@actsecurity/iam-lens 0.1.166 → 0.1.168

package/dist/cjs/simulate/contextKeys.d.ts

@@ -16,6 +16,10 @@ export interface CreateContextKeysOptions {
      * Whether resource tags and presence should be loaded from collected data.
      */
     includeResourceMetadata?: boolean;
+    /**
+     * Whether principal tags should be loaded from collected IAM metadata.
+     */
+    includePrincipalTags?: boolean;
 }
 /**
  * Placeholder for the caller account AWS supplies on a service-mediated KMS request.

package/dist/cjs/simulate/contextKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AAE3D;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AAED;;;;GAIG;AACH,eAAO,MAAM,2CAA2C,iBAAiB,CAAA;AAEzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAA;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,yBAAyB,EAC5C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,EAChC,8BAA8B,CAAC,EAAE,MAAM,EACvC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC,CAsItE;AAwBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAyCD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E"}
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAA;AAE3D;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAEjC;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,2CAA2C,iBAAiB,CAAA;AAEzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAyB7C,CAAA;AAED,eAAO,MAAM,YAAY;;;;;;;;;CASxB,CAAA;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKnE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,aAAa,EAAE,gBAAgB,EAC/B,iBAAiB,EAAE,yBAAyB,EAC5C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,EAChC,8BAA8B,CAAC,EAAE,MAAM,EACvC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC,CA2ItE;AAwBD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgEtB;AAyCD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E"}

package/dist/cjs/simulate/contextKeys.js

@@ -113,7 +113,11 @@ async function createContextKeys(collectClient, simulationRequest, service, cont
         'aws:EpochTime': Math.floor(Date.now() / 1000).toString()
     };
     const principal = simulationRequest.principal;
-    if (principal && (0, principals_js_1.isArnPrincipal)(principal)) {
+    if (!principal) {
+        contextKeys['aws:userid'] = 'anonymous';
+        contextKeys['aws:PrincipalType'] = 'Anonymous';
+    }
+    else if ((0, principals_js_1.isArnPrincipal)(principal)) {
         const arnParts = (0, iam_utils_1.splitArnParts)(principal);
         const principalArnForContext = resolvedPrincipalArnForContext ??
             (arnParts.resourceType === 'assumed-role'
@@ -128,9 +132,11 @@ async function createContextKeys(collectClient, simulationRequest, service, cont
             const orgStructure = await collectClient.getOrgUnitHierarchyForAccount(principalAccountId);
             contextKeys['aws:PrincipalOrgPaths'] = makeOrgPaths(orgId, orgStructure);
         }
-        const { tags } = await collectClient.getTagsForResource(principalArnForContext, principalAccountId);
-        for (const [key, value] of Object.entries(tags)) {
-            contextKeys[`aws:PrincipalTag/${key}`] = value;
+        if (options.includePrincipalTags !== false) {
+            const { tags } = await collectClient.getTagsForResource(principalArnForContext, principalAccountId);
+            for (const [key, value] of Object.entries(tags)) {
+                contextKeys[`aws:PrincipalTag/${key}`] = value;
+            }
         }
         contextKeys['aws:PrincipalIsAWSService'] = 'false';
         if (service.toLowerCase() === 'kms') {

