@actsecurity/iam-simulate 0.1.173

package/dist/cjs/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE/D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAClF,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,CAAA;AAEtB,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,IAAI,GAAG,QAAQ,CAAA;AAE9F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,wBAAwB,CAAA;IAChC,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxC,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,gBAAgB,CAAA;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAA;IACnC,eAAe,EAAE,iBAAiB,EAAE,CAAA;IACpC,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;IACxC,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,aAAa,EAAE,CAAA;IAC3B,UAAU,EAAE,0BAA0B,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,oBAAoB,GACpB,2BAA2B,CAAA;AAE/B,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,QAAQ,CAAA;CACxB;AAED,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAA;IACtB,MAAM,EAAE,+BAA+B,GAAG,mBAAmB,CAAA;CAC9D;AAED,2DAA2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,KAAK,GAAG,IAAI,CAAA;IACtB,UAAU,EAAE,0BAA0B,EAAE,CAAA;CACzC;AAED,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,CAAA;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,OAAO,EAAE,sBAAsB,EAAE,CAAA;IACjC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,aAAa,CAAA;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,sBAAsB,EAAE,CAAA;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EACR,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;IAC/F,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE;QACR,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,kBAAkB,CAAC,EAAE;QACnB,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;IACD,cAAc,CAAC,EAAE;QACf,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;QAC1B,IAAI,CAAC,EAAE,gBAAgB,EAAE,CAAA;KAC1B,CAAA;CACF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,gBAAgB,CAAA;IAExB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAA;IAEpB;;OAEG;IACH,eAAe,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAE9C;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAEnC;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IAEzB;;OAEG;IACH,0BAA0B,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAEzD;;OAEG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAE/C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,0BAA0B,CAAA;IAEvC;;OAEG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IAErC;;OAEG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,aAAa,EAAE,CAAA;CAC5B"}

package/dist/cjs/evaluate.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=evaluate.js.map

package/dist/cjs/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/evaluate.ts"],"names":[],"mappings":""}

package/dist/cjs/explain/displayExplainCli.d.ts

@@ -0,0 +1,3 @@
+import { type StatementExplain } from './statementExplain.js';
+export declare function printExplain(explain: StatementExplain): void;
+//# sourceMappingURL=displayExplainCli.d.ts.map

package/dist/cjs/explain/displayExplainCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.d.ts","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AA2M7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,QAqErD"}

