameterized type instance.
+	TypeParamType = types.NewTypeParamType
 )
 
 // Type holds a reference to a runtime type with an optional type-checked set of type parameters.
-type Type struct {
-	// kind indicates general category of the type.
-	kind Kind
-
-	// runtimeType is the runtime type of the declaration.
-	runtimeType ref.Type
-
-	// parameters holds the optional type-checked set of type parameters that are used during static analysis.
-	parameters []*Type
-
-	// isAssignableType function determines whether one type is assignable to this type.
-	// A nil value for the isAssignableType function falls back to equality of kind, runtimeType, and parameters.
-	isAssignableType func(other *Type) bool
-
-	// isAssignableRuntimeType function determines whether the runtime type (with erasure) is assignable to this type.
-	// A nil value for the isAssignableRuntimeType function falls back to the equality of the type or type name.
-	isAssignableRuntimeType func(other ref.Val) bool
-}
-
-// IsAssignableType determines whether the current type is type-check assignable from the input fromType.
-func (t *Type) IsAssignableType(fromType *Type) bool {
-	if t.isAssignableType != nil {
-		return t.isAssignableType(fromType)
-	}
-	return t.defaultIsAssignableType(fromType)
-}
-
-// IsAssignableRuntimeType determines whether the current type is runtime assignable from the input runtimeType.
-//
-// At runtime, parameterized types are erased and so a function which type-checks to support a map(string, string)
-// will have a runtime assignable type of a map.
-func (t *Type) IsAssignableRuntimeType(val ref.Val) bool {
-	if t.isAssignableRuntimeType != nil {
-		return t.isAssignableRuntimeType(val)
-	}
-	return t.defaultIsAssignableRuntimeType(val)
-}
-
-// String returns a human-readable definition of the type name.
-func (t *Type) String() string {
-	if len(t.parameters) == 0 {
-		return t.runtimeType.TypeName()
-	}
-	params := make([]string, len(t.parameters))
-	for i, p := range t.parameters {
-		params[i] = p.String()
-	}
-	return fmt.Sprintf("%s(%s)", t.runtimeType.TypeName(), strings.Join(params, ", "))
-}
-
-// isDyn indicates whether the type is dynamic in any way.
-func (t *Type) isDyn() bool {
-	return t.kind == DynKind || t.kind == AnyKind || t.kind == TypeParamKind
-}
+type Type = types.Type
 
-// equals indicates whether two types have the same kind, type name, and parameters.
-func (t *Type) equals(other *Type) bool {
-	if t.kind != other.kind ||
-		t.runtimeType.TypeName() != other.runtimeType.TypeName() ||
-		len(t.parameters) != len(other.parameters) {
-		return false
-	}
-	for i, p := range t.parameters {
-		if !p.equals(other.parameters[i]) {
-			return false
-		}
-	}
-	return true
-}
-
-// defaultIsAssignableType provides the standard definition of what it means for one type to be assignable to another
-// where any of the following may return a true result:
-// - The from types are the same instance
-// - The target type is dynamic
-// - The fromType has the same kind and type name as the target type, and all parameters of the target type
-//
-//	are IsAssignableType() from the parameters of the fromType.
-func (t *Type) defaultIsAssignableType(fromType *Type) bool {
-	if t == fromType || t.isDyn() {
-		return true
-	}
-	if t.kind != fromType.kind ||
-		t.runtimeType.TypeName() != fromType.runtimeType.TypeName() ||
-		len(t.parameters) != len(fromType.parameters) {
-		return false
-	}
-	for i, tp := range t.parameters {
-		fp := fromType.parameters[i]
-		if !tp.IsAssignableType(fp) {
-			return false
-		}
-	}
-	return true
-}
-
-// defaultIsAssignableRuntimeType inspects the type and in the case of list and map elements, the key and element types
-// to determine whether a ref.Val is assignable to the declared type for a function signature.
-func (t *Type) defaultIsAssignableRuntimeType(val ref.Val) bool {
-	valType := val.Type()
-	if !(t.runtimeType == valType || t.isDyn() || t.runtimeType.TypeName() == valType.TypeName()) {
-		return false
-	}
-	switch t.runtimeType {
-	case types.ListType:
-		elemType := t.parameters[0]
-		l := val.(traits.Lister)
-		if l.Size() == types.IntZero {
-			return true
-		}
-		it := l.Iterator()
-		for it.HasNext() == types.True {
-			elemVal := it.Next()
-			return elemType.IsAssignableRuntimeType(elemVal)
-		}
-	case types.MapType:
-		keyType := t.parameters[0]
-		elemType := t.parameters[1]
-		m := val.(traits.Mapper)
-		if m.Size() == types.IntZero {
-			return true
-		}
-		it := m.Iterator()
-		for it.HasNext() == types.True {
-			keyVal := it.Next()
-			elemVal := m.Get(keyVal)
-			return keyType.IsAssignableRuntimeType(keyVal) && elemType.IsAssignableRuntimeType(elemVal)
-		}
-	}
-	return true
-}
-
-// ListType creates an instances of a list type value with the provided element type.
-func ListType(elemType *Type) *Type {
-	return &Type{
-		kind:        ListKind,
-		runtimeType: types.ListType,
-		parameters:  []*Type{elemType},
-	}
-}
-
-// MapType creates an instance of a map type value with the provided key and value types.
-func MapType(keyType, valueType *Type) *Type {
-	return &Type{
-		kind:        MapKind,
-		runtimeType: types.MapType,
-		parameters:  []*Type{keyType, valueType},
-	}
-}
-
-// NullableType creates an instance of a nullable type with the provided wrapped type.
-//
-// Note: only primitive types are supported as wrapped types.
-func NullableType(wrapped *Type) *Type {
-	return &Type{
-		kind:        wrapped.kind,
-		runtimeType: wrapped.runtimeType,
-		parameters:  wrapped.parameters,
-		isAssignableType: func(other *Type) bool {
-			return NullType.IsAssignableType(other) || wrapped.IsAssignableType(other)
-		},
-		isAssignableRuntimeType: func(other ref.Val) bool {
-			return NullType.IsAssignableRuntimeType(other) || wrapped.IsAssignableRuntimeType(other)
-		},
-	}
-}
-
-// OptionalType creates an abstract parameterized type instance corresponding to CEL's notion of optional.
-func OptionalType(param *Type) *Type {
-	return OpaqueType("optional", param)
-}
-
-// OpaqueType creates an abstract parameterized type with a given name.
-func OpaqueType(name string, params ...*Type) *Type {
-	return &Type{
-		kind:        OpaqueKind,
-		runtimeType: types.NewTypeValue(name),
-		parameters:  params,
-	}
-}
-
-// ObjectType creates a type references to an externally defined type, e.g. a protobuf message type.
-func ObjectType(typeName string) *Type {
-	return &Type{
-		kind:        StructKind,
-		runtimeType: types.NewObjectTypeValue(typeName),
-	}
-}
-
-// TypeParamType creates a parameterized type instance.
-func TypeParamType(paramName string) *Type {
-	return &Type{
-		kind:        TypeParamKind,
-		runtimeType: types.NewTypeValue(paramName),
+// Constant creates an instances of an identifier declaration with a variable name, type, and value.
+func Constant(name string, t *Type, v ref.Val) EnvOption {
+	return func(e *Env) (*Env, error) {
+		e.variables = append(e.variables, decls.NewConstant(name, t, v))
+		return e, nil
 	}
 }
 
 // Variable creates an instance of a variable declaration with a variable name and type.
 func Variable(name string, t *Type) EnvOption {
 	return func(e *Env) (*Env, error) {
-		et, err := TypeToExprType(t)
-		if err != nil {
-			return nil, err
-		}
-		e.declarations = append(e.declarations, decls.NewVar(name, et))
+		e.variables = append(e.variables, decls.NewVariable(name, t))
 		return e, nil
 	}
 }
@@ -386,53 +179,30 @@ func Variable(name string, t *Type) EnvOption {
 // overload as CEL can only make inferences by type-name regarding such types.
 func Function(name string, opts ...FunctionOpt) EnvOption {
 	return func(e *Env) (*Env, error) {
-		fn := &functionDecl{
-			name:      name,
-			overloads: []*overloadDecl{},
-			options:   opts,
-		}
-		err := fn.init()
+		fn, err := decls.NewFunction(name, opts...)
 		if err != nil {
 			return nil, err
 		}
-		_, err = functionDeclToExprDecl(fn)
-		if err != nil {
-			return nil, err
-		}
-		if existing, found := e.functions[fn.name]; found {
-			fn, err = existing.merge(fn)
+		if existing, found := e.functions[fn.Name()]; found {
+			fn, err = existing.Merge(fn)
 			if err != nil {
 				return nil, err
 			}
 		}
-		e.functions[name] = fn
+		e.functions[fn.Name()] = fn
 		return e, nil
 	}
 }
 
 // FunctionOpt defines a functional  option for configuring a function declaration.
-type FunctionOpt func(*functionDecl) (*functionDecl, error)
+type FunctionOpt = decls.FunctionOpt
 
 // SingletonUnaryBinding creates a singleton function definition to be used for all function overloads.
 //
 // Note, this approach works well if operand is expected to have a specific trait which it implements,
 // e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
 func SingletonUnaryBinding(fn functions.UnaryOp, traits ...int) FunctionOpt {
-	trait := 0
-	for _, t := range traits {
-		trait = trait | t
-	}
-	return func(f *functionDecl) (*functionDecl, error) {
-		if f.singleton != nil {
-			return nil, fmt.Errorf("function already has a singleton binding: %s", f.name)
-		}
-		f.singleton = &functions.Overload{
-			Operator:     f.name,
-			Unary:        fn,
-			OperandTrait: trait,
-		}
-		return f, nil
-	}
+	return decls.SingletonUnaryBinding(fn, traits...)
 }
 
 // SingletonBinaryImpl creates a singleton function definition to be used with all function overloads.
@@ -442,7 +212,7 @@ func SingletonUnaryBinding(fn functions.UnaryOp, traits ...int) FunctionOpt {
 //
 // Deprecated: use SingletonBinaryBinding
 func SingletonBinaryImpl(fn functions.BinaryOp, traits ...int) FunctionOpt {
-	return SingletonBinaryBinding(fn, traits...)
+	return decls.SingletonBinaryBinding(fn, traits...)
 }
 
 // SingletonBinaryBinding creates a singleton function definition to be used with all function overloads.
@@ -450,21 +220,7 @@ func SingletonBinaryImpl(fn functions.BinaryOp, traits ...int) FunctionOpt {
 // Note, this approach works well if operand is expected to have a specific trait which it implements,
 // e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
 func SingletonBinaryBinding(fn functions.BinaryOp, traits ...int) FunctionOpt {
-	trait := 0
-	for _, t := range traits {
-		trait = trait | t
-	}
-	return func(f *functionDecl) (*functionDecl, error) {
-		if f.singleton != nil {
-			return nil, fmt.Errorf("function already has a singleton binding: %s", f.name)
-		}
-		f.singleton = &functions.Overload{
-			Operator:     f.name,
-			Binary:       fn,
-			OperandTrait: trait,
-		}
-		return f, nil
-	}
+	return decls.SingletonBinaryBinding(fn, traits...)
 }
 
 // SingletonFunctionImpl creates a singleton function definition to be used with all function overloads.
@@ -474,7 +230,7 @@ func SingletonBinaryBinding(fn functions.BinaryOp, traits ...int) FunctionOpt {
 //
 // Deprecated: use SingletonFunctionBinding
 func SingletonFunctionImpl(fn functions.FunctionOp, traits ...int) FunctionOpt {
-	return SingletonFunctionBinding(fn, traits...)
+	return decls.SingletonFunctionBinding(fn, traits...)
 }
 
 // SingletonFunctionBinding creates a singleton function definition to be used with all function overloads.
@@ -482,21 +238,13 @@ func SingletonFunctionImpl(fn functions.FunctionOp, traits ...int) FunctionOpt {
 // Note, this approach works well if operand is expected to have a specific trait which it implements,
 // e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
 func SingletonFunctionBinding(fn functions.FunctionOp, traits ...int) FunctionOpt {
-	trait := 0
-	for _, t := range traits {
-		trait = trait | t
-	}
-	return func(f *functionDecl) (*functionDecl, error) {
-		if f.singleton != nil {
-			return nil, fmt.Errorf("function already has a singleton binding: %s", f.name)
-		}
-		f.singleton = &functions.Overload{
-			Operator:     f.name,
-			Function:     fn,
-			OperandTrait: trait,
-		}
-		return f, nil
-	}
+	return decls.SingletonFunctionBinding(fn, traits...)
+}
+
+// DisableDeclaration disables the function signatures, effectively removing them from the type-check
+// environment while preserving the runtime bindings.
+func DisableDeclaration(value bool) FunctionOpt {
+	return decls.DisableDeclaration(value)
 }
 
 // Overload defines a new global overload with an overload id, argument types, and result type. Through the
@@ -506,7 +254,7 @@ func SingletonFunctionBinding(fn functions.FunctionOp, traits ...int) FunctionOp
 // Note: function bindings should be commonly configured with Overload instances whereas operand traits and
 // strict-ness should be rare occurrences.
 func Overload(overloadID string, args []*Type, resultType *Type, opts ...OverloadOpt) FunctionOpt {
-	return newOverload(overloadID, false, args, resultType, opts...)
+	return decls.Overload(overloadID, args, resultType, opts...)
 }
 
 // MemberOverload defines a new receiver-style overload (or member function) with an overload id, argument types,
@@ -516,731 +264,107 @@ func Overload(overloadID string, args []*Type, resultType *Type, opts ...Overloa
 // Note: function bindings should be commonly configured with Overload instances whereas operand traits and
 // strict-ness should be rare occurrences.
 func MemberOverload(overloadID string, args []*Type, resultType *Type, opts ...OverloadOpt) FunctionOpt {
-	return newOverload(overloadID, true, args, resultType, opts...)
+	return decls.MemberOverload(overloadID, args, resultType, opts...)
 }
 
 // OverloadOpt is a functional option for configuring a function overload.
-type OverloadOpt func(*overloadDecl) (*overloadDecl, error)
+type OverloadOpt = decls.OverloadOpt
 
 // UnaryBinding provides the implementation of a unary overload. The provided function is protected by a runtime
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func UnaryBinding(binding functions.UnaryOp) OverloadOpt {
-	return func(o *overloadDecl) (*overloadDecl, error) {
-		if o.hasBinding() {
-			return nil, fmt.Errorf("overload already has a binding: %s", o.id)
-		}
-		if len(o.argTypes) != 1 {
-			return nil, fmt.Errorf("unary function bound to non-unary overload: %s", o.id)
-		}
-		o.unaryOp = binding
-		return o, nil
-	}
+	return decls.UnaryBinding(binding)
 }
 
 // BinaryBinding provides the implementation of a binary overload. The provided function is protected by a runtime
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func BinaryBinding(binding functions.BinaryOp) OverloadOpt {
-	return func(o *overloadDecl) (*overloadDecl, error) {
-		if o.hasBinding() {
-			return nil, fmt.Errorf("overload already has a binding: %s", o.id)
-		}
-		if len(o.argTypes) != 2 {
-			return nil, fmt.Errorf("binary function bound to non-binary overload: %s", o.id)
-		}
-		o.binaryOp = binding
-		return o, nil
-	}
+	return decls.BinaryBinding(binding)
 }
 
 // FunctionBinding provides the implementation of a variadic overload. The provided function is protected by a runtime
 // type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
 func FunctionBinding(binding functions.FunctionOp) OverloadOpt {
-	return func(o *overloadDecl) (*overloadDecl, error) {
-		if o.hasBinding() {
-			return nil, fmt.Errorf("overload already has a binding: %s", o.id)
-		}
-		o.functionOp = binding
-		return o, nil
-	}
+	return decls.FunctionBinding(binding)
 }
 
 // OverloadIsNonStrict enables the function to be called with error and unknown argument values.
 //
 // Note: do not use this option unless absoluately necessary as it should be an uncommon feature.
 func OverloadIsNonStrict() OverloadOpt {
-	return func(o *overloadDecl) (*overloadDecl, error) {
-		o.nonStrict = true
-		return o, nil
-	}
+	return decls.OverloadIsNonStrict()
 }
 
 // OverloadOperandTrait configures a set of traits which the first argument to the overload must implement in order to be
 // successfully invoked.
 func OverloadOperandTrait(trait int) OverloadOpt {
-	return func(o *overloadDecl) (*overloadDecl, error) {
-		o.operandTrait = trait
-		return o, nil
-	}
-}
-
-type functionDecl struct {
-	name        string
-	overloads   []*overloadDecl
-	options     []FunctionOpt
-	singleton   *functions.Overload
-	initialized bool
-}
-
-// init ensures that a function's options have been applied.
-//
-// This function is used in both the environment configuration and internally for function merges.
-func (f *functionDecl) init() error {
-	if f.initialized {
-		return nil
-	}
-	f.initialized = true
-
-	var err error
-	for _, opt := range f.options {
-		f, err = opt(f)
-		if err != nil {
-			return err
-		}
-	}
-	if len(f.overloads) == 0 {
-		return fmt.Errorf("function %s must have at least one overload", f.name)
-	}
-	return nil
-}
-
-// bindings produces a set of function bindings, if any are defined.
-func (f *functionDecl) bindings() ([]*functions.Overload, error) {
-	overloads := []*functions.Overload{}
-	nonStrict := false
-	for _, o := range f.overloads {
-		if o.hasBinding() {
-			overload := &functions.Overload{
-				Operator:     o.id,
-				Unary:        o.guardedUnaryOp(f.name),
-				Binary:       o.guardedBinaryOp(f.name),
-				Function:     o.guardedFunctionOp(f.name),
-				OperandTrait: o.operandTrait,
-				NonStrict:    o.nonStrict,
-			}
-			overloads = append(overloads, overload)
-			nonStrict = nonStrict || o.nonStrict
-		}
-	}
-	if f.singleton != nil {
-		if len(overloads) != 0 {
-			return nil, fmt.Errorf("singleton function incompatible with specialized overloads: %s", f.name)
-		}
-		return []*functions.Overload{
-			{
-				Operator:     f.name,
-				Unary:        f.singleton.Unary,
-				Binary:       f.singleton.Binary,
-				Function:     f.singleton.Function,
-				OperandTrait: f.singleton.OperandTrait,
-			},
-		}, nil
-	}
-	if len(overloads) == 0 {
-		return overloads, nil
-	}
-	// Single overload. Replicate an entry for it using the function name as well.
-	if len(overloads) == 1 {
-		if overloads[0].Operator == f.name {
-			return overloads, nil
-		}
-		return append(overloads, &functions.Overload{
-			Operator:     f.name,
-			Unary:        overloads[0].Unary,
-			Binary:       overloads[0].Binary,
-			Function:     overloads[0].Function,
-			NonStrict:    overloads[0].NonStrict,
-			OperandTrait: overloads[0].OperandTrait,
-		}), nil
-	}
-	// All of the defined overloads are wrapped into a top-level function which
-	// performs dynamic dispatch to the proper overload based on the argument types.
-	bindings := append([]*functions.Overload{}, overloads...)
-	funcDispatch := func(args ...ref.Val) ref.Val {
-		for _, o := range f.overloads {
-			if !o.matchesRuntimeSignature(args...) {
-				continue
-			}
-			switch len(args) {
-			case 1:
-				if o.unaryOp != nil {
-					return o.unaryOp(args[0])
-				}
-			case 2:
-				if o.binaryOp != nil {
-					return o.binaryOp(args[0], args[1])
-				}
-			}
-			if o.functionOp != nil {
-				return o.functionOp(args...)
-			}
-			// eventually this will fall through to the noSuchOverload below.
-		}
-		return noSuchOverload(f.name, args...)
-	}
-	function := &functions.Overload{
-		Operator:  f.name,
-		Function:  funcDispatch,
-		NonStrict: nonStrict,
-	}
-	return append(bindings, function), nil
-}
-
-// merge one function declaration with another.
-//
-// If a function is extended, by say adding new overloads to an existing function, then it is merged with the
-// prior definition of the function at which point its overloads must not collide with pre-existing overloads
-// and its bindings (singleton, or per-overload) must not conflict with previous definitions either.
-func (f *functionDecl) merge(other *functionDecl) (*functionDecl, error) {
-	if f.name != other.name {
-		return nil, fmt.Errorf("cannot merge unrelated functions. %s and %s", f.name, other.name)
-	}
-	err := f.init()
-	if err != nil {
-		return nil, err
-	}
-	err = other.init()
-	if err != nil {
-		return nil, err
-	}
-	merged := &functionDecl{
-		name:        f.name,
-		overloads:   make([]*overloadDecl, len(f.overloads)),
-		options:     []FunctionOpt{},
-		initialized: true,
-		singleton:   f.singleton,
-	}
-	copy(merged.overloads, f.overloads)
-	for _, o := range other.overloads {
-		err := merged.addOverload(o)
-		if err != nil {
-			return nil, fmt.Errorf("function declaration merge failed: %v", err)
-		}
-	}
-	if other.singleton != nil {
-		if merged.singleton != nil {
-			return nil, fmt.Errorf("function already has a binding: %s", f.name)
-		}
-		merged.singleton = other.singleton
-	}
-	return merged, nil
-}
-
-// addOverload ensures that the new overload does not collide with an existing overload signature;
-// however, if the function signatures are identical, the implementation may be rewritten as its
-// difficult to compare functions by object identity.
-func (f *functionDecl) addOverload(overload *overloadDecl) error {
-	for index, o := range f.overloads {
-		if o.id != overload.id && o.signatureOverlaps(overload) {
-			return fmt.Errorf("overload signature collision in function %s: %s collides with %s", f.name, o.id, overload.id)
-		}
-		if o.id == overload.id {
-			if o.signatureEquals(overload) && o.nonStrict == overload.nonStrict {
-				// Allow redefinition of an overload implementation so long as the signatures match.
-				f.overloads[index] = overload
-				return nil
-			}
-			return fmt.Errorf("overload redefinition in function. %s: %s has multiple definitions", f.name, o.id)
-		}
-	}
-	f.overloads = append(f.overloads, overload)
-	return nil
-}
-
-func noSuchOverload(funcName string, args ...ref.Val) ref.Val {
-	argTypes := make([]string, len(args))
-	for i, arg := range args {
-		argTypes[i] = arg.Type().TypeName()
-	}
-	signature := strings.Join(argTypes, ", ")
-	return types.NewErr("no such overload: %s(%s)", funcName, signature)
-}
-
-// overloadDecl contains all of the relevant information regarding a specific function overload.
-type overloadDecl struct {
-	id             string
-	argTypes       []*Type
-	resultType     *Type
-	memberFunction bool
-
-	// binding options, optional but encouraged.
-	unaryOp    functions.UnaryOp
-	binaryOp   functions.BinaryOp
-	functionOp functions.FunctionOp
-
-	// behavioral options, uncommon
-	nonStrict    bool
-	operandTrait int
-}
-
-func (o *overloadDecl) hasBinding() bool {
-	return o.unaryOp != nil || o.binaryOp != nil || o.functionOp != nil
-}
-
-// guardedUnaryOp creates an invocation guard around the provided unary operator, if one is defined.
-func (o *overloadDecl) guardedUnaryOp(funcName string) functions.UnaryOp {
-	if o.unaryOp == nil {
-		return nil
-	}
-	return func(arg ref.Val) ref.Val {
-		if !o.matchesRuntimeUnarySignature(arg) {
-			return noSuchOverload(funcName, arg)
-		}
-		return o.unaryOp(arg)
-	}
-}
-
-// guardedBinaryOp creates an invocation guard around the provided binary operator, if one is defined.
-func (o *overloadDecl) guardedBinaryOp(funcName string) functions.BinaryOp {
-	if o.binaryOp == nil {
-		return nil
-	}
-	return func(arg1, arg2 ref.Val) ref.Val {
-		if !o.matchesRuntimeBinarySignature(arg1, arg2) {
-			return noSuchOverload(funcName, arg1, arg2)
-		}
-		return o.binaryOp(arg1, arg2)
-	}
-}
-
-// guardedFunctionOp creates an invocation guard around the provided variadic function binding, if one is provided.
-func (o *overloadDecl) guardedFunctionOp(funcName string) functions.FunctionOp {
-	if o.functionOp == nil {
-		return nil
-	}
-	return func(args ...ref.Val) ref.Val {
-		if !o.matchesRuntimeSignature(args...) {
-			return noSuchOverload(funcName, args...)
-		}
-		return o.functionOp(args...)
-	}
-}
-
-// matchesRuntimeUnarySignature indicates whether the argument type is runtime assiganble to the overload's expected argument.
-func (o *overloadDecl) matchesRuntimeUnarySignature(arg ref.Val) bool {
-	if o.nonStrict && types.IsUnknownOrError(arg) {
-		return true
-	}
-	return o.argTypes[0].IsAssignableRuntimeType(arg) && (o.operandTrait == 0 || arg.Type().HasTrait(o.operandTrait))
-}
-
-// matchesRuntimeBinarySignature indicates whether the argument types are runtime assiganble to the overload's expected arguments.
-func (o *overloadDecl) matchesRuntimeBinarySignature(arg1, arg2 ref.Val) bool {
-	if o.nonStrict {
-		if types.IsUnknownOrError(arg1) {
-			return types.IsUnknownOrError(arg2) || o.argTypes[1].IsAssignableRuntimeType(arg2)
-		}
-	} else if !o.argTypes[1].IsAssignableRuntimeType(arg2) {
-		return false
-	}
-	return o.argTypes[0].IsAssignableRuntimeType(arg1) && (o.operandTrait == 0 || arg1.Type().HasTrait(o.operandTrait))
-}
-
-// matchesRuntimeSignature indicates whether the argument types are runtime assiganble to the overload's expected arguments.
-func (o *overloadDecl) matchesRuntimeSignature(args ...ref.Val) bool {
-	if len(args) != len(o.argTypes) {
-		return false
-	}
-	if len(args) == 0 {
-		return true
-	}
-	allArgsMatch := true
-	for i, arg := range args {
-		if o.nonStrict && types.IsUnknownOrError(arg) {
-			continue
-		}
-		allArgsMatch = allArgsMatch && o.argTypes[i].IsAssignableRuntimeType(arg)
-	}
-
-	arg := args[0]
-	return allArgsMatch && (o.operandTrait == 0 || (o.nonStrict && types.IsUnknownOrError(arg)) || arg.Type().HasTrait(o.operandTrait))
-}
-
-// signatureEquals indicates whether one overload has an identical signature to another overload.
-//
-// Providing a duplicate signature is not an issue, but an overloapping signature is problematic.
-func (o *overloadDecl) signatureEquals(other *overloadDecl) bool {
-	if o.id != other.id || o.memberFunction != other.memberFunction || len(o.argTypes) != len(other.argTypes) {
-		return false
-	}
-	for i, at := range o.argTypes {
-		oat := other.argTypes[i]
-		if !at.equals(oat) {
-			return false
-		}
-	}
-	return o.resultType.equals(other.resultType)
-}
-
-// signatureOverlaps indicates whether one overload has an overlapping signature with another overload.
-//
-// The 'other' overload must first be checked for equality before determining whether it overlaps in order to be completely accurate.
-func (o *overloadDecl) signatureOverlaps(other *overloadDecl) bool {
-	if o.memberFunction != other.memberFunction || len(o.argTypes) != len(other.argTypes) {
-		return false
-	}
-	argsOverlap := true
-	for i, argType := range o.argTypes {
-		otherArgType := other.argTypes[i]
-		argsOverlap = argsOverlap &&
-			(argType.IsAssignableType(otherArgType) ||
-				otherArgType.IsAssignableType(argType))
-	}
-	return argsOverlap
-}
-
-func newOverload(overloadID string, memberFunction bool, args []*Type, resultType *Type, opts ...OverloadOpt) FunctionOpt {
-	return func(f *functionDecl) (*functionDecl, error) {
-		overload := &overloadDecl{
-			id:             overloadID,
-			argTypes:       args,
-			resultType:     resultType,
-			memberFunction: memberFunction,
-		}
-		var err error
-		for _, opt := range opts {
-			overload, err = opt(overload)
-			if err != nil {
-				return nil, err
-			}
-		}
-		err = f.addOverload(overload)
-		if err != nil {
-			return nil, err
-		}
-		return f, nil
-	}
-}
-
-func maybeWrapper(t *Type, pbType *exprpb.Type) *exprpb.Type {
-	if t.IsAssignableType(NullType) {
-		return decls.NewWrapperType(pbType)
-	}
-	return pbType
+	return decls.OverloadOperandTrait(trait)
 }
 
 // TypeToExprType converts a CEL-native type representation to a protobuf CEL Type representation.
 func TypeToExprType(t *Type) (*exprpb.Type, error) {
-	switch t.kind {
-	case AnyKind:
-		return decls.Any, nil
-	case BoolKind:
-		return maybeWrapper(t, decls.Bool), nil
-	case BytesKind:
-		return maybeWrapper(t, decls.Bytes), nil
-	case DoubleKind:
-		return maybeWrapper(t, decls.Double), nil
-	case DurationKind:
-		return decls.Duration, nil
-	case DynKind:
-		return decls.Dyn, nil
-	case IntKind:
-		return maybeWrapper(t, decls.Int), nil
-	case ListKind:
-		et, err := TypeToExprType(t.parameters[0])
-		if err != nil {
-			return nil, err
-		}
-		return decls.NewListType(et), nil
-	case MapKind:
-		kt, err := TypeToExprType(t.parameters[0])
-		if err != nil {
-			return nil, err
-		}
-		vt, err := TypeToExprType(t.parameters[1])
-		if err != nil {
-			return nil, err
-		}
-		return decls.NewMapType(kt, vt), nil
-	case NullTypeKind:
-		return decls.Null, nil
-	case OpaqueKind:
-		params := make([]*exprpb.Type, len(t.parameters))
-		for i, p := range t.parameters {
-			pt, err := TypeToExprType(p)
-			if err != nil {
-				return nil, err
-			}
-			params[i] = pt
-		}
-		return decls.NewAbstractType(t.runtimeType.TypeName(), params...), nil
-	case StringKind:
-		return maybeWrapper(t, decls.String), nil
-	case StructKind:
-		switch t.runtimeType.TypeName() {
-		case "google.protobuf.Any":
-			return decls.Any, nil
-		case "google.protobuf.Duration":
-			return decls.Duration, nil
-		case "google.protobuf.Timestamp":
-			return decls.Timestamp, nil
-		case "google.protobuf.Value":
-			return decls.Dyn, nil
-		case "google.protobuf.ListValue":
-			return decls.NewListType(decls.Dyn), nil
-		case "google.protobuf.Struct":
-			return decls.NewMapType(decls.String, decls.Dyn), nil
-		case "google.protobuf.BoolValue":
-			return decls.NewWrapperType(decls.Bool), nil
-		case "google.protobuf.BytesValue":
-			return decls.NewWrapperType(decls.Bytes), nil
-		case "google.protobuf.DoubleValue", "google.protobuf.FloatValue":
-			return decls.NewWrapperType(decls.Double), nil
-		case "google.protobuf.Int32Value", "google.protobuf.Int64Value":
-			return decls.NewWrapperType(decls.Int), nil
-		case "google.protobuf.StringValue":
-			return decls.NewWrapperType(decls.String), nil
-		case "google.protobuf.UInt32Value", "google.protobuf.UInt64Value":
-			return decls.NewWrapperType(decls.Uint), nil
-		default:
-			return decls.NewObjectType(t.runtimeType.TypeName()), nil
-		}
-	case TimestampKind:
-		return decls.Timestamp, nil
-	case TypeParamKind:
-		return decls.NewTypeParamType(t.runtimeType.TypeName()), nil
-	case TypeKind:
-		return decls.NewTypeType(decls.Dyn), nil
-	case UintKind:
-		return maybeWrapper(t, decls.Uint), nil
-	}
-	return nil, fmt.Errorf("missing type conversion to proto: %v", t)
+	return types.TypeToExprType(t)
 }
 
 // ExprTypeToType converts a protobuf CEL type representation to a CEL-native type representation.
 func ExprTypeToType(t *exprpb.Type) (*Type, error) {
-	switch t.GetTypeKind().(type) {
-	case *exprpb.Type_Dyn:
-		return DynType, nil
-	case *exprpb.Type_AbstractType_:
-		paramTypes := make([]*Type, len(t.GetAbstractType().GetParameterTypes()))
-		for i, p := range t.GetAbstractType().GetParameterTypes() {
-			pt, err := ExprTypeToType(p)
-			if err != nil {
-				return nil, err
-			}
-			paramTypes[i] = pt
-		}
-		return OpaqueType(t.GetAbstractType().GetName(), paramTypes...), nil
-	case *exprpb.Type_ListType_:
-		et, err := ExprTypeToType(t.GetListType().GetElemType())
-		if err != nil {
-			return nil, err
-		}
-		return ListType(et), nil
-	case *exprpb.Type_MapType_:
-		kt, err := ExprTypeToType(t.GetMapType().GetKeyType())
-		if err != nil {
-			return nil, err
-		}
-		vt, err := ExprTypeToType(t.GetMapType().GetValueType())
-		if err != nil {
-			return nil, err
-		}
-		return MapType(kt, vt), nil
-	case *exprpb.Type_MessageType:
-		switch t.GetMessageType() {
-		case "google.protobuf.Any":
-			return AnyType, nil
-		case "google.protobuf.Duration":
-			return DurationType, nil
-		case "google.protobuf.Timestamp":
-			return TimestampType, nil
-		case "google.protobuf.Value":
-			return DynType, nil
-		case "google.protobuf.ListValue":
-			return ListType(DynType), nil
-		case "google.protobuf.Struct":
-			return MapType(StringType, DynType), nil
-		case "google.protobuf.BoolValue":
-			return NullableType(BoolType), nil
-		case "google.protobuf.BytesValue":
-			return NullableType(BytesType), nil
-		case "google.protobuf.DoubleValue", "google.protobuf.FloatValue":
-			return NullableType(DoubleType), nil
-		case "google.protobuf.Int32Value", "google.protobuf.Int64Value":
-			return NullableType(IntType), nil
-		case "google.protobuf.StringValue":
-			return NullableType(StringType), nil
-		case "google.protobuf.UInt32Value", "google.protobuf.UInt64Value":
-			return NullableType(UintType), nil
-		default:
-			return ObjectType(t.GetMessageType()), nil
-		}
-	case *exprpb.Type_Null:
-		return NullType, nil
-	case *exprpb.Type_Primitive:
-		switch t.GetPrimitive() {
-		case exprpb.Type_BOOL:
-			return BoolType, nil
-		case exprpb.Type_BYTES:
-			return BytesType, nil
-		case exprpb.Type_DOUBLE:
-			return DoubleType, nil
-		case exprpb.Type_INT64:
-			return IntType, nil
-		case exprpb.Type_STRING:
-			return StringType, nil
-		case exprpb.Type_UINT64:
-			return UintType, nil
-		default:
-			return nil, fmt.Errorf("unsupported primitive type: %v", t)
-		}
-	case *exprpb.Type_TypeParam:
-		return TypeParamType(t.GetTypeParam()), nil
-	case *exprpb.Type_Type:
-		return TypeType, nil
-	case *exprpb.Type_WellKnown:
-		switch t.GetWellKnown() {
-		case exprpb.Type_ANY:
-			return AnyType, nil
-		case exprpb.Type_DURATION:
-			return DurationType, nil
-		case exprpb.Type_TIMESTAMP:
-			return TimestampType, nil
-		default:
-			return nil, fmt.Errorf("unsupported well-known type: %v", t)
-		}
-	case *exprpb.Type_Wrapper:
-		t, err := ExprTypeToType(&exprpb.Type{TypeKind: &exprpb.Type_Primitive{Primitive: t.GetWrapper()}})
-		if err != nil {
-			return nil, err
-		}
-		return NullableType(t), nil
-	default:
-		return nil, fmt.Errorf("unsupported type: %v", t)
-	}
+	return types.ExprTypeToType(t)
 }
 
 // ExprDeclToDeclaration converts a protobuf CEL declaration to a CEL-native declaration, either a Variable or Function.
 func ExprDeclToDeclaration(d *exprpb.Decl) (EnvOption, error) {
+	return AlphaProtoAsDeclaration(d)
+}
+
+// AlphaProtoAsDeclaration converts a v1alpha1.Decl value describing a variable or function into an EnvOption.
+func AlphaProtoAsDeclaration(d *exprpb.Decl) (EnvOption, error) {
+	canonical := &celpb.Decl{}
+	if err := convertProto(d, canonical); err != nil {
+		return nil, err
+	}
+	return ProtoAsDeclaration(canonical)
+}
+
+// ProtoAsDeclaration converts a canonical celpb.Decl value describing a variable or function into an EnvOption.
+func ProtoAsDeclaration(d *celpb.Decl) (EnvOption, error) {
 	switch d.GetDeclKind().(type) {
-	case *exprpb.Decl_Function:
+	case *celpb.Decl_Function:
 		overloads := d.GetFunction().GetOverloads()
 		opts := make([]FunctionOpt, len(overloads))
 		for i, o := range overloads {
 			args := make([]*Type, len(o.GetParams()))
 			for j, p := range o.GetParams() {
-				a, err := ExprTypeToType(p)
+				a, err := types.ProtoAsType(p)
 				if err != nil {
 					return nil, err
 				}
 				args[j] = a
 			}
-			res, err := ExprTypeToType(o.GetResultType())
+			res, err := types.ProtoAsType(o.GetResultType())
 			if err != nil {
 				return nil, err
 			}
-			opts[i] = Overload(o.GetOverloadId(), args, res)
+			if o.IsInstanceFunction {
+				opts[i] = decls.MemberOverload(o.GetOverloadId(), args, res)
+			} else {
+				opts[i] = decls.Overload(o.GetOverloadId(), args, res)
+			}
 		}
 		return Function(d.GetName(), opts...), nil
-	case *exprpb.Decl_Ident:
-		t, err := ExprTypeToType(d.GetIdent().GetType())
+	case *celpb.Decl_Ident:
+		t, err := types.ProtoAsType(d.GetIdent().GetType())
 		if err != nil {
 			return nil, err
 		}
-		return Variable(d.GetName(), t), nil
-	default:
-		return nil, fmt.Errorf("unsupported decl: %v", d)
-	}
-
-}
-
-func functionDeclToExprDecl(f *functionDecl) (*exprpb.Decl, error) {
-	overloads := make([]*exprpb.Decl_FunctionDecl_Overload, len(f.overloads))
-	i := 0
-	for _, o := range f.overloads {
-		paramNames := map[string]struct{}{}
-		argTypes := make([]*exprpb.Type, len(o.argTypes))
-		for j, a := range o.argTypes {
-			collectParamNames(paramNames, a)
-			at, err := TypeToExprType(a)
-			if err != nil {
-				return nil, err
-			}
-			argTypes[j] = at
+		if d.GetIdent().GetValue() == nil {
+			return Variable(d.GetName(), t), nil
 		}
-		collectParamNames(paramNames, o.resultType)
-		resultType, err := TypeToExprType(o.resultType)
+		val, err := ast.ProtoConstantAsVal(d.GetIdent().GetValue())
 		if err != nil {
 			return nil, err
 		}
-		if len(paramNames) == 0 {
-			if o.memberFunction {
-				overloads[i] = decls.NewInstanceOverload(o.id, argTypes, resultType)
-			} else {
-				overloads[i] = decls.NewOverload(o.id, argTypes, resultType)
-			}
-		} else {
-			params := []string{}
-			for pn := range paramNames {
-				params = append(params, pn)
-			}
-			if o.memberFunction {
-				overloads[i] = decls.NewParameterizedInstanceOverload(o.id, argTypes, resultType, params)
-			} else {
-				overloads[i] = decls.NewParameterizedOverload(o.id, argTypes, resultType, params)
-			}
-		}
-		i++
-	}
-	return decls.NewFunction(f.name, overloads...), nil
-}
-
-func collectParamNames(paramNames map[string]struct{}, arg *Type) {
-	if arg.kind == TypeParamKind {
-		paramNames[arg.runtimeType.TypeName()] = struct{}{}
-	}
-	for _, param := range arg.parameters {
-		collectParamNames(paramNames, param)
-	}
-}
-
-func typeValueToKind(tv *types.TypeValue) (Kind, error) {
-	switch tv {
-	case types.BoolType:
-		return BoolKind, nil
-	case types.DoubleType:
-		return DoubleKind, nil
-	case types.IntType:
-		return IntKind, nil
-	case types.UintType:
-		return UintKind, nil
-	case types.ListType:
-		return ListKind, nil
-	case types.MapType:
-		return MapKind, nil
-	case types.StringType:
-		return StringKind, nil
-	case types.BytesType:
-		return BytesKind, nil
-	case types.DurationType:
-		return DurationKind, nil
-	case types.TimestampType:
-		return TimestampKind, nil
-	case types.NullType:
-		return NullTypeKind, nil
-	case types.TypeType:
-		return TypeKind, nil
+		return Constant(d.GetName(), t, val), nil
 	default:
-		switch tv.TypeName() {
-		case "dyn":
-			return DynKind, nil
-		case "google.protobuf.Any":
-			return AnyKind, nil
-		case "optional":
-			return OpaqueKind, nil
-		default:
-			return 0, fmt.Errorf("no known conversion for type of %s", tv.TypeName())
-		}
+		return nil, fmt.Errorf("unsupported decl: %v", d)
 	}
 }
diff --git a/vendor/github.com/google/cel-go/cel/env.go b/vendor/github.com/google/cel-go/cel/env.go
index 8cf442e..caee8e8 100644
--- a/vendor/github.com/google/cel-go/cel/env.go
+++ b/vendor/github.com/google/cel-go/cel/env.go
@@ -16,13 +16,14 @@ package cel
 
 import (
 	"errors"
-	"fmt"
 	"sync"
 
 	"github.com/google/cel-go/checker"
-	"github.com/google/cel-go/checker/decls"
+	chkdecls "github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common"
+	celast "github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/decls"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/interpreter"
@@ -37,82 +38,114 @@ type Source = common.Source
 // Ast representing the checked or unchecked expression, its source, and related metadata such as
 // source position information.
 type Ast struct {
-	expr    *exprpb.Expr
-	info    *exprpb.SourceInfo
-	source  Source
-	refMap  map[int64]*exprpb.Reference
-	typeMap map[int64]*exprpb.Type
+	source Source
+	impl   *celast.AST
+}
+
+// NativeRep converts the AST to a Go-native representation.
+func (ast *Ast) NativeRep() *celast.AST {
+	if ast == nil {
+		return nil
+	}
+	return ast.impl
 }
 
 // Expr returns the proto serializable instance of the parsed/checked expression.
+//
+// Deprecated: prefer cel.AstToCheckedExpr() or cel.AstToParsedExpr() and call GetExpr()
+// the result instead.
 func (ast *Ast) Expr() *exprpb.Expr {
-	return ast.expr
+	if ast == nil {
+		return nil
+	}
+	pbExpr, _ := celast.ExprToProto(ast.NativeRep().Expr())
+	return pbExpr
 }
 
 // IsChecked returns whether the Ast value has been successfully type-checked.
 func (ast *Ast) IsChecked() bool {
-	return ast.typeMap != nil && len(ast.typeMap) > 0
+	return ast.NativeRep().IsChecked()
 }
 
 // SourceInfo returns character offset and newline position information about expression elements.
 func (ast *Ast) SourceInfo() *exprpb.SourceInfo {
-	return ast.info
+	if ast == nil {
+		return nil
+	}
+	pbInfo, _ := celast.SourceInfoToProto(ast.NativeRep().SourceInfo())
+	return pbInfo
 }
 
 // ResultType returns the output type of the expression if the Ast has been type-checked, else
-// returns decls.Dyn as the parse step cannot infer the type.
+// returns chkdecls.Dyn as the parse step cannot infer the type.
 //
 // Deprecated: use OutputType
 func (ast *Ast) ResultType() *exprpb.Type {
-	if !ast.IsChecked() {
-		return decls.Dyn
+	out := ast.OutputType()
+	t, err := TypeToExprType(out)
+	if err != nil {
+		return chkdecls.Dyn
 	}
-	return ast.typeMap[ast.expr.GetId()]
+	return t
 }
 
 // OutputType returns the output type of the expression if the Ast has been type-checked, else
 // returns cel.DynType as the parse step cannot infer types.
 func (ast *Ast) OutputType() *Type {
-	t, err := ExprTypeToType(ast.ResultType())
-	if err != nil {
-		return DynType
+	if ast == nil {
+		return types.ErrorType
 	}
-	return t
+	return ast.NativeRep().GetType(ast.NativeRep().Expr().ID())
 }
 
 // Source returns a view of the input used to create the Ast. This source may be complete or
 // constructed from the SourceInfo.
 func (ast *Ast) Source() Source {
+	if ast == nil {
+		return nil
+	}
 	return ast.source
 }
 
 // FormatType converts a type message into a string representation.
+//
+// Deprecated: prefer FormatCELType
 func FormatType(t *exprpb.Type) string {
 	return checker.FormatCheckedType(t)
 }
 
+// FormatCELType formats a cel.Type value to a string representation.
+//
+// The type formatting is identical to FormatType.
+func FormatCELType(t *Type) string {
+	return checker.FormatCELType(t)
+}
+
 // Env encapsulates the context necessary to perform parsing, type checking, or generation of
 // evaluable programs for different expressions.
 type Env struct {
 	Container       *containers.Container
-	functions       map[string]*functionDecl
-	declarations    []*exprpb.Decl
+	variables       []*decls.VariableDecl
+	functions       map[string]*decls.FunctionDecl
 	macros          []parser.Macro
-	adapter         ref.TypeAdapter
-	provider        ref.TypeProvider
+	adapter         types.Adapter
+	provider        types.Provider
 	features        map[int]bool
 	appliedFeatures map[int]bool
 	libraries       map[string]bool
+	validators      []ASTValidator
+	costOptions     []checker.CostOption
 
 	// Internal parser representation
 	prsr     *parser.Parser
 	prsrOpts []parser.Option
 
 	// Internal checker representation
-	chk     *checker.Env
-	chkErr  error
-	chkOnce sync.Once
-	chkOpts []checker.Option
+	chkMutex sync.Mutex
+	chk      *checker.Env
+	chkErr   error
+	chkOnce  sync.Once
+	chkOpts  []checker.Option
 
 	// Program options tied to the environment
 	progOpts []ProgramOption
@@ -153,8 +186,8 @@ func NewCustomEnv(opts ...EnvOption) (*Env, error) {
 		return nil, err
 	}
 	return (&Env{
-		declarations:    []*exprpb.Decl{},
-		functions:       map[string]*functionDecl{},
+		variables:       []*decls.VariableDecl{},
+		functions:       map[string]*decls.FunctionDecl{},
 		macros:          []parser.Macro{},
 		Container:       containers.DefaultContainer,
 		adapter:         registry,
@@ -162,41 +195,63 @@ func NewCustomEnv(opts ...EnvOption) (*Env, error) {
 		features:        map[int]bool{},
 		appliedFeatures: map[int]bool{},
 		libraries:       map[string]bool{},
+		validators:      []ASTValidator{},
 		progOpts:        []ProgramOption{},
+		costOptions:     []checker.CostOption{},
 	}).configure(opts)
 }
 
 // Check performs type-checking on the input Ast and yields a checked Ast and/or set of Issues.
+// If any `ASTValidators` are configured on the environment, they will be applied after a valid
+// type-check result. If any issues are detected, the validators will provide them on the
+// output Issues object.
 //
-// Checking has failed if the returned Issues value and its Issues.Err() value are non-nil.
-// Issues should be inspected if they are non-nil, but may not represent a fatal error.
+// Either checking or validation has failed if the returned Issues value and its Issues.Err()
+// value are non-nil. Issues should be inspected if they are non-nil, but may not represent a
+// fatal error.
 //
 // It is possible to have both non-nil Ast and Issues values returned from this call: however,
 // the mere presence of an Ast does not imply that it is valid for use.
 func (e *Env) Check(ast *Ast) (*Ast, *Issues) {
-	// Note, errors aren't currently possible on the Ast to ParsedExpr conversion.
-	pe, _ := AstToParsedExpr(ast)
-
 	// Construct the internal checker env, erroring if there is an issue adding the declarations.
-	err := e.initChecker()
+	chk, err := e.initChecker()
 	if err != nil {
 		errs := common.NewErrors(ast.Source())
-		errs.ReportError(common.NoLocation, e.chkErr.Error())
-		return nil, NewIssues(errs)
+		errs.ReportError(common.NoLocation, err.Error())
+		return nil, NewIssuesWithSourceInfo(errs, ast.NativeRep().SourceInfo())
 	}
 
-	res, errs := checker.Check(pe, ast.Source(), e.chk)
+	checked, errs := checker.Check(ast.NativeRep(), ast.Source(), chk)
 	if len(errs.GetErrors()) > 0 {
-		return nil, NewIssues(errs)
+		return nil, NewIssuesWithSourceInfo(errs, ast.NativeRep().SourceInfo())
 	}
 	// Manually create the Ast to ensure that the Ast source information (which may be more
 	// detailed than the information provided by Check), is returned to the caller.
-	return &Ast{
-		source:  ast.Source(),
-		expr:    res.GetExpr(),
-		info:    res.GetSourceInfo(),
-		refMap:  res.GetReferenceMap(),
-		typeMap: res.GetTypeMap()}, nil
+	ast = &Ast{
+		source: ast.Source(),
+		impl:   checked}
+
+	// Avoid creating a validator config if it's not needed.
+	if len(e.validators) == 0 {
+		return ast, nil
+	}
+
+	// Generate a validator configuration from the set of configured validators.
+	vConfig := newValidatorConfig()
+	for _, v := range e.validators {
+		if cv, ok := v.(ASTValidatorConfigurer); ok {
+			cv.Configure(vConfig)
+		}
+	}
+	// Apply additional validators on the type-checked result.
+	iss := NewIssuesWithSourceInfo(errs, ast.NativeRep().SourceInfo())
+	for _, v := range e.validators {
+		v.Validate(e, vConfig, checked, iss)
+	}
+	if iss.Err() != nil {
+		return nil, iss
+	}
+	return ast, nil
 }
 
 // Compile combines the Parse and Check phases CEL program compilation to produce an Ast and
@@ -239,8 +294,9 @@ func (e *Env) CompileSource(src Source) (*Ast, *Issues) {
 // TypeProvider are immutable, or that their underlying implementations are based on the
 // ref.TypeRegistry which provides a Copy method which will be invoked by this method.
 func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
-	if e.chkErr != nil {
-		return nil, e.chkErr
+	chk, chkErr := e.getCheckerOrError()
+	if chkErr != nil {
+		return nil, chkErr
 	}
 
 	prsrOptsCopy := make([]parser.Option, len(e.prsrOpts))
@@ -253,17 +309,13 @@ func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
 	copy(chkOptsCopy, e.chkOpts)
 
 	// Copy the declarations if needed.
-	decsCopy := []*exprpb.Decl{}
-	if e.chk != nil {
+	if chk != nil {
 		// If the type-checker has already been instantiated, then the e.declarations have been
 		// validated within the chk instance.
-		chkOptsCopy = append(chkOptsCopy, checker.ValidatedDeclarations(e.chk))
-	} else {
-		// If the type-checker has not been instantiated, ensure the unvalidated declarations are
-		// provided to the extended Env instance.
-		decsCopy = make([]*exprpb.Decl, len(e.declarations))
-		copy(decsCopy, e.declarations)
+		chkOptsCopy = append(chkOptsCopy, checker.ValidatedDeclarations(chk))
 	}
+	varsCopy := make([]*decls.VariableDecl, len(e.variables))
+	copy(varsCopy, e.variables)
 
 	// Copy macros and program options
 	macsCopy := make([]parser.Macro, len(e.macros))
@@ -274,8 +326,8 @@ func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
 	// Copy the adapter / provider if they appear to be mutable.
 	adapter := e.adapter
 	provider := e.provider
-	adapterReg, isAdapterReg := e.adapter.(ref.TypeRegistry)
-	providerReg, isProviderReg := e.provider.(ref.TypeRegistry)
+	adapterReg, isAdapterReg := e.adapter.(*types.Registry)
+	providerReg, isProviderReg := e.provider.(*types.Registry)
 	// In most cases the provider and adapter will be a ref.TypeRegistry;
 	// however, in the rare cases where they are not, they are assumed to
 	// be immutable. Since it is possible to set the TypeProvider separately
@@ -306,7 +358,7 @@ func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
 	for k, v := range e.appliedFeatures {
 		appliedFeaturesCopy[k] = v
 	}
-	funcsCopy := make(map[string]*functionDecl, len(e.functions))
+	funcsCopy := make(map[string]*decls.FunctionDecl, len(e.functions))
 	for k, v := range e.functions {
 		funcsCopy[k] = v
 	}
@@ -314,10 +366,14 @@ func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
 	for k, v := range e.libraries {
 		libsCopy[k] = v
 	}
+	validatorsCopy := make([]ASTValidator, len(e.validators))
+	copy(validatorsCopy, e.validators)
+	costOptsCopy := make([]checker.CostOption, len(e.costOptions))
+	copy(costOptsCopy, e.costOptions)
 
 	ext := &Env{
 		Container:       e.Container,
-		declarations:    decsCopy,
+		variables:       varsCopy,
 		functions:       funcsCopy,
 		macros:          macsCopy,
 		progOpts:        progOptsCopy,
@@ -325,9 +381,11 @@ func (e *Env) Extend(opts ...EnvOption) (*Env, error) {
 		features:        featuresCopy,
 		appliedFeatures: appliedFeaturesCopy,
 		libraries:       libsCopy,
+		validators:      validatorsCopy,
 		provider:        provider,
 		chkOpts:         chkOptsCopy,
 		prsrOpts:        prsrOptsCopy,
+		costOptions:     costOptsCopy,
 	}
 	return ext.configure(opts)
 }
@@ -345,6 +403,36 @@ func (e *Env) HasLibrary(libName string) bool {
 	return exists && configured
 }
 
+// Libraries returns a list of SingletonLibrary that have been configured in the environment.
+func (e *Env) Libraries() []string {
+	libraries := make([]string, 0, len(e.libraries))
+	for libName := range e.libraries {
+		libraries = append(libraries, libName)
+	}
+	return libraries
+}
+
+// HasFunction returns whether a specific function has been configured in the environment
+func (e *Env) HasFunction(functionName string) bool {
+	_, ok := e.functions[functionName]
+	return ok
+}
+
+// Functions returns map of Functions, keyed by function name, that have been configured in the environment.
+func (e *Env) Functions() map[string]*decls.FunctionDecl {
+	return e.functions
+}
+
+// HasValidator returns whether a specific ASTValidator has been configured in the environment.
+func (e *Env) HasValidator(name string) bool {
+	for _, v := range e.validators {
+		if v.Name() == name {
+			return true
+		}
+	}
+	return false
+}
+
 // Parse parses the input expression value `txt` to a Ast and/or a set of Issues.
 //
 // This form of Parse creates a Source value for the input `txt` and forwards to the
@@ -362,20 +450,21 @@ func (e *Env) Parse(txt string) (*Ast, *Issues) {
 // It is possible to have both non-nil Ast and Issues values returned from this call; however,
 // the mere presence of an Ast does not imply that it is valid for use.
 func (e *Env) ParseSource(src Source) (*Ast, *Issues) {
-	res, errs := e.prsr.Parse(src)
+	parsed, errs := e.prsr.Parse(src)
 	if len(errs.GetErrors()) > 0 {
 		return nil, &Issues{errs: errs}
 	}
-	// Manually create the Ast to ensure that the text source information is propagated on
-	// subsequent calls to Check.
-	return &Ast{
-		source: src,
-		expr:   res.GetExpr(),
-		info:   res.GetSourceInfo()}, nil
+	return &Ast{source: src, impl: parsed}, nil
 }
 
 // Program generates an evaluable instance of the Ast within the environment (Env).
 func (e *Env) Program(ast *Ast, opts ...ProgramOption) (Program, error) {
+	return e.PlanProgram(ast.NativeRep(), opts...)
+}
+
+// PlanProgram generates an evaluable instance of the AST in the go-native representation within
+// the environment (Env).
+func (e *Env) PlanProgram(a *celast.AST, opts ...ProgramOption) (Program, error) {
 	optSet := e.progOpts
 	if len(opts) != 0 {
 		mergedOpts := []ProgramOption{}
@@ -383,39 +472,67 @@ func (e *Env) Program(ast *Ast, opts ...ProgramOption) (Program, error) {
 		mergedOpts = append(mergedOpts, opts...)
 		optSet = mergedOpts
 	}
-	return newProgram(e, ast, optSet)
+	return newProgram(e, a, optSet)
+}
+
+// CELTypeAdapter returns the `types.Adapter` configured for the environment.
+func (e *Env) CELTypeAdapter() types.Adapter {
+	return e.adapter
+}
+
+// CELTypeProvider returns the `types.Provider` configured for the environment.
+func (e *Env) CELTypeProvider() types.Provider {
+	return e.provider
 }
 
 // TypeAdapter returns the `ref.TypeAdapter` configured for the environment.
+//
+// Deprecated: use CELTypeAdapter()
 func (e *Env) TypeAdapter() ref.TypeAdapter {
 	return e.adapter
 }
 
 // TypeProvider returns the `ref.TypeProvider` configured for the environment.
+//
+// Deprecated: use CELTypeProvider()
 func (e *Env) TypeProvider() ref.TypeProvider {
-	return e.provider
+	if legacyProvider, ok := e.provider.(ref.TypeProvider); ok {
+		return legacyProvider
+	}
+	return &interopLegacyTypeProvider{Provider: e.provider}
 }
 
-// UnknownVars returns an interpreter.PartialActivation which marks all variables
-// declared in the Env as unknown AttributePattern values.
+// UnknownVars returns an interpreter.PartialActivation which marks all variables declared in the
+// Env as unknown AttributePattern values.
 //
-// Note, the UnknownVars will behave the same as an interpreter.EmptyActivation
-// unless the PartialAttributes option is provided as a ProgramOption.
+// Note, the UnknownVars will behave the same as an interpreter.EmptyActivation unless the
+// PartialAttributes option is provided as a ProgramOption.
 func (e *Env) UnknownVars() interpreter.PartialActivation {
-	var unknownPatterns []*interpreter.AttributePattern
-	for _, d := range e.declarations {
-		switch d.GetDeclKind().(type) {
-		case *exprpb.Decl_Ident:
-			unknownPatterns = append(unknownPatterns,
-				interpreter.NewAttributePattern(d.GetName()))
-		}
-	}
-	part, _ := PartialVars(
-		interpreter.EmptyActivation(),
-		unknownPatterns...)
+	act := interpreter.EmptyActivation()
+	part, _ := PartialVars(act, e.computeUnknownVars(act)...)
 	return part
 }
 
+// PartialVars returns an interpreter.PartialActivation where all variables not in the input variable
+// set, but which have been configured in the environment, are marked as unknown.
+//
+// The `vars` value may either be an interpreter.Activation or any valid input to the
+// interpreter.NewActivation call.
+//
+// Note, this is equivalent to calling cel.PartialVars and manually configuring the set of unknown
+// variables. For more advanced use cases of partial state where portions of an object graph, rather
+// than top-level variables, are missing the PartialVars() method may be a more suitable choice.
+//
+// Note, the PartialVars will behave the same as an interpreter.EmptyActivation unless the
+// PartialAttributes option is provided as a ProgramOption.
+func (e *Env) PartialVars(vars any) (interpreter.PartialActivation, error) {
+	act, err := interpreter.NewActivation(vars)
+	if err != nil {
+		return nil, err
+	}
+	return PartialVars(act, e.computeUnknownVars(act)...)
+}
+
 // ResidualAst takes an Ast and its EvalDetails to produce a new Ast which only contains the
 // attribute references which are unknown.
 //
@@ -439,8 +556,10 @@ func (e *Env) UnknownVars() interpreter.PartialActivation {
 // TODO: Consider adding an option to generate a Program.Residual to avoid round-tripping to an
 // Ast format and then Program again.
 func (e *Env) ResidualAst(a *Ast, details *EvalDetails) (*Ast, error) {
-	pruned := interpreter.PruneAst(a.Expr(), a.SourceInfo().GetMacroCalls(), details.State())
-	expr, err := AstToString(ParsedExprToAst(pruned))
+	ast := a.NativeRep()
+	pruned := interpreter.PruneAst(ast.Expr(), ast.SourceInfo().MacroCalls(), details.State())
+	newAST := &Ast{source: a.Source(), impl: pruned}
+	expr, err := AstToString(newAST)
 	if err != nil {
 		return nil, err
 	}
@@ -460,12 +579,11 @@ func (e *Env) ResidualAst(a *Ast, details *EvalDetails) (*Ast, error) {
 
 // EstimateCost estimates the cost of a type checked CEL expression using the length estimates of input data and
 // extension functions provided by estimator.
-func (e *Env) EstimateCost(ast *Ast, estimator checker.CostEstimator) (checker.CostEstimate, error) {
-	checked, err := AstToCheckedExpr(ast)
-	if err != nil {
-		return checker.CostEstimate{}, fmt.Errorf("EsimateCost could not inspect Ast: %v", err)
-	}
-	return checker.Cost(checked, estimator), nil
+func (e *Env) EstimateCost(ast *Ast, estimator checker.CostEstimator, opts ...checker.CostOption) (checker.CostEstimate, error) {
+	extendedOpts := make([]checker.CostOption, 0, len(e.costOptions))
+	extendedOpts = append(extendedOpts, opts...)
+	extendedOpts = append(extendedOpts, e.costOptions...)
+	return checker.Cost(ast.NativeRep(), estimator, extendedOpts...)
 }
 
 // configure applies a series of EnvOptions to the current environment.
@@ -486,14 +604,6 @@ func (e *Env) configure(opts []EnvOption) (*Env, error) {
 		return nil, err
 	}
 
-	// Initialize all of the functions configured within the environment.
-	for _, fn := range e.functions {
-		err = fn.init()
-		if err != nil {
-			return nil, err
-		}
-	}
-
 	// Configure the parser.
 	prsrOpts := []parser.Option{}
 	prsrOpts = append(prsrOpts, e.prsrOpts...)
@@ -502,6 +612,9 @@ func (e *Env) configure(opts []EnvOption) (*Env, error) {
 	if e.HasFeature(featureEnableMacroCallTracking) {
 		prsrOpts = append(prsrOpts, parser.PopulateMacroCalls(true))
 	}
+	if e.HasFeature(featureVariadicLogicalASTs) {
+		prsrOpts = append(prsrOpts, parser.EnableVariadicOperatorASTs(true))
+	}
 	e.prsr, err = parser.NewParser(prsrOpts...)
 	if err != nil {
 		return nil, err
@@ -509,7 +622,7 @@ func (e *Env) configure(opts []EnvOption) (*Env, error) {
 
 	// Ensure that the checker init happens eagerly rather than lazily.
 	if e.HasFeature(featureEagerlyValidateDeclarations) {
-		err := e.initChecker()
+		_, err := e.initChecker()
 		if err != nil {
 			return nil, err
 		}
@@ -518,44 +631,55 @@ func (e *Env) configure(opts []EnvOption) (*Env, error) {
 	return e, nil
 }
 
-func (e *Env) initChecker() error {
+func (e *Env) initChecker() (*checker.Env, error) {
 	e.chkOnce.Do(func() {
 		chkOpts := []checker.Option{}
 		chkOpts = append(chkOpts, e.chkOpts...)
 		chkOpts = append(chkOpts,
-			checker.HomogeneousAggregateLiterals(
-				e.HasFeature(featureDisableDynamicAggregateLiterals)),
 			checker.CrossTypeNumericComparisons(
 				e.HasFeature(featureCrossTypeNumericComparisons)))
 
 		ce, err := checker.NewEnv(e.Container, e.provider, chkOpts...)
 		if err != nil {
-			e.chkErr = err
+			e.setCheckerOrError(nil, err)
 			return
 		}
 		// Add the statically configured declarations.
-		err = ce.Add(e.declarations...)
+		err = ce.AddIdents(e.variables...)
 		if err != nil {
-			e.chkErr = err
+			e.setCheckerOrError(nil, err)
 			return
 		}
 		// Add the function declarations which are derived from the FunctionDecl instances.
 		for _, fn := range e.functions {
-			fnDecl, err := functionDeclToExprDecl(fn)
-			if err != nil {
-				e.chkErr = err
-				return
+			if fn.IsDeclarationDisabled() {
+				continue
 			}
-			err = ce.Add(fnDecl)
+			err = ce.AddFunctions(fn)
 			if err != nil {
-				e.chkErr = err
+				e.setCheckerOrError(nil, err)
 				return
 			}
 		}
 		// Add function declarations here separately.
-		e.chk = ce
+		e.setCheckerOrError(ce, nil)
 	})
-	return e.chkErr
+	return e.getCheckerOrError()
+}
+
+// setCheckerOrError sets the checker.Env or error state in a concurrency-safe manner
+func (e *Env) setCheckerOrError(chk *checker.Env, chkErr error) {
+	e.chkMutex.Lock()
+	e.chk = chk
+	e.chkErr = chkErr
+	e.chkMutex.Unlock()
+}
+
+// getCheckerOrError gets the checker.Env or error state in a concurrency-safe manner
+func (e *Env) getCheckerOrError() (*checker.Env, error) {
+	e.chkMutex.Lock()
+	defer e.chkMutex.Unlock()
+	return e.chk, e.chkErr
 }
 
 // maybeApplyFeature determines whether the feature-guarded option is enabled, and if so applies
@@ -579,17 +703,43 @@ func (e *Env) maybeApplyFeature(feature int, option EnvOption) (*Env, error) {
 	return e, nil
 }
 
+// computeUnknownVars determines a set of missing variables based on the input activation and the
+// environment's configured declaration set.
+func (e *Env) computeUnknownVars(vars interpreter.Activation) []*interpreter.AttributePattern {
+	var unknownPatterns []*interpreter.AttributePattern
+	for _, v := range e.variables {
+		varName := v.Name()
+		if _, found := vars.ResolveName(varName); found {
+			continue
+		}
+		unknownPatterns = append(unknownPatterns, interpreter.NewAttributePattern(varName))
+	}
+	return unknownPatterns
+}
+
+// Error type which references an expression id, a location within source, and a message.
+type Error = common.Error
+
 // Issues defines methods for inspecting the error details of parse and check calls.
 //
 // Note: in the future, non-fatal warnings and notices may be inspectable via the Issues struct.
 type Issues struct {
 	errs *common.Errors
+	info *celast.SourceInfo
 }
 
 // NewIssues returns an Issues struct from a common.Errors object.
 func NewIssues(errs *common.Errors) *Issues {
+	return NewIssuesWithSourceInfo(errs, nil)
+}
+
+// NewIssuesWithSourceInfo returns an Issues struct from a common.Errors object with SourceInfo metatata
+// which can be used with the `ReportErrorAtID` method for additional error reports within the context
+// information that's inferred from an expression id.
+func NewIssuesWithSourceInfo(errs *common.Errors, info *celast.SourceInfo) *Issues {
 	return &Issues{
 		errs: errs,
+		info: info,
 	}
 }
 
@@ -605,9 +755,9 @@ func (i *Issues) Err() error {
 }
 
 // Errors returns the collection of errors encountered in more granular detail.
-func (i *Issues) Errors() []common.Error {
+func (i *Issues) Errors() []*Error {
 	if i == nil {
-		return []common.Error{}
+		return []*Error{}
 	}
 	return i.errs.GetErrors()
 }
@@ -617,10 +767,10 @@ func (i *Issues) Append(other *Issues) *Issues {
 	if i == nil {
 		return other
 	}
-	if other == nil {
+	if other == nil || i == other {
 		return i
 	}
-	return NewIssues(i.errs.Append(other.errs.GetErrors()))
+	return NewIssuesWithSourceInfo(i.errs.Append(other.errs.GetErrors()), i.info)
 }
 
 // String converts the issues to a suitable display string.
@@ -631,6 +781,14 @@ func (i *Issues) String() string {
 	return i.errs.ToDisplayString()
 }
 
+// ReportErrorAtID reports an error message with an optional set of formatting arguments.
+//
+// The source metadata for the expression at `id`, if present, is attached to the error report.
+// To ensure that source metadata is attached to error reports, use NewIssuesWithSourceInfo.
+func (i *Issues) ReportErrorAtID(id int64, message string, args ...any) {
+	i.errs.ReportErrorAtID(id, i.info.GetStartLocation(id), message, args...)
+}
+
 // getStdEnv lazy initializes the CEL standard environment.
 func getStdEnv() (*Env, error) {
 	stdEnvInit.Do(func() {
@@ -639,6 +797,97 @@ func getStdEnv() (*Env, error) {
 	return stdEnv, stdEnvErr
 }
 
+// interopCELTypeProvider layers support for the types.Provider interface on top of a ref.TypeProvider.
+type interopCELTypeProvider struct {
+	ref.TypeProvider
+}
+
+// FindStructType returns a types.Type instance for the given fully-qualified typeName if one exists.
+//
+// This method proxies to the underlying ref.TypeProvider's FindType method and converts protobuf type
+// into a native type representation. If the conversion fails, the type is listed as not found.
+func (p *interopCELTypeProvider) FindStructType(typeName string) (*types.Type, bool) {
+	if et, found := p.FindType(typeName); found {
+		t, err := types.ExprTypeToType(et)
+		if err != nil {
+			return nil, false
+		}
+		return t, true
+	}
+	return nil, false
+}
+
+// FindStructFieldNames returns an empty set of field for the interop provider.
+//
+// To inspect the field names, migrate to a `types.Provider` implementation.
+func (p *interopCELTypeProvider) FindStructFieldNames(typeName string) ([]string, bool) {
+	return []string{}, false
+}
+
+// FindStructFieldType returns a types.FieldType instance for the given fully-qualified typeName and field
+// name, if one exists.
+//
+// This method proxies to the underlying ref.TypeProvider's FindFieldType method and converts protobuf type
+// into a native type representation. If the conversion fails, the type is listed as not found.
+func (p *interopCELTypeProvider) FindStructFieldType(structType, fieldName string) (*types.FieldType, bool) {
+	if ft, found := p.FindFieldType(structType, fieldName); found {
+		t, err := types.ExprTypeToType(ft.Type)
+		if err != nil {
+			return nil, false
+		}
+		return &types.FieldType{
+			Type:    t,
+			IsSet:   ft.IsSet,
+			GetFrom: ft.GetFrom,
+		}, true
+	}
+	return nil, false
+}
+
+// interopLegacyTypeProvider layers support for the ref.TypeProvider interface on top of a types.Provider.
+type interopLegacyTypeProvider struct {
+	types.Provider
+}
+
+// FindType retruns the protobuf Type representation for the input type name if one exists.
+//
+// This method proxies to the underlying types.Provider FindStructType method and converts the types.Type
+// value to a protobuf Type representation.
+//
+// Failure to convert the type will result in the type not being found.
+func (p *interopLegacyTypeProvider) FindType(typeName string) (*exprpb.Type, bool) {
+	if t, found := p.FindStructType(typeName); found {
+		et, err := types.TypeToExprType(t)
+		if err != nil {
+			return nil, false
+		}
+		return et, true
+	}
+	return nil, false
+}
+
+// FindFieldType returns the protobuf-based FieldType representation for the input type name and field,
+// if one exists.
+//
+// This call proxies to the types.Provider FindStructFieldType method and converts the types.FIeldType
+// value to a protobuf-based ref.FieldType representation if found.
+//
+// Failure to convert the FieldType will result in the field not being found.
+func (p *interopLegacyTypeProvider) FindFieldType(structType, fieldName string) (*ref.FieldType, bool) {
+	if cft, found := p.FindStructFieldType(structType, fieldName); found {
+		et, err := types.TypeToExprType(cft.Type)
+		if err != nil {
+			return nil, false
+		}
+		return &ref.FieldType{
+			Type:    et,
+			IsSet:   cft.IsSet,
+			GetFrom: cft.GetFrom,
+		}, true
+	}
+	return nil, false
+}
+
 var (
 	stdEnvInit sync.Once
 	stdEnv     *Env
diff --git a/vendor/github.com/google/cel-go/cel/folding.go b/vendor/github.com/google/cel-go/cel/folding.go
new file mode 100644
index 0000000..d706089
--- /dev/null
+++ b/vendor/github.com/google/cel-go/cel/folding.go
@@ -0,0 +1,559 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cel
+
+import (
+	"fmt"
+
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+// ConstantFoldingOption defines a functional option for configuring constant folding.
+type ConstantFoldingOption func(opt *constantFoldingOptimizer) (*constantFoldingOptimizer, error)
+
+// MaxConstantFoldIterations limits the number of times literals may be folding during optimization.
+//
+// Defaults to 100 if not set.
+func MaxConstantFoldIterations(limit int) ConstantFoldingOption {
+	return func(opt *constantFoldingOptimizer) (*constantFoldingOptimizer, error) {
+		opt.maxFoldIterations = limit
+		return opt, nil
+	}
+}
+
+// NewConstantFoldingOptimizer creates an optimizer which inlines constant scalar an aggregate
+// literal values within function calls and select statements with their evaluated result.
+func NewConstantFoldingOptimizer(opts ...ConstantFoldingOption) (ASTOptimizer, error) {
+	folder := &constantFoldingOptimizer{
+		maxFoldIterations: defaultMaxConstantFoldIterations,
+	}
+	var err error
+	for _, o := range opts {
+		folder, err = o(folder)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return folder, nil
+}
+
+type constantFoldingOptimizer struct {
+	maxFoldIterations int
+}
+
+// Optimize queries the expression graph for scalar and aggregate literal expressions within call and
+// select statements and then evaluates them and replaces the call site with the literal result.
+//
+// Note: only values which can be represented as literals in CEL syntax are supported.
+func (opt *constantFoldingOptimizer) Optimize(ctx *OptimizerContext, a *ast.AST) *ast.AST {
+	root := ast.NavigateAST(a)
+
+	// Walk the list of foldable expression and continue to fold until there are no more folds left.
+	// All of the fold candidates returned by the constantExprMatcher should succeed unless there's
+	// a logic bug with the selection of expressions.
+	foldableExprs := ast.MatchDescendants(root, constantExprMatcher)
+	foldCount := 0
+	for len(foldableExprs) != 0 && foldCount < opt.maxFoldIterations {
+		for _, fold := range foldableExprs {
+			// If the expression could be folded because it's a non-strict call, and the
+			// branches are pruned, continue to the next fold.
+			if fold.Kind() == ast.CallKind && maybePruneBranches(ctx, fold) {
+				continue
+			}
+			// Otherwise, assume all context is needed to evaluate the expression.
+			err := tryFold(ctx, a, fold)
+			if err != nil {
+				ctx.ReportErrorAtID(fold.ID(), "constant-folding evaluation failed: %v", err.Error())
+				return a
+			}
+		}
+		foldCount++
+		foldableExprs = ast.MatchDescendants(root, constantExprMatcher)
+	}
+	// Once all of the constants have been folded, try to run through the remaining comprehensions
+	// one last time. In this case, there's no guarantee they'll run, so we only update the
+	// target comprehension node with the literal value if the evaluation succeeds.
+	for _, compre := range ast.MatchDescendants(root, ast.KindMatcher(ast.ComprehensionKind)) {
+		tryFold(ctx, a, compre)
+	}
+
+	// If the output is a list, map, or struct which contains optional entries, then prune it
+	// to make sure that the optionals, if resolved, do not surface in the output literal.
+	pruneOptionalElements(ctx, root)
+
+	// Ensure that all intermediate values in the folded expression can be represented as valid
+	// CEL literals within the AST structure. Use `PostOrderVisit` rather than `MatchDescendents`
+	// to avoid extra allocations during this final pass through the AST.
+	ast.PostOrderVisit(root, ast.NewExprVisitor(func(e ast.Expr) {
+		if e.Kind() != ast.LiteralKind {
+			return
+		}
+		val := e.AsLiteral()
+		adapted, err := adaptLiteral(ctx, val)
+		if err != nil {
+			ctx.ReportErrorAtID(root.ID(), "constant-folding evaluation failed: %v", err.Error())
+			return
+		}
+		ctx.UpdateExpr(e, adapted)
+	}))
+
+	return a
+}
+
+// tryFold attempts to evaluate a sub-expression to a literal.
+//
+// If the evaluation succeeds, the input expr value will be modified to become a literal, otherwise
+// the method will return an error.
+func tryFold(ctx *OptimizerContext, a *ast.AST, expr ast.Expr) error {
+	// Assume all context is needed to evaluate the expression.
+	subAST := &Ast{
+		impl: ast.NewCheckedAST(ast.NewAST(expr, a.SourceInfo()), a.TypeMap(), a.ReferenceMap()),
+	}
+	prg, err := ctx.Program(subAST)
+	if err != nil {
+		return err
+	}
+	out, _, err := prg.Eval(NoVars())
+	if err != nil {
+		return err
+	}
+	// Update the fold expression to be a literal.
+	ctx.UpdateExpr(expr, ctx.NewLiteral(out))
+	return nil
+}
+
+// maybePruneBranches inspects the non-strict call expression to determine whether
+// a branch can be removed. Evaluation will naturally prune logical and / or calls,
+// but conditional will not be pruned cleanly, so this is one small area where the
+// constant folding step reimplements a portion of the evaluator.
+func maybePruneBranches(ctx *OptimizerContext, expr ast.NavigableExpr) bool {
+	call := expr.AsCall()
+	args := call.Args()
+	switch call.FunctionName() {
+	case operators.LogicalAnd, operators.LogicalOr:
+		return maybeShortcircuitLogic(ctx, call.FunctionName(), args, expr)
+	case operators.Conditional:
+		cond := args[0]
+		truthy := args[1]
+		falsy := args[2]
+		if cond.Kind() != ast.LiteralKind {
+			return false
+		}
+		if cond.AsLiteral() == types.True {
+			ctx.UpdateExpr(expr, truthy)
+		} else {
+			ctx.UpdateExpr(expr, falsy)
+		}
+		return true
+	case operators.In:
+		haystack := args[1]
+		if haystack.Kind() == ast.ListKind && haystack.AsList().Size() == 0 {
+			ctx.UpdateExpr(expr, ctx.NewLiteral(types.False))
+			return true
+		}
+		needle := args[0]
+		if needle.Kind() == ast.LiteralKind && haystack.Kind() == ast.ListKind {
+			needleValue := needle.AsLiteral()
+			list := haystack.AsList()
+			for _, e := range list.Elements() {
+				if e.Kind() == ast.LiteralKind && e.AsLiteral().Equal(needleValue) == types.True {
+					ctx.UpdateExpr(expr, ctx.NewLiteral(types.True))
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
+func maybeShortcircuitLogic(ctx *OptimizerContext, function string, args []ast.Expr, expr ast.NavigableExpr) bool {
+	shortcircuit := types.False
+	skip := types.True
+	if function == operators.LogicalOr {
+		shortcircuit = types.True
+		skip = types.False
+	}
+	newArgs := []ast.Expr{}
+	for _, arg := range args {
+		if arg.Kind() != ast.LiteralKind {
+			newArgs = append(newArgs, arg)
+			continue
+		}
+		if arg.AsLiteral() == skip {
+			continue
+		}
+		if arg.AsLiteral() == shortcircuit {
+			ctx.UpdateExpr(expr, arg)
+			return true
+		}
+	}
+	if len(newArgs) == 0 {
+		newArgs = append(newArgs, args[0])
+		ctx.UpdateExpr(expr, newArgs[0])
+		return true
+	}
+	if len(newArgs) == 1 {
+		ctx.UpdateExpr(expr, newArgs[0])
+		return true
+	}
+	ctx.UpdateExpr(expr, ctx.NewCall(function, newArgs...))
+	return true
+}
+
+// pruneOptionalElements works from the bottom up to resolve optional elements within
+// aggregate literals.
+//
+// Note, many aggregate literals will be resolved as arguments to functions or select
+// statements, so this method exists to handle the case where the literal could not be
+// fully resolved or exists outside of a call, select, or comprehension context.
+func pruneOptionalElements(ctx *OptimizerContext, root ast.NavigableExpr) {
+	aggregateLiterals := ast.MatchDescendants(root, aggregateLiteralMatcher)
+	for _, lit := range aggregateLiterals {
+		switch lit.Kind() {
+		case ast.ListKind:
+			pruneOptionalListElements(ctx, lit)
+		case ast.MapKind:
+			pruneOptionalMapEntries(ctx, lit)
+		case ast.StructKind:
+			pruneOptionalStructFields(ctx, lit)
+		}
+	}
+}
+
+func pruneOptionalListElements(ctx *OptimizerContext, e ast.Expr) {
+	l := e.AsList()
+	elems := l.Elements()
+	optIndices := l.OptionalIndices()
+	if len(optIndices) == 0 {
+		return
+	}
+	updatedElems := []ast.Expr{}
+	updatedIndices := []int32{}
+	newOptIndex := -1
+	for _, e := range elems {
+		newOptIndex++
+		if !l.IsOptional(int32(newOptIndex)) {
+			updatedElems = append(updatedElems, e)
+			continue
+		}
+		if e.Kind() != ast.LiteralKind {
+			updatedElems = append(updatedElems, e)
+			updatedIndices = append(updatedIndices, int32(newOptIndex))
+			continue
+		}
+		optElemVal, ok := e.AsLiteral().(*types.Optional)
+		if !ok {
+			updatedElems = append(updatedElems, e)
+			updatedIndices = append(updatedIndices, int32(newOptIndex))
+			continue
+		}
+		if !optElemVal.HasValue() {
+			newOptIndex-- // Skipping causes the list to get smaller.
+			continue
+		}
+		ctx.UpdateExpr(e, ctx.NewLiteral(optElemVal.GetValue()))
+		updatedElems = append(updatedElems, e)
+	}
+	ctx.UpdateExpr(e, ctx.NewList(updatedElems, updatedIndices))
+}
+
+func pruneOptionalMapEntries(ctx *OptimizerContext, e ast.Expr) {
+	m := e.AsMap()
+	entries := m.Entries()
+	updatedEntries := []ast.EntryExpr{}
+	modified := false
+	for _, e := range entries {
+		entry := e.AsMapEntry()
+		key := entry.Key()
+		val := entry.Value()
+		// If the entry is not optional, or the value-side of the optional hasn't
+		// been resolved to a literal, then preserve the entry as-is.
+		if !entry.IsOptional() || val.Kind() != ast.LiteralKind {
+			updatedEntries = append(updatedEntries, e)
+			continue
+		}
+		optElemVal, ok := val.AsLiteral().(*types.Optional)
+		if !ok {
+			updatedEntries = append(updatedEntries, e)
+			continue
+		}
+		// When the key is not a literal, but the value is, then it needs to be
+		// restored to an optional value.
+		if key.Kind() != ast.LiteralKind {
+			undoOptVal, err := adaptLiteral(ctx, optElemVal)
+			if err != nil {
+				ctx.ReportErrorAtID(val.ID(), "invalid map value literal %v: %v", optElemVal, err)
+			}
+			ctx.UpdateExpr(val, undoOptVal)
+			updatedEntries = append(updatedEntries, e)
+			continue
+		}
+		modified = true
+		if !optElemVal.HasValue() {
+			continue
+		}
+		ctx.UpdateExpr(val, ctx.NewLiteral(optElemVal.GetValue()))
+		updatedEntry := ctx.NewMapEntry(key, val, false)
+		updatedEntries = append(updatedEntries, updatedEntry)
+	}
+	if modified {
+		ctx.UpdateExpr(e, ctx.NewMap(updatedEntries))
+	}
+}
+
+func pruneOptionalStructFields(ctx *OptimizerContext, e ast.Expr) {
+	s := e.AsStruct()
+	fields := s.Fields()
+	updatedFields := []ast.EntryExpr{}
+	modified := false
+	for _, f := range fields {
+		field := f.AsStructField()
+		val := field.Value()
+		if !field.IsOptional() || val.Kind() != ast.LiteralKind {
+			updatedFields = append(updatedFields, f)
+			continue
+		}
+		optElemVal, ok := val.AsLiteral().(*types.Optional)
+		if !ok {
+			updatedFields = append(updatedFields, f)
+			continue
+		}
+		modified = true
+		if !optElemVal.HasValue() {
+			continue
+		}
+		ctx.UpdateExpr(val, ctx.NewLiteral(optElemVal.GetValue()))
+		updatedField := ctx.NewStructField(field.Name(), val, false)
+		updatedFields = append(updatedFields, updatedField)
+	}
+	if modified {
+		ctx.UpdateExpr(e, ctx.NewStruct(s.TypeName(), updatedFields))
+	}
+}
+
+// adaptLiteral converts a runtime CEL value to its equivalent literal expression.
+//
+// For strongly typed values, the type-provider will be used to reconstruct the fields
+// which are present in the literal and their equivalent initialization values.
+func adaptLiteral(ctx *OptimizerContext, val ref.Val) (ast.Expr, error) {
+	switch t := val.Type().(type) {
+	case *types.Type:
+		switch t {
+		case types.BoolType, types.BytesType, types.DoubleType, types.IntType,
+			types.NullType, types.StringType, types.UintType:
+			return ctx.NewLiteral(val), nil
+		case types.DurationType:
+			return ctx.NewCall(
+				overloads.TypeConvertDuration,
+				ctx.NewLiteral(val.ConvertToType(types.StringType)),
+			), nil
+		case types.TimestampType:
+			return ctx.NewCall(
+				overloads.TypeConvertTimestamp,
+				ctx.NewLiteral(val.ConvertToType(types.StringType)),
+			), nil
+		case types.OptionalType:
+			opt := val.(*types.Optional)
+			if !opt.HasValue() {
+				return ctx.NewCall("optional.none"), nil
+			}
+			target, err := adaptLiteral(ctx, opt.GetValue())
+			if err != nil {
+				return nil, err
+			}
+			return ctx.NewCall("optional.of", target), nil
+		case types.TypeType:
+			return ctx.NewIdent(val.(*types.Type).TypeName()), nil
+		case types.ListType:
+			l, ok := val.(traits.Lister)
+			if !ok {
+				return nil, fmt.Errorf("failed to adapt %v to literal", val)
+			}
+			elems := make([]ast.Expr, l.Size().(types.Int))
+			idx := 0
+			it := l.Iterator()
+			for it.HasNext() == types.True {
+				elemVal := it.Next()
+				elemExpr, err := adaptLiteral(ctx, elemVal)
+				if err != nil {
+					return nil, err
+				}
+				elems[idx] = elemExpr
+				idx++
+			}
+			return ctx.NewList(elems, []int32{}), nil
+		case types.MapType:
+			m, ok := val.(traits.Mapper)
+			if !ok {
+				return nil, fmt.Errorf("failed to adapt %v to literal", val)
+			}
+			entries := make([]ast.EntryExpr, m.Size().(types.Int))
+			idx := 0
+			it := m.Iterator()
+			for it.HasNext() == types.True {
+				keyVal := it.Next()
+				keyExpr, err := adaptLiteral(ctx, keyVal)
+				if err != nil {
+					return nil, err
+				}
+				valVal := m.Get(keyVal)
+				valExpr, err := adaptLiteral(ctx, valVal)
+				if err != nil {
+					return nil, err
+				}
+				entries[idx] = ctx.NewMapEntry(keyExpr, valExpr, false)
+				idx++
+			}
+			return ctx.NewMap(entries), nil
+		default:
+			provider := ctx.CELTypeProvider()
+			fields, found := provider.FindStructFieldNames(t.TypeName())
+			if !found {
+				return nil, fmt.Errorf("failed to adapt %v to literal", val)
+			}
+			tester := val.(traits.FieldTester)
+			indexer := val.(traits.Indexer)
+			fieldInits := []ast.EntryExpr{}
+			for _, f := range fields {
+				field := types.String(f)
+				if tester.IsSet(field) != types.True {
+					continue
+				}
+				fieldVal := indexer.Get(field)
+				fieldExpr, err := adaptLiteral(ctx, fieldVal)
+				if err != nil {
+					return nil, err
+				}
+				fieldInits = append(fieldInits, ctx.NewStructField(f, fieldExpr, false))
+			}
+			return ctx.NewStruct(t.TypeName(), fieldInits), nil
+		}
+	}
+	return nil, fmt.Errorf("failed to adapt %v to literal", val)
+}
+
+// constantExprMatcher matches calls, select statements, and comprehensions whose arguments
+// are all constant scalar or aggregate literal values.
+//
+// Only comprehensions which are not nested are included as possible constant folds, and only
+// if all variables referenced in the comprehension stack exist are only iteration or
+// accumulation variables.
+func constantExprMatcher(e ast.NavigableExpr) bool {
+	switch e.Kind() {
+	case ast.CallKind:
+		return constantCallMatcher(e)
+	case ast.SelectKind:
+		sel := e.AsSelect() // guaranteed to be a navigable value
+		return constantMatcher(sel.Operand().(ast.NavigableExpr))
+	case ast.ComprehensionKind:
+		if isNestedComprehension(e) {
+			return false
+		}
+		vars := map[string]bool{}
+		constantExprs := true
+		visitor := ast.NewExprVisitor(func(e ast.Expr) {
+			if e.Kind() == ast.ComprehensionKind {
+				nested := e.AsComprehension()
+				vars[nested.AccuVar()] = true
+				vars[nested.IterVar()] = true
+			}
+			if e.Kind() == ast.IdentKind && !vars[e.AsIdent()] {
+				constantExprs = false
+			}
+		})
+		ast.PreOrderVisit(e, visitor)
+		return constantExprs
+	default:
+		return false
+	}
+}
+
+// constantCallMatcher identifies strict and non-strict calls which can be folded.
+func constantCallMatcher(e ast.NavigableExpr) bool {
+	call := e.AsCall()
+	children := e.Children()
+	fnName := call.FunctionName()
+	if fnName == operators.LogicalAnd {
+		for _, child := range children {
+			if child.Kind() == ast.LiteralKind {
+				return true
+			}
+		}
+	}
+	if fnName == operators.LogicalOr {
+		for _, child := range children {
+			if child.Kind() == ast.LiteralKind {
+				return true
+			}
+		}
+	}
+	if fnName == operators.Conditional {
+		cond := children[0]
+		if cond.Kind() == ast.LiteralKind && cond.AsLiteral().Type() == types.BoolType {
+			return true
+		}
+	}
+	if fnName == operators.In {
+		haystack := children[1]
+		if haystack.Kind() == ast.ListKind && haystack.AsList().Size() == 0 {
+			return true
+		}
+		needle := children[0]
+		if needle.Kind() == ast.LiteralKind && haystack.Kind() == ast.ListKind {
+			needleValue := needle.AsLiteral()
+			list := haystack.AsList()
+			for _, e := range list.Elements() {
+				if e.Kind() == ast.LiteralKind && e.AsLiteral().Equal(needleValue) == types.True {
+					return true
+				}
+			}
+		}
+	}
+	// convert all other calls with constant arguments
+	for _, child := range children {
+		if !constantMatcher(child) {
+			return false
+		}
+	}
+	return true
+}
+
+func isNestedComprehension(e ast.NavigableExpr) bool {
+	parent, found := e.Parent()
+	for found {
+		if parent.Kind() == ast.ComprehensionKind {
+			return true
+		}
+		parent, found = parent.Parent()
+	}
+	return false
+}
+
+func aggregateLiteralMatcher(e ast.NavigableExpr) bool {
+	return e.Kind() == ast.ListKind || e.Kind() == ast.MapKind || e.Kind() == ast.StructKind
+}
+
+var (
+	constantMatcher = ast.ConstantValueMatcher()
+)
+
+const (
+	defaultMaxConstantFoldIterations = 100
+)
diff --git a/vendor/github.com/google/cel-go/cel/inlining.go b/vendor/github.com/google/cel-go/cel/inlining.go
new file mode 100644
index 0000000..a4530e1
--- /dev/null
+++ b/vendor/github.com/google/cel-go/cel/inlining.go
@@ -0,0 +1,228 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cel
+
+import (
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+// InlineVariable holds a variable name to be matched and an AST representing
+// the expression graph which should be used to replace it.
+type InlineVariable struct {
+	name  string
+	alias string
+	def   *ast.AST
+}
+
+// Name returns the qualified variable or field selection to replace.
+func (v *InlineVariable) Name() string {
+	return v.name
+}
+
+// Alias returns the alias to use when performing cel.bind() calls during inlining.
+func (v *InlineVariable) Alias() string {
+	return v.alias
+}
+
+// Expr returns the inlined expression value.
+func (v *InlineVariable) Expr() ast.Expr {
+	return v.def.Expr()
+}
+
+// Type indicates the inlined expression type.
+func (v *InlineVariable) Type() *Type {
+	return v.def.GetType(v.def.Expr().ID())
+}
+
+// NewInlineVariable declares a variable name to be replaced by a checked expression.
+func NewInlineVariable(name string, definition *Ast) *InlineVariable {
+	return NewInlineVariableWithAlias(name, name, definition)
+}
+
+// NewInlineVariableWithAlias declares a variable name to be replaced by a checked expression.
+// If the variable occurs more than once, the provided alias will be used to replace the expressions
+// where the variable name occurs.
+func NewInlineVariableWithAlias(name, alias string, definition *Ast) *InlineVariable {
+	return &InlineVariable{name: name, alias: alias, def: definition.NativeRep()}
+}
+
+// NewInliningOptimizer creates and optimizer which replaces variables with expression definitions.
+//
+// If a variable occurs one time, the variable is replaced by the inline definition. If the
+// variable occurs more than once, the variable occurences are replaced by a cel.bind() call.
+func NewInliningOptimizer(inlineVars ...*InlineVariable) ASTOptimizer {
+	return &inliningOptimizer{variables: inlineVars}
+}
+
+type inliningOptimizer struct {
+	variables []*InlineVariable
+}
+
+func (opt *inliningOptimizer) Optimize(ctx *OptimizerContext, a *ast.AST) *ast.AST {
+	root := ast.NavigateAST(a)
+	for _, inlineVar := range opt.variables {
+		matches := ast.MatchDescendants(root, opt.matchVariable(inlineVar.Name()))
+		// Skip cases where the variable isn't in the expression graph
+		if len(matches) == 0 {
+			continue
+		}
+
+		// For a single match, do a direct replacement of the expression sub-graph.
+		if len(matches) == 1 || !isBindable(matches, inlineVar.Expr(), inlineVar.Type()) {
+			for _, match := range matches {
+				// Copy the inlined AST expr and source info.
+				copyExpr := ctx.CopyASTAndMetadata(inlineVar.def)
+				opt.inlineExpr(ctx, match, copyExpr, inlineVar.Type())
+			}
+			continue
+		}
+
+		// For multiple matches, find the least common ancestor (lca) and insert the
+		// variable as a cel.bind() macro.
+		var lca ast.NavigableExpr = root
+		lcaAncestorCount := 0
+		ancestors := map[int64]int{}
+		for _, match := range matches {
+			// Update the identifier matches with the provided alias.
+			parent, found := match, true
+			for found {
+				ancestorCount, hasAncestor := ancestors[parent.ID()]
+				if !hasAncestor {
+					ancestors[parent.ID()] = 1
+					parent, found = parent.Parent()
+					continue
+				}
+				if lcaAncestorCount < ancestorCount || (lcaAncestorCount == ancestorCount && lca.Depth() < parent.Depth()) {
+					lca = parent
+					lcaAncestorCount = ancestorCount
+				}
+				ancestors[parent.ID()] = ancestorCount + 1
+				parent, found = parent.Parent()
+			}
+			aliasExpr := ctx.NewIdent(inlineVar.Alias())
+			opt.inlineExpr(ctx, match, aliasExpr, inlineVar.Type())
+		}
+
+		// Copy the inlined AST expr and source info.
+		copyExpr := ctx.CopyASTAndMetadata(inlineVar.def)
+		// Update the least common ancestor by inserting a cel.bind() call to the alias.
+		inlined, bindMacro := ctx.NewBindMacro(lca.ID(), inlineVar.Alias(), copyExpr, lca)
+		opt.inlineExpr(ctx, lca, inlined, inlineVar.Type())
+		ctx.SetMacroCall(lca.ID(), bindMacro)
+	}
+	return a
+}
+
+// inlineExpr replaces the current expression with the inlined one, unless the location of the inlining
+// happens within a presence test, e.g. has(a.b.c) -> inline alpha for a.b.c in which case an attempt is
+// made to determine whether the inlined value can be presence or existence tested.
+func (opt *inliningOptimizer) inlineExpr(ctx *OptimizerContext, prev ast.NavigableExpr, inlined ast.Expr, inlinedType *Type) {
+	switch prev.Kind() {
+	case ast.SelectKind:
+		sel := prev.AsSelect()
+		if !sel.IsTestOnly() {
+			ctx.UpdateExpr(prev, inlined)
+			return
+		}
+		opt.rewritePresenceExpr(ctx, prev, inlined, inlinedType)
+	default:
+		ctx.UpdateExpr(prev, inlined)
+	}
+}
+
+// rewritePresenceExpr converts the inlined expression, when it occurs within a has() macro, to type-safe
+// expression appropriate for the inlined type, if possible.
+//
+// If the rewrite is not possible an error is reported at the inline expression site.
+func (opt *inliningOptimizer) rewritePresenceExpr(ctx *OptimizerContext, prev, inlined ast.Expr, inlinedType *Type) {
+	// If the input inlined expression is not a select expression it won't work with the has()
+	// macro. Attempt to rewrite the presence test in terms of the typed input, otherwise error.
+	if inlined.Kind() == ast.SelectKind {
+		presenceTest, hasMacro := ctx.NewHasMacro(prev.ID(), inlined)
+		ctx.UpdateExpr(prev, presenceTest)
+		ctx.SetMacroCall(prev.ID(), hasMacro)
+		return
+	}
+
+	ctx.ClearMacroCall(prev.ID())
+	if inlinedType.IsAssignableType(NullType) {
+		ctx.UpdateExpr(prev,
+			ctx.NewCall(operators.NotEquals,
+				inlined,
+				ctx.NewLiteral(types.NullValue),
+			))
+		return
+	}
+	if inlinedType.HasTrait(traits.SizerType) {
+		ctx.UpdateExpr(prev,
+			ctx.NewCall(operators.NotEquals,
+				ctx.NewMemberCall(overloads.Size, inlined),
+				ctx.NewLiteral(types.IntZero),
+			))
+		return
+	}
+	ctx.ReportErrorAtID(prev.ID(), "unable to inline expression type %v into presence test", inlinedType)
+}
+
+// isBindable indicates whether the inlined type can be used within a cel.bind() if the expression
+// being replaced occurs within a presence test. Value types with a size() method or field selection
+// support can be bound.
+//
+// In future iterations, support may also be added for indexer types which can be rewritten as an `in`
+// expression; however, this would imply a rewrite of the inlined expression that may not be necessary
+// in most cases.
+func isBindable(matches []ast.NavigableExpr, inlined ast.Expr, inlinedType *Type) bool {
+	if inlinedType.IsAssignableType(NullType) ||
+		inlinedType.HasTrait(traits.SizerType) {
+		return true
+	}
+	for _, m := range matches {
+		if m.Kind() != ast.SelectKind {
+			continue
+		}
+		sel := m.AsSelect()
+		if sel.IsTestOnly() {
+			return false
+		}
+	}
+	return true
+}
+
+// matchVariable matches simple identifiers, select expressions, and presence test expressions
+// which match the (potentially) qualified variable name provided as input.
+//
+// Note, this function does not support inlining against select expressions which includes optional
+// field selection. This may be a future refinement.
+func (opt *inliningOptimizer) matchVariable(varName string) ast.ExprMatcher {
+	return func(e ast.NavigableExpr) bool {
+		if e.Kind() == ast.IdentKind && e.AsIdent() == varName {
+			return true
+		}
+		if e.Kind() == ast.SelectKind {
+			sel := e.AsSelect()
+			// While the `ToQualifiedName` call could take the select directly, this
+			// would skip presence tests from possible matches, which we would like
+			// to include.
+			qualName, found := containers.ToQualifiedName(sel.Operand())
+			return found && qualName+"."+sel.FieldName() == varName
+		}
+		return false
+	}
+}
diff --git a/vendor/github.com/google/cel-go/cel/io.go b/vendor/github.com/google/cel-go/cel/io.go
index 93ded3c..a327c96 100644
--- a/vendor/github.com/google/cel-go/cel/io.go
+++ b/vendor/github.com/google/cel-go/cel/io.go
@@ -22,18 +22,21 @@ import (
 	"google.golang.org/protobuf/proto"
 
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
 	"github.com/google/cel-go/parser"
 
+	celpb "cel.dev/expr"
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 	anypb "google.golang.org/protobuf/types/known/anypb"
 )
 
 // CheckedExprToAst converts a checked expression proto message to an Ast.
 func CheckedExprToAst(checkedExpr *exprpb.CheckedExpr) *Ast {
-	return CheckedExprToAstWithSource(checkedExpr, nil)
+	checked, _ := CheckedExprToAstWithSource(checkedExpr, nil)
+	return checked
 }
 
 // CheckedExprToAstWithSource converts a checked expression proto message to an Ast,
@@ -44,29 +47,12 @@ func CheckedExprToAst(checkedExpr *exprpb.CheckedExpr) *Ast {
 // through future calls.
 //
 // Prefer CheckedExprToAst if loading expressions from storage.
-func CheckedExprToAstWithSource(checkedExpr *exprpb.CheckedExpr, src Source) *Ast {
-	refMap := checkedExpr.GetReferenceMap()
-	if refMap == nil {
-		refMap = map[int64]*exprpb.Reference{}
-	}
-	typeMap := checkedExpr.GetTypeMap()
-	if typeMap == nil {
-		typeMap = map[int64]*exprpb.Type{}
-	}
-	si := checkedExpr.GetSourceInfo()
-	if si == nil {
-		si = &exprpb.SourceInfo{}
-	}
-	if src == nil {
-		src = common.NewInfoSource(si)
-	}
-	return &Ast{
-		expr:    checkedExpr.GetExpr(),
-		info:    si,
-		source:  src,
-		refMap:  refMap,
-		typeMap: typeMap,
+func CheckedExprToAstWithSource(checkedExpr *exprpb.CheckedExpr, src Source) (*Ast, error) {
+	checked, err := ast.ToAST(checkedExpr)
+	if err != nil {
+		return nil, err
 	}
+	return &Ast{source: src, impl: checked}, nil
 }
 
 // AstToCheckedExpr converts an Ast to an protobuf CheckedExpr value.
@@ -76,12 +62,7 @@ func AstToCheckedExpr(a *Ast) (*exprpb.CheckedExpr, error) {
 	if !a.IsChecked() {
 		return nil, fmt.Errorf("cannot convert unchecked ast")
 	}
-	return &exprpb.CheckedExpr{
-		Expr:         a.Expr(),
-		SourceInfo:   a.SourceInfo(),
-		ReferenceMap: a.refMap,
-		TypeMap:      a.typeMap,
-	}, nil
+	return ast.ToProto(a.NativeRep())
 }
 
 // ParsedExprToAst converts a parsed expression proto message to an Ast.
@@ -97,18 +78,12 @@ func ParsedExprToAst(parsedExpr *exprpb.ParsedExpr) *Ast {
 //
 // Prefer ParsedExprToAst if loading expressions from storage.
 func ParsedExprToAstWithSource(parsedExpr *exprpb.ParsedExpr, src Source) *Ast {
-	si := parsedExpr.GetSourceInfo()
-	if si == nil {
-		si = &exprpb.SourceInfo{}
-	}
+	info, _ := ast.ProtoToSourceInfo(parsedExpr.GetSourceInfo())
 	if src == nil {
-		src = common.NewInfoSource(si)
-	}
-	return &Ast{
-		expr:   parsedExpr.GetExpr(),
-		info:   si,
-		source: src,
+		src = common.NewInfoSource(parsedExpr.GetSourceInfo())
 	}
+	e, _ := ast.ProtoToExpr(parsedExpr.GetExpr())
+	return &Ast{source: src, impl: ast.NewAST(e, info)}
 }
 
 // AstToParsedExpr converts an Ast to an protobuf ParsedExpr value.
@@ -124,85 +99,101 @@ func AstToParsedExpr(a *Ast) (*exprpb.ParsedExpr, error) {
 // Note, the conversion may not be an exact replica of the original expression, but will produce
 // a string that is semantically equivalent and whose textual representation is stable.
 func AstToString(a *Ast) (string, error) {
-	expr := a.Expr()
-	info := a.SourceInfo()
-	return parser.Unparse(expr, info)
+	return parser.Unparse(a.NativeRep().Expr(), a.NativeRep().SourceInfo())
 }
 
-// RefValueToValue converts between ref.Val and api.expr.Value.
+// RefValueToValue converts between ref.Val and google.api.expr.v1alpha1.Value.
 // The result Value is the serialized proto form. The ref.Val must not be error or unknown.
 func RefValueToValue(res ref.Val) (*exprpb.Value, error) {
+	return ValueAsAlphaProto(res)
+}
+
+// ValueAsAlphaProto converts between ref.Val and google.api.expr.v1alpha1.Value.
+// The result Value is the serialized proto form. The ref.Val must not be error or unknown.
+func ValueAsAlphaProto(res ref.Val) (*exprpb.Value, error) {
+	canonical, err := ValueAsProto(res)
+	if err != nil {
+		return nil, err
+	}
+	alpha := &exprpb.Value{}
+	err = convertProto(canonical, alpha)
+	return alpha, err
+}
+
+// ValueAsProto converts between ref.Val and cel.expr.Value.
+// The result Value is the serialized proto form. The ref.Val must not be error or unknown.
+func ValueAsProto(res ref.Val) (*celpb.Value, error) {
 	switch res.Type() {
 	case types.BoolType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_BoolValue{BoolValue: res.Value().(bool)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_BoolValue{BoolValue: res.Value().(bool)}}, nil
 	case types.BytesType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_BytesValue{BytesValue: res.Value().([]byte)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_BytesValue{BytesValue: res.Value().([]byte)}}, nil
 	case types.DoubleType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_DoubleValue{DoubleValue: res.Value().(float64)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_DoubleValue{DoubleValue: res.Value().(float64)}}, nil
 	case types.IntType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_Int64Value{Int64Value: res.Value().(int64)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_Int64Value{Int64Value: res.Value().(int64)}}, nil
 	case types.ListType:
 		l := res.(traits.Lister)
 		sz := l.Size().(types.Int)
-		elts := make([]*exprpb.Value, 0, int64(sz))
+		elts := make([]*celpb.Value, 0, int64(sz))
 		for i := types.Int(0); i < sz; i++ {
-			v, err := RefValueToValue(l.Get(i))
+			v, err := ValueAsProto(l.Get(i))
 			if err != nil {
 				return nil, err
 			}
 			elts = append(elts, v)
 		}
-		return &exprpb.Value{
-			Kind: &exprpb.Value_ListValue{
-				ListValue: &exprpb.ListValue{Values: elts}}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_ListValue{
+				ListValue: &celpb.ListValue{Values: elts}}}, nil
 	case types.MapType:
 		mapper := res.(traits.Mapper)
 		sz := mapper.Size().(types.Int)
-		entries := make([]*exprpb.MapValue_Entry, 0, int64(sz))
+		entries := make([]*celpb.MapValue_Entry, 0, int64(sz))
 		for it := mapper.Iterator(); it.HasNext().(types.Bool); {
 			k := it.Next()
 			v := mapper.Get(k)
-			kv, err := RefValueToValue(k)
+			kv, err := ValueAsProto(k)
 			if err != nil {
 				return nil, err
 			}
-			vv, err := RefValueToValue(v)
+			vv, err := ValueAsProto(v)
 			if err != nil {
 				return nil, err
 			}
-			entries = append(entries, &exprpb.MapValue_Entry{Key: kv, Value: vv})
+			entries = append(entries, &celpb.MapValue_Entry{Key: kv, Value: vv})
 		}
-		return &exprpb.Value{
-			Kind: &exprpb.Value_MapValue{
-				MapValue: &exprpb.MapValue{Entries: entries}}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_MapValue{
+				MapValue: &celpb.MapValue{Entries: entries}}}, nil
 	case types.NullType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_NullValue{}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_NullValue{}}, nil
 	case types.StringType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_StringValue{StringValue: res.Value().(string)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_StringValue{StringValue: res.Value().(string)}}, nil
 	case types.TypeType:
 		typeName := res.(ref.Type).TypeName()
-		return &exprpb.Value{Kind: &exprpb.Value_TypeValue{TypeValue: typeName}}, nil
+		return &celpb.Value{Kind: &celpb.Value_TypeValue{TypeValue: typeName}}, nil
 	case types.UintType:
-		return &exprpb.Value{
-			Kind: &exprpb.Value_Uint64Value{Uint64Value: res.Value().(uint64)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_Uint64Value{Uint64Value: res.Value().(uint64)}}, nil
 	default:
 		any, err := res.ConvertToNative(anyPbType)
 		if err != nil {
 			return nil, err
 		}
-		return &exprpb.Value{
-			Kind: &exprpb.Value_ObjectValue{ObjectValue: any.(*anypb.Any)}}, nil
+		return &celpb.Value{
+			Kind: &celpb.Value_ObjectValue{ObjectValue: any.(*anypb.Any)}}, nil
 	}
 }
 
 var (
-	typeNameToTypeValue = map[string]*types.TypeValue{
+	typeNameToTypeValue = map[string]ref.Val{
 		"bool":      types.BoolType,
 		"bytes":     types.BytesType,
 		"double":    types.DoubleType,
@@ -218,57 +209,71 @@ var (
 	anyPbType = reflect.TypeOf(&anypb.Any{})
 )
 
-// ValueToRefValue converts between exprpb.Value and ref.Val.
-func ValueToRefValue(adapter ref.TypeAdapter, v *exprpb.Value) (ref.Val, error) {
+// ValueToRefValue converts between google.api.expr.v1alpha1.Value and ref.Val.
+func ValueToRefValue(adapter types.Adapter, v *exprpb.Value) (ref.Val, error) {
+	return AlphaProtoAsValue(adapter, v)
+}
+
+// AlphaProtoAsValue converts between google.api.expr.v1alpha1.Value and ref.Val.
+func AlphaProtoAsValue(adapter types.Adapter, v *exprpb.Value) (ref.Val, error) {
+	canonical := &celpb.Value{}
+	if err := convertProto(v, canonical); err != nil {
+		return nil, err
+	}
+	return ProtoAsValue(adapter, canonical)
+}
+
+// ProtoAsValue converts between cel.expr.Value and ref.Val.
+func ProtoAsValue(adapter types.Adapter, v *celpb.Value) (ref.Val, error) {
 	switch v.Kind.(type) {
-	case *exprpb.Value_NullValue:
+	case *celpb.Value_NullValue:
 		return types.NullValue, nil
-	case *exprpb.Value_BoolValue:
+	case *celpb.Value_BoolValue:
 		return types.Bool(v.GetBoolValue()), nil
-	case *exprpb.Value_Int64Value:
+	case *celpb.Value_Int64Value:
 		return types.Int(v.GetInt64Value()), nil
-	case *exprpb.Value_Uint64Value:
+	case *celpb.Value_Uint64Value:
 		return types.Uint(v.GetUint64Value()), nil
-	case *exprpb.Value_DoubleValue:
+	case *celpb.Value_DoubleValue:
 		return types.Double(v.GetDoubleValue()), nil
-	case *exprpb.Value_StringValue:
+	case *celpb.Value_StringValue:
 		return types.String(v.GetStringValue()), nil
-	case *exprpb.Value_BytesValue:
+	case *celpb.Value_BytesValue:
 		return types.Bytes(v.GetBytesValue()), nil
-	case *exprpb.Value_ObjectValue:
+	case *celpb.Value_ObjectValue:
 		any := v.GetObjectValue()
 		msg, err := anypb.UnmarshalNew(any, proto.UnmarshalOptions{DiscardUnknown: true})
 		if err != nil {
 			return nil, err
 		}
 		return adapter.NativeToValue(msg), nil
-	case *exprpb.Value_MapValue:
+	case *celpb.Value_MapValue:
 		m := v.GetMapValue()
 		entries := make(map[ref.Val]ref.Val)
 		for _, entry := range m.Entries {
-			key, err := ValueToRefValue(adapter, entry.Key)
+			key, err := ProtoAsValue(adapter, entry.Key)
 			if err != nil {
 				return nil, err
 			}
-			pb, err := ValueToRefValue(adapter, entry.Value)
+			pb, err := ProtoAsValue(adapter, entry.Value)
 			if err != nil {
 				return nil, err
 			}
 			entries[key] = pb
 		}
 		return adapter.NativeToValue(entries), nil
-	case *exprpb.Value_ListValue:
+	case *celpb.Value_ListValue:
 		l := v.GetListValue()
 		elts := make([]ref.Val, len(l.Values))
 		for i, e := range l.Values {
-			rv, err := ValueToRefValue(adapter, e)
+			rv, err := ProtoAsValue(adapter, e)
 			if err != nil {
 				return nil, err
 			}
 			elts[i] = rv
 		}
 		return adapter.NativeToValue(elts), nil
-	case *exprpb.Value_TypeValue:
+	case *celpb.Value_TypeValue:
 		typeName := v.GetTypeValue()
 		tv, ok := typeNameToTypeValue[typeName]
 		if ok {
@@ -278,3 +283,12 @@ func ValueToRefValue(adapter ref.TypeAdapter, v *exprpb.Value) (ref.Val, error)
 	}
 	return nil, errors.New("unknown value")
 }
+
+func convertProto(src, dst proto.Message) error {
+	pb, err := proto.Marshal(src)
+	if err != nil {
+		return err
+	}
+	err = proto.Unmarshal(pb, dst)
+	return err
+}
diff --git a/vendor/github.com/google/cel-go/cel/library.go b/vendor/github.com/google/cel-go/cel/library.go
index 072cec3..be59f1b 100644
--- a/vendor/github.com/google/cel-go/cel/library.go
+++ b/vendor/github.com/google/cel-go/cel/library.go
@@ -15,21 +15,33 @@
 package cel
 
 import (
+	"math"
 	"strconv"
 	"strings"
 	"time"
 
-	"github.com/google/cel-go/checker"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/stdlib"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
 	"github.com/google/cel-go/interpreter"
-	"github.com/google/cel-go/interpreter/functions"
 	"github.com/google/cel-go/parser"
 )
 
+const (
+	optMapMacro                = "optMap"
+	optFlatMapMacro            = "optFlatMap"
+	hasValueFunc               = "hasValue"
+	optionalNoneFunc           = "optional.none"
+	optionalOfFunc             = "optional.of"
+	optionalOfNonZeroValueFunc = "optional.ofNonZeroValue"
+	valueFunc                  = "value"
+	unusedIterVar              = "#unused"
+)
+
 // Library provides a collection of EnvOption and ProgramOption values used to configure a CEL
 // environment for a particular use case or with a related set of functionality.
 //
@@ -93,50 +105,222 @@ func (stdLibrary) LibraryName() string {
 	return "cel.lib.std"
 }
 
-// EnvOptions returns options for the standard CEL function declarations and macros.
+// CompileOptions returns options for the standard CEL function declarations and macros.
 func (stdLibrary) CompileOptions() []EnvOption {
 	return []EnvOption{
-		Declarations(checker.StandardDeclarations()...),
+		func(e *Env) (*Env, error) {
+			var err error
+			for _, fn := range stdlib.Functions() {
+				existing, found := e.functions[fn.Name()]
+				if found {
+					fn, err = existing.Merge(fn)
+					if err != nil {
+						return nil, err
+					}
+				}
+				e.functions[fn.Name()] = fn
+			}
+			return e, nil
+		},
+		func(e *Env) (*Env, error) {
+			e.variables = append(e.variables, stdlib.Types()...)
+			return e, nil
+		},
 		Macros(StandardMacros...),
 	}
 }
 
 // ProgramOptions returns function implementations for the standard CEL functions.
 func (stdLibrary) ProgramOptions() []ProgramOption {
-	return []ProgramOption{
-		Functions(functions.StandardOverloads()...),
+	return []ProgramOption{}
+}
+
+// OptionalTypes enable support for optional syntax and types in CEL.
+//
+// The optional value type makes it possible to express whether variables have
+// been provided, whether a result has been computed, and in the future whether
+// an object field path, map key value, or list index has a value.
+//
+// # Syntax Changes
+//
+// OptionalTypes are unlike other CEL extensions because they modify the CEL
+// syntax itself, notably through the use of a `?` preceding a field name or
+// index value.
+//
+// ## Field Selection
+//
+// The optional syntax in field selection is denoted as `obj.?field`. In other
+// words, if a field is set, return `optional.of(obj.field)“, else
+// `optional.none()`. The optional field selection is viral in the sense that
+// after the first optional selection all subsequent selections or indices
+// are treated as optional, i.e. the following expressions are equivalent:
+//
+//	obj.?field.subfield
+//	obj.?field.?subfield
+//
+// ## Indexing
+//
+// Similar to field selection, the optional syntax can be used in index
+// expressions on maps and lists:
+//
+//	list[?0]
+//	map[?key]
+//
+// ## Optional Field Setting
+//
+// When creating map or message literals, if a field may be optionally set
+// based on its presence, then placing a `?` before the field name or key
+// will ensure the type on the right-hand side must be optional(T) where T
+// is the type of the field or key-value.
+//
+// The following returns a map with the key expression set only if the
+// subfield is present, otherwise an empty map is created:
+//
+//	{?key: obj.?field.subfield}
+//
+// ## Optional Element Setting
+//
+// When creating list literals, an element in the list may be optionally added
+// when the element expression is preceded by a `?`:
+//
+//	[a, ?b, ?c] // return a list with either [a], [a, b], [a, b, c], or [a, c]
+//
+// # Optional.Of
+//
+// Create an optional(T) value of a given value with type T.
+//
+//	optional.of(10)
+//
+// # Optional.OfNonZeroValue
+//
+// Create an optional(T) value of a given value with type T if it is not a
+// zero-value. A zero-value the default empty value for any given CEL type,
+// including empty protobuf message types. If the value is empty, the result
+// of this call will be optional.none().
+//
+//	optional.ofNonZeroValue([1, 2, 3]) // optional(list(int))
+//	optional.ofNonZeroValue([]) // optional.none()
+//	optional.ofNonZeroValue(0)  // optional.none()
+//	optional.ofNonZeroValue("") // optional.none()
+//
+// # Optional.None
+//
+// Create an empty optional value.
+//
+// # HasValue
+//
+// Determine whether the optional contains a value.
+//
+//	optional.of(b'hello').hasValue() // true
+//	optional.ofNonZeroValue({}).hasValue() // false
+//
+// # Value
+//
+// Get the value contained by the optional. If the optional does not have a
+// value, the result will be a CEL error.
+//
+//	optional.of(b'hello').value() // b'hello'
+//	optional.ofNonZeroValue({}).value() // error
+//
+// # Or
+//
+// If the value on the left-hand side is optional.none(), the optional value
+// on the right hand side is returned. If the value on the left-hand set is
+// valued, then it is returned. This operation is short-circuiting and will
+// only evaluate as many links in the `or` chain as are needed to return a
+// non-empty optional value.
+//
+//	obj.?field.or(m[?key])
+//	l[?index].or(obj.?field.subfield).or(obj.?other)
+//
+// # OrValue
+//
+// Either return the value contained within the optional on the left-hand side
+// or return the alternative value on the right hand side.
+//
+//	m[?key].orValue("none")
+//
+// # OptMap
+//
+// Apply a transformation to the optional's underlying value if it is not empty
+// and return an optional typed result based on the transformation. The
+// transformation expression type must return a type T which is wrapped into
+// an optional.
+//
+//	msg.?elements.optMap(e, e.size()).orValue(0)
+//
+// # OptFlatMap
+//
+// Introduced in version: 1
+//
+// Apply a transformation to the optional's underlying value if it is not empty
+// and return the result. The transform expression must return an optional(T)
+// rather than type T. This can be useful when dealing with zero values and
+// conditionally generating an empty or non-empty result in ways which cannot
+// be expressed with `optMap`.
+//
+//	msg.?elements.optFlatMap(e, e[?0]) // return the first element if present.
+func OptionalTypes(opts ...OptionalTypesOption) EnvOption {
+	lib := &optionalLib{version: math.MaxUint32}
+	for _, opt := range opts {
+		lib = opt(lib)
 	}
+	return Lib(lib)
 }
 
-type optionalLibrary struct{}
+type optionalLib struct {
+	version uint32
+}
+
+// OptionalTypesOption is a functional interface for configuring the strings library.
+type OptionalTypesOption func(*optionalLib) *optionalLib
+
+// OptionalTypesVersion configures the version of the optional type library.
+//
+// The version limits which functions are available. Only functions introduced
+// below or equal to the given version included in the library. If this option
+// is not set, all functions are available.
+//
+// See the library documentation to determine which version a function was introduced.
+// If the documentation does not state which version a function was introduced, it can
+// be assumed to be introduced at version 0, when the library was first created.
+func OptionalTypesVersion(version uint32) OptionalTypesOption {
+	return func(lib *optionalLib) *optionalLib {
+		lib.version = version
+		return lib
+	}
+}
 
 // LibraryName implements the SingletonLibrary interface method.
-func (optionalLibrary) LibraryName() string {
+func (lib *optionalLib) LibraryName() string {
 	return "cel.lib.optional"
 }
 
 // CompileOptions implements the Library interface method.
-func (optionalLibrary) CompileOptions() []EnvOption {
+func (lib *optionalLib) CompileOptions() []EnvOption {
 	paramTypeK := TypeParamType("K")
 	paramTypeV := TypeParamType("V")
 	optionalTypeV := OptionalType(paramTypeV)
 	listTypeV := ListType(paramTypeV)
 	mapTypeKV := MapType(paramTypeK, paramTypeV)
 
-	return []EnvOption{
+	opts := []EnvOption{
 		// Enable the optional syntax in the parser.
 		enableOptionalSyntax(),
 
 		// Introduce the optional type.
 		Types(types.OptionalType),
 
+		// Configure the optMap and optFlatMap macros.
+		Macros(ReceiverMacro(optMapMacro, 2, optMap)),
+
 		// Global and member functions for working with optional values.
-		Function("optional.of",
+		Function(optionalOfFunc,
 			Overload("optional_of", []*Type{paramTypeV}, optionalTypeV,
 				UnaryBinding(func(value ref.Val) ref.Val {
 					return types.OptionalOf(value)
 				}))),
-		Function("optional.ofNonZeroValue",
+		Function(optionalOfNonZeroValueFunc,
 			Overload("optional_ofNonZeroValue", []*Type{paramTypeV}, optionalTypeV,
 				UnaryBinding(func(value ref.Val) ref.Val {
 					v, isZeroer := value.(traits.Zeroer)
@@ -145,18 +329,18 @@ func (optionalLibrary) CompileOptions() []EnvOption {
 					}
 					return types.OptionalNone
 				}))),
-		Function("optional.none",
+		Function(optionalNoneFunc,
 			Overload("optional_none", []*Type{}, optionalTypeV,
 				FunctionBinding(func(values ...ref.Val) ref.Val {
 					return types.OptionalNone
 				}))),
-		Function("value",
+		Function(valueFunc,
 			MemberOverload("optional_value", []*Type{optionalTypeV}, paramTypeV,
 				UnaryBinding(func(value ref.Val) ref.Val {
 					opt := value.(*types.Optional)
 					return opt.GetValue()
 				}))),
-		Function("hasValue",
+		Function(hasValueFunc,
 			MemberOverload("optional_hasValue", []*Type{optionalTypeV}, BoolType,
 				UnaryBinding(func(value ref.Val) ref.Val {
 					opt := value.(*types.Optional)
@@ -186,17 +370,75 @@ func (optionalLibrary) CompileOptions() []EnvOption {
 		// Index overloads to accommodate using an optional value as the operand.
 		Function(operators.Index,
 			Overload("optional_list_index_int", []*Type{OptionalType(listTypeV), IntType}, optionalTypeV),
-			Overload("optional_map_index_optional_value", []*Type{OptionalType(mapTypeKV), paramTypeK}, optionalTypeV)),
+			Overload("optional_map_index_value", []*Type{OptionalType(mapTypeKV), paramTypeK}, optionalTypeV)),
+	}
+	if lib.version >= 1 {
+		opts = append(opts, Macros(ReceiverMacro(optFlatMapMacro, 2, optFlatMap)))
 	}
+	return opts
 }
 
 // ProgramOptions implements the Library interface method.
-func (optionalLibrary) ProgramOptions() []ProgramOption {
+func (lib *optionalLib) ProgramOptions() []ProgramOption {
 	return []ProgramOption{
 		CustomDecorator(decorateOptionalOr),
 	}
 }
 
+func optMap(meh MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *Error) {
+	varIdent := args[0]
+	varName := ""
+	switch varIdent.Kind() {
+	case ast.IdentKind:
+		varName = varIdent.AsIdent()
+	default:
+		return nil, meh.NewError(varIdent.ID(), "optMap() variable name must be a simple identifier")
+	}
+	mapExpr := args[1]
+	return meh.NewCall(
+		operators.Conditional,
+		meh.NewMemberCall(hasValueFunc, target),
+		meh.NewCall(optionalOfFunc,
+			meh.NewComprehension(
+				meh.NewList(),
+				unusedIterVar,
+				varName,
+				meh.NewMemberCall(valueFunc, meh.Copy(target)),
+				meh.NewLiteral(types.False),
+				meh.NewIdent(varName),
+				mapExpr,
+			),
+		),
+		meh.NewCall(optionalNoneFunc),
+	), nil
+}
+
+func optFlatMap(meh MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *Error) {
+	varIdent := args[0]
+	varName := ""
+	switch varIdent.Kind() {
+	case ast.IdentKind:
+		varName = varIdent.AsIdent()
+	default:
+		return nil, meh.NewError(varIdent.ID(), "optFlatMap() variable name must be a simple identifier")
+	}
+	mapExpr := args[1]
+	return meh.NewCall(
+		operators.Conditional,
+		meh.NewMemberCall(hasValueFunc, target),
+		meh.NewComprehension(
+			meh.NewList(),
+			unusedIterVar,
+			varName,
+			meh.NewMemberCall(valueFunc, meh.Copy(target)),
+			meh.NewLiteral(types.False),
+			meh.NewIdent(varName),
+			mapExpr,
+		),
+		meh.NewCall(optionalNoneFunc),
+	), nil
+}
+
 func enableOptionalSyntax() EnvOption {
 	return func(e *Env) (*Env, error) {
 		e.prsrOpts = append(e.prsrOpts, parser.EnableOptionalSyntax(true))
@@ -204,6 +446,12 @@ func enableOptionalSyntax() EnvOption {
 	}
 }
 
+// EnableErrorOnBadPresenceTest enables error generation when a presence test or optional field
+// selection is performed on a primitive type.
+func EnableErrorOnBadPresenceTest(value bool) EnvOption {
+	return features(featureEnableErrorOnBadPresenceTest, value)
+}
+
 func decorateOptionalOr(i interpreter.Interpretable) (interpreter.Interpretable, error) {
 	call, ok := i.(interpreter.InterpretableCall)
 	if !ok {
@@ -311,28 +559,16 @@ var (
 	timeOverloadDeclarations = []EnvOption{
 		Function(overloads.TimeGetHours,
 			MemberOverload(overloads.DurationToHours, []*Type{DurationType}, IntType,
-				UnaryBinding(func(dur ref.Val) ref.Val {
-					d := dur.(types.Duration)
-					return types.Int(d.Hours())
-				}))),
+				UnaryBinding(types.DurationGetHours))),
 		Function(overloads.TimeGetMinutes,
 			MemberOverload(overloads.DurationToMinutes, []*Type{DurationType}, IntType,
-				UnaryBinding(func(dur ref.Val) ref.Val {
-					d := dur.(types.Duration)
-					return types.Int(d.Minutes())
-				}))),
+				UnaryBinding(types.DurationGetMinutes))),
 		Function(overloads.TimeGetSeconds,
 			MemberOverload(overloads.DurationToSeconds, []*Type{DurationType}, IntType,
-				UnaryBinding(func(dur ref.Val) ref.Val {
-					d := dur.(types.Duration)
-					return types.Int(d.Seconds())
-				}))),
+				UnaryBinding(types.DurationGetSeconds))),
 		Function(overloads.TimeGetMilliseconds,
 			MemberOverload(overloads.DurationToMilliseconds, []*Type{DurationType}, IntType,
-				UnaryBinding(func(dur ref.Val) ref.Val {
-					d := dur.(types.Duration)
-					return types.Int(d.Milliseconds())
-				}))),
+				UnaryBinding(types.DurationGetMilliseconds))),
 		Function(overloads.TimeGetFullYear,
 			MemberOverload(overloads.TimestampToYear, []*Type{TimestampType}, IntType,
 				UnaryBinding(func(ts ref.Val) ref.Val {
diff --git a/vendor/github.com/google/cel-go/cel/macro.go b/vendor/github.com/google/cel-go/cel/macro.go
index e48c5bf..4db1fd5 100644
--- a/vendor/github.com/google/cel-go/cel/macro.go
+++ b/vendor/github.com/google/cel-go/cel/macro.go
@@ -15,7 +15,11 @@
 package cel
 
 import (
+	"fmt"
+
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/parser"
 
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
@@ -27,7 +31,14 @@ import (
 // a Macro should be created per arg-count or as a var arg macro.
 type Macro = parser.Macro
 
-// MacroExpander converts a call and its associated arguments into a new CEL abstract syntax tree.
+// MacroFactory defines an expansion function which converts a call and its arguments to a cel.Expr value.
+type MacroFactory = parser.MacroExpander
+
+// MacroExprFactory assists with the creation of Expr values in a manner which is consistent
+// the internal semantics and id generation behaviors of the parser and checker libraries.
+type MacroExprFactory = parser.ExprHelper
+
+// MacroExpander converts a call and its associated arguments into a protobuf Expr representation.
 //
 // If the MacroExpander determines within the implementation that an expansion is not needed it may return
 // a nil Expr value to indicate a non-match. However, if an expansion is to be performed, but the arguments
@@ -37,48 +48,197 @@ type Macro = parser.Macro
 // and produces as output an Expr ast node.
 //
 // Note: when the Macro.IsReceiverStyle() method returns true, the target argument will be nil.
-type MacroExpander = parser.MacroExpander
+type MacroExpander func(eh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error)
 
 // MacroExprHelper exposes helper methods for creating new expressions within a CEL abstract syntax tree.
-type MacroExprHelper = parser.ExprHelper
+// ExprHelper assists with the manipulation of proto-based Expr values in a manner which is
+// consistent with the source position and expression id generation code leveraged by both
+// the parser and type-checker.
+type MacroExprHelper interface {
+	// Copy the input expression with a brand new set of identifiers.
+	Copy(*exprpb.Expr) *exprpb.Expr
+
+	// LiteralBool creates an Expr value for a bool literal.
+	LiteralBool(value bool) *exprpb.Expr
+
+	// LiteralBytes creates an Expr value for a byte literal.
+	LiteralBytes(value []byte) *exprpb.Expr
+
+	// LiteralDouble creates an Expr value for double literal.
+	LiteralDouble(value float64) *exprpb.Expr
+
+	// LiteralInt creates an Expr value for an int literal.
+	LiteralInt(value int64) *exprpb.Expr
+
+	// LiteralString creates am Expr value for a string literal.
+	LiteralString(value string) *exprpb.Expr
+
+	// LiteralUint creates an Expr value for a uint literal.
+	LiteralUint(value uint64) *exprpb.Expr
+
+	// NewList creates a CreateList instruction where the list is comprised of the optional set
+	// of elements provided as arguments.
+	NewList(elems ...*exprpb.Expr) *exprpb.Expr
+
+	// NewMap creates a CreateStruct instruction for a map where the map is comprised of the
+	// optional set of key, value entries.
+	NewMap(entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr
+
+	// NewMapEntry creates a Map Entry for the key, value pair.
+	NewMapEntry(key *exprpb.Expr, val *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry
+
+	// NewObject creates a CreateStruct instruction for an object with a given type name and
+	// optional set of field initializers.
+	NewObject(typeName string, fieldInits ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr
+
+	// NewObjectFieldInit creates a new Object field initializer from the field name and value.
+	NewObjectFieldInit(field string, init *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry
+
+	// Fold creates a fold comprehension instruction.
+	//
+	// - iterVar is the iteration variable name.
+	// - iterRange represents the expression that resolves to a list or map where the elements or
+	//   keys (respectively) will be iterated over.
+	// - accuVar is the accumulation variable name, typically parser.AccumulatorName.
+	// - accuInit is the initial expression whose value will be set for the accuVar prior to
+	//   folding.
+	// - condition is the expression to test to determine whether to continue folding.
+	// - step is the expression to evaluation at the conclusion of a single fold iteration.
+	// - result is the computation to evaluate at the conclusion of the fold.
+	//
+	// The accuVar should not shadow variable names that you would like to reference within the
+	// environment in the step and condition expressions. Presently, the name __result__ is commonly
+	// used by built-in macros but this may change in the future.
+	Fold(iterVar string,
+		iterRange *exprpb.Expr,
+		accuVar string,
+		accuInit *exprpb.Expr,
+		condition *exprpb.Expr,
+		step *exprpb.Expr,
+		result *exprpb.Expr) *exprpb.Expr
+
+	// Ident creates an identifier Expr value.
+	Ident(name string) *exprpb.Expr
+
+	// AccuIdent returns an accumulator identifier for use with comprehension results.
+	AccuIdent() *exprpb.Expr
+
+	// GlobalCall creates a function call Expr value for a global (free) function.
+	GlobalCall(function string, args ...*exprpb.Expr) *exprpb.Expr
+
+	// ReceiverCall creates a function call Expr value for a receiver-style function.
+	ReceiverCall(function string, target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr
+
+	// PresenceTest creates a Select TestOnly Expr value for modelling has() semantics.
+	PresenceTest(operand *exprpb.Expr, field string) *exprpb.Expr
+
+	// Select create a field traversal Expr value.
+	Select(operand *exprpb.Expr, field string) *exprpb.Expr
+
+	// OffsetLocation returns the Location of the expression identifier.
+	OffsetLocation(exprID int64) common.Location
+
+	// NewError associates an error message with a given expression id.
+	NewError(exprID int64, message string) *Error
+}
+
+// GlobalMacro creates a Macro for a global function with the specified arg count.
+func GlobalMacro(function string, argCount int, factory MacroFactory) Macro {
+	return parser.NewGlobalMacro(function, argCount, factory)
+}
+
+// ReceiverMacro creates a Macro for a receiver function matching the specified arg count.
+func ReceiverMacro(function string, argCount int, factory MacroFactory) Macro {
+	return parser.NewReceiverMacro(function, argCount, factory)
+}
+
+// GlobalVarArgMacro creates a Macro for a global function with a variable arg count.
+func GlobalVarArgMacro(function string, factory MacroFactory) Macro {
+	return parser.NewGlobalVarArgMacro(function, factory)
+}
+
+// ReceiverVarArgMacro creates a Macro for a receiver function matching a variable arg count.
+func ReceiverVarArgMacro(function string, factory MacroFactory) Macro {
+	return parser.NewReceiverVarArgMacro(function, factory)
+}
 
 // NewGlobalMacro creates a Macro for a global function with the specified arg count.
+//
+// Deprecated: use GlobalMacro
 func NewGlobalMacro(function string, argCount int, expander MacroExpander) Macro {
-	return parser.NewGlobalMacro(function, argCount, expander)
+	expand := adaptingExpander{expander}
+	return parser.NewGlobalMacro(function, argCount, expand.Expander)
 }
 
 // NewReceiverMacro creates a Macro for a receiver function matching the specified arg count.
+//
+// Deprecated: use ReceiverMacro
 func NewReceiverMacro(function string, argCount int, expander MacroExpander) Macro {
-	return parser.NewReceiverMacro(function, argCount, expander)
+	expand := adaptingExpander{expander}
+	return parser.NewReceiverMacro(function, argCount, expand.Expander)
 }
 
 // NewGlobalVarArgMacro creates a Macro for a global function with a variable arg count.
+//
+// Deprecated: use GlobalVarArgMacro
 func NewGlobalVarArgMacro(function string, expander MacroExpander) Macro {
-	return parser.NewGlobalVarArgMacro(function, expander)
+	expand := adaptingExpander{expander}
+	return parser.NewGlobalVarArgMacro(function, expand.Expander)
 }
 
 // NewReceiverVarArgMacro creates a Macro for a receiver function matching a variable arg count.
+//
+// Deprecated: use ReceiverVarArgMacro
 func NewReceiverVarArgMacro(function string, expander MacroExpander) Macro {
-	return parser.NewReceiverVarArgMacro(function, expander)
+	expand := adaptingExpander{expander}
+	return parser.NewReceiverVarArgMacro(function, expand.Expander)
 }
 
 // HasMacroExpander expands the input call arguments into a presence test, e.g. has(<operand>.field)
-func HasMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	return parser.MakeHas(meh, target, args)
+func HasMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error) {
+	ph, err := toParserHelper(meh)
+	if err != nil {
+		return nil, err
+	}
+	arg, err := adaptToExpr(args[0])
+	if err != nil {
+		return nil, err
+	}
+	if arg.Kind() == ast.SelectKind {
+		s := arg.AsSelect()
+		return adaptToProto(ph.NewPresenceTest(s.Operand(), s.FieldName()))
+	}
+	return nil, ph.NewError(arg.ID(), "invalid argument to has() macro")
 }
 
 // ExistsMacroExpander expands the input call arguments into a comprehension that returns true if any of the
 // elements in the range match the predicate expressions:
 // <iterRange>.exists(<iterVar>, <predicate>)
-func ExistsMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	return parser.MakeExists(meh, target, args)
+func ExistsMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error) {
+	ph, err := toParserHelper(meh)
+	if err != nil {
+		return nil, err
+	}
+	out, err := parser.MakeExists(ph, mustAdaptToExpr(target), mustAdaptToExprs(args))
+	if err != nil {
+		return nil, err
+	}
+	return adaptToProto(out)
 }
 
 // ExistsOneMacroExpander expands the input call arguments into a comprehension that returns true if exactly
 // one of the elements in the range match the predicate expressions:
 // <iterRange>.exists_one(<iterVar>, <predicate>)
-func ExistsOneMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	return parser.MakeExistsOne(meh, target, args)
+func ExistsOneMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error) {
+	ph, err := toParserHelper(meh)
+	if err != nil {
+		return nil, err
+	}
+	out, err := parser.MakeExistsOne(ph, mustAdaptToExpr(target), mustAdaptToExprs(args))
+	if err != nil {
+		return nil, err
+	}
+	return adaptToProto(out)
 }
 
 // MapMacroExpander expands the input call arguments into a comprehension that transforms each element in the
@@ -91,15 +251,31 @@ func ExistsOneMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*ex
 //
 // In the second form only iterVar values which return true when provided to the predicate expression
 // are transformed.
-func MapMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	return parser.MakeMap(meh, target, args)
+func MapMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error) {
+	ph, err := toParserHelper(meh)
+	if err != nil {
+		return nil, err
+	}
+	out, err := parser.MakeMap(ph, mustAdaptToExpr(target), mustAdaptToExprs(args))
+	if err != nil {
+		return nil, err
+	}
+	return adaptToProto(out)
 }
 
 // FilterMacroExpander expands the input call arguments into a comprehension which produces a list which contains
 // only elements which match the provided predicate expression:
 // <iterRange>.filter(<iterVar>, <predicate>)
-func FilterMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	return parser.MakeFilter(meh, target, args)
+func FilterMacroExpander(meh MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *Error) {
+	ph, err := toParserHelper(meh)
+	if err != nil {
+		return nil, err
+	}
+	out, err := parser.MakeFilter(ph, mustAdaptToExpr(target), mustAdaptToExprs(args))
+	if err != nil {
+		return nil, err
+	}
+	return adaptToProto(out)
 }
 
 var (
@@ -143,3 +319,258 @@ var (
 	// NoMacros provides an alias to an empty list of macros
 	NoMacros = []Macro{}
 )
+
+type adaptingExpander struct {
+	legacyExpander MacroExpander
+}
+
+func (adapt *adaptingExpander) Expander(eh parser.ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
+	var legacyTarget *exprpb.Expr = nil
+	var err *Error = nil
+	if target != nil {
+		legacyTarget, err = adaptToProto(target)
+		if err != nil {
+			return nil, err
+		}
+	}
+	legacyArgs := make([]*exprpb.Expr, len(args))
+	for i, arg := range args {
+		legacyArgs[i], err = adaptToProto(arg)
+		if err != nil {
+			return nil, err
+		}
+	}
+	ah := &adaptingHelper{modernHelper: eh}
+	legacyExpr, err := adapt.legacyExpander(ah, legacyTarget, legacyArgs)
+	if err != nil {
+		return nil, err
+	}
+	ex, err := adaptToExpr(legacyExpr)
+	if err != nil {
+		return nil, err
+	}
+	return ex, nil
+}
+
+func wrapErr(id int64, message string, err error) *common.Error {
+	return &common.Error{
+		Location: common.NoLocation,
+		Message:  fmt.Sprintf("%s: %v", message, err),
+		ExprID:   id,
+	}
+}
+
+type adaptingHelper struct {
+	modernHelper parser.ExprHelper
+}
+
+// Copy the input expression with a brand new set of identifiers.
+func (ah *adaptingHelper) Copy(e *exprpb.Expr) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.Copy(mustAdaptToExpr(e)))
+}
+
+// LiteralBool creates an Expr value for a bool literal.
+func (ah *adaptingHelper) LiteralBool(value bool) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.Bool(value)))
+}
+
+// LiteralBytes creates an Expr value for a byte literal.
+func (ah *adaptingHelper) LiteralBytes(value []byte) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.Bytes(value)))
+}
+
+// LiteralDouble creates an Expr value for double literal.
+func (ah *adaptingHelper) LiteralDouble(value float64) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.Double(value)))
+}
+
+// LiteralInt creates an Expr value for an int literal.
+func (ah *adaptingHelper) LiteralInt(value int64) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.Int(value)))
+}
+
+// LiteralString creates am Expr value for a string literal.
+func (ah *adaptingHelper) LiteralString(value string) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.String(value)))
+}
+
+// LiteralUint creates an Expr value for a uint literal.
+func (ah *adaptingHelper) LiteralUint(value uint64) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewLiteral(types.Uint(value)))
+}
+
+// NewList creates a CreateList instruction where the list is comprised of the optional set
+// of elements provided as arguments.
+func (ah *adaptingHelper) NewList(elems ...*exprpb.Expr) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewList(mustAdaptToExprs(elems)...))
+}
+
+// NewMap creates a CreateStruct instruction for a map where the map is comprised of the
+// optional set of key, value entries.
+func (ah *adaptingHelper) NewMap(entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
+	adaptedEntries := make([]ast.EntryExpr, len(entries))
+	for i, e := range entries {
+		adaptedEntries[i] = mustAdaptToEntryExpr(e)
+	}
+	return mustAdaptToProto(ah.modernHelper.NewMap(adaptedEntries...))
+}
+
+// NewMapEntry creates a Map Entry for the key, value pair.
+func (ah *adaptingHelper) NewMapEntry(key *exprpb.Expr, val *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
+	return mustAdaptToProtoEntry(
+		ah.modernHelper.NewMapEntry(mustAdaptToExpr(key), mustAdaptToExpr(val), optional))
+}
+
+// NewObject creates a CreateStruct instruction for an object with a given type name and
+// optional set of field initializers.
+func (ah *adaptingHelper) NewObject(typeName string, fieldInits ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
+	adaptedEntries := make([]ast.EntryExpr, len(fieldInits))
+	for i, e := range fieldInits {
+		adaptedEntries[i] = mustAdaptToEntryExpr(e)
+	}
+	return mustAdaptToProto(ah.modernHelper.NewStruct(typeName, adaptedEntries...))
+}
+
+// NewObjectFieldInit creates a new Object field initializer from the field name and value.
+func (ah *adaptingHelper) NewObjectFieldInit(field string, init *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
+	return mustAdaptToProtoEntry(
+		ah.modernHelper.NewStructField(field, mustAdaptToExpr(init), optional))
+}
+
+// Fold creates a fold comprehension instruction.
+//
+//   - iterVar is the iteration variable name.
+//   - iterRange represents the expression that resolves to a list or map where the elements or
+//     keys (respectively) will be iterated over.
+//   - accuVar is the accumulation variable name, typically parser.AccumulatorName.
+//   - accuInit is the initial expression whose value will be set for the accuVar prior to
+//     folding.
+//   - condition is the expression to test to determine whether to continue folding.
+//   - step is the expression to evaluation at the conclusion of a single fold iteration.
+//   - result is the computation to evaluate at the conclusion of the fold.
+//
+// The accuVar should not shadow variable names that you would like to reference within the
+// environment in the step and condition expressions. Presently, the name __result__ is commonly
+// used by built-in macros but this may change in the future.
+func (ah *adaptingHelper) Fold(iterVar string,
+	iterRange *exprpb.Expr,
+	accuVar string,
+	accuInit *exprpb.Expr,
+	condition *exprpb.Expr,
+	step *exprpb.Expr,
+	result *exprpb.Expr) *exprpb.Expr {
+	return mustAdaptToProto(
+		ah.modernHelper.NewComprehension(
+			mustAdaptToExpr(iterRange),
+			iterVar,
+			accuVar,
+			mustAdaptToExpr(accuInit),
+			mustAdaptToExpr(condition),
+			mustAdaptToExpr(step),
+			mustAdaptToExpr(result),
+		),
+	)
+}
+
+// Ident creates an identifier Expr value.
+func (ah *adaptingHelper) Ident(name string) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewIdent(name))
+}
+
+// AccuIdent returns an accumulator identifier for use with comprehension results.
+func (ah *adaptingHelper) AccuIdent() *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewAccuIdent())
+}
+
+// GlobalCall creates a function call Expr value for a global (free) function.
+func (ah *adaptingHelper) GlobalCall(function string, args ...*exprpb.Expr) *exprpb.Expr {
+	return mustAdaptToProto(ah.modernHelper.NewCall(function, mustAdaptToExprs(args)...))
+}
+
+// ReceiverCall creates a function call Expr value for a receiver-style function.
+func (ah *adaptingHelper) ReceiverCall(function string, target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr {
+	return mustAdaptToProto(
+		ah.modernHelper.NewMemberCall(function, mustAdaptToExpr(target), mustAdaptToExprs(args)...))
+}
+
+// PresenceTest creates a Select TestOnly Expr value for modelling has() semantics.
+func (ah *adaptingHelper) PresenceTest(operand *exprpb.Expr, field string) *exprpb.Expr {
+	op := mustAdaptToExpr(operand)
+	return mustAdaptToProto(ah.modernHelper.NewPresenceTest(op, field))
+}
+
+// Select create a field traversal Expr value.
+func (ah *adaptingHelper) Select(operand *exprpb.Expr, field string) *exprpb.Expr {
+	op := mustAdaptToExpr(operand)
+	return mustAdaptToProto(ah.modernHelper.NewSelect(op, field))
+}
+
+// OffsetLocation returns the Location of the expression identifier.
+func (ah *adaptingHelper) OffsetLocation(exprID int64) common.Location {
+	return ah.modernHelper.OffsetLocation(exprID)
+}
+
+// NewError associates an error message with a given expression id.
+func (ah *adaptingHelper) NewError(exprID int64, message string) *Error {
+	return ah.modernHelper.NewError(exprID, message)
+}
+
+func mustAdaptToExprs(exprs []*exprpb.Expr) []ast.Expr {
+	adapted := make([]ast.Expr, len(exprs))
+	for i, e := range exprs {
+		adapted[i] = mustAdaptToExpr(e)
+	}
+	return adapted
+}
+
+func mustAdaptToExpr(e *exprpb.Expr) ast.Expr {
+	out, _ := adaptToExpr(e)
+	return out
+}
+
+func adaptToExpr(e *exprpb.Expr) (ast.Expr, *Error) {
+	if e == nil {
+		return nil, nil
+	}
+	out, err := ast.ProtoToExpr(e)
+	if err != nil {
+		return nil, wrapErr(e.GetId(), "proto conversion failure", err)
+	}
+	return out, nil
+}
+
+func mustAdaptToEntryExpr(e *exprpb.Expr_CreateStruct_Entry) ast.EntryExpr {
+	out, _ := ast.ProtoToEntryExpr(e)
+	return out
+}
+
+func mustAdaptToProto(e ast.Expr) *exprpb.Expr {
+	out, _ := adaptToProto(e)
+	return out
+}
+
+func adaptToProto(e ast.Expr) (*exprpb.Expr, *Error) {
+	if e == nil {
+		return nil, nil
+	}
+	out, err := ast.ExprToProto(e)
+	if err != nil {
+		return nil, wrapErr(e.ID(), "expr conversion failure", err)
+	}
+	return out, nil
+}
+
+func mustAdaptToProtoEntry(e ast.EntryExpr) *exprpb.Expr_CreateStruct_Entry {
+	out, _ := ast.EntryExprToProto(e)
+	return out
+}
+
+func toParserHelper(meh MacroExprHelper) (parser.ExprHelper, *Error) {
+	ah, ok := meh.(*adaptingHelper)
+	if !ok {
+		return nil, common.NewError(0,
+			fmt.Sprintf("unsupported macro helper: %v (%T)", meh, meh),
+			common.NoLocation)
+	}
+	return ah.modernHelper, nil
+}
diff --git a/vendor/github.com/google/cel-go/cel/optimizer.go b/vendor/github.com/google/cel-go/cel/optimizer.go
new file mode 100644
index 0000000..9a2a97a
--- /dev/null
+++ b/vendor/github.com/google/cel-go/cel/optimizer.go
@@ -0,0 +1,535 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cel
+
+import (
+	"sort"
+
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// StaticOptimizer contains a sequence of ASTOptimizer instances which will be applied in order.
+//
+// The static optimizer normalizes expression ids and type-checking run between optimization
+// passes to ensure that the final optimized output is a valid expression with metadata consistent
+// with what would have been generated from a parsed and checked expression.
+//
+// Note: source position information is best-effort and likely wrong, but optimized expressions
+// should be suitable for calls to parser.Unparse.
+type StaticOptimizer struct {
+	optimizers []ASTOptimizer
+}
+
+// NewStaticOptimizer creates a StaticOptimizer with a sequence of ASTOptimizer's to be applied
+// to a checked expression.
+func NewStaticOptimizer(optimizers ...ASTOptimizer) *StaticOptimizer {
+	return &StaticOptimizer{
+		optimizers: optimizers,
+	}
+}
+
+// Optimize applies a sequence of optimizations to an Ast within a given environment.
+//
+// If issues are encountered, the Issues.Err() return value will be non-nil.
+func (opt *StaticOptimizer) Optimize(env *Env, a *Ast) (*Ast, *Issues) {
+	// Make a copy of the AST to be optimized.
+	optimized := ast.Copy(a.NativeRep())
+	ids := newIDGenerator(ast.MaxID(a.NativeRep()))
+
+	// Create the optimizer context, could be pooled in the future.
+	issues := NewIssues(common.NewErrors(a.Source()))
+	baseFac := ast.NewExprFactory()
+	exprFac := &optimizerExprFactory{
+		idGenerator: ids,
+		fac:         baseFac,
+		sourceInfo:  optimized.SourceInfo(),
+	}
+	ctx := &OptimizerContext{
+		optimizerExprFactory: exprFac,
+		Env:                  env,
+		Issues:               issues,
+	}
+
+	// Apply the optimizations sequentially.
+	for _, o := range opt.optimizers {
+		optimized = o.Optimize(ctx, optimized)
+		if issues.Err() != nil {
+			return nil, issues
+		}
+		// Normalize expression id metadata including coordination with macro call metadata.
+		freshIDGen := newIDGenerator(0)
+		info := optimized.SourceInfo()
+		expr := optimized.Expr()
+		normalizeIDs(freshIDGen.renumberStable, expr, info)
+		cleanupMacroRefs(expr, info)
+
+		// Recheck the updated expression for any possible type-agreement or validation errors.
+		parsed := &Ast{
+			source: a.Source(),
+			impl:   ast.NewAST(expr, info)}
+		checked, iss := ctx.Check(parsed)
+		if iss.Err() != nil {
+			return nil, iss
+		}
+		optimized = checked.NativeRep()
+	}
+
+	// Return the optimized result.
+	return &Ast{
+		source: a.Source(),
+		impl:   optimized,
+	}, nil
+}
+
+// normalizeIDs ensures that the metadata present with an AST is reset in a manner such
+// that the ids within the expression correspond to the ids within macros.
+func normalizeIDs(idGen ast.IDGenerator, optimized ast.Expr, info *ast.SourceInfo) {
+	optimized.RenumberIDs(idGen)
+	if len(info.MacroCalls()) == 0 {
+		return
+	}
+
+	// Sort the macro ids to make sure that the renumbering of macro-specific variables
+	// is stable across normalization calls.
+	sortedMacroIDs := []int64{}
+	for id := range info.MacroCalls() {
+		sortedMacroIDs = append(sortedMacroIDs, id)
+	}
+	sort.Slice(sortedMacroIDs, func(i, j int) bool { return sortedMacroIDs[i] < sortedMacroIDs[j] })
+
+	// First, update the macro call ids themselves.
+	callIDMap := map[int64]int64{}
+	for _, id := range sortedMacroIDs {
+		callIDMap[id] = idGen(id)
+	}
+	// Then update the macro call definitions which refer to these ids, but
+	// ensure that the updates don't collide and remove macro entries which haven't
+	// been visited / updated yet.
+	type macroUpdate struct {
+		id   int64
+		call ast.Expr
+	}
+	macroUpdates := []macroUpdate{}
+	for _, oldID := range sortedMacroIDs {
+		newID := callIDMap[oldID]
+		call, found := info.GetMacroCall(oldID)
+		if !found {
+			continue
+		}
+		call.RenumberIDs(idGen)
+		macroUpdates = append(macroUpdates, macroUpdate{id: newID, call: call})
+		info.ClearMacroCall(oldID)
+	}
+	for _, u := range macroUpdates {
+		info.SetMacroCall(u.id, u.call)
+	}
+}
+
+func cleanupMacroRefs(expr ast.Expr, info *ast.SourceInfo) {
+	if len(info.MacroCalls()) == 0 {
+		return
+	}
+
+	// Sanitize the macro call references once the optimized expression has been computed
+	// and the ids normalized between the expression and the macros.
+	exprRefMap := make(map[int64]struct{})
+	ast.PostOrderVisit(expr, ast.NewExprVisitor(func(e ast.Expr) {
+		if e.ID() == 0 {
+			return
+		}
+		exprRefMap[e.ID()] = struct{}{}
+	}))
+	// Update the macro call id references to ensure that macro pointers are
+	// updated consistently across macros.
+	for _, call := range info.MacroCalls() {
+		ast.PostOrderVisit(call, ast.NewExprVisitor(func(e ast.Expr) {
+			if e.ID() == 0 {
+				return
+			}
+			exprRefMap[e.ID()] = struct{}{}
+		}))
+	}
+	for id := range info.MacroCalls() {
+		if _, found := exprRefMap[id]; !found {
+			info.ClearMacroCall(id)
+		}
+	}
+}
+
+// newIDGenerator ensures that new ids are only created the first time they are encountered.
+func newIDGenerator(seed int64) *idGenerator {
+	return &idGenerator{
+		idMap: make(map[int64]int64),
+		seed:  seed,
+	}
+}
+
+type idGenerator struct {
+	idMap map[int64]int64
+	seed  int64
+}
+
+func (gen *idGenerator) nextID() int64 {
+	gen.seed++
+	return gen.seed
+}
+
+func (gen *idGenerator) renumberStable(id int64) int64 {
+	if id == 0 {
+		return 0
+	}
+	if newID, found := gen.idMap[id]; found {
+		return newID
+	}
+	nextID := gen.nextID()
+	gen.idMap[id] = nextID
+	return nextID
+}
+
+// OptimizerContext embeds Env and Issues instances to make it easy to type-check and evaluate
+// subexpressions and report any errors encountered along the way. The context also embeds the
+// optimizerExprFactory which can be used to generate new sub-expressions with expression ids
+// consistent with the expectations of a parsed expression.
+type OptimizerContext struct {
+	*Env
+	*optimizerExprFactory
+	*Issues
+}
+
+// ExtendEnv auguments the context's environment with the additional options.
+func (opt *OptimizerContext) ExtendEnv(opts ...EnvOption) error {
+	e, err := opt.Env.Extend(opts...)
+	if err != nil {
+		return err
+	}
+	opt.Env = e
+	return nil
+}
+
+// ASTOptimizer applies an optimization over an AST and returns the optimized result.
+type ASTOptimizer interface {
+	// Optimize optimizes a type-checked AST within an Environment and accumulates any issues.
+	Optimize(*OptimizerContext, *ast.AST) *ast.AST
+}
+
+type optimizerExprFactory struct {
+	*idGenerator
+	fac        ast.ExprFactory
+	sourceInfo *ast.SourceInfo
+}
+
+// NewAST creates an AST from the current expression using the tracked source info which
+// is modified and managed by the OptimizerContext.
+func (opt *optimizerExprFactory) NewAST(expr ast.Expr) *ast.AST {
+	return ast.NewAST(expr, opt.sourceInfo)
+}
+
+// CopyAST creates a renumbered copy of `Expr` and `SourceInfo` values of the input AST, where the
+// renumbering uses the same scheme as the core optimizer logic ensuring there are no collisions
+// between copies.
+//
+// Use this method before attempting to merge the expression from AST into another.
+func (opt *optimizerExprFactory) CopyAST(a *ast.AST) (ast.Expr, *ast.SourceInfo) {
+	idGen := newIDGenerator(opt.nextID())
+	defer func() { opt.seed = idGen.nextID() }()
+	copyExpr := opt.fac.CopyExpr(a.Expr())
+	copyInfo := ast.CopySourceInfo(a.SourceInfo())
+	normalizeIDs(idGen.renumberStable, copyExpr, copyInfo)
+	return copyExpr, copyInfo
+}
+
+// CopyASTAndMetadata copies the input AST and propagates the macro metadata into the AST being
+// optimized.
+func (opt *optimizerExprFactory) CopyASTAndMetadata(a *ast.AST) ast.Expr {
+	copyExpr, copyInfo := opt.CopyAST(a)
+	for macroID, call := range copyInfo.MacroCalls() {
+		opt.SetMacroCall(macroID, call)
+	}
+	return copyExpr
+}
+
+// ClearMacroCall clears the macro at the given expression id.
+func (opt *optimizerExprFactory) ClearMacroCall(id int64) {
+	opt.sourceInfo.ClearMacroCall(id)
+}
+
+// SetMacroCall sets the macro call metadata for the given macro id within the tracked source info
+// metadata.
+func (opt *optimizerExprFactory) SetMacroCall(id int64, expr ast.Expr) {
+	opt.sourceInfo.SetMacroCall(id, expr)
+}
+
+// MacroCalls returns the map of macro calls currently in the context.
+func (opt *optimizerExprFactory) MacroCalls() map[int64]ast.Expr {
+	return opt.sourceInfo.MacroCalls()
+}
+
+// NewBindMacro creates an AST expression representing the expanded bind() macro, and a macro expression
+// representing the unexpanded call signature to be inserted into the source info macro call metadata.
+func (opt *optimizerExprFactory) NewBindMacro(macroID int64, varName string, varInit, remaining ast.Expr) (astExpr, macroExpr ast.Expr) {
+	varID := opt.nextID()
+	remainingID := opt.nextID()
+	remaining = opt.fac.CopyExpr(remaining)
+	remaining.RenumberIDs(func(id int64) int64 {
+		if id == macroID {
+			return remainingID
+		}
+		return id
+	})
+	if call, exists := opt.sourceInfo.GetMacroCall(macroID); exists {
+		opt.SetMacroCall(remainingID, opt.fac.CopyExpr(call))
+	}
+
+	astExpr = opt.fac.NewComprehension(macroID,
+		opt.fac.NewList(opt.nextID(), []ast.Expr{}, []int32{}),
+		"#unused",
+		varName,
+		opt.fac.CopyExpr(varInit),
+		opt.fac.NewLiteral(opt.nextID(), types.False),
+		opt.fac.NewIdent(varID, varName),
+		remaining)
+
+	macroExpr = opt.fac.NewMemberCall(0, "bind",
+		opt.fac.NewIdent(opt.nextID(), "cel"),
+		opt.fac.NewIdent(varID, varName),
+		opt.fac.CopyExpr(varInit),
+		opt.fac.CopyExpr(remaining))
+	opt.sanitizeMacro(macroID, macroExpr)
+	return
+}
+
+// NewCall creates a global function call invocation expression.
+//
+// Example:
+//
+// countByField(list, fieldName)
+// - function: countByField
+// - args: [list, fieldName]
+func (opt *optimizerExprFactory) NewCall(function string, args ...ast.Expr) ast.Expr {
+	return opt.fac.NewCall(opt.nextID(), function, args...)
+}
+
+// NewMemberCall creates a member function call invocation expression where 'target' is the receiver of the call.
+//
+// Example:
+//
+// list.countByField(fieldName)
+// - function: countByField
+// - target: list
+// - args: [fieldName]
+func (opt *optimizerExprFactory) NewMemberCall(function string, target ast.Expr, args ...ast.Expr) ast.Expr {
+	return opt.fac.NewMemberCall(opt.nextID(), function, target, args...)
+}
+
+// NewIdent creates a new identifier expression.
+//
+// Examples:
+//
+// - simple_var_name
+// - qualified.subpackage.var_name
+func (opt *optimizerExprFactory) NewIdent(name string) ast.Expr {
+	return opt.fac.NewIdent(opt.nextID(), name)
+}
+
+// NewLiteral creates a new literal expression value.
+//
+// The range of valid values for a literal generated during optimization is different than for expressions
+// generated via parsing / type-checking, as the ref.Val may be _any_ CEL value so long as the value can
+// be converted back to a literal-like form.
+func (opt *optimizerExprFactory) NewLiteral(value ref.Val) ast.Expr {
+	return opt.fac.NewLiteral(opt.nextID(), value)
+}
+
+// NewList creates a list expression with a set of optional indices.
+//
+// Examples:
+//
+// [a, b]
+// - elems: [a, b]
+// - optIndices: []
+//
+// [a, ?b, ?c]
+// - elems: [a, b, c]
+// - optIndices: [1, 2]
+func (opt *optimizerExprFactory) NewList(elems []ast.Expr, optIndices []int32) ast.Expr {
+	return opt.fac.NewList(opt.nextID(), elems, optIndices)
+}
+
+// NewMap creates a map from a set of entry expressions which contain a key and value expression.
+func (opt *optimizerExprFactory) NewMap(entries []ast.EntryExpr) ast.Expr {
+	return opt.fac.NewMap(opt.nextID(), entries)
+}
+
+// NewMapEntry creates a map entry with a key and value expression and a flag to indicate whether the
+// entry is optional.
+//
+// Examples:
+//
+// {a: b}
+// - key: a
+// - value: b
+// - optional: false
+//
+// {?a: ?b}
+// - key: a
+// - value: b
+// - optional: true
+func (opt *optimizerExprFactory) NewMapEntry(key, value ast.Expr, isOptional bool) ast.EntryExpr {
+	return opt.fac.NewMapEntry(opt.nextID(), key, value, isOptional)
+}
+
+// NewHasMacro generates a test-only select expression to be included within an AST and an unexpanded
+// has() macro call signature to be inserted into the source info macro call metadata.
+func (opt *optimizerExprFactory) NewHasMacro(macroID int64, s ast.Expr) (astExpr, macroExpr ast.Expr) {
+	sel := s.AsSelect()
+	astExpr = opt.fac.NewPresenceTest(macroID, sel.Operand(), sel.FieldName())
+	macroExpr = opt.fac.NewCall(0, "has",
+		opt.NewSelect(opt.fac.CopyExpr(sel.Operand()), sel.FieldName()))
+	opt.sanitizeMacro(macroID, macroExpr)
+	return
+}
+
+// NewSelect creates a select expression where a field value is selected from an operand.
+//
+// Example:
+//
+// msg.field_name
+// - operand: msg
+// - field: field_name
+func (opt *optimizerExprFactory) NewSelect(operand ast.Expr, field string) ast.Expr {
+	return opt.fac.NewSelect(opt.nextID(), operand, field)
+}
+
+// NewStruct creates a new typed struct value with an set of field initializations.
+//
+// Example:
+//
+// pkg.TypeName{field: value}
+// - typeName: pkg.TypeName
+// - fields: [{field: value}]
+func (opt *optimizerExprFactory) NewStruct(typeName string, fields []ast.EntryExpr) ast.Expr {
+	return opt.fac.NewStruct(opt.nextID(), typeName, fields)
+}
+
+// NewStructField creates a struct field initialization.
+//
+// Examples:
+//
+// {count: 3u}
+// - field: count
+// - value: 3u
+// - optional: false
+//
+// {?count: x}
+// - field: count
+// - value: x
+// - optional: true
+func (opt *optimizerExprFactory) NewStructField(field string, value ast.Expr, isOptional bool) ast.EntryExpr {
+	return opt.fac.NewStructField(opt.nextID(), field, value, isOptional)
+}
+
+// UpdateExpr updates the target expression with the updated content while preserving macro metadata.
+//
+// There are four scenarios during the update to consider:
+// 1. target is not macro, updated is not macro
+// 2. target is macro, updated is not macro
+// 3. target is macro, updated is macro
+// 4. target is not macro, updated is macro
+//
+// When the target is a macro already, it may either be updated to a new macro function
+// body if the update is also a macro, or it may be removed altogether if the update is
+// a macro.
+//
+// When the update is a macro, then the target references within other macros must be
+// updated to point to the new updated macro. Otherwise, other macros which pointed to
+// the target body must be replaced with copies of the updated expression body.
+func (opt *optimizerExprFactory) UpdateExpr(target, updated ast.Expr) {
+	// Update the expression
+	target.SetKindCase(updated)
+
+	// Early return if there's no macros present sa the source info reflects the
+	// macro set from the target and updated expressions.
+	if len(opt.sourceInfo.MacroCalls()) == 0 {
+		return
+	}
+	// Determine whether the target expression was a macro.
+	_, targetIsMacro := opt.sourceInfo.GetMacroCall(target.ID())
+
+	// Determine whether the updated expression was a macro.
+	updatedMacro, updatedIsMacro := opt.sourceInfo.GetMacroCall(updated.ID())
+
+	if updatedIsMacro {
+		// If the updated call was a macro, then updated id maps to target id,
+		// and the updated macro moves into the target id slot.
+		opt.sourceInfo.ClearMacroCall(updated.ID())
+		opt.sourceInfo.SetMacroCall(target.ID(), updatedMacro)
+	} else if targetIsMacro {
+		// Otherwise if the target expr was a macro, but is no longer, clear
+		// the macro reference.
+		opt.sourceInfo.ClearMacroCall(target.ID())
+	}
+
+	// Punch holes in the updated value where macros references exist.
+	macroExpr := opt.fac.CopyExpr(target)
+	macroRefVisitor := ast.NewExprVisitor(func(e ast.Expr) {
+		if _, exists := opt.sourceInfo.GetMacroCall(e.ID()); exists {
+			e.SetKindCase(nil)
+		}
+	})
+	ast.PostOrderVisit(macroExpr, macroRefVisitor)
+
+	// Update any references to the expression within a macro
+	macroVisitor := ast.NewExprVisitor(func(call ast.Expr) {
+		// Update the target expression to point to the macro expression which
+		// will be empty if the updated expression was a macro.
+		if call.ID() == target.ID() {
+			call.SetKindCase(opt.fac.CopyExpr(macroExpr))
+		}
+		// Update the macro call expression if it refers to the updated expression
+		// id which has since been remapped to the target id.
+		if call.ID() == updated.ID() {
+			// Either ensure the expression is a macro reference or a populated with
+			// the relevant sub-expression if the updated expr was not a macro.
+			if updatedIsMacro {
+				call.SetKindCase(nil)
+			} else {
+				call.SetKindCase(opt.fac.CopyExpr(macroExpr))
+			}
+			// Since SetKindCase does not renumber the id, ensure the references to
+			// the old 'updated' id are mapped to the target id.
+			call.RenumberIDs(func(id int64) int64 {
+				if id == updated.ID() {
+					return target.ID()
+				}
+				return id
+			})
+		}
+	})
+	for _, call := range opt.sourceInfo.MacroCalls() {
+		ast.PostOrderVisit(call, macroVisitor)
+	}
+}
+
+func (opt *optimizerExprFactory) sanitizeMacro(macroID int64, macroExpr ast.Expr) {
+	macroRefVisitor := ast.NewExprVisitor(func(e ast.Expr) {
+		if _, exists := opt.sourceInfo.GetMacroCall(e.ID()); exists && e.ID() != macroID {
+			e.SetKindCase(nil)
+		}
+	})
+	ast.PostOrderVisit(macroExpr, macroRefVisitor)
+}
diff --git a/vendor/github.com/google/cel-go/cel/options.go b/vendor/github.com/google/cel-go/cel/options.go
index 63321b5..69c6942 100644
--- a/vendor/github.com/google/cel-go/cel/options.go
+++ b/vendor/github.com/google/cel-go/cel/options.go
@@ -23,12 +23,13 @@ import (
 	"google.golang.org/protobuf/reflect/protoregistry"
 	"google.golang.org/protobuf/types/dynamicpb"
 
-	"github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/checker"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/functions"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/pb"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/interpreter"
-	"github.com/google/cel-go/interpreter/functions"
 	"github.com/google/cel-go/parser"
 
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
@@ -41,13 +42,6 @@ import (
 const (
 	_ = iota
 
-	// Disallow heterogeneous aggregate (list, map) literals.
-	// Note, it is still possible to have heterogeneous aggregates when
-	// provided as variables to the expression, as well as via conversion
-	// of well-known dynamic types, or with unchecked expressions.
-	// Affects checking.  Provides a subset of standard behavior.
-	featureDisableDynamicAggregateLiterals
-
 	// Enable the tracking of function call expressions replaced by macros.
 	featureEnableMacroCallTracking
 
@@ -63,9 +57,14 @@ const (
 	// is not already in UTC.
 	featureDefaultUTCTimeZone
 
-	// Enable the use of optional types in the syntax, type-system, type-checking,
-	// and runtime.
-	featureOptionalTypes
+	// Enable the serialization of logical operator ASTs as variadic calls, thus
+	// compressing the logic graph to a single call when multiple like-operator
+	// expressions occur: e.g. a && b && c && d -> call(_&&_, [a, b, c, d])
+	featureVariadicLogicalASTs
+
+	// Enable error generation when a presence test or optional field selection is
+	// performed on a primitive type.
+	featureEnableErrorOnBadPresenceTest
 )
 
 // EnvOption is a functional interface for configuring the environment.
@@ -82,23 +81,26 @@ func ClearMacros() EnvOption {
 	}
 }
 
-// CustomTypeAdapter swaps the default ref.TypeAdapter implementation with a custom one.
+// CustomTypeAdapter swaps the default types.Adapter implementation with a custom one.
 //
 // Note: This option must be specified before the Types and TypeDescs options when used together.
-func CustomTypeAdapter(adapter ref.TypeAdapter) EnvOption {
+func CustomTypeAdapter(adapter types.Adapter) EnvOption {
 	return func(e *Env) (*Env, error) {
 		e.adapter = adapter
 		return e, nil
 	}
 }
 
-// CustomTypeProvider swaps the default ref.TypeProvider implementation with a custom one.
+// CustomTypeProvider replaces the types.Provider implementation with a custom one.
+//
+// The `provider` variable type may either be types.Provider or ref.TypeProvider (deprecated)
 //
 // Note: This option must be specified before the Types and TypeDescs options when used together.
-func CustomTypeProvider(provider ref.TypeProvider) EnvOption {
+func CustomTypeProvider(provider any) EnvOption {
 	return func(e *Env) (*Env, error) {
-		e.provider = provider
-		return e, nil
+		var err error
+		e.provider, err = maybeInteropProvider(provider)
+		return e, err
 	}
 }
 