package/dist/cjs/simulate/contextKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":";;;AAmGA,wEAKC;AASD,sCAEC;AASD,oCAKC;AAaD,8CA6IC;AAgCD,gCAoEC;AA+CD,kFAEC;AAhbD,sDAM+B;AAE/B,oDAAqE;AAsBrE;;;;GAIG;AACU,QAAA,2CAA2C,GAAG,cAAc,CAAA;AAE5D,QAAA,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAEY,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,iBAAiB;IACjB,kCAAkC;IAClC,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,SAAgB,8BAA8B,CAAC,GAAW;IACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,aAAa,CAAC,CAC9F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAA4C,EAC5C,OAAe,EACf,mBAAgC,EAChC,8BAAuC,EACvC,UAAoC,EAAE;IAEtC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAA;IAC7C,IAAI,SAAS,IAAI,IAAA,8BAAc,EAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;QACzC,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,IAAA,0CAA8B,EAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC,CAAA;QAChB,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;QAChD,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;YAC7E,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,IAAA,0CAA8B,EAAC,SAAS,CAAC,CAAA;gBACzD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAA,oDAAwC,EAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAA,iCAAqB,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,IAAA,qBAAS,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,SAAS,IAAI,IAAA,kCAAkB,EAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAA;QACnD,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,mDAA2C,CAAA;QAChF,CAAC;QAED,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;IAE1D,mFAAmF;IACnF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,WAAwB,EACxB,mBAAgC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;QACD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,YAAY,CAAC,CAAA;QAClC,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,oBAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,oBAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,oBAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,oBAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,oBAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,oBAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,SAAgB,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/simulate/contextKeys.ts"],"names":[],"mappings":";;;AAwGA,wEAKC;AASD,sCAEC;AASD,oCAKC;AAaD,8CAkJC;AAgCD,gCAoEC;AA+CD,kFAEC;AA1bD,sDAM+B;AAE/B,oDAAqE;AA2BrE;;;;GAIG;AACU,QAAA,2CAA2C,GAAG,cAAc,CAAA;AAE5D,QAAA,gBAAgB,GAAsB;IACjD,qBAAqB;IACrB,iBAAiB;IACjB,eAAe;IAEf,kBAAkB;IAClB,sBAAsB;IACtB,oBAAoB;IACpB,uBAAuB;IACvB,mBAAmB;IACnB,cAAc;IAEd,qBAAqB;IACrB,mBAAmB;IACnB,sBAAsB;IAEtB,2BAA2B;IAC3B,0BAA0B;IAC1B,mBAAmB;IACnB,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,eAAe;IAEf,mBAAmB;CACpB,CAAA;AAEY,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,eAAe;IACpB,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,iBAAiB;IACrC,gBAAgB,EAAE,eAAe;IACjC,mBAAmB,EAAE,kBAAkB;IACvC,MAAM,EAAE,kBAAkB;CAC3B,CAAA;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,iBAAiB;IACjB,kCAAkC;IAClC,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;IACxB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,YAAY;IACZ,mBAAmB;CACpB,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,SAAgB,8BAA8B,CAAC,GAAW;IACxD,MAAM,aAAa,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,CACL,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,aAAa,CAAC,CAC9F,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,OAAoB,EAAE,GAAW;IAC7D,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,OAAoB,EAAE,GAAW;IAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;IACD,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,iBAAiB,CACrC,aAA+B,EAC/B,iBAA4C,EAC5C,OAAe,EACf,mBAAgC,EAChC,8BAAuC,EACvC,UAAoC,EAAE;IAEtC,MAAM,WAAW,GAAgB;QAC/B,qBAAqB,EAAE,MAAM;QAC7B,iBAAiB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3C,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAA;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAA;IAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,WAAW,CAAC,YAAY,CAAC,GAAG,WAAW,CAAA;QACvC,WAAW,CAAC,mBAAmB,CAAC,GAAG,WAAW,CAAA;IAChD,CAAC;SAAM,IAAI,IAAA,8BAAc,EAAC,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAA;QACzC,MAAM,sBAAsB,GAC1B,8BAA8B;YAC9B,CAAC,QAAQ,CAAC,YAAY,KAAK,cAAc;gBACvC,CAAC,CAAC,IAAA,0CAA8B,EAAC,SAAS,CAAC;gBAC3C,CAAC,CAAC,SAAS,CAAC,CAAA;QAChB,WAAW,CAAC,kBAAkB,CAAC,GAAG,sBAAsB,CAAA;QACxD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,SAAU,CAAA;QAC9C,WAAW,CAAC,sBAAsB,CAAC,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;QAE9D,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;YAEzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,CAAA;YAC1F,WAAW,CAAC,uBAAuB,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;QAC1E,CAAC;QAED,IAAI,OAAO,CAAC,oBAAoB,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,kBAAkB,CACrD,sBAAsB,EACtB,kBAAkB,CACnB,CAAA;YAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,WAAW,CAAC,oBAAoB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAChD,CAAC;QACH,CAAC;QAED,WAAW,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAA;QAElD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,kBAAkB,CAAA;QACvD,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAA;YAC5C,WAAW,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAA;QAChD,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,WAAW,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAA;YACzC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAA;YAC7E,WAAW,CAAC,YAAY,CAAC,GAAG,YAAY,IAAI,SAAS,CAAA;YACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;YAC1D,WAAW,CAAC,cAAc,CAAC,GAAG,QAAQ,CAAA;QACxC,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;YACtD,WAAW,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAA;YAClD,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAA;QAC9E,CAAC;aAAM,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACxF,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,0CAA0C;YAC1C,IAAI,QAAQ,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAA;gBAC7D,MAAM,OAAO,GAAG,IAAA,0CAA8B,EAAC,SAAS,CAAC,CAAA;gBACzD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAA;gBAC3E,WAAW,CAAC,YAAY,CAAC,GAAG,GAAG,YAAY,IAAI,SAAS,IAAI,WAAW,EAAE,CAAA;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAA,oDAAwC,EAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,WAAW,CAAC,qBAAqB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QAEvE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,eAAgB,CAAC,CAAA;QAChG,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAA;YAEhD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,6BAA6B,CACpE,iBAAiB,CAAC,eAAgB,CACnC,CAAA;YAED,WAAW,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,KAAK,CAAA;IAChC,IAAI,iBAAiB,CAAC,WAAW,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAA,iCAAqB,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACrE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,GACvD,MAAM,aAAa,CAAC,kBAAkB,CACpC,QAAQ,CAAC,CAAC,CAAC,IAAA,qBAAS,EAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EACnF,iBAAiB,CAAC,eAAgB,CACnC,CAAA;QACH,oBAAoB,GAAG,kBAAkB,CAAA;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACxD,WAAW,CAAC,mBAAmB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,gBAAgB,GAAG,EAAE,CAAC,GAAG,KAAK,CAAA;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,IAAI,SAAS,IAAI,IAAA,kCAAkB,EAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,WAAW,CAAC,2BAA2B,CAAC,GAAG,MAAM,CAAA;QACjD,WAAW,CAAC,0BAA0B,CAAC,GAAG,SAAS,CAAA;QACnD,WAAW,CAAC,mBAAmB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACrE,WAAW,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC,eAAgB,CAAA;QACnE,WAAW,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAA;QACjE,WAAW,CAAC,oBAAoB,CAAC,GAAG,WAAW,CAAC,sBAAsB,CAAC,CAAA;QAEvE,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,WAAW,CAAC,mBAAmB,CAAC,GAAG,mDAA2C,CAAA;QAChF,CAAC;QAED,IAAI,iBAAiB,CAAC,cAAc,KAAK,WAAW,EAAE,CAAC;YACrD,8EAA8E;YAC9E,kFAAkF;YAClF,WAAW,CAAC,eAAe,CAAC,GAAG,+CAA+C,CAAA;QAChF,CAAC;IACH,CAAC;IAED,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAA;IAE1D,mFAAmF;IACnF,kFAAkF;IAClF,sBAAsB;IACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,OAAO;QACL,oBAAoB;QACpB,WAAW;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,WAAwB,EACxB,mBAAgC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAChD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAC/D,CAAA;QACD,IAAI,YAAY,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YACzC,OAAO,WAAW,CAAC,YAAY,CAAC,CAAA;QAClC,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,UAAU,CAC9B,OAAoB,EACpB,OAAe,EACf,aAA+B;IAE/B,MAAM,OAAO,GAAgB,EAAE,CAAA;IAE/B,IAAI,aAAa,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,aAAa,CAAC,CAAA;IACrE,MAAM,cAAc,GAAG,CAAC,CAAC,aAAa,CAAA;IACtC,IAAI,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,GAAG,CAAC,CAAA;IACnD,IAAI,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,CAAA;IAEvD,iEAAiE;IACjE,IAAI,CAAC,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzD,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACnF,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,aAAa,GAAG,MAAM,aAAa,CAAC,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;YACzE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,oBAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,oBAAY,CAAC,aAAa,CAAC,GAAG,aAAa,CAAA;IACrD,CAAC;IAED,IACE,aAAa;QACb,OAAO,aAAa,KAAK,QAAQ;QACjC,mCAAmC,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAA;QACpF,MAAM,uBAAuB,GAC3B,MAAM,aAAa,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,aAAa,CAAC,CAAA;QAE3E,IAAI,kBAAkB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACnF,OAAO,CAAC,oBAAY,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;QAC/D,CAAC;QACD,IAAI,gBAAgB,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/E,OAAO,CAAC,oBAAY,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,oBAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QACvC,CAAC;QACD,IACE,gBAAgB;YAChB,uBAAuB;YACvB,CAAC,aAAa,CAAC,OAAO,EAAE,oBAAY,CAAC,mBAAmB,CAAC,EACzD,CAAC;YACD,OAAO,CAAC,oBAAY,CAAC,mBAAmB,CAAC,GAAG,YAAY,CACtD,gBAAgB,EAChB,uBAAuB,CACxB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,uCAAuC,GAAG,IAAI,GAAG,CAAC;IACtD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,KAAK;IACL,KAAK;IACL,kBAAkB;IAClB,SAAS;IACT,UAAU;IACV,KAAK;IACL,WAAW;IACX,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,OAAO;IACP,KAAK;IACL,cAAc;IACd,aAAa;IACb,KAAK;IACL,QAAQ;IACR,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,IAAI;IACJ,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,SAAgB,mCAAmC,CAAC,OAAe;IACjE,OAAO,uCAAuC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,SAAmB;IACtD,OAAO,CAAC,GAAG,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}