package/dist/cjs/explain/displayExplainCli.js

@@ -0,0 +1,260 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printExplain = printExplain;
+const explain1 = {
+    identifier: 'Statement1',
+    matches: true,
+    actionMatch: true,
+    resourceMatch: true,
+    principalMatch: 'Match',
+    conditionMatch: true,
+    effect: 'Allow',
+    actions: [
+        {
+            action: 's3:Get*',
+            matches: true
+        },
+        {
+            action: 's3:PutObject',
+            matches: false
+        }
+    ],
+    resources: [
+        {
+            resource: 'arn:aws:s3:::examplebucket/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/${aws:PrincipalTag/Department}/*',
+            resolvedValue: 'arn:aws:s3:::examplebucket/Engineering/*',
+            errors: [],
+            matches: true
+        },
+        {
+            resource: 'arn:aws:s3:::examplebucket/abc/*',
+            errors: [],
+            matches: false
+        }
+    ],
+    conditions: [
+        {
+            conditionKeyValue: 'aws:SecureTransport',
+            resolvedConditionKeyValue: 'true',
+            operator: 'Bool',
+            matches: true,
+            values: {
+                value: 'true',
+                resolvedValue: 'true',
+                matches: true,
+                errors: []
+            }
+        },
+        {
+            conditionKeyValue: 's3:PrincipalTag/Department',
+            resolvedConditionKeyValue: 'Engineering',
+            operator: 'StringEquals',
+            matches: true,
+            values: [
+                {
+                    value: 'Engineering',
+                    resolvedValue: 'Engineering',
+                    matches: true,
+                    errors: []
+                },
+                {
+                    value: 'Quality',
+                    resolvedValue: 'Engineering',
+                    matches: false,
+                    errors: []
+                }
+            ]
+        }
+    ]
+};
+const explain2 = {
+    identifier: 'Statement2',
+    matches: true,
+    actionMatch: true,
+    resourceMatch: true,
+    principalMatch: 'Match',
+    conditionMatch: true,
+    effect: 'Allow',
+    actions: [
+        {
+            action: 's3:Put*',
+            matches: true
+        }
+    ],
+    resources: [
+        {
+            resource: 'arn:aws:s3:::examplebucket/*',
+            errors: [],
+            matches: true
+        }
+    ],
+    conditions: [
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAllValues:StringLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAllValues:StringNotLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    // matchingValues: ['Color', 'Size', 'Banana', 'Blueberry'],
+                    negativeMatchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    // matchingValues: ['Color', 'Size', 'Apple', 'Apricot'],
+                    negativeMatchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAnyValue:StringLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Apple', 'Apricot']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Banana', 'Blueberry']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:RequestObjectTagKeys',
+            operator: 'ForAnyValue:StringNotLike',
+            matches: true,
+            unmatchedValues: ['Color', 'Size'],
+            values: [
+                {
+                    value: 'A*',
+                    matches: true,
+                    matchingValues: ['Color', 'Size', 'Banana', 'Blueberry']
+                },
+                {
+                    value: 'B*',
+                    matches: true,
+                    matchingValues: ['Color', 'Size', 'Apple', 'Apricot']
+                }