@@ -108,8 +110,28 @@ func CustomTypeProvider(provider ref.TypeProvider) EnvOption {
 // for the environment. The NewEnv call builds on top of the standard CEL declarations. For a
 // purely custom set of declarations use NewCustomEnv.
 func Declarations(decls ...*exprpb.Decl) EnvOption {
+	declOpts := []EnvOption{}
+	var err error
+	var opt EnvOption
+	// Convert the declarations to `EnvOption` values ahead of time.
+	// Surface any errors in conversion when the options are applied.
+	for _, d := range decls {
+		opt, err = ExprDeclToDeclaration(d)
+		if err != nil {
+			break
+		}
+		declOpts = append(declOpts, opt)
+	}
 	return func(e *Env) (*Env, error) {
-		e.declarations = append(e.declarations, decls...)
+		if err != nil {
+			return nil, err
+		}
+		for _, o := range declOpts {
+			e, err = o(e)
+			if err != nil {
+				return nil, err
+			}
+		}
 		return e, nil
 	}
 }
@@ -126,14 +148,25 @@ func EagerlyValidateDeclarations(enabled bool) EnvOption {
 	return features(featureEagerlyValidateDeclarations, enabled)
 }
 
-// HomogeneousAggregateLiterals option ensures that list and map literal entry types must agree
-// during type-checking.
+// HomogeneousAggregateLiterals disables mixed type list and map literal values.
 //
 // Note, it is still possible to have heterogeneous aggregates when provided as variables to the
 // expression, as well as via conversion of well-known dynamic types, or with unchecked
 // expressions.
 func HomogeneousAggregateLiterals() EnvOption {
-	return features(featureDisableDynamicAggregateLiterals, true)
+	return ASTValidators(ValidateHomogeneousAggregateLiterals())
+}
+
+// variadicLogicalOperatorASTs flatten like-operator chained logical expressions into a single
+// variadic call with N-terms. This behavior is useful when serializing to a protocol buffer as
+// it will reduce the number of recursive calls needed to deserialize the AST later.
+//
+// For example, given the following expression the call graph will be rendered accordingly:
+//
+//	expression: a && b && c && (d || e)
+//	ast: call(_&&_, [a, b, c, call(_||_, [d, e])])
+func variadicLogicalOperatorASTs() EnvOption {
+	return features(featureVariadicLogicalASTs, true)
 }
 
 // Macros option extends the macro set configured in the environment.
@@ -214,6 +247,13 @@ func Abbrevs(qualifiedNames ...string) EnvOption {
 	}
 }
 
+// customTypeRegistry is an internal-only interface containing the minimum methods required to support
+// custom types. It is a subset of methods from ref.TypeRegistry.
+type customTypeRegistry interface {
+	RegisterDescriptor(protoreflect.FileDescriptor) error
+	RegisterType(...ref.Type) error
+}
+
 // Types adds one or more type declarations to the environment, allowing for construction of
 // type-literals whose definitions are included in the common expression built-in set.
 //
@@ -226,7 +266,7 @@ func Abbrevs(qualifiedNames ...string) EnvOption {
 // Note: This option must be specified after the CustomTypeProvider option when used together.
 func Types(addTypes ...any) EnvOption {
 	return func(e *Env) (*Env, error) {
-		reg, isReg := e.provider.(ref.TypeRegistry)
+		reg, isReg := e.provider.(customTypeRegistry)
 		if !isReg {
 			return nil, fmt.Errorf("custom types not supported by provider: %T", e.provider)
 		}
@@ -263,7 +303,7 @@ func Types(addTypes ...any) EnvOption {
 // extension or by re-using the same EnvOption with another NewEnv() call.
 func TypeDescs(descs ...any) EnvOption {
 	return func(e *Env) (*Env, error) {
-		reg, isReg := e.provider.(ref.TypeRegistry)
+		reg, isReg := e.provider.(customTypeRegistry)
 		if !isReg {
 			return nil, fmt.Errorf("custom types not supported by provider: %T", e.provider)
 		}
@@ -311,7 +351,7 @@ func TypeDescs(descs ...any) EnvOption {
 	}
 }
 
-func registerFileSet(reg ref.TypeRegistry, fileSet *descpb.FileDescriptorSet) error {
+func registerFileSet(reg customTypeRegistry, fileSet *descpb.FileDescriptorSet) error {
 	files, err := protodesc.NewFiles(fileSet)
 	if err != nil {
 		return fmt.Errorf("protodesc.NewFiles(%v) failed: %v", fileSet, err)
@@ -319,7 +359,7 @@ func registerFileSet(reg ref.TypeRegistry, fileSet *descpb.FileDescriptorSet) er
 	return registerFiles(reg, files)
 }
 
-func registerFiles(reg ref.TypeRegistry, files *protoregistry.Files) error {
+func registerFiles(reg customTypeRegistry, files *protoregistry.Files) error {
 	var err error
 	files.RangeFiles(func(fd protoreflect.FileDescriptor) bool {
 		err = reg.RegisterDescriptor(fd)
@@ -414,6 +454,8 @@ const (
 	OptTrackCost EvalOption = 1 << iota
 
 	// OptCheckStringFormat enables compile-time checking of string.format calls for syntax/cardinality.
+	//
+	// Deprecated: use ext.StringsValidateFormatCalls() as this option is now a no-op.
 	OptCheckStringFormat EvalOption = 1 << iota
 )
 
@@ -436,6 +478,24 @@ func InterruptCheckFrequency(checkFrequency uint) ProgramOption {
 	}
 }
 
+// CostEstimatorOptions configure type-check time options for estimating expression cost.
+func CostEstimatorOptions(costOpts ...checker.CostOption) EnvOption {
+	return func(e *Env) (*Env, error) {
+		e.costOptions = append(e.costOptions, costOpts...)
+		return e, nil
+	}
+}
+
+// CostTrackerOptions configures a set of options for cost-tracking.
+//
+// Note, CostTrackerOptions is a no-op unless CostTracking is also enabled.
+func CostTrackerOptions(costOpts ...interpreter.CostTrackerOption) ProgramOption {
+	return func(p *prog) (*prog, error) {
+		p.costOptions = append(p.costOptions, costOpts...)
+		return p, nil
+	}
+}
+
 // CostTracking enables cost tracking and registers a ActualCostEstimator that can optionally provide a runtime cost estimate for any function calls.
 func CostTracking(costEstimator interpreter.ActualCostEstimator) ProgramOption {
 	return func(p *prog) (*prog, error) {
@@ -457,25 +517,21 @@ func CostLimit(costLimit uint64) ProgramOption {
 	}
 }
 
-func fieldToCELType(field protoreflect.FieldDescriptor) (*exprpb.Type, error) {
+func fieldToCELType(field protoreflect.FieldDescriptor) (*Type, error) {
 	if field.Kind() == protoreflect.MessageKind || field.Kind() == protoreflect.GroupKind {
 		msgName := (string)(field.Message().FullName())
-		wellKnownType, found := pb.CheckedWellKnowns[msgName]
-		if found {
-			return wellKnownType, nil
-		}
-		return decls.NewObjectType(msgName), nil
+		return ObjectType(msgName), nil
 	}
-	if primitiveType, found := pb.CheckedPrimitives[field.Kind()]; found {
+	if primitiveType, found := types.ProtoCELPrimitives[field.Kind()]; found {
 		return primitiveType, nil
 	}
 	if field.Kind() == protoreflect.EnumKind {
-		return decls.Int, nil
+		return IntType, nil
 	}
 	return nil, fmt.Errorf("field %s type %s not implemented", field.FullName(), field.Kind().String())
 }
 
-func fieldToDecl(field protoreflect.FieldDescriptor) (*exprpb.Decl, error) {
+func fieldToVariable(field protoreflect.FieldDescriptor) (EnvOption, error) {
 	name := string(field.Name())
 	if field.IsMap() {
 		mapKey := field.MapKey()
@@ -488,20 +544,20 @@ func fieldToDecl(field protoreflect.FieldDescriptor) (*exprpb.Decl, error) {
 		if err != nil {
 			return nil, err
 		}
-		return decls.NewVar(name, decls.NewMapType(keyType, valueType)), nil
+		return Variable(name, MapType(keyType, valueType)), nil
 	}
 	if field.IsList() {
 		elemType, err := fieldToCELType(field)
 		if err != nil {
 			return nil, err
 		}
-		return decls.NewVar(name, decls.NewListType(elemType)), nil
+		return Variable(name, ListType(elemType)), nil
 	}
 	celType, err := fieldToCELType(field)
 	if err != nil {
 		return nil, err
 	}
-	return decls.NewVar(name, celType), nil
+	return Variable(name, celType), nil
 }
 
 // DeclareContextProto returns an option to extend CEL environment with declarations from the given context proto.
@@ -509,23 +565,51 @@ func fieldToDecl(field protoreflect.FieldDescriptor) (*exprpb.Decl, error) {
 // https://github.com/google/cel-spec/blob/master/doc/langdef.md#evaluation-environment
 func DeclareContextProto(descriptor protoreflect.MessageDescriptor) EnvOption {
 	return func(e *Env) (*Env, error) {
-		var decls []*exprpb.Decl
 		fields := descriptor.Fields()
 		for i := 0; i < fields.Len(); i++ {
 			field := fields.Get(i)
-			decl, err := fieldToDecl(field)
+			variable, err := fieldToVariable(field)
+			if err != nil {
+				return nil, err
+			}
+			e, err = variable(e)
 			if err != nil {
 				return nil, err
 			}
-			decls = append(decls, decl)
 		}
-		var err error
-		e, err = Declarations(decls...)(e)
+		return Types(dynamicpb.NewMessage(descriptor))(e)
+	}
+}
+
+// ContextProtoVars uses the fields of the input proto.Messages as top-level variables within an Activation.
+//
+// Consider using with `DeclareContextProto` to simplify variable type declarations and publishing when using
+// protocol buffers.
+func ContextProtoVars(ctx proto.Message) (interpreter.Activation, error) {
+	if ctx == nil || !ctx.ProtoReflect().IsValid() {
+		return interpreter.EmptyActivation(), nil
+	}
+	reg, err := types.NewRegistry(ctx)
+	if err != nil {
+		return nil, err
+	}
+	pbRef := ctx.ProtoReflect()
+	typeName := string(pbRef.Descriptor().FullName())
+	fields := pbRef.Descriptor().Fields()
+	vars := make(map[string]any, fields.Len())
+	for i := 0; i < fields.Len(); i++ {
+		field := fields.Get(i)
+		sft, found := reg.FindStructFieldType(typeName, field.TextName())
+		if !found {
+			return nil, fmt.Errorf("no such field: %s", field.TextName())
+		}
+		fieldVal, err := sft.GetFrom(ctx)
 		if err != nil {
 			return nil, err
 		}
-		return Types(dynamicpb.NewMessage(descriptor))(e)
+		vars[field.TextName()] = fieldVal
 	}
+	return interpreter.NewActivation(vars)
 }
 
 // EnableMacroCallTracking ensures that call expressions which are replaced by macros
@@ -545,13 +629,6 @@ func DefaultUTCTimeZone(enabled bool) EnvOption {
 	return features(featureDefaultUTCTimeZone, enabled)
 }
 
-// OptionalTypes enable support for optional syntax and types in CEL. The optional value type makes
-// it possible to express whether variables have been provided, whether a result has been computed,
-// and in the future whether an object field path, map key value, or list index has a value.
-func OptionalTypes() EnvOption {
-	return Lib(optionalLibrary{})
-}
-
 // features sets the given feature flags.  See list of Feature constants above.
 func features(flag int, enabled bool) EnvOption {
 	return func(e *Env) (*Env, error) {
@@ -568,3 +645,23 @@ func ParserRecursionLimit(limit int) EnvOption {
 		return e, nil
 	}
 }
+
+// ParserExpressionSizeLimit adjusts the number of code points the expression parser is allowed to parse.
+// Defaults defined in the parser package.
+func ParserExpressionSizeLimit(limit int) EnvOption {
+	return func(e *Env) (*Env, error) {
+		e.prsrOpts = append(e.prsrOpts, parser.ExpressionSizeCodePointLimit(limit))
+		return e, nil
+	}
+}
+
+func maybeInteropProvider(provider any) (types.Provider, error) {
+	switch p := provider.(type) {
+	case types.Provider:
+		return p, nil
+	case ref.TypeProvider:
+		return &interopCELTypeProvider{TypeProvider: p}, nil
+	default:
+		return nil, fmt.Errorf("unsupported type provider: %T", provider)
+	}
+}
diff --git a/vendor/github.com/google/cel-go/cel/program.go b/vendor/github.com/google/cel-go/cel/program.go
index a630f5b..49bd537 100644
--- a/vendor/github.com/google/cel-go/cel/program.go
+++ b/vendor/github.com/google/cel-go/cel/program.go
@@ -19,11 +19,10 @@ import (
 	"fmt"
 	"sync"
 
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/interpreter"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // Program is an evaluable view of an Ast.
@@ -62,6 +61,9 @@ func NoVars() interpreter.Activation {
 // PartialVars returns a PartialActivation which contains variables and a set of AttributePattern
 // values that indicate variables or parts of variables whose value are not yet known.
 //
+// This method relies on manually configured sets of missing attribute patterns. For a method which
+// infers the missing variables from the input and the configured environment, use Env.PartialVars().
+//
 // The `vars` value may either be an interpreter.Activation or any valid input to the
 // interpreter.NewActivation call.
 func PartialVars(vars any,
@@ -98,13 +100,16 @@ type EvalDetails struct {
 // State of the evaluation, non-nil if the OptTrackState or OptExhaustiveEval is specified
 // within EvalOptions.
 func (ed *EvalDetails) State() interpreter.EvalState {
+	if ed == nil {
+		return interpreter.NewEvalState()
+	}
 	return ed.state
 }
 
 // ActualCost returns the tracked cost through the course of execution when `CostTracking` is enabled.
 // Otherwise, returns nil if the cost was not enabled.
 func (ed *EvalDetails) ActualCost() *uint64 {
-	if ed.costTracker == nil {
+	if ed == nil || ed.costTracker == nil {
 		return nil
 	}
 	cost := ed.costTracker.ActualCost()
@@ -128,10 +133,14 @@ type prog struct {
 	// Interpretable configured from an Ast and aggregate decorator set based on program options.
 	interpretable     interpreter.Interpretable
 	callCostEstimator interpreter.ActualCostEstimator
+	costOptions       []interpreter.CostTrackerOption
 	costLimit         *uint64
 }
 
 func (p *prog) clone() *prog {
+	costOptsCopy := make([]interpreter.CostTrackerOption, len(p.costOptions))
+	copy(costOptsCopy, p.costOptions)
+
 	return &prog{
 		Env:                     p.Env,
 		evalOpts:                p.evalOpts,
@@ -146,16 +155,17 @@ func (p *prog) clone() *prog {
 // ProgramOption values.
 //
 // If the program cannot be configured the prog will be nil, with a non-nil error response.
-func newProgram(e *Env, ast *Ast, opts []ProgramOption) (Program, error) {
+func newProgram(e *Env, a *ast.AST, opts []ProgramOption) (Program, error) {
 	// Build the dispatcher, interpreter, and default program value.
 	disp := interpreter.NewDispatcher()
 
 	// Ensure the default attribute factory is set after the adapter and provider are
 	// configured.
 	p := &prog{
-		Env:        e,
-		decorators: []interpreter.InterpretableDecorator{},
-		dispatcher: disp,
+		Env:         e,
+		decorators:  []interpreter.InterpretableDecorator{},
+		dispatcher:  disp,
+		costOptions: []interpreter.CostTrackerOption{},
 	}
 
 	// Configure the program via the ProgramOption values.
@@ -169,7 +179,7 @@ func newProgram(e *Env, ast *Ast, opts []ProgramOption) (Program, error) {
 
 	// Add the function bindings created via Function() options.
 	for _, fn := range e.functions {
-		bindings, err := fn.bindings()
+		bindings, err := fn.Bindings()
 		if err != nil {
 			return nil, err
 		}
@@ -181,10 +191,13 @@ func newProgram(e *Env, ast *Ast, opts []ProgramOption) (Program, error) {
 
 	// Set the attribute factory after the options have been set.
 	var attrFactory interpreter.AttributeFactory
+	attrFactorOpts := []interpreter.AttrFactoryOption{
+		interpreter.EnableErrorOnBadPresenceTest(p.HasFeature(featureEnableErrorOnBadPresenceTest)),
+	}
 	if p.evalOpts&OptPartialEval == OptPartialEval {
-		attrFactory = interpreter.NewPartialAttributeFactory(e.Container, e.adapter, e.provider)
+		attrFactory = interpreter.NewPartialAttributeFactory(e.Container, e.adapter, e.provider, attrFactorOpts...)
 	} else {
-		attrFactory = interpreter.NewAttributeFactory(e.Container, e.adapter, e.provider)
+		attrFactory = interpreter.NewAttributeFactory(e.Container, e.adapter, e.provider, attrFactorOpts...)
 	}
 	interp := interpreter.NewInterpreter(disp, e.Container, e.provider, e.adapter, attrFactory)
 	p.interpreter = interp
@@ -206,43 +219,18 @@ func newProgram(e *Env, ast *Ast, opts []ProgramOption) (Program, error) {
 	if len(p.regexOptimizations) > 0 {
 		decorators = append(decorators, interpreter.CompileRegexConstants(p.regexOptimizations...))
 	}
-	// Enable compile-time checking of syntax/cardinality for string.format calls.
-	if p.evalOpts&OptCheckStringFormat == OptCheckStringFormat {
-		var isValidType func(id int64, validTypes ...*types.TypeValue) (bool, error)
-		if ast.IsChecked() {
-			isValidType = func(id int64, validTypes ...*types.TypeValue) (bool, error) {
-				t, err := ExprTypeToType(ast.typeMap[id])
-				if err != nil {
-					return false, err
-				}
-				if t.kind == DynKind {
-					return true, nil
-				}
-				for _, vt := range validTypes {
-					k, err := typeValueToKind(vt)
-					if err != nil {
-						return false, err
-					}
-					if k == t.kind {
-						return true, nil
-					}
-				}
-				return false, nil
-			}
-		} else {
-			// if the AST isn't type-checked, short-circuit validation
-			isValidType = func(id int64, validTypes ...*types.TypeValue) (bool, error) {
-				return true, nil
-			}
-		}
-		decorators = append(decorators, interpreter.InterpolateFormattedString(isValidType))
-	}
 
 	// Enable exhaustive eval, state tracking and cost tracking last since they require a factory.
 	if p.evalOpts&(OptExhaustiveEval|OptTrackState|OptTrackCost) != 0 {
 		factory := func(state interpreter.EvalState, costTracker *interpreter.CostTracker) (Program, error) {
 			costTracker.Estimator = p.callCostEstimator
 			costTracker.Limit = p.costLimit
+			for _, costOpt := range p.costOptions {
+				err := costOpt(costTracker)
+				if err != nil {
+					return nil, err
+				}
+			}
 			// Limit capacity to guarantee a reallocation when calling 'append(decs, ...)' below. This
 			// prevents the underlying memory from being shared between factory function calls causing
 			// undesired mutations.
@@ -264,32 +252,16 @@ func newProgram(e *Env, ast *Ast, opts []ProgramOption) (Program, error) {
 				decs = append(decs, interpreter.Observe(observers...))
 			}
 
-			return p.clone().initInterpretable(ast, decs)
+			return p.clone().initInterpretable(a, decs)
 		}
 		return newProgGen(factory)
 	}
-	return p.initInterpretable(ast, decorators)
+	return p.initInterpretable(a, decorators)
 }
 
-func (p *prog) initInterpretable(ast *Ast, decs []interpreter.InterpretableDecorator) (*prog, error) {
-	// Unchecked programs do not contain type and reference information and may be slower to execute.
-	if !ast.IsChecked() {
-		interpretable, err :=
-			p.interpreter.NewUncheckedInterpretable(ast.Expr(), decs...)
-		if err != nil {
-			return nil, err
-		}
-		p.interpretable = interpretable
-		return p, nil
-	}
-
-	// When the AST has been checked it contains metadata that can be used to speed up program execution.
-	var checked *exprpb.CheckedExpr
-	checked, err := AstToCheckedExpr(ast)
-	if err != nil {
-		return nil, err
-	}
-	interpretable, err := p.interpreter.NewInterpretable(checked, decs...)
+func (p *prog) initInterpretable(a *ast.AST, decs []interpreter.InterpretableDecorator) (*prog, error) {
+	// When the AST has been exprAST it contains metadata that can be used to speed up program execution.
+	interpretable, err := p.interpreter.NewInterpretable(a, decs...)
 	if err != nil {
 		return nil, err
 	}
@@ -371,7 +343,11 @@ type progGen struct {
 // the test is successful.
 func newProgGen(factory progFactory) (Program, error) {
 	// Test the factory to make sure that configuration errors are spotted at config
-	_, err := factory(interpreter.NewEvalState(), &interpreter.CostTracker{})
+	tracker, err := interpreter.NewCostTracker(nil)
+	if err != nil {
+		return nil, err
+	}
+	_, err = factory(interpreter.NewEvalState(), tracker)
 	if err != nil {
 		return nil, err
 	}
@@ -384,7 +360,10 @@ func (gen *progGen) Eval(input any) (ref.Val, *EvalDetails, error) {
 	// new EvalState instance for each call to ensure that unique evaluations yield unique stateful
 	// results.
 	state := interpreter.NewEvalState()
-	costTracker := &interpreter.CostTracker{}
+	costTracker, err := interpreter.NewCostTracker(nil)
+	if err != nil {
+		return nil, nil, err
+	}
 	det := &EvalDetails{state: state, costTracker: costTracker}
 
 	// Generate a new instance of the interpretable using the factory configured during the call to
@@ -412,7 +391,10 @@ func (gen *progGen) ContextEval(ctx context.Context, input any) (ref.Val, *EvalD
 	// new EvalState instance for each call to ensure that unique evaluations yield unique stateful
 	// results.
 	state := interpreter.NewEvalState()
-	costTracker := &interpreter.CostTracker{}
+	costTracker, err := interpreter.NewCostTracker(nil)
+	if err != nil {
+		return nil, nil, err
+	}
 	det := &EvalDetails{state: state, costTracker: costTracker}
 
 	// Generate a new instance of the interpretable using the factory configured during the call to
@@ -498,7 +480,7 @@ type evalActivation struct {
 // The lazy binding will only be invoked once per evaluation.
 //
 // Values which are not represented as ref.Val types on input may be adapted to a ref.Val using
-// the ref.TypeAdapter configured in the environment.
+// the types.Adapter configured in the environment.
 func (a *evalActivation) ResolveName(name string) (any, bool) {
 	v, found := a.vars[name]
 	if !found {
@@ -559,8 +541,6 @@ func (p *evalActivationPool) Put(value any) {
 }
 
 var (
-	emptyEvalState = interpreter.NewEvalState()
-
 	// activationPool is an internally managed pool of Activation values that wrap map[string]any inputs
 	activationPool = newEvalActivationPool()
 
diff --git a/vendor/github.com/google/cel-go/cel/validator.go b/vendor/github.com/google/cel-go/cel/validator.go
new file mode 100644
index 0000000..b50c674
--- /dev/null
+++ b/vendor/github.com/google/cel-go/cel/validator.go
@@ -0,0 +1,375 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cel
+
+import (
+	"fmt"
+	"reflect"
+	"regexp"
+
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/overloads"
+)
+
+const (
+	homogeneousValidatorName = "cel.lib.std.validate.types.homogeneous"
+
+	// HomogeneousAggregateLiteralExemptFunctions is the ValidatorConfig key used to configure
+	// the set of function names which are exempt from homogeneous type checks. The expected type
+	// is a string list of function names.
+	//
+	// As an example, the `<string>.format([args])` call expects the input arguments list to be
+	// comprised of a variety of types which correspond to the types expected by the format control
+	// clauses; however, all other uses of a mixed element type list, would be unexpected.
+	HomogeneousAggregateLiteralExemptFunctions = homogeneousValidatorName + ".exempt"
+)
+
+// ASTValidators configures a set of ASTValidator instances into the target environment.
+//
+// Validators are applied in the order in which the are specified and are treated as singletons.
+// The same ASTValidator with a given name will not be applied more than once.
+func ASTValidators(validators ...ASTValidator) EnvOption {
+	return func(e *Env) (*Env, error) {
+		for _, v := range validators {
+			if !e.HasValidator(v.Name()) {
+				e.validators = append(e.validators, v)
+			}
+		}
+		return e, nil
+	}
+}
+
+// ASTValidator defines a singleton interface for validating a type-checked Ast against an environment.
+//
+// Note: the Issues argument is mutable in the sense that it is intended to collect errors which will be
+// reported to the caller.
+type ASTValidator interface {
+	// Name returns the name of the validator. Names must be unique.
+	Name() string
+
+	// Validate validates a given Ast within an Environment and collects a set of potential issues.
+	//
+	// The ValidatorConfig is generated from the set of ASTValidatorConfigurer instances prior to
+	// the invocation of the Validate call. The expectation is that the validator configuration
+	// is created in sequence and immutable once provided to the Validate call.
+	//
+	// See individual validators for more information on their configuration keys and configuration
+	// properties.
+	Validate(*Env, ValidatorConfig, *ast.AST, *Issues)
+}
+
+// ValidatorConfig provides an accessor method for querying validator configuration state.
+type ValidatorConfig interface {
+	GetOrDefault(name string, value any) any
+}
+
+// MutableValidatorConfig provides mutation methods for querying and updating validator configuration
+// settings.
+type MutableValidatorConfig interface {
+	ValidatorConfig
+	Set(name string, value any) error
+}
+
+// ASTValidatorConfigurer indicates that this object, currently expected to be an ASTValidator,
+// participates in validator configuration settings.
+//
+// This interface may be split from the expectation of being an ASTValidator instance in the future.
+type ASTValidatorConfigurer interface {
+	Configure(MutableValidatorConfig) error
+}
+
+// validatorConfig implements the ValidatorConfig and MutableValidatorConfig interfaces.
+type validatorConfig struct {
+	data map[string]any
+}
+
+// newValidatorConfig initializes the validator config with default values for core CEL validators.
+func newValidatorConfig() *validatorConfig {
+	return &validatorConfig{
+		data: map[string]any{
+			HomogeneousAggregateLiteralExemptFunctions: []string{},
+		},
+	}
+}
+
+// GetOrDefault returns the configured value for the name, if present, else the input default value.
+//
+// Note, the type-agreement between the input default and configured value is not checked on read.
+func (config *validatorConfig) GetOrDefault(name string, value any) any {
+	v, found := config.data[name]
+	if !found {
+		return value
+	}
+	return v
+}
+
+// Set configures a validator option with the given name and value.
+//
+// If the value had previously been set, the new value must have the same reflection type as the old one,
+// or the call will error.
+func (config *validatorConfig) Set(name string, value any) error {
+	v, found := config.data[name]
+	if found && reflect.TypeOf(v) != reflect.TypeOf(value) {
+		return fmt.Errorf("incompatible configuration type for %s, got %T, wanted %T", name, value, v)
+	}
+	config.data[name] = value
+	return nil
+}
+
+// ExtendedValidations collects a set of common AST validations which reduce the likelihood of runtime errors.
+//
+// - Validate duration and timestamp literals
+// - Ensure regex strings are valid
+// - Disable mixed type list and map literals
+func ExtendedValidations() EnvOption {
+	return ASTValidators(
+		ValidateDurationLiterals(),
+		ValidateTimestampLiterals(),
+		ValidateRegexLiterals(),
+		ValidateHomogeneousAggregateLiterals(),
+	)
+}
+
+// ValidateDurationLiterals ensures that duration literal arguments are valid immediately after type-check.
+func ValidateDurationLiterals() ASTValidator {
+	return newFormatValidator(overloads.TypeConvertDuration, 0, evalCall)
+}
+
+// ValidateTimestampLiterals ensures that timestamp literal arguments are valid immediately after type-check.
+func ValidateTimestampLiterals() ASTValidator {
+	return newFormatValidator(overloads.TypeConvertTimestamp, 0, evalCall)
+}
+
+// ValidateRegexLiterals ensures that regex patterns are validated after type-check.
+func ValidateRegexLiterals() ASTValidator {
+	return newFormatValidator(overloads.Matches, 0, compileRegex)
+}
+
+// ValidateHomogeneousAggregateLiterals checks that all list and map literals entries have the same types, i.e.
+// no mixed list element types or mixed map key or map value types.
+//
+// Note: the string format call relies on a mixed element type list for ease of use, so this check skips all
+// literals which occur within string format calls.
+func ValidateHomogeneousAggregateLiterals() ASTValidator {
+	return homogeneousAggregateLiteralValidator{}
+}
+
+// ValidateComprehensionNestingLimit ensures that comprehension nesting does not exceed the specified limit.
+//
+// This validator can be useful for preventing arbitrarily nested comprehensions which can take high polynomial
+// time to complete.
+//
+// Note, this limit does not apply to comprehensions with an empty iteration range, as these comprehensions have
+// no actual looping cost. The cel.bind() utilizes the comprehension structure to perform local variable
+// assignments and supplies an empty iteration range, so they won't count against the nesting limit either.
+func ValidateComprehensionNestingLimit(limit int) ASTValidator {
+	return nestingLimitValidator{limit: limit}
+}
+
+type argChecker func(env *Env, call, arg ast.Expr) error
+
+func newFormatValidator(funcName string, argNum int, check argChecker) formatValidator {
+	return formatValidator{
+		funcName: funcName,
+		check:    check,
+		argNum:   argNum,
+	}
+}
+
+type formatValidator struct {
+	funcName string
+	argNum   int
+	check    argChecker
+}
+
+// Name returns the unique name of this function format validator.
+func (v formatValidator) Name() string {
+	return fmt.Sprintf("cel.lib.std.validate.functions.%s", v.funcName)
+}
+
+// Validate searches the AST for uses of a given function name with a constant argument and performs a check
+// on whether the argument is a valid literal value.
+func (v formatValidator) Validate(e *Env, _ ValidatorConfig, a *ast.AST, iss *Issues) {
+	root := ast.NavigateAST(a)
+	funcCalls := ast.MatchDescendants(root, ast.FunctionMatcher(v.funcName))
+	for _, call := range funcCalls {
+		callArgs := call.AsCall().Args()
+		if len(callArgs) <= v.argNum {
+			continue
+		}
+		litArg := callArgs[v.argNum]
+		if litArg.Kind() != ast.LiteralKind {
+			continue
+		}
+		if err := v.check(e, call, litArg); err != nil {
+			iss.ReportErrorAtID(litArg.ID(), "invalid %s argument", v.funcName)
+		}
+	}
+}
+
+func evalCall(env *Env, call, arg ast.Expr) error {
+	ast := &Ast{impl: ast.NewAST(call, ast.NewSourceInfo(nil))}
+	prg, err := env.Program(ast)
+	if err != nil {
+		return err
+	}
+	_, _, err = prg.Eval(NoVars())
+	return err
+}
+
+func compileRegex(_ *Env, _, arg ast.Expr) error {
+	pattern := arg.AsLiteral().Value().(string)
+	_, err := regexp.Compile(pattern)
+	return err
+}
+
+type homogeneousAggregateLiteralValidator struct{}
+
+// Name returns the unique name of the homogeneous type validator.
+func (homogeneousAggregateLiteralValidator) Name() string {
+	return homogeneousValidatorName
+}
+
+// Validate validates that all lists and map literals have homogeneous types, i.e. don't contain dyn types.
+//
+// This validator makes an exception for list and map literals which occur at any level of nesting within
+// string format calls.
+func (v homogeneousAggregateLiteralValidator) Validate(_ *Env, c ValidatorConfig, a *ast.AST, iss *Issues) {
+	var exemptedFunctions []string
+	exemptedFunctions = c.GetOrDefault(HomogeneousAggregateLiteralExemptFunctions, exemptedFunctions).([]string)
+	root := ast.NavigateAST(a)
+	listExprs := ast.MatchDescendants(root, ast.KindMatcher(ast.ListKind))
+	for _, listExpr := range listExprs {
+		if inExemptFunction(listExpr, exemptedFunctions) {
+			continue
+		}
+		l := listExpr.AsList()
+		elements := l.Elements()
+		optIndices := l.OptionalIndices()
+		var elemType *Type
+		for i, e := range elements {
+			et := a.GetType(e.ID())
+			if isOptionalIndex(i, optIndices) {
+				et = et.Parameters()[0]
+			}
+			if elemType == nil {
+				elemType = et
+				continue
+			}
+			if !elemType.IsEquivalentType(et) {
+				v.typeMismatch(iss, e.ID(), elemType, et)
+				break
+			}
+		}
+	}
+	mapExprs := ast.MatchDescendants(root, ast.KindMatcher(ast.MapKind))
+	for _, mapExpr := range mapExprs {
+		if inExemptFunction(mapExpr, exemptedFunctions) {
+			continue
+		}
+		m := mapExpr.AsMap()
+		entries := m.Entries()
+		var keyType, valType *Type
+		for _, e := range entries {
+			mapEntry := e.AsMapEntry()
+			key, val := mapEntry.Key(), mapEntry.Value()
+			kt, vt := a.GetType(key.ID()), a.GetType(val.ID())
+			if mapEntry.IsOptional() {
+				vt = vt.Parameters()[0]
+			}
+			if keyType == nil && valType == nil {
+				keyType, valType = kt, vt
+				continue
+			}
+			if !keyType.IsEquivalentType(kt) {
+				v.typeMismatch(iss, key.ID(), keyType, kt)
+			}
+			if !valType.IsEquivalentType(vt) {
+				v.typeMismatch(iss, val.ID(), valType, vt)
+			}
+		}
+	}
+}
+
+func inExemptFunction(e ast.NavigableExpr, exemptFunctions []string) bool {
+	parent, found := e.Parent()
+	for found {
+		if parent.Kind() == ast.CallKind {
+			fnName := parent.AsCall().FunctionName()
+			for _, exempt := range exemptFunctions {
+				if exempt == fnName {
+					return true
+				}
+			}
+		}
+		parent, found = parent.Parent()
+	}
+	return false
+}
+
+func isOptionalIndex(i int, optIndices []int32) bool {
+	for _, optInd := range optIndices {
+		if i == int(optInd) {
+			return true
+		}
+	}
+	return false
+}
+
+func (homogeneousAggregateLiteralValidator) typeMismatch(iss *Issues, id int64, expected, actual *Type) {
+	iss.ReportErrorAtID(id, "expected type '%s' but found '%s'", FormatCELType(expected), FormatCELType(actual))
+}
+
+type nestingLimitValidator struct {
+	limit int
+}
+
+func (v nestingLimitValidator) Name() string {
+	return "cel.lib.std.validate.comprehension_nesting_limit"
+}
+
+func (v nestingLimitValidator) Validate(e *Env, _ ValidatorConfig, a *ast.AST, iss *Issues) {
+	root := ast.NavigateAST(a)
+	comprehensions := ast.MatchDescendants(root, ast.KindMatcher(ast.ComprehensionKind))
+	if len(comprehensions) <= v.limit {
+		return
+	}
+	for _, comp := range comprehensions {
+		count := 0
+		e := comp
+		hasParent := true
+		for hasParent {
+			// When the expression is not a comprehension, continue to the next ancestor.
+			if e.Kind() != ast.ComprehensionKind {
+				e, hasParent = e.Parent()
+				continue
+			}
+			// When the comprehension has an empty range, continue to the next ancestor
+			// as this comprehension does not have any associated cost.
+			iterRange := e.AsComprehension().IterRange()
+			if iterRange.Kind() == ast.ListKind && iterRange.AsList().Size() == 0 {
+				e, hasParent = e.Parent()
+				continue
+			}
+			// Otherwise check the nesting limit.
+			count++
+			if count > v.limit {
+				iss.ReportErrorAtID(comp.ID(), "comprehension exceeds nesting limit")
+				break
+			}
+			e, hasParent = e.Parent()
+		}
+	}
+}
diff --git a/vendor/github.com/google/cel-go/checker/BUILD.bazel b/vendor/github.com/google/cel-go/checker/BUILD.bazel
index ac2417b..678b412 100644
--- a/vendor/github.com/google/cel-go/checker/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/checker/BUILD.bazel
@@ -11,10 +11,11 @@ go_library(
         "cost.go",
         "env.go",
         "errors.go",
+        "format.go",
         "mapping.go",
         "options.go",
         "printer.go",
-        "standard.go",
+        "scopes.go",
         "types.go",
     ],
     importpath = "github.com/google/cel-go/checker",
@@ -22,15 +23,18 @@ go_library(
     deps = [
         "//checker/decls:go_default_library",
         "//common:go_default_library",
+        "//common/ast:go_default_library",
         "//common/containers:go_default_library",
         "//common/debug:go_default_library",
+        "//common/decls:go_default_library",
         "//common/operators:go_default_library",
         "//common/overloads:go_default_library",
+        "//common/stdlib:go_default_library",
         "//common/types:go_default_library",
         "//common/types/pb:go_default_library",
         "//common/types/ref:go_default_library",
         "//parser:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
@@ -44,6 +48,7 @@ go_test(
         "checker_test.go",
         "cost_test.go",
         "env_test.go",
+        "format_test.go",
     ],
     embed = [
         ":go_default_library",
@@ -54,7 +59,6 @@ go_test(
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
-        "@com_github_antlr_antlr4_runtime_go_antlr_v4//:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/checker/checker.go b/vendor/github.com/google/cel-go/checker/checker.go
index 257cffe..6824af7 100644
--- a/vendor/github.com/google/cel-go/checker/checker.go
+++ b/vendor/github.com/google/cel-go/checker/checker.go
@@ -20,150 +20,104 @@ import (
 	"fmt"
 	"reflect"
 
-	"github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/decls"
 	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
-
-	"google.golang.org/protobuf/proto"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 type checker struct {
+	*ast.AST
+	ast.ExprFactory
 	env                *Env
 	errors             *typeErrors
 	mappings           *mapping
 	freeTypeVarCounter int
-	sourceInfo         *exprpb.SourceInfo
-	types              map[int64]*exprpb.Type
-	references         map[int64]*exprpb.Reference
 }
 
 // Check performs type checking, giving a typed AST.
-// The input is a ParsedExpr proto and an env which encapsulates
-// type binding of variables, declarations of built-in functions,
-// descriptions of protocol buffers, and a registry for errors.
-// Returns a CheckedExpr proto, which might not be usable if
-// there are errors in the error registry.
-func Check(parsedExpr *exprpb.ParsedExpr,
-	source common.Source,
-	env *Env) (*exprpb.CheckedExpr, *common.Errors) {
+//
+// The input is a parsed AST and an env which encapsulates type binding of variables,
+// declarations of built-in functions, descriptions of protocol buffers, and a registry for
+// errors.
+//
+// Returns a type-checked AST, which might not be usable if there are errors in the error
+// registry.
+func Check(parsed *ast.AST, source common.Source, env *Env) (*ast.AST, *common.Errors) {
+	errs := common.NewErrors(source)
+	typeMap := make(map[int64]*types.Type)
+	refMap := make(map[int64]*ast.ReferenceInfo)
 	c := checker{
+		AST:                ast.NewCheckedAST(parsed, typeMap, refMap),
+		ExprFactory:        ast.NewExprFactory(),
 		env:                env,
-		errors:             &typeErrors{common.NewErrors(source)},
+		errors:             &typeErrors{errs: errs},
 		mappings:           newMapping(),
 		freeTypeVarCounter: 0,
-		sourceInfo:         parsedExpr.GetSourceInfo(),
-		types:              make(map[int64]*exprpb.Type),
-		references:         make(map[int64]*exprpb.Reference),
 	}
-	c.check(parsedExpr.GetExpr())
+	c.check(c.Expr())
 
-	// Walk over the final type map substituting any type parameters either by their bound value or
-	// by DYN.
-	m := make(map[int64]*exprpb.Type)
-	for k, v := range c.types {
-		m[k] = substitute(c.mappings, v, true)
+	// Walk over the final type map substituting any type parameters either by their bound value
+	// or by DYN.
+	for id, t := range c.TypeMap() {
+		c.SetType(id, substitute(c.mappings, t, true))
 	}
-
-	return &exprpb.CheckedExpr{
-		Expr:         parsedExpr.GetExpr(),
-		SourceInfo:   parsedExpr.GetSourceInfo(),
-		TypeMap:      m,
-		ReferenceMap: c.references,
-	}, c.errors.Errors
+	return c.AST, errs
 }
 
-func (c *checker) check(e *exprpb.Expr) {
+func (c *checker) check(e ast.Expr) {
 	if e == nil {
 		return
 	}
-
-	switch e.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
-		literal := e.GetConstExpr()
-		switch literal.GetConstantKind().(type) {
-		case *exprpb.Constant_BoolValue:
-			c.checkBoolLiteral(e)
-		case *exprpb.Constant_BytesValue:
-			c.checkBytesLiteral(e)
-		case *exprpb.Constant_DoubleValue:
-			c.checkDoubleLiteral(e)
-		case *exprpb.Constant_Int64Value:
-			c.checkInt64Literal(e)
-		case *exprpb.Constant_NullValue:
-			c.checkNullLiteral(e)
-		case *exprpb.Constant_StringValue:
-			c.checkStringLiteral(e)
-		case *exprpb.Constant_Uint64Value:
-			c.checkUint64Literal(e)
+	switch e.Kind() {
+	case ast.LiteralKind:
+		literal := ref.Val(e.AsLiteral())
+		switch literal.Type() {
+		case types.BoolType, types.BytesType, types.DoubleType, types.IntType,
+			types.NullType, types.StringType, types.UintType:
+			c.setType(e, literal.Type().(*types.Type))
+		default:
+			c.errors.unexpectedASTType(e.ID(), c.location(e), "literal", literal.Type().TypeName())
 		}
-	case *exprpb.Expr_IdentExpr:
+	case ast.IdentKind:
 		c.checkIdent(e)
-	case *exprpb.Expr_SelectExpr:
+	case ast.SelectKind:
 		c.checkSelect(e)
-	case *exprpb.Expr_CallExpr:
+	case ast.CallKind:
 		c.checkCall(e)
-	case *exprpb.Expr_ListExpr:
+	case ast.ListKind:
 		c.checkCreateList(e)
-	case *exprpb.Expr_StructExpr:
+	case ast.MapKind:
+		c.checkCreateMap(e)
+	case ast.StructKind:
 		c.checkCreateStruct(e)
-	case *exprpb.Expr_ComprehensionExpr:
+	case ast.ComprehensionKind:
 		c.checkComprehension(e)
 	default:
-		c.errors.ReportError(
-			c.location(e), "Unrecognized ast type: %v", reflect.TypeOf(e))
+		c.errors.unexpectedASTType(e.ID(), c.location(e), "unspecified", reflect.TypeOf(e).Name())
 	}
 }
 
-func (c *checker) checkInt64Literal(e *exprpb.Expr) {
-	c.setType(e, decls.Int)
-}
-
-func (c *checker) checkUint64Literal(e *exprpb.Expr) {
-	c.setType(e, decls.Uint)
-}
-
-func (c *checker) checkStringLiteral(e *exprpb.Expr) {
-	c.setType(e, decls.String)
-}
-
-func (c *checker) checkBytesLiteral(e *exprpb.Expr) {
-	c.setType(e, decls.Bytes)
-}
-
-func (c *checker) checkDoubleLiteral(e *exprpb.Expr) {
-	c.setType(e, decls.Double)
-}
-
-func (c *checker) checkBoolLiteral(e *exprpb.Expr) {
-	c.setType(e, decls.Bool)
-}
-
-func (c *checker) checkNullLiteral(e *exprpb.Expr) {
-	c.setType(e, decls.Null)
-}
-
-func (c *checker) checkIdent(e *exprpb.Expr) {
-	identExpr := e.GetIdentExpr()
+func (c *checker) checkIdent(e ast.Expr) {
+	identName := e.AsIdent()
 	// Check to see if the identifier is declared.
-	if ident := c.env.LookupIdent(identExpr.GetName()); ident != nil {
-		c.setType(e, ident.GetIdent().GetType())
-		c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().GetValue()))
+	if ident := c.env.LookupIdent(identName); ident != nil {
+		c.setType(e, ident.Type())
+		c.setReference(e, ast.NewIdentReference(ident.Name(), ident.Value()))
 		// Overwrite the identifier with its fully qualified name.
-		identExpr.Name = ident.GetName()
+		e.SetKindCase(c.NewIdent(e.ID(), ident.Name()))
 		return
 	}
 
-	c.setType(e, decls.Error)
-	c.errors.undeclaredReference(
-		c.location(e), c.env.container.Name(), identExpr.GetName())
+	c.setType(e, types.ErrorType)
+	c.errors.undeclaredReference(e.ID(), c.location(e), c.env.container.Name(), identName)
 }
 
-func (c *checker) checkSelect(e *exprpb.Expr) {
-	sel := e.GetSelectExpr()
+func (c *checker) checkSelect(e ast.Expr) {
+	sel := e.AsSelect()
 	// Before traversing down the tree, try to interpret as qualified name.
 	qname, found := containers.ToQualifiedName(e)
 	if found {
@@ -174,42 +128,38 @@ func (c *checker) checkSelect(e *exprpb.Expr) {
 
 			// Rewrite the node to be a variable reference to the resolved fully-qualified
 			// variable name.
-			c.setType(e, ident.GetIdent().GetType())
-			c.setReference(e, newIdentReference(ident.GetName(), ident.GetIdent().GetValue()))
-			identName := ident.GetName()
-			e.ExprKind = &exprpb.Expr_IdentExpr{
-				IdentExpr: &exprpb.Expr_Ident{
-					Name: identName,
-				},
-			}
+			c.setType(e, ident.Type())
+			c.setReference(e, ast.NewIdentReference(ident.Name(), ident.Value()))
+			e.SetKindCase(c.NewIdent(e.ID(), ident.Name()))
 			return
 		}
 	}
 
-	resultType := c.checkSelectField(e, sel.GetOperand(), sel.GetField(), false)
-	if sel.TestOnly {
-		resultType = decls.Bool
+	resultType := c.checkSelectField(e, sel.Operand(), sel.FieldName(), false)
+	if sel.IsTestOnly() {
+		resultType = types.BoolType
 	}
 	c.setType(e, substitute(c.mappings, resultType, false))
 }
 
-func (c *checker) checkOptSelect(e *exprpb.Expr) {
+func (c *checker) checkOptSelect(e ast.Expr) {
 	// Collect metadata related to the opt select call packaged by the parser.
-	call := e.GetCallExpr()
-	operand := call.GetArgs()[0]
-	field := call.GetArgs()[1]
+	call := e.AsCall()
+	operand := call.Args()[0]
+	field := call.Args()[1]
 	fieldName, isString := maybeUnwrapString(field)
 	if !isString {
-		c.errors.ReportError(c.location(field), "unsupported optional field selection: %v", field)
+		c.errors.notAnOptionalFieldSelection(field.ID(), c.location(field), field)
 		return
 	}
 
 	// Perform type-checking using the field selection logic.
 	resultType := c.checkSelectField(e, operand, fieldName, true)
 	c.setType(e, substitute(c.mappings, resultType, false))
+	c.setReference(e, ast.NewFunctionReference("select_optional_field"))
 }
 
-func (c *checker) checkSelectField(e, operand *exprpb.Expr, field string, optional bool) *exprpb.Type {
+func (c *checker) checkSelectField(e, operand ast.Expr, field string, optional bool) *types.Type {
 	// Interpret as field selection, first traversing down the operand.
 	c.check(operand)
 	operandType := substitute(c.mappings, c.getType(operand), false)
@@ -218,74 +168,71 @@ func (c *checker) checkSelectField(e, operand *exprpb.Expr, field string, option
 	targetType, isOpt := maybeUnwrapOptional(operandType)
 
 	// Assume error type by default as most types do not support field selection.
-	resultType := decls.Error
-	switch kindOf(targetType) {
-	case kindMap:
+	resultType := types.ErrorType
+	switch targetType.Kind() {
+	case types.MapKind:
 		// Maps yield their value type as the selection result type.
-		mapType := targetType.GetMapType()
-		resultType = mapType.GetValueType()
-	case kindObject:
+		resultType = targetType.Parameters()[1]
+	case types.StructKind:
 		// Objects yield their field type declaration as the selection result type, but only if
 		// the field is defined.
 		messageType := targetType
-		if fieldType, found := c.lookupFieldType(c.location(e), messageType.GetMessageType(), field); found {
-			resultType = fieldType.Type
+		if fieldType, found := c.lookupFieldType(e.ID(), messageType.TypeName(), field); found {
+			resultType = fieldType
 		}
-	case kindTypeParam:
+	case types.TypeParamKind:
 		// Set the operand type to DYN to prevent assignment to a potentially incorrect type
 		// at a later point in type-checking. The isAssignable call will update the type
 		// substitutions for the type param under the covers.
-		c.isAssignable(decls.Dyn, targetType)
+		c.isAssignable(types.DynType, targetType)
 		// Also, set the result type to DYN.
-		resultType = decls.Dyn
+		resultType = types.DynType
 	default:
 		// Dynamic / error values are treated as DYN type. Errors are handled this way as well
 		// in order to allow forward progress on the check.
 		if !isDynOrError(targetType) {
-			c.errors.typeDoesNotSupportFieldSelection(c.location(e), targetType)
+			c.errors.typeDoesNotSupportFieldSelection(e.ID(), c.location(e), targetType)
 		}
-		resultType = decls.Dyn
+		resultType = types.DynType
 	}
 
 	// If the target type was optional coming in, then the result must be optional going out.
 	if isOpt || optional {
-		return decls.NewOptionalType(resultType)
+		return types.NewOptionalType(resultType)
 	}
 	return resultType
 }
 
-func (c *checker) checkCall(e *exprpb.Expr) {
+func (c *checker) checkCall(e ast.Expr) {
 	// Note: similar logic exists within the `interpreter/planner.go`. If making changes here
 	// please consider the impact on planner.go and consolidate implementations or mirror code
 	// as appropriate.
-	call := e.GetCallExpr()
-	fnName := call.GetFunction()
+	call := e.AsCall()
+	fnName := call.FunctionName()
 	if fnName == operators.OptSelect {
 		c.checkOptSelect(e)
 		return
 	}
 
-	args := call.GetArgs()
+	args := call.Args()
 	// Traverse arguments.
 	for _, arg := range args {
 		c.check(arg)
 	}
 
-	target := call.GetTarget()
 	// Regular static call with simple name.
-	if target == nil {
+	if !call.IsMemberFunction() {
 		// Check for the existence of the function.
 		fn := c.env.LookupFunction(fnName)
 		if fn == nil {
-			c.errors.undeclaredReference(
-				c.location(e), c.env.container.Name(), fnName)
-			c.setType(e, decls.Error)
+			c.errors.undeclaredReference(e.ID(), c.location(e), c.env.container.Name(), fnName)
+			c.setType(e, types.ErrorType)
 			return
 		}
 		// Overwrite the function name with its fully qualified resolved name.
-		call.Function = fn.GetName()
+		e.SetKindCase(c.NewCall(e.ID(), fn.Name(), args...))
 		// Check to see whether the overload resolves.
-		c.resolveOverloadOrError(c.location(e), e, fn, nil, args)
+		c.resolveOverloadOrError(e, fn, nil, args)
 		return
 	}
 
@@ -294,6 +241,7 @@ func (c *checker) checkCall(e *exprpb.Expr) {
 	// target a.b.
 	//
 	// Check whether the target is a namespaced function name.
+	target := call.Target()
 	qualifiedPrefix, maybeQualified := containers.ToQualifiedName(target)
 	if maybeQualified {
 		maybeQualifiedName := qualifiedPrefix + "." + fnName
@@ -302,34 +250,32 @@ func (c *checker) checkCall(e *exprpb.Expr) {
 			// The function name is namespaced and so preserving the target operand would
 			// be an inaccurate representation of the desired evaluation behavior.
 			// Overwrite with fully-qualified resolved function name sans receiver target.
-			call.Target = nil
-			call.Function = fn.GetName()
-			c.resolveOverloadOrError(c.location(e), e, fn, nil, args)
+			e.SetKindCase(c.NewCall(e.ID(), fn.Name(), args...))
+			c.resolveOverloadOrError(e, fn, nil, args)
 			return
 		}
 	}
 
 	// Regular instance call.
-	c.check(call.Target)
+	c.check(target)
 	fn := c.env.LookupFunction(fnName)
 	// Function found, attempt overload resolution.
 	if fn != nil {
-		c.resolveOverloadOrError(c.location(e), e, fn, target, args)
+		c.resolveOverloadOrError(e, fn, target, args)
 		return
 	}
 	// Function name not declared, record error.
-	c.errors.undeclaredReference(c.location(e), c.env.container.Name(), fnName)
+	c.setType(e, types.ErrorType)
+	c.errors.undeclaredReference(e.ID(), c.location(e), c.env.container.Name(), fnName)
 }
 
 func (c *checker) resolveOverloadOrError(
-	loc common.Location,
-	e *exprpb.Expr,
-	fn *exprpb.Decl, target *exprpb.Expr, args []*exprpb.Expr) {
+	e ast.Expr, fn *decls.FunctionDecl, target ast.Expr, args []ast.Expr) {
 	// Attempt to resolve the overload.
-	resolution := c.resolveOverload(loc, fn, target, args)
+	resolution := c.resolveOverload(e, fn, target, args)
 	// No such overload, error noted in the resolveOverload call, type recorded here.
 	if resolution == nil {
-		c.setType(e, decls.Error)
+		c.setType(e, types.ErrorType)
 		return
 	}
 	// Overload found.
@@ -338,10 +284,9 @@ func (c *checker) resolveOverloadOrError(
 }
 
 func (c *checker) resolveOverload(
-	loc common.Location,
-	fn *exprpb.Decl, target *exprpb.Expr, args []*exprpb.Expr) *overloadResolution {
+	call ast.Expr, fn *decls.FunctionDecl, target ast.Expr, args []ast.Expr) *overloadResolution {
 
-	var argTypes []*exprpb.Type
+	var argTypes []*types.Type
 	if target != nil {
 		argTypes = append(argTypes, c.getType(target))
 	}
@@ -349,234 +294,273 @@ func (c *checker) resolveOverload(
 		argTypes = append(argTypes, c.getType(arg))
 	}
 
-	var resultType *exprpb.Type
-	var checkedRef *exprpb.Reference
-	for _, overload := range fn.GetFunction().GetOverloads() {
+	var resultType *types.Type
+	var checkedRef *ast.ReferenceInfo
+	for _, overload := range fn.OverloadDecls() {
 		// Determine whether the overload is currently considered.
-		if c.env.isOverloadDisabled(overload.GetOverloadId()) {
+		if c.env.isOverloadDisabled(overload.ID()) {
 			continue
 		}
 
 		// Ensure the call style for the overload matches.
-		if (target == nil && overload.GetIsInstanceFunction()) ||
-			(target != nil && !overload.GetIsInstanceFunction()) {
+		if (target == nil && overload.IsMemberFunction()) ||
+			(target != nil && !overload.IsMemberFunction()) {
 			// not a compatible call style.
 			continue
 		}
 
-		overloadType := decls.NewFunctionType(overload.ResultType, overload.Params...)
-		if len(overload.GetTypeParams()) > 0 {
+		// Alternative type-checking behavior when the logical operators are compacted into
+		// variadic AST representations.
+		if fn.Name() == operators.LogicalAnd || fn.Name() == operators.LogicalOr {
+			checkedRef = ast.NewFunctionReference(overload.ID())
+			for i, argType := range argTypes {
+				if !c.isAssignable(argType, types.BoolType) {
+					c.errors.typeMismatch(
+						args[i].ID(),
+						c.locationByID(args[i].ID()),
+						types.BoolType,
+						argType)
+					resultType = types.ErrorType
+				}
+			}
+			if isError(resultType) {
+				return nil
+			}
+			return newResolution(checkedRef, types.BoolType)
+		}
+
+		overloadType := newFunctionType(overload.ResultType(), overload.ArgTypes()...)
+		typeParams := overload.TypeParams()
+		if len(typeParams) != 0 {
 			// Instantiate overload's type with fresh type variables.
 			substitutions := newMapping()
-			for _, typePar := range overload.GetTypeParams() {
-				substitutions.add(decls.NewTypeParamType(typePar), c.newTypeVar())
+			for _, typePar := range typeParams {
+				substitutions.add(types.NewTypeParamType(typePar), c.newTypeVar())
 			}
 			overloadType = substitute(substitutions, overloadType, false)
 		}
 
-		candidateArgTypes := overloadType.GetFunction().GetArgTypes()
+		candidateArgTypes := overloadType.Parameters()[1:]
 		if c.isAssignableList(argTypes, candidateArgTypes) {
 			if checkedRef == nil {
-				checkedRef = newFunctionReference(overload.GetOverloadId())
+				checkedRef = ast.NewFunctionReference(overload.ID())
 			} else {
-				checkedRef.OverloadId = append(checkedRef.GetOverloadId(), overload.GetOverloadId())
+				checkedRef.AddOverload(overload.ID())
 			}
 
 			// First matching overload, determines result type.
-			fnResultType := substitute(c.mappings, overloadType.GetFunction().GetResultType(), false)
+			fnResultType := substitute(c.mappings, overloadType.Parameters()[0], false)
 			if resultType == nil {
 				resultType = fnResultType
-			} else if !isDyn(resultType) && !proto.Equal(fnResultType, resultType) {
-				resultType = decls.Dyn
+			} else if !isDyn(resultType) && !fnResultType.IsExactType(resultType) {
+				resultType = types.DynType
 			}
 		}
 	}
 
 	if resultType == nil {
-		for i, arg := range argTypes {
-			argTypes[i] = substitute(c.mappings, arg, true)
+		for i, argType := range argTypes {
+			argTypes[i] = substitute(c.mappings, argType, true)
 		}
-		c.errors.noMatchingOverload(loc, fn.GetName(), argTypes, target != nil)
-		resultType = decls.Error
+		c.errors.noMatchingOverload(call.ID(), c.location(call), fn.Name(), argTypes, target != nil)
 		return nil
 	}
 
 	return newResolution(checkedRef, resultType)
 }
 
-func (c *checker) checkCreateList(e *exprpb.Expr) {
-	create := e.GetListExpr()
-	var elemsType *exprpb.Type
-	optionalIndices := create.GetOptionalIndices()
+func (c *checker) checkCreateList(e ast.Expr) {
+	create := e.AsList()
+	var elemsType *types.Type
+	optionalIndices := create.OptionalIndices()
 	optionals := make(map[int32]bool, len(optionalIndices))
 	for _, optInd := range optionalIndices {
 		optionals[optInd] = true
 	}
-	for i, e := range create.GetElements() {
+	for i, e := range create.Elements() {
 		c.check(e)
 		elemType := c.getType(e)
 		if optionals[int32(i)] {
 			var isOptional bool
 			elemType, isOptional = maybeUnwrapOptional(elemType)
 			if !isOptional && !isDyn(elemType) {
-				c.errors.typeMismatch(c.location(e), decls.NewOptionalType(elemType), elemType)
+				c.errors.typeMismatch(e.ID(), c.location(e), types.NewOptionalType(elemType), elemType)
 			}
 		}
-		elemsType = c.joinTypes(c.location(e), elemsType, elemType)
+		elemsType = c.joinTypes(e, elemsType, elemType)
 	}
 	if elemsType == nil {
 		// If the list is empty, assign free type var to elem type.
 		elemsType = c.newTypeVar()
 	}
-	c.setType(e, decls.NewListType(elemsType))
+	c.setType(e, types.NewListType(elemsType))
 }
 
-func (c *checker) checkCreateStruct(e *exprpb.Expr) {
-	str := e.GetStructExpr()
-	if str.GetMessageName() != "" {
-		c.checkCreateMessage(e)
-	} else {
-		c.checkCreateMap(e)
-	}
-}
-
-func (c *checker) checkCreateMap(e *exprpb.Expr) {
-	mapVal := e.GetStructExpr()
-	var mapKeyType *exprpb.Type
-	var mapValueType *exprpb.Type
-	for _, ent := range mapVal.GetEntries() {
-		key := ent.GetMapKey()
+func (c *checker) checkCreateMap(e ast.Expr) {
+	mapVal := e.AsMap()
+	var mapKeyType *types.Type
+	var mapValueType *types.Type
+	for _, e := range mapVal.Entries() {
+		entry := e.AsMapEntry()
+		key := entry.Key()
 		c.check(key)
-		mapKeyType = c.joinTypes(c.location(key), mapKeyType, c.getType(key))
+		mapKeyType = c.joinTypes(key, mapKeyType, c.getType(key))
 
-		val := ent.GetValue()
+		val := entry.Value()
 		c.check(val)
 		valType := c.getType(val)
-		if ent.GetOptionalEntry() {
+		if entry.IsOptional() {
 			var isOptional bool
 			valType, isOptional = maybeUnwrapOptional(valType)
 			if !isOptional && !isDyn(valType) {
-				c.errors.typeMismatch(c.location(val), decls.NewOptionalType(valType), valType)
+				c.errors.typeMismatch(val.ID(), c.location(val), types.NewOptionalType(valType), valType)
 			}
 		}
-		mapValueType = c.joinTypes(c.location(val), mapValueType, valType)
+		mapValueType = c.joinTypes(val, mapValueType, valType)
 	}
 	if mapKeyType == nil {
 		// If the map is empty, assign free type variables to typeKey and value type.
 		mapKeyType = c.newTypeVar()
 		mapValueType = c.newTypeVar()
 	}
-	c.setType(e, decls.NewMapType(mapKeyType, mapValueType))
+	c.setType(e, types.NewMapType(mapKeyType, mapValueType))
 }
 
-func (c *checker) checkCreateMessage(e *exprpb.Expr) {
-	msgVal := e.GetStructExpr()
+func (c *checker) checkCreateStruct(e ast.Expr) {
+	msgVal := e.AsStruct()
 	// Determine the type of the message.
-	messageType := decls.Error
-	decl := c.env.LookupIdent(msgVal.GetMessageName())
-	if decl == nil {
+	resultType := types.ErrorType
+	ident := c.env.LookupIdent(msgVal.TypeName())
+	if ident == nil {
 		c.errors.undeclaredReference(
-			c.location(e), c.env.container.Name(), msgVal.GetMessageName())
+			e.ID(), c.location(e), c.env.container.Name(), msgVal.TypeName())
+		c.setType(e, types.ErrorType)
 		return
 	}
 	// Ensure the type name is fully qualified in the AST.
-	msgVal.MessageName = decl.GetName()
-	c.setReference(e, newIdentReference(decl.GetName(), nil))
-	ident := decl.GetIdent()
-	identKind := kindOf(ident.GetType())
-	if identKind != kindError {
-		if identKind != kindType {
-			c.errors.notAType(c.location(e), ident.GetType())
+	typeName := ident.Name()
+	if msgVal.TypeName() != typeName {
+		e.SetKindCase(c.NewStruct(e.ID(), typeName, msgVal.Fields()))
+		msgVal = e.AsStruct()
+	}
+	c.setReference(e, ast.NewIdentReference(typeName, nil))
+	identKind := ident.Type().Kind()
+	if identKind != types.ErrorKind {
+		if identKind != types.TypeKind {
+			c.errors.notAType(e.ID(), c.location(e), ident.Type().DeclaredTypeName())
 		} else {
-			messageType = ident.GetType().GetType()
-			if kindOf(messageType) != kindObject {
-				c.errors.notAMessageType(c.location(e), messageType)
-				messageType = decls.Error
+			resultType = ident.Type().Parameters()[0]
+			// Backwards compatibility test between well-known types and message types
+			// In this context, the type is being instantiated by its protobuf name which
+			// is not ideal or recommended, but some users expect this to work.
+			if isWellKnownType(resultType) {
+				typeName = getWellKnownTypeName(resultType)
+			} else if resultType.Kind() == types.StructKind {
+				typeName = resultType.DeclaredTypeName()
+			} else {
+				c.errors.notAMessageType(e.ID(), c.location(e), resultType.DeclaredTypeName())
+				resultType = types.ErrorType
 			}
 		}
 	}
-	if isObjectWellKnownType(messageType) {
-		c.setType(e, getObjectWellKnownType(messageType))
-	} else {
-		c.setType(e, messageType)
-	}
+	c.setType(e, resultType)
 
 	// Check the field initializers.
-	for _, ent := range msgVal.GetEntries() {
-		field := ent.GetFieldKey()
-		value := ent.GetValue()
+	for _, f := range msgVal.Fields() {
+		field := f.AsStructField()
+		fieldName := field.Name()
+		value := field.Value()
 		c.check(value)
 
-		fieldType := decls.Error
-		ft, found := c.lookupFieldType(c.locationByID(ent.GetId()), messageType.GetMessageType(), field)
+		fieldType := types.ErrorType
+		ft, found := c.lookupFieldType(f.ID(), typeName, fieldName)
 		if found {
-			fieldType = ft.Type
+			fieldType = ft
 		}
 
 		valType := c.getType(value)
-		if ent.GetOptionalEntry() {
+		if field.IsOptional() {
 			var isOptional bool
 			valType, isOptional = maybeUnwrapOptional(valType)
 			if !isOptional && !isDyn(valType) {
-				c.errors.typeMismatch(c.location(value), decls.NewOptionalType(valType), valType)
+				c.errors.typeMismatch(value.ID(), c.location(value), types.NewOptionalType(valType), valType)
 			}
 		}
 		if !c.isAssignable(fieldType, valType) {
-			c.errors.fieldTypeMismatch(c.locationByID(ent.Id), field, fieldType, valType)
+			c.errors.fieldTypeMismatch(f.ID(), c.locationByID(f.ID()), fieldName, fieldType, valType)
 		}
 	}
 }
 
-func (c *checker) checkComprehension(e *exprpb.Expr) {
-	comp := e.GetComprehensionExpr()
-	c.check(comp.GetIterRange())
-	c.check(comp.GetAccuInit())
-	accuType := c.getType(comp.GetAccuInit())
-	rangeType := substitute(c.mappings, c.getType(comp.GetIterRange()), false)
-	var varType *exprpb.Type
-
-	switch kindOf(rangeType) {
-	case kindList:
-		varType = rangeType.GetListType().GetElemType()
-	case kindMap:
-		// Ranges over the keys.
-		varType = rangeType.GetMapType().GetKeyType()
-	case kindDyn, kindError, kindTypeParam:
+func (c *checker) checkComprehension(e ast.Expr) {
+	comp := e.AsComprehension()
+	c.check(comp.IterRange())
+	c.check(comp.AccuInit())
+	rangeType := substitute(c.mappings, c.getType(comp.IterRange()), false)
+
+	// Create a scope for the comprehension since it has a local accumulation variable.
+	// This scope will contain the accumulation variable used to compute the result.
+	accuType := c.getType(comp.AccuInit())
+	c.env = c.env.enterScope()
+	c.env.AddIdents(decls.NewVariable(comp.AccuVar(), accuType))
+
+	var varType, var2Type *types.Type
+	switch rangeType.Kind() {
+	case types.ListKind:
+		// varType represents the list element type for one-variable comprehensions.
+		varType = rangeType.Parameters()[0]
+		if comp.HasIterVar2() {
+			// varType represents the list index (int) for two-variable comprehensions,
+			// and var2Type represents the list element type.
+			var2Type = varType
+			varType = types.IntType
+		}
+	case types.MapKind:
+		// varType represents the map entry key for all comprehension types.
+		varType = rangeType.Parameters()[0]
+		if comp.HasIterVar2() {
+			// var2Type represents the map entry value for two-variable comprehensions.
+			var2Type = rangeType.Parameters()[1]
+		}
+	case types.DynKind, types.ErrorKind, types.TypeParamKind:
 		// Set the range type to DYN to prevent assignment to a potentially incorrect type
 		// at a later point in type-checking. The isAssignable call will update the type
 		// substitutions for the type param under the covers.
-		c.isAssignable(decls.Dyn, rangeType)
+		c.isAssignable(types.DynType, rangeType)
 		// Set the range iteration variable to type DYN as well.
-		varType = decls.Dyn
+		varType = types.DynType
+		if comp.HasIterVar2() {
+			var2Type = types.DynType
+		}
 	default:
-		c.errors.notAComprehensionRange(c.location(comp.GetIterRange()), rangeType)
-		varType = decls.Error
+		c.errors.notAComprehensionRange(comp.IterRange().ID(), c.location(comp.IterRange()), rangeType)
+		varType = types.ErrorType
+		if comp.HasIterVar2() {
+			var2Type = types.ErrorType
+		}
 	}
 
-	// Create a scope for the comprehension since it has a local accumulation variable.
-	// This scope will contain the accumulation variable used to compute the result.
-	c.env = c.env.enterScope()
-	c.env.Add(decls.NewVar(comp.GetAccuVar(), accuType))
 	// Create a block scope for the loop.
 	c.env = c.env.enterScope()
-	c.env.Add(decls.NewVar(comp.GetIterVar(), varType))
+	c.env.AddIdents(decls.NewVariable(comp.IterVar(), varType))
+	if comp.HasIterVar2() {
+		c.env.AddIdents(decls.NewVariable(comp.IterVar2(), var2Type))
+	}
 	// Check the variable references in the condition and step.
-	c.check(comp.GetLoopCondition())
-	c.assertType(comp.GetLoopCondition(), decls.Bool)
-	c.check(comp.GetLoopStep())
-	c.assertType(comp.GetLoopStep(), accuType)
+	c.check(comp.LoopCondition())
+	c.assertType(comp.LoopCondition(), types.BoolType)
+	c.check(comp.LoopStep())
+	c.assertType(comp.LoopStep(), accuType)
 	// Exit the loop's block scope before checking the result.
 	c.env = c.env.exitScope()
-	c.check(comp.GetResult())
+	c.check(comp.Result())
 	// Exit the comprehension scope.
 	c.env = c.env.exitScope()
-	c.setType(e, substitute(c.mappings, c.getType(comp.GetResult()), false))
+	c.setType(e, substitute(c.mappings, c.getType(comp.Result()), false))
 }
 
 // Checks compatibility of joined types, and returns the most general common type.
-func (c *checker) joinTypes(loc common.Location,
-	previous *exprpb.Type,
-	current *exprpb.Type) *exprpb.Type {
+func (c *checker) joinTypes(e ast.Expr, previous, current *types.Type) *types.Type {
 	if previous == nil {
 		return current
 	}
@@ -584,23 +568,23 @@ func (c *checker) joinTypes(loc common.Location,
 		return mostGeneral(previous, current)
 	}
 	if c.dynAggregateLiteralElementTypesEnabled() {
-		return decls.Dyn
+		return types.DynType
 	}
-	c.errors.typeMismatch(loc, previous, current)
-	return decls.Error
+	c.errors.typeMismatch(e.ID(), c.location(e), previous, current)
+	return types.ErrorType
 }
 
 func (c *checker) dynAggregateLiteralElementTypesEnabled() bool {
 	return c.env.aggLitElemType == dynElementType
 }
 
-func (c *checker) newTypeVar() *exprpb.Type {
+func (c *checker) newTypeVar() *types.Type {
 	id := c.freeTypeVarCounter
 	c.freeTypeVarCounter++
-	return decls.NewTypeParamType(fmt.Sprintf("_var%d", id))
+	return types.NewTypeParamType(fmt.Sprintf("_var%d", id))
 }
 
-func (c *checker) isAssignable(t1 *exprpb.Type, t2 *exprpb.Type) bool {
+func (c *checker) isAssignable(t1, t2 *types.Type) bool {
 	subs := isAssignable(c.mappings, t1, t2)
 	if subs != nil {
 		c.mappings = subs
@@ -610,7 +594,7 @@ func (c *checker) isAssignable(t1 *exprpb.Type, t2 *exprpb.Type) bool {
 	return false
 }
 
-func (c *checker) isAssignableList(l1 []*exprpb.Type, l2 []*exprpb.Type) bool {
+func (c *checker) isAssignableList(l1, l2 []*types.Type) bool {
 	subs := isAssignableList(c.mappings, l1, l2)
 	if subs != nil {
 		c.mappings = subs
@@ -620,87 +604,114 @@ func (c *checker) isAssignableList(l1 []*exprpb.Type, l2 []*exprpb.Type) bool {
 	return false
 }
 
-func (c *checker) lookupFieldType(l common.Location, messageType string, fieldName string) (*ref.FieldType, bool) {
-	if _, found := c.env.provider.FindType(messageType); !found {
-		// This should not happen, anyway, report an error.
-		c.errors.unexpectedFailedResolution(l, messageType)
-		return nil, false
-	}
-
-	if ft, found := c.env.provider.FindFieldType(messageType, fieldName); found {
-		return ft, found
+func maybeUnwrapString(e ast.Expr) (string, bool) {
+	switch e.Kind() {
+	case ast.LiteralKind:
+		literal := e.AsLiteral()
+		switch v := literal.(type) {
+		case types.String:
+			return string(v), true
+		}
 	}
-
-	c.errors.undefinedField(l, fieldName)
-	return nil, false
+	return "", false
 }
 
-func (c *checker) setType(e *exprpb.Expr, t *exprpb.Type) {
-	if old, found := c.types[e.GetId()]; found && !proto.Equal(old, t) {
-		c.errors.ReportError(c.location(e),
-			"(Incompatible) Type already exists for expression: %v(%d) old:%v, new:%v", e, e.GetId(), old, t)
+func (c *checker) setType(e ast.Expr, t *types.Type) {
+	if old, found := c.TypeMap()[e.ID()]; found && !old.IsExactType(t) {
+		c.errors.incompatibleType(e.ID(), c.location(e), e, old, t)
 		return
 	}
-	c.types[e.GetId()] = t
+	c.SetType(e.ID(), t)
 }
 
-func (c *checker) getType(e *exprpb.Expr) *exprpb.Type {
-	return c.types[e.GetId()]
+func (c *checker) getType(e ast.Expr) *types.Type {
+	return c.TypeMap()[e.ID()]
 }
 
-func (c *checker) setReference(e *exprpb.Expr, r *exprpb.Reference) {
-	if old, found := c.references[e.GetId()]; found && !proto.Equal(old, r) {
-		c.errors.ReportError(c.location(e),
-			"Reference already exists for expression: %v(%d) old:%v, new:%v", e, e.GetId(), old, r)
+func (c *checker) setReference(e ast.Expr, r *ast.ReferenceInfo) {
+	if old, found := c.ReferenceMap()[e.ID()]; found && !old.Equals(r) {
+		c.errors.referenceRedefinition(e.ID(), c.location(e), e, old, r)
 		return
 	}
-	c.references[e.GetId()] = r
+	c.SetReference(e.ID(), r)
 }
 
-func (c *checker) assertType(e *exprpb.Expr, t *exprpb.Type) {
+func (c *checker) assertType(e ast.Expr, t *types.Type) {
 	if !c.isAssignable(t, c.getType(e)) {
-		c.errors.typeMismatch(c.location(e), t, c.getType(e))
+		c.errors.typeMismatch(e.ID(), c.location(e), t, c.getType(e))
 	}
 }
 
 type overloadResolution struct {
-	Reference *exprpb.Reference
-	Type      *exprpb.Type
+	Type      *types.Type
+	Reference *ast.ReferenceInfo
 }
 
-func newResolution(checkedRef *exprpb.Reference, t *exprpb.Type) *overloadResolution {
+func newResolution(r *ast.ReferenceInfo, t *types.Type) *overloadResolution {
 	return &overloadResolution{
-		Reference: checkedRef,
+		Reference: r,
 		Type:      t,
 	}
 }
 
-func (c *checker) location(e *exprpb.Expr) common.Location {
-	return c.locationByID(e.GetId())
+func (c *checker) location(e ast.Expr) common.Location {
+	return c.locationByID(e.ID())
 }
 
 func (c *checker) locationByID(id int64) common.Location {
-	positions := c.sourceInfo.GetPositions()
-	var line = 1
-	if offset, found := positions[id]; found {
-		col := int(offset)
-		for _, lineOffset := range c.sourceInfo.GetLineOffsets() {
-			if lineOffset < offset {
-				line++
-				col = int(offset - lineOffset)
-			} else {
-				break
-			}
-		}
-		return common.NewLocation(line, col)
+	return c.SourceInfo().GetStartLocation(id)
+}
+
+func (c *checker) lookupFieldType(exprID int64, structType, fieldName string) (*types.Type, bool) {
+	if _, found := c.env.provider.FindStructType(structType); !found {
+		// This should not happen, anyway, report an error.
+		c.errors.unexpectedFailedResolution(exprID, c.locationByID(exprID), structType)
+		return nil, false
+	}
+
+	if ft, found := c.env.provider.FindStructFieldType(structType, fieldName); found {
+		return ft.Type, found
 	}
-	return common.NoLocation
+
+	c.errors.undefinedField(exprID, c.locationByID(exprID), fieldName)
+	return nil, false
 }
 
-func newIdentReference(name string, value *exprpb.Constant) *exprpb.Reference {
-	return &exprpb.Reference{Name: name, Value: value}
+func isWellKnownType(t *types.Type) bool {
+	switch t.Kind() {
+	case types.AnyKind, types.TimestampKind, types.DurationKind, types.DynKind, types.NullTypeKind:
+		return true
+	case types.BoolKind, types.BytesKind, types.DoubleKind, types.IntKind, types.StringKind, types.UintKind:
+		return t.IsAssignableType(types.NullType)
+	case types.ListKind:
+		return t.Parameters()[0] == types.DynType
+	case types.MapKind:
+		return t.Parameters()[0] == types.StringType && t.Parameters()[1] == types.DynType
+	}
+	return false
 }
 
-func newFunctionReference(overloads ...string) *exprpb.Reference {
-	return &exprpb.Reference{OverloadId: overloads}
+func getWellKnownTypeName(t *types.Type) string {
+	if name, found := wellKnownTypes[t.Kind()]; found {
+		return name
+	}
+	return ""
 }
+
+var (
+	wellKnownTypes = map[types.Kind]string{
+		types.AnyKind:       "google.protobuf.Any",
+		types.BoolKind:      "google.protobuf.BoolValue",
+		types.BytesKind:     "google.protobuf.BytesValue",
+		types.DoubleKind:    "google.protobuf.DoubleValue",
+		types.DurationKind:  "google.protobuf.Duration",
+		types.DynKind:       "google.protobuf.Value",
+		types.IntKind:       "google.protobuf.Int64Value",
+		types.ListKind:      "google.protobuf.ListValue",
+		types.NullTypeKind:  "google.protobuf.NullValue",
+		types.MapKind:       "google.protobuf.Struct",
+		types.StringKind:    "google.protobuf.StringValue",
+		types.TimestampKind: "google.protobuf.Timestamp",
+		types.UintKind:      "google.protobuf.UInt64Value",
+	}
+)
diff --git a/vendor/github.com/google/cel-go/checker/cost.go b/vendor/github.com/google/cel-go/checker/cost.go
index 6cf8c4f..0424469 100644
--- a/vendor/github.com/google/cel-go/checker/cost.go
+++ b/vendor/github.com/google/cel-go/checker/cost.go
@@ -18,10 +18,10 @@ import (
 	"math"
 
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/parser"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // WARNING: Any changes to cost calculations in this file require a corresponding change in interpreter/runtimecost.go
@@ -54,9 +54,9 @@ type AstNode interface {
 	// The first path element is a variable. All subsequent path elements are one of: field name, '@items', '@keys', '@values'.
 	Path() []string
 	// Type returns the deduced type of the AstNode.
-	Type() *exprpb.Type
+	Type() *types.Type
 	// Expr returns the expression of the AstNode.
-	Expr() *exprpb.Expr
+	Expr() ast.Expr
 	// ComputedSize returns a size estimate of the AstNode derived from information available in the CEL expression.
 	// For constants and inline list and map declarations, the exact size is returned. For concatenated list, strings
 	// and bytes, the size is derived from the size estimates of the operands. nil is returned if there is no
@@ -66,8 +66,8 @@ type AstNode interface {
 
 type astNode struct {
 	path        []string
-	t           *exprpb.Type
-	expr        *exprpb.Expr
+	t           *types.Type
+	expr        ast.Expr
 	derivedSize *SizeEstimate
 }
 
@@ -75,11 +75,11 @@ func (e astNode) Path() []string {
 	return e.path
 }
 
-func (e astNode) Type() *exprpb.Type {
+func (e astNode) Type() *types.Type {
 	return e.t
 }
 
-func (e astNode) Expr() *exprpb.Expr {
+func (e astNode) Expr() ast.Expr {
 	return e.expr
 }
 
@@ -88,29 +88,27 @@ func (e astNode) ComputedSize() *SizeEstimate {
 		return e.derivedSize
 	}
 	var v uint64
-	switch ek := e.expr.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
-		switch ck := ek.ConstExpr.GetConstantKind().(type) {
-		case *exprpb.Constant_StringValue:
+	switch e.expr.Kind() {
+	case ast.LiteralKind:
+		switch ck := e.expr.AsLiteral().(type) {
+		case types.String:
 			// converting to runes here is an O(n) operation, but
 			// this is consistent with how size is computed at runtime,
 			// and how the language definition defines string size
-			v = uint64(len([]rune(ck.StringValue)))
-		case *exprpb.Constant_BytesValue:
-			v = uint64(len(ck.BytesValue))
-		case *exprpb.Constant_BoolValue, *exprpb.Constant_DoubleValue, *exprpb.Constant_DurationValue,
-			*exprpb.Constant_Int64Value, *exprpb.Constant_TimestampValue, *exprpb.Constant_Uint64Value,
-			*exprpb.Constant_NullValue:
+			v = uint64(len([]rune(ck)))
+		case types.Bytes:
+			v = uint64(len(ck))
+		case types.Bool, types.Double, types.Duration,
+			types.Int, types.Timestamp, types.Uint,
+			types.Null:
 			v = uint64(1)
 		default:
 			return nil
 		}
-	case *exprpb.Expr_ListExpr:
-		v = uint64(len(ek.ListExpr.GetElements()))
-	case *exprpb.Expr_StructExpr:
-		if ek.StructExpr.GetMessageName() == "" {
-			v = uint64(len(ek.StructExpr.GetEntries()))
-		}
+	case ast.ListKind:
+		v = uint64(e.expr.AsList().Size())
+	case ast.MapKind:
+		v = uint64(e.expr.AsMap().Size())
 	default:
 		return nil
 	}
@@ -228,7 +226,7 @@ func addUint64NoOverflow(x, y uint64) uint64 {
 // multiplyUint64NoOverflow multiplies non-negative ints. If the result is exceeds math.MaxUint64, math.MaxUint64
 // is returned.
 func multiplyUint64NoOverflow(x, y uint64) uint64 {
-	if x > 0 && y > 0 && x > math.MaxUint64/y {
+	if y != 0 && x > math.MaxUint64/y {
 		return math.MaxUint64
 	}
 	return x * y
@@ -240,7 +238,11 @@ func multiplyByCostFactor(x uint64, y float64) uint64 {
 	if xFloat > 0 && y > 0 && xFloat > math.MaxUint64/y {
 		return math.MaxUint64
 	}
-	return uint64(math.Ceil(xFloat * y))
+	ceil := math.Ceil(xFloat * y)
+	if ceil >= doubleTwoTo64 {
+		return math.MaxUint64
+	}
+	return uint64(ceil)
 }
 
 var (
@@ -258,16 +260,19 @@ type coster struct {
 	// iterRanges tracks the iterRange of each iterVar.
 	iterRanges iterRangeScopes
 	// computedSizes tracks the computed sizes of call results.
-	computedSizes map[int64]SizeEstimate
-	checkedExpr   *exprpb.CheckedExpr
-	estimator     CostEstimator
+	computedSizes      map[int64]SizeEstimate
+	checkedAST         *ast.AST
+	estimator          CostEstimator
+	overloadEstimators map[string]FunctionEstimator
+	// presenceTestCost will either be a zero or one based on whether has() macros count against cost computations.
+	presenceTestCost CostEstimate
 }
 
 // Use a stack of iterVar -> iterRange Expr Ids to handle shadowed variable names.
 type iterRangeScopes map[string][]int64
 
-func (vs iterRangeScopes) push(varName string, expr *exprpb.Expr) {
-	vs[varName] = append(vs[varName], expr.GetId())
+func (vs iterRangeScopes) push(varName string, expr ast.Expr) {
+	vs[varName] = append(vs[varName], expr.ID())
 }
 
 func (vs iterRangeScopes) pop(varName string) {
@@ -283,37 +288,78 @@ func (vs iterRangeScopes) peek(varName string) (int64, bool) {
 	return 0, false
 }
 
+// CostOption configures flags which affect cost computations.
+type CostOption func(*coster) error
+
+// PresenceTestHasCost determines whether presence testing has a cost of one or zero.
+//
+// Defaults to presence test has a cost of one.
+func PresenceTestHasCost(hasCost bool) CostOption {
+	return func(c *coster) error {
+		if hasCost {
+			c.presenceTestCost = selectAndIdentCost
+			return nil
+		}
+		c.presenceTestCost = CostEstimate{Min: 0, Max: 0}
+		return nil
+	}
+}
+
+// FunctionEstimator provides a CallEstimate given the target and arguments for a specific function, overload pair.
+type FunctionEstimator func(estimator CostEstimator, target *AstNode, args []AstNode) *CallEstimate
+
+// OverloadCostEstimate binds a FunctionCoster to a specific function overload ID.
+//
+// When a OverloadCostEstimate is provided, it will override the cost calculation of the CostEstimator provided to
+// the Cost() call.
+func OverloadCostEstimate(overloadID string, functionCoster FunctionEstimator) CostOption {
+	return func(c *coster) error {
+		c.overloadEstimators[overloadID] = functionCoster
+		return nil
+	}
+}
+
 // Cost estimates the cost of the parsed and type checked CEL expression.
-func Cost(checker *exprpb.CheckedExpr, estimator CostEstimator) CostEstimate {
-	c := coster{
-		checkedExpr:   checker,
-		estimator:     estimator,
-		exprPath:      map[int64][]string{},
-		iterRanges:    map[string][]int64{},
-		computedSizes: map[int64]SizeEstimate{},
+func Cost(checked *ast.AST, estimator CostEstimator, opts ...CostOption) (CostEstimate, error) {
+	c := &coster{
+		checkedAST:         checked,
+		estimator:          estimator,
+		overloadEstimators: map[string]FunctionEstimator{},
+		exprPath:           map[int64][]string{},
+		iterRanges:         map[string][]int64{},
+		computedSizes:      map[int64]SizeEstimate{},
+		presenceTestCost:   CostEstimate{Min: 1, Max: 1},
+	}
+	for _, opt := range opts {
+		err := opt(c)
+		if err != nil {
+			return CostEstimate{}, err
+		}
 	}
-	return c.cost(checker.GetExpr())
+	return c.cost(checked.Expr()), nil
 }
 
-func (c *coster) cost(e *exprpb.Expr) CostEstimate {
+func (c *coster) cost(e ast.Expr) CostEstimate {
 	if e == nil {
 		return CostEstimate{}
 	}
 	var cost CostEstimate
-	switch e.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
+	switch e.Kind() {
+	case ast.LiteralKind:
 		cost = constCost
-	case *exprpb.Expr_IdentExpr:
+	case ast.IdentKind:
 		cost = c.costIdent(e)
-	case *exprpb.Expr_SelectExpr:
+	case ast.SelectKind:
 		cost = c.costSelect(e)
-	case *exprpb.Expr_CallExpr:
+	case ast.CallKind:
 		cost = c.costCall(e)
-	case *exprpb.Expr_ListExpr:
+	case ast.ListKind:
 		cost = c.costCreateList(e)
-	case *exprpb.Expr_StructExpr:
+	case ast.MapKind:
+		cost = c.costCreateMap(e)
+	case ast.StructKind:
 		cost = c.costCreateStruct(e)
-	case *exprpb.Expr_ComprehensionExpr:
+	case ast.ComprehensionKind:
 		cost = c.costComprehension(e)
 	default:
 		return CostEstimate{}
@@ -321,52 +367,51 @@ func (c *coster) cost(e *exprpb.Expr) CostEstimate {
 	return cost
 }
 
-func (c *coster) costIdent(e *exprpb.Expr) CostEstimate {
-	identExpr := e.GetIdentExpr()
-
+func (c *coster) costIdent(e ast.Expr) CostEstimate {
+	identName := e.AsIdent()
 	// build and track the field path
-	if iterRange, ok := c.iterRanges.peek(identExpr.GetName()); ok {
-		switch c.checkedExpr.TypeMap[iterRange].GetTypeKind().(type) {
-		case *exprpb.Type_ListType_:
+	if iterRange, ok := c.iterRanges.peek(identName); ok {
+		switch c.checkedAST.GetType(iterRange).Kind() {
+		case types.ListKind:
 			c.addPath(e, append(c.exprPath[iterRange], "@items"))
-		case *exprpb.Type_MapType_:
+		case types.MapKind:
 			c.addPath(e, append(c.exprPath[iterRange], "@keys"))
 		}
 	} else {
-		c.addPath(e, []string{identExpr.GetName()})
+		c.addPath(e, []string{identName})
 	}
 
 	return selectAndIdentCost
 }
 
-func (c *coster) costSelect(e *exprpb.Expr) CostEstimate {
-	sel := e.GetSelectExpr()
+func (c *coster) costSelect(e ast.Expr) CostEstimate {
+	sel := e.AsSelect()
 	var sum CostEstimate
-	if sel.GetTestOnly() {
+	if sel.IsTestOnly() {
 		// recurse, but do not add any cost
 		// this is equivalent to how evalTestOnly increments the runtime cost counter
 		// but does not add any additional cost for the qualifier, except here we do
 		// the reverse (ident adds cost)
-		sum = sum.Add(c.cost(sel.GetOperand()))
+		sum = sum.Add(c.presenceTestCost)
+		sum = sum.Add(c.cost(sel.Operand()))
 		return sum
 	}
-	sum = sum.Add(c.cost(sel.GetOperand()))
-	targetType := c.getType(sel.GetOperand())
-	switch kindOf(targetType) {
-	case kindMap, kindObject, kindTypeParam:
+	sum = sum.Add(c.cost(sel.Operand()))
+	targetType := c.getType(sel.Operand())
+	switch targetType.Kind() {
+	case types.MapKind, types.StructKind, types.TypeParamKind:
 		sum = sum.Add(selectAndIdentCost)
 	}
 
 	// build and track the field path
-	c.addPath(e, append(c.getPath(sel.GetOperand()), sel.GetField()))
+	c.addPath(e, append(c.getPath(sel.Operand()), sel.FieldName()))
 
 	return sum
 }
 
-func (c *coster) costCall(e *exprpb.Expr) CostEstimate {
-	call := e.GetCallExpr()
-	target := call.GetTarget()
-	args := call.GetArgs()
+func (c *coster) costCall(e ast.Expr) CostEstimate {
+	call := e.AsCall()
+	args := call.Args()
 
 	var sum CostEstimate
 
@@ -377,22 +422,20 @@ func (c *coster) costCall(e *exprpb.Expr) CostEstimate {
 		argTypes[i] = c.newAstNode(arg)
 	}
 
-	ref := c.checkedExpr.ReferenceMap[e.GetId()]
-	if ref == nil || len(ref.GetOverloadId()) == 0 {
+	overloadIDs := c.checkedAST.GetOverloadIDs(e.ID())
+	if len(overloadIDs) == 0 {
 		return CostEstimate{}
 	}
 	var targetType AstNode
-	if target != nil {
-		if call.Target != nil {
-			sum = sum.Add(c.cost(call.GetTarget()))
-			targetType = c.newAstNode(call.GetTarget())
-		}
+	if call.IsMemberFunction() {
+		sum = sum.Add(c.cost(call.Target()))
+		targetType = c.newAstNode(call.Target())
 	}
 	// Pick a cost estimate range that covers all the overload cost estimation ranges
 	fnCost := CostEstimate{Min: uint64(math.MaxUint64), Max: 0}
 	var resultSize *SizeEstimate
-	for _, overload := range ref.GetOverloadId() {
-		overloadCost := c.functionCost(call.GetFunction(), overload, &targetType, argTypes, argCosts)
+	for _, overload := range overloadIDs {
+		overloadCost := c.functionCost(call.FunctionName(), overload, &targetType, argTypes, argCosts)
 		fnCost = fnCost.Union(overloadCost.CostEstimate)
 		if overloadCost.ResultSize != nil {
 			if resultSize == nil {
@@ -415,62 +458,57 @@ func (c *coster) costCall(e *exprpb.Expr) CostEstimate {
 		}
 	}
 	if resultSize != nil {
-		c.computedSizes[e.GetId()] = *resultSize
+		c.computedSizes[e.ID()] = *resultSize
 	}
 	return sum.Add(fnCost)
 }
 
-func (c *coster) costCreateList(e *exprpb.Expr) CostEstimate {
-	create := e.GetListExpr()
+func (c *coster) costCreateList(e ast.Expr) CostEstimate {
+	create := e.AsList()
 	var sum CostEstimate
-	for _, e := range create.GetElements() {
+	for _, e := range create.Elements() {
 		sum = sum.Add(c.cost(e))
 	}
 	return sum.Add(createListBaseCost)
 }
 
-func (c *coster) costCreateStruct(e *exprpb.Expr) CostEstimate {
-	str := e.GetStructExpr()
-	if str.MessageName != "" {
-		return c.costCreateMessage(e)
-	}
-	return c.costCreateMap(e)
-}
-
-func (c *coster) costCreateMap(e *exprpb.Expr) CostEstimate {
-	mapVal := e.GetStructExpr()
+func (c *coster) costCreateMap(e ast.Expr) CostEstimate {
+	mapVal := e.AsMap()
 	var sum CostEstimate
-	for _, ent := range mapVal.GetEntries() {
-		key := ent.GetMapKey()
-		sum = sum.Add(c.cost(key))
-
-		sum = sum.Add(c.cost(ent.GetValue()))
+	for _, ent := range mapVal.Entries() {
+		entry := ent.AsMapEntry()
+		sum = sum.Add(c.cost(entry.Key()))
+		sum = sum.Add(c.cost(entry.Value()))
 	}
 	return sum.Add(createMapBaseCost)
 }
 
-func (c *coster) costCreateMessage(e *exprpb.Expr) CostEstimate {
-	msgVal := e.GetStructExpr()
+func (c *coster) costCreateStruct(e ast.Expr) CostEstimate {
+	msgVal := e.AsStruct()
 	var sum CostEstimate
-	for _, ent := range msgVal.GetEntries() {
-		sum = sum.Add(c.cost(ent.GetValue()))
+	for _, ent := range msgVal.Fields() {
+		field := ent.AsStructField()
+		sum = sum.Add(c.cost(field.Value()))
 	}
 	return sum.Add(createMessageBaseCost)
 }
 
-func (c *coster) costComprehension(e *exprpb.Expr) CostEstimate {
-	comp := e.GetComprehensionExpr()
+func (c *coster) costComprehension(e ast.Expr) CostEstimate {
+	comp := e.AsComprehension()
 	var sum CostEstimate
-	sum = sum.Add(c.cost(comp.GetIterRange()))
-	sum = sum.Add(c.cost(comp.GetAccuInit()))
+	sum = sum.Add(c.cost(comp.IterRange()))
+	sum = sum.Add(c.cost(comp.AccuInit()))
 
 	// Track the iterRange of each IterVar for field path construction
-	c.iterRanges.push(comp.GetIterVar(), comp.GetIterRange())
-	loopCost := c.cost(comp.GetLoopCondition())
-	stepCost := c.cost(comp.GetLoopStep())
-	c.iterRanges.pop(comp.GetIterVar())
-	sum = sum.Add(c.cost(comp.Result))
-	rangeCnt := c.sizeEstimate(c.newAstNode(comp.GetIterRange()))
+	c.iterRanges.push(comp.IterVar(), comp.IterRange())
+	loopCost := c.cost(comp.LoopCondition())
+	stepCost := c.cost(comp.LoopStep())
+	c.iterRanges.pop(comp.IterVar())
+	sum = sum.Add(c.cost(comp.Result()))
+	rangeCnt := c.sizeEstimate(c.newAstNode(comp.IterRange()))
+
+	c.computedSizes[e.ID()] = rangeCnt
+
 	rangeCost := rangeCnt.MultiplyByCost(stepCost.Add(loopCost))
 	sum = sum.Add(rangeCost)
 
@@ -504,17 +542,44 @@ func (c *coster) functionCost(function, overloadID string, target *AstNode, args
 		}
 		return sum
 	}
-
+	if len(c.overloadEstimators) != 0 {
+		if estimator, found := c.overloadEstimators[overloadID]; found {
+			if est := estimator(c.estimator, target, args); est != nil {
+				callEst := *est
+				return CallEstimate{CostEstimate: callEst.Add(argCostSum()), ResultSize: est.ResultSize}
+			}
+		}
+	}
 	if est := c.estimator.EstimateCallCost(function, overloadID, target, args); est != nil {
 		callEst := *est
-		return CallEstimate{CostEstimate: callEst.Add(argCostSum())}
+		return CallEstimate{CostEstimate: callEst.Add(argCostSum()), ResultSize: est.ResultSize}
 	}
 	switch overloadID {
 	// O(n) functions
-	case overloads.StartsWithString, overloads.EndsWithString, overloads.StringToBytes, overloads.BytesToString, overloads.ExtQuoteString, overloads.ExtFormatString:
-		if overloadID == overloads.ExtFormatString {
+	case overloads.ExtFormatString:
+		if target != nil {
+			// ResultSize not calculated because we can't bound the max size.
 			return CallEstimate{CostEstimate: c.sizeEstimate(*target).MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum())}
 		}
+	case overloads.StringToBytes:
+		if len(args) == 1 {
+			sz := c.sizeEstimate(args[0])
+			// ResultSize max is when each char converts to 4 bytes.
+			return CallEstimate{CostEstimate: sz.MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum()), ResultSize: &SizeEstimate{Min: sz.Min, Max: sz.Max * 4}}
+		}
+	case overloads.BytesToString:
+		if len(args) == 1 {
+			sz := c.sizeEstimate(args[0])
+			// ResultSize min is when 4 bytes convert to 1 char.
+			return CallEstimate{CostEstimate: sz.MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum()), ResultSize: &SizeEstimate{Min: sz.Min / 4, Max: sz.Max}}
+		}
+	case overloads.ExtQuoteString:
+		if len(args) == 1 {
+			sz := c.sizeEstimate(args[0])
+			// ResultSize max is when each char is escaped. 2 quote chars always added.
+			return CallEstimate{CostEstimate: sz.MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum()), ResultSize: &SizeEstimate{Min: sz.Min + 2, Max: sz.Max*2 + 2}}
+		}
+	case overloads.StartsWithString, overloads.EndsWithString:
 		if len(args) == 1 {
 			return CallEstimate{CostEstimate: c.sizeEstimate(args[0]).MultiplyByCostFactor(common.StringTraversalCostFactor).Add(argCostSum())}
 		}
@@ -595,44 +660,46 @@ func (c *coster) functionCost(function, overloadID string, target *AstNode, args
 	return CallEstimate{CostEstimate: CostEstimate{Min: 1, Max: 1}.Add(argCostSum())}
 }
 
-func (c *coster) getType(e *exprpb.Expr) *exprpb.Type {
-	return c.checkedExpr.TypeMap[e.GetId()]
+func (c *coster) getType(e ast.Expr) *types.Type {
+	return c.checkedAST.GetType(e.ID())
 }
 
-func (c *coster) getPath(e *exprpb.Expr) []string {
-	return c.exprPath[e.GetId()]
+func (c *coster) getPath(e ast.Expr) []string {
+	return c.exprPath[e.ID()]
 }
 
-func (c *coster) addPath(e *exprpb.Expr, path []string) {
-	c.exprPath[e.GetId()] = path
+func (c *coster) addPath(e ast.Expr, path []string) {
+	c.exprPath[e.ID()] = path
 }
 
-func (c *coster) newAstNode(e *exprpb.Expr) *astNode {
+func (c *coster) newAstNode(e ast.Expr) *astNode {
 	path := c.getPath(e)
 	if len(path) > 0 && path[0] == parser.AccumulatorName {
 		// only provide paths to root vars; omit accumulator vars
 		path = nil
 	}
 	var derivedSize *SizeEstimate
-	if size, ok := c.computedSizes[e.GetId()]; ok {
+	if size, ok := c.computedSizes[e.ID()]; ok {
 		derivedSize = &size
 	}
-	return &astNode{path: path, t: c.getType(e), expr: e, derivedSize: derivedSize}
+	return &astNode{
+		path:        path,
+		t:           c.getType(e),
+		expr:        e,
+		derivedSize: derivedSize}
 }
 
 // isScalar returns true if the given type is known to be of a constant size at
 // compile time. isScalar will return false for strings (they are variable-width)
 // in addition to protobuf.Any and protobuf.Value (their size is not knowable at compile time).
-func isScalar(t *exprpb.Type) bool {
-	switch kindOf(t) {
-	case kindPrimitive:
-		if t.GetPrimitive() != exprpb.Type_STRING && t.GetPrimitive() != exprpb.Type_BYTES {
-			return true
-		}
-	case kindWellKnown:
-		if t.GetWellKnown() == exprpb.Type_DURATION || t.GetWellKnown() == exprpb.Type_TIMESTAMP {
-			return true
-		}
+func isScalar(t *types.Type) bool {
+	switch t.Kind() {
+	case types.BoolKind, types.DoubleKind, types.DurationKind, types.IntKind, types.TimestampKind, types.UintKind:
+		return true
 	}
 	return false
 }
+
+var (
+	doubleTwoTo64 = math.Ldexp(1.0, 64)
+)
diff --git a/vendor/github.com/google/cel-go/checker/decls/BUILD.bazel b/vendor/github.com/google/cel-go/checker/decls/BUILD.bazel
index 5a24f1d..a6b0be2 100644
--- a/vendor/github.com/google/cel-go/checker/decls/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/checker/decls/BUILD.bazel
@@ -9,11 +9,10 @@ go_library(
     name = "go_default_library",
     srcs = [
         "decls.go",
-        "scopes.go",
     ],
     importpath = "github.com/google/cel-go/checker/decls",
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//types/known/emptypb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
     ],
diff --git a/vendor/github.com/google/cel-go/checker/decls/decls.go b/vendor/github.com/google/cel-go/checker/decls/decls.go
index 0d91bef..c0e5de4 100644
--- a/vendor/github.com/google/cel-go/checker/decls/decls.go
+++ b/vendor/github.com/google/cel-go/checker/decls/decls.go
@@ -67,7 +67,7 @@ func NewAbstractType(name string, paramTypes ...*exprpb.Type) *exprpb.Type {
 // NewOptionalType constructs an abstract type indicating that the parameterized type
 // may be contained within the object.
 func NewOptionalType(paramType *exprpb.Type) *exprpb.Type {
-	return NewAbstractType("optional", paramType)
+	return NewAbstractType("optional_type", paramType)
 }
 
 // NewFunctionType creates a function invocation contract, typically only used
diff --git a/vendor/github.com/google/cel-go/checker/env.go b/vendor/github.com/google/cel-go/checker/env.go
index c7eeb04..d5ac050 100644
--- a/vendor/github.com/google/cel-go/checker/env.go
+++ b/vendor/github.com/google/cel-go/checker/env.go
@@ -18,17 +18,11 @@ import (
 	"fmt"
 	"strings"
 
-	"google.golang.org/protobuf/proto"
-
-	"github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/decls"
 	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types"
-	"github.com/google/cel-go/common/types/pb"
-	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/parser"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 type aggregateLiteralElementType int
@@ -76,15 +70,15 @@ var (
 // which can be used to assist with type-checking.
 type Env struct {
 	container           *containers.Container
-	provider            ref.TypeProvider
-	declarations        *decls.Scopes
+	provider            types.Provider
+	declarations        *Scopes
 	aggLitElemType      aggregateLiteralElementType
 	filteredOverloadIDs map[string]struct{}
 }
 
 // NewEnv returns a new *Env with the given parameters.
-func NewEnv(container *containers.Container, provider ref.TypeProvider, opts ...Option) (*Env, error) {
-	declarations := decls.NewScopes()
+func NewEnv(container *containers.Container, provider types.Provider, opts ...Option) (*Env, error) {
+	declarations := newScopes()
 	declarations.Push()
 
 	envOptions := &options{}
@@ -113,24 +107,31 @@ func NewEnv(container *containers.Container, provider ref.TypeProvider, opts ...
 	}, nil
 }
 
-// Add adds new Decl protos to the Env.
-// Returns an error for identifier redeclarations.
-func (e *Env) Add(decls ...*exprpb.Decl) error {
+// AddIdents configures the checker with a list of variable declarations.
+//
+// If there are overlapping declarations, the method will error.
+func (e *Env) AddIdents(declarations ...*decls.VariableDecl) error {
 	errMsgs := make([]errorMsg, 0)
-	for _, decl := range decls {
-		switch decl.DeclKind.(type) {
-		case *exprpb.Decl_Ident:
-			errMsgs = append(errMsgs, e.addIdent(sanitizeIdent(decl)))
-		case *exprpb.Decl_Function:
-			errMsgs = append(errMsgs, e.setFunction(sanitizeFunction(decl))...)
-		}
+	for _, d := range declarations {
+		errMsgs = append(errMsgs, e.addIdent(d))
+	}
+	return formatError(errMsgs)
+}
+
+// AddFunctions configures the checker with a list of function declarations.
+//
+// If there are overlapping declarations, the method will error.
+func (e *Env) AddFunctions(declarations ...*decls.FunctionDecl) error {
+	errMsgs := make([]errorMsg, 0)
+	for _, d := range declarations {
+		errMsgs = append(errMsgs, e.setFunction(d)...)
 	}
 	return formatError(errMsgs)
 }
 
 // LookupIdent returns a Decl proto for typeName as an identifier in the Env.
 // Returns nil if no such identifier is found in the Env.
-func (e *Env) LookupIdent(name string) *exprpb.Decl {
+func (e *Env) LookupIdent(name string) *decls.VariableDecl {
 	for _, candidate := range e.container.ResolveCandidateNames(name) {
 		if ident := e.declarations.FindIdent(candidate); ident != nil {
 			return ident
@@ -139,20 +140,24 @@ func (e *Env) LookupIdent(name string) *exprpb.Decl {
 		// Next try to import the name as a reference to a message type. If found,
 		// the declaration is added to the outest (global) scope of the
 		// environment, so next time we can access it faster.
-		if t, found := e.provider.FindType(candidate); found {
-			decl := decls.NewVar(candidate, t)
+		if t, found := e.provider.FindStructType(candidate); found {
+			decl := decls.NewVariable(candidate, t)
 			e.declarations.AddIdent(decl)
 			return decl
 		}
 
+		if i, found := e.provider.FindIdent(candidate); found {
+			if t, ok := i.(*types.Type); ok {
+				decl := decls.NewVariable(candidate, types.NewTypeTypeWithParam(t))
+				e.declarations.AddIdent(decl)
+				return decl
+			}
+		}
+
 		// Next try to import this as an enum value by splitting the name in a type prefix and
 		// the enum inside.
 		if enumValue := e.provider.EnumValue(candidate); enumValue.Type() != types.ErrType {
-			decl := decls.NewIdent(candidate,
-				decls.Int,
-				&exprpb.Constant{
-					ConstantKind: &exprpb.Constant_Int64Value{
-						Int64Value: int64(enumValue.(types.Int))}})
+			decl := decls.NewConstant(candidate, types.IntType, enumValue)
 			e.declarations.AddIdent(decl)
 			return decl
 		}
@@ -162,7 +167,7 @@ func (e *Env) LookupIdent(name string) *exprpb.Decl {
 
 // LookupFunction returns a Decl proto for typeName as a function in env.
 // Returns nil if no such function is found in env.
-func (e *Env) LookupFunction(name string) *exprpb.Decl {
+func (e *Env) LookupFunction(name string) *decls.FunctionDecl {
 	for _, candidate := range e.container.ResolveCandidateNames(name) {
 		if fn := e.declarations.FindFunction(candidate); fn != nil {
 			return fn
@@ -171,88 +176,46 @@ func (e *Env) LookupFunction(name string) *exprpb.Decl {
 	return nil
 }
 
-// addOverload adds overload to function declaration f.
-// Returns one or more errorMsg values if the overload overlaps with an existing overload or macro.
-func (e *Env) addOverload(f *exprpb.Decl, overload *exprpb.Decl_FunctionDecl_Overload) []errorMsg {
-	errMsgs := make([]errorMsg, 0)
-	function := f.GetFunction()
-	emptyMappings := newMapping()
-	overloadFunction := decls.NewFunctionType(overload.GetResultType(),
-		overload.GetParams()...)
-	overloadErased := substitute(emptyMappings, overloadFunction, true)
-	for _, existing := range function.GetOverloads() {
-		existingFunction := decls.NewFunctionType(existing.GetResultType(), existing.GetParams()...)
-		existingErased := substitute(emptyMappings, existingFunction, true)
-		overlap := isAssignable(emptyMappings, overloadErased, existingErased) != nil ||
-			isAssignable(emptyMappings, existingErased, overloadErased) != nil
-		if overlap &&
-			overload.GetIsInstanceFunction() == existing.GetIsInstanceFunction() {
-			errMsgs = append(errMsgs,
-				overlappingOverloadError(f.Name,
-					overload.GetOverloadId(), overloadFunction,
-					existing.GetOverloadId(), existingFunction))
-		}
-	}
-
-	for _, macro := range parser.AllMacros {
-		if macro.Function() == f.Name &&
-			macro.IsReceiverStyle() == overload.GetIsInstanceFunction() &&
-			macro.ArgCount() == len(overload.GetParams()) {
-			errMsgs = append(errMsgs, overlappingMacroError(f.Name, macro.ArgCount()))
-		}
-	}
-	if len(errMsgs) > 0 {
-		return errMsgs
-	}
-	function.Overloads = append(function.GetOverloads(), overload)
-	return errMsgs
-}
-
 // setFunction adds the function Decl to the Env.
 // Adds a function decl if one doesn't already exist, then adds all overloads from the Decl.
 // If overload overlaps with an existing overload, adds to the errors  in the Env instead.
-func (e *Env) setFunction(decl *exprpb.Decl) []errorMsg {
-	errorMsgs := make([]errorMsg, 0)
-	overloads := decl.GetFunction().GetOverloads()
-	current := e.declarations.FindFunction(decl.Name)
-	if current == nil {
-		//Add the function declaration without overloads and check the overloads below.
-		current = decls.NewFunction(decl.Name)
-	} else {
-		existingOverloads := map[string]*exprpb.Decl_FunctionDecl_Overload{}
-		for _, overload := range current.GetFunction().GetOverloads() {
-			existingOverloads[overload.GetOverloadId()] = overload
+func (e *Env) setFunction(fn *decls.FunctionDecl) []errorMsg {
+	errMsgs := make([]errorMsg, 0)
+	current := e.declarations.FindFunction(fn.Name())
+	if current != nil {
+		var err error
+		current, err = current.Merge(fn)
+		if err != nil {
+			return append(errMsgs, errorMsg(err.Error()))
 		}
-		newOverloads := []*exprpb.Decl_FunctionDecl_Overload{}
-		for _, overload := range overloads {
-			existing, found := existingOverloads[overload.GetOverloadId()]
-			if !found || !proto.Equal(existing, overload) {
-				newOverloads = append(newOverloads, overload)
+	} else {
+		current = fn
+	}
+	for _, overload := range current.OverloadDecls() {
+		for _, macro := range parser.AllMacros {
+			if macro.Function() == current.Name() &&
+				macro.IsReceiverStyle() == overload.IsMemberFunction() &&
+				macro.ArgCount() == len(overload.ArgTypes()) {
+				errMsgs = append(errMsgs, overlappingMacroError(current.Name(), macro.ArgCount()))
 			}
 		}
-		overloads = newOverloads
-		if len(newOverloads) == 0 {
-			return errorMsgs
+		if len(errMsgs) > 0 {
+			return errMsgs
 		}
-		// Copy on write since we don't know where this original definition came from.
-		current = proto.Clone(current).(*exprpb.Decl)
 	}
 	e.declarations.SetFunction(current)
-	for _, overload := range overloads {
-		errorMsgs = append(errorMsgs, e.addOverload(current, overload)...)
-	}
-	return errorMsgs
+	return errMsgs
 }
 
 // addIdent adds the Decl to the declarations in the Env.
 // Returns a non-empty errorMsg if the identifier is already declared in the scope.
-func (e *Env) addIdent(decl *exprpb.Decl) errorMsg {
-	current := e.declarations.FindIdentInScope(decl.Name)
+func (e *Env) addIdent(decl *decls.VariableDecl) errorMsg {
+	current := e.declarations.FindIdentInScope(decl.Name())
 	if current != nil {
-		if proto.Equal(current, decl) {
+		if current.DeclarationIsEquivalent(decl) {
 			return ""
 		}
-		return overlappingIdentifierError(decl.Name)
+		return overlappingIdentifierError(decl.Name())
 	}
 	e.declarations.AddIdent(decl)
 	return ""
@@ -264,86 +227,9 @@ func (e *Env) isOverloadDisabled(overloadID string) bool {
 	return found
 }
 
-// sanitizeFunction replaces well-known types referenced by message name with their equivalent
-// CEL built-in type instances.
-func sanitizeFunction(decl *exprpb.Decl) *exprpb.Decl {
-	fn := decl.GetFunction()
-	// Determine whether the declaration requires replacements from proto-based message type
-	// references to well-known CEL type references.
-	var needsSanitizing bool
-	for _, o := range fn.GetOverloads() {
-		if isObjectWellKnownType(o.GetResultType()) {
-			needsSanitizing = true
-			break
-		}
-		for _, p := range o.GetParams() {
-			if isObjectWellKnownType(p) {
-				needsSanitizing = true
-				break
-			}
-		}
-	}
-
-	// Early return if the declaration requires no modification.
-	if !needsSanitizing {
-		return decl
-	}
-
-	// Sanitize all of the overloads if any overload requires an update to its type references.
-	overloads := make([]*exprpb.Decl_FunctionDecl_Overload, len(fn.GetOverloads()))
-	for i, o := range fn.GetOverloads() {
-		rt := o.GetResultType()
-		if isObjectWellKnownType(rt) {
-			rt = getObjectWellKnownType(rt)
-		}
-		params := make([]*exprpb.Type, len(o.GetParams()))
-		copy(params, o.GetParams())
-		for j, p := range params {
-			if isObjectWellKnownType(p) {
-				params[j] = getObjectWellKnownType(p)
-			}
-		}
-		// If sanitized, replace the overload definition.
-		if o.IsInstanceFunction {
-			overloads[i] =
-				decls.NewInstanceOverload(o.GetOverloadId(), params, rt)
-		} else {
-			overloads[i] =
-				decls.NewOverload(o.GetOverloadId(), params, rt)
-		}
-	}
-	return decls.NewFunction(decl.GetName(), overloads...)
-}
-
-// sanitizeIdent replaces the identifier's well-known types referenced by message name with
-// references to CEL built-in type instances.
-func sanitizeIdent(decl *exprpb.Decl) *exprpb.Decl {
-	id := decl.GetIdent()
-	t := id.GetType()
-	if !isObjectWellKnownType(t) {
-		return decl
-	}
-	return decls.NewIdent(decl.GetName(), getObjectWellKnownType(t), id.GetValue())
-}
-
-// isObjectWellKnownType returns true if the input type is an OBJECT type with a message name
-// that corresponds the message name of a built-in CEL type.
-func isObjectWellKnownType(t *exprpb.Type) bool {
-	if kindOf(t) != kindObject {
-		return false
-	}
-	_, found := pb.CheckedWellKnowns[t.GetMessageType()]
-	return found
-}
-
-// getObjectWellKnownType returns the built-in CEL type declaration for input type's message name.
-func getObjectWellKnownType(t *exprpb.Type) *exprpb.Type {
-	return pb.CheckedWellKnowns[t.GetMessageType()]
-}
-
 // validatedDeclarations returns a reference to the validated variable and function declaration scope stack.
 // must be copied before use.
-func (e *Env) validatedDeclarations() *decls.Scopes {
+func (e *Env) validatedDeclarations() *Scopes {
 	return e.declarations
 }
 
@@ -377,19 +263,6 @@ func overlappingIdentifierError(name string) errorMsg {
 	return errorMsg(fmt.Sprintf("overlapping identifier for name '%s'", name))
 }
 
-func overlappingOverloadError(name string,
-	overloadID1 string, f1 *exprpb.Type,
-	overloadID2 string, f2 *exprpb.Type) errorMsg {
-	return errorMsg(fmt.Sprintf(
-		"overlapping overload for name '%s' (type '%s' with overloadId: '%s' "+
-			"cannot be distinguished from '%s' with overloadId: '%s')",
-		name,
-		FormatCheckedType(f1),
-		overloadID1,
-		FormatCheckedType(f2),
-		overloadID2))
-}
-
 func overlappingMacroError(name string, argCount int) errorMsg {
 	return errorMsg(fmt.Sprintf(
 		"overlapping macro for name '%s' with %d args", name, argCount))
diff --git a/vendor/github.com/google/cel-go/checker/errors.go b/vendor/github.com/google/cel-go/checker/errors.go
index 0014f9a..8b3bf0b 100644
--- a/vendor/github.com/google/cel-go/checker/errors.go
+++ b/vendor/github.com/google/cel-go/checker/errors.go
@@ -16,81 +16,73 @@ package checker
 
 import (
 	"github.com/google/cel-go/common"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
 )
 
 // typeErrors is a specialization of Errors.
 type typeErrors struct {
-	*common.Errors
+	errs *common.Errors
+}
+
+func (e *typeErrors) fieldTypeMismatch(id int64, l common.Location, name string, field, value *types.Type) {
+	e.errs.ReportErrorAtID(id, l, "expected type of field '%s' is '%s' but provided type is '%s'",
+		name, FormatCELType(field), FormatCELType(value))
+}
+
+func (e *typeErrors) incompatibleType(id int64, l common.Location, ex ast.Expr, prev, next *types.Type) {
+	e.errs.ReportErrorAtID(id, l,
+		"incompatible type already exists for expression: %v(%d) old:%v, new:%v", ex, ex.ID(), prev, next)
+}
+
+func (e *typeErrors) noMatchingOverload(id int64, l common.Location, name string, args []*types.Type, isInstance bool) {
+	signature := formatFunctionDeclType(nil, args, isInstance)
+	e.errs.ReportErrorAtID(id, l, "found no matching overload for '%s' applied to '%s'", name, signature)
 }
 
-func (e *typeErrors) undeclaredReference(l common.Location, container string, name string) {
-	e.ReportError(l, "undeclared reference to '%s' (in container '%s')", name, container)
+func (e *typeErrors) notAComprehensionRange(id int64, l common.Location, t *types.Type) {
+	e.errs.ReportErrorAtID(id, l, "expression of type '%s' cannot be range of a comprehension (must be list, map, or dynamic)",
+		FormatCELType(t))
 }
 
-func (e *typeErrors) typeDoesNotSupportFieldSelection(l common.Location, t *exprpb.Type) {
-	e.ReportError(l, "type '%s' does not support field selection", t)
+func (e *typeErrors) notAnOptionalFieldSelection(id int64, l common.Location, field ast.Expr) {
+	e.errs.ReportErrorAtID(id, l, "unsupported optional field selection: %v", field)
 }
 
-func (e *typeErrors) undefinedField(l common.Location, field string) {
-	e.ReportError(l, "undefined field '%s'", field)
+func (e *typeErrors) notAType(id int64, l common.Location, typeName string) {
+	e.errs.ReportErrorAtID(id, l, "'%s' is not a type", typeName)
 }
 
-func (e *typeErrors) noMatchingOverload(l common.Location, name string, args []*exprpb.Type, isInstance bool) {
-	signature := formatFunction(nil, args, isInstance)
-	e.ReportError(l, "found no matching overload for '%s' applied to '%s'", name, signature)
+func (e *typeErrors) notAMessageType(id int64, l common.Location, typeName string) {
+	e.errs.ReportErrorAtID(id, l, "'%s' is not a message type", typeName)
 }
 
-func (e *typeErrors) notAType(l common.Location, t *exprpb.Type) {
-	e.ReportError(l, "'%s(%v)' is not a type", FormatCheckedType(t), t)
+func (e *typeErrors) referenceRedefinition(id int64, l common.Location, ex ast.Expr, prev, next *ast.ReferenceInfo) {
+	e.errs.ReportErrorAtID(id, l,
+		"reference already exists for expression: %v(%d) old:%v, new:%v", ex, ex.ID(), prev, next)
 }
 
-func (e *typeErrors) notAMessageType(l common.Location, t *exprpb.Type) {
-	e.ReportError(l, "'%s' is not a message type", FormatCheckedType(t))
+func (e *typeErrors) typeDoesNotSupportFieldSelection(id int64, l common.Location, t *types.Type) {
+	e.errs.ReportErrorAtID(id, l, "type '%s' does not support field selection", FormatCELType(t))
 }
 
-func (e *typeErrors) fieldTypeMismatch(l common.Location, name string, field *exprpb.Type, value *exprpb.Type) {
-	e.ReportError(l, "expected type of field '%s' is '%s' but provided type is '%s'",
-		name, FormatCheckedType(field), FormatCheckedType(value))
+func (e *typeErrors) typeMismatch(id int64, l common.Location, expected, actual *types.Type) {
+	e.errs.ReportErrorAtID(id, l, "expected type '%s' but found '%s'",
+		FormatCELType(expected), FormatCELType(actual))
 }
 
-func (e *typeErrors) unexpectedFailedResolution(l common.Location, typeName string) {
-	e.ReportError(l, "[internal] unexpected failed resolution of '%s'", typeName)
+func (e *typeErrors) undefinedField(id int64, l common.Location, field string) {
+	e.errs.ReportErrorAtID(id, l, "undefined field '%s'", field)
 }
 
-func (e *typeErrors) notAComprehensionRange(l common.Location, t *exprpb.Type) {
-	e.ReportError(l, "expression of type '%s' cannot be range of a comprehension (must be list, map, or dynamic)",
-		FormatCheckedType(t))
+func (e *typeErrors) undeclaredReference(id int64, l common.Location, container string, name string) {
+	e.errs.ReportErrorAtID(id, l, "undeclared reference to '%s' (in container '%s')", name, container)
 }
 
-func (e *typeErrors) typeMismatch(l common.Location, expected *exprpb.Type, actual *exprpb.Type) {
-	e.ReportError(l, "expected type '%s' but found '%s'",
-		FormatCheckedType(expected), FormatCheckedType(actual))
+func (e *typeErrors) unexpectedFailedResolution(id int64, l common.Location, typeName string) {
+	e.errs.ReportErrorAtID(id, l, "unexpected failed resolution of '%s'", typeName)
 }
 
-func formatFunction(resultType *exprpb.Type, argTypes []*exprpb.Type, isInstance bool) string {
-	result := ""
-	if isInstance {
-		target := argTypes[0]
-		argTypes = argTypes[1:]
-
-		result += FormatCheckedType(target)
-		result += "."
-	}
-
-	result += "("
-	for i, arg := range argTypes {
-		if i > 0 {
-			result += ", "
-		}
-		result += FormatCheckedType(arg)
-	}
-	result += ")"
-	if resultType != nil {
-		result += " -> "
-		result += FormatCheckedType(resultType)
-	}
-
-	return result
+func (e *typeErrors) unexpectedASTType(id int64, l common.Location, kind, typeName string) {
+	e.errs.ReportErrorAtID(id, l, "unexpected %s type: %v", kind, typeName)
 }
diff --git a/vendor/github.com/google/cel-go/checker/format.go b/vendor/github.com/google/cel-go/checker/format.go
new file mode 100644
index 0000000..9584290
--- /dev/null
+++ b/vendor/github.com/google/cel-go/checker/format.go
@@ -0,0 +1,216 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checker
+
+import (
+	"fmt"
+	"strings"
+
+	chkdecls "github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/types"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+const (
+	kindUnknown = iota + 1
+	kindError
+	kindFunction
+	kindDyn
+	kindPrimitive
+	kindWellKnown
+	kindWrapper
+	kindNull
+	kindAbstract
+	kindType
+	kindList
+	kindMap
+	kindObject
+	kindTypeParam
+)
+
+// FormatCheckedType converts a type message into a string representation.
+func FormatCheckedType(t *exprpb.Type) string {
+	switch kindOf(t) {
+	case kindDyn:
+		return "dyn"
+	case kindFunction:
+		return formatFunctionExprType(t.GetFunction().GetResultType(),
+			t.GetFunction().GetArgTypes(),
+			false)
+	case kindList:
+		return fmt.Sprintf("list(%s)", FormatCheckedType(t.GetListType().GetElemType()))
+	case kindObject:
+		return t.GetMessageType()
+	case kindMap:
+		return fmt.Sprintf("map(%s, %s)",
+			FormatCheckedType(t.GetMapType().GetKeyType()),
+			FormatCheckedType(t.GetMapType().GetValueType()))
+	case kindNull:
+		return "null"
+	case kindPrimitive:
+		switch t.GetPrimitive() {
+		case exprpb.Type_UINT64:
+			return "uint"
+		case exprpb.Type_INT64:
+			return "int"
+		}
+		return strings.Trim(strings.ToLower(t.GetPrimitive().String()), " ")
+	case kindType:
+		if t.GetType() == nil || t.GetType().GetTypeKind() == nil {
+			return "type"
+		}
+		return fmt.Sprintf("type(%s)", FormatCheckedType(t.GetType()))
+	case kindWellKnown:
+		switch t.GetWellKnown() {
+		case exprpb.Type_ANY:
+			return "any"
+		case exprpb.Type_DURATION:
+			return "duration"
+		case exprpb.Type_TIMESTAMP:
+			return "timestamp"
+		}
+	case kindWrapper:
+		return fmt.Sprintf("wrapper(%s)",
+			FormatCheckedType(chkdecls.NewPrimitiveType(t.GetWrapper())))
+	case kindError:
+		return "!error!"
+	case kindTypeParam:
+		return t.GetTypeParam()
+	case kindAbstract:
+		at := t.GetAbstractType()
+		params := at.GetParameterTypes()
+		paramStrs := make([]string, len(params))
+		for i, p := range params {
+			paramStrs[i] = FormatCheckedType(p)
+		}
+		return fmt.Sprintf("%s(%s)", at.GetName(), strings.Join(paramStrs, ", "))
+	}
+	return t.String()
+}
+
+type formatter func(any) string
+
+// FormatCELType formats a types.Type value to a string representation.
+//
+// The type formatting is identical to FormatCheckedType.
+func FormatCELType(t any) string {
+	dt := t.(*types.Type)
+	switch dt.Kind() {
+	case types.AnyKind:
+		return "any"
+	case types.DurationKind:
+		return "duration"
+	case types.ErrorKind:
+		return "!error!"
+	case types.NullTypeKind:
+		return "null"
+	case types.TimestampKind:
+		return "timestamp"
+	case types.TypeParamKind:
+		return dt.TypeName()
+	case types.OpaqueKind:
+		if dt.TypeName() == "function" {
+			// There is no explicit function type in the new types representation, so information like
+			// whether the function is a member function is absent.
+			return formatFunctionDeclType(dt.Parameters()[0], dt.Parameters()[1:], false)
+		}
+	case types.UnspecifiedKind:
+		return ""
+	}
+	if len(dt.Parameters()) == 0 {
+		return dt.DeclaredTypeName()
+	}
+	paramTypeNames := make([]string, 0, len(dt.Parameters()))
+	for _, p := range dt.Parameters() {
+		paramTypeNames = append(paramTypeNames, FormatCELType(p))
+	}
+	return fmt.Sprintf("%s(%s)", dt.TypeName(), strings.Join(paramTypeNames, ", "))
+}
+
+func formatExprType(t any) string {
+	if t == nil {
+		return ""
+	}
+	return FormatCheckedType(t.(*exprpb.Type))
+}
+
+func formatFunctionExprType(resultType *exprpb.Type, argTypes []*exprpb.Type, isInstance bool) string {
+	return formatFunctionInternal[*exprpb.Type](resultType, argTypes, isInstance, formatExprType)
+}
+
+func formatFunctionDeclType(resultType *types.Type, argTypes []*types.Type, isInstance bool) string {
+	return formatFunctionInternal[*types.Type](resultType, argTypes, isInstance, FormatCELType)
+}
+
+func formatFunctionInternal[T any](resultType T, argTypes []T, isInstance bool, format formatter) string {
+	result := ""
+	if isInstance {
+		target := argTypes[0]
+		argTypes = argTypes[1:]
+		result += format(target)
+		result += "."
+	}
+	result += "("
+	for i, arg := range argTypes {
+		if i > 0 {
+			result += ", "
+		}
+		result += format(arg)
+	}
+	result += ")"
+	rt := format(resultType)
+	if rt != "" {
+		result += " -> "
+		result += rt
+	}
+	return result
+}
+
+// kindOf returns the kind of the type as defined in the checked.proto.
+func kindOf(t *exprpb.Type) int {
+	if t == nil || t.TypeKind == nil {
+		return kindUnknown
+	}
+	switch t.GetTypeKind().(type) {
+	case *exprpb.Type_Error:
+		return kindError
+	case *exprpb.Type_Function:
+		return kindFunction
+	case *exprpb.Type_Dyn:
+		return kindDyn
+	case *exprpb.Type_Primitive:
+		return kindPrimitive
+	case *exprpb.Type_WellKnown:
+		return kindWellKnown
+	case *exprpb.Type_Wrapper:
+		return kindWrapper
+	case *exprpb.Type_Null:
+		return kindNull
+	case *exprpb.Type_Type:
+		return kindType
+	case *exprpb.Type_ListType_:
+		return kindList
+	case *exprpb.Type_MapType_:
+		return kindMap
+	case *exprpb.Type_MessageType:
+		return kindObject
+	case *exprpb.Type_TypeParam:
+		return kindTypeParam
+	case *exprpb.Type_AbstractType_:
+		return kindAbstract
+	}
+	return kindUnknown
+}
diff --git a/vendor/github.com/google/cel-go/checker/mapping.go b/vendor/github.com/google/cel-go/checker/mapping.go
index fbc55a2..8163a90 100644
--- a/vendor/github.com/google/cel-go/checker/mapping.go
+++ b/vendor/github.com/google/cel-go/checker/mapping.go
@@ -15,25 +15,25 @@
 package checker
 
 import (
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/types"
 )
 
 type mapping struct {
-	mapping map[string]*exprpb.Type
+	mapping map[string]*types.Type
 }
 
 func newMapping() *mapping {
 	return &mapping{
-		mapping: make(map[string]*exprpb.Type),
+		mapping: make(map[string]*types.Type),
 	}
 }
 
-func (m *mapping) add(from *exprpb.Type, to *exprpb.Type) {
-	m.mapping[typeKey(from)] = to
+func (m *mapping) add(from, to *types.Type) {
+	m.mapping[FormatCELType(from)] = to
 }
 
-func (m *mapping) find(from *exprpb.Type) (*exprpb.Type, bool) {
-	if r, found := m.mapping[typeKey(from)]; found {
+func (m *mapping) find(from *types.Type) (*types.Type, bool) {
+	if r, found := m.mapping[FormatCELType(from)]; found {
 		return r, found
 	}
 	return nil, false
diff --git a/vendor/github.com/google/cel-go/checker/options.go b/vendor/github.com/google/cel-go/checker/options.go
index cded00a..0560c38 100644
--- a/vendor/github.com/google/cel-go/checker/options.go
+++ b/vendor/github.com/google/cel-go/checker/options.go
@@ -14,12 +14,10 @@
 
 package checker
 
-import "github.com/google/cel-go/checker/decls"
-
 type options struct {
 	crossTypeNumericComparisons  bool
 	homogeneousAggregateLiterals bool
-	validatedDeclarations        *decls.Scopes
+	validatedDeclarations        *Scopes
 }
 
 // Option is a functional option for configuring the type-checker
@@ -34,15 +32,6 @@ func CrossTypeNumericComparisons(enabled bool) Option {
 	}
 }
 
-// HomogeneousAggregateLiterals toggles support for constructing lists and maps whose elements all
-// have the same type.
-func HomogeneousAggregateLiterals(enabled bool) Option {
-	return func(opts *options) error {
-		opts.homogeneousAggregateLiterals = enabled
-		return nil
-	}
-}
-
 // ValidatedDeclarations provides a references to validated declarations which will be copied
 // into new checker instances.
 func ValidatedDeclarations(env *Env) Option {
diff --git a/vendor/github.com/google/cel-go/checker/printer.go b/vendor/github.com/google/cel-go/checker/printer.go
index 0cecc52..7a3984f 100644
--- a/vendor/github.com/google/cel-go/checker/printer.go
+++ b/vendor/github.com/google/cel-go/checker/printer.go
@@ -15,39 +15,42 @@
 package checker
 
 import (
-	"github.com/google/cel-go/common/debug"
+	"sort"
 
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/debug"
 )
 
 type semanticAdorner struct {
-	checks *exprpb.CheckedExpr
+	checked *ast.AST
 }
 
 var _ debug.Adorner = &semanticAdorner{}
 
 func (a *semanticAdorner) GetMetadata(elem any) string {
 	result := ""
-	e, isExpr := elem.(*exprpb.Expr)
+	e, isExpr := elem.(ast.Expr)
 	if !isExpr {
 		return result
 	}
-	t := a.checks.TypeMap[e.GetId()]
+	t := a.checked.TypeMap()[e.ID()]
 	if t != nil {
 		result += "~"
-		result += FormatCheckedType(t)
+		result += FormatCELType(t)
 	}
 
-	switch e.GetExprKind().(type) {
-	case *exprpb.Expr_IdentExpr,
-		*exprpb.Expr_CallExpr,
-		*exprpb.Expr_StructExpr,
-		*exprpb.Expr_SelectExpr:
-		if ref, found := a.checks.ReferenceMap[e.GetId()]; found {
-			if len(ref.GetOverloadId()) == 0 {
+	switch e.Kind() {
+	case ast.IdentKind,
+		ast.CallKind,
+		ast.ListKind,
+		ast.StructKind,
+		ast.SelectKind:
+		if ref, found := a.checked.ReferenceMap()[e.ID()]; found {
+			if len(ref.OverloadIDs) == 0 {
 				result += "^" + ref.Name
 			} else {
-				for i, overload := range ref.GetOverloadId() {
+				sort.Strings(ref.OverloadIDs)
+				for i, overload := range ref.OverloadIDs {
 					if i == 0 {
 						result += "^"
 					} else {
@@ -65,7 +68,7 @@ func (a *semanticAdorner) GetMetadata(elem any) string {
 // Print returns a string representation of the Expr message,
 // annotated with types from the CheckedExpr.  The Expr must
 // be a sub-expression embedded in the CheckedExpr.
-func Print(e *exprpb.Expr, checks *exprpb.CheckedExpr) string {
-	a := &semanticAdorner{checks: checks}
+func Print(e ast.Expr, checked *ast.AST) string {
+	a := &semanticAdorner{checked: checked}
 	return debug.ToAdornedDebugString(e, a)
 }
diff --git a/vendor/github.com/google/cel-go/checker/decls/scopes.go b/vendor/github.com/google/cel-go/checker/scopes.go
index 608bca3..8bb73dd 100644
--- a/vendor/github.com/google/cel-go/checker/decls/scopes.go
+++ b/vendor/github.com/google/cel-go/checker/scopes.go
@@ -12,9 +12,11 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-package decls
+package checker
 
-import exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+import (
+	"github.com/google/cel-go/common/decls"
+)
 
 // Scopes represents nested Decl sets where the Scopes value contains a Groups containing all
 // identifiers in scope and an optional parent representing outer scopes.
@@ -25,9 +27,9 @@ type Scopes struct {
 	scopes *Group
 }
 
-// NewScopes creates a new, empty Scopes.
+// newScopes creates a new, empty Scopes.
 // Some operations can't be safely performed until a Group is added with Push.
-func NewScopes() *Scopes {
+func newScopes() *Scopes {
 	return &Scopes{
 		scopes: newGroup(),
 	}
@@ -35,7 +37,7 @@ func NewScopes() *Scopes {
 
 // Copy creates a copy of the current Scopes values, including a copy of its parent if non-nil.
 func (s *Scopes) Copy() *Scopes {
-	cpy := NewScopes()
+	cpy := newScopes()
 	if s == nil {
 		return cpy
 	}
@@ -66,14 +68,14 @@ func (s *Scopes) Pop() *Scopes {
 
 // AddIdent adds the ident Decl in the current scope.
 // Note: If the name collides with an existing identifier in the scope, the Decl is overwritten.
-func (s *Scopes) AddIdent(decl *exprpb.Decl) {
-	s.scopes.idents[decl.Name] = decl
+func (s *Scopes) AddIdent(decl *decls.VariableDecl) {
+	s.scopes.idents[decl.Name()] = decl
 }
 
 // FindIdent finds the first ident Decl with a matching name in Scopes, or nil if one cannot be
 // found.
 // Note: The search is performed from innermost to outermost.
-func (s *Scopes) FindIdent(name string) *exprpb.Decl {
+func (s *Scopes) FindIdent(name string) *decls.VariableDecl {
 	if ident, found := s.scopes.idents[name]; found {
 		return ident
 	}
@@ -86,7 +88,7 @@ func (s *Scopes) FindIdent(name string) *exprpb.Decl {
 // FindIdentInScope finds the first ident Decl with a matching name in the current Scopes value, or
 // nil if one does not exist.
 // Note: The search is only performed on the current scope and does not search outer scopes.
-func (s *Scopes) FindIdentInScope(name string) *exprpb.Decl {
+func (s *Scopes) FindIdentInScope(name string) *decls.VariableDecl {
 	if ident, found := s.scopes.idents[name]; found {
 		return ident
 	}
@@ -95,14 +97,14 @@ func (s *Scopes) FindIdentInScope(name string) *exprpb.Decl {
 
 // SetFunction adds the function Decl to the current scope.
 // Note: Any previous entry for a function in the current scope with the same name is overwritten.
-func (s *Scopes) SetFunction(fn *exprpb.Decl) {
-	s.scopes.functions[fn.Name] = fn
+func (s *Scopes) SetFunction(fn *decls.FunctionDecl) {
+	s.scopes.functions[fn.Name()] = fn
 }
 
 // FindFunction finds the first function Decl with a matching name in Scopes.
 // The search is performed from innermost to outermost.
 // Returns nil if no such function in Scopes.
-func (s *Scopes) FindFunction(name string) *exprpb.Decl {
+func (s *Scopes) FindFunction(name string) *decls.FunctionDecl {
 	if fn, found := s.scopes.functions[name]; found {
 		return fn
 	}
@@ -116,16 +118,16 @@ func (s *Scopes) FindFunction(name string) *exprpb.Decl {
 // Contains separate namespaces for identifier and function Decls.
 // (Should be named "Scope" perhaps?)
 type Group struct {
-	idents    map[string]*exprpb.Decl
-	functions map[string]*exprpb.Decl
+	idents    map[string]*decls.VariableDecl
+	functions map[string]*decls.FunctionDecl
 }
 
 // copy creates a new Group instance with a shallow copy of the variables and functions.
 // If callers need to mutate the exprpb.Decl definitions for a Function, they should copy-on-write.
 func (g *Group) copy() *Group {
 	cpy := &Group{
-		idents:    make(map[string]*exprpb.Decl, len(g.idents)),
-		functions: make(map[string]*exprpb.Decl, len(g.functions)),
+		idents:    make(map[string]*decls.VariableDecl, len(g.idents)),
+		functions: make(map[string]*decls.FunctionDecl, len(g.functions)),
 	}
 	for n, id := range g.idents {
 		cpy.idents[n] = id
@@ -139,7 +141,7 @@ func (g *Group) copy() *Group {
 // newGroup creates a new Group with empty maps for identifiers and functions.
 func newGroup() *Group {
 	return &Group{
-		idents:    make(map[string]*exprpb.Decl),
-		functions: make(map[string]*exprpb.Decl),
+		idents:    make(map[string]*decls.VariableDecl),
+		functions: make(map[string]*decls.FunctionDecl),
 	}
 }
diff --git a/vendor/github.com/google/cel-go/checker/standard.go b/vendor/github.com/google/cel-go/checker/standard.go
deleted file mode 100644
index e64337b..0000000
--- a/vendor/github.com/google/cel-go/checker/standard.go
+++ /dev/null
@@ -1,494 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package checker
-
-import (
-	"github.com/google/cel-go/checker/decls"
-	"github.com/google/cel-go/common/operators"
-	"github.com/google/cel-go/common/overloads"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
-)
-
-var (
-	standardDeclarations []*exprpb.Decl
-)
-
-func init() {
-	// Some shortcuts we use when building declarations.
-	paramA := decls.NewTypeParamType("A")
-	typeParamAList := []string{"A"}
-	listOfA := decls.NewListType(paramA)
-	paramB := decls.NewTypeParamType("B")
-	typeParamABList := []string{"A", "B"}
-	mapOfAB := decls.NewMapType(paramA, paramB)
-
-	var idents []*exprpb.Decl
-	for _, t := range []*exprpb.Type{
-		decls.Int, decls.Uint, decls.Bool,
-		decls.Double, decls.Bytes, decls.String} {
-		idents = append(idents,
-			decls.NewVar(FormatCheckedType(t), decls.NewTypeType(t)))
-	}
-	idents = append(idents,
-		decls.NewVar("list", decls.NewTypeType(listOfA)),
-		decls.NewVar("map", decls.NewTypeType(mapOfAB)),
-		decls.NewVar("null_type", decls.NewTypeType(decls.Null)),
-		decls.NewVar("type", decls.NewTypeType(decls.NewTypeType(nil))))
-
-	standardDeclarations = append(standardDeclarations, idents...)
-	standardDeclarations = append(standardDeclarations, []*exprpb.Decl{
-		// Booleans
-		decls.NewFunction(operators.Conditional,
-			decls.NewParameterizedOverload(overloads.Conditional,
-				[]*exprpb.Type{decls.Bool, paramA, paramA}, paramA,
-				typeParamAList)),
-
-		decls.NewFunction(operators.LogicalAnd,
-			decls.NewOverload(overloads.LogicalAnd,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool)),
-
-		decls.NewFunction(operators.LogicalOr,
-			decls.NewOverload(overloads.LogicalOr,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool)),
-
-		decls.NewFunction(operators.LogicalNot,
-			decls.NewOverload(overloads.LogicalNot,
-				[]*exprpb.Type{decls.Bool}, decls.Bool)),
-
-		decls.NewFunction(operators.NotStrictlyFalse,
-			decls.NewOverload(overloads.NotStrictlyFalse,
-				[]*exprpb.Type{decls.Bool}, decls.Bool)),
-
-		decls.NewFunction(operators.Equals,
-			decls.NewParameterizedOverload(overloads.Equals,
-				[]*exprpb.Type{paramA, paramA}, decls.Bool,
-				typeParamAList)),
-
-		decls.NewFunction(operators.NotEquals,
-			decls.NewParameterizedOverload(overloads.NotEquals,
-				[]*exprpb.Type{paramA, paramA}, decls.Bool,
-				typeParamAList)),
-
-		// Algebra.
-
-		decls.NewFunction(operators.Subtract,
-			decls.NewOverload(overloads.SubtractInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
-			decls.NewOverload(overloads.SubtractUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
-			decls.NewOverload(overloads.SubtractDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double),
-			decls.NewOverload(overloads.SubtractTimestampTimestamp,
-				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Duration),
-			decls.NewOverload(overloads.SubtractTimestampDuration,
-				[]*exprpb.Type{decls.Timestamp, decls.Duration}, decls.Timestamp),
-			decls.NewOverload(overloads.SubtractDurationDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Duration)),
-
-		decls.NewFunction(operators.Multiply,
-			decls.NewOverload(overloads.MultiplyInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
-			decls.NewOverload(overloads.MultiplyUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
-			decls.NewOverload(overloads.MultiplyDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double)),
-
-		decls.NewFunction(operators.Divide,
-			decls.NewOverload(overloads.DivideInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
-			decls.NewOverload(overloads.DivideUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
-			decls.NewOverload(overloads.DivideDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double)),
-
-		decls.NewFunction(operators.Modulo,
-			decls.NewOverload(overloads.ModuloInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
-			decls.NewOverload(overloads.ModuloUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint)),
-
-		decls.NewFunction(operators.Add,
-			decls.NewOverload(overloads.AddInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Int),
-			decls.NewOverload(overloads.AddUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Uint),
-			decls.NewOverload(overloads.AddDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Double),
-			decls.NewOverload(overloads.AddString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.String),
-			decls.NewOverload(overloads.AddBytes,
-				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bytes),
-			decls.NewParameterizedOverload(overloads.AddList,
-				[]*exprpb.Type{listOfA, listOfA}, listOfA,
-				typeParamAList),
-			decls.NewOverload(overloads.AddTimestampDuration,
-				[]*exprpb.Type{decls.Timestamp, decls.Duration}, decls.Timestamp),
-			decls.NewOverload(overloads.AddDurationTimestamp,
-				[]*exprpb.Type{decls.Duration, decls.Timestamp}, decls.Timestamp),
-			decls.NewOverload(overloads.AddDurationDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Duration)),
-
-		decls.NewFunction(operators.Negate,
-			decls.NewOverload(overloads.NegateInt64,
-				[]*exprpb.Type{decls.Int}, decls.Int),
-			decls.NewOverload(overloads.NegateDouble,
-				[]*exprpb.Type{decls.Double}, decls.Double)),
-
-		// Index.
-
-		decls.NewFunction(operators.Index,
-			decls.NewParameterizedOverload(overloads.IndexList,
-				[]*exprpb.Type{listOfA, decls.Int}, paramA,
-				typeParamAList),
-			decls.NewParameterizedOverload(overloads.IndexMap,
-				[]*exprpb.Type{mapOfAB, paramA}, paramB,
-				typeParamABList)),
-
-		// Collections.
-
-		decls.NewFunction(overloads.Size,
-			decls.NewInstanceOverload(overloads.SizeStringInst,
-				[]*exprpb.Type{decls.String}, decls.Int),
-			decls.NewInstanceOverload(overloads.SizeBytesInst,
-				[]*exprpb.Type{decls.Bytes}, decls.Int),
-			decls.NewParameterizedInstanceOverload(overloads.SizeListInst,
-				[]*exprpb.Type{listOfA}, decls.Int, typeParamAList),
-			decls.NewParameterizedInstanceOverload(overloads.SizeMapInst,
-				[]*exprpb.Type{mapOfAB}, decls.Int, typeParamABList),
-			decls.NewOverload(overloads.SizeString,
-				[]*exprpb.Type{decls.String}, decls.Int),
-			decls.NewOverload(overloads.SizeBytes,
-				[]*exprpb.Type{decls.Bytes}, decls.Int),
-			decls.NewParameterizedOverload(overloads.SizeList,
-				[]*exprpb.Type{listOfA}, decls.Int, typeParamAList),
-			decls.NewParameterizedOverload(overloads.SizeMap,
-				[]*exprpb.Type{mapOfAB}, decls.Int, typeParamABList)),
-
-		decls.NewFunction(operators.In,
-			decls.NewParameterizedOverload(overloads.InList,
-				[]*exprpb.Type{paramA, listOfA}, decls.Bool,
-				typeParamAList),
-			decls.NewParameterizedOverload(overloads.InMap,
-				[]*exprpb.Type{paramA, mapOfAB}, decls.Bool,
-				typeParamABList)),
-
-		// Deprecated 'in()' function.
-
-		decls.NewFunction(overloads.DeprecatedIn,
-			decls.NewParameterizedOverload(overloads.InList,
-				[]*exprpb.Type{paramA, listOfA}, decls.Bool,
-				typeParamAList),
-			decls.NewParameterizedOverload(overloads.InMap,
-				[]*exprpb.Type{paramA, mapOfAB}, decls.Bool,
-				typeParamABList)),
-
-		// Conversions to type.
-
-		decls.NewFunction(overloads.TypeConvertType,
-			decls.NewParameterizedOverload(overloads.TypeConvertType,
-				[]*exprpb.Type{paramA}, decls.NewTypeType(paramA), typeParamAList)),
-
-		// Conversions to int.
-
-		decls.NewFunction(overloads.TypeConvertInt,
-			decls.NewOverload(overloads.IntToInt, []*exprpb.Type{decls.Int}, decls.Int),
-			decls.NewOverload(overloads.UintToInt, []*exprpb.Type{decls.Uint}, decls.Int),
-			decls.NewOverload(overloads.DoubleToInt, []*exprpb.Type{decls.Double}, decls.Int),
-			decls.NewOverload(overloads.StringToInt, []*exprpb.Type{decls.String}, decls.Int),
-			decls.NewOverload(overloads.TimestampToInt, []*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewOverload(overloads.DurationToInt, []*exprpb.Type{decls.Duration}, decls.Int)),
-
-		// Conversions to uint.
-
-		decls.NewFunction(overloads.TypeConvertUint,
-			decls.NewOverload(overloads.UintToUint, []*exprpb.Type{decls.Uint}, decls.Uint),
-			decls.NewOverload(overloads.IntToUint, []*exprpb.Type{decls.Int}, decls.Uint),
-			decls.NewOverload(overloads.DoubleToUint, []*exprpb.Type{decls.Double}, decls.Uint),
-			decls.NewOverload(overloads.StringToUint, []*exprpb.Type{decls.String}, decls.Uint)),
-
-		// Conversions to double.
-
-		decls.NewFunction(overloads.TypeConvertDouble,
-			decls.NewOverload(overloads.DoubleToDouble, []*exprpb.Type{decls.Double}, decls.Double),
-			decls.NewOverload(overloads.IntToDouble, []*exprpb.Type{decls.Int}, decls.Double),
-			decls.NewOverload(overloads.UintToDouble, []*exprpb.Type{decls.Uint}, decls.Double),
-			decls.NewOverload(overloads.StringToDouble, []*exprpb.Type{decls.String}, decls.Double)),
-
-		// Conversions to bool.
-
-		decls.NewFunction(overloads.TypeConvertBool,
-			decls.NewOverload(overloads.BoolToBool, []*exprpb.Type{decls.Bool}, decls.Bool),
-			decls.NewOverload(overloads.StringToBool, []*exprpb.Type{decls.String}, decls.Bool)),
-
-		// Conversions to string.
-
-		decls.NewFunction(overloads.TypeConvertString,
-			decls.NewOverload(overloads.StringToString, []*exprpb.Type{decls.String}, decls.String),
-			decls.NewOverload(overloads.BoolToString, []*exprpb.Type{decls.Bool}, decls.String),
-			decls.NewOverload(overloads.IntToString, []*exprpb.Type{decls.Int}, decls.String),
-			decls.NewOverload(overloads.UintToString, []*exprpb.Type{decls.Uint}, decls.String),
-			decls.NewOverload(overloads.DoubleToString, []*exprpb.Type{decls.Double}, decls.String),
-			decls.NewOverload(overloads.BytesToString, []*exprpb.Type{decls.Bytes}, decls.String),
-			decls.NewOverload(overloads.TimestampToString, []*exprpb.Type{decls.Timestamp}, decls.String),
-			decls.NewOverload(overloads.DurationToString, []*exprpb.Type{decls.Duration}, decls.String)),
-
-		// Conversions to bytes.
-
-		decls.NewFunction(overloads.TypeConvertBytes,
-			decls.NewOverload(overloads.BytesToBytes, []*exprpb.Type{decls.Bytes}, decls.Bytes),
-			decls.NewOverload(overloads.StringToBytes, []*exprpb.Type{decls.String}, decls.Bytes)),
-
-		// Conversions to timestamps.
-
-		decls.NewFunction(overloads.TypeConvertTimestamp,
-			decls.NewOverload(overloads.TimestampToTimestamp,
-				[]*exprpb.Type{decls.Timestamp}, decls.Timestamp),
-			decls.NewOverload(overloads.StringToTimestamp,
-				[]*exprpb.Type{decls.String}, decls.Timestamp),
-			decls.NewOverload(overloads.IntToTimestamp,
-				[]*exprpb.Type{decls.Int}, decls.Timestamp)),
-
-		// Conversions to durations.
-
-		decls.NewFunction(overloads.TypeConvertDuration,
-			decls.NewOverload(overloads.DurationToDuration,
-				[]*exprpb.Type{decls.Duration}, decls.Duration),
-			decls.NewOverload(overloads.StringToDuration,
-				[]*exprpb.Type{decls.String}, decls.Duration),
-			decls.NewOverload(overloads.IntToDuration,
-				[]*exprpb.Type{decls.Int}, decls.Duration)),
-
-		// Conversions to Dyn.
-
-		decls.NewFunction(overloads.TypeConvertDyn,
-			decls.NewParameterizedOverload(overloads.ToDyn,
-				[]*exprpb.Type{paramA}, decls.Dyn,
-				typeParamAList)),
-
-		// String functions.
-
-		decls.NewFunction(overloads.Contains,
-			decls.NewInstanceOverload(overloads.ContainsString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
-		decls.NewFunction(overloads.EndsWith,
-			decls.NewInstanceOverload(overloads.EndsWithString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
-		decls.NewFunction(overloads.Matches,
-			decls.NewOverload(overloads.Matches,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
-			decls.NewInstanceOverload(overloads.MatchesString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
-		decls.NewFunction(overloads.StartsWith,
-			decls.NewInstanceOverload(overloads.StartsWithString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool)),
-
-		// Date/time functions.
-
-		decls.NewFunction(overloads.TimeGetFullYear,
-			decls.NewInstanceOverload(overloads.TimestampToYear,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToYearWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetMonth,
-			decls.NewInstanceOverload(overloads.TimestampToMonth,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToMonthWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetDayOfYear,
-			decls.NewInstanceOverload(overloads.TimestampToDayOfYear,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToDayOfYearWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetDayOfMonth,
-			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthZeroBased,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthZeroBasedWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetDate,
-			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthOneBased,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToDayOfMonthOneBasedWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetDayOfWeek,
-			decls.NewInstanceOverload(overloads.TimestampToDayOfWeek,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToDayOfWeekWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetHours,
-			decls.NewInstanceOverload(overloads.TimestampToHours,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToHoursWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
-			decls.NewInstanceOverload(overloads.DurationToHours,
-				[]*exprpb.Type{decls.Duration}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetMinutes,
-			decls.NewInstanceOverload(overloads.TimestampToMinutes,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToMinutesWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
-			decls.NewInstanceOverload(overloads.DurationToMinutes,
-				[]*exprpb.Type{decls.Duration}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetSeconds,
-			decls.NewInstanceOverload(overloads.TimestampToSeconds,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToSecondsWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
-			decls.NewInstanceOverload(overloads.DurationToSeconds,
-				[]*exprpb.Type{decls.Duration}, decls.Int)),
-
-		decls.NewFunction(overloads.TimeGetMilliseconds,
-			decls.NewInstanceOverload(overloads.TimestampToMilliseconds,
-				[]*exprpb.Type{decls.Timestamp}, decls.Int),
-			decls.NewInstanceOverload(overloads.TimestampToMillisecondsWithTz,
-				[]*exprpb.Type{decls.Timestamp, decls.String}, decls.Int),
-			decls.NewInstanceOverload(overloads.DurationToMilliseconds,
-				[]*exprpb.Type{decls.Duration}, decls.Int)),
-
-		// Relations.
-		decls.NewFunction(operators.Less,
-			decls.NewOverload(overloads.LessBool,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
-			decls.NewOverload(overloads.LessInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessInt64Double,
-				[]*exprpb.Type{decls.Int, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessInt64Uint64,
-				[]*exprpb.Type{decls.Int, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessUint64Double,
-				[]*exprpb.Type{decls.Uint, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessUint64Int64,
-				[]*exprpb.Type{decls.Uint, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessDoubleInt64,
-				[]*exprpb.Type{decls.Double, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessDoubleUint64,
-				[]*exprpb.Type{decls.Double, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
-			decls.NewOverload(overloads.LessBytes,
-				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
-			decls.NewOverload(overloads.LessTimestamp,
-				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
-			decls.NewOverload(overloads.LessDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
-
-		decls.NewFunction(operators.LessEquals,
-			decls.NewOverload(overloads.LessEqualsBool,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsInt64Double,
-				[]*exprpb.Type{decls.Int, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsInt64Uint64,
-				[]*exprpb.Type{decls.Int, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsUint64Double,
-				[]*exprpb.Type{decls.Uint, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsUint64Int64,
-				[]*exprpb.Type{decls.Uint, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsDoubleInt64,
-				[]*exprpb.Type{decls.Double, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsDoubleUint64,
-				[]*exprpb.Type{decls.Double, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsBytes,
-				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsTimestamp,
-				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
-			decls.NewOverload(overloads.LessEqualsDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
-
-		decls.NewFunction(operators.Greater,
-			decls.NewOverload(overloads.GreaterBool,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
-			decls.NewOverload(overloads.GreaterInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterInt64Double,
-				[]*exprpb.Type{decls.Int, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterInt64Uint64,
-				[]*exprpb.Type{decls.Int, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterUint64Double,
-				[]*exprpb.Type{decls.Uint, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterUint64Int64,
-				[]*exprpb.Type{decls.Uint, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterDoubleInt64,
-				[]*exprpb.Type{decls.Double, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterDoubleUint64,
-				[]*exprpb.Type{decls.Double, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
-			decls.NewOverload(overloads.GreaterBytes,
-				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
-			decls.NewOverload(overloads.GreaterTimestamp,
-				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
-			decls.NewOverload(overloads.GreaterDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
-
-		decls.NewFunction(operators.GreaterEquals,
-			decls.NewOverload(overloads.GreaterEqualsBool,
-				[]*exprpb.Type{decls.Bool, decls.Bool}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsInt64,
-				[]*exprpb.Type{decls.Int, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsInt64Double,
-				[]*exprpb.Type{decls.Int, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsInt64Uint64,
-				[]*exprpb.Type{decls.Int, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsUint64,
-				[]*exprpb.Type{decls.Uint, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsUint64Double,
-				[]*exprpb.Type{decls.Uint, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsUint64Int64,
-				[]*exprpb.Type{decls.Uint, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsDouble,
-				[]*exprpb.Type{decls.Double, decls.Double}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsDoubleInt64,
-				[]*exprpb.Type{decls.Double, decls.Int}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsDoubleUint64,
-				[]*exprpb.Type{decls.Double, decls.Uint}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsString,
-				[]*exprpb.Type{decls.String, decls.String}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsBytes,
-				[]*exprpb.Type{decls.Bytes, decls.Bytes}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsTimestamp,
-				[]*exprpb.Type{decls.Timestamp, decls.Timestamp}, decls.Bool),
-			decls.NewOverload(overloads.GreaterEqualsDuration,
-				[]*exprpb.Type{decls.Duration, decls.Duration}, decls.Bool)),
-	}...)
-}
-
-// StandardDeclarations returns the Decls for all functions and constants in the evaluator.
-func StandardDeclarations() []*exprpb.Decl {
-	return standardDeclarations
-}
diff --git a/vendor/github.com/google/cel-go/checker/types.go b/vendor/github.com/google/cel-go/checker/types.go
index 28d21c9..4c65b27 100644
--- a/vendor/github.com/google/cel-go/checker/types.go
+++ b/vendor/github.com/google/cel-go/checker/types.go
@@ -15,154 +15,54 @@
 package checker
 
 import (
-	"fmt"
-	"strings"
-
-	"github.com/google/cel-go/checker/decls"
-
-	"google.golang.org/protobuf/proto"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/types"
 )
 
-const (
-	kindUnknown = iota + 1
-	kindError
-	kindFunction
-	kindDyn
-	kindPrimitive
-	kindWellKnown
-	kindWrapper
-	kindNull
-	kindAbstract
-	kindType
-	kindList
-	kindMap
-	kindObject
-	kindTypeParam
-)
-
-// FormatCheckedType converts a type message into a string representation.
-func FormatCheckedType(t *exprpb.Type) string {
-	switch kindOf(t) {
-	case kindDyn:
-		return "dyn"
-	case kindFunction:
-		return formatFunction(t.GetFunction().GetResultType(),
-			t.GetFunction().GetArgTypes(),
-			false)
-	case kindList:
-		return fmt.Sprintf("list(%s)", FormatCheckedType(t.GetListType().GetElemType()))
-	case kindObject:
-		return t.GetMessageType()
-	case kindMap:
-		return fmt.Sprintf("map(%s, %s)",
-			FormatCheckedType(t.GetMapType().GetKeyType()),
-			FormatCheckedType(t.GetMapType().GetValueType()))
-	case kindNull:
-		return "null"
-	case kindPrimitive:
-		switch t.GetPrimitive() {
-		case exprpb.Type_UINT64:
-			return "uint"
-		case exprpb.Type_INT64:
-			return "int"
-		}
-		return strings.Trim(strings.ToLower(t.GetPrimitive().String()), " ")
-	case kindType:
-		if t.GetType() == nil {
-			return "type"
-		}
-		return fmt.Sprintf("type(%s)", FormatCheckedType(t.GetType()))
-	case kindWellKnown:
-		switch t.GetWellKnown() {
-		case exprpb.Type_ANY:
-			return "any"
-		case exprpb.Type_DURATION:
-			return "duration"
-		case exprpb.Type_TIMESTAMP:
-			return "timestamp"
-		}
-	case kindWrapper:
-		return fmt.Sprintf("wrapper(%s)",
-			FormatCheckedType(decls.NewPrimitiveType(t.GetWrapper())))
-	case kindError:
-		return "!error!"
-	case kindTypeParam:
-		return t.GetTypeParam()
-	case kindAbstract:
-		at := t.GetAbstractType()
-		params := at.GetParameterTypes()
-		paramStrs := make([]string, len(params))
-		for i, p := range params {
-			paramStrs[i] = FormatCheckedType(p)
-		}
-		return fmt.Sprintf("%s(%s)", at.GetName(), strings.Join(paramStrs, ", "))
-	}
-	return t.String()
-}
-
 // isDyn returns true if the input t is either type DYN or a well-known ANY message.
-func isDyn(t *exprpb.Type) bool {
+func isDyn(t *types.Type) bool {
 	// Note: object type values that are well-known and map to a DYN value in practice
 	// are sanitized prior to being added to the environment.
-	switch kindOf(t) {
-	case kindDyn:
+	switch t.Kind() {
+	case types.DynKind, types.AnyKind:
 		return true
-	case kindWellKnown:
-		return t.GetWellKnown() == exprpb.Type_ANY
 	default:
 		return false
 	}
 }
 
 // isDynOrError returns true if the input is either an Error, DYN, or well-known ANY message.
-func isDynOrError(t *exprpb.Type) bool {
+func isDynOrError(t *types.Type) bool {
 	return isError(t) || isDyn(t)
 }
 
-func isError(t *exprpb.Type) bool {
-	return kindOf(t) == kindError
+func isError(t *types.Type) bool {
+	return t.Kind() == types.ErrorKind
 }
 
-func isOptional(t *exprpb.Type) bool {
-	if kindOf(t) == kindAbstract {
-		at := t.GetAbstractType()
-		return at.GetName() == "optional"
+func isOptional(t *types.Type) bool {
+	if t.Kind() == types.OpaqueKind {
+		return t.TypeName() == "optional_type"
 	}
 	return false
 }
 
-func maybeUnwrapOptional(t *exprpb.Type) (*exprpb.Type, bool) {
+func maybeUnwrapOptional(t *types.Type) (*types.Type, bool) {
 	if isOptional(t) {
-		at := t.GetAbstractType()
-		return at.GetParameterTypes()[0], true
+		return t.Parameters()[0], true
 	}
 	return t, false
 }
 
-func maybeUnwrapString(e *exprpb.Expr) (string, bool) {
-	switch e.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
-		literal := e.GetConstExpr()
-		switch literal.GetConstantKind().(type) {
-		case *exprpb.Constant_StringValue:
-			return literal.GetStringValue(), true
-		}
-	}
-	return "", false
-}
-
 // isEqualOrLessSpecific checks whether one type is equal or less specific than the other one.
 // A type is less specific if it matches the other type using the DYN type.
-func isEqualOrLessSpecific(t1 *exprpb.Type, t2 *exprpb.Type) bool {
-	kind1, kind2 := kindOf(t1), kindOf(t2)
+func isEqualOrLessSpecific(t1, t2 *types.Type) bool {
+	kind1, kind2 := t1.Kind(), t2.Kind()
 	// The first type is less specific.
-	if isDyn(t1) || kind1 == kindTypeParam {
+	if isDyn(t1) || kind1 == types.TypeParamKind {
 		return true
 	}
 	// The first type is not less specific.
-	if isDyn(t2) || kind2 == kindTypeParam {
+	if isDyn(t2) || kind2 == types.TypeParamKind {
 		return false
 	}
 	// Types must be of the same kind to be equal.
@@ -173,38 +73,34 @@ func isEqualOrLessSpecific(t1 *exprpb.Type, t2 *exprpb.Type) bool {
 	// With limited exceptions for ANY and JSON values, the types must agree and be equivalent in
 	// order to return true.
 	switch kind1 {
-	case kindAbstract:
-		a1 := t1.GetAbstractType()
-		a2 := t2.GetAbstractType()
-		if a1.GetName() != a2.GetName() ||
-			len(a1.GetParameterTypes()) != len(a2.GetParameterTypes()) {
+	case types.OpaqueKind:
+		if t1.TypeName() != t2.TypeName() ||
+			len(t1.Parameters()) != len(t2.Parameters()) {
 			return false
 		}
-		for i, p1 := range a1.GetParameterTypes() {
-			if !isEqualOrLessSpecific(p1, a2.GetParameterTypes()[i]) {
+		for i, p1 := range t1.Parameters() {
+			if !isEqualOrLessSpecific(p1, t2.Parameters()[i]) {
 				return false
 			}
 		}
 		return true
-	case kindList:
-		return isEqualOrLessSpecific(t1.GetListType().GetElemType(), t2.GetListType().GetElemType())
-	case kindMap:
-		m1 := t1.GetMapType()
-		m2 := t2.GetMapType()
-		return isEqualOrLessSpecific(m1.GetKeyType(), m2.GetKeyType()) &&
-			isEqualOrLessSpecific(m1.GetValueType(), m2.GetValueType())
-	case kindType:
+	case types.ListKind:
+		return isEqualOrLessSpecific(t1.Parameters()[0], t2.Parameters()[0])
+	case types.MapKind:
+		return isEqualOrLessSpecific(t1.Parameters()[0], t2.Parameters()[0]) &&
+			isEqualOrLessSpecific(t1.Parameters()[1], t2.Parameters()[1])
+	case types.TypeKind:
 		return true
 	default:
-		return proto.Equal(t1, t2)
+		return t1.IsExactType(t2)
 	}
 }
 
 // / internalIsAssignable returns true if t1 is assignable to t2.
-func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
+func internalIsAssignable(m *mapping, t1, t2 *types.Type) bool {
 	// Process type parameters.
-	kind1, kind2 := kindOf(t1), kindOf(t2)
-	if kind2 == kindTypeParam {
+	kind1, kind2 := t1.Kind(), t2.Kind()
+	if kind2 == types.TypeParamKind {
 		// If t2 is a valid type substitution for t1, return true.
 		valid, t2HasSub := isValidTypeSubstitution(m, t1, t2)
 		if valid {
@@ -217,7 +113,7 @@ func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
 		}
 		// Otherwise, fall through to check whether t1 is a possible substitution for t2.
 	}
-	if kind1 == kindTypeParam {
+	if kind1 == types.TypeParamKind {
 		// Return whether t1 is a valid substitution for t2. If not, do no additional checks as the
 		// possible type substitutions have been searched in both directions.
 		valid, _ := isValidTypeSubstitution(m, t2, t1)
@@ -228,40 +124,29 @@ func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
 	if isDynOrError(t1) || isDynOrError(t2) {
 		return true
 	}
-
-	// Test for when the types do not need to agree, but are more specific than dyn.
-	switch kind1 {
-	case kindNull:
+	// Preserve the nullness checks of the legacy type-checker.
+	if kind1 == types.NullTypeKind {
 		return internalIsAssignableNull(t2)
-	case kindPrimitive:
-		return internalIsAssignablePrimitive(t1.GetPrimitive(), t2)
-	case kindWrapper:
-		return internalIsAssignable(m, decls.NewPrimitiveType(t1.GetWrapper()), t2)
-	default:
-		if kind1 != kind2 {
-			return false
-		}
+	}
+	if kind2 == types.NullTypeKind {
+		return internalIsAssignableNull(t1)
 	}
 
-	// Test for when the types must agree.
+	// Test for when the types do not need to agree, but are more specific than dyn.
 	switch kind1 {
-	// ERROR, TYPE_PARAM, and DYN handled above.
-	case kindAbstract:
-		return internalIsAssignableAbstractType(m, t1.GetAbstractType(), t2.GetAbstractType())
-	case kindFunction:
-		return internalIsAssignableFunction(m, t1.GetFunction(), t2.GetFunction())
-	case kindList:
-		return internalIsAssignable(m, t1.GetListType().GetElemType(), t2.GetListType().GetElemType())
-	case kindMap:
-		return internalIsAssignableMap(m, t1.GetMapType(), t2.GetMapType())
-	case kindObject:
-		return t1.GetMessageType() == t2.GetMessageType()
-	case kindType:
-		// A type is a type is a type, any additional parameterization of the
-		// type cannot affect method resolution or assignability.
-		return true
-	case kindWellKnown:
-		return t1.GetWellKnown() == t2.GetWellKnown()
+	case types.BoolKind, types.BytesKind, types.DoubleKind, types.IntKind, types.StringKind, types.UintKind,
+		types.AnyKind, types.DurationKind, types.TimestampKind,
+		types.StructKind:
+		// Test whether t2 is assignable from t1. The order of this check won't usually matter;
+		// however, there may be cases where type capabilities are expanded beyond what is supported
+		// in the current common/types package. For example, an interface designation for a group of
+		// Struct types.
+		return t2.IsAssignableType(t1)
+	case types.TypeKind:
+		return kind2 == types.TypeKind
+	case types.OpaqueKind, types.ListKind, types.MapKind:
+		return t1.Kind() == t2.Kind() && t1.TypeName() == t2.TypeName() &&
+			internalIsAssignableList(m, t1.Parameters(), t2.Parameters())
 	default:
 		return false
 	}
@@ -274,16 +159,16 @@ func internalIsAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) bool {
 // - t2 has a type substitution (t2sub) equal to t1
 // - t2 has a type substitution (t2sub) assignable to t1
 // - t2 does not occur within t1.
-func isValidTypeSubstitution(m *mapping, t1, t2 *exprpb.Type) (valid, hasSub bool) {
+func isValidTypeSubstitution(m *mapping, t1, t2 *types.Type) (valid, hasSub bool) {
 	// Early return if the t1 and t2 are the same instance.
-	kind1, kind2 := kindOf(t1), kindOf(t2)
-	if kind1 == kind2 && (t1 == t2 || proto.Equal(t1, t2)) {
+	kind1, kind2 := t1.Kind(), t2.Kind()
+	if kind1 == kind2 && t1.IsExactType(t2) {
 		return true, true
 	}
 	if t2Sub, found := m.find(t2); found {
 		// Early return if t1 and t2Sub are the same instance as otherwise the mapping
 		// might mark a type as being a subtitution for itself.
-		if kind1 == kindOf(t2Sub) && (t1 == t2Sub || proto.Equal(t1, t2Sub)) {
+		if kind1 == t2Sub.Kind() && t1.IsExactType(t2Sub) {
 			return true, true
 		}
 		// If the types are compatible, pick the more general type and return true
@@ -305,28 +190,10 @@ func isValidTypeSubstitution(m *mapping, t1, t2 *exprpb.Type) (valid, hasSub boo
 	return false, false
 }
 
-// internalIsAssignableAbstractType returns true if the abstract type names agree and all type
-// parameters are assignable.
-func internalIsAssignableAbstractType(m *mapping, a1 *exprpb.Type_AbstractType, a2 *exprpb.Type_AbstractType) bool {
-	return a1.GetName() == a2.GetName() &&
-		internalIsAssignableList(m, a1.GetParameterTypes(), a2.GetParameterTypes())
-}
-
-// internalIsAssignableFunction returns true if the function return type and arg types are
-// assignable.
-func internalIsAssignableFunction(m *mapping, f1 *exprpb.Type_FunctionType, f2 *exprpb.Type_FunctionType) bool {
-	f1ArgTypes := flattenFunctionTypes(f1)
-	f2ArgTypes := flattenFunctionTypes(f2)
-	if internalIsAssignableList(m, f1ArgTypes, f2ArgTypes) {
-		return true
-	}
-	return false
-}
-
 // internalIsAssignableList returns true if the element types at each index in the list are
 // assignable from l1[i] to l2[i]. The list lengths must also agree for the lists to be
 // assignable.
-func internalIsAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type) bool {
+func internalIsAssignableList(m *mapping, l1, l2 []*types.Type) bool {
 	if len(l1) != len(l2) {
 		return false
 	}
@@ -338,41 +205,22 @@ func internalIsAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type)
 	return true
 }
 
