@actsecurity/iam-simulate 0.1.173

package/dist/esm/condition/string/StringNotEqualsIgnoreCase.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const StringNotEqualsIgnoreCase: BaseConditionOperator;
+//# sourceMappingURL=StringNotEqualsIgnoreCase.d.ts.map

package/dist/esm/condition/string/StringNotEqualsIgnoreCase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEqualsIgnoreCase.d.ts","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEqualsIgnoreCase.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,yBAAyB,EAAE,qBA8BvC,CAAA"}

package/dist/esm/condition/string/StringNotEqualsIgnoreCase.js

@@ -0,0 +1,34 @@
+import {} from '../../explain/statementExplain.js';
+import { convertIamString } from '../../util.js';
+import {} from '../BaseConditionOperator.js';
+import { resolvedValue } from '../conditionUtil.js';
+export const StringNotEqualsIgnoreCase = {
+    name: 'StringNotEqualsIgnoreCase',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = convertIamString(value, request, { replaceWildcards: false });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = !new RegExp(pattern, 'i').test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: resolvedValue(value, request)
+            };
+        });
+        const overallMatch = !explains.some((explain) => !explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: false,
+    isNegative: true
+};
+//# sourceMappingURL=StringNotEqualsIgnoreCase.js.map

package/dist/esm/condition/string/StringNotEqualsIgnoreCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEqualsIgnoreCase.js","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEqualsIgnoreCase.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAA8B,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;YACzF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACxD,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/esm/condition/string/StringNotLike.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const StringNotLike: BaseConditionOperator;
+//# sourceMappingURL=StringNotLike.d.ts.map

package/dist/esm/condition/string/StringNotLike.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotLike.d.ts","sourceRoot":"","sources":["../../../../src/condition/string/StringNotLike.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,aAAa,EAAE,qBA8B3B,CAAA"}

package/dist/esm/condition/string/StringNotLike.js

@@ -0,0 +1,34 @@
+import {} from '../../explain/statementExplain.js';
+import { convertIamString } from '../../util.js';
+import {} from '../BaseConditionOperator.js';
+import { resolvedValue } from '../conditionUtil.js';
+export const StringNotLike = {
+    name: 'StringNotLike',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = convertIamString(value, request, { replaceWildcards: true });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = !pattern.test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: resolvedValue(value, request)
+            };
+        });
+        const overallMatch = !explains.some((explain) => !explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: true,
+    isNegative: true
+};
+//# sourceMappingURL=StringNotLike.js.map

package/dist/esm/condition/string/StringNotLike.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotLike.js","sourceRoot":"","sources":["../../../../src/condition/string/StringNotLike.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAA8B,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,CAAC,MAAM,aAAa,GAA0B;IAClD,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/esm/context_keys/contextKeyTypes.d.ts

@@ -0,0 +1,19 @@
+export type BaseConditionKeyType = 'String' | 'ARN' | 'Numeric' | 'Bool' | 'Date' | 'IPAddress' | 'Binary';
+export type ArrayConditionKeyType = `ArrayOf${BaseConditionKeyType}`;
+export type ConditionKeyType = BaseConditionKeyType | ArrayConditionKeyType;
+/**
+ * Check if a condition key is an array types
+ *
+ * @param key the condition key type to check
+ * @returns true if the key is an array type, otherwise false
+ */
+export declare function isConditionKeyArray(key: ConditionKeyType): key is ArrayConditionKeyType;
+/**
+ * Get the BaseConditionKeyType from an ArrayConditionKeyType
+ *
+ * @param key the ArrayConditionKeyType to get the base type from
+ * @returns the base type of the array key
+ * @throws if the key is not an array type
+ */
+export declare function getBaseConditionKeyType(key: ArrayConditionKeyType): BaseConditionKeyType;
+//# sourceMappingURL=contextKeyTypes.d.ts.map

package/dist/esm/context_keys/contextKeyTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeyTypes.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeyTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAC9B,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,UAAU,oBAAoB,EAAE,CAAA;AACpE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,qBAAqB,CAAA;AAE3E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,GAAG,IAAI,qBAAqB,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,oBAAoB,CAKxF"}