+            ]
+        },
+        {
+            conditionKeyValue: 's3:PrincipalTag/Department',
+            resolvedConditionKeyValue: 'Engineering',
+            operator: 'StringEquals',
+            matches: true,
+            values: [
+                {
+                    value: 'Engineering',
+                    resolvedValue: 'Engineering',
+                    matches: true,
+                    errors: []
+                },
+                {
+                    value: 'Quality',
+                    resolvedValue: 'Engineering',
+                    matches: false,
+                    errors: []
+                }
+            ]
+        }
+    ]
+};
+function buffers(n) {
+    return '  '.repeat(n);
+}
+function printExplain(explain) {
+    const buffer = '  ';
+    console.log(`{`);
+    if (explain.matches) {
+        console.log(`${buffer}// Statement ${explain.identifier} Matches`);
+    }
+    else {
+        console.log(`${buffer}// Statement ${explain.identifier} Does NOT Match`);
+    }
+    if (explain.actions && !Array.isArray(explain.actions)) {
+        const actionString = `${buffer}"Action": "${explain.actions.action}", // ${explain.actions.matches ? 'Match' : 'No Match'}`;
+        console.log(actionString);
+    }
+    else if (explain.actions && Array.isArray(explain.actions)) {
+        console.log(`${buffer}"Action": [`);
+        for (const action of explain.actions) {
+            console.log(`${buffers(2)}"${action.action}", // ${action.matches ? 'Match' : 'No Match'}`);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.resources && !Array.isArray(explain.resources)) {
+        if (explain.resources.resolvedValue) {
+            console.log(`${buffer}        //${explain.resources.resolvedValue} // Resolved Value`);
+        }
+        console.log(`${buffer}"Resource": "${explain.resources.resource}", // ${explain.resources.matches ? 'Match' : 'No Match'}`);
+    }
+    else if (explain.resources && Array.isArray(explain.resources)) {
+        console.log(`${buffer}"Resource": [`);
+        for (const resource of explain.resources) {
+            let resourceLine = `${buffers(2)}"${resource.resource}", // ${resource.matches ? 'Match' : 'No Match'}`;
+            if (resource.resolvedValue) {
+                resourceLine += ` Resolved to "${resource.resolvedValue}"`;
+            }
+            console.log(resourceLine);
+        }
+        console.log(`${buffer}]`);
+    }
+    if (explain.conditions) {
+        const operators = explain.conditions.map((c) => c.operator);
+        console.log(`${buffer}"Condition": {`);
+        for (const op of operators) {
+            const opConditions = explain.conditions.filter((c) => c.operator === op);
+            console.log(`${buffers(2)}"${op}": {`);
+            for (const c of opConditions) {
+                if (c.values && !Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": "${c.values.value}", // ${c.matches ? 'Match' : 'No Match'}`);
+                    // console.log(`${buffers(3)}"Value": "${c.values.value}", // ${c.values.matches ? 'Match' : 'No Match'}`)
+                }
+                else if (c.values && Array.isArray(c.values)) {
+                    console.log(`${buffers(3)}"${c.conditionKeyValue}": [`);
+                    for (const v of c.values) {
+                        console.log(`${buffers(4)}"${v.value}", // ${v.matches ? 'Match' : 'No Match'}`);
+                    }
+                    console.log(`${buffers(3)}]`);
+                }
+            }
+            console.log(`${buffers(2)}}`);
+        }
+        console.log(`${buffer}}`);
+    }
+    console.log(`}`);
+}
+void explain2;
+printExplain(explain1);
+//# sourceMappingURL=displayExplainCli.js.map