package/dist/cjs/simulate/roleSessionTags.d.ts

@@ -0,0 +1,51 @@
+import { type ValidatedPolicy } from '@actsecurity/iam-policy';
+/** A tag-key value permitted by a role trust policy. */
+export interface SessionTagKey {
+    /** Tag-key spelling from the trust policy. */
+    tagKey: string;
+    /** Whether the trust-policy comparison ignores case. */
+    ignoreCase: boolean;
+}
+/** Describes which tag keys a role session may supply, independently of the role's stored tags. */
+export type RoleSessionTagCapability = {
+    type: 'none';
+} | {
+    type: 'any';
+} | {
+    type: 'allowlist';
+    tagKeys: SessionTagKey[];
+};
+/**
+ * Determines which tag keys a role session may supply from the role's trust policy.
+ *
+ * This result intentionally does not depend on tags currently stored on the role. Deny statements
+ * and conditions unrelated to `aws:TagKeys` are ignored. Supported
+ * `ForAllValues:StringEquals` operators form a finite allowlist for one Allow statement, while
+ * `ForAnyValue`, unsupported operators, and policy-variable values conservatively permit any key.
+ *
+ * @param trustPolicy the role's validated trust policy, or undefined when it was not collected
+ * @returns the role's session-tag key capability
+ */
+export declare function roleSessionTagCapability(trustPolicy: ValidatedPolicy<{
+    name: string;
+}> | undefined): RoleSessionTagCapability;
+/**
+ * Determines whether a tag key can be supplied by a role session.
+ *
+ * @param capability the trust-policy-derived session-tag capability
+ * @param tagKey the tag key to test
+ * @returns true when a role session may supply the key
+ */
+export declare function roleSessionCanSetTagKey(capability: RoleSessionTagCapability, tagKey: string): boolean;
+/**
+ * Builds a slash-delimited regex constraint for PrincipalTag keys that cannot be session supplied.
+ *
+ * The iam-simulate constraint matcher is case-insensitive. Consequently, case variants of a
+ * case-sensitive allowlist entry are also excluded from this strict pattern. That may preserve
+ * extra conditional results, but it cannot incorrectly make a mutable tag strict.
+ *
+ * @param capability the trust-policy-derived session-tag capability
+ * @returns a strict PrincipalTag pattern, or undefined when every tag key may be supplied
+ */
+export declare function immutablePrincipalTagPattern(capability: RoleSessionTagCapability): string | undefined;
+//# sourceMappingURL=roleSessionTags.d.ts.map

package/dist/cjs/simulate/roleSessionTags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleSessionTags.d.ts","sourceRoot":"","sources":["../../../src/simulate/roleSessionTags.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAA;AAOhC,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IAEd,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAA;CACpB;AAED,mGAAmG;AACnG,MAAM,MAAM,wBAAwB,GAClC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,CAAA;AAQtF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,eAAe,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GACzD,wBAAwB,CAiC1B;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,wBAAwB,EACpC,MAAM,EAAE,MAAM,GACb,OAAO,CAST;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,wBAAwB,GACnC,MAAM,GAAG,SAAS,CAUpB"}