-// internalIsAssignableMap returns true if map m1 may be assigned to map m2.
-func internalIsAssignableMap(m *mapping, m1 *exprpb.Type_MapType, m2 *exprpb.Type_MapType) bool {
-	if internalIsAssignableList(m,
-		[]*exprpb.Type{m1.GetKeyType(), m1.GetValueType()},
-		[]*exprpb.Type{m2.GetKeyType(), m2.GetValueType()}) {
-		return true
-	}
-	return false
-}
-
 // internalIsAssignableNull returns true if the type is nullable.
-func internalIsAssignableNull(t *exprpb.Type) bool {
-	switch kindOf(t) {
-	case kindAbstract, kindObject, kindNull, kindWellKnown, kindWrapper:
-		return true
-	default:
-		return false
-	}
+func internalIsAssignableNull(t *types.Type) bool {
+	return isLegacyNullable(t) || t.IsAssignableType(types.NullType)
 }
 
-// internalIsAssignablePrimitive returns true if the target type is the same or if it is a wrapper
-// for the primitive type.
-func internalIsAssignablePrimitive(p exprpb.Type_PrimitiveType, target *exprpb.Type) bool {
-	switch kindOf(target) {
-	case kindPrimitive:
-		return p == target.GetPrimitive()
-	case kindWrapper:
-		return p == target.GetWrapper()
-	default:
-		return false
+// isLegacyNullable preserves the null-ness compatibility of the original type-checker implementation.
+func isLegacyNullable(t *types.Type) bool {
+	switch t.Kind() {
+	case types.OpaqueKind, types.StructKind, types.AnyKind, types.DurationKind, types.TimestampKind:
+		return true
 	}
+	return false
 }
 
 // isAssignable returns an updated type substitution mapping if t1 is assignable to t2.
-func isAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) *mapping {
+func isAssignable(m *mapping, t1, t2 *types.Type) *mapping {
 	mCopy := m.copy()
 	if internalIsAssignable(mCopy, t1, t2) {
 		return mCopy
@@ -381,7 +229,7 @@ func isAssignable(m *mapping, t1 *exprpb.Type, t2 *exprpb.Type) *mapping {
 }
 
 // isAssignableList returns an updated type substitution mapping if l1 is assignable to l2.
-func isAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type) *mapping {
+func isAssignableList(m *mapping, l1, l2 []*types.Type) *mapping {
 	mCopy := m.copy()
 	if internalIsAssignableList(mCopy, l1, l2) {
 		return mCopy
@@ -389,44 +237,8 @@ func isAssignableList(m *mapping, l1 []*exprpb.Type, l2 []*exprpb.Type) *mapping
 	return nil
 }
 
-// kindOf returns the kind of the type as defined in the checked.proto.
-func kindOf(t *exprpb.Type) int {
-	if t == nil || t.TypeKind == nil {
-		return kindUnknown
-	}
-	switch t.GetTypeKind().(type) {
-	case *exprpb.Type_Error:
-		return kindError
-	case *exprpb.Type_Function:
-		return kindFunction
-	case *exprpb.Type_Dyn:
-		return kindDyn
-	case *exprpb.Type_Primitive:
-		return kindPrimitive
-	case *exprpb.Type_WellKnown:
-		return kindWellKnown
-	case *exprpb.Type_Wrapper:
-		return kindWrapper
-	case *exprpb.Type_Null:
-		return kindNull
-	case *exprpb.Type_Type:
-		return kindType
-	case *exprpb.Type_ListType_:
-		return kindList
-	case *exprpb.Type_MapType_:
-		return kindMap
-	case *exprpb.Type_MessageType:
-		return kindObject
-	case *exprpb.Type_TypeParam:
-		return kindTypeParam
-	case *exprpb.Type_AbstractType_:
-		return kindAbstract
-	}
-	return kindUnknown
-}
-
 // mostGeneral returns the more general of two types which are known to unify.
-func mostGeneral(t1 *exprpb.Type, t2 *exprpb.Type) *exprpb.Type {
+func mostGeneral(t1, t2 *types.Type) *types.Type {
 	if isEqualOrLessSpecific(t1, t2) {
 		return t1
 	}
@@ -436,32 +248,25 @@ func mostGeneral(t1 *exprpb.Type, t2 *exprpb.Type) *exprpb.Type {
 // notReferencedIn checks whether the type doesn't appear directly or transitively within the other
 // type. This is a standard requirement for type unification, commonly referred to as the "occurs
 // check".
-func notReferencedIn(m *mapping, t *exprpb.Type, withinType *exprpb.Type) bool {
-	if proto.Equal(t, withinType) {
+func notReferencedIn(m *mapping, t, withinType *types.Type) bool {
+	if t.IsExactType(withinType) {
 		return false
 	}
-	withinKind := kindOf(withinType)
+	withinKind := withinType.Kind()
 	switch withinKind {
-	case kindTypeParam:
+	case types.TypeParamKind:
 		wtSub, found := m.find(withinType)
 		if !found {
 			return true
 		}
 		return notReferencedIn(m, t, wtSub)
-	case kindAbstract:
-		for _, pt := range withinType.GetAbstractType().GetParameterTypes() {
+	case types.OpaqueKind, types.ListKind, types.MapKind, types.TypeKind:
+		for _, pt := range withinType.Parameters() {
 			if !notReferencedIn(m, t, pt) {
 				return false
 			}
 		}
 		return true
-	case kindList:
-		return notReferencedIn(m, t, withinType.GetListType().GetElemType())
-	case kindMap:
-		mt := withinType.GetMapType()
-		return notReferencedIn(m, t, mt.GetKeyType()) && notReferencedIn(m, t, mt.GetValueType())
-	case kindWrapper:
-		return notReferencedIn(m, t, decls.NewPrimitiveType(withinType.GetWrapper()))
 	default:
 		return true
 	}
@@ -469,39 +274,26 @@ func notReferencedIn(m *mapping, t *exprpb.Type, withinType *exprpb.Type) bool {
 
 // substitute replaces all direct and indirect occurrences of bound type parameters. Unbound type
 // parameters are replaced by DYN if typeParamToDyn is true.
-func substitute(m *mapping, t *exprpb.Type, typeParamToDyn bool) *exprpb.Type {
+func substitute(m *mapping, t *types.Type, typeParamToDyn bool) *types.Type {
 	if tSub, found := m.find(t); found {
 		return substitute(m, tSub, typeParamToDyn)
 	}
-	kind := kindOf(t)
-	if typeParamToDyn && kind == kindTypeParam {
-		return decls.Dyn
+	kind := t.Kind()
+	if typeParamToDyn && kind == types.TypeParamKind {
+		return types.DynType
 	}
 	switch kind {
-	case kindAbstract:
-		at := t.GetAbstractType()
-		params := make([]*exprpb.Type, len(at.GetParameterTypes()))
-		for i, p := range at.GetParameterTypes() {
-			params[i] = substitute(m, p, typeParamToDyn)
-		}
-		return decls.NewAbstractType(at.GetName(), params...)
-	case kindFunction:
-		fn := t.GetFunction()
-		rt := substitute(m, fn.ResultType, typeParamToDyn)
-		args := make([]*exprpb.Type, len(fn.GetArgTypes()))
-		for i, a := range fn.ArgTypes {
-			args[i] = substitute(m, a, typeParamToDyn)
-		}
-		return decls.NewFunctionType(rt, args...)
-	case kindList:
-		return decls.NewListType(substitute(m, t.GetListType().GetElemType(), typeParamToDyn))
-	case kindMap:
-		mt := t.GetMapType()
-		return decls.NewMapType(substitute(m, mt.GetKeyType(), typeParamToDyn),
-			substitute(m, mt.GetValueType(), typeParamToDyn))
-	case kindType:
-		if t.GetType() != nil {
-			return decls.NewTypeType(substitute(m, t.GetType(), typeParamToDyn))
+	case types.OpaqueKind:
+		return types.NewOpaqueType(t.TypeName(), substituteParams(m, t.Parameters(), typeParamToDyn)...)
+	case types.ListKind:
+		return types.NewListType(substitute(m, t.Parameters()[0], typeParamToDyn))
+	case types.MapKind:
+		return types.NewMapType(substitute(m, t.Parameters()[0], typeParamToDyn),
+			substitute(m, t.Parameters()[1], typeParamToDyn))
+	case types.TypeKind:
+		if len(t.Parameters()) > 0 {
+			tParam := t.Parameters()[0]
+			return types.NewTypeTypeWithParam(substitute(m, tParam, typeParamToDyn))
 		}
 		return t
 	default:
@@ -509,21 +301,14 @@ func substitute(m *mapping, t *exprpb.Type, typeParamToDyn bool) *exprpb.Type {
 	}
 }
 
-func typeKey(t *exprpb.Type) string {
-	return FormatCheckedType(t)
+func substituteParams(m *mapping, typeParams []*types.Type, typeParamToDyn bool) []*types.Type {
+	subParams := make([]*types.Type, len(typeParams))
+	for i, tp := range typeParams {
+		subParams[i] = substitute(m, tp, typeParamToDyn)
+	}
+	return subParams
 }
 
-// flattenFunctionTypes takes a function with arg types T1, T2, ..., TN and result type TR
-// and returns a slice containing {T1, T2, ..., TN, TR}.
-func flattenFunctionTypes(f *exprpb.Type_FunctionType) []*exprpb.Type {
-	argTypes := f.GetArgTypes()
-	if len(argTypes) == 0 {
-		return []*exprpb.Type{f.GetResultType()}
-	}
-	flattend := make([]*exprpb.Type, len(argTypes)+1, len(argTypes)+1)
-	for i, at := range argTypes {
-		flattend[i] = at
-	}
-	flattend[len(argTypes)] = f.GetResultType()
-	return flattend
+func newFunctionType(resultType *types.Type, argTypes ...*types.Type) *types.Type {
+	return types.NewOpaqueType("function", append([]*types.Type{resultType}, argTypes...)...)
 }
diff --git a/vendor/github.com/google/cel-go/common/BUILD.bazel b/vendor/github.com/google/cel-go/common/BUILD.bazel
index a0058ae..eef7f28 100644
--- a/vendor/github.com/google/cel-go/common/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/BUILD.bazel
@@ -17,8 +17,7 @@ go_library(
     importpath = "github.com/google/cel-go/common",
     deps = [
         "//common/runes:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
-        "@org_golang_x_text//width:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
     ],
 )
 
diff --git a/vendor/github.com/google/cel-go/common/ast/BUILD.bazel b/vendor/github.com/google/cel-go/common/ast/BUILD.bazel
new file mode 100644
index 0000000..9824f57
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/BUILD.bazel
@@ -0,0 +1,57 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "ast.go",
+        "conversion.go",
+        "expr.go",
+        "factory.go",
+        "navigable.go",
+    ],
+    importpath = "github.com/google/cel-go/common/ast",
+    deps = [
+        "//common:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
+        "@dev_cel_expr//:expr",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
+        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//types/known/structpb:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "ast_test.go",
+        "conversion_test.go",
+        "expr_test.go",
+        "navigable_test.go",
+    ],
+    embed = [
+        ":go_default_library",
+    ],
+    deps = [
+        "//checker:go_default_library",
+        "//checker/decls:go_default_library",
+        "//common:go_default_library",
+        "//common/containers:go_default_library",
+        "//common/decls:go_default_library",
+        "//common/operators:go_default_library",
+        "//common/overloads:go_default_library",
+        "//common/stdlib:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
+        "//parser:go_default_library",
+        "//test/proto3pb:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
+        "@org_golang_google_protobuf//proto:go_default_library",
+        "@org_golang_google_protobuf//encoding/prototext:go_default_library",
+    ],
+)
diff --git a/vendor/github.com/google/cel-go/common/ast/ast.go b/vendor/github.com/google/cel-go/common/ast/ast.go
new file mode 100644
index 0000000..b807669
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/ast.go
@@ -0,0 +1,457 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package ast declares data structures useful for parsed and checked abstract syntax trees
+package ast
+
+import (
+	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// AST contains a protobuf expression and source info along with CEL-native type and reference information.
+type AST struct {
+	expr       Expr
+	sourceInfo *SourceInfo
+	typeMap    map[int64]*types.Type
+	refMap     map[int64]*ReferenceInfo
+}
+
+// Expr returns the root ast.Expr value in the AST.
+func (a *AST) Expr() Expr {
+	if a == nil {
+		return nilExpr
+	}
+	return a.expr
+}
+
+// SourceInfo returns the source metadata associated with the parse / type-check passes.
+func (a *AST) SourceInfo() *SourceInfo {
+	if a == nil {
+		return nil
+	}
+	return a.sourceInfo
+}
+
+// GetType returns the type for the expression at the given id, if one exists, else types.DynType.
+func (a *AST) GetType(id int64) *types.Type {
+	if t, found := a.TypeMap()[id]; found {
+		return t
+	}
+	return types.DynType
+}
+
+// SetType sets the type of the expression node at the given id.
+func (a *AST) SetType(id int64, t *types.Type) {
+	if a == nil {
+		return
+	}
+	a.typeMap[id] = t
+}
+
+// TypeMap returns the map of expression ids to type-checked types.
+//
+// If the AST is not type-checked, the map will be empty.
+func (a *AST) TypeMap() map[int64]*types.Type {
+	if a == nil {
+		return map[int64]*types.Type{}
+	}
+	return a.typeMap
+}
+
+// GetOverloadIDs returns the set of overload function names for a given expression id.
+//
+// If the expression id is not a function call, or the AST is not type-checked, the result will be empty.
+func (a *AST) GetOverloadIDs(id int64) []string {
+	if ref, found := a.ReferenceMap()[id]; found {
+		return ref.OverloadIDs
+	}
+	return []string{}
+}
+
+// ReferenceMap returns the map of expression id to identifier, constant, and function references.
+func (a *AST) ReferenceMap() map[int64]*ReferenceInfo {
+	if a == nil {
+		return map[int64]*ReferenceInfo{}
+	}
+	return a.refMap
+}
+
+// SetReference adds a reference to the checked AST type map.
+func (a *AST) SetReference(id int64, r *ReferenceInfo) {
+	if a == nil {
+		return
+	}
+	a.refMap[id] = r
+}
+
+// IsChecked returns whether the AST is type-checked.
+func (a *AST) IsChecked() bool {
+	return a != nil && len(a.TypeMap()) > 0
+}
+
+// NewAST creates a base AST instance with an ast.Expr and ast.SourceInfo value.
+func NewAST(e Expr, sourceInfo *SourceInfo) *AST {
+	if e == nil {
+		e = nilExpr
+	}
+	return &AST{
+		expr:       e,
+		sourceInfo: sourceInfo,
+		typeMap:    make(map[int64]*types.Type),
+		refMap:     make(map[int64]*ReferenceInfo),
+	}
+}
+
+// NewCheckedAST wraps an parsed AST and augments it with type and reference metadata.
+func NewCheckedAST(parsed *AST, typeMap map[int64]*types.Type, refMap map[int64]*ReferenceInfo) *AST {
+	return &AST{
+		expr:       parsed.Expr(),
+		sourceInfo: parsed.SourceInfo(),
+		typeMap:    typeMap,
+		refMap:     refMap,
+	}
+}
+
+// Copy creates a deep copy of the Expr and SourceInfo values in the input AST.
+//
+// Copies of the Expr value are generated using an internal default ExprFactory.
+func Copy(a *AST) *AST {
+	if a == nil {
+		return nil
+	}
+	e := defaultFactory.CopyExpr(a.expr)
+	if !a.IsChecked() {
+		return NewAST(e, CopySourceInfo(a.SourceInfo()))
+	}
+	typesCopy := make(map[int64]*types.Type, len(a.typeMap))
+	for id, t := range a.typeMap {
+		typesCopy[id] = t
+	}
+	refsCopy := make(map[int64]*ReferenceInfo, len(a.refMap))
+	for id, r := range a.refMap {
+		refsCopy[id] = r
+	}
+	return NewCheckedAST(NewAST(e, CopySourceInfo(a.SourceInfo())), typesCopy, refsCopy)
+}
+
+// MaxID returns the upper-bound, non-inclusive, of ids present within the AST's Expr value.
+func MaxID(a *AST) int64 {
+	visitor := &maxIDVisitor{maxID: 1}
+	PostOrderVisit(a.Expr(), visitor)
+	for id, call := range a.SourceInfo().MacroCalls() {
+		PostOrderVisit(call, visitor)
+		if id > visitor.maxID {
+			visitor.maxID = id + 1
+		}
+	}
+	return visitor.maxID + 1
+}
+
+// NewSourceInfo creates a simple SourceInfo object from an input common.Source value.
+func NewSourceInfo(src common.Source) *SourceInfo {
+	var lineOffsets []int32
+	var desc string
+	baseLine := int32(0)
+	baseCol := int32(0)
+	if src != nil {
+		desc = src.Description()
+		lineOffsets = src.LineOffsets()
+		// Determine whether the source metadata should be computed relative
+		// to a base line and column value. This can be determined by requesting
+		// the location for offset 0 from the source object.
+		if loc, found := src.OffsetLocation(0); found {
+			baseLine = int32(loc.Line()) - 1
+			baseCol = int32(loc.Column())
+		}
+	}
+	return &SourceInfo{
+		desc:         desc,
+		lines:        lineOffsets,
+		baseLine:     baseLine,
+		baseCol:      baseCol,
+		offsetRanges: make(map[int64]OffsetRange),
+		macroCalls:   make(map[int64]Expr),
+	}
+}
+
+// CopySourceInfo creates a deep copy of the MacroCalls within the input SourceInfo.
+//
+// Copies of macro Expr values are generated using an internal default ExprFactory.
+func CopySourceInfo(info *SourceInfo) *SourceInfo {
+	if info == nil {
+		return nil
+	}
+	rangesCopy := make(map[int64]OffsetRange, len(info.offsetRanges))
+	for id, off := range info.offsetRanges {
+		rangesCopy[id] = off
+	}
+	callsCopy := make(map[int64]Expr, len(info.macroCalls))
+	for id, call := range info.macroCalls {
+		callsCopy[id] = defaultFactory.CopyExpr(call)
+	}
+	return &SourceInfo{
+		syntax:       info.syntax,
+		desc:         info.desc,
+		lines:        info.lines,
+		baseLine:     info.baseLine,
+		baseCol:      info.baseCol,
+		offsetRanges: rangesCopy,
+		macroCalls:   callsCopy,
+	}
+}
+
+// SourceInfo records basic information about the expression as a textual input and
+// as a parsed expression value.
+type SourceInfo struct {
+	syntax       string
+	desc         string
+	lines        []int32
+	baseLine     int32
+	baseCol      int32
+	offsetRanges map[int64]OffsetRange
+	macroCalls   map[int64]Expr
+}
+
+// SyntaxVersion returns the syntax version associated with the text expression.
+func (s *SourceInfo) SyntaxVersion() string {
+	if s == nil {
+		return ""
+	}
+	return s.syntax
+}
+
+// Description provides information about where the expression came from.
+func (s *SourceInfo) Description() string {
+	if s == nil {
+		return ""
+	}
+	return s.desc
+}
+
+// LineOffsets returns a list of the 0-based character offsets in the input text where newlines appear.
+func (s *SourceInfo) LineOffsets() []int32 {
+	if s == nil {
+		return []int32{}
+	}
+	return s.lines
+}
+
+// MacroCalls returns a map of expression id to ast.Expr value where the id represents the expression
+// node where the macro was inserted into the AST, and the ast.Expr value represents the original call
+// signature which was replaced.
+func (s *SourceInfo) MacroCalls() map[int64]Expr {
+	if s == nil {
+		return map[int64]Expr{}
+	}
+	return s.macroCalls
+}
+
+// GetMacroCall returns the original ast.Expr value for the given expression if it was generated via
+// a macro replacement.
+//
+// Note, parsing options must be enabled to track macro calls before this method will return a value.
+func (s *SourceInfo) GetMacroCall(id int64) (Expr, bool) {
+	e, found := s.MacroCalls()[id]
+	return e, found
+}
+
+// SetMacroCall records a macro call at a specific location.
+func (s *SourceInfo) SetMacroCall(id int64, e Expr) {
+	if s != nil {
+		s.macroCalls[id] = e
+	}
+}
+
+// ClearMacroCall removes the macro call at the given expression id.
+func (s *SourceInfo) ClearMacroCall(id int64) {
+	if s != nil {
+		delete(s.macroCalls, id)
+	}
+}
+
+// OffsetRanges returns a map of expression id to OffsetRange values where the range indicates either:
+// the start and end position in the input stream where the expression occurs, or the start position
+// only. If the range only captures start position, the stop position of the range will be equal to
+// the start.
+func (s *SourceInfo) OffsetRanges() map[int64]OffsetRange {
+	if s == nil {
+		return map[int64]OffsetRange{}
+	}
+	return s.offsetRanges
+}
+
+// GetOffsetRange retrieves an OffsetRange for the given expression id if one exists.
+func (s *SourceInfo) GetOffsetRange(id int64) (OffsetRange, bool) {
+	if s == nil {
+		return OffsetRange{}, false
+	}
+	o, found := s.offsetRanges[id]
+	return o, found
+}
+
+// SetOffsetRange sets the OffsetRange for the given expression id.
+func (s *SourceInfo) SetOffsetRange(id int64, o OffsetRange) {
+	if s == nil {
+		return
+	}
+	s.offsetRanges[id] = o
+}
+
+// ClearOffsetRange removes the OffsetRange for the given expression id.
+func (s *SourceInfo) ClearOffsetRange(id int64) {
+	if s != nil {
+		delete(s.offsetRanges, id)
+	}
+}
+
+// GetStartLocation calculates the human-readable 1-based line and 0-based column of the first character
+// of the expression node at the id.
+func (s *SourceInfo) GetStartLocation(id int64) common.Location {
+	if o, found := s.GetOffsetRange(id); found {
+		return s.GetLocationByOffset(o.Start)
+	}
+	return common.NoLocation
+}
+
+// GetStopLocation calculates the human-readable 1-based line and 0-based column of the last character for
+// the expression node at the given id.
+//
+// If the SourceInfo was generated from a serialized protobuf representation, the stop location will
+// be identical to the start location for the expression.
+func (s *SourceInfo) GetStopLocation(id int64) common.Location {
+	if o, found := s.GetOffsetRange(id); found {
+		return s.GetLocationByOffset(o.Stop)
+	}
+	return common.NoLocation
+}
+
+// GetLocationByOffset returns the line and column information for a given character offset.
+func (s *SourceInfo) GetLocationByOffset(offset int32) common.Location {
+	line := 1
+	col := int(offset)
+	for _, lineOffset := range s.LineOffsets() {
+		if lineOffset > offset {
+			break
+		}
+		line++
+		col = int(offset - lineOffset)
+	}
+	return common.NewLocation(line, col)
+}
+
+// ComputeOffset calculates the 0-based character offset from a 1-based line and 0-based column.
+func (s *SourceInfo) ComputeOffset(line, col int32) int32 {
+	if s != nil {
+		line = s.baseLine + line
+		col = s.baseCol + col
+	}
+	if line == 1 {
+		return col
+	}
+	if line < 1 || line > int32(len(s.LineOffsets())) {
+		return -1
+	}
+	offset := s.LineOffsets()[line-2]
+	return offset + col
+}
+
+// OffsetRange captures the start and stop positions of a section of text in the input expression.
+type OffsetRange struct {
+	Start int32
+	Stop  int32
+}
+
+// ReferenceInfo contains a CEL native representation of an identifier reference which may refer to
+// either a qualified identifier name, a set of overload ids, or a constant value from an enum.
+type ReferenceInfo struct {
+	Name        string
+	OverloadIDs []string
+	Value       ref.Val
+}
+
+// NewIdentReference creates a ReferenceInfo instance for an identifier with an optional constant value.
+func NewIdentReference(name string, value ref.Val) *ReferenceInfo {
+	return &ReferenceInfo{Name: name, Value: value}
+}
+
+// NewFunctionReference creates a ReferenceInfo instance for a set of function overloads.
+func NewFunctionReference(overloads ...string) *ReferenceInfo {
+	info := &ReferenceInfo{}
+	for _, id := range overloads {
+		info.AddOverload(id)
+	}
+	return info
+}
+
+// AddOverload appends a function overload ID to the ReferenceInfo.
+func (r *ReferenceInfo) AddOverload(overloadID string) {
+	for _, id := range r.OverloadIDs {
+		if id == overloadID {
+			return
+		}
+	}
+	r.OverloadIDs = append(r.OverloadIDs, overloadID)
+}
+
+// Equals returns whether two references are identical to each other.
+func (r *ReferenceInfo) Equals(other *ReferenceInfo) bool {
+	if r.Name != other.Name {
+		return false
+	}
+	if len(r.OverloadIDs) != len(other.OverloadIDs) {
+		return false
+	}
+	if len(r.OverloadIDs) != 0 {
+		overloadMap := make(map[string]struct{}, len(r.OverloadIDs))
+		for _, id := range r.OverloadIDs {
+			overloadMap[id] = struct{}{}
+		}
+		for _, id := range other.OverloadIDs {
+			_, found := overloadMap[id]
+			if !found {
+				return false
+			}
+		}
+	}
+	if r.Value == nil && other.Value == nil {
+		return true
+	}
+	if r.Value == nil && other.Value != nil ||
+		r.Value != nil && other.Value == nil ||
+		r.Value.Equal(other.Value) != types.True {
+		return false
+	}
+	return true
+}
+
+type maxIDVisitor struct {
+	maxID int64
+	*baseVisitor
+}
+
+// VisitExpr updates the max identifier if the incoming expression id is greater than previously observed.
+func (v *maxIDVisitor) VisitExpr(e Expr) {
+	if v.maxID < e.ID() {
+		v.maxID = e.ID()
+	}
+}
+
+// VisitEntryExpr updates the max identifier if the incoming entry id is greater than previously observed.
+func (v *maxIDVisitor) VisitEntryExpr(e EntryExpr) {
+	if v.maxID < e.ID() {
+		v.maxID = e.ID()
+	}
+}
diff --git a/vendor/github.com/google/cel-go/common/ast/conversion.go b/vendor/github.com/google/cel-go/common/ast/conversion.go
new file mode 100644
index 0000000..435d8f6
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/conversion.go
@@ -0,0 +1,659 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ast
+
+import (
+	"fmt"
+
+	"google.golang.org/protobuf/proto"
+
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+
+	celpb "cel.dev/expr"
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	structpb "google.golang.org/protobuf/types/known/structpb"
+)
+
+// ToProto converts an AST to a CheckedExpr protobouf.
+func ToProto(ast *AST) (*exprpb.CheckedExpr, error) {
+	refMap := make(map[int64]*exprpb.Reference, len(ast.ReferenceMap()))
+	for id, ref := range ast.ReferenceMap() {
+		r, err := ReferenceInfoToProto(ref)
+		if err != nil {
+			return nil, err
+		}
+		refMap[id] = r
+	}
+	typeMap := make(map[int64]*exprpb.Type, len(ast.TypeMap()))
+	for id, typ := range ast.TypeMap() {
+		t, err := types.TypeToExprType(typ)
+		if err != nil {
+			return nil, err
+		}
+		typeMap[id] = t
+	}
+	e, err := ExprToProto(ast.Expr())
+	if err != nil {
+		return nil, err
+	}
+	info, err := SourceInfoToProto(ast.SourceInfo())
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.CheckedExpr{
+		Expr:         e,
+		SourceInfo:   info,
+		ReferenceMap: refMap,
+		TypeMap:      typeMap,
+	}, nil
+}
+
+// ToAST converts a CheckedExpr protobuf to an AST instance.
+func ToAST(checked *exprpb.CheckedExpr) (*AST, error) {
+	refMap := make(map[int64]*ReferenceInfo, len(checked.GetReferenceMap()))
+	for id, ref := range checked.GetReferenceMap() {
+		r, err := ProtoToReferenceInfo(ref)
+		if err != nil {
+			return nil, err
+		}
+		refMap[id] = r
+	}
+	typeMap := make(map[int64]*types.Type, len(checked.GetTypeMap()))
+	for id, typ := range checked.GetTypeMap() {
+		t, err := types.ExprTypeToType(typ)
+		if err != nil {
+			return nil, err
+		}
+		typeMap[id] = t
+	}
+	info, err := ProtoToSourceInfo(checked.GetSourceInfo())
+	if err != nil {
+		return nil, err
+	}
+	root, err := ProtoToExpr(checked.GetExpr())
+	if err != nil {
+		return nil, err
+	}
+	ast := NewCheckedAST(NewAST(root, info), typeMap, refMap)
+	return ast, nil
+}
+
+// ProtoToExpr converts a protobuf Expr value to an ast.Expr value.
+func ProtoToExpr(e *exprpb.Expr) (Expr, error) {
+	factory := NewExprFactory()
+	return exprInternal(factory, e)
+}
+
+// ProtoToEntryExpr converts a protobuf struct/map entry to an ast.EntryExpr
+func ProtoToEntryExpr(e *exprpb.Expr_CreateStruct_Entry) (EntryExpr, error) {
+	factory := NewExprFactory()
+	switch e.GetKeyKind().(type) {
+	case *exprpb.Expr_CreateStruct_Entry_FieldKey:
+		return exprStructField(factory, e.GetId(), e)
+	case *exprpb.Expr_CreateStruct_Entry_MapKey:
+		return exprMapEntry(factory, e.GetId(), e)
+	}
+	return nil, fmt.Errorf("unsupported expr entry kind: %v", e)
+}
+
+func exprInternal(factory ExprFactory, e *exprpb.Expr) (Expr, error) {
+	id := e.GetId()
+	switch e.GetExprKind().(type) {
+	case *exprpb.Expr_CallExpr:
+		return exprCall(factory, id, e.GetCallExpr())
+	case *exprpb.Expr_ComprehensionExpr:
+		return exprComprehension(factory, id, e.GetComprehensionExpr())
+	case *exprpb.Expr_ConstExpr:
+		return exprLiteral(factory, id, e.GetConstExpr())
+	case *exprpb.Expr_IdentExpr:
+		return exprIdent(factory, id, e.GetIdentExpr())
+	case *exprpb.Expr_ListExpr:
+		return exprList(factory, id, e.GetListExpr())
+	case *exprpb.Expr_SelectExpr:
+		return exprSelect(factory, id, e.GetSelectExpr())
+	case *exprpb.Expr_StructExpr:
+		s := e.GetStructExpr()
+		if s.GetMessageName() != "" {
+			return exprStruct(factory, id, s)
+		}
+		return exprMap(factory, id, s)
+	}
+	return factory.NewUnspecifiedExpr(id), nil
+}
+
+func exprCall(factory ExprFactory, id int64, call *exprpb.Expr_Call) (Expr, error) {
+	var err error
+	args := make([]Expr, len(call.GetArgs()))
+	for i, a := range call.GetArgs() {
+		args[i], err = exprInternal(factory, a)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if call.GetTarget() == nil {
+		return factory.NewCall(id, call.GetFunction(), args...), nil
+	}
+
+	target, err := exprInternal(factory, call.GetTarget())
+	if err != nil {
+		return nil, err
+	}
+	return factory.NewMemberCall(id, call.GetFunction(), target, args...), nil
+}
+
+func exprComprehension(factory ExprFactory, id int64, comp *exprpb.Expr_Comprehension) (Expr, error) {
+	iterRange, err := exprInternal(factory, comp.GetIterRange())
+	if err != nil {
+		return nil, err
+	}
+	accuInit, err := exprInternal(factory, comp.GetAccuInit())
+	if err != nil {
+		return nil, err
+	}
+	loopCond, err := exprInternal(factory, comp.GetLoopCondition())
+	if err != nil {
+		return nil, err
+	}
+	loopStep, err := exprInternal(factory, comp.GetLoopStep())
+	if err != nil {
+		return nil, err
+	}
+	result, err := exprInternal(factory, comp.GetResult())
+	if err != nil {
+		return nil, err
+	}
+	return factory.NewComprehensionTwoVar(id,
+		iterRange,
+		comp.GetIterVar(),
+		comp.GetIterVar2(),
+		comp.GetAccuVar(),
+		accuInit,
+		loopCond,
+		loopStep,
+		result), nil
+}
+
+func exprLiteral(factory ExprFactory, id int64, c *exprpb.Constant) (Expr, error) {
+	val, err := ConstantToVal(c)
+	if err != nil {
+		return nil, err
+	}
+	return factory.NewLiteral(id, val), nil
+}
+
+func exprIdent(factory ExprFactory, id int64, i *exprpb.Expr_Ident) (Expr, error) {
+	return factory.NewIdent(id, i.GetName()), nil
+}
+
+func exprList(factory ExprFactory, id int64, l *exprpb.Expr_CreateList) (Expr, error) {
+	elems := make([]Expr, len(l.GetElements()))
+	for i, e := range l.GetElements() {
+		elem, err := exprInternal(factory, e)
+		if err != nil {
+			return nil, err
+		}
+		elems[i] = elem
+	}
+	return factory.NewList(id, elems, l.GetOptionalIndices()), nil
+}
+
+func exprMap(factory ExprFactory, id int64, s *exprpb.Expr_CreateStruct) (Expr, error) {
+	entries := make([]EntryExpr, len(s.GetEntries()))
+	var err error
+	for i, entry := range s.GetEntries() {
+		entries[i], err = exprMapEntry(factory, entry.GetId(), entry)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return factory.NewMap(id, entries), nil
+}
+
+func exprMapEntry(factory ExprFactory, id int64, e *exprpb.Expr_CreateStruct_Entry) (EntryExpr, error) {
+	k, err := exprInternal(factory, e.GetMapKey())
+	if err != nil {
+		return nil, err
+	}
+	v, err := exprInternal(factory, e.GetValue())
+	if err != nil {
+		return nil, err
+	}
+	return factory.NewMapEntry(id, k, v, e.GetOptionalEntry()), nil
+}
+
+func exprSelect(factory ExprFactory, id int64, s *exprpb.Expr_Select) (Expr, error) {
+	op, err := exprInternal(factory, s.GetOperand())
+	if err != nil {
+		return nil, err
+	}
+	if s.GetTestOnly() {
+		return factory.NewPresenceTest(id, op, s.GetField()), nil
+	}
+	return factory.NewSelect(id, op, s.GetField()), nil
+}
+
+func exprStruct(factory ExprFactory, id int64, s *exprpb.Expr_CreateStruct) (Expr, error) {
+	fields := make([]EntryExpr, len(s.GetEntries()))
+	var err error
+	for i, field := range s.GetEntries() {
+		fields[i], err = exprStructField(factory, field.GetId(), field)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return factory.NewStruct(id, s.GetMessageName(), fields), nil
+}
+
+func exprStructField(factory ExprFactory, id int64, f *exprpb.Expr_CreateStruct_Entry) (EntryExpr, error) {
+	v, err := exprInternal(factory, f.GetValue())
+	if err != nil {
+		return nil, err
+	}
+	return factory.NewStructField(id, f.GetFieldKey(), v, f.GetOptionalEntry()), nil
+}
+
+// ExprToProto serializes an ast.Expr value to a protobuf Expr representation.
+func ExprToProto(e Expr) (*exprpb.Expr, error) {
+	if e == nil {
+		return &exprpb.Expr{}, nil
+	}
+	switch e.Kind() {
+	case CallKind:
+		return protoCall(e.ID(), e.AsCall())
+	case ComprehensionKind:
+		return protoComprehension(e.ID(), e.AsComprehension())
+	case IdentKind:
+		return protoIdent(e.ID(), e.AsIdent())
+	case ListKind:
+		return protoList(e.ID(), e.AsList())
+	case LiteralKind:
+		return protoLiteral(e.ID(), e.AsLiteral())
+	case MapKind:
+		return protoMap(e.ID(), e.AsMap())
+	case SelectKind:
+		return protoSelect(e.ID(), e.AsSelect())
+	case StructKind:
+		return protoStruct(e.ID(), e.AsStruct())
+	case UnspecifiedExprKind:
+		// Handle the case where a macro reference may be getting translated.
+		// A nested macro 'pointer' is a non-zero expression id with no kind set.
+		if e.ID() != 0 {
+			return &exprpb.Expr{Id: e.ID()}, nil
+		}
+		return &exprpb.Expr{}, nil
+	}
+	return nil, fmt.Errorf("unsupported expr kind: %v", e)
+}
+
+// EntryExprToProto converts an ast.EntryExpr to a protobuf CreateStruct entry
+func EntryExprToProto(e EntryExpr) (*exprpb.Expr_CreateStruct_Entry, error) {
+	switch e.Kind() {
+	case MapEntryKind:
+		return protoMapEntry(e.ID(), e.AsMapEntry())
+	case StructFieldKind:
+		return protoStructField(e.ID(), e.AsStructField())
+	case UnspecifiedEntryExprKind:
+		return &exprpb.Expr_CreateStruct_Entry{}, nil
+	}
+	return nil, fmt.Errorf("unsupported expr entry kind: %v", e)
+}
+
+func protoCall(id int64, call CallExpr) (*exprpb.Expr, error) {
+	var err error
+	var target *exprpb.Expr
+	if call.IsMemberFunction() {
+		target, err = ExprToProto(call.Target())
+		if err != nil {
+			return nil, err
+		}
+	}
+	callArgs := call.Args()
+	args := make([]*exprpb.Expr, len(callArgs))
+	for i, a := range callArgs {
+		args[i], err = ExprToProto(a)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_CallExpr{
+			CallExpr: &exprpb.Expr_Call{
+				Function: call.FunctionName(),
+				Target:   target,
+				Args:     args,
+			},
+		},
+	}, nil
+}
+
+func protoComprehension(id int64, comp ComprehensionExpr) (*exprpb.Expr, error) {
+	iterRange, err := ExprToProto(comp.IterRange())
+	if err != nil {
+		return nil, err
+	}
+	accuInit, err := ExprToProto(comp.AccuInit())
+	if err != nil {
+		return nil, err
+	}
+	loopCond, err := ExprToProto(comp.LoopCondition())
+	if err != nil {
+		return nil, err
+	}
+	loopStep, err := ExprToProto(comp.LoopStep())
+	if err != nil {
+		return nil, err
+	}
+	result, err := ExprToProto(comp.Result())
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_ComprehensionExpr{
+			ComprehensionExpr: &exprpb.Expr_Comprehension{
+				IterVar:       comp.IterVar(),
+				IterVar2:      comp.IterVar2(),
+				IterRange:     iterRange,
+				AccuVar:       comp.AccuVar(),
+				AccuInit:      accuInit,
+				LoopCondition: loopCond,
+				LoopStep:      loopStep,
+				Result:        result,
+			},
+		},
+	}, nil
+}
+
+func protoIdent(id int64, name string) (*exprpb.Expr, error) {
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_IdentExpr{
+			IdentExpr: &exprpb.Expr_Ident{
+				Name: name,
+			},
+		},
+	}, nil
+}
+
+func protoList(id int64, list ListExpr) (*exprpb.Expr, error) {
+	var err error
+	elems := make([]*exprpb.Expr, list.Size())
+	for i, e := range list.Elements() {
+		elems[i], err = ExprToProto(e)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_ListExpr{
+			ListExpr: &exprpb.Expr_CreateList{
+				Elements:        elems,
+				OptionalIndices: list.OptionalIndices(),
+			},
+		},
+	}, nil
+}
+
+func protoLiteral(id int64, val ref.Val) (*exprpb.Expr, error) {
+	c, err := ValToConstant(val)
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_ConstExpr{
+			ConstExpr: c,
+		},
+	}, nil
+}
+
+func protoMap(id int64, m MapExpr) (*exprpb.Expr, error) {
+	entries := make([]*exprpb.Expr_CreateStruct_Entry, len(m.Entries()))
+	var err error
+	for i, e := range m.Entries() {
+		entries[i], err = EntryExprToProto(e)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_StructExpr{
+			StructExpr: &exprpb.Expr_CreateStruct{
+				Entries: entries,
+			},
+		},
+	}, nil
+}
+
+func protoMapEntry(id int64, e MapEntry) (*exprpb.Expr_CreateStruct_Entry, error) {
+	k, err := ExprToProto(e.Key())
+	if err != nil {
+		return nil, err
+	}
+	v, err := ExprToProto(e.Value())
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Expr_CreateStruct_Entry{
+		Id: id,
+		KeyKind: &exprpb.Expr_CreateStruct_Entry_MapKey{
+			MapKey: k,
+		},
+		Value:         v,
+		OptionalEntry: e.IsOptional(),
+	}, nil
+}
+
+func protoSelect(id int64, s SelectExpr) (*exprpb.Expr, error) {
+	op, err := ExprToProto(s.Operand())
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_SelectExpr{
+			SelectExpr: &exprpb.Expr_Select{
+				Operand:  op,
+				Field:    s.FieldName(),
+				TestOnly: s.IsTestOnly(),
+			},
+		},
+	}, nil
+}
+
+func protoStruct(id int64, s StructExpr) (*exprpb.Expr, error) {
+	entries := make([]*exprpb.Expr_CreateStruct_Entry, len(s.Fields()))
+	var err error
+	for i, e := range s.Fields() {
+		entries[i], err = EntryExprToProto(e)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return &exprpb.Expr{
+		Id: id,
+		ExprKind: &exprpb.Expr_StructExpr{
+			StructExpr: &exprpb.Expr_CreateStruct{
+				MessageName: s.TypeName(),
+				Entries:     entries,
+			},
+		},
+	}, nil
+}
+
+func protoStructField(id int64, f StructField) (*exprpb.Expr_CreateStruct_Entry, error) {
+	v, err := ExprToProto(f.Value())
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Expr_CreateStruct_Entry{
+		Id: id,
+		KeyKind: &exprpb.Expr_CreateStruct_Entry_FieldKey{
+			FieldKey: f.Name(),
+		},
+		Value:         v,
+		OptionalEntry: f.IsOptional(),
+	}, nil
+}
+
+// SourceInfoToProto serializes an ast.SourceInfo value to a protobuf SourceInfo object.
+func SourceInfoToProto(info *SourceInfo) (*exprpb.SourceInfo, error) {
+	if info == nil {
+		return &exprpb.SourceInfo{}, nil
+	}
+	sourceInfo := &exprpb.SourceInfo{
+		SyntaxVersion: info.SyntaxVersion(),
+		Location:      info.Description(),
+		LineOffsets:   info.LineOffsets(),
+		Positions:     make(map[int64]int32, len(info.OffsetRanges())),
+		MacroCalls:    make(map[int64]*exprpb.Expr, len(info.MacroCalls())),
+	}
+	for id, offset := range info.OffsetRanges() {
+		sourceInfo.Positions[id] = offset.Start
+	}
+	for id, e := range info.MacroCalls() {
+		call, err := ExprToProto(e)
+		if err != nil {
+			return nil, err
+		}
+		sourceInfo.MacroCalls[id] = call
+	}
+	return sourceInfo, nil
+}
+
+// ProtoToSourceInfo deserializes the protobuf into a native SourceInfo value.
+func ProtoToSourceInfo(info *exprpb.SourceInfo) (*SourceInfo, error) {
+	sourceInfo := &SourceInfo{
+		syntax:       info.GetSyntaxVersion(),
+		desc:         info.GetLocation(),
+		lines:        info.GetLineOffsets(),
+		offsetRanges: make(map[int64]OffsetRange, len(info.GetPositions())),
+		macroCalls:   make(map[int64]Expr, len(info.GetMacroCalls())),
+	}
+	for id, offset := range info.GetPositions() {
+		sourceInfo.SetOffsetRange(id, OffsetRange{Start: offset, Stop: offset})
+	}
+	for id, e := range info.GetMacroCalls() {
+		call, err := ProtoToExpr(e)
+		if err != nil {
+			return nil, err
+		}
+		sourceInfo.SetMacroCall(id, call)
+	}
+	return sourceInfo, nil
+}
+
+// ReferenceInfoToProto converts a ReferenceInfo instance to a protobuf Reference suitable for serialization.
+func ReferenceInfoToProto(info *ReferenceInfo) (*exprpb.Reference, error) {
+	c, err := ValToConstant(info.Value)
+	if err != nil {
+		return nil, err
+	}
+	return &exprpb.Reference{
+		Name:       info.Name,
+		OverloadId: info.OverloadIDs,
+		Value:      c,
+	}, nil
+}
+
+// ProtoToReferenceInfo converts a protobuf Reference into a CEL-native ReferenceInfo instance.
+func ProtoToReferenceInfo(ref *exprpb.Reference) (*ReferenceInfo, error) {
+	v, err := ConstantToVal(ref.GetValue())
+	if err != nil {
+		return nil, err
+	}
+	return &ReferenceInfo{
+		Name:        ref.GetName(),
+		OverloadIDs: ref.GetOverloadId(),
+		Value:       v,
+	}, nil
+}
+
+// ValToConstant converts a CEL-native ref.Val to a protobuf Constant.
+//
+// Only simple scalar types are supported by this method.
+func ValToConstant(v ref.Val) (*exprpb.Constant, error) {
+	if v == nil {
+		return nil, nil
+	}
+	switch v.Type() {
+	case types.BoolType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_BoolValue{BoolValue: v.Value().(bool)}}, nil
+	case types.BytesType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_BytesValue{BytesValue: v.Value().([]byte)}}, nil
+	case types.DoubleType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_DoubleValue{DoubleValue: v.Value().(float64)}}, nil
+	case types.IntType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_Int64Value{Int64Value: v.Value().(int64)}}, nil
+	case types.NullType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_NullValue{NullValue: structpb.NullValue_NULL_VALUE}}, nil
+	case types.StringType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_StringValue{StringValue: v.Value().(string)}}, nil
+	case types.UintType:
+		return &exprpb.Constant{ConstantKind: &exprpb.Constant_Uint64Value{Uint64Value: v.Value().(uint64)}}, nil
+	}
+	return nil, fmt.Errorf("unsupported constant kind: %v", v.Type())
+}
+
+// ConstantToVal converts a protobuf Constant to a CEL-native ref.Val.
+func ConstantToVal(c *exprpb.Constant) (ref.Val, error) {
+	return AlphaProtoConstantAsVal(c)
+}
+
+// AlphaProtoConstantAsVal converts a v1alpha1.Constant protobuf to a CEL-native ref.Val.
+func AlphaProtoConstantAsVal(c *exprpb.Constant) (ref.Val, error) {
+	if c == nil {
+		return nil, nil
+	}
+	canonical := &celpb.Constant{}
+	if err := convertProto(c, canonical); err != nil {
+		return nil, err
+	}
+	return ProtoConstantAsVal(canonical)
+}
+
+// ProtoConstantAsVal converts a canonical celpb.Constant protobuf to a CEL-native ref.Val.
+func ProtoConstantAsVal(c *celpb.Constant) (ref.Val, error) {
+	switch c.GetConstantKind().(type) {
+	case *celpb.Constant_BoolValue:
+		return types.Bool(c.GetBoolValue()), nil
+	case *celpb.Constant_BytesValue:
+		return types.Bytes(c.GetBytesValue()), nil
+	case *celpb.Constant_DoubleValue:
+		return types.Double(c.GetDoubleValue()), nil
+	case *celpb.Constant_Int64Value:
+		return types.Int(c.GetInt64Value()), nil
+	case *celpb.Constant_NullValue:
+		return types.NullValue, nil
+	case *celpb.Constant_StringValue:
+		return types.String(c.GetStringValue()), nil
+	case *celpb.Constant_Uint64Value:
+		return types.Uint(c.GetUint64Value()), nil
+	}
+	return nil, fmt.Errorf("unsupported constant kind: %v", c.GetConstantKind())
+}
+
+func convertProto(src, dst proto.Message) error {
+	pb, err := proto.Marshal(src)
+	if err != nil {
+		return err
+	}
+	err = proto.Unmarshal(pb, dst)
+	return err
+}
diff --git a/vendor/github.com/google/cel-go/common/ast/expr.go b/vendor/github.com/google/cel-go/common/ast/expr.go
new file mode 100644
index 0000000..9f55cb3
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/expr.go
@@ -0,0 +1,884 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ast
+
+import (
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// ExprKind represents the expression node kind.
+type ExprKind int
+
+const (
+	// UnspecifiedExprKind represents an unset expression with no specified properties.
+	UnspecifiedExprKind ExprKind = iota
+
+	// CallKind represents a function call.
+	CallKind
+
+	// ComprehensionKind represents a comprehension expression generated by a macro.
+	ComprehensionKind
+
+	// IdentKind represents a simple variable, constant, or type identifier.
+	IdentKind
+
+	// ListKind represents a list literal expression.
+	ListKind
+
+	// LiteralKind represents a primitive scalar literal.
+	LiteralKind
+
+	// MapKind represents a map literal expression.
+	MapKind
+
+	// SelectKind represents a field selection expression.
+	SelectKind
+
+	// StructKind represents a struct literal expression.
+	StructKind
+)
+
+// Expr represents the base expression node in a CEL abstract syntax tree.
+//
+// Depending on the `Kind()` value, the Expr may be converted to a concrete expression types
+// as indicated by the `As<Kind>` methods.
+type Expr interface {
+	// ID of the expression as it appears in the AST
+	ID() int64
+
+	// Kind of the expression node. See ExprKind for the valid enum values.
+	Kind() ExprKind
+
+	// AsCall adapts the expr into a CallExpr
+	//
+	// The Kind() must be equal to a CallKind for the conversion to be well-defined.
+	AsCall() CallExpr
+
+	// AsComprehension adapts the expr into a ComprehensionExpr.
+	//
+	// The Kind() must be equal to a ComprehensionKind for the conversion to be well-defined.
+	AsComprehension() ComprehensionExpr
+
+	// AsIdent adapts the expr into an identifier string.
+	//
+	// The Kind() must be equal to an IdentKind for the conversion to be well-defined.
+	AsIdent() string
+
+	// AsLiteral adapts the expr into a constant ref.Val.
+	//
+	// The Kind() must be equal to a LiteralKind for the conversion to be well-defined.
+	AsLiteral() ref.Val
+
+	// AsList adapts the expr into a ListExpr.
+	//
+	// The Kind() must be equal to a ListKind for the conversion to be well-defined.
+	AsList() ListExpr
+
+	// AsMap adapts the expr into a MapExpr.
+	//
+	// The Kind() must be equal to a MapKind for the conversion to be well-defined.
+	AsMap() MapExpr
+
+	// AsSelect adapts the expr into a SelectExpr.
+	//
+	// The Kind() must be equal to a SelectKind for the conversion to be well-defined.
+	AsSelect() SelectExpr
+
+	// AsStruct adapts the expr into a StructExpr.
+	//
+	// The Kind() must be equal to a StructKind for the conversion to be well-defined.
+	AsStruct() StructExpr
+
+	// RenumberIDs performs an in-place update of the expression and all of its descendents numeric ids.
+	RenumberIDs(IDGenerator)
+
+	// SetKindCase replaces the contents of the current expression with the contents of the other.
+	//
+	// The SetKindCase takes ownership of any expression instances references within the input Expr.
+	// A shallow copy is made of the Expr value itself, but not a deep one.
+	//
+	// This method should only be used during AST rewrites using temporary Expr values.
+	SetKindCase(Expr)
+
+	// isExpr is a marker interface.
+	isExpr()
+}
+
+// EntryExprKind represents the possible EntryExpr kinds.
+type EntryExprKind int
+
+const (
+	// UnspecifiedEntryExprKind indicates that the entry expr is not set.
+	UnspecifiedEntryExprKind EntryExprKind = iota
+
+	// MapEntryKind indicates that the entry is a MapEntry type with key and value expressions.
+	MapEntryKind
+
+	// StructFieldKind indicates that the entry is a StructField with a field name and initializer
+	// expression.
+	StructFieldKind
+)
+
+// EntryExpr represents the base entry expression in a CEL map or struct literal.
+type EntryExpr interface {
+	// ID of the entry as it appears in the AST.
+	ID() int64
+
+	// Kind of the entry expression node. See EntryExprKind for valid enum values.
+	Kind() EntryExprKind
+
+	// AsMapEntry casts the EntryExpr to a MapEntry.
+	//
+	// The Kind() must be equal to MapEntryKind for the conversion to be well-defined.
+	AsMapEntry() MapEntry
+
+	// AsStructField casts the EntryExpr to a StructField
+	//
+	// The Kind() must be equal to StructFieldKind for the conversion to be well-defined.
+	AsStructField() StructField
+
+	// RenumberIDs performs an in-place update of the expression and all of its descendents numeric ids.
+	RenumberIDs(IDGenerator)
+
+	isEntryExpr()
+}
+
+// IDGenerator produces unique ids suitable for tagging expression nodes
+type IDGenerator func(originalID int64) int64
+
+// CallExpr defines an interface for inspecting a function call and its arguments.
+type CallExpr interface {
+	// FunctionName returns the name of the function.
+	FunctionName() string
+
+	// IsMemberFunction returns whether the call has a non-nil target indicating it is a member function
+	IsMemberFunction() bool
+
+	// Target returns the target of the expression if one is present.
+	Target() Expr
+
+	// Args returns the list of call arguments, excluding the target.
+	Args() []Expr
+
+	// marker interface method
+	isExpr()
+}
+
+// ListExpr defines an interface for inspecting a list literal expression.
+type ListExpr interface {
+	// Elements returns the list elements as navigable expressions.
+	Elements() []Expr
+
+	// OptionalIndicies returns the list of optional indices in the list literal.
+	OptionalIndices() []int32
+
+	// IsOptional indicates whether the given element index is optional.
+	IsOptional(int32) bool
+
+	// Size returns the number of elements in the list.
+	Size() int
+
+	// marker interface method
+	isExpr()
+}
+
+// SelectExpr defines an interface for inspecting a select expression.
+type SelectExpr interface {
+	// Operand returns the selection operand expression.
+	Operand() Expr
+
+	// FieldName returns the field name being selected from the operand.
+	FieldName() string
+
+	// IsTestOnly indicates whether the select expression is a presence test generated by a macro.
+	IsTestOnly() bool
+
+	// marker interface method
+	isExpr()
+}
+
+// MapExpr defines an interface for inspecting a map expression.
+type MapExpr interface {
+	// Entries returns the map key value pairs as EntryExpr values.
+	Entries() []EntryExpr
+
+	// Size returns the number of entries in the map.
+	Size() int
+
+	// marker interface method
+	isExpr()
+}
+
+// MapEntry defines an interface for inspecting a map entry.
+type MapEntry interface {
+	// Key returns the map entry key expression.
+	Key() Expr
+
+	// Value returns the map entry value expression.
+	Value() Expr
+
+	// IsOptional returns whether the entry is optional.
+	IsOptional() bool
+
+	// marker interface method
+	isEntryExpr()
+}
+
+// StructExpr defines an interfaces for inspecting a struct and its field initializers.
+type StructExpr interface {
+	// TypeName returns the struct type name.
+	TypeName() string
+
+	// Fields returns the set of field initializers in the struct expression as EntryExpr values.
+	Fields() []EntryExpr
+
+	// marker interface method
+	isExpr()
+}
+
+// StructField defines an interface for inspecting a struct field initialization.
+type StructField interface {
+	// Name returns the name of the field.
+	Name() string
+
+	// Value returns the field initialization expression.
+	Value() Expr
+
+	// IsOptional returns whether the field is optional.
+	IsOptional() bool
+
+	// marker interface method
+	isEntryExpr()
+}
+
+// ComprehensionExpr defines an interface for inspecting a comprehension expression.
+type ComprehensionExpr interface {
+	// IterRange returns the iteration range expression.
+	IterRange() Expr
+
+	// IterVar returns the iteration variable name.
+	//
+	// For one-variable comprehensions, the iter var refers to the element value
+	// when iterating over a list, or the map key when iterating over a map.
+	//
+	// For two-variable comprehneions, the iter var refers to the list index or the
+	// map key.
+	IterVar() string
+
+	// IterVar2 returns the second iteration variable name.
+	//
+	// When the value is non-empty, the comprehension is a two-variable comprehension.
+	IterVar2() string
+
+	// HasIterVar2 returns true if the second iteration variable is non-empty.
+	HasIterVar2() bool
+
+	// AccuVar returns the accumulation variable name.
+	AccuVar() string
+
+	// AccuInit returns the accumulation variable initialization expression.
+	AccuInit() Expr
+
+	// LoopCondition returns the loop condition expression.
+	LoopCondition() Expr
+
+	// LoopStep returns the loop step expression.
+	LoopStep() Expr
+
+	// Result returns the comprehension result expression.
+	Result() Expr
+
+	// marker interface method
+	isExpr()
+}
+
+var _ Expr = &expr{}
+
+type expr struct {
+	id int64
+	exprKindCase
+}
+
+type exprKindCase interface {
+	Kind() ExprKind
+
+	renumberIDs(IDGenerator)
+
+	isExpr()
+}
+
+func (e *expr) ID() int64 {
+	if e == nil {
+		return 0
+	}
+	return e.id
+}
+
+func (e *expr) Kind() ExprKind {
+	if e == nil || e.exprKindCase == nil {
+		return UnspecifiedExprKind
+	}
+	return e.exprKindCase.Kind()
+}
+
+func (e *expr) AsCall() CallExpr {
+	if e.Kind() != CallKind {
+		return nilCall
+	}
+	return e.exprKindCase.(CallExpr)
+}
+
+func (e *expr) AsComprehension() ComprehensionExpr {
+	if e.Kind() != ComprehensionKind {
+		return nilCompre
+	}
+	return e.exprKindCase.(ComprehensionExpr)
+}
+
+func (e *expr) AsIdent() string {
+	if e.Kind() != IdentKind {
+		return ""
+	}
+	return string(e.exprKindCase.(baseIdentExpr))
+}
+
+func (e *expr) AsLiteral() ref.Val {
+	if e.Kind() != LiteralKind {
+		return nil
+	}
+	return e.exprKindCase.(*baseLiteral).Val
+}
+
+func (e *expr) AsList() ListExpr {
+	if e.Kind() != ListKind {
+		return nilList
+	}
+	return e.exprKindCase.(ListExpr)
+}
+
+func (e *expr) AsMap() MapExpr {
+	if e.Kind() != MapKind {
+		return nilMap
+	}
+	return e.exprKindCase.(MapExpr)
+}
+
+func (e *expr) AsSelect() SelectExpr {
+	if e.Kind() != SelectKind {
+		return nilSel
+	}
+	return e.exprKindCase.(SelectExpr)
+}
+
+func (e *expr) AsStruct() StructExpr {
+	if e.Kind() != StructKind {
+		return nilStruct
+	}
+	return e.exprKindCase.(StructExpr)
+}
+
+func (e *expr) SetKindCase(other Expr) {
+	if e == nil {
+		return
+	}
+	if other == nil {
+		e.exprKindCase = nil
+		return
+	}
+	switch other.Kind() {
+	case CallKind:
+		c := other.AsCall()
+		e.exprKindCase = &baseCallExpr{
+			function: c.FunctionName(),
+			target:   c.Target(),
+			args:     c.Args(),
+			isMember: c.IsMemberFunction(),
+		}
+	case ComprehensionKind:
+		c := other.AsComprehension()
+		e.exprKindCase = &baseComprehensionExpr{
+			iterRange: c.IterRange(),
+			iterVar:   c.IterVar(),
+			iterVar2:  c.IterVar2(),
+			accuVar:   c.AccuVar(),
+			accuInit:  c.AccuInit(),
+			loopCond:  c.LoopCondition(),
+			loopStep:  c.LoopStep(),
+			result:    c.Result(),
+		}
+	case IdentKind:
+		e.exprKindCase = baseIdentExpr(other.AsIdent())
+	case ListKind:
+		l := other.AsList()
+		optIndexMap := make(map[int32]struct{}, len(l.OptionalIndices()))
+		for _, idx := range l.OptionalIndices() {
+			optIndexMap[idx] = struct{}{}
+		}
+		e.exprKindCase = &baseListExpr{
+			elements:    l.Elements(),
+			optIndices:  l.OptionalIndices(),
+			optIndexMap: optIndexMap,
+		}
+	case LiteralKind:
+		e.exprKindCase = &baseLiteral{Val: other.AsLiteral()}
+	case MapKind:
+		e.exprKindCase = &baseMapExpr{
+			entries: other.AsMap().Entries(),
+		}
+	case SelectKind:
+		s := other.AsSelect()
+		e.exprKindCase = &baseSelectExpr{
+			operand:  s.Operand(),
+			field:    s.FieldName(),
+			testOnly: s.IsTestOnly(),
+		}
+	case StructKind:
+		s := other.AsStruct()
+		e.exprKindCase = &baseStructExpr{
+			typeName: s.TypeName(),
+			fields:   s.Fields(),
+		}
+	case UnspecifiedExprKind:
+		e.exprKindCase = nil
+	}
+}
+
+func (e *expr) RenumberIDs(idGen IDGenerator) {
+	if e == nil {
+		return
+	}
+	e.id = idGen(e.id)
+	if e.exprKindCase != nil {
+		e.exprKindCase.renumberIDs(idGen)
+	}
+}
+
+type baseCallExpr struct {
+	function string
+	target   Expr
+	args     []Expr
+	isMember bool
+}
+
+func (*baseCallExpr) Kind() ExprKind {
+	return CallKind
+}
+
+func (e *baseCallExpr) FunctionName() string {
+	if e == nil {
+		return ""
+	}
+	return e.function
+}
+
+func (e *baseCallExpr) IsMemberFunction() bool {
+	if e == nil {
+		return false
+	}
+	return e.isMember
+}
+
+func (e *baseCallExpr) Target() Expr {
+	if e == nil || !e.IsMemberFunction() {
+		return nilExpr
+	}
+	return e.target
+}
+
+func (e *baseCallExpr) Args() []Expr {
+	if e == nil {
+		return []Expr{}
+	}
+	return e.args
+}
+
+func (e *baseCallExpr) renumberIDs(idGen IDGenerator) {
+	if e.IsMemberFunction() {
+		e.Target().RenumberIDs(idGen)
+	}
+	for _, arg := range e.Args() {
+		arg.RenumberIDs(idGen)
+	}
+}
+
+func (*baseCallExpr) isExpr() {}
+
+var _ ComprehensionExpr = &baseComprehensionExpr{}
+
+type baseComprehensionExpr struct {
+	iterRange Expr
+	iterVar   string
+	iterVar2  string
+	accuVar   string
+	accuInit  Expr
+	loopCond  Expr
+	loopStep  Expr
+	result    Expr
+}
+
+func (*baseComprehensionExpr) Kind() ExprKind {
+	return ComprehensionKind
+}
+
+func (e *baseComprehensionExpr) IterRange() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.iterRange
+}
+
+func (e *baseComprehensionExpr) IterVar() string {
+	return e.iterVar
+}
+
+func (e *baseComprehensionExpr) IterVar2() string {
+	return e.iterVar2
+}
+
+func (e *baseComprehensionExpr) HasIterVar2() bool {
+	return e.iterVar2 != ""
+}
+
+func (e *baseComprehensionExpr) AccuVar() string {
+	return e.accuVar
+}
+
+func (e *baseComprehensionExpr) AccuInit() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.accuInit
+}
+
+func (e *baseComprehensionExpr) LoopCondition() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.loopCond
+}
+
+func (e *baseComprehensionExpr) LoopStep() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.loopStep
+}
+
+func (e *baseComprehensionExpr) Result() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.result
+}
+
+func (e *baseComprehensionExpr) renumberIDs(idGen IDGenerator) {
+	e.IterRange().RenumberIDs(idGen)
+	e.AccuInit().RenumberIDs(idGen)
+	e.LoopCondition().RenumberIDs(idGen)
+	e.LoopStep().RenumberIDs(idGen)
+	e.Result().RenumberIDs(idGen)
+}
+
+func (*baseComprehensionExpr) isExpr() {}
+
+var _ exprKindCase = baseIdentExpr("")
+
+type baseIdentExpr string
+
+func (baseIdentExpr) Kind() ExprKind {
+	return IdentKind
+}
+
+func (e baseIdentExpr) renumberIDs(IDGenerator) {}
+
+func (baseIdentExpr) isExpr() {}
+
+var _ exprKindCase = &baseLiteral{}
+var _ ref.Val = &baseLiteral{}
+
+type baseLiteral struct {
+	ref.Val
+}
+
+func (*baseLiteral) Kind() ExprKind {
+	return LiteralKind
+}
+
+func (l *baseLiteral) renumberIDs(IDGenerator) {}
+
+func (*baseLiteral) isExpr() {}
+
+var _ ListExpr = &baseListExpr{}
+
+type baseListExpr struct {
+	elements    []Expr
+	optIndices  []int32
+	optIndexMap map[int32]struct{}
+}
+
+func (*baseListExpr) Kind() ExprKind {
+	return ListKind
+}
+
+func (e *baseListExpr) Elements() []Expr {
+	if e == nil {
+		return []Expr{}
+	}
+	return e.elements
+}
+
+func (e *baseListExpr) IsOptional(index int32) bool {
+	_, found := e.optIndexMap[index]
+	return found
+}
+
+func (e *baseListExpr) OptionalIndices() []int32 {
+	if e == nil {
+		return []int32{}
+	}
+	return e.optIndices
+}
+
+func (e *baseListExpr) Size() int {
+	return len(e.Elements())
+}
+
+func (e *baseListExpr) renumberIDs(idGen IDGenerator) {
+	for _, elem := range e.Elements() {
+		elem.RenumberIDs(idGen)
+	}
+}
+
+func (*baseListExpr) isExpr() {}
+
+type baseMapExpr struct {
+	entries []EntryExpr
+}
+
+func (*baseMapExpr) Kind() ExprKind {
+	return MapKind
+}
+
+func (e *baseMapExpr) Entries() []EntryExpr {
+	if e == nil {
+		return []EntryExpr{}
+	}
+	return e.entries
+}
+
+func (e *baseMapExpr) Size() int {
+	return len(e.Entries())
+}
+
+func (e *baseMapExpr) renumberIDs(idGen IDGenerator) {
+	for _, entry := range e.Entries() {
+		entry.RenumberIDs(idGen)
+	}
+}
+
+func (*baseMapExpr) isExpr() {}
+
+type baseSelectExpr struct {
+	operand  Expr
+	field    string
+	testOnly bool
+}
+
+func (*baseSelectExpr) Kind() ExprKind {
+	return SelectKind
+}
+
+func (e *baseSelectExpr) Operand() Expr {
+	if e == nil || e.operand == nil {
+		return nilExpr
+	}
+	return e.operand
+}
+
+func (e *baseSelectExpr) FieldName() string {
+	if e == nil {
+		return ""
+	}
+	return e.field
+}
+
+func (e *baseSelectExpr) IsTestOnly() bool {
+	if e == nil {
+		return false
+	}
+	return e.testOnly
+}
+
+func (e *baseSelectExpr) renumberIDs(idGen IDGenerator) {
+	e.Operand().RenumberIDs(idGen)
+}
+
+func (*baseSelectExpr) isExpr() {}
+
+type baseStructExpr struct {
+	typeName string
+	fields   []EntryExpr
+}
+
+func (*baseStructExpr) Kind() ExprKind {
+	return StructKind
+}
+
+func (e *baseStructExpr) TypeName() string {
+	if e == nil {
+		return ""
+	}
+	return e.typeName
+}
+
+func (e *baseStructExpr) Fields() []EntryExpr {
+	if e == nil {
+		return []EntryExpr{}
+	}
+	return e.fields
+}
+
+func (e *baseStructExpr) renumberIDs(idGen IDGenerator) {
+	for _, f := range e.Fields() {
+		f.RenumberIDs(idGen)
+	}
+}
+
+func (*baseStructExpr) isExpr() {}
+
+type entryExprKindCase interface {
+	Kind() EntryExprKind
+
+	renumberIDs(IDGenerator)
+
+	isEntryExpr()
+}
+
+var _ EntryExpr = &entryExpr{}
+
+type entryExpr struct {
+	id int64
+	entryExprKindCase
+}
+
+func (e *entryExpr) ID() int64 {
+	return e.id
+}
+
+func (e *entryExpr) AsMapEntry() MapEntry {
+	if e.Kind() != MapEntryKind {
+		return nilMapEntry
+	}
+	return e.entryExprKindCase.(MapEntry)
+}
+
+func (e *entryExpr) AsStructField() StructField {
+	if e.Kind() != StructFieldKind {
+		return nilStructField
+	}
+	return e.entryExprKindCase.(StructField)
+}
+
+func (e *entryExpr) RenumberIDs(idGen IDGenerator) {
+	e.id = idGen(e.id)
+	e.entryExprKindCase.renumberIDs(idGen)
+}
+
+type baseMapEntry struct {
+	key        Expr
+	value      Expr
+	isOptional bool
+}
+
+func (e *baseMapEntry) Kind() EntryExprKind {
+	return MapEntryKind
+}
+
+func (e *baseMapEntry) Key() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.key
+}
+
+func (e *baseMapEntry) Value() Expr {
+	if e == nil {
+		return nilExpr
+	}
+	return e.value
+}
+
+func (e *baseMapEntry) IsOptional() bool {
+	if e == nil {
+		return false
+	}
+	return e.isOptional
+}
+
+func (e *baseMapEntry) renumberIDs(idGen IDGenerator) {
+	e.Key().RenumberIDs(idGen)
+	e.Value().RenumberIDs(idGen)
+}
+
+func (*baseMapEntry) isEntryExpr() {}
+
+type baseStructField struct {
+	field      string
+	value      Expr
+	isOptional bool
+}
+
+func (f *baseStructField) Kind() EntryExprKind {
+	return StructFieldKind
+}
+
+func (f *baseStructField) Name() string {
+	if f == nil {
+		return ""
+	}
+	return f.field
+}
+
+func (f *baseStructField) Value() Expr {
+	if f == nil {
+		return nilExpr
+	}
+	return f.value
+}
+
+func (f *baseStructField) IsOptional() bool {
+	if f == nil {
+		return false
+	}
+	return f.isOptional
+}
+
+func (f *baseStructField) renumberIDs(idGen IDGenerator) {
+	f.Value().RenumberIDs(idGen)
+}
+
+func (*baseStructField) isEntryExpr() {}
+
+var (
+	nilExpr        *expr                  = nil
+	nilCall        *baseCallExpr          = nil
+	nilCompre      *baseComprehensionExpr = nil
+	nilList        *baseListExpr          = nil
+	nilMap         *baseMapExpr           = nil
+	nilMapEntry    *baseMapEntry          = nil
+	nilSel         *baseSelectExpr        = nil
+	nilStruct      *baseStructExpr        = nil
+	nilStructField *baseStructField       = nil
+)
diff --git a/vendor/github.com/google/cel-go/common/ast/factory.go b/vendor/github.com/google/cel-go/common/ast/factory.go
new file mode 100644
index 0000000..994806b
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/factory.go
@@ -0,0 +1,313 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ast
+
+import "github.com/google/cel-go/common/types/ref"
+
+// ExprFactory interfaces defines a set of methods necessary for building native expression values.
+type ExprFactory interface {
+	// CopyExpr creates a deep copy of the input Expr value.
+	CopyExpr(Expr) Expr
+
+	// CopyEntryExpr creates a deep copy of the input EntryExpr value.
+	CopyEntryExpr(EntryExpr) EntryExpr
+
+	// NewCall creates an Expr value representing a global function call.
+	NewCall(id int64, function string, args ...Expr) Expr
+
+	// NewComprehension creates an Expr value representing a one-variable comprehension over a value range.
+	NewComprehension(id int64, iterRange Expr, iterVar, accuVar string, accuInit, loopCondition, loopStep, result Expr) Expr
+
+	// NewComprehensionTwoVar creates an Expr value representing a two-variable comprehension over a value range.
+	NewComprehensionTwoVar(id int64, iterRange Expr, iterVar, iterVar2, accuVar string, accuInit, loopCondition, loopStep, result Expr) Expr
+
+	// NewMemberCall creates an Expr value representing a member function call.
+	NewMemberCall(id int64, function string, receiver Expr, args ...Expr) Expr
+
+	// NewIdent creates an Expr value representing an identifier.
+	NewIdent(id int64, name string) Expr
+
+	// NewAccuIdent creates an Expr value representing an accumulator identifier within a
+	//comprehension.
+	NewAccuIdent(id int64) Expr
+
+	// NewLiteral creates an Expr value representing a literal value, such as a string or integer.
+	NewLiteral(id int64, value ref.Val) Expr
+
+	// NewList creates an Expr value representing a list literal expression with optional indices.
+	//
+	// Optional indicies will typically be empty unless the CEL optional types are enabled.
+	NewList(id int64, elems []Expr, optIndices []int32) Expr
+
+	// NewMap creates an Expr value representing a map literal expression
+	NewMap(id int64, entries []EntryExpr) Expr
+
+	// NewMapEntry creates a MapEntry with a given key, value, and a flag indicating whether
+	// the key is optionally set.
+	NewMapEntry(id int64, key, value Expr, isOptional bool) EntryExpr
+
+	// NewPresenceTest creates an Expr representing a field presence test on an operand expression.
+	NewPresenceTest(id int64, operand Expr, field string) Expr
+
+	// NewSelect creates an Expr representing a field selection on an operand expression.
+	NewSelect(id int64, operand Expr, field string) Expr
+
+	// NewStruct creates an Expr value representing a struct literal with a given type name and a
+	// set of field initializers.
+	NewStruct(id int64, typeName string, fields []EntryExpr) Expr
+
+	// NewStructField creates a StructField with a given field name, value, and a flag indicating
+	// whether the field is optionally set.
+	NewStructField(id int64, field string, value Expr, isOptional bool) EntryExpr
+
+	// NewUnspecifiedExpr creates an empty expression node.
+	NewUnspecifiedExpr(id int64) Expr
+
+	isExprFactory()
+}
+
+type baseExprFactory struct{}
+
+// NewExprFactory creates an ExprFactory instance.
+func NewExprFactory() ExprFactory {
+	return &baseExprFactory{}
+}
+
+func (fac *baseExprFactory) NewCall(id int64, function string, args ...Expr) Expr {
+	if len(args) == 0 {
+		args = []Expr{}
+	}
+	return fac.newExpr(
+		id,
+		&baseCallExpr{
+			function: function,
+			target:   nilExpr,
+			args:     args,
+			isMember: false,
+		})
+}
+
+func (fac *baseExprFactory) NewMemberCall(id int64, function string, target Expr, args ...Expr) Expr {
+	if len(args) == 0 {
+		args = []Expr{}
+	}
+	return fac.newExpr(
+		id,
+		&baseCallExpr{
+			function: function,
+			target:   target,
+			args:     args,
+			isMember: true,
+		})
+}
+
+func (fac *baseExprFactory) NewComprehension(id int64, iterRange Expr, iterVar, accuVar string, accuInit, loopCond, loopStep, result Expr) Expr {
+	// Set the iter_var2 to empty string to indicate the second variable is omitted
+	return fac.NewComprehensionTwoVar(id, iterRange, iterVar, "", accuVar, accuInit, loopCond, loopStep, result)
+}
+
+func (fac *baseExprFactory) NewComprehensionTwoVar(id int64, iterRange Expr, iterVar, iterVar2, accuVar string, accuInit, loopCond, loopStep, result Expr) Expr {
+	return fac.newExpr(
+		id,
+		&baseComprehensionExpr{
+			iterRange: iterRange,
+			iterVar:   iterVar,
+			iterVar2:  iterVar2,
+			accuVar:   accuVar,
+			accuInit:  accuInit,
+			loopCond:  loopCond,
+			loopStep:  loopStep,
+			result:    result,
+		})
+}
+
+func (fac *baseExprFactory) NewIdent(id int64, name string) Expr {
+	return fac.newExpr(id, baseIdentExpr(name))
+}
+
+func (fac *baseExprFactory) NewAccuIdent(id int64) Expr {
+	return fac.NewIdent(id, "__result__")
+}
+
+func (fac *baseExprFactory) NewLiteral(id int64, value ref.Val) Expr {
+	return fac.newExpr(id, &baseLiteral{Val: value})
+}
+
+func (fac *baseExprFactory) NewList(id int64, elems []Expr, optIndices []int32) Expr {
+	optIndexMap := make(map[int32]struct{}, len(optIndices))
+	for _, idx := range optIndices {
+		optIndexMap[idx] = struct{}{}
+	}
+	return fac.newExpr(id,
+		&baseListExpr{
+			elements:    elems,
+			optIndices:  optIndices,
+			optIndexMap: optIndexMap,
+		})
+}
+
+func (fac *baseExprFactory) NewMap(id int64, entries []EntryExpr) Expr {
+	return fac.newExpr(id, &baseMapExpr{entries: entries})
+}
+
+func (fac *baseExprFactory) NewMapEntry(id int64, key, value Expr, isOptional bool) EntryExpr {
+	return fac.newEntryExpr(
+		id,
+		&baseMapEntry{
+			key:        key,
+			value:      value,
+			isOptional: isOptional,
+		})
+}
+
+func (fac *baseExprFactory) NewPresenceTest(id int64, operand Expr, field string) Expr {
+	return fac.newExpr(
+		id,
+		&baseSelectExpr{
+			operand:  operand,
+			field:    field,
+			testOnly: true,
+		})
+}
+
+func (fac *baseExprFactory) NewSelect(id int64, operand Expr, field string) Expr {
+	return fac.newExpr(
+		id,
+		&baseSelectExpr{
+			operand: operand,
+			field:   field,
+		})
+}
+
+func (fac *baseExprFactory) NewStruct(id int64, typeName string, fields []EntryExpr) Expr {
+	return fac.newExpr(
+		id,
+		&baseStructExpr{
+			typeName: typeName,
+			fields:   fields,
+		})
+}
+
+func (fac *baseExprFactory) NewStructField(id int64, field string, value Expr, isOptional bool) EntryExpr {
+	return fac.newEntryExpr(
+		id,
+		&baseStructField{
+			field:      field,
+			value:      value,
+			isOptional: isOptional,
+		})
+}
+
+func (fac *baseExprFactory) NewUnspecifiedExpr(id int64) Expr {
+	return fac.newExpr(id, nil)
+}
+
+func (fac *baseExprFactory) CopyExpr(e Expr) Expr {
+	// unwrap navigable expressions to avoid unnecessary allocations during copying.
+	if nav, ok := e.(*navigableExprImpl); ok {
+		e = nav.Expr
+	}
+	switch e.Kind() {
+	case CallKind:
+		c := e.AsCall()
+		argsCopy := make([]Expr, len(c.Args()))
+		for i, arg := range c.Args() {
+			argsCopy[i] = fac.CopyExpr(arg)
+		}
+		if !c.IsMemberFunction() {
+			return fac.NewCall(e.ID(), c.FunctionName(), argsCopy...)
+		}
+		return fac.NewMemberCall(e.ID(), c.FunctionName(), fac.CopyExpr(c.Target()), argsCopy...)
+	case ComprehensionKind:
+		compre := e.AsComprehension()
+		return fac.NewComprehensionTwoVar(e.ID(),
+			fac.CopyExpr(compre.IterRange()),
+			compre.IterVar(),
+			compre.IterVar2(),
+			compre.AccuVar(),
+			fac.CopyExpr(compre.AccuInit()),
+			fac.CopyExpr(compre.LoopCondition()),
+			fac.CopyExpr(compre.LoopStep()),
+			fac.CopyExpr(compre.Result()))
+	case IdentKind:
+		return fac.NewIdent(e.ID(), e.AsIdent())
+	case ListKind:
+		l := e.AsList()
+		elemsCopy := make([]Expr, l.Size())
+		for i, elem := range l.Elements() {
+			elemsCopy[i] = fac.CopyExpr(elem)
+		}
+		return fac.NewList(e.ID(), elemsCopy, l.OptionalIndices())
+	case LiteralKind:
+		return fac.NewLiteral(e.ID(), e.AsLiteral())
+	case MapKind:
+		m := e.AsMap()
+		entriesCopy := make([]EntryExpr, m.Size())
+		for i, entry := range m.Entries() {
+			entriesCopy[i] = fac.CopyEntryExpr(entry)
+		}
+		return fac.NewMap(e.ID(), entriesCopy)
+	case SelectKind:
+		s := e.AsSelect()
+		if s.IsTestOnly() {
+			return fac.NewPresenceTest(e.ID(), fac.CopyExpr(s.Operand()), s.FieldName())
+		}
+		return fac.NewSelect(e.ID(), fac.CopyExpr(s.Operand()), s.FieldName())
+	case StructKind:
+		s := e.AsStruct()
+		fieldsCopy := make([]EntryExpr, len(s.Fields()))
+		for i, field := range s.Fields() {
+			fieldsCopy[i] = fac.CopyEntryExpr(field)
+		}
+		return fac.NewStruct(e.ID(), s.TypeName(), fieldsCopy)
+	default:
+		return fac.NewUnspecifiedExpr(e.ID())
+	}
+}
+
+func (fac *baseExprFactory) CopyEntryExpr(e EntryExpr) EntryExpr {
+	switch e.Kind() {
+	case MapEntryKind:
+		entry := e.AsMapEntry()
+		return fac.NewMapEntry(e.ID(),
+			fac.CopyExpr(entry.Key()), fac.CopyExpr(entry.Value()), entry.IsOptional())
+	case StructFieldKind:
+		field := e.AsStructField()
+		return fac.NewStructField(e.ID(),
+			field.Name(), fac.CopyExpr(field.Value()), field.IsOptional())
+	default:
+		return fac.newEntryExpr(e.ID(), nil)
+	}
+}
+
+func (*baseExprFactory) isExprFactory() {}
+
+func (fac *baseExprFactory) newExpr(id int64, e exprKindCase) Expr {
+	return &expr{
+		id:           id,
+		exprKindCase: e,
+	}
+}
+
+func (fac *baseExprFactory) newEntryExpr(id int64, e entryExprKindCase) EntryExpr {
+	return &entryExpr{
+		id:                id,
+		entryExprKindCase: e,
+	}
+}
+
+var (
+	defaultFactory = &baseExprFactory{}
+)
diff --git a/vendor/github.com/google/cel-go/common/ast/navigable.go b/vendor/github.com/google/cel-go/common/ast/navigable.go
new file mode 100644
index 0000000..d7a90fb
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/ast/navigable.go
@@ -0,0 +1,660 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ast
+
+import (
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+)
+
+// NavigableExpr represents the base navigable expression value with methods to inspect the
+// parent and child expressions.
+type NavigableExpr interface {
+	Expr
+
+	// Type of the expression.
+	//
+	// If the expression is type-checked, the type check metadata is returned. If the expression
+	// has not been type-checked, the types.DynType value is returned.
+	Type() *types.Type
+
+	// Parent returns the parent expression node, if one exists.
+	Parent() (NavigableExpr, bool)
+
+	// Children returns a list of child expression nodes.
+	Children() []NavigableExpr
+
+	// Depth indicates the depth in the expression tree.
+	//
+	// The root expression has depth 0.
+	Depth() int
+}
+
+// NavigateAST converts an AST to a NavigableExpr
+func NavigateAST(ast *AST) NavigableExpr {
+	return NavigateExpr(ast, ast.Expr())
+}
+
+// NavigateExpr creates a NavigableExpr whose type information is backed by the input AST.
+//
+// If the expression is already a NavigableExpr, the parent and depth information will be
+// propagated on the new NavigableExpr value; otherwise, the expr value will be treated
+// as though it is the root of the expression graph with a depth of 0.
+func NavigateExpr(ast *AST, expr Expr) NavigableExpr {
+	depth := 0
+	var parent NavigableExpr = nil
+	if nav, ok := expr.(NavigableExpr); ok {
+		depth = nav.Depth()
+		parent, _ = nav.Parent()
+	}
+	return newNavigableExpr(ast, parent, expr, depth)
+}
+
+// ExprMatcher takes a NavigableExpr in and indicates whether the value is a match.
+//
+// This function type should be use with the `Match` and `MatchList` calls.
+type ExprMatcher func(NavigableExpr) bool
+
+// ConstantValueMatcher returns an ExprMatcher which will return true if the input NavigableExpr
+// is comprised of all constant values, such as a simple literal or even list and map literal.
+func ConstantValueMatcher() ExprMatcher {
+	return matchIsConstantValue
+}
+
+// KindMatcher returns an ExprMatcher which will return true if the input NavigableExpr.Kind() matches
+// the specified `kind`.
+func KindMatcher(kind ExprKind) ExprMatcher {
+	return func(e NavigableExpr) bool {
+		return e.Kind() == kind
+	}
+}
+
+// FunctionMatcher returns an ExprMatcher which will match NavigableExpr nodes of CallKind type whose
+// function name is equal to `funcName`.
+func FunctionMatcher(funcName string) ExprMatcher {
+	return func(e NavigableExpr) bool {
+		if e.Kind() != CallKind {
+			return false
+		}
+		return e.AsCall().FunctionName() == funcName
+	}
+}
+
+// AllMatcher returns true for all descendants of a NavigableExpr, effectively flattening them into a list.
+//
+// Such a result would work well with subsequent MatchList calls.
+func AllMatcher() ExprMatcher {
+	return func(NavigableExpr) bool {
+		return true
+	}
+}
+
+// MatchDescendants takes a NavigableExpr and ExprMatcher and produces a list of NavigableExpr values
+// matching the input criteria in post-order (bottom up).
+func MatchDescendants(expr NavigableExpr, matcher ExprMatcher) []NavigableExpr {
+	matches := []NavigableExpr{}
+	navVisitor := &baseVisitor{
+		visitExpr: func(e Expr) {
+			nav := e.(NavigableExpr)
+			if matcher(nav) {
+				matches = append(matches, nav)
+			}
+		},
+	}
+	visit(expr, navVisitor, postOrder, 0, 0)
+	return matches
+}
+
+// MatchSubset applies an ExprMatcher to a list of NavigableExpr values and their descendants, producing a
+// subset of NavigableExpr values which match.
+func MatchSubset(exprs []NavigableExpr, matcher ExprMatcher) []NavigableExpr {
+	matches := []NavigableExpr{}
+	navVisitor := &baseVisitor{
+		visitExpr: func(e Expr) {
+			nav := e.(NavigableExpr)
+			if matcher(nav) {
+				matches = append(matches, nav)
+			}
+		},
+	}
+	for _, expr := range exprs {
+		visit(expr, navVisitor, postOrder, 0, 1)
+	}
+	return matches
+}
+
+// Visitor defines an object for visiting Expr and EntryExpr nodes within an expression graph.
+type Visitor interface {
+	// VisitExpr visits the input expression.
+	VisitExpr(Expr)
+
+	// VisitEntryExpr visits the input entry expression, i.e. a struct field or map entry.
+	VisitEntryExpr(EntryExpr)
+}
+
+type baseVisitor struct {
+	visitExpr      func(Expr)
+	visitEntryExpr func(EntryExpr)
+}
+
+// VisitExpr visits the Expr if the internal expr visitor has been configured.
+func (v *baseVisitor) VisitExpr(e Expr) {
+	if v.visitExpr != nil {
+		v.visitExpr(e)
+	}
+}
+
+// VisitEntryExpr visits the entry if the internal expr entry visitor has been configured.
+func (v *baseVisitor) VisitEntryExpr(e EntryExpr) {
+	if v.visitEntryExpr != nil {
+		v.visitEntryExpr(e)
+	}
+}
+
+// NewExprVisitor creates a visitor which only visits expression nodes.
+func NewExprVisitor(v func(Expr)) Visitor {
+	return &baseVisitor{
+		visitExpr:      v,
+		visitEntryExpr: nil,
+	}
+}
+
+// PostOrderVisit walks the expression graph and calls the visitor in post-order (bottom-up).
+func PostOrderVisit(expr Expr, visitor Visitor) {
+	visit(expr, visitor, postOrder, 0, 0)
+}
+
+// PreOrderVisit walks the expression graph and calls the visitor in pre-order (top-down).
+func PreOrderVisit(expr Expr, visitor Visitor) {
+	visit(expr, visitor, preOrder, 0, 0)
+}
+
+type visitOrder int
+
+const (
+	preOrder = iota + 1
+	postOrder
+)
+
+// TODO: consider exposing a way to configure a limit for the max visit depth.
+// It's possible that we could want to configure this on the NewExprVisitor()
+// and through MatchDescendents() / MaxID().
+func visit(expr Expr, visitor Visitor, order visitOrder, depth, maxDepth int) {
+	if maxDepth > 0 && depth == maxDepth {
+		return
+	}
+	if order == preOrder {
+		visitor.VisitExpr(expr)
+	}
+	switch expr.Kind() {
+	case CallKind:
+		c := expr.AsCall()
+		if c.IsMemberFunction() {
+			visit(c.Target(), visitor, order, depth+1, maxDepth)
+		}
+		for _, arg := range c.Args() {
+			visit(arg, visitor, order, depth+1, maxDepth)
+		}
+	case ComprehensionKind:
+		c := expr.AsComprehension()
+		visit(c.IterRange(), visitor, order, depth+1, maxDepth)
+		visit(c.AccuInit(), visitor, order, depth+1, maxDepth)
+		visit(c.LoopCondition(), visitor, order, depth+1, maxDepth)
+		visit(c.LoopStep(), visitor, order, depth+1, maxDepth)
+		visit(c.Result(), visitor, order, depth+1, maxDepth)
+	case ListKind:
+		l := expr.AsList()
+		for _, elem := range l.Elements() {
+			visit(elem, visitor, order, depth+1, maxDepth)
+		}
+	case MapKind:
+		m := expr.AsMap()
+		for _, e := range m.Entries() {
+			if order == preOrder {
+				visitor.VisitEntryExpr(e)
+			}
+			entry := e.AsMapEntry()
+			visit(entry.Key(), visitor, order, depth+1, maxDepth)
+			visit(entry.Value(), visitor, order, depth+1, maxDepth)
+			if order == postOrder {
+				visitor.VisitEntryExpr(e)
+			}
+		}
+	case SelectKind:
+		visit(expr.AsSelect().Operand(), visitor, order, depth+1, maxDepth)
+	case StructKind:
+		s := expr.AsStruct()
+		for _, f := range s.Fields() {
+			visitor.VisitEntryExpr(f)
+			visit(f.AsStructField().Value(), visitor, order, depth+1, maxDepth)
+		}
+	}
+	if order == postOrder {
+		visitor.VisitExpr(expr)
+	}
+}
+
+func matchIsConstantValue(e NavigableExpr) bool {
+	if e.Kind() == LiteralKind {
+		return true
+	}
+	if e.Kind() == StructKind || e.Kind() == MapKind || e.Kind() == ListKind {
+		for _, child := range e.Children() {
+			if !matchIsConstantValue(child) {
+				return false
+			}
+		}
+		return true
+	}
+	return false
+}
+
+func newNavigableExpr(ast *AST, parent NavigableExpr, expr Expr, depth int) NavigableExpr {
+	// Reduce navigable expression nesting by unwrapping the embedded Expr value.
+	if nav, ok := expr.(*navigableExprImpl); ok {
+		expr = nav.Expr
+	}
+	nav := &navigableExprImpl{
+		Expr:           expr,
+		depth:          depth,
+		ast:            ast,
+		parent:         parent,
+		createChildren: getChildFactory(expr),
+	}
+	return nav
+}
+
+type navigableExprImpl struct {
+	Expr
+	depth          int
+	ast            *AST
+	parent         NavigableExpr
+	createChildren childFactory
+}
+
+func (nav *navigableExprImpl) Parent() (NavigableExpr, bool) {
+	if nav.parent != nil {
+		return nav.parent, true
+	}
+	return nil, false
+}
+
+func (nav *navigableExprImpl) ID() int64 {
+	return nav.Expr.ID()
+}
+
+func (nav *navigableExprImpl) Kind() ExprKind {
+	return nav.Expr.Kind()
+}
+
+func (nav *navigableExprImpl) Type() *types.Type {
+	return nav.ast.GetType(nav.ID())
+}
+
+func (nav *navigableExprImpl) Children() []NavigableExpr {
+	return nav.createChildren(nav)
+}
+
+func (nav *navigableExprImpl) Depth() int {
+	return nav.depth
+}
+
+func (nav *navigableExprImpl) AsCall() CallExpr {
+	return navigableCallImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) AsComprehension() ComprehensionExpr {
+	return navigableComprehensionImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) AsIdent() string {
+	return nav.Expr.AsIdent()
+}
+
+func (nav *navigableExprImpl) AsList() ListExpr {
+	return navigableListImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) AsLiteral() ref.Val {
+	return nav.Expr.AsLiteral()
+}
+
+func (nav *navigableExprImpl) AsMap() MapExpr {
+	return navigableMapImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) AsSelect() SelectExpr {
+	return navigableSelectImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) AsStruct() StructExpr {
+	return navigableStructImpl{navigableExprImpl: nav}
+}
+
+func (nav *navigableExprImpl) createChild(e Expr) NavigableExpr {
+	return newNavigableExpr(nav.ast, nav, e, nav.depth+1)
+}
+
+func (nav *navigableExprImpl) isExpr() {}
+
+type navigableCallImpl struct {
+	*navigableExprImpl
+}
+
+func (call navigableCallImpl) FunctionName() string {
+	return call.Expr.AsCall().FunctionName()
+}
+
+func (call navigableCallImpl) IsMemberFunction() bool {
+	return call.Expr.AsCall().IsMemberFunction()
+}
+
+func (call navigableCallImpl) Target() Expr {
+	t := call.Expr.AsCall().Target()
+	if t != nil {
+		return call.createChild(t)
+	}
+	return nil
+}
+
+func (call navigableCallImpl) Args() []Expr {
+	args := call.Expr.AsCall().Args()
+	navArgs := make([]Expr, len(args))
+	for i, a := range args {
+		navArgs[i] = call.createChild(a)
+	}
+	return navArgs
+}
+
+type navigableComprehensionImpl struct {
+	*navigableExprImpl
+}
+
+func (comp navigableComprehensionImpl) IterRange() Expr {
+	return comp.createChild(comp.Expr.AsComprehension().IterRange())
+}
+
+func (comp navigableComprehensionImpl) IterVar() string {
+	return comp.Expr.AsComprehension().IterVar()
+}
+
+func (comp navigableComprehensionImpl) IterVar2() string {
+	return comp.Expr.AsComprehension().IterVar2()
+}
+
+func (comp navigableComprehensionImpl) HasIterVar2() bool {
+	return comp.Expr.AsComprehension().HasIterVar2()
+}
+
+func (comp navigableComprehensionImpl) AccuVar() string {
+	return comp.Expr.AsComprehension().AccuVar()
+}
+
+func (comp navigableComprehensionImpl) AccuInit() Expr {
+	return comp.createChild(comp.Expr.AsComprehension().AccuInit())
+}
+
+func (comp navigableComprehensionImpl) LoopCondition() Expr {
+	return comp.createChild(comp.Expr.AsComprehension().LoopCondition())
+}
+
+func (comp navigableComprehensionImpl) LoopStep() Expr {
+	return comp.createChild(comp.Expr.AsComprehension().LoopStep())
+}
+
+func (comp navigableComprehensionImpl) Result() Expr {
+	return comp.createChild(comp.Expr.AsComprehension().Result())
+}
+
+type navigableListImpl struct {
+	*navigableExprImpl
+}
+
+func (l navigableListImpl) Elements() []Expr {
+	pbElems := l.Expr.AsList().Elements()
+	elems := make([]Expr, len(pbElems))
+	for i := 0; i < len(pbElems); i++ {
+		elems[i] = l.createChild(pbElems[i])
+	}
+	return elems
+}
+
+func (l navigableListImpl) IsOptional(index int32) bool {
+	return l.Expr.AsList().IsOptional(index)
+}
+
+func (l navigableListImpl) OptionalIndices() []int32 {
+	return l.Expr.AsList().OptionalIndices()
+}
+
+func (l navigableListImpl) Size() int {
+	return l.Expr.AsList().Size()
+}
+
+type navigableMapImpl struct {
+	*navigableExprImpl
+}
+
+func (m navigableMapImpl) Entries() []EntryExpr {
+	mapExpr := m.Expr.AsMap()
+	entries := make([]EntryExpr, len(mapExpr.Entries()))
+	for i, e := range mapExpr.Entries() {
+		entry := e.AsMapEntry()
+		entries[i] = &entryExpr{
+			id: e.ID(),
+			entryExprKindCase: navigableEntryImpl{
+				key:   m.createChild(entry.Key()),
+				val:   m.createChild(entry.Value()),
+				isOpt: entry.IsOptional(),
+			},
+		}
+	}
+	return entries
+}
+
+func (m navigableMapImpl) Size() int {
+	return m.Expr.AsMap().Size()
+}
+
+type navigableEntryImpl struct {
+	key   NavigableExpr
+	val   NavigableExpr
+	isOpt bool
+}
+
+func (e navigableEntryImpl) Kind() EntryExprKind {
+	return MapEntryKind
+}
+
+func (e navigableEntryImpl) Key() Expr {
+	return e.key
+}
+
+func (e navigableEntryImpl) Value() Expr {
+	return e.val
+}
+
+func (e navigableEntryImpl) IsOptional() bool {
+	return e.isOpt
+}
+
+func (e navigableEntryImpl) renumberIDs(IDGenerator) {}
+
+func (e navigableEntryImpl) isEntryExpr() {}
+
+type navigableSelectImpl struct {
+	*navigableExprImpl
+}
+
+func (sel navigableSelectImpl) FieldName() string {
+	return sel.Expr.AsSelect().FieldName()
+}
+
+func (sel navigableSelectImpl) IsTestOnly() bool {
+	return sel.Expr.AsSelect().IsTestOnly()
+}
+
+func (sel navigableSelectImpl) Operand() Expr {
+	return sel.createChild(sel.Expr.AsSelect().Operand())
+}
+
+type navigableStructImpl struct {
+	*navigableExprImpl
+}
+
+func (s navigableStructImpl) TypeName() string {
+	return s.Expr.AsStruct().TypeName()
+}
+
+func (s navigableStructImpl) Fields() []EntryExpr {
+	fieldInits := s.Expr.AsStruct().Fields()
+	fields := make([]EntryExpr, len(fieldInits))
+	for i, f := range fieldInits {
+		field := f.AsStructField()
+		fields[i] = &entryExpr{
+			id: f.ID(),
+			entryExprKindCase: navigableFieldImpl{
+				name:  field.Name(),
+				val:   s.createChild(field.Value()),
+				isOpt: field.IsOptional(),
+			},
+		}
+	}
+	return fields
+}
+
+type navigableFieldImpl struct {
+	name  string
+	val   NavigableExpr
+	isOpt bool
+}
+
+func (f navigableFieldImpl) Kind() EntryExprKind {
+	return StructFieldKind
+}
+
+func (f navigableFieldImpl) Name() string {
+	return f.name
+}
+
+func (f navigableFieldImpl) Value() Expr {
+	return f.val
+}
+
+func (f navigableFieldImpl) IsOptional() bool {
+	return f.isOpt
+}
+
+func (f navigableFieldImpl) renumberIDs(IDGenerator) {}
+
+func (f navigableFieldImpl) isEntryExpr() {}
+
+func getChildFactory(expr Expr) childFactory {
+	if expr == nil {
+		return noopFactory
+	}
+	switch expr.Kind() {
+	case LiteralKind:
+		return noopFactory
+	case IdentKind:
+		return noopFactory
+	case SelectKind:
+		return selectFactory
+	case CallKind:
+		return callArgFactory
+	case ListKind:
+		return listElemFactory
+	case MapKind:
+		return mapEntryFactory
+	case StructKind:
+		return structEntryFactory
+	case ComprehensionKind:
+		return comprehensionFactory
+	default:
+		return noopFactory
+	}
+}
+
+type childFactory func(*navigableExprImpl) []NavigableExpr
+
+func noopFactory(*navigableExprImpl) []NavigableExpr {
+	return nil
+}
+
+func selectFactory(nav *navigableExprImpl) []NavigableExpr {
+	return []NavigableExpr{nav.createChild(nav.AsSelect().Operand())}
+}
+
+func callArgFactory(nav *navigableExprImpl) []NavigableExpr {
+	call := nav.Expr.AsCall()
+	argCount := len(call.Args())
+	if call.IsMemberFunction() {
+		argCount++
+	}
+	navExprs := make([]NavigableExpr, argCount)
+	i := 0
+	if call.IsMemberFunction() {
+		navExprs[i] = nav.createChild(call.Target())
+		i++
+	}
+	for _, arg := range call.Args() {
+		navExprs[i] = nav.createChild(arg)
+		i++
+	}
+	return navExprs
+}
+
+func listElemFactory(nav *navigableExprImpl) []NavigableExpr {
+	l := nav.Expr.AsList()
+	navExprs := make([]NavigableExpr, len(l.Elements()))
+	for i, e := range l.Elements() {
+		navExprs[i] = nav.createChild(e)
+	}
+	return navExprs
+}
+
+func structEntryFactory(nav *navigableExprImpl) []NavigableExpr {
+	s := nav.Expr.AsStruct()
+	entries := make([]NavigableExpr, len(s.Fields()))
+	for i, e := range s.Fields() {
+		f := e.AsStructField()
+		entries[i] = nav.createChild(f.Value())
+	}
+	return entries
+}
+
+func mapEntryFactory(nav *navigableExprImpl) []NavigableExpr {
+	m := nav.Expr.AsMap()
+	entries := make([]NavigableExpr, len(m.Entries())*2)
+	j := 0
+	for _, e := range m.Entries() {
+		mapEntry := e.AsMapEntry()
+		entries[j] = nav.createChild(mapEntry.Key())
+		entries[j+1] = nav.createChild(mapEntry.Value())
+		j += 2
+	}
+	return entries
+}
+
+func comprehensionFactory(nav *navigableExprImpl) []NavigableExpr {
+	compre := nav.Expr.AsComprehension()
+	return []NavigableExpr{
+		nav.createChild(compre.IterRange()),
+		nav.createChild(compre.AccuInit()),
+		nav.createChild(compre.LoopCondition()),
+		nav.createChild(compre.LoopStep()),
+		nav.createChild(compre.Result()),
+	}
+}
diff --git a/vendor/github.com/google/cel-go/common/containers/BUILD.bazel b/vendor/github.com/google/cel-go/common/containers/BUILD.bazel
index 18142d9..81197f0 100644
--- a/vendor/github.com/google/cel-go/common/containers/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/containers/BUILD.bazel
@@ -12,7 +12,7 @@ go_library(
     ],
     importpath = "github.com/google/cel-go/common/containers",
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "//common/ast:go_default_library",
     ],
 )
 
@@ -26,6 +26,6 @@ go_test(
         ":go_default_library",
     ],
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "//common/ast:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/common/containers/container.go b/vendor/github.com/google/cel-go/common/containers/container.go
index d46698d..3097a3f 100644
--- a/vendor/github.com/google/cel-go/common/containers/container.go
+++ b/vendor/github.com/google/cel-go/common/containers/container.go
@@ -19,8 +19,9 @@ package containers
 import (
 	"fmt"
 	"strings"
+	"unicode"
 
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
 )
 
 var (
@@ -212,6 +213,13 @@ type ContainerOption func(*Container) (*Container, error)
 func Abbrevs(qualifiedNames ...string) ContainerOption {
 	return func(c *Container) (*Container, error) {
 		for _, qn := range qualifiedNames {
+			qn = strings.TrimSpace(qn)
+			for _, r := range qn {
+				if !isIdentifierChar(r) {
+					return nil, fmt.Errorf(
+						"invalid qualified name: %s, wanted name of the form 'qualified.name'", qn)
+				}
+			}
 			ind := strings.LastIndex(qn, ".")
 			if ind <= 0 || ind >= len(qn)-1 {
 				return nil, fmt.Errorf(
@@ -278,6 +286,10 @@ func aliasAs(kind, qualifiedName, alias string) ContainerOption {
 	}
 }
 
+func isIdentifierChar(r rune) bool {
+	return r <= unicode.MaxASCII && (r == '.' || r == '_' || unicode.IsLetter(r) || unicode.IsNumber(r))
+}
+
 // Name sets the fully-qualified name of the Container.
 func Name(name string) ContainerOption {
 	return func(c *Container) (*Container, error) {
@@ -297,19 +309,19 @@ func Name(name string) ContainerOption {
 
 // ToQualifiedName converts an expression AST into a qualified name if possible, with a boolean
 // 'found' value that indicates if the conversion is successful.
-func ToQualifiedName(e *exprpb.Expr) (string, bool) {
-	switch e.GetExprKind().(type) {
-	case *exprpb.Expr_IdentExpr:
-		id := e.GetIdentExpr()
-		return id.GetName(), true
-	case *exprpb.Expr_SelectExpr:
-		sel := e.GetSelectExpr()
+func ToQualifiedName(e ast.Expr) (string, bool) {
+	switch e.Kind() {
+	case ast.IdentKind:
+		id := e.AsIdent()
+		return id, true
+	case ast.SelectKind:
+		sel := e.AsSelect()
 		// Test only expressions are not valid as qualified names.
-		if sel.GetTestOnly() {
+		if sel.IsTestOnly() {
 			return "", false
 		}
-		if qual, found := ToQualifiedName(sel.GetOperand()); found {
-			return qual + "." + sel.GetField(), true
+		if qual, found := ToQualifiedName(sel.Operand()); found {
+			return qual + "." + sel.FieldName(), true
 		}
 	}
 	return "", false
diff --git a/vendor/github.com/google/cel-go/common/debug/BUILD.bazel b/vendor/github.com/google/cel-go/common/debug/BUILD.bazel
index cf5c5d2..724ed34 100644
--- a/vendor/github.com/google/cel-go/common/debug/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/debug/BUILD.bazel
@@ -13,6 +13,8 @@ go_library(
     importpath = "github.com/google/cel-go/common/debug",
     deps = [
         "//common:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "//common/ast:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/common/debug/debug.go b/vendor/github.com/google/cel-go/common/debug/debug.go
index 5dab156..25d2e3d 100644
--- a/vendor/github.com/google/cel-go/common/debug/debug.go
+++ b/vendor/github.com/google/cel-go/common/debug/debug.go
@@ -22,7 +22,9 @@ import (
 	"strconv"
 	"strings"
 
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
 )
 
 // Adorner returns debug metadata that will be tacked on to the string
@@ -38,7 +40,7 @@ type Writer interface {
 
 	// Buffer pushes an expression into an internal queue of expressions to
 	// write to a string.
-	Buffer(e *exprpb.Expr)
+	Buffer(e ast.Expr)
 }
 
 type emptyDebugAdorner struct {
@@ -51,12 +53,12 @@ func (a *emptyDebugAdorner) GetMetadata(e any) string {
 }
 
 // ToDebugString gives the unadorned string representation of the Expr.
-func ToDebugString(e *exprpb.Expr) string {
+func ToDebugString(e ast.Expr) string {
 	return ToAdornedDebugString(e, emptyAdorner)
 }
 
 // ToAdornedDebugString gives the adorned string representation of the Expr.
-func ToAdornedDebugString(e *exprpb.Expr, adorner Adorner) string {
+func ToAdornedDebugString(e ast.Expr, adorner Adorner) string {
 	w := newDebugWriter(adorner)
 	w.Buffer(e)
 	return w.String()
@@ -78,49 +80,51 @@ func newDebugWriter(a Adorner) *debugWriter {
 	}
 }
 
-func (w *debugWriter) Buffer(e *exprpb.Expr) {
+func (w *debugWriter) Buffer(e ast.Expr) {
 	if e == nil {
 		return
 	}
-	switch e.ExprKind.(type) {
-	case *exprpb.Expr_ConstExpr:
-		w.append(formatLiteral(e.GetConstExpr()))
-	case *exprpb.Expr_IdentExpr:
-		w.append(e.GetIdentExpr().Name)
-	case *exprpb.Expr_SelectExpr:
-		w.appendSelect(e.GetSelectExpr())
-	case *exprpb.Expr_CallExpr:
-		w.appendCall(e.GetCallExpr())
-	case *exprpb.Expr_ListExpr:
-		w.appendList(e.GetListExpr())
-	case *exprpb.Expr_StructExpr:
-		w.appendStruct(e.GetStructExpr())
-	case *exprpb.Expr_ComprehensionExpr:
-		w.appendComprehension(e.GetComprehensionExpr())
+	switch e.Kind() {
+	case ast.LiteralKind:
+		w.append(formatLiteral(e.AsLiteral()))
+	case ast.IdentKind:
+		w.append(e.AsIdent())
+	case ast.SelectKind:
+		w.appendSelect(e.AsSelect())
+	case ast.CallKind:
+		w.appendCall(e.AsCall())
+	case ast.ListKind:
+		w.appendList(e.AsList())
+	case ast.MapKind:
+		w.appendMap(e.AsMap())
+	case ast.StructKind:
+		w.appendStruct(e.AsStruct())
+	case ast.ComprehensionKind:
+		w.appendComprehension(e.AsComprehension())
 	}
 	w.adorn(e)
 }
 
-func (w *debugWriter) appendSelect(sel *exprpb.Expr_Select) {
-	w.Buffer(sel.GetOperand())
+func (w *debugWriter) appendSelect(sel ast.SelectExpr) {
+	w.Buffer(sel.Operand())
 	w.append(".")
-	w.append(sel.GetField())
-	if sel.TestOnly {
+	w.append(sel.FieldName())
+	if sel.IsTestOnly() {
 		w.append("~test-only~")
 	}
 }
 
-func (w *debugWriter) appendCall(call *exprpb.Expr_Call) {
-	if call.Target != nil {
-		w.Buffer(call.GetTarget())
+func (w *debugWriter) appendCall(call ast.CallExpr) {
+	if call.IsMemberFunction() {
+		w.Buffer(call.Target())
 		w.append(".")
 	}
-	w.append(call.GetFunction())
+	w.append(call.FunctionName())
 	w.append("(")
-	if len(call.GetArgs()) > 0 {
+	if len(call.Args()) > 0 {
 		w.addIndent()
 		w.appendLine()
-		for i, arg := range call.GetArgs() {
+		for i, arg := range call.Args() {
 			if i > 0 {
 				w.append(",")
 				w.appendLine()
@@ -133,12 +137,12 @@ func (w *debugWriter) appendCall(call *exprpb.Expr_Call) {
 	w.append(")")
 }
 
-func (w *debugWriter) appendList(list *exprpb.Expr_CreateList) {
+func (w *debugWriter) appendList(list ast.ListExpr) {
 	w.append("[")
-	if len(list.GetElements()) > 0 {
+	if len(list.Elements()) > 0 {
 		w.appendLine()
 		w.addIndent()
-		for i, elem := range list.GetElements() {
+		for i, elem := range list.Elements() {
 			if i > 0 {
 				w.append(",")
 				w.appendLine()
@@ -151,32 +155,25 @@ func (w *debugWriter) appendList(list *exprpb.Expr_CreateList) {
 	w.append("]")
 }
 
-func (w *debugWriter) appendStruct(obj *exprpb.Expr_CreateStruct) {
-	if obj.MessageName != "" {
-		w.appendObject(obj)
-	} else {
-		w.appendMap(obj)
-	}
-}
-
-func (w *debugWriter) appendObject(obj *exprpb.Expr_CreateStruct) {
-	w.append(obj.GetMessageName())
+func (w *debugWriter) appendStruct(obj ast.StructExpr) {
+	w.append(obj.TypeName())
 	w.append("{")
-	if len(obj.GetEntries()) > 0 {
+	if len(obj.Fields()) > 0 {
 		w.appendLine()
 		w.addIndent()
-		for i, entry := range obj.GetEntries() {
+		for i, f := range obj.Fields() {
+			field := f.AsStructField()
 			if i > 0 {
 				w.append(",")
 				w.appendLine()
 			}
-			if entry.GetOptionalEntry() {
+			if field.IsOptional() {
 				w.append("?")
 			}
-			w.append(entry.GetFieldKey())
+			w.append(field.Name())
 			w.append(":")
-			w.Buffer(entry.GetValue())
-			w.adorn(entry)
+			w.Buffer(field.Value())
+			w.adorn(f)
 		}
 		w.removeIndent()
 		w.appendLine()
@@ -184,23 +181,24 @@ func (w *debugWriter) appendObject(obj *exprpb.Expr_CreateStruct) {
 	w.append("}")
 }
 
-func (w *debugWriter) appendMap(obj *exprpb.Expr_CreateStruct) {
+func (w *debugWriter) appendMap(m ast.MapExpr) {
 	w.append("{")
-	if len(obj.GetEntries()) > 0 {
+	if m.Size() > 0 {
 		w.appendLine()
 		w.addIndent()
-		for i, entry := range obj.GetEntries() {
+		for i, e := range m.Entries() {
+			entry := e.AsMapEntry()
 			if i > 0 {
 				w.append(",")
 				w.appendLine()
 			}
-			if entry.GetOptionalEntry() {
+			if entry.IsOptional() {
 				w.append("?")
 			}
-			w.Buffer(entry.GetMapKey())
+			w.Buffer(entry.Key())
 			w.append(":")
-			w.Buffer(entry.GetValue())
-			w.adorn(entry)
+			w.Buffer(entry.Value())
+			w.adorn(e)
 		}
 		w.removeIndent()
 		w.appendLine()
@@ -208,62 +206,67 @@ func (w *debugWriter) appendMap(obj *exprpb.Expr_CreateStruct) {
 	w.append("}")
 }
 
-func (w *debugWriter) appendComprehension(comprehension *exprpb.Expr_Comprehension) {
+func (w *debugWriter) appendComprehension(comprehension ast.ComprehensionExpr) {
 	w.append("__comprehension__(")
 	w.addIndent()
 	w.appendLine()
 	w.append("// Variable")
 	w.appendLine()
-	w.append(comprehension.GetIterVar())
+	w.append(comprehension.IterVar())
 	w.append(",")
 	w.appendLine()
+	if comprehension.HasIterVar2() {
+		w.append(comprehension.IterVar2())
+		w.append(",")
+		w.appendLine()
+	}
 	w.append("// Target")
 	w.appendLine()
-	w.Buffer(comprehension.GetIterRange())
+	w.Buffer(comprehension.IterRange())
 	w.append(",")
 	w.appendLine()
 	w.append("// Accumulator")
 	w.appendLine()
-	w.append(comprehension.GetAccuVar())
+	w.append(comprehension.AccuVar())
 	w.append(",")
 	w.appendLine()
 	w.append("// Init")
 	w.appendLine()
-	w.Buffer(comprehension.GetAccuInit())
+	w.Buffer(comprehension.AccuInit())
 	w.append(",")
 	w.appendLine()
 	w.append("// LoopCondition")
 	w.appendLine()
-	w.Buffer(comprehension.GetLoopCondition())
+	w.Buffer(comprehension.LoopCondition())
 	w.append(",")
 	w.appendLine()
 	w.append("// LoopStep")
 	w.appendLine()
-	w.Buffer(comprehension.GetLoopStep())
+	w.Buffer(comprehension.LoopStep())
 	w.append(",")
 	w.appendLine()
 	w.append("// Result")
 	w.appendLine()
-	w.Buffer(comprehension.GetResult())
+	w.Buffer(comprehension.Result())
 	w.append(")")
 	w.removeIndent()
 }
 
-func formatLiteral(c *exprpb.Constant) string {
-	switch c.GetConstantKind().(type) {
-	case *exprpb.Constant_BoolValue:
-		return fmt.Sprintf("%t", c.GetBoolValue())
-	case *exprpb.Constant_BytesValue:
-		return fmt.Sprintf("b\"%s\"", string(c.GetBytesValue()))
-	case *exprpb.Constant_DoubleValue:
-		return fmt.Sprintf("%v", c.GetDoubleValue())
-	case *exprpb.Constant_Int64Value:
-		return fmt.Sprintf("%d", c.GetInt64Value())
-	case *exprpb.Constant_StringValue:
-		return strconv.Quote(c.GetStringValue())
-	case *exprpb.Constant_Uint64Value:
-		return fmt.Sprintf("%du", c.GetUint64Value())
-	case *exprpb.Constant_NullValue:
+func formatLiteral(c ref.Val) string {
+	switch v := c.(type) {
+	case types.Bool:
+		return fmt.Sprintf("%t", v)
+	case types.Bytes:
+		return fmt.Sprintf("b\"%s\"", string(v))
+	case types.Double:
+		return fmt.Sprintf("%v", float64(v))
+	case types.Int:
+		return fmt.Sprintf("%d", int64(v))
+	case types.String:
+		return strconv.Quote(string(v))
+	case types.Uint:
+		return fmt.Sprintf("%du", uint64(v))
+	case types.Null:
 		return "null"
 	default:
 		panic("Unknown constant type")
diff --git a/vendor/github.com/google/cel-go/common/decls/BUILD.bazel b/vendor/github.com/google/cel-go/common/decls/BUILD.bazel
new file mode 100644
index 0000000..17791dc
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/decls/BUILD.bazel
@@ -0,0 +1,39 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "decls.go",
+    ],
+    importpath = "github.com/google/cel-go/common/decls",
+    deps = [
+        "//checker/decls:go_default_library",
+        "//common/functions:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
+        "//common/types/traits:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
+    ],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = [
+        "decls_test.go",
+    ],
+    embed = [":go_default_library"],
+    deps = [
+        "//checker/decls:go_default_library",
+        "//common/overloads:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
+        "//common/types/traits:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
+        "@org_golang_google_protobuf//proto:go_default_library",
+    ],
+)
diff --git a/vendor/github.com/google/cel-go/common/decls/decls.go b/vendor/github.com/google/cel-go/common/decls/decls.go
new file mode 100644
index 0000000..bfeb52c
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/decls/decls.go
@@ -0,0 +1,856 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package decls contains function and variable declaration structs and helper methods.
+package decls
+
+import (
+	"fmt"
+	"strings"
+
+	chkdecls "github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/functions"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+// NewFunction creates a new function declaration with a set of function options to configure overloads
+// and function definitions (implementations).
+//
+// Functions are checked for name collisions and singleton redefinition.
+func NewFunction(name string, opts ...FunctionOpt) (*FunctionDecl, error) {
+	fn := &FunctionDecl{
+		name:             name,
+		overloads:        map[string]*OverloadDecl{},
+		overloadOrdinals: []string{},
+	}
+	var err error
+	for _, opt := range opts {
+		fn, err = opt(fn)
+		if err != nil {
+			return nil, err
+		}
+	}
+	if len(fn.overloads) == 0 {
+		return nil, fmt.Errorf("function %s must have at least one overload", name)
+	}
+	return fn, nil
+}
+
+// FunctionDecl defines a function name, overload set, and optionally a singleton definition for all
+// overload instances.
+type FunctionDecl struct {
+	name string
+
+	// overloads associated with the function name.
+	overloads map[string]*OverloadDecl
+
+	// singleton implementation of the function for all overloads.
+	//
+	// If this option is set, an error will occur if any overloads specify a per-overload implementation
+	// or if another function with the same name attempts to redefine the singleton.
+	singleton *functions.Overload
+
+	// disableTypeGuards is a performance optimization to disable detailed runtime type checks which could
+	// add overhead on common operations. Setting this option true leaves error checks and argument checks
+	// intact.
+	disableTypeGuards bool
+
+	// state indicates that the binding should be provided as a declaration, as a runtime binding, or both.
+	state declarationState
+
+	// overloadOrdinals indicates the order in which the overload was declared.
+	overloadOrdinals []string
+}
+
+type declarationState int
+
+const (
+	declarationStateUnset declarationState = iota
+	declarationDisabled
+	declarationEnabled
+)
+
+// Name returns the function name in human-readable terms, e.g. 'contains' of 'math.least'
+func (f *FunctionDecl) Name() string {
+	if f == nil {
+		return ""
+	}
+	return f.name
+}
+
+// IsDeclarationDisabled indicates that the function implementation should be added to the dispatcher, but the
+// declaration should not be exposed for use in expressions.
+func (f *FunctionDecl) IsDeclarationDisabled() bool {
+	return f.state == declarationDisabled
+}
+
+// Merge combines an existing function declaration with another.
+//
+// If a function is extended, by say adding new overloads to an existing function, then it is merged with the
+// prior definition of the function at which point its overloads must not collide with pre-existing overloads
+// and its bindings (singleton, or per-overload) must not conflict with previous definitions either.
+func (f *FunctionDecl) Merge(other *FunctionDecl) (*FunctionDecl, error) {
+	if f == other {
+		return f, nil
+	}
+	if f.Name() != other.Name() {
+		return nil, fmt.Errorf("cannot merge unrelated functions. %s and %s", f.Name(), other.Name())
+	}
+	merged := &FunctionDecl{
+		name:             f.Name(),
+		overloads:        make(map[string]*OverloadDecl, len(f.overloads)),
+		singleton:        f.singleton,
+		overloadOrdinals: make([]string, len(f.overloads)),
+		// if one function is expecting type-guards and the other is not, then they
+		// must not be disabled.
+		disableTypeGuards: f.disableTypeGuards && other.disableTypeGuards,
+		// default to the current functions declaration state.
+		state: f.state,
+	}
+	// If the other state indicates that the declaration should be explicitly enabled or
+	// disabled, then update the merged state with the most recent value.
+	if other.state != declarationStateUnset {
+		merged.state = other.state
+	}
+	// baseline copy of the overloads and their ordinals
+	copy(merged.overloadOrdinals, f.overloadOrdinals)
+	for oID, o := range f.overloads {
+		merged.overloads[oID] = o
+	}
+	// overloads and their ordinals are added from the left
+	for _, oID := range other.overloadOrdinals {
+		o := other.overloads[oID]
+		err := merged.AddOverload(o)
+		if err != nil {
+			return nil, fmt.Errorf("function declaration merge failed: %v", err)
+		}
+	}
+	if other.singleton != nil {
+		if merged.singleton != nil && merged.singleton != other.singleton {
+			return nil, fmt.Errorf("function already has a singleton binding: %s", f.Name())
+		}
+		merged.singleton = other.singleton
+	}
+	return merged, nil
+}
+
+// AddOverload ensures that the new overload does not collide with an existing overload signature;
+// however, if the function signatures are identical, the implementation may be rewritten as its
+// difficult to compare functions by object identity.
+func (f *FunctionDecl) AddOverload(overload *OverloadDecl) error {
+	if f == nil {
+		return fmt.Errorf("nil function cannot add overload: %s", overload.ID())
+	}
+	for oID, o := range f.overloads {
+		if oID != overload.ID() && o.SignatureOverlaps(overload) {
+			return fmt.Errorf("overload signature collision in function %s: %s collides with %s", f.Name(), oID, overload.ID())
+		}
+		if oID == overload.ID() {
+			if o.SignatureEquals(overload) && o.IsNonStrict() == overload.IsNonStrict() {
+				// Allow redefinition of an overload implementation so long as the signatures match.
+				if overload.hasBinding() {
+					f.overloads[oID] = overload
+				}
+				return nil
+			}
+			return fmt.Errorf("overload redefinition in function. %s: %s has multiple definitions", f.Name(), oID)
+		}
+	}
+	f.overloadOrdinals = append(f.overloadOrdinals, overload.ID())
+	f.overloads[overload.ID()] = overload
+	return nil
+}
+
+// OverloadDecls returns the overload declarations in the order in which they were declared.
+func (f *FunctionDecl) OverloadDecls() []*OverloadDecl {
+	if f == nil {
+		return []*OverloadDecl{}
+	}
+	overloads := make([]*OverloadDecl, 0, len(f.overloads))
+	for _, oID := range f.overloadOrdinals {
+		overloads = append(overloads, f.overloads[oID])
+	}
+	return overloads
+}
+
+// Bindings produces a set of function bindings, if any are defined.
+func (f *FunctionDecl) Bindings() ([]*functions.Overload, error) {
+	if f == nil {
+		return []*functions.Overload{}, nil
+	}
+	overloads := []*functions.Overload{}
+	nonStrict := false
+	for _, oID := range f.overloadOrdinals {
+		o := f.overloads[oID]
+		if o.hasBinding() {
+			overload := &functions.Overload{
+				Operator:     o.ID(),
+				Unary:        o.guardedUnaryOp(f.Name(), f.disableTypeGuards),
+				Binary:       o.guardedBinaryOp(f.Name(), f.disableTypeGuards),
+				Function:     o.guardedFunctionOp(f.Name(), f.disableTypeGuards),
+				OperandTrait: o.OperandTrait(),
+				NonStrict:    o.IsNonStrict(),
+			}
+			overloads = append(overloads, overload)
+			nonStrict = nonStrict || o.IsNonStrict()
+		}
+	}
+	if f.singleton != nil {
+		if len(overloads) != 0 {
+			return nil, fmt.Errorf("singleton function incompatible with specialized overloads: %s", f.Name())
+		}
+		overloads = []*functions.Overload{
+			{
+				Operator:     f.Name(),
+				Unary:        f.singleton.Unary,
+				Binary:       f.singleton.Binary,
+				Function:     f.singleton.Function,
+				OperandTrait: f.singleton.OperandTrait,
+			},
+		}
+		// fall-through to return single overload case.
+	}
+	if len(overloads) == 0 {
+		return overloads, nil
+	}
+	// Single overload. Replicate an entry for it using the function name as well.
+	if len(overloads) == 1 {
+		if overloads[0].Operator == f.Name() {
+			return overloads, nil
+		}
+		return append(overloads, &functions.Overload{
+			Operator:     f.Name(),
+			Unary:        overloads[0].Unary,
+			Binary:       overloads[0].Binary,
+			Function:     overloads[0].Function,
+			NonStrict:    overloads[0].NonStrict,
+			OperandTrait: overloads[0].OperandTrait,
+		}), nil
+	}
+	// All of the defined overloads are wrapped into a top-level function which
+	// performs dynamic dispatch to the proper overload based on the argument types.
+	bindings := append([]*functions.Overload{}, overloads...)
+	funcDispatch := func(args ...ref.Val) ref.Val {
+		for _, oID := range f.overloadOrdinals {
+			o := f.overloads[oID]
+			// During dynamic dispatch over multiple functions, signature agreement checks
+			// are preserved in order to assist with the function resolution step.
+			switch len(args) {
+			case 1:
+				if o.unaryOp != nil && o.matchesRuntimeSignature(f.disableTypeGuards, args...) {
+					return o.unaryOp(args[0])
+				}
+			case 2:
+				if o.binaryOp != nil && o.matchesRuntimeSignature(f.disableTypeGuards, args...) {
+					return o.binaryOp(args[0], args[1])
+				}
+			}
+			if o.functionOp != nil && o.matchesRuntimeSignature(f.disableTypeGuards, args...) {
+				return o.functionOp(args...)
+			}
+			// eventually this will fall through to the noSuchOverload below.
+		}
+		return MaybeNoSuchOverload(f.Name(), args...)
+	}
+	function := &functions.Overload{
+		Operator:  f.Name(),
+		Function:  funcDispatch,
+		NonStrict: nonStrict,
+	}
+	return append(bindings, function), nil
+}
+
+// MaybeNoSuchOverload determines whether to propagate an error if one is provided as an argument, or
+// to return an unknown set, or to produce a new error for a missing function signature.
+func MaybeNoSuchOverload(funcName string, args ...ref.Val) ref.Val {
+	argTypes := make([]string, len(args))
+	var unk *types.Unknown = nil
+	for i, arg := range args {
+		if types.IsError(arg) {
+			return arg
+		}
+		if types.IsUnknown(arg) {
+			unk = types.MergeUnknowns(arg.(*types.Unknown), unk)
+		}
+		argTypes[i] = arg.Type().TypeName()
+	}
+	if unk != nil {
+		return unk
+	}
+	signature := strings.Join(argTypes, ", ")
+	return types.NewErr("no such overload: %s(%s)", funcName, signature)
+}
+
+// FunctionOpt defines a functional option for mutating a function declaration.
+type FunctionOpt func(*FunctionDecl) (*FunctionDecl, error)
+
+// DisableTypeGuards disables automatically generated function invocation guards on direct overload calls.
+// Type guards remain on during dynamic dispatch for parsed-only expressions.
+func DisableTypeGuards(value bool) FunctionOpt {
+	return func(fn *FunctionDecl) (*FunctionDecl, error) {
+		fn.disableTypeGuards = value
+		return fn, nil
+	}
+}
+
+// DisableDeclaration indicates that the function declaration should be disabled, but the runtime function
+// binding should be provided. Marking a function as runtime-only is a safe way to manage deprecations
+// of function declarations while still preserving the runtime behavior for previously compiled expressions.
+func DisableDeclaration(value bool) FunctionOpt {
+	return func(fn *FunctionDecl) (*FunctionDecl, error) {
+		if value {
+			fn.state = declarationDisabled
+		} else {
+			fn.state = declarationEnabled
+		}
+		return fn, nil
+	}
+}
+
+// SingletonUnaryBinding creates a singleton function definition to be used for all function overloads.
+//
+// Note, this approach works well if operand is expected to have a specific trait which it implements,
+// e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
+func SingletonUnaryBinding(fn functions.UnaryOp, traits ...int) FunctionOpt {
+	trait := 0
+	for _, t := range traits {
+		trait = trait | t
+	}
+	return func(f *FunctionDecl) (*FunctionDecl, error) {
+		if f.singleton != nil {
+			return nil, fmt.Errorf("function already has a singleton binding: %s", f.Name())
+		}
+		f.singleton = &functions.Overload{
+			Operator:     f.Name(),
+			Unary:        fn,
+			OperandTrait: trait,
+		}
+		return f, nil
+	}
+}
+
+// SingletonBinaryBinding creates a singleton function definition to be used with all function overloads.
+//
+// Note, this approach works well if operand is expected to have a specific trait which it implements,
+// e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
+func SingletonBinaryBinding(fn functions.BinaryOp, traits ...int) FunctionOpt {
+	trait := 0
+	for _, t := range traits {
+		trait = trait | t
+	}
+	return func(f *FunctionDecl) (*FunctionDecl, error) {
+		if f.singleton != nil {
+			return nil, fmt.Errorf("function already has a singleton binding: %s", f.Name())
+		}
+		f.singleton = &functions.Overload{
+			Operator:     f.Name(),
+			Binary:       fn,
+			OperandTrait: trait,
+		}
+		return f, nil
+	}
+}
+
+// SingletonFunctionBinding creates a singleton function definition to be used with all function overloads.
+//
+// Note, this approach works well if operand is expected to have a specific trait which it implements,
+// e.g. traits.ContainerType. Otherwise, prefer per-overload function bindings.
+func SingletonFunctionBinding(fn functions.FunctionOp, traits ...int) FunctionOpt {
+	trait := 0
+	for _, t := range traits {
+		trait = trait | t
+	}
+	return func(f *FunctionDecl) (*FunctionDecl, error) {
+		if f.singleton != nil {
+			return nil, fmt.Errorf("function already has a singleton binding: %s", f.Name())
+		}
+		f.singleton = &functions.Overload{
+			Operator:     f.Name(),
+			Function:     fn,
+			OperandTrait: trait,
+		}
+		return f, nil
+	}
+}
+
+// Overload defines a new global overload with an overload id, argument types, and result type. Through the
+// use of OverloadOpt options, the overload may also be configured with a binding, an operand trait, and to
+// be non-strict.
+//
+// Note: function bindings should be commonly configured with Overload instances whereas operand traits and
+// strict-ness should be rare occurrences.
+func Overload(overloadID string,
+	args []*types.Type, resultType *types.Type,
+	opts ...OverloadOpt) FunctionOpt {
+	return newOverload(overloadID, false, args, resultType, opts...)
+}
+
+// MemberOverload defines a new receiver-style overload (or member function) with an overload id, argument types,
+// and result type. Through the use of OverloadOpt options, the overload may also be configured with a binding,
+// an operand trait, and to be non-strict.
+//
+// Note: function bindings should be commonly configured with Overload instances whereas operand traits and
+// strict-ness should be rare occurrences.
+func MemberOverload(overloadID string,
+	args []*types.Type, resultType *types.Type,
+	opts ...OverloadOpt) FunctionOpt {
+	return newOverload(overloadID, true, args, resultType, opts...)
+}
+
+func newOverload(overloadID string,
+	memberFunction bool, args []*types.Type, resultType *types.Type,
+	opts ...OverloadOpt) FunctionOpt {
+	return func(f *FunctionDecl) (*FunctionDecl, error) {
+		overload, err := newOverloadInternal(overloadID, memberFunction, args, resultType, opts...)
+		if err != nil {
+			return nil, err
+		}
+		err = f.AddOverload(overload)
+		if err != nil {
+			return nil, err
+		}
+		return f, nil
+	}
+}
+
+func newOverloadInternal(overloadID string,
+	memberFunction bool, args []*types.Type, resultType *types.Type,
+	opts ...OverloadOpt) (*OverloadDecl, error) {
+	overload := &OverloadDecl{
+		id:               overloadID,
+		argTypes:         args,
+		resultType:       resultType,
+		isMemberFunction: memberFunction,
+	}
+	var err error
+	for _, opt := range opts {
+		overload, err = opt(overload)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return overload, nil
+}
+
+// OverloadDecl contains the definition of a single overload id with a specific signature, and an optional
+// implementation.
+type OverloadDecl struct {
+	id               string
+	argTypes         []*types.Type
+	resultType       *types.Type
+	isMemberFunction bool
+	// nonStrict indicates that the function will accept error and unknown arguments as inputs.
+	nonStrict bool
+	// operandTrait indicates whether the member argument should have a specific type-trait.
+	//
+	// This is useful for creating overloads which operate on a type-interface rather than a concrete type.
+	operandTrait int
+
+	// Function implementation options. Optional, but encouraged.
+	// unaryOp is a function binding that takes a single argument.
+	unaryOp functions.UnaryOp
+	// binaryOp is a function binding that takes two arguments.
+	binaryOp functions.BinaryOp
+	// functionOp is a catch-all for zero-arity and three-plus arity functions.
+	functionOp functions.FunctionOp
+}
+
+// ID mirrors the overload signature and provides a unique id which may be referenced within the type-checker
+// and interpreter to optimize performance.
+//
+// The ID format is usually one of two styles:
+// global: <functionName>_<argType>_<argTypeN>
+// member: <memberType>_<functionName>_<argType>_<argTypeN>
+func (o *OverloadDecl) ID() string {
+	if o == nil {
+		return ""
+	}
+	return o.id
+}
+
+// ArgTypes contains the set of argument types expected by the overload.
+//
+// For member functions ArgTypes[0] represents the member operand type.
+func (o *OverloadDecl) ArgTypes() []*types.Type {
+	if o == nil {
+		return emptyArgs
+	}
+	return o.argTypes
+}
+
+// IsMemberFunction indicates whether the overload is a member function
+func (o *OverloadDecl) IsMemberFunction() bool {
+	if o == nil {
+		return false
+	}
+	return o.isMemberFunction
+}
+
+// IsNonStrict returns whether the overload accepts errors and unknown values as arguments.
+func (o *OverloadDecl) IsNonStrict() bool {
+	if o == nil {
+		return false
+	}
+	return o.nonStrict
+}
+
+// OperandTrait returns the trait mask of the first operand to the overload call, e.g.
+// `traits.Indexer`
+func (o *OverloadDecl) OperandTrait() int {
+	if o == nil {
+		return 0
+	}
+	return o.operandTrait
+}
+
+// ResultType indicates the output type from calling the function.
+func (o *OverloadDecl) ResultType() *types.Type {
+	if o == nil {
+		// *types.Type is nil-safe
+		return nil
+	}
+	return o.resultType
+}
+
+// TypeParams returns the type parameter names associated with the overload.
+func (o *OverloadDecl) TypeParams() []string {
+	typeParams := map[string]struct{}{}
+	collectParamNames(typeParams, o.ResultType())
+	for _, arg := range o.ArgTypes() {
+		collectParamNames(typeParams, arg)
+	}
+	params := make([]string, 0, len(typeParams))
+	for param := range typeParams {
+		params = append(params, param)
+	}
+	return params
+}
+
+// SignatureEquals determines whether the incoming overload declaration signature is equal to the current signature.
+//
+// Result type, operand trait, and strict-ness are not considered as part of signature equality.
+func (o *OverloadDecl) SignatureEquals(other *OverloadDecl) bool {
+	if o == other {
+		return true
+	}
+	if o.ID() != other.ID() || o.IsMemberFunction() != other.IsMemberFunction() || len(o.ArgTypes()) != len(other.ArgTypes()) {
+		return false
+	}
+	for i, at := range o.ArgTypes() {
+		oat := other.ArgTypes()[i]
+		if !at.IsEquivalentType(oat) {
+			return false
+		}
+	}
+	return o.ResultType().IsEquivalentType(other.ResultType())
+}
+
+// SignatureOverlaps indicates whether two functions have non-equal, but overloapping function signatures.
+//
+// For example, list(dyn) collides with list(string) since the 'dyn' type can contain a 'string' type.
+func (o *OverloadDecl) SignatureOverlaps(other *OverloadDecl) bool {
+	if o.IsMemberFunction() != other.IsMemberFunction() || len(o.ArgTypes()) != len(other.ArgTypes()) {
+		return false
+	}
+	argsOverlap := true
+	for i, argType := range o.ArgTypes() {
+		otherArgType := other.ArgTypes()[i]
+		argsOverlap = argsOverlap &&
+			(argType.IsAssignableType(otherArgType) ||
+				otherArgType.IsAssignableType(argType))
+	}
+	return argsOverlap
+}
+
+// hasBinding indicates whether the overload already has a definition.
+func (o *OverloadDecl) hasBinding() bool {
+	return o != nil && (o.unaryOp != nil || o.binaryOp != nil || o.functionOp != nil)
+}
+
+// guardedUnaryOp creates an invocation guard around the provided unary operator, if one is defined.
+func (o *OverloadDecl) guardedUnaryOp(funcName string, disableTypeGuards bool) functions.UnaryOp {
+	if o.unaryOp == nil {
+		return nil
+	}
+	return func(arg ref.Val) ref.Val {
+		if !o.matchesRuntimeUnarySignature(disableTypeGuards, arg) {
+			return MaybeNoSuchOverload(funcName, arg)
+		}
+		return o.unaryOp(arg)
+	}
+}
+
+// guardedBinaryOp creates an invocation guard around the provided binary operator, if one is defined.
+func (o *OverloadDecl) guardedBinaryOp(funcName string, disableTypeGuards bool) functions.BinaryOp {
+	if o.binaryOp == nil {
+		return nil
+	}
+	return func(arg1, arg2 ref.Val) ref.Val {
+		if !o.matchesRuntimeBinarySignature(disableTypeGuards, arg1, arg2) {
+			return MaybeNoSuchOverload(funcName, arg1, arg2)
+		}
+		return o.binaryOp(arg1, arg2)
+	}
+}
+
+// guardedFunctionOp creates an invocation guard around the provided variadic function binding, if one is provided.
+func (o *OverloadDecl) guardedFunctionOp(funcName string, disableTypeGuards bool) functions.FunctionOp {
+	if o.functionOp == nil {
+		return nil
+	}
+	return func(args ...ref.Val) ref.Val {
+		if !o.matchesRuntimeSignature(disableTypeGuards, args...) {
+			return MaybeNoSuchOverload(funcName, args...)
+		}
+		return o.functionOp(args...)
+	}
+}
+
+// matchesRuntimeUnarySignature indicates whether the argument type is runtime assiganble to the overload's expected argument.
+func (o *OverloadDecl) matchesRuntimeUnarySignature(disableTypeGuards bool, arg ref.Val) bool {
+	return matchRuntimeArgType(o.IsNonStrict(), disableTypeGuards, o.ArgTypes()[0], arg) &&
+		matchOperandTrait(o.OperandTrait(), arg)
+}
+
+// matchesRuntimeBinarySignature indicates whether the argument types are runtime assiganble to the overload's expected arguments.
+func (o *OverloadDecl) matchesRuntimeBinarySignature(disableTypeGuards bool, arg1, arg2 ref.Val) bool {
+	return matchRuntimeArgType(o.IsNonStrict(), disableTypeGuards, o.ArgTypes()[0], arg1) &&
+		matchRuntimeArgType(o.IsNonStrict(), disableTypeGuards, o.ArgTypes()[1], arg2) &&
+		matchOperandTrait(o.OperandTrait(), arg1)
+}
+
+// matchesRuntimeSignature indicates whether the argument types are runtime assiganble to the overload's expected arguments.
+func (o *OverloadDecl) matchesRuntimeSignature(disableTypeGuards bool, args ...ref.Val) bool {
+	if len(args) != len(o.ArgTypes()) {
+		return false
+	}
+	if len(args) == 0 {
+		return true
+	}
+	for i, arg := range args {
+		if !matchRuntimeArgType(o.IsNonStrict(), disableTypeGuards, o.ArgTypes()[i], arg) {
+			return false
+		}
+	}
+	return matchOperandTrait(o.OperandTrait(), args[0])
+}
+
+func matchRuntimeArgType(nonStrict, disableTypeGuards bool, argType *types.Type, arg ref.Val) bool {
+	if nonStrict && (disableTypeGuards || types.IsUnknownOrError(arg)) {
+		return true
+	}
+	if types.IsUnknownOrError(arg) {
+		return false
+	}
+	return disableTypeGuards || argType.IsAssignableRuntimeType(arg)
+}
+
+func matchOperandTrait(trait int, arg ref.Val) bool {
+	return trait == 0 || arg.Type().HasTrait(trait) || types.IsUnknownOrError(arg)
+}
+
+// OverloadOpt is a functional option for configuring a function overload.
+type OverloadOpt func(*OverloadDecl) (*OverloadDecl, error)
+
+// UnaryBinding provides the implementation of a unary overload. The provided function is protected by a runtime
+// type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
+func UnaryBinding(binding functions.UnaryOp) OverloadOpt {
+	return func(o *OverloadDecl) (*OverloadDecl, error) {
+		if o.hasBinding() {
+			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
+		}
+		if len(o.ArgTypes()) != 1 {
+			return nil, fmt.Errorf("unary function bound to non-unary overload: %s", o.ID())
+		}
+		o.unaryOp = binding
+		return o, nil
+	}
+}
+
+// BinaryBinding provides the implementation of a binary overload. The provided function is protected by a runtime
+// type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
+func BinaryBinding(binding functions.BinaryOp) OverloadOpt {
+	return func(o *OverloadDecl) (*OverloadDecl, error) {
+		if o.hasBinding() {
+			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
+		}
+		if len(o.ArgTypes()) != 2 {
+			return nil, fmt.Errorf("binary function bound to non-binary overload: %s", o.ID())
+		}
+		o.binaryOp = binding
+		return o, nil
+	}
+}
+
+// FunctionBinding provides the implementation of a variadic overload. The provided function is protected by a runtime
+// type-guard which ensures runtime type agreement between the overload signature and runtime argument types.
+func FunctionBinding(binding functions.FunctionOp) OverloadOpt {
+	return func(o *OverloadDecl) (*OverloadDecl, error) {
+		if o.hasBinding() {
+			return nil, fmt.Errorf("overload already has a binding: %s", o.ID())
+		}
+		o.functionOp = binding
+		return o, nil
+	}
+}
+
+// OverloadIsNonStrict enables the function to be called with error and unknown argument values.
+//
+// Note: do not use this option unless absoluately necessary as it should be an uncommon feature.
+func OverloadIsNonStrict() OverloadOpt {
+	return func(o *OverloadDecl) (*OverloadDecl, error) {
+		o.nonStrict = true
+		return o, nil
+	}
+}
+
+// OverloadOperandTrait configures a set of traits which the first argument to the overload must implement in order to be
+// successfully invoked.
+func OverloadOperandTrait(trait int) OverloadOpt {
+	return func(o *OverloadDecl) (*OverloadDecl, error) {
+		o.operandTrait = trait
+		return o, nil
+	}
+}
+
+// NewConstant creates a new constant declaration.
+func NewConstant(name string, t *types.Type, v ref.Val) *VariableDecl {
+	return &VariableDecl{name: name, varType: t, value: v}
+}
+
+// NewVariable creates a new variable declaration.
+func NewVariable(name string, t *types.Type) *VariableDecl {
+	return &VariableDecl{name: name, varType: t}
+}
+
+// VariableDecl defines a variable declaration which may optionally have a constant value.
+type VariableDecl struct {
+	name    string
+	varType *types.Type
+	value   ref.Val
+}
+
+// Name returns the fully-qualified variable name
+func (v *VariableDecl) Name() string {
+	if v == nil {
+		return ""
+	}
+	return v.name
+}
+
+// Type returns the types.Type value associated with the variable.
+func (v *VariableDecl) Type() *types.Type {
+	if v == nil {
+		// types.Type is nil-safe
+		return nil
+	}
+	return v.varType
+}
+
+// Value returns the constant value associated with the declaration.
+func (v *VariableDecl) Value() ref.Val {
+	if v == nil {
+		return nil
+	}
+	return v.value
+}
+
+// DeclarationIsEquivalent returns true if one variable declaration has the same name and same type as the input.
+func (v *VariableDecl) DeclarationIsEquivalent(other *VariableDecl) bool {
+	if v == other {
+		return true
+	}
+	return v.Name() == other.Name() && v.Type().IsEquivalentType(other.Type())
+}
+
+// TypeVariable creates a new type identifier for use within a types.Provider
+func TypeVariable(t *types.Type) *VariableDecl {
+	return NewVariable(t.TypeName(), types.NewTypeTypeWithParam(t))
+}
+
+// VariableDeclToExprDecl converts a go-native variable declaration into a protobuf-type variable declaration.
+func VariableDeclToExprDecl(v *VariableDecl) (*exprpb.Decl, error) {
+	return variableDeclToExprDecl(v)
+}
+
+// variableDeclToExprDecl converts a go-native variable declaration into a protobuf-type variable declaration.
+func variableDeclToExprDecl(v *VariableDecl) (*exprpb.Decl, error) {
+	varType, err := types.TypeToExprType(v.Type())
+	if err != nil {
+		return nil, err
+	}
+	return chkdecls.NewVar(v.Name(), varType), nil
+}
+
+// FunctionDeclToExprDecl converts a go-native function declaration into a protobuf-typed function declaration.
+func FunctionDeclToExprDecl(f *FunctionDecl) (*exprpb.Decl, error) {
+	return functionDeclToExprDecl(f)
+}
+
+// functionDeclToExprDecl converts a go-native function declaration into a protobuf-typed function declaration.
+func functionDeclToExprDecl(f *FunctionDecl) (*exprpb.Decl, error) {
+	overloads := make([]*exprpb.Decl_FunctionDecl_Overload, len(f.overloads))
+	for i, oID := range f.overloadOrdinals {
+		o := f.overloads[oID]
+		paramNames := map[string]struct{}{}
+		argTypes := make([]*exprpb.Type, len(o.ArgTypes()))
+		for j, a := range o.ArgTypes() {
+			collectParamNames(paramNames, a)
+			at, err := types.TypeToExprType(a)
+			if err != nil {
+				return nil, err
+			}
+			argTypes[j] = at
+		}
+		collectParamNames(paramNames, o.ResultType())
+		resultType, err := types.TypeToExprType(o.ResultType())
+		if err != nil {
+			return nil, err
+		}
+		if len(paramNames) == 0 {
+			if o.IsMemberFunction() {
+				overloads[i] = chkdecls.NewInstanceOverload(oID, argTypes, resultType)
+			} else {
+				overloads[i] = chkdecls.NewOverload(oID, argTypes, resultType)
+			}
+		} else {
+			params := []string{}
+			for pn := range paramNames {
+				params = append(params, pn)
+			}
+			if o.IsMemberFunction() {
+				overloads[i] = chkdecls.NewParameterizedInstanceOverload(oID, argTypes, resultType, params)
+			} else {
+				overloads[i] = chkdecls.NewParameterizedOverload(oID, argTypes, resultType, params)
+			}
+		}
+	}
+	return chkdecls.NewFunction(f.Name(), overloads...), nil
+}
+
+func collectParamNames(paramNames map[string]struct{}, arg *types.Type) {
+	if arg.Kind() == types.TypeParamKind {
+		paramNames[arg.TypeName()] = struct{}{}
+	}
+	for _, param := range arg.Parameters() {
+		collectParamNames(paramNames, param)
+	}
+}
+
+var (
+	emptyArgs = []*types.Type{}
+)
diff --git a/vendor/github.com/google/cel-go/common/error.go b/vendor/github.com/google/cel-go/common/error.go
index f91f7f8..0cf2134 100644
--- a/vendor/github.com/google/cel-go/common/error.go
+++ b/vendor/github.com/google/cel-go/common/error.go
@@ -18,29 +18,30 @@ import (
 	"fmt"
 	"strings"
 	"unicode/utf8"
-
-	"golang.org/x/text/width"
 )
 
-// Error type which references a location within source and a message.
+// NewError creates an error associated with an expression id with the given message at the given location.
+func NewError(id int64, message string, location Location) *Error {
+	return &Error{Message: message, Location: location, ExprID: id}
+}
+
+// Error type which references an expression id, a location within source, and a message.
 type Error struct {
 	Location Location
 	Message  string
+	ExprID   int64
 }
 
 const (
-	dot = "."
-	ind = "^"
+	dot     = "."
+	ind     = "^"
+	wideDot = "\uff0e"
+	wideInd = "\uff3e"
 
 	// maxSnippetLength is the largest number of characters which can be rendered in an error message snippet.
 	maxSnippetLength = 16384
 )
 
-var (
-	wideDot = width.Widen.String(dot)
-	wideInd = width.Widen.String(ind)
-)
-
 // ToDisplayString decorates the error message with the source location.
 func (e *Error) ToDisplayString(source Source) string {
 	var result = fmt.Sprintf("ERROR: %s:%d:%d: %s",
diff --git a/vendor/github.com/google/cel-go/common/errors.go b/vendor/github.com/google/cel-go/common/errors.go
index 1565085..8957068 100644
--- a/vendor/github.com/google/cel-go/common/errors.go
+++ b/vendor/github.com/google/cel-go/common/errors.go
@@ -22,7 +22,7 @@ import (
 
 // Errors type which contains a list of errors observed during parsing.
 type Errors struct {
-	errors            []Error
+	errors            []*Error
 	source            Source
 	numErrors         int
 	maxErrorsToReport int
@@ -30,20 +30,30 @@ type Errors struct {
 
 // NewErrors creates a new instance of the Errors type.
 func NewErrors(source Source) *Errors {
+	src := source
+	if src == nil {
+		src = NewTextSource("")
+	}
 	return &Errors{
-		errors:            []Error{},
-		source:            source,
+		errors:            []*Error{},
+		source:            src,
 		maxErrorsToReport: 100,
 	}
 }
 
 // ReportError records an error at a source location.
 func (e *Errors) ReportError(l Location, format string, args ...any) {
+	e.ReportErrorAtID(0, l, format, args...)
+}
+
+// ReportErrorAtID records an error at a source location and expression id.
+func (e *Errors) ReportErrorAtID(id int64, l Location, format string, args ...any) {
 	e.numErrors++
 	if e.numErrors > e.maxErrorsToReport {
 		return
 	}
-	err := Error{
+	err := &Error{
+		ExprID:   id,
 		Location: l,
 		Message:  fmt.Sprintf(format, args...),
 	}
@@ -51,14 +61,14 @@ func (e *Errors) ReportError(l Location, format string, args ...any) {
 }
 
 // GetErrors returns the list of observed errors.
-func (e *Errors) GetErrors() []Error {
+func (e *Errors) GetErrors() []*Error {
 	return e.errors[:]
 }
 
 // Append creates a new Errors object with the current and input errors.
-func (e *Errors) Append(errs []Error) *Errors {
+func (e *Errors) Append(errs []*Error) *Errors {
 	return &Errors{
-		errors:            append(e.errors, errs...),
+		errors:            append(e.errors[:], errs...),
 		source:            e.source,
 		numErrors:         e.numErrors + len(errs),
 		maxErrorsToReport: e.maxErrorsToReport,
diff --git a/vendor/github.com/google/cel-go/common/functions/BUILD.bazel b/vendor/github.com/google/cel-go/common/functions/BUILD.bazel
new file mode 100644
index 0000000..3cc27d6
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/functions/BUILD.bazel
@@ -0,0 +1,17 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "functions.go",
+    ],
+    importpath = "github.com/google/cel-go/common/functions",
+    deps = [
+        "//common/types/ref:go_default_library",
+    ],
+)
diff --git a/vendor/github.com/google/cel-go/common/functions/functions.go b/vendor/github.com/google/cel-go/common/functions/functions.go
new file mode 100644
index 0000000..67f4a59
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/functions/functions.go
@@ -0,0 +1,61 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package functions defines the standard builtin functions supported by the interpreter
+package functions
+
+import "github.com/google/cel-go/common/types/ref"
+
+// Overload defines a named overload of a function, indicating an operand trait
+// which must be present on the first argument to the overload as well as one
+// of either a unary, binary, or function implementation.
+//
+// The majority of  operators within the expression language are unary or binary
+// and the specializations simplify the call contract for implementers of
+// types with operator overloads. Any added complexity is assumed to be handled
+// by the generic FunctionOp.
+type Overload struct {
+	// Operator name as written in an expression or defined within
+	// operators.go.
+	Operator string
+
+	// Operand trait used to dispatch the call. The zero-value indicates a
+	// global function overload or that one of the Unary / Binary / Function
+	// definitions should be used to execute the call.
+	OperandTrait int
+
+	// Unary defines the overload with a UnaryOp implementation. May be nil.
+	Unary UnaryOp
+
+	// Binary defines the overload with a BinaryOp implementation. May be nil.
+	Binary BinaryOp
+
+	// Function defines the overload with a FunctionOp implementation. May be
+	// nil.
+	Function FunctionOp
+
+	// NonStrict specifies whether the Overload will tolerate arguments that
+	// are types.Err or types.Unknown.
+	NonStrict bool
+}
+
+// UnaryOp is a function that takes a single value and produces an output.
+type UnaryOp func(value ref.Val) ref.Val
+
+// BinaryOp is a function that takes two values and produces an output.
+type BinaryOp func(lhs ref.Val, rhs ref.Val) ref.Val
+
+// FunctionOp is a function with accepts zero or more arguments and produces
+// a value or error as a result.
+type FunctionOp func(values ...ref.Val) ref.Val
diff --git a/vendor/github.com/google/cel-go/common/runes/buffer.go b/vendor/github.com/google/cel-go/common/runes/buffer.go
index 50aac0b..0211982 100644
--- a/vendor/github.com/google/cel-go/common/runes/buffer.go
+++ b/vendor/github.com/google/cel-go/common/runes/buffer.go
@@ -127,20 +127,48 @@ var nilBuffer = &emptyBuffer{}
 // elements of the byte or uint16 array, and continue. The underlying storage is an rune array
 // containing any Unicode character.
 func NewBuffer(data string) Buffer {
+	buf, _ := newBuffer(data, false)
+	return buf
+}
+
+// NewBufferAndLineOffsets returns an efficient implementation of Buffer for the given text based on
+// the ranges of the encoded code points contained within, as well as returning the line offsets.
+//
+// Code points are represented as an array of byte, uint16, or rune. This approach ensures that
+// each index represents a code point by itself without needing to use an array of rune. At first
+// we assume all code points are less than or equal to '\u007f'. If this holds true, the
+// underlying storage is a byte array containing only ASCII characters. If we encountered a code
+// point above this range but less than or equal to '\uffff' we allocate a uint16 array, copy the
+// elements of previous byte array to the uint16 array, and continue. If this holds true, the
+// underlying storage is a uint16 array containing only Unicode characters in the Basic Multilingual
+// Plane. If we encounter a code point above '\uffff' we allocate an rune array, copy the previous
+// elements of the byte or uint16 array, and continue. The underlying storage is an rune array
+// containing any Unicode character.
+func NewBufferAndLineOffsets(data string) (Buffer, []int32) {
+	return newBuffer(data, true)
+}
+
+func newBuffer(data string, lines bool) (Buffer, []int32) {
 	if len(data) == 0 {
-		return nilBuffer
+		return nilBuffer, []int32{0}
 	}
 	var (
-		idx   = 0
-		buf8  = make([]byte, 0, len(data))
+		idx         = 0
+		off   int32 = 0
+		buf8        = make([]byte, 0, len(data))
 		buf16 []uint16
 		buf32 []rune
+		offs  []int32
 	)
 	for idx < len(data) {
 		r, s := utf8.DecodeRuneInString(data[idx:])
 		idx += s
+		if lines && r == '\n' {
+			offs = append(offs, off+1)
+		}
 		if r < utf8.RuneSelf {
 			buf8 = append(buf8, byte(r))
+			off++
 			continue
 		}
 		if r <= 0xffff {
@@ -150,6 +178,7 @@ func NewBuffer(data string) Buffer {
 			}
 			buf8 = nil
 			buf16 = append(buf16, uint16(r))
+			off++
 			goto copy16
 		}
 		buf32 = make([]rune, len(buf8), len(data))
@@ -158,17 +187,25 @@ func NewBuffer(data string) Buffer {
 		}
 		buf8 = nil
 		buf32 = append(buf32, r)
+		off++
 		goto copy32
 	}
+	if lines {
+		offs = append(offs, off+1)
+	}
 	return &asciiBuffer{
 		arr: buf8,
-	}
+	}, offs
 copy16:
 	for idx < len(data) {
 		r, s := utf8.DecodeRuneInString(data[idx:])
 		idx += s
+		if lines && r == '\n' {
+			offs = append(offs, off+1)
+		}
 		if r <= 0xffff {
 			buf16 = append(buf16, uint16(r))
+			off++
 			continue
 		}
 		buf32 = make([]rune, len(buf16), len(data))
@@ -177,18 +214,29 @@ copy16:
 		}
 		buf16 = nil
 		buf32 = append(buf32, r)
+		off++
 		goto copy32
 	}
+	if lines {
+		offs = append(offs, off+1)
+	}
 	return &basicBuffer{
 		arr: buf16,
-	}
+	}, offs
 copy32:
 	for idx < len(data) {
 		r, s := utf8.DecodeRuneInString(data[idx:])
 		idx += s
+		if lines && r == '\n' {
+			offs = append(offs, off+1)
+		}
 		buf32 = append(buf32, r)
+		off++
+	}
+	if lines {
+		offs = append(offs, off+1)
 	}
 	return &supplementalBuffer{
 		arr: buf32,
-	}
+	}, offs
 }
diff --git a/vendor/github.com/google/cel-go/common/source.go b/vendor/github.com/google/cel-go/common/source.go
index 52377d9..ec79cb5 100644
--- a/vendor/github.com/google/cel-go/common/source.go
+++ b/vendor/github.com/google/cel-go/common/source.go
@@ -15,9 +15,6 @@
 package common
 
 import (
-	"strings"
-	"unicode/utf8"
-
 	"github.com/google/cel-go/common/runes"
 
 	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
@@ -64,7 +61,6 @@ type sourceImpl struct {
 	runes.Buffer
 	description string
 	lineOffsets []int32
-	idOffsets   map[int64]int32
 }
 
 var _ runes.Buffer = &sourceImpl{}
@@ -81,18 +77,11 @@ func NewTextSource(text string) Source {
 // NewStringSource creates a new Source from the given contents and description.
 func NewStringSource(contents string, description string) Source {
 	// Compute line offsets up front as they are referred to frequently.
-	lines := strings.Split(contents, "\n")
-	offsets := make([]int32, len(lines))
-	var offset int32
-	for i, line := range lines {
-		offset = offset + int32(utf8.RuneCountInString(line)) + 1
-		offsets[int32(i)] = offset
-	}
+	buf, offs := runes.NewBufferAndLineOffsets(contents)
 	return &sourceImpl{
-		Buffer:      runes.NewBuffer(contents),
+		Buffer:      buf,
 		description: description,
-		lineOffsets: offsets,
-		idOffsets:   map[int64]int32{},
+		lineOffsets: offs,
 	}
 }
 
@@ -102,7 +91,6 @@ func NewInfoSource(info *exprpb.SourceInfo) Source {
 		Buffer:      runes.NewBuffer(""),
 		description: info.GetLocation(),
 		lineOffsets: info.GetLineOffsets(),
-		idOffsets:   info.GetPositions(),
 	}
 }
 