package/dist/cjs/explain/displayExplainCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"displayExplainCli.js","sourceRoot":"","sources":["../../../src/explain/displayExplainCli.ts"],"names":[],"mappings":";;AA2MA,oCAqEC;AA9QD,MAAM,QAAQ,GAAqB;IACjC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,OAAO;IACvB,cAAc,EAAE,IAAI;IAEpB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE;QACP;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;SACd;QACD;YACE,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,KAAK;SACf;KACF;IAED,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,6DAA6D;YACvE,aAAa,EAAE,0CAA0C;YACzD,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;QACD;YACE,QAAQ,EAAE,kCAAkC;YAC5C,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,KAAK;SACf;KACF;IAED,UAAU,EAAE;QACV;YACE,iBAAiB,EAAE,qBAAqB;YACxC,yBAAyB,EAAE,MAAM;YACjC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN,KAAK,EAAE,MAAM;gBACb,aAAa,EAAE,MAAM;gBACrB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,EAAE;aACX;SACF;QACD;YACE,iBAAiB,EAAE,4BAA4B;YAC/C,yBAAyB,EAAE,aAAa;YACxC,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,KAAK,EAAE,SAAS;oBAChB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;iBACX;aACF;SACF;KACF;CACF,CAAA;AAED,MAAM,QAAQ,GAAqB;IACjC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,OAAO;IACvB,cAAc,EAAE,IAAI;IAEpB,MAAM,EAAE,OAAO;IACf,OAAO,EAAE;QACP;YACE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;SACd;KACF;IAED,SAAS,EAAE;QACT;YACE,QAAQ,EAAE,8BAA8B;YACxC,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,IAAI;SACd;KACF;IAED,UAAU,EAAE;QACV;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,yBAAyB;YACnC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBACrC;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBACxC;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,4BAA4B;YACtC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,4DAA4D;oBAC5D,sBAAsB,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBAC7C;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,yDAAyD;oBACzD,sBAAsB,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBAChD;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;iBACrC;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;iBACxC;aACF;SACF;QACD;YACE,iBAAiB,EAAE,yBAAyB;YAC5C,QAAQ,EAAE,2BAA2B;YACrC,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAClC,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC;iBACzD;gBACD;oBACE,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;iBACtD;aACF;SACF;QACD;YACE,iBAAiB,EAAE,4BAA4B;YAC/C,yBAAyB,EAAE,aAAa;YACxC,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE;gBACN;oBACE,KAAK,EAAE,aAAa;oBACpB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,KAAK,EAAE,SAAS;oBAChB,aAAa,EAAE,aAAa;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,EAAE;iBACX;aACF;SACF;KACF;CACF,CAAA;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACvB,CAAC;AAED,SAAgB,YAAY,CAAC,OAAyB;IACpD,MAAM,MAAM,GAAG,IAAI,CAAA;IAEnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,UAAU,CAAC,CAAA;IACpE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,OAAO,CAAC,UAAU,iBAAiB,CAAC,CAAA;IAC3E,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,MAAM,YAAY,GAAG,GAAG,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;QAC3H,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC3B,CAAC;SAAM,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,CAAC,CAAA;QACnC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,OAAO,CAAC,SAAS,CAAC,aAAa,oBAAoB,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,gBAAgB,OAAO,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAC/G,CAAA;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,eAAe,CAAC,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,YAAY,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,SAAS,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;YACvG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC3B,YAAY,IAAI,iBAAiB,QAAQ,CAAC,aAAa,GAAG,CAAA;YAC5D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,CAAC,CAAA;QACtC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACtC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzC,OAAO,CAAC,GAAG,CACT,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CACrG,CAAA;oBACD,0GAA0G;gBAC5G,CAAC;qBAAM,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,MAAM,CAAC,CAAA;oBACvD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;wBACzB,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;oBAClF,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAClB,CAAC;AAED,KAAK,QAAQ,CAAA;AACb,YAAY,CAAC,QAAQ,CAAC,CAAA"}