package/dist/cjs/simulate/roleSessionTags.js

@@ -0,0 +1,218 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.roleSessionTagCapability = roleSessionTagCapability;
+exports.roleSessionCanSetTagKey = roleSessionCanSetTagKey;
+exports.immutablePrincipalTagPattern = immutablePrincipalTagPattern;
+const iam_policy_1 = require("@actsecurity/iam-policy");
+const iam_utils_1 = require("@actsecurity/iam-utils");
+const tagSessionAction = 'sts:TagSession';
+const tagKeysConditionKey = 'aws:tagkeys';
+const policyVariablePattern = /\$\{[^}]+\}/;
+/** No trust-policy Allow permits session tags. */
+const noSessionTags = { type: 'none' };
+/** At least one trust-policy Allow may permit any session-tag key. */
+const anySessionTag = { type: 'any' };
+/**
+ * Determines which tag keys a role session may supply from the role's trust policy.
+ *
+ * This result intentionally does not depend on tags currently stored on the role. Deny statements
+ * and conditions unrelated to `aws:TagKeys` are ignored. Supported
+ * `ForAllValues:StringEquals` operators form a finite allowlist for one Allow statement, while
+ * `ForAnyValue`, unsupported operators, and policy-variable values conservatively permit any key.
+ *
+ * @param trustPolicy the role's validated trust policy, or undefined when it was not collected
+ * @returns the role's session-tag key capability
+ */
+function roleSessionTagCapability(trustPolicy) {
+    if (!trustPolicy) {
+        return noSessionTags;
+    }
+    if (trustPolicy.errors.length > 0) {
+        return anySessionTag;
+    }
+    const allowedTagKeys = [];
+    let hasTagSessionAllow = false;
+    for (const statement of (0, iam_policy_1.loadPolicy)(trustPolicy).statements()) {
+        if (!statement.isAllow() || !statementAllowsTagSession(statement)) {
+            continue;
+        }
+        hasTagSessionAllow = true;
+        const statementCapability = tagCapabilityForStatement(statement);
+        if (statementCapability.type === 'any') {
+            return anySessionTag;
+        }
+        if (statementCapability.type === 'allowlist') {
+            allowedTagKeys.push(...statementCapability.tagKeys);
+        }
+    }
+    if (!hasTagSessionAllow) {
+        return noSessionTags;
+    }
+    return {
+        type: 'allowlist',
+        tagKeys: uniqueTagKeys(allowedTagKeys)
+    };
+}
+/**
+ * Determines whether a tag key can be supplied by a role session.
+ *
+ * @param capability the trust-policy-derived session-tag capability
+ * @param tagKey the tag key to test
+ * @returns true when a role session may supply the key
+ */
+function roleSessionCanSetTagKey(capability, tagKey) {
+    if (capability.type === 'any') {
+        return true;
+    }
+    if (capability.type === 'none') {
+        return false;
+    }
+    return capability.tagKeys.some((entry) => tagKeyMatchesEntry(tagKey, entry));
+}
+/**
+ * Builds a slash-delimited regex constraint for PrincipalTag keys that cannot be session supplied.
+ *
+ * The iam-simulate constraint matcher is case-insensitive. Consequently, case variants of a
+ * case-sensitive allowlist entry are also excluded from this strict pattern. That may preserve
+ * extra conditional results, but it cannot incorrectly make a mutable tag strict.
+ *
+ * @param capability the trust-policy-derived session-tag capability
+ * @returns a strict PrincipalTag pattern, or undefined when every tag key may be supplied
+ */
+function immutablePrincipalTagPattern(capability) {
+    if (capability.type === 'any') {
+        return undefined;
+    }
+    if (capability.type === 'none' || capability.tagKeys.length === 0) {
+        return '/^aws:PrincipalTag\/.*/';
+    }
+    const mutableNames = capability.tagKeys.map((entry) => escapeRegex(entry.tagKey)).join('|');
+    return `/^aws:PrincipalTag\\/(?!(?:${mutableNames})$).*/`;
+}
+/**
+ * Determines whether an Allow statement's Action or NotAction includes `sts:TagSession`.
+ *
+ * @param statement the parsed trust-policy statement to inspect
+ * @returns true when the statement applies to the TagSession action
+ */
+function statementAllowsTagSession(statement) {
+    if (statement.isActionStatement()) {
+        return statement
+            .actions()
+            .some((action) => (0, iam_utils_1.actionMatchesPattern)(tagSessionAction, action.value()));
+    }
+    if (statement.isNotActionStatement()) {
+        return !statement
+            .notActions()
+            .some((action) => (0, iam_utils_1.actionMatchesPattern)(tagSessionAction, action.value()));
+    }
+    return false;
+}
+/**
+ * Determines which tag keys one TagSession Allow statement may supply.
+ *
+ * @param statement a parsed Allow statement that includes TagSession
+ * @returns the statement's session-tag capability
+ */
+function tagCapabilityForStatement(statement) {
+    const tagKeysConditions = statement
+        .conditions()
+        .filter((condition) => stringsEqualIgnoreCase(condition.conditionKey(), tagKeysConditionKey));
+    if (tagKeysConditions.length === 0 || tagKeysConditions.some(conditionIsUnbounded)) {
+        return anySessionTag;
+    }
+    return {
+        type: 'allowlist',
+        tagKeys: intersectTagKeyConditions(tagKeysConditions)
+    };
+}
+/**
+ * Determines whether a TagKeys condition cannot prove a finite exhaustive key allowlist.
+ *
+ * @param condition the parsed `aws:TagKeys` condition
+ * @returns true when the statement must conservatively be treated as permitting any key
+ */
+function conditionIsUnbounded(condition) {
+    const operation = condition.operation();
+    if (operation.isIfExists() || operation.setOperator() !== 'ForAllValues') {
+        return true;
+    }
+    const baseOperator = operation.baseOperator();
+    if (!stringsEqualIgnoreCase(baseOperator, 'StringEquals') &&
+        !stringsEqualIgnoreCase(baseOperator, 'StringEqualsIgnoreCase')) {
+        return true;
+    }
+    return condition.conditionValues().some((value) => policyVariablePattern.test(value));
+}
+/**
+ * Intersects finite ForAllValues TagKeys allowlists within one statement.
+ *
+ * @param conditions supported TagKeys conditions from one statement
+ * @returns tag keys capable of satisfying every condition
+ */
+function intersectTagKeyConditions(conditions) {
+    const conditionEntries = conditions.map(entriesForCondition);
+    const hasCaseSensitiveCondition = conditionEntries.some((entries) => entries.some((entry) => !entry.ignoreCase));
+    const candidates = hasCaseSensitiveCondition
+        ? conditionEntries.flat().filter((entry) => !entry.ignoreCase)
+        : conditionEntries[0];
+    return uniqueTagKeys(candidates.filter((candidate) => conditionEntries.every((entries) => entries.some((entry) => tagKeyMatchesEntry(candidate.tagKey, entry)))));
+}
+/**
+ * Converts one supported TagKeys condition into comparable entries.
+ *
+ * @param condition the parsed supported condition
+ * @returns entries carrying the condition's case-comparison semantics
+ */
+function entriesForCondition(condition) {
+    const ignoreCase = stringsEqualIgnoreCase(condition.operation().baseOperator(), 'StringEqualsIgnoreCase');
+    return condition.conditionValues().map((tagKey) => ({ tagKey, ignoreCase }));
+}
+/**
+ * Tests a concrete tag key against a trust-policy allowlist entry.
+ *
+ * @param tagKey the concrete tag key
+ * @param entry the allowlist entry and its comparison semantics
+ * @returns true when the key matches the entry
+ */
+function tagKeyMatchesEntry(tagKey, entry) {
+    return entry.ignoreCase ? stringsEqualIgnoreCase(tagKey, entry.tagKey) : tagKey === entry.tagKey;
+}
+/**
+ * Removes semantically duplicate tag-key entries while preserving case-sensitive alternatives.
+ *
+ * @param entries tag-key entries to deduplicate
+ * @returns unique entries
+ */
+function uniqueTagKeys(entries) {
+    const unique = [];
+    for (const entry of entries) {
+        if (!unique.some((existing) => existing.ignoreCase === entry.ignoreCase &&
+            (entry.ignoreCase
+                ? stringsEqualIgnoreCase(existing.tagKey, entry.tagKey)
+                : existing.tagKey === entry.tagKey))) {
+            unique.push(entry);
+        }
+    }
+    return unique;
+}
+/**
+ * Compares strings without case sensitivity or normalized string allocations.
+ *
+ * @param left first value to compare
+ * @param right second value to compare
+ * @returns true when the values compare equally without case sensitivity
+ */
+function stringsEqualIgnoreCase(left, right) {
+    return left.localeCompare(right, undefined, { sensitivity: 'base' }) === 0;
+}
+/**
+ * Escapes a literal string for use inside a regular expression.
+ *
+ * @param value the literal value to escape
+ * @returns a regex-safe representation
+ */
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=roleSessionTags.js.map