@@ -175,9 +163,8 @@ func (s *sourceImpl) findLine(characterOffset int32) (int32, int32) {
 	for _, lineOffset := range s.lineOffsets {
 		if lineOffset > characterOffset {
 			break
-		} else {
-			line++
 		}
+		line++
 	}
 	if line == 1 {
 		return line, 0
diff --git a/vendor/github.com/google/cel-go/common/stdlib/BUILD.bazel b/vendor/github.com/google/cel-go/common/stdlib/BUILD.bazel
new file mode 100644
index 0000000..b55f452
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/stdlib/BUILD.bazel
@@ -0,0 +1,23 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+package(
+    default_visibility = ["//visibility:public"],
+    licenses = ["notice"],  # Apache 2.0
+)
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "standard.go",
+    ],
+    importpath = "github.com/google/cel-go/common/stdlib",
+    deps = [
+        "//common/decls:go_default_library",
+        "//common/functions:go_default_library",
+        "//common/operators:go_default_library",
+        "//common/overloads:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
+        "//common/types/traits:go_default_library",
+    ],
+)
\ No newline at end of file
diff --git a/vendor/github.com/google/cel-go/common/stdlib/standard.go b/vendor/github.com/google/cel-go/common/stdlib/standard.go
new file mode 100644
index 0000000..1550c17
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/stdlib/standard.go
@@ -0,0 +1,620 @@
+// Copyright 2018 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package stdlib contains all of the standard library function declarations and definitions for CEL.
+package stdlib
+
+import (
+	"github.com/google/cel-go/common/decls"
+	"github.com/google/cel-go/common/functions"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+var (
+	stdFunctions []*decls.FunctionDecl
+	stdTypes     []*decls.VariableDecl
+)
+
+func init() {
+	paramA := types.NewTypeParamType("A")
+	paramB := types.NewTypeParamType("B")
+	listOfA := types.NewListType(paramA)
+	mapOfAB := types.NewMapType(paramA, paramB)
+
+	stdTypes = []*decls.VariableDecl{
+		decls.TypeVariable(types.BoolType),
+		decls.TypeVariable(types.BytesType),
+		decls.TypeVariable(types.DoubleType),
+		decls.TypeVariable(types.DurationType),
+		decls.TypeVariable(types.IntType),
+		decls.TypeVariable(listOfA),
+		decls.TypeVariable(mapOfAB),
+		decls.TypeVariable(types.NullType),
+		decls.TypeVariable(types.StringType),
+		decls.TypeVariable(types.TimestampType),
+		decls.TypeVariable(types.TypeType),
+		decls.TypeVariable(types.UintType),
+	}
+
+	stdFunctions = []*decls.FunctionDecl{
+		// Logical operators. Special-cased within the interpreter.
+		// Note, the singleton binding prevents extensions from overriding the operator behavior.
+		function(operators.Conditional,
+			decls.Overload(overloads.Conditional, argTypes(types.BoolType, paramA, paramA), paramA,
+				decls.OverloadIsNonStrict()),
+			decls.SingletonFunctionBinding(noFunctionOverrides)),
+		function(operators.LogicalAnd,
+			decls.Overload(overloads.LogicalAnd, argTypes(types.BoolType, types.BoolType), types.BoolType,
+				decls.OverloadIsNonStrict()),
+			decls.SingletonBinaryBinding(noBinaryOverrides)),
+		function(operators.LogicalOr,
+			decls.Overload(overloads.LogicalOr, argTypes(types.BoolType, types.BoolType), types.BoolType,
+				decls.OverloadIsNonStrict()),
+			decls.SingletonBinaryBinding(noBinaryOverrides)),
+		function(operators.LogicalNot,
+			decls.Overload(overloads.LogicalNot, argTypes(types.BoolType), types.BoolType),
+			decls.SingletonUnaryBinding(func(val ref.Val) ref.Val {
+				b, ok := val.(types.Bool)
+				if !ok {
+					return types.MaybeNoSuchOverloadErr(val)
+				}
+				return b.Negate()
+			})),
+
+		// Comprehension short-circuiting related function
+		function(operators.NotStrictlyFalse,
+			decls.Overload(overloads.NotStrictlyFalse, argTypes(types.BoolType), types.BoolType,
+				decls.OverloadIsNonStrict(),
+				decls.UnaryBinding(notStrictlyFalse))),
+		// Deprecated: __not_strictly_false__
+		function(operators.OldNotStrictlyFalse,
+			decls.DisableDeclaration(true), // safe deprecation
+			decls.Overload(operators.OldNotStrictlyFalse, argTypes(types.BoolType), types.BoolType,
+				decls.OverloadIsNonStrict(),
+				decls.UnaryBinding(notStrictlyFalse))),
+
+		// Equality / inequality. Special-cased in the interpreter
+		function(operators.Equals,
+			decls.Overload(overloads.Equals, argTypes(paramA, paramA), types.BoolType),
+			decls.SingletonBinaryBinding(noBinaryOverrides)),
+		function(operators.NotEquals,
+			decls.Overload(overloads.NotEquals, argTypes(paramA, paramA), types.BoolType),
+			decls.SingletonBinaryBinding(noBinaryOverrides)),
+
+		// Mathematical operators
+		function(operators.Add,
+			decls.Overload(overloads.AddBytes,
+				argTypes(types.BytesType, types.BytesType), types.BytesType),
+			decls.Overload(overloads.AddDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.DoubleType),
+			decls.Overload(overloads.AddDurationDuration,
+				argTypes(types.DurationType, types.DurationType), types.DurationType),
+			decls.Overload(overloads.AddDurationTimestamp,
+				argTypes(types.DurationType, types.TimestampType), types.TimestampType),
+			decls.Overload(overloads.AddTimestampDuration,
+				argTypes(types.TimestampType, types.DurationType), types.TimestampType),
+			decls.Overload(overloads.AddInt64,
+				argTypes(types.IntType, types.IntType), types.IntType),
+			decls.Overload(overloads.AddList,
+				argTypes(listOfA, listOfA), listOfA),
+			decls.Overload(overloads.AddString,
+				argTypes(types.StringType, types.StringType), types.StringType),
+			decls.Overload(overloads.AddUint64,
+				argTypes(types.UintType, types.UintType), types.UintType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Adder).Add(rhs)
+			}, traits.AdderType)),
+		function(operators.Divide,
+			decls.Overload(overloads.DivideDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.DoubleType),
+			decls.Overload(overloads.DivideInt64,
+				argTypes(types.IntType, types.IntType), types.IntType),
+			decls.Overload(overloads.DivideUint64,
+				argTypes(types.UintType, types.UintType), types.UintType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Divider).Divide(rhs)
+			}, traits.DividerType)),
+		function(operators.Modulo,
+			decls.Overload(overloads.ModuloInt64,
+				argTypes(types.IntType, types.IntType), types.IntType),
+			decls.Overload(overloads.ModuloUint64,
+				argTypes(types.UintType, types.UintType), types.UintType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Modder).Modulo(rhs)
+			}, traits.ModderType)),
+		function(operators.Multiply,
+			decls.Overload(overloads.MultiplyDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.DoubleType),
+			decls.Overload(overloads.MultiplyInt64,
+				argTypes(types.IntType, types.IntType), types.IntType),
+			decls.Overload(overloads.MultiplyUint64,
+				argTypes(types.UintType, types.UintType), types.UintType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Multiplier).Multiply(rhs)
+			}, traits.MultiplierType)),
+		function(operators.Negate,
+			decls.Overload(overloads.NegateDouble, argTypes(types.DoubleType), types.DoubleType),
+			decls.Overload(overloads.NegateInt64, argTypes(types.IntType), types.IntType),
+			decls.SingletonUnaryBinding(func(val ref.Val) ref.Val {
+				if types.IsBool(val) {
+					return types.MaybeNoSuchOverloadErr(val)
+				}
+				return val.(traits.Negater).Negate()
+			}, traits.NegatorType)),
+		function(operators.Subtract,
+			decls.Overload(overloads.SubtractDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.DoubleType),
+			decls.Overload(overloads.SubtractDurationDuration,
+				argTypes(types.DurationType, types.DurationType), types.DurationType),
+			decls.Overload(overloads.SubtractInt64,
+				argTypes(types.IntType, types.IntType), types.IntType),
+			decls.Overload(overloads.SubtractTimestampDuration,
+				argTypes(types.TimestampType, types.DurationType), types.TimestampType),
+			decls.Overload(overloads.SubtractTimestampTimestamp,
+				argTypes(types.TimestampType, types.TimestampType), types.DurationType),
+			decls.Overload(overloads.SubtractUint64,
+				argTypes(types.UintType, types.UintType), types.UintType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Subtractor).Subtract(rhs)
+			}, traits.SubtractorType)),
+
+		// Relations operators
+
+		function(operators.Less,
+			decls.Overload(overloads.LessBool,
+				argTypes(types.BoolType, types.BoolType), types.BoolType),
+			decls.Overload(overloads.LessInt64,
+				argTypes(types.IntType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessInt64Double,
+				argTypes(types.IntType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessInt64Uint64,
+				argTypes(types.IntType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessUint64,
+				argTypes(types.UintType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessUint64Double,
+				argTypes(types.UintType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessUint64Int64,
+				argTypes(types.UintType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessDoubleInt64,
+				argTypes(types.DoubleType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessDoubleUint64,
+				argTypes(types.DoubleType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessString,
+				argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.Overload(overloads.LessBytes,
+				argTypes(types.BytesType, types.BytesType), types.BoolType),
+			decls.Overload(overloads.LessTimestamp,
+				argTypes(types.TimestampType, types.TimestampType), types.BoolType),
+			decls.Overload(overloads.LessDuration,
+				argTypes(types.DurationType, types.DurationType), types.BoolType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				cmp := lhs.(traits.Comparer).Compare(rhs)
+				if cmp == types.IntNegOne {
+					return types.True
+				}
+				if cmp == types.IntOne || cmp == types.IntZero {
+					return types.False
+				}
+				return cmp
+			}, traits.ComparerType)),
+
+		function(operators.LessEquals,
+			decls.Overload(overloads.LessEqualsBool,
+				argTypes(types.BoolType, types.BoolType), types.BoolType),
+			decls.Overload(overloads.LessEqualsInt64,
+				argTypes(types.IntType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessEqualsInt64Double,
+				argTypes(types.IntType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessEqualsInt64Uint64,
+				argTypes(types.IntType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessEqualsUint64,
+				argTypes(types.UintType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessEqualsUint64Double,
+				argTypes(types.UintType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessEqualsUint64Int64,
+				argTypes(types.UintType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessEqualsDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.LessEqualsDoubleInt64,
+				argTypes(types.DoubleType, types.IntType), types.BoolType),
+			decls.Overload(overloads.LessEqualsDoubleUint64,
+				argTypes(types.DoubleType, types.UintType), types.BoolType),
+			decls.Overload(overloads.LessEqualsString,
+				argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.Overload(overloads.LessEqualsBytes,
+				argTypes(types.BytesType, types.BytesType), types.BoolType),
+			decls.Overload(overloads.LessEqualsTimestamp,
+				argTypes(types.TimestampType, types.TimestampType), types.BoolType),
+			decls.Overload(overloads.LessEqualsDuration,
+				argTypes(types.DurationType, types.DurationType), types.BoolType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				cmp := lhs.(traits.Comparer).Compare(rhs)
+				if cmp == types.IntNegOne || cmp == types.IntZero {
+					return types.True
+				}
+				if cmp == types.IntOne {
+					return types.False
+				}
+				return cmp
+			}, traits.ComparerType)),
+
+		function(operators.Greater,
+			decls.Overload(overloads.GreaterBool,
+				argTypes(types.BoolType, types.BoolType), types.BoolType),
+			decls.Overload(overloads.GreaterInt64,
+				argTypes(types.IntType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterInt64Double,
+				argTypes(types.IntType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterInt64Uint64,
+				argTypes(types.IntType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterUint64,
+				argTypes(types.UintType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterUint64Double,
+				argTypes(types.UintType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterUint64Int64,
+				argTypes(types.UintType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterDoubleInt64,
+				argTypes(types.DoubleType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterDoubleUint64,
+				argTypes(types.DoubleType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterString,
+				argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.Overload(overloads.GreaterBytes,
+				argTypes(types.BytesType, types.BytesType), types.BoolType),
+			decls.Overload(overloads.GreaterTimestamp,
+				argTypes(types.TimestampType, types.TimestampType), types.BoolType),
+			decls.Overload(overloads.GreaterDuration,
+				argTypes(types.DurationType, types.DurationType), types.BoolType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				cmp := lhs.(traits.Comparer).Compare(rhs)
+				if cmp == types.IntOne {
+					return types.True
+				}
+				if cmp == types.IntNegOne || cmp == types.IntZero {
+					return types.False
+				}
+				return cmp
+			}, traits.ComparerType)),
+
+		function(operators.GreaterEquals,
+			decls.Overload(overloads.GreaterEqualsBool,
+				argTypes(types.BoolType, types.BoolType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsInt64,
+				argTypes(types.IntType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsInt64Double,
+				argTypes(types.IntType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsInt64Uint64,
+				argTypes(types.IntType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsUint64,
+				argTypes(types.UintType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsUint64Double,
+				argTypes(types.UintType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsUint64Int64,
+				argTypes(types.UintType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsDouble,
+				argTypes(types.DoubleType, types.DoubleType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsDoubleInt64,
+				argTypes(types.DoubleType, types.IntType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsDoubleUint64,
+				argTypes(types.DoubleType, types.UintType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsString,
+				argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsBytes,
+				argTypes(types.BytesType, types.BytesType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsTimestamp,
+				argTypes(types.TimestampType, types.TimestampType), types.BoolType),
+			decls.Overload(overloads.GreaterEqualsDuration,
+				argTypes(types.DurationType, types.DurationType), types.BoolType),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				cmp := lhs.(traits.Comparer).Compare(rhs)
+				if cmp == types.IntOne || cmp == types.IntZero {
+					return types.True
+				}
+				if cmp == types.IntNegOne {
+					return types.False
+				}
+				return cmp
+			}, traits.ComparerType)),
+
+		// Indexing
+		function(operators.Index,
+			decls.Overload(overloads.IndexList, argTypes(listOfA, types.IntType), paramA),
+			decls.Overload(overloads.IndexMap, argTypes(mapOfAB, paramA), paramB),
+			decls.SingletonBinaryBinding(func(lhs, rhs ref.Val) ref.Val {
+				return lhs.(traits.Indexer).Get(rhs)
+			}, traits.IndexerType)),
+
+		// Collections operators
+		function(operators.In,
+			decls.Overload(overloads.InList, argTypes(paramA, listOfA), types.BoolType),
+			decls.Overload(overloads.InMap, argTypes(paramA, mapOfAB), types.BoolType),
+			decls.SingletonBinaryBinding(inAggregate)),
+		function(operators.OldIn,
+			decls.DisableDeclaration(true), // safe deprecation
+			decls.Overload(overloads.InList, argTypes(paramA, listOfA), types.BoolType),
+			decls.Overload(overloads.InMap, argTypes(paramA, mapOfAB), types.BoolType),
+			decls.SingletonBinaryBinding(inAggregate)),
+		function(overloads.DeprecatedIn,
+			decls.DisableDeclaration(true), // safe deprecation
+			decls.Overload(overloads.InList, argTypes(paramA, listOfA), types.BoolType),
+			decls.Overload(overloads.InMap, argTypes(paramA, mapOfAB), types.BoolType),
+			decls.SingletonBinaryBinding(inAggregate)),
+		function(overloads.Size,
+			decls.Overload(overloads.SizeBytes, argTypes(types.BytesType), types.IntType),
+			decls.MemberOverload(overloads.SizeBytesInst, argTypes(types.BytesType), types.IntType),
+			decls.Overload(overloads.SizeList, argTypes(listOfA), types.IntType),
+			decls.MemberOverload(overloads.SizeListInst, argTypes(listOfA), types.IntType),
+			decls.Overload(overloads.SizeMap, argTypes(mapOfAB), types.IntType),
+			decls.MemberOverload(overloads.SizeMapInst, argTypes(mapOfAB), types.IntType),
+			decls.Overload(overloads.SizeString, argTypes(types.StringType), types.IntType),
+			decls.MemberOverload(overloads.SizeStringInst, argTypes(types.StringType), types.IntType),
+			decls.SingletonUnaryBinding(func(val ref.Val) ref.Val {
+				return val.(traits.Sizer).Size()
+			}, traits.SizerType)),
+
+		// Type conversions
+		function(overloads.TypeConvertType,
+			decls.Overload(overloads.TypeConvertType, argTypes(paramA), types.NewTypeTypeWithParam(paramA)),
+			decls.SingletonUnaryBinding(convertToType(types.TypeType))),
+
+		// Bool conversions
+		function(overloads.TypeConvertBool,
+			decls.Overload(overloads.BoolToBool, argTypes(types.BoolType), types.BoolType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.StringToBool, argTypes(types.StringType), types.BoolType,
+				decls.UnaryBinding(convertToType(types.BoolType)))),
+
+		// Bytes conversions
+		function(overloads.TypeConvertBytes,
+			decls.Overload(overloads.BytesToBytes, argTypes(types.BytesType), types.BytesType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.StringToBytes, argTypes(types.StringType), types.BytesType,
+				decls.UnaryBinding(convertToType(types.BytesType)))),
+
+		// Double conversions
+		function(overloads.TypeConvertDouble,
+			decls.Overload(overloads.DoubleToDouble, argTypes(types.DoubleType), types.DoubleType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.IntToDouble, argTypes(types.IntType), types.DoubleType,
+				decls.UnaryBinding(convertToType(types.DoubleType))),
+			decls.Overload(overloads.StringToDouble, argTypes(types.StringType), types.DoubleType,
+				decls.UnaryBinding(convertToType(types.DoubleType))),
+			decls.Overload(overloads.UintToDouble, argTypes(types.UintType), types.DoubleType,
+				decls.UnaryBinding(convertToType(types.DoubleType)))),
+
+		// Duration conversions
+		function(overloads.TypeConvertDuration,
+			decls.Overload(overloads.DurationToDuration, argTypes(types.DurationType), types.DurationType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.IntToDuration, argTypes(types.IntType), types.DurationType,
+				decls.UnaryBinding(convertToType(types.DurationType))),
+			decls.Overload(overloads.StringToDuration, argTypes(types.StringType), types.DurationType,
+				decls.UnaryBinding(convertToType(types.DurationType)))),
+
+		// Dyn conversions
+		function(overloads.TypeConvertDyn,
+			decls.Overload(overloads.ToDyn, argTypes(paramA), types.DynType),
+			decls.SingletonUnaryBinding(identity)),
+
+		// Int conversions
+		function(overloads.TypeConvertInt,
+			decls.Overload(overloads.IntToInt, argTypes(types.IntType), types.IntType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.DoubleToInt, argTypes(types.DoubleType), types.IntType,
+				decls.UnaryBinding(convertToType(types.IntType))),
+			decls.Overload(overloads.DurationToInt, argTypes(types.DurationType), types.IntType,
+				decls.UnaryBinding(convertToType(types.IntType))),
+			decls.Overload(overloads.StringToInt, argTypes(types.StringType), types.IntType,
+				decls.UnaryBinding(convertToType(types.IntType))),
+			decls.Overload(overloads.TimestampToInt, argTypes(types.TimestampType), types.IntType,
+				decls.UnaryBinding(convertToType(types.IntType))),
+			decls.Overload(overloads.UintToInt, argTypes(types.UintType), types.IntType,
+				decls.UnaryBinding(convertToType(types.IntType))),
+		),
+
+		// String conversions
+		function(overloads.TypeConvertString,
+			decls.Overload(overloads.StringToString, argTypes(types.StringType), types.StringType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.BoolToString, argTypes(types.BoolType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.BytesToString, argTypes(types.BytesType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.DoubleToString, argTypes(types.DoubleType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.DurationToString, argTypes(types.DurationType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.IntToString, argTypes(types.IntType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.TimestampToString, argTypes(types.TimestampType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType))),
+			decls.Overload(overloads.UintToString, argTypes(types.UintType), types.StringType,
+				decls.UnaryBinding(convertToType(types.StringType)))),
+
+		// Timestamp conversions
+		function(overloads.TypeConvertTimestamp,
+			decls.Overload(overloads.TimestampToTimestamp, argTypes(types.TimestampType), types.TimestampType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.IntToTimestamp, argTypes(types.IntType), types.TimestampType,
+				decls.UnaryBinding(convertToType(types.TimestampType))),
+			decls.Overload(overloads.StringToTimestamp, argTypes(types.StringType), types.TimestampType,
+				decls.UnaryBinding(convertToType(types.TimestampType)))),
+
+		// Uint conversions
+		function(overloads.TypeConvertUint,
+			decls.Overload(overloads.UintToUint, argTypes(types.UintType), types.UintType,
+				decls.UnaryBinding(identity)),
+			decls.Overload(overloads.DoubleToUint, argTypes(types.DoubleType), types.UintType,
+				decls.UnaryBinding(convertToType(types.UintType))),
+			decls.Overload(overloads.IntToUint, argTypes(types.IntType), types.UintType,
+				decls.UnaryBinding(convertToType(types.UintType))),
+			decls.Overload(overloads.StringToUint, argTypes(types.StringType), types.UintType,
+				decls.UnaryBinding(convertToType(types.UintType)))),
+
+		// String functions
+		function(overloads.Contains,
+			decls.MemberOverload(overloads.ContainsString,
+				argTypes(types.StringType, types.StringType), types.BoolType,
+				decls.BinaryBinding(types.StringContains)),
+			decls.DisableTypeGuards(true)),
+		function(overloads.EndsWith,
+			decls.MemberOverload(overloads.EndsWithString,
+				argTypes(types.StringType, types.StringType), types.BoolType,
+				decls.BinaryBinding(types.StringEndsWith)),
+			decls.DisableTypeGuards(true)),
+		function(overloads.StartsWith,
+			decls.MemberOverload(overloads.StartsWithString,
+				argTypes(types.StringType, types.StringType), types.BoolType,
+				decls.BinaryBinding(types.StringStartsWith)),
+			decls.DisableTypeGuards(true)),
+		function(overloads.Matches,
+			decls.Overload(overloads.Matches, argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.MemberOverload(overloads.MatchesString,
+				argTypes(types.StringType, types.StringType), types.BoolType),
+			decls.SingletonBinaryBinding(func(str, pat ref.Val) ref.Val {
+				return str.(traits.Matcher).Match(pat)
+			}, traits.MatcherType)),
+
+		// Timestamp / duration functions
+		function(overloads.TimeGetFullYear,
+			decls.MemberOverload(overloads.TimestampToYear,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToYearWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetMonth,
+			decls.MemberOverload(overloads.TimestampToMonth,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToMonthWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetDayOfYear,
+			decls.MemberOverload(overloads.TimestampToDayOfYear,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToDayOfYearWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetDayOfMonth,
+			decls.MemberOverload(overloads.TimestampToDayOfMonthZeroBased,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToDayOfMonthZeroBasedWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetDate,
+			decls.MemberOverload(overloads.TimestampToDayOfMonthOneBased,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToDayOfMonthOneBasedWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetDayOfWeek,
+			decls.MemberOverload(overloads.TimestampToDayOfWeek,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToDayOfWeekWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType)),
+
+		function(overloads.TimeGetHours,
+			decls.MemberOverload(overloads.TimestampToHours,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToHoursWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType),
+			decls.MemberOverload(overloads.DurationToHours,
+				argTypes(types.DurationType), types.IntType)),
+
+		function(overloads.TimeGetMinutes,
+			decls.MemberOverload(overloads.TimestampToMinutes,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToMinutesWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType),
+			decls.MemberOverload(overloads.DurationToMinutes,
+				argTypes(types.DurationType), types.IntType)),
+
+		function(overloads.TimeGetSeconds,
+			decls.MemberOverload(overloads.TimestampToSeconds,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToSecondsWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType),
+			decls.MemberOverload(overloads.DurationToSeconds,
+				argTypes(types.DurationType), types.IntType)),
+
+		function(overloads.TimeGetMilliseconds,
+			decls.MemberOverload(overloads.TimestampToMilliseconds,
+				argTypes(types.TimestampType), types.IntType),
+			decls.MemberOverload(overloads.TimestampToMillisecondsWithTz,
+				argTypes(types.TimestampType, types.StringType), types.IntType),
+			decls.MemberOverload(overloads.DurationToMilliseconds,
+				argTypes(types.DurationType), types.IntType)),
+	}
+}
+
+// Functions returns the set of standard library function declarations and definitions for CEL.
+func Functions() []*decls.FunctionDecl {
+	return stdFunctions
+}
+
+// Types returns the set of standard library types for CEL.
+func Types() []*decls.VariableDecl {
+	return stdTypes
+}
+
+func notStrictlyFalse(value ref.Val) ref.Val {
+	if types.IsBool(value) {
+		return value
+	}
+	return types.True
+}
+
+func inAggregate(lhs ref.Val, rhs ref.Val) ref.Val {
+	if rhs.Type().HasTrait(traits.ContainerType) {
+		return rhs.(traits.Container).Contains(lhs)
+	}
+	return types.ValOrErr(rhs, "no such overload")
+}
+
+func function(name string, opts ...decls.FunctionOpt) *decls.FunctionDecl {
+	fn, err := decls.NewFunction(name, opts...)
+	if err != nil {
+		panic(err)
+	}
+	return fn
+}
+
+func argTypes(args ...*types.Type) []*types.Type {
+	return args
+}
+
+func noBinaryOverrides(rhs, lhs ref.Val) ref.Val {
+	return types.NoSuchOverloadErr()
+}
+
+func noFunctionOverrides(args ...ref.Val) ref.Val {
+	return types.NoSuchOverloadErr()
+}
+
+func identity(val ref.Val) ref.Val {
+	return val
+}
+
+func convertToType(t ref.Type) functions.UnaryOp {
+	return func(val ref.Val) ref.Val {
+		return val.ConvertToType(t)
+	}
+}
diff --git a/vendor/github.com/google/cel-go/common/types/BUILD.bazel b/vendor/github.com/google/cel-go/common/types/BUILD.bazel
index f56700d..8f010fa 100644
--- a/vendor/github.com/google/cel-go/common/types/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/types/BUILD.bazel
@@ -27,23 +27,25 @@ go_library(
         "provider.go",
         "string.go",
         "timestamp.go",
-        "type.go",
+        "types.go",
         "uint.go",
         "unknown.go",
         "util.go",
     ],
     importpath = "github.com/google/cel-go/common/types",
     deps = [
+        "//checker/decls:go_default_library",
         "//common/overloads:go_default_library",
         "//common/types/pb:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
         "@com_github_stoewer_go_strcase//:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
-        "@org_golang_google_genproto//googleapis/rpc/status:go_default_library",
+        "@dev_cel_expr//:expr",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//encoding/protojson:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
+        "@org_golang_google_protobuf//types/dynamicpb:go_default_library",
         "@org_golang_google_protobuf//types/known/anypb:go_default_library",
         "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
@@ -71,8 +73,9 @@ go_test(
         "provider_test.go",
         "string_test.go",
         "timestamp_test.go",
-        "type_test.go",
+        "types_test.go",
         "uint_test.go",
+        "unknown_test.go",
         "util_test.go",
     ],
     embed = [":go_default_library"],
@@ -80,7 +83,7 @@ go_test(
         "//common/types/ref:go_default_library",
         "//test:go_default_library",
         "//test/proto3pb:test_all_types_go_proto",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//encoding/protojson:go_default_library",
         "@org_golang_google_protobuf//types/known/anypb:go_default_library",
         "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
diff --git a/vendor/github.com/google/cel-go/common/types/bool.go b/vendor/github.com/google/cel-go/common/types/bool.go
index a634ecc..565734f 100644
--- a/vendor/github.com/google/cel-go/common/types/bool.go
+++ b/vendor/github.com/google/cel-go/common/types/bool.go
@@ -20,7 +20,6 @@ import (
 	"strconv"
 
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -31,11 +30,6 @@ import (
 type Bool bool
 
 var (
-	// BoolType singleton.
-	BoolType = NewTypeValue("bool",
-		traits.ComparerType,
-		traits.NegatorType)
-
 	// boolWrapperType golang reflected type for protobuf bool wrapper type.
 	boolWrapperType = reflect.TypeOf(&wrapperspb.BoolValue{})
 )
diff --git a/vendor/github.com/google/cel-go/common/types/bytes.go b/vendor/github.com/google/cel-go/common/types/bytes.go
index bef1907..7e813e2 100644
--- a/vendor/github.com/google/cel-go/common/types/bytes.go
+++ b/vendor/github.com/google/cel-go/common/types/bytes.go
@@ -22,7 +22,6 @@ import (
 	"unicode/utf8"
 
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -34,12 +33,6 @@ import (
 type Bytes []byte
 
 var (
-	// BytesType singleton.
-	BytesType = NewTypeValue("bytes",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.SizerType)
-
 	// byteWrapperType golang reflected type for protobuf bytes wrapper type.
 	byteWrapperType = reflect.TypeOf(&wrapperspb.BytesValue{})
 )
@@ -65,7 +58,17 @@ func (b Bytes) Compare(other ref.Val) ref.Val {
 // ConvertToNative implements the ref.Val interface method.
 func (b Bytes) ConvertToNative(typeDesc reflect.Type) (any, error) {
 	switch typeDesc.Kind() {
-	case reflect.Array, reflect.Slice:
+	case reflect.Array:
+		if len(b) != typeDesc.Len() {
+			return nil, fmt.Errorf("[%d]byte not assignable to [%d]byte array", len(b), typeDesc.Len())
+		}
+		refArrPtr := reflect.New(reflect.ArrayOf(len(b), typeDesc.Elem()))
+		refArr := refArrPtr.Elem()
+		for i, byt := range b {
+			refArr.Index(i).Set(reflect.ValueOf(byt).Convert(typeDesc.Elem()))
+		}
+		return refArr.Interface(), nil
+	case reflect.Slice:
 		return reflect.ValueOf(b).Convert(typeDesc).Interface(), nil
 	case reflect.Ptr:
 		switch typeDesc {
diff --git a/vendor/github.com/google/cel-go/common/types/double.go b/vendor/github.com/google/cel-go/common/types/double.go
index bda9f31..027e789 100644
--- a/vendor/github.com/google/cel-go/common/types/double.go
+++ b/vendor/github.com/google/cel-go/common/types/double.go
@@ -20,7 +20,6 @@ import (
 	"reflect"
 
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -32,15 +31,6 @@ import (
 type Double float64
 
 var (
-	// DoubleType singleton.
-	DoubleType = NewTypeValue("double",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.DividerType,
-		traits.MultiplierType,
-		traits.NegatorType,
-		traits.SubtractorType)
-
 	// doubleWrapperType reflected type for protobuf double wrapper type.
 	doubleWrapperType = reflect.TypeOf(&wrapperspb.DoubleValue{})
 
diff --git a/vendor/github.com/google/cel-go/common/types/duration.go b/vendor/github.com/google/cel-go/common/types/duration.go
index c90ac1b..596e56d 100644
--- a/vendor/github.com/google/cel-go/common/types/duration.go
+++ b/vendor/github.com/google/cel-go/common/types/duration.go
@@ -22,7 +22,6 @@ import (
 
 	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	dpb "google.golang.org/protobuf/types/known/durationpb"
@@ -41,13 +40,14 @@ func durationOf(d time.Duration) Duration {
 }
 
 var (
-	// DurationType singleton.
-	DurationType = NewTypeValue("google.protobuf.Duration",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.NegatorType,
-		traits.ReceiverType,
-		traits.SubtractorType)
+	durationValueType = reflect.TypeOf(&dpb.Duration{})
+
+	durationZeroArgOverloads = map[string]func(ref.Val) ref.Val{
+		overloads.TimeGetHours:        DurationGetHours,
+		overloads.TimeGetMinutes:      DurationGetMinutes,
+		overloads.TimeGetSeconds:      DurationGetSeconds,
+		overloads.TimeGetMilliseconds: DurationGetMilliseconds,
+	}
 )
 
 // Add implements traits.Adder.Add.
@@ -156,7 +156,7 @@ func (d Duration) Negate() ref.Val {
 func (d Duration) Receive(function string, overload string, args []ref.Val) ref.Val {
 	if len(args) == 0 {
 		if f, found := durationZeroArgOverloads[function]; found {
-			return f(d.Duration)
+			return f(d)
 		}
 	}
 	return NoSuchOverloadErr()
@@ -185,20 +185,38 @@ func (d Duration) Value() any {
 	return d.Duration
 }
 
-var (
-	durationValueType = reflect.TypeOf(&dpb.Duration{})
+// DurationGetHours returns the duration in hours.
+func DurationGetHours(val ref.Val) ref.Val {
+	dur, ok := val.(Duration)
+	if !ok {
+		return MaybeNoSuchOverloadErr(val)
+	}
+	return Int(dur.Hours())
+}
 
-	durationZeroArgOverloads = map[string]func(time.Duration) ref.Val{
-		overloads.TimeGetHours: func(dur time.Duration) ref.Val {
-			return Int(dur.Hours())
-		},
-		overloads.TimeGetMinutes: func(dur time.Duration) ref.Val {
-			return Int(dur.Minutes())
-		},
-		overloads.TimeGetSeconds: func(dur time.Duration) ref.Val {
-			return Int(dur.Seconds())
-		},
-		overloads.TimeGetMilliseconds: func(dur time.Duration) ref.Val {
-			return Int(dur.Milliseconds())
-		}}
-)
+// DurationGetMinutes returns duration in minutes.
+func DurationGetMinutes(val ref.Val) ref.Val {
+	dur, ok := val.(Duration)
+	if !ok {
+		return MaybeNoSuchOverloadErr(val)
+	}
+	return Int(dur.Minutes())
+}
+
+// DurationGetSeconds returns duration in seconds.
+func DurationGetSeconds(val ref.Val) ref.Val {
+	dur, ok := val.(Duration)
+	if !ok {
+		return MaybeNoSuchOverloadErr(val)
+	}
+	return Int(dur.Seconds())
+}
+
+// DurationGetMilliseconds returns duration in milliseconds.
+func DurationGetMilliseconds(val ref.Val) ref.Val {
+	dur, ok := val.(Duration)
+	if !ok {
+		return MaybeNoSuchOverloadErr(val)
+	}
+	return Int(dur.Milliseconds())
+}
diff --git a/vendor/github.com/google/cel-go/common/types/err.go b/vendor/github.com/google/cel-go/common/types/err.go
index b4874d9..9c9d9e2 100644
--- a/vendor/github.com/google/cel-go/common/types/err.go
+++ b/vendor/github.com/google/cel-go/common/types/err.go
@@ -31,11 +31,12 @@ type Error interface {
 // Err type which extends the built-in go error and implements ref.Val.
 type Err struct {
 	error
+	id int64
 }
 
 var (
 	// ErrType singleton.
-	ErrType = NewTypeValue("error")
+	ErrType = NewOpaqueType("error")
 
 	// errDivideByZero is an error indicating a division by zero of an integer value.
 	errDivideByZero = errors.New("division by zero")
@@ -58,7 +59,24 @@ var (
 // NewErr creates a new Err described by the format string and args.
 // TODO: Audit the use of this function and standardize the error messages and codes.
 func NewErr(format string, args ...any) ref.Val {
-	return &Err{fmt.Errorf(format, args...)}
+	return &Err{error: fmt.Errorf(format, args...)}
+}
+
+// NewErrWithNodeID creates a new Err described by the format string and args.
+// TODO: Audit the use of this function and standardize the error messages and codes.
+func NewErrWithNodeID(id int64, format string, args ...any) ref.Val {
+	return &Err{error: fmt.Errorf(format, args...), id: id}
+}
+
+// LabelErrNode returns val unaltered it is not an Err or if the error has a non-zero
+// AST node ID already present. Otherwise the id is added to the error for
+// recovery with the Err.NodeID method.
+func LabelErrNode(id int64, val ref.Val) ref.Val {
+	if err, ok := val.(*Err); ok && err.id == 0 {
+		err.id = id
+		return err
+	}
+	return val
 }
 
 // NoSuchOverloadErr returns a new types.Err instance with a no such overload message.
@@ -124,11 +142,21 @@ func (e *Err) Value() any {
 	return e.error
 }
 
+// NodeID returns the AST node ID of the expression that returned the error.
+func (e *Err) NodeID() int64 {
+	return e.id
+}
+
 // Is implements errors.Is.
 func (e *Err) Is(target error) bool {
 	return e.error.Error() == target.Error()
 }
 
+// Unwrap implements errors.Unwrap.
+func (e *Err) Unwrap() error {
+	return e.error
+}
+
 // IsError returns whether the input element ref.Type or ref.Val is equal to
 // the ErrType singleton.
 func IsError(val ref.Val) bool {
diff --git a/vendor/github.com/google/cel-go/common/types/int.go b/vendor/github.com/google/cel-go/common/types/int.go
index f5a9511..0ae9507 100644
--- a/vendor/github.com/google/cel-go/common/types/int.go
+++ b/vendor/github.com/google/cel-go/common/types/int.go
@@ -22,7 +22,6 @@ import (
 	"time"
 
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -41,16 +40,6 @@ const (
 )
 
 var (
-	// IntType singleton.
-	IntType = NewTypeValue("int",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.DividerType,
-		traits.ModderType,
-		traits.MultiplierType,
-		traits.NegatorType,
-		traits.SubtractorType)
-
 	// int32WrapperType reflected type for protobuf int32 wrapper type.
 	int32WrapperType = reflect.TypeOf(&wrapperspb.Int32Value{})
 
@@ -101,6 +90,18 @@ func (i Int) ConvertToNative(typeDesc reflect.Type) (any, error) {
 			return nil, err
 		}
 		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
+	case reflect.Int8:
+		v, err := int64ToInt8Checked(int64(i))
+		if err != nil {
+			return nil, err
+		}
+		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
+	case reflect.Int16:
+		v, err := int64ToInt16Checked(int64(i))
+		if err != nil {
+			return nil, err
+		}
+		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
 	case reflect.Int64:
 		return reflect.ValueOf(i).Convert(typeDesc).Interface(), nil
 	case reflect.Ptr:
diff --git a/vendor/github.com/google/cel-go/common/types/iterator.go b/vendor/github.com/google/cel-go/common/types/iterator.go
index 9f224ad..98e9147 100644
--- a/vendor/github.com/google/cel-go/common/types/iterator.go
+++ b/vendor/github.com/google/cel-go/common/types/iterator.go
@@ -24,7 +24,7 @@ import (
 
 var (
 	// IteratorType singleton.
-	IteratorType = NewTypeValue("iterator", traits.IteratorType)
+	IteratorType = NewObjectType("iterator", traits.IteratorType)
 )
 
 // baseIterator is the basis for list, map, and object iterators.
diff --git a/vendor/github.com/google/cel-go/common/types/list.go b/vendor/github.com/google/cel-go/common/types/list.go
index de5f209..ca47d39 100644
--- a/vendor/github.com/google/cel-go/common/types/list.go
+++ b/vendor/github.com/google/cel-go/common/types/list.go
@@ -29,25 +29,15 @@ import (
 	structpb "google.golang.org/protobuf/types/known/structpb"
 )
 
-var (
-	// ListType singleton.
-	ListType = NewTypeValue("list",
-		traits.AdderType,
-		traits.ContainerType,
-		traits.IndexerType,
-		traits.IterableType,
-		traits.SizerType)
-)
-
 // NewDynamicList returns a traits.Lister with heterogenous elements.
 // value should be an array of "native" types, i.e. any type that
 // NativeToValue() can convert to a ref.Val.
-func NewDynamicList(adapter ref.TypeAdapter, value any) traits.Lister {
+func NewDynamicList(adapter Adapter, value any) traits.Lister {
 	refValue := reflect.ValueOf(value)
 	return &baseList{
-		TypeAdapter: adapter,
-		value:       value,
-		size:        refValue.Len(),
+		Adapter: adapter,
+		value:   value,
+		size:    refValue.Len(),
 		get: func(i int) any {
 			return refValue.Index(i).Interface()
 		},
@@ -55,56 +45,56 @@ func NewDynamicList(adapter ref.TypeAdapter, value any) traits.Lister {
 }
 
 // NewStringList returns a traits.Lister containing only strings.
-func NewStringList(adapter ref.TypeAdapter, elems []string) traits.Lister {
+func NewStringList(adapter Adapter, elems []string) traits.Lister {
 	return &baseList{
-		TypeAdapter: adapter,
-		value:       elems,
-		size:        len(elems),
-		get:         func(i int) any { return elems[i] },
+		Adapter: adapter,
+		value:   elems,
+		size:    len(elems),
+		get:     func(i int) any { return elems[i] },
 	}
 }
 
 // NewRefValList returns a traits.Lister with ref.Val elements.
 //
 // This type specialization is used with list literals within CEL expressions.
-func NewRefValList(adapter ref.TypeAdapter, elems []ref.Val) traits.Lister {
+func NewRefValList(adapter Adapter, elems []ref.Val) traits.Lister {
 	return &baseList{
-		TypeAdapter: adapter,
-		value:       elems,
-		size:        len(elems),
-		get:         func(i int) any { return elems[i] },
+		Adapter: adapter,
+		value:   elems,
+		size:    len(elems),
+		get:     func(i int) any { return elems[i] },
 	}
 }
 
 // NewProtoList returns a traits.Lister based on a pb.List instance.
-func NewProtoList(adapter ref.TypeAdapter, list protoreflect.List) traits.Lister {
+func NewProtoList(adapter Adapter, list protoreflect.List) traits.Lister {
 	return &baseList{
-		TypeAdapter: adapter,
-		value:       list,
-		size:        list.Len(),
-		get:         func(i int) any { return list.Get(i).Interface() },
+		Adapter: adapter,
+		value:   list,
+		size:    list.Len(),
+		get:     func(i int) any { return list.Get(i).Interface() },
 	}
 }
 
 // NewJSONList returns a traits.Lister based on structpb.ListValue instance.
-func NewJSONList(adapter ref.TypeAdapter, l *structpb.ListValue) traits.Lister {
+func NewJSONList(adapter Adapter, l *structpb.ListValue) traits.Lister {
 	vals := l.GetValues()
 	return &baseList{
-		TypeAdapter: adapter,
-		value:       l,
-		size:        len(vals),
-		get:         func(i int) any { return vals[i] },
+		Adapter: adapter,
+		value:   l,
+		size:    len(vals),
+		get:     func(i int) any { return vals[i] },
 	}
 }
 
 // NewMutableList creates a new mutable list whose internal state can be modified.
-func NewMutableList(adapter ref.TypeAdapter) traits.MutableLister {
+func NewMutableList(adapter Adapter) traits.MutableLister {
 	var mutableValues []ref.Val
 	l := &mutableList{
 		baseList: &baseList{
-			TypeAdapter: adapter,
-			value:       mutableValues,
-			size:        0,
+			Adapter: adapter,
+			value:   mutableValues,
+			size:    0,
 		},
 		mutableValues: mutableValues,
 	}
@@ -116,9 +106,9 @@ func NewMutableList(adapter ref.TypeAdapter) traits.MutableLister {
 
 // baseList points to a list containing elements of any type.
 // The `value` is an array of native values, and refValue is its reflection object.
-// The `ref.TypeAdapter` enables native type to CEL type conversions.
+// The `Adapter` enables native type to CEL type conversions.
 type baseList struct {
-	ref.TypeAdapter
+	Adapter
 	value any
 
 	// size indicates the number of elements within the list.
@@ -143,9 +133,9 @@ func (l *baseList) Add(other ref.Val) ref.Val {
 		return l
 	}
 	return &concatList{
-		TypeAdapter: l.TypeAdapter,
-		prevList:    l,
-		nextList:    otherList}
+		Adapter:  l.Adapter,
+		prevList: l,
+		nextList: otherList}
 }
 
 // Contains implements the traits.Container interface method.
@@ -200,7 +190,13 @@ func (l *baseList) ConvertToNative(typeDesc reflect.Type) (any, error) {
 	// Allow the element ConvertToNative() function to determine whether conversion is possible.
 	otherElemType := typeDesc.Elem()
 	elemCount := l.size
-	nativeList := reflect.MakeSlice(typeDesc, elemCount, elemCount)
+	var nativeList reflect.Value
+	if typeDesc.Kind() == reflect.Array {
+		nativeList = reflect.New(reflect.ArrayOf(elemCount, typeDesc)).Elem().Index(0)
+	} else {
+		nativeList = reflect.MakeSlice(typeDesc, elemCount, elemCount)
+
+	}
 	for i := 0; i < elemCount; i++ {
 		elem := l.NativeToValue(l.get(i))
 		nativeElemVal, err := elem.ConvertToNative(otherElemType)
@@ -260,6 +256,15 @@ func (l *baseList) IsZeroValue() bool {
 	return l.size == 0
 }
 
+// Fold calls the FoldEntry method for each (index, value) pair in the list.
+func (l *baseList) Fold(f traits.Folder) {
+	for i := 0; i < l.size; i++ {
+		if !f.FoldEntry(i, l.get(i)) {
+			break
+		}
+	}
+}
+
 // Iterator implements the traits.Iterable interface method.
 func (l *baseList) Iterator() traits.Iterator {
 	return newListIterator(l)
@@ -322,13 +327,13 @@ func (l *mutableList) Add(other ref.Val) ref.Val {
 func (l *mutableList) ToImmutableList() traits.Lister {
 	// The reference to internal state is guaranteed to be safe as this call is only performed
 	// when mutations have been completed.
-	return NewRefValList(l.TypeAdapter, l.mutableValues)
+	return NewRefValList(l.Adapter, l.mutableValues)
 }
 
 // concatList combines two list implementations together into a view.
-// The `ref.TypeAdapter` enables native type to CEL type conversions.
+// The `Adapter` enables native type to CEL type conversions.
 type concatList struct {
-	ref.TypeAdapter
+	Adapter
 	value    any
 	prevList traits.Lister
 	nextList traits.Lister
@@ -347,9 +352,9 @@ func (l *concatList) Add(other ref.Val) ref.Val {
 		return l
 	}
 	return &concatList{
-		TypeAdapter: l.TypeAdapter,
-		prevList:    l,
-		nextList:    otherList}
+		Adapter:  l.Adapter,
+		prevList: l,
+		nextList: otherList}
 }
 
 // Contains implements the traits.Container interface method.
@@ -376,7 +381,7 @@ func (l *concatList) Contains(elem ref.Val) ref.Val {
 
 // ConvertToNative implements the ref.Val interface method.
 func (l *concatList) ConvertToNative(typeDesc reflect.Type) (any, error) {
-	combined := NewDynamicList(l.TypeAdapter, l.Value().([]any))
+	combined := NewDynamicList(l.Adapter, l.Value().([]any))
 	return combined.ConvertToNative(typeDesc)
 }
 
@@ -437,6 +442,15 @@ func (l *concatList) IsZeroValue() bool {
 	return l.Size().(Int) == 0
 }
 
+// Fold calls the FoldEntry method for each (index, value) pair in the list.
+func (l *concatList) Fold(f traits.Folder) {
+	for i := Int(0); i < l.Size().(Int); i++ {
+		if !f.FoldEntry(i, l.Get(i)) {
+			break
+		}
+	}
+}
+
 // Iterator implements the traits.Iterable interface method.
 func (l *concatList) Iterator() traits.Iterator {
 	return newListIterator(l)
@@ -531,3 +545,30 @@ func IndexOrError(index ref.Val) (int, error) {
 		return -1, fmt.Errorf("unsupported index type '%s' in list", index.Type())
 	}
 }
+
+// ToFoldableList will create a Foldable version of a list suitable for key-value pair iteration.
+//
+// For values which are already Foldable, this call is a no-op. For all other values, the fold is
+// driven via the Size() and Get() calls which means that the folding will function, but take a
+// performance hit.
+func ToFoldableList(l traits.Lister) traits.Foldable {
+	if f, ok := l.(traits.Foldable); ok {
+		return f
+	}
+	return interopFoldableList{Lister: l}
+}
+
+type interopFoldableList struct {
+	traits.Lister
+}
+
+// Fold implements the traits.Foldable interface method and performs an iteration over the
+// range of elements of the list.
+func (l interopFoldableList) Fold(f traits.Folder) {
+	sz := l.Size().(Int)
+	for i := Int(0); i < sz; i++ {
+		if !f.FoldEntry(i, l.Get(i)) {
+			break
+		}
+	}
+}
diff --git a/vendor/github.com/google/cel-go/common/types/map.go b/vendor/github.com/google/cel-go/common/types/map.go
index 213be4a..cb6cce7 100644
--- a/vendor/github.com/google/cel-go/common/types/map.go
+++ b/vendor/github.com/google/cel-go/common/types/map.go
@@ -32,10 +32,10 @@ import (
 )
 
 // NewDynamicMap returns a traits.Mapper value with dynamic key, value pairs.
-func NewDynamicMap(adapter ref.TypeAdapter, value any) traits.Mapper {
+func NewDynamicMap(adapter Adapter, value any) traits.Mapper {
 	refValue := reflect.ValueOf(value)
 	return &baseMap{
-		TypeAdapter: adapter,
+		Adapter:     adapter,
 		mapAccessor: newReflectMapAccessor(adapter, refValue),
 		value:       value,
 		size:        refValue.Len(),
@@ -46,10 +46,10 @@ func NewDynamicMap(adapter ref.TypeAdapter, value any) traits.Mapper {
 // encoded in protocol buffer form.
 //
 // The `adapter` argument provides type adaptation capabilities from proto to CEL.
-func NewJSONStruct(adapter ref.TypeAdapter, value *structpb.Struct) traits.Mapper {
+func NewJSONStruct(adapter Adapter, value *structpb.Struct) traits.Mapper {
 	fields := value.GetFields()
 	return &baseMap{
-		TypeAdapter: adapter,
+		Adapter:     adapter,
 		mapAccessor: newJSONStructAccessor(adapter, fields),
 		value:       value,
 		size:        len(fields),
@@ -57,9 +57,9 @@ func NewJSONStruct(adapter ref.TypeAdapter, value *structpb.Struct) traits.Mappe
 }
 
 // NewRefValMap returns a specialized traits.Mapper with CEL valued keys and values.
-func NewRefValMap(adapter ref.TypeAdapter, value map[ref.Val]ref.Val) traits.Mapper {
+func NewRefValMap(adapter Adapter, value map[ref.Val]ref.Val) traits.Mapper {
 	return &baseMap{
-		TypeAdapter: adapter,
+		Adapter:     adapter,
 		mapAccessor: newRefValMapAccessor(value),
 		value:       value,
 		size:        len(value),
@@ -67,9 +67,9 @@ func NewRefValMap(adapter ref.TypeAdapter, value map[ref.Val]ref.Val) traits.Map
 }
 
 // NewStringInterfaceMap returns a specialized traits.Mapper with string keys and interface values.
-func NewStringInterfaceMap(adapter ref.TypeAdapter, value map[string]any) traits.Mapper {
+func NewStringInterfaceMap(adapter Adapter, value map[string]any) traits.Mapper {
 	return &baseMap{
-		TypeAdapter: adapter,
+		Adapter:     adapter,
 		mapAccessor: newStringIfaceMapAccessor(adapter, value),
 		value:       value,
 		size:        len(value),
@@ -77,9 +77,9 @@ func NewStringInterfaceMap(adapter ref.TypeAdapter, value map[string]any) traits
 }
 
 // NewStringStringMap returns a specialized traits.Mapper with string keys and values.
-func NewStringStringMap(adapter ref.TypeAdapter, value map[string]string) traits.Mapper {
+func NewStringStringMap(adapter Adapter, value map[string]string) traits.Mapper {
 	return &baseMap{
-		TypeAdapter: adapter,
+		Adapter:     adapter,
 		mapAccessor: newStringMapAccessor(value),
 		value:       value,
 		size:        len(value),
@@ -87,21 +87,30 @@ func NewStringStringMap(adapter ref.TypeAdapter, value map[string]string) traits
 }
 
 // NewProtoMap returns a specialized traits.Mapper for handling protobuf map values.
-func NewProtoMap(adapter ref.TypeAdapter, value *pb.Map) traits.Mapper {
+func NewProtoMap(adapter Adapter, value *pb.Map) traits.Mapper {
 	return &protoMap{
-		TypeAdapter: adapter,
-		value:       value,
+		Adapter: adapter,
+		value:   value,
 	}
 }
 
-var (
-	// MapType singleton.
-	MapType = NewTypeValue("map",
-		traits.ContainerType,
-		traits.IndexerType,
-		traits.IterableType,
-		traits.SizerType)
-)
+// NewMutableMap constructs a mutable map from an adapter and a set of map values.
+func NewMutableMap(adapter Adapter, mutableValues map[ref.Val]ref.Val) traits.MutableMapper {
+	mutableCopy := make(map[ref.Val]ref.Val, len(mutableValues))
+	for k, v := range mutableValues {
+		mutableCopy[k] = v
+	}
+	m := &mutableMap{
+		baseMap: &baseMap{
+			Adapter:     adapter,
+			mapAccessor: newRefValMapAccessor(mutableCopy),
+			value:       mutableCopy,
+			size:        len(mutableCopy),
+		},
+		mutableValues: mutableCopy,
+	}
+	return m
+}
 
 // mapAccessor is a private interface for finding values within a map and iterating over the keys.
 // This interface implements portions of the API surface area required by the traits.Mapper
@@ -114,6 +123,9 @@ type mapAccessor interface {
 
 	// Iterator returns an Iterator over the map key set.
 	Iterator() traits.Iterator
+
+	// Fold calls the FoldEntry method for each (key, value) pair in the map.
+	Fold(traits.Folder)
 }
 
 // baseMap is a reflection based map implementation designed to handle a variety of map-like types.
@@ -121,7 +133,7 @@ type mapAccessor interface {
 // Since CEL is side-effect free, the base map represents an immutable object.
 type baseMap struct {
 	// TypeAdapter used to convert keys and values accessed within the map.
-	ref.TypeAdapter
+	Adapter
 
 	// mapAccessor interface implementation used to find and iterate over map keys.
 	mapAccessor
@@ -316,15 +328,37 @@ func (m *baseMap) Value() any {
 	return m.value
 }
 
-func newJSONStructAccessor(adapter ref.TypeAdapter, st map[string]*structpb.Value) mapAccessor {
+// mutableMap holds onto a set of mutable values which are used for intermediate computations.
+type mutableMap struct {
+	*baseMap
+	mutableValues map[ref.Val]ref.Val
+}
+
+// Insert implements the traits.MutableMapper interface method, returning true if the key insertion
+// succeeds.
+func (m *mutableMap) Insert(k, v ref.Val) ref.Val {
+	if _, found := m.Find(k); found {
+		return NewErr("insert failed: key %v already exists", k)
+	}
+	m.mutableValues[k] = v
+	return m
+}
+
+// ToImmutableMap implements the traits.MutableMapper interface method, converting a mutable map
+// an immutable map implementation.
+func (m *mutableMap) ToImmutableMap() traits.Mapper {
+	return NewRefValMap(m.Adapter, m.mutableValues)
+}
+
+func newJSONStructAccessor(adapter Adapter, st map[string]*structpb.Value) mapAccessor {
 	return &jsonStructAccessor{
-		TypeAdapter: adapter,
-		st:          st,
+		Adapter: adapter,
+		st:      st,
 	}
 }
 
 type jsonStructAccessor struct {
-	ref.TypeAdapter
+	Adapter
 	st map[string]*structpb.Value
 }
 
@@ -359,17 +393,26 @@ func (a *jsonStructAccessor) Iterator() traits.Iterator {
 	}
 }
 
-func newReflectMapAccessor(adapter ref.TypeAdapter, value reflect.Value) mapAccessor {
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (a *jsonStructAccessor) Fold(f traits.Folder) {
+	for k, v := range a.st {
+		if !f.FoldEntry(k, v) {
+			break
+		}
+	}
+}
+
+func newReflectMapAccessor(adapter Adapter, value reflect.Value) mapAccessor {
 	keyType := value.Type().Key()
 	return &reflectMapAccessor{
-		TypeAdapter: adapter,
-		refValue:    value,
-		keyType:     keyType,
+		Adapter:  adapter,
+		refValue: value,
+		keyType:  keyType,
 	}
 }
 
 type reflectMapAccessor struct {
-	ref.TypeAdapter
+	Adapter
 	refValue reflect.Value
 	keyType  reflect.Type
 }
@@ -427,9 +470,19 @@ func (m *reflectMapAccessor) findInternal(key ref.Val) (ref.Val, bool) {
 // Iterator creates a Golang reflection based traits.Iterator.
 func (m *reflectMapAccessor) Iterator() traits.Iterator {
 	return &mapIterator{
-		TypeAdapter: m.TypeAdapter,
-		mapKeys:     m.refValue.MapRange(),
-		len:         m.refValue.Len(),
+		Adapter: m.Adapter,
+		mapKeys: m.refValue.MapRange(),
+		len:     m.refValue.Len(),
+	}
+}
+
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (m *reflectMapAccessor) Fold(f traits.Folder) {
+	mapRange := m.refValue.MapRange()
+	for mapRange.Next() {
+		if !f.FoldEntry(mapRange.Key().Interface(), mapRange.Value().Interface()) {
+			break
+		}
 	}
 }
 
@@ -480,9 +533,18 @@ func (a *refValMapAccessor) Find(key ref.Val) (ref.Val, bool) {
 // Iterator produces a new traits.Iterator which iterates over the map keys via Golang reflection.
 func (a *refValMapAccessor) Iterator() traits.Iterator {
 	return &mapIterator{
-		TypeAdapter: DefaultTypeAdapter,
-		mapKeys:     reflect.ValueOf(a.mapVal).MapRange(),
-		len:         len(a.mapVal),
+		Adapter: DefaultTypeAdapter,
+		mapKeys: reflect.ValueOf(a.mapVal).MapRange(),
+		len:     len(a.mapVal),
+	}
+}
+
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (a *refValMapAccessor) Fold(f traits.Folder) {
+	for k, v := range a.mapVal {
+		if !f.FoldEntry(k, v) {
+			break
+		}
 	}
 }
 
@@ -524,15 +586,24 @@ func (a *stringMapAccessor) Iterator() traits.Iterator {
 	}
 }
 
-func newStringIfaceMapAccessor(adapter ref.TypeAdapter, mapVal map[string]any) mapAccessor {
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (a *stringMapAccessor) Fold(f traits.Folder) {
+	for k, v := range a.mapVal {
+		if !f.FoldEntry(k, v) {
+			break
+		}
+	}
+}
+
+func newStringIfaceMapAccessor(adapter Adapter, mapVal map[string]any) mapAccessor {
 	return &stringIfaceMapAccessor{
-		TypeAdapter: adapter,
-		mapVal:      mapVal,
+		Adapter: adapter,
+		mapVal:  mapVal,
 	}
 }
 
 type stringIfaceMapAccessor struct {
-	ref.TypeAdapter
+	Adapter
 	mapVal map[string]any
 }
 
@@ -566,10 +637,19 @@ func (a *stringIfaceMapAccessor) Iterator() traits.Iterator {
 	}
 }
 
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (a *stringIfaceMapAccessor) Fold(f traits.Folder) {
+	for k, v := range a.mapVal {
+		if !f.FoldEntry(k, v) {
+			break
+		}
+	}
+}
+
 // protoMap is a specialized, separate implementation of the traits.Mapper interfaces tailored to
 // accessing protoreflect.Map values.
 type protoMap struct {
-	ref.TypeAdapter
+	Adapter
 	value *pb.Map
 }
 
@@ -772,12 +852,19 @@ func (m *protoMap) Iterator() traits.Iterator {
 		return true
 	})
 	return &protoMapIterator{
-		TypeAdapter: m.TypeAdapter,
-		mapKeys:     mapKeys,
-		len:         m.value.Len(),
+		Adapter: m.Adapter,
+		mapKeys: mapKeys,
+		len:     m.value.Len(),
 	}
 }
 
+// Fold calls the FoldEntry method for each (key, value) pair in the map.
+func (m *protoMap) Fold(f traits.Folder) {
+	m.value.Range(func(k protoreflect.MapKey, v protoreflect.Value) bool {
+		return f.FoldEntry(k.Interface(), v.Interface())
+	})
+}
+
 // Size returns the number of entries in the protoreflect.Map.
 func (m *protoMap) Size() ref.Val {
 	return Int(m.value.Len())
@@ -795,7 +882,7 @@ func (m *protoMap) Value() any {
 
 type mapIterator struct {
 	*baseIterator
-	ref.TypeAdapter
+	Adapter
 	mapKeys *reflect.MapIter
 	cursor  int
 	len     int
@@ -818,7 +905,7 @@ func (it *mapIterator) Next() ref.Val {
 
 type protoMapIterator struct {
 	*baseIterator
-	ref.TypeAdapter
+	Adapter
 	mapKeys []protoreflect.MapKey
 	cursor  int
 	len     int
@@ -861,3 +948,55 @@ func (it *stringKeyIterator) Next() ref.Val {
 	}
 	return nil
 }
+
+// ToFoldableMap will create a Foldable version of a map suitable for key-value pair iteration.
+//
+// For values which are already Foldable, this call is a no-op. For all other values, the fold
+// is driven via the Iterator HasNext() and Next() calls as well as the map's Get() method
+// which means that the folding will function, but take a performance hit.
+func ToFoldableMap(m traits.Mapper) traits.Foldable {
+	if f, ok := m.(traits.Foldable); ok {
+		return f
+	}
+	return interopFoldableMap{Mapper: m}
+}
+
+type interopFoldableMap struct {
+	traits.Mapper
+}
+
+func (m interopFoldableMap) Fold(f traits.Folder) {
+	it := m.Iterator()
+	for it.HasNext() == True {
+		k := it.Next()
+		if !f.FoldEntry(k, m.Get(k)) {
+			break
+		}
+	}
+}
+
+// InsertMapKeyValue inserts a key, value pair into the target map if the target map does not
+// already contain the given key.
+//
+// If the map is mutable, it is modified in-place per the MutableMapper contract.
+// If the map is not mutable, a copy containing the new key, value pair is made.
+func InsertMapKeyValue(m traits.Mapper, k, v ref.Val) ref.Val {
+	if mutable, ok := m.(traits.MutableMapper); ok {
+		return mutable.Insert(k, v)
+	}
+
+	// Otherwise perform the slow version of the insertion which makes a copy of the incoming map.
+	if _, found := m.Find(k); !found {
+		size := m.Size().(Int)
+		copy := make(map[ref.Val]ref.Val, size+1)
+		copy[k] = v
+		it := m.Iterator()
+		for it.HasNext() == True {
+			nextK := it.Next()
+			nextV := m.Get(nextK)
+			copy[nextK] = nextV
+		}
+		return DefaultTypeAdapter.NativeToValue(copy)
+	}
+	return NewErr("insert failed: key %v already exists", k)
+}
diff --git a/vendor/github.com/google/cel-go/common/types/null.go b/vendor/github.com/google/cel-go/common/types/null.go
index 38927a1..36514ff 100644
--- a/vendor/github.com/google/cel-go/common/types/null.go
+++ b/vendor/github.com/google/cel-go/common/types/null.go
@@ -30,13 +30,13 @@ import (
 type Null structpb.NullValue
 
 var (
-	// NullType singleton.
-	NullType = NewTypeValue("null_type")
 	// NullValue singleton.
 	NullValue = Null(structpb.NullValue_NULL_VALUE)
 
 	// golang reflect type for Null values.
 	nullReflectType = reflect.TypeOf(NullValue)
+
+	protoIfaceType = reflect.TypeOf((*proto.Message)(nil)).Elem()
 )
 
 // ConvertToNative implements ref.Val.ConvertToNative.
@@ -63,8 +63,14 @@ func (n Null) ConvertToNative(typeDesc reflect.Type) (any, error) {
 			return structpb.NewNullValue(), nil
 		case boolWrapperType, byteWrapperType, doubleWrapperType, floatWrapperType,
 			int32WrapperType, int64WrapperType, stringWrapperType, uint32WrapperType,
-			uint64WrapperType:
+			uint64WrapperType, durationValueType, timestampValueType, protoIfaceType:
 			return nil, nil
+		case jsonListValueType, jsonStructType:
+			// skip handling
+		default:
+			if typeDesc.Implements(protoIfaceType) {
+				return nil, nil
+			}
 		}
 	case reflect.Interface:
 		nv := n.Value()
diff --git a/vendor/github.com/google/cel-go/common/types/object.go b/vendor/github.com/google/cel-go/common/types/object.go
index 9955e2d..8ba0af9 100644
--- a/vendor/github.com/google/cel-go/common/types/object.go
+++ b/vendor/github.com/google/cel-go/common/types/object.go
@@ -29,10 +29,10 @@ import (
 )
 
 type protoObj struct {
-	ref.TypeAdapter
+	Adapter
 	value     proto.Message
 	typeDesc  *pb.TypeDescription
-	typeValue *TypeValue
+	typeValue ref.Val
 }
 
 // NewObject returns an object based on a proto.Message value which handles
@@ -42,15 +42,15 @@ type protoObj struct {
 // Note: the type value is pulled from the list of registered types within the
 // type provider. If the proto type is not registered within the type provider,
 // then this will result in an error within the type adapter / provider.
-func NewObject(adapter ref.TypeAdapter,
+func NewObject(adapter Adapter,
 	typeDesc *pb.TypeDescription,
-	typeValue *TypeValue,
+	typeValue ref.Val,
 	value proto.Message) ref.Val {
 	return &protoObj{
-		TypeAdapter: adapter,
-		value:       value,
-		typeDesc:    typeDesc,
-		typeValue:   typeValue}
+		Adapter:   adapter,
+		value:     value,
+		typeDesc:  typeDesc,
+		typeValue: typeValue}
 }
 
 func (o *protoObj) ConvertToNative(typeDesc reflect.Type) (any, error) {
@@ -157,7 +157,7 @@ func (o *protoObj) Get(index ref.Val) ref.Val {
 }
 
 func (o *protoObj) Type() ref.Type {
-	return o.typeValue
+	return o.typeValue.(ref.Type)
 }
 
 func (o *protoObj) Value() any {
diff --git a/vendor/github.com/google/cel-go/common/types/optional.go b/vendor/github.com/google/cel-go/common/types/optional.go
index 54cb35b..97845a7 100644
--- a/vendor/github.com/google/cel-go/common/types/optional.go
+++ b/vendor/github.com/google/cel-go/common/types/optional.go
@@ -24,7 +24,7 @@ import (
 
 var (
 	// OptionalType indicates the runtime type of an optional value.
-	OptionalType = NewTypeValue("optional")
+	OptionalType = NewOpaqueType("optional_type")
 
 	// OptionalNone is a sentinel value which is used to indicate an empty optional value.
 	OptionalNone = &Optional{}
diff --git a/vendor/github.com/google/cel-go/common/types/overflow.go b/vendor/github.com/google/cel-go/common/types/overflow.go
index c68a921..dcb66ef 100644
--- a/vendor/github.com/google/cel-go/common/types/overflow.go
+++ b/vendor/github.com/google/cel-go/common/types/overflow.go
@@ -326,6 +326,26 @@ func int64ToUint64Checked(v int64) (uint64, error) {
 	return uint64(v), nil
 }
 
+// int64ToInt8Checked converts an int64 to an int8 value.
+//
+// If the conversion fails due to overflow the error return value will be non-nil.
+func int64ToInt8Checked(v int64) (int8, error) {
+	if v < math.MinInt8 || v > math.MaxInt8 {
+		return 0, errIntOverflow
+	}
+	return int8(v), nil
+}
+
+// int64ToInt16Checked converts an int64 to an int16 value.
+//
+// If the conversion fails due to overflow the error return value will be non-nil.
+func int64ToInt16Checked(v int64) (int16, error) {
+	if v < math.MinInt16 || v > math.MaxInt16 {
+		return 0, errIntOverflow
+	}
+	return int16(v), nil
+}
+
 // int64ToInt32Checked converts an int64 to an int32 value.
 //
 // If the conversion fails due to overflow the error return value will be non-nil.
@@ -336,6 +356,26 @@ func int64ToInt32Checked(v int64) (int32, error) {
 	return int32(v), nil
 }
 
+// uint64ToUint8Checked converts a uint64 to a uint8 value.
+//
+// If the conversion fails due to overflow the error return value will be non-nil.
+func uint64ToUint8Checked(v uint64) (uint8, error) {
+	if v > math.MaxUint8 {
+		return 0, errUintOverflow
+	}
+	return uint8(v), nil
+}
+
+// uint64ToUint16Checked converts a uint64 to a uint16 value.
+//
+// If the conversion fails due to overflow the error return value will be non-nil.
+func uint64ToUint16Checked(v uint64) (uint16, error) {
+	if v > math.MaxUint16 {
+		return 0, errUintOverflow
+	}
+	return uint16(v), nil
+}
+
 // uint64ToUint32Checked converts a uint64 to a uint32 value.
 //
 // If the conversion fails due to overflow the error return value will be non-nil.
diff --git a/vendor/github.com/google/cel-go/common/types/pb/BUILD.bazel b/vendor/github.com/google/cel-go/common/types/pb/BUILD.bazel
index f23ac9c..e2b9d37 100644
--- a/vendor/github.com/google/cel-go/common/types/pb/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/types/pb/BUILD.bazel
@@ -17,7 +17,7 @@ go_library(
     ],
     importpath = "github.com/google/cel-go/common/types/pb",
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//encoding/protowire:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
diff --git a/vendor/github.com/google/cel-go/common/types/pb/type.go b/vendor/github.com/google/cel-go/common/types/pb/type.go
index df95321..bdd474c 100644
--- a/vendor/github.com/google/cel-go/common/types/pb/type.go
+++ b/vendor/github.com/google/cel-go/common/types/pb/type.go
@@ -285,7 +285,7 @@ func (fd *FieldDescription) GetFrom(target any) (any, error) {
 
 // IsEnum returns true if the field type refers to an enum value.
 func (fd *FieldDescription) IsEnum() bool {
-	return fd.desc.Kind() == protoreflect.EnumKind
+	return fd.ProtoKind() == protoreflect.EnumKind
 }
 
 // IsMap returns true if the field is of map type.
@@ -295,7 +295,7 @@ func (fd *FieldDescription) IsMap() bool {
 
 // IsMessage returns true if the field is of message type.
 func (fd *FieldDescription) IsMessage() bool {
-	kind := fd.desc.Kind()
+	kind := fd.ProtoKind()
 	return kind == protoreflect.MessageKind || kind == protoreflect.GroupKind
 }
 
@@ -326,6 +326,11 @@ func (fd *FieldDescription) Name() string {
 	return string(fd.desc.Name())
 }
 
+// ProtoKind returns the protobuf reflected kind of the field.
+func (fd *FieldDescription) ProtoKind() protoreflect.Kind {
+	return fd.desc.Kind()
+}
+
 // ReflectType returns the Golang reflect.Type for this field.
 func (fd *FieldDescription) ReflectType() reflect.Type {
 	return fd.reflectType
@@ -345,17 +350,17 @@ func (fd *FieldDescription) Zero() proto.Message {
 }
 
 func (fd *FieldDescription) typeDefToType() *exprpb.Type {
-	if fd.desc.Kind() == protoreflect.MessageKind || fd.desc.Kind() == protoreflect.GroupKind {
+	if fd.IsMessage() {
 		msgType := string(fd.desc.Message().FullName())
 		if wk, found := CheckedWellKnowns[msgType]; found {
 			return wk
 		}
 		return checkedMessageType(msgType)
 	}
-	if fd.desc.Kind() == protoreflect.EnumKind {
+	if fd.IsEnum() {
 		return checkedInt
 	}
-	return CheckedPrimitives[fd.desc.Kind()]
+	return CheckedPrimitives[fd.ProtoKind()]
 }
 
 // Map wraps the protoreflect.Map object with a key and value FieldDescription for use in
@@ -422,22 +427,49 @@ func unwrap(desc description, msg proto.Message) (any, bool, error) {
 			return structpb.NullValue_NULL_VALUE, true, nil
 		}
 	case *wrapperspb.BoolValue:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	case *wrapperspb.BytesValue:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	case *wrapperspb.DoubleValue:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	case *wrapperspb.FloatValue:
+		if v == nil {
+			return nil, true, nil
+		}
 		return float64(v.GetValue()), true, nil
 	case *wrapperspb.Int32Value:
+		if v == nil {
+			return nil, true, nil
+		}
 		return int64(v.GetValue()), true, nil
 	case *wrapperspb.Int64Value:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	case *wrapperspb.StringValue:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	case *wrapperspb.UInt32Value:
+		if v == nil {
+			return nil, true, nil
+		}
 		return uint64(v.GetValue()), true, nil
 	case *wrapperspb.UInt64Value:
+		if v == nil {
+			return nil, true, nil
+		}
 		return v.GetValue(), true, nil
 	}
 	return msg, false, nil
@@ -463,13 +495,13 @@ func unwrapDynamic(desc description, refMsg protoreflect.Message) (any, bool, er
 		unwrappedAny := &anypb.Any{}
 		err := Merge(unwrappedAny, msg)
 		if err != nil {
-			return nil, false, err
+			return nil, false, fmt.Errorf("unwrap dynamic field failed: %v", err)
 		}
 		dynMsg, err := unwrappedAny.UnmarshalNew()
 		if err != nil {
 			// Allow the error to move further up the stack as it should result in an type
 			// conversion error if the caller does not recover it somehow.
-			return nil, false, err
+			return nil, false, fmt.Errorf("unmarshal dynamic any failed: %v", err)
 		}
 		// Attempt to unwrap the dynamic type, otherwise return the dynamic message.
 		unwrapped, nested, err := unwrapDynamic(desc, dynMsg.ProtoReflect())
@@ -560,8 +592,10 @@ func zeroValueOf(msg proto.Message) proto.Message {
 }
 
 var (
+	jsonValueTypeURL = "types.googleapis.com/google.protobuf.Value"
+
 	zeroValueMap = map[string]proto.Message{
-		"google.protobuf.Any":         &anypb.Any{},
+		"google.protobuf.Any":         &anypb.Any{TypeUrl: jsonValueTypeURL},
 		"google.protobuf.Duration":    &dpb.Duration{},
 		"google.protobuf.ListValue":   &structpb.ListValue{},
 		"google.protobuf.Struct":      &structpb.Struct{},
diff --git a/vendor/github.com/google/cel-go/common/types/provider.go b/vendor/github.com/google/cel-go/common/types/provider.go
index e66951f..936a4e2 100644
--- a/vendor/github.com/google/cel-go/common/types/provider.go
+++ b/vendor/github.com/google/cel-go/common/types/provider.go
@@ -33,17 +33,68 @@ import (
 	tpb "google.golang.org/protobuf/types/known/timestamppb"
 )
 
-type protoTypeRegistry struct {
-	revTypeMap map[string]ref.Type
+// Adapter converts native Go values of varying type and complexity to equivalent CEL values.
+type Adapter = ref.TypeAdapter
+
+// Provider specifies functions for creating new object instances and for resolving
+// enum values by name.
+type Provider interface {
+	// EnumValue returns the numeric value of the given enum value name.
+	EnumValue(enumName string) ref.Val
+
+	// FindIdent takes a qualified identifier name and returns a ref.Val if one exists.
+	FindIdent(identName string) (ref.Val, bool)
+
+	// FindStructType returns the Type give a qualified type name.
+	//
+	// For historical reasons, only struct types are expected to be returned through this
+	// method, and the type values are expected to be wrapped in a TypeType instance using
+	// TypeTypeWithParam(<structType>).
+	//
+	// Returns false if not found.
+	FindStructType(structType string) (*Type, bool)
+
+	// FindStructFieldNames returns thet field names associated with the type, if the type
+	// is found.
+	FindStructFieldNames(structType string) ([]string, bool)
+
+	// FieldStructFieldType returns the field type for a checked type value. Returns
+	// false if the field could not be found.
+	FindStructFieldType(structType, fieldName string) (*FieldType, bool)
+
+	// NewValue creates a new type value from a qualified name and map of field
+	// name to value.
+	//
+	// Note, for each value, the Val.ConvertToNative function will be invoked
+	// to convert the Val to the field's native type. If an error occurs during
+	// conversion, the NewValue will be a types.Err.
+	NewValue(structType string, fields map[string]ref.Val) ref.Val
+}
+
+// FieldType represents a field's type value and whether that field supports presence detection.
+type FieldType struct {
+	// Type of the field as a CEL native type value.
+	Type *Type
+
+	// IsSet indicates whether the field is set on an input object.
+	IsSet ref.FieldTester
+
+	// GetFrom retrieves the field value on the input object, if set.
+	GetFrom ref.FieldGetter
+}
+
+// Registry provides type information for a set of registered types.
+type Registry struct {
+	revTypeMap map[string]*Type
 	pbdb       *pb.Db
 }
 
 // NewRegistry accepts a list of proto message instances and returns a type
 // provider which can create new instances of the provided message or any
 // message that proto depends upon in its FileDescriptor.
-func NewRegistry(types ...proto.Message) (ref.TypeRegistry, error) {
-	p := &protoTypeRegistry{
-		revTypeMap: make(map[string]ref.Type),
+func NewRegistry(types ...proto.Message) (*Registry, error) {
+	p := &Registry{
+		revTypeMap: make(map[string]*Type),
 		pbdb:       pb.NewDb(),
 	}
 	err := p.RegisterType(
@@ -79,18 +130,17 @@ func NewRegistry(types ...proto.Message) (ref.TypeRegistry, error) {
 }
 
 // NewEmptyRegistry returns a registry which is completely unconfigured.
-func NewEmptyRegistry() ref.TypeRegistry {
-	return &protoTypeRegistry{
-		revTypeMap: make(map[string]ref.Type),
+func NewEmptyRegistry() *Registry {
+	return &Registry{
+		revTypeMap: make(map[string]*Type),
 		pbdb:       pb.NewDb(),
 	}
 }
 
-// Copy implements the ref.TypeRegistry interface method which copies the current state of the
-// registry into its own memory space.
-func (p *protoTypeRegistry) Copy() ref.TypeRegistry {
-	copy := &protoTypeRegistry{
-		revTypeMap: make(map[string]ref.Type),
+// Copy copies the current state of the registry into its own memory space.
+func (p *Registry) Copy() *Registry {
+	copy := &Registry{
+		revTypeMap: make(map[string]*Type),
 		pbdb:       p.pbdb.Copy(),
 	}
 	for k, v := range p.revTypeMap {
@@ -99,7 +149,8 @@ func (p *protoTypeRegistry) Copy() ref.TypeRegistry {
 	return copy
 }
 
-func (p *protoTypeRegistry) EnumValue(enumName string) ref.Val {
+// EnumValue returns the numeric value of the given enum value name.
+func (p *Registry) EnumValue(enumName string) ref.Val {
 	enumVal, found := p.pbdb.DescribeEnum(enumName)
 	if !found {
 		return NewErr("unknown enum name '%s'", enumName)
@@ -107,9 +158,12 @@ func (p *protoTypeRegistry) EnumValue(enumName string) ref.Val {
 	return Int(enumVal.Value())
 }
 
-func (p *protoTypeRegistry) FindFieldType(messageType string,
-	fieldName string) (*ref.FieldType, bool) {
-	msgType, found := p.pbdb.DescribeType(messageType)
+// FindFieldType returns the field type for a checked type value. Returns false if
+// the field could not be found.
+//
+// Deprecated: use FindStructFieldType
+func (p *Registry) FindFieldType(structType, fieldName string) (*ref.FieldType, bool) {
+	msgType, found := p.pbdb.DescribeType(structType)
 	if !found {
 		return nil, false
 	}
@@ -118,15 +172,49 @@ func (p *protoTypeRegistry) FindFieldType(messageType string,
 		return nil, false
 	}
 	return &ref.FieldType{
-			Type:    field.CheckedType(),
-			IsSet:   field.IsSet,
-			GetFrom: field.GetFrom},
-		true
+		Type:    field.CheckedType(),
+		IsSet:   field.IsSet,
+		GetFrom: field.GetFrom}, true
+}
+
+// FindStructFieldNames returns the set of field names for the given struct type,
+// if the type exists in the registry.
+func (p *Registry) FindStructFieldNames(structType string) ([]string, bool) {
+	msgType, found := p.pbdb.DescribeType(structType)
+	if !found {
+		return []string{}, false
+	}
+	fieldMap := msgType.FieldMap()
+	fields := make([]string, len(fieldMap))
+	idx := 0
+	for f := range fieldMap {
+		fields[idx] = f
+		idx++
+	}
+	return fields, true
 }
 
-func (p *protoTypeRegistry) FindIdent(identName string) (ref.Val, bool) {
+// FindStructFieldType returns the field type for a checked type value. Returns
+// false if the field could not be found.
+func (p *Registry) FindStructFieldType(structType, fieldName string) (*FieldType, bool) {
+	msgType, found := p.pbdb.DescribeType(structType)
+	if !found {
+		return nil, false
+	}
+	field, found := msgType.FieldByName(fieldName)
+	if !found {
+		return nil, false
+	}
+	return &FieldType{
+		Type:    fieldDescToCELType(field),
+		IsSet:   field.IsSet,
+		GetFrom: field.GetFrom}, true
+}
+
+// FindIdent takes a qualified identifier name and returns a ref.Val if one exists.
+func (p *Registry) FindIdent(identName string) (ref.Val, bool) {
 	if t, found := p.revTypeMap[identName]; found {
-		return t.(ref.Val), true
+		return t, true
 	}
 	if enumVal, found := p.pbdb.DescribeEnum(identName); found {
 		return Int(enumVal.Value()), true
@@ -134,24 +222,50 @@ func (p *protoTypeRegistry) FindIdent(identName string) (ref.Val, bool) {
 	return nil, false
 }
 
-func (p *protoTypeRegistry) FindType(typeName string) (*exprpb.Type, bool) {
-	if _, found := p.pbdb.DescribeType(typeName); !found {
+// FindType looks up the Type given a qualified typeName. Returns false if not found.
+//
+// Deprecated: use FindStructType
+func (p *Registry) FindType(structType string) (*exprpb.Type, bool) {
+	if _, found := p.pbdb.DescribeType(structType); !found {
 		return nil, false
 	}
-	if typeName != "" && typeName[0] == '.' {
-		typeName = typeName[1:]
+	if structType != "" && structType[0] == '.' {
+		structType = structType[1:]
 	}
 	return &exprpb.Type{
 		TypeKind: &exprpb.Type_Type{
 			Type: &exprpb.Type{
 				TypeKind: &exprpb.Type_MessageType{
-					MessageType: typeName}}}}, true
+					MessageType: structType}}}}, true
 }
 
-func (p *protoTypeRegistry) NewValue(typeName string, fields map[string]ref.Val) ref.Val {
-	td, found := p.pbdb.DescribeType(typeName)
+// FindStructType returns the Type give a qualified type name.
+//
+// For historical reasons, only struct types are expected to be returned through this
+// method, and the type values are expected to be wrapped in a TypeType instance using
+// TypeTypeWithParam(<structType>).
+//
+// Returns false if not found.
+func (p *Registry) FindStructType(structType string) (*Type, bool) {
+	if _, found := p.pbdb.DescribeType(structType); !found {
+		return nil, false
+	}
+	if structType != "" && structType[0] == '.' {
+		structType = structType[1:]
+	}
+	return NewTypeTypeWithParam(NewObjectType(structType)), true
+}
+
+// NewValue creates a new type value from a qualified name and map of field
+// name to value.
+//
+// Note, for each value, the Val.ConvertToNative function will be invoked
+// to convert the Val to the field's native type. If an error occurs during
+// conversion, the NewValue will be a types.Err.
+func (p *Registry) NewValue(structType string, fields map[string]ref.Val) ref.Val {
+	td, found := p.pbdb.DescribeType(structType)
 	if !found {
-		return NewErr("unknown type '%s'", typeName)
+		return NewErr("unknown type '%s'", structType)
 	}
 	msg := td.New()
 	fieldMap := td.FieldMap()
@@ -162,13 +276,14 @@ func (p *protoTypeRegistry) NewValue(typeName string, fields map[string]ref.Val)
 		}
 		err := msgSetField(msg, field, value)
 		if err != nil {
-			return &Err{err}
+			return &Err{error: err}
 		}
 	}
 	return p.NativeToValue(msg.Interface())
 }
 
-func (p *protoTypeRegistry) RegisterDescriptor(fileDesc protoreflect.FileDescriptor) error {
+// RegisterDescriptor registers the contents of a protocol buffer `FileDescriptor`.
+func (p *Registry) RegisterDescriptor(fileDesc protoreflect.FileDescriptor) error {
 	fd, err := p.pbdb.RegisterDescriptor(fileDesc)
 	if err != nil {
 		return err
@@ -176,7 +291,8 @@ func (p *protoTypeRegistry) RegisterDescriptor(fileDesc protoreflect.FileDescrip
 	return p.registerAllTypes(fd)
 }
 
-func (p *protoTypeRegistry) RegisterMessage(message proto.Message) error {
+// RegisterMessage registers a protocol buffer message and its dependencies.
+func (p *Registry) RegisterMessage(message proto.Message) error {
 	fd, err := p.pbdb.RegisterMessage(message)
 	if err != nil {
 		return err
@@ -184,11 +300,32 @@ func (p *protoTypeRegistry) RegisterMessage(message proto.Message) error {
 	return p.registerAllTypes(fd)
 }
 
-func (p *protoTypeRegistry) RegisterType(types ...ref.Type) error {
+// RegisterType registers a type value with the provider which ensures the provider is aware of how to
+// map the type to an identifier.
+//
+// If the `ref.Type` value is a `*types.Type` it will be registered directly by its runtime type name.
+// If the `ref.Type` value is not a `*types.Type` instance, a `*types.Type` instance which reflects the
+// traits present on the input and the runtime type name. By default this foreign type will be treated
+// as a types.StructKind. To avoid potential issues where the `ref.Type` values does not match the
+// generated `*types.Type` instance, consider always using the `*types.Type` to represent type extensions
+// to CEL, even when they're not based on protobuf types.
+func (p *Registry) RegisterType(types ...ref.Type) error {
 	for _, t := range types {
-		p.revTypeMap[t.TypeName()] = t
+		celType := maybeForeignType(t)
+		existing, found := p.revTypeMap[t.TypeName()]
+		if !found {
+			p.revTypeMap[t.TypeName()] = celType
+			continue
+		}
+		if !existing.IsEquivalentType(celType) {
+			return fmt.Errorf("type registration conflict. found: %v, input: %v", existing, celType)
+		}
+		if existing.traitMask != celType.traitMask {
+			return fmt.Errorf(
+				"type registered with conflicting traits: %v with traits %v, input: %v",
+				existing.TypeName(), existing.traitMask, celType.traitMask)
+		}
 	}
-	// TODO: generate an error when the type name is registered more than once.
 	return nil
 }
 
@@ -196,7 +333,7 @@ func (p *protoTypeRegistry) RegisterType(types ...ref.Type) error {
 // providing support for custom proto-based types.
 //
 // This method should be the inverse of ref.Val.ConvertToNative.
-func (p *protoTypeRegistry) NativeToValue(value any) ref.Val {
+func (p *Registry) NativeToValue(value any) ref.Val {
 	if val, found := nativeToValue(p, value); found {
 		return val
 	}
@@ -218,7 +355,7 @@ func (p *protoTypeRegistry) NativeToValue(value any) ref.Val {
 		if !found {
 			return NewErr("unknown type: '%s'", typeName)
 		}
-		return NewObject(p, td, typeVal.(*TypeValue), v)
+		return NewObject(p, td, typeVal, v)
 	case *pb.Map:
 		return NewProtoMap(p, v)
 	case protoreflect.List:
@@ -231,8 +368,13 @@ func (p *protoTypeRegistry) NativeToValue(value any) ref.Val {
 	return UnsupportedRefValConversionErr(value)
 }
 
-func (p *protoTypeRegistry) registerAllTypes(fd *pb.FileDescription) error {
+func (p *Registry) registerAllTypes(fd *pb.FileDescription) error {
 	for _, typeName := range fd.GetTypeNames() {
+		// skip well-known type names since they're automatically sanitized
+		// during NewObjectType() calls.
+		if _, found := checkedWellKnowns[typeName]; found {
+			continue
+		}
 		err := p.RegisterType(NewObjectTypeValue(typeName))
 		if err != nil {
 			return err
@@ -241,6 +383,28 @@ func (p *protoTypeRegistry) registerAllTypes(fd *pb.FileDescription) error {
 	return nil
 }
 
+func fieldDescToCELType(field *pb.FieldDescription) *Type {
+	if field.IsMap() {
+		return NewMapType(
+			singularFieldDescToCELType(field.KeyType),
+			singularFieldDescToCELType(field.ValueType))
+	}
+	if field.IsList() {
+		return NewListType(singularFieldDescToCELType(field))
+	}
+	return singularFieldDescToCELType(field)
+}
+
+func singularFieldDescToCELType(field *pb.FieldDescription) *Type {
+	if field.IsMessage() {
+		return NewObjectType(string(field.Descriptor().Message().FullName()))
+	}
+	if field.IsEnum() {
+		return IntType
+	}
+	return ProtoCELPrimitives[field.ProtoKind()]
+}
+
 // defaultTypeAdapter converts go native types to CEL values.
 type defaultTypeAdapter struct{}
 
@@ -259,7 +423,7 @@ func (a *defaultTypeAdapter) NativeToValue(value any) ref.Val {
 
 // nativeToValue returns the converted (ref.Val, true) of a conversion is found,
 // otherwise (nil, false)
-func nativeToValue(a ref.TypeAdapter, value any) (ref.Val, bool) {
+func nativeToValue(a Adapter, value any) (ref.Val, bool) {
 	switch v := value.(type) {
 	case nil:
 		return NullValue, true
@@ -421,17 +585,46 @@ func nativeToValue(a ref.TypeAdapter, value any) (ref.Val, bool) {
 		refKind := refValue.Kind()
 		switch refKind {
 		case reflect.Array, reflect.Slice:
+			if refValue.Type().Elem() == reflect.TypeOf(byte(0)) {
+				if refValue.CanAddr() {
+					return Bytes(refValue.Bytes()), true
+				}
+				tmp := reflect.New(refValue.Type())
+				tmp.Elem().Set(refValue)
+				return Bytes(tmp.Elem().Bytes()), true
+			}
 			return NewDynamicList(a, v), true
 		case reflect.Map:
 			return NewDynamicMap(a, v), true
 		// type aliases of primitive types cannot be asserted as that type, but rather need
 		// to be downcast to int32 before being converted to a CEL representation.
+		case reflect.Bool:
+			boolTupe := reflect.TypeOf(false)
+			return Bool(refValue.Convert(boolTupe).Interface().(bool)), true
+		case reflect.Int:
+			intType := reflect.TypeOf(int(0))
+			return Int(refValue.Convert(intType).Interface().(int)), true
+		case reflect.Int8:
+			intType := reflect.TypeOf(int8(0))
+			return Int(refValue.Convert(intType).Interface().(int8)), true
+		case reflect.Int16:
+			intType := reflect.TypeOf(int16(0))
+			return Int(refValue.Convert(intType).Interface().(int16)), true
 		case reflect.Int32:
 			intType := reflect.TypeOf(int32(0))
 			return Int(refValue.Convert(intType).Interface().(int32)), true
 		case reflect.Int64:
 			intType := reflect.TypeOf(int64(0))
 			return Int(refValue.Convert(intType).Interface().(int64)), true
+		case reflect.Uint:
+			uintType := reflect.TypeOf(uint(0))
+			return Uint(refValue.Convert(uintType).Interface().(uint)), true
+		case reflect.Uint8:
+			uintType := reflect.TypeOf(uint8(0))
+			return Uint(refValue.Convert(uintType).Interface().(uint8)), true
+		case reflect.Uint16:
+			uintType := reflect.TypeOf(uint16(0))
+			return Uint(refValue.Convert(uintType).Interface().(uint16)), true
 		case reflect.Uint32:
 			uintType := reflect.TypeOf(uint32(0))
 			return Uint(refValue.Convert(uintType).Interface().(uint32)), true
@@ -444,6 +637,9 @@ func nativeToValue(a ref.TypeAdapter, value any) (ref.Val, bool) {
 		case reflect.Float64:
 			doubleType := reflect.TypeOf(float64(0))
 			return Double(refValue.Convert(doubleType).Interface().(float64)), true
+		case reflect.String:
+			stringType := reflect.TypeOf("")
+			return String(refValue.Convert(stringType).Interface().(string)), true
 		}
 	}
 	return nil, false
@@ -547,3 +743,24 @@ func fieldTypeConversionError(field *pb.FieldDescription, err error) error {
 	msgName := field.Descriptor().ContainingMessage().FullName()
 	return fmt.Errorf("field type conversion error for %v.%v value type: %v", msgName, field.Name(), err)
 }
+
+var (
+	// ProtoCELPrimitives provides a map from the protoreflect Kind to the equivalent CEL type.
+	ProtoCELPrimitives = map[protoreflect.Kind]*Type{
+		protoreflect.BoolKind:     BoolType,
+		protoreflect.BytesKind:    BytesType,
+		protoreflect.DoubleKind:   DoubleType,
+		protoreflect.FloatKind:    DoubleType,
+		protoreflect.Int32Kind:    IntType,
+		protoreflect.Int64Kind:    IntType,
+		protoreflect.Sint32Kind:   IntType,
+		protoreflect.Sint64Kind:   IntType,
+		protoreflect.Uint32Kind:   UintType,
+		protoreflect.Uint64Kind:   UintType,
+		protoreflect.Fixed32Kind:  UintType,
+		protoreflect.Fixed64Kind:  UintType,
+		protoreflect.Sfixed32Kind: IntType,
+		protoreflect.Sfixed64Kind: IntType,
+		protoreflect.StringKind:   StringType,
+	}
+)
diff --git a/vendor/github.com/google/cel-go/common/types/ref/BUILD.bazel b/vendor/github.com/google/cel-go/common/types/ref/BUILD.bazel
index 1d0f468..79330c3 100644
--- a/vendor/github.com/google/cel-go/common/types/ref/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/common/types/ref/BUILD.bazel
@@ -13,7 +13,7 @@ go_library(
     ],
     importpath = "github.com/google/cel-go/common/types/ref",
     deps = [
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
     ],
diff --git a/vendor/github.com/google/cel-go/common/types/ref/provider.go b/vendor/github.com/google/cel-go/common/types/ref/provider.go
index 7eabbb9..b982002 100644
--- a/vendor/github.com/google/cel-go/common/types/ref/provider.go
+++ b/vendor/github.com/google/cel-go/common/types/ref/provider.go
@@ -23,34 +23,34 @@ import (
 
 // TypeProvider specifies functions for creating new object instances and for
 // resolving enum values by name.
+//
+// Deprecated: use types.Provider
 type TypeProvider interface {
 	// EnumValue returns the numeric value of the given enum value name.
 	EnumValue(enumName string) Val
 
-	// FindIdent takes a qualified identifier name and returns a Value if one
-	// exists.
+	// FindIdent takes a qualified identifier name and returns a Value if one exists.
 	FindIdent(identName string) (Val, bool)
 
-	// FindType looks up the Type given a qualified typeName. Returns false
-	// if not found.
-	//
-	// Used during type-checking only.
+	// FindType looks up the Type given a qualified typeName. Returns false if not found.
 	FindType(typeName string) (*exprpb.Type, bool)
 
-	// FieldFieldType returns the field type for a checked type value. Returns
-	// false if the field could not be found.
-	FindFieldType(messageType string, fieldName string) (*FieldType, bool)
+	// FieldFieldType returns the field type for a checked type value. Returns false if
+	// the field could not be found.
+	FindFieldType(messageType, fieldName string) (*FieldType, bool)
 
-	// NewValue creates a new type value from a qualified name and map of field
-	// name to value.
+	// NewValue creates a new type value from a qualified name and map of field name
+	// to value.
 	//
-	// Note, for each value, the Val.ConvertToNative function will be invoked
-	// to convert the Val to the field's native type. If an error occurs during
-	// conversion, the NewValue will be a types.Err.
+	// Note, for each value, the Val.ConvertToNative function will be invoked to convert
+	// the Val to the field's native type. If an error occurs during conversion, the
+	// NewValue will be a types.Err.
 	NewValue(typeName string, fields map[string]Val) Val
 }
 
 // TypeAdapter converts native Go values of varying type and complexity to equivalent CEL values.
+//
+// Deprecated: use types.Adapter
 type TypeAdapter interface {
 	// NativeToValue converts the input `value` to a CEL `ref.Val`.
 	NativeToValue(value any) Val
@@ -60,6 +60,8 @@ type TypeAdapter interface {
 // implementations support type-customization, so these features are optional. However, a
 // `TypeRegistry` should be a `TypeProvider` and a `TypeAdapter` to ensure that types
 // which are registered can be converted to CEL representations.
+//
+// Deprecated: use types.Registry
 type TypeRegistry interface {
 	TypeAdapter
 	TypeProvider
@@ -76,15 +78,14 @@ type TypeRegistry interface {
 	// If a type is provided more than once with an alternative definition, the
 	// call will result in an error.
 	RegisterType(types ...Type) error
-
-	// Copy the TypeRegistry and return a new registry whose mutable state is isolated.
-	Copy() TypeRegistry
 }
 
 // FieldType represents a field's type value and whether that field supports
 // presence detection.
+//
+// Deprecated: use types.FieldType
 type FieldType struct {
-	// Type of the field.
+	// Type of the field as a protobuf type value.
 	Type *exprpb.Type
 
 	// IsSet indicates whether the field is set on an input object.
diff --git a/vendor/github.com/google/cel-go/common/types/string.go b/vendor/github.com/google/cel-go/common/types/string.go
index a65cc14..3a93743 100644
--- a/vendor/github.com/google/cel-go/common/types/string.go
+++ b/vendor/github.com/google/cel-go/common/types/string.go
@@ -24,7 +24,6 @@ import (
 
 	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -36,18 +35,10 @@ import (
 type String string
 
 var (
-	// StringType singleton.
-	StringType = NewTypeValue("string",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.MatcherType,
-		traits.ReceiverType,
-		traits.SizerType)
-
-	stringOneArgOverloads = map[string]func(String, ref.Val) ref.Val{
-		overloads.Contains:   stringContains,
-		overloads.EndsWith:   stringEndsWith,
-		overloads.StartsWith: stringStartsWith,
+	stringOneArgOverloads = map[string]func(ref.Val, ref.Val) ref.Val{
+		overloads.Contains:   StringContains,
+		overloads.EndsWith:   StringEndsWith,
+		overloads.StartsWith: StringStartsWith,
 	}
 
 	stringWrapperType = reflect.TypeOf(&wrapperspb.StringValue{})
@@ -75,10 +66,7 @@ func (s String) Compare(other ref.Val) ref.Val {
 func (s String) ConvertToNative(typeDesc reflect.Type) (any, error) {
 	switch typeDesc.Kind() {
 	case reflect.String:
-		if reflect.TypeOf(s).AssignableTo(typeDesc) {
-			return s, nil
-		}
-		return s.Value(), nil
+		return reflect.ValueOf(s).Convert(typeDesc).Interface(), nil
 	case reflect.Ptr:
 		switch typeDesc {
 		case anyValueType:
@@ -167,7 +155,7 @@ func (s String) Match(pattern ref.Val) ref.Val {
 	}
 	matched, err := regexp.MatchString(pat.Value().(string), s.Value().(string))
 	if err != nil {
-		return &Err{err}
+		return &Err{error: err}
 	}
 	return Bool(matched)
 }
@@ -198,26 +186,41 @@ func (s String) Value() any {
 	return string(s)
 }
 
-func stringContains(s String, sub ref.Val) ref.Val {
+// StringContains returns whether the string contains a substring.
+func StringContains(s, sub ref.Val) ref.Val {
+	str, ok := s.(String)
+	if !ok {
+		return MaybeNoSuchOverloadErr(s)
+	}
 	subStr, ok := sub.(String)
 	if !ok {
 		return MaybeNoSuchOverloadErr(sub)
 	}
-	return Bool(strings.Contains(string(s), string(subStr)))
+	return Bool(strings.Contains(string(str), string(subStr)))
 }
 
-func stringEndsWith(s String, suf ref.Val) ref.Val {
+// StringEndsWith returns whether the target string contains the input suffix.
+func StringEndsWith(s, suf ref.Val) ref.Val {
+	str, ok := s.(String)
+	if !ok {
+		return MaybeNoSuchOverloadErr(s)
+	}
 	sufStr, ok := suf.(String)
 	if !ok {
 		return MaybeNoSuchOverloadErr(suf)
 	}
-	return Bool(strings.HasSuffix(string(s), string(sufStr)))
+	return Bool(strings.HasSuffix(string(str), string(sufStr)))
 }
 
-func stringStartsWith(s String, pre ref.Val) ref.Val {
+// StringStartsWith returns whether the target string contains the input prefix.
+func StringStartsWith(s, pre ref.Val) ref.Val {
+	str, ok := s.(String)
+	if !ok {
+		return MaybeNoSuchOverloadErr(s)
+	}
 	preStr, ok := pre.(String)
 	if !ok {
 		return MaybeNoSuchOverloadErr(pre)
 	}
-	return Bool(strings.HasPrefix(string(s), string(preStr)))
+	return Bool(strings.HasPrefix(string(str), string(preStr)))
 }
diff --git a/vendor/github.com/google/cel-go/common/types/timestamp.go b/vendor/github.com/google/cel-go/common/types/timestamp.go
index c784f2e..33acdea 100644
--- a/vendor/github.com/google/cel-go/common/types/timestamp.go
+++ b/vendor/github.com/google/cel-go/common/types/timestamp.go
@@ -23,7 +23,6 @@ import (
 
 	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -53,15 +52,6 @@ const (
 	maxUnixTime int64 = 253402300799
 )
 
-var (
-	// TimestampType singleton.
-	TimestampType = NewTypeValue("google.protobuf.Timestamp",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.ReceiverType,
-		traits.SubtractorType)
-)
-
 // Add implements traits.Adder.Add.
 func (t Timestamp) Add(other ref.Val) ref.Val {
 	switch other.Type() {
diff --git a/vendor/github.com/google/cel-go/common/types/traits/iterator.go b/vendor/github.com/google/cel-go/common/types/traits/iterator.go
index 42dd371..91c10f0 100644
--- a/vendor/github.com/google/cel-go/common/types/traits/iterator.go
+++ b/vendor/github.com/google/cel-go/common/types/traits/iterator.go
@@ -34,3 +34,16 @@ type Iterator interface {
 	// Next returns the next element.
 	Next() ref.Val
 }
+
+// Foldable aggregate types support iteration over (key, value) or (index, value) pairs.
+type Foldable interface {
+	// Fold invokes the Folder.FoldEntry for all entries in the type
+	Fold(Folder)
+}
+
+// Folder performs a fold on a given entry and indicates whether to continue folding.
+type Folder interface {
+	// FoldEntry indicates the key, value pair associated with the entry.
+	// If the output is true, continue folding. Otherwise, terminate the fold.
+	FoldEntry(key, val any) bool
+}
diff --git a/vendor/github.com/google/cel-go/common/types/traits/lister.go b/vendor/github.com/google/cel-go/common/types/traits/lister.go
index 5cf2593..e54781a 100644
--- a/vendor/github.com/google/cel-go/common/types/traits/lister.go
+++ b/vendor/github.com/google/cel-go/common/types/traits/lister.go
@@ -27,6 +27,9 @@ type Lister interface {
 }
 
 // MutableLister interface which emits an immutable result after an intermediate computation.
+//
+// Note, this interface is intended only to be used within Comprehensions where the mutable
+// value is not directly observable within the user-authored CEL expression.
 type MutableLister interface {
 	Lister
 	ToImmutableList() Lister
diff --git a/vendor/github.com/google/cel-go/common/types/traits/mapper.go b/vendor/github.com/google/cel-go/common/types/traits/mapper.go
index 2f7c919..d13333f 100644
--- a/vendor/github.com/google/cel-go/common/types/traits/mapper.go
+++ b/vendor/github.com/google/cel-go/common/types/traits/mapper.go
@@ -31,3 +31,18 @@ type Mapper interface {
 	// (Unknown|Err, false).
 	Find(key ref.Val) (ref.Val, bool)
 }
+
+// MutableMapper interface which emits an immutable result after an intermediate computation.
+//
+// Note, this interface is intended only to be used within Comprehensions where the mutable
+// value is not directly observable within the user-authored CEL expression.
+type MutableMapper interface {
+	Mapper
+
+	// Insert a key, value pair into the map, returning the map if the insert is successful
+	// and an error if key already exists in the mutable map.
+	Insert(k, v ref.Val) ref.Val
+
+	// ToImmutableMap converts a mutable map into an immutable map.
+	ToImmutableMap() Mapper
+}
diff --git a/vendor/github.com/google/cel-go/common/types/traits/traits.go b/vendor/github.com/google/cel-go/common/types/traits/traits.go
index 6da3e6a..51a09df 100644
--- a/vendor/github.com/google/cel-go/common/types/traits/traits.go
+++ b/vendor/github.com/google/cel-go/common/types/traits/traits.go
@@ -59,6 +59,21 @@ const (
 	// SizerType types support the size() method.
 	SizerType
 
-	// SubtractorType type support '-' operations.
+	// SubtractorType types support '-' operations.
 	SubtractorType
+
+	// FoldableType types support comprehensions v2 macros which iterate over (key, value) pairs.
+	FoldableType
+)
+
+const (
+	// ListerType supports a set of traits necessary for list operations.
+	//
+	// The ListerType is syntactic sugar and not intended to be a perfect reflection of all List operators.
+	ListerType = AdderType | ContainerType | IndexerType | IterableType | SizerType
+
+	// MapperType supports a set of traits necessary for map operations.
+	//
+	// The MapperType is syntactic sugar and not intended to be a perfect reflection of all Map operators.
+	MapperType = ContainerType | IndexerType | IterableType | SizerType
 )
diff --git a/vendor/github.com/google/cel-go/common/types/type.go b/vendor/github.com/google/cel-go/common/types/type.go
deleted file mode 100644
index 164a460..0000000
--- a/vendor/github.com/google/cel-go/common/types/type.go
+++ /dev/null
@@ -1,102 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package types
-
-import (
-	"fmt"
-	"reflect"
-
-	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
-)
-
-var (
-	// TypeType is the type of a TypeValue.
-	TypeType = NewTypeValue("type")
-)
-
-// TypeValue is an instance of a Value that describes a value's type.
-type TypeValue struct {
-	name      string
-	traitMask int
-}
-
-// NewTypeValue returns *TypeValue which is both a ref.Type and ref.Val.
-func NewTypeValue(name string, traits ...int) *TypeValue {
-	traitMask := 0
-	for _, trait := range traits {
-		traitMask |= trait
-	}
-	return &TypeValue{
-		name:      name,
-		traitMask: traitMask}
-}
-
-// NewObjectTypeValue returns a *TypeValue based on the input name, which is
-// annotated with the traits relevant to all objects.
-func NewObjectTypeValue(name string) *TypeValue {
-	return NewTypeValue(name,
-		traits.FieldTesterType,
-		traits.IndexerType)
-}
-
-// ConvertToNative implements ref.Val.ConvertToNative.
-func (t *TypeValue) ConvertToNative(typeDesc reflect.Type) (any, error) {
-	// TODO: replace the internal type representation with a proto-value.
-	return nil, fmt.Errorf("type conversion not supported for 'type'")
-}
-
-// ConvertToType implements ref.Val.ConvertToType.
-func (t *TypeValue) ConvertToType(typeVal ref.Type) ref.Val {
-	switch typeVal {
-	case TypeType:
-		return TypeType
-	case StringType:
-		return String(t.TypeName())
-	}
-	return NewErr("type conversion error from '%s' to '%s'", TypeType, typeVal)
-}
-
-// Equal implements ref.Val.Equal.
-func (t *TypeValue) Equal(other ref.Val) ref.Val {
-	otherType, ok := other.(ref.Type)
-	return Bool(ok && t.TypeName() == otherType.TypeName())
-}
-
-// HasTrait indicates whether the type supports the given trait.
-// Trait codes are defined in the traits package, e.g. see traits.AdderType.
-func (t *TypeValue) HasTrait(trait int) bool {
-	return trait&t.traitMask == trait
-}
-
-// String implements fmt.Stringer.
-func (t *TypeValue) String() string {
-	return t.name
-}
-
-// Type implements ref.Val.Type.
-func (t *TypeValue) Type() ref.Type {
-	return TypeType
-}
-
-// TypeName gives the type's name as a string.
-func (t *TypeValue) TypeName() string {
-	return t.name
-}
-
-// Value implements ref.Val.Value.
-func (t *TypeValue) Value() any {
-	return t.name
-}
diff --git a/vendor/github.com/google/cel-go/common/types/types.go b/vendor/github.com/google/cel-go/common/types/types.go
new file mode 100644
index 0000000..1c5b6c4
--- /dev/null
+++ b/vendor/github.com/google/cel-go/common/types/types.go
@@ -0,0 +1,864 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package types
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"google.golang.org/protobuf/proto"
+
+	chkdecls "github.com/google/cel-go/checker/decls"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+
+	celpb "cel.dev/expr"
+	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+)
+
+// Kind indicates a CEL type's kind which is used to differentiate quickly between simple
+// and complex types.
+type Kind uint
+
+const (
+	// UnspecifiedKind is returned when the type is nil or its kind is not specified.
+	UnspecifiedKind Kind = iota
+
+	// DynKind represents a dynamic type. This kind only exists at type-check time.
+	DynKind
+
+	// AnyKind represents a google.protobuf.Any type. This kind only exists at type-check time.
+	// Prefer DynKind to AnyKind as AnyKind has a specific meaning which is based on protobuf
+	// well-known types.
+	AnyKind
+
+	// BoolKind represents a boolean type.
+	BoolKind
+
+	// BytesKind represents a bytes type.
+	BytesKind
+
+	// DoubleKind represents a double type.
+	DoubleKind
+
+	// DurationKind represents a CEL duration type.
+	DurationKind
+
+	// ErrorKind represents a CEL error type.
+	ErrorKind
+
+	// IntKind represents an integer type.
+	IntKind
+
+	// ListKind represents a list type.
+	ListKind
+
+	// MapKind represents a map type.
+	MapKind
+
+	// NullTypeKind represents a null type.
+	NullTypeKind
+
+	// OpaqueKind represents an abstract type which has no accessible fields.
+	OpaqueKind
+
+	// StringKind represents a string type.
+	StringKind
+
+	// StructKind represents a structured object with typed fields.
+	StructKind
+
+	// TimestampKind represents a a CEL time type.
+	TimestampKind
+
+	// TypeKind represents the CEL type.
+	TypeKind
+
+	// TypeParamKind represents a parameterized type whose type name will be resolved at type-check time, if possible.
+	TypeParamKind
+
+	// UintKind represents a uint type.
+	UintKind
+
+	// UnknownKind represents an unknown value type.
+	UnknownKind
+)
+
+var (
+	// AnyType represents the google.protobuf.Any type.
+	AnyType = &Type{
+		kind:            AnyKind,
+		runtimeTypeName: "google.protobuf.Any",
+		traitMask: traits.FieldTesterType |
+			traits.IndexerType,
+	}
+	// BoolType represents the bool type.
+	BoolType = &Type{
+		kind:            BoolKind,
+		runtimeTypeName: "bool",
+		traitMask: traits.ComparerType |
+			traits.NegatorType,
+	}
+	// BytesType represents the bytes type.
+	BytesType = &Type{
+		kind:            BytesKind,
+		runtimeTypeName: "bytes",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.SizerType,
+	}
+	// DoubleType represents the double type.
+	DoubleType = &Type{
+		kind:            DoubleKind,
+		runtimeTypeName: "double",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.DividerType |
+			traits.MultiplierType |
+			traits.NegatorType |
+			traits.SubtractorType,
+	}
+	// DurationType represents the CEL duration type.
+	DurationType = &Type{
+		kind:            DurationKind,
+		runtimeTypeName: "google.protobuf.Duration",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.NegatorType |
+			traits.ReceiverType |
+			traits.SubtractorType,
+	}
+	// DynType represents a dynamic CEL type whose type will be determined at runtime from context.
+	DynType = &Type{
+		kind:            DynKind,
+		runtimeTypeName: "dyn",
+	}
+	// ErrorType represents a CEL error value.
+	ErrorType = &Type{
+		kind:            ErrorKind,
+		runtimeTypeName: "error",
+	}
+	// IntType represents the int type.
+	IntType = &Type{
+		kind:            IntKind,
+		runtimeTypeName: "int",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.DividerType |
+			traits.ModderType |
+			traits.MultiplierType |
+			traits.NegatorType |
+			traits.SubtractorType,
+	}
+	// ListType represents the runtime list type.
+	ListType = NewListType(nil)
+	// MapType represents the runtime map type.
+	MapType = NewMapType(nil, nil)
+	// NullType represents the type of a null value.
+	NullType = &Type{
+		kind:            NullTypeKind,
+		runtimeTypeName: "null_type",
+	}
+	// StringType represents the string type.
+	StringType = &Type{
+		kind:            StringKind,
+		runtimeTypeName: "string",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.MatcherType |
+			traits.ReceiverType |
+			traits.SizerType,
+	}
+	// TimestampType represents the time type.
+	TimestampType = &Type{
+		kind:            TimestampKind,
+		runtimeTypeName: "google.protobuf.Timestamp",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.ReceiverType |
+			traits.SubtractorType,
+	}
+	// TypeType represents a CEL type
+	TypeType = &Type{
+		kind:            TypeKind,
+		runtimeTypeName: "type",
+	}
+	// UintType represents a uint type.
+	UintType = &Type{
+		kind:            UintKind,
+		runtimeTypeName: "uint",
+		traitMask: traits.AdderType |
+			traits.ComparerType |
+			traits.DividerType |
+			traits.ModderType |
+			traits.MultiplierType |
+			traits.SubtractorType,
+	}
+	// UnknownType represents an unknown value type.
+	UnknownType = &Type{
+		kind:            UnknownKind,
+		runtimeTypeName: "unknown",
+	}
+)
+
+var _ ref.Type = &Type{}
+var _ ref.Val = &Type{}
+
+// Type holds a reference to a runtime type with an optional type-checked set of type parameters.
+type Type struct {
+	// kind indicates general category of the type.
+	kind Kind
+
+	// parameters holds the optional type-checked set of type Parameters that are used during static analysis.
+	parameters []*Type
+
+	// runtimeTypeName indicates the runtime type name of the type.
+	runtimeTypeName string
+
+	// isAssignableType function determines whether one type is assignable to this type.
+	// A nil value for the isAssignableType function falls back to equality of kind, runtimeType, and parameters.
+	isAssignableType func(other *Type) bool
+
+	// isAssignableRuntimeType function determines whether the runtime type (with erasure) is assignable to this type.
+	// A nil value for the isAssignableRuntimeType function falls back to the equality of the type or type name.
+	isAssignableRuntimeType func(other ref.Val) bool
+
+	// traitMask is a mask of flags which indicate the capabilities of the type.
+	traitMask int
+}
+
+// ConvertToNative implements ref.Val.ConvertToNative.
+func (t *Type) ConvertToNative(typeDesc reflect.Type) (any, error) {
+	return nil, fmt.Errorf("type conversion not supported for 'type'")
+}
+
+// ConvertToType implements ref.Val.ConvertToType.
+func (t *Type) ConvertToType(typeVal ref.Type) ref.Val {
+	switch typeVal {
+	case TypeType:
+		return TypeType
+	case StringType:
+		return String(t.TypeName())
+	}
+	return NewErr("type conversion error from '%s' to '%s'", TypeType, typeVal)
+}
+
+// Equal indicates whether two types have the same runtime type name.
+//
+// The name Equal is a bit of a misnomer, but for historical reasons, this is the
+// runtime behavior. For a more accurate definition see IsType().
+func (t *Type) Equal(other ref.Val) ref.Val {
+	otherType, ok := other.(ref.Type)
+	return Bool(ok && t.TypeName() == otherType.TypeName())
+}
+
+// HasTrait implements the ref.Type interface method.
+func (t *Type) HasTrait(trait int) bool {
+	return trait&t.traitMask == trait
+}
+
+// IsExactType indicates whether the two types are exactly the same. This check also verifies type parameter type names.
+func (t *Type) IsExactType(other *Type) bool {
+	return t.isTypeInternal(other, true)
+}
+
+// IsEquivalentType indicates whether two types are equivalent. This check ignores type parameter type names.
+func (t *Type) IsEquivalentType(other *Type) bool {
+	return t.isTypeInternal(other, false)
+}
+
+// Kind indicates general category of the type.
+func (t *Type) Kind() Kind {
+	if t == nil {
+		return UnspecifiedKind
+	}
+	return t.kind
+}
+
+// isTypeInternal checks whether the two types are equivalent or exactly the same based on the checkTypeParamName flag.
+func (t *Type) isTypeInternal(other *Type, checkTypeParamName bool) bool {
+	if t == nil {
+		return false
+	}
+	if t == other {
+		return true
+	}
+	if t.Kind() != other.Kind() || len(t.Parameters()) != len(other.Parameters()) {
+		return false
+	}
+	if (checkTypeParamName || t.Kind() != TypeParamKind) && t.TypeName() != other.TypeName() {
+		return false
+	}
+	for i, p := range t.Parameters() {
+		if !p.isTypeInternal(other.Parameters()[i], checkTypeParamName) {
+			return false
+		}
+	}
+	return true
+}
+
+// IsAssignableType determines whether the current type is type-check assignable from the input fromType.
+func (t *Type) IsAssignableType(fromType *Type) bool {
+	if t == nil {
+		return false
+	}
+	if t.isAssignableType != nil {
+		return t.isAssignableType(fromType)
+	}
+	return t.defaultIsAssignableType(fromType)
+}
+
+// IsAssignableRuntimeType determines whether the current type is runtime assignable from the input runtimeType.
+//
+// At runtime, parameterized types are erased and so a function which type-checks to support a map(string, string)
+// will have a runtime assignable type of a map.
+func (t *Type) IsAssignableRuntimeType(val ref.Val) bool {
+	if t == nil {
+		return false
+	}
+	if t.isAssignableRuntimeType != nil {
+		return t.isAssignableRuntimeType(val)
+	}
+	return t.defaultIsAssignableRuntimeType(val)
+}
+
+// Parameters returns the list of type parameters if set.
+//
+// For ListKind, Parameters()[0] represents the list element type
+// For MapKind, Parameters()[0] represents the map key type, and Parameters()[1] represents the map
+// value type.
+func (t *Type) Parameters() []*Type {
+	if t == nil {
+		return emptyParams
+	}
+	return t.parameters
+}
+
+// DeclaredTypeName indicates the fully qualified and parameterized type-check type name.
+func (t *Type) DeclaredTypeName() string {
+	// if the type itself is neither null, nor dyn, but is assignable to null, then it's a wrapper type.
+	if t.Kind() != NullTypeKind && !t.isDyn() && t.IsAssignableType(NullType) {
+		return fmt.Sprintf("wrapper(%s)", t.TypeName())
+	}
+	return t.TypeName()
+}
+
+// Type implements the ref.Val interface method.
+func (t *Type) Type() ref.Type {
+	return TypeType
+}
+
+// Value implements the ref.Val interface method.
+func (t *Type) Value() any {
+	return t.TypeName()
+}
+
+// TypeName returns the type-erased fully qualified runtime type name.
+//
+// TypeName implements the ref.Type interface method.
+func (t *Type) TypeName() string {
+	if t == nil {
+		return ""
+	}
+	return t.runtimeTypeName
+}
+
+// WithTraits creates a copy of the current Type and sets the trait mask to the traits parameter.
+//
+// This method should be used with Opaque types where the type acts like a container, e.g. vector.
+func (t *Type) WithTraits(traits int) *Type {
+	if t == nil {
+		return nil
+	}
+	return &Type{
+		kind:                    t.kind,
+		parameters:              t.parameters,
+		runtimeTypeName:         t.runtimeTypeName,
+		isAssignableType:        t.isAssignableType,
+		isAssignableRuntimeType: t.isAssignableRuntimeType,
+		traitMask:               traits,
+	}
+}
+
+// String returns a human-readable definition of the type name.
+func (t *Type) String() string {
+	if len(t.Parameters()) == 0 {
+		return t.DeclaredTypeName()
+	}
+	params := make([]string, len(t.Parameters()))
+	for i, p := range t.Parameters() {
+		params[i] = p.String()
+	}
+	return fmt.Sprintf("%s(%s)", t.DeclaredTypeName(), strings.Join(params, ", "))
+}
+
+// isDyn indicates whether the type is dynamic in any way.
+func (t *Type) isDyn() bool {
+	k := t.Kind()
+	return k == DynKind || k == AnyKind || k == TypeParamKind
+}
+
+// defaultIsAssignableType provides the standard definition of what it means for one type to be assignable to another
+// where any of the following may return a true result:
+// - The from types are the same instance
+// - The target type is dynamic
+// - The fromType has the same kind and type name as the target type, and all parameters of the target type
+//
+//	are IsAssignableType() from the parameters of the fromType.
+func (t *Type) defaultIsAssignableType(fromType *Type) bool {
+	if t == fromType || t.isDyn() {
+		return true
+	}
+	if t.Kind() != fromType.Kind() ||
+		t.TypeName() != fromType.TypeName() ||
+		len(t.Parameters()) != len(fromType.Parameters()) {
+		return false
+	}
+	for i, tp := range t.Parameters() {
+		fp := fromType.Parameters()[i]
+		if !tp.IsAssignableType(fp) {
+			return false
+		}
+	}
+	return true
+}
+
+// defaultIsAssignableRuntimeType inspects the type and in the case of list and map elements, the key and element types
+// to determine whether a ref.Val is assignable to the declared type for a function signature.
+func (t *Type) defaultIsAssignableRuntimeType(val ref.Val) bool {
+	valType := val.Type()
+	// If the current type and value type don't agree, then return
+	if !(t.isDyn() || t.TypeName() == valType.TypeName()) {
+		return false
+	}
+	switch t.Kind() {
+	case ListKind:
+		elemType := t.Parameters()[0]
+		l := val.(traits.Lister)
+		if l.Size() == IntZero {
+			return true
+		}
+		it := l.Iterator()
+		elemVal := it.Next()
+		return elemType.IsAssignableRuntimeType(elemVal)
+	case MapKind:
+		keyType := t.Parameters()[0]
+		elemType := t.Parameters()[1]
+		m := val.(traits.Mapper)
+		if m.Size() == IntZero {
+			return true
+		}
+		it := m.Iterator()
+		keyVal := it.Next()
+		elemVal := m.Get(keyVal)
+		return keyType.IsAssignableRuntimeType(keyVal) && elemType.IsAssignableRuntimeType(elemVal)
+	}
+	return true
+}
+
+// NewListType creates an instances of a list type value with the provided element type.
+func NewListType(elemType *Type) *Type {
+	return &Type{
+		kind:            ListKind,
+		parameters:      []*Type{elemType},
+		runtimeTypeName: "list",
+		traitMask: traits.AdderType |
+			traits.ContainerType |
+			traits.IndexerType |
+			traits.IterableType |
+			traits.SizerType,
+	}
+}
+
+// NewMapType creates an instance of a map type value with the provided key and value types.
+func NewMapType(keyType, valueType *Type) *Type {
+	return &Type{
+		kind:            MapKind,
+		parameters:      []*Type{keyType, valueType},
+		runtimeTypeName: "map",
+		traitMask: traits.ContainerType |
+			traits.IndexerType |
+			traits.IterableType |
+			traits.SizerType,
+	}
+}
+
+// NewNullableType creates an instance of a nullable type with the provided wrapped type.
+//
+// Note: only primitive types are supported as wrapped types.
+func NewNullableType(wrapped *Type) *Type {
+	return &Type{
+		kind:            wrapped.Kind(),
+		parameters:      wrapped.Parameters(),
+		runtimeTypeName: wrapped.TypeName(),
+		traitMask:       wrapped.traitMask,
+		isAssignableType: func(other *Type) bool {
+			return NullType.IsAssignableType(other) || wrapped.IsAssignableType(other)
+		},
+		isAssignableRuntimeType: func(other ref.Val) bool {
+			return NullType.IsAssignableRuntimeType(other) || wrapped.IsAssignableRuntimeType(other)
+		},
+	}
+}
+
+// NewOptionalType creates an abstract parameterized type instance corresponding to CEL's notion of optional.
+func NewOptionalType(param *Type) *Type {
+	return NewOpaqueType("optional_type", param)
+}
+
+// NewOpaqueType creates an abstract parameterized type with a given name.
+func NewOpaqueType(name string, params ...*Type) *Type {
+	return &Type{
+		kind:            OpaqueKind,
+		parameters:      params,
+		runtimeTypeName: name,
+	}
+}
+
+// NewObjectType creates a type reference to an externally defined type, e.g. a protobuf message type.
+//
+// An object type is assumed to support field presence testing and field indexing. Additionally, the
+// type may also indicate additional traits through the use of the optional traits vararg argument.
+func NewObjectType(typeName string, traits ...int) *Type {
+	// Function sanitizes object types on the fly
+	if wkt, found := checkedWellKnowns[typeName]; found {
+		return wkt
+	}
+	traitMask := 0
+	for _, trait := range traits {
+		traitMask |= trait
+	}
+	return &Type{
+		kind:            StructKind,
+		parameters:      emptyParams,
+		runtimeTypeName: typeName,
+		traitMask:       structTypeTraitMask | traitMask,
+	}
+}
+
+// NewObjectTypeValue creates a type reference to an externally defined type.
+//
+// Deprecated: use cel.ObjectType(typeName)
+func NewObjectTypeValue(typeName string) *Type {
+	return NewObjectType(typeName)
+}
+
+// NewTypeValue creates an opaque type which has a set of optional type traits as defined in
+// the common/types/traits package.
+//
+// Deprecated: use cel.ObjectType(typeName, traits)
+func NewTypeValue(typeName string, traits ...int) *Type {
+	traitMask := 0
+	for _, trait := range traits {
+		traitMask |= trait
+	}
+	return &Type{
+		kind:            StructKind,
+		parameters:      emptyParams,
+		runtimeTypeName: typeName,
+		traitMask:       traitMask,
+	}
+}
+
+// NewTypeParamType creates a parameterized type instance.
+func NewTypeParamType(paramName string) *Type {
+	return &Type{
+		kind:            TypeParamKind,
+		runtimeTypeName: paramName,
+	}
+}
+
+// NewTypeTypeWithParam creates a type with a type parameter.
+// Used for type-checking purposes, but equivalent to TypeType otherwise.
+func NewTypeTypeWithParam(param *Type) *Type {
+	return &Type{
+		kind:            TypeKind,
+		runtimeTypeName: "type",
+		parameters:      []*Type{param},
+	}
+}
+
+// TypeToExprType converts a CEL-native type representation to a protobuf CEL Type representation.
+func TypeToExprType(t *Type) (*exprpb.Type, error) {
+	switch t.Kind() {
+	case AnyKind:
+		return chkdecls.Any, nil
+	case BoolKind:
+		return maybeWrapper(t, chkdecls.Bool), nil
+	case BytesKind:
+		return maybeWrapper(t, chkdecls.Bytes), nil
+	case DoubleKind:
+		return maybeWrapper(t, chkdecls.Double), nil
+	case DurationKind:
+		return chkdecls.Duration, nil
+	case DynKind:
+		return chkdecls.Dyn, nil
+	case ErrorKind:
+		return chkdecls.Error, nil
+	case IntKind:
+		return maybeWrapper(t, chkdecls.Int), nil
+	case ListKind:
+		if len(t.Parameters()) != 1 {
+			return nil, fmt.Errorf("invalid list, got %d parameters, wanted one", len(t.Parameters()))
+		}
+		et, err := TypeToExprType(t.Parameters()[0])
+		if err != nil {
+			return nil, err
+		}
+		return chkdecls.NewListType(et), nil
+	case MapKind:
+		if len(t.Parameters()) != 2 {
+			return nil, fmt.Errorf("invalid map, got %d parameters, wanted two", len(t.Parameters()))
+		}
+		kt, err := TypeToExprType(t.Parameters()[0])
+		if err != nil {
+			return nil, err
+		}
+		vt, err := TypeToExprType(t.Parameters()[1])
+		if err != nil {
+			return nil, err
+		}
+		return chkdecls.NewMapType(kt, vt), nil
+	case NullTypeKind:
+		return chkdecls.Null, nil
+	case OpaqueKind:
+		params := make([]*exprpb.Type, len(t.Parameters()))
+		for i, p := range t.Parameters() {
+			pt, err := TypeToExprType(p)
+			if err != nil {
+				return nil, err
+			}
+			params[i] = pt
+		}
+		return chkdecls.NewAbstractType(t.TypeName(), params...), nil
+	case StringKind:
+		return maybeWrapper(t, chkdecls.String), nil
+	case StructKind:
+		return chkdecls.NewObjectType(t.TypeName()), nil
+	case TimestampKind:
+		return chkdecls.Timestamp, nil
+	case TypeParamKind:
+		return chkdecls.NewTypeParamType(t.TypeName()), nil
+	case TypeKind:
+		if len(t.Parameters()) == 1 {
+			p, err := TypeToExprType(t.Parameters()[0])
+			if err != nil {
+				return nil, err
+			}
+			return chkdecls.NewTypeType(p), nil
+		}
+		return chkdecls.NewTypeType(nil), nil
+	case UintKind:
+		return maybeWrapper(t, chkdecls.Uint), nil
+	}
+	return nil, fmt.Errorf("missing type conversion to proto: %v", t)
+}
+
+// ExprTypeToType converts a protobuf CEL type representation to a CEL-native type representation.
+func ExprTypeToType(t *exprpb.Type) (*Type, error) {
+	return AlphaProtoAsType(t)
+}
+
+// AlphaProtoAsType converts a CEL v1alpha1.Type protobuf type to a CEL-native type representation.
+func AlphaProtoAsType(t *exprpb.Type) (*Type, error) {
+	canonical := &celpb.Type{}
+	if err := convertProto(t, canonical); err != nil {
+		return nil, err
+	}
+	return ProtoAsType(canonical)
+}
+
+// ProtoAsType converts a canonical CEL celpb.Type protobuf type to a CEL-native type representation.
+func ProtoAsType(t *celpb.Type) (*Type, error) {
+	switch t.GetTypeKind().(type) {
+	case *celpb.Type_Dyn:
+		return DynType, nil
+	case *celpb.Type_AbstractType_:
+		paramTypes := make([]*Type, len(t.GetAbstractType().GetParameterTypes()))
+		for i, p := range t.GetAbstractType().GetParameterTypes() {
+			pt, err := ProtoAsType(p)
+			if err != nil {
+				return nil, err
+			}
+			paramTypes[i] = pt
+		}
+		return NewOpaqueType(t.GetAbstractType().GetName(), paramTypes...), nil
+	case *celpb.Type_ListType_:
+		et, err := ProtoAsType(t.GetListType().GetElemType())
+		if err != nil {
+			return nil, err
+		}
+		return NewListType(et), nil
+	case *celpb.Type_MapType_:
+		kt, err := ProtoAsType(t.GetMapType().GetKeyType())
+		if err != nil {
+			return nil, err
+		}
+		vt, err := ProtoAsType(t.GetMapType().GetValueType())
+		if err != nil {
+			return nil, err
+		}
+		return NewMapType(kt, vt), nil
+	case *celpb.Type_MessageType:
+		return NewObjectType(t.GetMessageType()), nil
+	case *celpb.Type_Null:
+		return NullType, nil
+	case *celpb.Type_Primitive:
+		switch t.GetPrimitive() {
+		case celpb.Type_BOOL:
+			return BoolType, nil
+		case celpb.Type_BYTES:
+			return BytesType, nil
+		case celpb.Type_DOUBLE:
+			return DoubleType, nil
+		case celpb.Type_INT64:
+			return IntType, nil
+		case celpb.Type_STRING:
+			return StringType, nil
+		case celpb.Type_UINT64:
+			return UintType, nil
+		default:
+			return nil, fmt.Errorf("unsupported primitive type: %v", t)
+		}
+	case *celpb.Type_TypeParam:
+		return NewTypeParamType(t.GetTypeParam()), nil
+	case *celpb.Type_Type:
+		if t.GetType().GetTypeKind() != nil {
+			p, err := ProtoAsType(t.GetType())
+			if err != nil {
+				return nil, err
+			}
+			return NewTypeTypeWithParam(p), nil
+		}
+		return TypeType, nil
+	case *celpb.Type_WellKnown:
+		switch t.GetWellKnown() {
+		case celpb.Type_ANY:
+			return AnyType, nil
+		case celpb.Type_DURATION:
+			return DurationType, nil
+		case celpb.Type_TIMESTAMP:
+			return TimestampType, nil
+		default:
+			return nil, fmt.Errorf("unsupported well-known type: %v", t)
+		}
+	case *celpb.Type_Wrapper:
+		t, err := ProtoAsType(&celpb.Type{TypeKind: &celpb.Type_Primitive{Primitive: t.GetWrapper()}})
+		if err != nil {
+			return nil, err
+		}
+		return NewNullableType(t), nil
+	case *celpb.Type_Error:
+		return ErrorType, nil
+	default:
+		return nil, fmt.Errorf("unsupported type: %v", t)
+	}
+}
+
+func maybeWrapper(t *Type, pbType *exprpb.Type) *exprpb.Type {
+	if t.IsAssignableType(NullType) {
+		return chkdecls.NewWrapperType(pbType)
+	}
+	return pbType
+}
+
+func maybeForeignType(t ref.Type) *Type {
+	if celType, ok := t.(*Type); ok {
+		return celType
+	}
+	// Inspect the incoming type to determine its traits. The assumption will be that the incoming
+	// type does not have any field values; however, if the trait mask indicates that field testing
+	// and indexing are supported, the foreign type is marked as a struct.
+	traitMask := 0
+	for _, trait := range allTraits {
+		if t.HasTrait(trait) {
+			traitMask |= trait
+		}
+	}
+	// Treat the value like a struct. If it has no fields, this is harmless to denote the type
+	// as such since it basically becomes an opaque type by convention.
+	return NewObjectType(t.TypeName(), traitMask)
+}
+
+func convertProto(src, dst proto.Message) error {
+	pb, err := proto.Marshal(src)
+	if err != nil {
+		return err
+	}
+	err = proto.Unmarshal(pb, dst)
+	return err
+}
+
+func primitiveType(primitive celpb.Type_PrimitiveType) *celpb.Type {
+	return &celpb.Type{
+		TypeKind: &celpb.Type_Primitive{
+			Primitive: primitive,
+		},
+	}
+}
+
+var (
+	checkedWellKnowns = map[string]*Type{
+		// Wrapper types.
+		"google.protobuf.BoolValue":   NewNullableType(BoolType),
+		"google.protobuf.BytesValue":  NewNullableType(BytesType),
+		"google.protobuf.DoubleValue": NewNullableType(DoubleType),
+		"google.protobuf.FloatValue":  NewNullableType(DoubleType),
+		"google.protobuf.Int64Value":  NewNullableType(IntType),
+		"google.protobuf.Int32Value":  NewNullableType(IntType),
+		"google.protobuf.UInt64Value": NewNullableType(UintType),
+		"google.protobuf.UInt32Value": NewNullableType(UintType),
+		"google.protobuf.StringValue": NewNullableType(StringType),
+		// Well-known types.
+		"google.protobuf.Any":       AnyType,
+		"google.protobuf.Duration":  DurationType,
+		"google.protobuf.Timestamp": TimestampType,
+		// Json types.
+		"google.protobuf.ListValue": NewListType(DynType),
+		"google.protobuf.NullValue": NullType,
+		"google.protobuf.Struct":    NewMapType(StringType, DynType),
+		"google.protobuf.Value":     DynType,
+	}
+
+	emptyParams = []*Type{}
+
+	allTraits = []int{
+		traits.AdderType,
+		traits.ComparerType,
+		traits.ContainerType,
+		traits.DividerType,
+		traits.FieldTesterType,
+		traits.IndexerType,
+		traits.IterableType,
+		traits.IteratorType,
+		traits.MatcherType,
+		traits.ModderType,
+		traits.MultiplierType,
+		traits.NegatorType,
+		traits.ReceiverType,
+		traits.SizerType,
+		traits.SubtractorType,
+	}
+
+	structTypeTraitMask = traits.FieldTesterType | traits.IndexerType
+
+	boolType   = primitiveType(celpb.Type_BOOL)
+	bytesType  = primitiveType(celpb.Type_BYTES)
+	doubleType = primitiveType(celpb.Type_DOUBLE)
+	intType    = primitiveType(celpb.Type_INT64)
+	stringType = primitiveType(celpb.Type_STRING)
+	uintType   = primitiveType(celpb.Type_UINT64)
+)
diff --git a/vendor/github.com/google/cel-go/common/types/uint.go b/vendor/github.com/google/cel-go/common/types/uint.go
index 615c7ec..6d74f30 100644
--- a/vendor/github.com/google/cel-go/common/types/uint.go
+++ b/vendor/github.com/google/cel-go/common/types/uint.go
@@ -21,7 +21,6 @@ import (
 	"strconv"
 
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
 
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	structpb "google.golang.org/protobuf/types/known/structpb"
@@ -32,15 +31,6 @@ import (
 type Uint uint64
 
 var (
-	// UintType singleton.
-	UintType = NewTypeValue("uint",
-		traits.AdderType,
-		traits.ComparerType,
-		traits.DividerType,
-		traits.ModderType,
-		traits.MultiplierType,
-		traits.SubtractorType)
-
 	uint32WrapperType = reflect.TypeOf(&wrapperspb.UInt32Value{})
 
 	uint64WrapperType = reflect.TypeOf(&wrapperspb.UInt64Value{})
@@ -90,6 +80,18 @@ func (i Uint) ConvertToNative(typeDesc reflect.Type) (any, error) {
 			return 0, err
 		}
 		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
+	case reflect.Uint8:
+		v, err := uint64ToUint8Checked(uint64(i))
+		if err != nil {
+			return 0, err
+		}
+		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
+	case reflect.Uint16:
+		v, err := uint64ToUint16Checked(uint64(i))
+		if err != nil {
+			return 0, err
+		}
+		return reflect.ValueOf(v).Convert(typeDesc).Interface(), nil
 	case reflect.Uint64:
 		return reflect.ValueOf(i).Convert(typeDesc).Interface(), nil
 	case reflect.Ptr:
diff --git a/vendor/github.com/google/cel-go/common/types/unknown.go b/vendor/github.com/google/cel-go/common/types/unknown.go
index bc411c1..9dd2b25 100644
--- a/vendor/github.com/google/cel-go/common/types/unknown.go
+++ b/vendor/github.com/google/cel-go/common/types/unknown.go
@@ -15,52 +15,312 @@
 package types
 
 import (
+	"fmt"
+	"math"
 	"reflect"
+	"sort"
+	"strings"
+	"unicode"
 
 	"github.com/google/cel-go/common/types/ref"
 )
 
-// Unknown type implementation which collects expression ids which caused the
-// current value to become unknown.
-type Unknown []int64
-
 var (
-	// UnknownType singleton.
-	UnknownType = NewTypeValue("unknown")
+	unspecifiedAttribute = &AttributeTrail{qualifierPath: []any{}}
 )
 
+// NewAttributeTrail creates a new simple attribute from a variable name.
+func NewAttributeTrail(variable string) *AttributeTrail {
+	if variable == "" {
+		return unspecifiedAttribute
+	}
+	return &AttributeTrail{variable: variable}
+}
+
+// AttributeTrail specifies a variable with an optional qualifier path. An attribute value is expected to
+// correspond to an AbsoluteAttribute, meaning a field selection which starts with a top-level variable.
+//
+// The qualifer path elements adhere to the AttributeQualifier type constraint.
+type AttributeTrail struct {
+	variable      string
+	qualifierPath []any
+}
+
+// Equal returns whether two attribute values have the same variable name and qualifier paths.
+func (a *AttributeTrail) Equal(other *AttributeTrail) bool {
+	if a.Variable() != other.Variable() || len(a.QualifierPath()) != len(other.QualifierPath()) {
+		return false
+	}
+	for i, q := range a.QualifierPath() {
+		qual := other.QualifierPath()[i]
+		if !qualifiersEqual(q, qual) {
+			return false
+		}
+	}
+	return true
+}
+
+func qualifiersEqual(a, b any) bool {
+	if a == b {
+		return true
+	}
+	switch numA := a.(type) {
+	case int64:
+		numB, ok := b.(uint64)
+		if !ok {
+			return false
+		}
+		return intUintEqual(numA, numB)
+	case uint64:
+		numB, ok := b.(int64)
+		if !ok {
+			return false
+		}
+		return intUintEqual(numB, numA)
+	default:
+		return false
+	}
+}
+
+func intUintEqual(i int64, u uint64) bool {
+	if i < 0 || u > math.MaxInt64 {
+		return false
+	}
+	return i == int64(u)
+}
+
+// Variable returns the variable name associated with the attribute.
+func (a *AttributeTrail) Variable() string {
+	return a.variable
+}
+
+// QualifierPath returns the optional set of qualifying fields or indices applied to the variable.
+func (a *AttributeTrail) QualifierPath() []any {
+	return a.qualifierPath
+}
+
+// String returns the string representation of the Attribute.
+func (a *AttributeTrail) String() string {
+	if a.variable == "" {
+		return "<unspecified>"
+	}
+	var str strings.Builder
+	str.WriteString(a.variable)
+	for _, q := range a.qualifierPath {
+		switch q := q.(type) {
+		case bool, int64:
+			str.WriteString(fmt.Sprintf("[%v]", q))
+		case uint64:
+			str.WriteString(fmt.Sprintf("[%vu]", q))
+		case string:
+			if isIdentifierCharacter(q) {
+				str.WriteString(fmt.Sprintf(".%v", q))
+			} else {
+				str.WriteString(fmt.Sprintf("[%q]", q))
+			}
+		}
+	}
+	return str.String()
+}
+
+func isIdentifierCharacter(str string) bool {
+	for _, c := range str {
+		if unicode.IsLetter(c) || unicode.IsDigit(c) || string(c) == "_" {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+// AttributeQualifier constrains the possible types which may be used to qualify an attribute.
+type AttributeQualifier interface {
+	bool | int64 | uint64 | string
+}
+
+// QualifyAttribute qualifies an attribute using a valid AttributeQualifier type.
+func QualifyAttribute[T AttributeQualifier](attr *AttributeTrail, qualifier T) *AttributeTrail {
+	attr.qualifierPath = append(attr.qualifierPath, qualifier)
+	return attr
+}
+
+// Unknown type which collects expression ids which caused the current value to become unknown.
+type Unknown struct {
+	attributeTrails map[int64][]*AttributeTrail
+}
+
+// NewUnknown creates a new unknown at a given expression id for an attribute.
+//
+// If the attribute is nil, the attribute value will be the `unspecifiedAttribute`.
+func NewUnknown(id int64, attr *AttributeTrail) *Unknown {
+	if attr == nil {
+		attr = unspecifiedAttribute
+	}
+	return &Unknown{
+		attributeTrails: map[int64][]*AttributeTrail{id: {attr}},
+	}
+}
+
+// IDs returns the set of unknown expression ids contained by this value.
+//
+// Numeric identifiers are guaranteed to be in sorted order.
+func (u *Unknown) IDs() []int64 {
+	ids := make(int64Slice, len(u.attributeTrails))
+	i := 0
+	for id := range u.attributeTrails {
+		ids[i] = id
+		i++
+	}
+	ids.Sort()
+	return ids
+}
+
+// GetAttributeTrails returns the attribute trails, if present, missing for a given expression id.
+func (u *Unknown) GetAttributeTrails(id int64) ([]*AttributeTrail, bool) {
+	trails, found := u.attributeTrails[id]
+	return trails, found
+}
+
+// Contains returns true if the input unknown is a subset of the current unknown.
+func (u *Unknown) Contains(other *Unknown) bool {
+	for id, otherTrails := range other.attributeTrails {
+		trails, found := u.attributeTrails[id]
+		if !found || len(otherTrails) != len(trails) {
+			return false
+		}
+		for _, ot := range otherTrails {
+			found := false
+			for _, t := range trails {
+				if t.Equal(ot) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return false
+			}
+		}
+	}
+	return true
+}
+
 // ConvertToNative implements ref.Val.ConvertToNative.
-func (u Unknown) ConvertToNative(typeDesc reflect.Type) (any, error) {
+func (u *Unknown) ConvertToNative(typeDesc reflect.Type) (any, error) {
 	return u.Value(), nil
 }
 
 // ConvertToType is an identity function since unknown values cannot be modified.
-func (u Unknown) ConvertToType(typeVal ref.Type) ref.Val {
+func (u *Unknown) ConvertToType(typeVal ref.Type) ref.Val {
 	return u
 }
 
 // Equal is an identity function since unknown values cannot be modified.
-func (u Unknown) Equal(other ref.Val) ref.Val {
+func (u *Unknown) Equal(other ref.Val) ref.Val {
 	return u
 }
 
+// String implements the Stringer interface
+func (u *Unknown) String() string {
+	var str strings.Builder
+	for id, attrs := range u.attributeTrails {
+		if str.Len() != 0 {
+			str.WriteString(", ")
+		}
+		if len(attrs) == 1 {
+			str.WriteString(fmt.Sprintf("%v (%d)", attrs[0], id))
+		} else {
+			str.WriteString(fmt.Sprintf("%v (%d)", attrs, id))
+		}
+	}
+	return str.String()
+}
+
 // Type implements ref.Val.Type.
-func (u Unknown) Type() ref.Type {
+func (u *Unknown) Type() ref.Type {
 	return UnknownType
 }
 
 // Value implements ref.Val.Value.
-func (u Unknown) Value() any {
-	return []int64(u)
+func (u *Unknown) Value() any {
+	return u
 }
 
-// IsUnknown returns whether the element ref.Type or ref.Val is equal to the
-// UnknownType singleton.
+// IsUnknown returns whether the element ref.Val is in instance of *types.Unknown
 func IsUnknown(val ref.Val) bool {
 	switch val.(type) {
-	case Unknown:
+	case *Unknown:
 		return true
 	default:
 		return false
 	}
 }
+
+// MaybeMergeUnknowns determines whether an input value and another, possibly nil, unknown will produce
+// an unknown result.
+//
+// If the input `val` is another Unknown, then the result will be the merge of the `val` and the input
+// `unk`. If the `val` is not unknown, then the result will depend on whether the input `unk` is nil.
+// If both values are non-nil and unknown, then the return value will be a merge of both unknowns.
+func MaybeMergeUnknowns(val ref.Val, unk *Unknown) (*Unknown, bool) {
+	src, isUnk := val.(*Unknown)
+	if !isUnk {
+		if unk != nil {
+			return unk, true
+		}
+		return unk, false
+	}
+	return MergeUnknowns(src, unk), true
+}
+
+// MergeUnknowns combines two unknown values into a new unknown value.
+func MergeUnknowns(unk1, unk2 *Unknown) *Unknown {
+	if unk1 == nil {
+		return unk2
+	}
+	if unk2 == nil {
+		return unk1
+	}
+	out := &Unknown{
+		attributeTrails: make(map[int64][]*AttributeTrail, len(unk1.attributeTrails)+len(unk2.attributeTrails)),
+	}
+	for id, ats := range unk1.attributeTrails {
+		out.attributeTrails[id] = ats
+	}
+	for id, ats := range unk2.attributeTrails {
+		existing, found := out.attributeTrails[id]
+		if !found {
+			out.attributeTrails[id] = ats
+			continue
+		}
+
+		for _, at := range ats {
+			found := false
+			for _, et := range existing {
+				if at.Equal(et) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				existing = append(existing, at)
+			}
+		}
+		out.attributeTrails[id] = existing
+	}
+	return out
+}
+
+// int64Slice is an implementation of the sort.Interface
+type int64Slice []int64
+
+// Len returns the number of elements in the slice.
+func (x int64Slice) Len() int { return len(x) }
+
+// Less indicates whether the value at index i is less than the value at index j.
+func (x int64Slice) Less(i, j int) bool { return x[i] < x[j] }
+
+// Swap swaps the values at indices i and j in place.
+func (x int64Slice) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+
+// Sort is a convenience method: x.Sort() calls Sort(x).
+func (x int64Slice) Sort() { sort.Sort(x) }
diff --git a/vendor/github.com/google/cel-go/common/types/util.go b/vendor/github.com/google/cel-go/common/types/util.go
index a8e9afa..71662ee 100644
--- a/vendor/github.com/google/cel-go/common/types/util.go
+++ b/vendor/github.com/google/cel-go/common/types/util.go
@@ -21,7 +21,7 @@ import (
 // IsUnknownOrError returns whether the input element ref.Val is an ErrType or UnknownType.
 func IsUnknownOrError(val ref.Val) bool {
 	switch val.(type) {
-	case Unknown, *Err:
+	case *Unknown, *Err:
 		return true
 	}
 	return false
diff --git a/vendor/github.com/google/cel-go/ext/BUILD.bazel b/vendor/github.com/google/cel-go/ext/BUILD.bazel
index 7dfbc6f..b764fa1 100644
--- a/vendor/github.com/google/cel-go/ext/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/ext/BUILD.bazel
@@ -7,8 +7,12 @@ package(
 go_library(
     name = "go_default_library",
     srcs = [
+        "bindings.go",
+        "comprehensions.go",
         "encoders.go",
+        "formatting.go",
         "guards.go",
+        "lists.go",
         "math.go",
         "native.go",
         "protos.go",
@@ -19,15 +23,17 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//cel:go_default_library",
-        "//checker/decls:go_default_library",
-        "//common:go_default_library",
+        "//checker:go_default_library",
+        "//common/ast:go_default_library",
+        "//common/decls:go_default_library",
         "//common/overloads:go_default_library",
+        "//common/operators:go_default_library",
         "//common/types:go_default_library",
         "//common/types/pb:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
         "//interpreter:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "//parser:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//reflect/protoreflect:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb",
@@ -40,7 +46,10 @@ go_test(
     name = "go_default_test",
     size = "small",
     srcs = [
-        "encoders_test.go",
+        "bindings_test.go",
+        "comprehensions_test.go",
+        "encoders_test.go",        
+        "lists_test.go",
         "math_test.go",
         "native_test.go",
         "protos_test.go",
@@ -53,14 +62,12 @@ go_test(
     deps = [
         "//cel:go_default_library",
         "//checker:go_default_library",
-        "//common:go_default_library",
         "//common/types:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
         "//test:go_default_library",
-        "//test/proto2pb:go_default_library",   
-        "//test/proto3pb:go_default_library",     
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "//test/proto2pb:go_default_library",
+        "//test/proto3pb:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/wrapperspb:go_default_library",
         "@org_golang_google_protobuf//encoding/protojson:go_default_library",
diff --git a/vendor/github.com/google/cel-go/ext/README.md b/vendor/github.com/google/cel-go/ext/README.md
index ef0eb2a..07e544d 100644
--- a/vendor/github.com/google/cel-go/ext/README.md
+++ b/vendor/github.com/google/cel-go/ext/README.md
@@ -3,12 +3,12 @@
 CEL extensions are a related set of constants, functions, macros, or other
 features which may not be covered by the core CEL spec.
 
-## Bindings 
+## Bindings
 
 Returns a cel.EnvOption to configure support for local variable bindings
 in expressions.
 
-# Cel.Bind
+### Cel.Bind
 
 Binds a simple identifier to an initialization expression which may be used
 in a subsequenct result expression. Bindings may also be nested within each
@@ -19,11 +19,11 @@ other.
 Examples:
 
     cel.bind(a, 'hello',
-     cel.bind(b, 'world', a + b + b + a)) // "helloworldworldhello"
+    cel.bind(b, 'world', a + b + b + a)) // "helloworldworldhello"
 
     // Avoid a list allocation within the exists comprehension.
     cel.bind(valid_values, [a, b, c],
-     [d, e, f].exists(elem, elem in valid_values))
+    [d, e, f].exists(elem, elem in valid_values))
 
 Local bindings are not guaranteed to be evaluated before use.
 
@@ -100,7 +100,8 @@ argument. Simple numeric and list literals are supported as valid argument
 types; however, other literals will be flagged as errors during macro
 expansion. If the argument expression does not resolve to a numeric or
 list(numeric) type during type-checking, or during runtime then an error
-will be produced. If a list argument is empty, this too will produce an error.
+will be produced. If a list argument is empty, this too will produce an
+error.
 
     math.least(<arg>, ...) -> <double|int|uint>
 
@@ -117,6 +118,244 @@ Examples:
     math.least(a, b)     // check-time error if a or b is non-numeric
     math.least(dyn('string')) // runtime error
 
+### Math.BitOr
+
+Introduced at version: 1
+
+Performs a bitwise-OR operation over two int or uint values.
+
+    math.bitOr(<int>, <int>) -> <int>
+    math.bitOr(<uint>, <uint>) -> <uint>
+
+Examples:
+
+    math.bitOr(1u, 2u)    // returns 3u
+    math.bitOr(-2, -4)    // returns -2
+
+### Math.BitAnd
+
+Introduced at version: 1
+
+Performs a bitwise-AND operation over two int or uint values.
+
+    math.bitAnd(<int>, <int>) -> <int>
+    math.bitAnd(<uint>, <uint>) -> <uint>
+
+Examples:
+
+    math.bitAnd(3u, 2u)   // return 2u
+    math.bitAnd(3, 5)     // returns 3
+    math.bitAnd(-3, -5)   // returns -7
+
+### Math.BitXor
+
+Introduced at version: 1
+
+    math.bitXor(<int>, <int>) -> <int>
+    math.bitXor(<uint>, <uint>) -> <uint>
+
+Performs a bitwise-XOR operation over two int or uint values.
+
+Examples:
+
+    math.bitXor(3u, 5u) // returns 6u
+    math.bitXor(1, 3)   // returns 2
+
+### Math.BitNot
+
+Introduced at version: 1
+
+Function which accepts a single int or uint and performs a bitwise-NOT
+ones-complement of the given binary value.
+
+    math.bitNot(<int>) -> <int>
+    math.bitNot(<uint>) -> <uint>
+
+Examples
+
+    math.bitNot(1)  // returns -1
+    math.bitNot(-1) // return 0
+    math.bitNot(0u) // returns 18446744073709551615u
+
+### Math.BitShiftLeft
+
+Introduced at version: 1
+
+Perform a left shift of bits on the first parameter, by the amount of bits
+specified in the second parameter. The first parameter is either a uint or
+an int. The second parameter must be an int.
+
+When the second parameter is 64 or greater, 0 will be always be returned
+since the number of bits shifted is greater than or equal to the total bit
+length of the number being shifted. Negative valued bit shifts will result
+in a runtime error.
+
+    math.bitShiftLeft(<int>, <int>) -> <int>
+    math.bitShiftLeft(<uint>, <int>) -> <uint>
+
+Examples
+
+    math.bitShiftLeft(1, 2)    // returns 4
+    math.bitShiftLeft(-1, 2)   // returns -4
+    math.bitShiftLeft(1u, 2)   // return 4u
+    math.bitShiftLeft(1u, 200) // returns 0u
+
+### Math.BitShiftRight
+
+Introduced at version: 1
+
+Perform a right shift of bits on the first parameter, by the amount of bits
+specified in the second parameter. The first parameter is either a uint or
+an int. The second parameter must be an int.
+
+When the second parameter is 64 or greater, 0 will always be returned since
+the number of bits shifted is greater than or equal to the total bit length
+of the number being shifted. Negative valued bit shifts will result in a
+runtime error.
+
+The sign bit extension will not be preserved for this operation: vacant bits
+on the left are filled with 0.
+
+    math.bitShiftRight(<int>, <int>) -> <int>
+    math.bitShiftRight(<uint>, <int>) -> <uint>
+
+Examples
+
+    math.bitShiftRight(1024, 2)    // returns 256
+    math.bitShiftRight(1024u, 2)   // returns 256u
+    math.bitShiftRight(1024u, 64)  // returns 0u
+
+### Math.Ceil
+
+Introduced at version: 1
+
+Compute the ceiling of a double value.
+
+    math.ceil(<double>) -> <double>
+
+Examples:
+
+    math.ceil(1.2)   // returns 2.0
+    math.ceil(-1.2)  // returns -1.0
+
+### Math.Floor
+
+Introduced at version: 1
+
+Compute the floor of a double value.
+
+    math.floor(<double>) -> <double>
+
+Examples:
+
+    math.floor(1.2)   // returns 1.0
+    math.floor(-1.2)  // returns -2.0
+
+### Math.Round
+
+Introduced at version: 1
+
+Rounds the double value to the nearest whole number with ties rounding away
+from zero, e.g. 1.5 -> 2.0, -1.5 -> -2.0.
+
+    math.round(<double>) -> <double>
+
+Examples:
+
+    math.round(1.2)  // returns 1.0
+    math.round(1.5)  // returns 2.0
+    math.round(-1.5) // returns -2.0
+
+### Math.Trunc
+
+Introduced at version: 1
+
+Truncates the fractional portion of the double value.
+
+    math.trunc(<double>) -> <double>
+
+Examples:
+
+    math.trunc(-1.3)  // returns -1.0
+    math.trunc(1.3)   // returns 1.0
+
+### Math.Abs
+
+Introduced at version: 1
+
+Returns the absolute value of the numeric type provided as input. If the
+value is NaN, the output is NaN. If the input is int64 min, the function
+will result in an overflow error.
+
+    math.abs(<double>) -> <double>
+    math.abs(<int>) -> <int>
+    math.abs(<uint>) -> <uint>
+
+Examples:
+
+    math.abs(-1)  // returns 1
+    math.abs(1)   // returns 1
+    math.abs(-9223372036854775808) // overlflow error
+
+### Math.Sign
+
+Introduced at version: 1
+
+Returns the sign of the numeric type, either -1, 0, 1 as an int, double, or
+uint depending on the overload. For floating point values, if NaN is
+provided as input, the output is also NaN. The implementation does not
+differentiate between positive and negative zero.
+
+    math.sign(<double>) -> <double>
+    math.sign(<int>) -> <int>
+    math.sign(<uint>) -> <uint>
+
+Examples:
+
+    math.sign(-42) // returns -1
+    math.sign(0)   // returns 0
+    math.sign(42)  // returns 1
+
+### Math.IsInf
+
+Introduced at version: 1
+
+Returns true if the input double value is -Inf or +Inf.
+
+    math.isInf(<double>) -> <bool>
+
+Examples:
+
+    math.isInf(1.0/0.0)  // returns true
+    math.isInf(1.2)      // returns false
+
+### Math.IsNaN
+
+Introduced at version: 1
+
+Returns true if the input double value is NaN, false otherwise.
+
+    math.isNaN(<double>) -> <bool>
+
+Examples:
+
+    math.isNaN(0.0/0.0)  // returns true
+    math.isNaN(1.2)      // returns false
+
+### Math.IsFinite
+
+Introduced at version: 1
+
+Returns true if the value is a finite number. Equivalent in behavior to:
+!math.isNaN(double) && !math.isInf(double)
+
+    math.isFinite(<double>) -> <bool>
+
+Examples:
+
+    math.isFinite(0.0/0.0)  // returns false
+    math.isFinite(1.2)      // returns true
+
 ## Protos
 
 Protos configure extended macros and functions for proto manipulation.
@@ -149,6 +388,118 @@ Example:
 
     proto.hasExt(msg, google.expr.proto2.test.int32_ext) // returns true || false
 
+## Lists
+
+Extended functions for list manipulation. As a general note, all indices are
+zero-based.
+
+### Distinct
+
+**Introduced in version 2**
+
+Returns the distinct elements of a list.
+
+	<list(T)>.distinct() -> <list(T)>
+
+Examples:
+
+    [1, 2, 2, 3, 3, 3].distinct() // return [1, 2, 3]
+    ["b", "b", "c", "a", "c"].distinct() // return ["b", "c", "a"]
+    [1, "b", 2, "b"].distinct() // return [1, "b", 2]
+
+### Flatten
+
+**Introduced in version 1**
+
+Flattens a list recursively.
+If an optional depth is provided, the list is flattened to a the specificied level.
+A negative depth value will result in an error.
+
+	<list>.flatten(<list>) -> <list>
+	<list>.flatten(<list>, <int>) -> <list>
+
+Examples:
+
+    [1,[2,3],[4]].flatten() // return [1, 2, 3, 4]
+    [1,[2,[3,4]]].flatten() // return [1, 2, [3, 4]]
+    [1,2,[],[],[3,4]].flatten() // return [1, 2, 3, 4]
+    [1,[2,[3,[4]]]].flatten(2) // return [1, 2, 3, [4]]
+    [1,[2,[3,[4]]]].flatten(-1) // error
+
+### Range
+
+**Introduced in version 2**
+
+Returns a list of integers from 0 to n-1.
+
+	lists.range(<int>) -> <list(int)>
+
+Examples:
+
+	lists.range(5) -> [0, 1, 2, 3, 4]
+
+
+### Reverse
+
+**Introduced in version 2**
+
+Returns the elements of a list in reverse order.
+
+	<list(T)>.reverse() -> <list(T)>
+
+Examples:
+
+	[5, 3, 1, 2].reverse() // return [2, 1, 3, 5]
+
+
+### Slice
+
+
+Returns a new sub-list using the indexes provided.
+
+    <list>.slice(<int>, <int>) -> <list>
+
+Examples:
+
+    [1,2,3,4].slice(1, 3) // return [2, 3]
+    [1,2,3,4].slice(2, 4) // return [3, 4]
+
+### Sort
+
+**Introduced in version 2**
+
+Sorts a list with comparable elements. If the element type is not comparable
+or the element types are not the same, the function will produce an error.
+
+    <list(T)>.sort() -> <list(T)>
+    T in {int, uint, double, bool, duration, timestamp, string, bytes}
+
+Examples:
+
+    [3, 2, 1].sort() // return [1, 2, 3]
+    ["b", "c", "a"].sort() // return ["a", "b", "c"]
+    [1, "b"].sort() // error
+    [[1, 2, 3]].sort() // error
+
+### SortBy
+
+**Introduced in version 2**
+
+Sorts a list by a key value, i.e., the order is determined by the result of
+an expression applied to each element of the list.
+
+    <list(T)>.sortBy(<bindingName>, <keyExpr>) -> <list(T)>
+    keyExpr returns a value in {int, uint, double, bool, duration, timestamp, string, bytes}
+
+Examples:
+
+	[
+	  Player { name: "foo", score: 0 },
+	  Player { name: "bar", score: -10 },
+	  Player { name: "baz", score: 1000 },
+	].sortBy(e, e.score).map(e, e.name)
+	== ["bar", "foo", "baz"]
+
 ## Sets
 
 Sets provides set relationship tests.
@@ -242,7 +593,8 @@ Examples:
     'hello mellow'.indexOf('jello')    // returns -1
     'hello mellow'.indexOf('', 2)      // returns 2
     'hello mellow'.indexOf('ello', 2)  // returns 7
-    'hello mellow'.indexOf('ello', 20) // error
+    'hello mellow'.indexOf('ello', 20) // returns -1
+    'hello mellow'.indexOf('ello', -1) // error
 
 ### Join
 
@@ -256,10 +608,10 @@ elements in the resulting string.
 