package/dist/cjs/explain/statementExplain.d.ts

@@ -0,0 +1,161 @@
+export type ExplainPrincipalMatch = 'Match' | 'NoMatch' | 'AccountLevelMatch' | 'SessionRoleMatch' | 'SessionUserMatch';
+export interface ActionExplain {
+    action: string;
+    matches: boolean;
+}
+/**
+ * Known reasons that a policy resource can fail to match a request resource.
+ *
+ * The `invertible` flag records whether the mismatch definitively proves that
+ * the request is outside a `NotResource` set. Non-invertible reasons indicate
+ * invalid policy syntax or unavailable input rather than a definitive mismatch.
+ */
+export declare const resourceMismatchReasons: {
+    readonly invalidPolicyResourceArn: {
+        readonly invertible: false;
+    };
+    readonly requestMissingResource: {
+        readonly invertible: false;
+    };
+    readonly unresolvablePolicyVariable: {
+        readonly invertible: false;
+    };
+    readonly shortArnNoMatch: {
+        readonly invertible: true;
+    };
+    readonly shortArnExpandedMismatch: {
+        readonly invertible: false;
+    };
+    readonly wildcardOnlyActionSpecificResource: {
+        readonly invertible: true;
+    };
+    readonly requestAllResourcesSpecificNotResource: {
+        readonly invertible: true;
+    };
+    readonly requestAllResourcesDenySpecificResource: {
+        readonly invertible: true;
+    };
+    readonly resourcePatternMismatch: {
+        readonly invertible: true;
+    };
+    readonly partitionMismatch: {
+        readonly invertible: true;
+    };
+    readonly serviceMismatch: {
+        readonly invertible: true;
+    };
+    readonly regionMismatch: {
+        readonly invertible: true;
+    };
+    readonly accountMismatch: {
+        readonly invertible: true;
+    };
+    readonly productMismatch: {
+        readonly invertible: true;
+    };
+    readonly resourceIdMismatch: {
+        readonly invertible: true;
+    };
+};
+/**
+ * A machine-readable key explaining why a policy resource did not match a request resource.
+ */
+export type ResourceMismatchReason = keyof typeof resourceMismatchReasons;
+export interface ResourceExplain {
+    resource: string;
+    resolvedValue?: string;
+    errors?: string[];
+    /**
+     * Machine-readable reason for a non-match, when the resource did not match.
+     */
+    mismatchReason?: ResourceMismatchReason;
+    matches: boolean;
+}
+export interface PrincipalExplain {
+    principal: string;
+    matches: ExplainPrincipalMatch;
+    roleForSessionArn?: string;
+    userForSessionArn?: string;
+    errors?: string[];
+}
+export interface ConditionValueExplain {
+    value: string;
+    resolvedValue?: string;
+    matches: boolean;
+    matchingValues?: string[];
+    negativeMatchingValues?: string[];
+    errors?: string[];
+}
+export interface ConditionExplain {
+    /**
+     * The operation that was used in the condition statement
+     */
+    operator: string;
+    /**
+     * The value being matched in the condition statement
+     */
+    conditionKeyValue: string;
+    /**
+     * The resolved value of the condition key
+     */
+    resolvedConditionKeyValue?: string;
+    values: ConditionValueExplain | ConditionValueExplain[];
+    /**
+     * The values from the request context that were not matched by a condition with a set operation
+     */
+    unmatchedValues?: string[];
+    /**
+     * Whether the condition matches the request
+     */
+    matches: boolean;
+    /**
+     *
+     */
+    matchedBecauseMissing?: boolean;
+    /**
+     * Failed because the context key was missing from the request.
+     */
+    failedBecauseMissing?: boolean;
+    /**
+     * Failed because the context key was required to be a string but was was
+     * an instead an array. Caused by a set operation being used on a single value
+     * context key.
+     */
+    failedBecauseArray?: boolean;
+    /**
+     * Was the base operator in the condition statement not found
+     */
+    missingOperator?: boolean;
+}
+export interface StatementExplain {
+    actionMatch: boolean;
+    resourceMatch: boolean;
+    principalMatch: ExplainPrincipalMatch;
+    conditionMatch: boolean;
+    matches: boolean;
+    identifier: string;
+    effect: string;
+    actions?: ActionExplain | ActionExplain[];
+    notActions?: ActionExplain | ActionExplain[];
+    resources?: ResourceExplain | ResourceExplain[];
+    notResources?: ResourceExplain | ResourceExplain[];
+    principals?: PrincipalExplain | PrincipalExplain[];
+    notPrincipals?: PrincipalExplain | PrincipalExplain[];
+    conditions?: ConditionExplain[];
+    /**
+     * The statement was denied because the resource policy has a NotPrincipal in a Deny
+     * statement and the principal has a Permission Boundary.
+     *
+     * This will always resolve to to Deny.
+     *
+     * https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html
+     */
+    denyBecauseNpInRpAndPb?: boolean;
+    /**
+     * The statement in a resource policy had neither a Principal nor a NotPrincipal
+     * element. AWS accepts this syntactically, but such a statement can never match
+     * a request, so the simulator reports it as NoMatch with this flag set.
+     */
+    noPrincipalElement?: boolean;
+}
+//# sourceMappingURL=statementExplain.d.ts.map

package/dist/cjs/explain/statementExplain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.d.ts","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAC/B,OAAO,GAAG,SAAS,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAErF,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiB1B,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,uBAAuB,CAAA;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB;;OAEG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAA;IACvC,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,qBAAqB,CAAA;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAEhB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAA;IAEzB;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,MAAM,EAAE,qBAAqB,GAAG,qBAAqB,EAAE,CAAA;IAEvD;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;OAEG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAE/B;;OAEG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAE9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAE5B;;OAEG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,OAAO,CAAA;IACpB,aAAa,EAAE,OAAO,CAAA;IACtB,cAAc,EAAE,qBAAqB,CAAA;IACrC,cAAc,EAAE,OAAO,CAAA;IAEvB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IACzC,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE,CAAA;IAC5C,SAAS,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAC/C,YAAY,CAAC,EAAE,eAAe,GAAG,eAAe,EAAE,CAAA;IAClD,UAAU,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IAClD,aAAa,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAA;IACrD,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAE/B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC7B"}