package/dist/cjs/simulate/roleSessionTags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleSessionTags.js","sourceRoot":"","sources":["../../../src/simulate/roleSessionTags.ts"],"names":[],"mappings":";;AA0CA,4DAmCC;AASD,0DAYC;AAYD,oEAYC;AA1HD,wDAKgC;AAChC,sDAA6D;AAE7D,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AACzC,MAAM,mBAAmB,GAAG,aAAa,CAAA;AACzC,MAAM,qBAAqB,GAAG,aAAa,CAAA;AAe3C,kDAAkD;AAClD,MAAM,aAAa,GAA6B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAEhE,sEAAsE;AACtE,MAAM,aAAa,GAA6B,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAE/D;;;;;;;;;;GAUG;AACH,SAAgB,wBAAwB,CACtC,WAA0D;IAE1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,MAAM,cAAc,GAAoB,EAAE,CAAA;IAC1C,IAAI,kBAAkB,GAAG,KAAK,CAAA;IAC9B,KAAK,MAAM,SAAS,IAAI,IAAA,uBAAU,EAAC,WAAW,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;YAClE,SAAQ;QACV,CAAC;QAED,kBAAkB,GAAG,IAAI,CAAA;QACzB,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAA;QAChE,IAAI,mBAAmB,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,IAAI,mBAAmB,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC7C,cAAc,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QACrD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC;KACvC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CACrC,UAAoC,EACpC,MAAc;IAEd,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,4BAA4B,CAC1C,UAAoC;IAEpC,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,yBAAyB,CAAA;IAClC,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC3F,OAAO,8BAA8B,YAAY,QAAQ,CAAA;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,SAAoB;IACrD,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QAClC,OAAO,SAAS;aACb,OAAO,EAAE;aACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,gCAAoB,EAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,IAAI,SAAS,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACrC,OAAO,CAAC,SAAS;aACd,UAAU,EAAE;aACZ,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAA,gCAAoB,EAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,SAAoB;IACrD,MAAM,iBAAiB,GAAG,SAAS;SAChC,UAAU,EAAE;SACZ,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,sBAAsB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAE/F,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnF,OAAO,aAAa,CAAA;IACtB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,yBAAyB,CAAC,iBAAiB,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,SAAoB;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,CAAA;IACvC,IAAI,SAAS,CAAC,UAAU,EAAE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;QACzE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,EAAE,CAAA;IAC7C,IACE,CAAC,sBAAsB,CAAC,YAAY,EAAE,cAAc,CAAC;QACrD,CAAC,sBAAsB,CAAC,YAAY,EAAE,wBAAwB,CAAC,EAC/D,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,UAAuB;IACxD,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC5D,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAClE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAC3C,CAAA;IACD,MAAM,UAAU,GAAG,yBAAyB;QAC1C,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;QAC9D,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;IAEvB,OAAO,aAAa,CAClB,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAC9B,gBAAgB,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CACjC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CACrE,CACF,CACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,SAAoB;IAC/C,MAAM,UAAU,GAAG,sBAAsB,CACvC,SAAS,CAAC,SAAS,EAAE,CAAC,YAAY,EAAE,EACpC,wBAAwB,CACzB,CAAA;IACD,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,KAAoB;IAC9D,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAA;AAClG,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAwB;IAC7C,MAAM,MAAM,GAAoB,EAAE,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IACE,CAAC,MAAM,CAAC,IAAI,CACV,CAAC,QAAQ,EAAE,EAAE,CACX,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;YACxC,CAAC,KAAK,CAAC,UAAU;gBACf,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBACvD,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CACxC,EACD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACrD,CAAC"}