package/dist/esm/context_keys/contextKeyTypes.js

@@ -0,0 +1,23 @@
+/**
+ * Check if a condition key is an array types
+ *
+ * @param key the condition key type to check
+ * @returns true if the key is an array type, otherwise false
+ */
+export function isConditionKeyArray(key) {
+    return key.startsWith('ArrayOf');
+}
+/**
+ * Get the BaseConditionKeyType from an ArrayConditionKeyType
+ *
+ * @param key the ArrayConditionKeyType to get the base type from
+ * @returns the base type of the array key
+ * @throws if the key is not an array type
+ */
+export function getBaseConditionKeyType(key) {
+    if (!isConditionKeyArray(key)) {
+        throw new Error(`Expected ArrayConditionType, got ${key}`);
+    }
+    return key.slice(7);
+}
+//# sourceMappingURL=contextKeyTypes.js.map

package/dist/esm/context_keys/contextKeyTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeyTypes.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeyTypes.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAqB;IACvD,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAA0B;IAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAyB,CAAA;AAC7C,CAAC"}

package/dist/esm/context_keys/contextKeys.d.ts

@@ -0,0 +1,24 @@
+import { type ConditionKeyType } from './contextKeyTypes.js';
+/**
+ * Check if a context key actually exists
+ *
+ * @param key The context key to check
+ * @returns true if the context key is valid, false otherwise
+ */
+export declare function isActualContextKey(key: string): Promise<boolean>;
+/**
+ * Check the capitalization of a context key and return the correct capitalization
+ *
+ * @param contextKey the condition key to check
+ * @returns if the condition key is an array type
+ */
+export declare function normalizeContextKeyCase(contextKey: string): Promise<string>;
+/**
+ * Get the type of a context key
+ *
+ * @param contextKey - The string condition key to get the type for
+ * @returns The type of the condition key
+ * @throws an error if the condition key is not found
+ */
+export declare function typeForContextKey(contextKey: string): Promise<ConditionKeyType>;
+//# sourceMappingURL=contextKeys.d.ts.map

package/dist/esm/context_keys/contextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AAYD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}

package/dist/esm/context_keys/contextKeys.js

@@ -0,0 +1,117 @@
+import { findConditionKey } from '@actsecurity/iam-data';
+import { getGlobalConditionKeyWithOrWithoutPrefix } from '../global_conditions/globalConditionKeys.js';
+import {} from './contextKeyTypes.js';
+const oidcKeys = new Set([
+    'amr',
+    'aud',
+    'email',
+    'oaud',
+    'sub',
+    'actor',
+    'actor_id',
+    'job_workflow_ref',
+    'repository',
+    'repository_id',
+    'workflow',
+    'ref',
+    'environment',
+    'enterprise_id',
+    'app_id',
+    'user_id',
+    'id',
+    'project_id',
+    'rpst_id',
+    'google/organization_number'
+]);
+const oidcProviderPattern = /^[0-9a-zA-Z\._\-]+$/;
+/**
+ * Check if a context key actually exists
+ *
+ * @param key The context key to check
+ * @returns true if the context key is valid, false otherwise
+ */
+export async function isActualContextKey(key) {
+    if (isOidcConditionKey(key)) {
+        return true;
+    }
+    const dataKey = await findConditionKey(key);
+    return !!dataKey;
+}
+/**
+ * Takes context key and returns the details for it, accounting for any variables in the key
+ *
+ * @param contextKey The context key to get the details for
+ * @returns The details for the context key if it exists. if the key has variables in it it will return the details for the variable key
+ */
+async function serviceContextKeyDetails(contextKey) {
+    return findConditionKey(contextKey);
+}
+/**
+ * Check the capitalization of a context key and return the correct capitalization
+ *
+ * @param contextKey the condition key to check
+ * @returns if the condition key is an array type
+ */
+export async function normalizeContextKeyCase(contextKey) {
+    const serviceKey = await serviceContextKeyDetails(contextKey);
+    if (serviceKey) {
+        return replaceVariableInContextKey(serviceKey.key, contextKey);
+    }
+    const globalConditionKey = getGlobalConditionKeyWithOrWithoutPrefix(contextKey);
+    if (globalConditionKey) {
+        return replaceVariableInContextKey(globalConditionKey.key, contextKey);
+    }
+    if (isOidcConditionKey(contextKey)) {
+        return contextKey;
+    }
+    throw new Error(`Context key ${contextKey} not found`);
+}
+/**
+ * Replaces a variable in a context key with the actual value from a policy
+ *
+ * @param specKey the string value of the condition key spec
+ * @param actualKey the string value of the condition key in the policy
+ * @returns the spec condition key with the variable portion replaced with the actual value
+ */
+function replaceVariableInContextKey(specKey, actualKey) {
+    const slashIndex = specKey.indexOf('/');
+    if (slashIndex === -1) {
+        return specKey;
+    }
+    const prefix = specKey.slice(0, slashIndex);
+    const suffix = actualKey.slice(slashIndex);
+    return prefix + suffix;
+}
+/**
+ * Get the type of a context key
+ *
+ * @param contextKey - The string condition key to get the type for
+ * @returns The type of the condition key
+ * @throws an error if the condition key is not found
+ */
+export async function typeForContextKey(contextKey) {
+    const globalConditionKey = getGlobalConditionKeyWithOrWithoutPrefix(contextKey);
+    if (globalConditionKey) {
+        return globalConditionKey.type;
+    }
+    const keyDetails = await serviceContextKeyDetails(contextKey);
+    if (keyDetails) {
+        return keyDetails.type;
+    }
+    throw new Error(`Condition key ${contextKey} not found`);
+}
+/**
+ * Checks if a string is a valid OIDC condition key
+ *
+ * @param key the key to check
+ * @returns true if the key is a valid OIDC condition key
+ */
+function isOidcConditionKey(key) {
+    const parts = key.split(':');
+    if (parts.length !== 2) {
+        return false;
+    }
+    const [service, action] = parts;
+    return oidcKeys.has(action) && oidcProviderPattern.test(service);
+}
+//# sourceMappingURL=contextKeys.js.map