package/dist/cjs/explain/statementExplain.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceMismatchReasons = void 0;
+/**
+ * Known reasons that a policy resource can fail to match a request resource.
+ *
+ * The `invertible` flag records whether the mismatch definitively proves that
+ * the request is outside a `NotResource` set. Non-invertible reasons indicate
+ * invalid policy syntax or unavailable input rather than a definitive mismatch.
+ */
+exports.resourceMismatchReasons = {
+    invalidPolicyResourceArn: { invertible: false },
+    requestMissingResource: { invertible: false },
+    unresolvablePolicyVariable: { invertible: false },
+    shortArnNoMatch: { invertible: true },
+    // Expanded short ARN mismatches preserve existing conservative behavior and are not inverted.
+    shortArnExpandedMismatch: { invertible: false },
+    wildcardOnlyActionSpecificResource: { invertible: true },
+    requestAllResourcesSpecificNotResource: { invertible: true },
+    requestAllResourcesDenySpecificResource: { invertible: true },
+    resourcePatternMismatch: { invertible: true },
+    partitionMismatch: { invertible: true },
+    serviceMismatch: { invertible: true },
+    regionMismatch: { invertible: true },
+    accountMismatch: { invertible: true },
+    productMismatch: { invertible: true },
+    resourceIdMismatch: { invertible: true }
+};
+/*
+I want to emit the policy object exactly as it was written. How do I get a structure
+that matches the policy object exactly? Should I just embed the values in the explain?
+*/
+//# sourceMappingURL=statementExplain.js.map

package/dist/cjs/explain/statementExplain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statementExplain.js","sourceRoot":"","sources":["../../../src/explain/statementExplain.ts"],"names":[],"mappings":";;;AAQA;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAG;IACrC,wBAAwB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC/C,sBAAsB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7C,0BAA0B,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IACjD,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,8FAA8F;IAC9F,wBAAwB,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC/C,kCAAkC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACxD,sCAAsC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC5D,uCAAuC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7D,uBAAuB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IAC7C,iBAAiB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACvC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,cAAc,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACpC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;IACrC,kBAAkB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;CAChC,CAAA;AAwHV;;;EAGE"}

package/dist/cjs/global_conditions/globalConditionKeys.d.ts

@@ -0,0 +1,3 @@
+import { type ConditionKey } from '@actsecurity/iam-data';
+export declare function getGlobalConditionKeyWithOrWithoutPrefix(key: string): ConditionKey | undefined;
+//# sourceMappingURL=globalConditionKeys.d.ts.map

package/dist/cjs/global_conditions/globalConditionKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalConditionKeys.d.ts","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,uBAAuB,CAAA;AAE9B,wBAAgB,wCAAwC,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM9F"}

package/dist/cjs/global_conditions/globalConditionKeys.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGlobalConditionKeyWithOrWithoutPrefix = getGlobalConditionKeyWithOrWithoutPrefix;
+const iam_data_1 = require("@actsecurity/iam-data");
+function getGlobalConditionKeyWithOrWithoutPrefix(key) {
+    const slashIndex = key.indexOf('/');
+    if (slashIndex !== -1) {
+        return (0, iam_data_1.getGlobalConditionKeyByPrefix)(key.slice(0, slashIndex));
+    }
+    return (0, iam_data_1.getGlobalConditionKeyByName)(key);
+}
+//# sourceMappingURL=globalConditionKeys.js.map