package/dist/cjs/simulate/simulate.d.ts

@@ -185,14 +185,19 @@ export declare function simulateVirtualPrincipal(simulationRequest: VirtualPrinc
  */
 export declare function simulateExternalResourceRequest(simulationRequest: ExternalResourceSimulationRequest, collectClient: IamCollectClient): Promise<SimulateRequestResult>;
 /**
- * Convert an iam-lens strict context key into an iam-simulate Discovery constraint.
+ * Convert an iam-lens context key into an iam-simulate Discovery constraint.
+ *
+ * Caller-provided and explicitly strict keys remain fully authoritative. A stored PrincipalTag
+ * whose role session may override it has known presence but an unknown value. All other input keys
+ * are strict and continue through the existing special-case handling.
  *
  * @param keyName the literal context key or slash-delimited key pattern
  * @param simulationRequest the normalized request whose context certainty is modeled
+ * @param mutablePrincipalTagKeys stored PrincipalTag keys whose values are non-authoritative
  * @returns the Discovery constraint to pass to iam-simulate
  * @internal
  */
-export declare function discoveryConstraintForStrictKey(keyName: string, simulationRequest: Pick<InternalSimulationRequest, 'customContextKeys' | 'simulationMode' | 'principal'>): DiscoveryContextKeyConstraint;
+export declare function discoveryConstraintForStrictKey(keyName: string, simulationRequest: Pick<InternalSimulationRequest, 'additionalStrictContextKeys' | 'customContextKeys' | 'simulationMode' | 'principal'>, mutablePrincipalTagKeys?: ReadonlySet<string>): DiscoveryContextKeyConstraint;
 /**
  * Compare an actual simulation decision with an optional expected result.
  *

package/dist/cjs/simulate/simulate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAQlC,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAanF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAKjB,MAAM,kBAAkB,CAAA;AAKzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,iBAAiB,EACjB,WAAW,GAAG,aAAa,GAAG,eAAe,CAC9C;IACC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAkC,SAAQ,iBAAiB;IAC1E;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAC/F;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAQD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAC7E;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEtC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;IAEjD;;OAEG;IACH,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;IAE/C;;OAEG;IACH,0BAA0B,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,GAAG,SAAS,CAAA;IAEvE;;OAEG;IACH,oBAAoB,EAAE,qBAAqB,EAAE,CAAA;CAC9C;AAiBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,iBAAiB,EAAE,0BAA0B,EAC7C,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAMhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,iBAAiB,EAAE,iCAAiC,EACpD,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,iBAAiB,EAAE,iCAAiC,EACpD,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAqZD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,IAAI,CACrB,yBAAyB,EACzB,mBAAmB,GAAG,gBAAgB,GAAG,WAAW,CACrD,GACA,6BAA6B,CA6B/B;AAoLD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}
+{"version":3,"file":"simulate.d.ts","sourceRoot":"","sources":["../../../src/simulate/simulate.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EACf,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AASlC,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAanF,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,EAEL,KAAK,WAAW,EAKjB,MAAM,kBAAkB,CAAA;AAWzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;OAEG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAE/B;;OAEG;IACH,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IAEnC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,iBAAiB,EAAE,WAAW,CAAA;IAE9B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAE9B;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAE/B;;OAEG;IACH,aAAa,CAAC,EAAE,GAAG,CAAA;IAEnB;;OAEG;IACH,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAA;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CACtD,iBAAiB,EACjB,WAAW,GAAG,aAAa,GAAG,eAAe,CAC9C;IACC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iCAAkC,SAAQ,iBAAiB;IAC1E;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,iBAAiB,EAAE,aAAa,CAAC;IAC/F;;OAEG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE9B;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAQD;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAAG;IAC7E;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEtC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzC,CAAA;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,gBAAgB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,CAAA;IAEjD;;OAEG;IACH,sBAAsB,EAAE,qBAAqB,EAAE,CAAA;IAE/C;;OAEG;IACH,0BAA0B,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,GAAG,CAAA;KAAE,EAAE,GAAG,SAAS,CAAA;IAEvE;;OAEG;IACH,oBAAoB,EAAE,qBAAqB,EAAE,CAAA;CAC9C;AAiBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,iBAAiB,EAAE,0BAA0B,EAC7C,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAMhC;AAED;;;;;;;;GAQG;AACH,wBAAsB,gCAAgC,CACpD,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,iBAAiB,EAAE,iCAAiC,EACpD,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,iBAAiB,EAAE,iCAAiC,EACpD,aAAa,EAAE,gBAAgB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAwiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,IAAI,CACrB,yBAAyB,EACzB,6BAA6B,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,WAAW,CACrF,EACD,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5C,6BAA6B,CAoC/B;AAoLD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,EAClD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT"}