package/dist/esm/context_keys/contextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,wCAAwC,EAAE,MAAM,6CAA6C,CAAA;AACtG,OAAO,EAAyB,MAAM,sBAAsB,CAAA;AAE5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}

package/dist/esm/context_keys/discoveryContextKeyConstraints.d.ts

@@ -0,0 +1,103 @@
+/** Shared key or pattern field for Discovery context-key constraints. */
+interface DiscoveryContextKeyConstraintKey {
+    /**
+     * Context key name or slash-delimited regular expression pattern.
+     *
+     * Literal names are matched case-insensitively. Regex-style names such as
+     * a ResourceTag-prefix pattern are also matched case-insensitively.
+     */
+    keyName: string;
+}
+/**
+ * Discovery knowledge for a key whose presence and concrete value are both known.
+ */
+interface KnownPresenceKnownValueConstraint {
+    /** Presence/absence in the request context is authoritative. */
+    presenceIsKnown: true;
+    /** The concrete value in the request context is authoritative when the key is present. */
+    valueIsKnown: true;
+}
+/**
+ * Discovery knowledge for a key whose presence is known but concrete value is not.
+ */
+interface KnownPresenceUnknownValueConstraint {
+    /** Presence/absence in the request context is authoritative. */
+    presenceIsKnown: true;
+    /** The concrete value in the request context is not authoritative. */
+    valueIsKnown: false;
+}
+/**
+ * Discovery knowledge for a key whose presence is unknown.
+ *
+ * Value knowledge must also be unknown because a value cannot be authoritative
+ * when the key might not exist.
+ */
+interface UnknownPresenceConstraint {
+    /** Presence/absence in the request context is not authoritative. */
+    presenceIsKnown: false;
+    /** Must be false because value knowledge requires known presence. */
+    valueIsKnown: false;
+}
+/**
+ * Caller-provided Discovery-mode knowledge about a single context key or key pattern.
+ *
+ * These constraints do not add context keys to the request. The request context
+ * still determines whether a key is actually present. A constraint only tells
+ * Discovery mode whether it can trust that presence and/or the concrete value.
+ *
+ * The discriminated union intentionally makes `{ presenceIsKnown: false,
+ * valueIsKnown: true }` unrepresentable in TypeScript.
+ */
+export type DiscoveryContextKeyConstraint = DiscoveryContextKeyConstraintKey & (KnownPresenceKnownValueConstraint | KnownPresenceUnknownValueConstraint | UnknownPresenceConstraint);
+/**
+ * Resolved Discovery-mode knowledge for a specific context key lookup.
+ *
+ * This is the effective result after merging all matching literal, prefix, and
+ * regex constraints. If no constraint matches, both booleans are false and
+ * `explicitlyConfigured` is false, which tells condition evaluation to preserve
+ * the current unconstrained Discovery behavior for that key.
+ *
+ * The discriminated union intentionally makes `{ presenceIsKnown: false,
+ * valueIsKnown: true }` unrepresentable in TypeScript.
+ */
+export type EffectiveDiscoveryContextKeyConstraint = (KnownPresenceKnownValueConstraint | KnownPresenceUnknownValueConstraint | UnknownPresenceConstraint) & {
+    /** Whether at least one caller-provided constraint matched the looked-up key. */
+    explicitlyConfigured: boolean;
+};
+/**
+ * Discovery-only context key knowledge constraints.
+ *
+ * The request context still determines whether a key is present. These constraints
+ * describe whether Discovery mode can trust that presence and/or concrete value.
+ */
+export declare class DiscoveryContextKeyConstraints {
+    private literalConstraints;
+    private prefixConstraintsByService;
+    private regexConstraints;
+    private resolvedCache;
+    /**
+     * Create Discovery context key constraints.
+     *
+     * @param constraints the constraint definitions to index
+     */
+    constructor(constraints?: DiscoveryContextKeyConstraint[]);
+    /**
+     * Get the effective Discovery constraint for a context key.
+     *
+     * @param key the context key to look up
+     * @returns the merged matching constraint, or an unconstrained result
+     */
+    constraintFor(key: string): EffectiveDiscoveryContextKeyConstraint;
+    /**
+     * Adds a caller-provided constraint to the appropriate lookup index.
+     *
+     * Literal keys are stored in a case-insensitive map. Simple prefix-like regex
+     * patterns are stored in prefix buckets, and complex regex patterns fall back
+     * to the regex list.
+     *
+     * @param constraint the caller-provided constraint to index
+     */
+    private addConstraint;
+}
+export {};
+//# sourceMappingURL=discoveryContextKeyConstraints.d.ts.map