 Examples:
 
-	['hello', 'mellow'].join() // returns 'hellomellow'
-	['hello', 'mellow'].join(' ') // returns 'hello mellow'
-	[].join() // returns ''
-	[].join('/') // returns ''
+    ['hello', 'mellow'].join() // returns 'hellomellow'
+    ['hello', 'mellow'].join(' ') // returns 'hello mellow'
+    [].join() // returns ''
+    [].join('/') // returns ''
 
 ### LastIndexOf
 
@@ -280,6 +632,7 @@ Examples:
     'hello mellow'.lastIndexOf('ello')     // returns 7
     'hello mellow'.lastIndexOf('jello')    // returns -1
     'hello mellow'.lastIndexOf('ello', 6)  // returns 1
+    'hello mellow'.lastIndexOf('ello', 20) // returns -1
     'hello mellow'.lastIndexOf('ello', -1) // error
 
 ### LowerAscii
@@ -397,3 +750,150 @@ Examples:
 
      'TacoCat'.upperAscii()      // returns 'TACOCAT'
      'TacoCÆt Xii'.upperAscii()  // returns 'TACOCÆT XII'
+
+### Reverse
+
+Returns a new string whose characters are the same as the target string, only formatted in
+reverse order.
+This function relies on converting strings to rune arrays in order to reverse.
+It can be located in Version 3 of strings.
+
+    <string>.reverse() -> <string>
+
+Examples:
+
+    'gums'.reverse() // returns 'smug'
+    'John Smith'.reverse() // returns 'htimS nhoJ'
+
+## TwoVarComprehensions
+
+TwoVarComprehensions introduces support for two-variable comprehensions.
+
+The two-variable form of comprehensions looks similar to the one-variable
+counterparts. Where possible, the same macro names were used and additional
+macro signatures added. The notable distinction for two-variable comprehensions
+is the introduction of `transformList`, `transformMap`, and `transformMapEntry`
+support for list and map types rather than the more traditional `map` and
+`filter` macros.
+
+### All
+
+Comprehension which tests whether all elements in the list or map satisfy a
+given predicate. The `all` macro evaluates in a manner consistent with logical
+AND and will short-circuit when encountering a `false` value.
+
+    <list>.all(indexVar, valueVar, <predicate>) -> bool
+    <map>.all(keyVar, valueVar, <predicate>) -> bool
+
+Examples:
+
+    [1, 2, 3].all(i, j, i < j) // returns true
+    {'hello': 'world', 'taco': 'taco'}.all(k, v, k != v) // returns false
+
+    // Combines two-variable comprehension with single variable
+    {'h': ['hello', 'hi'], 'j': ['joke', 'jog']}
+      .all(k, vals, vals.all(v, v.startsWith(k))) // returns true
+
+### Exists
+
+Comprehension which tests whether any element in a list or map exists which
+satisfies a given predicate. The `exists` macro evaluates in a manner consistent
+with logical OR and will short-circuit when encountering a `true` value.
+
+    <list>.exists(indexVar, valueVar, <predicate>) -> bool
+    <map>.exists(keyVar, valueVar, <predicate>) -> bool
+
+Examples:
+
+    {'greeting': 'hello', 'farewell': 'goodbye'}
+      .exists(k, v, k.startsWith('good') || v.endsWith('bye')) // returns true
+    [1, 2, 4, 8, 16].exists(i, v, v == 1024 && i == 10) // returns false
+
+### ExistsOne
+
+Comprehension which tests whether exactly one element in a list or map exists
+which satisfies a given predicate expression. This comprehension does not
+short-circuit in keeping with the one-variable exists one macro semantics.
+
+    <list>.existsOne(indexVar, valueVar, <predicate>)
+    <map>.existsOne(keyVar, valueVar, <predicate>)
+
+This macro may also be used with the `exists_one` function name, for
+compatibility with the one-variable macro of the same name.
+
+Examples:
+
+    [1, 2, 1, 3, 1, 4].existsOne(i, v, i == 1 || v == 1) // returns false
+    [1, 1, 2, 2, 3, 3].existsOne(i, v, i == 2 && v == 2) // returns true
+    {'i': 0, 'j': 1, 'k': 2}.existsOne(i, v, i == 'l' || v == 1) // returns true
+
+### TransformList
+
+Comprehension which converts a map or a list into a list value. The output
+expression of the comprehension determines the contents of the output list.
+Elements in the list may optionally be filtered according to a predicate
+expression, where elements that satisfy the predicate are transformed.
+
+    <list>.transformList(indexVar, valueVar, <transform>)
+    <list>.transformList(indexVar, valueVar, <filter>, <transform>)
+    <map>.transformList(keyVar, valueVar, <transform>)
+    <map>.transformList(keyVar, valueVar, <filter>, <transform>)
+
+Examples:
+
+    [1, 2, 3].transformList(indexVar, valueVar,
+      (indexVar * valueVar) + valueVar) // returns [1, 4, 9]
+    [1, 2, 3].transformList(indexVar, valueVar, indexVar % 2 == 0
+      (indexVar * valueVar) + valueVar) // returns [1, 9]
+    {'greeting': 'hello', 'farewell': 'goodbye'}
+      .transformList(k, _, k) // returns ['greeting', 'farewell']
+    {'greeting': 'hello', 'farewell': 'goodbye'}
+      .transformList(_, v, v) // returns ['hello', 'goodbye']
+
+### TransformMap
+
+Comprehension which converts a map or a list into a map value. The output
+expression of the comprehension determines the value of the output map entry;
+however, the key remains fixed. Elements in the map may optionally be filtered
+according to a predicate expression, where elements that satisfy the predicate
+are transformed.
+
+    <list>.transformMap(indexVar, valueVar, <transform>)
+    <list>.transformMap(indexVar, valueVar, <filter>, <transform>)
+    <map>.transformMap(keyVar, valueVar, <transform>)
+    <map>.transformMap(keyVar, valueVar, <filter>, <transform>)
+
+Examples:
+
+    [1, 2, 3].transformMap(indexVar, valueVar,
+      (indexVar * valueVar) + valueVar) // returns {0: 1, 1: 4, 2: 9}
+    [1, 2, 3].transformMap(indexVar, valueVar, indexVar % 2 == 0
+      (indexVar * valueVar) + valueVar) // returns {0: 1, 2: 9}
+    {'greeting': 'hello'}.transformMap(k, v, v + '!') // returns {'greeting': 'hello!'}
+
+### TransformMapEntry
+
+Comprehension which converts a map or a list into a map value; however, this
+transform expects the entry expression be a map literal. If the transform
+produces an entry which duplicates a key in the target map, the comprehension
+will error. Note, that key equality is determined using CEL equality which
+asserts that numeric values which are equal, even if they don't have the same
+type will cause a key collision.
+
+Elements in the map may optionally be filtered according to a predicate
+expression, where elements that satisfy the predicate are transformed.
+
+    <list>.transformMap(indexVar, valueVar, <transform>)
+    <list>.transformMap(indexVar, valueVar, <filter>, <transform>)
+    <map>.transformMap(keyVar, valueVar, <transform>)
+    <map>.transformMap(keyVar, valueVar, <filter>, <transform>)
+
+Examples:
+
+    // returns {'hello': 'greeting'}
+    {'greeting': 'hello'}.transformMapEntry(keyVar, valueVar, {valueVar: keyVar})
+    // reverse lookup, require all values in list be unique
+    [1, 2, 3].transformMapEntry(indexVar, valueVar, {valueVar: indexVar})
+
+    {'greeting': 'aloha', 'farewell': 'aloha'}
+      .transformMapEntry(keyVar, valueVar, {valueVar: keyVar}) // error, duplicate key
diff --git a/vendor/github.com/google/cel-go/ext/bindings.go b/vendor/github.com/google/cel-go/ext/bindings.go
index 9cc3c3e..50cf4fb 100644
--- a/vendor/github.com/google/cel-go/ext/bindings.go
+++ b/vendor/github.com/google/cel-go/ext/bindings.go
@@ -15,10 +15,19 @@
 package ext
 
 import (
-	"github.com/google/cel-go/cel"
-	"github.com/google/cel-go/common"
+	"errors"
+	"fmt"
+	"math"
+	"strconv"
+	"strings"
+	"sync"
 
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+	"github.com/google/cel-go/interpreter"
 )
 
 // Bindings returns a cel.EnvOption to configure support for local variable
@@ -42,59 +51,286 @@ import (
 //	[d, e, f].exists(elem, elem in valid_values))
 //
 // Local bindings are not guaranteed to be evaluated before use.
-func Bindings() cel.EnvOption {
-	return cel.Lib(celBindings{})
+func Bindings(options ...BindingsOption) cel.EnvOption {
+	b := &celBindings{version: math.MaxUint32}
+	for _, o := range options {
+		b = o(b)
+	}
+	return cel.Lib(b)
 }
 
 const (
 	celNamespace  = "cel"
 	bindMacro     = "bind"
+	blockFunc     = "@block"
 	unusedIterVar = "#unused"
 )
 
-type celBindings struct{}
+// BindingsOption declares a functional operator for configuring the Bindings library behavior.
+type BindingsOption func(*celBindings) *celBindings
+
+// BindingsVersion sets the version of the bindings library to an explicit version.
+func BindingsVersion(version uint32) BindingsOption {
+	return func(lib *celBindings) *celBindings {
+		lib.version = version
+		return lib
+	}
+}
+
+type celBindings struct {
+	version uint32
+}
 
-func (celBindings) LibraryName() string {
+func (*celBindings) LibraryName() string {
 	return "cel.lib.ext.cel.bindings"
 }
 
-func (celBindings) CompileOptions() []cel.EnvOption {
-	return []cel.EnvOption{
+func (lib *celBindings) CompileOptions() []cel.EnvOption {
+	opts := []cel.EnvOption{
 		cel.Macros(
 			// cel.bind(var, <init>, <expr>)
-			cel.NewReceiverMacro(bindMacro, 3, celBind),
+			cel.ReceiverMacro(bindMacro, 3, celBind),
 		),
 	}
+	if lib.version >= 1 {
+		// The cel.@block signature takes a list of subexpressions and a typed expression which is
+		// used as the output type.
+		paramType := cel.TypeParamType("T")
+		opts = append(opts,
+			cel.Function("cel.@block",
+				cel.Overload("cel_block_list",
+					[]*cel.Type{cel.ListType(cel.DynType), paramType}, paramType)),
+		)
+		opts = append(opts, cel.ASTValidators(blockValidationExemption{}))
+	}
+	return opts
 }
 
-func (celBindings) ProgramOptions() []cel.ProgramOption {
+func (lib *celBindings) ProgramOptions() []cel.ProgramOption {
+	if lib.version >= 1 {
+		celBlockPlan := func(i interpreter.Interpretable) (interpreter.Interpretable, error) {
+			call, ok := i.(interpreter.InterpretableCall)
+			if !ok {
+				return i, nil
+			}
+			switch call.Function() {
+			case "cel.@block":
+				args := call.Args()
+				if len(args) != 2 {
+					return nil, fmt.Errorf("cel.@block expects two arguments, but got %d", len(args))
+				}
+				expr := args[1]
+				// Non-empty block
+				if block, ok := args[0].(interpreter.InterpretableConstructor); ok {
+					slotExprs := block.InitVals()
+					return newDynamicBlock(slotExprs, expr), nil
+				}
+				// Constant valued block which can happen during runtime optimization.
+				if cons, ok := args[0].(interpreter.InterpretableConst); ok {
+					if cons.Value().Type() == types.ListType {
+						l := cons.Value().(traits.Lister)
+						if l.Size().Equal(types.IntZero) == types.True {
+							return args[1], nil
+						}
+						return newConstantBlock(l, expr), nil
+					}
+				}
+				return nil, errors.New("cel.@block expects a list constructor as the first argument")
+			default:
+				return i, nil
+			}
+		}
+		return []cel.ProgramOption{cel.CustomDecorator(celBlockPlan)}
+	}
 	return []cel.ProgramOption{}
 }
 
-func celBind(meh cel.MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+type blockValidationExemption struct{}
+
+// Name returns the name of the validator.
+func (blockValidationExemption) Name() string {
+	return "cel.lib.ext.validate.functions.cel.block"
+}
+
+// Configure implements the ASTValidatorConfigurer interface and augments the list of functions to skip
+// during homogeneous aggregate literal type-checks.
+func (blockValidationExemption) Configure(config cel.MutableValidatorConfig) error {
+	functions := config.GetOrDefault(cel.HomogeneousAggregateLiteralExemptFunctions, []string{}).([]string)
+	functions = append(functions, "cel.@block")
+	return config.Set(cel.HomogeneousAggregateLiteralExemptFunctions, functions)
+}
+
+// Validate is a no-op as the intent is to simply disable strong type-checks for list literals during
+// when they occur within cel.@block calls as the arg types have already been validated.
+func (blockValidationExemption) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
+}
+
+func celBind(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
 	if !macroTargetMatchesNamespace(celNamespace, target) {
 		return nil, nil
 	}
 	varIdent := args[0]
 	varName := ""
-	switch varIdent.GetExprKind().(type) {
-	case *exprpb.Expr_IdentExpr:
-		varName = varIdent.GetIdentExpr().GetName()
+	switch varIdent.Kind() {
+	case ast.IdentKind:
+		varName = varIdent.AsIdent()
 	default:
-		return nil, &common.Error{
-			Message:  "cel.bind() variable names must be simple identifers",
-			Location: meh.OffsetLocation(varIdent.GetId()),
-		}
+		return nil, mef.NewError(varIdent.ID(), "cel.bind() variable names must be simple identifiers")
 	}
 	varInit := args[1]
 	resultExpr := args[2]
-	return meh.Fold(
+	return mef.NewComprehension(
+		mef.NewList(),
 		unusedIterVar,
-		meh.NewList(),
 		varName,
 		varInit,
-		meh.LiteralBool(false),
-		meh.Ident(varName),
+		mef.NewLiteral(types.False),
+		mef.NewIdent(varName),
 		resultExpr,
 	), nil
 }
+
+func newDynamicBlock(slotExprs []interpreter.Interpretable, expr interpreter.Interpretable) interpreter.Interpretable {
+	bs := &dynamicBlock{
+		slotExprs: slotExprs,
+		expr:      expr,
+	}
+	bs.slotActivationPool = &sync.Pool{
+		New: func() any {
+			slotCount := len(slotExprs)
+			sa := &dynamicSlotActivation{
+				slotExprs: slotExprs,
+				slotCount: slotCount,
+				slotVals:  make([]*slotVal, slotCount),
+			}
+			for i := 0; i < slotCount; i++ {
+				sa.slotVals[i] = &slotVal{}
+			}
+			return sa
+		},
+	}
+	return bs
+}
+
+type dynamicBlock struct {
+	slotExprs          []interpreter.Interpretable
+	expr               interpreter.Interpretable
+	slotActivationPool *sync.Pool
+}
+
+// ID implements the Interpretable interface method.
+func (b *dynamicBlock) ID() int64 {
+	return b.expr.ID()
+}
+
+// Eval implements the Interpretable interface method.
+func (b *dynamicBlock) Eval(activation interpreter.Activation) ref.Val {
+	sa := b.slotActivationPool.Get().(*dynamicSlotActivation)
+	sa.Activation = activation
+	defer b.clearSlots(sa)
+	return b.expr.Eval(sa)
+}
+
+func (b *dynamicBlock) clearSlots(sa *dynamicSlotActivation) {
+	sa.reset()
+	b.slotActivationPool.Put(sa)
+}
+
+type slotVal struct {
+	value   *ref.Val
+	visited bool
+}
+
+type dynamicSlotActivation struct {
+	interpreter.Activation
+	slotExprs []interpreter.Interpretable
+	slotCount int
+	slotVals  []*slotVal
+}
+
+// ResolveName implements the Activation interface method but handles variables prefixed with `@index`
+// as special variables which exist within the slot-based memory of the cel.@block() where each slot
+// refers to an expression which must be computed only once.
+func (sa *dynamicSlotActivation) ResolveName(name string) (any, bool) {
+	if idx, found := matchSlot(name, sa.slotCount); found {
+		v := sa.slotVals[idx]
+		if v.visited {
+			// Return not found if the index expression refers to itself
+			if v.value == nil {
+				return nil, false
+			}
+			return *v.value, true
+		}
+		v.visited = true
+		val := sa.slotExprs[idx].Eval(sa)
+		v.value = &val
+		return val, true
+	}
+	return sa.Activation.ResolveName(name)
+}
+
+func (sa *dynamicSlotActivation) reset() {
+	sa.Activation = nil
+	for _, sv := range sa.slotVals {
+		sv.visited = false
+		sv.value = nil
+	}
+}
+
+func newConstantBlock(slots traits.Lister, expr interpreter.Interpretable) interpreter.Interpretable {
+	count := slots.Size().(types.Int)
+	return &constantBlock{slots: slots, slotCount: int(count), expr: expr}
+}
+
+type constantBlock struct {
+	slots     traits.Lister
+	slotCount int
+	expr      interpreter.Interpretable
+}
+
+// ID implements the interpreter.Interpretable interface method.
+func (b *constantBlock) ID() int64 {
+	return b.expr.ID()
+}
+
+// Eval implements the interpreter.Interpretable interface method, and will proxy @index prefixed variable
+// lookups into a set of constant slots determined from the plan step.
+func (b *constantBlock) Eval(activation interpreter.Activation) ref.Val {
+	vars := constantSlotActivation{Activation: activation, slots: b.slots, slotCount: b.slotCount}
+	return b.expr.Eval(vars)
+}
+
+type constantSlotActivation struct {
+	interpreter.Activation
+	slots     traits.Lister
+	slotCount int
+}
+
+// ResolveName implements Activation interface method and proxies @index prefixed lookups into the slot
+// activation associated with the block scope.
+func (sa constantSlotActivation) ResolveName(name string) (any, bool) {
+	if idx, found := matchSlot(name, sa.slotCount); found {
+		return sa.slots.Get(types.Int(idx)), true
+	}
+	return sa.Activation.ResolveName(name)
+}
+
+func matchSlot(name string, slotCount int) (int, bool) {
+	if idx, found := strings.CutPrefix(name, indexPrefix); found {
+		idx, err := strconv.Atoi(idx)
+		// Return not found if the index is not numeric
+		if err != nil {
+			return -1, false
+		}
+		// Return not found if the index is not a valid slot
+		if idx < 0 || idx >= slotCount {
+			return -1, false
+		}
+		return idx, true
+	}
+	return -1, false
+}
+
+var (
+	indexPrefix = "@index"
+)
diff --git a/vendor/github.com/google/cel-go/ext/comprehensions.go b/vendor/github.com/google/cel-go/ext/comprehensions.go
new file mode 100644
index 0000000..1428558
--- /dev/null
+++ b/vendor/github.com/google/cel-go/ext/comprehensions.go
@@ -0,0 +1,410 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ext
+
+import (
+	"fmt"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+	"github.com/google/cel-go/parser"
+)
+
+const (
+	mapInsert                 = "cel.@mapInsert"
+	mapInsertOverloadMap      = "@mapInsert_map_map"
+	mapInsertOverloadKeyValue = "@mapInsert_map_key_value"
+)
+
+// TwoVarComprehensions introduces support for two-variable comprehensions.
+//
+// The two-variable form of comprehensions looks similar to the one-variable counterparts.
+// Where possible, the same macro names were used and additional macro signatures added.
+// The notable distinction for two-variable comprehensions is the introduction of
+// `transformList`, `transformMap`, and `transformMapEntry` support for list and map types
+// rather than the more traditional `map` and `filter` macros.
+//
+// # All
+//
+// Comprehension which tests whether all elements in the list or map satisfy a given
+// predicate. The `all` macro evaluates in a manner consistent with logical AND and will
+// short-circuit when encountering a `false` value.
+//
+//	<list>.all(indexVar, valueVar, <predicate>) -> bool
+//	<map>.all(keyVar, valueVar, <predicate>) -> bool
+//
+// Examples:
+//
+//	[1, 2, 3].all(i, j, i < j) // returns true
+//	{'hello': 'world', 'taco': 'taco'}.all(k, v, k != v) // returns false
+//
+//	// Combines two-variable comprehension with single variable
+//	{'h': ['hello', 'hi'], 'j': ['joke', 'jog']}
+//	    .all(k, vals, vals.all(v, v.startsWith(k))) // returns true
+//
+// # Exists
+//
+// Comprehension which tests whether any element in a list or map exists which satisfies
+// a given predicate. The `exists` macro evaluates in a manner consistent with logical OR
+// and will short-circuit when encountering a `true` value.
+//
+//	<list>.exists(indexVar, valueVar, <predicate>) -> bool
+//	<map>.exists(keyVar, valueVar, <predicate>) -> bool
+//
+// Examples:
+//
+//	{'greeting': 'hello', 'farewell': 'goodbye'}
+//	    .exists(k, v, k.startsWith('good') || v.endsWith('bye')) // returns true
+//	[1, 2, 4, 8, 16].exists(i, v, v == 1024 && i == 10) // returns false
+//
+// # ExistsOne
+//
+// Comprehension which tests whether exactly one element in a list or map exists which
+// satisfies a given predicate expression. This comprehension does not short-circuit in
+// keeping with the one-variable exists one macro semantics.
+//
+//	<list>.existsOne(indexVar, valueVar, <predicate>)
+//	<map>.existsOne(keyVar, valueVar, <predicate>)
+//
+// This macro may also be used with the `exists_one` function name, for compatibility
+// with the one-variable macro of the same name.
+//
+// Examples:
+//
+//	[1, 2, 1, 3, 1, 4].existsOne(i, v, i == 1 || v == 1) // returns false
+//	[1, 1, 2, 2, 3, 3].existsOne(i, v, i == 2 && v == 2) // returns true
+//	{'i': 0, 'j': 1, 'k': 2}.existsOne(i, v, i == 'l' || v == 1) // returns true
+//
+// # TransformList
+//
+// Comprehension which converts a map or a list into a list value. The output expression
+// of the comprehension determines the contents of the output list. Elements in the list
+// may optionally be filtered according to a predicate expression, where elements that
+// satisfy the predicate are transformed.
+//
+//	<list>.transformList(indexVar, valueVar, <transform>)
+//	<list>.transformList(indexVar, valueVar, <filter>, <transform>)
+//	<map>.transformList(keyVar, valueVar, <transform>)
+//	<map>.transformList(keyVar, valueVar, <filter>, <transform>)
+//
+// Examples:
+//
+//	[1, 2, 3].transformList(indexVar, valueVar,
+//	  (indexVar * valueVar) + valueVar) // returns [1, 4, 9]
+//	[1, 2, 3].transformList(indexVar, valueVar, indexVar % 2 == 0
+//	  (indexVar * valueVar) + valueVar) // returns [1, 9]
+//	{'greeting': 'hello', 'farewell': 'goodbye'}
+//	  .transformList(k, _, k) // returns ['greeting', 'farewell']
+//	{'greeting': 'hello', 'farewell': 'goodbye'}
+//	  .transformList(_, v, v) // returns ['hello', 'goodbye']
+//
+// # TransformMap
+//
+// Comprehension which converts a map or a list into a map value. The output expression
+// of the comprehension determines the value of the output map entry; however, the key
+// remains fixed. Elements in the map may optionally be filtered according to a predicate
+// expression, where elements that satisfy the predicate are transformed.
+//
+//	<list>.transformMap(indexVar, valueVar, <transform>)
+//	<list>.transformMap(indexVar, valueVar, <filter>, <transform>)
+//	<map>.transformMap(keyVar, valueVar, <transform>)
+//	<map>.transformMap(keyVar, valueVar, <filter>, <transform>)
+//
+// Examples:
+//
+//	[1, 2, 3].transformMap(indexVar, valueVar,
+//	  (indexVar * valueVar) + valueVar) // returns {0: 1, 1: 4, 2: 9}
+//	[1, 2, 3].transformMap(indexVar, valueVar, indexVar % 2 == 0
+//	  (indexVar * valueVar) + valueVar) // returns {0: 1, 2: 9}
+//	{'greeting': 'hello'}.transformMap(k, v, v + '!') // returns {'greeting': 'hello!'}
+//
+// # TransformMapEntry
+//
+// Comprehension which converts a map or a list into a map value; however, this transform
+// expects the entry expression be a map literal. If the tranform produces an entry which
+// duplicates a key in the target map, the comprehension will error.  Note, that key
+// equality is determined using CEL equality which asserts that numeric values which are
+// equal, even if they don't have the same type will cause a key collision.
+//
+// Elements in the map may optionally be filtered according to a predicate expression, where
+// elements that satisfy the predicate are transformed.
+//
+//	<list>.transformMap(indexVar, valueVar, <transform>)
+//	<list>.transformMap(indexVar, valueVar, <filter>, <transform>)
+//	<map>.transformMap(keyVar, valueVar, <transform>)
+//	<map>.transformMap(keyVar, valueVar, <filter>, <transform>)
+//
+// Examples:
+//
+//	// returns {'hello': 'greeting'}
+//	{'greeting': 'hello'}.transformMapEntry(keyVar, valueVar, {valueVar: keyVar})
+//	// reverse lookup, require all values in list be unique
+//	[1, 2, 3].transformMapEntry(indexVar, valueVar, {valueVar: indexVar})
+//
+//	{'greeting': 'aloha', 'farewell': 'aloha'}
+//	  .transformMapEntry(keyVar, valueVar, {valueVar: keyVar}) // error, duplicate key
+func TwoVarComprehensions() cel.EnvOption {
+	return cel.Lib(compreV2Lib{})
+}
+
+type compreV2Lib struct{}
+
+// LibraryName implements that SingletonLibrary interface method.
+func (compreV2Lib) LibraryName() string {
+	return "cel.lib.ext.comprev2"
+}
+
+// CompileOptions implements the cel.Library interface method.
+func (compreV2Lib) CompileOptions() []cel.EnvOption {
+	kType := cel.TypeParamType("K")
+	vType := cel.TypeParamType("V")
+	mapKVType := cel.MapType(kType, vType)
+	opts := []cel.EnvOption{
+		cel.Macros(
+			cel.ReceiverMacro("all", 3, quantifierAll),
+			cel.ReceiverMacro("exists", 3, quantifierExists),
+			cel.ReceiverMacro("existsOne", 3, quantifierExistsOne),
+			cel.ReceiverMacro("exists_one", 3, quantifierExistsOne),
+			cel.ReceiverMacro("transformList", 3, transformList),
+			cel.ReceiverMacro("transformList", 4, transformList),
+			cel.ReceiverMacro("transformMap", 3, transformMap),
+			cel.ReceiverMacro("transformMap", 4, transformMap),
+			cel.ReceiverMacro("transformMapEntry", 3, transformMapEntry),
+			cel.ReceiverMacro("transformMapEntry", 4, transformMapEntry),
+		),
+		cel.Function(mapInsert,
+			cel.Overload(mapInsertOverloadKeyValue, []*cel.Type{mapKVType, kType, vType}, mapKVType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					m := args[0].(traits.Mapper)
+					k := args[1]
+					v := args[2]
+					return types.InsertMapKeyValue(m, k, v)
+				})),
+			cel.Overload(mapInsertOverloadMap, []*cel.Type{mapKVType, mapKVType}, mapKVType,
+				cel.BinaryBinding(func(targetMap, updateMap ref.Val) ref.Val {
+					tm := targetMap.(traits.Mapper)
+					um := updateMap.(traits.Mapper)
+					umIt := um.Iterator()
+					for umIt.HasNext() == types.True {
+						k := umIt.Next()
+						updateOrErr := types.InsertMapKeyValue(tm, k, um.Get(k))
+						if types.IsError(updateOrErr) {
+							return updateOrErr
+						}
+						tm = updateOrErr.(traits.Mapper)
+					}
+					return tm
+				})),
+		),
+	}
+	return opts
+}
+
+// ProgramOptions implements the cel.Library interface method
+func (compreV2Lib) ProgramOptions() []cel.ProgramOption {
+	return []cel.ProgramOption{}
+}
+
+func quantifierAll(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewLiteral(types.True),
+		/*condition=*/ mef.NewCall(operators.NotStrictlyFalse, mef.NewAccuIdent()),
+		/*step=*/ mef.NewCall(operators.LogicalAnd, mef.NewAccuIdent(), args[2]),
+		/*result=*/ mef.NewAccuIdent(),
+	), nil
+}
+
+func quantifierExists(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewLiteral(types.False),
+		/*condition=*/ mef.NewCall(operators.NotStrictlyFalse, mef.NewCall(operators.LogicalNot, mef.NewAccuIdent())),
+		/*step=*/ mef.NewCall(operators.LogicalOr, mef.NewAccuIdent(), args[2]),
+		/*result=*/ mef.NewAccuIdent(),
+	), nil
+}
+
+func quantifierExistsOne(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewLiteral(types.Int(0)),
+		/*condition=*/ mef.NewLiteral(types.True),
+		/*step=*/ mef.NewCall(operators.Conditional, args[2],
+			mef.NewCall(operators.Add, mef.NewAccuIdent(), mef.NewLiteral(types.Int(1))),
+			mef.NewAccuIdent()),
+		/*result=*/ mef.NewCall(operators.Equals, mef.NewAccuIdent(), mef.NewLiteral(types.Int(1))),
+	), nil
+}
+
+func transformList(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	var transform ast.Expr
+	var filter ast.Expr
+	if len(args) == 4 {
+		filter = args[2]
+		transform = args[3]
+	} else {
+		filter = nil
+		transform = args[2]
+	}
+
+	//  __result__ = __result__ + [transform]
+	step := mef.NewCall(operators.Add, mef.NewAccuIdent(), mef.NewList(transform))
+	if filter != nil {
+		//  __result__ = (filter) ? __result__ + [transform] : __result__
+		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
+	}
+
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewList(),
+		/*condition=*/ mef.NewLiteral(types.True),
+		step,
+		/*result=*/ mef.NewAccuIdent(),
+	), nil
+}
+
+func transformMap(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	var transform ast.Expr
+	var filter ast.Expr
+	if len(args) == 4 {
+		filter = args[2]
+		transform = args[3]
+	} else {
+		filter = nil
+		transform = args[2]
+	}
+
+	// __result__ = cel.@mapInsert(__result__, iterVar1, transform)
+	step := mef.NewCall(mapInsert, mef.NewAccuIdent(), mef.NewIdent(iterVar1), transform)
+	if filter != nil {
+		// __result__ = (filter) ? cel.@mapInsert(__result__, iterVar1, transform) : __result__
+		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
+	}
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewMap(),
+		/*condition=*/ mef.NewLiteral(types.True),
+		step,
+		/*result=*/ mef.NewAccuIdent(),
+	), nil
+}
+
+func transformMapEntry(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	iterVar1, iterVar2, err := extractIterVars(mef, args[0], args[1])
+	if err != nil {
+		return nil, err
+	}
+
+	var transform ast.Expr
+	var filter ast.Expr
+	if len(args) == 4 {
+		filter = args[2]
+		transform = args[3]
+	} else {
+		filter = nil
+		transform = args[2]
+	}
+
+	// __result__ = cel.@mapInsert(__result__, transform)
+	step := mef.NewCall(mapInsert, mef.NewAccuIdent(), transform)
+	if filter != nil {
+		// __result__ = (filter) ? cel.@mapInsert(__result__, transform) : __result__
+		step = mef.NewCall(operators.Conditional, filter, step, mef.NewAccuIdent())
+	}
+	return mef.NewComprehensionTwoVar(
+		target,
+		iterVar1,
+		iterVar2,
+		parser.AccumulatorName,
+		/*accuInit=*/ mef.NewMap(),
+		/*condition=*/ mef.NewLiteral(types.True),
+		step,
+		/*result=*/ mef.NewAccuIdent(),
+	), nil
+}
+
+func extractIterVars(mef cel.MacroExprFactory, arg0, arg1 ast.Expr) (string, string, *cel.Error) {
+	iterVar1, err := extractIterVar(mef, arg0)
+	if err != nil {
+		return "", "", err
+	}
+	iterVar2, err := extractIterVar(mef, arg1)
+	if err != nil {
+		return "", "", err
+	}
+	if iterVar1 == iterVar2 {
+		return "", "", mef.NewError(arg1.ID(), fmt.Sprintf("duplicate variable name: %s", iterVar1))
+	}
+	if iterVar1 == parser.AccumulatorName {
+		return "", "", mef.NewError(arg0.ID(), "iteration variable overwrites accumulator variable")
+	}
+	if iterVar2 == parser.AccumulatorName {
+		return "", "", mef.NewError(arg1.ID(), "iteration variable overwrites accumulator variable")
+	}
+	return iterVar1, iterVar2, nil
+}
+
+func extractIterVar(mef cel.MacroExprFactory, target ast.Expr) (string, *cel.Error) {
+	iterVar, found := extractIdent(target)
+	if !found {
+		return "", mef.NewError(target.ID(), "argument must be a simple name")
+	}
+	return iterVar, nil
+}
diff --git a/vendor/github.com/google/cel-go/ext/encoders.go b/vendor/github.com/google/cel-go/ext/encoders.go
index d9f9cb5..ac04b1a 100644
--- a/vendor/github.com/google/cel-go/ext/encoders.go
+++ b/vendor/github.com/google/cel-go/ext/encoders.go
@@ -16,7 +16,6 @@ package ext
 
 import (
 	"encoding/base64"
-	"reflect"
 
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/types"
@@ -37,7 +36,7 @@ import (
 // Examples:
 //
 //	base64.decode('aGVsbG8=')  // return b'hello'
-//	base64.decode('aGVsbG8')   // error
+//	base64.decode('aGVsbG8')   // return b'hello'
 //
 // # Base64.Encode
 //
@@ -80,13 +79,16 @@ func (encoderLib) ProgramOptions() []cel.ProgramOption {
 }
 
 func base64DecodeString(str string) ([]byte, error) {
-	return base64.StdEncoding.DecodeString(str)
+	b, err := base64.StdEncoding.DecodeString(str)
+	if err == nil {
+		return b, nil
+	}
+	if _, tryAltEncoding := err.(base64.CorruptInputError); tryAltEncoding {
+		return base64.RawStdEncoding.DecodeString(str)
+	}
+	return nil, err
 }
 
 func base64EncodeBytes(bytes []byte) (string, error) {
 	return base64.StdEncoding.EncodeToString(bytes), nil
 }
-
-var (
-	bytesListType = reflect.TypeOf([]byte{})
-)
diff --git a/vendor/github.com/google/cel-go/ext/formatting.go b/vendor/github.com/google/cel-go/ext/formatting.go
new file mode 100644
index 0000000..dbff613
--- /dev/null
+++ b/vendor/github.com/google/cel-go/ext/formatting.go
@@ -0,0 +1,904 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ext
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode"
+
+	"golang.org/x/text/language"
+	"golang.org/x/text/message"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/overloads"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+)
+
+type clauseImpl func(ref.Val, string) (string, error)
+
+func clauseForType(argType ref.Type) (clauseImpl, error) {
+	switch argType {
+	case types.IntType, types.UintType:
+		return formatDecimal, nil
+	case types.StringType, types.BytesType, types.BoolType, types.NullType, types.TypeType:
+		return FormatString, nil
+	case types.TimestampType, types.DurationType:
+		// special case to ensure timestamps/durations get printed as CEL literals
+		return func(arg ref.Val, locale string) (string, error) {
+			argStrVal := arg.ConvertToType(types.StringType)
+			argStr := argStrVal.Value().(string)
+			if arg.Type() == types.TimestampType {
+				return fmt.Sprintf("timestamp(%q)", argStr), nil
+			}
+			if arg.Type() == types.DurationType {
+				return fmt.Sprintf("duration(%q)", argStr), nil
+			}
+			return "", fmt.Errorf("cannot convert argument of type %s to timestamp/duration", arg.Type().TypeName())
+		}, nil
+	case types.ListType:
+		return formatList, nil
+	case types.MapType:
+		return formatMap, nil
+	case types.DoubleType:
+		// avoid formatFixed so we can output a period as the decimal separator in order
+		// to always be a valid CEL literal
+		return func(arg ref.Val, locale string) (string, error) {
+			argDouble, ok := arg.Value().(float64)
+			if !ok {
+				return "", fmt.Errorf("couldn't convert %s to float64", arg.Type().TypeName())
+			}
+			fmtStr := fmt.Sprintf("%%.%df", defaultPrecision)
+			return fmt.Sprintf(fmtStr, argDouble), nil
+		}, nil
+	case types.TypeType:
+		return func(arg ref.Val, locale string) (string, error) {
+			return fmt.Sprintf("type(%s)", arg.Value().(string)), nil
+		}, nil
+	default:
+		return nil, fmt.Errorf("no formatting function for %s", argType.TypeName())
+	}
+}
+
+func formatList(arg ref.Val, locale string) (string, error) {
+	argList := arg.(traits.Lister)
+	argIterator := argList.Iterator()
+	var listStrBuilder strings.Builder
+	_, err := listStrBuilder.WriteRune('[')
+	if err != nil {
+		return "", fmt.Errorf("error writing to list string: %w", err)
+	}
+	for argIterator.HasNext() == types.True {
+		member := argIterator.Next()
+		memberFormat, err := clauseForType(member.Type())
+		if err != nil {
+			return "", err
+		}
+		unquotedStr, err := memberFormat(member, locale)
+		if err != nil {
+			return "", err
+		}
+		str := quoteForCEL(member, unquotedStr)
+		_, err = listStrBuilder.WriteString(str)
+		if err != nil {
+			return "", fmt.Errorf("error writing to list string: %w", err)
+		}
+		if argIterator.HasNext() == types.True {
+			_, err = listStrBuilder.WriteString(", ")
+			if err != nil {
+				return "", fmt.Errorf("error writing to list string: %w", err)
+			}
+		}
+	}
+	_, err = listStrBuilder.WriteRune(']')
+	if err != nil {
+		return "", fmt.Errorf("error writing to list string: %w", err)
+	}
+	return listStrBuilder.String(), nil
+}
+
+func formatMap(arg ref.Val, locale string) (string, error) {
+	argMap := arg.(traits.Mapper)
+	argIterator := argMap.Iterator()
+	type mapPair struct {
+		key   string
+		value string
+	}
+	argPairs := make([]mapPair, argMap.Size().Value().(int64))
+	i := 0
+	for argIterator.HasNext() == types.True {
+		key := argIterator.Next()
+		var keyFormat clauseImpl
+		switch key.Type() {
+		case types.StringType, types.BoolType:
+			keyFormat = FormatString
+		case types.IntType, types.UintType:
+			keyFormat = formatDecimal
+		default:
+			return "", fmt.Errorf("no formatting function for map key of type %s", key.Type().TypeName())
+		}
+		unquotedKeyStr, err := keyFormat(key, locale)
+		if err != nil {
+			return "", err
+		}
+		keyStr := quoteForCEL(key, unquotedKeyStr)
+		value, found := argMap.Find(key)
+		if !found {
+			return "", fmt.Errorf("could not find key: %q", key)
+		}
+		valueFormat, err := clauseForType(value.Type())
+		if err != nil {
+			return "", err
+		}
+		unquotedValueStr, err := valueFormat(value, locale)
+		if err != nil {
+			return "", err
+		}
+		valueStr := quoteForCEL(value, unquotedValueStr)
+		argPairs[i] = mapPair{keyStr, valueStr}
+		i++
+	}
+	sort.SliceStable(argPairs, func(x, y int) bool {
+		return argPairs[x].key < argPairs[y].key
+	})
+	var mapStrBuilder strings.Builder
+	_, err := mapStrBuilder.WriteRune('{')
+	if err != nil {
+		return "", fmt.Errorf("error writing to map string: %w", err)
+	}
+	for i, entry := range argPairs {
+		_, err = mapStrBuilder.WriteString(fmt.Sprintf("%s:%s", entry.key, entry.value))
+		if err != nil {
+			return "", fmt.Errorf("error writing to map string: %w", err)
+		}
+		if i < len(argPairs)-1 {
+			_, err = mapStrBuilder.WriteString(", ")
+			if err != nil {
+				return "", fmt.Errorf("error writing to map string: %w", err)
+			}
+		}
+	}
+	_, err = mapStrBuilder.WriteRune('}')
+	if err != nil {
+		return "", fmt.Errorf("error writing to map string: %w", err)
+	}
+	return mapStrBuilder.String(), nil
+}
+
+// quoteForCEL takes a formatted, unquoted value and quotes it in a manner suitable
+// for embedding directly in CEL.
+func quoteForCEL(refVal ref.Val, unquotedValue string) string {
+	switch refVal.Type() {
+	case types.StringType:
+		return fmt.Sprintf("%q", unquotedValue)
+	case types.BytesType:
+		return fmt.Sprintf("b%q", unquotedValue)
+	case types.DoubleType:
+		// special case to handle infinity/NaN
+		num := refVal.Value().(float64)
+		if math.IsInf(num, 1) || math.IsInf(num, -1) || math.IsNaN(num) {
+			return fmt.Sprintf("%q", unquotedValue)
+		}
+		return unquotedValue
+	default:
+		return unquotedValue
+	}
+}
+
+// FormatString returns the string representation of a CEL value.
+//
+// It is used to implement the %s specifier in the (string).format() extension function.
+func FormatString(arg ref.Val, locale string) (string, error) {
+	switch arg.Type() {
+	case types.ListType:
+		return formatList(arg, locale)
+	case types.MapType:
+		return formatMap(arg, locale)
+	case types.IntType, types.UintType, types.DoubleType,
+		types.BoolType, types.StringType, types.TimestampType, types.BytesType, types.DurationType, types.TypeType:
+		argStrVal := arg.ConvertToType(types.StringType)
+		argStr, ok := argStrVal.Value().(string)
+		if !ok {
+			return "", fmt.Errorf("could not convert argument %q to string", argStrVal)
+		}
+		return argStr, nil
+	case types.NullType:
+		return "null", nil
+	default:
+		return "", stringFormatError(runtimeID, arg.Type().TypeName())
+	}
+}
+
+func formatDecimal(arg ref.Val, locale string) (string, error) {
+	switch arg.Type() {
+	case types.IntType:
+		argInt, ok := arg.ConvertToType(types.IntType).Value().(int64)
+		if !ok {
+			return "", fmt.Errorf("could not convert \"%s\" to int64", arg.Value())
+		}
+		return fmt.Sprintf("%d", argInt), nil
+	case types.UintType:
+		argInt, ok := arg.ConvertToType(types.UintType).Value().(uint64)
+		if !ok {
+			return "", fmt.Errorf("could not convert \"%s\" to uint64", arg.Value())
+		}
+		return fmt.Sprintf("%d", argInt), nil
+	default:
+		return "", decimalFormatError(runtimeID, arg.Type().TypeName())
+	}
+}
+
+func matchLanguage(locale string) (language.Tag, error) {
+	matcher, err := makeMatcher(locale)
+	if err != nil {
+		return language.Und, err
+	}
+	tag, _ := language.MatchStrings(matcher, locale)
+	return tag, nil
+}
+
+func makeMatcher(locale string) (language.Matcher, error) {
+	tags := make([]language.Tag, 0)
+	tag, err := language.Parse(locale)
+	if err != nil {
+		return nil, err
+	}
+	tags = append(tags, tag)
+	return language.NewMatcher(tags), nil
+}
+
+type stringFormatter struct{}
+
+func (c *stringFormatter) String(arg ref.Val, locale string) (string, error) {
+	return FormatString(arg, locale)
+}
+
+func (c *stringFormatter) Decimal(arg ref.Val, locale string) (string, error) {
+	return formatDecimal(arg, locale)
+}
+
+func (c *stringFormatter) Fixed(precision *int) func(ref.Val, string) (string, error) {
+	if precision == nil {
+		precision = new(int)
+		*precision = defaultPrecision
+	}
+	return func(arg ref.Val, locale string) (string, error) {
+		strException := false
+		if arg.Type() == types.StringType {
+			argStr := arg.Value().(string)
+			if argStr == "NaN" || argStr == "Infinity" || argStr == "-Infinity" {
+				strException = true
+			}
+		}
+		if arg.Type() != types.DoubleType && !strException {
+			return "", fixedPointFormatError(runtimeID, arg.Type().TypeName())
+		}
+		argFloatVal := arg.ConvertToType(types.DoubleType)
+		argFloat, ok := argFloatVal.Value().(float64)
+		if !ok {
+			return "", fmt.Errorf("could not convert \"%s\" to float64", argFloatVal.Value())
+		}
+		fmtStr := fmt.Sprintf("%%.%df", *precision)
+
+		matchedLocale, err := matchLanguage(locale)
+		if err != nil {
+			return "", fmt.Errorf("error matching locale: %w", err)
+		}
+		return message.NewPrinter(matchedLocale).Sprintf(fmtStr, argFloat), nil
+	}
+}
+
+func (c *stringFormatter) Scientific(precision *int) func(ref.Val, string) (string, error) {
+	if precision == nil {
+		precision = new(int)
+		*precision = defaultPrecision
+	}
+	return func(arg ref.Val, locale string) (string, error) {
+		strException := false
+		if arg.Type() == types.StringType {
+			argStr := arg.Value().(string)
+			if argStr == "NaN" || argStr == "Infinity" || argStr == "-Infinity" {
+				strException = true
+			}
+		}
+		if arg.Type() != types.DoubleType && !strException {
+			return "", scientificFormatError(runtimeID, arg.Type().TypeName())
+		}
+		argFloatVal := arg.ConvertToType(types.DoubleType)
+		argFloat, ok := argFloatVal.Value().(float64)
+		if !ok {
+			return "", fmt.Errorf("could not convert \"%v\" to float64", argFloatVal.Value())
+		}
+		matchedLocale, err := matchLanguage(locale)
+		if err != nil {
+			return "", fmt.Errorf("error matching locale: %w", err)
+		}
+		fmtStr := fmt.Sprintf("%%%de", *precision)
+		return message.NewPrinter(matchedLocale).Sprintf(fmtStr, argFloat), nil
+	}
+}
+
+func (c *stringFormatter) Binary(arg ref.Val, locale string) (string, error) {
+	switch arg.Type() {
+	case types.IntType:
+		argInt := arg.Value().(int64)
+		// locale is intentionally unused as integers formatted as binary
+		// strings are locale-independent
+		return fmt.Sprintf("%b", argInt), nil
+	case types.UintType:
+		argInt := arg.Value().(uint64)
+		return fmt.Sprintf("%b", argInt), nil
+	case types.BoolType:
+		argBool := arg.Value().(bool)
+		if argBool {
+			return "1", nil
+		}
+		return "0", nil
+	default:
+		return "", binaryFormatError(runtimeID, arg.Type().TypeName())
+	}
+}
+
+func (c *stringFormatter) Hex(useUpper bool) func(ref.Val, string) (string, error) {
+	return func(arg ref.Val, locale string) (string, error) {
+		fmtStr := "%x"
+		if useUpper {
+			fmtStr = "%X"
+		}
+		switch arg.Type() {
+		case types.StringType, types.BytesType:
+			if arg.Type() == types.BytesType {
+				return fmt.Sprintf(fmtStr, arg.Value().([]byte)), nil
+			}
+			return fmt.Sprintf(fmtStr, arg.Value().(string)), nil
+		case types.IntType:
+			argInt, ok := arg.Value().(int64)
+			if !ok {
+				return "", fmt.Errorf("could not convert \"%s\" to int64", arg.Value())
+			}
+			return fmt.Sprintf(fmtStr, argInt), nil
+		case types.UintType:
+			argInt, ok := arg.Value().(uint64)
+			if !ok {
+				return "", fmt.Errorf("could not convert \"%s\" to uint64", arg.Value())
+			}
+			return fmt.Sprintf(fmtStr, argInt), nil
+		default:
+			return "", hexFormatError(runtimeID, arg.Type().TypeName())
+		}
+	}
+}
+
+func (c *stringFormatter) Octal(arg ref.Val, locale string) (string, error) {
+	switch arg.Type() {
+	case types.IntType:
+		argInt := arg.Value().(int64)
+		return fmt.Sprintf("%o", argInt), nil
+	case types.UintType:
+		argInt := arg.Value().(uint64)
+		return fmt.Sprintf("%o", argInt), nil
+	default:
+		return "", octalFormatError(runtimeID, arg.Type().TypeName())
+	}
+}
+
+// stringFormatValidator implements the cel.ASTValidator interface allowing for static validation
+// of string.format calls.
+type stringFormatValidator struct{}
+
+// Name returns the name of the validator.
+func (stringFormatValidator) Name() string {
+	return "cel.lib.ext.validate.functions.string.format"
+}
+
+// Configure implements the ASTValidatorConfigurer interface and augments the list of functions to skip
+// during homogeneous aggregate literal type-checks.
+func (stringFormatValidator) Configure(config cel.MutableValidatorConfig) error {
+	functions := config.GetOrDefault(cel.HomogeneousAggregateLiteralExemptFunctions, []string{}).([]string)
+	functions = append(functions, "format")
+	return config.Set(cel.HomogeneousAggregateLiteralExemptFunctions, functions)
+}
+
+// Validate parses all literal format strings and type checks the format clause against the argument
+// at the corresponding ordinal within the list literal argument to the function, if one is specified.
+func (stringFormatValidator) Validate(env *cel.Env, _ cel.ValidatorConfig, a *ast.AST, iss *cel.Issues) {
+	root := ast.NavigateAST(a)
+	formatCallExprs := ast.MatchDescendants(root, matchConstantFormatStringWithListLiteralArgs(a))
+	for _, e := range formatCallExprs {
+		call := e.AsCall()
+		formatStr := call.Target().AsLiteral().Value().(string)
+		args := call.Args()[0].AsList().Elements()
+		formatCheck := &stringFormatChecker{
+			args: args,
+			ast:  a,
+		}
+		// use a placeholder locale, since locale doesn't affect syntax
+		_, err := parseFormatString(formatStr, formatCheck, formatCheck, "en_US")
+		if err != nil {
+			iss.ReportErrorAtID(getErrorExprID(e.ID(), err), err.Error())
+			continue
+		}
+		seenArgs := formatCheck.argsRequested
+		if len(args) > seenArgs {
+			iss.ReportErrorAtID(e.ID(),
+				"too many arguments supplied to string.format (expected %d, got %d)", seenArgs, len(args))
+		}
+	}
+}
+
+// getErrorExprID determines which list literal argument triggered a type-disagreement for the
+// purposes of more accurate error message reports.
+func getErrorExprID(id int64, err error) int64 {
+	fmtErr, ok := err.(formatError)
+	if ok {
+		return fmtErr.id
+	}
+	wrapped := errors.Unwrap(err)
+	if wrapped != nil {
+		return getErrorExprID(id, wrapped)
+	}
+	return id
+}
+
+// matchConstantFormatStringWithListLiteralArgs matches all valid expression nodes for string
+// format checking.
+func matchConstantFormatStringWithListLiteralArgs(a *ast.AST) ast.ExprMatcher {
+	return func(e ast.NavigableExpr) bool {
+		if e.Kind() != ast.CallKind {
+			return false
+		}
+		call := e.AsCall()
+		if !call.IsMemberFunction() || call.FunctionName() != "format" {
+			return false
+		}
+		overloadIDs := a.GetOverloadIDs(e.ID())
+		if len(overloadIDs) != 0 {
+			found := false
+			for _, overload := range overloadIDs {
+				if overload == overloads.ExtFormatString {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return false
+			}
+		}
+		formatString := call.Target()
+		if formatString.Kind() != ast.LiteralKind || formatString.AsLiteral().Type() != cel.StringType {
+			return false
+		}
+		args := call.Args()
+		if len(args) != 1 {
+			return false
+		}
+		formatArgs := args[0]
+		return formatArgs.Kind() == ast.ListKind
+	}
+}
+
+// stringFormatChecker implements the formatStringInterpolater interface
+type stringFormatChecker struct {
+	args          []ast.Expr
+	argsRequested int
+	currArgIndex  int64
+	ast           *ast.AST
+}
+
+func (c *stringFormatChecker) String(arg ref.Val, locale string) (string, error) {
+	formatArg := c.args[c.currArgIndex]
+	valid, badID := c.verifyString(formatArg)
+	if !valid {
+		return "", stringFormatError(badID, c.typeOf(badID).TypeName())
+	}
+	return "", nil
+}
+
+func (c *stringFormatChecker) Decimal(arg ref.Val, locale string) (string, error) {
+	id := c.args[c.currArgIndex].ID()
+	valid := c.verifyTypeOneOf(id, types.IntType, types.UintType)
+	if !valid {
+		return "", decimalFormatError(id, c.typeOf(id).TypeName())
+	}
+	return "", nil
+}
+
+func (c *stringFormatChecker) Fixed(precision *int) func(ref.Val, string) (string, error) {
+	return func(arg ref.Val, locale string) (string, error) {
+		id := c.args[c.currArgIndex].ID()
+		// we allow StringType since "NaN", "Infinity", and "-Infinity" are also valid values
+		valid := c.verifyTypeOneOf(id, types.DoubleType, types.StringType)
+		if !valid {
+			return "", fixedPointFormatError(id, c.typeOf(id).TypeName())
+		}
+		return "", nil
+	}
+}
+
+func (c *stringFormatChecker) Scientific(precision *int) func(ref.Val, string) (string, error) {
+	return func(arg ref.Val, locale string) (string, error) {
+		id := c.args[c.currArgIndex].ID()
+		valid := c.verifyTypeOneOf(id, types.DoubleType, types.StringType)
+		if !valid {
+			return "", scientificFormatError(id, c.typeOf(id).TypeName())
+		}
+		return "", nil
+	}
+}
+
+func (c *stringFormatChecker) Binary(arg ref.Val, locale string) (string, error) {
+	id := c.args[c.currArgIndex].ID()
+	valid := c.verifyTypeOneOf(id, types.IntType, types.UintType, types.BoolType)
+	if !valid {
+		return "", binaryFormatError(id, c.typeOf(id).TypeName())
+	}
+	return "", nil
+}
+
+func (c *stringFormatChecker) Hex(useUpper bool) func(ref.Val, string) (string, error) {
+	return func(arg ref.Val, locale string) (string, error) {
+		id := c.args[c.currArgIndex].ID()
+		valid := c.verifyTypeOneOf(id, types.IntType, types.UintType, types.StringType, types.BytesType)
+		if !valid {
+			return "", hexFormatError(id, c.typeOf(id).TypeName())
+		}
+		return "", nil
+	}
+}
+
+func (c *stringFormatChecker) Octal(arg ref.Val, locale string) (string, error) {
+	id := c.args[c.currArgIndex].ID()
+	valid := c.verifyTypeOneOf(id, types.IntType, types.UintType)
+	if !valid {
+		return "", octalFormatError(id, c.typeOf(id).TypeName())
+	}
+	return "", nil
+}
+
+func (c *stringFormatChecker) Arg(index int64) (ref.Val, error) {
+	c.argsRequested++
+	c.currArgIndex = index
+	// return a dummy value - this is immediately passed to back to us
+	// through one of the FormatCallback functions, so anything will do
+	return types.Int(0), nil
+}
+
+func (c *stringFormatChecker) Size() int64 {
+	return int64(len(c.args))
+}
+
+func (c *stringFormatChecker) typeOf(id int64) *cel.Type {
+	return c.ast.GetType(id)
+}
+
+func (c *stringFormatChecker) verifyTypeOneOf(id int64, validTypes ...*cel.Type) bool {
+	t := c.typeOf(id)
+	if t == cel.DynType {
+		return true
+	}
+	for _, vt := range validTypes {
+		// Only check runtime type compatibility without delving deeper into parameterized types
+		if t.Kind() == vt.Kind() {
+			return true
+		}
+	}
+	return false
+}
+
+func (c *stringFormatChecker) verifyString(sub ast.Expr) (bool, int64) {
+	paramA := cel.TypeParamType("A")
+	paramB := cel.TypeParamType("B")
+	subVerified := c.verifyTypeOneOf(sub.ID(),
+		cel.ListType(paramA), cel.MapType(paramA, paramB),
+		cel.IntType, cel.UintType, cel.DoubleType, cel.BoolType, cel.StringType,
+		cel.TimestampType, cel.BytesType, cel.DurationType, cel.TypeType, cel.NullType)
+	if !subVerified {
+		return false, sub.ID()
+	}
+	switch sub.Kind() {
+	case ast.ListKind:
+		for _, e := range sub.AsList().Elements() {
+			// recursively verify if we're dealing with a list/map
+			verified, id := c.verifyString(e)
+			if !verified {
+				return false, id
+			}
+		}
+		return true, sub.ID()
+	case ast.MapKind:
+		for _, e := range sub.AsMap().Entries() {
+			// recursively verify if we're dealing with a list/map
+			entry := e.AsMapEntry()
+			verified, id := c.verifyString(entry.Key())
+			if !verified {
+				return false, id
+			}
+			verified, id = c.verifyString(entry.Value())
+			if !verified {
+				return false, id
+			}
+		}
+		return true, sub.ID()
+	default:
+		return true, sub.ID()
+	}
+}
+
+// helper routines for reporting common errors during string formatting static validation and
+// runtime execution.
+
+func binaryFormatError(id int64, badType string) error {
+	return newFormatError(id, "only integers and bools can be formatted as binary, was given %s", badType)
+}
+
+func decimalFormatError(id int64, badType string) error {
+	return newFormatError(id, "decimal clause can only be used on integers, was given %s", badType)
+}
+
+func fixedPointFormatError(id int64, badType string) error {
+	return newFormatError(id, "fixed-point clause can only be used on doubles, was given %s", badType)
+}
+
+func hexFormatError(id int64, badType string) error {
+	return newFormatError(id, "only integers, byte buffers, and strings can be formatted as hex, was given %s", badType)
+}
+
+func octalFormatError(id int64, badType string) error {
+	return newFormatError(id, "octal clause can only be used on integers, was given %s", badType)
+}
+
+func scientificFormatError(id int64, badType string) error {
+	return newFormatError(id, "scientific clause can only be used on doubles, was given %s", badType)
+}
+
+func stringFormatError(id int64, badType string) error {
+	return newFormatError(id, "string clause can only be used on strings, bools, bytes, ints, doubles, maps, lists, types, durations, and timestamps, was given %s", badType)
+}
+
+type formatError struct {
+	id  int64
+	msg string
+}
+
+func newFormatError(id int64, msg string, args ...any) error {
+	return formatError{
+		id:  id,
+		msg: fmt.Sprintf(msg, args...),
+	}
+}
+
+func (e formatError) Error() string {
+	return e.msg
+}
+
+func (e formatError) Is(target error) bool {
+	return e.msg == target.Error()
+}
+
+// stringArgList implements the formatListArgs interface.
+type stringArgList struct {
+	args traits.Lister
+}
+
+func (c *stringArgList) Arg(index int64) (ref.Val, error) {
+	if index >= c.args.Size().Value().(int64) {
+		return nil, fmt.Errorf("index %d out of range", index)
+	}
+	return c.args.Get(types.Int(index)), nil
+}
+
+func (c *stringArgList) Size() int64 {
+	return c.args.Size().Value().(int64)
+}
+
+// formatStringInterpolator is an interface that allows user-defined behavior
+// for formatting clause implementations, as well as argument retrieval.
+// Each function is expected to support the appropriate types as laid out in
+// the string.format documentation, and to return an error if given an inappropriate type.
+type formatStringInterpolator interface {
+	// String takes a ref.Val and a string representing the current locale identifier
+	// and returns the Val formatted as a string, or an error if one occurred.
+	String(ref.Val, string) (string, error)
+
+	// Decimal takes a ref.Val and a string representing the current locale identifier
+	// and returns the Val formatted as a decimal integer, or an error if one occurred.
+	Decimal(ref.Val, string) (string, error)
+
+	// Fixed takes an int pointer representing precision (or nil if none was given) and
+	// returns a function operating in a similar manner to String and Decimal, taking a
+	// ref.Val and locale and returning the appropriate string. A closure is returned
+	// so precision can be set without needing an additional function call/configuration.
+	Fixed(*int) func(ref.Val, string) (string, error)
+
+	// Scientific functions identically to Fixed, except the string returned from the closure
+	// is expected to be in scientific notation.
+	Scientific(*int) func(ref.Val, string) (string, error)
+
+	// Binary takes a ref.Val and a string representing the current locale identifier
+	// and returns the Val formatted as a binary integer, or an error if one occurred.
+	Binary(ref.Val, string) (string, error)
+
+	// Hex takes a boolean that, if true, indicates the hex string output by the returned
+	// closure should use uppercase letters for A-F.
+	Hex(bool) func(ref.Val, string) (string, error)
+
+	// Octal takes a ref.Val and a string representing the current locale identifier and
+	// returns the Val formatted in octal, or an error if one occurred.
+	Octal(ref.Val, string) (string, error)
+}
+
+// formatListArgs is an interface that allows user-defined list-like datatypes to be used
+// for formatting clause implementations.
+type formatListArgs interface {
+	// Arg returns the ref.Val at the given index, or an error if one occurred.
+	Arg(int64) (ref.Val, error)
+
+	// Size returns the length of the argument list.
+	Size() int64
+}
+
+// parseFormatString formats a string according to the string.format syntax, taking the clause implementations
+// from the provided FormatCallback and the args from the given FormatList.
+func parseFormatString(formatStr string, callback formatStringInterpolator, list formatListArgs, locale string) (string, error) {
+	i := 0
+	argIndex := 0
+	var builtStr strings.Builder
+	for i < len(formatStr) {
+		if formatStr[i] == '%' {
+			if i+1 < len(formatStr) && formatStr[i+1] == '%' {
+				err := builtStr.WriteByte('%')
+				if err != nil {
+					return "", fmt.Errorf("error writing format string: %w", err)
+				}
+				i += 2
+				continue
+			} else {
+				argAny, err := list.Arg(int64(argIndex))
+				if err != nil {
+					return "", err
+				}
+				if i+1 >= len(formatStr) {
+					return "", errors.New("unexpected end of string")
+				}
+				if int64(argIndex) >= list.Size() {
+					return "", fmt.Errorf("index %d out of range", argIndex)
+				}
+				numRead, val, refErr := parseAndFormatClause(formatStr[i:], argAny, callback, list, locale)
+				if refErr != nil {
+					return "", refErr
+				}
+				_, err = builtStr.WriteString(val)
+				if err != nil {
+					return "", fmt.Errorf("error writing format string: %w", err)
+				}
+				i += numRead
+				argIndex++
+			}
+		} else {
+			err := builtStr.WriteByte(formatStr[i])
+			if err != nil {
+				return "", fmt.Errorf("error writing format string: %w", err)
+			}
+			i++
+		}
+	}
+	return builtStr.String(), nil
+}
+
+// parseAndFormatClause parses the format clause at the start of the given string with val, and returns
+// how many characters were consumed and the substituted string form of val, or an error if one occurred.
+func parseAndFormatClause(formatStr string, val ref.Val, callback formatStringInterpolator, list formatListArgs, locale string) (int, string, error) {
+	i := 1
+	read, formatter, err := parseFormattingClause(formatStr[i:], callback)
+	i += read
+	if err != nil {
+		return -1, "", newParseFormatError("could not parse formatting clause", err)
+	}
+
+	valStr, err := formatter(val, locale)
+	if err != nil {
+		return -1, "", newParseFormatError("error during formatting", err)
+	}
+	return i, valStr, nil
+}
+
+func parseFormattingClause(formatStr string, callback formatStringInterpolator) (int, clauseImpl, error) {
+	i := 0
+	read, precision, err := parsePrecision(formatStr[i:])
+	i += read
+	if err != nil {
+		return -1, nil, fmt.Errorf("error while parsing precision: %w", err)
+	}
+	r := rune(formatStr[i])
+	i++
+	switch r {
+	case 's':
+		return i, callback.String, nil
+	case 'd':
+		return i, callback.Decimal, nil
+	case 'f':
+		return i, callback.Fixed(precision), nil
+	case 'e':
+		return i, callback.Scientific(precision), nil
+	case 'b':
+		return i, callback.Binary, nil
+	case 'x', 'X':
+		return i, callback.Hex(unicode.IsUpper(r)), nil
+	case 'o':
+		return i, callback.Octal, nil
+	default:
+		return -1, nil, fmt.Errorf("unrecognized formatting clause \"%c\"", r)
+	}
+}
+
+func parsePrecision(formatStr string) (int, *int, error) {
+	i := 0
+	if formatStr[i] != '.' {
+		return i, nil, nil
+	}
+	i++
+	var buffer strings.Builder
+	for {
+		if i >= len(formatStr) {
+			return -1, nil, errors.New("could not find end of precision specifier")
+		}
+		if !isASCIIDigit(rune(formatStr[i])) {
+			break
+		}
+		buffer.WriteByte(formatStr[i])
+		i++
+	}
+	precision, err := strconv.Atoi(buffer.String())
+	if err != nil {
+		return -1, nil, fmt.Errorf("error while converting precision to integer: %w", err)
+	}
+	return i, &precision, nil
+}
+
+func isASCIIDigit(r rune) bool {
+	return r <= unicode.MaxASCII && unicode.IsDigit(r)
+}
+
+type parseFormatError struct {
+	msg     string
+	wrapped error
+}
+
+func newParseFormatError(msg string, wrapped error) error {
+	return parseFormatError{msg: msg, wrapped: wrapped}
+}
+
+func (e parseFormatError) Error() string {
+	return fmt.Sprintf("%s: %s", e.msg, e.wrapped.Error())
+}
+
+func (e parseFormatError) Is(target error) bool {
+	return e.Error() == target.Error()
+}
+
+func (e parseFormatError) Unwrap() error {
+	return e.wrapped
+}
+
+const (
+	runtimeID = int64(-1)
+)
diff --git a/vendor/github.com/google/cel-go/ext/guards.go b/vendor/github.com/google/cel-go/ext/guards.go
index 4c7786a..ccede28 100644
--- a/vendor/github.com/google/cel-go/ext/guards.go
+++ b/vendor/github.com/google/cel-go/ext/guards.go
@@ -15,9 +15,9 @@
 package ext
 
 import (
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // function invocation guards for common call signatures within extension functions.
@@ -50,14 +50,18 @@ func listStringOrError(strs []string, err error) ref.Val {
 	return types.DefaultTypeAdapter.NativeToValue(strs)
 }
 
-func macroTargetMatchesNamespace(ns string, target *exprpb.Expr) bool {
-	switch target.GetExprKind().(type) {
-	case *exprpb.Expr_IdentExpr:
-		if target.GetIdentExpr().GetName() != ns {
-			return false
-		}
-		return true
+func extractIdent(target ast.Expr) (string, bool) {
+	switch target.Kind() {
+	case ast.IdentKind:
+		return target.AsIdent(), true
 	default:
-		return false
+		return "", false
 	}
 }
+
+func macroTargetMatchesNamespace(ns string, target ast.Expr) bool {
+	if id, found := extractIdent(target); found {
+		return id == ns
+	}
+	return false
+}
diff --git a/vendor/github.com/google/cel-go/ext/lists.go b/vendor/github.com/google/cel-go/ext/lists.go
new file mode 100644
index 0000000..d0b90ea
--- /dev/null
+++ b/vendor/github.com/google/cel-go/ext/lists.go
@@ -0,0 +1,560 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package ext
+
+import (
+	"fmt"
+	"math"
+	"sort"
+
+	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/decls"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
+	"github.com/google/cel-go/common/types/traits"
+	"github.com/google/cel-go/parser"
+)
+
+var comparableTypes = []*cel.Type{
+	cel.IntType,
+	cel.UintType,
+	cel.DoubleType,
+	cel.BoolType,
+	cel.DurationType,
+	cel.TimestampType,
+	cel.StringType,
+	cel.BytesType,
+}
+
+// Lists returns a cel.EnvOption to configure extended functions for list manipulation.
+// As a general note, all indices are zero-based.
+//
+// # Distinct
+//
+// Introduced in version: 2
+//
+// Returns the distinct elements of a list.
+//
+//	<list(T)>.distinct() -> <list(T)>
+//
+// Examples:
+//
+//	[1, 2, 2, 3, 3, 3].distinct() // return [1, 2, 3]
+//	["b", "b", "c", "a", "c"].distinct() // return ["b", "c", "a"]
+//	[1, "b", 2, "b"].distinct() // return [1, "b", 2]
+//
+// # Range
+//
+// Introduced in version: 2
+//
+// Returns a list of integers from 0 to n-1.
+//
+//	lists.range(<int>) -> <list(int)>
+//
+// Examples:
+//
+//	lists.range(5) -> [0, 1, 2, 3, 4]
+//
+// # Reverse
+//
+// Introduced in version: 2
+//
+// Returns the elements of a list in reverse order.
+//
+//	<list(T)>.reverse() -> <list(T)>
+//
+// Examples:
+//
+//	[5, 3, 1, 2].reverse() // return [2, 1, 3, 5]
+//
+// # Slice
+//
+// Returns a new sub-list using the indexes provided.
+//
+//	<list>.slice(<int>, <int>) -> <list>
+//
+// Examples:
+//
+//	[1,2,3,4].slice(1, 3) // return [2, 3]
+//	[1,2,3,4].slice(2, 4) // return [3 ,4]
+//
+// # Flatten
+//
+// Flattens a list recursively.
+// If an optional depth is provided, the list is flattened to a the specificied level.
+// A negative depth value will result in an error.
+//
+//	<list>.flatten(<list>) -> <list>
+//	<list>.flatten(<list>, <int>) -> <list>
+//
+// Examples:
+//
+// [1,[2,3],[4]].flatten() // return [1, 2, 3, 4]
+// [1,[2,[3,4]]].flatten() // return [1, 2, [3, 4]]
+// [1,2,[],[],[3,4]].flatten() // return [1, 2, 3, 4]
+// [1,[2,[3,[4]]]].flatten(2) // return [1, 2, 3, [4]]
+// [1,[2,[3,[4]]]].flatten(-1) // error
+//
+// # Sort
+//
+// Introduced in version: 2
+//
+// Sorts a list with comparable elements. If the element type is not comparable
+// or the element types are not the same, the function will produce an error.
+//
+//	<list(T)>.sort() -> <list(T)>
+//	T in {int, uint, double, bool, duration, timestamp, string, bytes}
+//
+// Examples:
+//
+//	[3, 2, 1].sort() // return [1, 2, 3]
+//	["b", "c", "a"].sort() // return ["a", "b", "c"]
+//	[1, "b"].sort() // error
+//	[[1, 2, 3]].sort() // error
+//
+// # SortBy
+//
+// Sorts a list by a key value, i.e., the order is determined by the result of
+// an expression applied to each element of the list.
+// The output of the key expression must be a comparable type, otherwise the
+// function will return an error.
+//
+//	<list(T)>.sortBy(<bindingName>, <keyExpr>) -> <list(T)>
+//	keyExpr returns a value in {int, uint, double, bool, duration, timestamp, string, bytes}
+
+// Examples:
+//
+//	[
+//	  Player { name: "foo", score: 0 },
+//	  Player { name: "bar", score: -10 },
+//	  Player { name: "baz", score: 1000 },
+//	].sortBy(e, e.score).map(e, e.name)
+//	== ["bar", "foo", "baz"]
+
+func Lists(options ...ListsOption) cel.EnvOption {
+	l := &listsLib{
+		version: math.MaxUint32,
+	}
+	for _, o := range options {
+		l = o(l)
+	}
+
+	return cel.Lib(l)
+}
+
+type listsLib struct {
+	version uint32
+}
+
+// LibraryName implements the SingletonLibrary interface method.
+func (listsLib) LibraryName() string {
+	return "cel.lib.ext.lists"
+}
+
+// ListsOption is a functional interface for configuring the strings library.
+type ListsOption func(*listsLib) *listsLib
+
+// ListsVersion configures the version of the string library.
+//
+// The version limits which functions are available. Only functions introduced
+// below or equal to the given version included in the library. If this option
+// is not set, all functions are available.
+//
+// See the library documentation to determine which version a function was introduced.
+// If the documentation does not state which version a function was introduced, it can
+// be assumed to be introduced at version 0, when the library was first created.
+func ListsVersion(version uint32) ListsOption {
+	return func(lib *listsLib) *listsLib {
+		lib.version = version
+		return lib
+	}
+}
+
+// CompileOptions implements the Library interface method.
+func (lib listsLib) CompileOptions() []cel.EnvOption {
+	listType := cel.ListType(cel.TypeParamType("T"))
+	listListType := cel.ListType(listType)
+	listDyn := cel.ListType(cel.DynType)
+	opts := []cel.EnvOption{
+		cel.Function("slice",
+			cel.MemberOverload("list_slice",
+				[]*cel.Type{listType, cel.IntType, cel.IntType}, listType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					list := args[0].(traits.Lister)
+					start := args[1].(types.Int)
+					end := args[2].(types.Int)
+					result, err := slice(list, start, end)
+					if err != nil {
+						return types.WrapErr(err)
+					}
+					return result
+				}),
+			),
+		),
+	}
+	if lib.version >= 1 {
+		opts = append(opts,
+			cel.Function("flatten",
+				cel.MemberOverload("list_flatten",
+					[]*cel.Type{listListType}, listType,
+					cel.UnaryBinding(func(arg ref.Val) ref.Val {
+						list, ok := arg.(traits.Lister)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg)
+						}
+						flatList, err := flatten(list, 1)
+						if err != nil {
+							return types.WrapErr(err)
+						}
+
+						return types.DefaultTypeAdapter.NativeToValue(flatList)
+					}),
+				),
+				cel.MemberOverload("list_flatten_int",
+					[]*cel.Type{listDyn, types.IntType}, listDyn,
+					cel.BinaryBinding(func(arg1, arg2 ref.Val) ref.Val {
+						list, ok := arg1.(traits.Lister)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg1)
+						}
+						depth, ok := arg2.(types.Int)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg2)
+						}
+						flatList, err := flatten(list, int64(depth))
+						if err != nil {
+							return types.WrapErr(err)
+						}
+
+						return types.DefaultTypeAdapter.NativeToValue(flatList)
+					}),
+				),
+				// To handle the case where a variable of just `list(T)` is provided at runtime
+				// with a graceful failure more, disable the type guards since the implementation
+				// can handle lists which are already flat.
+				decls.DisableTypeGuards(true),
+			),
+		)
+	}
+	if lib.version >= 2 {
+		sortDecl := cel.Function("sort",
+			append(
+				templatedOverloads(comparableTypes, func(t *cel.Type) cel.FunctionOpt {
+					return cel.MemberOverload(
+						fmt.Sprintf("list_%s_sort", t.TypeName()),
+						[]*cel.Type{cel.ListType(t)}, cel.ListType(t),
+					)
+				}),
+				cel.SingletonUnaryBinding(
+					func(arg ref.Val) ref.Val {
+						list, ok := arg.(traits.Lister)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg)
+						}
+						sorted, err := sortList(list)
+						if err != nil {
+							return types.WrapErr(err)
+						}
+
+						return sorted
+					},
+					// List traits
+					traits.ListerType,
+				),
+			)...,
+		)
+		opts = append(opts, sortDecl)
+		opts = append(opts, cel.Macros(cel.ReceiverMacro("sortBy", 2, sortByMacro)))
+		opts = append(opts, cel.Function("@sortByAssociatedKeys",
+			append(
+				templatedOverloads(comparableTypes, func(u *cel.Type) cel.FunctionOpt {
+					return cel.MemberOverload(
+						fmt.Sprintf("list_%s_sortByAssociatedKeys", u.TypeName()),
+						[]*cel.Type{listType, cel.ListType(u)}, listType,
+					)
+				}),
+				cel.SingletonBinaryBinding(
+					func(arg1 ref.Val, arg2 ref.Val) ref.Val {
+						list, ok := arg1.(traits.Lister)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg1)
+						}
+						keys, ok := arg2.(traits.Lister)
+						if !ok {
+							return types.MaybeNoSuchOverloadErr(arg2)
+						}
+						sorted, err := sortListByAssociatedKeys(list, keys)
+						if err != nil {
+							return types.WrapErr(err)
+						}
+
+						return sorted
+					},
+					// List traits
+					traits.ListerType,
+				),
+			)...,
+		))
+
+		opts = append(opts, cel.Function("lists.range",
+			cel.Overload("lists_range",
+				[]*cel.Type{cel.IntType}, cel.ListType(cel.IntType),
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					n := args[0].(types.Int)
+					result, err := genRange(n)
+					if err != nil {
+						return types.WrapErr(err)
+					}
+					return result
+				}),
+			),
+		))
+		opts = append(opts, cel.Function("reverse",
+			cel.MemberOverload("list_reverse",
+				[]*cel.Type{listType}, listType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					list := args[0].(traits.Lister)
+					result, err := reverseList(list)
+					if err != nil {
+						return types.WrapErr(err)
+					}
+					return result
+				}),
+			),
+		))
+		opts = append(opts, cel.Function("distinct",
+			cel.MemberOverload("list_distinct",
+				[]*cel.Type{listType}, listType,
+				cel.UnaryBinding(func(list ref.Val) ref.Val {
+					result, err := distinctList(list.(traits.Lister))
+					if err != nil {
+						return types.WrapErr(err)
+					}
+					return result
+				}),
+			),
+		))
+	}
+
+	return opts
+}
+
+// ProgramOptions implements the Library interface method.
+func (listsLib) ProgramOptions() []cel.ProgramOption {
+	return []cel.ProgramOption{}
+}
+
+func genRange(n types.Int) (ref.Val, error) {
+	var newList []ref.Val
+	for i := types.Int(0); i < n; i++ {
+		newList = append(newList, i)
+	}
+	return types.DefaultTypeAdapter.NativeToValue(newList), nil
+}
+
+func reverseList(list traits.Lister) (ref.Val, error) {
+	var newList []ref.Val
+	listLength := list.Size().(types.Int)
+	for i := types.Int(0); i < listLength; i++ {
+		val := list.Get(listLength - i - 1)
+		newList = append(newList, val)
+	}
+	return types.DefaultTypeAdapter.NativeToValue(newList), nil
+}
+
+func slice(list traits.Lister, start, end types.Int) (ref.Val, error) {
+	listLength := list.Size().(types.Int)
+	if start < 0 || end < 0 {
+		return nil, fmt.Errorf("cannot slice(%d, %d), negative indexes not supported", start, end)
+	}
+	if start > end {
+		return nil, fmt.Errorf("cannot slice(%d, %d), start index must be less than or equal to end index", start, end)
+	}
+	if listLength < end {
+		return nil, fmt.Errorf("cannot slice(%d, %d), list is length %d", start, end, listLength)
+	}
+
+	var newList []ref.Val
+	for i := types.Int(start); i < end; i++ {
+		val := list.Get(i)
+		newList = append(newList, val)
+	}
+	return types.DefaultTypeAdapter.NativeToValue(newList), nil
+}
+
+func flatten(list traits.Lister, depth int64) ([]ref.Val, error) {
+	if depth < 0 {
+		return nil, fmt.Errorf("level must be non-negative")
+	}
+
+	var newList []ref.Val
+	iter := list.Iterator()
+
+	for iter.HasNext() == types.True {
+		val := iter.Next()
+		nestedList, isList := val.(traits.Lister)
+
+		if !isList || depth == 0 {
+			newList = append(newList, val)
+			continue
+		} else {
+			flattenedList, err := flatten(nestedList, depth-1)
+			if err != nil {
+				return nil, err
+			}
+
+			newList = append(newList, flattenedList...)
+		}
+	}
+
+	return newList, nil
+}
+
+func sortList(list traits.Lister) (ref.Val, error) {
+	return sortListByAssociatedKeys(list, list)
+}
+
+// Internal function used for the implementation of sort() and sortBy().
+//
+// Sorts a list of arbitrary elements, according to the order produced by sorting
+// another list of comparable elements. If the element type of the keys is not
+// comparable or the element types are not the same, the function will produce an error.
+//
+//	<list(T)>.@sortByAssociatedKeys(<list(U)>) -> <list(T)>
+//	U in {int, uint, double, bool, duration, timestamp, string, bytes}
+//
+// Example:
+//
+//	["foo", "bar", "baz"].@sortByAssociatedKeys([3, 1, 2]) // return ["bar", "baz", "foo"]
+func sortListByAssociatedKeys(list, keys traits.Lister) (ref.Val, error) {
+	listLength := list.Size().(types.Int)
+	keysLength := keys.Size().(types.Int)
+	if listLength != keysLength {
+		return nil, fmt.Errorf(
+			"@sortByAssociatedKeys() expected a list of the same size as the associated keys list, but got %d and %d elements respectively",
+			listLength,
+			keysLength,
+		)
+	}
+	if listLength == 0 {
+		return list, nil
+	}
+	elem := keys.Get(types.IntZero)
+	if _, ok := elem.(traits.Comparer); !ok {
+		return nil, fmt.Errorf("list elements must be comparable")
+	}
+
+	sortedIndices := make([]ref.Val, 0, listLength)
+	for i := types.IntZero; i < listLength; i++ {
+		if keys.Get(i).Type() != elem.Type() {
+			return nil, fmt.Errorf("list elements must have the same type")
+		}
+		sortedIndices = append(sortedIndices, i)
+	}
+
+	sort.Slice(sortedIndices, func(i, j int) bool {
+		iKey := keys.Get(sortedIndices[i])
+		jKey := keys.Get(sortedIndices[j])
+		return iKey.(traits.Comparer).Compare(jKey) == types.IntNegOne
+	})
+
+	sorted := make([]ref.Val, 0, listLength)
+
+	for _, sortedIdx := range sortedIndices {
+		sorted = append(sorted, list.Get(sortedIdx))
+	}
+	return types.DefaultTypeAdapter.NativeToValue(sorted), nil
+}
+
+// sortByMacro transforms an expression like:
+//
+//	mylistExpr.sortBy(e, -math.abs(e))
+//
+// into something equivalent to:
+//
+//	cel.bind(
+//	   __sortBy_input__,
+//	   myListExpr,
+//	   __sortBy_input__.@sortByAssociatedKeys(__sortBy_input__.map(e, -math.abs(e))
+//	)
+func sortByMacro(meh cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
+	varIdent := meh.NewIdent("@__sortBy_input__")
+	varName := varIdent.AsIdent()
+
+	targetKind := target.Kind()
+	if targetKind != ast.ListKind &&
+		targetKind != ast.SelectKind &&
+		targetKind != ast.IdentKind &&
+		targetKind != ast.ComprehensionKind && targetKind != ast.CallKind {
+		return nil, meh.NewError(target.ID(), fmt.Sprintf("sortBy can only be applied to a list, identifier, comprehension, call or select expression"))
+	}
+
+	mapCompr, err := parser.MakeMap(meh, meh.Copy(varIdent), args)
+	if err != nil {
+		return nil, err
+	}
+	callExpr := meh.NewMemberCall("@sortByAssociatedKeys",
+		meh.Copy(varIdent),
+		mapCompr,
+	)
+
+	bindExpr := meh.NewComprehension(
+		meh.NewList(),
+		"#unused",
+		varName,
+		target,
+		meh.NewLiteral(types.False),
+		varIdent,
+		callExpr,
+	)
+
+	return bindExpr, nil
+}
+
+func distinctList(list traits.Lister) (ref.Val, error) {
+	listLength := list.Size().(types.Int)
+	if listLength == 0 {
+		return list, nil
+	}
+	uniqueList := make([]ref.Val, 0, listLength)
+	for i := types.IntZero; i < listLength; i++ {
+		val := list.Get(i)
+		seen := false
+		for j := types.IntZero; j < types.Int(len(uniqueList)); j++ {
+			if i == j {
+				continue
+			}
+			other := uniqueList[j]
+			if val.Equal(other) == types.True {
+				seen = true
+				break
+			}
+		}
+		if !seen {
+			uniqueList = append(uniqueList, val)
+		}
+	}
+
+	return types.DefaultTypeAdapter.NativeToValue(uniqueList), nil
+}
+
+func templatedOverloads(types []*cel.Type, template func(t *cel.Type) cel.FunctionOpt) []cel.FunctionOpt {
+	overloads := make([]cel.FunctionOpt, len(types))
+	for i, t := range types {
+		overloads[i] = template(t)
+	}
+	return overloads
+}
diff --git a/vendor/github.com/google/cel-go/ext/math.go b/vendor/github.com/google/cel-go/ext/math.go
index 1c8ad58..250246d 100644
--- a/vendor/github.com/google/cel-go/ext/math.go
+++ b/vendor/github.com/google/cel-go/ext/math.go
@@ -16,14 +16,14 @@ package ext
 
 import (
 	"fmt"
+	"math"
 	"strings"
 
 	"github.com/google/cel-go/cel"
-	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // Math returns a cel.EnvOption to configure namespaced math helper macros and
@@ -87,33 +87,317 @@ import (
 //	math.least('string') // parse error
 //	math.least(a, b)     // check-time error if a or b is non-numeric
 //	math.least(dyn('string')) // runtime error
-func Math() cel.EnvOption {
-	return cel.Lib(mathLib{})
+//
+// # Math.BitOr
+//
+// Introduced at version: 1
+//
+// Performs a bitwise-OR operation over two int or uint values.
+//
+//	math.bitOr(<int>, <int>) -> <int>
+//	math.bitOr(<uint>, <uint>) -> <uint>
+//
+// Examples:
+//
+//	math.bitOr(1u, 2u)    // returns 3u
+//	math.bitOr(-2, -4)    // returns -2
+//
+// # Math.BitAnd
+//
+// Introduced at version: 1
+//
+// Performs a bitwise-AND operation over two int or uint values.
+//
+//	math.bitAnd(<int>, <int>) -> <int>
+//	math.bitAnd(<uint>, <uint>) -> <uint>
+//
+// Examples:
+//
+//	math.bitAnd(3u, 2u)   // return 2u
+//	math.bitAnd(3, 5)     // returns 3
+//	math.bitAnd(-3, -5)   // returns -7
+//
+// # Math.BitXor
+//
+// Introduced at version: 1
+//
+//	math.bitXor(<int>, <int>) -> <int>
+//	math.bitXor(<uint>, <uint>) -> <uint>
+//
+// Performs a bitwise-XOR operation over two int or uint values.
+//
+// Examples:
+//
+//	math.bitXor(3u, 5u) // returns 6u
+//	math.bitXor(1, 3)   // returns 2
+//
+// # Math.BitNot
+//
+// Introduced at version: 1
+//
+// Function which accepts a single int or uint and performs a bitwise-NOT
+// ones-complement of the given binary value.
+//
+//	math.bitNot(<int>) -> <int>
+//	math.bitNot(<uint>) -> <uint>
+//
+// Examples
+//
+//	math.bitNot(1)  // returns -1
+//	math.bitNot(-1) // return 0
+//	math.bitNot(0u) // returns 18446744073709551615u
+//
+// # Math.BitShiftLeft
+//
+// Introduced at version: 1
+//
+// Perform a left shift of bits on the first parameter, by the amount of bits
+// specified in the second parameter. The first parameter is either a uint or
+// an int. The second parameter must be an int.
+//
+// When the second parameter is 64 or greater, 0 will be always be returned
+// since the number of bits shifted is greater than or equal to the total bit
+// length of the number being shifted. Negative valued bit shifts will result
+// in a runtime error.
+//
+//	math.bitShiftLeft(<int>, <int>) -> <int>
+//	math.bitShiftLeft(<uint>, <int>) -> <uint>
+//
+// Examples
+//
+//	math.bitShiftLeft(1, 2)    // returns 4
+//	math.bitShiftLeft(-1, 2)   // returns -4
+//	math.bitShiftLeft(1u, 2)   // return 4u
+//	math.bitShiftLeft(1u, 200) // returns 0u
+//
+// # Math.BitShiftRight
+//
+// Introduced at version: 1
+//
+// Perform a right shift of bits on the first parameter, by the amount of bits
+// specified in the second parameter. The first parameter is either a uint or
+// an int. The second parameter must be an int.
+//
+// When the second parameter is 64 or greater, 0 will always be returned since
+// the number of bits shifted is greater than or equal to the total bit length
+// of the number being shifted. Negative valued bit shifts will result in a
+// runtime error.
+//
+// The sign bit extension will not be preserved for this operation: vacant bits
+// on the left are filled with 0.
+//
+//	math.bitShiftRight(<int>, <int>) -> <int>
+//	math.bitShiftRight(<uint>, <int>) -> <uint>
+//
+// Examples
+//
+//	math.bitShiftRight(1024, 2)    // returns 256
+//	math.bitShiftRight(1024u, 2)   // returns 256u
+//	math.bitShiftRight(1024u, 64)  // returns 0u
+//
+// # Math.Ceil
+//
+// Introduced at version: 1
+//
+// Compute the ceiling of a double value.
+//
+//	math.ceil(<double>) -> <double>
+//
+// Examples:
+//
+//	math.ceil(1.2)   // returns 2.0
+//	math.ceil(-1.2)  // returns -1.0
+//
+// # Math.Floor
+//
+// Introduced at version: 1
+//
+// Compute the floor of a double value.
+//
+//	math.floor(<double>) -> <double>
+//
+// Examples:
+//
+//	math.floor(1.2)   // returns 1.0
+//	math.floor(-1.2)  // returns -2.0
+//
+// # Math.Round
+//
+// Introduced at version: 1
+//
+// Rounds the double value to the nearest whole number with ties rounding away
+// from zero, e.g. 1.5 -> 2.0, -1.5 -> -2.0.
+//
+//	math.round(<double>) -> <double>
+//
+// Examples:
+//
+//	math.round(1.2)  // returns 1.0
+//	math.round(1.5)  // returns 2.0
+//	math.round(-1.5) // returns -2.0
+//
+// # Math.Trunc
+//
+// Introduced at version: 1
+//
+// Truncates the fractional portion of the double value.
+//
+//	math.trunc(<double>) -> <double>
+//
+// Examples:
+//
+//	math.trunc(-1.3)  // returns -1.0
+//	math.trunc(1.3)   // returns 1.0
+//
+// # Math.Abs
+//
+// Introduced at version: 1
+//
+// Returns the absolute value of the numeric type provided as input. If the
+// value is NaN, the output is NaN. If the input is int64 min, the function
+// will result in an overflow error.
+//
+//	math.abs(<double>) -> <double>
+//	math.abs(<int>) -> <int>
+//	math.abs(<uint>) -> <uint>
+//
+// Examples:
+//
+//	math.abs(-1)  // returns 1
+//	math.abs(1)   // returns 1
+//	math.abs(-9223372036854775808) // overflow error
+//
+// # Math.Sign
+//
+// Introduced at version: 1
+//
+// Returns the sign of the numeric type, either -1, 0, 1 as an int, double, or
+// uint depending on the overload. For floating point values, if NaN is
+// provided as input, the output is also NaN. The implementation does not
+// differentiate between positive and negative zero.
+//
+//	math.sign(<double>) -> <double>
+//	math.sign(<int>) -> <int>
+//	math.sign(<uint>) -> <uint>
+//
+// Examples:
+//
+//	math.sign(-42) // returns -1
+//	math.sign(0)   // returns 0
+//	math.sign(42)  // returns 1
+//
+// # Math.IsInf
+//
+// Introduced at version: 1
+//
+// Returns true if the input double value is -Inf or +Inf.
+//
+//	math.isInf(<double>) -> <bool>
+//
+// Examples:
+//
+//	math.isInf(1.0/0.0)  // returns true
+//	math.isInf(1.2)      // returns false
+//
+// # Math.IsNaN
+//
+// Introduced at version: 1
+//
+// Returns true if the input double value is NaN, false otherwise.
+//
+//	math.isNaN(<double>) -> <bool>
+//
+// Examples:
+//
+//	math.isNaN(0.0/0.0)  // returns true
+//	math.isNaN(1.2)      // returns false
+//
+// # Math.IsFinite
+//
+// Introduced at version: 1
+//
+// Returns true if the value is a finite number. Equivalent in behavior to:
+// !math.isNaN(double) && !math.isInf(double)
+//
+//	math.isFinite(<double>) -> <bool>
+//
+// Examples:
+//
+//	math.isFinite(0.0/0.0)  // returns false
+//	math.isFinite(1.2)      // returns true
+func Math(options ...MathOption) cel.EnvOption {
+	m := &mathLib{version: math.MaxUint32}
+	for _, o := range options {
+		m = o(m)
+	}
+	return cel.Lib(m)
 }
 
 const (
 	mathNamespace = "math"
 	leastMacro    = "least"
 	greatestMacro = "greatest"
-	minFunc       = "math.@min"
-	maxFunc       = "math.@max"
+
+	// Min-max functions
+	minFunc = "math.@min"
+	maxFunc = "math.@max"
+
+	// Rounding functions
+	ceilFunc  = "math.ceil"
+	floorFunc = "math.floor"
+	roundFunc = "math.round"
+	truncFunc = "math.trunc"
+
+	// Floating point helper functions
+	isInfFunc    = "math.isInf"
+	isNanFunc    = "math.isNaN"
+	isFiniteFunc = "math.isFinite"
+
+	// Signedness functions
+	absFunc  = "math.abs"
+	signFunc = "math.sign"
+
+	// Bitwise functions
+	bitAndFunc        = "math.bitAnd"
+	bitOrFunc         = "math.bitOr"
+	bitXorFunc        = "math.bitXor"
+	bitNotFunc        = "math.bitNot"
+	bitShiftLeftFunc  = "math.bitShiftLeft"
+	bitShiftRightFunc = "math.bitShiftRight"
+)
+
+var (
+	errIntOverflow = types.NewErr("integer overflow")
 )
 
-type mathLib struct{}
+// MathOption declares a functional operator for configuring math extensions.
+type MathOption func(*mathLib) *mathLib
+
+// MathVersion sets the library version for math extensions.
+func MathVersion(version uint32) MathOption {
+	return func(lib *mathLib) *mathLib {
+		lib.version = version
+		return lib
+	}
+}
+
+type mathLib struct {
+	version uint32
+}
 
 // LibraryName implements the SingletonLibrary interface method.
-func (mathLib) LibraryName() string {
+func (*mathLib) LibraryName() string {
 	return "cel.lib.ext.math"
 }
 
 // CompileOptions implements the Library interface method.
-func (mathLib) CompileOptions() []cel.EnvOption {
-	return []cel.EnvOption{
+func (lib *mathLib) CompileOptions() []cel.EnvOption {
+	opts := []cel.EnvOption{
 		cel.Macros(
 			// math.least(num, ...)
-			cel.NewReceiverVarArgMacro(leastMacro, mathLeast),
+			cel.ReceiverVarArgMacro(leastMacro, mathLeast),
 			// math.greatest(num, ...)
-			cel.NewReceiverVarArgMacro(greatestMacro, mathGreatest),
+			cel.ReceiverVarArgMacro(greatestMacro, mathGreatest),
 		),
 		cel.Function(minFunc,
 			cel.Overload("math_@min_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
@@ -180,76 +464,149 @@ func (mathLib) CompileOptions() []cel.EnvOption {
 				cel.UnaryBinding(maxList)),
 		),
 	}
+	if lib.version >= 1 {
+		opts = append(opts,
+			// Rounding function declarations
+			cel.Function(ceilFunc,
+				cel.Overload("math_ceil_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(ceil))),
+			cel.Function(floorFunc,
+				cel.Overload("math_floor_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(floor))),
+			cel.Function(roundFunc,
+				cel.Overload("math_round_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(round))),
+			cel.Function(truncFunc,
+				cel.Overload("math_trunc_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(trunc))),
+
+			// Floating point helpers
+			cel.Function(isInfFunc,
+				cel.Overload("math_isInf_double", []*cel.Type{cel.DoubleType}, cel.BoolType,
+					cel.UnaryBinding(isInf))),
+			cel.Function(isNanFunc,
+				cel.Overload("math_isNaN_double", []*cel.Type{cel.DoubleType}, cel.BoolType,
+					cel.UnaryBinding(isNaN))),
+			cel.Function(isFiniteFunc,
+				cel.Overload("math_isFinite_double", []*cel.Type{cel.DoubleType}, cel.BoolType,
+					cel.UnaryBinding(isFinite))),
+
+			// Signedness functions
+			cel.Function(absFunc,
+				cel.Overload("math_abs_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(absDouble)),
+				cel.Overload("math_abs_int", []*cel.Type{cel.IntType}, cel.IntType,
+					cel.UnaryBinding(absInt)),
+				cel.Overload("math_abs_uint", []*cel.Type{cel.UintType}, cel.UintType,
+					cel.UnaryBinding(identity)),
+			),
+			cel.Function(signFunc,
+				cel.Overload("math_sign_double", []*cel.Type{cel.DoubleType}, cel.DoubleType,
+					cel.UnaryBinding(sign)),
+				cel.Overload("math_sign_int", []*cel.Type{cel.IntType}, cel.IntType,
+					cel.UnaryBinding(sign)),
+				cel.Overload("math_sign_uint", []*cel.Type{cel.UintType}, cel.UintType,
+					cel.UnaryBinding(sign)),
+			),
+
+			// Bitwise operator declarations
+			cel.Function(bitAndFunc,
+				cel.Overload("math_bitAnd_int_int", []*cel.Type{cel.IntType, cel.IntType}, cel.IntType,
+					cel.BinaryBinding(bitAndPairInt)),
+				cel.Overload("math_bitAnd_uint_uint", []*cel.Type{cel.UintType, cel.UintType}, cel.UintType,
+					cel.BinaryBinding(bitAndPairUint)),
+			),
+			cel.Function(bitOrFunc,
+				cel.Overload("math_bitOr_int_int", []*cel.Type{cel.IntType, cel.IntType}, cel.IntType,
+					cel.BinaryBinding(bitOrPairInt)),
+				cel.Overload("math_bitOr_uint_uint", []*cel.Type{cel.UintType, cel.UintType}, cel.UintType,
+					cel.BinaryBinding(bitOrPairUint)),
+			),
+			cel.Function(bitXorFunc,
+				cel.Overload("math_bitXor_int_int", []*cel.Type{cel.IntType, cel.IntType}, cel.IntType,
+					cel.BinaryBinding(bitXorPairInt)),
+				cel.Overload("math_bitXor_uint_uint", []*cel.Type{cel.UintType, cel.UintType}, cel.UintType,
+					cel.BinaryBinding(bitXorPairUint)),
+			),
+			cel.Function(bitNotFunc,
+				cel.Overload("math_bitNot_int_int", []*cel.Type{cel.IntType}, cel.IntType,
+					cel.UnaryBinding(bitNotInt)),
+				cel.Overload("math_bitNot_uint_uint", []*cel.Type{cel.UintType}, cel.UintType,
+					cel.UnaryBinding(bitNotUint)),
+			),
+			cel.Function(bitShiftLeftFunc,
+				cel.Overload("math_bitShiftLeft_int_int", []*cel.Type{cel.IntType, cel.IntType}, cel.IntType,
+					cel.BinaryBinding(bitShiftLeftIntInt)),
+				cel.Overload("math_bitShiftLeft_uint_int", []*cel.Type{cel.UintType, cel.IntType}, cel.UintType,
+					cel.BinaryBinding(bitShiftLeftUintInt)),
+			),
+			cel.Function(bitShiftRightFunc,
+				cel.Overload("math_bitShiftRight_int_int", []*cel.Type{cel.IntType, cel.IntType}, cel.IntType,
+					cel.BinaryBinding(bitShiftRightIntInt)),
+				cel.Overload("math_bitShiftRight_uint_int", []*cel.Type{cel.UintType, cel.IntType}, cel.UintType,
+					cel.BinaryBinding(bitShiftRightUintInt)),
+			),
+		)
+	}
+	return opts
 }
 
 // ProgramOptions implements the Library interface method.
-func (mathLib) ProgramOptions() []cel.ProgramOption {
+func (*mathLib) ProgramOptions() []cel.ProgramOption {
 	return []cel.ProgramOption{}
 }
 
-func mathLeast(meh cel.MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func mathLeast(meh cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
 	if !macroTargetMatchesNamespace(mathNamespace, target) {
 		return nil, nil
 	}
 	switch len(args) {
 	case 0:
-		return nil, &common.Error{
-			Message:  "math.least() requires at least one argument",
-			Location: meh.OffsetLocation(target.GetId()),
-		}
+		return nil, meh.NewError(target.ID(), "math.least() requires at least one argument")
 	case 1:
-		if isListLiteralWithValidArgs(args[0]) || isValidArgType(args[0]) {
-			return meh.GlobalCall(minFunc, args[0]), nil
-		}
-		return nil, &common.Error{
-			Message:  "math.least() invalid single argument value",
-			Location: meh.OffsetLocation(args[0].GetId()),
+		if isListLiteralWithNumericArgs(args[0]) || isNumericArgType(args[0]) {
+			return meh.NewCall(minFunc, args[0]), nil
 		}
+		return nil, meh.NewError(args[0].ID(), "math.least() invalid single argument value")
 	case 2:
 		err := checkInvalidArgs(meh, "math.least()", args)
 		if err != nil {
 			return nil, err
 		}
-		return meh.GlobalCall(minFunc, args...), nil
+		return meh.NewCall(minFunc, args...), nil
 	default:
 		err := checkInvalidArgs(meh, "math.least()", args)
 		if err != nil {
 			return nil, err
 		}
-		return meh.GlobalCall(minFunc, meh.NewList(args...)), nil
+		return meh.NewCall(minFunc, meh.NewList(args...)), nil
 	}
 }
 
-func mathGreatest(meh cel.MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func mathGreatest(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
 	if !macroTargetMatchesNamespace(mathNamespace, target) {
 		return nil, nil
 	}
 	switch len(args) {
 	case 0:
-		return nil, &common.Error{
-			Message:  "math.greatest() requires at least one argument",
-			Location: meh.OffsetLocation(target.GetId()),
-		}
+		return nil, mef.NewError(target.ID(), "math.greatest() requires at least one argument")
 	case 1:
-		if isListLiteralWithValidArgs(args[0]) || isValidArgType(args[0]) {
-			return meh.GlobalCall(maxFunc, args[0]), nil
-		}
-		return nil, &common.Error{
-			Message:  "math.greatest() invalid single argument value",
-			Location: meh.OffsetLocation(args[0].GetId()),
+		if isListLiteralWithNumericArgs(args[0]) || isNumericArgType(args[0]) {
+			return mef.NewCall(maxFunc, args[0]), nil
 		}
+		return nil, mef.NewError(args[0].ID(), "math.greatest() invalid single argument value")
 	case 2:
-		err := checkInvalidArgs(meh, "math.greatest()", args)
+		err := checkInvalidArgs(mef, "math.greatest()", args)
 		if err != nil {
 			return nil, err
 		}
-		return meh.GlobalCall(maxFunc, args...), nil
+		return mef.NewCall(maxFunc, args...), nil
 	default:
-		err := checkInvalidArgs(meh, "math.greatest()", args)
+		err := checkInvalidArgs(mef, "math.greatest()", args)
 		if err != nil {
 			return nil, err
 		}
-		return meh.GlobalCall(maxFunc, meh.NewList(args...)), nil
+		return mef.NewCall(maxFunc, mef.NewList(args...)), nil
 	}
 }
 
@@ -257,6 +614,165 @@ func identity(val ref.Val) ref.Val {
 	return val
 }
 
+func ceil(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Double(math.Ceil(float64(v)))
+}
+
+func floor(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Double(math.Floor(float64(v)))
+}
+
+func round(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Double(math.Round(float64(v)))
+}
+
+func trunc(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Double(math.Trunc(float64(v)))
+}
+
+func isInf(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Bool(math.IsInf(float64(v), 0))
+}
+
+func isFinite(val ref.Val) ref.Val {
+	v := float64(val.(types.Double))
+	return types.Bool(!math.IsInf(v, 0) && !math.IsNaN(v))
+}
+
+func isNaN(val ref.Val) ref.Val {
+	v := val.(types.Double)
+	return types.Bool(math.IsNaN(float64(v)))
+}
+
+func absDouble(val ref.Val) ref.Val {
+	v := float64(val.(types.Double))
+	return types.Double(math.Abs(v))
+}
+
+func absInt(val ref.Val) ref.Val {
+	v := int64(val.(types.Int))
+	if v == math.MinInt64 {
+		return errIntOverflow
+	}
+	if v >= 0 {
+		return val
+	}
+	return -types.Int(v)
+}
+
+func sign(val ref.Val) ref.Val {
+	switch v := val.(type) {
+	case types.Double:
+		if isNaN(v) == types.True {
+			return v
+		}
+		zero := types.Double(0)
+		if v > zero {
+			return types.Double(1)
+		}
+		if v < zero {
+			return types.Double(-1)
+		}
+		return zero
+	case types.Int:
+		return v.Compare(types.IntZero)
+	case types.Uint:
+		if v == types.Uint(0) {
+			return types.Uint(0)
+		}
+		return types.Uint(1)
+	default:
+		return maybeSuffixError(val, "math.sign")
+	}
+}
+
+func bitAndPairInt(first, second ref.Val) ref.Val {
+	l := first.(types.Int)
+	r := second.(types.Int)
+	return l & r
+}
+
+func bitAndPairUint(first, second ref.Val) ref.Val {
+	l := first.(types.Uint)
+	r := second.(types.Uint)
+	return l & r
+}
+
+func bitOrPairInt(first, second ref.Val) ref.Val {
+	l := first.(types.Int)
+	r := second.(types.Int)
+	return l | r
+}
+
+func bitOrPairUint(first, second ref.Val) ref.Val {
+	l := first.(types.Uint)
+	r := second.(types.Uint)
+	return l | r
+}
+
+func bitXorPairInt(first, second ref.Val) ref.Val {
+	l := first.(types.Int)
+	r := second.(types.Int)
+	return l ^ r
+}
+
+func bitXorPairUint(first, second ref.Val) ref.Val {
+	l := first.(types.Uint)
+	r := second.(types.Uint)
+	return l ^ r
+}
+
+func bitNotInt(value ref.Val) ref.Val {
+	v := value.(types.Int)
+	return ^v
+}
+
+func bitNotUint(value ref.Val) ref.Val {
+	v := value.(types.Uint)
+	return ^v
+}
+
+func bitShiftLeftIntInt(value, bits ref.Val) ref.Val {
+	v := value.(types.Int)
+	bs := bits.(types.Int)
+	if bs < types.IntZero {
+		return types.NewErr("math.bitShiftLeft() negative offset: %d", bs)
+	}
+	return v << bs
+}
+
+func bitShiftLeftUintInt(value, bits ref.Val) ref.Val {
+	v := value.(types.Uint)
+	bs := bits.(types.Int)
+	if bs < types.IntZero {
+		return types.NewErr("math.bitShiftLeft() negative offset: %d", bs)
+	}
+	return v << bs
+}
+
+func bitShiftRightIntInt(value, bits ref.Val) ref.Val {
+	v := value.(types.Int)
+	bs := bits.(types.Int)
+	if bs < types.IntZero {
+		return types.NewErr("math.bitShiftRight() negative offset: %d", bs)
+	}
+	return types.Int(types.Uint(v) >> bs)
+}
+
+func bitShiftRightUintInt(value, bits ref.Val) ref.Val {
+	v := value.(types.Uint)
+	bs := bits.(types.Int)
+	if bs < types.IntZero {
+		return types.NewErr("math.bitShiftRight() negative offset: %d", bs)
+	}
+	return v >> bs
+}
+
 func minPair(first, second ref.Val) ref.Val {
 	cmp, ok := first.(traits.Comparer)
 	if !ok {
@@ -323,52 +839,49 @@ func maxList(numList ref.Val) ref.Val {
 	}
 }
 
-func checkInvalidArgs(meh cel.MacroExprHelper, funcName string, args []*exprpb.Expr) *common.Error {
+func checkInvalidArgs(meh cel.MacroExprFactory, funcName string, args []ast.Expr) *cel.Error {
 	for _, arg := range args {
 		err := checkInvalidArgLiteral(funcName, arg)
 		if err != nil {
-			return &common.Error{
-				Message:  err.Error(),
-				Location: meh.OffsetLocation(arg.GetId()),
-			}
+			return meh.NewError(arg.ID(), err.Error())
 		}
 	}
 	return nil
 }
 
-func checkInvalidArgLiteral(funcName string, arg *exprpb.Expr) error {
-	if !isValidArgType(arg) {
+func checkInvalidArgLiteral(funcName string, arg ast.Expr) error {
+	if !isNumericArgType(arg) {
 		return fmt.Errorf("%s simple literal arguments must be numeric", funcName)
 	}
 	return nil
 }
 
-func isValidArgType(arg *exprpb.Expr) bool {
-	switch arg.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
-		c := arg.GetConstExpr()
-		switch c.GetConstantKind().(type) {
-		case *exprpb.Constant_DoubleValue, *exprpb.Constant_Int64Value, *exprpb.Constant_Uint64Value:
+func isNumericArgType(arg ast.Expr) bool {
+	switch arg.Kind() {
+	case ast.LiteralKind:
+		c := ref.Val(arg.AsLiteral())
+		switch c.(type) {
+		case types.Double, types.Int, types.Uint:
 			return true
 		default:
 			return false
 		}
-	case *exprpb.Expr_ListExpr, *exprpb.Expr_StructExpr:
+	case ast.ListKind, ast.MapKind, ast.StructKind:
 		return false
 	default:
 		return true
 	}
 }
 
-func isListLiteralWithValidArgs(arg *exprpb.Expr) bool {
-	switch arg.GetExprKind().(type) {
-	case *exprpb.Expr_ListExpr:
-		list := arg.GetListExpr()
-		if len(list.GetElements()) == 0 {
+func isListLiteralWithNumericArgs(arg ast.Expr) bool {
+	switch arg.Kind() {
+	case ast.ListKind:
+		list := arg.AsList()
+		if list.Size() == 0 {
 			return false
 		}
-		for _, e := range list.GetElements() {
-			if !isValidArgType(e) {
+		for _, e := range list.Elements() {
+			if !isNumericArgType(e) {
 				return false
 			}
 		}
diff --git a/vendor/github.com/google/cel-go/ext/native.go b/vendor/github.com/google/cel-go/ext/native.go
index acbc44b..36ab4a7 100644
--- a/vendor/github.com/google/cel-go/ext/native.go
+++ b/vendor/github.com/google/cel-go/ext/native.go
@@ -15,6 +15,7 @@
 package ext
 
 import (
+	"errors"
 	"fmt"
 	"reflect"
 	"strings"
@@ -24,13 +25,11 @@ import (
 	"google.golang.org/protobuf/reflect/protoreflect"
 
 	"github.com/google/cel-go/cel"
-	"github.com/google/cel-go/checker/decls"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/pb"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
 
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 	structpb "google.golang.org/protobuf/types/known/structpb"
 )
 
@@ -79,12 +78,45 @@ var (
 // same advice holds if you are using custom type adapters and type providers. The native type
 // provider composes over whichever type adapter and provider is configured in the cel.Env at
 // the time that it is invoked.
-func NativeTypes(refTypes ...any) cel.EnvOption {
+//
+// There is also the possibility to rename the fields of native structs by setting the `cel` tag
+// for fields you want to override. In order to enable this feature, pass in the `EnableStructTag`
+// option. Here is an example to see it in action:
+//
+// ```go
+// package identity
+//
+//	type Account struct {
+//	  ID int
+//	  OwnerName string `cel:"owner"`
+//	}
+//
+// ```
+//
+// The `OwnerName` field is now accessible in CEL via `owner`, e.g. `identity.Account{owner: 'bob'}`.
+// In case there are duplicated field names in the struct, an error will be returned.
+func NativeTypes(args ...any) cel.EnvOption {
 	return func(env *cel.Env) (*cel.Env, error) {
-		tp, err := newNativeTypeProvider(env.TypeAdapter(), env.TypeProvider(), refTypes...)
+		nativeTypes := make([]any, 0, len(args))
+		tpOptions := nativeTypeOptions{}
+
+		for _, v := range args {
+			switch v := v.(type) {
+			case NativeTypesOption:
+				err := v(&tpOptions)
+				if err != nil {
+					return nil, err
+				}
+			default:
+				nativeTypes = append(nativeTypes, v)
+			}
+		}
+
+		tp, err := newNativeTypeProvider(tpOptions, env.CELTypeAdapter(), env.CELTypeProvider(), nativeTypes...)
 		if err != nil {
 			return nil, err
 		}
+
 		env, err = cel.CustomTypeAdapter(tp)(env)
 		if err != nil {
 			return nil, err
@@ -93,22 +125,93 @@ func NativeTypes(refTypes ...any) cel.EnvOption {
 	}
 }
 
-func newNativeTypeProvider(adapter ref.TypeAdapter, provider ref.TypeProvider, refTypes ...any) (*nativeTypeProvider, error) {
+// NativeTypesOption is a functional interface for configuring handling of native types.
+type NativeTypesOption func(*nativeTypeOptions) error
+
+// NativeTypesFieldNameHandler is a handler for mapping a reflect.StructField to a CEL field name.
+// This can be used to override the default Go struct field to CEL field name mapping.
+type NativeTypesFieldNameHandler = func(field reflect.StructField) string
+
+func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string {
+	return func(field reflect.StructField) string {
+		tag, found := field.Tag.Lookup(structTagToParse)
+		if found {
+			splits := strings.Split(tag, ",")
+			if len(splits) > 0 {
+				// We make the assumption that the leftmost entry in the tag is the name.
+				// This seems to be true for most tags that have the concept of a name/key, such as:
+				// https://pkg.go.dev/encoding/xml#Marshal
+				// https://pkg.go.dev/encoding/json#Marshal
+				// https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs
+				// https://pkg.go.dev/gopkg.in/yaml.v2#Marshal
+				name := splits[0]
+				return name
+			}
+		}
+
+		return field.Name
+	}
+}
+
+type nativeTypeOptions struct {
+	// fieldNameHandler controls how CEL should perform struct field renames.
+	// This is most commonly used for switching to parsing based off the struct field tag,
+	// such as "cel" or "json".
+	fieldNameHandler NativeTypesFieldNameHandler
+}
+
+// ParseStructTags configures if native types field names should be overridable by CEL struct tags.
+// This is equivalent to ParseStructTag("cel")
+func ParseStructTags(enabled bool) NativeTypesOption {
+	return func(ntp *nativeTypeOptions) error {
+		if enabled {
+			ntp.fieldNameHandler = fieldNameByTag("cel")
+		} else {
+			ntp.fieldNameHandler = nil
+		}
+		return nil
+	}
+}
+
+// ParseStructTag configures the struct tag to parse. The 0th item in the tag is used as the name of the CEL field.
+// For example:
+// If the tag to parse is "cel" and the struct field has tag cel:"foo", the CEL struct field will be "foo".
+// If the tag to parse is "json" and the struct field has tag json:"foo,omitempty", the CEL struct field will be "foo".
+func ParseStructTag(tag string) NativeTypesOption {
+	return func(ntp *nativeTypeOptions) error {
+		ntp.fieldNameHandler = fieldNameByTag(tag)
+		return nil
+	}
+}
+
+// ParseStructField configures how to parse Go struct fields. It can be used to customize struct field parsing.
+func ParseStructField(handler NativeTypesFieldNameHandler) NativeTypesOption {
+	return func(ntp *nativeTypeOptions) error {
+		ntp.fieldNameHandler = handler
+		return nil
+	}
+}
+
+func newNativeTypeProvider(tpOptions nativeTypeOptions, adapter types.Adapter, provider types.Provider, refTypes ...any) (*nativeTypeProvider, error) {
 	nativeTypes := make(map[string]*nativeType, len(refTypes))
 	for _, refType := range refTypes {
 		switch rt := refType.(type) {
 		case reflect.Type:
-			t, err := newNativeType(rt)
+			result, err := newNativeTypes(tpOptions.fieldNameHandler, rt)
 			if err != nil {
 				return nil, err
 			}
-			nativeTypes[t.TypeName()] = t
+			for idx := range result {
+				nativeTypes[result[idx].TypeName()] = result[idx]
+			}
 		case reflect.Value:
-			t, err := newNativeType(rt.Type())
+			result, err := newNativeTypes(tpOptions.fieldNameHandler, rt.Type())
 			if err != nil {
 				return nil, err
 			}
-			nativeTypes[t.TypeName()] = t
+			for idx := range result {
+				nativeTypes[result[idx].TypeName()] = result[idx]
+			}
 		default:
 			return nil, fmt.Errorf("unsupported native type: %v (%T) must be reflect.Type or reflect.Value", rt, rt)
 		}
@@ -117,23 +220,25 @@ func newNativeTypeProvider(adapter ref.TypeAdapter, provider ref.TypeProvider, r
 		nativeTypes:  nativeTypes,
 		baseAdapter:  adapter,
 		baseProvider: provider,
+		options:      tpOptions,
 	}, nil
 }
 
 type nativeTypeProvider struct {
 	nativeTypes  map[string]*nativeType
-	baseAdapter  ref.TypeAdapter
-	baseProvider ref.TypeProvider
+	baseAdapter  types.Adapter
+	baseProvider types.Provider
+	options      nativeTypeOptions
 }
 
-// EnumValue proxies to the ref.TypeProvider configured at the times the NativeTypes
+// EnumValue proxies to the types.Provider configured at the times the NativeTypes
 // option was configured.
 func (tp *nativeTypeProvider) EnumValue(enumName string) ref.Val {
 	return tp.baseProvider.EnumValue(enumName)
 }
 
 // FindIdent looks up natives type instances by qualified identifier, and if not found
-// proxies to the composed ref.TypeProvider.
+// proxies to the composed types.Provider.
 func (tp *nativeTypeProvider) FindIdent(typeName string) (ref.Val, bool) {
 	if t, found := tp.nativeTypes[typeName]; found {
 		return t, true
@@ -141,41 +246,70 @@ func (tp *nativeTypeProvider) FindIdent(typeName string) (ref.Val, bool) {
 	return tp.baseProvider.FindIdent(typeName)
 }
 
-// FindType looks up CEL type-checker type definition by qualified identifier, and if not found
-// proxies to the composed ref.TypeProvider.
-func (tp *nativeTypeProvider) FindType(typeName string) (*exprpb.Type, bool) {
+// FindStructType looks up the CEL type definition by qualified identifier, and if not found
+// proxies to the composed types.Provider.
+func (tp *nativeTypeProvider) FindStructType(typeName string) (*types.Type, bool) {
 	if _, found := tp.nativeTypes[typeName]; found {
-		return decls.NewTypeType(decls.NewObjectType(typeName)), true
+		return types.NewTypeTypeWithParam(types.NewObjectType(typeName)), true
 	}
-	return tp.baseProvider.FindType(typeName)
+	if celType, found := tp.baseProvider.FindStructType(typeName); found {
+		return celType, true
+	}
+	return tp.baseProvider.FindStructType(typeName)
 }
 
-// FindFieldType looks up a native type's field definition, and if the type name is not a native
-// type then proxies to the composed ref.TypeProvider
-func (tp *nativeTypeProvider) FindFieldType(typeName, fieldName string) (*ref.FieldType, bool) {
+func toFieldName(fieldNameHandler NativeTypesFieldNameHandler, f reflect.StructField) string {
+	if fieldNameHandler == nil {
+		return f.Name
+	}
+
+	return fieldNameHandler(f)
+}
+
+// FindStructFieldNames looks up the type definition first from the native types, then from
+// the backing provider type set. If found, a set of field names corresponding to the type
+// will be returned.
+func (tp *nativeTypeProvider) FindStructFieldNames(typeName string) ([]string, bool) {
+	if t, found := tp.nativeTypes[typeName]; found {
+		fieldCount := t.refType.NumField()
+		fields := make([]string, fieldCount)
+		for i := 0; i < fieldCount; i++ {
+			fields[i] = toFieldName(tp.options.fieldNameHandler, t.refType.Field(i))
+		}
+		return fields, true
+	}
+	if celTypeFields, found := tp.baseProvider.FindStructFieldNames(typeName); found {
+		return celTypeFields, true
+	}
+	return tp.baseProvider.FindStructFieldNames(typeName)
+}
+
+// FindStructFieldType looks up a native type's field definition, and if the type name is not a native
+// type then proxies to the composed types.Provider
+func (tp *nativeTypeProvider) FindStructFieldType(typeName, fieldName string) (*types.FieldType, bool) {
 	t, found := tp.nativeTypes[typeName]
 	if !found {
-		return tp.baseProvider.FindFieldType(typeName, fieldName)
+		return tp.baseProvider.FindStructFieldType(typeName, fieldName)
 	}
 	refField, isDefined := t.hasField(fieldName)
 	if !found || !isDefined {
 		return nil, false
 	}
-	exprType, ok := convertToExprType(refField.Type)
+	celType, ok := convertToCelType(refField.Type)
 	if !ok {
 		return nil, false
 	}
-	return &ref.FieldType{
-		Type: exprType,
+	return &types.FieldType{
+		Type: celType,
 		IsSet: func(obj any) bool {
 			refVal := reflect.Indirect(reflect.ValueOf(obj))
-			refField := refVal.FieldByName(fieldName)
+			refField := refVal.FieldByName(refField.Name)
 			return !refField.IsZero()
 		},
 		GetFrom: func(obj any) (any, error) {
 			refVal := reflect.Indirect(reflect.ValueOf(obj))
-			refField := refVal.FieldByName(fieldName)
-			return getFieldValue(tp, refField), nil
+			refField := refVal.FieldByName(refField.Name)
+			return getFieldValue(refField), nil
 		},
 	}, true
 }
@@ -226,6 +360,9 @@ func (tp *nativeTypeProvider) NativeToValue(val any) ref.Val {
 		case []byte:
 			return tp.baseAdapter.NativeToValue(val)
 		default:
+			if refVal.Type().Elem() == reflect.TypeOf(byte(0)) {
+				return tp.baseAdapter.NativeToValue(val)
+			}
 			return types.NewDynamicList(tp, val)
 		}
 	case reflect.Map:
@@ -236,82 +373,81 @@ func (tp *nativeTypeProvider) NativeToValue(val any) ref.Val {
 			time.Time:
 			return tp.baseAdapter.NativeToValue(val)
 		default:
-			return newNativeObject(tp, val, rawVal)
+			return tp.newNativeObject(val, rawVal)
 		}
 	default:
 		return tp.baseAdapter.NativeToValue(val)
 	}
 }
 
-// convertToExprType converts the Golang reflect.Type to a protobuf exprpb.Type.
-func convertToExprType(refType reflect.Type) (*exprpb.Type, bool) {
+func convertToCelType(refType reflect.Type) (*cel.Type, bool) {
 	switch refType.Kind() {
 	case reflect.Bool:
-		return decls.Bool, true
+		return cel.BoolType, true
 	case reflect.Float32, reflect.Float64:
-		return decls.Double, true
+		return cel.DoubleType, true
 	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
 		if refType == durationType {
-			return decls.Duration, true
+			return cel.DurationType, true
 		}
-		return decls.Int, true
+		return cel.IntType, true
 	case reflect.String:
-		return decls.String, true
+		return cel.StringType, true
 	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		return decls.Uint, true
+		return cel.UintType, true
 	case reflect.Array, reflect.Slice:
 		refElem := refType.Elem()
 		if refElem == reflect.TypeOf(byte(0)) {
-			return decls.Bytes, true
+			return cel.BytesType, true
 		}
-		elemType, ok := convertToExprType(refElem)
+		elemType, ok := convertToCelType(refElem)
 		if !ok {
 			return nil, false
 		}
-		return decls.NewListType(elemType), true
+		return cel.ListType(elemType), true
 	case reflect.Map:
-		keyType, ok := convertToExprType(refType.Key())
+		keyType, ok := convertToCelType(refType.Key())
 		if !ok {
 			return nil, false
 		}
 		// Ensure the key type is a int, bool, uint, string
-		elemType, ok := convertToExprType(refType.Elem())
+		elemType, ok := convertToCelType(refType.Elem())
 		if !ok {
 			return nil, false
 		}
-		return decls.NewMapType(keyType, elemType), true
+		return cel.MapType(keyType, elemType), true
 	case reflect.Struct:
 		if refType == timestampType {
-			return decls.Timestamp, true
+			return cel.TimestampType, true
 		}
-		return decls.NewObjectType(
+		return cel.ObjectType(
 			fmt.Sprintf("%s.%s", simplePkgAlias(refType.PkgPath()), refType.Name()),
 		), true
 	case reflect.Pointer:
 		if refType.Implements(pbMsgInterfaceType) {
 			pbMsg := reflect.New(refType.Elem()).Interface().(protoreflect.ProtoMessage)
-			return decls.NewObjectType(string(pbMsg.ProtoReflect().Descriptor().FullName())), true
+			return cel.ObjectType(string(pbMsg.ProtoReflect().Descriptor().FullName())), true
 		}
-		return convertToExprType(refType.Elem())
+		return convertToCelType(refType.Elem())
 	}
 	return nil, false
 }
 
-func newNativeObject(adapter ref.TypeAdapter, val any, refValue reflect.Value) ref.Val {
-	valType, err := newNativeType(refValue.Type())
+func (tp *nativeTypeProvider) newNativeObject(val any, refValue reflect.Value) ref.Val {
+	valType, err := newNativeType(tp.options.fieldNameHandler, refValue.Type())
 	if err != nil {
 		return types.NewErr(err.Error())
 	}
 	return &nativeObj{
-		TypeAdapter: adapter,
-		val:         val,
-		valType:     valType,
-		refValue:    refValue,
+		Adapter:  tp,
+		val:      val,
+		valType:  valType,
+		refValue: refValue,
 	}
 }
 
 type nativeObj struct {
-	ref.TypeAdapter
+	types.Adapter
 	val      any
 	valType  *nativeType
 	refValue reflect.Value
@@ -350,12 +486,13 @@ func (o *nativeObj) ConvertToNative(typeDesc reflect.Type) (any, error) {
 			if !fieldValue.IsValid() || fieldValue.IsZero() {
 				continue
 			}
+			fieldName := toFieldName(o.valType.fieldNameHandler, fieldType)
 			fieldCELVal := o.NativeToValue(fieldValue.Interface())
 			fieldJSONVal, err := fieldCELVal.ConvertToNative(jsonValueType)
 			if err != nil {
 				return nil, err
 			}
-			fields[fieldType.Name] = fieldJSONVal.(*structpb.Value)
+			fields[fieldName] = fieldJSONVal.(*structpb.Value)
 		}
 		return &structpb.Struct{Fields: fields}, nil
 	}
@@ -447,7 +584,47 @@ func (o *nativeObj) Value() any {
 	return o.val
 }
 
-func newNativeType(rawType reflect.Type) (*nativeType, error) {
+func newNativeTypes(fieldNameHandler NativeTypesFieldNameHandler, rawType reflect.Type) ([]*nativeType, error) {
+	nt, err := newNativeType(fieldNameHandler, rawType)
+	if err != nil {
+		return nil, err
+	}
+	result := []*nativeType{nt}
+
+	alreadySeen := make(map[string]struct{})
+	var iterateStructMembers func(reflect.Type)
+	iterateStructMembers = func(t reflect.Type) {
+		if k := t.Kind(); k == reflect.Pointer || k == reflect.Slice || k == reflect.Array || k == reflect.Map {
+			t = t.Elem()
+		}
+		if t.Kind() != reflect.Struct {
+			return
+		}
+		if _, seen := alreadySeen[t.String()]; seen {
+			return
+		}
+		alreadySeen[t.String()] = struct{}{}
+		nt, ntErr := newNativeType(fieldNameHandler, t)
+		if ntErr != nil {
+			err = ntErr
+			return
+		}
+		result = append(result, nt)
+
+		for idx := 0; idx < t.NumField(); idx++ {
+			iterateStructMembers(t.Field(idx).Type)
+		}
+	}
+	iterateStructMembers(rawType)
+
+	return result, err
+}
+
+var (
+	errDuplicatedFieldName = errors.New("field name already exists in struct")
+)
+
+func newNativeType(fieldNameHandler NativeTypesFieldNameHandler, rawType reflect.Type) (*nativeType, error) {
 	refType := rawType
 	if refType.Kind() == reflect.Pointer {
 		refType = refType.Elem()
@@ -455,15 +632,34 @@ func newNativeType(rawType reflect.Type) (*nativeType, error) {
 	if !isValidObjectType(refType) {
 		return nil, fmt.Errorf("unsupported reflect.Type %v, must be reflect.Struct", rawType)
 	}
+
+	// Since naming collisions can only happen with struct tag parsing, we only check for them if it is enabled.
+	if fieldNameHandler != nil {
+		fieldNames := make(map[string]struct{})
+
+		for idx := 0; idx < refType.NumField(); idx++ {
+			field := refType.Field(idx)
+			fieldName := toFieldName(fieldNameHandler, field)
+
+			if _, found := fieldNames[fieldName]; found {
+				return nil, fmt.Errorf("invalid field name `%s` in struct `%s`: %w", fieldName, refType.Name(), errDuplicatedFieldName)
+			} else {
+				fieldNames[fieldName] = struct{}{}
+			}
+		}
+	}
+
 	return &nativeType{
-		typeName: fmt.Sprintf("%s.%s", simplePkgAlias(refType.PkgPath()), refType.Name()),
-		refType:  refType,
+		typeName:         fmt.Sprintf("%s.%s", simplePkgAlias(refType.PkgPath()), refType.Name()),
+		refType:          refType,
+		fieldNameHandler: fieldNameHandler,
 	}, nil
 }
 
 type nativeType struct {
-	typeName string
-	refType  reflect.Type
+	typeName         string
+	refType          reflect.Type
+	fieldNameHandler NativeTypesFieldNameHandler
 }
 
 // ConvertToNative implements ref.Val.ConvertToNative.
@@ -511,31 +707,43 @@ func (t *nativeType) Value() any {
 	return t.typeName
 }
 
+// fieldByName returns the corresponding reflect.StructField for the give name either by matching
+// field tag or field name.
+func (t *nativeType) fieldByName(fieldName string) (reflect.StructField, bool) {
+	if t.fieldNameHandler == nil {
+		return t.refType.FieldByName(fieldName)
+	}
+
+	for i := 0; i < t.refType.NumField(); i++ {
+		f := t.refType.Field(i)
+		if toFieldName(t.fieldNameHandler, f) == fieldName {
+			return f, true
+		}
+	}
+
+	return reflect.StructField{}, false
+}
+
 // hasField returns whether a field name has a corresponding Golang reflect.StructField
 func (t *nativeType) hasField(fieldName string) (reflect.StructField, bool) {
-	f, found := t.refType.FieldByName(fieldName)
+	f, found := t.fieldByName(fieldName)
 	if !found || !f.IsExported() || !isSupportedType(f.Type) {
 		return reflect.StructField{}, false
 	}
 	return f, true
 }
 
-func adaptFieldValue(adapter ref.TypeAdapter, refField reflect.Value) ref.Val {
-	return adapter.NativeToValue(getFieldValue(adapter, refField))
+func adaptFieldValue(adapter types.Adapter, refField reflect.Value) ref.Val {
+	return adapter.NativeToValue(getFieldValue(refField))
 }
 
-func getFieldValue(adapter ref.TypeAdapter, refField reflect.Value) any {
+func getFieldValue(refField reflect.Value) any {
 	if refField.IsZero() {
 		switch refField.Kind() {
-		case reflect.Array, reflect.Slice:
-			return types.NewDynamicList(adapter, []ref.Val{})
-		case reflect.Map:
-			return types.NewDynamicMap(adapter, map[ref.Val]ref.Val{})
 		case reflect.Struct:
 			if refField.Type() == timestampType {
-				return types.Timestamp{Time: time.Unix(0, 0)}
+				return time.Unix(0, 0)
 			}
-			return reflect.New(refField.Type()).Elem().Interface()
 		case reflect.Pointer:
 			return reflect.New(refField.Type().Elem()).Interface()
 		}
diff --git a/vendor/github.com/google/cel-go/ext/protos.go b/vendor/github.com/google/cel-go/ext/protos.go
index b905e71..68796f6 100644
--- a/vendor/github.com/google/cel-go/ext/protos.go
+++ b/vendor/github.com/google/cel-go/ext/protos.go
@@ -16,9 +16,7 @@ package ext
 
 import (
 	"github.com/google/cel-go/cel"
-	"github.com/google/cel-go/common"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
 )
 
 // Protos returns a cel.EnvOption to configure extended macros and functions for
@@ -73,9 +71,9 @@ func (protoLib) CompileOptions() []cel.EnvOption {
 	return []cel.EnvOption{
 		cel.Macros(
 			// proto.getExt(msg, select_expression)
-			cel.NewReceiverMacro(getExtension, 2, getProtoExt),
+			cel.ReceiverMacro(getExtension, 2, getProtoExt),
 			// proto.hasExt(msg, select_expression)
-			cel.NewReceiverMacro(hasExtension, 2, hasProtoExt),
+			cel.ReceiverMacro(hasExtension, 2, hasProtoExt),
 		),
 	}
 }
@@ -86,59 +84,56 @@ func (protoLib) ProgramOptions() []cel.ProgramOption {
 }
 
 // hasProtoExt generates a test-only select expression for a fully-qualified extension name on a protobuf message.
-func hasProtoExt(meh cel.MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func hasProtoExt(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
 	if !macroTargetMatchesNamespace(protoNamespace, target) {
 		return nil, nil
 	}
-	extensionField, err := getExtFieldName(meh, args[1])
+	extensionField, err := getExtFieldName(mef, args[1])
 	if err != nil {
 		return nil, err
 	}
-	return meh.PresenceTest(args[0], extensionField), nil
+	return mef.NewPresenceTest(args[0], extensionField), nil
 }
 
 // getProtoExt generates a select expression for a fully-qualified extension name on a protobuf message.
-func getProtoExt(meh cel.MacroExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func getProtoExt(mef cel.MacroExprFactory, target ast.Expr, args []ast.Expr) (ast.Expr, *cel.Error) {
 	if !macroTargetMatchesNamespace(protoNamespace, target) {
 		return nil, nil
 	}
-	extFieldName, err := getExtFieldName(meh, args[1])
+	extFieldName, err := getExtFieldName(mef, args[1])
 	if err != nil {
 		return nil, err
 	}
-	return meh.Select(args[0], extFieldName), nil
+	return mef.NewSelect(args[0], extFieldName), nil
 }
 
-func getExtFieldName(meh cel.MacroExprHelper, expr *exprpb.Expr) (string, *common.Error) {
+func getExtFieldName(mef cel.MacroExprFactory, expr ast.Expr) (string, *cel.Error) {
 	isValid := false
 	extensionField := ""
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_SelectExpr:
+	switch expr.Kind() {
+	case ast.SelectKind:
 		extensionField, isValid = validateIdentifier(expr)
 	}
 	if !isValid {
-		return "", &common.Error{
-			Message:  "invalid extension field",
-			Location: meh.OffsetLocation(expr.GetId()),
-		}
+		return "", mef.NewError(expr.ID(), "invalid extension field")
 	}
 	return extensionField, nil
 }
 
-func validateIdentifier(expr *exprpb.Expr) (string, bool) {
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_IdentExpr:
-		return expr.GetIdentExpr().GetName(), true
-	case *exprpb.Expr_SelectExpr:
-		sel := expr.GetSelectExpr()
-		if sel.GetTestOnly() {
+func validateIdentifier(expr ast.Expr) (string, bool) {
+	switch expr.Kind() {
+	case ast.IdentKind:
+		return expr.AsIdent(), true
+	case ast.SelectKind:
+		sel := expr.AsSelect()
+		if sel.IsTestOnly() {
 			return "", false
 		}
-		opStr, isIdent := validateIdentifier(sel.GetOperand())
+		opStr, isIdent := validateIdentifier(sel.Operand())
 		if !isIdent {
 			return "", false
 		}
-		return opStr + "." + sel.GetField(), true
+		return opStr + "." + sel.FieldName(), true
 	default:
 		return "", false
 	}
diff --git a/vendor/github.com/google/cel-go/ext/sets.go b/vendor/github.com/google/cel-go/ext/sets.go
index 4820d61..7e94166 100644
--- a/vendor/github.com/google/cel-go/ext/sets.go
+++ b/vendor/github.com/google/cel-go/ext/sets.go
@@ -15,10 +15,16 @@
 package ext
 
 import (
+	"math"
+
 	"github.com/google/cel-go/cel"
+	"github.com/google/cel-go/checker"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
+	"github.com/google/cel-go/interpreter"
 )
 
 // Sets returns a cel.EnvOption to configure namespaced set relationship
@@ -95,12 +101,86 @@ func (setsLib) CompileOptions() []cel.EnvOption {
 		cel.Function("sets.intersects",
 			cel.Overload("list_sets_intersects_list", []*cel.Type{listType, listType}, cel.BoolType,
 				cel.BinaryBinding(setsIntersects))),
+		cel.CostEstimatorOptions(
+			checker.OverloadCostEstimate("list_sets_contains_list", estimateSetsCost(1)),
+			checker.OverloadCostEstimate("list_sets_intersects_list", estimateSetsCost(1)),
+			// equivalence requires potentially two m*n comparisons to ensure each list is contained by the other
+			checker.OverloadCostEstimate("list_sets_equivalent_list", estimateSetsCost(2)),
+		),
 	}
 }
 
 // ProgramOptions implements the Library interface method.
 func (setsLib) ProgramOptions() []cel.ProgramOption {
-	return []cel.ProgramOption{}
+	return []cel.ProgramOption{
+		cel.CostTrackerOptions(
+			interpreter.OverloadCostTracker("list_sets_contains_list", trackSetsCost(1)),
+			interpreter.OverloadCostTracker("list_sets_intersects_list", trackSetsCost(1)),
+			interpreter.OverloadCostTracker("list_sets_equivalent_list", trackSetsCost(2)),
+		),
+	}
+}
+
+// NewSetMembershipOptimizer rewrites set membership tests using the `in` operator against a list
+// of constant values of enum, int, uint, string, or boolean type into a set membership test against
+// a map where the map keys are the elements of the list.
+func NewSetMembershipOptimizer() (cel.ASTOptimizer, error) {
+	return setsLib{}, nil
+}
+
+func (setsLib) Optimize(ctx *cel.OptimizerContext, a *ast.AST) *ast.AST {
+	root := ast.NavigateAST(a)
+	matches := ast.MatchDescendants(root, matchInConstantList(a))
+	for _, match := range matches {
+		call := match.AsCall()
+		listArg := call.Args()[1]
+		entries := make([]ast.EntryExpr, len(listArg.AsList().Elements()))
+		for i, elem := range listArg.AsList().Elements() {
+			var entry ast.EntryExpr
+			if r, found := a.ReferenceMap()[elem.ID()]; found && r.Value != nil {
+				entry = ctx.NewMapEntry(ctx.NewLiteral(r.Value), ctx.NewLiteral(types.True), false)
+			} else {
+				entry = ctx.NewMapEntry(elem, ctx.NewLiteral(types.True), false)
+			}
+			entries[i] = entry
+		}
+		mapArg := ctx.NewMap(entries)
+		ctx.UpdateExpr(listArg, mapArg)
+	}
+	return a
+}
+
+func matchInConstantList(a *ast.AST) ast.ExprMatcher {
+	return func(e ast.NavigableExpr) bool {
+		if e.Kind() != ast.CallKind {
+			return false
+		}
+		call := e.AsCall()
+		if call.FunctionName() != operators.In {
+			return false
+		}
+		aggregateVal := call.Args()[1]
+		if aggregateVal.Kind() != ast.ListKind {
+			return false
+		}
+		listVal := aggregateVal.AsList()
+		for _, elem := range listVal.Elements() {
+			if r, found := a.ReferenceMap()[elem.ID()]; found {
+				if r.Value != nil {
+					continue
+				}
+			}
+			if elem.Kind() != ast.LiteralKind {
+				return false
+			}
+			lit := elem.AsLiteral()
+			if !(lit.Type() == cel.StringType || lit.Type() == cel.IntType ||
+				lit.Type() == cel.UintType || lit.Type() == cel.BoolType) {
+				return false
+			}
+		}
+		return true
+	}
 }
 
 func setsIntersects(listA, listB ref.Val) ref.Val {
@@ -136,3 +216,46 @@ func setsEquivalent(listA, listB ref.Val) ref.Val {
 	}
 	return setsContains(listB, listA)
 }
+
+func estimateSetsCost(costFactor float64) checker.FunctionEstimator {
+	return func(estimator checker.CostEstimator, target *checker.AstNode, args []checker.AstNode) *checker.CallEstimate {
+		if len(args) == 2 {
+			arg0Size := estimateSize(estimator, args[0])
+			arg1Size := estimateSize(estimator, args[1])
+			costEstimate := arg0Size.Multiply(arg1Size).MultiplyByCostFactor(costFactor).Add(callCostEstimate)
+			return &checker.CallEstimate{CostEstimate: costEstimate}
+		}
+		return nil
+	}
+}
+
+func estimateSize(estimator checker.CostEstimator, node checker.AstNode) checker.SizeEstimate {
+	if l := node.ComputedSize(); l != nil {
+		return *l
+	}
+	if l := estimator.EstimateSize(node); l != nil {
+		return *l
+	}
+	return checker.SizeEstimate{Min: 0, Max: math.MaxUint64}
+}
+
+func trackSetsCost(costFactor float64) interpreter.FunctionTracker {
+	return func(args []ref.Val, _ ref.Val) *uint64 {
+		lhsSize := actualSize(args[0])
+		rhsSize := actualSize(args[1])
+		cost := callCost + uint64(float64(lhsSize*rhsSize)*costFactor)
+		return &cost
+	}
+}
+
+func actualSize(value ref.Val) uint64 {
+	if sz, ok := value.(traits.Sizer); ok {
+		return uint64(sz.Size().(types.Int))
+	}
+	return 1
+}
+
+var (
+	callCostEstimate = checker.CostEstimate{Min: 1, Max: 1}
+	callCost         = uint64(1)
+)
diff --git a/vendor/github.com/google/cel-go/ext/strings.go b/vendor/github.com/google/cel-go/ext/strings.go
index 8455d58..2e590a4 100644
--- a/vendor/github.com/google/cel-go/ext/strings.go
+++ b/vendor/github.com/google/cel-go/ext/strings.go
@@ -21,19 +21,16 @@ import (
 	"fmt"
 	"math"
 	"reflect"
-	"sort"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"golang.org/x/text/language"
-	"golang.org/x/text/message"
 
 	"github.com/google/cel-go/cel"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
-	"github.com/google/cel-go/interpreter"
 )
 
 const (
@@ -99,7 +96,7 @@ const (
 //	"a map inside a list: %s".format([[1, 2, 3, {"a": "x", "b": "y", "c": "z"}]]) // returns "a map inside a list: [1, 2, 3, {"a":"x", "b":"y", "c":"d"}]"
 //	"true bool: %s - false bool: %s\nbinary bool: %b".format([true, false, true]) // returns "true bool: true - false bool: false\nbinary bool: 1"
 //
-// Passing an incorrect type (an integer to `%s`) is considered an error, as well as attempting
+// Passing an incorrect type (a string to `%b`) is considered an error, as well as attempting
 // to use more formatting clauses than there are arguments (`%d %d %d` while passing two ints, for instance).
 // If compile-time checking is enabled, and the formatting string is a constant, and the argument list is a literal,
 // then letting any arguments go unused/unformatted is also considered an error.
@@ -122,7 +119,8 @@ const (
 //	'hello mellow'.indexOf('jello')    // returns -1
 //	'hello mellow'.indexOf('', 2)      // returns 2
 //	'hello mellow'.indexOf('ello', 2)  // returns 7
-//	'hello mellow'.indexOf('ello', 20) // error
+//	'hello mellow'.indexOf('ello', 20) // returns -1
+//	'hello mellow'.indexOf('ello', -1) // error
 //
 // # Join
 //
@@ -158,6 +156,7 @@ const (
 //	'hello mellow'.lastIndexOf('ello')     // returns 7
 //	'hello mellow'.lastIndexOf('jello')    // returns -1
 //	'hello mellow'.lastIndexOf('ello', 6)  // returns 1
+//	'hello mellow'.lastIndexOf('ello', 20) // returns -1
 //	'hello mellow'.lastIndexOf('ello', -1) // error
 //
 // # LowerAscii
@@ -173,7 +172,7 @@ const (
 //	'TacoCat'.lowerAscii()      // returns 'tacocat'
 //	'TacoCÆt Xii'.lowerAscii()  // returns 'tacocÆt xii'
 //
-// # Quote
+// # Strings.Quote
 //
 // Introduced in version: 1
 //
@@ -205,6 +204,8 @@ const (
 //	'hello hello'.replace('he', 'we', -1) // returns 'wello wello'
 //	'hello hello'.replace('he', 'we', 1)  // returns 'wello hello'
 //	'hello hello'.replace('he', 'we', 0)  // returns 'hello hello'
+//	'hello hello'.replace('', '_')  // returns '_h_e_l_l_o_ _h_e_l_l_o_'
+//	'hello hello'.replace('h', '')  // returns 'ello ello'
 //
 // # Split
 //
@@ -270,8 +271,26 @@ const (
 //
 //	'TacoCat'.upperAscii()      // returns 'TACOCAT'
 //	'TacoCÆt Xii'.upperAscii()  // returns 'TACOCÆT XII'
+//
+// # Reverse
+//
+// Introduced at version: 3
+//
+// Returns a new string whose characters are the same as the target string, only formatted in
+// reverse order.
+// This function relies on converting strings to rune arrays in order to reverse
+//
+//	<string>.reverse() -> <string>
+//
+// Examples:
+//
+//	'gums'.reverse() // returns 'smug'
+//	'John Smith'.reverse() // returns 'htimS nhoJ'
 func Strings(options ...StringsOption) cel.EnvOption {
-	s := &stringLib{version: math.MaxUint32}
+	s := &stringLib{
+		version:        math.MaxUint32,
+		validateFormat: true,
+	}
 	for _, o := range options {
 		s = o(s)
 	}
@@ -279,8 +298,9 @@ func Strings(options ...StringsOption) cel.EnvOption {
 }
 
 type stringLib struct {
-	locale  string
-	version uint32
+	locale         string
+	version        uint32
+	validateFormat bool
 }
 
 // LibraryName implements the SingletonLibrary interface method.
@@ -301,26 +321,39 @@ func StringsLocale(locale string) StringsOption {
 	}
 }
 
-// StringsVersion configures the version of the string library. The version limits which
-// functions are available. Only functions introduced below or equal to the given
-// version included in the library. See the library documentation to determine
-// which version a function was introduced at. If the documentation does not
-// state which version a function was introduced at, it can be assumed to be
-// introduced at version 0, when the library was first created.
-// If this option is not set, all functions are available.
-func StringsVersion(version uint32) func(lib *stringLib) *stringLib {
-	return func(sl *stringLib) *stringLib {
-		sl.version = version
-		return sl
+// StringsVersion configures the version of the string library.
+//
+// The version limits which functions are available. Only functions introduced
+// below or equal to the given version included in the library. If this option
+// is not set, all functions are available.
+//
+// See the library documentation to determine which version a function was introduced.
+// If the documentation does not state which version a function was introduced, it can
+// be assumed to be introduced at version 0, when the library was first created.
+func StringsVersion(version uint32) StringsOption {
+	return func(lib *stringLib) *stringLib {
+		lib.version = version
+		return lib
+	}
+}
+
+// StringsValidateFormatCalls validates type-checked ASTs to ensure that string.format() calls have
+// valid formatting clauses and valid argument types for each clause.
+//
+// Enabled by default.
+func StringsValidateFormatCalls(value bool) StringsOption {
+	return func(s *stringLib) *stringLib {
+		s.validateFormat = value
+		return s
 	}
 }
 
 // CompileOptions implements the Library interface method.
-func (sl *stringLib) CompileOptions() []cel.EnvOption {
+func (lib *stringLib) CompileOptions() []cel.EnvOption {
 	formatLocale := "en_US"
-	if sl.locale != "" {
+	if lib.locale != "" {
 		// ensure locale is properly-formed if set
-		_, err := language.Parse(sl.locale)
+		_, err := language.Parse(lib.locale)
 		if err != nil {
 			return []cel.EnvOption{
 				func(e *cel.Env) (*cel.Env, error) {
@@ -328,7 +361,7 @@ func (sl *stringLib) CompileOptions() []cel.EnvOption {
 				},
 			}
 		}
-		formatLocale = sl.locale
+		formatLocale = lib.locale
 	}
 
 	opts := []cel.EnvOption{
@@ -432,22 +465,24 @@ func (sl *stringLib) CompileOptions() []cel.EnvOption {
 					return stringOrError(upperASCII(string(s)))
 				}))),
 	}
-	if sl.version >= 1 {
+	if lib.version >= 1 {
 		opts = append(opts, cel.Function("format",
 			cel.MemberOverload("string_format", []*cel.Type{cel.StringType, cel.ListType(cel.DynType)}, cel.StringType,
 				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
 					s := string(args[0].(types.String))
 					formatArgs := args[1].(traits.Lister)
-					return stringOrError(interpreter.ParseFormatString(s, &stringFormatter{}, &stringArgList{formatArgs}, formatLocale))
+					return stringOrError(parseFormatString(s, &stringFormatter{}, &stringArgList{formatArgs}, formatLocale))
 				}))),
 			cel.Function("strings.quote", cel.Overload("strings_quote", []*cel.Type{cel.StringType}, cel.StringType,
 				cel.UnaryBinding(func(str ref.Val) ref.Val {
 					s := str.(types.String)
 					return stringOrError(quote(string(s)))
-				}))))
+				}))),
+
+			cel.ASTValidators(stringFormatValidator{}))
 
 	}
-	if sl.version >= 2 {
+	if lib.version >= 2 {
 		opts = append(opts,
 			cel.Function("join",
 				cel.MemberOverload("list_join", []*cel.Type{cel.ListType(cel.StringType)}, cel.StringType,
@@ -469,7 +504,7 @@ func (sl *stringLib) CompileOptions() []cel.EnvOption {
 					cel.UnaryBinding(func(list ref.Val) ref.Val {
 						l, err := list.ConvertToNative(stringListType)
 						if err != nil {
-							return types.NewErr(err.Error())
+							return types.WrapErr(err)
 						}
 						return stringOrError(join(l.([]string)))
 					})),
@@ -477,13 +512,26 @@ func (sl *stringLib) CompileOptions() []cel.EnvOption {
 					cel.BinaryBinding(func(list, delim ref.Val) ref.Val {
 						l, err := list.ConvertToNative(stringListType)
 						if err != nil {
-							return types.NewErr(err.Error())
+							return types.WrapErr(err)
 						}
 						d := delim.(types.String)
 						return stringOrError(joinSeparator(l.([]string), string(d)))
 					}))),
 		)
 	}
+	if lib.version >= 3 {
+		opts = append(opts,
+			cel.Function("reverse",
+				cel.MemberOverload("string_reverse", []*cel.Type{cel.StringType}, cel.StringType,
+					cel.UnaryBinding(func(str ref.Val) ref.Val {
+						s := str.(types.String)
+						return stringOrError(reverse(string(s)))
+					}))),
+		)
+	}
+	if lib.validateFormat {
+		opts = append(opts, cel.ASTValidators(stringFormatValidator{}))
+	}
 	return opts
 }
 
@@ -515,9 +563,13 @@ func indexOfOffset(str, substr string, offset int64) (int64, error) {
 	off := int(offset)
 	runes := []rune(str)
 	subrunes := []rune(substr)
-	if off < 0 || off >= len(runes) {
+	if off < 0 {
 		return -1, fmt.Errorf("index out of range: %d", off)
 	}
+	// If the offset exceeds the length, return -1 rather than error.
+	if off >= len(runes) {
+		return -1, nil
+	}
 	for i := off; i < len(runes)-(len(subrunes)-1); i++ {
 		found := true
 		for j := 0; j < len(subrunes); j++ {
@@ -548,9 +600,13 @@ func lastIndexOfOffset(str, substr string, offset int64) (int64, error) {
 	off := int(offset)
 	runes := []rune(str)
 	subrunes := []rune(substr)
-	if off < 0 || off >= len(runes) {
+	if off < 0 {
 		return -1, fmt.Errorf("index out of range: %d", off)
 	}
+	// If the offset is far greater than the length return -1
+	if off >= len(runes) {
+		return -1, nil
+	}
 	if off > len(runes)-len(subrunes) {
 		off = len(runes) - len(subrunes)
 	}
@@ -634,6 +690,14 @@ func upperASCII(str string) (string, error) {
 	return string(runes), nil
 }
 
+func reverse(str string) (string, error) {
+	chars := []rune(str)
+	for i, j := 0, len(chars)-1; i < j; i, j = i+1, j-1 {
+		chars[i], chars[j] = chars[j], chars[i]
+	}
+	return string(chars), nil
+}
+
 func joinSeparator(strs []string, separator string) (string, error) {
 	return strings.Join(strs, separator), nil
 }
@@ -659,238 +723,6 @@ func joinValSeparator(strs traits.Lister, separator string) (string, error) {
 	return sb.String(), nil
 }
 
-type clauseImpl func(ref.Val, string) (string, error)
-
-func clauseForType(argType ref.Type) (clauseImpl, error) {
-	switch argType {
-	case types.IntType, types.UintType:
-		return formatDecimal, nil
-	case types.StringType, types.BytesType, types.BoolType, types.NullType, types.TypeType:
-		return FormatString, nil
-	case types.TimestampType, types.DurationType:
-		// special case to ensure timestamps/durations get printed as CEL literals
-		return func(arg ref.Val, locale string) (string, error) {
-			argStrVal := arg.ConvertToType(types.StringType)
-			argStr := argStrVal.Value().(string)
-			if arg.Type() == types.TimestampType {
-				return fmt.Sprintf("timestamp(%q)", argStr), nil
-			}
-			if arg.Type() == types.DurationType {
-				return fmt.Sprintf("duration(%q)", argStr), nil
-			}
-			return "", fmt.Errorf("cannot convert argument of type %s to timestamp/duration", arg.Type().TypeName())
-		}, nil
-	case types.ListType:
-		return formatList, nil
-	case types.MapType:
-		return formatMap, nil
-	case types.DoubleType:
-		// avoid formatFixed so we can output a period as the decimal separator in order
-		// to always be a valid CEL literal
-		return func(arg ref.Val, locale string) (string, error) {
-			argDouble, ok := arg.Value().(float64)
-			if !ok {
-				return "", fmt.Errorf("couldn't convert %s to float64", arg.Type().TypeName())
-			}
-			fmtStr := fmt.Sprintf("%%.%df", defaultPrecision)
-			return fmt.Sprintf(fmtStr, argDouble), nil
-		}, nil
-	case types.TypeType:
-		return func(arg ref.Val, locale string) (string, error) {
-			return fmt.Sprintf("type(%s)", arg.Value().(string)), nil
-		}, nil
-	default:
-		return nil, fmt.Errorf("no formatting function for %s", argType.TypeName())
-	}
-}
-
-func formatList(arg ref.Val, locale string) (string, error) {
-	argList := arg.(traits.Lister)
-	argIterator := argList.Iterator()
-	var listStrBuilder strings.Builder
-	_, err := listStrBuilder.WriteRune('[')
-	if err != nil {
-		return "", fmt.Errorf("error writing to list string: %w", err)
-	}
-	for argIterator.HasNext() == types.True {
-		member := argIterator.Next()
-		memberFormat, err := clauseForType(member.Type())
-		if err != nil {
-			return "", err
-		}
-		unquotedStr, err := memberFormat(member, locale)
-		if err != nil {
-			return "", err
-		}
-		str := quoteForCEL(member, unquotedStr)
-		_, err = listStrBuilder.WriteString(str)
-		if err != nil {
-			return "", fmt.Errorf("error writing to list string: %w", err)
-		}
-		if argIterator.HasNext() == types.True {
-			_, err = listStrBuilder.WriteString(", ")
-			if err != nil {
-				return "", fmt.Errorf("error writing to list string: %w", err)
-			}
-		}
-	}
-	_, err = listStrBuilder.WriteRune(']')
-	if err != nil {
-		return "", fmt.Errorf("error writing to list string: %w", err)
-	}
-	return listStrBuilder.String(), nil
-}
-
-func formatMap(arg ref.Val, locale string) (string, error) {
-	argMap := arg.(traits.Mapper)
-	argIterator := argMap.Iterator()
-	type mapPair struct {
-		key   string
-		value string
-	}
-	argPairs := make([]mapPair, argMap.Size().Value().(int64))
-	i := 0
-	for argIterator.HasNext() == types.True {
-		key := argIterator.Next()
-		var keyFormat clauseImpl
-		switch key.Type() {
-		case types.StringType, types.BoolType:
-			keyFormat = FormatString
-		case types.IntType, types.UintType:
-			keyFormat = formatDecimal
-		default:
-			return "", fmt.Errorf("no formatting function for map key of type %s", key.Type().TypeName())
-		}
-		unquotedKeyStr, err := keyFormat(key, locale)
-		if err != nil {
-			return "", err
-		}
-		keyStr := quoteForCEL(key, unquotedKeyStr)
-		value, found := argMap.Find(key)
-		if !found {
-			return "", fmt.Errorf("could not find key: %q", key)
-		}
-		valueFormat, err := clauseForType(value.Type())
-		if err != nil {
-			return "", err
-		}
-		unquotedValueStr, err := valueFormat(value, locale)
-		if err != nil {
-			return "", err
-		}
-		valueStr := quoteForCEL(value, unquotedValueStr)
-		argPairs[i] = mapPair{keyStr, valueStr}
-		i++
-	}
-	sort.SliceStable(argPairs, func(x, y int) bool {
-		return argPairs[x].key < argPairs[y].key
-	})
-	var mapStrBuilder strings.Builder
-	_, err := mapStrBuilder.WriteRune('{')
-	if err != nil {
-		return "", fmt.Errorf("error writing to map string: %w", err)
-	}
-	for i, entry := range argPairs {
-		_, err = mapStrBuilder.WriteString(fmt.Sprintf("%s:%s", entry.key, entry.value))
-		if err != nil {
-			return "", fmt.Errorf("error writing to map string: %w", err)
-		}
-		if i < len(argPairs)-1 {
-			_, err = mapStrBuilder.WriteString(", ")
-			if err != nil {
-				return "", fmt.Errorf("error writing to map string: %w", err)
-			}
-		}
-	}
-	_, err = mapStrBuilder.WriteRune('}')
-	if err != nil {
-		return "", fmt.Errorf("error writing to map string: %w", err)
-	}
-	return mapStrBuilder.String(), nil
-}
-
-// quoteForCEL takes a formatted, unquoted value and quotes it in a manner
-// suitable for embedding directly in CEL.
-func quoteForCEL(refVal ref.Val, unquotedValue string) string {
-	switch refVal.Type() {
-	case types.StringType:
-		return fmt.Sprintf("%q", unquotedValue)
-	case types.BytesType:
-		return fmt.Sprintf("b%q", unquotedValue)
-	case types.DoubleType:
-		// special case to handle infinity/NaN
-		num := refVal.Value().(float64)
-		if math.IsInf(num, 1) || math.IsInf(num, -1) || math.IsNaN(num) {
-			return fmt.Sprintf("%q", unquotedValue)
-		}
-		return unquotedValue
-	default:
-		return unquotedValue
-	}
-}
-
-// FormatString returns the string representation of a CEL value.
-// It is used to implement the %s specifier in the (string).format() extension
-// function.
-func FormatString(arg ref.Val, locale string) (string, error) {
-	switch arg.Type() {
-	case types.ListType:
-		return formatList(arg, locale)
-	case types.MapType:
-		return formatMap(arg, locale)
-	case types.IntType, types.UintType, types.DoubleType,
-		types.BoolType, types.StringType, types.TimestampType, types.BytesType, types.DurationType, types.TypeType:
-		argStrVal := arg.ConvertToType(types.StringType)
-		argStr, ok := argStrVal.Value().(string)
-		if !ok {
-			return "", fmt.Errorf("could not convert argument %q to string", argStrVal)
-		}
-		return argStr, nil
-	case types.NullType:
-		return "null", nil
-	default:
-		return "", fmt.Errorf("string clause can only be used on strings, bools, bytes, ints, doubles, maps, lists, types, durations, and timestamps, was given %s", arg.Type().TypeName())
-	}
-}
-
-func formatDecimal(arg ref.Val, locale string) (string, error) {
-	switch arg.Type() {
-	case types.IntType:
-		argInt, ok := arg.ConvertToType(types.IntType).Value().(int64)
-		if !ok {
-			return "", fmt.Errorf("could not convert \"%s\" to int64", arg.Value())
-		}
-		return fmt.Sprintf("%d", argInt), nil
-	case types.UintType:
-		argInt, ok := arg.ConvertToType(types.UintType).Value().(uint64)
-		if !ok {
-			return "", fmt.Errorf("could not convert \"%s\" to uint64", arg.Value())
-		}
-		return fmt.Sprintf("%d", argInt), nil
-	default:
-		return "", fmt.Errorf("decimal clause can only be used on integers, was given %s", arg.Type().TypeName())
-	}
-}
-
-func matchLanguage(locale string) (language.Tag, error) {
-	matcher, err := makeMatcher(locale)
-	if err != nil {
-		return language.Und, err
-	}
-	tag, _ := language.MatchStrings(matcher, locale)
-	return tag, nil
-}
-
-func makeMatcher(locale string) (language.Matcher, error) {
-	tags := make([]language.Tag, 0)
-	tag, err := language.Parse(locale)
-	if err != nil {
-		return nil, err
-	}
-	tags = append(tags, tag)
-	return language.NewMatcher(tags), nil
-}
-
 // quote implements a string quoting function. The string will be wrapped in
 // double quotes, and all valid CEL escape sequences will be escaped to show up
 // literally if printed. If the input contains any invalid UTF-8, the invalid runes
@@ -938,156 +770,6 @@ func sanitize(s string) string {
 	return sanitizedStringBuilder.String()
 }
 
-type stringFormatter struct{}
-
-func (c *stringFormatter) String(arg ref.Val, locale string) (string, error) {
-	return FormatString(arg, locale)
-}
-
-func (c *stringFormatter) Decimal(arg ref.Val, locale string) (string, error) {
-	return formatDecimal(arg, locale)
-}
-
-func (c *stringFormatter) Fixed(precision *int) func(ref.Val, string) (string, error) {
-	if precision == nil {
-		precision = new(int)
-		*precision = defaultPrecision
-	}
-	return func(arg ref.Val, locale string) (string, error) {
-		strException := false
-		if arg.Type() == types.StringType {
-			argStr := arg.Value().(string)
-			if argStr == "NaN" || argStr == "Infinity" || argStr == "-Infinity" {
-				strException = true
-			}
-		}
-		if arg.Type() != types.DoubleType && !strException {
-			return "", fmt.Errorf("fixed-point clause can only be used on doubles, was given %s", arg.Type().TypeName())
-		}
-		argFloatVal := arg.ConvertToType(types.DoubleType)
-		argFloat, ok := argFloatVal.Value().(float64)
-		if !ok {
-			return "", fmt.Errorf("could not convert \"%s\" to float64", argFloatVal.Value())
-		}
-		fmtStr := fmt.Sprintf("%%.%df", *precision)
-
-		matchedLocale, err := matchLanguage(locale)
-		if err != nil {
-			return "", fmt.Errorf("error matching locale: %w", err)
-		}
-		return message.NewPrinter(matchedLocale).Sprintf(fmtStr, argFloat), nil
-	}
-}
-
-func (c *stringFormatter) Scientific(precision *int) func(ref.Val, string) (string, error) {
-	if precision == nil {
-		precision = new(int)
-		*precision = defaultPrecision
-	}
-	return func(arg ref.Val, locale string) (string, error) {
-		strException := false
-		if arg.Type() == types.StringType {
-			argStr := arg.Value().(string)
-			if argStr == "NaN" || argStr == "Infinity" || argStr == "-Infinity" {
-				strException = true
-			}
-		}
-		if arg.Type() != types.DoubleType && !strException {
-			return "", fmt.Errorf("scientific clause can only be used on doubles, was given %s", arg.Type().TypeName())
-		}
-		argFloatVal := arg.ConvertToType(types.DoubleType)
-		argFloat, ok := argFloatVal.Value().(float64)
-		if !ok {
-			return "", fmt.Errorf("could not convert \"%s\" to float64", argFloatVal.Value())
-		}
-		matchedLocale, err := matchLanguage(locale)
-		if err != nil {
-			return "", fmt.Errorf("error matching locale: %w", err)
-		}
-		fmtStr := fmt.Sprintf("%%%de", *precision)
-		return message.NewPrinter(matchedLocale).Sprintf(fmtStr, argFloat), nil
-	}
-}
-
-func (c *stringFormatter) Binary(arg ref.Val, locale string) (string, error) {
-	switch arg.Type() {
-	case types.IntType:
-		argInt := arg.Value().(int64)
-		// locale is intentionally unused as integers formatted as binary
-		// strings are locale-independent
-		return fmt.Sprintf("%b", argInt), nil
-	case types.UintType:
-		argInt := arg.Value().(uint64)
-		return fmt.Sprintf("%b", argInt), nil
-	case types.BoolType:
-		argBool := arg.Value().(bool)
-		if argBool {
-			return "1", nil
-		}
-		return "0", nil
-	default:
-		return "", fmt.Errorf("only integers and bools can be formatted as binary, was given %s", arg.Type().TypeName())
-	}
-}
-
-func (c *stringFormatter) Hex(useUpper bool) func(ref.Val, string) (string, error) {
-	return func(arg ref.Val, locale string) (string, error) {
-		fmtStr := "%x"
-		if useUpper {
-			fmtStr = "%X"
-		}
-		switch arg.Type() {
-		case types.StringType, types.BytesType:
-			if arg.Type() == types.BytesType {
-				return fmt.Sprintf(fmtStr, arg.Value().([]byte)), nil
-			}
-			return fmt.Sprintf(fmtStr, arg.Value().(string)), nil
-		case types.IntType:
-			argInt, ok := arg.Value().(int64)
-			if !ok {
-				return "", fmt.Errorf("could not convert \"%s\" to int64", arg.Value())
-			}
-			return fmt.Sprintf(fmtStr, argInt), nil
-		case types.UintType:
-			argInt, ok := arg.Value().(uint64)
-			if !ok {
-				return "", fmt.Errorf("could not convert \"%s\" to uint64", arg.Value())
-			}
-			return fmt.Sprintf(fmtStr, argInt), nil
-		default:
-			return "", fmt.Errorf("only integers, byte buffers, and strings can be formatted as hex, was given %s", arg.Type().TypeName())
-		}
-	}
-}
-
-func (c *stringFormatter) Octal(arg ref.Val, locale string) (string, error) {
-	switch arg.Type() {
-	case types.IntType:
-		argInt := arg.Value().(int64)
-		return fmt.Sprintf("%o", argInt), nil
-	case types.UintType:
-		argInt := arg.Value().(uint64)
-		return fmt.Sprintf("%o", argInt), nil
-	default:
-		return "", fmt.Errorf("octal clause can only be used on integers, was given %s", arg.Type().TypeName())
-	}
-}
-
-type stringArgList struct {
-	args traits.Lister
-}
-
-func (c *stringArgList) Arg(index int64) (ref.Val, error) {
-	if index >= c.args.Size().Value().(int64) {
-		return nil, fmt.Errorf("index %d out of range", index)
-	}
-	return c.args.Get(types.Int(index)), nil
-}
-
-func (c *stringArgList) ArgSize() int64 {
-	return c.args.Size().Value().(int64)
-}
-
 var (
 	stringListType = reflect.TypeOf([]string{})
 )
diff --git a/vendor/github.com/google/cel-go/interpreter/BUILD.bazel b/vendor/github.com/google/cel-go/interpreter/BUILD.bazel
index c6a6206..220e23d 100644
--- a/vendor/github.com/google/cel-go/interpreter/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/interpreter/BUILD.bazel
@@ -14,7 +14,6 @@ go_library(
         "decorators.go",
         "dispatcher.go",
         "evalstate.go",
-        "formatting.go",
         "interpretable.go",
         "interpreter.go",
         "optimizations.go",
@@ -25,14 +24,15 @@ go_library(
     importpath = "github.com/google/cel-go/interpreter",
     deps = [
         "//common:go_default_library",
+        "//common/ast:go_default_library",
         "//common/containers:go_default_library",
+        "//common/functions:go_default_library",
         "//common/operators:go_default_library",
         "//common/overloads:go_default_library",
         "//common/types:go_default_library",
         "//common/types/ref:go_default_library",
         "//common/types/traits:go_default_library",
-        "//interpreter/functions:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/durationpb:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
@@ -49,23 +49,25 @@ go_test(
         "attributes_test.go",
         "interpreter_test.go",
         "prune_test.go",
+        "runtimecost_test.go",
     ],
     embed = [
         ":go_default_library",
     ],
     deps = [
         "//checker:go_default_library",
-        "//checker/decls:go_default_library",
         "//common/containers:go_default_library",
         "//common/debug:go_default_library",
+        "//common/decls:go_default_library",
+        "//common/functions:go_default_library",
         "//common/operators:go_default_library",
+        "//common/stdlib:go_default_library",
         "//common/types:go_default_library",
-        "//interpreter/functions:go_default_library",
         "//parser:go_default_library",
         "//test:go_default_library",
         "//test/proto2pb:go_default_library",
         "//test/proto3pb:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/anypb:go_default_library",
     ],
diff --git a/vendor/github.com/google/cel-go/interpreter/activation.go b/vendor/github.com/google/cel-go/interpreter/activation.go
index f82e4e9..1577f35 100644
--- a/vendor/github.com/google/cel-go/interpreter/activation.go
+++ b/vendor/github.com/google/cel-go/interpreter/activation.go
@@ -17,7 +17,6 @@ package interpreter
 import (
 	"errors"
 	"fmt"
-	"sync"
 
 	"github.com/google/cel-go/common/types/ref"
 )
@@ -58,7 +57,7 @@ func (emptyActivation) Parent() Activation             { return nil }
 // The output of the lazy binding will overwrite the variable reference in the internal map.
 //
 // Values which are not represented as ref.Val types on input may be adapted to a ref.Val using
-// the ref.TypeAdapter configured in the environment.
+// the types.Adapter configured in the environment.
 func NewActivation(bindings any) (Activation, error) {
 	if bindings == nil {
 		return nil, errors.New("bindings must be non-nil")
@@ -167,35 +166,3 @@ type partActivation struct {
 func (a *partActivation) UnknownAttributePatterns() []*AttributePattern {
 	return a.unknowns
 }
-
-// varActivation represents a single mutable variable binding.
-//
-// This activation type should only be used within folds as the fold loop controls the object
-// life-cycle.
-type varActivation struct {
-	parent Activation
-	name   string
-	val    ref.Val
-}
-
-// Parent implements the Activation interface method.
-func (v *varActivation) Parent() Activation {
-	return v.parent
-}
-
-// ResolveName implements the Activation interface method.
-func (v *varActivation) ResolveName(name string) (any, bool) {
-	if name == v.name {
-		return v.val, true
-	}
-	return v.parent.ResolveName(name)
-}
-
-var (
-	// pool of var activations to reduce allocations during folds.
-	varActivationPool = &sync.Pool{
-		New: func() any {
-			return &varActivation{}
-		},
-	}
-)
diff --git a/vendor/github.com/google/cel-go/interpreter/attribute_patterns.go b/vendor/github.com/google/cel-go/interpreter/attribute_patterns.go
index afb7c8d..8f19bde 100644
--- a/vendor/github.com/google/cel-go/interpreter/attribute_patterns.go
+++ b/vendor/github.com/google/cel-go/interpreter/attribute_patterns.go
@@ -15,6 +15,8 @@
 package interpreter
 
 import (
+	"fmt"
+
 	"github.com/google/cel-go/common/containers"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
@@ -176,10 +178,8 @@ func numericValueEquals(value any, celValue ref.Val) bool {
 
 // NewPartialAttributeFactory returns an AttributeFactory implementation capable of performing
 // AttributePattern matches with PartialActivation inputs.
-func NewPartialAttributeFactory(container *containers.Container,
-	adapter ref.TypeAdapter,
-	provider ref.TypeProvider) AttributeFactory {
-	fac := NewAttributeFactory(container, adapter, provider)
+func NewPartialAttributeFactory(container *containers.Container, adapter types.Adapter, provider types.Provider, opts ...AttrFactoryOption) AttributeFactory {
+	fac := NewAttributeFactory(container, adapter, provider, opts...)
 	return &partialAttributeFactory{
 		AttributeFactory: fac,
 		container:        container,
@@ -191,8 +191,8 @@ func NewPartialAttributeFactory(container *containers.Container,
 type partialAttributeFactory struct {
 	AttributeFactory
 	container *containers.Container
-	adapter   ref.TypeAdapter
-	provider  ref.TypeProvider
+	adapter   types.Adapter
+	provider  types.Provider
 }
 
 // AbsoluteAttribute implementation of the AttributeFactory interface which wraps the
@@ -241,12 +241,15 @@ func (fac *partialAttributeFactory) matchesUnknownPatterns(
 	vars PartialActivation,
 	attrID int64,
 	variableNames []string,
-	qualifiers []Qualifier) (types.Unknown, error) {
+	qualifiers []Qualifier) (*types.Unknown, error) {
 	patterns := vars.UnknownAttributePatterns()
 	candidateIndices := map[int]struct{}{}
 	for _, variable := range variableNames {
 		for i, pat := range patterns {
 			if pat.VariableMatches(variable) {
+				if len(qualifiers) == 0 {
+					return types.NewUnknown(attrID, types.NewAttributeTrail(variable)), nil
+				}
 				candidateIndices[i] = struct{}{}
 			}
 		}
@@ -255,10 +258,6 @@ func (fac *partialAttributeFactory) matchesUnknownPatterns(
 	if len(candidateIndices) == 0 {
 		return nil, nil
 	}
-	// Determine whether to return early if there are no qualifiers.
-	if len(qualifiers) == 0 {
-		return types.Unknown{attrID}, nil
-	}
 	// Resolve the attribute qualifiers into a static set. This prevents more dynamic
 	// Attribute resolutions than necessary when there are multiple unknown patterns
 	// that traverse the same Attribute-based qualifier field.
@@ -300,7 +299,28 @@ func (fac *partialAttributeFactory) matchesUnknownPatterns(
 			}
 		}
 		if isUnk {
-			return types.Unknown{matchExprID}, nil
+			attr := types.NewAttributeTrail(pat.variable)
+			for i := 0; i < len(qualPats) && i < len(newQuals); i++ {
+				if qual, ok := newQuals[i].(ConstantQualifier); ok {
+					switch v := qual.Value().Value().(type) {
+					case bool:
+						types.QualifyAttribute[bool](attr, v)
+					case float64:
+						types.QualifyAttribute[int64](attr, int64(v))
+					case int64:
+						types.QualifyAttribute[int64](attr, v)
+					case string:
+						types.QualifyAttribute[string](attr, v)
+					case uint64:
+						types.QualifyAttribute[uint64](attr, v)
+					default:
+						types.QualifyAttribute[string](attr, fmt.Sprintf("%v", v))
+					}
+				} else {
+					types.QualifyAttribute[string](attr, "*")
+				}
+			}
+			return types.NewUnknown(matchExprID, attr), nil
 		}
 	}
 	return nil, nil
diff --git a/vendor/github.com/google/cel-go/interpreter/attributes.go b/vendor/github.com/google/cel-go/interpreter/attributes.go
index d2205d9..b1b3aac 100644
--- a/vendor/github.com/google/cel-go/interpreter/attributes.go
+++ b/vendor/github.com/google/cel-go/interpreter/attributes.go
@@ -22,8 +22,6 @@ import (
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // AttributeFactory provides methods creating Attribute and Qualifier values.
@@ -61,7 +59,7 @@ type AttributeFactory interface {
 	// The qualifier may consider the object type being qualified, if present. If absent, the
 	// qualification should be considered dynamic and the qualification should still work, though
 	// it may be sub-optimal.
-	NewQualifier(objType *exprpb.Type, qualID int64, val any, opt bool) (Qualifier, error)
+	NewQualifier(objType *types.Type, qualID int64, val any, opt bool) (Qualifier, error)
 }
 
 // Qualifier marker interface for designating different qualifier values and where they appear
@@ -128,21 +126,39 @@ type NamespacedAttribute interface {
 	Qualifiers() []Qualifier
 }
 
+// AttrFactoryOption specifies a functional option for configuring an attribute factory.
+type AttrFactoryOption func(*attrFactory) *attrFactory
+
+// EnableErrorOnBadPresenceTest error generation when a presence test or optional field selection
+// is performed on a primitive type.
+func EnableErrorOnBadPresenceTest(value bool) AttrFactoryOption {
+	return func(fac *attrFactory) *attrFactory {
+		fac.errorOnBadPresenceTest = value
+		return fac
+	}
+}
+
 // NewAttributeFactory returns a default AttributeFactory which is produces Attribute values
 // capable of resolving types by simple names and qualify the values using the supported qualifier
 // types: bool, int, string, and uint.
-func NewAttributeFactory(cont *containers.Container, a ref.TypeAdapter, p ref.TypeProvider) AttributeFactory {
-	return &attrFactory{
+func NewAttributeFactory(cont *containers.Container, a types.Adapter, p types.Provider, opts ...AttrFactoryOption) AttributeFactory {
+	fac := &attrFactory{
 		container: cont,
 		adapter:   a,
 		provider:  p,
 	}
+	for _, o := range opts {
+		fac = o(fac)
+	}
+	return fac
 }
 
 type attrFactory struct {
 	container *containers.Container
-	adapter   ref.TypeAdapter
-	provider  ref.TypeProvider
+	adapter   types.Adapter
+	provider  types.Provider
+
+	errorOnBadPresenceTest bool
 }
 
 // AbsoluteAttribute refers to a variable value and an optional qualifier path.
@@ -151,12 +167,13 @@ type attrFactory struct {
 // resolution rules.
 func (r *attrFactory) AbsoluteAttribute(id int64, names ...string) NamespacedAttribute {
 	return &absoluteAttribute{
-		id:             id,
-		namespaceNames: names,
-		qualifiers:     []Qualifier{},
-		adapter:        r.adapter,
-		provider:       r.provider,
-		fac:            r,
+		id:                     id,
+		namespaceNames:         names,
+		qualifiers:             []Qualifier{},
+		adapter:                r.adapter,
+		provider:               r.provider,
+		fac:                    r,
+		errorOnBadPresenceTest: r.errorOnBadPresenceTest,
 	}
 }
 
@@ -190,22 +207,23 @@ func (r *attrFactory) MaybeAttribute(id int64, name string) Attribute {
 // RelativeAttribute refers to an expression and an optional qualifier path.
 func (r *attrFactory) RelativeAttribute(id int64, operand Interpretable) Attribute {
 	return &relativeAttribute{
-		id:         id,
-		operand:    operand,
-		qualifiers: []Qualifier{},
-		adapter:    r.adapter,
-		fac:        r,
+		id:                     id,
+		operand:                operand,
+		qualifiers:             []Qualifier{},
+		adapter:                r.adapter,
+		fac:                    r,
+		errorOnBadPresenceTest: r.errorOnBadPresenceTest,
 	}
 }
 
 // NewQualifier is an implementation of the AttributeFactory interface.
-func (r *attrFactory) NewQualifier(objType *exprpb.Type, qualID int64, val any, opt bool) (Qualifier, error) {
+func (r *attrFactory) NewQualifier(objType *types.Type, qualID int64, val any, opt bool) (Qualifier, error) {
 	// Before creating a new qualifier check to see if this is a protobuf message field access.
 	// If so, use the precomputed GetFrom qualification method rather than the standard
 	// stringQualifier.
 	str, isStr := val.(string)
-	if isStr && objType != nil && objType.GetMessageType() != "" {
-		ft, found := r.provider.FindFieldType(objType.GetMessageType(), str)
+	if isStr && objType != nil && objType.Kind() == types.StructKind {
+		ft, found := r.provider.FindStructFieldType(objType.TypeName(), str)
 		if found && ft.IsSet != nil && ft.GetFrom != nil {
 			return &fieldQualifier{
 				id:        qualID,
@@ -216,7 +234,7 @@ func (r *attrFactory) NewQualifier(objType *exprpb.Type, qualID int64, val any,
 			}, nil
 		}
 	}
-	return newQualifier(r.adapter, qualID, val, opt)
+	return newQualifier(r.adapter, qualID, val, opt, r.errorOnBadPresenceTest)
 }
 
 type absoluteAttribute struct {
@@ -225,9 +243,11 @@ type absoluteAttribute struct {
 	// (package) of the expression.
 	namespaceNames []string
 	qualifiers     []Qualifier
-	adapter        ref.TypeAdapter
-	provider       ref.TypeProvider
+	adapter        types.Adapter
+	provider       types.Provider
 	fac            AttributeFactory
+
+	errorOnBadPresenceTest bool
 }
 
 // ID implements the Attribute interface method.
@@ -289,12 +309,19 @@ func (a *absoluteAttribute) Resolve(vars Activation) (any, error) {
 		// determine whether the type is unknown before returning.
 		obj, found := vars.ResolveName(nm)
 		if found {
+			if celErr, ok := obj.(*types.Err); ok {
+				return nil, celErr.Unwrap()
+			}
 			obj, isOpt, err := applyQualifiers(vars, obj, a.qualifiers)
 			if err != nil {
 				return nil, err
 			}
 			if isOpt {
-				return types.OptionalOf(a.adapter.NativeToValue(obj)), nil
+				val := a.adapter.NativeToValue(obj)
+				if types.IsUnknown(val) {
+					return val, nil
+				}
+				return types.OptionalOf(val), nil
 			}
 			return obj, nil
 		}
@@ -321,7 +348,7 @@ type conditionalAttribute struct {
 	expr    Interpretable
 	truthy  Attribute
 	falsy   Attribute
-	adapter ref.TypeAdapter
+	adapter types.Adapter
 	fac     AttributeFactory
 }
 
@@ -389,8 +416,8 @@ func (a *conditionalAttribute) String() string {
 type maybeAttribute struct {
 	id       int64
 	attrs    []NamespacedAttribute
-	adapter  ref.TypeAdapter
-	provider ref.TypeProvider
+	adapter  types.Adapter
+	provider types.Provider
 	fac      AttributeFactory
 }
 
@@ -507,8 +534,10 @@ type relativeAttribute struct {
 	id         int64
 	operand    Interpretable
 	qualifiers []Qualifier
-	adapter    ref.TypeAdapter
+	adapter    types.Adapter
 	fac        AttributeFactory
+
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Attribute interface method.
@@ -558,7 +587,11 @@ func (a *relativeAttribute) Resolve(vars Activation) (any, error) {
 		return nil, err
 	}
 	if isOpt {
-		return types.OptionalOf(a.adapter.NativeToValue(obj)), nil
+		val := a.adapter.NativeToValue(obj)
+		if types.IsUnknown(val) {
+			return val, nil
+		}
+		return types.OptionalOf(val), nil
 	}
 	return obj, nil
 }
@@ -568,7 +601,7 @@ func (a *relativeAttribute) String() string {
 	return fmt.Sprintf("id: %v, operand: %v", a.id, a.operand)
 }
 
-func newQualifier(adapter ref.TypeAdapter, id int64, v any, opt bool) (Qualifier, error) {
+func newQualifier(adapter types.Adapter, id int64, v any, opt, errorOnBadPresenceTest bool) (Qualifier, error) {
 	var qual Qualifier
 	switch val := v.(type) {
 	case Attribute:
@@ -583,73 +616,140 @@ func newQualifier(adapter ref.TypeAdapter, id int64, v any, opt bool) (Qualifier
 		}, nil
 	case string:
 		qual = &stringQualifier{
-			id:       id,
-			value:    val,
-			celValue: types.String(val),
-			adapter:  adapter,
-			optional: opt,
+			id:                     id,
+			value:                  val,
+			celValue:               types.String(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case int:
 		qual = &intQualifier{
-			id: id, value: int64(val), celValue: types.Int(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  int64(val),
+			celValue:               types.Int(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case int32:
 		qual = &intQualifier{
-			id: id, value: int64(val), celValue: types.Int(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  int64(val),
+			celValue:               types.Int(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case int64:
 		qual = &intQualifier{
-			id: id, value: val, celValue: types.Int(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  val,
+			celValue:               types.Int(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case uint:
 		qual = &uintQualifier{
-			id: id, value: uint64(val), celValue: types.Uint(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  uint64(val),
+			celValue:               types.Uint(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case uint32:
 		qual = &uintQualifier{
-			id: id, value: uint64(val), celValue: types.Uint(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  uint64(val),
+			celValue:               types.Uint(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case uint64:
 		qual = &uintQualifier{
-			id: id, value: val, celValue: types.Uint(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  val,
+			celValue:               types.Uint(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case bool:
 		qual = &boolQualifier{
-			id: id, value: val, celValue: types.Bool(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  val,
+			celValue:               types.Bool(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case float32:
 		qual = &doubleQualifier{
-			id:       id,
-			value:    float64(val),
-			celValue: types.Double(val),
-			adapter:  adapter,
-			optional: opt,
+			id:                     id,
+			value:                  float64(val),
+			celValue:               types.Double(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case float64:
 		qual = &doubleQualifier{
-			id: id, value: val, celValue: types.Double(val), adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  val,
+			celValue:               types.Double(val),
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case types.String:
 		qual = &stringQualifier{
-			id: id, value: string(val), celValue: val, adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  string(val),
+			celValue:               val,
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case types.Int:
 		qual = &intQualifier{
-			id: id, value: int64(val), celValue: val, adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  int64(val),
+			celValue:               val,
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case types.Uint:
 		qual = &uintQualifier{
-			id: id, value: uint64(val), celValue: val, adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  uint64(val),
+			celValue:               val,
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case types.Bool:
 		qual = &boolQualifier{
-			id: id, value: bool(val), celValue: val, adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  bool(val),
+			celValue:               val,
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
 	case types.Double:
 		qual = &doubleQualifier{
-			id: id, value: float64(val), celValue: val, adapter: adapter, optional: opt,
+			id:                     id,
+			value:                  float64(val),
+			celValue:               val,
+			adapter:                adapter,
+			optional:               opt,
+			errorOnBadPresenceTest: errorOnBadPresenceTest,
 		}
-	case types.Unknown:
+	case *types.Unknown:
 		qual = &unknownQualifier{id: id, value: val}
 	default:
 		if q, ok := v.(Qualifier); ok {
@@ -678,11 +778,12 @@ func (q *attrQualifier) IsOptional() bool {
 }
 
 type stringQualifier struct {
-	id       int64
-	value    string
-	celValue ref.Val
-	adapter  ref.TypeAdapter
-	optional bool
+	id                     int64
+	value                  string
+	celValue               ref.Val
+	adapter                types.Adapter
+	optional               bool
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -765,7 +866,7 @@ func (q *stringQualifier) qualifyInternal(vars Activation, obj any, presenceTest
 			return obj, true, nil
 		}
 	default:
-		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly)
+		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly, q.errorOnBadPresenceTest)
 	}
 	if presenceTest {
 		return nil, false, nil
@@ -779,11 +880,12 @@ func (q *stringQualifier) Value() ref.Val {
 }
 
 type intQualifier struct {
-	id       int64
-	value    int64
-	celValue ref.Val
-	adapter  ref.TypeAdapter
-	optional bool
+	id                     int64
+	value                  int64
+	celValue               ref.Val
+	adapter                types.Adapter
+	optional               bool
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -889,7 +991,7 @@ func (q *intQualifier) qualifyInternal(vars Activation, obj any, presenceTest, p
 			return o[i], true, nil
 		}
 	default:
-		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly)
+		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly, q.errorOnBadPresenceTest)
 	}
 	if presenceTest {
 		return nil, false, nil
@@ -906,11 +1008,12 @@ func (q *intQualifier) Value() ref.Val {
 }
 
 type uintQualifier struct {
-	id       int64
-	value    uint64
-	celValue ref.Val
-	adapter  ref.TypeAdapter
-	optional bool
+	id                     int64
+	value                  uint64
+	celValue               ref.Val
+	adapter                types.Adapter
+	optional               bool
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -957,7 +1060,7 @@ func (q *uintQualifier) qualifyInternal(vars Activation, obj any, presenceTest,
 			return obj, true, nil
 		}
 	default:
-		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly)
+		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly, q.errorOnBadPresenceTest)
 	}
 	if presenceTest {
 		return nil, false, nil
@@ -971,11 +1074,12 @@ func (q *uintQualifier) Value() ref.Val {
 }
 
 type boolQualifier struct {
-	id       int64
-	value    bool
-	celValue ref.Val
-	adapter  ref.TypeAdapter
-	optional bool
+	id                     int64
+	value                  bool
+	celValue               ref.Val
+	adapter                types.Adapter
+	optional               bool
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -1008,7 +1112,7 @@ func (q *boolQualifier) qualifyInternal(vars Activation, obj any, presenceTest,
 			return obj, true, nil
 		}
 	default:
-		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly)
+		return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly, q.errorOnBadPresenceTest)
 	}
 	if presenceTest {
 		return nil, false, nil
@@ -1027,8 +1131,8 @@ func (q *boolQualifier) Value() ref.Val {
 type fieldQualifier struct {
 	id        int64
 	Name      string
-	FieldType *ref.FieldType
-	adapter   ref.TypeAdapter
+	FieldType *types.FieldType
+	adapter   types.Adapter
 	optional  bool
 }
 
@@ -1083,11 +1187,12 @@ func (q *fieldQualifier) Value() ref.Val {
 // type may not be known ahead of time and may not conform to the standard types supported as valid
 // protobuf map key types.
 type doubleQualifier struct {
-	id       int64
-	value    float64
-	celValue ref.Val
-	adapter  ref.TypeAdapter
-	optional bool
+	id                     int64
+	value                  float64
+	celValue               ref.Val
+	adapter                types.Adapter
+	optional               bool
+	errorOnBadPresenceTest bool
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -1111,7 +1216,7 @@ func (q *doubleQualifier) QualifyIfPresent(vars Activation, obj any, presenceOnl
 }
 
 func (q *doubleQualifier) qualifyInternal(vars Activation, obj any, presenceTest, presenceOnly bool) (any, bool, error) {
-	return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly)
+	return refQualify(q.adapter, obj, q.celValue, presenceTest, presenceOnly, q.errorOnBadPresenceTest)
 }
 
 // Value implements the ConstantQualifier interface
@@ -1123,7 +1228,7 @@ func (q *doubleQualifier) Value() ref.Val {
 // for any value subject to qualification. This is consistent with CEL's unknown handling elsewhere.
 type unknownQualifier struct {
 	id    int64
-	value types.Unknown
+	value *types.Unknown
 }
 
 // ID is an implementation of the Qualifier interface method.
@@ -1171,6 +1276,9 @@ func applyQualifiers(vars Activation, obj any, qualifiers []Qualifier) (any, boo
 				return nil, false, err
 			}
 			if !present {
+				// We return optional none here with a presence of 'false' as the layers
+				// above will attempt to call types.OptionalOf() on a present value if any
+				// of the qualifiers is optional.
 				return types.OptionalNone, false, nil
 			}
 		} else {
@@ -1214,15 +1322,17 @@ func attrQualifyIfPresent(fac AttributeFactory, vars Activation, obj any, qualAt
 
 // refQualify attempts to convert the value to a CEL value and then uses reflection methods to try and
 // apply the qualifier with the option to presence test field accesses before retrieving field values.
-func refQualify(adapter ref.TypeAdapter, obj any, idx ref.Val, presenceTest, presenceOnly bool) (ref.Val, bool, error) {
+func refQualify(adapter types.Adapter, obj any, idx ref.Val, presenceTest, presenceOnly, errorOnBadPresenceTest bool) (ref.Val, bool, error) {
 	celVal := adapter.NativeToValue(obj)
 	switch v := celVal.(type) {
-	case types.Unknown:
+	case *types.Unknown:
 		return v, true, nil
 	case *types.Err:
 		return nil, false, v
 	case traits.Mapper:
 		val, found := v.Find(idx)
+		// If the index is of the wrong type for the map, then it is possible
+		// for the Find call to produce an error.
 		if types.IsError(val) {
 			return nil, false, val.(*types.Err)
 		}
@@ -1234,6 +1344,8 @@ func refQualify(adapter ref.TypeAdapter, obj any, idx ref.Val, presenceTest, pre
 		}
 		return nil, false, missingKey(idx)
 	case traits.Lister:
+		// If the index argument is not a valid numeric type, then it is possible
+		// for the index operation to produce an error.
 		i, err := types.IndexOrError(idx)
 		if err != nil {
 			return nil, false, err
@@ -1254,6 +1366,8 @@ func refQualify(adapter ref.TypeAdapter, obj any, idx ref.Val, presenceTest, pre
 				if types.IsError(presence) {
 					return nil, false, presence.(*types.Err)
 				}
+				// If not found or presence only test, then return.
+				// Otherwise, if found, obtain the value later on.
 				if presenceOnly || presence == types.False {
 					return nil, presence == types.True, nil
 				}
@@ -1265,7 +1379,7 @@ func refQualify(adapter ref.TypeAdapter, obj any, idx ref.Val, presenceTest, pre
 		}
 		return val, true, nil
 	default:
-		if presenceTest {
+		if presenceTest && !errorOnBadPresenceTest {
 			return nil, false, nil
 		}
 		return nil, false, missingKey(idx)
@@ -1320,17 +1434,3 @@ func (e *resolutionError) Error() string {
 func (e *resolutionError) Is(err error) bool {
 	return err.Error() == e.Error()
 }
-
-func findMin(x, y int64) int64 {
-	if x < y {
-		return x
-	}
-	return y
-}
-
-func findMax(x, y int64) int64 {
-	if x > y {
-		return x
-	}
-	return y
-}
diff --git a/vendor/github.com/google/cel-go/interpreter/decorators.go b/vendor/github.com/google/cel-go/interpreter/decorators.go
index 208487b..502db35 100644
--- a/vendor/github.com/google/cel-go/interpreter/decorators.go
+++ b/vendor/github.com/google/cel-go/interpreter/decorators.go
@@ -75,15 +75,13 @@ func decDisableShortcircuits() InterpretableDecorator {
 		switch expr := i.(type) {
 		case *evalOr:
 			return &evalExhaustiveOr{
-				id:  expr.id,
-				lhs: expr.lhs,
-				rhs: expr.rhs,
+				id:    expr.id,
+				terms: expr.terms,
 			}, nil
 		case *evalAnd:
 			return &evalExhaustiveAnd{
-				id:  expr.id,
-				lhs: expr.lhs,
-				rhs: expr.rhs,
+				id:    expr.id,
+				terms: expr.terms,
 			}, nil
 		case *evalFold:
 			expr.exhaustive = true
diff --git a/vendor/github.com/google/cel-go/interpreter/dispatcher.go b/vendor/github.com/google/cel-go/interpreter/dispatcher.go
index febf9d8..8f0bdb7 100644
--- a/vendor/github.com/google/cel-go/interpreter/dispatcher.go
+++ b/vendor/github.com/google/cel-go/interpreter/dispatcher.go
@@ -17,7 +17,7 @@ package interpreter
 import (
 	"fmt"
 
-	"github.com/google/cel-go/interpreter/functions"
+	"github.com/google/cel-go/common/functions"
 )
 