package/dist/cjs/simulate/simulate.js

@@ -15,6 +15,7 @@ const resources_js_1 = require("../resources.js");
 const sts_js_1 = require("../utils/sts.js");
 const contextKeys_js_1 = require("./contextKeys.js");
 const generatedPolicies_js_1 = require("./generatedPolicies.js");
+const roleSessionTags_js_1 = require("./roleSessionTags.js");
 const kmsRetireGrantAction = 'kms:retiregrant';
 /**
  * Simulate an IAM request using the collected policies for both the principal and resource.
@@ -148,7 +149,7 @@ async function simulateRequestInternal(input, variant, collectClient) {
         ? await resolvePrincipalArnForContext(collectClient, simulationRequest.principal)
         : undefined;
     const includeResourceMetadata = variant !== 'externalResource';
-    const { contextKeys, resourceTagsAreKnown } = await (0, contextKeys_js_1.createContextKeys)(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext, { includeResourceMetadata });
+    const { contextKeys, resourceTagsAreKnown } = await (0, contextKeys_js_1.createContextKeys)(collectClient, simulationRequest, service, simulationRequest.customContextKeys, principalArnForContext, { includePrincipalTags: requiresCollectedPrincipal, includeResourceMetadata });
     const vpcEndpointPolicy = await getVpcEndpointPolicy(collectClient, contextKeys);
     request.contextVariables = contextKeys;
     const simulation = {
@@ -162,8 +163,15 @@ async function simulateRequestInternal(input, variant, collectClient) {
         vpcEndpointPolicies: vpcEndpointPolicy ? [vpcEndpointPolicy] : undefined
     };
     await applyS3Settings(simulation, simulationRequest, variant, collectClient);
-    const strictContextKeys = makeStrictContextKeys(simulationRequest, contextKeys, resourceTagsAreKnown, (0, iam_utils_1.isS3BucketOrObjectArn)(simulationRequest.resourceArn || ''));
-    const discoveryContextKeyConstraints = strictContextKeys.map((keyName) => discoveryConstraintForStrictKey(keyName, simulationRequest));
+    const sessionTagCapability = await sessionTagCapabilityForRequest(collectClient, simulationRequest, principalArnForContext, requiresCollectedPrincipal);
+    const mutableExistingPrincipalTagKeys = mutableStoredPrincipalTagKeys(sessionTagCapability, contextKeys, simulationRequest.customContextKeys);
+    const principalTagsAreUnknown = variant === 'externalPrincipal' || variant === 'virtualPrincipal';
+    const strictContextKeys = makeStrictContextKeys(simulationRequest, contextKeys, resourceTagsAreKnown, (0, iam_utils_1.isS3BucketOrObjectArn)(simulationRequest.resourceArn || ''), principalTagsAreUnknown, sessionTagCapability, mutableExistingPrincipalTagKeys);
+    const discoveryContextKeyNames = new Set([
+        ...strictContextKeys,
+        ...mutableExistingPrincipalTagKeys
+    ]);
+    const discoveryContextKeyConstraints = [...discoveryContextKeyNames].map((keyName) => discoveryConstraintForStrictKey(keyName, simulationRequest, mutableExistingPrincipalTagKeys));
     const result = await (0, iam_simulate_1.runSimulation)(simulation, {
         simulationMode: simulationRequest.simulationMode,
         discoveryContextKeyConstraints
@@ -311,9 +319,12 @@ async function applyS3Settings(simulation, request, variant, collectClient) {
  * @param contextKeys generated and caller-provided context values
  * @param resourceTagsAreKnown whether all resource tags are known
  * @param s3BucketOrObjectRequest whether S3 bucket tag keys apply
+ * @param principalTagsAreUnknown whether synthetic principal tag presence and values are unknown
+ * @param sessionTagCapability trust-policy-derived role session-tag capability, when applicable
+ * @param mutablePrincipalTagKeys stored PrincipalTag keys whose values are not authoritative
  * @returns strict literal keys and key patterns
  */
-function makeStrictContextKeys(request, contextKeys, resourceTagsAreKnown, s3BucketOrObjectRequest) {
+function makeStrictContextKeys(request, contextKeys, resourceTagsAreKnown, s3BucketOrObjectRequest, principalTagsAreUnknown, sessionTagCapability, mutablePrincipalTagKeys) {
     const strictContextKeys = [...contextKeys_js_1.knownContextKeys, ...(request.additionalStrictContextKeys ?? [])];
     if (!request.principal) {
         strictContextKeys.push(contextKeys_js_1.CONTEXT_KEYS.userId, contextKeys_js_1.CONTEXT_KEYS.assumedRoot, '/^aws:PrincipalTag\/.*/');
@@ -326,6 +337,15 @@ function makeStrictContextKeys(request, contextKeys, resourceTagsAreKnown, s3Buc
             strictContextKeys.push(contextKeys_js_1.CONTEXT_KEYS.assumedRoot);
         }
     }
+    if (!principalTagsAreUnknown && request.principal && (0, iam_utils_1.isIamUserArn)(request.principal)) {
+        strictContextKeys.push('/^aws:PrincipalTag\/.*/');
+    }
+    if (sessionTagCapability) {
+        const immutableTagPattern = (0, roleSessionTags_js_1.immutablePrincipalTagPattern)(sessionTagCapability);
+        if (immutableTagPattern) {
+            strictContextKeys.push(immutableTagPattern);
+        }
+    }
     if (request.action.startsWith('s3:')) {
         strictContextKeys.push('s3:DataAccessPointAccount', 's3:DataAccessPointArn');
     }
@@ -336,21 +356,49 @@ function makeStrictContextKeys(request, contextKeys, resourceTagsAreKnown, s3Buc
             strictContextKeys.push('/^s3:BucketTag\/.*/');
         }
     }
+    // There also may be other tag context keys, so add those too. Mutable role tags must not
+    // receive a strict constraint because iam-simulate merges constraints with true-winning semantics.
     for (const key of Object.keys(contextKeys)) {
-        if (key.toLowerCase().includes('tag/')) {
+        if (isTagContextKey(key) &&
+            !(principalTagsAreUnknown && isPrincipalTagContextKey(key)) &&
+            !mutablePrincipalTagKeys.has(key)) {
             strictContextKeys.push(key);
         }
     }
     return strictContextKeys;