package/dist/esm/context_keys/discoveryContextKeyConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoveryContextKeyConstraints.d.ts","sourceRoot":"","sources":["../../../src/context_keys/discoveryContextKeyConstraints.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,UAAU,gCAAgC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,UAAU,iCAAiC;IACzC,gEAAgE;IAChE,eAAe,EAAE,IAAI,CAAA;IAErB,0FAA0F;IAC1F,YAAY,EAAE,IAAI,CAAA;CACnB;AAED;;GAEG;AACH,UAAU,mCAAmC;IAC3C,gEAAgE;IAChE,eAAe,EAAE,IAAI,CAAA;IAErB,sEAAsE;IACtE,YAAY,EAAE,KAAK,CAAA;CACpB;AAED;;;;;GAKG;AACH,UAAU,yBAAyB;IACjC,oEAAoE;IACpE,eAAe,EAAE,KAAK,CAAA;IAEtB,qEAAqE;IACrE,YAAY,EAAE,KAAK,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,6BAA6B,GAAG,gCAAgC,GAC1E,CACI,iCAAiC,GACjC,mCAAmC,GACnC,yBAAyB,CAC5B,CAAA;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sCAAsC,GAAG,CACjD,iCAAiC,GACjC,mCAAmC,GACnC,yBAAyB,CAC5B,GAAG;IACF,iFAAiF;IACjF,oBAAoB,EAAE,OAAO,CAAA;CAC9B,CAAA;AAuCD;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,kBAAkB,CAA2C;IACrE,OAAO,CAAC,0BAA0B,CAA6C;IAC/E,OAAO,CAAC,gBAAgB,CAAwB;IAChD,OAAO,CAAC,aAAa,CAAiE;IAEtF;;;;OAIG;gBACS,WAAW,GAAE,6BAA6B,EAAO;IAgB7D;;;;;OAKG;IACI,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,sCAAsC;IAuCzE;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;CAoBtB"}