 // Dispatcher resolves function calls to their appropriate overload.
diff --git a/vendor/github.com/google/cel-go/interpreter/evalstate.go b/vendor/github.com/google/cel-go/interpreter/evalstate.go
index cc0d3e6..4bdd1fd 100644
--- a/vendor/github.com/google/cel-go/interpreter/evalstate.go
+++ b/vendor/github.com/google/cel-go/interpreter/evalstate.go
@@ -66,7 +66,11 @@ func (s *evalState) Value(exprID int64) (ref.Val, bool) {
 
 // SetValue is an implementation of the EvalState interface method.
 func (s *evalState) SetValue(exprID int64, val ref.Val) {
-	s.values[exprID] = val
+	if val == nil {
+		delete(s.values, exprID)
+	} else {
+		s.values[exprID] = val
+	}
 }
 
 // Reset implements the EvalState interface method.
diff --git a/vendor/github.com/google/cel-go/interpreter/formatting.go b/vendor/github.com/google/cel-go/interpreter/formatting.go
deleted file mode 100644
index 6a98f6f..0000000
--- a/vendor/github.com/google/cel-go/interpreter/formatting.go
+++ /dev/null
@@ -1,383 +0,0 @@
-// Copyright 2023 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package interpreter
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"unicode"
-
-	"github.com/google/cel-go/common/types"
-	"github.com/google/cel-go/common/types/ref"
-)
-
-type typeVerifier func(int64, ...*types.TypeValue) (bool, error)
-
-// InterpolateFormattedString checks the syntax and cardinality of any string.format calls present in the expression and reports
-// any errors at compile time.
-func InterpolateFormattedString(verifier typeVerifier) InterpretableDecorator {
-	return func(inter Interpretable) (Interpretable, error) {
-		call, ok := inter.(InterpretableCall)
-		if !ok {
-			return inter, nil
-		}
-		if call.OverloadID() != "string_format" {
-			return inter, nil
-		}
-		args := call.Args()
-		if len(args) != 2 {
-			return nil, fmt.Errorf("wrong number of arguments to string.format (expected 2, got %d)", len(args))
-		}
-		fmtStrInter, ok := args[0].(InterpretableConst)
-		if !ok {
-			return inter, nil
-		}
-		var fmtArgsInter InterpretableConstructor
-		fmtArgsInter, ok = args[1].(InterpretableConstructor)
-		if !ok {
-			return inter, nil
-		}
-		if fmtArgsInter.Type() != types.ListType {
-			// don't necessarily return an error since the list may be DynType
-			return inter, nil
-		}
-		formatStr := fmtStrInter.Value().Value().(string)
-		initVals := fmtArgsInter.InitVals()
-
-		formatCheck := &formatCheck{
-			args:     initVals,
-			verifier: verifier,
-		}
-		// use a placeholder locale, since locale doesn't affect syntax
-		_, err := ParseFormatString(formatStr, formatCheck, formatCheck, "en_US")
-		if err != nil {
-			return nil, err
-		}
-		seenArgs := formatCheck.argsRequested
-		if len(initVals) > seenArgs {
-			return nil, fmt.Errorf("too many arguments supplied to string.format (expected %d, got %d)", seenArgs, len(initVals))
-		}
-		return inter, nil
-	}
-}
-
-type formatCheck struct {
-	args                []Interpretable
-	argsRequested       int
-	curArgIndex         int64
-	enableCheckArgTypes bool
-	verifier            typeVerifier
-}
-
-func (c *formatCheck) String(arg ref.Val, locale string) (string, error) {
-	valid, err := verifyString(c.args[c.curArgIndex], c.verifier)
-	if err != nil {
-		return "", err
-	}
-	if !valid {
-		return "", errors.New("string clause can only be used on strings, bools, bytes, ints, doubles, maps, lists, types, durations, and timestamps")
-	}
-	return "", nil
-}
-
-func (c *formatCheck) Decimal(arg ref.Val, locale string) (string, error) {
-	id := c.args[c.curArgIndex].ID()
-	valid, err := c.verifier(id, types.IntType, types.UintType)
-	if err != nil {
-		return "", err
-	}
-	if !valid {
-		return "", errors.New("integer clause can only be used on integers")
-	}
-	return "", nil
-}
-
-func (c *formatCheck) Fixed(precision *int) func(ref.Val, string) (string, error) {
-	return func(arg ref.Val, locale string) (string, error) {
-		id := c.args[c.curArgIndex].ID()
-		// we allow StringType since "NaN", "Infinity", and "-Infinity" are also valid values
-		valid, err := c.verifier(id, types.DoubleType, types.StringType)
-		if err != nil {
-			return "", err
-		}
-		if !valid {
-			return "", errors.New("fixed-point clause can only be used on doubles")
-		}
-		return "", nil
-	}
-}
-
-func (c *formatCheck) Scientific(precision *int) func(ref.Val, string) (string, error) {
-	return func(arg ref.Val, locale string) (string, error) {
-		id := c.args[c.curArgIndex].ID()
-		valid, err := c.verifier(id, types.DoubleType, types.StringType)
-		if err != nil {
-			return "", err
-		}
-		if !valid {
-			return "", errors.New("scientific clause can only be used on doubles")
-		}
-		return "", nil
-	}
-}
-
-func (c *formatCheck) Binary(arg ref.Val, locale string) (string, error) {
-	id := c.args[c.curArgIndex].ID()
-	valid, err := c.verifier(id, types.IntType, types.UintType, types.BoolType)
-	if err != nil {
-		return "", err
-	}
-	if !valid {
-		return "", errors.New("only integers and bools can be formatted as binary")
-	}
-	return "", nil
-}
-
-func (c *formatCheck) Hex(useUpper bool) func(ref.Val, string) (string, error) {
-	return func(arg ref.Val, locale string) (string, error) {
-		id := c.args[c.curArgIndex].ID()
-		valid, err := c.verifier(id, types.IntType, types.UintType, types.StringType, types.BytesType)
-		if err != nil {
-			return "", err
-		}
-		if !valid {
-			return "", errors.New("only integers, byte buffers, and strings can be formatted as hex")
-		}
-		return "", nil
-	}
-}
-
-func (c *formatCheck) Octal(arg ref.Val, locale string) (string, error) {
-	id := c.args[c.curArgIndex].ID()
-	valid, err := c.verifier(id, types.IntType, types.UintType)
-	if err != nil {
-		return "", err
-	}
-	if !valid {
-		return "", errors.New("octal clause can only be used on integers")
-	}
-	return "", nil
-}
-
-func (c *formatCheck) Arg(index int64) (ref.Val, error) {
-	c.argsRequested++
-	c.curArgIndex = index
-	// return a dummy value - this is immediately passed to back to us
-	// through one of the FormatCallback functions, so anything will do
-	return types.Int(0), nil
-}
-
-func (c *formatCheck) ArgSize() int64 {
-	return int64(len(c.args))
-}
-
-func verifyString(sub Interpretable, verifier typeVerifier) (bool, error) {
-	subVerified, err := verifier(sub.ID(),
-		types.ListType, types.MapType, types.IntType, types.UintType, types.DoubleType,
-		types.BoolType, types.StringType, types.TimestampType, types.BytesType, types.DurationType, types.TypeType, types.NullType)
-	if err != nil {
-		return false, err
-	}
-	if !subVerified {
-		return false, nil
-	}
-	con, ok := sub.(InterpretableConstructor)
-	if ok {
-		members := con.InitVals()
-		for _, m := range members {
-			// recursively verify if we're dealing with a list/map
-			verified, err := verifyString(m, verifier)
-			if err != nil {
-				return false, err
-			}
-			if !verified {
-				return false, nil
-			}
-		}
-	}
-	return true, nil
-
-}
-
-// FormatStringInterpolator is an interface that allows user-defined behavior
-// for formatting clause implementations, as well as argument retrieval.
-// Each function is expected to support the appropriate types as laid out in
-// the string.format documentation, and to return an error if given an inappropriate type.
-type FormatStringInterpolator interface {
-	// String takes a ref.Val and a string representing the current locale identifier
-	// and returns the Val formatted as a string, or an error if one occurred.
-	String(ref.Val, string) (string, error)
-
-	// Decimal takes a ref.Val and a string representing the current locale identifier
-	// and returns the Val formatted as a decimal integer, or an error if one occurred.
-	Decimal(ref.Val, string) (string, error)
-
-	// Fixed takes an int pointer representing precision (or nil if none was given) and
-	// returns a function operating in a similar manner to String and Decimal, taking a
-	// ref.Val and locale and returning the appropriate string. A closure is returned
-	// so precision can be set without needing an additional function call/configuration.
-	Fixed(*int) func(ref.Val, string) (string, error)
-
-	// Scientific functions identically to Fixed, except the string returned from the closure
-	// is expected to be in scientific notation.
-	Scientific(*int) func(ref.Val, string) (string, error)
-
-	// Binary takes a ref.Val and a string representing the current locale identifier
-	// and returns the Val formatted as a binary integer, or an error if one occurred.
-	Binary(ref.Val, string) (string, error)
-
-	// Hex takes a boolean that, if true, indicates the hex string output by the returned
-	// closure should use uppercase letters for A-F.
-	Hex(bool) func(ref.Val, string) (string, error)
-
-	// Octal takes a ref.Val and a string representing the current locale identifier and
-	// returns the Val formatted in octal, or an error if one occurred.
-	Octal(ref.Val, string) (string, error)
-}
-
-// FormatList is an interface that allows user-defined list-like datatypes to be used
-// for formatting clause implementations.
-type FormatList interface {
-	// Arg returns the ref.Val at the given index, or an error if one occurred.
-	Arg(int64) (ref.Val, error)
-	// ArgSize returns the length of the argument list.
-	ArgSize() int64
-}
-
-type clauseImpl func(ref.Val, string) (string, error)
-
-// ParseFormatString formats a string according to the string.format syntax, taking the clause implementations
-// from the provided FormatCallback and the args from the given FormatList.
-func ParseFormatString(formatStr string, callback FormatStringInterpolator, list FormatList, locale string) (string, error) {
-	i := 0
-	argIndex := 0
-	var builtStr strings.Builder
-	for i < len(formatStr) {
-		if formatStr[i] == '%' {
-			if i+1 < len(formatStr) && formatStr[i+1] == '%' {
-				err := builtStr.WriteByte('%')
-				if err != nil {
-					return "", fmt.Errorf("error writing format string: %w", err)
-				}
-				i += 2
-				continue
-			} else {
-				argAny, err := list.Arg(int64(argIndex))
-				if err != nil {
-					return "", err
-				}
-				if i+1 >= len(formatStr) {
-					return "", errors.New("unexpected end of string")
-				}
-				if int64(argIndex) >= list.ArgSize() {
-					return "", fmt.Errorf("index %d out of range", argIndex)
-				}
-				numRead, val, refErr := parseAndFormatClause(formatStr[i:], argAny, callback, list, locale)
-				if refErr != nil {
-					return "", refErr
-				}
-				_, err = builtStr.WriteString(val)
-				if err != nil {
-					return "", fmt.Errorf("error writing format string: %w", err)
-				}
-				i += numRead
-				argIndex++
-			}
-		} else {
-			err := builtStr.WriteByte(formatStr[i])
-			if err != nil {
-				return "", fmt.Errorf("error writing format string: %w", err)
-			}
-			i++
-		}
-	}
-	return builtStr.String(), nil
-}
-
-// parseAndFormatClause parses the format clause at the start of the given string with val, and returns
-// how many characters were consumed and the substituted string form of val, or an error if one occurred.
-func parseAndFormatClause(formatStr string, val ref.Val, callback FormatStringInterpolator, list FormatList, locale string) (int, string, error) {
-	i := 1
-	read, formatter, err := parseFormattingClause(formatStr[i:], callback)
-	i += read
-	if err != nil {
-		return -1, "", fmt.Errorf("could not parse formatting clause: %s", err)
-	}
-
-	valStr, err := formatter(val, locale)
-	if err != nil {
-		return -1, "", fmt.Errorf("error during formatting: %s", err)
-	}
-	return i, valStr, nil
-}
-
-func parseFormattingClause(formatStr string, callback FormatStringInterpolator) (int, clauseImpl, error) {
-	i := 0
-	read, precision, err := parsePrecision(formatStr[i:])
-	i += read
-	if err != nil {
-		return -1, nil, fmt.Errorf("error while parsing precision: %w", err)
-	}
-	r := rune(formatStr[i])
-	i++
-	switch r {
-	case 's':
-		return i, callback.String, nil
-	case 'd':
-		return i, callback.Decimal, nil
-	case 'f':
-		return i, callback.Fixed(precision), nil
-	case 'e':
-		return i, callback.Scientific(precision), nil
-	case 'b':
-		return i, callback.Binary, nil
-	case 'x', 'X':
-		return i, callback.Hex(unicode.IsUpper(r)), nil
-	case 'o':
-		return i, callback.Octal, nil
-	default:
-		return -1, nil, fmt.Errorf("unrecognized formatting clause \"%c\"", r)
-	}
-}
-
-func parsePrecision(formatStr string) (int, *int, error) {
-	i := 0
-	if formatStr[i] != '.' {
-		return i, nil, nil
-	}
-	i++
-	var buffer strings.Builder
-	for {
-		if i >= len(formatStr) {
-			return -1, nil, errors.New("could not find end of precision specifier")
-		}
-		if !isASCIIDigit(rune(formatStr[i])) {
-			break
-		}
-		buffer.WriteByte(formatStr[i])
-		i++
-	}
-	precision, err := strconv.Atoi(buffer.String())
-	if err != nil {
-		return -1, nil, fmt.Errorf("error while converting precision to integer: %w", err)
-	}
-	return i, &precision, nil
-}
-
-func isASCIIDigit(r rune) bool {
-	return r <= unicode.MaxASCII && unicode.IsDigit(r)
-}
diff --git a/vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazel b/vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazel
index 846d11b..4a80c3e 100644
--- a/vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/interpreter/functions/BUILD.bazel
@@ -7,16 +7,11 @@ package(
 
 go_library(
     name = "go_default_library",
-    srcs = [
+    srcs = [ 
         "functions.go",
-        "standard.go",
     ],
     importpath = "github.com/google/cel-go/interpreter/functions",
     deps = [
-        "//common/operators:go_default_library",
-        "//common/overloads:go_default_library",
-        "//common/types:go_default_library",
-        "//common/types/ref:go_default_library",
-        "//common/types/traits:go_default_library",
+        "//common/functions:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/interpreter/functions/functions.go b/vendor/github.com/google/cel-go/interpreter/functions/functions.go
index 9816017..21ffb69 100644
--- a/vendor/github.com/google/cel-go/interpreter/functions/functions.go
+++ b/vendor/github.com/google/cel-go/interpreter/functions/functions.go
@@ -16,7 +16,7 @@
 // interpreter and as declared within the checker#StandardDeclarations.
 package functions
 
-import "github.com/google/cel-go/common/types/ref"
+import fn "github.com/google/cel-go/common/functions"
 
 // Overload defines a named overload of a function, indicating an operand trait
 // which must be present on the first argument to the overload as well as one
@@ -26,37 +26,14 @@ import "github.com/google/cel-go/common/types/ref"
 // and the specializations simplify the call contract for implementers of
 // types with operator overloads. Any added complexity is assumed to be handled
 // by the generic FunctionOp.
-type Overload struct {
-	// Operator name as written in an expression or defined within
-	// operators.go.
-	Operator string
-
-	// Operand trait used to dispatch the call. The zero-value indicates a
-	// global function overload or that one of the Unary / Binary / Function
-	// definitions should be used to execute the call.
-	OperandTrait int
-
-	// Unary defines the overload with a UnaryOp implementation. May be nil.
-	Unary UnaryOp
-
-	// Binary defines the overload with a BinaryOp implementation. May be nil.
-	Binary BinaryOp
-
-	// Function defines the overload with a FunctionOp implementation. May be
-	// nil.
-	Function FunctionOp
-
-	// NonStrict specifies whether the Overload will tolerate arguments that
-	// are types.Err or types.Unknown.
-	NonStrict bool
-}
+type Overload = fn.Overload
 
 // UnaryOp is a function that takes a single value and produces an output.
-type UnaryOp func(value ref.Val) ref.Val
+type UnaryOp = fn.UnaryOp
 
 // BinaryOp is a function that takes two values and produces an output.
-type BinaryOp func(lhs ref.Val, rhs ref.Val) ref.Val
+type BinaryOp = fn.BinaryOp
 
 // FunctionOp is a function with accepts zero or more arguments and produces
 // a value or error as a result.
-type FunctionOp func(values ...ref.Val) ref.Val
+type FunctionOp = fn.FunctionOp
diff --git a/vendor/github.com/google/cel-go/interpreter/functions/standard.go b/vendor/github.com/google/cel-go/interpreter/functions/standard.go
deleted file mode 100644
index 73e9361..0000000
--- a/vendor/github.com/google/cel-go/interpreter/functions/standard.go
+++ /dev/null
@@ -1,270 +0,0 @@
-// Copyright 2018 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package functions
-
-import (
-	"github.com/google/cel-go/common/operators"
-	"github.com/google/cel-go/common/overloads"
-	"github.com/google/cel-go/common/types"
-	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/common/types/traits"
-)
-
-// StandardOverloads returns the definitions of the built-in overloads.
-func StandardOverloads() []*Overload {
-	return []*Overload{
-		// Logical not (!a)
-		{
-			Operator:     operators.LogicalNot,
-			OperandTrait: traits.NegatorType,
-			Unary: func(value ref.Val) ref.Val {
-				if !types.IsBool(value) {
-					return types.ValOrErr(value, "no such overload")
-				}
-				return value.(traits.Negater).Negate()
-			}},
-		// Not strictly false: IsBool(a) ? a : true
-		{
-			Operator: operators.NotStrictlyFalse,
-			Unary:    notStrictlyFalse},
-		// Deprecated: not strictly false, may be overridden in the environment.
-		{
-			Operator: operators.OldNotStrictlyFalse,
-			Unary:    notStrictlyFalse},
-
-		// Less than operator
-		{Operator: operators.Less,
-			OperandTrait: traits.ComparerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				cmp := lhs.(traits.Comparer).Compare(rhs)
-				if cmp == types.IntNegOne {
-					return types.True
-				}
-				if cmp == types.IntOne || cmp == types.IntZero {
-					return types.False
-				}
-				return cmp
-			}},
-
-		// Less than or equal operator
-		{Operator: operators.LessEquals,
-			OperandTrait: traits.ComparerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				cmp := lhs.(traits.Comparer).Compare(rhs)
-				if cmp == types.IntNegOne || cmp == types.IntZero {
-					return types.True
-				}
-				if cmp == types.IntOne {
-					return types.False
-				}
-				return cmp
-			}},
-
-		// Greater than operator
-		{Operator: operators.Greater,
-			OperandTrait: traits.ComparerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				cmp := lhs.(traits.Comparer).Compare(rhs)
-				if cmp == types.IntOne {
-					return types.True
-				}
-				if cmp == types.IntNegOne || cmp == types.IntZero {
-					return types.False
-				}
-				return cmp
-			}},
-
-		// Greater than equal operators
-		{Operator: operators.GreaterEquals,
-			OperandTrait: traits.ComparerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				cmp := lhs.(traits.Comparer).Compare(rhs)
-				if cmp == types.IntOne || cmp == types.IntZero {
-					return types.True
-				}
-				if cmp == types.IntNegOne {
-					return types.False
-				}
-				return cmp
-			}},
-
-		// Add operator
-		{Operator: operators.Add,
-			OperandTrait: traits.AdderType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Adder).Add(rhs)
-			}},
-
-		// Subtract operators
-		{Operator: operators.Subtract,
-			OperandTrait: traits.SubtractorType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Subtractor).Subtract(rhs)
-			}},
-
-		// Multiply operator
-		{Operator: operators.Multiply,
-			OperandTrait: traits.MultiplierType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Multiplier).Multiply(rhs)
-			}},
-
-		// Divide operator
-		{Operator: operators.Divide,
-			OperandTrait: traits.DividerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Divider).Divide(rhs)
-			}},
-
-		// Modulo operator
-		{Operator: operators.Modulo,
-			OperandTrait: traits.ModderType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Modder).Modulo(rhs)
-			}},
-
-		// Negate operator
-		{Operator: operators.Negate,
-			OperandTrait: traits.NegatorType,
-			Unary: func(value ref.Val) ref.Val {
-				if types.IsBool(value) {
-					return types.ValOrErr(value, "no such overload")
-				}
-				return value.(traits.Negater).Negate()
-			}},
-
-		// Index operator
-		{Operator: operators.Index,
-			OperandTrait: traits.IndexerType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Indexer).Get(rhs)
-			}},
-
-		// Size function
-		{Operator: overloads.Size,
-			OperandTrait: traits.SizerType,
-			Unary: func(value ref.Val) ref.Val {
-				return value.(traits.Sizer).Size()
-			}},
-
-		// In operator
-		{Operator: operators.In, Binary: inAggregate},
-		// Deprecated: in operator, may be overridden in the environment.
-		{Operator: operators.OldIn, Binary: inAggregate},
-
-		// Matches function
-		{Operator: overloads.Matches,
-			OperandTrait: traits.MatcherType,
-			Binary: func(lhs ref.Val, rhs ref.Val) ref.Val {
-				return lhs.(traits.Matcher).Match(rhs)
-			}},
-
-		// Type conversion functions
-		// TODO: verify type conversion safety of numeric values.
-
-		// Int conversions.
-		{Operator: overloads.TypeConvertInt,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.IntType)
-			}},
-
-		// Uint conversions.
-		{Operator: overloads.TypeConvertUint,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.UintType)
-			}},
-
-		// Double conversions.
-		{Operator: overloads.TypeConvertDouble,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.DoubleType)
-			}},
-
-		// Bool conversions.
-		{Operator: overloads.TypeConvertBool,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.BoolType)
-			}},
-
-		// Bytes conversions.
-		{Operator: overloads.TypeConvertBytes,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.BytesType)
-			}},
-
-		// String conversions.
-		{Operator: overloads.TypeConvertString,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.StringType)
-			}},
-
-		// Timestamp conversions.
-		{Operator: overloads.TypeConvertTimestamp,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.TimestampType)
-			}},
-
-		// Duration conversions.
-		{Operator: overloads.TypeConvertDuration,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.DurationType)
-			}},
-
-		// Type operations.
-		{Operator: overloads.TypeConvertType,
-			Unary: func(value ref.Val) ref.Val {
-				return value.ConvertToType(types.TypeType)
-			}},
-
-		// Dyn conversion (identity function).
-		{Operator: overloads.TypeConvertDyn,
-			Unary: func(value ref.Val) ref.Val {
-				return value
-			}},
-
-		{Operator: overloads.Iterator,
-			OperandTrait: traits.IterableType,
-			Unary: func(value ref.Val) ref.Val {
-				return value.(traits.Iterable).Iterator()
-			}},
-
-		{Operator: overloads.HasNext,
-			OperandTrait: traits.IteratorType,
-			Unary: func(value ref.Val) ref.Val {
-				return value.(traits.Iterator).HasNext()
-			}},
-
-		{Operator: overloads.Next,
-			OperandTrait: traits.IteratorType,
-			Unary: func(value ref.Val) ref.Val {
-				return value.(traits.Iterator).Next()
-			}},
-	}
-
-}
-
-func notStrictlyFalse(value ref.Val) ref.Val {
-	if types.IsBool(value) {
-		return value
-	}
-	return types.True
-}
-
-func inAggregate(lhs ref.Val, rhs ref.Val) ref.Val {
-	if rhs.Type().HasTrait(traits.ContainerType) {
-		return rhs.(traits.Container).Contains(lhs)
-	}
-	return types.ValOrErr(rhs, "no such overload")
-}
diff --git a/vendor/github.com/google/cel-go/interpreter/interpretable.go b/vendor/github.com/google/cel-go/interpreter/interpretable.go
index eedf67d..ebc432e 100644
--- a/vendor/github.com/google/cel-go/interpreter/interpretable.go
+++ b/vendor/github.com/google/cel-go/interpreter/interpretable.go
@@ -15,12 +15,15 @@
 package interpreter
 
 import (
+	"fmt"
+	"sync"
+
+	"github.com/google/cel-go/common/functions"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
-	"github.com/google/cel-go/interpreter/functions"
 )
 
 // Interpretable can accept a given Activation and produce a value along with
@@ -50,7 +53,7 @@ type InterpretableAttribute interface {
 	Attr() Attribute
 
 	// Adapter returns the type adapter to be used for adapting resolved Attribute values.
-	Adapter() ref.TypeAdapter
+	Adapter() types.Adapter
 
 	// AddQualifier proxies the Attribute.AddQualifier method.
 	//
@@ -69,6 +72,7 @@ type InterpretableAttribute interface {
 	// to whether the qualifier is present.
 	QualifyIfPresent(vars Activation, obj any, presenceOnly bool) (any, bool, error)
 
+	// IsOptional indicates whether the resulting value is an optional type.
 	IsOptional() bool
 
 	// Resolve returns the value of the Attribute given the current Activation.
@@ -93,7 +97,7 @@ type InterpretableCall interface {
 	Args() []Interpretable
 }
 
-// InterpretableConstructor interface for inspecting  Interpretable instructions that initialize a list, map
+// InterpretableConstructor interface for inspecting Interpretable instructions that initialize a list, map
 // or struct.
 type InterpretableConstructor interface {
 	Interpretable
@@ -108,10 +112,8 @@ type InterpretableConstructor interface {
 // Core Interpretable implementations used during the program planning phase.
 
 type evalTestOnly struct {
-	id    int64
-	attr  InterpretableAttribute
-	qual  Qualifier
-	field types.String
+	id int64
+	InterpretableAttribute
 }
 
 // ID implements the Interpretable interface method.
@@ -121,28 +123,55 @@ func (test *evalTestOnly) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (test *evalTestOnly) Eval(ctx Activation) ref.Val {
-	val, err := test.attr.Resolve(ctx)
+	val, err := test.Resolve(ctx)
+	// Return an error if the resolve step fails
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.LabelErrNode(test.id, types.WrapErr(err))
 	}
-	optVal, isOpt := val.(*types.Optional)
-	if isOpt {
-		if !optVal.HasValue() {
-			return types.False
-		}
-		val = optVal.GetValue()
+	if optVal, isOpt := val.(*types.Optional); isOpt {
+		return types.Bool(optVal.HasValue())
 	}
-	out, found, err := test.qual.QualifyIfPresent(ctx, val, true)
+	return test.Adapter().NativeToValue(val)
+}
+
+// AddQualifier appends a qualifier that will always and only perform a presence test.
+func (test *evalTestOnly) AddQualifier(q Qualifier) (Attribute, error) {
+	cq, ok := q.(ConstantQualifier)
+	if !ok {
+		return nil, fmt.Errorf("test only expressions must have constant qualifiers: %v", q)
+	}
+	return test.InterpretableAttribute.AddQualifier(&testOnlyQualifier{ConstantQualifier: cq})
+}
+
+type testOnlyQualifier struct {
+	ConstantQualifier
+}
+
+// Qualify determines whether the test-only qualifier is present on the input object.
+func (q *testOnlyQualifier) Qualify(vars Activation, obj any) (any, error) {
+	out, present, err := q.ConstantQualifier.QualifyIfPresent(vars, obj, true)
 	if err != nil {
-		return types.NewErr(err.Error())
+		return nil, err
 	}
 	if unk, isUnk := out.(types.Unknown); isUnk {
-		return unk
+		return unk, nil
 	}
-	if found {
-		return types.True
+	if opt, isOpt := out.(types.Optional); isOpt {
+		return opt.HasValue(), nil
 	}
-	return types.False
+	return present, nil
+}
+
+// QualifyIfPresent returns whether the target field in the test-only expression is present.
+func (q *testOnlyQualifier) QualifyIfPresent(vars Activation, obj any, presenceOnly bool) (any, bool, error) {
+	// Only ever test for presence.
+	return q.ConstantQualifier.QualifyIfPresent(vars, obj, true)
+}
+
+// QualifierValueEquals determines whether the test-only constant qualifier equals the input value.
+func (q *testOnlyQualifier) QualifierValueEquals(value any) bool {
+	// The input qualifier will always be of type string
+	return q.ConstantQualifier.Value().Value() == value
 }
 
 // NewConstValue creates a new constant valued Interpretable.
@@ -174,9 +203,8 @@ func (cons *evalConst) Value() ref.Val {
 }
 
 type evalOr struct {
-	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	id    int64
+	terms []Interpretable
 }
 
 // ID implements the Interpretable interface method.
@@ -186,41 +214,40 @@ func (or *evalOr) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (or *evalOr) Eval(ctx Activation) ref.Val {
-	// short-circuit lhs.
-	lVal := or.lhs.Eval(ctx)
-	lBool, lok := lVal.(types.Bool)
-	if lok && lBool == types.True {
-		return types.True
-	}
-	// short-circuit on rhs.
-	rVal := or.rhs.Eval(ctx)
-	rBool, rok := rVal.(types.Bool)
-	if rok && rBool == types.True {
-		return types.True
-	}
-	// return if both sides are bool false.
-	if lok && rok {
-		return types.False
-	}
-	// TODO: return both values as a set if both are unknown or error.
-	// prefer left unknown to right unknown.
-	if types.IsUnknown(lVal) {
-		return lVal
+	var err ref.Val = nil
+	var unk *types.Unknown
+	for _, term := range or.terms {
+		val := term.Eval(ctx)
+		boolVal, ok := val.(types.Bool)
+		// short-circuit on true.
+		if ok && boolVal == types.True {
+			return types.True
+		}
+		if !ok {
+			isUnk := false
+			unk, isUnk = types.MaybeMergeUnknowns(val, unk)
+			if !isUnk && err == nil {
+				if types.IsError(val) {
+					err = val
+				} else {
+					err = types.MaybeNoSuchOverloadErr(val)
+				}
+				err = types.LabelErrNode(or.id, err)
+			}
+		}
 	}
-	if types.IsUnknown(rVal) {
-		return rVal
+	if unk != nil {
+		return unk
 	}
-	// If the left-hand side is non-boolean return it as the error.
-	if types.IsError(lVal) {
-		return lVal
+	if err != nil {
+		return err
 	}
-	return types.ValOrErr(rVal, "no such overload")
+	return types.False
 }
 
 type evalAnd struct {
-	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	id    int64
+	terms []Interpretable
 }
 
 // ID implements the Interpretable interface method.
@@ -230,35 +257,35 @@ func (and *evalAnd) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (and *evalAnd) Eval(ctx Activation) ref.Val {
-	// short-circuit lhs.
-	lVal := and.lhs.Eval(ctx)
-	lBool, lok := lVal.(types.Bool)
-	if lok && lBool == types.False {
-		return types.False
-	}
-	// short-circuit on rhs.
-	rVal := and.rhs.Eval(ctx)
-	rBool, rok := rVal.(types.Bool)
-	if rok && rBool == types.False {
-		return types.False
-	}
-	// return if both sides are bool true.
-	if lok && rok {
-		return types.True
-	}
-	// TODO: return both values as a set if both are unknown or error.
-	// prefer left unknown to right unknown.
-	if types.IsUnknown(lVal) {
-		return lVal
+	var err ref.Val = nil
+	var unk *types.Unknown
+	for _, term := range and.terms {
+		val := term.Eval(ctx)
+		boolVal, ok := val.(types.Bool)
+		// short-circuit on false.
+		if ok && boolVal == types.False {
+			return types.False
+		}
+		if !ok {
+			isUnk := false
+			unk, isUnk = types.MaybeMergeUnknowns(val, unk)
+			if !isUnk && err == nil {
+				if types.IsError(val) {
+					err = val
+				} else {
+					err = types.MaybeNoSuchOverloadErr(val)
+				}
+				err = types.LabelErrNode(and.id, err)
+			}
+		}
 	}
-	if types.IsUnknown(rVal) {
-		return rVal
+	if unk != nil {
+		return unk
 	}
-	// If the left-hand side is non-boolean return it as the error.
-	if types.IsError(lVal) {
-		return lVal
+	if err != nil {
+		return err
 	}
-	return types.ValOrErr(rVal, "no such overload")
+	return types.True
 }
 
 type evalEq struct {
@@ -353,7 +380,7 @@ func (zero *evalZeroArity) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (zero *evalZeroArity) Eval(ctx Activation) ref.Val {
-	return zero.impl()
+	return types.LabelErrNode(zero.id, zero.impl())
 }
 
 // Function implements the InterpretableCall interface method.
@@ -397,14 +424,14 @@ func (un *evalUnary) Eval(ctx Activation) ref.Val {
 	// If the implementation is bound and the argument value has the right traits required to
 	// invoke it, then call the implementation.
 	if un.impl != nil && (un.trait == 0 || (!strict && types.IsUnknownOrError(argVal)) || argVal.Type().HasTrait(un.trait)) {
-		return un.impl(argVal)
+		return types.LabelErrNode(un.id, un.impl(argVal))
 	}
 	// Otherwise, if the argument is a ReceiverType attempt to invoke the receiver method on the
 	// operand (arg0).
 	if argVal.Type().HasTrait(traits.ReceiverType) {
-		return argVal.(traits.Receiver).Receive(un.function, un.overload, []ref.Val{})
+		return types.LabelErrNode(un.id, argVal.(traits.Receiver).Receive(un.function, un.overload, []ref.Val{}))
 	}
-	return types.NewErr("no such overload: %s", un.function)
+	return types.NewErrWithNodeID(un.id, "no such overload: %s", un.function)
 }
 
 // Function implements the InterpretableCall interface method.
@@ -455,14 +482,14 @@ func (bin *evalBinary) Eval(ctx Activation) ref.Val {
 	// If the implementation is bound and the argument value has the right traits required to
 	// invoke it, then call the implementation.
 	if bin.impl != nil && (bin.trait == 0 || (!strict && types.IsUnknownOrError(lVal)) || lVal.Type().HasTrait(bin.trait)) {
-		return bin.impl(lVal, rVal)
+		return types.LabelErrNode(bin.id, bin.impl(lVal, rVal))
 	}
 	// Otherwise, if the argument is a ReceiverType attempt to invoke the receiver method on the
 	// operand (arg0).
 	if lVal.Type().HasTrait(traits.ReceiverType) {
-		return lVal.(traits.Receiver).Receive(bin.function, bin.overload, []ref.Val{rVal})
+		return types.LabelErrNode(bin.id, lVal.(traits.Receiver).Receive(bin.function, bin.overload, []ref.Val{rVal}))
 	}
-	return types.NewErr("no such overload: %s", bin.function)
+	return types.NewErrWithNodeID(bin.id, "no such overload: %s", bin.function)
 }
 
 // Function implements the InterpretableCall interface method.
@@ -521,14 +548,14 @@ func (fn *evalVarArgs) Eval(ctx Activation) ref.Val {
 	// invoke it, then call the implementation.
 	arg0 := argVals[0]
 	if fn.impl != nil && (fn.trait == 0 || (!strict && types.IsUnknownOrError(arg0)) || arg0.Type().HasTrait(fn.trait)) {
-		return fn.impl(argVals...)
+		return types.LabelErrNode(fn.id, fn.impl(argVals...))
 	}
 	// Otherwise, if the argument is a ReceiverType attempt to invoke the receiver method on the
 	// operand (arg0).
 	if arg0.Type().HasTrait(traits.ReceiverType) {
-		return arg0.(traits.Receiver).Receive(fn.function, fn.overload, argVals[1:])
+		return types.LabelErrNode(fn.id, arg0.(traits.Receiver).Receive(fn.function, fn.overload, argVals[1:]))
 	}
-	return types.NewErr("no such overload: %s", fn.function)
+	return types.NewErrWithNodeID(fn.id, "no such overload: %s %d", fn.function, fn.id)
 }
 
 // Function implements the InterpretableCall interface method.
@@ -551,7 +578,7 @@ type evalList struct {
 	elems        []Interpretable
 	optionals    []bool
 	hasOptionals bool
-	adapter      ref.TypeAdapter
+	adapter      types.Adapter
 }
 
 // ID implements the Interpretable interface method.
@@ -571,7 +598,7 @@ func (l *evalList) Eval(ctx Activation) ref.Val {
 		if l.hasOptionals && l.optionals[i] {
 			optVal, ok := elemVal.(*types.Optional)
 			if !ok {
-				return invalidOptionalElementInit(elemVal)
+				return types.LabelErrNode(l.id, invalidOptionalElementInit(elemVal))
 			}
 			if !optVal.HasValue() {
 				continue
@@ -597,7 +624,7 @@ type evalMap struct {
 	vals         []Interpretable
 	optionals    []bool
 	hasOptionals bool
-	adapter      ref.TypeAdapter
+	adapter      types.Adapter
 }
 
 // ID implements the Interpretable interface method.
@@ -621,7 +648,7 @@ func (m *evalMap) Eval(ctx Activation) ref.Val {
 		if m.hasOptionals && m.optionals[i] {
 			optVal, ok := valVal.(*types.Optional)
 			if !ok {
-				return invalidOptionalEntryInit(keyVal, valVal)
+				return types.LabelErrNode(m.id, invalidOptionalEntryInit(keyVal, valVal))
 			}
 			if !optVal.HasValue() {
 				delete(entries, keyVal)
@@ -661,7 +688,7 @@ type evalObj struct {
 	vals         []Interpretable
 	optionals    []bool
 	hasOptionals bool
-	provider     ref.TypeProvider
+	provider     types.Provider
 }
 
 // ID implements the Interpretable interface method.
@@ -681,7 +708,7 @@ func (o *evalObj) Eval(ctx Activation) ref.Val {
 		if o.hasOptionals && o.optionals[i] {
 			optVal, ok := val.(*types.Optional)
 			if !ok {
-				return invalidOptionalEntryInit(field, val)
+				return types.LabelErrNode(o.id, invalidOptionalEntryInit(field, val))
 			}
 			if !optVal.HasValue() {
 				delete(fieldVals, field)
@@ -691,27 +718,34 @@ func (o *evalObj) Eval(ctx Activation) ref.Val {
 		}
 		fieldVals[field] = val
 	}
-	return o.provider.NewValue(o.typeName, fieldVals)
+	return types.LabelErrNode(o.id, o.provider.NewValue(o.typeName, fieldVals))
 }
 
+// InitVals implements the InterpretableConstructor interface method.
 func (o *evalObj) InitVals() []Interpretable {
 	return o.vals
 }
 
+// Type implements the InterpretableConstructor interface method.
 func (o *evalObj) Type() ref.Type {
-	return types.NewObjectTypeValue(o.typeName)
+	return types.NewObjectType(o.typeName)
 }
 
 type evalFold struct {
-	id            int64
-	accuVar       string
-	iterVar       string
-	iterRange     Interpretable
-	accu          Interpretable
-	cond          Interpretable
-	step          Interpretable
-	result        Interpretable
-	adapter       ref.TypeAdapter
+	id        int64
+	accuVar   string
+	iterVar   string
+	iterVar2  string
+	iterRange Interpretable
+	accu      Interpretable
+	cond      Interpretable
+	step      Interpretable
+	result    Interpretable
+	adapter   types.Adapter
+
+	// note an exhaustive fold will ensure that all branches are evaluated
+	// when using mutable values, these branches will mutate the final result
+	// rather than make a throw-away computation.
 	exhaustive    bool
 	interruptable bool
 }
@@ -723,64 +757,30 @@ func (fold *evalFold) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (fold *evalFold) Eval(ctx Activation) ref.Val {
-	foldRange := fold.iterRange.Eval(ctx)
-	if !foldRange.Type().HasTrait(traits.IterableType) {
-		return types.ValOrErr(foldRange, "got '%T', expected iterable type", foldRange)
-	}
-	// Configure the fold activation with the accumulator initial value.
-	accuCtx := varActivationPool.Get().(*varActivation)
-	accuCtx.parent = ctx
-	accuCtx.name = fold.accuVar
-	accuCtx.val = fold.accu.Eval(ctx)
-	// If the accumulator starts as an empty list, then the comprehension will build a list
-	// so create a mutable list to optimize the cost of the inner loop.
-	l, ok := accuCtx.val.(traits.Lister)
-	buildingList := false
-	if !fold.exhaustive && ok && l.Size() == types.IntZero {
-		buildingList = true
-		accuCtx.val = types.NewMutableList(fold.adapter)
-	}
-	iterCtx := varActivationPool.Get().(*varActivation)
-	iterCtx.parent = accuCtx
-	iterCtx.name = fold.iterVar
-
-	interrupted := false
-	it := foldRange.(traits.Iterable).Iterator()
-	for it.HasNext() == types.True {
-		// Modify the iter var in the fold activation.
-		iterCtx.val = it.Next()
+	// Initialize the folder interface
+	f := newFolder(fold, ctx)
+	defer releaseFolder(f)
 
-		// Evaluate the condition, terminate the loop if false.
-		cond := fold.cond.Eval(iterCtx)
-		condBool, ok := cond.(types.Bool)
-		if !fold.exhaustive && ok && condBool != types.True {
-			break
-		}
-		// Evaluate the evaluation step into accu var.
-		accuCtx.val = fold.step.Eval(iterCtx)
-		if fold.interruptable {
-			if stop, found := ctx.ResolveName("#interrupted"); found && stop == true {
-				interrupted = true
-				break
-			}
+	foldRange := fold.iterRange.Eval(ctx)
+	if fold.iterVar2 != "" {
+		var foldable traits.Foldable
+		switch r := foldRange.(type) {
+		case traits.Mapper:
+			foldable = types.ToFoldableMap(r)
+		case traits.Lister:
+			foldable = types.ToFoldableList(r)
+		default:
+			return types.NewErrWithNodeID(fold.ID(), "unsupported comprehension range type: %T", foldRange)
 		}
-	}
-	varActivationPool.Put(iterCtx)
-	if interrupted {
-		varActivationPool.Put(accuCtx)
-		return types.NewErr("operation interrupted")
+		foldable.Fold(f)
+		return f.evalResult()
 	}
 
-	// Compute the result.
-	res := fold.result.Eval(accuCtx)
-	varActivationPool.Put(accuCtx)
-	// Convert a mutable list to an immutable one, if the comprehension has generated a list as a result.
-	if !types.IsUnknownOrError(res) && buildingList {
-		if _, ok := res.(traits.MutableLister); ok {
-			res = res.(traits.MutableLister).ToImmutableList()
-		}
+	if !foldRange.Type().HasTrait(traits.IterableType) {
+		return types.ValOrErr(foldRange, "got '%T', expected iterable type", foldRange)
 	}
-	return res
+	iterable := foldRange.(traits.Iterable)
+	return f.foldIterable(iterable)
 }
 
 // Optional Interpretable implementations that specialize, subsume, or extend the core evaluation
@@ -837,18 +837,40 @@ type evalWatchAttr struct {
 // AddQualifier creates a wrapper over the incoming qualifier which observes the qualification
 // result.
 func (e *evalWatchAttr) AddQualifier(q Qualifier) (Attribute, error) {
-	cq, isConst := q.(ConstantQualifier)
-	if isConst {
+	switch qual := q.(type) {
+	// By default, the qualifier is either a constant or an attribute
+	// There may be some custom cases where the attribute is neither.
+	case ConstantQualifier:
+		// Expose a method to test whether the qualifier matches the input pattern.
 		q = &evalWatchConstQual{
-			ConstantQualifier: cq,
+			ConstantQualifier: qual,
 			observer:          e.observer,
-			adapter:           e.InterpretableAttribute.Adapter(),
+			adapter:           e.Adapter(),
 		}
-	} else {
+	case *evalWatchAttr:
+		// Unwrap the evalWatchAttr since the observation will be applied during Qualify or
+		// QualifyIfPresent rather than Eval.
+		q = &evalWatchAttrQual{
+			Attribute: qual.InterpretableAttribute,
+			observer:  e.observer,
+			adapter:   e.Adapter(),
+		}
+	case Attribute:
+		// Expose methods which intercept the qualification prior to being applied as a qualifier.
+		// Using this interface ensures that the qualifier is converted to a constant value one
+		// time during attribute pattern matching as the method embeds the Attribute interface
+		// needed to trip the conversion to a constant.
+		q = &evalWatchAttrQual{
+			Attribute: qual,
+			observer:  e.observer,
+			adapter:   e.Adapter(),
+		}
+	default:
+		// This is likely a custom qualifier type.
 		q = &evalWatchQual{
-			Qualifier: q,
+			Qualifier: qual,
 			observer:  e.observer,
-			adapter:   e.InterpretableAttribute.Adapter(),
+			adapter:   e.Adapter(),
 		}
 	}
 	_, err := e.InterpretableAttribute.AddQualifier(q)
@@ -867,7 +889,7 @@ func (e *evalWatchAttr) Eval(vars Activation) ref.Val {
 type evalWatchConstQual struct {
 	ConstantQualifier
 	observer EvalObserver
-	adapter  ref.TypeAdapter
+	adapter  types.Adapter
 }
 
 // Qualify observes the qualification of a object via a constant boolean, int, string, or uint.
@@ -875,7 +897,7 @@ func (e *evalWatchConstQual) Qualify(vars Activation, obj any) (any, error) {
 	out, err := e.ConstantQualifier.Qualify(vars, obj)
 	var val ref.Val
 	if err != nil {
-		val = types.NewErr(err.Error())
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
 	} else {
 		val = e.adapter.NativeToValue(out)
 	}
@@ -883,17 +905,71 @@ func (e *evalWatchConstQual) Qualify(vars Activation, obj any) (any, error) {
 	return out, err
 }
 
+// QualifyIfPresent conditionally qualifies the variable and only records a value if one is present.
+func (e *evalWatchConstQual) QualifyIfPresent(vars Activation, obj any, presenceOnly bool) (any, bool, error) {
+	out, present, err := e.ConstantQualifier.QualifyIfPresent(vars, obj, presenceOnly)
+	var val ref.Val
+	if err != nil {
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
+	} else if out != nil {
+		val = e.adapter.NativeToValue(out)
+	} else if presenceOnly {
+		val = types.Bool(present)
+	}
+	if present || presenceOnly {
+		e.observer(e.ID(), e.ConstantQualifier, val)
+	}
+	return out, present, err
+}
+
 // QualifierValueEquals tests whether the incoming value is equal to the qualifying constant.
 func (e *evalWatchConstQual) QualifierValueEquals(value any) bool {
 	qve, ok := e.ConstantQualifier.(qualifierValueEquator)
 	return ok && qve.QualifierValueEquals(value)
 }
 
+// evalWatchAttrQual observes the qualification of an object by a value computed at runtime.
+type evalWatchAttrQual struct {
+	Attribute
+	observer EvalObserver
+	adapter  ref.TypeAdapter
+}
+
+// Qualify observes the qualification of a object via a value computed at runtime.
+func (e *evalWatchAttrQual) Qualify(vars Activation, obj any) (any, error) {
+	out, err := e.Attribute.Qualify(vars, obj)
+	var val ref.Val
+	if err != nil {
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
+	} else {
+		val = e.adapter.NativeToValue(out)
+	}
+	e.observer(e.ID(), e.Attribute, val)
+	return out, err
+}
+
+// QualifyIfPresent conditionally qualifies the variable and only records a value if one is present.
+func (e *evalWatchAttrQual) QualifyIfPresent(vars Activation, obj any, presenceOnly bool) (any, bool, error) {
+	out, present, err := e.Attribute.QualifyIfPresent(vars, obj, presenceOnly)
+	var val ref.Val
+	if err != nil {
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
+	} else if out != nil {
+		val = e.adapter.NativeToValue(out)
+	} else if presenceOnly {
+		val = types.Bool(present)
+	}
+	if present || presenceOnly {
+		e.observer(e.ID(), e.Attribute, val)
+	}
+	return out, present, err
+}
+
 // evalWatchQual observes the qualification of an object by a value computed at runtime.
 type evalWatchQual struct {
 	Qualifier
 	observer EvalObserver
-	adapter  ref.TypeAdapter
+	adapter  types.Adapter
 }
 
 // Qualify observes the qualification of a object via a value computed at runtime.
@@ -901,7 +977,7 @@ func (e *evalWatchQual) Qualify(vars Activation, obj any) (any, error) {
 	out, err := e.Qualifier.Qualify(vars, obj)
 	var val ref.Val
 	if err != nil {
-		val = types.NewErr(err.Error())
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
 	} else {
 		val = e.adapter.NativeToValue(out)
 	}
@@ -909,6 +985,23 @@ func (e *evalWatchQual) Qualify(vars Activation, obj any) (any, error) {
 	return out, err
 }
 
+// QualifyIfPresent conditionally qualifies the variable and only records a value if one is present.
+func (e *evalWatchQual) QualifyIfPresent(vars Activation, obj any, presenceOnly bool) (any, bool, error) {
+	out, present, err := e.Qualifier.QualifyIfPresent(vars, obj, presenceOnly)
+	var val ref.Val
+	if err != nil {
+		val = types.LabelErrNode(e.ID(), types.WrapErr(err))
+	} else if out != nil {
+		val = e.adapter.NativeToValue(out)
+	} else if presenceOnly {
+		val = types.Bool(present)
+	}
+	if present || presenceOnly {
+		e.observer(e.ID(), e.Qualifier, val)
+	}
+	return out, present, err
+}
+
 // evalWatchConst describes a watcher of an instConst Interpretable.
 type evalWatchConst struct {
 	InterpretableConst
@@ -924,9 +1017,8 @@ func (e *evalWatchConst) Eval(vars Activation) ref.Val {
 
 // evalExhaustiveOr is just like evalOr, but does not short-circuit argument evaluation.
 type evalExhaustiveOr struct {
-	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	id    int64
+	terms []Interpretable
 }
 
 // ID implements the Interpretable interface method.
@@ -936,38 +1028,44 @@ func (or *evalExhaustiveOr) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (or *evalExhaustiveOr) Eval(ctx Activation) ref.Val {
-	lVal := or.lhs.Eval(ctx)
-	rVal := or.rhs.Eval(ctx)
-	lBool, lok := lVal.(types.Bool)
-	if lok && lBool == types.True {
-		return types.True
+	var err ref.Val = nil
+	var unk *types.Unknown
+	isTrue := false
+	for _, term := range or.terms {
+		val := term.Eval(ctx)
+		boolVal, ok := val.(types.Bool)
+		// flag the result as true
+		if ok && boolVal == types.True {
+			isTrue = true
+		}
+		if !ok && !isTrue {
+			isUnk := false
+			unk, isUnk = types.MaybeMergeUnknowns(val, unk)
+			if !isUnk && err == nil {
+				if types.IsError(val) {
+					err = val
+				} else {
+					err = types.MaybeNoSuchOverloadErr(val)
+				}
+			}
+		}
 	}
-	rBool, rok := rVal.(types.Bool)
-	if rok && rBool == types.True {
+	if isTrue {
 		return types.True
 	}
-	if lok && rok {
-		return types.False
-	}
-	if types.IsUnknown(lVal) {
-		return lVal
-	}
-	if types.IsUnknown(rVal) {
-		return rVal
+	if unk != nil {
+		return unk
 	}
-	// TODO: Combine the errors into a set in the future.
-	// If the left-hand side is non-boolean return it as the error.
-	if types.IsError(lVal) {
-		return lVal
+	if err != nil {
+		return err
 	}
-	return types.MaybeNoSuchOverloadErr(rVal)
+	return types.False
 }
 
 // evalExhaustiveAnd is just like evalAnd, but does not short-circuit argument evaluation.
 type evalExhaustiveAnd struct {
-	id  int64
-	lhs Interpretable
-	rhs Interpretable
+	id    int64
+	terms []Interpretable
 }
 
 // ID implements the Interpretable interface method.
@@ -977,38 +1075,45 @@ func (and *evalExhaustiveAnd) ID() int64 {
 
 // Eval implements the Interpretable interface method.
 func (and *evalExhaustiveAnd) Eval(ctx Activation) ref.Val {
-	lVal := and.lhs.Eval(ctx)
-	rVal := and.rhs.Eval(ctx)
-	lBool, lok := lVal.(types.Bool)
-	if lok && lBool == types.False {
-		return types.False
+	var err ref.Val = nil
+	var unk *types.Unknown
+	isFalse := false
+	for _, term := range and.terms {
+		val := term.Eval(ctx)
+		boolVal, ok := val.(types.Bool)
+		// short-circuit on false.
+		if ok && boolVal == types.False {
+			isFalse = true
+		}
+		if !ok && !isFalse {
+			isUnk := false
+			unk, isUnk = types.MaybeMergeUnknowns(val, unk)
+			if !isUnk && err == nil {
+				if types.IsError(val) {
+					err = val
+				} else {
+					err = types.MaybeNoSuchOverloadErr(val)
+				}
+			}
+		}
 	}
-	rBool, rok := rVal.(types.Bool)
-	if rok && rBool == types.False {
+	if isFalse {
 		return types.False
 	}
-	if lok && rok {
-		return types.True
-	}
-	if types.IsUnknown(lVal) {
-		return lVal
-	}
-	if types.IsUnknown(rVal) {
-		return rVal
+	if unk != nil {
+		return unk
 	}
-	// TODO: Combine the errors into a set in the future.
-	// If the left-hand side is non-boolean return it as the error.
-	if types.IsError(lVal) {
-		return lVal
+	if err != nil {
+		return err
 	}
-	return types.MaybeNoSuchOverloadErr(rVal)
+	return types.True
 }
 
 // evalExhaustiveConditional is like evalConditional, but does not short-circuit argument
 // evaluation.
 type evalExhaustiveConditional struct {
 	id      int64
-	adapter ref.TypeAdapter
+	adapter types.Adapter
 	attr    *conditionalAttribute
 }
 
@@ -1028,23 +1133,25 @@ func (cond *evalExhaustiveConditional) Eval(ctx Activation) ref.Val {
 	}
 	if cBool {
 		if tErr != nil {
-			return types.NewErr(tErr.Error())
+			return types.LabelErrNode(cond.id, types.WrapErr(tErr))
 		}
 		return cond.adapter.NativeToValue(tVal)
 	}
 	if fErr != nil {
-		return types.NewErr(fErr.Error())
+		return types.LabelErrNode(cond.id, types.WrapErr(fErr))
 	}
 	return cond.adapter.NativeToValue(fVal)
 }
 
 // evalAttr evaluates an Attribute value.
 type evalAttr struct {
-	adapter  ref.TypeAdapter
+	adapter  types.Adapter
 	attr     Attribute
 	optional bool
 }
 
+var _ InterpretableAttribute = &evalAttr{}
+
 // ID of the attribute instruction.
 func (a *evalAttr) ID() int64 {
 	return a.attr.ID()
@@ -1063,7 +1170,7 @@ func (a *evalAttr) Attr() Attribute {
 }
 
 // Adapter implements the InterpretableAttribute interface method.
-func (a *evalAttr) Adapter() ref.TypeAdapter {
+func (a *evalAttr) Adapter() types.Adapter {
 	return a.adapter
 }
 
@@ -1071,7 +1178,7 @@ func (a *evalAttr) Adapter() ref.TypeAdapter {
 func (a *evalAttr) Eval(ctx Activation) ref.Val {
 	v, err := a.attr.Resolve(ctx)
 	if err != nil {
-		return types.NewErr(err.Error())
+		return types.LabelErrNode(a.ID(), types.WrapErr(err))
 	}
 	return a.adapter.NativeToValue(v)
 }
@@ -1129,3 +1236,172 @@ func invalidOptionalEntryInit(field any, value ref.Val) ref.Val {
 func invalidOptionalElementInit(value ref.Val) ref.Val {
 	return types.NewErr("cannot initialize optional list element from non-optional value %v", value)
 }
+
+// newFolder creates or initializes a pooled folder instance.
+func newFolder(eval *evalFold, ctx Activation) *folder {
+	f := folderPool.Get().(*folder)
+	f.evalFold = eval
+	f.Activation = ctx
+	return f
+}
+
+// releaseFolder resets and releases a pooled folder instance.
+func releaseFolder(f *folder) {
+	f.reset()
+	folderPool.Put(f)
+}
+
+// folder tracks the state associated with folding a list or map with a comprehension v2 style macro.
+//
+// The folder embeds an interpreter.Activation and Interpretable evalFold value as well as implements
+// the traits.Folder interface methods.
+//
+// Instances of a folder are intended to be pooled to minimize allocation overhead with this temporary
+// bookkeeping object which supports lazy evaluation of the accumulator init expression which is useful
+// in preserving evaluation order semantics which might otherwise be disrupted through the use of
+// cel.bind or cel.@block.
+type folder struct {
+	*evalFold
+	Activation
+
+	// fold state objects.
+	accuVal     ref.Val
+	iterVar1Val any
+	iterVar2Val any
+
+	// bookkeeping flags to modify Activation and fold behaviors.
+	initialized   bool
+	mutableValue  bool
+	interrupted   bool
+	computeResult bool
+}
+
+func (f *folder) foldIterable(iterable traits.Iterable) ref.Val {
+	it := iterable.Iterator()
+	for it.HasNext() == types.True {
+		f.iterVar1Val = it.Next()
+
+		cond := f.cond.Eval(f)
+		condBool, ok := cond.(types.Bool)
+		if f.interrupted || (!f.exhaustive && ok && condBool != types.True) {
+			return f.evalResult()
+		}
+
+		// Update the accumulation value and check for eval interuption.
+		f.accuVal = f.step.Eval(f)
+		f.initialized = true
+		if f.interruptable && checkInterrupt(f.Activation) {
+			f.interrupted = true
+			return f.evalResult()
+		}
+	}
+	return f.evalResult()
+}
+
+// FoldEntry will either fold comprehension v1 style macros if iterVar2 is unset, or comprehension v2 style
+// macros if both the iterVar and iterVar2 are set to non-empty strings.
+func (f *folder) FoldEntry(key, val any) bool {
+	// Default to referencing both values.
+	f.iterVar1Val = key
+	f.iterVar2Val = val
+
+	// Terminate evaluation if evaluation is interrupted or the condition is not true and exhaustive
+	// eval is not enabled.
+	cond := f.cond.Eval(f)
+	condBool, ok := cond.(types.Bool)
+	if f.interrupted || (!f.exhaustive && ok && condBool != types.True) {
+		return false
+	}
+
+	// Update the accumulation value and check for eval interuption.
+	f.accuVal = f.step.Eval(f)
+	f.initialized = true
+	if f.interruptable && checkInterrupt(f.Activation) {
+		f.interrupted = true
+		return false
+	}
+	return true
+}
+
+// ResolveName overrides the default Activation lookup to perform lazy initialization of the accumulator
+// and specialized lookups of iteration values with consideration for whether the final result is being
+// computed and the iteration variables should be ignored.
+func (f *folder) ResolveName(name string) (any, bool) {
+	if name == f.accuVar {
+		if !f.initialized {
+			f.initialized = true
+			initVal := f.accu.Eval(f.Activation)
+			if !f.exhaustive {
+				if l, isList := initVal.(traits.Lister); isList && l.Size() == types.IntZero {
+					initVal = types.NewMutableList(f.adapter)
+					f.mutableValue = true
+				}
+				if m, isMap := initVal.(traits.Mapper); isMap && m.Size() == types.IntZero {
+					initVal = types.NewMutableMap(f.adapter, map[ref.Val]ref.Val{})
+					f.mutableValue = true
+				}
+			}
+			f.accuVal = initVal
+		}
+		return f.accuVal, true
+	}
+	if !f.computeResult {
+		if name == f.iterVar {
+			f.iterVar1Val = f.adapter.NativeToValue(f.iterVar1Val)
+			return f.iterVar1Val, true
+		}
+		if name == f.iterVar2 {
+			f.iterVar2Val = f.adapter.NativeToValue(f.iterVar2Val)
+			return f.iterVar2Val, true
+		}
+	}
+	return f.Activation.ResolveName(name)
+}
+
+// evalResult computes the final result of the fold after all entries have been folded and accumulated.
+func (f *folder) evalResult() ref.Val {
+	f.computeResult = true
+	if f.interrupted {
+		return types.NewErr("operation interrupted")
+	}
+	res := f.result.Eval(f)
+	// Convert a mutable list or map to an immutable one if the comprehension has generated a list or
+	// map as a result.
+	if !types.IsUnknownOrError(res) && f.mutableValue {
+		if _, ok := res.(traits.MutableLister); ok {
+			res = res.(traits.MutableLister).ToImmutableList()
+		}
+		if _, ok := res.(traits.MutableMapper); ok {
+			res = res.(traits.MutableMapper).ToImmutableMap()
+		}
+	}
+	return res
+}
+
+// reset clears any state associated with folder evaluation.
+func (f *folder) reset() {
+	f.evalFold = nil
+	f.Activation = nil
+	f.accuVal = nil
+	f.iterVar1Val = nil
+	f.iterVar2Val = nil
+
+	f.initialized = false
+	f.mutableValue = false
+	f.interrupted = false
+	f.computeResult = false
+}
+
+func checkInterrupt(a Activation) bool {
+	stop, found := a.ResolveName("#interrupted")
+	return found && stop == true
+}
+
+var (
+	// pool of var folders to reduce allocations during folds.
+	folderPool = &sync.Pool{
+		New: func() any {
+			return &folder{}
+		},
+	}
+)
diff --git a/vendor/github.com/google/cel-go/interpreter/interpreter.go b/vendor/github.com/google/cel-go/interpreter/interpreter.go
index 707a610..0aca74d 100644
--- a/vendor/github.com/google/cel-go/interpreter/interpreter.go
+++ b/vendor/github.com/google/cel-go/interpreter/interpreter.go
@@ -18,22 +18,17 @@
 package interpreter
 
 import (
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/interpreter/functions"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // Interpreter generates a new Interpretable from a checked or unchecked expression.
 type Interpreter interface {
 	// NewInterpretable creates an Interpretable from a checked expression and an
 	// optional list of InterpretableDecorator values.
-	NewInterpretable(checked *exprpb.CheckedExpr, decorators ...InterpretableDecorator) (Interpretable, error)
-
-	// NewUncheckedInterpretable returns an Interpretable from a parsed expression
-	// and an optional list of InterpretableDecorator values.
-	NewUncheckedInterpretable(expr *exprpb.Expr, decorators ...InterpretableDecorator) (Interpretable, error)
+	NewInterpretable(exprAST *ast.AST, decorators ...InterpretableDecorator) (Interpretable, error)
 }
 
 // EvalObserver is a functional interface that accepts an expression id and an observed value.
@@ -154,8 +149,8 @@ func CompileRegexConstants(regexOptimizations ...*RegexOptimization) Interpretab
 type exprInterpreter struct {
 	dispatcher  Dispatcher
 	container   *containers.Container
-	provider    ref.TypeProvider
-	adapter     ref.TypeAdapter
+	provider    types.Provider
+	adapter     types.Adapter
 	attrFactory AttributeFactory
 }
 
@@ -163,8 +158,8 @@ type exprInterpreter struct {
 // throughout the Eval of all Interpretable instances generated from it.
 func NewInterpreter(dispatcher Dispatcher,
 	container *containers.Container,
-	provider ref.TypeProvider,
-	adapter ref.TypeAdapter,
+	provider types.Provider,
+	adapter types.Adapter,
 	attrFactory AttributeFactory) Interpreter {
 	return &exprInterpreter{
 		dispatcher:  dispatcher,
@@ -174,20 +169,9 @@ func NewInterpreter(dispatcher Dispatcher,
 		attrFactory: attrFactory}
 }
 
-// NewStandardInterpreter builds a Dispatcher and TypeProvider with support for all of the CEL
-// builtins defined in the language definition.
-func NewStandardInterpreter(container *containers.Container,
-	provider ref.TypeProvider,
-	adapter ref.TypeAdapter,
-	resolver AttributeFactory) Interpreter {
-	dispatcher := NewDispatcher()
-	dispatcher.Add(functions.StandardOverloads()...)
-	return NewInterpreter(dispatcher, container, provider, adapter, resolver)
-}
-
 // NewIntepretable implements the Interpreter interface method.
 func (i *exprInterpreter) NewInterpretable(
-	checked *exprpb.CheckedExpr,
+	checked *ast.AST,
 	decorators ...InterpretableDecorator) (Interpretable, error) {
 	p := newPlanner(
 		i.dispatcher,
@@ -197,19 +181,5 @@ func (i *exprInterpreter) NewInterpretable(
 		i.container,
 		checked,
 		decorators...)
-	return p.Plan(checked.GetExpr())
-}
-
-// NewUncheckedIntepretable implements the Interpreter interface method.
-func (i *exprInterpreter) NewUncheckedInterpretable(
-	expr *exprpb.Expr,
-	decorators ...InterpretableDecorator) (Interpretable, error) {
-	p := newUncheckedPlanner(
-		i.dispatcher,
-		i.provider,
-		i.adapter,
-		i.attrFactory,
-		i.container,
-		decorators...)
-	return p.Plan(expr)
+	return p.Plan(checked.Expr())
 }
diff --git a/vendor/github.com/google/cel-go/interpreter/planner.go b/vendor/github.com/google/cel-go/interpreter/planner.go
index 9cf8e4e..f0fd4ea 100644
--- a/vendor/github.com/google/cel-go/interpreter/planner.go
+++ b/vendor/github.com/google/cel-go/interpreter/planner.go
@@ -18,19 +18,17 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/containers"
+	"github.com/google/cel-go/common/functions"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/types"
-	"github.com/google/cel-go/common/types/ref"
-	"github.com/google/cel-go/interpreter/functions"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
 )
 
 // interpretablePlanner creates an Interpretable evaluation plan from a proto Expr value.
 type interpretablePlanner interface {
 	// Plan generates an Interpretable value (or error) from the input proto Expr.
-	Plan(expr *exprpb.Expr) (Interpretable, error)
+	Plan(expr ast.Expr) (Interpretable, error)
 }
 
 // newPlanner creates an interpretablePlanner which references a Dispatcher, TypeProvider,
@@ -38,11 +36,11 @@ type interpretablePlanner interface {
 // functions, types, and namespaced identifiers at plan time rather than at runtime since
 // it only needs to be done once and may be semi-expensive to compute.
 func newPlanner(disp Dispatcher,
-	provider ref.TypeProvider,
-	adapter ref.TypeAdapter,
+	provider types.Provider,
+	adapter types.Adapter,
 	attrFactory AttributeFactory,
 	cont *containers.Container,
-	checked *exprpb.CheckedExpr,
+	exprAST *ast.AST,
 	decorators ...InterpretableDecorator) interpretablePlanner {
 	return &planner{
 		disp:        disp,
@@ -50,29 +48,8 @@ func newPlanner(disp Dispatcher,
 		adapter:     adapter,
 		attrFactory: attrFactory,
 		container:   cont,
-		refMap:      checked.GetReferenceMap(),
-		typeMap:     checked.GetTypeMap(),
-		decorators:  decorators,
-	}
-}
-
-// newUncheckedPlanner creates an interpretablePlanner which references a Dispatcher, TypeProvider,
-// TypeAdapter, and Container to resolve functions and types at plan time. Namespaces present in
-// Select expressions are resolved lazily at evaluation time.
-func newUncheckedPlanner(disp Dispatcher,
-	provider ref.TypeProvider,
-	adapter ref.TypeAdapter,
-	attrFactory AttributeFactory,
-	cont *containers.Container,
-	decorators ...InterpretableDecorator) interpretablePlanner {
-	return &planner{
-		disp:        disp,
-		provider:    provider,
-		adapter:     adapter,
-		attrFactory: attrFactory,
-		container:   cont,
-		refMap:      make(map[int64]*exprpb.Reference),
-		typeMap:     make(map[int64]*exprpb.Type),
+		refMap:      exprAST.ReferenceMap(),
+		typeMap:     exprAST.TypeMap(),
 		decorators:  decorators,
 	}
 }
@@ -80,12 +57,12 @@ func newUncheckedPlanner(disp Dispatcher,
 // planner is an implementation of the interpretablePlanner interface.
 type planner struct {
 	disp        Dispatcher
-	provider    ref.TypeProvider
-	adapter     ref.TypeAdapter
+	provider    types.Provider
+	adapter     types.Adapter
 	attrFactory AttributeFactory
 	container   *containers.Container
-	refMap      map[int64]*exprpb.Reference
-	typeMap     map[int64]*exprpb.Type
+	refMap      map[int64]*ast.ReferenceInfo
+	typeMap     map[int64]*types.Type
 	decorators  []InterpretableDecorator
 }
 
@@ -94,22 +71,24 @@ type planner struct {
 // useful for layering functionality into the evaluation that is not natively understood by CEL,
 // such as state-tracking, expression re-write, and possibly efficient thread-safe memoization of
 // repeated expressions.
-func (p *planner) Plan(expr *exprpb.Expr) (Interpretable, error) {
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_CallExpr:
+func (p *planner) Plan(expr ast.Expr) (Interpretable, error) {
+	switch expr.Kind() {
+	case ast.CallKind:
 		return p.decorate(p.planCall(expr))
-	case *exprpb.Expr_IdentExpr:
+	case ast.IdentKind:
 		return p.decorate(p.planIdent(expr))
-	case *exprpb.Expr_SelectExpr:
+	case ast.LiteralKind:
+		return p.decorate(p.planConst(expr))
+	case ast.SelectKind:
 		return p.decorate(p.planSelect(expr))
-	case *exprpb.Expr_ListExpr:
+	case ast.ListKind:
 		return p.decorate(p.planCreateList(expr))
-	case *exprpb.Expr_StructExpr:
+	case ast.MapKind:
+		return p.decorate(p.planCreateMap(expr))
+	case ast.StructKind:
 		return p.decorate(p.planCreateStruct(expr))
-	case *exprpb.Expr_ComprehensionExpr:
+	case ast.ComprehensionKind:
 		return p.decorate(p.planComprehension(expr))
-	case *exprpb.Expr_ConstExpr:
-		return p.decorate(p.planConst(expr))
 	}
 	return nil, fmt.Errorf("unsupported expr: %v", expr)
 }
@@ -131,35 +110,32 @@ func (p *planner) decorate(i Interpretable, err error) (Interpretable, error) {
 }
 
 // planIdent creates an Interpretable that resolves an identifier from an Activation.
-func (p *planner) planIdent(expr *exprpb.Expr) (Interpretable, error) {
+func (p *planner) planIdent(expr ast.Expr) (Interpretable, error) {
 	// Establish whether the identifier is in the reference map.
-	if identRef, found := p.refMap[expr.GetId()]; found {
-		return p.planCheckedIdent(expr.GetId(), identRef)
+	if identRef, found := p.refMap[expr.ID()]; found {
+		return p.planCheckedIdent(expr.ID(), identRef)
 	}
 	// Create the possible attribute list for the unresolved reference.
-	ident := expr.GetIdentExpr()
+	ident := expr.AsIdent()
 	return &evalAttr{
 		adapter: p.adapter,
-		attr:    p.attrFactory.MaybeAttribute(expr.GetId(), ident.Name),
+		attr:    p.attrFactory.MaybeAttribute(expr.ID(), ident),
 	}, nil
 }
 
-func (p *planner) planCheckedIdent(id int64, identRef *exprpb.Reference) (Interpretable, error) {
+func (p *planner) planCheckedIdent(id int64, identRef *ast.ReferenceInfo) (Interpretable, error) {
 	// Plan a constant reference if this is the case for this simple identifier.
-	if identRef.GetValue() != nil {
-		return p.Plan(&exprpb.Expr{Id: id,
-			ExprKind: &exprpb.Expr_ConstExpr{
-				ConstExpr: identRef.GetValue(),
-			}})
+	if identRef.Value != nil {
+		return NewConstValue(id, identRef.Value), nil
 	}
 
 	// Check to see whether the type map indicates this is a type name. All types should be
 	// registered with the provider.
 	cType := p.typeMap[id]
-	if cType.GetType() != nil {
-		cVal, found := p.provider.FindIdent(identRef.GetName())
+	if cType.Kind() == types.TypeKind {
+		cVal, found := p.provider.FindIdent(identRef.Name)
 		if !found {
-			return nil, fmt.Errorf("reference to undefined type: %s", identRef.GetName())
+			return nil, fmt.Errorf("reference to undefined type: %s", identRef.Name)
 		}
 		return NewConstValue(id, cVal), nil
 	}
@@ -167,7 +143,7 @@ func (p *planner) planCheckedIdent(id int64, identRef *exprpb.Reference) (Interp
 	// Otherwise, return the attribute for the resolved identifier name.
 	return &evalAttr{
 		adapter: p.adapter,
-		attr:    p.attrFactory.AbsoluteAttribute(id, identRef.GetName()),
+		attr:    p.attrFactory.AbsoluteAttribute(id, identRef.Name),
 	}, nil
 }
 
@@ -176,20 +152,20 @@ func (p *planner) planCheckedIdent(id int64, identRef *exprpb.Reference) (Interp
 //	a) selects a field from a map or proto.
 //	b) creates a field presence test for a select within a has() macro.
 //	c) resolves the select expression to a namespaced identifier.
-func (p *planner) planSelect(expr *exprpb.Expr) (Interpretable, error) {
+func (p *planner) planSelect(expr ast.Expr) (Interpretable, error) {
 	// If the Select id appears in the reference map from the CheckedExpr proto then it is either
 	// a namespaced identifier or enum value.
-	if identRef, found := p.refMap[expr.GetId()]; found {
-		return p.planCheckedIdent(expr.GetId(), identRef)
+	if identRef, found := p.refMap[expr.ID()]; found {
+		return p.planCheckedIdent(expr.ID(), identRef)
 	}
 
-	sel := expr.GetSelectExpr()
+	sel := expr.AsSelect()
 	// Plan the operand evaluation.
-	op, err := p.Plan(sel.GetOperand())
+	op, err := p.Plan(sel.Operand())
 	if err != nil {
 		return nil, err
 	}
-	opType := p.typeMap[sel.GetOperand().GetId()]
+	opType := p.typeMap[sel.Operand().ID()]
 
 	// If the Select was marked TestOnly, this is a presence test.
 	//
@@ -213,22 +189,18 @@ func (p *planner) planSelect(expr *exprpb.Expr) (Interpretable, error) {
 	}
 
 	// Build a qualifier for the attribute.
-	qual, err := p.attrFactory.NewQualifier(opType, expr.GetId(), sel.GetField(), false)
+	qual, err := p.attrFactory.NewQualifier(opType, expr.ID(), sel.FieldName(), false)
 	if err != nil {
 		return nil, err
 	}
-
-	// Return the test only eval expression.
-	if sel.GetTestOnly() {
-		return &evalTestOnly{
-			id:    expr.GetId(),
-			field: types.String(sel.GetField()),
-			attr:  attr,
-			qual:  qual,
-		}, nil
+	// Modify the attribute to be test-only.
+	if sel.IsTestOnly() {
+		attr = &evalTestOnly{
+			id:                     expr.ID(),
+			InterpretableAttribute: attr,
+		}
 	}
-
-	// Otherwise, append the qualifier on the attribute.
+	// Append the qualifier on the attribute.
 	_, err = attr.AddQualifier(qual)
 	return attr, err
 }
@@ -236,10 +208,10 @@ func (p *planner) planSelect(expr *exprpb.Expr) (Interpretable, error) {
 // planCall creates a callable Interpretable while specializing for common functions and invocation
 // patterns. Specifically, conditional operators &&, ||, ?:, and (in)equality functions result in
 // optimized Interpretable values.
-func (p *planner) planCall(expr *exprpb.Expr) (Interpretable, error) {
-	call := expr.GetCallExpr()
+func (p *planner) planCall(expr ast.Expr) (Interpretable, error) {
+	call := expr.AsCall()
 	target, fnName, oName := p.resolveFunction(expr)
-	argCount := len(call.GetArgs())
+	argCount := len(call.Args())
 	var offset int
 	if target != nil {
 		argCount++
@@ -254,7 +226,7 @@ func (p *planner) planCall(expr *exprpb.Expr) (Interpretable, error) {
 		}
 		args[0] = arg
 	}
-	for i, argExpr := range call.GetArgs() {
+	for i, argExpr := range call.Args() {
 		arg, err := p.Plan(argExpr)
 		if err != nil {
 			return nil, err
@@ -313,7 +285,7 @@ func (p *planner) planCall(expr *exprpb.Expr) (Interpretable, error) {
 }
 
 // planCallZero generates a zero-arity callable Interpretable.
-func (p *planner) planCallZero(expr *exprpb.Expr,
+func (p *planner) planCallZero(expr ast.Expr,
 	function string,
 	overload string,
 	impl *functions.Overload) (Interpretable, error) {
@@ -321,7 +293,7 @@ func (p *planner) planCallZero(expr *exprpb.Expr,
 		return nil, fmt.Errorf("no such overload: %s()", function)
 	}
 	return &evalZeroArity{
-		id:       expr.GetId(),
+		id:       expr.ID(),
 		function: function,
 		overload: overload,
 		impl:     impl.Function,
@@ -329,7 +301,7 @@ func (p *planner) planCallZero(expr *exprpb.Expr,
 }
 
 // planCallUnary generates a unary callable Interpretable.
-func (p *planner) planCallUnary(expr *exprpb.Expr,
+func (p *planner) planCallUnary(expr ast.Expr,
 	function string,
 	overload string,
 	impl *functions.Overload,
@@ -346,7 +318,7 @@ func (p *planner) planCallUnary(expr *exprpb.Expr,
 		nonStrict = impl.NonStrict
 	}
 	return &evalUnary{
-		id:        expr.GetId(),
+		id:        expr.ID(),
 		function:  function,
 		overload:  overload,
 		arg:       args[0],
@@ -357,7 +329,7 @@ func (p *planner) planCallUnary(expr *exprpb.Expr,
 }
 
 // planCallBinary generates a binary callable Interpretable.
-func (p *planner) planCallBinary(expr *exprpb.Expr,
+func (p *planner) planCallBinary(expr ast.Expr,
 	function string,
 	overload string,
 	impl *functions.Overload,
@@ -374,7 +346,7 @@ func (p *planner) planCallBinary(expr *exprpb.Expr,
 		nonStrict = impl.NonStrict
 	}
 	return &evalBinary{
-		id:        expr.GetId(),
+		id:        expr.ID(),
 		function:  function,
 		overload:  overload,
 		lhs:       args[0],
@@ -386,7 +358,7 @@ func (p *planner) planCallBinary(expr *exprpb.Expr,
 }
 
 // planCallVarArgs generates a variable argument callable Interpretable.
-func (p *planner) planCallVarArgs(expr *exprpb.Expr,
+func (p *planner) planCallVarArgs(expr ast.Expr,
 	function string,
 	overload string,
 	impl *functions.Overload,
@@ -403,7 +375,7 @@ func (p *planner) planCallVarArgs(expr *exprpb.Expr,
 		nonStrict = impl.NonStrict
 	}
 	return &evalVarArgs{
-		id:        expr.GetId(),
+		id:        expr.ID(),
 		function:  function,
 		overload:  overload,
 		args:      args,
@@ -414,43 +386,41 @@ func (p *planner) planCallVarArgs(expr *exprpb.Expr,
 }
 
 // planCallEqual generates an equals (==) Interpretable.
-func (p *planner) planCallEqual(expr *exprpb.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planner) planCallEqual(expr ast.Expr, args []Interpretable) (Interpretable, error) {
 	return &evalEq{
-		id:  expr.GetId(),
+		id:  expr.ID(),
 		lhs: args[0],
 		rhs: args[1],
 	}, nil
 }
 
 // planCallNotEqual generates a not equals (!=) Interpretable.
-func (p *planner) planCallNotEqual(expr *exprpb.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planner) planCallNotEqual(expr ast.Expr, args []Interpretable) (Interpretable, error) {
 	return &evalNe{
-		id:  expr.GetId(),
+		id:  expr.ID(),
 		lhs: args[0],
 		rhs: args[1],
 	}, nil
 }
 
 // planCallLogicalAnd generates a logical and (&&) Interpretable.
-func (p *planner) planCallLogicalAnd(expr *exprpb.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planner) planCallLogicalAnd(expr ast.Expr, args []Interpretable) (Interpretable, error) {
 	return &evalAnd{
-		id:  expr.GetId(),
-		lhs: args[0],
-		rhs: args[1],
+		id:    expr.ID(),
+		terms: args,
 	}, nil
 }
 
 // planCallLogicalOr generates a logical or (||) Interpretable.
-func (p *planner) planCallLogicalOr(expr *exprpb.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planner) planCallLogicalOr(expr ast.Expr, args []Interpretable) (Interpretable, error) {
 	return &evalOr{
-		id:  expr.GetId(),
-		lhs: args[0],
-		rhs: args[1],
+		id:    expr.ID(),
+		terms: args,
 	}, nil
 }
 
 // planCallConditional generates a conditional / ternary (c ? t : f) Interpretable.
-func (p *planner) planCallConditional(expr *exprpb.Expr, args []Interpretable) (Interpretable, error) {
+func (p *planner) planCallConditional(expr ast.Expr, args []Interpretable) (Interpretable, error) {
 	cond := args[0]
 	t := args[1]
 	var tAttr Attribute
@@ -472,16 +442,16 @@ func (p *planner) planCallConditional(expr *exprpb.Expr, args []Interpretable) (
 
 	return &evalAttr{
 		adapter: p.adapter,
-		attr:    p.attrFactory.ConditionalAttribute(expr.GetId(), cond, tAttr, fAttr),
+		attr:    p.attrFactory.ConditionalAttribute(expr.ID(), cond, tAttr, fAttr),
 	}, nil
 }
 
 // planCallIndex either extends an attribute with the argument to the index operation, or creates
 // a relative attribute based on the return of a function call or operation.
-func (p *planner) planCallIndex(expr *exprpb.Expr, args []Interpretable, optional bool) (Interpretable, error) {
+func (p *planner) planCallIndex(expr ast.Expr, args []Interpretable, optional bool) (Interpretable, error) {
 	op := args[0]
 	ind := args[1]
-	opType := p.typeMap[expr.GetCallExpr().GetTarget().GetId()]
+	opType := p.typeMap[op.ID()]
 
 	// Establish the attribute reference.
 	var err error
@@ -497,11 +467,11 @@ func (p *planner) planCallIndex(expr *exprpb.Expr, args []Interpretable, optiona
 	var qual Qualifier
 	switch ind := ind.(type) {
 	case InterpretableConst:
-		qual, err = p.attrFactory.NewQualifier(opType, expr.GetId(), ind.Value(), optional)
+		qual, err = p.attrFactory.NewQualifier(opType, expr.ID(), ind.Value(), optional)
 	case InterpretableAttribute:
-		qual, err = p.attrFactory.NewQualifier(opType, expr.GetId(), ind, optional)
+		qual, err = p.attrFactory.NewQualifier(opType, expr.ID(), ind, optional)
 	default:
-		qual, err = p.relativeAttr(expr.GetId(), ind, optional)
+		qual, err = p.relativeAttr(expr.ID(), ind, optional)
 	}
 	if err != nil {
 		return nil, err
@@ -513,10 +483,10 @@ func (p *planner) planCallIndex(expr *exprpb.Expr, args []Interpretable, optiona
 }
 
 // planCreateList generates a list construction Interpretable.
-func (p *planner) planCreateList(expr *exprpb.Expr) (Interpretable, error) {
-	list := expr.GetListExpr()
-	optionalIndices := list.GetOptionalIndices()
-	elements := list.GetElements()
+func (p *planner) planCreateList(expr ast.Expr) (Interpretable, error) {
+	list := expr.AsList()
+	optionalIndices := list.OptionalIndices()
+	elements := list.Elements()
 	optionals := make([]bool, len(elements))
 	for _, index := range optionalIndices {
 		if index < 0 || index >= int32(len(elements)) {
@@ -533,107 +503,111 @@ func (p *planner) planCreateList(expr *exprpb.Expr) (Interpretable, error) {
 		elems[i] = elemVal
 	}
 	return &evalList{
-		id:           expr.GetId(),
+		id:           expr.ID(),
 		elems:        elems,
 		optionals:    optionals,
-		hasOptionals: len(optionals) != 0,
+		hasOptionals: len(optionalIndices) != 0,
 		adapter:      p.adapter,
 	}, nil
 }
 
 // planCreateStruct generates a map or object construction Interpretable.
-func (p *planner) planCreateStruct(expr *exprpb.Expr) (Interpretable, error) {
-	str := expr.GetStructExpr()
-	if len(str.MessageName) != 0 {
-		return p.planCreateObj(expr)
-	}
-	entries := str.GetEntries()
+func (p *planner) planCreateMap(expr ast.Expr) (Interpretable, error) {
+	m := expr.AsMap()
+	entries := m.Entries()
 	optionals := make([]bool, len(entries))
 	keys := make([]Interpretable, len(entries))
 	vals := make([]Interpretable, len(entries))
-	for i, entry := range entries {
-		keyVal, err := p.Plan(entry.GetMapKey())
+	hasOptionals := false
+	for i, e := range entries {
+		entry := e.AsMapEntry()
+		keyVal, err := p.Plan(entry.Key())
 		if err != nil {
 			return nil, err
 		}
 		keys[i] = keyVal
 
-		valVal, err := p.Plan(entry.GetValue())
+		valVal, err := p.Plan(entry.Value())
 		if err != nil {
 			return nil, err
 		}
 		vals[i] = valVal
-		optionals[i] = entry.GetOptionalEntry()
+		optionals[i] = entry.IsOptional()
+		hasOptionals = hasOptionals || entry.IsOptional()
 	}
 	return &evalMap{
-		id:           expr.GetId(),
+		id:           expr.ID(),
 		keys:         keys,
 		vals:         vals,
 		optionals:    optionals,
-		hasOptionals: len(optionals) != 0,
+		hasOptionals: hasOptionals,
 		adapter:      p.adapter,
 	}, nil
 }
 
 // planCreateObj generates an object construction Interpretable.
-func (p *planner) planCreateObj(expr *exprpb.Expr) (Interpretable, error) {
-	obj := expr.GetStructExpr()
-	typeName, defined := p.resolveTypeName(obj.GetMessageName())
+func (p *planner) planCreateStruct(expr ast.Expr) (Interpretable, error) {
+	obj := expr.AsStruct()
+	typeName, defined := p.resolveTypeName(obj.TypeName())
 	if !defined {
-		return nil, fmt.Errorf("unknown type: %s", obj.GetMessageName())
-	}
-	entries := obj.GetEntries()
-	optionals := make([]bool, len(entries))
-	fields := make([]string, len(entries))
-	vals := make([]Interpretable, len(entries))
-	for i, entry := range entries {
-		fields[i] = entry.GetFieldKey()
-		val, err := p.Plan(entry.GetValue())
+		return nil, fmt.Errorf("unknown type: %s", obj.TypeName())
+	}
+	objFields := obj.Fields()
+	optionals := make([]bool, len(objFields))
+	fields := make([]string, len(objFields))
+	vals := make([]Interpretable, len(objFields))
+	hasOptionals := false
+	for i, f := range objFields {
+		field := f.AsStructField()
+		fields[i] = field.Name()
+		val, err := p.Plan(field.Value())
 		if err != nil {
 			return nil, err
 		}
 		vals[i] = val
-		optionals[i] = entry.GetOptionalEntry()
+		optionals[i] = field.IsOptional()
+		hasOptionals = hasOptionals || field.IsOptional()
 	}
 	return &evalObj{
-		id:           expr.GetId(),
+		id:           expr.ID(),
 		typeName:     typeName,
 		fields:       fields,
 		vals:         vals,
 		optionals:    optionals,
-		hasOptionals: len(optionals) != 0,
+		hasOptionals: hasOptionals,
 		provider:     p.provider,
 	}, nil
 }
 
 // planComprehension generates an Interpretable fold operation.
-func (p *planner) planComprehension(expr *exprpb.Expr) (Interpretable, error) {
-	fold := expr.GetComprehensionExpr()
-	accu, err := p.Plan(fold.GetAccuInit())
+func (p *planner) planComprehension(expr ast.Expr) (Interpretable, error) {
+	fold := expr.AsComprehension()
+	accu, err := p.Plan(fold.AccuInit())
 	if err != nil {
 		return nil, err
 	}
-	iterRange, err := p.Plan(fold.GetIterRange())
+	iterRange, err := p.Plan(fold.IterRange())
 	if err != nil {
 		return nil, err
 	}
-	cond, err := p.Plan(fold.GetLoopCondition())
+	cond, err := p.Plan(fold.LoopCondition())
 	if err != nil {
 		return nil, err
 	}
-	step, err := p.Plan(fold.GetLoopStep())
+	step, err := p.Plan(fold.LoopStep())
 	if err != nil {
 		return nil, err
 	}
-	result, err := p.Plan(fold.GetResult())
+	result, err := p.Plan(fold.Result())
 	if err != nil {
 		return nil, err
 	}
 	return &evalFold{
-		id:        expr.GetId(),
-		accuVar:   fold.AccuVar,
+		id:        expr.ID(),
+		accuVar:   fold.AccuVar(),
 		accu:      accu,
-		iterVar:   fold.IterVar,
+		iterVar:   fold.IterVar(),
+		iterVar2:  fold.IterVar2(),
 		iterRange: iterRange,
 		cond:      cond,
 		step:      step,
@@ -643,44 +617,15 @@ func (p *planner) planComprehension(expr *exprpb.Expr) (Interpretable, error) {
 }
 
 // planConst generates a constant valued Interpretable.
-func (p *planner) planConst(expr *exprpb.Expr) (Interpretable, error) {
-	val, err := p.constValue(expr.GetConstExpr())
-	if err != nil {
-		return nil, err
-	}
-	return NewConstValue(expr.GetId(), val), nil
-}
-
-// constValue converts a proto Constant value to a ref.Val.
-func (p *planner) constValue(c *exprpb.Constant) (ref.Val, error) {
-	switch c.GetConstantKind().(type) {
-	case *exprpb.Constant_BoolValue:
-		return p.adapter.NativeToValue(c.GetBoolValue()), nil
-	case *exprpb.Constant_BytesValue:
-		return p.adapter.NativeToValue(c.GetBytesValue()), nil
-	case *exprpb.Constant_DoubleValue:
-		return p.adapter.NativeToValue(c.GetDoubleValue()), nil
-	case *exprpb.Constant_DurationValue:
-		return p.adapter.NativeToValue(c.GetDurationValue().AsDuration()), nil
-	case *exprpb.Constant_Int64Value:
-		return p.adapter.NativeToValue(c.GetInt64Value()), nil
-	case *exprpb.Constant_NullValue:
-		return p.adapter.NativeToValue(c.GetNullValue()), nil
-	case *exprpb.Constant_StringValue:
-		return p.adapter.NativeToValue(c.GetStringValue()), nil
-	case *exprpb.Constant_TimestampValue:
-		return p.adapter.NativeToValue(c.GetTimestampValue().AsTime()), nil
-	case *exprpb.Constant_Uint64Value:
-		return p.adapter.NativeToValue(c.GetUint64Value()), nil
-	}
-	return nil, fmt.Errorf("unknown constant type: %v", c)
+func (p *planner) planConst(expr ast.Expr) (Interpretable, error) {
+	return NewConstValue(expr.ID(), expr.AsLiteral()), nil
 }
 
 // resolveTypeName takes a qualified string constructed at parse time, applies the proto
 // namespace resolution rules to it in a scan over possible matching types in the TypeProvider.
 func (p *planner) resolveTypeName(typeName string) (string, bool) {
 	for _, qualifiedTypeName := range p.container.ResolveCandidateNames(typeName) {
-		if _, found := p.provider.FindType(qualifiedTypeName); found {
+		if _, found := p.provider.FindStructType(qualifiedTypeName); found {
 			return qualifiedTypeName, true
 		}
 	}
@@ -695,20 +640,23 @@ func (p *planner) resolveTypeName(typeName string) (string, bool) {
 // - The target expression may only consist of ident and select expressions.
 // - The function is declared in the environment using its fully-qualified name.
 // - The fully-qualified function name matches the string serialized target value.
-func (p *planner) resolveFunction(expr *exprpb.Expr) (*exprpb.Expr, string, string) {
+func (p *planner) resolveFunction(expr ast.Expr) (ast.Expr, string, string) {
 	// Note: similar logic exists within the `checker/checker.go`. If making changes here
 	// please consider the impact on checker.go and consolidate implementations or mirror code
 	// as appropriate.
-	call := expr.GetCallExpr()
-	target := call.GetTarget()
-	fnName := call.GetFunction()
+	call := expr.AsCall()
+	var target ast.Expr = nil
+	if call.IsMemberFunction() {
+		target = call.Target()
+	}
+	fnName := call.FunctionName()
 
 	// Checked expressions always have a reference map entry, and _should_ have the fully qualified
 	// function name as the fnName value.
-	oRef, hasOverload := p.refMap[expr.GetId()]
+	oRef, hasOverload := p.refMap[expr.ID()]
 	if hasOverload {
-		if len(oRef.GetOverloadId()) == 1 {
-			return target, fnName, oRef.GetOverloadId()[0]
+		if len(oRef.OverloadIDs) == 1 {
+			return target, fnName, oRef.OverloadIDs[0]
 		}
 		// Note, this namespaced function name will not appear as a fully qualified name in ASTs
 		// built and stored before cel-go v0.5.0; however, this functionality did not work at all
@@ -779,16 +727,30 @@ func (p *planner) relativeAttr(id int64, eval Interpretable, opt bool) (Interpre
 
 // toQualifiedName converts an expression AST into a qualified name if possible, with a boolean
 // 'found' value that indicates if the conversion is successful.
-func (p *planner) toQualifiedName(operand *exprpb.Expr) (string, bool) {
+func (p *planner) toQualifiedName(operand ast.Expr) (string, bool) {
 	// If the checker identified the expression as an attribute by the type-checker, then it can't
 	// possibly be part of qualified name in a namespace.
-	_, isAttr := p.refMap[operand.GetId()]
+	_, isAttr := p.refMap[operand.ID()]
 	if isAttr {
 		return "", false
 	}
 	// Since functions cannot be both namespaced and receiver functions, if the operand is not an
 	// qualified variable name, return the (possibly) qualified name given the expressions.
-	return containers.ToQualifiedName(operand)
+	switch operand.Kind() {
+	case ast.IdentKind:
+		id := operand.AsIdent()
+		return id, true
+	case ast.SelectKind:
+		sel := operand.AsSelect()
+		// Test only expressions are not valid as qualified names.
+		if sel.IsTestOnly() {
+			return "", false
+		}
+		if qual, found := p.toQualifiedName(sel.Operand()); found {
+			return qual + "." + sel.FieldName(), true
+		}
+	}
+	return "", false
 }
 
 func stripLeadingDot(name string) string {
diff --git a/vendor/github.com/google/cel-go/interpreter/prune.go b/vendor/github.com/google/cel-go/interpreter/prune.go
index 85b3b06..410d80d 100644
--- a/vendor/github.com/google/cel-go/interpreter/prune.go
+++ b/vendor/github.com/google/cel-go/interpreter/prune.go
@@ -15,18 +15,18 @@
 package interpreter
 
 import (
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
+	"github.com/google/cel-go/common/overloads"
 	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/common/types/ref"
 	"github.com/google/cel-go/common/types/traits"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
-	structpb "google.golang.org/protobuf/types/known/structpb"
 )
 
 type astPruner struct {
-	expr       *exprpb.Expr
-	macroCalls map[int64]*exprpb.Expr
+	ast.ExprFactory
+	expr       ast.Expr
+	macroCalls map[int64]ast.Expr
 	state      EvalState
 	nextExprID int64
 }
@@ -66,73 +66,44 @@ type astPruner struct {
 // compiled and constant folded expressions, but is not willing to constant
 // fold(and thus cache results of) some external calls, then they can prepare
 // the overloads accordingly.
-func PruneAst(expr *exprpb.Expr, macroCalls map[int64]*exprpb.Expr, state EvalState) *exprpb.ParsedExpr {
+func PruneAst(expr ast.Expr, macroCalls map[int64]ast.Expr, state EvalState) *ast.AST {
 	pruneState := NewEvalState()
-	maxID := int64(1)
 	for _, id := range state.IDs() {
 		v, _ := state.Value(id)
 		pruneState.SetValue(id, v)
-		if id > maxID {
-			maxID = id + 1
-		}
 	}
 	pruner := &astPruner{
-		expr:       expr,
-		macroCalls: macroCalls,
-		state:      pruneState,
-		nextExprID: maxID}
+		ExprFactory: ast.NewExprFactory(),
+		expr:        expr,
+		macroCalls:  macroCalls,
+		state:       pruneState,
+		nextExprID:  getMaxID(expr)}
 	newExpr, _ := pruner.maybePrune(expr)
-	return &exprpb.ParsedExpr{
-		Expr:       newExpr,
-		SourceInfo: &exprpb.SourceInfo{MacroCalls: pruner.macroCalls},
+	newInfo := ast.NewSourceInfo(nil)
+	for id, call := range pruner.macroCalls {
+		newInfo.SetMacroCall(id, call)
 	}
+	return ast.NewAST(newExpr, newInfo)
 }
 
-func (p *astPruner) createLiteral(id int64, val *exprpb.Constant) *exprpb.Expr {
-	return &exprpb.Expr{
-		Id: id,
-		ExprKind: &exprpb.Expr_ConstExpr{
-			ConstExpr: val,
-		},
-	}
-}
-
-func (p *astPruner) maybeCreateLiteral(id int64, val ref.Val) (*exprpb.Expr, bool) {
-	switch val.Type() {
-	case types.BoolType:
-		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_BoolValue{BoolValue: val.Value().(bool)}}), true
-	case types.IntType:
-		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_Int64Value{Int64Value: val.Value().(int64)}}), true
-	case types.UintType:
-		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_Uint64Value{Uint64Value: val.Value().(uint64)}}), true
-	case types.StringType:
-		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_StringValue{StringValue: val.Value().(string)}}), true
-	case types.DoubleType:
+func (p *astPruner) maybeCreateLiteral(id int64, val ref.Val) (ast.Expr, bool) {
+	switch v := val.(type) {
+	case types.Bool, types.Bytes, types.Double, types.Int, types.Null, types.String, types.Uint:
 		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_DoubleValue{DoubleValue: val.Value().(float64)}}), true
-	case types.BytesType:
+		return p.NewLiteral(id, val), true
+	case types.Duration:
 		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_BytesValue{BytesValue: val.Value().([]byte)}}), true
-	case types.NullType:
-		p.state.SetValue(id, val)
-		return p.createLiteral(id,
-			&exprpb.Constant{ConstantKind: &exprpb.Constant_NullValue{NullValue: val.Value().(structpb.NullValue)}}), true
+		durationString := v.ConvertToType(types.StringType).(types.String)
+		return p.NewCall(id, overloads.TypeConvertDuration, p.NewLiteral(p.nextID(), durationString)), true
+	case types.Timestamp:
+		timestampString := v.ConvertToType(types.StringType).(types.String)
+		return p.NewCall(id, overloads.TypeConvertTimestamp, p.NewLiteral(p.nextID(), timestampString)), true
 	}
 
 	// Attempt to build a list literal.
 	if list, isList := val.(traits.Lister); isList {
 		sz := list.Size().(types.Int)
-		elemExprs := make([]*exprpb.Expr, sz)
+		elemExprs := make([]ast.Expr, sz)
 		for i := types.Int(0); i < sz; i++ {
 			elem := list.Get(i)
 			if types.IsUnknownOrError(elem) {
@@ -145,20 +116,13 @@ func (p *astPruner) maybeCreateLiteral(id int64, val ref.Val) (*exprpb.Expr, boo
 			elemExprs[i] = elemExpr
 		}
 		p.state.SetValue(id, val)
-		return &exprpb.Expr{
-			Id: id,
-			ExprKind: &exprpb.Expr_ListExpr{
-				ListExpr: &exprpb.Expr_CreateList{
-					Elements: elemExprs,
-				},
-			},
-		}, true
+		return p.NewList(id, elemExprs, []int32{}), true
 	}
 
 	// Create a map literal if possible.
 	if mp, isMap := val.(traits.Mapper); isMap {
 		it := mp.Iterator()
-		entries := make([]*exprpb.Expr_CreateStruct_Entry, mp.Size().(types.Int))
+		entries := make([]ast.EntryExpr, mp.Size().(types.Int))
 		i := 0
 		for it.HasNext() != types.False {
 			key := it.Next()
@@ -174,25 +138,12 @@ func (p *astPruner) maybeCreateLiteral(id int64, val ref.Val) (*exprpb.Expr, boo
 			if !ok {
 				return nil, false
 			}
-			entry := &exprpb.Expr_CreateStruct_Entry{
-				Id: p.nextID(),
-				KeyKind: &exprpb.Expr_CreateStruct_Entry_MapKey{
-					MapKey: keyExpr,
-				},
-				Value: valExpr,
-			}
+			entry := p.NewMapEntry(p.nextID(), keyExpr, valExpr, false)
 			entries[i] = entry
 			i++
 		}
 		p.state.SetValue(id, val)
-		return &exprpb.Expr{
-			Id: id,
-			ExprKind: &exprpb.Expr_StructExpr{
-				StructExpr: &exprpb.Expr_CreateStruct{
-					Entries: entries,
-				},
-			},
-		}, true
+		return p.NewMap(id, entries), true
 	}
 
 	// TODO(issues/377) To construct message literals, the type provider will need to support
@@ -200,238 +151,286 @@ func (p *astPruner) maybeCreateLiteral(id int64, val ref.Val) (*exprpb.Expr, boo
 	return nil, false
 }
 
-func (p *astPruner) maybePruneIn(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	if !p.existsWithUnknownValue(node.GetId()) {
-		return nil, false
+func (p *astPruner) maybePruneOptional(elem ast.Expr) (ast.Expr, bool) {
+	elemVal, found := p.value(elem.ID())
+	if found && elemVal.Type() == types.OptionalType {
+		opt := elemVal.(*types.Optional)
+		if !opt.HasValue() {
+			return nil, true
+		}
+		if newElem, pruned := p.maybeCreateLiteral(elem.ID(), opt.GetValue()); pruned {
+			return newElem, true
+		}
 	}
-	call := node.GetCallExpr()
-	val, valueExists := p.value(call.GetArgs()[1].GetId())
-	if !valueExists {
+	return elem, false
+}
+
+func (p *astPruner) maybePruneIn(node ast.Expr) (ast.Expr, bool) {
+	// elem in list
+	call := node.AsCall()
+	val, exists := p.maybeValue(call.Args()[1].ID())
+	if !exists {
 		return nil, false
 	}
 	if sz, ok := val.(traits.Sizer); ok && sz.Size() == types.IntZero {
-		return p.maybeCreateLiteral(node.GetId(), types.False)
+		return p.maybeCreateLiteral(node.ID(), types.False)
 	}
 	return nil, false
 }
 
-func (p *astPruner) maybePruneLogicalNot(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	if !p.existsWithUnknownValue(node.GetId()) {
-		return nil, false
-	}
-	call := node.GetCallExpr()
-	arg := call.GetArgs()[0]
-	v, exists := p.value(arg.GetId())
+func (p *astPruner) maybePruneLogicalNot(node ast.Expr) (ast.Expr, bool) {
+	call := node.AsCall()
+	arg := call.Args()[0]
+	val, exists := p.maybeValue(arg.ID())
 	if !exists {
 		return nil, false
 	}
-	if b, ok := v.(types.Bool); ok {
-		return p.maybeCreateLiteral(node.GetId(), !b)
+	if b, ok := val.(types.Bool); ok {
+		return p.maybeCreateLiteral(node.ID(), !b)
 	}
 	return nil, false
 }
 
-func (p *astPruner) maybePruneAndOr(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	if !p.existsWithUnknownValue(node.GetId()) {
-		return nil, false
+func (p *astPruner) maybePruneOr(node ast.Expr) (ast.Expr, bool) {
+	call := node.AsCall()
+	// We know result is unknown, so we have at least one unknown arg
+	// and if one side is a known value, we know we can ignore it.
+	if v, exists := p.maybeValue(call.Args()[0].ID()); exists {
+		if v == types.True {
+			return p.maybeCreateLiteral(node.ID(), types.True)
+		}
+		return call.Args()[1], true
 	}
+	if v, exists := p.maybeValue(call.Args()[1].ID()); exists {
+		if v == types.True {
+			return p.maybeCreateLiteral(node.ID(), types.True)
+		}
+		return call.Args()[0], true
+	}
+	return nil, false
+}
 
-	call := node.GetCallExpr()
+func (p *astPruner) maybePruneAnd(node ast.Expr) (ast.Expr, bool) {
+	call := node.AsCall()
 	// We know result is unknown, so we have at least one unknown arg
 	// and if one side is a known value, we know we can ignore it.
-	if p.existsWithKnownValue(call.Args[0].GetId()) {
-		return call.Args[1], true
+	if v, exists := p.maybeValue(call.Args()[0].ID()); exists {
+		if v == types.False {
+			return p.maybeCreateLiteral(node.ID(), types.False)
+		}
+		return call.Args()[1], true
 	}
-	if p.existsWithKnownValue(call.Args[1].GetId()) {
-		return call.Args[0], true
+	if v, exists := p.maybeValue(call.Args()[1].ID()); exists {
+		if v == types.False {
+			return p.maybeCreateLiteral(node.ID(), types.False)
+		}
+		return call.Args()[0], true
 	}
 	return nil, false
 }
 
-func (p *astPruner) maybePruneConditional(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	if !p.existsWithUnknownValue(node.GetId()) {
+func (p *astPruner) maybePruneConditional(node ast.Expr) (ast.Expr, bool) {
+	call := node.AsCall()
+	cond, exists := p.maybeValue(call.Args()[0].ID())
+	if !exists {
 		return nil, false
 	}
+	if cond.Value().(bool) {
+		return call.Args()[1], true
+	}
+	return call.Args()[2], true
+}
 
-	call := node.GetCallExpr()
-	condVal, condValueExists := p.value(call.Args[0].GetId())
-	if !condValueExists || types.IsUnknownOrError(condVal) {
+func (p *astPruner) maybePruneFunction(node ast.Expr) (ast.Expr, bool) {
+	if _, exists := p.value(node.ID()); !exists {
 		return nil, false
 	}
-
-	if condVal.Value().(bool) {
-		return call.Args[1], true
+	call := node.AsCall()
+	if call.FunctionName() == operators.LogicalOr {
+		return p.maybePruneOr(node)
 	}
-	return call.Args[2], true
-}
-
-func (p *astPruner) maybePruneFunction(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	call := node.GetCallExpr()
-	if call.Function == operators.LogicalOr || call.Function == operators.LogicalAnd {
-		return p.maybePruneAndOr(node)
+	if call.FunctionName() == operators.LogicalAnd {
+		return p.maybePruneAnd(node)
 	}
-	if call.Function == operators.Conditional {
+	if call.FunctionName() == operators.Conditional {
 		return p.maybePruneConditional(node)
 	}
-	if call.Function == operators.In {
+	if call.FunctionName() == operators.In {
 		return p.maybePruneIn(node)
 	}
-	if call.Function == operators.LogicalNot {
+	if call.FunctionName() == operators.LogicalNot {
 		return p.maybePruneLogicalNot(node)
 	}
 	return nil, false
 }
 
-func (p *astPruner) maybePrune(node *exprpb.Expr) (*exprpb.Expr, bool) {
-	out, pruned := p.prune(node)
-	if pruned {
-		delete(p.macroCalls, node.GetId())
-	}
-	return out, pruned
+func (p *astPruner) maybePrune(node ast.Expr) (ast.Expr, bool) {
+	return p.prune(node)
 }
 
-func (p *astPruner) prune(node *exprpb.Expr) (*exprpb.Expr, bool) {
+func (p *astPruner) prune(node ast.Expr) (ast.Expr, bool) {
 	if node == nil {
 		return node, false
 	}
-	val, valueExists := p.value(node.GetId())
-	if valueExists && !types.IsUnknownOrError(val) {
-		if newNode, ok := p.maybeCreateLiteral(node.GetId(), val); ok {
+	val, valueExists := p.maybeValue(node.ID())
+	if valueExists {
+		if newNode, ok := p.maybeCreateLiteral(node.ID(), val); ok {
+			delete(p.macroCalls, node.ID())
 			return newNode, true
 		}
 	}
+	if macro, found := p.macroCalls[node.ID()]; found {
+		// Ensure that intermediate values for the comprehension are cleared during pruning
+		if node.Kind() == ast.ComprehensionKind {
+			compre := node.AsComprehension()
+			visit(macro, clearIterVarVisitor(compre.IterVar(), p.state))
+		}
+		// prune the expression in terms of the macro call instead of the expanded form.
+		if newMacro, pruned := p.prune(macro); pruned {
+			p.macroCalls[node.ID()] = newMacro
+		}
+	}
 
 	// We have either an unknown/error value, or something we don't want to
 	// transform, or expression was not evaluated. If possible, drill down
 	// more.
-
-	switch node.GetExprKind().(type) {
-	case *exprpb.Expr_SelectExpr:
-		if operand, pruned := p.maybePrune(node.GetSelectExpr().GetOperand()); pruned {
-			return &exprpb.Expr{
-				Id: node.GetId(),
-				ExprKind: &exprpb.Expr_SelectExpr{
-					SelectExpr: &exprpb.Expr_Select{
-						Operand:  operand,
-						Field:    node.GetSelectExpr().GetField(),
-						TestOnly: node.GetSelectExpr().GetTestOnly(),
-					},
-				},
-			}, true
-		}
-	case *exprpb.Expr_CallExpr:
-		var prunedCall bool
-		call := node.GetCallExpr()
-		args := call.GetArgs()
-		newArgs := make([]*exprpb.Expr, len(args))
-		newCall := &exprpb.Expr_Call{
-			Function: call.GetFunction(),
-			Target:   call.GetTarget(),
-			Args:     newArgs,
+	switch node.Kind() {
+	case ast.SelectKind:
+		sel := node.AsSelect()
+		if operand, isPruned := p.maybePrune(sel.Operand()); isPruned {
+			if sel.IsTestOnly() {
+				return p.NewPresenceTest(node.ID(), operand, sel.FieldName()), true
+			}
+			return p.NewSelect(node.ID(), operand, sel.FieldName()), true
 		}
-		for i, arg := range args {
-			newArgs[i] = arg
-			if newArg, prunedArg := p.maybePrune(arg); prunedArg {
-				prunedCall = true
-				newArgs[i] = newArg
+	case ast.CallKind:
+		argsPruned := false
+		call := node.AsCall()
+		args := call.Args()
+		newArgs := make([]ast.Expr, len(args))
+		for i, a := range args {
+			newArgs[i] = a
+			if arg, isPruned := p.maybePrune(a); isPruned {
+				argsPruned = true
+				newArgs[i] = arg
 			}
 		}
-		if newTarget, prunedTarget := p.maybePrune(call.GetTarget()); prunedTarget {
-			prunedCall = true
-			newCall.Target = newTarget
+		if !call.IsMemberFunction() {
+			newCall := p.NewCall(node.ID(), call.FunctionName(), newArgs...)
+			if prunedCall, isPruned := p.maybePruneFunction(newCall); isPruned {
+				return prunedCall, true
+			}
+			return newCall, argsPruned
 		}
-		newNode := &exprpb.Expr{
-			Id: node.GetId(),
-			ExprKind: &exprpb.Expr_CallExpr{
-				CallExpr: newCall,
-			},
+		newTarget := call.Target()
+		targetPruned := false
+		if prunedTarget, isPruned := p.maybePrune(call.Target()); isPruned {
+			targetPruned = true
+			newTarget = prunedTarget
 		}
-		if newExpr, pruned := p.maybePruneFunction(newNode); pruned {
-			newExpr, _ = p.maybePrune(newExpr)
-			return newExpr, true
+		newCall := p.NewMemberCall(node.ID(), call.FunctionName(), newTarget, newArgs...)
+		if prunedCall, isPruned := p.maybePruneFunction(newCall); isPruned {
+			return prunedCall, true
 		}
-		if prunedCall {
-			return newNode, true
+		return newCall, targetPruned || argsPruned
+	case ast.ListKind:
+		l := node.AsList()
+		elems := l.Elements()
+		optIndices := l.OptionalIndices()
+		optIndexMap := map[int32]bool{}
+		for _, i := range optIndices {
+			optIndexMap[i] = true
 		}
-	case *exprpb.Expr_ListExpr:
-		elems := node.GetListExpr().GetElements()
-		newElems := make([]*exprpb.Expr, len(elems))
-		var prunedList bool
+		newOptIndexMap := make(map[int32]bool, len(optIndexMap))
+		newElems := make([]ast.Expr, 0, len(elems))
+		var listPruned bool
+		prunedIdx := 0
 		for i, elem := range elems {
-			newElems[i] = elem
+			_, isOpt := optIndexMap[int32(i)]
+			if isOpt {
+				newElem, pruned := p.maybePruneOptional(elem)
+				if pruned {
+					listPruned = true
+					if newElem != nil {
+						newElems = append(newElems, newElem)
+						prunedIdx++
+					}
+					continue
+				}
+				newOptIndexMap[int32(prunedIdx)] = true
+			}
 			if newElem, prunedElem := p.maybePrune(elem); prunedElem {
-				newElems[i] = newElem
-				prunedList = true
+				newElems = append(newElems, newElem)
+				listPruned = true
+			} else {
+				newElems = append(newElems, elem)
 			}
+			prunedIdx++
 		}
-		if prunedList {
-			return &exprpb.Expr{
-				Id: node.GetId(),
-				ExprKind: &exprpb.Expr_ListExpr{
-					ListExpr: &exprpb.Expr_CreateList{
-						Elements: newElems,
-					},
-				},
-			}, true
+		optIndices = make([]int32, len(newOptIndexMap))
+		idx := 0
+		for i := range newOptIndexMap {
+			optIndices[idx] = i
+			idx++
 		}
-	case *exprpb.Expr_StructExpr:
-		var prunedStruct bool
-		entries := node.GetStructExpr().GetEntries()
-		messageType := node.GetStructExpr().GetMessageName()
-		newEntries := make([]*exprpb.Expr_CreateStruct_Entry, len(entries))
+		if listPruned {
+			return p.NewList(node.ID(), newElems, optIndices), true
+		}
+	case ast.MapKind:
+		var mapPruned bool
+		m := node.AsMap()
+		entries := m.Entries()
+		newEntries := make([]ast.EntryExpr, len(entries))
 		for i, entry := range entries {
 			newEntries[i] = entry
-			newKey, prunedKey := p.maybePrune(entry.GetMapKey())
-			newValue, prunedValue := p.maybePrune(entry.GetValue())
-			if !prunedKey && !prunedValue {
+			e := entry.AsMapEntry()
+			newKey, keyPruned := p.maybePrune(e.Key())
+			newValue, valuePruned := p.maybePrune(e.Value())
+			if !keyPruned && !valuePruned {
 				continue
 			}
-			prunedStruct = true
-			newEntry := &exprpb.Expr_CreateStruct_Entry{
-				Value: newValue,
-			}
-			if messageType != "" {
-				newEntry.KeyKind = &exprpb.Expr_CreateStruct_Entry_FieldKey{
-					FieldKey: entry.GetFieldKey(),
-				}
-			} else {
-				newEntry.KeyKind = &exprpb.Expr_CreateStruct_Entry_MapKey{
-					MapKey: newKey,
-				}
-			}
+			mapPruned = true
+			newEntry := p.NewMapEntry(entry.ID(), newKey, newValue, e.IsOptional())
 			newEntries[i] = newEntry
 		}
-		if prunedStruct {
-			return &exprpb.Expr{
-				Id: node.GetId(),
-				ExprKind: &exprpb.Expr_StructExpr{
-					StructExpr: &exprpb.Expr_CreateStruct{
-						MessageName: messageType,
-						Entries:     newEntries,
-					},
-				},
-			}, true
+		if mapPruned {
+			return p.NewMap(node.ID(), newEntries), true
+		}
+	case ast.StructKind:
+		var structPruned bool
+		obj := node.AsStruct()
+		fields := obj.Fields()
+		newFields := make([]ast.EntryExpr, len(fields))
+		for i, field := range fields {
+			newFields[i] = field
+			f := field.AsStructField()
+			newValue, prunedValue := p.maybePrune(f.Value())
+			if !prunedValue {
+				continue
+			}
+			structPruned = true
+			newEntry := p.NewStructField(field.ID(), f.Name(), newValue, f.IsOptional())
+			newFields[i] = newEntry
+		}
+		if structPruned {
+			return p.NewStruct(node.ID(), obj.TypeName(), newFields), true
 		}
-	case *exprpb.Expr_ComprehensionExpr:
-		compre := node.GetComprehensionExpr()
+	case ast.ComprehensionKind:
+		compre := node.AsComprehension()
 		// Only the range of the comprehension is pruned since the state tracking only records
 		// the last iteration of the comprehension and not each step in the evaluation which
 		// means that the any residuals computed in between might be inaccurate.
-		if newRange, pruned := p.maybePrune(compre.GetIterRange()); pruned {
-			return &exprpb.Expr{
-				Id: node.GetId(),
-				ExprKind: &exprpb.Expr_ComprehensionExpr{
-					ComprehensionExpr: &exprpb.Expr_Comprehension{
-						IterVar:       compre.GetIterVar(),
-						IterRange:     newRange,
-						AccuVar:       compre.GetAccuVar(),
-						AccuInit:      compre.GetAccuInit(),
-						LoopCondition: compre.GetLoopCondition(),
-						LoopStep:      compre.GetLoopStep(),
-						Result:        compre.GetResult(),
-					},
-				},
-			}, true
+		if newRange, pruned := p.maybePrune(compre.IterRange()); pruned {
+			return p.NewComprehension(
+				node.ID(),
+				newRange,
+				compre.IterVar(),
+				compre.AccuVar(),
+				compre.AccuInit(),
+				compre.LoopCondition(),
+				compre.LoopStep(),
+				compre.Result(),
+			), true
 		}
 	}
 	return node, false
@@ -442,24 +441,103 @@ func (p *astPruner) value(id int64) (ref.Val, bool) {
 	return val, (found && val != nil)
 }
 
-func (p *astPruner) existsWithUnknownValue(id int64) bool {
-	val, valueExists := p.value(id)
-	return valueExists && types.IsUnknown(val)
+func (p *astPruner) maybeValue(id int64) (ref.Val, bool) {
+	val, found := p.value(id)
+	if !found || types.IsUnknownOrError(val) {
+		return nil, false
+	}
+	return val, true
 }
 
-func (p *astPruner) existsWithKnownValue(id int64) bool {
-	val, valueExists := p.value(id)
-	return valueExists && !types.IsUnknown(val)
+func (p *astPruner) nextID() int64 {
+	next := p.nextExprID
+	p.nextExprID++
+	return next
 }
 
-func (p *astPruner) nextID() int64 {
-	for {
-		_, found := p.state.Value(p.nextExprID)
-		if !found {
-			next := p.nextExprID
-			p.nextExprID++
-			return next
+type astVisitor struct {
+	// visitEntry is called on every expr node, including those within a map/struct entry.
+	visitExpr func(expr ast.Expr)
+	// visitEntry is called before entering the key, value of a map/struct entry.
+	visitEntry func(entry ast.EntryExpr)
+}
+
+func getMaxID(expr ast.Expr) int64 {
+	maxID := int64(1)
+	visit(expr, maxIDVisitor(&maxID))
+	return maxID
+}
+
+func clearIterVarVisitor(varName string, state EvalState) astVisitor {
+	return astVisitor{
+		visitExpr: func(e ast.Expr) {
+			if e.Kind() == ast.IdentKind && e.AsIdent() == varName {
+				state.SetValue(e.ID(), nil)
+			}
+		},
+	}
+}
+
+func maxIDVisitor(maxID *int64) astVisitor {
+	return astVisitor{
+		visitExpr: func(e ast.Expr) {
+			if e.ID() >= *maxID {
+				*maxID = e.ID() + 1
+			}
+		},
+		visitEntry: func(e ast.EntryExpr) {
+			if e.ID() >= *maxID {
+				*maxID = e.ID() + 1
+			}
+		},
+	}
+}
+
+func visit(expr ast.Expr, visitor astVisitor) {
+	exprs := []ast.Expr{expr}
+	for len(exprs) != 0 {
+		e := exprs[0]
+		if visitor.visitExpr != nil {
+			visitor.visitExpr(e)
+		}
+		exprs = exprs[1:]
+		switch e.Kind() {
+		case ast.SelectKind:
+			exprs = append(exprs, e.AsSelect().Operand())
+		case ast.CallKind:
+			call := e.AsCall()
+			if call.Target() != nil {
+				exprs = append(exprs, call.Target())
+			}
+			exprs = append(exprs, call.Args()...)
+		case ast.ComprehensionKind:
+			compre := e.AsComprehension()
+			exprs = append(exprs,
+				compre.IterRange(),
+				compre.AccuInit(),
+				compre.LoopCondition(),
+				compre.LoopStep(),
+				compre.Result())
+		case ast.ListKind:
+			list := e.AsList()
+			exprs = append(exprs, list.Elements()...)
+		case ast.MapKind:
+			for _, entry := range e.AsMap().Entries() {
+				e := entry.AsMapEntry()
+				if visitor.visitEntry != nil {
+					visitor.visitEntry(entry)
+				}
+				exprs = append(exprs, e.Key())
+				exprs = append(exprs, e.Value())
+			}
+		case ast.StructKind:
+			for _, entry := range e.AsStruct().Fields() {
+				f := entry.AsStructField()
+				if visitor.visitEntry != nil {
+					visitor.visitEntry(entry)
+				}
+				exprs = append(exprs, f.Value())
+			}
 		}
-		p.nextExprID++
 	}
 }
diff --git a/vendor/github.com/google/cel-go/interpreter/runtimecost.go b/vendor/github.com/google/cel-go/interpreter/runtimecost.go
index e7daf01..b9b307c 100644
--- a/vendor/github.com/google/cel-go/interpreter/runtimecost.go
+++ b/vendor/github.com/google/cel-go/interpreter/runtimecost.go
@@ -53,6 +53,11 @@ func CostObserver(tracker *CostTracker) EvalObserver {
 				tracker.stack.drop(t.Attr().ID())
 				tracker.cost += common.SelectAndIdentCost
 			}
+			if !tracker.presenceTestHasCost {
+				if _, isTestOnly := programStep.(*evalTestOnly); isTestOnly {
+					tracker.cost -= common.SelectAndIdentCost
+				}
+			}
 		case *evalExhaustiveConditional:
 			// Ternary has no direct cost. All cost is from the conditional and the true/false branch expressions.
 			tracker.stack.drop(t.attr.falsy.ID(), t.attr.truthy.ID(), t.attr.expr.ID())
@@ -60,17 +65,23 @@ func CostObserver(tracker *CostTracker) EvalObserver {
 		// While the field names are identical, the boolean operation eval structs do not share an interface and so
 		// must be handled individually.
 		case *evalOr:
-			tracker.stack.drop(t.rhs.ID(), t.lhs.ID())
+			for _, term := range t.terms {
+				tracker.stack.drop(term.ID())
+			}
 		case *evalAnd:
-			tracker.stack.drop(t.rhs.ID(), t.lhs.ID())
+			for _, term := range t.terms {
+				tracker.stack.drop(term.ID())
+			}
 		case *evalExhaustiveOr:
-			tracker.stack.drop(t.rhs.ID(), t.lhs.ID())
+			for _, term := range t.terms {
+				tracker.stack.drop(term.ID())
+			}
 		case *evalExhaustiveAnd:
-			tracker.stack.drop(t.rhs.ID(), t.lhs.ID())
+			for _, term := range t.terms {
+				tracker.stack.drop(term.ID())
+			}
 		case *evalFold:
 			tracker.stack.drop(t.iterRange.ID())
-		case *evalTestOnly:
-			tracker.cost += common.SelectAndIdentCost
 		case Qualifier:
 			tracker.cost++
 		case InterpretableCall:
@@ -97,24 +108,86 @@ func CostObserver(tracker *CostTracker) EvalObserver {
 	return observer
 }
 
-// CostTracker represents the information needed for tacking runtime cost
+// CostTrackerOption configures the behavior of CostTracker objects.
+type CostTrackerOption func(*CostTracker) error
+
+// CostTrackerLimit sets the runtime limit on the evaluation cost during execution and will terminate the expression
+// evaluation if the limit is exceeded.
+func CostTrackerLimit(limit uint64) CostTrackerOption {
+	return func(tracker *CostTracker) error {
+		tracker.Limit = &limit
+		return nil
+	}
+}
+
+// PresenceTestHasCost determines whether presence testing has a cost of one or zero.
+// Defaults to presence test has a cost of one.
+func PresenceTestHasCost(hasCost bool) CostTrackerOption {
+	return func(tracker *CostTracker) error {
+		tracker.presenceTestHasCost = hasCost
+		return nil
+	}
+}
+
+// NewCostTracker creates a new CostTracker with a given estimator and a set of functional CostTrackerOption values.
+func NewCostTracker(estimator ActualCostEstimator, opts ...CostTrackerOption) (*CostTracker, error) {
+	tracker := &CostTracker{
+		Estimator:           estimator,
+		overloadTrackers:    map[string]FunctionTracker{},
+		presenceTestHasCost: true,
+	}
+	for _, opt := range opts {
+		err := opt(tracker)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return tracker, nil
+}
+
+// OverloadCostTracker binds an overload ID to a runtime FunctionTracker implementation.
+//
+// OverloadCostTracker instances augment or override ActualCostEstimator decisions, allowing for  versioned and/or
+// optional cost tracking changes.
+func OverloadCostTracker(overloadID string, fnTracker FunctionTracker) CostTrackerOption {
+	return func(tracker *CostTracker) error {
+		tracker.overloadTrackers[overloadID] = fnTracker
+		return nil
+	}
+}
+
+// FunctionTracker computes the actual cost of evaluating the functions with the given arguments and result.
+type FunctionTracker func(args []ref.Val, result ref.Val) *uint64
+
+// CostTracker represents the information needed for tracking runtime cost.
 type CostTracker struct {
-	Estimator ActualCostEstimator
-	Limit     *uint64
+	Estimator           ActualCostEstimator
+	overloadTrackers    map[string]FunctionTracker
+	Limit               *uint64
+	presenceTestHasCost bool
 
 	cost  uint64
 	stack refValStack
 }
 
 // ActualCost returns the runtime cost
-func (c CostTracker) ActualCost() uint64 {
+func (c *CostTracker) ActualCost() uint64 {
 	return c.cost
 }
 
-func (c CostTracker) costCall(call InterpretableCall, argValues []ref.Val, result ref.Val) uint64 {
+func (c *CostTracker) costCall(call InterpretableCall, args []ref.Val, result ref.Val) uint64 {
 	var cost uint64
+	if len(c.overloadTrackers) != 0 {
+		if tracker, found := c.overloadTrackers[call.OverloadID()]; found {
+			callCost := tracker(args, result)
+			if callCost != nil {
+				cost += *callCost
+				return cost
+			}
+		}
+	}
 	if c.Estimator != nil {
-		callCost := c.Estimator.CallCost(call.Function(), call.OverloadID(), argValues, result)
+		callCost := c.Estimator.CallCost(call.Function(), call.OverloadID(), args, result)
 		if callCost != nil {
 			cost += *callCost
 			return cost
@@ -125,11 +198,11 @@ func (c CostTracker) costCall(call InterpretableCall, argValues []ref.Val, resul
 	switch call.OverloadID() {
 	// O(n) functions
 	case overloads.StartsWithString, overloads.EndsWithString, overloads.StringToBytes, overloads.BytesToString, overloads.ExtQuoteString, overloads.ExtFormatString:
-		cost += uint64(math.Ceil(float64(c.actualSize(argValues[0])) * common.StringTraversalCostFactor))
+		cost += uint64(math.Ceil(float64(c.actualSize(args[0])) * common.StringTraversalCostFactor))
 	case overloads.InList:
 		// If a list is composed entirely of constant values this is O(1), but we don't account for that here.
 		// We just assume all list containment checks are O(n).
-		cost += c.actualSize(argValues[1])
+		cost += c.actualSize(args[1])
 	// O(min(m, n)) functions
 	case overloads.LessString, overloads.GreaterString, overloads.LessEqualsString, overloads.GreaterEqualsString,
 		overloads.LessBytes, overloads.GreaterBytes, overloads.LessEqualsBytes, overloads.GreaterEqualsBytes,
@@ -137,8 +210,8 @@ func (c CostTracker) costCall(call InterpretableCall, argValues []ref.Val, resul
 		// When we check the equality of 2 scalar values (e.g. 2 integers, 2 floating-point numbers, 2 booleans etc.),
 		// the CostTracker.actualSize() function by definition returns 1 for each operand, resulting in an overall cost
 		// of 1.
-		lhsSize := c.actualSize(argValues[0])
-		rhsSize := c.actualSize(argValues[1])
+		lhsSize := c.actualSize(args[0])
+		rhsSize := c.actualSize(args[1])
 		minSize := lhsSize
 		if rhsSize < minSize {
 			minSize = rhsSize
@@ -147,23 +220,23 @@ func (c CostTracker) costCall(call InterpretableCall, argValues []ref.Val, resul
 	// O(m+n) functions
 	case overloads.AddString, overloads.AddBytes:
 		// In the worst case scenario, we would need to reallocate a new backing store and copy both operands over.
-		cost += uint64(math.Ceil(float64(c.actualSize(argValues[0])+c.actualSize(argValues[1])) * common.StringTraversalCostFactor))
+		cost += uint64(math.Ceil(float64(c.actualSize(args[0])+c.actualSize(args[1])) * common.StringTraversalCostFactor))
 	// O(nm) functions
 	case overloads.MatchesString:
 		// https://swtch.com/~rsc/regexp/regexp1.html applies to RE2 implementation supported by CEL
 		// Add one to string length for purposes of cost calculation to prevent product of string and regex to be 0
 		// in case where string is empty but regex is still expensive.
-		strCost := uint64(math.Ceil((1.0 + float64(c.actualSize(argValues[0]))) * common.StringTraversalCostFactor))
+		strCost := uint64(math.Ceil((1.0 + float64(c.actualSize(args[0]))) * common.StringTraversalCostFactor))
 		// We don't know how many expressions are in the regex, just the string length (a huge
 		// improvement here would be to somehow get a count the number of expressions in the regex or
 		// how many states are in the regex state machine and use that to measure regex cost).
 		// For now, we're making a guess that each expression in a regex is typically at least 4 chars
 		// in length.
-		regexCost := uint64(math.Ceil(float64(c.actualSize(argValues[1])) * common.RegexStringLengthCostFactor))
+		regexCost := uint64(math.Ceil(float64(c.actualSize(args[1])) * common.RegexStringLengthCostFactor))
 		cost += strCost * regexCost
 	case overloads.ContainsString:
-		strCost := uint64(math.Ceil(float64(c.actualSize(argValues[0])) * common.StringTraversalCostFactor))
-		substrCost := uint64(math.Ceil(float64(c.actualSize(argValues[1])) * common.StringTraversalCostFactor))
+		strCost := uint64(math.Ceil(float64(c.actualSize(args[0])) * common.StringTraversalCostFactor))
+		substrCost := uint64(math.Ceil(float64(c.actualSize(args[1])) * common.StringTraversalCostFactor))
 		cost += strCost * substrCost
 
 	default:
@@ -181,7 +254,7 @@ func (c CostTracker) costCall(call InterpretableCall, argValues []ref.Val, resul
 }
 
 // actualSize returns the size of value
-func (c CostTracker) actualSize(value ref.Val) uint64 {
+func (c *CostTracker) actualSize(value ref.Val) uint64 {
 	if sz, ok := value.(traits.Sizer); ok {
 		return uint64(sz.Size().(types.Int))
 	}
diff --git a/vendor/github.com/google/cel-go/parser/BUILD.bazel b/vendor/github.com/google/cel-go/parser/BUILD.bazel
index c904ae3..97bc9bd 100644
--- a/vendor/github.com/google/cel-go/parser/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/parser/BUILD.bazel
@@ -20,11 +20,14 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//common:go_default_library",
+        "//common/ast:go_default_library",
         "//common/operators:go_default_library",
         "//common/runes:go_default_library",
+        "//common/types:go_default_library",
+        "//common/types/ref:go_default_library",
         "//parser/gen:go_default_library",
-        "@com_github_antlr_antlr4_runtime_go_antlr_v4//:go_default_library",
-        "@org_golang_google_genproto//googleapis/api/expr/v1alpha1:go_default_library",
+        "@com_github_antlr4_go_antlr_v4//:go_default_library",
+        "@org_golang_google_genproto_googleapis_api//expr/v1alpha1:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//types/known/structpb:go_default_library",
     ],
@@ -43,10 +46,12 @@ go_test(
         ":go_default_library",
     ],
     deps = [
+        "//common/ast:go_default_library",
         "//common/debug:go_default_library",
+        "//common/types:go_default_library",
         "//parser/gen:go_default_library",
         "//test:go_default_library",
-        "@com_github_antlr_antlr4_runtime_go_antlr_v4//:go_default_library",
+        "@com_github_antlr4_go_antlr_v4//:go_default_library",
         "@org_golang_google_protobuf//proto:go_default_library",
         "@org_golang_google_protobuf//testing/protocmp:go_default_library",
     ],
diff --git a/vendor/github.com/google/cel-go/parser/errors.go b/vendor/github.com/google/cel-go/parser/errors.go
index ce49bb8..93ae7a3 100644
--- a/vendor/github.com/google/cel-go/parser/errors.go
+++ b/vendor/github.com/google/cel-go/parser/errors.go
@@ -22,9 +22,22 @@ import (
 
 // parseErrors is a specialization of Errors.
 type parseErrors struct {
-	*common.Errors
+	errs *common.Errors
+}
+
+// errorCount indicates the number of errors reported.
+func (e *parseErrors) errorCount() int {
+	return len(e.errs.GetErrors())
+}
+
+func (e *parseErrors) internalError(message string) {
+	e.errs.ReportErrorAtID(0, common.NoLocation, message)
 }
 
 func (e *parseErrors) syntaxError(l common.Location, message string) {
-	e.ReportError(l, fmt.Sprintf("Syntax error: %s", message))
+	e.errs.ReportErrorAtID(0, l, fmt.Sprintf("Syntax error: %s", message))
+}
+
+func (e *parseErrors) reportErrorAtID(id int64, l common.Location, message string, args ...any) {
+	e.errs.ReportErrorAtID(id, l, message, args...)
 }
diff --git a/vendor/github.com/google/cel-go/parser/gen/BUILD.bazel b/vendor/github.com/google/cel-go/parser/gen/BUILD.bazel
index 654d1de..3efed87 100644
--- a/vendor/github.com/google/cel-go/parser/gen/BUILD.bazel
+++ b/vendor/github.com/google/cel-go/parser/gen/BUILD.bazel
@@ -1,7 +1,7 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
 
 package(
-    default_visibility = ["//parser:__subpackages__"],
+    default_visibility = ["//:__subpackages__"],
     licenses = ["notice"],  # Apache 2.0
 )
 
@@ -21,6 +21,6 @@ go_library(
     ],
     importpath = "github.com/google/cel-go/parser/gen",
     deps = [
-        "@com_github_antlr_antlr4_runtime_go_antlr_v4//:go_default_library",
+        "@com_github_antlr4_go_antlr_v4//:go_default_library",
     ],
 )
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_base_listener.go b/vendor/github.com/google/cel-go/parser/gen/cel_base_listener.go
index 0247f47..c49d038 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_base_listener.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_base_listener.go
@@ -1,7 +1,7 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen // CEL
-import "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+import "github.com/antlr4-go/antlr/v4"
 
 // BaseCELListener is a complete listener for a parse tree produced by CELParser.
 type BaseCELListener struct{}
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.go b/vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.go
index 52a7f4d..b2c0783 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_base_visitor.go
@@ -1,7 +1,8 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen // CEL
-import "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+import "github.com/antlr4-go/antlr/v4"
+
 
 type BaseCELVisitor struct {
 	*antlr.BaseParseTreeVisitor
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_lexer.go b/vendor/github.com/google/cel-go/parser/gen/cel_lexer.go
index 98ddc06..e026cc4 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_lexer.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_lexer.go
@@ -1,280 +1,278 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen
-
 import (
 	"fmt"
-	"sync"
+  	"sync"
 	"unicode"
-
-	"github.com/antlr/antlr4/runtime/Go/antlr/v4"
+	"github.com/antlr4-go/antlr/v4"
 )
-
 // Suppress unused import error
 var _ = fmt.Printf
 var _ = sync.Once{}
 var _ = unicode.IsLetter
 
+
 type CELLexer struct {
 	*antlr.BaseLexer
 	channelNames []string
-	modeNames    []string
+	modeNames []string
 	// TODO: EOF string
 }
 
-var cellexerLexerStaticData struct {
-	once                   sync.Once
-	serializedATN          []int32
-	channelNames           []string
-	modeNames              []string
-	literalNames           []string
-	symbolicNames          []string
-	ruleNames              []string
-	predictionContextCache *antlr.PredictionContextCache
-	atn                    *antlr.ATN
-	decisionToDFA          []*antlr.DFA
+var CELLexerLexerStaticData struct {
+  once                   sync.Once
+  serializedATN          []int32
+  ChannelNames           []string
+  ModeNames              []string
+  LiteralNames           []string
+  SymbolicNames          []string
+  RuleNames              []string
+  PredictionContextCache *antlr.PredictionContextCache
+  atn                    *antlr.ATN
+  decisionToDFA          []*antlr.DFA
 }
 
 func cellexerLexerInit() {
-	staticData := &cellexerLexerStaticData
-	staticData.channelNames = []string{
-		"DEFAULT_TOKEN_CHANNEL", "HIDDEN",
-	}
-	staticData.modeNames = []string{
-		"DEFAULT_MODE",
-	}
-	staticData.literalNames = []string{
-		"", "'=='", "'!='", "'in'", "'<'", "'<='", "'>='", "'>'", "'&&'", "'||'",
-		"'['", "']'", "'{'", "'}'", "'('", "')'", "'.'", "','", "'-'", "'!'",
-		"'?'", "':'", "'+'", "'*'", "'/'", "'%'", "'true'", "'false'", "'null'",
-	}
-	staticData.symbolicNames = []string{
-		"", "EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS",
-		"GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE",
-		"RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK",
-		"COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE",
-		"NUL", "WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT",
-		"STRING", "BYTES", "IDENTIFIER",
-	}
-	staticData.ruleNames = []string{
-		"EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS",
-		"GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE",
-		"RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK",
-		"COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE",
-		"NUL", "BACKSLASH", "LETTER", "DIGIT", "EXPONENT", "HEXDIGIT", "RAW",
-		"ESC_SEQ", "ESC_CHAR_SEQ", "ESC_OCT_SEQ", "ESC_BYTE_SEQ", "ESC_UNI_SEQ",
-		"WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT", "STRING",
-		"BYTES", "IDENTIFIER",
-	}
-	staticData.predictionContextCache = antlr.NewPredictionContextCache()
-	staticData.serializedATN = []int32{
-		4, 0, 36, 423, 6, -1, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2,
-		4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2,
-		10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15,
-		7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7,
-		20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25,
-		2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2,
-		31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36,
-		7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7,
-		41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46,
-		1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 4,
-		1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 6, 1, 6, 1, 7, 1, 7, 1, 7, 1, 8, 1, 8,
-		1, 8, 1, 9, 1, 9, 1, 10, 1, 10, 1, 11, 1, 11, 1, 12, 1, 12, 1, 13, 1, 13,
-		1, 14, 1, 14, 1, 15, 1, 15, 1, 16, 1, 16, 1, 17, 1, 17, 1, 18, 1, 18, 1,
-		19, 1, 19, 1, 20, 1, 20, 1, 21, 1, 21, 1, 22, 1, 22, 1, 23, 1, 23, 1, 24,
-		1, 24, 1, 25, 1, 25, 1, 25, 1, 25, 1, 25, 1, 26, 1, 26, 1, 26, 1, 26, 1,
-		26, 1, 26, 1, 27, 1, 27, 1, 27, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29,
-		1, 30, 1, 30, 1, 31, 1, 31, 3, 31, 177, 8, 31, 1, 31, 4, 31, 180, 8, 31,
-		11, 31, 12, 31, 181, 1, 32, 1, 32, 1, 33, 1, 33, 1, 34, 1, 34, 1, 34, 1,
-		34, 3, 34, 192, 8, 34, 1, 35, 1, 35, 1, 35, 1, 36, 1, 36, 1, 36, 1, 36,
-		1, 36, 1, 37, 1, 37, 1, 37, 1, 37, 1, 37, 1, 38, 1, 38, 1, 38, 1, 38, 1,
-		38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38,
-		1, 38, 1, 38, 1, 38, 3, 38, 225, 8, 38, 1, 39, 4, 39, 228, 8, 39, 11, 39,
-		12, 39, 229, 1, 39, 1, 39, 1, 40, 1, 40, 1, 40, 1, 40, 5, 40, 238, 8, 40,
-		10, 40, 12, 40, 241, 9, 40, 1, 40, 1, 40, 1, 41, 4, 41, 246, 8, 41, 11,
-		41, 12, 41, 247, 1, 41, 1, 41, 4, 41, 252, 8, 41, 11, 41, 12, 41, 253,
-		1, 41, 3, 41, 257, 8, 41, 1, 41, 4, 41, 260, 8, 41, 11, 41, 12, 41, 261,
-		1, 41, 1, 41, 1, 41, 1, 41, 4, 41, 268, 8, 41, 11, 41, 12, 41, 269, 1,
-		41, 3, 41, 273, 8, 41, 3, 41, 275, 8, 41, 1, 42, 4, 42, 278, 8, 42, 11,
-		42, 12, 42, 279, 1, 42, 1, 42, 1, 42, 1, 42, 4, 42, 286, 8, 42, 11, 42,
-		12, 42, 287, 3, 42, 290, 8, 42, 1, 43, 4, 43, 293, 8, 43, 11, 43, 12, 43,
-		294, 1, 43, 1, 43, 1, 43, 1, 43, 1, 43, 1, 43, 4, 43, 303, 8, 43, 11, 43,
-		12, 43, 304, 1, 43, 1, 43, 3, 43, 309, 8, 43, 1, 44, 1, 44, 1, 44, 5, 44,
-		314, 8, 44, 10, 44, 12, 44, 317, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5,
-		44, 323, 8, 44, 10, 44, 12, 44, 326, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44,
-		1, 44, 1, 44, 1, 44, 5, 44, 335, 8, 44, 10, 44, 12, 44, 338, 9, 44, 1,
-		44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5, 44, 349,
-		8, 44, 10, 44, 12, 44, 352, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1,
-		44, 5, 44, 360, 8, 44, 10, 44, 12, 44, 363, 9, 44, 1, 44, 1, 44, 1, 44,
-		1, 44, 1, 44, 5, 44, 370, 8, 44, 10, 44, 12, 44, 373, 9, 44, 1, 44, 1,
-		44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5, 44, 383, 8, 44, 10, 44,
-		12, 44, 386, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1,
-		44, 1, 44, 1, 44, 5, 44, 398, 8, 44, 10, 44, 12, 44, 401, 9, 44, 1, 44,
-		1, 44, 1, 44, 1, 44, 3, 44, 407, 8, 44, 1, 45, 1, 45, 1, 45, 1, 46, 1,
-		46, 3, 46, 414, 8, 46, 1, 46, 1, 46, 1, 46, 5, 46, 419, 8, 46, 10, 46,
-		12, 46, 422, 9, 46, 4, 336, 350, 384, 399, 0, 47, 1, 1, 3, 2, 5, 3, 7,
-		4, 9, 5, 11, 6, 13, 7, 15, 8, 17, 9, 19, 10, 21, 11, 23, 12, 25, 13, 27,
-		14, 29, 15, 31, 16, 33, 17, 35, 18, 37, 19, 39, 20, 41, 21, 43, 22, 45,
-		23, 47, 24, 49, 25, 51, 26, 53, 27, 55, 28, 57, 0, 59, 0, 61, 0, 63, 0,
-		65, 0, 67, 0, 69, 0, 71, 0, 73, 0, 75, 0, 77, 0, 79, 29, 81, 30, 83, 31,
-		85, 32, 87, 33, 89, 34, 91, 35, 93, 36, 1, 0, 16, 2, 0, 65, 90, 97, 122,
-		2, 0, 69, 69, 101, 101, 2, 0, 43, 43, 45, 45, 3, 0, 48, 57, 65, 70, 97,
-		102, 2, 0, 82, 82, 114, 114, 10, 0, 34, 34, 39, 39, 63, 63, 92, 92, 96,
-		98, 102, 102, 110, 110, 114, 114, 116, 116, 118, 118, 2, 0, 88, 88, 120,
-		120, 3, 0, 9, 10, 12, 13, 32, 32, 1, 0, 10, 10, 2, 0, 85, 85, 117, 117,
-		4, 0, 10, 10, 13, 13, 34, 34, 92, 92, 4, 0, 10, 10, 13, 13, 39, 39, 92,
-		92, 1, 0, 92, 92, 3, 0, 10, 10, 13, 13, 34, 34, 3, 0, 10, 10, 13, 13, 39,
-		39, 2, 0, 66, 66, 98, 98, 456, 0, 1, 1, 0, 0, 0, 0, 3, 1, 0, 0, 0, 0, 5,
-		1, 0, 0, 0, 0, 7, 1, 0, 0, 0, 0, 9, 1, 0, 0, 0, 0, 11, 1, 0, 0, 0, 0, 13,
-		1, 0, 0, 0, 0, 15, 1, 0, 0, 0, 0, 17, 1, 0, 0, 0, 0, 19, 1, 0, 0, 0, 0,
-		21, 1, 0, 0, 0, 0, 23, 1, 0, 0, 0, 0, 25, 1, 0, 0, 0, 0, 27, 1, 0, 0, 0,
-		0, 29, 1, 0, 0, 0, 0, 31, 1, 0, 0, 0, 0, 33, 1, 0, 0, 0, 0, 35, 1, 0, 0,
-		0, 0, 37, 1, 0, 0, 0, 0, 39, 1, 0, 0, 0, 0, 41, 1, 0, 0, 0, 0, 43, 1, 0,
-		0, 0, 0, 45, 1, 0, 0, 0, 0, 47, 1, 0, 0, 0, 0, 49, 1, 0, 0, 0, 0, 51, 1,
-		0, 0, 0, 0, 53, 1, 0, 0, 0, 0, 55, 1, 0, 0, 0, 0, 79, 1, 0, 0, 0, 0, 81,
-		1, 0, 0, 0, 0, 83, 1, 0, 0, 0, 0, 85, 1, 0, 0, 0, 0, 87, 1, 0, 0, 0, 0,
-		89, 1, 0, 0, 0, 0, 91, 1, 0, 0, 0, 0, 93, 1, 0, 0, 0, 1, 95, 1, 0, 0, 0,
-		3, 98, 1, 0, 0, 0, 5, 101, 1, 0, 0, 0, 7, 104, 1, 0, 0, 0, 9, 106, 1, 0,
-		0, 0, 11, 109, 1, 0, 0, 0, 13, 112, 1, 0, 0, 0, 15, 114, 1, 0, 0, 0, 17,
-		117, 1, 0, 0, 0, 19, 120, 1, 0, 0, 0, 21, 122, 1, 0, 0, 0, 23, 124, 1,
-		0, 0, 0, 25, 126, 1, 0, 0, 0, 27, 128, 1, 0, 0, 0, 29, 130, 1, 0, 0, 0,
-		31, 132, 1, 0, 0, 0, 33, 134, 1, 0, 0, 0, 35, 136, 1, 0, 0, 0, 37, 138,
-		1, 0, 0, 0, 39, 140, 1, 0, 0, 0, 41, 142, 1, 0, 0, 0, 43, 144, 1, 0, 0,
-		0, 45, 146, 1, 0, 0, 0, 47, 148, 1, 0, 0, 0, 49, 150, 1, 0, 0, 0, 51, 152,
-		1, 0, 0, 0, 53, 157, 1, 0, 0, 0, 55, 163, 1, 0, 0, 0, 57, 168, 1, 0, 0,
-		0, 59, 170, 1, 0, 0, 0, 61, 172, 1, 0, 0, 0, 63, 174, 1, 0, 0, 0, 65, 183,
-		1, 0, 0, 0, 67, 185, 1, 0, 0, 0, 69, 191, 1, 0, 0, 0, 71, 193, 1, 0, 0,
-		0, 73, 196, 1, 0, 0, 0, 75, 201, 1, 0, 0, 0, 77, 224, 1, 0, 0, 0, 79, 227,
-		1, 0, 0, 0, 81, 233, 1, 0, 0, 0, 83, 274, 1, 0, 0, 0, 85, 289, 1, 0, 0,
-		0, 87, 308, 1, 0, 0, 0, 89, 406, 1, 0, 0, 0, 91, 408, 1, 0, 0, 0, 93, 413,
-		1, 0, 0, 0, 95, 96, 5, 61, 0, 0, 96, 97, 5, 61, 0, 0, 97, 2, 1, 0, 0, 0,
-		98, 99, 5, 33, 0, 0, 99, 100, 5, 61, 0, 0, 100, 4, 1, 0, 0, 0, 101, 102,
-		5, 105, 0, 0, 102, 103, 5, 110, 0, 0, 103, 6, 1, 0, 0, 0, 104, 105, 5,
-		60, 0, 0, 105, 8, 1, 0, 0, 0, 106, 107, 5, 60, 0, 0, 107, 108, 5, 61, 0,
-		0, 108, 10, 1, 0, 0, 0, 109, 110, 5, 62, 0, 0, 110, 111, 5, 61, 0, 0, 111,
-		12, 1, 0, 0, 0, 112, 113, 5, 62, 0, 0, 113, 14, 1, 0, 0, 0, 114, 115, 5,
-		38, 0, 0, 115, 116, 5, 38, 0, 0, 116, 16, 1, 0, 0, 0, 117, 118, 5, 124,
-		0, 0, 118, 119, 5, 124, 0, 0, 119, 18, 1, 0, 0, 0, 120, 121, 5, 91, 0,
-		0, 121, 20, 1, 0, 0, 0, 122, 123, 5, 93, 0, 0, 123, 22, 1, 0, 0, 0, 124,
-		125, 5, 123, 0, 0, 125, 24, 1, 0, 0, 0, 126, 127, 5, 125, 0, 0, 127, 26,
-		1, 0, 0, 0, 128, 129, 5, 40, 0, 0, 129, 28, 1, 0, 0, 0, 130, 131, 5, 41,
-		0, 0, 131, 30, 1, 0, 0, 0, 132, 133, 5, 46, 0, 0, 133, 32, 1, 0, 0, 0,
-		134, 135, 5, 44, 0, 0, 135, 34, 1, 0, 0, 0, 136, 137, 5, 45, 0, 0, 137,
-		36, 1, 0, 0, 0, 138, 139, 5, 33, 0, 0, 139, 38, 1, 0, 0, 0, 140, 141, 5,
-		63, 0, 0, 141, 40, 1, 0, 0, 0, 142, 143, 5, 58, 0, 0, 143, 42, 1, 0, 0,
-		0, 144, 145, 5, 43, 0, 0, 145, 44, 1, 0, 0, 0, 146, 147, 5, 42, 0, 0, 147,
-		46, 1, 0, 0, 0, 148, 149, 5, 47, 0, 0, 149, 48, 1, 0, 0, 0, 150, 151, 5,
-		37, 0, 0, 151, 50, 1, 0, 0, 0, 152, 153, 5, 116, 0, 0, 153, 154, 5, 114,
-		0, 0, 154, 155, 5, 117, 0, 0, 155, 156, 5, 101, 0, 0, 156, 52, 1, 0, 0,
-		0, 157, 158, 5, 102, 0, 0, 158, 159, 5, 97, 0, 0, 159, 160, 5, 108, 0,
-		0, 160, 161, 5, 115, 0, 0, 161, 162, 5, 101, 0, 0, 162, 54, 1, 0, 0, 0,
-		163, 164, 5, 110, 0, 0, 164, 165, 5, 117, 0, 0, 165, 166, 5, 108, 0, 0,
-		166, 167, 5, 108, 0, 0, 167, 56, 1, 0, 0, 0, 168, 169, 5, 92, 0, 0, 169,
-		58, 1, 0, 0, 0, 170, 171, 7, 0, 0, 0, 171, 60, 1, 0, 0, 0, 172, 173, 2,
-		48, 57, 0, 173, 62, 1, 0, 0, 0, 174, 176, 7, 1, 0, 0, 175, 177, 7, 2, 0,
-		0, 176, 175, 1, 0, 0, 0, 176, 177, 1, 0, 0, 0, 177, 179, 1, 0, 0, 0, 178,
-		180, 3, 61, 30, 0, 179, 178, 1, 0, 0, 0, 180, 181, 1, 0, 0, 0, 181, 179,
-		1, 0, 0, 0, 181, 182, 1, 0, 0, 0, 182, 64, 1, 0, 0, 0, 183, 184, 7, 3,
-		0, 0, 184, 66, 1, 0, 0, 0, 185, 186, 7, 4, 0, 0, 186, 68, 1, 0, 0, 0, 187,
-		192, 3, 71, 35, 0, 188, 192, 3, 75, 37, 0, 189, 192, 3, 77, 38, 0, 190,
-		192, 3, 73, 36, 0, 191, 187, 1, 0, 0, 0, 191, 188, 1, 0, 0, 0, 191, 189,
-		1, 0, 0, 0, 191, 190, 1, 0, 0, 0, 192, 70, 1, 0, 0, 0, 193, 194, 3, 57,
-		28, 0, 194, 195, 7, 5, 0, 0, 195, 72, 1, 0, 0, 0, 196, 197, 3, 57, 28,
-		0, 197, 198, 2, 48, 51, 0, 198, 199, 2, 48, 55, 0, 199, 200, 2, 48, 55,
-		0, 200, 74, 1, 0, 0, 0, 201, 202, 3, 57, 28, 0, 202, 203, 7, 6, 0, 0, 203,
-		204, 3, 65, 32, 0, 204, 205, 3, 65, 32, 0, 205, 76, 1, 0, 0, 0, 206, 207,
-		3, 57, 28, 0, 207, 208, 5, 117, 0, 0, 208, 209, 3, 65, 32, 0, 209, 210,
-		3, 65, 32, 0, 210, 211, 3, 65, 32, 0, 211, 212, 3, 65, 32, 0, 212, 225,
-		1, 0, 0, 0, 213, 214, 3, 57, 28, 0, 214, 215, 5, 85, 0, 0, 215, 216, 3,
-		65, 32, 0, 216, 217, 3, 65, 32, 0, 217, 218, 3, 65, 32, 0, 218, 219, 3,
-		65, 32, 0, 219, 220, 3, 65, 32, 0, 220, 221, 3, 65, 32, 0, 221, 222, 3,
-		65, 32, 0, 222, 223, 3, 65, 32, 0, 223, 225, 1, 0, 0, 0, 224, 206, 1, 0,
-		0, 0, 224, 213, 1, 0, 0, 0, 225, 78, 1, 0, 0, 0, 226, 228, 7, 7, 0, 0,
-		227, 226, 1, 0, 0, 0, 228, 229, 1, 0, 0, 0, 229, 227, 1, 0, 0, 0, 229,
-		230, 1, 0, 0, 0, 230, 231, 1, 0, 0, 0, 231, 232, 6, 39, 0, 0, 232, 80,
-		1, 0, 0, 0, 233, 234, 5, 47, 0, 0, 234, 235, 5, 47, 0, 0, 235, 239, 1,
-		0, 0, 0, 236, 238, 8, 8, 0, 0, 237, 236, 1, 0, 0, 0, 238, 241, 1, 0, 0,
-		0, 239, 237, 1, 0, 0, 0, 239, 240, 1, 0, 0, 0, 240, 242, 1, 0, 0, 0, 241,
-		239, 1, 0, 0, 0, 242, 243, 6, 40, 0, 0, 243, 82, 1, 0, 0, 0, 244, 246,
-		3, 61, 30, 0, 245, 244, 1, 0, 0, 0, 246, 247, 1, 0, 0, 0, 247, 245, 1,
-		0, 0, 0, 247, 248, 1, 0, 0, 0, 248, 249, 1, 0, 0, 0, 249, 251, 5, 46, 0,
-		0, 250, 252, 3, 61, 30, 0, 251, 250, 1, 0, 0, 0, 252, 253, 1, 0, 0, 0,
-		253, 251, 1, 0, 0, 0, 253, 254, 1, 0, 0, 0, 254, 256, 1, 0, 0, 0, 255,
-		257, 3, 63, 31, 0, 256, 255, 1, 0, 0, 0, 256, 257, 1, 0, 0, 0, 257, 275,
-		1, 0, 0, 0, 258, 260, 3, 61, 30, 0, 259, 258, 1, 0, 0, 0, 260, 261, 1,
-		0, 0, 0, 261, 259, 1, 0, 0, 0, 261, 262, 1, 0, 0, 0, 262, 263, 1, 0, 0,
-		0, 263, 264, 3, 63, 31, 0, 264, 275, 1, 0, 0, 0, 265, 267, 5, 46, 0, 0,
-		266, 268, 3, 61, 30, 0, 267, 266, 1, 0, 0, 0, 268, 269, 1, 0, 0, 0, 269,
-		267, 1, 0, 0, 0, 269, 270, 1, 0, 0, 0, 270, 272, 1, 0, 0, 0, 271, 273,
-		3, 63, 31, 0, 272, 271, 1, 0, 0, 0, 272, 273, 1, 0, 0, 0, 273, 275, 1,
-		0, 0, 0, 274, 245, 1, 0, 0, 0, 274, 259, 1, 0, 0, 0, 274, 265, 1, 0, 0,
-		0, 275, 84, 1, 0, 0, 0, 276, 278, 3, 61, 30, 0, 277, 276, 1, 0, 0, 0, 278,
-		279, 1, 0, 0, 0, 279, 277, 1, 0, 0, 0, 279, 280, 1, 0, 0, 0, 280, 290,
-		1, 0, 0, 0, 281, 282, 5, 48, 0, 0, 282, 283, 5, 120, 0, 0, 283, 285, 1,
-		0, 0, 0, 284, 286, 3, 65, 32, 0, 285, 284, 1, 0, 0, 0, 286, 287, 1, 0,
-		0, 0, 287, 285, 1, 0, 0, 0, 287, 288, 1, 0, 0, 0, 288, 290, 1, 0, 0, 0,
-		289, 277, 1, 0, 0, 0, 289, 281, 1, 0, 0, 0, 290, 86, 1, 0, 0, 0, 291, 293,
-		3, 61, 30, 0, 292, 291, 1, 0, 0, 0, 293, 294, 1, 0, 0, 0, 294, 292, 1,
-		0, 0, 0, 294, 295, 1, 0, 0, 0, 295, 296, 1, 0, 0, 0, 296, 297, 7, 9, 0,
-		0, 297, 309, 1, 0, 0, 0, 298, 299, 5, 48, 0, 0, 299, 300, 5, 120, 0, 0,
-		300, 302, 1, 0, 0, 0, 301, 303, 3, 65, 32, 0, 302, 301, 1, 0, 0, 0, 303,
-		304, 1, 0, 0, 0, 304, 302, 1, 0, 0, 0, 304, 305, 1, 0, 0, 0, 305, 306,
-		1, 0, 0, 0, 306, 307, 7, 9, 0, 0, 307, 309, 1, 0, 0, 0, 308, 292, 1, 0,
-		0, 0, 308, 298, 1, 0, 0, 0, 309, 88, 1, 0, 0, 0, 310, 315, 5, 34, 0, 0,
-		311, 314, 3, 69, 34, 0, 312, 314, 8, 10, 0, 0, 313, 311, 1, 0, 0, 0, 313,
-		312, 1, 0, 0, 0, 314, 317, 1, 0, 0, 0, 315, 313, 1, 0, 0, 0, 315, 316,
-		1, 0, 0, 0, 316, 318, 1, 0, 0, 0, 317, 315, 1, 0, 0, 0, 318, 407, 5, 34,
-		0, 0, 319, 324, 5, 39, 0, 0, 320, 323, 3, 69, 34, 0, 321, 323, 8, 11, 0,
-		0, 322, 320, 1, 0, 0, 0, 322, 321, 1, 0, 0, 0, 323, 326, 1, 0, 0, 0, 324,
-		322, 1, 0, 0, 0, 324, 325, 1, 0, 0, 0, 325, 327, 1, 0, 0, 0, 326, 324,
-		1, 0, 0, 0, 327, 407, 5, 39, 0, 0, 328, 329, 5, 34, 0, 0, 329, 330, 5,
-		34, 0, 0, 330, 331, 5, 34, 0, 0, 331, 336, 1, 0, 0, 0, 332, 335, 3, 69,
-		34, 0, 333, 335, 8, 12, 0, 0, 334, 332, 1, 0, 0, 0, 334, 333, 1, 0, 0,
-		0, 335, 338, 1, 0, 0, 0, 336, 337, 1, 0, 0, 0, 336, 334, 1, 0, 0, 0, 337,
-		339, 1, 0, 0, 0, 338, 336, 1, 0, 0, 0, 339, 340, 5, 34, 0, 0, 340, 341,
-		5, 34, 0, 0, 341, 407, 5, 34, 0, 0, 342, 343, 5, 39, 0, 0, 343, 344, 5,
-		39, 0, 0, 344, 345, 5, 39, 0, 0, 345, 350, 1, 0, 0, 0, 346, 349, 3, 69,
-		34, 0, 347, 349, 8, 12, 0, 0, 348, 346, 1, 0, 0, 0, 348, 347, 1, 0, 0,
-		0, 349, 352, 1, 0, 0, 0, 350, 351, 1, 0, 0, 0, 350, 348, 1, 0, 0, 0, 351,
-		353, 1, 0, 0, 0, 352, 350, 1, 0, 0, 0, 353, 354, 5, 39, 0, 0, 354, 355,
-		5, 39, 0, 0, 355, 407, 5, 39, 0, 0, 356, 357, 3, 67, 33, 0, 357, 361, 5,
-		34, 0, 0, 358, 360, 8, 13, 0, 0, 359, 358, 1, 0, 0, 0, 360, 363, 1, 0,
-		0, 0, 361, 359, 1, 0, 0, 0, 361, 362, 1, 0, 0, 0, 362, 364, 1, 0, 0, 0,
-		363, 361, 1, 0, 0, 0, 364, 365, 5, 34, 0, 0, 365, 407, 1, 0, 0, 0, 366,
-		367, 3, 67, 33, 0, 367, 371, 5, 39, 0, 0, 368, 370, 8, 14, 0, 0, 369, 368,
-		1, 0, 0, 0, 370, 373, 1, 0, 0, 0, 371, 369, 1, 0, 0, 0, 371, 372, 1, 0,
-		0, 0, 372, 374, 1, 0, 0, 0, 373, 371, 1, 0, 0, 0, 374, 375, 5, 39, 0, 0,
-		375, 407, 1, 0, 0, 0, 376, 377, 3, 67, 33, 0, 377, 378, 5, 34, 0, 0, 378,
-		379, 5, 34, 0, 0, 379, 380, 5, 34, 0, 0, 380, 384, 1, 0, 0, 0, 381, 383,
-		9, 0, 0, 0, 382, 381, 1, 0, 0, 0, 383, 386, 1, 0, 0, 0, 384, 385, 1, 0,
-		0, 0, 384, 382, 1, 0, 0, 0, 385, 387, 1, 0, 0, 0, 386, 384, 1, 0, 0, 0,
-		387, 388, 5, 34, 0, 0, 388, 389, 5, 34, 0, 0, 389, 390, 5, 34, 0, 0, 390,
-		407, 1, 0, 0, 0, 391, 392, 3, 67, 33, 0, 392, 393, 5, 39, 0, 0, 393, 394,
-		5, 39, 0, 0, 394, 395, 5, 39, 0, 0, 395, 399, 1, 0, 0, 0, 396, 398, 9,
-		0, 0, 0, 397, 396, 1, 0, 0, 0, 398, 401, 1, 0, 0, 0, 399, 400, 1, 0, 0,
-		0, 399, 397, 1, 0, 0, 0, 400, 402, 1, 0, 0, 0, 401, 399, 1, 0, 0, 0, 402,
-		403, 5, 39, 0, 0, 403, 404, 5, 39, 0, 0, 404, 405, 5, 39, 0, 0, 405, 407,
-		1, 0, 0, 0, 406, 310, 1, 0, 0, 0, 406, 319, 1, 0, 0, 0, 406, 328, 1, 0,
-		0, 0, 406, 342, 1, 0, 0, 0, 406, 356, 1, 0, 0, 0, 406, 366, 1, 0, 0, 0,
-		406, 376, 1, 0, 0, 0, 406, 391, 1, 0, 0, 0, 407, 90, 1, 0, 0, 0, 408, 409,
-		7, 15, 0, 0, 409, 410, 3, 89, 44, 0, 410, 92, 1, 0, 0, 0, 411, 414, 3,
-		59, 29, 0, 412, 414, 5, 95, 0, 0, 413, 411, 1, 0, 0, 0, 413, 412, 1, 0,
-		0, 0, 414, 420, 1, 0, 0, 0, 415, 419, 3, 59, 29, 0, 416, 419, 3, 61, 30,
-		0, 417, 419, 5, 95, 0, 0, 418, 415, 1, 0, 0, 0, 418, 416, 1, 0, 0, 0, 418,
-		417, 1, 0, 0, 0, 419, 422, 1, 0, 0, 0, 420, 418, 1, 0, 0, 0, 420, 421,
-		1, 0, 0, 0, 421, 94, 1, 0, 0, 0, 422, 420, 1, 0, 0, 0, 36, 0, 176, 181,
-		191, 224, 229, 239, 247, 253, 256, 261, 269, 272, 274, 279, 287, 289, 294,
-		304, 308, 313, 315, 322, 324, 334, 336, 348, 350, 361, 371, 384, 399, 406,
-		413, 418, 420, 1, 0, 1, 0,
-	}
-	deserializer := antlr.NewATNDeserializer(nil)
-	staticData.atn = deserializer.Deserialize(staticData.serializedATN)
-	atn := staticData.atn
-	staticData.decisionToDFA = make([]*antlr.DFA, len(atn.DecisionToState))
-	decisionToDFA := staticData.decisionToDFA
-	for index, state := range atn.DecisionToState {
-		decisionToDFA[index] = antlr.NewDFA(state, index)
-	}
+  staticData := &CELLexerLexerStaticData
+  staticData.ChannelNames = []string{
+    "DEFAULT_TOKEN_CHANNEL", "HIDDEN",
+  }
+  staticData.ModeNames = []string{
+    "DEFAULT_MODE",
+  }
+  staticData.LiteralNames = []string{
+    "", "'=='", "'!='", "'in'", "'<'", "'<='", "'>='", "'>'", "'&&'", "'||'", 
+    "'['", "']'", "'{'", "'}'", "'('", "')'", "'.'", "','", "'-'", "'!'", 
+    "'?'", "':'", "'+'", "'*'", "'/'", "'%'", "'true'", "'false'", "'null'",
+  }
+  staticData.SymbolicNames = []string{
+    "", "EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS", 
+    "GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE", 
+    "RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK", 
+    "COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE", 
+    "NUL", "WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT", 
+    "STRING", "BYTES", "IDENTIFIER",
+  }
+  staticData.RuleNames = []string{
+    "EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS", 
+    "GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE", 
+    "RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK", 
+    "COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE", 
+    "NUL", "BACKSLASH", "LETTER", "DIGIT", "EXPONENT", "HEXDIGIT", "RAW", 
+    "ESC_SEQ", "ESC_CHAR_SEQ", "ESC_OCT_SEQ", "ESC_BYTE_SEQ", "ESC_UNI_SEQ", 
+    "WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT", "STRING", 
+    "BYTES", "IDENTIFIER",
+  }
+  staticData.PredictionContextCache = antlr.NewPredictionContextCache()
+  staticData.serializedATN = []int32{
+	4, 0, 36, 423, 6, -1, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 
+	4, 7, 4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 
+	10, 7, 10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 
+	7, 15, 2, 16, 7, 16, 2, 17, 7, 17, 2, 18, 7, 18, 2, 19, 7, 19, 2, 20, 7, 
+	20, 2, 21, 7, 21, 2, 22, 7, 22, 2, 23, 7, 23, 2, 24, 7, 24, 2, 25, 7, 25, 
+	2, 26, 7, 26, 2, 27, 7, 27, 2, 28, 7, 28, 2, 29, 7, 29, 2, 30, 7, 30, 2, 
+	31, 7, 31, 2, 32, 7, 32, 2, 33, 7, 33, 2, 34, 7, 34, 2, 35, 7, 35, 2, 36, 
+	7, 36, 2, 37, 7, 37, 2, 38, 7, 38, 2, 39, 7, 39, 2, 40, 7, 40, 2, 41, 7, 
+	41, 2, 42, 7, 42, 2, 43, 7, 43, 2, 44, 7, 44, 2, 45, 7, 45, 2, 46, 7, 46, 
+	1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 4, 
+	1, 4, 1, 4, 1, 5, 1, 5, 1, 5, 1, 6, 1, 6, 1, 7, 1, 7, 1, 7, 1, 8, 1, 8, 
+	1, 8, 1, 9, 1, 9, 1, 10, 1, 10, 1, 11, 1, 11, 1, 12, 1, 12, 1, 13, 1, 13, 
+	1, 14, 1, 14, 1, 15, 1, 15, 1, 16, 1, 16, 1, 17, 1, 17, 1, 18, 1, 18, 1, 
+	19, 1, 19, 1, 20, 1, 20, 1, 21, 1, 21, 1, 22, 1, 22, 1, 23, 1, 23, 1, 24, 
+	1, 24, 1, 25, 1, 25, 1, 25, 1, 25, 1, 25, 1, 26, 1, 26, 1, 26, 1, 26, 1, 
+	26, 1, 26, 1, 27, 1, 27, 1, 27, 1, 27, 1, 27, 1, 28, 1, 28, 1, 29, 1, 29, 
+	1, 30, 1, 30, 1, 31, 1, 31, 3, 31, 177, 8, 31, 1, 31, 4, 31, 180, 8, 31, 
+	11, 31, 12, 31, 181, 1, 32, 1, 32, 1, 33, 1, 33, 1, 34, 1, 34, 1, 34, 1, 
+	34, 3, 34, 192, 8, 34, 1, 35, 1, 35, 1, 35, 1, 36, 1, 36, 1, 36, 1, 36, 
+	1, 36, 1, 37, 1, 37, 1, 37, 1, 37, 1, 37, 1, 38, 1, 38, 1, 38, 1, 38, 1, 
+	38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 1, 38, 
+	1, 38, 1, 38, 1, 38, 3, 38, 225, 8, 38, 1, 39, 4, 39, 228, 8, 39, 11, 39, 
+	12, 39, 229, 1, 39, 1, 39, 1, 40, 1, 40, 1, 40, 1, 40, 5, 40, 238, 8, 40, 
+	10, 40, 12, 40, 241, 9, 40, 1, 40, 1, 40, 1, 41, 4, 41, 246, 8, 41, 11, 
+	41, 12, 41, 247, 1, 41, 1, 41, 4, 41, 252, 8, 41, 11, 41, 12, 41, 253, 
+	1, 41, 3, 41, 257, 8, 41, 1, 41, 4, 41, 260, 8, 41, 11, 41, 12, 41, 261, 
+	1, 41, 1, 41, 1, 41, 1, 41, 4, 41, 268, 8, 41, 11, 41, 12, 41, 269, 1, 
+	41, 3, 41, 273, 8, 41, 3, 41, 275, 8, 41, 1, 42, 4, 42, 278, 8, 42, 11, 
+	42, 12, 42, 279, 1, 42, 1, 42, 1, 42, 1, 42, 4, 42, 286, 8, 42, 11, 42, 
+	12, 42, 287, 3, 42, 290, 8, 42, 1, 43, 4, 43, 293, 8, 43, 11, 43, 12, 43, 
+	294, 1, 43, 1, 43, 1, 43, 1, 43, 1, 43, 1, 43, 4, 43, 303, 8, 43, 11, 43, 
+	12, 43, 304, 1, 43, 1, 43, 3, 43, 309, 8, 43, 1, 44, 1, 44, 1, 44, 5, 44, 
+	314, 8, 44, 10, 44, 12, 44, 317, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5, 
+	44, 323, 8, 44, 10, 44, 12, 44, 326, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 
+	1, 44, 1, 44, 1, 44, 5, 44, 335, 8, 44, 10, 44, 12, 44, 338, 9, 44, 1, 
+	44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5, 44, 349, 
+	8, 44, 10, 44, 12, 44, 352, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 
+	44, 5, 44, 360, 8, 44, 10, 44, 12, 44, 363, 9, 44, 1, 44, 1, 44, 1, 44, 
+	1, 44, 1, 44, 5, 44, 370, 8, 44, 10, 44, 12, 44, 373, 9, 44, 1, 44, 1, 
+	44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 5, 44, 383, 8, 44, 10, 44, 
+	12, 44, 386, 9, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 44, 1, 
+	44, 1, 44, 1, 44, 5, 44, 398, 8, 44, 10, 44, 12, 44, 401, 9, 44, 1, 44, 
+	1, 44, 1, 44, 1, 44, 3, 44, 407, 8, 44, 1, 45, 1, 45, 1, 45, 1, 46, 1, 
+	46, 3, 46, 414, 8, 46, 1, 46, 1, 46, 1, 46, 5, 46, 419, 8, 46, 10, 46, 
+	12, 46, 422, 9, 46, 4, 336, 350, 384, 399, 0, 47, 1, 1, 3, 2, 5, 3, 7, 
+	4, 9, 5, 11, 6, 13, 7, 15, 8, 17, 9, 19, 10, 21, 11, 23, 12, 25, 13, 27, 
+	14, 29, 15, 31, 16, 33, 17, 35, 18, 37, 19, 39, 20, 41, 21, 43, 22, 45, 
+	23, 47, 24, 49, 25, 51, 26, 53, 27, 55, 28, 57, 0, 59, 0, 61, 0, 63, 0, 
+	65, 0, 67, 0, 69, 0, 71, 0, 73, 0, 75, 0, 77, 0, 79, 29, 81, 30, 83, 31, 
+	85, 32, 87, 33, 89, 34, 91, 35, 93, 36, 1, 0, 16, 2, 0, 65, 90, 97, 122, 
+	2, 0, 69, 69, 101, 101, 2, 0, 43, 43, 45, 45, 3, 0, 48, 57, 65, 70, 97, 
+	102, 2, 0, 82, 82, 114, 114, 10, 0, 34, 34, 39, 39, 63, 63, 92, 92, 96, 
+	98, 102, 102, 110, 110, 114, 114, 116, 116, 118, 118, 2, 0, 88, 88, 120, 
+	120, 3, 0, 9, 10, 12, 13, 32, 32, 1, 0, 10, 10, 2, 0, 85, 85, 117, 117, 
+	4, 0, 10, 10, 13, 13, 34, 34, 92, 92, 4, 0, 10, 10, 13, 13, 39, 39, 92, 
+	92, 1, 0, 92, 92, 3, 0, 10, 10, 13, 13, 34, 34, 3, 0, 10, 10, 13, 13, 39, 
+	39, 2, 0, 66, 66, 98, 98, 456, 0, 1, 1, 0, 0, 0, 0, 3, 1, 0, 0, 0, 0, 5, 
+	1, 0, 0, 0, 0, 7, 1, 0, 0, 0, 0, 9, 1, 0, 0, 0, 0, 11, 1, 0, 0, 0, 0, 13, 
+	1, 0, 0, 0, 0, 15, 1, 0, 0, 0, 0, 17, 1, 0, 0, 0, 0, 19, 1, 0, 0, 0, 0, 
+	21, 1, 0, 0, 0, 0, 23, 1, 0, 0, 0, 0, 25, 1, 0, 0, 0, 0, 27, 1, 0, 0, 0, 
+	0, 29, 1, 0, 0, 0, 0, 31, 1, 0, 0, 0, 0, 33, 1, 0, 0, 0, 0, 35, 1, 0, 0, 
+	0, 0, 37, 1, 0, 0, 0, 0, 39, 1, 0, 0, 0, 0, 41, 1, 0, 0, 0, 0, 43, 1, 0, 
+	0, 0, 0, 45, 1, 0, 0, 0, 0, 47, 1, 0, 0, 0, 0, 49, 1, 0, 0, 0, 0, 51, 1, 
+	0, 0, 0, 0, 53, 1, 0, 0, 0, 0, 55, 1, 0, 0, 0, 0, 79, 1, 0, 0, 0, 0, 81, 
+	1, 0, 0, 0, 0, 83, 1, 0, 0, 0, 0, 85, 1, 0, 0, 0, 0, 87, 1, 0, 0, 0, 0, 
+	89, 1, 0, 0, 0, 0, 91, 1, 0, 0, 0, 0, 93, 1, 0, 0, 0, 1, 95, 1, 0, 0, 0, 
+	3, 98, 1, 0, 0, 0, 5, 101, 1, 0, 0, 0, 7, 104, 1, 0, 0, 0, 9, 106, 1, 0, 
+	0, 0, 11, 109, 1, 0, 0, 0, 13, 112, 1, 0, 0, 0, 15, 114, 1, 0, 0, 0, 17, 
+	117, 1, 0, 0, 0, 19, 120, 1, 0, 0, 0, 21, 122, 1, 0, 0, 0, 23, 124, 1, 
+	0, 0, 0, 25, 126, 1, 0, 0, 0, 27, 128, 1, 0, 0, 0, 29, 130, 1, 0, 0, 0, 
+	31, 132, 1, 0, 0, 0, 33, 134, 1, 0, 0, 0, 35, 136, 1, 0, 0, 0, 37, 138, 
+	1, 0, 0, 0, 39, 140, 1, 0, 0, 0, 41, 142, 1, 0, 0, 0, 43, 144, 1, 0, 0, 
+	0, 45, 146, 1, 0, 0, 0, 47, 148, 1, 0, 0, 0, 49, 150, 1, 0, 0, 0, 51, 152, 
+	1, 0, 0, 0, 53, 157, 1, 0, 0, 0, 55, 163, 1, 0, 0, 0, 57, 168, 1, 0, 0, 
+	0, 59, 170, 1, 0, 0, 0, 61, 172, 1, 0, 0, 0, 63, 174, 1, 0, 0, 0, 65, 183, 
+	1, 0, 0, 0, 67, 185, 1, 0, 0, 0, 69, 191, 1, 0, 0, 0, 71, 193, 1, 0, 0, 
+	0, 73, 196, 1, 0, 0, 0, 75, 201, 1, 0, 0, 0, 77, 224, 1, 0, 0, 0, 79, 227, 
+	1, 0, 0, 0, 81, 233, 1, 0, 0, 0, 83, 274, 1, 0, 0, 0, 85, 289, 1, 0, 0, 
+	0, 87, 308, 1, 0, 0, 0, 89, 406, 1, 0, 0, 0, 91, 408, 1, 0, 0, 0, 93, 413, 
+	1, 0, 0, 0, 95, 96, 5, 61, 0, 0, 96, 97, 5, 61, 0, 0, 97, 2, 1, 0, 0, 0, 
+	98, 99, 5, 33, 0, 0, 99, 100, 5, 61, 0, 0, 100, 4, 1, 0, 0, 0, 101, 102, 
+	5, 105, 0, 0, 102, 103, 5, 110, 0, 0, 103, 6, 1, 0, 0, 0, 104, 105, 5, 
+	60, 0, 0, 105, 8, 1, 0, 0, 0, 106, 107, 5, 60, 0, 0, 107, 108, 5, 61, 0, 
+	0, 108, 10, 1, 0, 0, 0, 109, 110, 5, 62, 0, 0, 110, 111, 5, 61, 0, 0, 111, 
+	12, 1, 0, 0, 0, 112, 113, 5, 62, 0, 0, 113, 14, 1, 0, 0, 0, 114, 115, 5, 
+	38, 0, 0, 115, 116, 5, 38, 0, 0, 116, 16, 1, 0, 0, 0, 117, 118, 5, 124, 
+	0, 0, 118, 119, 5, 124, 0, 0, 119, 18, 1, 0, 0, 0, 120, 121, 5, 91, 0, 
+	0, 121, 20, 1, 0, 0, 0, 122, 123, 5, 93, 0, 0, 123, 22, 1, 0, 0, 0, 124, 
+	125, 5, 123, 0, 0, 125, 24, 1, 0, 0, 0, 126, 127, 5, 125, 0, 0, 127, 26, 
+	1, 0, 0, 0, 128, 129, 5, 40, 0, 0, 129, 28, 1, 0, 0, 0, 130, 131, 5, 41, 
+	0, 0, 131, 30, 1, 0, 0, 0, 132, 133, 5, 46, 0, 0, 133, 32, 1, 0, 0, 0, 
+	134, 135, 5, 44, 0, 0, 135, 34, 1, 0, 0, 0, 136, 137, 5, 45, 0, 0, 137, 
+	36, 1, 0, 0, 0, 138, 139, 5, 33, 0, 0, 139, 38, 1, 0, 0, 0, 140, 141, 5, 
+	63, 0, 0, 141, 40, 1, 0, 0, 0, 142, 143, 5, 58, 0, 0, 143, 42, 1, 0, 0, 
+	0, 144, 145, 5, 43, 0, 0, 145, 44, 1, 0, 0, 0, 146, 147, 5, 42, 0, 0, 147, 
+	46, 1, 0, 0, 0, 148, 149, 5, 47, 0, 0, 149, 48, 1, 0, 0, 0, 150, 151, 5, 
+	37, 0, 0, 151, 50, 1, 0, 0, 0, 152, 153, 5, 116, 0, 0, 153, 154, 5, 114, 
+	0, 0, 154, 155, 5, 117, 0, 0, 155, 156, 5, 101, 0, 0, 156, 52, 1, 0, 0, 
+	0, 157, 158, 5, 102, 0, 0, 158, 159, 5, 97, 0, 0, 159, 160, 5, 108, 0, 
+	0, 160, 161, 5, 115, 0, 0, 161, 162, 5, 101, 0, 0, 162, 54, 1, 0, 0, 0, 
+	163, 164, 5, 110, 0, 0, 164, 165, 5, 117, 0, 0, 165, 166, 5, 108, 0, 0, 
+	166, 167, 5, 108, 0, 0, 167, 56, 1, 0, 0, 0, 168, 169, 5, 92, 0, 0, 169, 
+	58, 1, 0, 0, 0, 170, 171, 7, 0, 0, 0, 171, 60, 1, 0, 0, 0, 172, 173, 2, 
+	48, 57, 0, 173, 62, 1, 0, 0, 0, 174, 176, 7, 1, 0, 0, 175, 177, 7, 2, 0, 
+	0, 176, 175, 1, 0, 0, 0, 176, 177, 1, 0, 0, 0, 177, 179, 1, 0, 0, 0, 178, 
+	180, 3, 61, 30, 0, 179, 178, 1, 0, 0, 0, 180, 181, 1, 0, 0, 0, 181, 179, 
+	1, 0, 0, 0, 181, 182, 1, 0, 0, 0, 182, 64, 1, 0, 0, 0, 183, 184, 7, 3, 
+	0, 0, 184, 66, 1, 0, 0, 0, 185, 186, 7, 4, 0, 0, 186, 68, 1, 0, 0, 0, 187, 
+	192, 3, 71, 35, 0, 188, 192, 3, 75, 37, 0, 189, 192, 3, 77, 38, 0, 190, 
+	192, 3, 73, 36, 0, 191, 187, 1, 0, 0, 0, 191, 188, 1, 0, 0, 0, 191, 189, 
+	1, 0, 0, 0, 191, 190, 1, 0, 0, 0, 192, 70, 1, 0, 0, 0, 193, 194, 3, 57, 
+	28, 0, 194, 195, 7, 5, 0, 0, 195, 72, 1, 0, 0, 0, 196, 197, 3, 57, 28, 
+	0, 197, 198, 2, 48, 51, 0, 198, 199, 2, 48, 55, 0, 199, 200, 2, 48, 55, 
+	0, 200, 74, 1, 0, 0, 0, 201, 202, 3, 57, 28, 0, 202, 203, 7, 6, 0, 0, 203, 
+	204, 3, 65, 32, 0, 204, 205, 3, 65, 32, 0, 205, 76, 1, 0, 0, 0, 206, 207, 
+	3, 57, 28, 0, 207, 208, 5, 117, 0, 0, 208, 209, 3, 65, 32, 0, 209, 210, 
+	3, 65, 32, 0, 210, 211, 3, 65, 32, 0, 211, 212, 3, 65, 32, 0, 212, 225, 
+	1, 0, 0, 0, 213, 214, 3, 57, 28, 0, 214, 215, 5, 85, 0, 0, 215, 216, 3, 
+	65, 32, 0, 216, 217, 3, 65, 32, 0, 217, 218, 3, 65, 32, 0, 218, 219, 3, 
+	65, 32, 0, 219, 220, 3, 65, 32, 0, 220, 221, 3, 65, 32, 0, 221, 222, 3, 
+	65, 32, 0, 222, 223, 3, 65, 32, 0, 223, 225, 1, 0, 0, 0, 224, 206, 1, 0, 
+	0, 0, 224, 213, 1, 0, 0, 0, 225, 78, 1, 0, 0, 0, 226, 228, 7, 7, 0, 0, 
+	227, 226, 1, 0, 0, 0, 228, 229, 1, 0, 0, 0, 229, 227, 1, 0, 0, 0, 229, 
+	230, 1, 0, 0, 0, 230, 231, 1, 0, 0, 0, 231, 232, 6, 39, 0, 0, 232, 80, 
+	1, 0, 0, 0, 233, 234, 5, 47, 0, 0, 234, 235, 5, 47, 0, 0, 235, 239, 1, 
+	0, 0, 0, 236, 238, 8, 8, 0, 0, 237, 236, 1, 0, 0, 0, 238, 241, 1, 0, 0, 
+	0, 239, 237, 1, 0, 0, 0, 239, 240, 1, 0, 0, 0, 240, 242, 1, 0, 0, 0, 241, 
+	239, 1, 0, 0, 0, 242, 243, 6, 40, 0, 0, 243, 82, 1, 0, 0, 0, 244, 246, 
+	3, 61, 30, 0, 245, 244, 1, 0, 0, 0, 246, 247, 1, 0, 0, 0, 247, 245, 1, 
+	0, 0, 0, 247, 248, 1, 0, 0, 0, 248, 249, 1, 0, 0, 0, 249, 251, 5, 46, 0, 
+	0, 250, 252, 3, 61, 30, 0, 251, 250, 1, 0, 0, 0, 252, 253, 1, 0, 0, 0, 
+	253, 251, 1, 0, 0, 0, 253, 254, 1, 0, 0, 0, 254, 256, 1, 0, 0, 0, 255, 
+	257, 3, 63, 31, 0, 256, 255, 1, 0, 0, 0, 256, 257, 1, 0, 0, 0, 257, 275, 
+	1, 0, 0, 0, 258, 260, 3, 61, 30, 0, 259, 258, 1, 0, 0, 0, 260, 261, 1, 
+	0, 0, 0, 261, 259, 1, 0, 0, 0, 261, 262, 1, 0, 0, 0, 262, 263, 1, 0, 0, 
+	0, 263, 264, 3, 63, 31, 0, 264, 275, 1, 0, 0, 0, 265, 267, 5, 46, 0, 0, 
+	266, 268, 3, 61, 30, 0, 267, 266, 1, 0, 0, 0, 268, 269, 1, 0, 0, 0, 269, 
+	267, 1, 0, 0, 0, 269, 270, 1, 0, 0, 0, 270, 272, 1, 0, 0, 0, 271, 273, 
+	3, 63, 31, 0, 272, 271, 1, 0, 0, 0, 272, 273, 1, 0, 0, 0, 273, 275, 1, 
+	0, 0, 0, 274, 245, 1, 0, 0, 0, 274, 259, 1, 0, 0, 0, 274, 265, 1, 0, 0, 
+	0, 275, 84, 1, 0, 0, 0, 276, 278, 3, 61, 30, 0, 277, 276, 1, 0, 0, 0, 278, 
+	279, 1, 0, 0, 0, 279, 277, 1, 0, 0, 0, 279, 280, 1, 0, 0, 0, 280, 290, 
+	1, 0, 0, 0, 281, 282, 5, 48, 0, 0, 282, 283, 5, 120, 0, 0, 283, 285, 1, 
+	0, 0, 0, 284, 286, 3, 65, 32, 0, 285, 284, 1, 0, 0, 0, 286, 287, 1, 0, 
+	0, 0, 287, 285, 1, 0, 0, 0, 287, 288, 1, 0, 0, 0, 288, 290, 1, 0, 0, 0, 
+	289, 277, 1, 0, 0, 0, 289, 281, 1, 0, 0, 0, 290, 86, 1, 0, 0, 0, 291, 293, 
+	3, 61, 30, 0, 292, 291, 1, 0, 0, 0, 293, 294, 1, 0, 0, 0, 294, 292, 1, 
+	0, 0, 0, 294, 295, 1, 0, 0, 0, 295, 296, 1, 0, 0, 0, 296, 297, 7, 9, 0, 
+	0, 297, 309, 1, 0, 0, 0, 298, 299, 5, 48, 0, 0, 299, 300, 5, 120, 0, 0, 
+	300, 302, 1, 0, 0, 0, 301, 303, 3, 65, 32, 0, 302, 301, 1, 0, 0, 0, 303, 
+	304, 1, 0, 0, 0, 304, 302, 1, 0, 0, 0, 304, 305, 1, 0, 0, 0, 305, 306, 
+	1, 0, 0, 0, 306, 307, 7, 9, 0, 0, 307, 309, 1, 0, 0, 0, 308, 292, 1, 0, 
+	0, 0, 308, 298, 1, 0, 0, 0, 309, 88, 1, 0, 0, 0, 310, 315, 5, 34, 0, 0, 
+	311, 314, 3, 69, 34, 0, 312, 314, 8, 10, 0, 0, 313, 311, 1, 0, 0, 0, 313, 
+	312, 1, 0, 0, 0, 314, 317, 1, 0, 0, 0, 315, 313, 1, 0, 0, 0, 315, 316, 
+	1, 0, 0, 0, 316, 318, 1, 0, 0, 0, 317, 315, 1, 0, 0, 0, 318, 407, 5, 34, 
+	0, 0, 319, 324, 5, 39, 0, 0, 320, 323, 3, 69, 34, 0, 321, 323, 8, 11, 0, 
+	0, 322, 320, 1, 0, 0, 0, 322, 321, 1, 0, 0, 0, 323, 326, 1, 0, 0, 0, 324, 
+	322, 1, 0, 0, 0, 324, 325, 1, 0, 0, 0, 325, 327, 1, 0, 0, 0, 326, 324, 
+	1, 0, 0, 0, 327, 407, 5, 39, 0, 0, 328, 329, 5, 34, 0, 0, 329, 330, 5, 
+	34, 0, 0, 330, 331, 5, 34, 0, 0, 331, 336, 1, 0, 0, 0, 332, 335, 3, 69, 
+	34, 0, 333, 335, 8, 12, 0, 0, 334, 332, 1, 0, 0, 0, 334, 333, 1, 0, 0, 
+	0, 335, 338, 1, 0, 0, 0, 336, 337, 1, 0, 0, 0, 336, 334, 1, 0, 0, 0, 337, 
+	339, 1, 0, 0, 0, 338, 336, 1, 0, 0, 0, 339, 340, 5, 34, 0, 0, 340, 341, 
+	5, 34, 0, 0, 341, 407, 5, 34, 0, 0, 342, 343, 5, 39, 0, 0, 343, 344, 5, 
+	39, 0, 0, 344, 345, 5, 39, 0, 0, 345, 350, 1, 0, 0, 0, 346, 349, 3, 69, 
+	34, 0, 347, 349, 8, 12, 0, 0, 348, 346, 1, 0, 0, 0, 348, 347, 1, 0, 0, 
+	0, 349, 352, 1, 0, 0, 0, 350, 351, 1, 0, 0, 0, 350, 348, 1, 0, 0, 0, 351, 
+	353, 1, 0, 0, 0, 352, 350, 1, 0, 0, 0, 353, 354, 5, 39, 0, 0, 354, 355, 
+	5, 39, 0, 0, 355, 407, 5, 39, 0, 0, 356, 357, 3, 67, 33, 0, 357, 361, 5, 
+	34, 0, 0, 358, 360, 8, 13, 0, 0, 359, 358, 1, 0, 0, 0, 360, 363, 1, 0, 
+	0, 0, 361, 359, 1, 0, 0, 0, 361, 362, 1, 0, 0, 0, 362, 364, 1, 0, 0, 0, 
+	363, 361, 1, 0, 0, 0, 364, 365, 5, 34, 0, 0, 365, 407, 1, 0, 0, 0, 366, 
+	367, 3, 67, 33, 0, 367, 371, 5, 39, 0, 0, 368, 370, 8, 14, 0, 0, 369, 368, 
+	1, 0, 0, 0, 370, 373, 1, 0, 0, 0, 371, 369, 1, 0, 0, 0, 371, 372, 1, 0, 
+	0, 0, 372, 374, 1, 0, 0, 0, 373, 371, 1, 0, 0, 0, 374, 375, 5, 39, 0, 0, 
+	375, 407, 1, 0, 0, 0, 376, 377, 3, 67, 33, 0, 377, 378, 5, 34, 0, 0, 378, 
+	379, 5, 34, 0, 0, 379, 380, 5, 34, 0, 0, 380, 384, 1, 0, 0, 0, 381, 383, 
+	9, 0, 0, 0, 382, 381, 1, 0, 0, 0, 383, 386, 1, 0, 0, 0, 384, 385, 1, 0, 
+	0, 0, 384, 382, 1, 0, 0, 0, 385, 387, 1, 0, 0, 0, 386, 384, 1, 0, 0, 0, 
+	387, 388, 5, 34, 0, 0, 388, 389, 5, 34, 0, 0, 389, 390, 5, 34, 0, 0, 390, 
+	407, 1, 0, 0, 0, 391, 392, 3, 67, 33, 0, 392, 393, 5, 39, 0, 0, 393, 394, 
+	5, 39, 0, 0, 394, 395, 5, 39, 0, 0, 395, 399, 1, 0, 0, 0, 396, 398, 9, 
+	0, 0, 0, 397, 396, 1, 0, 0, 0, 398, 401, 1, 0, 0, 0, 399, 400, 1, 0, 0, 
+	0, 399, 397, 1, 0, 0, 0, 400, 402, 1, 0, 0, 0, 401, 399, 1, 0, 0, 0, 402, 
+	403, 5, 39, 0, 0, 403, 404, 5, 39, 0, 0, 404, 405, 5, 39, 0, 0, 405, 407, 
+	1, 0, 0, 0, 406, 310, 1, 0, 0, 0, 406, 319, 1, 0, 0, 0, 406, 328, 1, 0, 
+	0, 0, 406, 342, 1, 0, 0, 0, 406, 356, 1, 0, 0, 0, 406, 366, 1, 0, 0, 0, 
+	406, 376, 1, 0, 0, 0, 406, 391, 1, 0, 0, 0, 407, 90, 1, 0, 0, 0, 408, 409, 
+	7, 15, 0, 0, 409, 410, 3, 89, 44, 0, 410, 92, 1, 0, 0, 0, 411, 414, 3, 
+	59, 29, 0, 412, 414, 5, 95, 0, 0, 413, 411, 1, 0, 0, 0, 413, 412, 1, 0, 
+	0, 0, 414, 420, 1, 0, 0, 0, 415, 419, 3, 59, 29, 0, 416, 419, 3, 61, 30, 
+	0, 417, 419, 5, 95, 0, 0, 418, 415, 1, 0, 0, 0, 418, 416, 1, 0, 0, 0, 418, 
+	417, 1, 0, 0, 0, 419, 422, 1, 0, 0, 0, 420, 418, 1, 0, 0, 0, 420, 421, 
+	1, 0, 0, 0, 421, 94, 1, 0, 0, 0, 422, 420, 1, 0, 0, 0, 36, 0, 176, 181, 
+	191, 224, 229, 239, 247, 253, 256, 261, 269, 272, 274, 279, 287, 289, 294, 
+	304, 308, 313, 315, 322, 324, 334, 336, 348, 350, 361, 371, 384, 399, 406, 
+	413, 418, 420, 1, 0, 1, 0,
+}
+  deserializer := antlr.NewATNDeserializer(nil)
+  staticData.atn = deserializer.Deserialize(staticData.serializedATN)
+  atn := staticData.atn
+  staticData.decisionToDFA = make([]*antlr.DFA, len(atn.DecisionToState))
+  decisionToDFA := staticData.decisionToDFA
+  for index, state := range atn.DecisionToState {
+    decisionToDFA[index] = antlr.NewDFA(state, index)
+  }
 }
 