 }
+/**
+ * Checks whether a context key's first slash-delimited namespace ends in `Tag`.
+ *
+ * @param key context-key name to inspect
+ * @returns true for tag context keys such as `aws:PrincipalTag/Department`
+ */
+function isTagContextKey(key) {
+    const slashIndex = key.indexOf('/');
+    return (slashIndex >= 3 &&
+        key
+            .slice(slashIndex - 3, slashIndex + 1)
+            .localeCompare('tag/', undefined, { sensitivity: 'base' }) === 0);
+}
 const awsSourceKeyPrefix = 'aws:source';
+const awsPrincipalTagPrefix = 'aws:principaltag/';
+/**
+ * Checks whether a context key is in the PrincipalTag namespace.
+ *
+ * @param key context-key name to inspect
+ * @returns true when the key starts with `aws:PrincipalTag/`, ignoring case
+ */
+function isPrincipalTagContextKey(key) {
+    return (key
+        .slice(0, awsPrincipalTagPrefix.length)
+        .localeCompare(awsPrincipalTagPrefix, undefined, { sensitivity: 'base' }) === 0);
+}
 const anonymousAbsentContextKeys = new Set([
     'aws:principalarn',
     'aws:principalaccount',
     'aws:principalorgid',
     'aws:principalorgpaths',
     'aws:username',
-    'aws:userid',
     'aws:principalisawsservice',
     'aws:principalservicename',
     'aws:sourceaccount',
@@ -363,17 +411,80 @@ const anonymousAbsentContextKeys = new Set([
     '/^aws:principaltag\/.*/'
 ]);
 /**
- * Convert an iam-lens strict context key into an iam-simulate Discovery constraint.
+ * Derives role session-tag capability independently from tags stored on the role.
+ *
+ * This lookup applies only to Discovery simulations for IAM roles and assumed-role sessions. IAM
+ * user tags are handled separately as fully strict because users cannot receive role-session tags.
+ *
+ * @param collectClient the collect client used to load the canonical role trust policy
+ * @param simulationRequest the request whose principal-tag certainty is being modeled
+ * @param resolvedPrincipalArnForContext the canonical role ARN resolved for an assumed-role session
+ * @param principalIsCollected whether absent principal metadata is authoritative
+ * @returns the role's session-tag capability, or undefined when role metadata is not applicable
+ */
+async function sessionTagCapabilityForRequest(collectClient, simulationRequest, resolvedPrincipalArnForContext, principalIsCollected) {
+    if (simulationRequest.simulationMode !== 'Discovery' || !principalIsCollected) {
+        return undefined;
+    }
+    const requestPrincipal = simulationRequest.principal;
+    const roleArn = requestPrincipal && (0, iam_utils_1.isIamRoleArn)(requestPrincipal)
+        ? requestPrincipal
+        : resolvedPrincipalArnForContext;
+    if (!roleArn || !(0, iam_utils_1.isIamRoleArn)(roleArn)) {
+        return undefined;
+    }
+    const accountId = (0, iam_utils_1.splitArnParts)(roleArn).accountId;
+    if (!accountId) {
+        return undefined;
+    }
+    const trustPolicy = await collectClient.getResourcePolicyForArn(roleArn, accountId);
+    return (0, roleSessionTags_js_1.roleSessionTagCapability)(trustPolicy);
+}
+/**
+ * Finds stored role-tag values that a session may override.
+ *
+ * Stored tags determine baseline presence, while the independent trust-policy capability determines
+ * mutability. A mutable stored tag is always present, but its effective session value is unknown.
+ *
+ * @param capability the role's session-tag capability, or undefined for non-role requests
+ * @param contextKeys generated and caller-provided request context
+ * @param customContextKeys authoritative caller-provided context values
+ * @returns existing non-custom PrincipalTag context-key names whose values are mutable
+ */
+function mutableStoredPrincipalTagKeys(capability, contextKeys, customContextKeys) {
+    if (!capability || capability.type === 'none') {
+        return new Set();
+    }
+    const storedPrincipalTagKeys = Object.keys(contextKeys).filter((key) => isPrincipalTagContextKey(key) && !hasCustomContextKey(customContextKeys, key));
+    if (capability.type === 'any') {
+        return new Set(storedPrincipalTagKeys);
+    }
+    return new Set(storedPrincipalTagKeys.filter((key) => {
+        const tagKey = key.slice(awsPrincipalTagPrefix.length);
+        return (0, roleSessionTags_js_1.roleSessionCanSetTagKey)(capability, tagKey);
+    }));
+}
+/**
+ * Convert an iam-lens context key into an iam-simulate Discovery constraint.
+ *
+ * Caller-provided and explicitly strict keys remain fully authoritative. A stored PrincipalTag
+ * whose role session may override it has known presence but an unknown value. All other input keys
+ * are strict and continue through the existing special-case handling.
  *
  * @param keyName the literal context key or slash-delimited key pattern
  * @param simulationRequest the normalized request whose context certainty is modeled
+ * @param mutablePrincipalTagKeys stored PrincipalTag keys whose values are non-authoritative
  * @returns the Discovery constraint to pass to iam-simulate
  * @internal
  */
-function discoveryConstraintForStrictKey(keyName, simulationRequest) {
-    if (hasCustomContextKey(simulationRequest.customContextKeys, keyName)) {
+function discoveryConstraintForStrictKey(keyName, simulationRequest, mutablePrincipalTagKeys) {
+    if (hasCustomContextKey(simulationRequest.customContextKeys, keyName) ||
+        simulationRequest.additionalStrictContextKeys?.includes(keyName)) {
         return { keyName, presenceIsKnown: true, valueIsKnown: true };
     }
+    if (mutablePrincipalTagKeys?.has(keyName)) {
+        return { keyName, presenceIsKnown: true, valueIsKnown: false };
+    }
     if (simulationRequest.principal === undefined &&
         anonymousAbsentContextKeys.has(keyName.toLowerCase())) {
         return { keyName, presenceIsKnown: true, valueIsKnown: true };