package/dist/cjs/global_conditions/globalConditionKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalConditionKeys.js","sourceRoot":"","sources":["../../../src/global_conditions/globalConditionKeys.ts"],"names":[],"mappings":";;AAMA,4FAMC;AAZD,oDAI8B;AAE9B,SAAgB,wCAAwC,CAAC,GAAW;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,IAAA,wCAA6B,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,IAAA,sCAA2B,EAAC,GAAG,CAAC,CAAA;AACzC,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,16 @@
+export { getDenialReasons, getGrantReasons, type DenialPolicyType, type RequestGrant, type RequestDenial } from './analysis/analyzeResults.js';
+export { typeForContextKey } from './context_keys/contextKeys.js';
+export { isConditionKeyArray, type BaseConditionKeyType, type ConditionKeyType } from './context_keys/contextKeyTypes.js';
+export type { DiscoveryContextKeyConstraint } from './context_keys/discoveryContextKeyConstraints.js';
+export { findContextKeys } from './context_keys/findContextKeys.js';
+export type { SimulationMode } from './core_engine/CoreSimulatorEngine.js';
+export type { AllowedConditionExpression, AllowedConditionGroup, AllowedConditionLeaf, AllowedConditionSource, AllowedSessionNameCondition, AlwaysAllowedCondition, BlockedReason, EvaluationResult, IgnoredCondition, IgnoredConditions, NeverAllowedCondition, RequestAnalysis } from './evaluate.js';
+export type { ActionExplain, ConditionExplain, ConditionValueExplain, ExplainPrincipalMatch, PrincipalExplain, ResourceExplain, StatementExplain } from './explain/statementExplain.js';
+export { allowedContextKeysForRequest } from './simulation_engine/contextKeys.js';
+export { anonymousPrincipal, isAnonymousRequestPrincipal, isSimulationRequestPrincipal, type AnonymousRequestPrincipal, type Simulation, type SimulationIdentityPolicy, type SimulationOrgPolicies, type SimulationRequestPrincipal } from './simulation_engine/simulation.js';
+export { runSimulation } from './simulation_engine/simulationEngine.js';
+export type { ErrorSimulationResult, RunSimulationResults, SimulationErrors, SimulationResourceResult, SimulationResultType, SingleResourceSimulationResult, SuccessfulRunSimulationResults, WildcardResourceSimulationResults, WildcardSimulationResourceResult } from './simulation_engine/simulationEngine.js';
+export type { SimulationOptions } from './simulation_engine/simulationOptions.js';
+export { runUnsafeSimulation } from './simulation_engine/unsafeSimulationEngine.js';
+export { isWildcardOnlyAction } from './util.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACtB,MAAM,mCAAmC,CAAA;AAC1C,YAAY,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAA;AACrG,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAC1E,YAAY,EACV,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EAChB,MAAM,eAAe,CAAA;AACtB,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EACjB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,UAAU,EACf,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAA;AACvE,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,8BAA8B,EAC9B,iCAAiC,EACjC,gCAAgC,EACjC,MAAM,yCAAyC,CAAA;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA"}