 // CELLexerInit initializes any static state used to implement CELLexer. By default the
@@ -282,22 +280,22 @@ func cellexerLexerInit() {
 // NewCELLexer(). You can call this function if you wish to initialize the static state ahead
 // of time.
 func CELLexerInit() {
-	staticData := &cellexerLexerStaticData
-	staticData.once.Do(cellexerLexerInit)
+  staticData := &CELLexerLexerStaticData
+  staticData.once.Do(cellexerLexerInit)
 }
 
 // NewCELLexer produces a new lexer instance for the optional input antlr.CharStream.
 func NewCELLexer(input antlr.CharStream) *CELLexer {
-	CELLexerInit()
+  CELLexerInit()
 	l := new(CELLexer)
 	l.BaseLexer = antlr.NewBaseLexer(input)
-	staticData := &cellexerLexerStaticData
-	l.Interpreter = antlr.NewLexerATNSimulator(l, staticData.atn, staticData.decisionToDFA, staticData.predictionContextCache)
-	l.channelNames = staticData.channelNames
-	l.modeNames = staticData.modeNames
-	l.RuleNames = staticData.ruleNames
-	l.LiteralNames = staticData.literalNames
-	l.SymbolicNames = staticData.symbolicNames
+  staticData := &CELLexerLexerStaticData
+	l.Interpreter = antlr.NewLexerATNSimulator(l, staticData.atn, staticData.decisionToDFA, staticData.PredictionContextCache)
+	l.channelNames = staticData.ChannelNames
+	l.modeNames = staticData.ModeNames
+	l.RuleNames = staticData.RuleNames
+	l.LiteralNames = staticData.LiteralNames
+	l.SymbolicNames = staticData.SymbolicNames
 	l.GrammarFileName = "CEL.g4"
 	// TODO: l.EOF = antlr.TokenEOF
 
@@ -306,40 +304,41 @@ func NewCELLexer(input antlr.CharStream) *CELLexer {
 
 // CELLexer tokens.
 const (
-	CELLexerEQUALS         = 1
-	CELLexerNOT_EQUALS     = 2
-	CELLexerIN             = 3
-	CELLexerLESS           = 4
-	CELLexerLESS_EQUALS    = 5
+	CELLexerEQUALS = 1
+	CELLexerNOT_EQUALS = 2
+	CELLexerIN = 3
+	CELLexerLESS = 4
+	CELLexerLESS_EQUALS = 5
 	CELLexerGREATER_EQUALS = 6
-	CELLexerGREATER        = 7
-	CELLexerLOGICAL_AND    = 8
-	CELLexerLOGICAL_OR     = 9
-	CELLexerLBRACKET       = 10
-	CELLexerRPRACKET       = 11
-	CELLexerLBRACE         = 12
-	CELLexerRBRACE         = 13
-	CELLexerLPAREN         = 14
-	CELLexerRPAREN         = 15
-	CELLexerDOT            = 16
-	CELLexerCOMMA          = 17
-	CELLexerMINUS          = 18
-	CELLexerEXCLAM         = 19
-	CELLexerQUESTIONMARK   = 20
-	CELLexerCOLON          = 21
-	CELLexerPLUS           = 22
-	CELLexerSTAR           = 23
-	CELLexerSLASH          = 24
-	CELLexerPERCENT        = 25
-	CELLexerCEL_TRUE       = 26
-	CELLexerCEL_FALSE      = 27
-	CELLexerNUL            = 28
-	CELLexerWHITESPACE     = 29
-	CELLexerCOMMENT        = 30
-	CELLexerNUM_FLOAT      = 31
-	CELLexerNUM_INT        = 32
-	CELLexerNUM_UINT       = 33
-	CELLexerSTRING         = 34
-	CELLexerBYTES          = 35
-	CELLexerIDENTIFIER     = 36
+	CELLexerGREATER = 7
+	CELLexerLOGICAL_AND = 8
+	CELLexerLOGICAL_OR = 9
+	CELLexerLBRACKET = 10
+	CELLexerRPRACKET = 11
+	CELLexerLBRACE = 12
+	CELLexerRBRACE = 13
+	CELLexerLPAREN = 14
+	CELLexerRPAREN = 15
+	CELLexerDOT = 16
+	CELLexerCOMMA = 17
+	CELLexerMINUS = 18
+	CELLexerEXCLAM = 19
+	CELLexerQUESTIONMARK = 20
+	CELLexerCOLON = 21
+	CELLexerPLUS = 22
+	CELLexerSTAR = 23
+	CELLexerSLASH = 24
+	CELLexerPERCENT = 25
+	CELLexerCEL_TRUE = 26
+	CELLexerCEL_FALSE = 27
+	CELLexerNUL = 28
+	CELLexerWHITESPACE = 29
+	CELLexerCOMMENT = 30
+	CELLexerNUM_FLOAT = 31
+	CELLexerNUM_INT = 32
+	CELLexerNUM_UINT = 33
+	CELLexerSTRING = 34
+	CELLexerBYTES = 35
+	CELLexerIDENTIFIER = 36
 )
+
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_listener.go b/vendor/github.com/google/cel-go/parser/gen/cel_listener.go
index 73b7f1d..22dc997 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_listener.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_listener.go
@@ -1,7 +1,8 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen // CEL
-import "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+import "github.com/antlr4-go/antlr/v4"
+
 
 // CELListener is a complete listener for a parse tree produced by CELParser.
 type CELListener interface {
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_parser.go b/vendor/github.com/google/cel-go/parser/gen/cel_parser.go
index 0cb6c8e..35334af 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_parser.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_parser.go
@@ -1,12 +1,12 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen // CEL
 import (
 	"fmt"
 	"strconv"
-	"sync"
+  	"sync"
 
-	"github.com/antlr/antlr4/runtime/Go/antlr/v4"
+	"github.com/antlr4-go/antlr/v4"
 )
 
 // Suppress unused import errors
@@ -14,166 +14,167 @@ var _ = fmt.Printf
 var _ = strconv.Itoa
 var _ = sync.Once{}
 
+
 type CELParser struct {
 	*antlr.BaseParser
 }
 
-var celParserStaticData struct {
-	once                   sync.Once
-	serializedATN          []int32
-	literalNames           []string
-	symbolicNames          []string
-	ruleNames              []string
-	predictionContextCache *antlr.PredictionContextCache
-	atn                    *antlr.ATN
-	decisionToDFA          []*antlr.DFA
+var CELParserStaticData struct {
+  once                   sync.Once
+  serializedATN          []int32
+  LiteralNames           []string
+  SymbolicNames          []string
+  RuleNames              []string
+  PredictionContextCache *antlr.PredictionContextCache
+  atn                    *antlr.ATN
+  decisionToDFA          []*antlr.DFA
 }
 
 func celParserInit() {
-	staticData := &celParserStaticData
-	staticData.literalNames = []string{
-		"", "'=='", "'!='", "'in'", "'<'", "'<='", "'>='", "'>'", "'&&'", "'||'",
-		"'['", "']'", "'{'", "'}'", "'('", "')'", "'.'", "','", "'-'", "'!'",
-		"'?'", "':'", "'+'", "'*'", "'/'", "'%'", "'true'", "'false'", "'null'",
-	}
-	staticData.symbolicNames = []string{
-		"", "EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS",
-		"GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE",
-		"RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK",
-		"COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE",
-		"NUL", "WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT",
-		"STRING", "BYTES", "IDENTIFIER",
-	}
-	staticData.ruleNames = []string{
-		"start", "expr", "conditionalOr", "conditionalAnd", "relation", "calc",
-		"unary", "member", "primary", "exprList", "listInit", "fieldInitializerList",
-		"optField", "mapInitializerList", "optExpr", "literal",
-	}
-	staticData.predictionContextCache = antlr.NewPredictionContextCache()
-	staticData.serializedATN = []int32{
-		4, 1, 36, 251, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7,
-		4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7,
-		10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15,
-		1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 1, 42, 8, 1, 1,
-		2, 1, 2, 1, 2, 5, 2, 47, 8, 2, 10, 2, 12, 2, 50, 9, 2, 1, 3, 1, 3, 1, 3,
-		5, 3, 55, 8, 3, 10, 3, 12, 3, 58, 9, 3, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1,
-		4, 5, 4, 66, 8, 4, 10, 4, 12, 4, 69, 9, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5,
-		1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 80, 8, 5, 10, 5, 12, 5, 83, 9, 5, 1, 6, 1,
-		6, 4, 6, 87, 8, 6, 11, 6, 12, 6, 88, 1, 6, 1, 6, 4, 6, 93, 8, 6, 11, 6,
-		12, 6, 94, 1, 6, 3, 6, 98, 8, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3,
-		7, 106, 8, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3, 7, 114, 8, 7, 1, 7,
-		1, 7, 1, 7, 1, 7, 3, 7, 120, 8, 7, 1, 7, 1, 7, 1, 7, 5, 7, 125, 8, 7, 10,
-		7, 12, 7, 128, 9, 7, 1, 8, 3, 8, 131, 8, 8, 1, 8, 1, 8, 1, 8, 3, 8, 136,
-		8, 8, 1, 8, 3, 8, 139, 8, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 3, 8,
-		147, 8, 8, 1, 8, 3, 8, 150, 8, 8, 1, 8, 1, 8, 1, 8, 3, 8, 155, 8, 8, 1,
-		8, 3, 8, 158, 8, 8, 1, 8, 1, 8, 3, 8, 162, 8, 8, 1, 8, 1, 8, 1, 8, 5, 8,
-		167, 8, 8, 10, 8, 12, 8, 170, 9, 8, 1, 8, 1, 8, 3, 8, 174, 8, 8, 1, 8,
-		3, 8, 177, 8, 8, 1, 8, 1, 8, 3, 8, 181, 8, 8, 1, 9, 1, 9, 1, 9, 5, 9, 186,
-		8, 9, 10, 9, 12, 9, 189, 9, 9, 1, 10, 1, 10, 1, 10, 5, 10, 194, 8, 10,
-		10, 10, 12, 10, 197, 9, 10, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1,
-		11, 1, 11, 5, 11, 207, 8, 11, 10, 11, 12, 11, 210, 9, 11, 1, 12, 3, 12,
-		213, 8, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1,
-		13, 1, 13, 5, 13, 225, 8, 13, 10, 13, 12, 13, 228, 9, 13, 1, 14, 3, 14,
-		231, 8, 14, 1, 14, 1, 14, 1, 15, 3, 15, 236, 8, 15, 1, 15, 1, 15, 1, 15,
-		3, 15, 241, 8, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 3, 15, 249,
-		8, 15, 1, 15, 0, 3, 8, 10, 14, 16, 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20,
-		22, 24, 26, 28, 30, 0, 3, 1, 0, 1, 7, 1, 0, 23, 25, 2, 0, 18, 18, 22, 22,
-		281, 0, 32, 1, 0, 0, 0, 2, 35, 1, 0, 0, 0, 4, 43, 1, 0, 0, 0, 6, 51, 1,
-		0, 0, 0, 8, 59, 1, 0, 0, 0, 10, 70, 1, 0, 0, 0, 12, 97, 1, 0, 0, 0, 14,
-		99, 1, 0, 0, 0, 16, 180, 1, 0, 0, 0, 18, 182, 1, 0, 0, 0, 20, 190, 1, 0,
-		0, 0, 22, 198, 1, 0, 0, 0, 24, 212, 1, 0, 0, 0, 26, 216, 1, 0, 0, 0, 28,
-		230, 1, 0, 0, 0, 30, 248, 1, 0, 0, 0, 32, 33, 3, 2, 1, 0, 33, 34, 5, 0,
-		0, 1, 34, 1, 1, 0, 0, 0, 35, 41, 3, 4, 2, 0, 36, 37, 5, 20, 0, 0, 37, 38,
-		3, 4, 2, 0, 38, 39, 5, 21, 0, 0, 39, 40, 3, 2, 1, 0, 40, 42, 1, 0, 0, 0,
-		41, 36, 1, 0, 0, 0, 41, 42, 1, 0, 0, 0, 42, 3, 1, 0, 0, 0, 43, 48, 3, 6,
-		3, 0, 44, 45, 5, 9, 0, 0, 45, 47, 3, 6, 3, 0, 46, 44, 1, 0, 0, 0, 47, 50,
-		1, 0, 0, 0, 48, 46, 1, 0, 0, 0, 48, 49, 1, 0, 0, 0, 49, 5, 1, 0, 0, 0,
-		50, 48, 1, 0, 0, 0, 51, 56, 3, 8, 4, 0, 52, 53, 5, 8, 0, 0, 53, 55, 3,
-		8, 4, 0, 54, 52, 1, 0, 0, 0, 55, 58, 1, 0, 0, 0, 56, 54, 1, 0, 0, 0, 56,
-		57, 1, 0, 0, 0, 57, 7, 1, 0, 0, 0, 58, 56, 1, 0, 0, 0, 59, 60, 6, 4, -1,
-		0, 60, 61, 3, 10, 5, 0, 61, 67, 1, 0, 0, 0, 62, 63, 10, 1, 0, 0, 63, 64,
-		7, 0, 0, 0, 64, 66, 3, 8, 4, 2, 65, 62, 1, 0, 0, 0, 66, 69, 1, 0, 0, 0,
-		67, 65, 1, 0, 0, 0, 67, 68, 1, 0, 0, 0, 68, 9, 1, 0, 0, 0, 69, 67, 1, 0,
-		0, 0, 70, 71, 6, 5, -1, 0, 71, 72, 3, 12, 6, 0, 72, 81, 1, 0, 0, 0, 73,
-		74, 10, 2, 0, 0, 74, 75, 7, 1, 0, 0, 75, 80, 3, 10, 5, 3, 76, 77, 10, 1,
-		0, 0, 77, 78, 7, 2, 0, 0, 78, 80, 3, 10, 5, 2, 79, 73, 1, 0, 0, 0, 79,
-		76, 1, 0, 0, 0, 80, 83, 1, 0, 0, 0, 81, 79, 1, 0, 0, 0, 81, 82, 1, 0, 0,
-		0, 82, 11, 1, 0, 0, 0, 83, 81, 1, 0, 0, 0, 84, 98, 3, 14, 7, 0, 85, 87,
-		5, 19, 0, 0, 86, 85, 1, 0, 0, 0, 87, 88, 1, 0, 0, 0, 88, 86, 1, 0, 0, 0,
-		88, 89, 1, 0, 0, 0, 89, 90, 1, 0, 0, 0, 90, 98, 3, 14, 7, 0, 91, 93, 5,
-		18, 0, 0, 92, 91, 1, 0, 0, 0, 93, 94, 1, 0, 0, 0, 94, 92, 1, 0, 0, 0, 94,
-		95, 1, 0, 0, 0, 95, 96, 1, 0, 0, 0, 96, 98, 3, 14, 7, 0, 97, 84, 1, 0,
-		0, 0, 97, 86, 1, 0, 0, 0, 97, 92, 1, 0, 0, 0, 98, 13, 1, 0, 0, 0, 99, 100,
-		6, 7, -1, 0, 100, 101, 3, 16, 8, 0, 101, 126, 1, 0, 0, 0, 102, 103, 10,
-		3, 0, 0, 103, 105, 5, 16, 0, 0, 104, 106, 5, 20, 0, 0, 105, 104, 1, 0,
-		0, 0, 105, 106, 1, 0, 0, 0, 106, 107, 1, 0, 0, 0, 107, 125, 5, 36, 0, 0,
-		108, 109, 10, 2, 0, 0, 109, 110, 5, 16, 0, 0, 110, 111, 5, 36, 0, 0, 111,
-		113, 5, 14, 0, 0, 112, 114, 3, 18, 9, 0, 113, 112, 1, 0, 0, 0, 113, 114,
-		1, 0, 0, 0, 114, 115, 1, 0, 0, 0, 115, 125, 5, 15, 0, 0, 116, 117, 10,
-		1, 0, 0, 117, 119, 5, 10, 0, 0, 118, 120, 5, 20, 0, 0, 119, 118, 1, 0,
-		0, 0, 119, 120, 1, 0, 0, 0, 120, 121, 1, 0, 0, 0, 121, 122, 3, 2, 1, 0,
-		122, 123, 5, 11, 0, 0, 123, 125, 1, 0, 0, 0, 124, 102, 1, 0, 0, 0, 124,
-		108, 1, 0, 0, 0, 124, 116, 1, 0, 0, 0, 125, 128, 1, 0, 0, 0, 126, 124,
-		1, 0, 0, 0, 126, 127, 1, 0, 0, 0, 127, 15, 1, 0, 0, 0, 128, 126, 1, 0,
-		0, 0, 129, 131, 5, 16, 0, 0, 130, 129, 1, 0, 0, 0, 130, 131, 1, 0, 0, 0,
-		131, 132, 1, 0, 0, 0, 132, 138, 5, 36, 0, 0, 133, 135, 5, 14, 0, 0, 134,
-		136, 3, 18, 9, 0, 135, 134, 1, 0, 0, 0, 135, 136, 1, 0, 0, 0, 136, 137,
-		1, 0, 0, 0, 137, 139, 5, 15, 0, 0, 138, 133, 1, 0, 0, 0, 138, 139, 1, 0,
-		0, 0, 139, 181, 1, 0, 0, 0, 140, 141, 5, 14, 0, 0, 141, 142, 3, 2, 1, 0,
-		142, 143, 5, 15, 0, 0, 143, 181, 1, 0, 0, 0, 144, 146, 5, 10, 0, 0, 145,
-		147, 3, 20, 10, 0, 146, 145, 1, 0, 0, 0, 146, 147, 1, 0, 0, 0, 147, 149,
-		1, 0, 0, 0, 148, 150, 5, 17, 0, 0, 149, 148, 1, 0, 0, 0, 149, 150, 1, 0,
-		0, 0, 150, 151, 1, 0, 0, 0, 151, 181, 5, 11, 0, 0, 152, 154, 5, 12, 0,
-		0, 153, 155, 3, 26, 13, 0, 154, 153, 1, 0, 0, 0, 154, 155, 1, 0, 0, 0,
-		155, 157, 1, 0, 0, 0, 156, 158, 5, 17, 0, 0, 157, 156, 1, 0, 0, 0, 157,
-		158, 1, 0, 0, 0, 158, 159, 1, 0, 0, 0, 159, 181, 5, 13, 0, 0, 160, 162,
-		5, 16, 0, 0, 161, 160, 1, 0, 0, 0, 161, 162, 1, 0, 0, 0, 162, 163, 1, 0,
-		0, 0, 163, 168, 5, 36, 0, 0, 164, 165, 5, 16, 0, 0, 165, 167, 5, 36, 0,
-		0, 166, 164, 1, 0, 0, 0, 167, 170, 1, 0, 0, 0, 168, 166, 1, 0, 0, 0, 168,
-		169, 1, 0, 0, 0, 169, 171, 1, 0, 0, 0, 170, 168, 1, 0, 0, 0, 171, 173,
-		5, 12, 0, 0, 172, 174, 3, 22, 11, 0, 173, 172, 1, 0, 0, 0, 173, 174, 1,
-		0, 0, 0, 174, 176, 1, 0, 0, 0, 175, 177, 5, 17, 0, 0, 176, 175, 1, 0, 0,
-		0, 176, 177, 1, 0, 0, 0, 177, 178, 1, 0, 0, 0, 178, 181, 5, 13, 0, 0, 179,
-		181, 3, 30, 15, 0, 180, 130, 1, 0, 0, 0, 180, 140, 1, 0, 0, 0, 180, 144,
-		1, 0, 0, 0, 180, 152, 1, 0, 0, 0, 180, 161, 1, 0, 0, 0, 180, 179, 1, 0,
-		0, 0, 181, 17, 1, 0, 0, 0, 182, 187, 3, 2, 1, 0, 183, 184, 5, 17, 0, 0,
-		184, 186, 3, 2, 1, 0, 185, 183, 1, 0, 0, 0, 186, 189, 1, 0, 0, 0, 187,
-		185, 1, 0, 0, 0, 187, 188, 1, 0, 0, 0, 188, 19, 1, 0, 0, 0, 189, 187, 1,
-		0, 0, 0, 190, 195, 3, 28, 14, 0, 191, 192, 5, 17, 0, 0, 192, 194, 3, 28,
-		14, 0, 193, 191, 1, 0, 0, 0, 194, 197, 1, 0, 0, 0, 195, 193, 1, 0, 0, 0,
-		195, 196, 1, 0, 0, 0, 196, 21, 1, 0, 0, 0, 197, 195, 1, 0, 0, 0, 198, 199,
-		3, 24, 12, 0, 199, 200, 5, 21, 0, 0, 200, 208, 3, 2, 1, 0, 201, 202, 5,
-		17, 0, 0, 202, 203, 3, 24, 12, 0, 203, 204, 5, 21, 0, 0, 204, 205, 3, 2,
-		1, 0, 205, 207, 1, 0, 0, 0, 206, 201, 1, 0, 0, 0, 207, 210, 1, 0, 0, 0,
-		208, 206, 1, 0, 0, 0, 208, 209, 1, 0, 0, 0, 209, 23, 1, 0, 0, 0, 210, 208,
-		1, 0, 0, 0, 211, 213, 5, 20, 0, 0, 212, 211, 1, 0, 0, 0, 212, 213, 1, 0,
-		0, 0, 213, 214, 1, 0, 0, 0, 214, 215, 5, 36, 0, 0, 215, 25, 1, 0, 0, 0,
-		216, 217, 3, 28, 14, 0, 217, 218, 5, 21, 0, 0, 218, 226, 3, 2, 1, 0, 219,
-		220, 5, 17, 0, 0, 220, 221, 3, 28, 14, 0, 221, 222, 5, 21, 0, 0, 222, 223,
-		3, 2, 1, 0, 223, 225, 1, 0, 0, 0, 224, 219, 1, 0, 0, 0, 225, 228, 1, 0,
-		0, 0, 226, 224, 1, 0, 0, 0, 226, 227, 1, 0, 0, 0, 227, 27, 1, 0, 0, 0,
-		228, 226, 1, 0, 0, 0, 229, 231, 5, 20, 0, 0, 230, 229, 1, 0, 0, 0, 230,
-		231, 1, 0, 0, 0, 231, 232, 1, 0, 0, 0, 232, 233, 3, 2, 1, 0, 233, 29, 1,
-		0, 0, 0, 234, 236, 5, 18, 0, 0, 235, 234, 1, 0, 0, 0, 235, 236, 1, 0, 0,
-		0, 236, 237, 1, 0, 0, 0, 237, 249, 5, 32, 0, 0, 238, 249, 5, 33, 0, 0,
-		239, 241, 5, 18, 0, 0, 240, 239, 1, 0, 0, 0, 240, 241, 1, 0, 0, 0, 241,
-		242, 1, 0, 0, 0, 242, 249, 5, 31, 0, 0, 243, 249, 5, 34, 0, 0, 244, 249,
-		5, 35, 0, 0, 245, 249, 5, 26, 0, 0, 246, 249, 5, 27, 0, 0, 247, 249, 5,
-		28, 0, 0, 248, 235, 1, 0, 0, 0, 248, 238, 1, 0, 0, 0, 248, 240, 1, 0, 0,
-		0, 248, 243, 1, 0, 0, 0, 248, 244, 1, 0, 0, 0, 248, 245, 1, 0, 0, 0, 248,
-		246, 1, 0, 0, 0, 248, 247, 1, 0, 0, 0, 249, 31, 1, 0, 0, 0, 35, 41, 48,
-		56, 67, 79, 81, 88, 94, 97, 105, 113, 119, 124, 126, 130, 135, 138, 146,
-		149, 154, 157, 161, 168, 173, 176, 180, 187, 195, 208, 212, 226, 230, 235,
-		240, 248,
-	}
-	deserializer := antlr.NewATNDeserializer(nil)
-	staticData.atn = deserializer.Deserialize(staticData.serializedATN)
-	atn := staticData.atn
-	staticData.decisionToDFA = make([]*antlr.DFA, len(atn.DecisionToState))
-	decisionToDFA := staticData.decisionToDFA
-	for index, state := range atn.DecisionToState {
-		decisionToDFA[index] = antlr.NewDFA(state, index)
-	}
+  staticData := &CELParserStaticData
+  staticData.LiteralNames = []string{
+    "", "'=='", "'!='", "'in'", "'<'", "'<='", "'>='", "'>'", "'&&'", "'||'", 
+    "'['", "']'", "'{'", "'}'", "'('", "')'", "'.'", "','", "'-'", "'!'", 
+    "'?'", "':'", "'+'", "'*'", "'/'", "'%'", "'true'", "'false'", "'null'",
+  }
+  staticData.SymbolicNames = []string{
+    "", "EQUALS", "NOT_EQUALS", "IN", "LESS", "LESS_EQUALS", "GREATER_EQUALS", 
+    "GREATER", "LOGICAL_AND", "LOGICAL_OR", "LBRACKET", "RPRACKET", "LBRACE", 
+    "RBRACE", "LPAREN", "RPAREN", "DOT", "COMMA", "MINUS", "EXCLAM", "QUESTIONMARK", 
+    "COLON", "PLUS", "STAR", "SLASH", "PERCENT", "CEL_TRUE", "CEL_FALSE", 
+    "NUL", "WHITESPACE", "COMMENT", "NUM_FLOAT", "NUM_INT", "NUM_UINT", 
+    "STRING", "BYTES", "IDENTIFIER",
+  }
+  staticData.RuleNames = []string{
+    "start", "expr", "conditionalOr", "conditionalAnd", "relation", "calc", 
+    "unary", "member", "primary", "exprList", "listInit", "fieldInitializerList", 
+    "optField", "mapInitializerList", "optExpr", "literal",
+  }
+  staticData.PredictionContextCache = antlr.NewPredictionContextCache()
+  staticData.serializedATN = []int32{
+	4, 1, 36, 251, 2, 0, 7, 0, 2, 1, 7, 1, 2, 2, 7, 2, 2, 3, 7, 3, 2, 4, 7, 
+	4, 2, 5, 7, 5, 2, 6, 7, 6, 2, 7, 7, 7, 2, 8, 7, 8, 2, 9, 7, 9, 2, 10, 7, 
+	10, 2, 11, 7, 11, 2, 12, 7, 12, 2, 13, 7, 13, 2, 14, 7, 14, 2, 15, 7, 15, 
+	1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 1, 42, 8, 1, 1, 
+	2, 1, 2, 1, 2, 5, 2, 47, 8, 2, 10, 2, 12, 2, 50, 9, 2, 1, 3, 1, 3, 1, 3, 
+	5, 3, 55, 8, 3, 10, 3, 12, 3, 58, 9, 3, 1, 4, 1, 4, 1, 4, 1, 4, 1, 4, 1, 
+	4, 5, 4, 66, 8, 4, 10, 4, 12, 4, 69, 9, 4, 1, 5, 1, 5, 1, 5, 1, 5, 1, 5, 
+	1, 5, 1, 5, 1, 5, 1, 5, 5, 5, 80, 8, 5, 10, 5, 12, 5, 83, 9, 5, 1, 6, 1, 
+	6, 4, 6, 87, 8, 6, 11, 6, 12, 6, 88, 1, 6, 1, 6, 4, 6, 93, 8, 6, 11, 6, 
+	12, 6, 94, 1, 6, 3, 6, 98, 8, 6, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3, 
+	7, 106, 8, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 1, 7, 3, 7, 114, 8, 7, 1, 7, 
+	1, 7, 1, 7, 1, 7, 3, 7, 120, 8, 7, 1, 7, 1, 7, 1, 7, 5, 7, 125, 8, 7, 10, 
+	7, 12, 7, 128, 9, 7, 1, 8, 3, 8, 131, 8, 8, 1, 8, 1, 8, 1, 8, 3, 8, 136, 
+	8, 8, 1, 8, 3, 8, 139, 8, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 1, 8, 3, 8, 
+	147, 8, 8, 1, 8, 3, 8, 150, 8, 8, 1, 8, 1, 8, 1, 8, 3, 8, 155, 8, 8, 1, 
+	8, 3, 8, 158, 8, 8, 1, 8, 1, 8, 3, 8, 162, 8, 8, 1, 8, 1, 8, 1, 8, 5, 8, 
+	167, 8, 8, 10, 8, 12, 8, 170, 9, 8, 1, 8, 1, 8, 3, 8, 174, 8, 8, 1, 8, 
+	3, 8, 177, 8, 8, 1, 8, 1, 8, 3, 8, 181, 8, 8, 1, 9, 1, 9, 1, 9, 5, 9, 186, 
+	8, 9, 10, 9, 12, 9, 189, 9, 9, 1, 10, 1, 10, 1, 10, 5, 10, 194, 8, 10, 
+	10, 10, 12, 10, 197, 9, 10, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 11, 1, 
+	11, 1, 11, 5, 11, 207, 8, 11, 10, 11, 12, 11, 210, 9, 11, 1, 12, 3, 12, 
+	213, 8, 12, 1, 12, 1, 12, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 13, 1, 
+	13, 1, 13, 5, 13, 225, 8, 13, 10, 13, 12, 13, 228, 9, 13, 1, 14, 3, 14, 
+	231, 8, 14, 1, 14, 1, 14, 1, 15, 3, 15, 236, 8, 15, 1, 15, 1, 15, 1, 15, 
+	3, 15, 241, 8, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 1, 15, 3, 15, 249, 
+	8, 15, 1, 15, 0, 3, 8, 10, 14, 16, 0, 2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 
+	22, 24, 26, 28, 30, 0, 3, 1, 0, 1, 7, 1, 0, 23, 25, 2, 0, 18, 18, 22, 22, 
+	281, 0, 32, 1, 0, 0, 0, 2, 35, 1, 0, 0, 0, 4, 43, 1, 0, 0, 0, 6, 51, 1, 
+	0, 0, 0, 8, 59, 1, 0, 0, 0, 10, 70, 1, 0, 0, 0, 12, 97, 1, 0, 0, 0, 14, 
+	99, 1, 0, 0, 0, 16, 180, 1, 0, 0, 0, 18, 182, 1, 0, 0, 0, 20, 190, 1, 0, 
+	0, 0, 22, 198, 1, 0, 0, 0, 24, 212, 1, 0, 0, 0, 26, 216, 1, 0, 0, 0, 28, 
+	230, 1, 0, 0, 0, 30, 248, 1, 0, 0, 0, 32, 33, 3, 2, 1, 0, 33, 34, 5, 0, 
+	0, 1, 34, 1, 1, 0, 0, 0, 35, 41, 3, 4, 2, 0, 36, 37, 5, 20, 0, 0, 37, 38, 
+	3, 4, 2, 0, 38, 39, 5, 21, 0, 0, 39, 40, 3, 2, 1, 0, 40, 42, 1, 0, 0, 0, 
+	41, 36, 1, 0, 0, 0, 41, 42, 1, 0, 0, 0, 42, 3, 1, 0, 0, 0, 43, 48, 3, 6, 
+	3, 0, 44, 45, 5, 9, 0, 0, 45, 47, 3, 6, 3, 0, 46, 44, 1, 0, 0, 0, 47, 50, 
+	1, 0, 0, 0, 48, 46, 1, 0, 0, 0, 48, 49, 1, 0, 0, 0, 49, 5, 1, 0, 0, 0, 
+	50, 48, 1, 0, 0, 0, 51, 56, 3, 8, 4, 0, 52, 53, 5, 8, 0, 0, 53, 55, 3, 
+	8, 4, 0, 54, 52, 1, 0, 0, 0, 55, 58, 1, 0, 0, 0, 56, 54, 1, 0, 0, 0, 56, 
+	57, 1, 0, 0, 0, 57, 7, 1, 0, 0, 0, 58, 56, 1, 0, 0, 0, 59, 60, 6, 4, -1, 
+	0, 60, 61, 3, 10, 5, 0, 61, 67, 1, 0, 0, 0, 62, 63, 10, 1, 0, 0, 63, 64, 
+	7, 0, 0, 0, 64, 66, 3, 8, 4, 2, 65, 62, 1, 0, 0, 0, 66, 69, 1, 0, 0, 0, 
+	67, 65, 1, 0, 0, 0, 67, 68, 1, 0, 0, 0, 68, 9, 1, 0, 0, 0, 69, 67, 1, 0, 
+	0, 0, 70, 71, 6, 5, -1, 0, 71, 72, 3, 12, 6, 0, 72, 81, 1, 0, 0, 0, 73, 
+	74, 10, 2, 0, 0, 74, 75, 7, 1, 0, 0, 75, 80, 3, 10, 5, 3, 76, 77, 10, 1, 
+	0, 0, 77, 78, 7, 2, 0, 0, 78, 80, 3, 10, 5, 2, 79, 73, 1, 0, 0, 0, 79, 
+	76, 1, 0, 0, 0, 80, 83, 1, 0, 0, 0, 81, 79, 1, 0, 0, 0, 81, 82, 1, 0, 0, 
+	0, 82, 11, 1, 0, 0, 0, 83, 81, 1, 0, 0, 0, 84, 98, 3, 14, 7, 0, 85, 87, 
+	5, 19, 0, 0, 86, 85, 1, 0, 0, 0, 87, 88, 1, 0, 0, 0, 88, 86, 1, 0, 0, 0, 
+	88, 89, 1, 0, 0, 0, 89, 90, 1, 0, 0, 0, 90, 98, 3, 14, 7, 0, 91, 93, 5, 
+	18, 0, 0, 92, 91, 1, 0, 0, 0, 93, 94, 1, 0, 0, 0, 94, 92, 1, 0, 0, 0, 94, 
+	95, 1, 0, 0, 0, 95, 96, 1, 0, 0, 0, 96, 98, 3, 14, 7, 0, 97, 84, 1, 0, 
+	0, 0, 97, 86, 1, 0, 0, 0, 97, 92, 1, 0, 0, 0, 98, 13, 1, 0, 0, 0, 99, 100, 
+	6, 7, -1, 0, 100, 101, 3, 16, 8, 0, 101, 126, 1, 0, 0, 0, 102, 103, 10, 
+	3, 0, 0, 103, 105, 5, 16, 0, 0, 104, 106, 5, 20, 0, 0, 105, 104, 1, 0, 
+	0, 0, 105, 106, 1, 0, 0, 0, 106, 107, 1, 0, 0, 0, 107, 125, 5, 36, 0, 0, 
+	108, 109, 10, 2, 0, 0, 109, 110, 5, 16, 0, 0, 110, 111, 5, 36, 0, 0, 111, 
+	113, 5, 14, 0, 0, 112, 114, 3, 18, 9, 0, 113, 112, 1, 0, 0, 0, 113, 114, 
+	1, 0, 0, 0, 114, 115, 1, 0, 0, 0, 115, 125, 5, 15, 0, 0, 116, 117, 10, 
+	1, 0, 0, 117, 119, 5, 10, 0, 0, 118, 120, 5, 20, 0, 0, 119, 118, 1, 0, 
+	0, 0, 119, 120, 1, 0, 0, 0, 120, 121, 1, 0, 0, 0, 121, 122, 3, 2, 1, 0, 
+	122, 123, 5, 11, 0, 0, 123, 125, 1, 0, 0, 0, 124, 102, 1, 0, 0, 0, 124, 
+	108, 1, 0, 0, 0, 124, 116, 1, 0, 0, 0, 125, 128, 1, 0, 0, 0, 126, 124, 
+	1, 0, 0, 0, 126, 127, 1, 0, 0, 0, 127, 15, 1, 0, 0, 0, 128, 126, 1, 0, 
+	0, 0, 129, 131, 5, 16, 0, 0, 130, 129, 1, 0, 0, 0, 130, 131, 1, 0, 0, 0, 
+	131, 132, 1, 0, 0, 0, 132, 138, 5, 36, 0, 0, 133, 135, 5, 14, 0, 0, 134, 
+	136, 3, 18, 9, 0, 135, 134, 1, 0, 0, 0, 135, 136, 1, 0, 0, 0, 136, 137, 
+	1, 0, 0, 0, 137, 139, 5, 15, 0, 0, 138, 133, 1, 0, 0, 0, 138, 139, 1, 0, 
+	0, 0, 139, 181, 1, 0, 0, 0, 140, 141, 5, 14, 0, 0, 141, 142, 3, 2, 1, 0, 
+	142, 143, 5, 15, 0, 0, 143, 181, 1, 0, 0, 0, 144, 146, 5, 10, 0, 0, 145, 
+	147, 3, 20, 10, 0, 146, 145, 1, 0, 0, 0, 146, 147, 1, 0, 0, 0, 147, 149, 
+	1, 0, 0, 0, 148, 150, 5, 17, 0, 0, 149, 148, 1, 0, 0, 0, 149, 150, 1, 0, 
+	0, 0, 150, 151, 1, 0, 0, 0, 151, 181, 5, 11, 0, 0, 152, 154, 5, 12, 0, 
+	0, 153, 155, 3, 26, 13, 0, 154, 153, 1, 0, 0, 0, 154, 155, 1, 0, 0, 0, 
+	155, 157, 1, 0, 0, 0, 156, 158, 5, 17, 0, 0, 157, 156, 1, 0, 0, 0, 157, 
+	158, 1, 0, 0, 0, 158, 159, 1, 0, 0, 0, 159, 181, 5, 13, 0, 0, 160, 162, 
+	5, 16, 0, 0, 161, 160, 1, 0, 0, 0, 161, 162, 1, 0, 0, 0, 162, 163, 1, 0, 
+	0, 0, 163, 168, 5, 36, 0, 0, 164, 165, 5, 16, 0, 0, 165, 167, 5, 36, 0, 
+	0, 166, 164, 1, 0, 0, 0, 167, 170, 1, 0, 0, 0, 168, 166, 1, 0, 0, 0, 168, 
+	169, 1, 0, 0, 0, 169, 171, 1, 0, 0, 0, 170, 168, 1, 0, 0, 0, 171, 173, 
+	5, 12, 0, 0, 172, 174, 3, 22, 11, 0, 173, 172, 1, 0, 0, 0, 173, 174, 1, 
+	0, 0, 0, 174, 176, 1, 0, 0, 0, 175, 177, 5, 17, 0, 0, 176, 175, 1, 0, 0, 
+	0, 176, 177, 1, 0, 0, 0, 177, 178, 1, 0, 0, 0, 178, 181, 5, 13, 0, 0, 179, 
+	181, 3, 30, 15, 0, 180, 130, 1, 0, 0, 0, 180, 140, 1, 0, 0, 0, 180, 144, 
+	1, 0, 0, 0, 180, 152, 1, 0, 0, 0, 180, 161, 1, 0, 0, 0, 180, 179, 1, 0, 
+	0, 0, 181, 17, 1, 0, 0, 0, 182, 187, 3, 2, 1, 0, 183, 184, 5, 17, 0, 0, 
+	184, 186, 3, 2, 1, 0, 185, 183, 1, 0, 0, 0, 186, 189, 1, 0, 0, 0, 187, 
+	185, 1, 0, 0, 0, 187, 188, 1, 0, 0, 0, 188, 19, 1, 0, 0, 0, 189, 187, 1, 
+	0, 0, 0, 190, 195, 3, 28, 14, 0, 191, 192, 5, 17, 0, 0, 192, 194, 3, 28, 
+	14, 0, 193, 191, 1, 0, 0, 0, 194, 197, 1, 0, 0, 0, 195, 193, 1, 0, 0, 0, 
+	195, 196, 1, 0, 0, 0, 196, 21, 1, 0, 0, 0, 197, 195, 1, 0, 0, 0, 198, 199, 
+	3, 24, 12, 0, 199, 200, 5, 21, 0, 0, 200, 208, 3, 2, 1, 0, 201, 202, 5, 
+	17, 0, 0, 202, 203, 3, 24, 12, 0, 203, 204, 5, 21, 0, 0, 204, 205, 3, 2, 
+	1, 0, 205, 207, 1, 0, 0, 0, 206, 201, 1, 0, 0, 0, 207, 210, 1, 0, 0, 0, 
+	208, 206, 1, 0, 0, 0, 208, 209, 1, 0, 0, 0, 209, 23, 1, 0, 0, 0, 210, 208, 
+	1, 0, 0, 0, 211, 213, 5, 20, 0, 0, 212, 211, 1, 0, 0, 0, 212, 213, 1, 0, 
+	0, 0, 213, 214, 1, 0, 0, 0, 214, 215, 5, 36, 0, 0, 215, 25, 1, 0, 0, 0, 
+	216, 217, 3, 28, 14, 0, 217, 218, 5, 21, 0, 0, 218, 226, 3, 2, 1, 0, 219, 
+	220, 5, 17, 0, 0, 220, 221, 3, 28, 14, 0, 221, 222, 5, 21, 0, 0, 222, 223, 
+	3, 2, 1, 0, 223, 225, 1, 0, 0, 0, 224, 219, 1, 0, 0, 0, 225, 228, 1, 0, 
+	0, 0, 226, 224, 1, 0, 0, 0, 226, 227, 1, 0, 0, 0, 227, 27, 1, 0, 0, 0, 
+	228, 226, 1, 0, 0, 0, 229, 231, 5, 20, 0, 0, 230, 229, 1, 0, 0, 0, 230, 
+	231, 1, 0, 0, 0, 231, 232, 1, 0, 0, 0, 232, 233, 3, 2, 1, 0, 233, 29, 1, 
+	0, 0, 0, 234, 236, 5, 18, 0, 0, 235, 234, 1, 0, 0, 0, 235, 236, 1, 0, 0, 
+	0, 236, 237, 1, 0, 0, 0, 237, 249, 5, 32, 0, 0, 238, 249, 5, 33, 0, 0, 
+	239, 241, 5, 18, 0, 0, 240, 239, 1, 0, 0, 0, 240, 241, 1, 0, 0, 0, 241, 
+	242, 1, 0, 0, 0, 242, 249, 5, 31, 0, 0, 243, 249, 5, 34, 0, 0, 244, 249, 
+	5, 35, 0, 0, 245, 249, 5, 26, 0, 0, 246, 249, 5, 27, 0, 0, 247, 249, 5, 
+	28, 0, 0, 248, 235, 1, 0, 0, 0, 248, 238, 1, 0, 0, 0, 248, 240, 1, 0, 0, 
+	0, 248, 243, 1, 0, 0, 0, 248, 244, 1, 0, 0, 0, 248, 245, 1, 0, 0, 0, 248, 
+	246, 1, 0, 0, 0, 248, 247, 1, 0, 0, 0, 249, 31, 1, 0, 0, 0, 35, 41, 48, 
+	56, 67, 79, 81, 88, 94, 97, 105, 113, 119, 124, 126, 130, 135, 138, 146, 
+	149, 154, 157, 161, 168, 173, 176, 180, 187, 195, 208, 212, 226, 230, 235, 
+	240, 248,
+}
+  deserializer := antlr.NewATNDeserializer(nil)
+  staticData.atn = deserializer.Deserialize(staticData.serializedATN)
+  atn := staticData.atn
+  staticData.decisionToDFA = make([]*antlr.DFA, len(atn.DecisionToState))
+  decisionToDFA := staticData.decisionToDFA
+  for index, state := range atn.DecisionToState {
+    decisionToDFA[index] = antlr.NewDFA(state, index)
+  }
 }
 
 // CELParserInit initializes any static state used to implement CELParser. By default the
@@ -181,8 +182,8 @@ func celParserInit() {
 // NewCELParser(). You can call this function if you wish to initialize the static state ahead
 // of time.
 func CELParserInit() {
-	staticData := &celParserStaticData
-	staticData.once.Do(celParserInit)
+  staticData := &CELParserStaticData
+  staticData.once.Do(celParserInit)
 }
 
 // NewCELParser produces a new parser instance for the optional input antlr.TokenStream.
@@ -190,75 +191,76 @@ func NewCELParser(input antlr.TokenStream) *CELParser {
 	CELParserInit()
 	this := new(CELParser)
 	this.BaseParser = antlr.NewBaseParser(input)
-	staticData := &celParserStaticData
-	this.Interpreter = antlr.NewParserATNSimulator(this, staticData.atn, staticData.decisionToDFA, staticData.predictionContextCache)
-	this.RuleNames = staticData.ruleNames
-	this.LiteralNames = staticData.literalNames
-	this.SymbolicNames = staticData.symbolicNames
+  staticData := &CELParserStaticData
+	this.Interpreter = antlr.NewParserATNSimulator(this, staticData.atn, staticData.decisionToDFA, staticData.PredictionContextCache)
+	this.RuleNames = staticData.RuleNames
+	this.LiteralNames = staticData.LiteralNames
+	this.SymbolicNames = staticData.SymbolicNames
 	this.GrammarFileName = "CEL.g4"
 
 	return this
 }
 
+
 // CELParser tokens.
 const (
-	CELParserEOF            = antlr.TokenEOF
-	CELParserEQUALS         = 1
-	CELParserNOT_EQUALS     = 2
-	CELParserIN             = 3
-	CELParserLESS           = 4
-	CELParserLESS_EQUALS    = 5
+	CELParserEOF = antlr.TokenEOF
+	CELParserEQUALS = 1
+	CELParserNOT_EQUALS = 2
+	CELParserIN = 3
+	CELParserLESS = 4
+	CELParserLESS_EQUALS = 5
 	CELParserGREATER_EQUALS = 6
-	CELParserGREATER        = 7
-	CELParserLOGICAL_AND    = 8
-	CELParserLOGICAL_OR     = 9
-	CELParserLBRACKET       = 10
-	CELParserRPRACKET       = 11
-	CELParserLBRACE         = 12
-	CELParserRBRACE         = 13
-	CELParserLPAREN         = 14
-	CELParserRPAREN         = 15
-	CELParserDOT            = 16
-	CELParserCOMMA          = 17
-	CELParserMINUS          = 18
-	CELParserEXCLAM         = 19
-	CELParserQUESTIONMARK   = 20
-	CELParserCOLON          = 21
-	CELParserPLUS           = 22
-	CELParserSTAR           = 23
-	CELParserSLASH          = 24
-	CELParserPERCENT        = 25
-	CELParserCEL_TRUE       = 26
-	CELParserCEL_FALSE      = 27
-	CELParserNUL            = 28
-	CELParserWHITESPACE     = 29
-	CELParserCOMMENT        = 30
-	CELParserNUM_FLOAT      = 31
-	CELParserNUM_INT        = 32
-	CELParserNUM_UINT       = 33
-	CELParserSTRING         = 34
-	CELParserBYTES          = 35
-	CELParserIDENTIFIER     = 36
+	CELParserGREATER = 7
+	CELParserLOGICAL_AND = 8
+	CELParserLOGICAL_OR = 9
+	CELParserLBRACKET = 10
+	CELParserRPRACKET = 11
+	CELParserLBRACE = 12
+	CELParserRBRACE = 13
+	CELParserLPAREN = 14
+	CELParserRPAREN = 15
+	CELParserDOT = 16
+	CELParserCOMMA = 17
+	CELParserMINUS = 18
+	CELParserEXCLAM = 19
+	CELParserQUESTIONMARK = 20
+	CELParserCOLON = 21
+	CELParserPLUS = 22
+	CELParserSTAR = 23
+	CELParserSLASH = 24
+	CELParserPERCENT = 25
+	CELParserCEL_TRUE = 26
+	CELParserCEL_FALSE = 27
+	CELParserNUL = 28
+	CELParserWHITESPACE = 29
+	CELParserCOMMENT = 30
+	CELParserNUM_FLOAT = 31
+	CELParserNUM_INT = 32
+	CELParserNUM_UINT = 33
+	CELParserSTRING = 34
+	CELParserBYTES = 35
+	CELParserIDENTIFIER = 36
 )
 
 // CELParser rules.
 const (
-	CELParserRULE_start                = 0
-	CELParserRULE_expr                 = 1
-	CELParserRULE_conditionalOr        = 2
-	CELParserRULE_conditionalAnd       = 3
-	CELParserRULE_relation             = 4
-	CELParserRULE_calc                 = 5
-	CELParserRULE_unary                = 6
-	CELParserRULE_member               = 7
-	CELParserRULE_primary              = 8
-	CELParserRULE_exprList             = 9
-	CELParserRULE_listInit             = 10
+	CELParserRULE_start = 0
+	CELParserRULE_expr = 1
+	CELParserRULE_conditionalOr = 2
+	CELParserRULE_conditionalAnd = 3
+	CELParserRULE_relation = 4
+	CELParserRULE_calc = 5
+	CELParserRULE_unary = 6
+	CELParserRULE_member = 7
+	CELParserRULE_primary = 8
+	CELParserRULE_exprList = 9
+	CELParserRULE_listInit = 10
 	CELParserRULE_fieldInitializerList = 11
-	CELParserRULE_optField             = 12
-	CELParserRULE_mapInitializerList   = 13
-	CELParserRULE_optExpr              = 14
-	CELParserRULE_literal              = 15
+	CELParserRULE_optField = 12
+	CELParserRULE_mapInitializerList = 13
+	CELParserRULE_optExpr = 14
+	CELParserRULE_literal = 15
 )
 
 // IStartContext is an interface to support dynamic dispatch.
@@ -271,9 +273,11 @@ type IStartContext interface {
 	// GetE returns the e rule contexts.
 	GetE() IExprContext
 
+
 	// SetE sets the e rule contexts.
 	SetE(IExprContext)
 
+
 	// Getter signatures
 	EOF() antlr.TerminalNode
 	Expr() IExprContext
@@ -283,24 +287,29 @@ type IStartContext interface {
 }
 
 type StartContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	e      IExprContext
+	e IExprContext 
 }
 
 func NewEmptyStartContext() *StartContext {
 	var p = new(StartContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_start
 	return p
 }
 
+func InitEmptyStartContext(p *StartContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_start
+}
+
 func (*StartContext) IsStartContext() {}
 
 func NewStartContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *StartContext {
 	var p = new(StartContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_start
@@ -312,17 +321,19 @@ func (s *StartContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *StartContext) GetE() IExprContext { return s.e }
 
+
 func (s *StartContext) SetE(v IExprContext) { s.e = v }
 
+
 func (s *StartContext) EOF() antlr.TerminalNode {
 	return s.GetToken(CELParserEOF, 0)
 }
 
 func (s *StartContext) Expr() IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -342,6 +353,7 @@ func (s *StartContext) ToStringTree(ruleNames []string, recog antlr.Recognizer)
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *StartContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterStart(s)
@@ -364,45 +376,46 @@ func (s *StartContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) Start() (localctx IStartContext) {
-	this := p
-	_ = this
 
-	localctx = NewStartContext(p, p.GetParserRuleContext(), p.GetState())
-	p.EnterRule(localctx, 0, CELParserRULE_start)
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
 
+func (p *CELParser) Start_() (localctx IStartContext) {
+	localctx = NewStartContext(p, p.GetParserRuleContext(), p.GetState())
+	p.EnterRule(localctx, 0, CELParserRULE_start)
 	p.EnterOuterAlt(localctx, 1)
 	{
 		p.SetState(32)
 
 		var _x = p.Expr()
 
+
 		localctx.(*StartContext).e = _x
 	}
 	{
 		p.SetState(33)
 		p.Match(CELParserEOF)
+		if p.HasError() {
+				// Recognition error - abort rule
+				goto errorExit
+		}
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IExprContext is an interface to support dynamic dispatch.
 type IExprContext interface {
 	antlr.ParserRuleContext
@@ -411,10 +424,12 @@ type IExprContext interface {
 	GetParser() antlr.Parser
 
 	// GetOp returns the op token.
-	GetOp() antlr.Token
+	GetOp() antlr.Token 
+
 
 	// SetOp sets the op token.
-	SetOp(antlr.Token)
+	SetOp(antlr.Token) 
+
 
 	// GetE returns the e rule contexts.
 	GetE() IConditionalOrContext
@@ -425,6 +440,7 @@ type IExprContext interface {
 	// GetE2 returns the e2 rule contexts.
 	GetE2() IExprContext
 
+
 	// SetE sets the e rule contexts.
 	SetE(IConditionalOrContext)
 
@@ -434,6 +450,7 @@ type IExprContext interface {
 	// SetE2 sets the e2 rule contexts.
 	SetE2(IExprContext)
 
+
 	// Getter signatures
 	AllConditionalOr() []IConditionalOrContext
 	ConditionalOr(i int) IConditionalOrContext
@@ -446,27 +463,32 @@ type IExprContext interface {
 }
 
 type ExprContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	e      IConditionalOrContext
-	op     antlr.Token
-	e1     IConditionalOrContext
-	e2     IExprContext
+	e IConditionalOrContext 
+	op antlr.Token
+	e1 IConditionalOrContext 
+	e2 IExprContext 
 }
 
 func NewEmptyExprContext() *ExprContext {
 	var p = new(ExprContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_expr
 	return p
 }
 
+func InitEmptyExprContext(p *ExprContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_expr
+}
+
 func (*ExprContext) IsExprContext() {}
 
 func NewExprContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *ExprContext {
 	var p = new(ExprContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_expr
@@ -478,20 +500,24 @@ func (s *ExprContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *ExprContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *ExprContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *ExprContext) GetE() IConditionalOrContext { return s.e }
 
 func (s *ExprContext) GetE1() IConditionalOrContext { return s.e1 }
 
 func (s *ExprContext) GetE2() IExprContext { return s.e2 }
 
+
 func (s *ExprContext) SetE(v IConditionalOrContext) { s.e = v }
 
 func (s *ExprContext) SetE1(v IConditionalOrContext) { s.e1 = v }
 
 func (s *ExprContext) SetE2(v IExprContext) { s.e2 = v }
 
+
 func (s *ExprContext) AllConditionalOr() []IConditionalOrContext {
 	children := s.GetChildren()
 	len := 0
@@ -514,12 +540,12 @@ func (s *ExprContext) AllConditionalOr() []IConditionalOrContext {
 }
 
 func (s *ExprContext) ConditionalOr(i int) IConditionalOrContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IConditionalOrContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -542,10 +568,10 @@ func (s *ExprContext) QUESTIONMARK() antlr.TerminalNode {
 }
 
 func (s *ExprContext) Expr() IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -565,6 +591,7 @@ func (s *ExprContext) ToStringTree(ruleNames []string, recog antlr.Recognizer) s
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *ExprContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterExpr(s)
@@ -587,42 +614,31 @@ func (s *ExprContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) Expr() (localctx IExprContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) Expr() (localctx IExprContext) {
 	localctx = NewExprContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 2, CELParserRULE_expr)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	{
 		p.SetState(35)
 
 		var _x = p.ConditionalOr()
 
+
 		localctx.(*ExprContext).e = _x
 	}
 	p.SetState(41)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	if _la == CELParserQUESTIONMARK {
 		{
 			p.SetState(36)
@@ -630,31 +646,54 @@ func (p *CELParser) Expr() (localctx IExprContext) {
 			var _m = p.Match(CELParserQUESTIONMARK)
 
 			localctx.(*ExprContext).op = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		{
 			p.SetState(37)
 
 			var _x = p.ConditionalOr()
 
+
 			localctx.(*ExprContext).e1 = _x
 		}
 		{
 			p.SetState(38)
 			p.Match(CELParserCOLON)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		{
 			p.SetState(39)
 
 			var _x = p.Expr()
 
+
 			localctx.(*ExprContext).e2 = _x
 		}
 
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IConditionalOrContext is an interface to support dynamic dispatch.
 type IConditionalOrContext interface {
 	antlr.ParserRuleContext
@@ -663,34 +702,42 @@ type IConditionalOrContext interface {
 	GetParser() antlr.Parser
 
 	// GetS9 returns the s9 token.
-	GetS9() antlr.Token
+	GetS9() antlr.Token 
+
 
 	// SetS9 sets the s9 token.
-	SetS9(antlr.Token)
+	SetS9(antlr.Token) 
+
 
 	// GetOps returns the ops token list.
 	GetOps() []antlr.Token
 
+
 	// SetOps sets the ops token list.
 	SetOps([]antlr.Token)
 
+
 	// GetE returns the e rule contexts.
 	GetE() IConditionalAndContext
 
 	// Get_conditionalAnd returns the _conditionalAnd rule contexts.
 	Get_conditionalAnd() IConditionalAndContext
 
+
 	// SetE sets the e rule contexts.
 	SetE(IConditionalAndContext)
 
 	// Set_conditionalAnd sets the _conditionalAnd rule contexts.
 	Set_conditionalAnd(IConditionalAndContext)
 
+
 	// GetE1 returns the e1 rule context list.
 	GetE1() []IConditionalAndContext
 
+
 	// SetE1 sets the e1 rule context list.
-	SetE1([]IConditionalAndContext)
+	SetE1([]IConditionalAndContext) 
+
 
 	// Getter signatures
 	AllConditionalAnd() []IConditionalAndContext
@@ -703,28 +750,33 @@ type IConditionalOrContext interface {
 }
 
 type ConditionalOrContext struct {
-	*antlr.BaseParserRuleContext
-	parser          antlr.Parser
-	e               IConditionalAndContext
-	s9              antlr.Token
-	ops             []antlr.Token
-	_conditionalAnd IConditionalAndContext
-	e1              []IConditionalAndContext
+	antlr.BaseParserRuleContext
+	parser antlr.Parser
+	e IConditionalAndContext 
+	s9 antlr.Token
+	ops []antlr.Token
+	_conditionalAnd IConditionalAndContext 
+	e1 []IConditionalAndContext
 }
 
 func NewEmptyConditionalOrContext() *ConditionalOrContext {
 	var p = new(ConditionalOrContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_conditionalOr
 	return p
 }
 
+func InitEmptyConditionalOrContext(p *ConditionalOrContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_conditionalOr
+}
+
 func (*ConditionalOrContext) IsConditionalOrContext() {}
 
 func NewConditionalOrContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *ConditionalOrContext {
 	var p = new(ConditionalOrContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_conditionalOr
@@ -736,24 +788,32 @@ func (s *ConditionalOrContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *ConditionalOrContext) GetS9() antlr.Token { return s.s9 }
 
+
 func (s *ConditionalOrContext) SetS9(v antlr.Token) { s.s9 = v }
 
+
 func (s *ConditionalOrContext) GetOps() []antlr.Token { return s.ops }
 
+
 func (s *ConditionalOrContext) SetOps(v []antlr.Token) { s.ops = v }
 
+
 func (s *ConditionalOrContext) GetE() IConditionalAndContext { return s.e }
 
 func (s *ConditionalOrContext) Get_conditionalAnd() IConditionalAndContext { return s._conditionalAnd }
 
+
 func (s *ConditionalOrContext) SetE(v IConditionalAndContext) { s.e = v }
 
 func (s *ConditionalOrContext) Set_conditionalAnd(v IConditionalAndContext) { s._conditionalAnd = v }
 
+
 func (s *ConditionalOrContext) GetE1() []IConditionalAndContext { return s.e1 }
 
+
 func (s *ConditionalOrContext) SetE1(v []IConditionalAndContext) { s.e1 = v }
 
+
 func (s *ConditionalOrContext) AllConditionalAnd() []IConditionalAndContext {
 	children := s.GetChildren()
 	len := 0
@@ -776,12 +836,12 @@ func (s *ConditionalOrContext) AllConditionalAnd() []IConditionalAndContext {
 }
 
 func (s *ConditionalOrContext) ConditionalAnd(i int) IConditionalAndContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IConditionalAndContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -811,6 +871,7 @@ func (s *ConditionalOrContext) ToStringTree(ruleNames []string, recog antlr.Reco
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *ConditionalOrContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterConditionalOr(s)
@@ -833,42 +894,31 @@ func (s *ConditionalOrContext) Accept(visitor antlr.ParseTreeVisitor) interface{
 	}
 }
 
-func (p *CELParser) ConditionalOr() (localctx IConditionalOrContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) ConditionalOr() (localctx IConditionalOrContext) {
 	localctx = NewConditionalOrContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 4, CELParserRULE_conditionalOr)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	{
 		p.SetState(43)
 
 		var _x = p.ConditionalAnd()
 
+
 		localctx.(*ConditionalOrContext).e = _x
 	}
 	p.SetState(48)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	for _la == CELParserLOGICAL_OR {
 		{
 			p.SetState(44)
@@ -876,6 +926,10 @@ func (p *CELParser) ConditionalOr() (localctx IConditionalOrContext) {
 			var _m = p.Match(CELParserLOGICAL_OR)
 
 			localctx.(*ConditionalOrContext).s9 = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		localctx.(*ConditionalOrContext).ops = append(localctx.(*ConditionalOrContext).ops, localctx.(*ConditionalOrContext).s9)
 		{
@@ -883,18 +937,36 @@ func (p *CELParser) ConditionalOr() (localctx IConditionalOrContext) {
 
 			var _x = p.ConditionalAnd()
 
+
 			localctx.(*ConditionalOrContext)._conditionalAnd = _x
 		}
 		localctx.(*ConditionalOrContext).e1 = append(localctx.(*ConditionalOrContext).e1, localctx.(*ConditionalOrContext)._conditionalAnd)
 
+
 		p.SetState(50)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+	    	goto errorExit
+	    }
 		_la = p.GetTokenStream().LA(1)
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IConditionalAndContext is an interface to support dynamic dispatch.
 type IConditionalAndContext interface {
 	antlr.ParserRuleContext
@@ -903,34 +975,42 @@ type IConditionalAndContext interface {
 	GetParser() antlr.Parser
 
 	// GetS8 returns the s8 token.
-	GetS8() antlr.Token
+	GetS8() antlr.Token 
+
 
 	// SetS8 sets the s8 token.
-	SetS8(antlr.Token)
+	SetS8(antlr.Token) 
+
 
 	// GetOps returns the ops token list.
 	GetOps() []antlr.Token
 
+
 	// SetOps sets the ops token list.
 	SetOps([]antlr.Token)
 
+
 	// GetE returns the e rule contexts.
 	GetE() IRelationContext
 
 	// Get_relation returns the _relation rule contexts.
 	Get_relation() IRelationContext
 
+
 	// SetE sets the e rule contexts.
 	SetE(IRelationContext)
 
 	// Set_relation sets the _relation rule contexts.
 	Set_relation(IRelationContext)
 
+
 	// GetE1 returns the e1 rule context list.
 	GetE1() []IRelationContext
 
+
 	// SetE1 sets the e1 rule context list.
-	SetE1([]IRelationContext)
+	SetE1([]IRelationContext) 
+
 
 	// Getter signatures
 	AllRelation() []IRelationContext
@@ -943,28 +1023,33 @@ type IConditionalAndContext interface {
 }
 
 type ConditionalAndContext struct {
-	*antlr.BaseParserRuleContext
-	parser    antlr.Parser
-	e         IRelationContext
-	s8        antlr.Token
-	ops       []antlr.Token
-	_relation IRelationContext
-	e1        []IRelationContext
+	antlr.BaseParserRuleContext
+	parser antlr.Parser
+	e IRelationContext 
+	s8 antlr.Token
+	ops []antlr.Token
+	_relation IRelationContext 
+	e1 []IRelationContext
 }
 
 func NewEmptyConditionalAndContext() *ConditionalAndContext {
 	var p = new(ConditionalAndContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_conditionalAnd
 	return p
 }
 
+func InitEmptyConditionalAndContext(p *ConditionalAndContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_conditionalAnd
+}
+
 func (*ConditionalAndContext) IsConditionalAndContext() {}
 
 func NewConditionalAndContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *ConditionalAndContext {
 	var p = new(ConditionalAndContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_conditionalAnd
@@ -976,24 +1061,32 @@ func (s *ConditionalAndContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *ConditionalAndContext) GetS8() antlr.Token { return s.s8 }
 
+
 func (s *ConditionalAndContext) SetS8(v antlr.Token) { s.s8 = v }
 
+
 func (s *ConditionalAndContext) GetOps() []antlr.Token { return s.ops }
 
+
 func (s *ConditionalAndContext) SetOps(v []antlr.Token) { s.ops = v }
 
+
 func (s *ConditionalAndContext) GetE() IRelationContext { return s.e }
 
 func (s *ConditionalAndContext) Get_relation() IRelationContext { return s._relation }
 
+
 func (s *ConditionalAndContext) SetE(v IRelationContext) { s.e = v }
 
 func (s *ConditionalAndContext) Set_relation(v IRelationContext) { s._relation = v }
 
+
 func (s *ConditionalAndContext) GetE1() []IRelationContext { return s.e1 }
 
+
 func (s *ConditionalAndContext) SetE1(v []IRelationContext) { s.e1 = v }
 
+
 func (s *ConditionalAndContext) AllRelation() []IRelationContext {
 	children := s.GetChildren()
 	len := 0
@@ -1016,12 +1109,12 @@ func (s *ConditionalAndContext) AllRelation() []IRelationContext {
 }
 
 func (s *ConditionalAndContext) Relation(i int) IRelationContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IRelationContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -1051,6 +1144,7 @@ func (s *ConditionalAndContext) ToStringTree(ruleNames []string, recog antlr.Rec
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *ConditionalAndContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterConditionalAnd(s)
@@ -1073,30 +1167,14 @@ func (s *ConditionalAndContext) Accept(visitor antlr.ParseTreeVisitor) interface
 	}
 }
 
-func (p *CELParser) ConditionalAnd() (localctx IConditionalAndContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) ConditionalAnd() (localctx IConditionalAndContext) {
 	localctx = NewConditionalAndContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 6, CELParserRULE_conditionalAnd)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	{
 		p.SetState(51)
@@ -1107,8 +1185,12 @@ func (p *CELParser) ConditionalAnd() (localctx IConditionalAndContext) {
 	}
 	p.SetState(56)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	for _la == CELParserLOGICAL_AND {
 		{
 			p.SetState(52)
@@ -1116,6 +1198,10 @@ func (p *CELParser) ConditionalAnd() (localctx IConditionalAndContext) {
 			var _m = p.Match(CELParserLOGICAL_AND)
 
 			localctx.(*ConditionalAndContext).s8 = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		localctx.(*ConditionalAndContext).ops = append(localctx.(*ConditionalAndContext).ops, localctx.(*ConditionalAndContext).s8)
 		{
@@ -1127,14 +1213,31 @@ func (p *CELParser) ConditionalAnd() (localctx IConditionalAndContext) {
 		}
 		localctx.(*ConditionalAndContext).e1 = append(localctx.(*ConditionalAndContext).e1, localctx.(*ConditionalAndContext)._relation)
 
+
 		p.SetState(58)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+	    	goto errorExit
+	    }
 		_la = p.GetTokenStream().LA(1)
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IRelationContext is an interface to support dynamic dispatch.
 type IRelationContext interface {
 	antlr.ParserRuleContext
@@ -1143,10 +1246,12 @@ type IRelationContext interface {
 	GetParser() antlr.Parser
 
 	// GetOp returns the op token.
-	GetOp() antlr.Token
+	GetOp() antlr.Token 
+
 
 	// SetOp sets the op token.
-	SetOp(antlr.Token)
+	SetOp(antlr.Token) 
+
 
 	// Getter signatures
 	Calc() ICalcContext
@@ -1165,24 +1270,29 @@ type IRelationContext interface {
 }
 
 type RelationContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	op     antlr.Token
+	op antlr.Token
 }
 
 func NewEmptyRelationContext() *RelationContext {
 	var p = new(RelationContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_relation
 	return p
 }
 
+func InitEmptyRelationContext(p *RelationContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_relation
+}
+
 func (*RelationContext) IsRelationContext() {}
 
 func NewRelationContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *RelationContext {
 	var p = new(RelationContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_relation
@@ -1194,13 +1304,15 @@ func (s *RelationContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *RelationContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *RelationContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *RelationContext) Calc() ICalcContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(ICalcContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -1234,12 +1346,12 @@ func (s *RelationContext) AllRelation() []IRelationContext {
 }
 
 func (s *RelationContext) Relation(i int) IRelationContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IRelationContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -1289,6 +1401,7 @@ func (s *RelationContext) ToStringTree(ruleNames []string, recog antlr.Recognize
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *RelationContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterRelation(s)
@@ -1311,15 +1424,17 @@ func (s *RelationContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
+
+
+
 func (p *CELParser) Relation() (localctx IRelationContext) {
 	return p.relation(0)
 }
 
 func (p *CELParser) relation(_p int) (localctx IRelationContext) {
-	this := p
-	_ = this
-
 	var _parentctx antlr.ParserRuleContext = p.GetParserRuleContext()
+
 	_parentState := p.GetState()
 	localctx = NewRelationContext(p, p.GetParserRuleContext(), _parentState)
 	var _prevctx IRelationContext = localctx
@@ -1328,22 +1443,6 @@ func (p *CELParser) relation(_p int) (localctx IRelationContext) {
 	p.EnterRecursionRule(localctx, 8, CELParserRULE_relation, _p)
 	var _la int
 
-	defer func() {
-		p.UnrollRecursionContexts(_parentctx)
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -1355,8 +1454,13 @@ func (p *CELParser) relation(_p int) (localctx IRelationContext) {
 	p.GetParserRuleContext().SetStop(p.GetTokenStream().LT(-1))
 	p.SetState(67)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 3, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 3, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			if p.GetParseListeners() != nil {
@@ -1368,7 +1472,8 @@ func (p *CELParser) relation(_p int) (localctx IRelationContext) {
 			p.SetState(62)
 
 			if !(p.Precpred(p.GetParserRuleContext(), 1)) {
-				panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+				p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+				goto errorExit
 			}
 			{
 				p.SetState(63)
@@ -1379,7 +1484,7 @@ func (p *CELParser) relation(_p int) (localctx IRelationContext) {
 
 				_la = p.GetTokenStream().LA(1)
 
-				if !((int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&254) != 0) {
+				if !(((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 254) != 0)) {
 					var _ri = p.GetErrorHandler().RecoverInline(p)
 
 					localctx.(*RelationContext).op = _ri
@@ -1393,15 +1498,35 @@ func (p *CELParser) relation(_p int) (localctx IRelationContext) {
 				p.relation(2)
 			}
 
+
 		}
 		p.SetState(69)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 3, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 3, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+	errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.UnrollRecursionContexts(_parentctx)
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // ICalcContext is an interface to support dynamic dispatch.
 type ICalcContext interface {
 	antlr.ParserRuleContext
@@ -1410,10 +1535,12 @@ type ICalcContext interface {
 	GetParser() antlr.Parser
 
 	// GetOp returns the op token.
-	GetOp() antlr.Token
+	GetOp() antlr.Token 
+
 
 	// SetOp sets the op token.
-	SetOp(antlr.Token)
+	SetOp(antlr.Token) 
+
 
 	// Getter signatures
 	Unary() IUnaryContext
@@ -1430,24 +1557,29 @@ type ICalcContext interface {
 }
 
 type CalcContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	op     antlr.Token
+	op antlr.Token
 }
 
 func NewEmptyCalcContext() *CalcContext {
 	var p = new(CalcContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_calc
 	return p
 }
 
+func InitEmptyCalcContext(p *CalcContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_calc
+}
+
 func (*CalcContext) IsCalcContext() {}
 
 func NewCalcContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *CalcContext {
 	var p = new(CalcContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_calc
@@ -1459,13 +1591,15 @@ func (s *CalcContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *CalcContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *CalcContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *CalcContext) Unary() IUnaryContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IUnaryContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -1499,12 +1633,12 @@ func (s *CalcContext) AllCalc() []ICalcContext {
 }
 
 func (s *CalcContext) Calc(i int) ICalcContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(ICalcContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -1546,6 +1680,7 @@ func (s *CalcContext) ToStringTree(ruleNames []string, recog antlr.Recognizer) s
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *CalcContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterCalc(s)
@@ -1568,15 +1703,17 @@ func (s *CalcContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
+
+
+
 func (p *CELParser) Calc() (localctx ICalcContext) {
 	return p.calc(0)
 }
 
 func (p *CELParser) calc(_p int) (localctx ICalcContext) {
-	this := p
-	_ = this
-
 	var _parentctx antlr.ParserRuleContext = p.GetParserRuleContext()
+
 	_parentState := p.GetState()
 	localctx = NewCalcContext(p, p.GetParserRuleContext(), _parentState)
 	var _prevctx ICalcContext = localctx
@@ -1585,22 +1722,6 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 	p.EnterRecursionRule(localctx, 10, CELParserRULE_calc, _p)
 	var _la int
 
-	defer func() {
-		p.UnrollRecursionContexts(_parentctx)
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -1612,8 +1733,13 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 	p.GetParserRuleContext().SetStop(p.GetTokenStream().LT(-1))
 	p.SetState(81)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 5, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 5, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			if p.GetParseListeners() != nil {
@@ -1622,14 +1748,19 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 			_prevctx = localctx
 			p.SetState(79)
 			p.GetErrorHandler().Sync(p)
-			switch p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 4, p.GetParserRuleContext()) {
+			if p.HasError() {
+				goto errorExit
+			}
+
+			switch p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 4, p.GetParserRuleContext()) {
 			case 1:
 				localctx = NewCalcContext(p, _parentctx, _parentState)
 				p.PushNewRecursionContext(localctx, _startState, CELParserRULE_calc)
 				p.SetState(73)
 
 				if !(p.Precpred(p.GetParserRuleContext(), 2)) {
-					panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 2)", ""))
+					p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 2)", ""))
+					goto errorExit
 				}
 				{
 					p.SetState(74)
@@ -1640,7 +1771,7 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 
 					_la = p.GetTokenStream().LA(1)
 
-					if !((int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&58720256) != 0) {
+					if !(((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 58720256) != 0)) {
 						var _ri = p.GetErrorHandler().RecoverInline(p)
 
 						localctx.(*CalcContext).op = _ri
@@ -1654,13 +1785,15 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 					p.calc(3)
 				}
 
+
 			case 2:
 				localctx = NewCalcContext(p, _parentctx, _parentState)
 				p.PushNewRecursionContext(localctx, _startState, CELParserRULE_calc)
 				p.SetState(76)
 
 				if !(p.Precpred(p.GetParserRuleContext(), 1)) {
-					panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+					p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+					goto errorExit
 				}
 				{
 					p.SetState(77)
@@ -1685,17 +1818,38 @@ func (p *CELParser) calc(_p int) (localctx ICalcContext) {
 					p.calc(2)
 				}
 
+			case antlr.ATNInvalidAltNumber:
+				goto errorExit
 			}
 
 		}
 		p.SetState(83)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 5, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 5, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+	errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.UnrollRecursionContexts(_parentctx)
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IUnaryContext is an interface to support dynamic dispatch.
 type IUnaryContext interface {
 	antlr.ParserRuleContext
@@ -1707,23 +1861,28 @@ type IUnaryContext interface {
 }
 
 type UnaryContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
 }
 
 func NewEmptyUnaryContext() *UnaryContext {
 	var p = new(UnaryContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_unary
 	return p
 }
 
+func InitEmptyUnaryContext(p *UnaryContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_unary
+}
+
 func (*UnaryContext) IsUnaryContext() {}
 
 func NewUnaryContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *UnaryContext {
 	var p = new(UnaryContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_unary
@@ -1733,8 +1892,8 @@ func NewUnaryContext(parser antlr.Parser, parent antlr.ParserRuleContext, invoki
 
 func (s *UnaryContext) GetParser() antlr.Parser { return s.parser }
 
-func (s *UnaryContext) CopyFrom(ctx *UnaryContext) {
-	s.BaseParserRuleContext.CopyFrom(ctx.BaseParserRuleContext)
+func (s *UnaryContext) CopyAll(ctx *UnaryContext) {
+	s.CopyFrom(&ctx.BaseParserRuleContext)
 }
 
 func (s *UnaryContext) GetRuleContext() antlr.RuleContext {
@@ -1745,8 +1904,11 @@ func (s *UnaryContext) ToStringTree(ruleNames []string, recog antlr.Recognizer)
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
+
+
 type LogicalNotContext struct {
-	*UnaryContext
+	UnaryContext
 	s19 antlr.Token
 	ops []antlr.Token
 }
@@ -1754,19 +1916,23 @@ type LogicalNotContext struct {
 func NewLogicalNotContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *LogicalNotContext {
 	var p = new(LogicalNotContext)
 
-	p.UnaryContext = NewEmptyUnaryContext()
+	InitEmptyUnaryContext(&p.UnaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*UnaryContext))
+	p.CopyAll(ctx.(*UnaryContext))
 
 	return p
 }
 
+
 func (s *LogicalNotContext) GetS19() antlr.Token { return s.s19 }
 
+
 func (s *LogicalNotContext) SetS19(v antlr.Token) { s.s19 = v }
 
+
 func (s *LogicalNotContext) GetOps() []antlr.Token { return s.ops }
 
+
 func (s *LogicalNotContext) SetOps(v []antlr.Token) { s.ops = v }
 
 func (s *LogicalNotContext) GetRuleContext() antlr.RuleContext {
@@ -1774,10 +1940,10 @@ func (s *LogicalNotContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *LogicalNotContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -1797,6 +1963,7 @@ func (s *LogicalNotContext) EXCLAM(i int) antlr.TerminalNode {
 	return s.GetToken(CELParserEXCLAM, i)
 }
 
+
 func (s *LogicalNotContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterLogicalNot(s)
@@ -1819,16 +1986,17 @@ func (s *LogicalNotContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type MemberExprContext struct {
-	*UnaryContext
+	UnaryContext
 }
 
 func NewMemberExprContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *MemberExprContext {
 	var p = new(MemberExprContext)
 
-	p.UnaryContext = NewEmptyUnaryContext()
+	InitEmptyUnaryContext(&p.UnaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*UnaryContext))
+	p.CopyAll(ctx.(*UnaryContext))
 
 	return p
 }
@@ -1838,10 +2006,10 @@ func (s *MemberExprContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *MemberExprContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -1853,6 +2021,7 @@ func (s *MemberExprContext) Member() IMemberContext {
 	return t.(IMemberContext)
 }
 
+
 func (s *MemberExprContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterMemberExpr(s)
@@ -1875,8 +2044,9 @@ func (s *MemberExprContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type NegateContext struct {
-	*UnaryContext
+	UnaryContext
 	s18 antlr.Token
 	ops []antlr.Token
 }
@@ -1884,19 +2054,23 @@ type NegateContext struct {
 func NewNegateContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *NegateContext {
 	var p = new(NegateContext)
 
-	p.UnaryContext = NewEmptyUnaryContext()
+	InitEmptyUnaryContext(&p.UnaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*UnaryContext))
+	p.CopyAll(ctx.(*UnaryContext))
 
 	return p
 }
 
+
 func (s *NegateContext) GetS18() antlr.Token { return s.s18 }
 
+
 func (s *NegateContext) SetS18(v antlr.Token) { s.s18 = v }
 
+
 func (s *NegateContext) GetOps() []antlr.Token { return s.ops }
 
+
 func (s *NegateContext) SetOps(v []antlr.Token) { s.ops = v }
 
 func (s *NegateContext) GetRuleContext() antlr.RuleContext {
@@ -1904,10 +2078,10 @@ func (s *NegateContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *NegateContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -1927,6 +2101,7 @@ func (s *NegateContext) MINUS(i int) antlr.TerminalNode {
 	return s.GetToken(CELParserMINUS, i)
 }
 
+
 func (s *NegateContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterNegate(s)
@@ -1949,35 +2124,22 @@ func (s *NegateContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) Unary() (localctx IUnaryContext) {
-	this := p
-	_ = this
 
+
+func (p *CELParser) Unary() (localctx IUnaryContext) {
 	localctx = NewUnaryContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 12, CELParserRULE_unary)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	var _alt int
 
 	p.SetState(97)
 	p.GetErrorHandler().Sync(p)
-	switch p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 8, p.GetParserRuleContext()) {
+	if p.HasError() {
+		goto errorExit
+	}
+
+	switch p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 8, p.GetParserRuleContext()) {
 	case 1:
 		localctx = NewMemberExprContext(p, localctx)
 		p.EnterOuterAlt(localctx, 1)
@@ -1986,13 +2148,18 @@ func (p *CELParser) Unary() (localctx IUnaryContext) {
 			p.member(0)
 		}
 
+
 	case 2:
 		localctx = NewLogicalNotContext(p, localctx)
 		p.EnterOuterAlt(localctx, 2)
 		p.SetState(86)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		for ok := true; ok; ok = _la == CELParserEXCLAM {
 			{
 				p.SetState(85)
@@ -2000,11 +2167,19 @@ func (p *CELParser) Unary() (localctx IUnaryContext) {
 				var _m = p.Match(CELParserEXCLAM)
 
 				localctx.(*LogicalNotContext).s19 = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			localctx.(*LogicalNotContext).ops = append(localctx.(*LogicalNotContext).ops, localctx.(*LogicalNotContext).s19)
 
+
 			p.SetState(88)
 			p.GetErrorHandler().Sync(p)
+			if p.HasError() {
+		    	goto errorExit
+		    }
 			_la = p.GetTokenStream().LA(1)
 		}
 		{
@@ -2012,42 +2187,71 @@ func (p *CELParser) Unary() (localctx IUnaryContext) {
 			p.member(0)
 		}
 
+
 	case 3:
 		localctx = NewNegateContext(p, localctx)
 		p.EnterOuterAlt(localctx, 3)
 		p.SetState(92)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_alt = 1
 		for ok := true; ok; ok = _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 			switch _alt {
 			case 1:
-				{
-					p.SetState(91)
+					{
+						p.SetState(91)
+
+						var _m = p.Match(CELParserMINUS)
+
+						localctx.(*NegateContext).s18 = _m
+						if p.HasError() {
+								// Recognition error - abort rule
+								goto errorExit
+						}
+					}
+					localctx.(*NegateContext).ops = append(localctx.(*NegateContext).ops, localctx.(*NegateContext).s18)
+
 
-					var _m = p.Match(CELParserMINUS)
 
-					localctx.(*NegateContext).s18 = _m
-				}
-				localctx.(*NegateContext).ops = append(localctx.(*NegateContext).ops, localctx.(*NegateContext).s18)
 
 			default:
-				panic(antlr.NewNoViableAltException(p, nil, nil, nil, nil, nil))
+				p.SetError(antlr.NewNoViableAltException(p, nil, nil, nil, nil, nil))
+				goto errorExit
 			}
 
 			p.SetState(94)
 			p.GetErrorHandler().Sync(p)
-			_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 7, p.GetParserRuleContext())
+			_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 7, p.GetParserRuleContext())
+			if p.HasError() {
+				goto errorExit
+			}
 		}
 		{
 			p.SetState(96)
 			p.member(0)
 		}
 
+	case antlr.ATNInvalidAltNumber:
+		goto errorExit
 	}
 
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IMemberContext is an interface to support dynamic dispatch.
 type IMemberContext interface {
 	antlr.ParserRuleContext
@@ -2059,23 +2263,28 @@ type IMemberContext interface {
 }
 
 type MemberContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
 }
 
 func NewEmptyMemberContext() *MemberContext {
 	var p = new(MemberContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_member
 	return p
 }
 
+func InitEmptyMemberContext(p *MemberContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_member
+}
+
 func (*MemberContext) IsMemberContext() {}
 
 func NewMemberContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *MemberContext {
 	var p = new(MemberContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_member
@@ -2085,8 +2294,8 @@ func NewMemberContext(parser antlr.Parser, parent antlr.ParserRuleContext, invok
 
 func (s *MemberContext) GetParser() antlr.Parser { return s.parser }
 
-func (s *MemberContext) CopyFrom(ctx *MemberContext) {
-	s.BaseParserRuleContext.CopyFrom(ctx.BaseParserRuleContext)
+func (s *MemberContext) CopyAll(ctx *MemberContext) {
+	s.CopyFrom(&ctx.BaseParserRuleContext)
 }
 
 func (s *MemberContext) GetRuleContext() antlr.RuleContext {
@@ -2097,38 +2306,46 @@ func (s *MemberContext) ToStringTree(ruleNames []string, recog antlr.Recognizer)
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
+
+
+
 type MemberCallContext struct {
-	*MemberContext
-	op   antlr.Token
-	id   antlr.Token
+	MemberContext
+	op antlr.Token
+	id antlr.Token
 	open antlr.Token
-	args IExprListContext
+	args IExprListContext 
 }
 
 func NewMemberCallContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *MemberCallContext {
 	var p = new(MemberCallContext)
 
-	p.MemberContext = NewEmptyMemberContext()
+	InitEmptyMemberContext(&p.MemberContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*MemberContext))
+	p.CopyAll(ctx.(*MemberContext))
 
 	return p
 }
 
+
 func (s *MemberCallContext) GetOp() antlr.Token { return s.op }
 
 func (s *MemberCallContext) GetId() antlr.Token { return s.id }
 
 func (s *MemberCallContext) GetOpen() antlr.Token { return s.open }
 
+
 func (s *MemberCallContext) SetOp(v antlr.Token) { s.op = v }
 
 func (s *MemberCallContext) SetId(v antlr.Token) { s.id = v }
 
 func (s *MemberCallContext) SetOpen(v antlr.Token) { s.open = v }
 
+
 func (s *MemberCallContext) GetArgs() IExprListContext { return s.args }
 
+
 func (s *MemberCallContext) SetArgs(v IExprListContext) { s.args = v }
 
 func (s *MemberCallContext) GetRuleContext() antlr.RuleContext {
@@ -2136,10 +2353,10 @@ func (s *MemberCallContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *MemberCallContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2168,10 +2385,10 @@ func (s *MemberCallContext) LPAREN() antlr.TerminalNode {
 }
 
 func (s *MemberCallContext) ExprList() IExprListContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprListContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2183,6 +2400,7 @@ func (s *MemberCallContext) ExprList() IExprListContext {
 	return t.(IExprListContext)
 }
 
+
 func (s *MemberCallContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterMemberCall(s)
@@ -2205,29 +2423,32 @@ func (s *MemberCallContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type SelectContext struct {
-	*MemberContext
-	op  antlr.Token
+	MemberContext
+	op antlr.Token
 	opt antlr.Token
-	id  antlr.Token
+	id antlr.Token
 }
 
 func NewSelectContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *SelectContext {
 	var p = new(SelectContext)
 
-	p.MemberContext = NewEmptyMemberContext()
+	InitEmptyMemberContext(&p.MemberContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*MemberContext))
+	p.CopyAll(ctx.(*MemberContext))
 
 	return p
 }
 
+
 func (s *SelectContext) GetOp() antlr.Token { return s.op }
 
 func (s *SelectContext) GetOpt() antlr.Token { return s.opt }
 
 func (s *SelectContext) GetId() antlr.Token { return s.id }
 
+
 func (s *SelectContext) SetOp(v antlr.Token) { s.op = v }
 
 func (s *SelectContext) SetOpt(v antlr.Token) { s.opt = v }
@@ -2239,10 +2460,10 @@ func (s *SelectContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *SelectContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2266,6 +2487,7 @@ func (s *SelectContext) QUESTIONMARK() antlr.TerminalNode {
 	return s.GetToken(CELParserQUESTIONMARK, 0)
 }
 
+
 func (s *SelectContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterSelect(s)
@@ -2288,16 +2510,17 @@ func (s *SelectContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type PrimaryExprContext struct {
-	*MemberContext
+	MemberContext
 }
 
 func NewPrimaryExprContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *PrimaryExprContext {
 	var p = new(PrimaryExprContext)
 
-	p.MemberContext = NewEmptyMemberContext()
+	InitEmptyMemberContext(&p.MemberContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*MemberContext))
+	p.CopyAll(ctx.(*MemberContext))
 
 	return p
 }
@@ -2307,10 +2530,10 @@ func (s *PrimaryExprContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *PrimaryExprContext) Primary() IPrimaryContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IPrimaryContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2322,6 +2545,7 @@ func (s *PrimaryExprContext) Primary() IPrimaryContext {
 	return t.(IPrimaryContext)
 }
 
+
 func (s *PrimaryExprContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterPrimaryExpr(s)
@@ -2344,33 +2568,38 @@ func (s *PrimaryExprContext) Accept(visitor antlr.ParseTreeVisitor) interface{}
 	}
 }
 
+
 type IndexContext struct {
-	*MemberContext
-	op    antlr.Token
-	opt   antlr.Token
-	index IExprContext
+	MemberContext
+	op antlr.Token
+	opt antlr.Token
+	index IExprContext 
 }
 
 func NewIndexContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *IndexContext {
 	var p = new(IndexContext)
 
-	p.MemberContext = NewEmptyMemberContext()
+	InitEmptyMemberContext(&p.MemberContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*MemberContext))
+	p.CopyAll(ctx.(*MemberContext))
 
 	return p
 }
 
+
 func (s *IndexContext) GetOp() antlr.Token { return s.op }
 
 func (s *IndexContext) GetOpt() antlr.Token { return s.opt }
 
+
 func (s *IndexContext) SetOp(v antlr.Token) { s.op = v }
 
 func (s *IndexContext) SetOpt(v antlr.Token) { s.opt = v }
 
+
 func (s *IndexContext) GetIndex() IExprContext { return s.index }
 
+
 func (s *IndexContext) SetIndex(v IExprContext) { s.index = v }
 
 func (s *IndexContext) GetRuleContext() antlr.RuleContext {
@@ -2378,10 +2607,10 @@ func (s *IndexContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *IndexContext) Member() IMemberContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMemberContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2402,10 +2631,10 @@ func (s *IndexContext) LBRACKET() antlr.TerminalNode {
 }
 
 func (s *IndexContext) Expr() IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2421,6 +2650,7 @@ func (s *IndexContext) QUESTIONMARK() antlr.TerminalNode {
 	return s.GetToken(CELParserQUESTIONMARK, 0)
 }
 
+
 func (s *IndexContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterIndex(s)
@@ -2443,15 +2673,15 @@ func (s *IndexContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
+
 func (p *CELParser) Member() (localctx IMemberContext) {
 	return p.member(0)
 }
 
 func (p *CELParser) member(_p int) (localctx IMemberContext) {
-	this := p
-	_ = this
-
 	var _parentctx antlr.ParserRuleContext = p.GetParserRuleContext()
+
 	_parentState := p.GetState()
 	localctx = NewMemberContext(p, p.GetParserRuleContext(), _parentState)
 	var _prevctx IMemberContext = localctx
@@ -2460,22 +2690,6 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 	p.EnterRecursionRule(localctx, 14, CELParserRULE_member, _p)
 	var _la int
 
-	defer func() {
-		p.UnrollRecursionContexts(_parentctx)
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -2491,8 +2705,13 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 	p.GetParserRuleContext().SetStop(p.GetTokenStream().LT(-1))
 	p.SetState(126)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 13, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 13, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			if p.GetParseListeners() != nil {
@@ -2501,14 +2720,19 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 			_prevctx = localctx
 			p.SetState(124)
 			p.GetErrorHandler().Sync(p)
-			switch p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 12, p.GetParserRuleContext()) {
+			if p.HasError() {
+				goto errorExit
+			}
+
+			switch p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 12, p.GetParserRuleContext()) {
 			case 1:
 				localctx = NewSelectContext(p, NewMemberContext(p, _parentctx, _parentState))
 				p.PushNewRecursionContext(localctx, _startState, CELParserRULE_member)
 				p.SetState(102)
 
 				if !(p.Precpred(p.GetParserRuleContext(), 3)) {
-					panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 3)", ""))
+					p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 3)", ""))
+					goto errorExit
 				}
 				{
 					p.SetState(103)
@@ -2516,11 +2740,19 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserDOT)
 
 					localctx.(*SelectContext).op = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 				p.SetState(105)
 				p.GetErrorHandler().Sync(p)
+				if p.HasError() {
+					goto errorExit
+				}
 				_la = p.GetTokenStream().LA(1)
 
+
 				if _la == CELParserQUESTIONMARK {
 					{
 						p.SetState(104)
@@ -2528,6 +2760,10 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 						var _m = p.Match(CELParserQUESTIONMARK)
 
 						localctx.(*SelectContext).opt = _m
+						if p.HasError() {
+								// Recognition error - abort rule
+								goto errorExit
+						}
 					}
 
 				}
@@ -2537,15 +2773,21 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserIDENTIFIER)
 
 					localctx.(*SelectContext).id = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 
+
 			case 2:
 				localctx = NewMemberCallContext(p, NewMemberContext(p, _parentctx, _parentState))
 				p.PushNewRecursionContext(localctx, _startState, CELParserRULE_member)
 				p.SetState(108)
 
 				if !(p.Precpred(p.GetParserRuleContext(), 2)) {
-					panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 2)", ""))
+					p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 2)", ""))
+					goto errorExit
 				}
 				{
 					p.SetState(109)
@@ -2553,6 +2795,10 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserDOT)
 
 					localctx.(*MemberCallContext).op = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 				{
 					p.SetState(110)
@@ -2560,6 +2806,10 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserIDENTIFIER)
 
 					localctx.(*MemberCallContext).id = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 				{
 					p.SetState(111)
@@ -2567,17 +2817,26 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserLPAREN)
 
 					localctx.(*MemberCallContext).open = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 				p.SetState(113)
 				p.GetErrorHandler().Sync(p)
+				if p.HasError() {
+					goto errorExit
+				}
 				_la = p.GetTokenStream().LA(1)
 
-				if (int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&135762105344) != 0 {
+
+				if ((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 135762105344) != 0) {
 					{
 						p.SetState(112)
 
 						var _x = p.ExprList()
 
+
 						localctx.(*MemberCallContext).args = _x
 					}
 
@@ -2585,15 +2844,21 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 				{
 					p.SetState(115)
 					p.Match(CELParserRPAREN)
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 
+
 			case 3:
 				localctx = NewIndexContext(p, NewMemberContext(p, _parentctx, _parentState))
 				p.PushNewRecursionContext(localctx, _startState, CELParserRULE_member)
 				p.SetState(116)
 
 				if !(p.Precpred(p.GetParserRuleContext(), 1)) {
-					panic(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+					p.SetError(antlr.NewFailedPredicateException(p, "p.Precpred(p.GetParserRuleContext(), 1)", ""))
+					goto errorExit
 				}
 				{
 					p.SetState(117)
@@ -2601,11 +2866,19 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 					var _m = p.Match(CELParserLBRACKET)
 
 					localctx.(*IndexContext).op = _m
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 				p.SetState(119)
 				p.GetErrorHandler().Sync(p)
+				if p.HasError() {
+					goto errorExit
+				}
 				_la = p.GetTokenStream().LA(1)
 
+
 				if _la == CELParserQUESTIONMARK {
 					{
 						p.SetState(118)
@@ -2613,6 +2886,10 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 						var _m = p.Match(CELParserQUESTIONMARK)
 
 						localctx.(*IndexContext).opt = _m
+						if p.HasError() {
+								// Recognition error - abort rule
+								goto errorExit
+						}
 					}
 
 				}
@@ -2621,24 +2898,50 @@ func (p *CELParser) member(_p int) (localctx IMemberContext) {
 
 					var _x = p.Expr()
 
+
 					localctx.(*IndexContext).index = _x
 				}
 				{
 					p.SetState(122)
 					p.Match(CELParserRPRACKET)
+					if p.HasError() {
+							// Recognition error - abort rule
+							goto errorExit
+					}
 				}
 
+			case antlr.ATNInvalidAltNumber:
+				goto errorExit
 			}
 
 		}
 		p.SetState(128)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 13, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 13, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+	errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.UnrollRecursionContexts(_parentctx)
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IPrimaryContext is an interface to support dynamic dispatch.
 type IPrimaryContext interface {
 	antlr.ParserRuleContext
@@ -2650,23 +2953,28 @@ type IPrimaryContext interface {
 }
 
 type PrimaryContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
 }
 
 func NewEmptyPrimaryContext() *PrimaryContext {
 	var p = new(PrimaryContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_primary
 	return p
 }
 
+func InitEmptyPrimaryContext(p *PrimaryContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_primary
+}
+
 func (*PrimaryContext) IsPrimaryContext() {}
 
 func NewPrimaryContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *PrimaryContext {
 	var p = new(PrimaryContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_primary
@@ -2676,8 +2984,8 @@ func NewPrimaryContext(parser antlr.Parser, parent antlr.ParserRuleContext, invo
 
 func (s *PrimaryContext) GetParser() antlr.Parser { return s.parser }
 
-func (s *PrimaryContext) CopyFrom(ctx *PrimaryContext) {
-	s.BaseParserRuleContext.CopyFrom(ctx.BaseParserRuleContext)
+func (s *PrimaryContext) CopyAll(ctx *PrimaryContext) {
+	s.CopyFrom(&ctx.BaseParserRuleContext)
 }
 
 func (s *PrimaryContext) GetRuleContext() antlr.RuleContext {
@@ -2688,28 +2996,35 @@ func (s *PrimaryContext) ToStringTree(ruleNames []string, recog antlr.Recognizer
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
+
+
 type CreateListContext struct {
-	*PrimaryContext
-	op    antlr.Token
-	elems IListInitContext
+	PrimaryContext
+	op antlr.Token
+	elems IListInitContext 
 }
 
 func NewCreateListContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *CreateListContext {
 	var p = new(CreateListContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
 
+
 func (s *CreateListContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *CreateListContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *CreateListContext) GetElems() IListInitContext { return s.elems }
 
+
 func (s *CreateListContext) SetElems(v IListInitContext) { s.elems = v }
 
 func (s *CreateListContext) GetRuleContext() antlr.RuleContext {
@@ -2729,10 +3044,10 @@ func (s *CreateListContext) COMMA() antlr.TerminalNode {
 }
 
 func (s *CreateListContext) ListInit() IListInitContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IListInitContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2744,6 +3059,7 @@ func (s *CreateListContext) ListInit() IListInitContext {
 	return t.(IListInitContext)
 }
 
+
 func (s *CreateListContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterCreateList(s)
@@ -2766,28 +3082,33 @@ func (s *CreateListContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type CreateStructContext struct {
-	*PrimaryContext
-	op      antlr.Token
-	entries IMapInitializerListContext
+	PrimaryContext
+	op antlr.Token
+	entries IMapInitializerListContext 
 }
 
 func NewCreateStructContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *CreateStructContext {
 	var p = new(CreateStructContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
 
+
 func (s *CreateStructContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *CreateStructContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *CreateStructContext) GetEntries() IMapInitializerListContext { return s.entries }
 
+
 func (s *CreateStructContext) SetEntries(v IMapInitializerListContext) { s.entries = v }
 
 func (s *CreateStructContext) GetRuleContext() antlr.RuleContext {
@@ -2807,10 +3128,10 @@ func (s *CreateStructContext) COMMA() antlr.TerminalNode {
 }
 
 func (s *CreateStructContext) MapInitializerList() IMapInitializerListContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IMapInitializerListContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2822,6 +3143,7 @@ func (s *CreateStructContext) MapInitializerList() IMapInitializerListContext {
 	return t.(IMapInitializerListContext)
 }
 
+
 func (s *CreateStructContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterCreateStruct(s)
@@ -2844,16 +3166,17 @@ func (s *CreateStructContext) Accept(visitor antlr.ParseTreeVisitor) interface{}
 	}
 }
 
+
 type ConstantLiteralContext struct {
-	*PrimaryContext
+	PrimaryContext
 }
 
 func NewConstantLiteralContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *ConstantLiteralContext {
 	var p = new(ConstantLiteralContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
@@ -2863,10 +3186,10 @@ func (s *ConstantLiteralContext) GetRuleContext() antlr.RuleContext {
 }
 
 func (s *ConstantLiteralContext) Literal() ILiteralContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(ILiteralContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2878,6 +3201,7 @@ func (s *ConstantLiteralContext) Literal() ILiteralContext {
 	return t.(ILiteralContext)
 }
 
+
 func (s *ConstantLiteralContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterConstantLiteral(s)
@@ -2900,23 +3224,26 @@ func (s *ConstantLiteralContext) Accept(visitor antlr.ParseTreeVisitor) interfac
 	}
 }
 
+
 type NestedContext struct {
-	*PrimaryContext
-	e IExprContext
+	PrimaryContext
+	e IExprContext 
 }
 
 func NewNestedContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *NestedContext {
 	var p = new(NestedContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
 
+
 func (s *NestedContext) GetE() IExprContext { return s.e }
 
+
 func (s *NestedContext) SetE(v IExprContext) { s.e = v }
 
 func (s *NestedContext) GetRuleContext() antlr.RuleContext {
@@ -2932,10 +3259,10 @@ func (s *NestedContext) RPAREN() antlr.TerminalNode {
 }
 
 func (s *NestedContext) Expr() IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -2947,6 +3274,7 @@ func (s *NestedContext) Expr() IExprContext {
 	return t.(IExprContext)
 }
 
+
 func (s *NestedContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterNested(s)
@@ -2969,27 +3297,29 @@ func (s *NestedContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type CreateMessageContext struct {
-	*PrimaryContext
-	leadingDot  antlr.Token
+	PrimaryContext
+	leadingDot antlr.Token
 	_IDENTIFIER antlr.Token
-	ids         []antlr.Token
-	s16         antlr.Token
-	ops         []antlr.Token
-	op          antlr.Token
-	entries     IFieldInitializerListContext
+	ids []antlr.Token
+	s16 antlr.Token
+	ops []antlr.Token
+	op antlr.Token
+	entries IFieldInitializerListContext 
 }
 
 func NewCreateMessageContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *CreateMessageContext {
 	var p = new(CreateMessageContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
 
+
 func (s *CreateMessageContext) GetLeadingDot() antlr.Token { return s.leadingDot }
 
 func (s *CreateMessageContext) Get_IDENTIFIER() antlr.Token { return s._IDENTIFIER }
@@ -2998,6 +3328,7 @@ func (s *CreateMessageContext) GetS16() antlr.Token { return s.s16 }
 
 func (s *CreateMessageContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *CreateMessageContext) SetLeadingDot(v antlr.Token) { s.leadingDot = v }
 
 func (s *CreateMessageContext) Set_IDENTIFIER(v antlr.Token) { s._IDENTIFIER = v }
@@ -3006,16 +3337,20 @@ func (s *CreateMessageContext) SetS16(v antlr.Token) { s.s16 = v }
 
 func (s *CreateMessageContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *CreateMessageContext) GetIds() []antlr.Token { return s.ids }
 
 func (s *CreateMessageContext) GetOps() []antlr.Token { return s.ops }
 
+
 func (s *CreateMessageContext) SetIds(v []antlr.Token) { s.ids = v }
 
 func (s *CreateMessageContext) SetOps(v []antlr.Token) { s.ops = v }
 
+
 func (s *CreateMessageContext) GetEntries() IFieldInitializerListContext { return s.entries }
 
+
 func (s *CreateMessageContext) SetEntries(v IFieldInitializerListContext) { s.entries = v }
 
 func (s *CreateMessageContext) GetRuleContext() antlr.RuleContext {
@@ -3051,10 +3386,10 @@ func (s *CreateMessageContext) DOT(i int) antlr.TerminalNode {
 }
 
 func (s *CreateMessageContext) FieldInitializerList() IFieldInitializerListContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IFieldInitializerListContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -3066,6 +3401,7 @@ func (s *CreateMessageContext) FieldInitializerList() IFieldInitializerListConte
 	return t.(IFieldInitializerListContext)
 }
 
+
 func (s *CreateMessageContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterCreateMessage(s)
@@ -3088,38 +3424,43 @@ func (s *CreateMessageContext) Accept(visitor antlr.ParseTreeVisitor) interface{
 	}
 }
 
+
 type IdentOrGlobalCallContext struct {
-	*PrimaryContext
+	PrimaryContext
 	leadingDot antlr.Token
-	id         antlr.Token
-	op         antlr.Token
-	args       IExprListContext
+	id antlr.Token
+	op antlr.Token
+	args IExprListContext 
 }
 
 func NewIdentOrGlobalCallContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *IdentOrGlobalCallContext {
 	var p = new(IdentOrGlobalCallContext)
 
-	p.PrimaryContext = NewEmptyPrimaryContext()
+	InitEmptyPrimaryContext(&p.PrimaryContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*PrimaryContext))
+	p.CopyAll(ctx.(*PrimaryContext))
 
 	return p
 }
 
+
 func (s *IdentOrGlobalCallContext) GetLeadingDot() antlr.Token { return s.leadingDot }
 
 func (s *IdentOrGlobalCallContext) GetId() antlr.Token { return s.id }
 
 func (s *IdentOrGlobalCallContext) GetOp() antlr.Token { return s.op }
 
+
 func (s *IdentOrGlobalCallContext) SetLeadingDot(v antlr.Token) { s.leadingDot = v }
 
 func (s *IdentOrGlobalCallContext) SetId(v antlr.Token) { s.id = v }
 
 func (s *IdentOrGlobalCallContext) SetOp(v antlr.Token) { s.op = v }
 
+
 func (s *IdentOrGlobalCallContext) GetArgs() IExprListContext { return s.args }
 
+
 func (s *IdentOrGlobalCallContext) SetArgs(v IExprListContext) { s.args = v }
 
 func (s *IdentOrGlobalCallContext) GetRuleContext() antlr.RuleContext {
@@ -3143,10 +3484,10 @@ func (s *IdentOrGlobalCallContext) LPAREN() antlr.TerminalNode {
 }
 
 func (s *IdentOrGlobalCallContext) ExprList() IExprListContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprListContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -3158,6 +3499,7 @@ func (s *IdentOrGlobalCallContext) ExprList() IExprListContext {
 	return t.(IExprListContext)
 }
 
+
 func (s *IdentOrGlobalCallContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterIdentOrGlobalCall(s)
@@ -3180,40 +3522,31 @@ func (s *IdentOrGlobalCallContext) Accept(visitor antlr.ParseTreeVisitor) interf
 	}
 }
 
-func (p *CELParser) Primary() (localctx IPrimaryContext) {
-	this := p
-	_ = this
 
+
+func (p *CELParser) Primary() (localctx IPrimaryContext) {
 	localctx = NewPrimaryContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 16, CELParserRULE_primary)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.SetState(180)
 	p.GetErrorHandler().Sync(p)
-	switch p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 25, p.GetParserRuleContext()) {
+	if p.HasError() {
+		goto errorExit
+	}
+
+	switch p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 25, p.GetParserRuleContext()) {
 	case 1:
 		localctx = NewIdentOrGlobalCallContext(p, localctx)
 		p.EnterOuterAlt(localctx, 1)
 		p.SetState(130)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserDOT {
 			{
 				p.SetState(129)
@@ -3221,6 +3554,10 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 				var _m = p.Match(CELParserDOT)
 
 				localctx.(*IdentOrGlobalCallContext).leadingDot = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
@@ -3230,28 +3567,42 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			var _m = p.Match(CELParserIDENTIFIER)
 
 			localctx.(*IdentOrGlobalCallContext).id = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		p.SetState(138)
 		p.GetErrorHandler().Sync(p)
 
-		if p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 16, p.GetParserRuleContext()) == 1 {
+
+		if p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 16, p.GetParserRuleContext()) == 1 {
 			{
 				p.SetState(133)
 
 				var _m = p.Match(CELParserLPAREN)
 
 				localctx.(*IdentOrGlobalCallContext).op = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			p.SetState(135)
 			p.GetErrorHandler().Sync(p)
+			if p.HasError() {
+				goto errorExit
+			}
 			_la = p.GetTokenStream().LA(1)
 
-			if (int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&135762105344) != 0 {
+
+			if ((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 135762105344) != 0) {
 				{
 					p.SetState(134)
 
 					var _x = p.ExprList()
 
+
 					localctx.(*IdentOrGlobalCallContext).args = _x
 				}
 
@@ -3259,29 +3610,46 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			{
 				p.SetState(137)
 				p.Match(CELParserRPAREN)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
+			} else if p.HasError() { // JIM
+				goto errorExit
 		}
 
+
 	case 2:
 		localctx = NewNestedContext(p, localctx)
 		p.EnterOuterAlt(localctx, 2)
 		{
 			p.SetState(140)
 			p.Match(CELParserLPAREN)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		{
 			p.SetState(141)
 
 			var _x = p.Expr()
 
+
 			localctx.(*NestedContext).e = _x
 		}
 		{
 			p.SetState(142)
 			p.Match(CELParserRPAREN)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 3:
 		localctx = NewCreateListContext(p, localctx)
 		p.EnterOuterAlt(localctx, 3)
@@ -3291,37 +3659,59 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			var _m = p.Match(CELParserLBRACKET)
 
 			localctx.(*CreateListContext).op = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		p.SetState(146)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
-		if (int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&135763153920) != 0 {
+
+		if ((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 135763153920) != 0) {
 			{
 				p.SetState(145)
 
 				var _x = p.ListInit()
 
+
 				localctx.(*CreateListContext).elems = _x
 			}
 
 		}
 		p.SetState(149)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserCOMMA {
 			{
 				p.SetState(148)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
 		{
 			p.SetState(151)
 			p.Match(CELParserRPRACKET)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 4:
 		localctx = NewCreateStructContext(p, localctx)
 		p.EnterOuterAlt(localctx, 4)
@@ -3331,44 +3721,70 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			var _m = p.Match(CELParserLBRACE)
 
 			localctx.(*CreateStructContext).op = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		p.SetState(154)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
-		if (int64(_la) & ^0x3f) == 0 && ((int64(1)<<_la)&135763153920) != 0 {
+
+		if ((int64(_la) & ^0x3f) == 0 && ((int64(1) << _la) & 135763153920) != 0) {
 			{
 				p.SetState(153)
 
 				var _x = p.MapInitializerList()
 
+
 				localctx.(*CreateStructContext).entries = _x
 			}
 
 		}
 		p.SetState(157)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserCOMMA {
 			{
 				p.SetState(156)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
 		{
 			p.SetState(159)
 			p.Match(CELParserRBRACE)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 5:
 		localctx = NewCreateMessageContext(p, localctx)
 		p.EnterOuterAlt(localctx, 5)
 		p.SetState(161)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserDOT {
 			{
 				p.SetState(160)
@@ -3376,6 +3792,10 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 				var _m = p.Match(CELParserDOT)
 
 				localctx.(*CreateMessageContext).leadingDot = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
@@ -3385,12 +3805,20 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			var _m = p.Match(CELParserIDENTIFIER)
 
 			localctx.(*CreateMessageContext)._IDENTIFIER = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		localctx.(*CreateMessageContext).ids = append(localctx.(*CreateMessageContext).ids, localctx.(*CreateMessageContext)._IDENTIFIER)
 		p.SetState(168)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		for _la == CELParserDOT {
 			{
 				p.SetState(164)
@@ -3398,6 +3826,10 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 				var _m = p.Match(CELParserDOT)
 
 				localctx.(*CreateMessageContext).s16 = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			localctx.(*CreateMessageContext).ops = append(localctx.(*CreateMessageContext).ops, localctx.(*CreateMessageContext).s16)
 			{
@@ -3406,11 +3838,19 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 				var _m = p.Match(CELParserIDENTIFIER)
 
 				localctx.(*CreateMessageContext)._IDENTIFIER = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			localctx.(*CreateMessageContext).ids = append(localctx.(*CreateMessageContext).ids, localctx.(*CreateMessageContext)._IDENTIFIER)
 
+
 			p.SetState(170)
 			p.GetErrorHandler().Sync(p)
+			if p.HasError() {
+		    	goto errorExit
+		    }
 			_la = p.GetTokenStream().LA(1)
 		}
 		{
@@ -3419,37 +3859,59 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			var _m = p.Match(CELParserLBRACE)
 
 			localctx.(*CreateMessageContext).op = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		p.SetState(173)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserQUESTIONMARK || _la == CELParserIDENTIFIER {
 			{
 				p.SetState(172)
 
 				var _x = p.FieldInitializerList()
 
+
 				localctx.(*CreateMessageContext).entries = _x
 			}
 
 		}
 		p.SetState(176)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserCOMMA {
 			{
 				p.SetState(175)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
 		{
 			p.SetState(178)
 			p.Match(CELParserRBRACE)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 6:
 		localctx = NewConstantLiteralContext(p, localctx)
 		p.EnterOuterAlt(localctx, 6)
@@ -3458,11 +3920,25 @@ func (p *CELParser) Primary() (localctx IPrimaryContext) {
 			p.Literal()
 		}
 
+	case antlr.ATNInvalidAltNumber:
+		goto errorExit
 	}
 
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IExprListContext is an interface to support dynamic dispatch.
 type IExprListContext interface {
 	antlr.ParserRuleContext
@@ -3473,14 +3949,18 @@ type IExprListContext interface {
 	// Get_expr returns the _expr rule contexts.
 	Get_expr() IExprContext
 
+
 	// Set_expr sets the _expr rule contexts.
 	Set_expr(IExprContext)
 
+
 	// GetE returns the e rule context list.
 	GetE() []IExprContext
 
+
 	// SetE sets the e rule context list.
-	SetE([]IExprContext)
+	SetE([]IExprContext) 
+
 
 	// Getter signatures
 	AllExpr() []IExprContext
@@ -3493,25 +3973,30 @@ type IExprListContext interface {
 }
 
 type ExprListContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	_expr  IExprContext
-	e      []IExprContext
+	_expr IExprContext 
+	e []IExprContext
 }
 
 func NewEmptyExprListContext() *ExprListContext {
 	var p = new(ExprListContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_exprList
 	return p
 }
 
+func InitEmptyExprListContext(p *ExprListContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_exprList
+}
+
 func (*ExprListContext) IsExprListContext() {}
 
 func NewExprListContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *ExprListContext {
 	var p = new(ExprListContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_exprList
@@ -3523,12 +4008,16 @@ func (s *ExprListContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *ExprListContext) Get_expr() IExprContext { return s._expr }
 
+
 func (s *ExprListContext) Set_expr(v IExprContext) { s._expr = v }
 
+
 func (s *ExprListContext) GetE() []IExprContext { return s.e }
 
+
 func (s *ExprListContext) SetE(v []IExprContext) { s.e = v }
 
+
 func (s *ExprListContext) AllExpr() []IExprContext {
 	children := s.GetChildren()
 	len := 0
@@ -3551,12 +4040,12 @@ func (s *ExprListContext) AllExpr() []IExprContext {
 }
 
 func (s *ExprListContext) Expr(i int) IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -3586,6 +4075,7 @@ func (s *ExprListContext) ToStringTree(ruleNames []string, recog antlr.Recognize
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *ExprListContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterExprList(s)
@@ -3608,65 +4098,76 @@ func (s *ExprListContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) ExprList() (localctx IExprListContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) ExprList() (localctx IExprListContext) {
 	localctx = NewExprListContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 18, CELParserRULE_exprList)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	{
 		p.SetState(182)
 
 		var _x = p.Expr()
 
+
 		localctx.(*ExprListContext)._expr = _x
 	}
 	localctx.(*ExprListContext).e = append(localctx.(*ExprListContext).e, localctx.(*ExprListContext)._expr)
 	p.SetState(187)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	for _la == CELParserCOMMA {
 		{
 			p.SetState(183)
 			p.Match(CELParserCOMMA)
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 		{
 			p.SetState(184)
 
 			var _x = p.Expr()
 
+
 			localctx.(*ExprListContext)._expr = _x
 		}
 		localctx.(*ExprListContext).e = append(localctx.(*ExprListContext).e, localctx.(*ExprListContext)._expr)
 
+
 		p.SetState(189)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+	    	goto errorExit
+	    }
 		_la = p.GetTokenStream().LA(1)
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IListInitContext is an interface to support dynamic dispatch.
 type IListInitContext interface {
 	antlr.ParserRuleContext
@@ -3677,14 +4178,18 @@ type IListInitContext interface {
 	// Get_optExpr returns the _optExpr rule contexts.
 	Get_optExpr() IOptExprContext
 
+
 	// Set_optExpr sets the _optExpr rule contexts.
 	Set_optExpr(IOptExprContext)
 
+
 	// GetElems returns the elems rule context list.
 	GetElems() []IOptExprContext
 
+
 	// SetElems sets the elems rule context list.
-	SetElems([]IOptExprContext)
+	SetElems([]IOptExprContext) 
+
 
 	// Getter signatures
 	AllOptExpr() []IOptExprContext
@@ -3697,25 +4202,30 @@ type IListInitContext interface {
 }
 
 type ListInitContext struct {
-	*antlr.BaseParserRuleContext
-	parser   antlr.Parser
-	_optExpr IOptExprContext
-	elems    []IOptExprContext
+	antlr.BaseParserRuleContext
+	parser antlr.Parser
+	_optExpr IOptExprContext 
+	elems []IOptExprContext
 }
 
 func NewEmptyListInitContext() *ListInitContext {
 	var p = new(ListInitContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_listInit
 	return p
 }
 
+func InitEmptyListInitContext(p *ListInitContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_listInit
+}
+
 func (*ListInitContext) IsListInitContext() {}
 
 func NewListInitContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *ListInitContext {
 	var p = new(ListInitContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_listInit
@@ -3727,12 +4237,16 @@ func (s *ListInitContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *ListInitContext) Get_optExpr() IOptExprContext { return s._optExpr }
 
+
 func (s *ListInitContext) Set_optExpr(v IOptExprContext) { s._optExpr = v }
 
+
 func (s *ListInitContext) GetElems() []IOptExprContext { return s.elems }
 
+
 func (s *ListInitContext) SetElems(v []IOptExprContext) { s.elems = v }
 
+
 func (s *ListInitContext) AllOptExpr() []IOptExprContext {
 	children := s.GetChildren()
 	len := 0
@@ -3755,12 +4269,12 @@ func (s *ListInitContext) AllOptExpr() []IOptExprContext {
 }
 
 func (s *ListInitContext) OptExpr(i int) IOptExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IOptExprContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -3790,6 +4304,7 @@ func (s *ListInitContext) ToStringTree(ruleNames []string, recog antlr.Recognize
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *ListInitContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterListInit(s)
@@ -3812,29 +4327,12 @@ func (s *ListInitContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) ListInit() (localctx IListInitContext) {
-	this := p
-	_ = this
 
-	localctx = NewListInitContext(p, p.GetParserRuleContext(), p.GetState())
-	p.EnterRule(localctx, 20, CELParserRULE_listInit)
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
 
+func (p *CELParser) ListInit() (localctx IListInitContext) {
+	localctx = NewListInitContext(p, p.GetParserRuleContext(), p.GetState())
+	p.EnterRule(localctx, 20, CELParserRULE_listInit)
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -3843,37 +4341,68 @@ func (p *CELParser) ListInit() (localctx IListInitContext) {
 
 		var _x = p.OptExpr()
 
+
 		localctx.(*ListInitContext)._optExpr = _x
 	}
 	localctx.(*ListInitContext).elems = append(localctx.(*ListInitContext).elems, localctx.(*ListInitContext)._optExpr)
 	p.SetState(195)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 27, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 27, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			{
 				p.SetState(191)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			{
 				p.SetState(192)
 
 				var _x = p.OptExpr()
 
+
 				localctx.(*ListInitContext)._optExpr = _x
 			}
 			localctx.(*ListInitContext).elems = append(localctx.(*ListInitContext).elems, localctx.(*ListInitContext)._optExpr)
 
+
 		}
 		p.SetState(197)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 27, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 27, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IFieldInitializerListContext is an interface to support dynamic dispatch.
 type IFieldInitializerListContext interface {
 	antlr.ParserRuleContext
@@ -3882,40 +4411,48 @@ type IFieldInitializerListContext interface {
 	GetParser() antlr.Parser
 
 	// GetS21 returns the s21 token.
-	GetS21() antlr.Token
+	GetS21() antlr.Token 
+
 
 	// SetS21 sets the s21 token.
-	SetS21(antlr.Token)
+	SetS21(antlr.Token) 
+
 
 	// GetCols returns the cols token list.
 	GetCols() []antlr.Token
 
+
 	// SetCols sets the cols token list.
 	SetCols([]antlr.Token)
 
+
 	// Get_optField returns the _optField rule contexts.
 	Get_optField() IOptFieldContext
 
 	// Get_expr returns the _expr rule contexts.
 	Get_expr() IExprContext
 
+
 	// Set_optField sets the _optField rule contexts.
 	Set_optField(IOptFieldContext)
 
 	// Set_expr sets the _expr rule contexts.
 	Set_expr(IExprContext)
 
+
 	// GetFields returns the fields rule context list.
 	GetFields() []IOptFieldContext
 
 	// GetValues returns the values rule context list.
 	GetValues() []IExprContext
 
+
 	// SetFields sets the fields rule context list.
-	SetFields([]IOptFieldContext)
+	SetFields([]IOptFieldContext) 
 
 	// SetValues sets the values rule context list.
-	SetValues([]IExprContext)
+	SetValues([]IExprContext) 
+
 
 	// Getter signatures
 	AllOptField() []IOptFieldContext
@@ -3932,29 +4469,34 @@ type IFieldInitializerListContext interface {
 }
 
 type FieldInitializerListContext struct {
-	*antlr.BaseParserRuleContext
-	parser    antlr.Parser
-	_optField IOptFieldContext
-	fields    []IOptFieldContext
-	s21       antlr.Token
-	cols      []antlr.Token
-	_expr     IExprContext
-	values    []IExprContext
+	antlr.BaseParserRuleContext
+	parser antlr.Parser
+	_optField IOptFieldContext 
+	fields []IOptFieldContext
+	s21 antlr.Token
+	cols []antlr.Token
+	_expr IExprContext 
+	values []IExprContext
 }
 
 func NewEmptyFieldInitializerListContext() *FieldInitializerListContext {
 	var p = new(FieldInitializerListContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_fieldInitializerList
 	return p
 }
 
+func InitEmptyFieldInitializerListContext(p *FieldInitializerListContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_fieldInitializerList
+}
+
 func (*FieldInitializerListContext) IsFieldInitializerListContext() {}
 
 func NewFieldInitializerListContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *FieldInitializerListContext {
 	var p = new(FieldInitializerListContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_fieldInitializerList
@@ -3966,28 +4508,36 @@ func (s *FieldInitializerListContext) GetParser() antlr.Parser { return s.parser
 
 func (s *FieldInitializerListContext) GetS21() antlr.Token { return s.s21 }
 
+
 func (s *FieldInitializerListContext) SetS21(v antlr.Token) { s.s21 = v }
 
+
 func (s *FieldInitializerListContext) GetCols() []antlr.Token { return s.cols }
 
+
 func (s *FieldInitializerListContext) SetCols(v []antlr.Token) { s.cols = v }
 
+
 func (s *FieldInitializerListContext) Get_optField() IOptFieldContext { return s._optField }
 
 func (s *FieldInitializerListContext) Get_expr() IExprContext { return s._expr }
 
+
 func (s *FieldInitializerListContext) Set_optField(v IOptFieldContext) { s._optField = v }
 
 func (s *FieldInitializerListContext) Set_expr(v IExprContext) { s._expr = v }
 
+
 func (s *FieldInitializerListContext) GetFields() []IOptFieldContext { return s.fields }
 
 func (s *FieldInitializerListContext) GetValues() []IExprContext { return s.values }
 
+
 func (s *FieldInitializerListContext) SetFields(v []IOptFieldContext) { s.fields = v }
 
 func (s *FieldInitializerListContext) SetValues(v []IExprContext) { s.values = v }
 
+
 func (s *FieldInitializerListContext) AllOptField() []IOptFieldContext {
 	children := s.GetChildren()
 	len := 0
@@ -4010,12 +4560,12 @@ func (s *FieldInitializerListContext) AllOptField() []IOptFieldContext {
 }
 
 func (s *FieldInitializerListContext) OptField(i int) IOptFieldContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IOptFieldContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -4059,12 +4609,12 @@ func (s *FieldInitializerListContext) AllExpr() []IExprContext {
 }
 
 func (s *FieldInitializerListContext) Expr(i int) IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -4094,6 +4644,7 @@ func (s *FieldInitializerListContext) ToStringTree(ruleNames []string, recog ant
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *FieldInitializerListContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterFieldInitializerList(s)
@@ -4116,29 +4667,12 @@ func (s *FieldInitializerListContext) Accept(visitor antlr.ParseTreeVisitor) int
 	}
 }
 
-func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContext) {
-	this := p
-	_ = this
 
-	localctx = NewFieldInitializerListContext(p, p.GetParserRuleContext(), p.GetState())
-	p.EnterRule(localctx, 22, CELParserRULE_fieldInitializerList)
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
 
+func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContext) {
+	localctx = NewFieldInitializerListContext(p, p.GetParserRuleContext(), p.GetState())
+	p.EnterRule(localctx, 22, CELParserRULE_fieldInitializerList)
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -4147,6 +4681,7 @@ func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContex
 
 		var _x = p.OptField()
 
+
 		localctx.(*FieldInitializerListContext)._optField = _x
 	}
 	localctx.(*FieldInitializerListContext).fields = append(localctx.(*FieldInitializerListContext).fields, localctx.(*FieldInitializerListContext)._optField)
@@ -4156,6 +4691,10 @@ func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContex
 		var _m = p.Match(CELParserCOLON)
 
 		localctx.(*FieldInitializerListContext).s21 = _m
+		if p.HasError() {
+				// Recognition error - abort rule
+				goto errorExit
+		}
 	}
 	localctx.(*FieldInitializerListContext).cols = append(localctx.(*FieldInitializerListContext).cols, localctx.(*FieldInitializerListContext).s21)
 	{
@@ -4163,24 +4702,35 @@ func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContex
 
 		var _x = p.Expr()
 
+
 		localctx.(*FieldInitializerListContext)._expr = _x
 	}
 	localctx.(*FieldInitializerListContext).values = append(localctx.(*FieldInitializerListContext).values, localctx.(*FieldInitializerListContext)._expr)
 	p.SetState(208)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 28, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 28, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			{
 				p.SetState(201)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			{
 				p.SetState(202)
 
 				var _x = p.OptField()
 
+
 				localctx.(*FieldInitializerListContext)._optField = _x
 			}
 			localctx.(*FieldInitializerListContext).fields = append(localctx.(*FieldInitializerListContext).fields, localctx.(*FieldInitializerListContext)._optField)
@@ -4190,6 +4740,10 @@ func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContex
 				var _m = p.Match(CELParserCOLON)
 
 				localctx.(*FieldInitializerListContext).s21 = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			localctx.(*FieldInitializerListContext).cols = append(localctx.(*FieldInitializerListContext).cols, localctx.(*FieldInitializerListContext).s21)
 			{
@@ -4197,19 +4751,40 @@ func (p *CELParser) FieldInitializerList() (localctx IFieldInitializerListContex
 
 				var _x = p.Expr()
 
+
 				localctx.(*FieldInitializerListContext)._expr = _x
 			}
 			localctx.(*FieldInitializerListContext).values = append(localctx.(*FieldInitializerListContext).values, localctx.(*FieldInitializerListContext)._expr)
 
+
 		}
 		p.SetState(210)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 28, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 28, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IOptFieldContext is an interface to support dynamic dispatch.
 type IOptFieldContext interface {
 	antlr.ParserRuleContext
@@ -4218,10 +4793,12 @@ type IOptFieldContext interface {
 	GetParser() antlr.Parser
 
 	// GetOpt returns the opt token.
-	GetOpt() antlr.Token
+	GetOpt() antlr.Token 
+
 
 	// SetOpt sets the opt token.
-	SetOpt(antlr.Token)
+	SetOpt(antlr.Token) 
+
 
 	// Getter signatures
 	IDENTIFIER() antlr.TerminalNode
@@ -4232,24 +4809,29 @@ type IOptFieldContext interface {
 }
 
 type OptFieldContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	opt    antlr.Token
+	opt antlr.Token
 }
 
 func NewEmptyOptFieldContext() *OptFieldContext {
 	var p = new(OptFieldContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_optField
 	return p
 }
 
+func InitEmptyOptFieldContext(p *OptFieldContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_optField
+}
+
 func (*OptFieldContext) IsOptFieldContext() {}
 
 func NewOptFieldContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *OptFieldContext {
 	var p = new(OptFieldContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_optField
@@ -4261,8 +4843,10 @@ func (s *OptFieldContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *OptFieldContext) GetOpt() antlr.Token { return s.opt }
 
+
 func (s *OptFieldContext) SetOpt(v antlr.Token) { s.opt = v }
 
+
 func (s *OptFieldContext) IDENTIFIER() antlr.TerminalNode {
 	return s.GetToken(CELParserIDENTIFIER, 0)
 }
@@ -4279,6 +4863,7 @@ func (s *OptFieldContext) ToStringTree(ruleNames []string, recog antlr.Recognize
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *OptFieldContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterOptField(s)
@@ -4301,35 +4886,23 @@ func (s *OptFieldContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) OptField() (localctx IOptFieldContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) OptField() (localctx IOptFieldContext) {
 	localctx = NewOptFieldContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 24, CELParserRULE_optField)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	p.SetState(212)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	if _la == CELParserQUESTIONMARK {
 		{
 			p.SetState(211)
@@ -4337,17 +4910,38 @@ func (p *CELParser) OptField() (localctx IOptFieldContext) {
 			var _m = p.Match(CELParserQUESTIONMARK)
 
 			localctx.(*OptFieldContext).opt = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
 	}
 	{
 		p.SetState(214)
 		p.Match(CELParserIDENTIFIER)
+		if p.HasError() {
+				// Recognition error - abort rule
+				goto errorExit
+		}
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IMapInitializerListContext is an interface to support dynamic dispatch.
 type IMapInitializerListContext interface {
 	antlr.ParserRuleContext
@@ -4356,40 +4950,48 @@ type IMapInitializerListContext interface {
 	GetParser() antlr.Parser
 
 	// GetS21 returns the s21 token.
-	GetS21() antlr.Token
+	GetS21() antlr.Token 
+
 
 	// SetS21 sets the s21 token.
-	SetS21(antlr.Token)
+	SetS21(antlr.Token) 
+
 
 	// GetCols returns the cols token list.
 	GetCols() []antlr.Token
 
+
 	// SetCols sets the cols token list.
 	SetCols([]antlr.Token)
 
+
 	// Get_optExpr returns the _optExpr rule contexts.
 	Get_optExpr() IOptExprContext
 
 	// Get_expr returns the _expr rule contexts.
 	Get_expr() IExprContext
 
+
 	// Set_optExpr sets the _optExpr rule contexts.
 	Set_optExpr(IOptExprContext)
 
 	// Set_expr sets the _expr rule contexts.
 	Set_expr(IExprContext)
 
+
 	// GetKeys returns the keys rule context list.
 	GetKeys() []IOptExprContext
 
 	// GetValues returns the values rule context list.
 	GetValues() []IExprContext
 
+
 	// SetKeys sets the keys rule context list.
-	SetKeys([]IOptExprContext)
+	SetKeys([]IOptExprContext) 
 
 	// SetValues sets the values rule context list.
-	SetValues([]IExprContext)
+	SetValues([]IExprContext) 
+
 
 	// Getter signatures
 	AllOptExpr() []IOptExprContext
@@ -4406,29 +5008,34 @@ type IMapInitializerListContext interface {
 }
 
 type MapInitializerListContext struct {
-	*antlr.BaseParserRuleContext
-	parser   antlr.Parser
-	_optExpr IOptExprContext
-	keys     []IOptExprContext
-	s21      antlr.Token
-	cols     []antlr.Token
-	_expr    IExprContext
-	values   []IExprContext
+	antlr.BaseParserRuleContext
+	parser antlr.Parser
+	_optExpr IOptExprContext 
+	keys []IOptExprContext
+	s21 antlr.Token
+	cols []antlr.Token
+	_expr IExprContext 
+	values []IExprContext
 }
 
 func NewEmptyMapInitializerListContext() *MapInitializerListContext {
 	var p = new(MapInitializerListContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_mapInitializerList
 	return p
 }
 
+func InitEmptyMapInitializerListContext(p *MapInitializerListContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_mapInitializerList
+}
+
 func (*MapInitializerListContext) IsMapInitializerListContext() {}
 
 func NewMapInitializerListContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *MapInitializerListContext {
 	var p = new(MapInitializerListContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_mapInitializerList
@@ -4440,28 +5047,36 @@ func (s *MapInitializerListContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *MapInitializerListContext) GetS21() antlr.Token { return s.s21 }
 
+
 func (s *MapInitializerListContext) SetS21(v antlr.Token) { s.s21 = v }
 
+
 func (s *MapInitializerListContext) GetCols() []antlr.Token { return s.cols }
 
+
 func (s *MapInitializerListContext) SetCols(v []antlr.Token) { s.cols = v }
 
+
 func (s *MapInitializerListContext) Get_optExpr() IOptExprContext { return s._optExpr }
 
 func (s *MapInitializerListContext) Get_expr() IExprContext { return s._expr }
 
+
 func (s *MapInitializerListContext) Set_optExpr(v IOptExprContext) { s._optExpr = v }
 
 func (s *MapInitializerListContext) Set_expr(v IExprContext) { s._expr = v }
 
+
 func (s *MapInitializerListContext) GetKeys() []IOptExprContext { return s.keys }
 
 func (s *MapInitializerListContext) GetValues() []IExprContext { return s.values }
 
+
 func (s *MapInitializerListContext) SetKeys(v []IOptExprContext) { s.keys = v }
 
 func (s *MapInitializerListContext) SetValues(v []IExprContext) { s.values = v }
 
+
 func (s *MapInitializerListContext) AllOptExpr() []IOptExprContext {
 	children := s.GetChildren()
 	len := 0
@@ -4484,12 +5099,12 @@ func (s *MapInitializerListContext) AllOptExpr() []IOptExprContext {
 }
 
 func (s *MapInitializerListContext) OptExpr(i int) IOptExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IOptExprContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -4533,12 +5148,12 @@ func (s *MapInitializerListContext) AllExpr() []IExprContext {
 }
 
 func (s *MapInitializerListContext) Expr(i int) IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	j := 0
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
 			if j == i {
-				t = ctx.(antlr.RuleContext)
+				t = ctx.(antlr.RuleContext);
 				break
 			}
 			j++
@@ -4568,6 +5183,7 @@ func (s *MapInitializerListContext) ToStringTree(ruleNames []string, recog antlr
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *MapInitializerListContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterMapInitializerList(s)
@@ -4590,29 +5206,12 @@ func (s *MapInitializerListContext) Accept(visitor antlr.ParseTreeVisitor) inter
 	}
 }
 
-func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
-	this := p
-	_ = this
 
-	localctx = NewMapInitializerListContext(p, p.GetParserRuleContext(), p.GetState())
-	p.EnterRule(localctx, 26, CELParserRULE_mapInitializerList)
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
 
+func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
+	localctx = NewMapInitializerListContext(p, p.GetParserRuleContext(), p.GetState())
+	p.EnterRule(localctx, 26, CELParserRULE_mapInitializerList)
 	var _alt int
 
 	p.EnterOuterAlt(localctx, 1)
@@ -4621,6 +5220,7 @@ func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
 
 		var _x = p.OptExpr()
 
+
 		localctx.(*MapInitializerListContext)._optExpr = _x
 	}
 	localctx.(*MapInitializerListContext).keys = append(localctx.(*MapInitializerListContext).keys, localctx.(*MapInitializerListContext)._optExpr)
@@ -4630,6 +5230,10 @@ func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
 		var _m = p.Match(CELParserCOLON)
 
 		localctx.(*MapInitializerListContext).s21 = _m
+		if p.HasError() {
+				// Recognition error - abort rule
+				goto errorExit
+		}
 	}
 	localctx.(*MapInitializerListContext).cols = append(localctx.(*MapInitializerListContext).cols, localctx.(*MapInitializerListContext).s21)
 	{
@@ -4637,24 +5241,35 @@ func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
 
 		var _x = p.Expr()
 
+
 		localctx.(*MapInitializerListContext)._expr = _x
 	}
 	localctx.(*MapInitializerListContext).values = append(localctx.(*MapInitializerListContext).values, localctx.(*MapInitializerListContext)._expr)
 	p.SetState(226)
 	p.GetErrorHandler().Sync(p)
-	_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 30, p.GetParserRuleContext())
-
+	if p.HasError() {
+		goto errorExit
+	}
+	_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 30, p.GetParserRuleContext())
+	if p.HasError() {
+		goto errorExit
+	}
 	for _alt != 2 && _alt != antlr.ATNInvalidAltNumber {
 		if _alt == 1 {
 			{
 				p.SetState(219)
 				p.Match(CELParserCOMMA)
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			{
 				p.SetState(220)
 
 				var _x = p.OptExpr()
 
+
 				localctx.(*MapInitializerListContext)._optExpr = _x
 			}
 			localctx.(*MapInitializerListContext).keys = append(localctx.(*MapInitializerListContext).keys, localctx.(*MapInitializerListContext)._optExpr)
@@ -4664,6 +5279,10 @@ func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
 				var _m = p.Match(CELParserCOLON)
 
 				localctx.(*MapInitializerListContext).s21 = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 			localctx.(*MapInitializerListContext).cols = append(localctx.(*MapInitializerListContext).cols, localctx.(*MapInitializerListContext).s21)
 			{
@@ -4671,19 +5290,40 @@ func (p *CELParser) MapInitializerList() (localctx IMapInitializerListContext) {
 
 				var _x = p.Expr()
 
+
 				localctx.(*MapInitializerListContext)._expr = _x
 			}
 			localctx.(*MapInitializerListContext).values = append(localctx.(*MapInitializerListContext).values, localctx.(*MapInitializerListContext)._expr)
 
+
 		}
 		p.SetState(228)
 		p.GetErrorHandler().Sync(p)
-		_alt = p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 30, p.GetParserRuleContext())
+		if p.HasError() {
+	    	goto errorExit
+	    }
+		_alt = p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 30, p.GetParserRuleContext())
+		if p.HasError() {
+			goto errorExit
+		}
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // IOptExprContext is an interface to support dynamic dispatch.
 type IOptExprContext interface {
 	antlr.ParserRuleContext
@@ -4692,17 +5332,21 @@ type IOptExprContext interface {
 	GetParser() antlr.Parser
 
 	// GetOpt returns the opt token.
-	GetOpt() antlr.Token
+	GetOpt() antlr.Token 
+
 
 	// SetOpt sets the opt token.
-	SetOpt(antlr.Token)
+	SetOpt(antlr.Token) 
+
 
 	// GetE returns the e rule contexts.
 	GetE() IExprContext
 
+
 	// SetE sets the e rule contexts.
 	SetE(IExprContext)
 
+
 	// Getter signatures
 	Expr() IExprContext
 	QUESTIONMARK() antlr.TerminalNode
@@ -4712,25 +5356,30 @@ type IOptExprContext interface {
 }
 
 type OptExprContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
-	opt    antlr.Token
-	e      IExprContext
+	opt antlr.Token
+	e IExprContext 
 }
 
 func NewEmptyOptExprContext() *OptExprContext {
 	var p = new(OptExprContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_optExpr
 	return p
 }
 
+func InitEmptyOptExprContext(p *OptExprContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_optExpr
+}
+
 func (*OptExprContext) IsOptExprContext() {}
 
 func NewOptExprContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *OptExprContext {
 	var p = new(OptExprContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_optExpr
@@ -4742,17 +5391,21 @@ func (s *OptExprContext) GetParser() antlr.Parser { return s.parser }
 
 func (s *OptExprContext) GetOpt() antlr.Token { return s.opt }
 
+
 func (s *OptExprContext) SetOpt(v antlr.Token) { s.opt = v }
 
+
 func (s *OptExprContext) GetE() IExprContext { return s.e }
 
+
 func (s *OptExprContext) SetE(v IExprContext) { s.e = v }
 
+
 func (s *OptExprContext) Expr() IExprContext {
-	var t antlr.RuleContext
+	var t antlr.RuleContext;
 	for _, ctx := range s.GetChildren() {
 		if _, ok := ctx.(IExprContext); ok {
-			t = ctx.(antlr.RuleContext)
+			t = ctx.(antlr.RuleContext);
 			break
 		}
 	}
@@ -4776,6 +5429,7 @@ func (s *OptExprContext) ToStringTree(ruleNames []string, recog antlr.Recognizer
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
 func (s *OptExprContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterOptExpr(s)
@@ -4798,35 +5452,23 @@ func (s *OptExprContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) OptExpr() (localctx IOptExprContext) {
-	this := p
-	_ = this
 
+
+
+func (p *CELParser) OptExpr() (localctx IOptExprContext) {
 	localctx = NewOptExprContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 28, CELParserRULE_optExpr)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.EnterOuterAlt(localctx, 1)
 	p.SetState(230)
 	p.GetErrorHandler().Sync(p)
+	if p.HasError() {
+		goto errorExit
+	}
 	_la = p.GetTokenStream().LA(1)
 
+
 	if _la == CELParserQUESTIONMARK {
 		{
 			p.SetState(229)
@@ -4834,6 +5476,10 @@ func (p *CELParser) OptExpr() (localctx IOptExprContext) {
 			var _m = p.Match(CELParserQUESTIONMARK)
 
 			localctx.(*OptExprContext).opt = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
 	}
@@ -4842,12 +5488,26 @@ func (p *CELParser) OptExpr() (localctx IOptExprContext) {
 
 		var _x = p.Expr()
 
+
 		localctx.(*OptExprContext).e = _x
 	}
 
+
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 // ILiteralContext is an interface to support dynamic dispatch.
 type ILiteralContext interface {
 	antlr.ParserRuleContext
@@ -4859,23 +5519,28 @@ type ILiteralContext interface {
 }
 
 type LiteralContext struct {
-	*antlr.BaseParserRuleContext
+	antlr.BaseParserRuleContext
 	parser antlr.Parser
 }
 
 func NewEmptyLiteralContext() *LiteralContext {
 	var p = new(LiteralContext)
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(nil, -1)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
 	p.RuleIndex = CELParserRULE_literal
 	return p
 }
 
+func InitEmptyLiteralContext(p *LiteralContext)  {
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, nil, -1)
+	p.RuleIndex = CELParserRULE_literal
+}
+
 func (*LiteralContext) IsLiteralContext() {}
 
 func NewLiteralContext(parser antlr.Parser, parent antlr.ParserRuleContext, invokingState int) *LiteralContext {
 	var p = new(LiteralContext)
 
-	p.BaseParserRuleContext = antlr.NewBaseParserRuleContext(parent, invokingState)
+	antlr.InitBaseParserRuleContext(&p.BaseParserRuleContext, parent, invokingState)
 
 	p.parser = parser
 	p.RuleIndex = CELParserRULE_literal
@@ -4885,8 +5550,8 @@ func NewLiteralContext(parser antlr.Parser, parent antlr.ParserRuleContext, invo
 
 func (s *LiteralContext) GetParser() antlr.Parser { return s.parser }
 
-func (s *LiteralContext) CopyFrom(ctx *LiteralContext) {
-	s.BaseParserRuleContext.CopyFrom(ctx.BaseParserRuleContext)
+func (s *LiteralContext) CopyAll(ctx *LiteralContext) {
+	s.CopyFrom(&ctx.BaseParserRuleContext)
 }
 
 func (s *LiteralContext) GetRuleContext() antlr.RuleContext {
@@ -4897,23 +5562,28 @@ func (s *LiteralContext) ToStringTree(ruleNames []string, recog antlr.Recognizer
 	return antlr.TreesStringTree(s, ruleNames, recog)
 }
 
+
+
+
 type BytesContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewBytesContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *BytesContext {
 	var p = new(BytesContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *BytesContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *BytesContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *BytesContext) GetRuleContext() antlr.RuleContext {
@@ -4924,6 +5594,7 @@ func (s *BytesContext) BYTES() antlr.TerminalNode {
 	return s.GetToken(CELParserBYTES, 0)
 }
 
+
 func (s *BytesContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterBytes(s)
@@ -4946,23 +5617,26 @@ func (s *BytesContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type UintContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewUintContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *UintContext {
 	var p = new(UintContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *UintContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *UintContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *UintContext) GetRuleContext() antlr.RuleContext {
@@ -4973,6 +5647,7 @@ func (s *UintContext) NUM_UINT() antlr.TerminalNode {
 	return s.GetToken(CELParserNUM_UINT, 0)
 }
 
+
 func (s *UintContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterUint(s)
@@ -4995,23 +5670,26 @@ func (s *UintContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type NullContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewNullContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *NullContext {
 	var p = new(NullContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *NullContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *NullContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *NullContext) GetRuleContext() antlr.RuleContext {
@@ -5022,6 +5700,7 @@ func (s *NullContext) NUL() antlr.TerminalNode {
 	return s.GetToken(CELParserNUL, 0)
 }
 
+
 func (s *NullContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterNull(s)
@@ -5044,23 +5723,26 @@ func (s *NullContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type BoolFalseContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewBoolFalseContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *BoolFalseContext {
 	var p = new(BoolFalseContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *BoolFalseContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *BoolFalseContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *BoolFalseContext) GetRuleContext() antlr.RuleContext {
@@ -5071,6 +5753,7 @@ func (s *BoolFalseContext) CEL_FALSE() antlr.TerminalNode {
 	return s.GetToken(CELParserCEL_FALSE, 0)
 }
 
+
 func (s *BoolFalseContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterBoolFalse(s)
@@ -5093,23 +5776,26 @@ func (s *BoolFalseContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type StringContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewStringContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *StringContext {
 	var p = new(StringContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *StringContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *StringContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *StringContext) GetRuleContext() antlr.RuleContext {
@@ -5120,6 +5806,7 @@ func (s *StringContext) STRING() antlr.TerminalNode {
 	return s.GetToken(CELParserSTRING, 0)
 }
 
+
 func (s *StringContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterString(s)
@@ -5142,26 +5829,29 @@ func (s *StringContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type DoubleContext struct {
-	*LiteralContext
+	LiteralContext
 	sign antlr.Token
-	tok  antlr.Token
+	tok antlr.Token
 }
 
 func NewDoubleContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *DoubleContext {
 	var p = new(DoubleContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *DoubleContext) GetSign() antlr.Token { return s.sign }
 
 func (s *DoubleContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *DoubleContext) SetSign(v antlr.Token) { s.sign = v }
 
 func (s *DoubleContext) SetTok(v antlr.Token) { s.tok = v }
@@ -5178,6 +5868,7 @@ func (s *DoubleContext) MINUS() antlr.TerminalNode {
 	return s.GetToken(CELParserMINUS, 0)
 }
 
+
 func (s *DoubleContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterDouble(s)
@@ -5200,23 +5891,26 @@ func (s *DoubleContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type BoolTrueContext struct {
-	*LiteralContext
+	LiteralContext
 	tok antlr.Token
 }
 
 func NewBoolTrueContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *BoolTrueContext {
 	var p = new(BoolTrueContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *BoolTrueContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *BoolTrueContext) SetTok(v antlr.Token) { s.tok = v }
 
 func (s *BoolTrueContext) GetRuleContext() antlr.RuleContext {
@@ -5227,6 +5921,7 @@ func (s *BoolTrueContext) CEL_TRUE() antlr.TerminalNode {
 	return s.GetToken(CELParserCEL_TRUE, 0)
 }
 
+
 func (s *BoolTrueContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterBoolTrue(s)
@@ -5249,26 +5944,29 @@ func (s *BoolTrueContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
+
 type IntContext struct {
-	*LiteralContext
+	LiteralContext
 	sign antlr.Token
-	tok  antlr.Token
+	tok antlr.Token
 }
 
 func NewIntContext(parser antlr.Parser, ctx antlr.ParserRuleContext) *IntContext {
 	var p = new(IntContext)
 
-	p.LiteralContext = NewEmptyLiteralContext()
+	InitEmptyLiteralContext(&p.LiteralContext)
 	p.parser = parser
-	p.CopyFrom(ctx.(*LiteralContext))
+	p.CopyAll(ctx.(*LiteralContext))
 
 	return p
 }
 
+
 func (s *IntContext) GetSign() antlr.Token { return s.sign }
 
 func (s *IntContext) GetTok() antlr.Token { return s.tok }
 
+
 func (s *IntContext) SetSign(v antlr.Token) { s.sign = v }
 
 func (s *IntContext) SetTok(v antlr.Token) { s.tok = v }
@@ -5285,6 +5983,7 @@ func (s *IntContext) MINUS() antlr.TerminalNode {
 	return s.GetToken(CELParserMINUS, 0)
 }
 
+
 func (s *IntContext) EnterRule(listener antlr.ParseTreeListener) {
 	if listenerT, ok := listener.(CELListener); ok {
 		listenerT.EnterInt(s)
@@ -5307,40 +6006,31 @@ func (s *IntContext) Accept(visitor antlr.ParseTreeVisitor) interface{} {
 	}
 }
 
-func (p *CELParser) Literal() (localctx ILiteralContext) {
-	this := p
-	_ = this
 
+
+func (p *CELParser) Literal() (localctx ILiteralContext) {
 	localctx = NewLiteralContext(p, p.GetParserRuleContext(), p.GetState())
 	p.EnterRule(localctx, 30, CELParserRULE_literal)
 	var _la int
 
-	defer func() {
-		p.ExitRule()
-	}()
-
-	defer func() {
-		if err := recover(); err != nil {
-			if v, ok := err.(antlr.RecognitionException); ok {
-				localctx.SetException(v)
-				p.GetErrorHandler().ReportError(p, v)
-				p.GetErrorHandler().Recover(p, v)
-			} else {
-				panic(err)
-			}
-		}
-	}()
-
 	p.SetState(248)
 	p.GetErrorHandler().Sync(p)
-	switch p.GetInterpreter().AdaptivePredict(p.GetTokenStream(), 34, p.GetParserRuleContext()) {
+	if p.HasError() {
+		goto errorExit
+	}
+
+	switch p.GetInterpreter().AdaptivePredict(p.BaseParser, p.GetTokenStream(), 34, p.GetParserRuleContext()) {
 	case 1:
 		localctx = NewIntContext(p, localctx)
 		p.EnterOuterAlt(localctx, 1)
 		p.SetState(235)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserMINUS {
 			{
 				p.SetState(234)
@@ -5348,6 +6038,10 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 				var _m = p.Match(CELParserMINUS)
 
 				localctx.(*IntContext).sign = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
@@ -5357,8 +6051,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserNUM_INT)
 
 			localctx.(*IntContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 2:
 		localctx = NewUintContext(p, localctx)
 		p.EnterOuterAlt(localctx, 2)
@@ -5368,15 +6067,24 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserNUM_UINT)
 
 			localctx.(*UintContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 3:
 		localctx = NewDoubleContext(p, localctx)
 		p.EnterOuterAlt(localctx, 3)
 		p.SetState(240)
 		p.GetErrorHandler().Sync(p)
+		if p.HasError() {
+			goto errorExit
+		}
 		_la = p.GetTokenStream().LA(1)
 
+
 		if _la == CELParserMINUS {
 			{
 				p.SetState(239)
@@ -5384,6 +6092,10 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 				var _m = p.Match(CELParserMINUS)
 
 				localctx.(*DoubleContext).sign = _m
+				if p.HasError() {
+						// Recognition error - abort rule
+						goto errorExit
+				}
 			}
 
 		}
@@ -5393,8 +6105,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserNUM_FLOAT)
 
 			localctx.(*DoubleContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 4:
 		localctx = NewStringContext(p, localctx)
 		p.EnterOuterAlt(localctx, 4)
@@ -5404,8 +6121,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserSTRING)
 
 			localctx.(*StringContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 5:
 		localctx = NewBytesContext(p, localctx)
 		p.EnterOuterAlt(localctx, 5)
@@ -5415,8 +6137,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserBYTES)
 
 			localctx.(*BytesContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 6:
 		localctx = NewBoolTrueContext(p, localctx)
 		p.EnterOuterAlt(localctx, 6)
@@ -5426,8 +6153,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserCEL_TRUE)
 
 			localctx.(*BoolTrueContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 7:
 		localctx = NewBoolFalseContext(p, localctx)
 		p.EnterOuterAlt(localctx, 7)
@@ -5437,8 +6169,13 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserCEL_FALSE)
 
 			localctx.(*BoolFalseContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+
 	case 8:
 		localctx = NewNullContext(p, localctx)
 		p.EnterOuterAlt(localctx, 8)
@@ -5448,35 +6185,48 @@ func (p *CELParser) Literal() (localctx ILiteralContext) {
 			var _m = p.Match(CELParserNUL)
 
 			localctx.(*NullContext).tok = _m
+			if p.HasError() {
+					// Recognition error - abort rule
+					goto errorExit
+			}
 		}
 
+	case antlr.ATNInvalidAltNumber:
+		goto errorExit
 	}
 
+
+errorExit:
+	if p.HasError() {
+		v := p.GetError()
+		localctx.SetException(v)
+		p.GetErrorHandler().ReportError(p, v)
+		p.GetErrorHandler().Recover(p, v)
+		p.SetError(nil)
+	}
+	p.ExitRule()
 	return localctx
+	goto errorExit // Trick to prevent compiler error if the label is not used
 }
 
+
 func (p *CELParser) Sempred(localctx antlr.RuleContext, ruleIndex, predIndex int) bool {
 	switch ruleIndex {
 	case 4:
-		var t *RelationContext = nil
-		if localctx != nil {
-			t = localctx.(*RelationContext)
-		}
-		return p.Relation_Sempred(t, predIndex)
+			var t *RelationContext = nil
+			if localctx != nil { t = localctx.(*RelationContext) }
+			return p.Relation_Sempred(t, predIndex)
 
 	case 5:
-		var t *CalcContext = nil
-		if localctx != nil {
-			t = localctx.(*CalcContext)
-		}
-		return p.Calc_Sempred(t, predIndex)
+			var t *CalcContext = nil
+			if localctx != nil { t = localctx.(*CalcContext) }
+			return p.Calc_Sempred(t, predIndex)
 
 	case 7:
-		var t *MemberContext = nil
-		if localctx != nil {
-			t = localctx.(*MemberContext)
-		}
-		return p.Member_Sempred(t, predIndex)
+			var t *MemberContext = nil
+			if localctx != nil { t = localctx.(*MemberContext) }
+			return p.Member_Sempred(t, predIndex)
+
 
 	default:
 		panic("No predicate with index: " + fmt.Sprint(ruleIndex))
@@ -5484,12 +6234,9 @@ func (p *CELParser) Sempred(localctx antlr.RuleContext, ruleIndex, predIndex int
 }
 
 func (p *CELParser) Relation_Sempred(localctx antlr.RuleContext, predIndex int) bool {
-	this := p
-	_ = this
-
 	switch predIndex {
 	case 0:
-		return p.Precpred(p.GetParserRuleContext(), 1)
+			return p.Precpred(p.GetParserRuleContext(), 1)
 
 	default:
 		panic("No predicate with index: " + fmt.Sprint(predIndex))
@@ -5497,15 +6244,12 @@ func (p *CELParser) Relation_Sempred(localctx antlr.RuleContext, predIndex int)
 }
 
 func (p *CELParser) Calc_Sempred(localctx antlr.RuleContext, predIndex int) bool {
-	this := p
-	_ = this
-
 	switch predIndex {
 	case 1:
-		return p.Precpred(p.GetParserRuleContext(), 2)
+			return p.Precpred(p.GetParserRuleContext(), 2)
 
 	case 2:
-		return p.Precpred(p.GetParserRuleContext(), 1)
+			return p.Precpred(p.GetParserRuleContext(), 1)
 
 	default:
 		panic("No predicate with index: " + fmt.Sprint(predIndex))
@@ -5513,20 +6257,18 @@ func (p *CELParser) Calc_Sempred(localctx antlr.RuleContext, predIndex int) bool
 }
 
 func (p *CELParser) Member_Sempred(localctx antlr.RuleContext, predIndex int) bool {
-	this := p
-	_ = this
-
 	switch predIndex {
 	case 3:
-		return p.Precpred(p.GetParserRuleContext(), 3)
+			return p.Precpred(p.GetParserRuleContext(), 3)
 
 	case 4:
-		return p.Precpred(p.GetParserRuleContext(), 2)
+			return p.Precpred(p.GetParserRuleContext(), 2)
 
 	case 5:
-		return p.Precpred(p.GetParserRuleContext(), 1)
+			return p.Precpred(p.GetParserRuleContext(), 1)
 
 	default:
 		panic("No predicate with index: " + fmt.Sprint(predIndex))
 	}
 }
+
diff --git a/vendor/github.com/google/cel-go/parser/gen/cel_visitor.go b/vendor/github.com/google/cel-go/parser/gen/cel_visitor.go
index 2c54e2c..d2fbd56 100644
--- a/vendor/github.com/google/cel-go/parser/gen/cel_visitor.go
+++ b/vendor/github.com/google/cel-go/parser/gen/cel_visitor.go
@@ -1,7 +1,8 @@
-// Code generated from /Users/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.12.0. DO NOT EDIT.
+// Code generated from /usr/local/google/home/tswadell/go/src/github.com/google/cel-go/parser/gen/CEL.g4 by ANTLR 4.13.1. DO NOT EDIT.
 
 package gen // CEL
-import "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+import "github.com/antlr4-go/antlr/v4"
+
 
 // A complete Visitor for a parse tree produced by CELParser.
 type CELVisitor interface {
@@ -105,4 +106,5 @@ type CELVisitor interface {
 
 	// Visit a parse tree produced by CELParser#Null.
 	VisitNull(ctx *NullContext) interface{}
-}
+
+}
\ No newline at end of file
diff --git a/vendor/github.com/google/cel-go/parser/gen/generate.sh b/vendor/github.com/google/cel-go/parser/gen/generate.sh
index 389107c..27a9559 100644
--- a/vendor/github.com/google/cel-go/parser/gen/generate.sh
+++ b/vendor/github.com/google/cel-go/parser/gen/generate.sh
@@ -27,7 +27,7 @@
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 # Generate AntLR artifacts.
-java -Xmx500M -cp ${DIR}/antlr-4.12.0-complete.jar org.antlr.v4.Tool  \
+java -Xmx500M -cp ${DIR}/antlr-4.13.1-complete.jar org.antlr.v4.Tool  \
     -Dlanguage=Go \
     -package gen \
     -o ${DIR} \
diff --git a/vendor/github.com/google/cel-go/parser/helper.go b/vendor/github.com/google/cel-go/parser/helper.go
index 52d7fd8..9f09ead 100644
--- a/vendor/github.com/google/cel-go/parser/helper.go
+++ b/vendor/github.com/google/cel-go/parser/helper.go
@@ -17,346 +17,308 @@ package parser
 import (
 	"sync"
 
-	antlr "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+	antlr "github.com/antlr4-go/antlr/v4"
 
 	"github.com/google/cel-go/common"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/ast"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
 )
 
 type parserHelper struct {
-	source     common.Source
-	nextID     int64
-	positions  map[int64]int32
-	macroCalls map[int64]*exprpb.Expr
+	exprFactory ast.ExprFactory
+	source      common.Source
+	sourceInfo  *ast.SourceInfo
+	nextID      int64
 }
 
-func newParserHelper(source common.Source) *parserHelper {
+func newParserHelper(source common.Source, fac ast.ExprFactory) *parserHelper {
 	return &parserHelper{
-		source:     source,
-		nextID:     1,
-		positions:  make(map[int64]int32),
-		macroCalls: make(map[int64]*exprpb.Expr),
+		exprFactory: fac,
+		source:      source,
+		sourceInfo:  ast.NewSourceInfo(source),
+		nextID:      1,
 	}
 }
 
-func (p *parserHelper) getSourceInfo() *exprpb.SourceInfo {
-	return &exprpb.SourceInfo{
-		Location:    p.source.Description(),
-		Positions:   p.positions,
-		LineOffsets: p.source.LineOffsets(),
-		MacroCalls:  p.macroCalls}
+func (p *parserHelper) getSourceInfo() *ast.SourceInfo {
+	return p.sourceInfo
 }
 
-func (p *parserHelper) newLiteral(ctx any, value *exprpb.Constant) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_ConstExpr{ConstExpr: value}
-	return exprNode
+func (p *parserHelper) newLiteral(ctx any, value ref.Val) ast.Expr {
+	return p.exprFactory.NewLiteral(p.newID(ctx), value)
 }
 
-func (p *parserHelper) newLiteralBool(ctx any, value bool) *exprpb.Expr {
-	return p.newLiteral(ctx,
-		&exprpb.Constant{ConstantKind: &exprpb.Constant_BoolValue{BoolValue: value}})
+func (p *parserHelper) newLiteralBool(ctx any, value bool) ast.Expr {
+	return p.newLiteral(ctx, types.Bool(value))
 }
 
-func (p *parserHelper) newLiteralString(ctx any, value string) *exprpb.Expr {
-	return p.newLiteral(ctx,
-		&exprpb.Constant{ConstantKind: &exprpb.Constant_StringValue{StringValue: value}})
+func (p *parserHelper) newLiteralString(ctx any, value string) ast.Expr {
+	return p.newLiteral(ctx, types.String(value))
 }
 
-func (p *parserHelper) newLiteralBytes(ctx any, value []byte) *exprpb.Expr {
-	return p.newLiteral(ctx,
-		&exprpb.Constant{ConstantKind: &exprpb.Constant_BytesValue{BytesValue: value}})
+func (p *parserHelper) newLiteralBytes(ctx any, value []byte) ast.Expr {
+	return p.newLiteral(ctx, types.Bytes(value))
 }
 
-func (p *parserHelper) newLiteralInt(ctx any, value int64) *exprpb.Expr {
-	return p.newLiteral(ctx,
-		&exprpb.Constant{ConstantKind: &exprpb.Constant_Int64Value{Int64Value: value}})
+func (p *parserHelper) newLiteralInt(ctx any, value int64) ast.Expr {
+	return p.newLiteral(ctx, types.Int(value))
 }
 
-func (p *parserHelper) newLiteralUint(ctx any, value uint64) *exprpb.Expr {
-	return p.newLiteral(ctx, &exprpb.Constant{ConstantKind: &exprpb.Constant_Uint64Value{Uint64Value: value}})
+func (p *parserHelper) newLiteralUint(ctx any, value uint64) ast.Expr {
+	return p.newLiteral(ctx, types.Uint(value))
 }
 
-func (p *parserHelper) newLiteralDouble(ctx any, value float64) *exprpb.Expr {
-	return p.newLiteral(ctx,
-		&exprpb.Constant{ConstantKind: &exprpb.Constant_DoubleValue{DoubleValue: value}})
+func (p *parserHelper) newLiteralDouble(ctx any, value float64) ast.Expr {
+	return p.newLiteral(ctx, types.Double(value))
 }
 
-func (p *parserHelper) newIdent(ctx any, name string) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_IdentExpr{IdentExpr: &exprpb.Expr_Ident{Name: name}}
-	return exprNode
+func (p *parserHelper) newIdent(ctx any, name string) ast.Expr {
+	return p.exprFactory.NewIdent(p.newID(ctx), name)
 }
 
-func (p *parserHelper) newSelect(ctx any, operand *exprpb.Expr, field string) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_SelectExpr{
-		SelectExpr: &exprpb.Expr_Select{Operand: operand, Field: field}}
-	return exprNode
+func (p *parserHelper) newSelect(ctx any, operand ast.Expr, field string) ast.Expr {
+	return p.exprFactory.NewSelect(p.newID(ctx), operand, field)
 }
 
-func (p *parserHelper) newPresenceTest(ctx any, operand *exprpb.Expr, field string) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_SelectExpr{
-		SelectExpr: &exprpb.Expr_Select{Operand: operand, Field: field, TestOnly: true}}
-	return exprNode
+func (p *parserHelper) newPresenceTest(ctx any, operand ast.Expr, field string) ast.Expr {
+	return p.exprFactory.NewPresenceTest(p.newID(ctx), operand, field)
 }
 
-func (p *parserHelper) newGlobalCall(ctx any, function string, args ...*exprpb.Expr) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_CallExpr{
-		CallExpr: &exprpb.Expr_Call{Function: function, Args: args}}
-	return exprNode
+func (p *parserHelper) newGlobalCall(ctx any, function string, args ...ast.Expr) ast.Expr {
+	return p.exprFactory.NewCall(p.newID(ctx), function, args...)
 }
 
-func (p *parserHelper) newReceiverCall(ctx any, function string, target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_CallExpr{
-		CallExpr: &exprpb.Expr_Call{Function: function, Target: target, Args: args}}
-	return exprNode
+func (p *parserHelper) newReceiverCall(ctx any, function string, target ast.Expr, args ...ast.Expr) ast.Expr {
+	return p.exprFactory.NewMemberCall(p.newID(ctx), function, target, args...)
 }
 
-func (p *parserHelper) newList(ctx any, elements []*exprpb.Expr, optionals ...int32) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_ListExpr{
-		ListExpr: &exprpb.Expr_CreateList{
-			Elements:        elements,
-			OptionalIndices: optionals,
-		}}
-	return exprNode
+func (p *parserHelper) newList(ctx any, elements []ast.Expr, optionals ...int32) ast.Expr {
+	return p.exprFactory.NewList(p.newID(ctx), elements, optionals)
 }
 
-func (p *parserHelper) newMap(ctx any, entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_StructExpr{
-		StructExpr: &exprpb.Expr_CreateStruct{Entries: entries}}
-	return exprNode
+func (p *parserHelper) newMap(ctx any, entries ...ast.EntryExpr) ast.Expr {
+	return p.exprFactory.NewMap(p.newID(ctx), entries)
 }
 
-func (p *parserHelper) newMapEntry(entryID int64, key *exprpb.Expr, value *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
-	return &exprpb.Expr_CreateStruct_Entry{
-		Id:            entryID,
-		KeyKind:       &exprpb.Expr_CreateStruct_Entry_MapKey{MapKey: key},
-		Value:         value,
-		OptionalEntry: optional,
-	}
+func (p *parserHelper) newMapEntry(entryID int64, key ast.Expr, value ast.Expr, optional bool) ast.EntryExpr {
+	return p.exprFactory.NewMapEntry(entryID, key, value, optional)
 }
 
-func (p *parserHelper) newObject(ctx any, typeName string, entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_StructExpr{
-		StructExpr: &exprpb.Expr_CreateStruct{
-			MessageName: typeName,
-			Entries:     entries,
-		},
-	}
-	return exprNode
+func (p *parserHelper) newObject(ctx any, typeName string, fields ...ast.EntryExpr) ast.Expr {
+	return p.exprFactory.NewStruct(p.newID(ctx), typeName, fields)
 }
 
-func (p *parserHelper) newObjectField(fieldID int64, field string, value *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
-	return &exprpb.Expr_CreateStruct_Entry{
-		Id:            fieldID,
-		KeyKind:       &exprpb.Expr_CreateStruct_Entry_FieldKey{FieldKey: field},
-		Value:         value,
-		OptionalEntry: optional,
-	}
+func (p *parserHelper) newObjectField(fieldID int64, field string, value ast.Expr, optional bool) ast.EntryExpr {
+	return p.exprFactory.NewStructField(fieldID, field, value, optional)
 }
 
-func (p *parserHelper) newComprehension(ctx any, iterVar string,
-	iterRange *exprpb.Expr,
+func (p *parserHelper) newComprehension(ctx any,
+	iterRange ast.Expr,
+	iterVar,
 	accuVar string,
-	accuInit *exprpb.Expr,
-	condition *exprpb.Expr,
-	step *exprpb.Expr,
-	result *exprpb.Expr) *exprpb.Expr {
-	exprNode := p.newExpr(ctx)
-	exprNode.ExprKind = &exprpb.Expr_ComprehensionExpr{
-		ComprehensionExpr: &exprpb.Expr_Comprehension{
-			AccuVar:       accuVar,
-			AccuInit:      accuInit,
-			IterVar:       iterVar,
-			IterRange:     iterRange,
-			LoopCondition: condition,
-			LoopStep:      step,
-			Result:        result}}
-	return exprNode
-}
-
-func (p *parserHelper) newExpr(ctx any) *exprpb.Expr {
-	id, isID := ctx.(int64)
-	if isID {
-		return &exprpb.Expr{Id: id}
+	accuInit ast.Expr,
+	condition ast.Expr,
+	step ast.Expr,
+	result ast.Expr) ast.Expr {
+	return p.exprFactory.NewComprehension(
+		p.newID(ctx), iterRange, iterVar, accuVar, accuInit, condition, step, result)
+}
+
+func (p *parserHelper) newComprehensionTwoVar(ctx any,
+	iterRange ast.Expr,
+	iterVar, iterVar2,
+	accuVar string,
+	accuInit ast.Expr,
+	condition ast.Expr,
+	step ast.Expr,
+	result ast.Expr) ast.Expr {
+	return p.exprFactory.NewComprehensionTwoVar(
+		p.newID(ctx), iterRange, iterVar, iterVar2, accuVar, accuInit, condition, step, result)
+}
+
+func (p *parserHelper) newID(ctx any) int64 {
+	if id, isID := ctx.(int64); isID {
+		return id
 	}
-	return &exprpb.Expr{Id: p.id(ctx)}
+	return p.id(ctx)
+}
+
+func (p *parserHelper) newExpr(ctx any) ast.Expr {
+	return p.exprFactory.NewUnspecifiedExpr(p.newID(ctx))
 }
 
 func (p *parserHelper) id(ctx any) int64 {
-	var location common.Location
-	switch ctx.(type) {
+	var offset ast.OffsetRange
+	switch c := ctx.(type) {
 	case antlr.ParserRuleContext:
-		token := (ctx.(antlr.ParserRuleContext)).GetStart()
-		location = p.source.NewLocation(token.GetLine(), token.GetColumn())
+		start := c.GetStart()
+		offset.Start = p.sourceInfo.ComputeOffset(int32(start.GetLine()), int32(start.GetColumn()))
+		offset.Stop = offset.Start + int32(len(c.GetText()))
 	case antlr.Token:
-		token := ctx.(antlr.Token)
-		location = p.source.NewLocation(token.GetLine(), token.GetColumn())
+		offset.Start = p.sourceInfo.ComputeOffset(int32(c.GetLine()), int32(c.GetColumn()))
+		offset.Stop = offset.Start + int32(len(c.GetText()))
 	case common.Location:
-		location = ctx.(common.Location)
+		offset.Start = p.sourceInfo.ComputeOffset(int32(c.Line()), int32(c.Column()))
+		offset.Stop = offset.Start
+	case ast.OffsetRange:
+		offset = c
 	default:
 		// This should only happen if the ctx is nil
 		return -1
 	}
 	id := p.nextID
-	p.positions[id], _ = p.source.LocationOffset(location)
+	p.sourceInfo.SetOffsetRange(id, offset)
 	p.nextID++
 	return id
 }
 
+func (p *parserHelper) deleteID(id int64) {
+	p.sourceInfo.ClearOffsetRange(id)
+	if id == p.nextID-1 {
+		p.nextID--
+	}
+}
+
 func (p *parserHelper) getLocation(id int64) common.Location {
-	characterOffset := p.positions[id]
-	location, _ := p.source.OffsetLocation(characterOffset)
-	return location
+	return p.sourceInfo.GetStartLocation(id)
+}
+
+func (p *parserHelper) getLocationByOffset(offset int32) common.Location {
+	return p.getSourceInfo().GetLocationByOffset(offset)
 }
 
 // buildMacroCallArg iterates the expression and returns a new expression
 // where all macros have been replaced by their IDs in MacroCalls
-func (p *parserHelper) buildMacroCallArg(expr *exprpb.Expr) *exprpb.Expr {
-	if _, found := p.macroCalls[expr.GetId()]; found {
-		return &exprpb.Expr{Id: expr.GetId()}
+func (p *parserHelper) buildMacroCallArg(expr ast.Expr) ast.Expr {
+	if _, found := p.sourceInfo.GetMacroCall(expr.ID()); found {
+		return p.exprFactory.NewUnspecifiedExpr(expr.ID())
 	}
 
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_CallExpr:
+	switch expr.Kind() {
+	case ast.CallKind:
 		// Iterate the AST from `expr` recursively looking for macros. Because we are at most
 		// starting from the top level macro, this recursion is bounded by the size of the AST. This
 		// means that the depth check on the AST during parsing will catch recursion overflows
 		// before we get to here.
-		macroTarget := expr.GetCallExpr().GetTarget()
-		if macroTarget != nil {
-			macroTarget = p.buildMacroCallArg(macroTarget)
-		}
-		macroArgs := make([]*exprpb.Expr, len(expr.GetCallExpr().GetArgs()))
-		for index, arg := range expr.GetCallExpr().GetArgs() {
+		call := expr.AsCall()
+		macroArgs := make([]ast.Expr, len(call.Args()))
+		for index, arg := range call.Args() {
 			macroArgs[index] = p.buildMacroCallArg(arg)
 		}
-		return &exprpb.Expr{
-			Id: expr.GetId(),
-			ExprKind: &exprpb.Expr_CallExpr{
-				CallExpr: &exprpb.Expr_Call{
-					Target:   macroTarget,
-					Function: expr.GetCallExpr().GetFunction(),
-					Args:     macroArgs,
-				},
-			},
+		if !call.IsMemberFunction() {
+			return p.exprFactory.NewCall(expr.ID(), call.FunctionName(), macroArgs...)
 		}
-	case *exprpb.Expr_ListExpr:
-		listExpr := expr.GetListExpr()
-		macroListArgs := make([]*exprpb.Expr, len(listExpr.GetElements()))
-		for i, elem := range listExpr.GetElements() {
+		macroTarget := p.buildMacroCallArg(call.Target())
+		return p.exprFactory.NewMemberCall(expr.ID(), call.FunctionName(), macroTarget, macroArgs...)
+	case ast.ListKind:
+		list := expr.AsList()
+		macroListArgs := make([]ast.Expr, list.Size())
+		for i, elem := range list.Elements() {
 			macroListArgs[i] = p.buildMacroCallArg(elem)
 		}
-		return &exprpb.Expr{
-			Id: expr.GetId(),
-			ExprKind: &exprpb.Expr_ListExpr{
-				ListExpr: &exprpb.Expr_CreateList{
-					Elements: macroListArgs,
-				},
-			},
-		}
+		return p.exprFactory.NewList(expr.ID(), macroListArgs, list.OptionalIndices())
 	}
-
 	return expr
 }
 
 // addMacroCall adds the macro the the MacroCalls map in source info. If a macro has args/subargs/target
 // that are macros, their ID will be stored instead for later self-lookups.
-func (p *parserHelper) addMacroCall(exprID int64, function string, target *exprpb.Expr, args ...*exprpb.Expr) {
-	macroTarget := target
-	if target != nil {
-		if _, found := p.macroCalls[target.GetId()]; found {
-			macroTarget = &exprpb.Expr{Id: target.GetId()}
-		} else {
-			macroTarget = p.buildMacroCallArg(target)
-		}
-	}
-
-	macroArgs := make([]*exprpb.Expr, len(args))
+func (p *parserHelper) addMacroCall(exprID int64, function string, target ast.Expr, args ...ast.Expr) {
+	macroArgs := make([]ast.Expr, len(args))
 	for index, arg := range args {
 		macroArgs[index] = p.buildMacroCallArg(arg)
 	}
-
-	p.macroCalls[exprID] = &exprpb.Expr{
-		ExprKind: &exprpb.Expr_CallExpr{
-			CallExpr: &exprpb.Expr_Call{
-				Target:   macroTarget,
-				Function: function,
-				Args:     macroArgs,
-			},
-		},
+	if target == nil {
+		p.sourceInfo.SetMacroCall(exprID, p.exprFactory.NewCall(0, function, macroArgs...))
+		return
+	}
+	macroTarget := target
+	if _, found := p.sourceInfo.GetMacroCall(target.ID()); found {
+		macroTarget = p.exprFactory.NewUnspecifiedExpr(target.ID())
+	} else {
+		macroTarget = p.buildMacroCallArg(target)
 	}
+	p.sourceInfo.SetMacroCall(exprID, p.exprFactory.NewMemberCall(0, function, macroTarget, macroArgs...))
 }
 
-// balancer performs tree balancing on operators whose arguments are of equal precedence.
+// logicManager compacts logical trees into a more efficient structure which is semantically
+// equivalent with how the logic graph is constructed by the ANTLR parser.
 //
-// The purpose of the balancer is to ensure a compact serialization format for the logical &&, ||
+// The purpose of the logicManager is to ensure a compact serialization format for the logical &&, ||
 // operators which have a tendency to create long DAGs which are skewed in one direction. Since the
 // operators are commutative re-ordering the terms *must not* affect the evaluation result.
 //
-// Re-balancing the terms is a safe, if somewhat controversial choice. A better solution would be
-// to make these functions variadic and update both the checker and interpreter to understand this;
-// however, this is a more complex change.
-//
-// TODO: Consider replacing tree-balancing with variadic logical &&, || within the parser, checker,
-// and interpreter.
-type balancer struct {
-	helper   *parserHelper
-	function string
-	terms    []*exprpb.Expr
-	ops      []int64
-}
-
-// newBalancer creates a balancer instance bound to a specific function and its first term.
-func newBalancer(h *parserHelper, function string, term *exprpb.Expr) *balancer {
-	return &balancer{
-		helper:   h,
-		function: function,
-		terms:    []*exprpb.Expr{term},
-		ops:      []int64{},
+// The logic manager will either render the terms to N-chained && / || operators as a single logical
+// call with N-terms, or will rebalance the tree. Rebalancing the terms is a safe, if somewhat
+// controversial choice as it alters the traditional order of execution assumptions present in most
+// expressions.
+type logicManager struct {
+	exprFactory  ast.ExprFactory
+	function     string
+	terms        []ast.Expr
+	ops          []int64
+	variadicASTs bool
+}
+
+// newVariadicLogicManager creates a logic manager instance bound to a specific function and its first term.
+func newVariadicLogicManager(fac ast.ExprFactory, function string, term ast.Expr) *logicManager {
+	return &logicManager{
+		exprFactory:  fac,
+		function:     function,
+		terms:        []ast.Expr{term},
+		ops:          []int64{},
+		variadicASTs: true,
+	}
+}
+
+// newBalancingLogicManager creates a logic manager instance bound to a specific function and its first term.
+func newBalancingLogicManager(fac ast.ExprFactory, function string, term ast.Expr) *logicManager {
+	return &logicManager{
+		exprFactory:  fac,
+		function:     function,
+		terms:        []ast.Expr{term},
+		ops:          []int64{},
+		variadicASTs: false,
 	}
 }
 
 // addTerm adds an operation identifier and term to the set of terms to be balanced.
-func (b *balancer) addTerm(op int64, term *exprpb.Expr) {
-	b.terms = append(b.terms, term)
-	b.ops = append(b.ops, op)
+func (l *logicManager) addTerm(op int64, term ast.Expr) {
+	l.terms = append(l.terms, term)
+	l.ops = append(l.ops, op)
 }
 
-// balance creates a balanced tree from the sub-terms and returns the final Expr value.
-func (b *balancer) balance() *exprpb.Expr {
-	if len(b.terms) == 1 {
-		return b.terms[0]
+// toExpr renders the logic graph into an Expr value, either balancing a tree of logical
+// operations or creating a variadic representation of the logical operator.
+func (l *logicManager) toExpr() ast.Expr {
+	if len(l.terms) == 1 {
+		return l.terms[0]
+	}
+	if l.variadicASTs {
+		return l.exprFactory.NewCall(l.ops[0], l.function, l.terms...)
 	}
-	return b.balancedTree(0, len(b.ops)-1)
+	return l.balancedTree(0, len(l.ops)-1)
 }
 
 // balancedTree recursively balances the terms provided to a commutative operator.
-func (b *balancer) balancedTree(lo, hi int) *exprpb.Expr {
+func (l *logicManager) balancedTree(lo, hi int) ast.Expr {
 	mid := (lo + hi + 1) / 2
 
-	var left *exprpb.Expr
+	var left ast.Expr
 	if mid == lo {
-		left = b.terms[mid]
+		left = l.terms[mid]
 	} else {
-		left = b.balancedTree(lo, mid-1)
+		left = l.balancedTree(lo, mid-1)
 	}
 
-	var right *exprpb.Expr
+	var right ast.Expr
 	if mid == hi {
-		right = b.terms[mid+1]
+		right = l.terms[mid+1]
 	} else {
-		right = b.balancedTree(mid+1, hi)
+		right = l.balancedTree(mid+1, hi)
 	}
-	return b.helper.newGlobalCall(b.ops[mid], b.function, left, right)
+	return l.exprFactory.NewCall(l.ops[mid], l.function, left, right)
 }
 
 type exprHelper struct {
@@ -369,197 +331,173 @@ func (e *exprHelper) nextMacroID() int64 {
 }
 
 // Copy implements the ExprHelper interface method by producing a copy of the input Expr value
-// with a fresh set of numeric identifiers the Expr and all its descendents.
-func (e *exprHelper) Copy(expr *exprpb.Expr) *exprpb.Expr {
-	copy := e.parserHelper.newExpr(e.parserHelper.getLocation(expr.GetId()))
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_ConstExpr:
-		copy.ExprKind = &exprpb.Expr_ConstExpr{ConstExpr: expr.GetConstExpr()}
-	case *exprpb.Expr_IdentExpr:
-		copy.ExprKind = &exprpb.Expr_IdentExpr{IdentExpr: expr.GetIdentExpr()}
-	case *exprpb.Expr_SelectExpr:
-		op := expr.GetSelectExpr().GetOperand()
-		copy.ExprKind = &exprpb.Expr_SelectExpr{SelectExpr: &exprpb.Expr_Select{
-			Operand:  e.Copy(op),
-			Field:    expr.GetSelectExpr().GetField(),
-			TestOnly: expr.GetSelectExpr().GetTestOnly(),
-		}}
-	case *exprpb.Expr_CallExpr:
-		call := expr.GetCallExpr()
-		target := call.GetTarget()
-		if target != nil {
-			target = e.Copy(target)
+// with a fresh set of numeric identifiers the Expr and all its descendants.
+func (e *exprHelper) Copy(expr ast.Expr) ast.Expr {
+	offsetRange, _ := e.parserHelper.sourceInfo.GetOffsetRange(expr.ID())
+	copyID := e.parserHelper.newID(offsetRange)
+	switch expr.Kind() {
+	case ast.LiteralKind:
+		return e.exprFactory.NewLiteral(copyID, expr.AsLiteral())
+	case ast.IdentKind:
+		return e.exprFactory.NewIdent(copyID, expr.AsIdent())
+	case ast.SelectKind:
+		sel := expr.AsSelect()
+		op := e.Copy(sel.Operand())
+		if sel.IsTestOnly() {
+			return e.exprFactory.NewPresenceTest(copyID, op, sel.FieldName())
 		}
-		args := call.GetArgs()
-		argsCopy := make([]*exprpb.Expr, len(args))
+		return e.exprFactory.NewSelect(copyID, op, sel.FieldName())
+	case ast.CallKind:
+		call := expr.AsCall()
+		args := call.Args()
+		argsCopy := make([]ast.Expr, len(args))
 		for i, arg := range args {
 			argsCopy[i] = e.Copy(arg)
 		}
-		copy.ExprKind = &exprpb.Expr_CallExpr{
-			CallExpr: &exprpb.Expr_Call{
-				Function: call.GetFunction(),
-				Target:   target,
-				Args:     argsCopy,
-			},
+		if !call.IsMemberFunction() {
+			return e.exprFactory.NewCall(copyID, call.FunctionName(), argsCopy...)
 		}
-	case *exprpb.Expr_ListExpr:
-		elems := expr.GetListExpr().GetElements()
-		elemsCopy := make([]*exprpb.Expr, len(elems))
+		return e.exprFactory.NewMemberCall(copyID, call.FunctionName(), e.Copy(call.Target()), argsCopy...)
+	case ast.ListKind:
+		list := expr.AsList()
+		elems := list.Elements()
+		elemsCopy := make([]ast.Expr, len(elems))
 		for i, elem := range elems {
 			elemsCopy[i] = e.Copy(elem)
 		}
-		copy.ExprKind = &exprpb.Expr_ListExpr{
-			ListExpr: &exprpb.Expr_CreateList{Elements: elemsCopy},
+		return e.exprFactory.NewList(copyID, elemsCopy, list.OptionalIndices())
+	case ast.MapKind:
+		m := expr.AsMap()
+		entries := m.Entries()
+		entriesCopy := make([]ast.EntryExpr, len(entries))
+		for i, en := range entries {
+			entry := en.AsMapEntry()
+			entryID := e.nextMacroID()
+			entriesCopy[i] = e.exprFactory.NewMapEntry(entryID,
+				e.Copy(entry.Key()), e.Copy(entry.Value()), entry.IsOptional())
 		}
-	case *exprpb.Expr_StructExpr:
-		entries := expr.GetStructExpr().GetEntries()
-		entriesCopy := make([]*exprpb.Expr_CreateStruct_Entry, len(entries))
-		for i, entry := range entries {
-			entryCopy := &exprpb.Expr_CreateStruct_Entry{}
-			entryCopy.Id = e.nextMacroID()
-			switch entry.GetKeyKind().(type) {
-			case *exprpb.Expr_CreateStruct_Entry_FieldKey:
-				entryCopy.KeyKind = &exprpb.Expr_CreateStruct_Entry_FieldKey{
-					FieldKey: entry.GetFieldKey(),
-				}
-			case *exprpb.Expr_CreateStruct_Entry_MapKey:
-				entryCopy.KeyKind = &exprpb.Expr_CreateStruct_Entry_MapKey{
-					MapKey: e.Copy(entry.GetMapKey()),
-				}
-			}
-			entryCopy.Value = e.Copy(entry.GetValue())
-			entriesCopy[i] = entryCopy
-		}
-		copy.ExprKind = &exprpb.Expr_StructExpr{
-			StructExpr: &exprpb.Expr_CreateStruct{
-				MessageName: expr.GetStructExpr().GetMessageName(),
-				Entries:     entriesCopy,
-			},
-		}
-	case *exprpb.Expr_ComprehensionExpr:
-		iterRange := e.Copy(expr.GetComprehensionExpr().GetIterRange())
-		accuInit := e.Copy(expr.GetComprehensionExpr().GetAccuInit())
-		cond := e.Copy(expr.GetComprehensionExpr().GetLoopCondition())
-		step := e.Copy(expr.GetComprehensionExpr().GetLoopStep())
-		result := e.Copy(expr.GetComprehensionExpr().GetResult())
-		copy.ExprKind = &exprpb.Expr_ComprehensionExpr{
-			ComprehensionExpr: &exprpb.Expr_Comprehension{
-				IterRange:     iterRange,
-				IterVar:       expr.GetComprehensionExpr().GetIterVar(),
-				AccuInit:      accuInit,
-				AccuVar:       expr.GetComprehensionExpr().GetAccuVar(),
-				LoopCondition: cond,
-				LoopStep:      step,
-				Result:        result,
-			},
+		return e.exprFactory.NewMap(copyID, entriesCopy)
+	case ast.StructKind:
+		s := expr.AsStruct()
+		fields := s.Fields()
+		fieldsCopy := make([]ast.EntryExpr, len(fields))
+		for i, f := range fields {
+			field := f.AsStructField()
+			fieldID := e.nextMacroID()
+			fieldsCopy[i] = e.exprFactory.NewStructField(fieldID,
+				field.Name(), e.Copy(field.Value()), field.IsOptional())
 		}
+		return e.exprFactory.NewStruct(copyID, s.TypeName(), fieldsCopy)
+	case ast.ComprehensionKind:
+		compre := expr.AsComprehension()
+		iterRange := e.Copy(compre.IterRange())
+		accuInit := e.Copy(compre.AccuInit())
+		cond := e.Copy(compre.LoopCondition())
+		step := e.Copy(compre.LoopStep())
+		result := e.Copy(compre.Result())
+		// All comprehensions can be represented by the two-variable comprehension since the
+		// differentiation between one and two-variable is whether the iterVar2 value is non-empty.
+		return e.exprFactory.NewComprehensionTwoVar(copyID,
+			iterRange, compre.IterVar(), compre.IterVar2(), compre.AccuVar(), accuInit, cond, step, result)
 	}
-	return copy
-}
-
-// LiteralBool implements the ExprHelper interface method.
-func (e *exprHelper) LiteralBool(value bool) *exprpb.Expr {
-	return e.parserHelper.newLiteralBool(e.nextMacroID(), value)
-}
-
-// LiteralBytes implements the ExprHelper interface method.
-func (e *exprHelper) LiteralBytes(value []byte) *exprpb.Expr {
-	return e.parserHelper.newLiteralBytes(e.nextMacroID(), value)
-}
-
-// LiteralDouble implements the ExprHelper interface method.
-func (e *exprHelper) LiteralDouble(value float64) *exprpb.Expr {
-	return e.parserHelper.newLiteralDouble(e.nextMacroID(), value)
-}
-
-// LiteralInt implements the ExprHelper interface method.
-func (e *exprHelper) LiteralInt(value int64) *exprpb.Expr {
-	return e.parserHelper.newLiteralInt(e.nextMacroID(), value)
-}
-
-// LiteralString implements the ExprHelper interface method.
-func (e *exprHelper) LiteralString(value string) *exprpb.Expr {
-	return e.parserHelper.newLiteralString(e.nextMacroID(), value)
+	return e.exprFactory.NewUnspecifiedExpr(copyID)
 }
 
-// LiteralUint implements the ExprHelper interface method.
-func (e *exprHelper) LiteralUint(value uint64) *exprpb.Expr {
-	return e.parserHelper.newLiteralUint(e.nextMacroID(), value)
+// NewLiteral implements the ExprHelper interface method.
+func (e *exprHelper) NewLiteral(value ref.Val) ast.Expr {
+	return e.exprFactory.NewLiteral(e.nextMacroID(), value)
 }
 
 // NewList implements the ExprHelper interface method.
-func (e *exprHelper) NewList(elems ...*exprpb.Expr) *exprpb.Expr {
-	return e.parserHelper.newList(e.nextMacroID(), elems)
+func (e *exprHelper) NewList(elems ...ast.Expr) ast.Expr {
+	return e.exprFactory.NewList(e.nextMacroID(), elems, []int32{})
 }
 
 // NewMap implements the ExprHelper interface method.
-func (e *exprHelper) NewMap(entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
-	return e.parserHelper.newMap(e.nextMacroID(), entries...)
+func (e *exprHelper) NewMap(entries ...ast.EntryExpr) ast.Expr {
+	return e.exprFactory.NewMap(e.nextMacroID(), entries)
 }
 
 // NewMapEntry implements the ExprHelper interface method.
-func (e *exprHelper) NewMapEntry(key *exprpb.Expr, val *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
-	return e.parserHelper.newMapEntry(e.nextMacroID(), key, val, optional)
+func (e *exprHelper) NewMapEntry(key ast.Expr, val ast.Expr, optional bool) ast.EntryExpr {
+	return e.exprFactory.NewMapEntry(e.nextMacroID(), key, val, optional)
 }
 
-// NewObject implements the ExprHelper interface method.
-func (e *exprHelper) NewObject(typeName string, fieldInits ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr {
-	return e.parserHelper.newObject(e.nextMacroID(), typeName, fieldInits...)
+// NewStruct implements the ExprHelper interface method.
+func (e *exprHelper) NewStruct(typeName string, fieldInits ...ast.EntryExpr) ast.Expr {
+	return e.exprFactory.NewStruct(e.nextMacroID(), typeName, fieldInits)
 }
 
-// NewObjectFieldInit implements the ExprHelper interface method.
-func (e *exprHelper) NewObjectFieldInit(field string, init *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry {
-	return e.parserHelper.newObjectField(e.nextMacroID(), field, init, optional)
+// NewStructField implements the ExprHelper interface method.
+func (e *exprHelper) NewStructField(field string, init ast.Expr, optional bool) ast.EntryExpr {
+	return e.exprFactory.NewStructField(e.nextMacroID(), field, init, optional)
 }
 
-// Fold implements the ExprHelper interface method.
-func (e *exprHelper) Fold(iterVar string,
-	iterRange *exprpb.Expr,
+// NewComprehension implements the ExprHelper interface method.
+func (e *exprHelper) NewComprehension(
+	iterRange ast.Expr,
+	iterVar string,
 	accuVar string,
-	accuInit *exprpb.Expr,
-	condition *exprpb.Expr,
-	step *exprpb.Expr,
-	result *exprpb.Expr) *exprpb.Expr {
-	return e.parserHelper.newComprehension(
-		e.nextMacroID(), iterVar, iterRange, accuVar, accuInit, condition, step, result)
+	accuInit ast.Expr,
+	condition ast.Expr,
+	step ast.Expr,
+	result ast.Expr) ast.Expr {
+	return e.exprFactory.NewComprehension(
+		e.nextMacroID(), iterRange, iterVar, accuVar, accuInit, condition, step, result)
+}
+
+// NewComprehensionTwoVar implements the ExprHelper interface method.
+func (e *exprHelper) NewComprehensionTwoVar(
+	iterRange ast.Expr,
+	iterVar,
+	iterVar2,
+	accuVar string,
+	accuInit,
+	condition,
+	step,
+	result ast.Expr) ast.Expr {
+	return e.exprFactory.NewComprehensionTwoVar(
+		e.nextMacroID(), iterRange, iterVar, iterVar2, accuVar, accuInit, condition, step, result)
 }
 
-// Ident implements the ExprHelper interface method.
-func (e *exprHelper) Ident(name string) *exprpb.Expr {
-	return e.parserHelper.newIdent(e.nextMacroID(), name)
+// NewIdent implements the ExprHelper interface method.
+func (e *exprHelper) NewIdent(name string) ast.Expr {
+	return e.exprFactory.NewIdent(e.nextMacroID(), name)
 }
 
-// AccuIdent implements the ExprHelper interface method.
-func (e *exprHelper) AccuIdent() *exprpb.Expr {
-	return e.parserHelper.newIdent(e.nextMacroID(), AccumulatorName)
+// NewAccuIdent implements the ExprHelper interface method.
+func (e *exprHelper) NewAccuIdent() ast.Expr {
+	return e.exprFactory.NewAccuIdent(e.nextMacroID())
 }
 
-// GlobalCall implements the ExprHelper interface method.
-func (e *exprHelper) GlobalCall(function string, args ...*exprpb.Expr) *exprpb.Expr {
-	return e.parserHelper.newGlobalCall(e.nextMacroID(), function, args...)
+// NewGlobalCall implements the ExprHelper interface method.
+func (e *exprHelper) NewCall(function string, args ...ast.Expr) ast.Expr {
+	return e.exprFactory.NewCall(e.nextMacroID(), function, args...)
 }
 
-// ReceiverCall implements the ExprHelper interface method.
-func (e *exprHelper) ReceiverCall(function string,
-	target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr {
-	return e.parserHelper.newReceiverCall(e.nextMacroID(), function, target, args...)
+// NewMemberCall implements the ExprHelper interface method.
+func (e *exprHelper) NewMemberCall(function string, target ast.Expr, args ...ast.Expr) ast.Expr {
+	return e.exprFactory.NewMemberCall(e.nextMacroID(), function, target, args...)
 }
 
-// PresenceTest implements the ExprHelper interface method.
-func (e *exprHelper) PresenceTest(operand *exprpb.Expr, field string) *exprpb.Expr {
-	return e.parserHelper.newPresenceTest(e.nextMacroID(), operand, field)
+// NewPresenceTest implements the ExprHelper interface method.
+func (e *exprHelper) NewPresenceTest(operand ast.Expr, field string) ast.Expr {
+	return e.exprFactory.NewPresenceTest(e.nextMacroID(), operand, field)
 }
 
-// Select implements the ExprHelper interface method.
-func (e *exprHelper) Select(operand *exprpb.Expr, field string) *exprpb.Expr {
-	return e.parserHelper.newSelect(e.nextMacroID(), operand, field)
+// NewSelect implements the ExprHelper interface method.
+func (e *exprHelper) NewSelect(operand ast.Expr, field string) ast.Expr {
+	return e.exprFactory.NewSelect(e.nextMacroID(), operand, field)
 }
 
 // OffsetLocation implements the ExprHelper interface method.
 func (e *exprHelper) OffsetLocation(exprID int64) common.Location {
-	offset := e.parserHelper.positions[exprID]
-	location, _ := e.parserHelper.source.OffsetLocation(offset)
-	return location
+	return e.parserHelper.sourceInfo.GetStartLocation(exprID)
+}
+
+// NewError associates an error message with a given expression id, populating the source offset location of the error if possible.
+func (e *exprHelper) NewError(exprID int64, message string) *common.Error {
+	return common.NewError(exprID, message, e.OffsetLocation(exprID))
 }
 
 var (
diff --git a/vendor/github.com/google/cel-go/parser/input.go b/vendor/github.com/google/cel-go/parser/input.go
index 810eaff..4479245 100644
--- a/vendor/github.com/google/cel-go/parser/input.go
+++ b/vendor/github.com/google/cel-go/parser/input.go
@@ -15,7 +15,7 @@
 package parser
 
 import (
-	antlr "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+	antlr "github.com/antlr4-go/antlr/v4"
 
 	"github.com/google/cel-go/common/runes"
 )
@@ -110,7 +110,7 @@ func (c *charStream) GetTextFromTokens(start, stop antlr.Token) string {
 }
 
 // GetTextFromInterval implements (antlr.CharStream).GetTextFromInterval.
-func (c *charStream) GetTextFromInterval(i *antlr.Interval) string {
+func (c *charStream) GetTextFromInterval(i antlr.Interval) string {
 	return c.GetText(i.Start, i.Stop)
 }
 
diff --git a/vendor/github.com/google/cel-go/parser/macro.go b/vendor/github.com/google/cel-go/parser/macro.go
index 80e5c66..dcd2322 100644
--- a/vendor/github.com/google/cel-go/parser/macro.go
+++ b/vendor/github.com/google/cel-go/parser/macro.go
@@ -18,9 +18,10 @@ import (
 	"fmt"
 
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/types"
+	"github.com/google/cel-go/common/types/ref"
 )
 
 // NewGlobalMacro creates a Macro for a global function with the specified arg count.
@@ -142,58 +143,39 @@ func makeVarArgMacroKey(name string, receiverStyle bool) string {
 // and produces as output an Expr ast node.
 //
 // Note: when the Macro.IsReceiverStyle() method returns true, the target argument will be nil.
-type MacroExpander func(eh ExprHelper,
-	target *exprpb.Expr,
-	args []*exprpb.Expr) (*exprpb.Expr, *common.Error)
+type MacroExpander func(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error)
 
-// ExprHelper assists with the manipulation of proto-based Expr values in a manner which is
-// consistent with the source position and expression id generation code leveraged by both
-// the parser and type-checker.
+// ExprHelper assists with the creation of Expr values in a manner which is consistent
+// the internal semantics and id generation behaviors of the parser and checker libraries.
 type ExprHelper interface {
 	// Copy the input expression with a brand new set of identifiers.
-	Copy(*exprpb.Expr) *exprpb.Expr
-
-	// LiteralBool creates an Expr value for a bool literal.
-	LiteralBool(value bool) *exprpb.Expr
-
-	// LiteralBytes creates an Expr value for a byte literal.
-	LiteralBytes(value []byte) *exprpb.Expr
-
-	// LiteralDouble creates an Expr value for double literal.
-	LiteralDouble(value float64) *exprpb.Expr
+	Copy(ast.Expr) ast.Expr
 
-	// LiteralInt creates an Expr value for an int literal.
-	LiteralInt(value int64) *exprpb.Expr
+	// Literal creates an Expr value for a scalar literal value.
+	NewLiteral(value ref.Val) ast.Expr
 
-	// LiteralString creates am Expr value for a string literal.
-	LiteralString(value string) *exprpb.Expr
-
-	// LiteralUint creates an Expr value for a uint literal.
-	LiteralUint(value uint64) *exprpb.Expr
-
-	// NewList creates a CreateList instruction where the list is comprised of the optional set
-	// of elements provided as arguments.
-	NewList(elems ...*exprpb.Expr) *exprpb.Expr
+	// NewList creates a list literal instruction with an optional set of elements.
+	NewList(elems ...ast.Expr) ast.Expr
 
 	// NewMap creates a CreateStruct instruction for a map where the map is comprised of the
 	// optional set of key, value entries.
-	NewMap(entries ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr
+	NewMap(entries ...ast.EntryExpr) ast.Expr
 
 	// NewMapEntry creates a Map Entry for the key, value pair.
-	NewMapEntry(key *exprpb.Expr, val *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry
+	NewMapEntry(key ast.Expr, val ast.Expr, optional bool) ast.EntryExpr
 
-	// NewObject creates a CreateStruct instruction for an object with a given type name and
-	// optional set of field initializers.
-	NewObject(typeName string, fieldInits ...*exprpb.Expr_CreateStruct_Entry) *exprpb.Expr
+	// NewStruct creates a struct literal expression with an optional set of field initializers.
+	NewStruct(typeName string, fieldInits ...ast.EntryExpr) ast.Expr
 
-	// NewObjectFieldInit creates a new Object field initializer from the field name and value.
-	NewObjectFieldInit(field string, init *exprpb.Expr, optional bool) *exprpb.Expr_CreateStruct_Entry
+	// NewStructField creates a new struct field initializer from the field name and value.
+	NewStructField(field string, init ast.Expr, optional bool) ast.EntryExpr
 
-	// Fold creates a fold comprehension instruction.
+	// NewComprehension creates a new one-variable comprehension instruction.
 	//
-	// - iterVar is the iteration variable name.
 	// - iterRange represents the expression that resolves to a list or map where the elements or
 	//   keys (respectively) will be iterated over.
+	// - iterVar is the variable name for the list element value, or the map key, depending on the
+	//   range type.
 	// - accuVar is the accumulation variable name, typically parser.AccumulatorName.
 	// - accuInit is the initial expression whose value will be set for the accuVar prior to
 	//   folding.
@@ -204,34 +186,62 @@ type ExprHelper interface {
 	// The accuVar should not shadow variable names that you would like to reference within the
 	// environment in the step and condition expressions. Presently, the name __result__ is commonly
 	// used by built-in macros but this may change in the future.
-	Fold(iterVar string,
-		iterRange *exprpb.Expr,
+	NewComprehension(iterRange ast.Expr,
+		iterVar,
 		accuVar string,
-		accuInit *exprpb.Expr,
-		condition *exprpb.Expr,
-		step *exprpb.Expr,
-		result *exprpb.Expr) *exprpb.Expr
+		accuInit,
+		condition,
+		step,
+		result ast.Expr) ast.Expr
 
-	// Ident creates an identifier Expr value.
-	Ident(name string) *exprpb.Expr
+	// NewComprehensionTwoVar creates a new two-variable comprehension instruction.
+	//
+	// - iterRange represents the expression that resolves to a list or map where the elements or
+	//   keys (respectively) will be iterated over.
+	// - iterVar is the iteration variable assigned to the list index or the map key.
+	// - iterVar2 is the iteration variable assigned to the list element value or the map key value.
+	// - accuVar is the accumulation variable name, typically parser.AccumulatorName.
+	// - accuInit is the initial expression whose value will be set for the accuVar prior to
+	//   folding.
+	// - condition is the expression to test to determine whether to continue folding.
+	// - step is the expression to evaluation at the conclusion of a single fold iteration.
+	// - result is the computation to evaluate at the conclusion of the fold.
+	//
+	// The accuVar should not shadow variable names that you would like to reference within the
+	// environment in the step and condition expressions. Presently, the name __result__ is commonly
+	// used by built-in macros but this may change in the future.
+	NewComprehensionTwoVar(iterRange ast.Expr,
+		iterVar,
+		iterVar2,
+		accuVar string,
+		accuInit,
+		condition,
+		step,
+		result ast.Expr) ast.Expr
+
+	// NewIdent creates an identifier Expr value.
+	NewIdent(name string) ast.Expr
 
-	// AccuIdent returns an accumulator identifier for use with comprehension results.
-	AccuIdent() *exprpb.Expr
+	// NewAccuIdent returns an accumulator identifier for use with comprehension results.
+	NewAccuIdent() ast.Expr
 
-	// GlobalCall creates a function call Expr value for a global (free) function.
-	GlobalCall(function string, args ...*exprpb.Expr) *exprpb.Expr
+	// NewCall creates a function call Expr value for a global (free) function.
+	NewCall(function string, args ...ast.Expr) ast.Expr
 
-	// ReceiverCall creates a function call Expr value for a receiver-style function.
-	ReceiverCall(function string, target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr
+	// NewMemberCall creates a function call Expr value for a receiver-style function.
+	NewMemberCall(function string, target ast.Expr, args ...ast.Expr) ast.Expr
 
-	// PresenceTest creates a Select TestOnly Expr value for modelling has() semantics.
-	PresenceTest(operand *exprpb.Expr, field string) *exprpb.Expr
+	// NewPresenceTest creates a Select TestOnly Expr value for modelling has() semantics.
+	NewPresenceTest(operand ast.Expr, field string) ast.Expr
 
-	// Select create a field traversal Expr value.
-	Select(operand *exprpb.Expr, field string) *exprpb.Expr
+	// NewSelect create a field traversal Expr value.
+	NewSelect(operand ast.Expr, field string) ast.Expr
 
 	// OffsetLocation returns the Location of the expression identifier.
 	OffsetLocation(exprID int64) common.Location
+
+	// NewError associates an error message with a given expression id.
+	NewError(exprID int64, message string) *common.Error
 }
 
 var (
@@ -249,8 +259,13 @@ var (
 
 	// ExistsOneMacro expands "range.exists_one(var, predicate)", which is true if for exactly one
 	// element in range the predicate holds.
+	// Deprecated: Use ExistsOneMacroNew
 	ExistsOneMacro = NewReceiverMacro(operators.ExistsOne, 2, MakeExistsOne)
 
+	// ExistsOneMacroNew expands "range.existsOne(var, predicate)", which is true if for exactly one
+	// element in range the predicate holds.
+	ExistsOneMacroNew = NewReceiverMacro("existsOne", 2, MakeExistsOne)
+
 	// MapMacro expands "range.map(var, function)" into a comprehension which applies the function
 	// to each element in the range to produce a new list.
 	MapMacro = NewReceiverMacro(operators.Map, 2, MakeMap)
@@ -270,6 +285,7 @@ var (
 		AllMacro,
 		ExistsMacro,
 		ExistsOneMacro,
+		ExistsOneMacroNew,
 		MapMacro,
 		MapFilterMacro,
 		FilterMacro,
@@ -293,21 +309,21 @@ const (
 // MakeAll expands the input call arguments into a comprehension that returns true if all of the
 // elements in the range match the predicate expressions:
 // <iterRange>.all(<iterVar>, <predicate>)
-func MakeAll(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func MakeAll(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	return makeQuantifier(quantifierAll, eh, target, args)
 }
 
 // MakeExists expands the input call arguments into a comprehension that returns true if any of the
 // elements in the range match the predicate expressions:
 // <iterRange>.exists(<iterVar>, <predicate>)
-func MakeExists(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func MakeExists(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	return makeQuantifier(quantifierExists, eh, target, args)
 }
 
 // MakeExistsOne expands the input call arguments into a comprehension that returns true if exactly
 // one of the elements in the range match the predicate expressions:
 // <iterRange>.exists_one(<iterVar>, <predicate>)
-func MakeExistsOne(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func MakeExistsOne(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	return makeQuantifier(quantifierExistsOne, eh, target, args)
 }
 
@@ -321,14 +337,17 @@ func MakeExistsOne(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*ex
 //
 // In the second form only iterVar values which return true when provided to the predicate expression
 // are transformed.
-func MakeMap(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func MakeMap(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	v, found := extractIdent(args[0])
 	if !found {
-		return nil, &common.Error{Message: "argument is not an identifier"}
+		return nil, eh.NewError(args[0].ID(), "argument is not an identifier")
+	}
+	if v == AccumulatorName {
+		return nil, eh.NewError(args[0].ID(), "iteration variable overwrites accumulator variable")
 	}
 
-	var fn *exprpb.Expr
-	var filter *exprpb.Expr
+	var fn ast.Expr
+	var filter ast.Expr
 
 	if len(args) == 3 {
 		filter = args[1]
@@ -338,88 +357,87 @@ func MakeMap(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.E
 		fn = args[1]
 	}
 
-	accuExpr := eh.Ident(AccumulatorName)
 	init := eh.NewList()
-	condition := eh.LiteralBool(true)
-	step := eh.GlobalCall(operators.Add, accuExpr, eh.NewList(fn))
+	condition := eh.NewLiteral(types.True)
+	step := eh.NewCall(operators.Add, eh.NewAccuIdent(), eh.NewList(fn))
 
 	if filter != nil {
-		step = eh.GlobalCall(operators.Conditional, filter, step, accuExpr)
+		step = eh.NewCall(operators.Conditional, filter, step, eh.NewAccuIdent())
 	}
-	return eh.Fold(v, target, AccumulatorName, init, condition, step, accuExpr), nil
+	return eh.NewComprehension(target, v, AccumulatorName, init, condition, step, eh.NewAccuIdent()), nil
 }
 
 // MakeFilter expands the input call arguments into a comprehension which produces a list which contains
 // only elements which match the provided predicate expression:
 // <iterRange>.filter(<iterVar>, <predicate>)
-func MakeFilter(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func MakeFilter(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	v, found := extractIdent(args[0])
 	if !found {
-		return nil, &common.Error{Message: "argument is not an identifier"}
+		return nil, eh.NewError(args[0].ID(), "argument is not an identifier")
+	}
+	if v == AccumulatorName {
+		return nil, eh.NewError(args[0].ID(), "iteration variable overwrites accumulator variable")
 	}
 
 	filter := args[1]
-	accuExpr := eh.Ident(AccumulatorName)
 	init := eh.NewList()
-	condition := eh.LiteralBool(true)
-	step := eh.GlobalCall(operators.Add, accuExpr, eh.NewList(args[0]))
-	step = eh.GlobalCall(operators.Conditional, filter, step, accuExpr)
-	return eh.Fold(v, target, AccumulatorName, init, condition, step, accuExpr), nil
+	condition := eh.NewLiteral(types.True)
+	step := eh.NewCall(operators.Add, eh.NewAccuIdent(), eh.NewList(args[0]))
+	step = eh.NewCall(operators.Conditional, filter, step, eh.NewAccuIdent())
+	return eh.NewComprehension(target, v, AccumulatorName, init, condition, step, eh.NewAccuIdent()), nil
 }
 
 // MakeHas expands the input call arguments into a presence test, e.g. has(<operand>.field)
-func MakeHas(eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
-	if s, ok := args[0].ExprKind.(*exprpb.Expr_SelectExpr); ok {
-		return eh.PresenceTest(s.SelectExpr.GetOperand(), s.SelectExpr.GetField()), nil
+func MakeHas(eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
+	if args[0].Kind() == ast.SelectKind {
+		s := args[0].AsSelect()
+		return eh.NewPresenceTest(s.Operand(), s.FieldName()), nil
 	}
-	return nil, &common.Error{Message: "invalid argument to has() macro"}
+	return nil, eh.NewError(args[0].ID(), "invalid argument to has() macro")
 }
 
-func makeQuantifier(kind quantifierKind, eh ExprHelper, target *exprpb.Expr, args []*exprpb.Expr) (*exprpb.Expr, *common.Error) {
+func makeQuantifier(kind quantifierKind, eh ExprHelper, target ast.Expr, args []ast.Expr) (ast.Expr, *common.Error) {
 	v, found := extractIdent(args[0])
 	if !found {
-		location := eh.OffsetLocation(args[0].GetId())
-		return nil, &common.Error{
-			Message:  "argument must be a simple name",
-			Location: location,
-		}
+		return nil, eh.NewError(args[0].ID(), "argument must be a simple name")
+	}
+	if v == AccumulatorName {
+		return nil, eh.NewError(args[0].ID(), "iteration variable overwrites accumulator variable")
 	}
 
-	var init *exprpb.Expr
-	var condition *exprpb.Expr
-	var step *exprpb.Expr
-	var result *exprpb.Expr
+	var init ast.Expr
+	var condition ast.Expr
+	var step ast.Expr
+	var result ast.Expr
 	switch kind {
 	case quantifierAll:
-		init = eh.LiteralBool(true)
-		condition = eh.GlobalCall(operators.NotStrictlyFalse, eh.AccuIdent())
-		step = eh.GlobalCall(operators.LogicalAnd, eh.AccuIdent(), args[1])
-		result = eh.AccuIdent()
+		init = eh.NewLiteral(types.True)
+		condition = eh.NewCall(operators.NotStrictlyFalse, eh.NewAccuIdent())
+		step = eh.NewCall(operators.LogicalAnd, eh.NewAccuIdent(), args[1])
+		result = eh.NewAccuIdent()
 	case quantifierExists:
-		init = eh.LiteralBool(false)
-		condition = eh.GlobalCall(
+		init = eh.NewLiteral(types.False)
+		condition = eh.NewCall(
 			operators.NotStrictlyFalse,
-			eh.GlobalCall(operators.LogicalNot, eh.AccuIdent()))
-		step = eh.GlobalCall(operators.LogicalOr, eh.AccuIdent(), args[1])
-		result = eh.AccuIdent()
+			eh.NewCall(operators.LogicalNot, eh.NewAccuIdent()))
+		step = eh.NewCall(operators.LogicalOr, eh.NewAccuIdent(), args[1])
+		result = eh.NewAccuIdent()
 	case quantifierExistsOne:
-		zeroExpr := eh.LiteralInt(0)
-		oneExpr := eh.LiteralInt(1)
-		init = zeroExpr
-		condition = eh.LiteralBool(true)
-		step = eh.GlobalCall(operators.Conditional, args[1],
-			eh.GlobalCall(operators.Add, eh.AccuIdent(), oneExpr), eh.AccuIdent())
-		result = eh.GlobalCall(operators.Equals, eh.AccuIdent(), oneExpr)
+		init = eh.NewLiteral(types.Int(0))
+		condition = eh.NewLiteral(types.True)
+		step = eh.NewCall(operators.Conditional, args[1],
+			eh.NewCall(operators.Add, eh.NewAccuIdent(), eh.NewLiteral(types.Int(1))), eh.NewAccuIdent())
+		result = eh.NewCall(operators.Equals, eh.NewAccuIdent(), eh.NewLiteral(types.Int(1)))
 	default:
-		return nil, &common.Error{Message: fmt.Sprintf("unrecognized quantifier '%v'", kind)}
+		return nil, eh.NewError(args[0].ID(), fmt.Sprintf("unrecognized quantifier '%v'", kind))
 	}
-	return eh.Fold(v, target, AccumulatorName, init, condition, step, result), nil
+	return eh.NewComprehension(target, v, AccumulatorName, init, condition, step, result), nil
 }
 
-func extractIdent(e *exprpb.Expr) (string, bool) {
-	switch e.ExprKind.(type) {
-	case *exprpb.Expr_IdentExpr:
-		return e.GetIdentExpr().GetName(), true
+func extractIdent(e ast.Expr) (string, bool) {
+	switch e.Kind() {
+	case ast.IdentKind:
+		return e.AsIdent(), true
 	}
 	return "", false
 }
diff --git a/vendor/github.com/google/cel-go/parser/options.go b/vendor/github.com/google/cel-go/parser/options.go
index 674c697..61fc3ad 100644
--- a/vendor/github.com/google/cel-go/parser/options.go
+++ b/vendor/github.com/google/cel-go/parser/options.go
@@ -25,6 +25,7 @@ type options struct {
 	macros                           map[string]Macro
 	populateMacroCalls               bool
 	enableOptionalSyntax             bool
+	enableVariadicOperatorASTs       bool
 }
 
 // Option configures the behavior of the parser.
@@ -125,3 +126,15 @@ func EnableOptionalSyntax(optionalSyntax bool) Option {
 		return nil
 	}
 }
+
+// EnableVariadicOperatorASTs enables a compact representation of chained like-kind commutative
+// operators. e.g. `a || b || c || d` -> `call(op='||', args=[a, b, c, d])`
+//
+// The benefit of enabling variadic operators ASTs is a more compact representation deeply nested
+// logic graphs.
+func EnableVariadicOperatorASTs(varArgASTs bool) Option {
+	return func(opts *options) error {
+		opts.enableVariadicOperatorASTs = varArgASTs
+		return nil
+	}
+}
diff --git a/vendor/github.com/google/cel-go/parser/parser.go b/vendor/github.com/google/cel-go/parser/parser.go
index e6f70f9..5cbb176 100644
--- a/vendor/github.com/google/cel-go/parser/parser.go
+++ b/vendor/github.com/google/cel-go/parser/parser.go
@@ -21,17 +21,15 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
-	"sync"
 
-	antlr "github.com/antlr/antlr4/runtime/Go/antlr/v4"
+	antlr "github.com/antlr4-go/antlr/v4"
 
 	"github.com/google/cel-go/common"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/runes"
+	"github.com/google/cel-go/common/types"
 	"github.com/google/cel-go/parser/gen"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
-	structpb "google.golang.org/protobuf/types/known/structpb"
 )
 
 // Parser encapsulates the context necessary to perform parsing for different expressions.
@@ -88,10 +86,13 @@ func mustNewParser(opts ...Option) *Parser {
 }
 
 // Parse parses the expression represented by source and returns the result.
-func (p *Parser) Parse(source common.Source) (*exprpb.ParsedExpr, *common.Errors) {
+func (p *Parser) Parse(source common.Source) (*ast.AST, *common.Errors) {
+	errs := common.NewErrors(source)
+	fac := ast.NewExprFactory()
 	impl := parser{
-		errors:                           &parseErrors{common.NewErrors(source)},
-		helper:                           newParserHelper(source),
+		errors:                           &parseErrors{errs},
+		exprFactory:                      fac,
+		helper:                           newParserHelper(source, fac),
 		macros:                           p.macros,
 		maxRecursionDepth:                p.maxRecursionDepth,
 		errorReportingLimit:              p.errorReportingLimit,
@@ -99,23 +100,21 @@ func (p *Parser) Parse(source common.Source) (*exprpb.ParsedExpr, *common.Errors
 		errorRecoveryLookaheadTokenLimit: p.errorRecoveryTokenLookaheadLimit,
 		populateMacroCalls:               p.populateMacroCalls,
 		enableOptionalSyntax:             p.enableOptionalSyntax,
+		enableVariadicOperatorASTs:       p.enableVariadicOperatorASTs,
 	}
 	buf, ok := source.(runes.Buffer)
 	if !ok {
 		buf = runes.NewBuffer(source.Content())
 	}
-	var e *exprpb.Expr
+	var out ast.Expr
 	if buf.Len() > p.expressionSizeCodePointLimit {
-		e = impl.reportError(common.NoLocation,
+		out = impl.reportError(common.NoLocation,
 			"expression code point size exceeds limit: size: %d, limit %d",
 			buf.Len(), p.expressionSizeCodePointLimit)
 	} else {
-		e = impl.parse(buf, source.Description())
+		out = impl.parse(buf, source.Description())
 	}
-	return &exprpb.ParsedExpr{
-		Expr:       e,
-		SourceInfo: impl.helper.getSourceInfo(),
-	}, impl.errors.Errors
+	return ast.NewAST(out, impl.helper.getSourceInfo()), errs
 }
 
 // reservedIds are not legal to use as variables.  We exclude them post-parse, as they *are* valid
@@ -148,7 +147,7 @@ var reservedIds = map[string]struct{}{
 // This function calls ParseWithMacros with AllMacros.
 //
 // Deprecated: Use NewParser().Parse() instead.
-func Parse(source common.Source) (*exprpb.ParsedExpr, *common.Errors) {
+func Parse(source common.Source) (*ast.AST, *common.Errors) {
 	return mustNewParser(Macros(AllMacros...)).Parse(source)
 }
 
@@ -285,6 +284,7 @@ var _ antlr.ErrorStrategy = &recoveryLimitErrorStrategy{}
 type parser struct {
 	gen.BaseCELVisitor
 	errors                           *parseErrors
+	exprFactory                      ast.ExprFactory
 	helper                           *parserHelper
 	macros                           map[string]Macro
 	recursionDepth                   int
@@ -295,55 +295,24 @@ type parser struct {
 	errorRecoveryLookaheadTokenLimit int
 	populateMacroCalls               bool
 	enableOptionalSyntax             bool
+	enableVariadicOperatorASTs       bool
 }
 
-var (
-	_ gen.CELVisitor = (*parser)(nil)
+var _ gen.CELVisitor = (*parser)(nil)
 
-	lexerPool *sync.Pool = &sync.Pool{
-		New: func() any {
-			l := gen.NewCELLexer(nil)
-			l.RemoveErrorListeners()
-			return l
-		},
-	}
-
-	parserPool *sync.Pool = &sync.Pool{
-		New: func() any {
-			p := gen.NewCELParser(nil)
-			p.RemoveErrorListeners()
-			return p
-		},
-	}
-)
+func (p *parser) parse(expr runes.Buffer, desc string) ast.Expr {
+	lexer := gen.NewCELLexer(newCharStream(expr, desc))
+	lexer.RemoveErrorListeners()
+	lexer.AddErrorListener(p)
 
-func (p *parser) parse(expr runes.Buffer, desc string) *exprpb.Expr {
-	// TODO: get rid of these pools once https://github.com/antlr/antlr4/pull/3571 is in a release
-	lexer := lexerPool.Get().(*gen.CELLexer)
-	prsr := parserPool.Get().(*gen.CELParser)
+	prsr := gen.NewCELParser(antlr.NewCommonTokenStream(lexer, 0))
+	prsr.RemoveErrorListeners()
 
 	prsrListener := &recursionListener{
 		maxDepth:      p.maxRecursionDepth,
 		ruleTypeDepth: map[int]*int{},
 	}
 
-	defer func() {
-		// Unfortunately ANTLR Go runtime is missing (*antlr.BaseParser).RemoveParseListeners,
-		// so this is good enough until that is exported.
-		// Reset the lexer and parser before putting them back in the pool.
-		lexer.RemoveErrorListeners()
-		prsr.RemoveParseListener(prsrListener)
-		prsr.RemoveErrorListeners()
-		lexer.SetInputStream(nil)
-		prsr.SetInputStream(nil)
-		lexerPool.Put(lexer)
-		parserPool.Put(prsr)
-	}()
-
-	lexer.SetInputStream(newCharStream(expr, desc))
-	prsr.SetInputStream(antlr.NewCommonTokenStream(lexer, 0))
-
-	lexer.AddErrorListener(p)
 	prsr.AddErrorListener(p)
 	prsr.AddParseListener(prsrListener)
 
@@ -357,9 +326,9 @@ func (p *parser) parse(expr runes.Buffer, desc string) *exprpb.Expr {
 		if val := recover(); val != nil {
 			switch err := val.(type) {
 			case *lookaheadLimitError:
-				p.errors.ReportError(common.NoLocation, err.Error())
+				p.errors.internalError(err.Error())
 			case *recursionError:
-				p.errors.ReportError(common.NoLocation, err.Error())
+				p.errors.internalError(err.Error())
 			case *tooManyErrors:
 				// do nothing
 			case *recoveryLimitError:
@@ -370,7 +339,7 @@ func (p *parser) parse(expr runes.Buffer, desc string) *exprpb.Expr {
 		}
 	}()
 
-	return p.Visit(prsr.Start()).(*exprpb.Expr)
+	return p.Visit(prsr.Start_()).(ast.Expr)
 }
 
 // Visitor implementations.
@@ -449,7 +418,7 @@ func (p *parser) Visit(tree antlr.ParseTree) any {
 
 	// Report at least one error if the parser reaches an unknown parse element.
 	// Typically, this happens if the parser has already encountered a syntax error elsewhere.
-	if len(p.errors.GetErrors()) == 0 {
+	if p.errors.errorCount() == 0 {
 		txt := "<<nil>>"
 		if t != nil {
 			txt = fmt.Sprintf("<<%T>>", t)
@@ -467,46 +436,46 @@ func (p *parser) VisitStart(ctx *gen.StartContext) any {
 
 // Visit a parse tree produced by CELParser#expr.
 func (p *parser) VisitExpr(ctx *gen.ExprContext) any {
-	result := p.Visit(ctx.GetE()).(*exprpb.Expr)
+	result := p.Visit(ctx.GetE()).(ast.Expr)
 	if ctx.GetOp() == nil {
 		return result
 	}
 	opID := p.helper.id(ctx.GetOp())
-	ifTrue := p.Visit(ctx.GetE1()).(*exprpb.Expr)
-	ifFalse := p.Visit(ctx.GetE2()).(*exprpb.Expr)
+	ifTrue := p.Visit(ctx.GetE1()).(ast.Expr)
+	ifFalse := p.Visit(ctx.GetE2()).(ast.Expr)
 	return p.globalCallOrMacro(opID, operators.Conditional, result, ifTrue, ifFalse)
 }
 
 // Visit a parse tree produced by CELParser#conditionalOr.
 func (p *parser) VisitConditionalOr(ctx *gen.ConditionalOrContext) any {
-	result := p.Visit(ctx.GetE()).(*exprpb.Expr)
-	b := newBalancer(p.helper, operators.LogicalOr, result)
+	result := p.Visit(ctx.GetE()).(ast.Expr)
+	l := p.newLogicManager(operators.LogicalOr, result)
 	rest := ctx.GetE1()
 	for i, op := range ctx.GetOps() {
 		if i >= len(rest) {
 			return p.reportError(ctx, "unexpected character, wanted '||'")
 		}
-		next := p.Visit(rest[i]).(*exprpb.Expr)
+		next := p.Visit(rest[i]).(ast.Expr)
 		opID := p.helper.id(op)
-		b.addTerm(opID, next)
+		l.addTerm(opID, next)
 	}
-	return b.balance()
+	return l.toExpr()
 }
 
 // Visit a parse tree produced by CELParser#conditionalAnd.
 func (p *parser) VisitConditionalAnd(ctx *gen.ConditionalAndContext) any {
-	result := p.Visit(ctx.GetE()).(*exprpb.Expr)
-	b := newBalancer(p.helper, operators.LogicalAnd, result)
+	result := p.Visit(ctx.GetE()).(ast.Expr)
+	l := p.newLogicManager(operators.LogicalAnd, result)
 	rest := ctx.GetE1()
 	for i, op := range ctx.GetOps() {
 		if i >= len(rest) {
 			return p.reportError(ctx, "unexpected character, wanted '&&'")
 		}
-		next := p.Visit(rest[i]).(*exprpb.Expr)
+		next := p.Visit(rest[i]).(ast.Expr)
 		opID := p.helper.id(op)
-		b.addTerm(opID, next)
+		l.addTerm(opID, next)
 	}
-	return b.balance()
+	return l.toExpr()
 }
 
 // Visit a parse tree produced by CELParser#relation.
@@ -516,9 +485,9 @@ func (p *parser) VisitRelation(ctx *gen.RelationContext) any {
 		opText = ctx.GetOp().GetText()
 	}
 	if op, found := operators.Find(opText); found {
-		lhs := p.Visit(ctx.Relation(0)).(*exprpb.Expr)
+		lhs := p.Visit(ctx.Relation(0)).(ast.Expr)
 		opID := p.helper.id(ctx.GetOp())
-		rhs := p.Visit(ctx.Relation(1)).(*exprpb.Expr)
+		rhs := p.Visit(ctx.Relation(1)).(ast.Expr)
 		return p.globalCallOrMacro(opID, op, lhs, rhs)
 	}
 	return p.reportError(ctx, "operator not found")
@@ -531,9 +500,9 @@ func (p *parser) VisitCalc(ctx *gen.CalcContext) any {
 		opText = ctx.GetOp().GetText()
 	}
 	if op, found := operators.Find(opText); found {
-		lhs := p.Visit(ctx.Calc(0)).(*exprpb.Expr)
+		lhs := p.Visit(ctx.Calc(0)).(ast.Expr)
 		opID := p.helper.id(ctx.GetOp())
-		rhs := p.Visit(ctx.Calc(1)).(*exprpb.Expr)
+		rhs := p.Visit(ctx.Calc(1)).(ast.Expr)
 		return p.globalCallOrMacro(opID, op, lhs, rhs)
 	}
 	return p.reportError(ctx, "operator not found")
@@ -549,7 +518,7 @@ func (p *parser) VisitLogicalNot(ctx *gen.LogicalNotContext) any {
 		return p.Visit(ctx.Member())
 	}
 	opID := p.helper.id(ctx.GetOps()[0])
-	target := p.Visit(ctx.Member()).(*exprpb.Expr)
+	target := p.Visit(ctx.Member()).(ast.Expr)
 	return p.globalCallOrMacro(opID, operators.LogicalNot, target)
 }
 
@@ -558,13 +527,13 @@ func (p *parser) VisitNegate(ctx *gen.NegateContext) any {
 		return p.Visit(ctx.Member())
 	}
 	opID := p.helper.id(ctx.GetOps()[0])
-	target := p.Visit(ctx.Member()).(*exprpb.Expr)
+	target := p.Visit(ctx.Member()).(ast.Expr)
 	return p.globalCallOrMacro(opID, operators.Negate, target)
 }
 
 // VisitSelect visits a parse tree produced by CELParser#Select.
 func (p *parser) VisitSelect(ctx *gen.SelectContext) any {
-	operand := p.Visit(ctx.Member()).(*exprpb.Expr)
+	operand := p.Visit(ctx.Member()).(ast.Expr)
 	// Handle the error case where no valid identifier is specified.
 	if ctx.GetId() == nil || ctx.GetOp() == nil {
 		return p.helper.newExpr(ctx)
@@ -585,7 +554,7 @@ func (p *parser) VisitSelect(ctx *gen.SelectContext) any {
 
 // VisitMemberCall visits a parse tree produced by CELParser#MemberCall.
 func (p *parser) VisitMemberCall(ctx *gen.MemberCallContext) any {
-	operand := p.Visit(ctx.Member()).(*exprpb.Expr)
+	operand := p.Visit(ctx.Member()).(ast.Expr)
 	// Handle the error case where no valid identifier is specified.
 	if ctx.GetId() == nil {
 		return p.helper.newExpr(ctx)
@@ -597,13 +566,13 @@ func (p *parser) VisitMemberCall(ctx *gen.MemberCallContext) any {
 
 // Visit a parse tree produced by CELParser#Index.
 func (p *parser) VisitIndex(ctx *gen.IndexContext) any {
-	target := p.Visit(ctx.Member()).(*exprpb.Expr)
+	target := p.Visit(ctx.Member()).(ast.Expr)
 	// Handle the error case where no valid identifier is specified.
 	if ctx.GetOp() == nil {
 		return p.helper.newExpr(ctx)
 	}
 	opID := p.helper.id(ctx.GetOp())
-	index := p.Visit(ctx.GetIndex()).(*exprpb.Expr)
+	index := p.Visit(ctx.GetIndex()).(ast.Expr)
 	operator := operators.Index
 	if ctx.GetOpt() != nil {
 		if !p.enableOptionalSyntax {
@@ -627,7 +596,7 @@ func (p *parser) VisitCreateMessage(ctx *gen.CreateMessageContext) any {
 		messageName = "." + messageName
 	}
 	objID := p.helper.id(ctx.GetOp())
-	entries := p.VisitIFieldInitializerList(ctx.GetEntries()).([]*exprpb.Expr_CreateStruct_Entry)
+	entries := p.VisitIFieldInitializerList(ctx.GetEntries()).([]ast.EntryExpr)
 	return p.helper.newObject(objID, messageName, entries...)
 }
 
@@ -635,16 +604,16 @@ func (p *parser) VisitCreateMessage(ctx *gen.CreateMessageContext) any {
 func (p *parser) VisitIFieldInitializerList(ctx gen.IFieldInitializerListContext) any {
 	if ctx == nil || ctx.GetFields() == nil {
 		// This is the result of a syntax error handled elswhere, return empty.
-		return []*exprpb.Expr_CreateStruct_Entry{}
+		return []ast.EntryExpr{}
 	}
 
-	result := make([]*exprpb.Expr_CreateStruct_Entry, len(ctx.GetFields()))
+	result := make([]ast.EntryExpr, len(ctx.GetFields()))
 	cols := ctx.GetCols()
 	vals := ctx.GetValues()
 	for i, f := range ctx.GetFields() {
 		if i >= len(cols) || i >= len(vals) {
 			// This is the result of a syntax error detected elsewhere.
-			return []*exprpb.Expr_CreateStruct_Entry{}
+			return []ast.EntryExpr{}
 		}
 		initID := p.helper.id(cols[i])
 		optField := f.(*gen.OptFieldContext)
@@ -656,10 +625,10 @@ func (p *parser) VisitIFieldInitializerList(ctx gen.IFieldInitializerListContext
 		// The field may be empty due to a prior error.
 		id := optField.IDENTIFIER()
 		if id == nil {
-			return []*exprpb.Expr_CreateStruct_Entry{}
+			return []ast.EntryExpr{}
 		}
 		fieldName := id.GetText()
-		value := p.Visit(vals[i]).(*exprpb.Expr)
+		value := p.Visit(vals[i]).(ast.Expr)
 		field := p.helper.newObjectField(initID, fieldName, value, optional)
 		result[i] = field
 	}
@@ -699,9 +668,9 @@ func (p *parser) VisitCreateList(ctx *gen.CreateListContext) any {
 // Visit a parse tree produced by CELParser#CreateStruct.
 func (p *parser) VisitCreateStruct(ctx *gen.CreateStructContext) any {
 	structID := p.helper.id(ctx.GetOp())
-	entries := []*exprpb.Expr_CreateStruct_Entry{}
+	entries := []ast.EntryExpr{}
 	if ctx.GetEntries() != nil {
-		entries = p.Visit(ctx.GetEntries()).([]*exprpb.Expr_CreateStruct_Entry)
+		entries = p.Visit(ctx.GetEntries()).([]ast.EntryExpr)
 	}
 	return p.helper.newMap(structID, entries...)
 }
@@ -710,17 +679,17 @@ func (p *parser) VisitCreateStruct(ctx *gen.CreateStructContext) any {
 func (p *parser) VisitMapInitializerList(ctx *gen.MapInitializerListContext) any {
 	if ctx == nil || ctx.GetKeys() == nil {
 		// This is the result of a syntax error handled elswhere, return empty.
-		return []*exprpb.Expr_CreateStruct_Entry{}
+		return []ast.EntryExpr{}
 	}
 
-	result := make([]*exprpb.Expr_CreateStruct_Entry, len(ctx.GetCols()))
+	result := make([]ast.EntryExpr, len(ctx.GetCols()))
 	keys := ctx.GetKeys()
 	vals := ctx.GetValues()
 	for i, col := range ctx.GetCols() {
 		colID := p.helper.id(col)
 		if i >= len(keys) || i >= len(vals) {
 			// This is the result of a syntax error detected elsewhere.
-			return []*exprpb.Expr_CreateStruct_Entry{}
+			return []ast.EntryExpr{}
 		}
 		optKey := keys[i]
 		optional := optKey.GetOpt() != nil
@@ -728,8 +697,8 @@ func (p *parser) VisitMapInitializerList(ctx *gen.MapInitializerListContext) any
 			p.reportError(optKey, "unsupported syntax '?'")
 			continue
 		}
-		key := p.Visit(optKey.GetE()).(*exprpb.Expr)
-		value := p.Visit(vals[i]).(*exprpb.Expr)
+		key := p.Visit(optKey.GetE()).(ast.Expr)
+		value := p.Visit(vals[i]).(ast.Expr)
 		entry := p.helper.newMapEntry(colID, key, value, optional)
 		result[i] = entry
 	}
@@ -809,30 +778,27 @@ func (p *parser) VisitBoolFalse(ctx *gen.BoolFalseContext) any {
 
 // Visit a parse tree produced by CELParser#Null.
 func (p *parser) VisitNull(ctx *gen.NullContext) any {
-	return p.helper.newLiteral(ctx,
-		&exprpb.Constant{
-			ConstantKind: &exprpb.Constant_NullValue{
-				NullValue: structpb.NullValue_NULL_VALUE}})
+	return p.helper.exprFactory.NewLiteral(p.helper.newID(ctx), types.NullValue)
 }
 
-func (p *parser) visitExprList(ctx gen.IExprListContext) []*exprpb.Expr {
+func (p *parser) visitExprList(ctx gen.IExprListContext) []ast.Expr {
 	if ctx == nil {
-		return []*exprpb.Expr{}
+		return []ast.Expr{}
 	}
 	return p.visitSlice(ctx.GetE())
 }
 
-func (p *parser) visitListInit(ctx gen.IListInitContext) ([]*exprpb.Expr, []int32) {
+func (p *parser) visitListInit(ctx gen.IListInitContext) ([]ast.Expr, []int32) {
 	if ctx == nil {
-		return []*exprpb.Expr{}, []int32{}
+		return []ast.Expr{}, []int32{}
 	}
 	elements := ctx.GetElems()
-	result := make([]*exprpb.Expr, len(elements))
+	result := make([]ast.Expr, len(elements))
 	optionals := []int32{}
 	for i, e := range elements {
-		ex := p.Visit(e.GetE()).(*exprpb.Expr)
+		ex := p.Visit(e.GetE()).(ast.Expr)
 		if ex == nil {
-			return []*exprpb.Expr{}, []int32{}
+			return []ast.Expr{}, []int32{}
 		}
 		result[i] = ex
 		if e.GetOpt() != nil {
@@ -846,13 +812,13 @@ func (p *parser) visitListInit(ctx gen.IListInitContext) ([]*exprpb.Expr, []int3
 	return result, optionals
 }
 
-func (p *parser) visitSlice(expressions []gen.IExprContext) []*exprpb.Expr {
+func (p *parser) visitSlice(expressions []gen.IExprContext) []ast.Expr {
 	if expressions == nil {
-		return []*exprpb.Expr{}
+		return []ast.Expr{}
 	}
-	result := make([]*exprpb.Expr, len(expressions))
+	result := make([]ast.Expr, len(expressions))
 	for i, e := range expressions {
-		ex := p.Visit(e).(*exprpb.Expr)
+		ex := p.Visit(e).(ast.Expr)
 		result[i] = ex
 	}
 	return result
@@ -867,24 +833,31 @@ func (p *parser) unquote(ctx any, value string, isBytes bool) string {
 	return text
 }
 
-func (p *parser) reportError(ctx any, format string, args ...any) *exprpb.Expr {
+func (p *parser) newLogicManager(function string, term ast.Expr) *logicManager {
+	if p.enableVariadicOperatorASTs {
+		return newVariadicLogicManager(p.exprFactory, function, term)
+	}
+	return newBalancingLogicManager(p.exprFactory, function, term)
+}
+
+func (p *parser) reportError(ctx any, format string, args ...any) ast.Expr {
 	var location common.Location
-	switch ctx.(type) {
+	err := p.helper.newExpr(ctx)
+	switch c := ctx.(type) {
 	case common.Location:
-		location = ctx.(common.Location)
+		location = c
 	case antlr.Token, antlr.ParserRuleContext:
-		err := p.helper.newExpr(ctx)
-		location = p.helper.getLocation(err.GetId())
+		location = p.helper.getLocation(err.ID())
 	}
-	err := p.helper.newExpr(ctx)
 	// Provide arguments to the report error.
-	p.errors.ReportError(location, format, args...)
+	p.errors.reportErrorAtID(err.ID(), location, format, args...)
 	return err
 }
 
 // ANTLR Parse listener implementations
 func (p *parser) SyntaxError(recognizer antlr.Recognizer, offendingSymbol any, line, column int, msg string, e antlr.RecognitionException) {
-	l := p.helper.source.NewLocation(line, column)
+	offset := p.helper.sourceInfo.ComputeOffset(int32(line), int32(column))
+	l := p.helper.getLocationByOffset(offset)
 	// Hack to keep existing error messages consistent with previous versions of CEL when a reserved word
 	// is used as an identifier. This behavior needs to be overhauled to provide consistent, normalized error
 	// messages out of ANTLR to prevent future breaking changes related to error message content.
@@ -903,33 +876,33 @@ func (p *parser) SyntaxError(recognizer antlr.Recognizer, offendingSymbol any, l
 	}
 }
 
-func (p *parser) ReportAmbiguity(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex int, exact bool, ambigAlts *antlr.BitSet, configs antlr.ATNConfigSet) {
+func (p *parser) ReportAmbiguity(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex int, exact bool, ambigAlts *antlr.BitSet, configs *antlr.ATNConfigSet) {
 	// Intentional
 }
 
-func (p *parser) ReportAttemptingFullContext(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex int, conflictingAlts *antlr.BitSet, configs antlr.ATNConfigSet) {
+func (p *parser) ReportAttemptingFullContext(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex int, conflictingAlts *antlr.BitSet, configs *antlr.ATNConfigSet) {
 	// Intentional
 }
 
-func (p *parser) ReportContextSensitivity(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex, prediction int, configs antlr.ATNConfigSet) {
+func (p *parser) ReportContextSensitivity(recognizer antlr.Parser, dfa *antlr.DFA, startIndex, stopIndex, prediction int, configs *antlr.ATNConfigSet) {
 	// Intentional
 }
 
-func (p *parser) globalCallOrMacro(exprID int64, function string, args ...*exprpb.Expr) *exprpb.Expr {
+func (p *parser) globalCallOrMacro(exprID int64, function string, args ...ast.Expr) ast.Expr {
 	if expr, found := p.expandMacro(exprID, function, nil, args...); found {
 		return expr
 	}
 	return p.helper.newGlobalCall(exprID, function, args...)
 }
 
-func (p *parser) receiverCallOrMacro(exprID int64, function string, target *exprpb.Expr, args ...*exprpb.Expr) *exprpb.Expr {
+func (p *parser) receiverCallOrMacro(exprID int64, function string, target ast.Expr, args ...ast.Expr) ast.Expr {
 	if expr, found := p.expandMacro(exprID, function, target, args...); found {
 		return expr
 	}
 	return p.helper.newReceiverCall(exprID, function, target, args...)
 }
 
-func (p *parser) expandMacro(exprID int64, function string, target *exprpb.Expr, args ...*exprpb.Expr) (*exprpb.Expr, bool) {
+func (p *parser) expandMacro(exprID int64, function string, target ast.Expr, args ...ast.Expr) (ast.Expr, bool) {
 	macro, found := p.macros[makeMacroKey(function, len(args), target != nil)]
 	if !found {
 		macro, found = p.macros[makeVarArgMacroKey(function, target != nil)]
@@ -944,10 +917,12 @@ func (p *parser) expandMacro(exprID int64, function string, target *exprpb.Expr,
 	expr, err := macro.Expander()(eh, target, args)
 	// An error indicates that the macro was matched, but the arguments were not well-formed.
 	if err != nil {
-		if err.Location != nil {
-			return p.reportError(err.Location, err.Message), true
+		loc := err.Location
+		if loc == nil {
+			loc = p.helper.getLocation(exprID)
 		}
-		return p.reportError(p.helper.getLocation(exprID), err.Message), true
+		p.helper.deleteID(exprID)
+		return p.reportError(loc, err.Message), true
 	}
 	// A nil value from the macro indicates that the macro implementation decided that
 	// an expansion should not be performed.
@@ -955,8 +930,9 @@ func (p *parser) expandMacro(exprID int64, function string, target *exprpb.Expr,
 		return nil, false
 	}
 	if p.populateMacroCalls {
-		p.helper.addMacroCall(expr.GetId(), function, target, args...)
+		p.helper.addMacroCall(expr.ID(), function, target, args...)
 	}
+	p.helper.deleteID(exprID)
 	return expr, true
 }
 
diff --git a/vendor/github.com/google/cel-go/parser/unparser.go b/vendor/github.com/google/cel-go/parser/unparser.go
index c3c40a0..91cf729 100644
--- a/vendor/github.com/google/cel-go/parser/unparser.go
+++ b/vendor/github.com/google/cel-go/parser/unparser.go
@@ -20,9 +20,9 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
-
-	exprpb "google.golang.org/genproto/googleapis/api/expr/v1alpha1"
+	"github.com/google/cel-go/common/types"
 )
 
 // Unparse takes an input expression and source position information and generates a human-readable
@@ -39,7 +39,7 @@ import (
 //
 // This function optionally takes in one or more UnparserOption to alter the unparsing behavior, such as
 // performing word wrapping on expressions.
-func Unparse(expr *exprpb.Expr, info *exprpb.SourceInfo, opts ...UnparserOption) (string, error) {
+func Unparse(expr ast.Expr, info *ast.SourceInfo, opts ...UnparserOption) (string, error) {
 	unparserOpts := &unparserOption{
 		wrapOnColumn:         defaultWrapOnColumn,
 		wrapAfterColumnLimit: defaultWrapAfterColumnLimit,
@@ -68,12 +68,12 @@ func Unparse(expr *exprpb.Expr, info *exprpb.SourceInfo, opts ...UnparserOption)
 // unparser visits an expression to reconstruct a human-readable string from an AST.
 type unparser struct {
 	str              strings.Builder
-	info             *exprpb.SourceInfo
+	info             *ast.SourceInfo
 	options          *unparserOption
 	lastWrappedIndex int
 }
 
-func (un *unparser) visit(expr *exprpb.Expr) error {
+func (un *unparser) visit(expr ast.Expr) error {
 	if expr == nil {
 		return errors.New("unsupported expression")
 	}
@@ -81,27 +81,29 @@ func (un *unparser) visit(expr *exprpb.Expr) error {
 	if visited || err != nil {
 		return err
 	}
-	switch expr.GetExprKind().(type) {
-	case *exprpb.Expr_CallExpr:
+	switch expr.Kind() {
+	case ast.CallKind:
 		return un.visitCall(expr)
-	case *exprpb.Expr_ConstExpr:
+	case ast.LiteralKind:
 		return un.visitConst(expr)
-	case *exprpb.Expr_IdentExpr:
+	case ast.IdentKind:
 		return un.visitIdent(expr)
-	case *exprpb.Expr_ListExpr:
+	case ast.ListKind:
 		return un.visitList(expr)
-	case *exprpb.Expr_SelectExpr:
+	case ast.MapKind:
+		return un.visitStructMap(expr)
+	case ast.SelectKind:
 		return un.visitSelect(expr)
-	case *exprpb.Expr_StructExpr:
-		return un.visitStruct(expr)
+	case ast.StructKind:
+		return un.visitStructMsg(expr)
 	default:
 		return fmt.Errorf("unsupported expression: %v", expr)
 	}
 }
 
-func (un *unparser) visitCall(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	fun := c.GetFunction()
+func (un *unparser) visitCall(expr ast.Expr) error {
+	c := expr.AsCall()
+	fun := c.FunctionName()
 	switch fun {
 	// ternary operator
 	case operators.Conditional:
@@ -141,10 +143,10 @@ func (un *unparser) visitCall(expr *exprpb.Expr) error {
 	}
 }
 
-func (un *unparser) visitCallBinary(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	fun := c.GetFunction()
-	args := c.GetArgs()
+func (un *unparser) visitCallBinary(expr ast.Expr) error {
+	c := expr.AsCall()
+	fun := c.FunctionName()
+	args := c.Args()
 	lhs := args[0]
 	// add parens if the current operator is lower precedence than the lhs expr operator.
 	lhsParen := isComplexOperatorWithRespectTo(fun, lhs)
@@ -168,9 +170,9 @@ func (un *unparser) visitCallBinary(expr *exprpb.Expr) error {
 	return un.visitMaybeNested(rhs, rhsParen)
 }
 
-func (un *unparser) visitCallConditional(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	args := c.GetArgs()
+func (un *unparser) visitCallConditional(expr ast.Expr) error {
+	c := expr.AsCall()
+	args := c.Args()
 	// add parens if operand is a conditional itself.
 	nested := isSamePrecedence(operators.Conditional, args[0]) ||
 		isComplexOperator(args[0])
@@ -196,13 +198,13 @@ func (un *unparser) visitCallConditional(expr *exprpb.Expr) error {
 	return un.visitMaybeNested(args[2], nested)
 }
 
-func (un *unparser) visitCallFunc(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	fun := c.GetFunction()
-	args := c.GetArgs()
-	if c.GetTarget() != nil {
-		nested := isBinaryOrTernaryOperator(c.GetTarget())
-		err := un.visitMaybeNested(c.GetTarget(), nested)
+func (un *unparser) visitCallFunc(expr ast.Expr) error {
+	c := expr.AsCall()
+	fun := c.FunctionName()
+	args := c.Args()
+	if c.IsMemberFunction() {
+		nested := isBinaryOrTernaryOperator(c.Target())
+		err := un.visitMaybeNested(c.Target(), nested)
 		if err != nil {
 			return err
 		}
@@ -223,17 +225,17 @@ func (un *unparser) visitCallFunc(expr *exprpb.Expr) error {
 	return nil
 }
 
-func (un *unparser) visitCallIndex(expr *exprpb.Expr) error {
+func (un *unparser) visitCallIndex(expr ast.Expr) error {
 	return un.visitCallIndexInternal(expr, "[")
 }
 
-func (un *unparser) visitCallOptIndex(expr *exprpb.Expr) error {
+func (un *unparser) visitCallOptIndex(expr ast.Expr) error {
 	return un.visitCallIndexInternal(expr, "[?")
 }
 
-func (un *unparser) visitCallIndexInternal(expr *exprpb.Expr, op string) error {
-	c := expr.GetCallExpr()
-	args := c.GetArgs()
+func (un *unparser) visitCallIndexInternal(expr ast.Expr, op string) error {
+	c := expr.AsCall()
+	args := c.Args()
 	nested := isBinaryOrTernaryOperator(args[0])
 	err := un.visitMaybeNested(args[0], nested)
 	if err != nil {
@@ -248,10 +250,10 @@ func (un *unparser) visitCallIndexInternal(expr *exprpb.Expr, op string) error {
 	return nil
 }
 
-func (un *unparser) visitCallUnary(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	fun := c.GetFunction()
-	args := c.GetArgs()
+func (un *unparser) visitCallUnary(expr ast.Expr) error {
+	c := expr.AsCall()
+	fun := c.FunctionName()
+	args := c.Args()
 	unmangled, found := operators.FindReverse(fun)
 	if !found {
 		return fmt.Errorf("cannot unmangle operator: %s", fun)
@@ -261,35 +263,34 @@ func (un *unparser) visitCallUnary(expr *exprpb.Expr) error {
 	return un.visitMaybeNested(args[0], nested)
 }
 
-func (un *unparser) visitConst(expr *exprpb.Expr) error {
-	c := expr.GetConstExpr()
-	switch c.GetConstantKind().(type) {
-	case *exprpb.Constant_BoolValue:
-		un.str.WriteString(strconv.FormatBool(c.GetBoolValue()))
-	case *exprpb.Constant_BytesValue:
+func (un *unparser) visitConst(expr ast.Expr) error {
+	val := expr.AsLiteral()
+	switch val := val.(type) {
+	case types.Bool:
+		un.str.WriteString(strconv.FormatBool(bool(val)))
+	case types.Bytes:
 		// bytes constants are surrounded with b"<bytes>"
-		b := c.GetBytesValue()
 		un.str.WriteString(`b"`)
-		un.str.WriteString(bytesToOctets(b))
+		un.str.WriteString(bytesToOctets([]byte(val)))
 		un.str.WriteString(`"`)
-	case *exprpb.Constant_DoubleValue:
+	case types.Double:
 		// represent the float using the minimum required digits
-		d := strconv.FormatFloat(c.GetDoubleValue(), 'g', -1, 64)
+		d := strconv.FormatFloat(float64(val), 'g', -1, 64)
 		un.str.WriteString(d)
 		if !strings.Contains(d, ".") {
 			un.str.WriteString(".0")
 		}
-	case *exprpb.Constant_Int64Value:
-		i := strconv.FormatInt(c.GetInt64Value(), 10)
+	case types.Int:
+		i := strconv.FormatInt(int64(val), 10)
 		un.str.WriteString(i)
-	case *exprpb.Constant_NullValue:
+	case types.Null:
 		un.str.WriteString("null")
-	case *exprpb.Constant_StringValue:
+	case types.String:
 		// strings will be double quoted with quotes escaped.
-		un.str.WriteString(strconv.Quote(c.GetStringValue()))
-	case *exprpb.Constant_Uint64Value:
+		un.str.WriteString(strconv.Quote(string(val)))
+	case types.Uint:
 		// uint literals have a 'u' suffix.
-		ui := strconv.FormatUint(c.GetUint64Value(), 10)
+		ui := strconv.FormatUint(uint64(val), 10)
 		un.str.WriteString(ui)
 		un.str.WriteString("u")
 	default:
@@ -298,16 +299,16 @@ func (un *unparser) visitConst(expr *exprpb.Expr) error {
 	return nil
 }
 
-func (un *unparser) visitIdent(expr *exprpb.Expr) error {
-	un.str.WriteString(expr.GetIdentExpr().GetName())
+func (un *unparser) visitIdent(expr ast.Expr) error {
+	un.str.WriteString(expr.AsIdent())
 	return nil
 }
 
-func (un *unparser) visitList(expr *exprpb.Expr) error {
-	l := expr.GetListExpr()
-	elems := l.GetElements()
+func (un *unparser) visitList(expr ast.Expr) error {
+	l := expr.AsList()
+	elems := l.Elements()
 	optIndices := make(map[int]bool, len(elems))
-	for _, idx := range l.GetOptionalIndices() {
+	for _, idx := range l.OptionalIndices() {
 		optIndices[int(idx)] = true
 	}
 	un.str.WriteString("[")
@@ -327,20 +328,20 @@ func (un *unparser) visitList(expr *exprpb.Expr) error {
 	return nil
 }
 
-func (un *unparser) visitOptSelect(expr *exprpb.Expr) error {
-	c := expr.GetCallExpr()
-	args := c.GetArgs()
+func (un *unparser) visitOptSelect(expr ast.Expr) error {
+	c := expr.AsCall()
+	args := c.Args()
 	operand := args[0]
-	field := args[1].GetConstExpr().GetStringValue()
-	return un.visitSelectInternal(operand, false, ".?", field)
+	field := args[1].AsLiteral().(types.String)
+	return un.visitSelectInternal(operand, false, ".?", string(field))
 }
 
-func (un *unparser) visitSelect(expr *exprpb.Expr) error {
-	sel := expr.GetSelectExpr()
-	return un.visitSelectInternal(sel.GetOperand(), sel.GetTestOnly(), ".", sel.GetField())
+func (un *unparser) visitSelect(expr ast.Expr) error {
+	sel := expr.AsSelect()
+	return un.visitSelectInternal(sel.Operand(), sel.IsTestOnly(), ".", sel.FieldName())
 }
 
-func (un *unparser) visitSelectInternal(operand *exprpb.Expr, testOnly bool, op string, field string) error {
+func (un *unparser) visitSelectInternal(operand ast.Expr, testOnly bool, op string, field string) error {
 	// handle the case when the select expression was generated by the has() macro.
 	if testOnly {
 		un.str.WriteString("has(")
@@ -358,34 +359,25 @@ func (un *unparser) visitSelectInternal(operand *exprpb.Expr, testOnly bool, op
 	return nil
 }
 
-func (un *unparser) visitStruct(expr *exprpb.Expr) error {
-	s := expr.GetStructExpr()
-	// If the message name is non-empty, then this should be treated as message construction.
-	if s.GetMessageName() != "" {
-		return un.visitStructMsg(expr)
-	}
-	// Otherwise, build a map.
-	return un.visitStructMap(expr)
-}
-
-func (un *unparser) visitStructMsg(expr *exprpb.Expr) error {
-	m := expr.GetStructExpr()
-	entries := m.GetEntries()
-	un.str.WriteString(m.GetMessageName())
+func (un *unparser) visitStructMsg(expr ast.Expr) error {
+	m := expr.AsStruct()
+	fields := m.Fields()
+	un.str.WriteString(m.TypeName())
 	un.str.WriteString("{")
-	for i, entry := range entries {
-		f := entry.GetFieldKey()
-		if entry.GetOptionalEntry() {
+	for i, f := range fields {
+		field := f.AsStructField()
+		f := field.Name()
+		if field.IsOptional() {
 			un.str.WriteString("?")
 		}
 		un.str.WriteString(f)
 		un.str.WriteString(": ")
-		v := entry.GetValue()
+		v := field.Value()
 		err := un.visit(v)
 		if err != nil {
 			return err
 		}
-		if i < len(entries)-1 {
+		if i < len(fields)-1 {
 			un.str.WriteString(", ")
 		}
 	}
@@ -393,13 +385,14 @@ func (un *unparser) visitStructMsg(expr *exprpb.Expr) error {
 	return nil
 }
 
-func (un *unparser) visitStructMap(expr *exprpb.Expr) error {
-	m := expr.GetStructExpr()
-	entries := m.GetEntries()
+func (un *unparser) visitStructMap(expr ast.Expr) error {
+	m := expr.AsMap()
+	entries := m.Entries()
 	un.str.WriteString("{")
-	for i, entry := range entries {
-		k := entry.GetMapKey()
-		if entry.GetOptionalEntry() {
+	for i, e := range entries {
+		entry := e.AsMapEntry()
+		k := entry.Key()
+		if entry.IsOptional() {
 			un.str.WriteString("?")
 		}
 		err := un.visit(k)
@@ -407,7 +400,7 @@ func (un *unparser) visitStructMap(expr *exprpb.Expr) error {
 			return err
 		}
 		un.str.WriteString(": ")
-		v := entry.GetValue()
+		v := entry.Value()
 		err = un.visit(v)
 		if err != nil {
 			return err
@@ -420,16 +413,15 @@ func (un *unparser) visitStructMap(expr *exprpb.Expr) error {
 	return nil
 }
 
-func (un *unparser) visitMaybeMacroCall(expr *exprpb.Expr) (bool, error) {
-	macroCalls := un.info.GetMacroCalls()
-	call, found := macroCalls[expr.GetId()]
+func (un *unparser) visitMaybeMacroCall(expr ast.Expr) (bool, error) {
+	call, found := un.info.GetMacroCall(expr.ID())
 	if !found {
 		return false, nil
 	}
 	return true, un.visit(call)
 }
 
-func (un *unparser) visitMaybeNested(expr *exprpb.Expr, nested bool) error {
+func (un *unparser) visitMaybeNested(expr ast.Expr, nested bool) error {
 	if nested {
 		un.str.WriteString("(")
 	}
@@ -453,12 +445,12 @@ func isLeftRecursive(op string) bool {
 // precedence of the (possible) operation represented in the input Expr.
 //
 // If the expr is not a Call, the result is false.
-func isSamePrecedence(op string, expr *exprpb.Expr) bool {
-	if expr.GetCallExpr() == nil {
+func isSamePrecedence(op string, expr ast.Expr) bool {
+	if expr.Kind() != ast.CallKind {
 		return false
 	}
-	c := expr.GetCallExpr()
-	other := c.GetFunction()
+	c := expr.AsCall()
+	other := c.FunctionName()
 	return operators.Precedence(op) == operators.Precedence(other)
 }
 
@@ -466,16 +458,16 @@ func isSamePrecedence(op string, expr *exprpb.Expr) bool {
 // than the (possible) operation represented in the input Expr.
 //
 // If the expr is not a Call, the result is false.
-func isLowerPrecedence(op string, expr *exprpb.Expr) bool {
-	c := expr.GetCallExpr()
-	other := c.GetFunction()
+func isLowerPrecedence(op string, expr ast.Expr) bool {
+	c := expr.AsCall()
+	other := c.FunctionName()
 	return operators.Precedence(op) < operators.Precedence(other)
 }
 
 // Indicates whether the expr is a complex operator, i.e., a call expression
 // with 2 or more arguments.
-func isComplexOperator(expr *exprpb.Expr) bool {
-	if expr.GetCallExpr() != nil && len(expr.GetCallExpr().GetArgs()) >= 2 {
+func isComplexOperator(expr ast.Expr) bool {
+	if expr.Kind() == ast.CallKind && len(expr.AsCall().Args()) >= 2 {
 		return true
 	}
 	return false
@@ -484,19 +476,19 @@ func isComplexOperator(expr *exprpb.Expr) bool {
 // Indicates whether it is a complex operation compared to another.
 // expr is *not* considered complex if it is not a call expression or has
 // less than two arguments, or if it has a higher precedence than op.
-func isComplexOperatorWithRespectTo(op string, expr *exprpb.Expr) bool {
-	if expr.GetCallExpr() == nil || len(expr.GetCallExpr().GetArgs()) < 2 {
+func isComplexOperatorWithRespectTo(op string, expr ast.Expr) bool {
+	if expr.Kind() != ast.CallKind || len(expr.AsCall().Args()) < 2 {
 		return false
 	}
 	return isLowerPrecedence(op, expr)
 }
 
 // Indicate whether this is a binary or ternary operator.
-func isBinaryOrTernaryOperator(expr *exprpb.Expr) bool {
-	if expr.GetCallExpr() == nil || len(expr.GetCallExpr().GetArgs()) < 2 {
+func isBinaryOrTernaryOperator(expr ast.Expr) bool {
+	if expr.Kind() != ast.CallKind || len(expr.AsCall().Args()) < 2 {
 		return false
 	}
-	_, isBinaryOp := operators.FindReverseBinaryOperator(expr.GetCallExpr().GetFunction())
+	_, isBinaryOp := operators.FindReverseBinaryOperator(expr.AsCall().FunctionName())
 	return isBinaryOp || isSamePrecedence(operators.Conditional, expr)
 }
 
diff --git a/vendor/github.com/google/certificate-transparency-go/AUTHORS b/vendor/github.com/google/certificate-transparency-go/AUTHORS
index 942cec9..ad51466 100644
--- a/vendor/github.com/google/certificate-transparency-go/AUTHORS
+++ b/vendor/github.com/google/certificate-transparency-go/AUTHORS
@@ -9,8 +9,8 @@
 # Please keep the list sorted.
 
 Alex Cohn <alex@alexcohn.com>
-Comodo CA Limited
 Ed Maste <emaste@freebsd.org>
+Elisha Silas <silaselisha66@gmail.com>
 Fiaz Hossain <fiaz.hossain@salesforce.com>
 Google LLC
 Internet Security Research Group
@@ -23,6 +23,7 @@ Nicholas Galbreath <nickg@client9.com>
 Oliver Weidner <Oliver.Weidner@gmail.com>
 PrimeKey Solutions AB
 Ruslan Kovalov <ruslan.kovalyov@gmail.com>
+Sectigo Limited
 Venafi, Inc.
 Vladimir Rutsky <vladimir@rutsky.org>
 Ximin Luo <infinity0@gmx.com>
diff --git a/vendor/github.com/google/certificate-transparency-go/CONTRIBUTORS b/vendor/github.com/google/certificate-transparency-go/CONTRIBUTORS
index 4d04dc6..3a98a7e 100644
--- a/vendor/github.com/google/certificate-transparency-go/CONTRIBUTORS
+++ b/vendor/github.com/google/certificate-transparency-go/CONTRIBUTORS
@@ -30,6 +30,7 @@ Chris Kennelly <ckennelly@google.com> <ckennelly@ckennelly.com>
 David Drysdale <drysdale@google.com>
 Deyan Bektchiev <deyan.bektchiev@venafi.com> <deyan@bektchiev.net>
 Ed Maste <emaste@freebsd.org>
+Elisha Silas <silaselisha66@gmail.com>
 Emilia Kasper <ekasper@google.com>
 Eran Messeri <eranm@google.com> <eran.mes@gmail.com>
 Fiaz Hossain <fiaz.hossain@salesforce.com>
@@ -51,7 +52,7 @@ Paul Lietar <lietar@google.com>
 Pavel Kalinnikov <pkalinnikov@google.com> <pavelkalinnikov@gmail.com>
 Pierre Phaneuf <pphaneuf@google.com>
 Rob Percival <robpercival@google.com>
-Rob Stradling <rob@comodo.com>
+Rob Stradling <rob@sectigo.com>
 Roger Ng <rogerng@google.com> <roger2hk@gmail.com>
 Roland Shoemaker <roland@letsencrypt.org>
 Ruslan Kovalov <ruslan.kovalyov@gmail.com>
diff --git a/vendor/github.com/google/certificate-transparency-go/tls/tls.go b/vendor/github.com/google/certificate-transparency-go/tls/tls.go
index 030074c..a48c998 100644
--- a/vendor/github.com/google/certificate-transparency-go/tls/tls.go
+++ b/vendor/github.com/google/certificate-transparency-go/tls/tls.go
@@ -638,7 +638,7 @@ func marshalField(out *bytes.Buffer, v reflect.Value, info *fieldInfo) error {
 			}
 		}
 		// Now we have seen all fields in the structure, check that all select(Enum) {..} selector
-		// fields found a source field get get their data from.
+		// fields found a source field to get their data from.
 		for selector, seen := range selectorSeen {
 			if !seen {
 				return syntaxError{info.fieldName(), selector + ": unhandled value for selector"}
diff --git a/vendor/github.com/google/certificate-transparency-go/x509/root_aix.go b/vendor/github.com/google/certificate-transparency-go/x509/root_aix.go
new file mode 100644
index 0000000..6d42773
--- /dev/null
+++ b/vendor/github.com/google/certificate-transparency-go/x509/root_aix.go
@@ -0,0 +1,10 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package x509
+
+// Possible certificate files; stop after finding one.
+var certFiles = []string{
+	"/var/ssl/certs/ca-bundle.crt",
+}
diff --git a/vendor/github.com/google/certificate-transparency-go/x509/root_unix.go b/vendor/github.com/google/certificate-transparency-go/x509/root_unix.go
index d00842a..ac2d01d 100644
--- a/vendor/github.com/google/certificate-transparency-go/x509/root_unix.go
+++ b/vendor/github.com/google/certificate-transparency-go/x509/root_unix.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build dragonfly || freebsd || linux || netbsd || openbsd || solaris
-// +build dragonfly freebsd linux netbsd openbsd solaris
+//go:build aix || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+// +build aix dragonfly freebsd linux netbsd openbsd solaris zos
 
 package x509
 
@@ -19,6 +19,7 @@ var certDirectories = []string{
 	"/usr/local/share/certs",       // FreeBSD
 	"/etc/pki/tls/certs",           // Fedora/RHEL
 	"/etc/openssl/certs",           // NetBSD
+	"/var/ssl/certs",               // AIX
 }
 
 const (
diff --git a/vendor/github.com/google/certificate-transparency-go/x509/root_wasip1.go b/vendor/github.com/google/certificate-transparency-go/x509/root_wasip1.go
new file mode 100644
index 0000000..e5cf98e
--- /dev/null
+++ b/vendor/github.com/google/certificate-transparency-go/x509/root_wasip1.go
@@ -0,0 +1,19 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build wasip1
+// +build wasip1
+
+package x509
+
+// Possible certificate files; stop after finding one.
+var certFiles = []string{}
+
+func loadSystemRoots() (*CertPool, error) {
+	return NewCertPool(), nil
+}
+
+func (c *Certificate) systemVerify(opts *VerifyOptions) (chains [][]*Certificate, err error) {
+	return nil, nil
+}
diff --git a/vendor/github.com/google/certificate-transparency-go/x509/root_zos.go b/vendor/github.com/google/certificate-transparency-go/x509/root_zos.go
new file mode 100644
index 0000000..54f240a
--- /dev/null
+++ b/vendor/github.com/google/certificate-transparency-go/x509/root_zos.go
@@ -0,0 +1,13 @@
+// Copyright 2015 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build zos
+// +build zos
+
+package x509
+
+// Possible certificate files; stop after finding one.
+var certFiles = []string{
+	"/etc/cacert.pem", // IBM zOS default
+}
diff --git a/vendor/github.com/google/go-tpm/legacy/tpm2/tpm2.go b/vendor/github.com/google/go-tpm/legacy/tpm2/tpm2.go
index 8de0c40..18d5a96 100644
--- a/vendor/github.com/google/go-tpm/legacy/tpm2/tpm2.go
+++ b/vendor/github.com/google/go-tpm/legacy/tpm2/tpm2.go
@@ -1276,7 +1276,6 @@ func NVDefineSpace(rw io.ReadWriter, owner, handle tpmutil.Handle, ownerAuth, au
 		Auth:       []byte(ownerAuth),
 	}
 	return NVDefineSpaceEx(rw, owner, authString, nvPub, authArea)
-
 }
 
 // NVDefineSpaceEx accepts NVPublic structure and AuthCommand, allowing more flexibility.
@@ -2121,12 +2120,12 @@ func RSAEncrypt(rw io.ReadWriter, key tpmutil.Handle, message []byte, scheme *As
 	return decodeRSAEncrypt(resp)
 }
 
-func encodeRSADecrypt(key tpmutil.Handle, password string, message tpmutil.U16Bytes, scheme *AsymScheme, label string) ([]byte, error) {
+func encodeRSADecrypt(sessionHandle, key tpmutil.Handle, password string, message tpmutil.U16Bytes, scheme *AsymScheme, label string) ([]byte, error) {
 	ha, err := tpmutil.Pack(key)
 	if err != nil {
 		return nil, err
 	}
-	auth, err := encodeAuthArea(AuthCommand{Session: HandlePasswordSession, Attributes: AttrContinueSession, Auth: []byte(password)})
+	auth, err := encodeAuthArea(AuthCommand{Session: sessionHandle, Attributes: AttrContinueSession, Auth: []byte(password)})
 	if err != nil {
 		return nil, err
 	}
@@ -2160,7 +2159,15 @@ func decodeRSADecrypt(resp []byte) ([]byte, error) {
 // label, a null byte is appended to the label and the null byte is included in the
 // padding scheme.
 func RSADecrypt(rw io.ReadWriter, key tpmutil.Handle, password string, message []byte, scheme *AsymScheme, label string) ([]byte, error) {
-	Cmd, err := encodeRSADecrypt(key, password, message, scheme, label)
+	return RSADecryptWithSession(rw, HandlePasswordSession, key, password, message, scheme, label)
+}
+
+// RSADecryptWithSession performs RSA decryption in the TPM according to RFC 3447. The key must be
+// a private RSA key in the TPM with FlagDecrypt set. Note that when using OAEP with a
+// label, a null byte is appended to the label and the null byte is included in the
+// padding scheme.
+func RSADecryptWithSession(rw io.ReadWriter, sessionHandle, key tpmutil.Handle, password string, message []byte, scheme *AsymScheme, label string) ([]byte, error) {
+	Cmd, err := encodeRSADecrypt(sessionHandle, key, password, message, scheme, label)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/google/pprof/profile/encode.go b/vendor/github.com/google/pprof/profile/encode.go
index ab7f03a..8ce9d3c 100644
--- a/vendor/github.com/google/pprof/profile/encode.go
+++ b/vendor/github.com/google/pprof/profile/encode.go
@@ -17,6 +17,7 @@ package profile
 import (
 	"errors"
 	"sort"
+	"strings"
 )
 
 func (p *Profile) decoder() []decoder {
@@ -121,6 +122,7 @@ func (p *Profile) preEncode() {
 	}
 
 	p.defaultSampleTypeX = addString(strings, p.DefaultSampleType)
+	p.docURLX = addString(strings, p.DocURL)
 
 	p.stringTable = make([]string, len(strings))
 	for s, i := range strings {
@@ -155,6 +157,7 @@ func (p *Profile) encode(b *buffer) {
 	encodeInt64Opt(b, 12, p.Period)
 	encodeInt64s(b, 13, p.commentX)
 	encodeInt64(b, 14, p.defaultSampleTypeX)
+	encodeInt64Opt(b, 15, p.docURLX)
 }
 
 var profileDecoder = []decoder{
@@ -183,12 +186,13 @@ var profileDecoder = []decoder{
 	// repeated Location location = 4
 	func(b *buffer, m message) error {
 		x := new(Location)
-		x.Line = make([]Line, 0, 8) // Pre-allocate Line buffer
+		x.Line = b.tmpLines[:0] // Use shared space temporarily
 		pp := m.(*Profile)
 		pp.Location = append(pp.Location, x)
 		err := decodeMessage(b, x)
-		var tmp []Line
-		x.Line = append(tmp, x.Line...) // Shrink to allocated size
+		b.tmpLines = x.Line[:0]
+		// Copy to shrink size and detach from shared space.
+		x.Line = append([]Line(nil), x.Line...)
 		return err
 	},
 	// repeated Function function = 5
@@ -235,6 +239,8 @@ var profileDecoder = []decoder{
 	func(b *buffer, m message) error { return decodeInt64s(b, &m.(*Profile).commentX) },
 	// int64 defaultSampleType = 14
 	func(b *buffer, m message) error { return decodeInt64(b, &m.(*Profile).defaultSampleTypeX) },
+	// string doc_link = 15;
+	func(b *buffer, m message) error { return decodeInt64(b, &m.(*Profile).docURLX) },
 }
 
 // postDecode takes the unexported fields populated by decode (with
@@ -252,6 +258,14 @@ func (p *Profile) postDecode() error {
 		} else {
 			mappings[m.ID] = m
 		}
+
+		// If this a main linux kernel mapping with a relocation symbol suffix
+		// ("[kernel.kallsyms]_text"), extract said suffix.
+		// It is fairly hacky to handle at this level, but the alternatives appear even worse.
+		const prefix = "[kernel.kallsyms]"
+		if strings.HasPrefix(m.File, prefix) {
+			m.KernelRelocationSymbol = m.File[len(prefix):]
+		}
 	}
 
 	functions := make(map[uint64]*Function, len(p.Function))
@@ -298,41 +312,52 @@ func (p *Profile) postDecode() error {
 		st.Unit, err = getString(p.stringTable, &st.unitX, err)
 	}
 
+	// Pre-allocate space for all locations.
+	numLocations := 0
+	for _, s := range p.Sample {
+		numLocations += len(s.locationIDX)
+	}
+	locBuffer := make([]*Location, numLocations)
+
 	for _, s := range p.Sample {
-		labels := make(map[string][]string, len(s.labelX))
-		numLabels := make(map[string][]int64, len(s.labelX))
-		numUnits := make(map[string][]string, len(s.labelX))
-		for _, l := range s.labelX {
-			var key, value string
-			key, err = getString(p.stringTable, &l.keyX, err)
-			if l.strX != 0 {
-				value, err = getString(p.stringTable, &l.strX, err)
-				labels[key] = append(labels[key], value)
-			} else if l.numX != 0 || l.unitX != 0 {
-				numValues := numLabels[key]
-				units := numUnits[key]
-				if l.unitX != 0 {
-					var unit string
-					unit, err = getString(p.stringTable, &l.unitX, err)
-					units = padStringArray(units, len(numValues))
-					numUnits[key] = append(units, unit)
+		if len(s.labelX) > 0 {
+			labels := make(map[string][]string, len(s.labelX))
+			numLabels := make(map[string][]int64, len(s.labelX))
+			numUnits := make(map[string][]string, len(s.labelX))
+			for _, l := range s.labelX {
+				var key, value string
+				key, err = getString(p.stringTable, &l.keyX, err)
+				if l.strX != 0 {
+					value, err = getString(p.stringTable, &l.strX, err)
+					labels[key] = append(labels[key], value)
+				} else if l.numX != 0 || l.unitX != 0 {
+					numValues := numLabels[key]
+					units := numUnits[key]
+					if l.unitX != 0 {
+						var unit string
+						unit, err = getString(p.stringTable, &l.unitX, err)
+						units = padStringArray(units, len(numValues))
+						numUnits[key] = append(units, unit)
+					}
+					numLabels[key] = append(numLabels[key], l.numX)
 				}
-				numLabels[key] = append(numLabels[key], l.numX)
 			}
-		}
-		if len(labels) > 0 {
-			s.Label = labels
-		}
-		if len(numLabels) > 0 {
-			s.NumLabel = numLabels
-			for key, units := range numUnits {
-				if len(units) > 0 {
-					numUnits[key] = padStringArray(units, len(numLabels[key]))
+			if len(labels) > 0 {
+				s.Label = labels
+			}
+			if len(numLabels) > 0 {
+				s.NumLabel = numLabels
+				for key, units := range numUnits {
+					if len(units) > 0 {
+						numUnits[key] = padStringArray(units, len(numLabels[key]))
+					}
 				}
+				s.NumUnit = numUnits
 			}
-			s.NumUnit = numUnits
 		}
-		s.Location = make([]*Location, len(s.locationIDX))
+
+		s.Location = locBuffer[:len(s.locationIDX)]
+		locBuffer = locBuffer[len(s.locationIDX):]
 		for i, lid := range s.locationIDX {
 			if lid < uint64(len(locationIds)) {
 				s.Location[i] = locationIds[lid]
@@ -363,6 +388,7 @@ func (p *Profile) postDecode() error {
 
 	p.commentX = nil
 	p.DefaultSampleType, err = getString(p.stringTable, &p.defaultSampleTypeX, err)
+	p.DocURL, err = getString(p.stringTable, &p.docURLX, err)
 	p.stringTable = nil
 	return err
 }
@@ -509,6 +535,7 @@ func (p *Line) decoder() []decoder {
 func (p *Line) encode(b *buffer) {
 	encodeUint64Opt(b, 1, p.functionIDX)
 	encodeInt64Opt(b, 2, p.Line)
+	encodeInt64Opt(b, 3, p.Column)
 }
 
 var lineDecoder = []decoder{
@@ -517,6 +544,8 @@ var lineDecoder = []decoder{
 	func(b *buffer, m message) error { return decodeUint64(b, &m.(*Line).functionIDX) },
 	// optional int64 line = 2
 	func(b *buffer, m message) error { return decodeInt64(b, &m.(*Line).Line) },
+	// optional int64 column = 3
+	func(b *buffer, m message) error { return decodeInt64(b, &m.(*Line).Column) },
 }
 
 func (p *Function) decoder() []decoder {
diff --git a/vendor/github.com/google/pprof/profile/filter.go b/vendor/github.com/google/pprof/profile/filter.go
index ea8e66c..c794b93 100644
--- a/vendor/github.com/google/pprof/profile/filter.go
+++ b/vendor/github.com/google/pprof/profile/filter.go
@@ -22,6 +22,10 @@ import "regexp"
 // samples where at least one frame matches focus but none match ignore.
 // Returns true is the corresponding regexp matched at least one sample.
 func (p *Profile) FilterSamplesByName(focus, ignore, hide, show *regexp.Regexp) (fm, im, hm, hnm bool) {
+	if focus == nil && ignore == nil && hide == nil && show == nil {
+		fm = true // Missing focus implies a match
+		return
+	}
 	focusOrIgnore := make(map[uint64]bool)
 	hidden := make(map[uint64]bool)
 	for _, l := range p.Location {
diff --git a/vendor/github.com/google/pprof/profile/legacy_java_profile.go b/vendor/github.com/google/pprof/profile/legacy_java_profile.go
index 91f45e5..4580bab 100644
--- a/vendor/github.com/google/pprof/profile/legacy_java_profile.go
+++ b/vendor/github.com/google/pprof/profile/legacy_java_profile.go
@@ -56,7 +56,7 @@ func javaCPUProfile(b []byte, period int64, parse func(b []byte) (uint64, []byte
 	}
 
 	// Strip out addresses for better merge.
-	if err = p.Aggregate(true, true, true, true, false); err != nil {
+	if err = p.Aggregate(true, true, true, true, false, false); err != nil {
 		return nil, err
 	}
 
@@ -99,7 +99,7 @@ func parseJavaProfile(b []byte) (*Profile, error) {
 	}
 
 	// Strip out addresses for better merge.
-	if err = p.Aggregate(true, true, true, true, false); err != nil {
+	if err = p.Aggregate(true, true, true, true, false, false); err != nil {
 		return nil, err
 	}
 
diff --git a/vendor/github.com/google/pprof/profile/legacy_profile.go b/vendor/github.com/google/pprof/profile/legacy_profile.go
index 0c8f3bb..8d07fd6 100644
--- a/vendor/github.com/google/pprof/profile/legacy_profile.go
+++ b/vendor/github.com/google/pprof/profile/legacy_profile.go
@@ -295,11 +295,12 @@ func get64b(b []byte) (uint64, []byte) {
 //
 // The general format for profilez samples is a sequence of words in
 // binary format. The first words are a header with the following data:
-//   1st word -- 0
-//   2nd word -- 3
-//   3rd word -- 0 if a c++ application, 1 if a java application.
-//   4th word -- Sampling period (in microseconds).
-//   5th word -- Padding.
+//
+//	1st word -- 0
+//	2nd word -- 3
+//	3rd word -- 0 if a c++ application, 1 if a java application.
+//	4th word -- Sampling period (in microseconds).
+//	5th word -- Padding.
 func parseCPU(b []byte) (*Profile, error) {
 	var parse func([]byte) (uint64, []byte)
 	var n1, n2, n3, n4, n5 uint64
@@ -403,15 +404,18 @@ func cleanupDuplicateLocations(p *Profile) {
 //
 // profilez samples are a repeated sequence of stack frames of the
 // form:
-//    1st word -- The number of times this stack was encountered.
-//    2nd word -- The size of the stack (StackSize).
-//    3rd word -- The first address on the stack.
-//    ...
-//    StackSize + 2 -- The last address on the stack
+//
+//	1st word -- The number of times this stack was encountered.
+//	2nd word -- The size of the stack (StackSize).
+//	3rd word -- The first address on the stack.
+//	...
+//	StackSize + 2 -- The last address on the stack
+//
 // The last stack trace is of the form:
-//   1st word -- 0
-//   2nd word -- 1
-//   3rd word -- 0
+//
+//	1st word -- 0
+//	2nd word -- 1
+//	3rd word -- 0
 //
 // Addresses from stack traces may point to the next instruction after
 // each call. Optionally adjust by -1 to land somewhere on the actual
@@ -861,7 +865,6 @@ func parseThread(b []byte) (*Profile, error) {
 	// Recognize each thread and populate profile samples.
 	for !isMemoryMapSentinel(line) {
 		if strings.HasPrefix(line, "---- no stack trace for") {
-			line = ""
 			break
 		}
 		if t := threadStartRE.FindStringSubmatch(line); len(t) != 4 {
diff --git a/vendor/github.com/google/pprof/profile/merge.go b/vendor/github.com/google/pprof/profile/merge.go
index 9978e73..ba4d746 100644
--- a/vendor/github.com/google/pprof/profile/merge.go
+++ b/vendor/github.com/google/pprof/profile/merge.go
@@ -15,6 +15,7 @@
 package profile
 
 import (
+	"encoding/binary"
 	"fmt"
 	"sort"
 	"strconv"
@@ -58,7 +59,7 @@ func Merge(srcs []*Profile) (*Profile, error) {
 
 	for _, src := range srcs {
 		// Clear the profile-specific hash tables
-		pm.locationsByID = make(map[uint64]*Location, len(src.Location))
+		pm.locationsByID = makeLocationIDMap(len(src.Location))
 		pm.functionsByID = make(map[uint64]*Function, len(src.Function))
 		pm.mappingsByID = make(map[uint64]mapInfo, len(src.Mapping))
 
@@ -136,7 +137,7 @@ type profileMerger struct {
 	p *Profile
 
 	// Memoization tables within a profile.
-	locationsByID map[uint64]*Location
+	locationsByID locationIDMap
 	functionsByID map[uint64]*Function
 	mappingsByID  map[uint64]mapInfo
 
@@ -153,6 +154,16 @@ type mapInfo struct {
 }
 
 func (pm *profileMerger) mapSample(src *Sample) *Sample {
+	// Check memoization table
+	k := pm.sampleKey(src)
+	if ss, ok := pm.samples[k]; ok {
+		for i, v := range src.Value {
+			ss.Value[i] += v
+		}
+		return ss
+	}
+
+	// Make new sample.
 	s := &Sample{
 		Location: make([]*Location, len(src.Location)),
 		Value:    make([]int64, len(src.Value)),
@@ -177,52 +188,98 @@ func (pm *profileMerger) mapSample(src *Sample) *Sample {
 		s.NumLabel[k] = vv
 		s.NumUnit[k] = uu
 	}
-	// Check memoization table. Must be done on the remapped location to
-	// account for the remapped mapping. Add current values to the
-	// existing sample.
-	k := s.key()
-	if ss, ok := pm.samples[k]; ok {
-		for i, v := range src.Value {
-			ss.Value[i] += v
-		}
-		return ss
-	}
 	copy(s.Value, src.Value)
 	pm.samples[k] = s
 	pm.p.Sample = append(pm.p.Sample, s)
 	return s
 }
 
-// key generates sampleKey to be used as a key for maps.
-func (sample *Sample) key() sampleKey {
-	ids := make([]string, len(sample.Location))
-	for i, l := range sample.Location {
-		ids[i] = strconv.FormatUint(l.ID, 16)
+func (pm *profileMerger) sampleKey(sample *Sample) sampleKey {
+	// Accumulate contents into a string.
+	var buf strings.Builder
+	buf.Grow(64) // Heuristic to avoid extra allocs
+
+	// encode a number
+	putNumber := func(v uint64) {
+		var num [binary.MaxVarintLen64]byte
+		n := binary.PutUvarint(num[:], v)
+		buf.Write(num[:n])
+	}
+
+	// encode a string prefixed with its length.
+	putDelimitedString := func(s string) {
+		putNumber(uint64(len(s)))
+		buf.WriteString(s)
+	}
+
+	for _, l := range sample.Location {
+		// Get the location in the merged profile, which may have a different ID.
+		if loc := pm.mapLocation(l); loc != nil {
+			putNumber(loc.ID)
+		}
 	}
+	putNumber(0) // Delimiter
 
-	labels := make([]string, 0, len(sample.Label))
-	for k, v := range sample.Label {
-		labels = append(labels, fmt.Sprintf("%q%q", k, v))
+	for _, l := range sortedKeys1(sample.Label) {
+		putDelimitedString(l)
+		values := sample.Label[l]
+		putNumber(uint64(len(values)))
+		for _, v := range values {
+			putDelimitedString(v)
+		}
 	}
-	sort.Strings(labels)
 
-	numlabels := make([]string, 0, len(sample.NumLabel))
-	for k, v := range sample.NumLabel {
-		numlabels = append(numlabels, fmt.Sprintf("%q%x%x", k, v, sample.NumUnit[k]))
+	for _, l := range sortedKeys2(sample.NumLabel) {
+		putDelimitedString(l)
+		values := sample.NumLabel[l]
+		putNumber(uint64(len(values)))
+		for _, v := range values {
+			putNumber(uint64(v))
+		}
+		units := sample.NumUnit[l]
+		putNumber(uint64(len(units)))
+		for _, v := range units {
+			putDelimitedString(v)
+		}
 	}
-	sort.Strings(numlabels)
 
-	return sampleKey{
-		strings.Join(ids, "|"),
-		strings.Join(labels, ""),
-		strings.Join(numlabels, ""),
+	return sampleKey(buf.String())
+}
+
+type sampleKey string
+
+// sortedKeys1 returns the sorted keys found in a string->[]string map.
+//
+// Note: this is currently non-generic since github pprof runs golint,
+// which does not support generics. When that issue is fixed, it can
+// be merged with sortedKeys2 and made into a generic function.
+func sortedKeys1(m map[string][]string) []string {
+	if len(m) == 0 {
+		return nil
 	}
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
 }
 
-type sampleKey struct {
-	locations string
-	labels    string
-	numlabels string
+// sortedKeys2 returns the sorted keys found in a string->[]int64 map.
+//
+// Note: this is currently non-generic since github pprof runs golint,
+// which does not support generics. When that issue is fixed, it can
+// be merged with sortedKeys1 and made into a generic function.
+func sortedKeys2(m map[string][]int64) []string {
+	if len(m) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
 }
 
 func (pm *profileMerger) mapLocation(src *Location) *Location {
@@ -230,7 +287,7 @@ func (pm *profileMerger) mapLocation(src *Location) *Location {
 		return nil
 	}
 
-	if l, ok := pm.locationsByID[src.ID]; ok {
+	if l := pm.locationsByID.get(src.ID); l != nil {
 		return l
 	}
 
@@ -249,10 +306,10 @@ func (pm *profileMerger) mapLocation(src *Location) *Location {
 	// account for the remapped mapping ID.
 	k := l.key()
 	if ll, ok := pm.locations[k]; ok {
-		pm.locationsByID[src.ID] = ll
+		pm.locationsByID.set(src.ID, ll)
 		return ll
 	}
-	pm.locationsByID[src.ID] = l
+	pm.locationsByID.set(src.ID, l)
 	pm.locations[k] = l
 	pm.p.Location = append(pm.p.Location, l)
 	return l
@@ -269,12 +326,13 @@ func (l *Location) key() locationKey {
 		key.addr -= l.Mapping.Start
 		key.mappingID = l.Mapping.ID
 	}
-	lines := make([]string, len(l.Line)*2)
+	lines := make([]string, len(l.Line)*3)
 	for i, line := range l.Line {
 		if line.Function != nil {
 			lines[i*2] = strconv.FormatUint(line.Function.ID, 16)
 		}
 		lines[i*2+1] = strconv.FormatInt(line.Line, 16)
+		lines[i*2+2] = strconv.FormatInt(line.Column, 16)
 	}
 	key.lines = strings.Join(lines, "|")
 	return key
@@ -303,16 +361,17 @@ func (pm *profileMerger) mapMapping(src *Mapping) mapInfo {
 		return mi
 	}
 	m := &Mapping{
-		ID:              uint64(len(pm.p.Mapping) + 1),
-		Start:           src.Start,
-		Limit:           src.Limit,
-		Offset:          src.Offset,
-		File:            src.File,
-		BuildID:         src.BuildID,
-		HasFunctions:    src.HasFunctions,
-		HasFilenames:    src.HasFilenames,
-		HasLineNumbers:  src.HasLineNumbers,
-		HasInlineFrames: src.HasInlineFrames,
+		ID:                     uint64(len(pm.p.Mapping) + 1),
+		Start:                  src.Start,
+		Limit:                  src.Limit,
+		Offset:                 src.Offset,
+		File:                   src.File,
+		KernelRelocationSymbol: src.KernelRelocationSymbol,
+		BuildID:                src.BuildID,
+		HasFunctions:           src.HasFunctions,
+		HasFilenames:           src.HasFilenames,
+		HasLineNumbers:         src.HasLineNumbers,
+		HasInlineFrames:        src.HasInlineFrames,
 	}
 	pm.p.Mapping = append(pm.p.Mapping, m)
 
@@ -360,6 +419,7 @@ func (pm *profileMerger) mapLine(src Line) Line {
 	ln := Line{
 		Function: pm.mapFunction(src.Function),
 		Line:     src.Line,
+		Column:   src.Column,
 	}
 	return ln
 }
@@ -416,6 +476,7 @@ func combineHeaders(srcs []*Profile) (*Profile, error) {
 	var timeNanos, durationNanos, period int64
 	var comments []string
 	seenComments := map[string]bool{}
+	var docURL string
 	var defaultSampleType string
 	for _, s := range srcs {
 		if timeNanos == 0 || s.TimeNanos < timeNanos {
@@ -434,6 +495,9 @@ func combineHeaders(srcs []*Profile) (*Profile, error) {
 		if defaultSampleType == "" {
 			defaultSampleType = s.DefaultSampleType
 		}
+		if docURL == "" {
+			docURL = s.DocURL
+		}
 	}
 
 	p := &Profile{
@@ -449,6 +513,7 @@ func combineHeaders(srcs []*Profile) (*Profile, error) {
 
 		Comments:          comments,
 		DefaultSampleType: defaultSampleType,
+		DocURL:            docURL,
 	}
 	copy(p.SampleType, srcs[0].SampleType)
 	return p, nil
@@ -479,3 +544,131 @@ func (p *Profile) compatible(pb *Profile) error {
 func equalValueType(st1, st2 *ValueType) bool {
 	return st1.Type == st2.Type && st1.Unit == st2.Unit
 }
+
+// locationIDMap is like a map[uint64]*Location, but provides efficiency for
+// ids that are densely numbered, which is often the case.
+type locationIDMap struct {
+	dense  []*Location          // indexed by id for id < len(dense)
+	sparse map[uint64]*Location // indexed by id for id >= len(dense)
+}
+
+func makeLocationIDMap(n int) locationIDMap {
+	return locationIDMap{
+		dense:  make([]*Location, n),
+		sparse: map[uint64]*Location{},
+	}
+}
+
+func (lm locationIDMap) get(id uint64) *Location {
+	if id < uint64(len(lm.dense)) {
+		return lm.dense[int(id)]
+	}
+	return lm.sparse[id]
+}
+
+func (lm locationIDMap) set(id uint64, loc *Location) {
+	if id < uint64(len(lm.dense)) {
+		lm.dense[id] = loc
+		return
+	}
+	lm.sparse[id] = loc
+}
+
+// CompatibilizeSampleTypes makes profiles compatible to be compared/merged. It
+// keeps sample types that appear in all profiles only and drops/reorders the
+// sample types as necessary.
+//
+// In the case of sample types order is not the same for given profiles the
+// order is derived from the first profile.
+//
+// Profiles are modified in-place.
+//
+// It returns an error if the sample type's intersection is empty.
+func CompatibilizeSampleTypes(ps []*Profile) error {
+	sTypes := commonSampleTypes(ps)
+	if len(sTypes) == 0 {
+		return fmt.Errorf("profiles have empty common sample type list")
+	}
+	for _, p := range ps {
+		if err := compatibilizeSampleTypes(p, sTypes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// commonSampleTypes returns sample types that appear in all profiles in the
+// order how they ordered in the first profile.
+func commonSampleTypes(ps []*Profile) []string {
+	if len(ps) == 0 {
+		return nil
+	}
+	sTypes := map[string]int{}
+	for _, p := range ps {
+		for _, st := range p.SampleType {
+			sTypes[st.Type]++
+		}
+	}
+	var res []string
+	for _, st := range ps[0].SampleType {
+		if sTypes[st.Type] == len(ps) {
+			res = append(res, st.Type)
+		}
+	}
+	return res
+}
+
+// compatibilizeSampleTypes drops sample types that are not present in sTypes
+// list and reorder them if needed.
+//
+// It sets DefaultSampleType to sType[0] if it is not in sType list.
+//
+// It assumes that all sample types from the sTypes list are present in the
+// given profile otherwise it returns an error.
+func compatibilizeSampleTypes(p *Profile, sTypes []string) error {
+	if len(sTypes) == 0 {
+		return fmt.Errorf("sample type list is empty")
+	}
+	defaultSampleType := sTypes[0]
+	reMap, needToModify := make([]int, len(sTypes)), false
+	for i, st := range sTypes {
+		if st == p.DefaultSampleType {
+			defaultSampleType = p.DefaultSampleType
+		}
+		idx := searchValueType(p.SampleType, st)
+		if idx < 0 {
+			return fmt.Errorf("%q sample type is not found in profile", st)
+		}
+		reMap[i] = idx
+		if idx != i {
+			needToModify = true
+		}
+	}
+	if !needToModify && len(sTypes) == len(p.SampleType) {
+		return nil
+	}
+	p.DefaultSampleType = defaultSampleType
+	oldSampleTypes := p.SampleType
+	p.SampleType = make([]*ValueType, len(sTypes))
+	for i, idx := range reMap {
+		p.SampleType[i] = oldSampleTypes[idx]
+	}
+	values := make([]int64, len(sTypes))
+	for _, s := range p.Sample {
+		for i, idx := range reMap {
+			values[i] = s.Value[idx]
+		}
+		s.Value = s.Value[:len(values)]
+		copy(s.Value, values)
+	}
+	return nil
+}
+
+func searchValueType(vts []*ValueType, s string) int {
+	for i, vt := range vts {
+		if vt.Type == s {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/vendor/github.com/google/pprof/profile/profile.go b/vendor/github.com/google/pprof/profile/profile.go
index 2590c8d..f47a243 100644
--- a/vendor/github.com/google/pprof/profile/profile.go
+++ b/vendor/github.com/google/pprof/profile/profile.go
@@ -21,7 +21,6 @@ import (
 	"compress/gzip"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math"
 	"path/filepath"
 	"regexp"
@@ -40,6 +39,7 @@ type Profile struct {
 	Location          []*Location
 	Function          []*Function
 	Comments          []string
+	DocURL            string
 
 	DropFrames string
 	KeepFrames string
@@ -54,6 +54,7 @@ type Profile struct {
 	encodeMu sync.Mutex
 
 	commentX           []int64
+	docURLX            int64
 	dropFramesX        int64
 	keepFramesX        int64
 	stringTable        []string
@@ -73,9 +74,23 @@ type ValueType struct {
 type Sample struct {
 	Location []*Location
 	Value    []int64
-	Label    map[string][]string
+	// Label is a per-label-key map to values for string labels.
+	//
+	// In general, having multiple values for the given label key is strongly
+	// discouraged - see docs for the sample label field in profile.proto.  The
+	// main reason this unlikely state is tracked here is to make the
+	// decoding->encoding roundtrip not lossy. But we expect that the value
+	// slices present in this map are always of length 1.
+	Label map[string][]string
+	// NumLabel is a per-label-key map to values for numeric labels. See a note
+	// above on handling multiple values for a label.
 	NumLabel map[string][]int64
-	NumUnit  map[string][]string
+	// NumUnit is a per-label-key map to the unit names of corresponding numeric
+	// label values. The unit info may be missing even if the label is in
+	// NumLabel, see the docs in profile.proto for details. When the value is
+	// slice is present and not nil, its length must be equal to the length of
+	// the corresponding value slice in NumLabel.
+	NumUnit map[string][]string
 
 	locationIDX []uint64
 	labelX      []label
@@ -106,6 +121,15 @@ type Mapping struct {
 
 	fileX    int64
 	buildIDX int64
+
+	// Name of the kernel relocation symbol ("_text" or "_stext"), extracted from File.
+	// For linux kernel mappings generated by some tools, correct symbolization depends
+	// on knowing which of the two possible relocation symbols was used for `Start`.
+	// This is given to us as a suffix in `File` (e.g. "[kernel.kallsyms]_stext").
+	//
+	// Note, this public field is not persisted in the proto. For the purposes of
+	// copying / merging / hashing profiles, it is considered subsumed by `File`.
+	KernelRelocationSymbol string
 }
 
 // Location corresponds to Profile.Location
@@ -123,6 +147,7 @@ type Location struct {
 type Line struct {
 	Function *Function
 	Line     int64
+	Column   int64
 
 	functionIDX uint64
 }
@@ -144,7 +169,7 @@ type Function struct {
 // may be a gzip-compressed encoded protobuf or one of many legacy
 // profile formats which may be unsupported in the future.
 func Parse(r io.Reader) (*Profile, error) {
-	data, err := ioutil.ReadAll(r)
+	data, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
@@ -159,7 +184,7 @@ func ParseData(data []byte) (*Profile, error) {
 	if len(data) >= 2 && data[0] == 0x1f && data[1] == 0x8b {
 		gz, err := gzip.NewReader(bytes.NewBuffer(data))
 		if err == nil {
-			data, err = ioutil.ReadAll(gz)
+			data, err = io.ReadAll(gz)
 		}
 		if err != nil {
 			return nil, fmt.Errorf("decompressing profile: %v", err)
@@ -414,7 +439,7 @@ func (p *Profile) CheckValid() error {
 // Aggregate merges the locations in the profile into equivalence
 // classes preserving the request attributes. It also updates the
 // samples to point to the merged locations.
-func (p *Profile) Aggregate(inlineFrame, function, filename, linenumber, address bool) error {
+func (p *Profile) Aggregate(inlineFrame, function, filename, linenumber, columnnumber, address bool) error {
 	for _, m := range p.Mapping {
 		m.HasInlineFrames = m.HasInlineFrames && inlineFrame
 		m.HasFunctions = m.HasFunctions && function
@@ -436,7 +461,7 @@ func (p *Profile) Aggregate(inlineFrame, function, filename, linenumber, address
 	}
 
 	// Aggregate locations
-	if !inlineFrame || !address || !linenumber {
+	if !inlineFrame || !address || !linenumber || !columnnumber {
 		for _, l := range p.Location {
 			if !inlineFrame && len(l.Line) > 1 {
 				l.Line = l.Line[len(l.Line)-1:]
@@ -444,6 +469,12 @@ func (p *Profile) Aggregate(inlineFrame, function, filename, linenumber, address
 			if !linenumber {
 				for i := range l.Line {
 					l.Line[i].Line = 0
+					l.Line[i].Column = 0
+				}
+			}
+			if !columnnumber {
+				for i := range l.Line {
+					l.Line[i].Column = 0
 				}
 			}
 			if !address {
@@ -526,6 +557,9 @@ func (p *Profile) String() string {
 	for _, c := range p.Comments {
 		ss = append(ss, "Comment: "+c)
 	}
+	if url := p.DocURL; url != "" {
+		ss = append(ss, fmt.Sprintf("Doc: %s", url))
+	}
 	if pt := p.PeriodType; pt != nil {
 		ss = append(ss, fmt.Sprintf("PeriodType: %s %s", pt.Type, pt.Unit))
 	}
@@ -605,10 +639,11 @@ func (l *Location) string() string {
 	for li := range l.Line {
 		lnStr := "??"
 		if fn := l.Line[li].Function; fn != nil {
-			lnStr = fmt.Sprintf("%s %s:%d s=%d",
+			lnStr = fmt.Sprintf("%s %s:%d:%d s=%d",
 				fn.Name,
 				fn.Filename,
 				l.Line[li].Line,
+				l.Line[li].Column,
 				fn.StartLine)
 			if fn.Name != fn.SystemName {
 				lnStr = lnStr + "(" + fn.SystemName + ")"
@@ -707,6 +742,35 @@ func (s *Sample) HasLabel(key, value string) bool {
 	return false
 }
 
+// SetNumLabel sets the specified key to the specified value for all samples in the
+// profile. "unit" is a slice that describes the units that each corresponding member
+// of "values" is measured in (e.g. bytes or seconds).  If there is no relevant
+// unit for a given value, that member of "unit" should be the empty string.
+// "unit" must either have the same length as "value", or be nil.
+func (p *Profile) SetNumLabel(key string, value []int64, unit []string) {
+	for _, sample := range p.Sample {
+		if sample.NumLabel == nil {
+			sample.NumLabel = map[string][]int64{key: value}
+		} else {
+			sample.NumLabel[key] = value
+		}
+		if sample.NumUnit == nil {
+			sample.NumUnit = map[string][]string{key: unit}
+		} else {
+			sample.NumUnit[key] = unit
+		}
+	}
+}
+
+// RemoveNumLabel removes all numerical labels associated with the specified key for all
+// samples in the profile.
+func (p *Profile) RemoveNumLabel(key string) {
+	for _, sample := range p.Sample {
+		delete(sample.NumLabel, key)
+		delete(sample.NumUnit, key)
+	}
+}
+
 // DiffBaseSample returns true if a sample belongs to the diff base and false
 // otherwise.
 func (s *Sample) DiffBaseSample() bool {
@@ -785,10 +849,10 @@ func (p *Profile) HasFileLines() bool {
 
 // Unsymbolizable returns true if a mapping points to a binary for which
 // locations can't be symbolized in principle, at least now. Examples are
-// "[vdso]", [vsyscall]" and some others, see the code.
+// "[vdso]", "[vsyscall]" and some others, see the code.
 func (m *Mapping) Unsymbolizable() bool {
 	name := filepath.Base(m.File)
-	return strings.HasPrefix(name, "[") || strings.HasPrefix(name, "linux-vdso") || strings.HasPrefix(m.File, "/dev/dri/")
+	return strings.HasPrefix(name, "[") || strings.HasPrefix(name, "linux-vdso") || strings.HasPrefix(m.File, "/dev/dri/") || m.File == "//anon"
 }
 
 // Copy makes a fully independent copy of a profile.
diff --git a/vendor/github.com/google/pprof/profile/proto.go b/vendor/github.com/google/pprof/profile/proto.go
index 539ad3a..a15696b 100644
--- a/vendor/github.com/google/pprof/profile/proto.go
+++ b/vendor/github.com/google/pprof/profile/proto.go
@@ -39,11 +39,12 @@ import (
 )
 
 type buffer struct {
-	field int // field tag
-	typ   int // proto wire type code for field
-	u64   uint64
-	data  []byte
-	tmp   [16]byte
+	field    int // field tag
+	typ      int // proto wire type code for field
+	u64      uint64
+	data     []byte
+	tmp      [16]byte
+	tmpLines []Line // temporary storage used while decoding "repeated Line".
 }
 
 type decoder func(*buffer, message) error
@@ -286,7 +287,6 @@ func decodeInt64s(b *buffer, x *[]int64) error {
 	if b.typ == 2 {
 		// Packed encoding
 		data := b.data
-		tmp := make([]int64, 0, len(data)) // Maximally sized
 		for len(data) > 0 {
 			var u uint64
 			var err error
@@ -294,9 +294,8 @@ func decodeInt64s(b *buffer, x *[]int64) error {
 			if u, data, err = decodeVarint(data); err != nil {
 				return err
 			}
-			tmp = append(tmp, int64(u))
+			*x = append(*x, int64(u))
 		}
-		*x = append(*x, tmp...)
 		return nil
 	}
 	var i int64
@@ -319,7 +318,6 @@ func decodeUint64s(b *buffer, x *[]uint64) error {
 	if b.typ == 2 {
 		data := b.data
 		// Packed encoding
-		tmp := make([]uint64, 0, len(data)) // Maximally sized
 		for len(data) > 0 {
 			var u uint64
 			var err error
@@ -327,9 +325,8 @@ func decodeUint64s(b *buffer, x *[]uint64) error {
 			if u, data, err = decodeVarint(data); err != nil {
 				return err
 			}
-			tmp = append(tmp, u)
+			*x = append(*x, u)
 		}
-		*x = append(*x, tmp...)
 		return nil
 	}
 	var u uint64
diff --git a/vendor/github.com/google/pprof/profile/prune.go b/vendor/github.com/google/pprof/profile/prune.go
index 02d21a8..b2f9fd5 100644
--- a/vendor/github.com/google/pprof/profile/prune.go
+++ b/vendor/github.com/google/pprof/profile/prune.go
@@ -62,15 +62,31 @@ func (p *Profile) Prune(dropRx, keepRx *regexp.Regexp) {
 	prune := make(map[uint64]bool)
 	pruneBeneath := make(map[uint64]bool)
 
+	// simplifyFunc can be expensive, so cache results.
+	// Note that the same function name can be encountered many times due
+	// different lines and addresses in the same function.
+	pruneCache := map[string]bool{} // Map from function to whether or not to prune
+	pruneFromHere := func(s string) bool {
+		if r, ok := pruneCache[s]; ok {
+			return r
+		}
+		funcName := simplifyFunc(s)
+		if dropRx.MatchString(funcName) {
+			if keepRx == nil || !keepRx.MatchString(funcName) {
+				pruneCache[s] = true
+				return true
+			}
+		}
+		pruneCache[s] = false
+		return false
+	}
+
 	for _, loc := range p.Location {
 		var i int
 		for i = len(loc.Line) - 1; i >= 0; i-- {
 			if fn := loc.Line[i].Function; fn != nil && fn.Name != "" {
-				funcName := simplifyFunc(fn.Name)
-				if dropRx.MatchString(funcName) {
-					if keepRx == nil || !keepRx.MatchString(funcName) {
-						break
-					}
+				if pruneFromHere(fn.Name) {
+					break
 				}
 			}
 		}
diff --git a/vendor/github.com/google/uuid/CHANGELOG.md b/vendor/github.com/google/uuid/CHANGELOG.md
index 2bd7866..7ec5ac7 100644
--- a/vendor/github.com/google/uuid/CHANGELOG.md
+++ b/vendor/github.com/google/uuid/CHANGELOG.md
@@ -1,5 +1,36 @@
 # Changelog
 
+## [1.6.0](https://github.com/google/uuid/compare/v1.5.0...v1.6.0) (2024-01-16)
+
+
+### Features
+
+* add Max UUID constant ([#149](https://github.com/google/uuid/issues/149)) ([c58770e](https://github.com/google/uuid/commit/c58770eb495f55fe2ced6284f93c5158a62e53e3))
+
+
+### Bug Fixes
+
+* fix typo in version 7 uuid documentation ([#153](https://github.com/google/uuid/issues/153)) ([016b199](https://github.com/google/uuid/commit/016b199544692f745ffc8867b914129ecb47ef06))
+* Monotonicity in UUIDv7 ([#150](https://github.com/google/uuid/issues/150)) ([a2b2b32](https://github.com/google/uuid/commit/a2b2b32373ff0b1a312b7fdf6d38a977099698a6))
+
+## [1.5.0](https://github.com/google/uuid/compare/v1.4.0...v1.5.0) (2023-12-12)
+
+
+### Features
+
+* Validate UUID without creating new UUID ([#141](https://github.com/google/uuid/issues/141)) ([9ee7366](https://github.com/google/uuid/commit/9ee7366e66c9ad96bab89139418a713dc584ae29))
+
+## [1.4.0](https://github.com/google/uuid/compare/v1.3.1...v1.4.0) (2023-10-26)
+
+
+### Features
+
+* UUIDs slice type with Strings() convenience method ([#133](https://github.com/google/uuid/issues/133)) ([cd5fbbd](https://github.com/google/uuid/commit/cd5fbbdd02f3e3467ac18940e07e062be1f864b4))
+
+### Fixes
+
+* Clarify that Parse's job is to parse but not necessarily validate strings. (Documents current behavior)
+
 ## [1.3.1](https://github.com/google/uuid/compare/v1.3.0...v1.3.1) (2023-08-18)
 
 
diff --git a/vendor/github.com/google/uuid/CONTRIBUTING.md b/vendor/github.com/google/uuid/CONTRIBUTING.md
index 5566888..a502fdc 100644
--- a/vendor/github.com/google/uuid/CONTRIBUTING.md
+++ b/vendor/github.com/google/uuid/CONTRIBUTING.md
@@ -11,7 +11,7 @@ please explain why in the pull request description.
 
 ### Releasing
 
-Commits that would precipitate a SemVer change, as desrcibed in the Conventional
+Commits that would precipitate a SemVer change, as described in the Conventional
 Commits Specification, will trigger [`release-please`](https://github.com/google-github-actions/release-please-action)
 to create a release candidate pull request. Once submitted, `release-please`
 will create a release.
diff --git a/vendor/github.com/google/uuid/hash.go b/vendor/github.com/google/uuid/hash.go
index b404f4b..dc60082 100644
--- a/vendor/github.com/google/uuid/hash.go
+++ b/vendor/github.com/google/uuid/hash.go
@@ -17,6 +17,12 @@ var (
 	NameSpaceOID  = Must(Parse("6ba7b812-9dad-11d1-80b4-00c04fd430c8"))
 	NameSpaceX500 = Must(Parse("6ba7b814-9dad-11d1-80b4-00c04fd430c8"))
 	Nil           UUID // empty UUID, all zeros
+
+	// The Max UUID is special form of UUID that is specified to have all 128 bits set to 1.
+	Max = UUID{
+		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+		0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+	}
 )
 
 // NewHash returns a new UUID derived from the hash of space concatenated with
diff --git a/vendor/github.com/google/uuid/time.go b/vendor/github.com/google/uuid/time.go
index e6ef06c..c351129 100644
--- a/vendor/github.com/google/uuid/time.go
+++ b/vendor/github.com/google/uuid/time.go
@@ -108,12 +108,23 @@ func setClockSequence(seq int) {
 }
 
 // Time returns the time in 100s of nanoseconds since 15 Oct 1582 encoded in
-// uuid.  The time is only defined for version 1 and 2 UUIDs.
+// uuid.  The time is only defined for version 1, 2, 6 and 7 UUIDs.
 func (uuid UUID) Time() Time {
-	time := int64(binary.BigEndian.Uint32(uuid[0:4]))
-	time |= int64(binary.BigEndian.Uint16(uuid[4:6])) << 32
-	time |= int64(binary.BigEndian.Uint16(uuid[6:8])&0xfff) << 48
-	return Time(time)
+	var t Time
+	switch uuid.Version() {
+	case 6:
+		time := binary.BigEndian.Uint64(uuid[:8]) // Ignore uuid[6] version b0110
+		t = Time(time)
+	case 7:
+		time := binary.BigEndian.Uint64(uuid[:8])
+		t = Time((time>>16)*10000 + g1582ns100)
+	default: // forward compatible
+		time := int64(binary.BigEndian.Uint32(uuid[0:4]))
+		time |= int64(binary.BigEndian.Uint16(uuid[4:6])) << 32
+		time |= int64(binary.BigEndian.Uint16(uuid[6:8])&0xfff) << 48
+		t = Time(time)
+	}
+	return t
 }
 
 // ClockSequence returns the clock sequence encoded in uuid.
diff --git a/vendor/github.com/google/uuid/uuid.go b/vendor/github.com/google/uuid/uuid.go
index a56138c..5232b48 100644
--- a/vendor/github.com/google/uuid/uuid.go
+++ b/vendor/github.com/google/uuid/uuid.go
@@ -56,11 +56,15 @@ func IsInvalidLengthError(err error) bool {
 	return ok
 }
 
-// Parse decodes s into a UUID or returns an error.  Both the standard UUID
-// forms of xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
-// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx are decoded as well as the
-// Microsoft encoding {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} and the raw hex
-// encoding: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
+// Parse decodes s into a UUID or returns an error if it cannot be parsed.  Both
+// the standard UUID forms defined in RFC 4122
+// (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx and
+// urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) are decoded.  In addition,
+// Parse accepts non-standard strings such as the raw hex encoding
+// xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx and 38 byte "Microsoft style" encodings,
+// e.g.  {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.  Only the middle 36 bytes are
+// examined in the latter case.  Parse should not be used to validate strings as
+// it parses non-standard encodings as indicated above.
 func Parse(s string) (UUID, error) {
 	var uuid UUID
 	switch len(s) {
@@ -182,6 +186,59 @@ func Must(uuid UUID, err error) UUID {
 	return uuid
 }
 
+// Validate returns an error if s is not a properly formatted UUID in one of the following formats:
+//   xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+//   urn:uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+//   xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+//   {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
+// It returns an error if the format is invalid, otherwise nil.
+func Validate(s string) error {
+	switch len(s) {
+	// Standard UUID format
+	case 36:
+
+	// UUID with "urn:uuid:" prefix
+	case 36 + 9:
+		if !strings.EqualFold(s[:9], "urn:uuid:") {
+			return fmt.Errorf("invalid urn prefix: %q", s[:9])
+		}
+		s = s[9:]
+
+	// UUID enclosed in braces
+	case 36 + 2:
+		if s[0] != '{' || s[len(s)-1] != '}' {
+			return fmt.Errorf("invalid bracketed UUID format")
+		}
+		s = s[1 : len(s)-1]
+
+	// UUID without hyphens
+	case 32:
+		for i := 0; i < len(s); i += 2 {
+			_, ok := xtob(s[i], s[i+1])
+			if !ok {
+				return errors.New("invalid UUID format")
+			}
+		}
+
+	default:
+		return invalidLengthError{len(s)}
+	}
+
+	// Check for standard UUID format
+	if len(s) == 36 {
+		if s[8] != '-' || s[13] != '-' || s[18] != '-' || s[23] != '-' {
+			return errors.New("invalid UUID format")
+		}
+		for _, x := range []int{0, 2, 4, 6, 9, 11, 14, 16, 19, 21, 24, 26, 28, 30, 32, 34} {
+			if _, ok := xtob(s[x], s[x+1]); !ok {
+				return errors.New("invalid UUID format")
+			}
+		}
+	}
+
+	return nil
+}
+
 // String returns the string form of uuid, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 // , or "" if uuid is invalid.
 func (uuid UUID) String() string {
@@ -294,3 +351,15 @@ func DisableRandPool() {
 	poolMu.Lock()
 	poolPos = randPoolSize
 }
+
+// UUIDs is a slice of UUID types.
+type UUIDs []UUID
+
+// Strings returns a string slice containing the string form of each UUID in uuids.
+func (uuids UUIDs) Strings() []string {
+	var uuidStrs = make([]string, len(uuids))
+	for i, uuid := range uuids {
+		uuidStrs[i] = uuid.String()
+	}
+	return uuidStrs
+}
diff --git a/vendor/github.com/google/uuid/version6.go b/vendor/github.com/google/uuid/version6.go
new file mode 100644
index 0000000..339a959
--- /dev/null
+++ b/vendor/github.com/google/uuid/version6.go
@@ -0,0 +1,56 @@
+// Copyright 2023 Google Inc.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package uuid
+
+import "encoding/binary"
+
+// UUID version 6 is a field-compatible version of UUIDv1, reordered for improved DB locality.
+// It is expected that UUIDv6 will primarily be used in contexts where there are existing v1 UUIDs.
+// Systems that do not involve legacy UUIDv1 SHOULD consider using UUIDv7 instead.
+//
+// see https://datatracker.ietf.org/doc/html/draft-peabody-dispatch-new-uuid-format-03#uuidv6
+//
+// NewV6 returns a Version 6 UUID based on the current NodeID and clock
+// sequence, and the current time. If the NodeID has not been set by SetNodeID
+// or SetNodeInterface then it will be set automatically. If the NodeID cannot
+// be set NewV6 set NodeID is random bits automatically . If clock sequence has not been set by
+// SetClockSequence then it will be set automatically. If GetTime fails to
+// return the current NewV6 returns Nil and an error.
+func NewV6() (UUID, error) {
+	var uuid UUID
+	now, seq, err := GetTime()
+	if err != nil {
+		return uuid, err
+	}
+
+	/*
+	    0                   1                   2                   3
+	    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+	   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	   |                           time_high                           |
+	   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	   |           time_mid            |      time_low_and_version     |
+	   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	   |clk_seq_hi_res |  clk_seq_low  |         node (0-1)            |
+	   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	   |                         node (2-5)                            |
+	   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	*/
+
+	binary.BigEndian.PutUint64(uuid[0:], uint64(now))
+	binary.BigEndian.PutUint16(uuid[8:], seq)
+
+	uuid[6] = 0x60 | (uuid[6] & 0x0F)
+	uuid[8] = 0x80 | (uuid[8] & 0x3F)
+
+	nodeMu.Lock()
+	if nodeID == zeroID {
+		setNodeInterface("")
+	}
+	copy(uuid[10:], nodeID[:])
+	nodeMu.Unlock()
+
+	return uuid, nil
+}
diff --git a/vendor/github.com/google/uuid/version7.go b/vendor/github.com/google/uuid/version7.go
new file mode 100644
index 0000000..3167b64
--- /dev/null
+++ b/vendor/github.com/google/uuid/version7.go
@@ -0,0 +1,104 @@
+// Copyright 2023 Google Inc.  All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package uuid
+
+import (
+	"io"
+)
+
+// UUID version 7 features a time-ordered value field derived from the widely
+// implemented and well known Unix Epoch timestamp source,
+// the number of milliseconds seconds since midnight 1 Jan 1970 UTC, leap seconds excluded.
+// As well as improved entropy characteristics over versions 1 or 6.
+//
+// see https://datatracker.ietf.org/doc/html/draft-peabody-dispatch-new-uuid-format-03#name-uuid-version-7
+//
+// Implementations SHOULD utilize UUID version 7 over UUID version 1 and 6 if possible.
+//
+// NewV7 returns a Version 7 UUID based on the current time(Unix Epoch).
+// Uses the randomness pool if it was enabled with EnableRandPool.
+// On error, NewV7 returns Nil and an error
+func NewV7() (UUID, error) {
+	uuid, err := NewRandom()
+	if err != nil {
+		return uuid, err
+	}
+	makeV7(uuid[:])
+	return uuid, nil
+}
+
+// NewV7FromReader returns a Version 7 UUID based on the current time(Unix Epoch).
+// it use NewRandomFromReader fill random bits.
+// On error, NewV7FromReader returns Nil and an error.
+func NewV7FromReader(r io.Reader) (UUID, error) {
+	uuid, err := NewRandomFromReader(r)
+	if err != nil {
+		return uuid, err
+	}
+
+	makeV7(uuid[:])
+	return uuid, nil
+}
+
+// makeV7 fill 48 bits time (uuid[0] - uuid[5]), set version b0111 (uuid[6])
+// uuid[8] already has the right version number (Variant is 10)
+// see function NewV7 and NewV7FromReader
+func makeV7(uuid []byte) {
+	/*
+		 0                   1                   2                   3
+		 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		|                           unix_ts_ms                          |
+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		|          unix_ts_ms           |  ver  |  rand_a (12 bit seq)  |
+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		|var|                        rand_b                             |
+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+		|                            rand_b                             |
+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+	*/
+	_ = uuid[15] // bounds check
+
+	t, s := getV7Time()
+
+	uuid[0] = byte(t >> 40)
+	uuid[1] = byte(t >> 32)
+	uuid[2] = byte(t >> 24)
+	uuid[3] = byte(t >> 16)
+	uuid[4] = byte(t >> 8)
+	uuid[5] = byte(t)
+
+	uuid[6] = 0x70 | (0x0F & byte(s>>8))
+	uuid[7] = byte(s)
+}
+
+// lastV7time is the last time we returned stored as:
+//
+//	52 bits of time in milliseconds since epoch
+//	12 bits of (fractional nanoseconds) >> 8
+var lastV7time int64
+
+const nanoPerMilli = 1000000
+
+// getV7Time returns the time in milliseconds and nanoseconds / 256.
+// The returned (milli << 12 + seq) is guarenteed to be greater than
+// (milli << 12 + seq) returned by any previous call to getV7Time.
+func getV7Time() (milli, seq int64) {
+	timeMu.Lock()
+	defer timeMu.Unlock()
+
+	nano := timeNow().UnixNano()
+	milli = nano / nanoPerMilli
+	// Sequence number is between 0 and 3906 (nanoPerMilli>>8)
+	seq = (nano - milli*nanoPerMilli) >> 8
+	now := milli<<12 + seq
+	if now <= lastV7time {
+		now = lastV7time + 1
+		milli = now >> 12
+		seq = now & 0xfff
+	}
+	lastV7time = now
+	return milli, seq
+}