package/dist/cjs/index.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isWildcardOnlyAction = exports.runUnsafeSimulation = exports.runSimulation = exports.isSimulationRequestPrincipal = exports.isAnonymousRequestPrincipal = exports.anonymousPrincipal = exports.allowedContextKeysForRequest = exports.findContextKeys = exports.isConditionKeyArray = exports.typeForContextKey = exports.getGrantReasons = exports.getDenialReasons = void 0;
+var analyzeResults_js_1 = require("./analysis/analyzeResults.js");
+Object.defineProperty(exports, "getDenialReasons", { enumerable: true, get: function () { return analyzeResults_js_1.getDenialReasons; } });
+Object.defineProperty(exports, "getGrantReasons", { enumerable: true, get: function () { return analyzeResults_js_1.getGrantReasons; } });
+var contextKeys_js_1 = require("./context_keys/contextKeys.js");
+Object.defineProperty(exports, "typeForContextKey", { enumerable: true, get: function () { return contextKeys_js_1.typeForContextKey; } });
+var contextKeyTypes_js_1 = require("./context_keys/contextKeyTypes.js");
+Object.defineProperty(exports, "isConditionKeyArray", { enumerable: true, get: function () { return contextKeyTypes_js_1.isConditionKeyArray; } });
+var findContextKeys_js_1 = require("./context_keys/findContextKeys.js");
+Object.defineProperty(exports, "findContextKeys", { enumerable: true, get: function () { return findContextKeys_js_1.findContextKeys; } });
+var contextKeys_js_2 = require("./simulation_engine/contextKeys.js");
+Object.defineProperty(exports, "allowedContextKeysForRequest", { enumerable: true, get: function () { return contextKeys_js_2.allowedContextKeysForRequest; } });
+var simulation_js_1 = require("./simulation_engine/simulation.js");
+Object.defineProperty(exports, "anonymousPrincipal", { enumerable: true, get: function () { return simulation_js_1.anonymousPrincipal; } });
+Object.defineProperty(exports, "isAnonymousRequestPrincipal", { enumerable: true, get: function () { return simulation_js_1.isAnonymousRequestPrincipal; } });
+Object.defineProperty(exports, "isSimulationRequestPrincipal", { enumerable: true, get: function () { return simulation_js_1.isSimulationRequestPrincipal; } });
+var simulationEngine_js_1 = require("./simulation_engine/simulationEngine.js");
+Object.defineProperty(exports, "runSimulation", { enumerable: true, get: function () { return simulationEngine_js_1.runSimulation; } });
+var unsafeSimulationEngine_js_1 = require("./simulation_engine/unsafeSimulationEngine.js");
+Object.defineProperty(exports, "runUnsafeSimulation", { enumerable: true, get: function () { return unsafeSimulationEngine_js_1.runUnsafeSimulation; } });
+var util_js_1 = require("./util.js");
+Object.defineProperty(exports, "isWildcardOnlyAction", { enumerable: true, get: function () { return util_js_1.isWildcardOnlyAction; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,kEAMqC;AALnC,qHAAA,gBAAgB,OAAA;AAChB,oHAAA,eAAe,OAAA;AAKjB,gEAAiE;AAAxD,mHAAA,iBAAiB,OAAA;AAC1B,wEAI0C;AAHxC,yHAAA,mBAAmB,OAAA;AAKrB,wEAAmE;AAA1D,qHAAA,eAAe,OAAA;AAyBxB,qEAAiF;AAAxE,8HAAA,4BAA4B,OAAA;AACrC,mEAS0C;AARxC,mHAAA,kBAAkB,OAAA;AAClB,4HAAA,2BAA2B,OAAA;AAC3B,6HAAA,4BAA4B,OAAA;AAO9B,+EAAuE;AAA9D,oHAAA,aAAa,OAAA;AAatB,2FAAmF;AAA1E,gIAAA,mBAAmB,OAAA;AAC5B,qCAAgD;AAAvC,+GAAA,oBAAoB,OAAA"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "commonjs"
+}

package/dist/cjs/policyType.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The type of IAM policy being evaluated during authorization.
+ *
+ * - `'identity'` — identity-based policies attached to the principal
+ * - `'resource'` — resource-based policies attached to the target resource
+ * - `'scp'` — service control policies from AWS Organizations
+ * - `'rcp'` — resource control policies from AWS Organizations
+ * - `'pb'` — permission boundary policies
+ * - `'vpce'` — VPC endpoint policies
+ * - `'session'` — session policies for assumed role or federated sessions
+ */
+export type PolicyType = 'scp' | 'rcp' | 'vpce' | 'identity' | 'resource' | 'pb' | 'session';
+//# sourceMappingURL=policyType.d.ts.map

package/dist/cjs/policyType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyType.d.ts","sourceRoot":"","sources":["../../src/policyType.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,GAAG,IAAI,GAAG,SAAS,CAAA"}

package/dist/cjs/policyType.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=policyType.js.map

package/dist/cjs/policyType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyType.js","sourceRoot":"","sources":["../../src/policyType.ts"],"names":[],"mappings":""}