package/dist/esm/context_keys/discoveryContextKeyConstraints.js

@@ -0,0 +1,149 @@
+const unconstrained = {
+    presenceIsKnown: false,
+    valueIsKnown: false,
+    explicitlyConfigured: false
+};
+/**
+ * Discovery-only context key knowledge constraints.
+ *
+ * The request context still determines whether a key is present. These constraints
+ * describe whether Discovery mode can trust that presence and/or concrete value.
+ */
+export class DiscoveryContextKeyConstraints {
+    /**
+     * Create Discovery context key constraints.
+     *
+     * @param constraints the constraint definitions to index
+     */
+    constructor(constraints = []) {
+        this.literalConstraints = new Map();
+        this.prefixConstraintsByService = new Map();
+        this.regexConstraints = [];
+        this.resolvedCache = new Map();
+        for (const constraint of constraints) {
+            const runtimeConstraint = constraint;
+            if (!runtimeConstraint.presenceIsKnown && runtimeConstraint.valueIsKnown) {
+                throw new Error(`Invalid discovery context key constraint for ${runtimeConstraint.keyName}: valueIsKnown requires presenceIsKnown`);
+            }
+            this.addConstraint(constraint);
+        }
+    }
+    /**
+     * Get the effective Discovery constraint for a context key.
+     *
+     * @param key the context key to look up
+     * @returns the merged matching constraint, or an unconstrained result
+     */
+    constraintFor(key) {
+        const lowerKey = key.toLowerCase();
+        const cached = this.resolvedCache.get(lowerKey);
+        if (cached) {
+            return cached;
+        }
+        let result = { ...unconstrained };
+        const merge = (constraint) => {
+            result = effectiveConstraint(result.presenceIsKnown || constraint.presenceIsKnown, result.valueIsKnown || constraint.valueIsKnown, true);
+        };
+        const literal = this.literalConstraints.get(lowerKey);
+        if (literal) {
+            merge(literal);
+        }
+        const service = lowerKey.split(':')[0];
+        const prefixConstraints = this.prefixConstraintsByService.get(service) ?? [];
+        for (const constraint of prefixConstraints) {
+            if (lowerKey.startsWith(constraint.prefixLower)) {
+                merge(constraint);
+            }
+        }
+        for (const constraint of this.regexConstraints) {
+            if (constraint.pattern.test(key)) {
+                merge(constraint);
+            }
+        }
+        this.resolvedCache.set(lowerKey, result);
+        return result;
+    }
+    /**
+     * Adds a caller-provided constraint to the appropriate lookup index.
+     *
+     * Literal keys are stored in a case-insensitive map. Simple prefix-like regex
+     * patterns are stored in prefix buckets, and complex regex patterns fall back
+     * to the regex list.
+     *
+     * @param constraint the caller-provided constraint to index
+     */
+    addConstraint(constraint) {
+        const stored = storedConstraint(constraint.presenceIsKnown, constraint.valueIsKnown);
+        if (constraint.keyName.startsWith('/') && constraint.keyName.endsWith('/')) {
+            const patternText = constraint.keyName.slice(1, -1);
+            const prefix = regexPrefix(patternText);
+            if (prefix) {
+                const service = prefix.split(':')[0];
+                const constraints = this.prefixConstraintsByService.get(service) ?? [];
+                constraints.push({ ...stored, prefixLower: prefix });
+                this.prefixConstraintsByService.set(service, constraints);
+            }
+            else {
+                this.regexConstraints.push({ ...stored, pattern: new RegExp(patternText, 'i') });
+            }
+        }
+        else {
+            const key = constraint.keyName.toLowerCase();
+            const existing = this.literalConstraints.get(key);
+            this.literalConstraints.set(key, existing ? mergeStored(existing, stored) : stored);
+        }
+    }
+}
+/**
+ * Merges two stored constraints with true-winning OR semantics.
+ *
+ * @param a the first stored constraint
+ * @param b the second stored constraint
+ * @returns the merged constraint
+ */
+function mergeStored(a, b) {
+    return storedConstraint(a.presenceIsKnown || b.presenceIsKnown, a.valueIsKnown || b.valueIsKnown);
+}
+/**
+ * Builds a stored constraint while preserving the valid-state union.
+ *
+ * @param presenceIsKnown whether presence/absence is authoritative
+ * @param valueIsKnown whether the concrete value is authoritative
+ * @returns a stored constraint in one of the valid knowledge states
+ */
+function storedConstraint(presenceIsKnown, valueIsKnown) {
+    if (valueIsKnown) {
+        return { presenceIsKnown: true, valueIsKnown: true };
+    }
+    return presenceIsKnown
+        ? { presenceIsKnown: true, valueIsKnown: false }
+        : { presenceIsKnown: false, valueIsKnown: false };
+}
+/**
+ * Builds an effective constraint while preserving the valid-state union.
+ *
+ * @param presenceIsKnown whether presence/absence is authoritative
+ * @param valueIsKnown whether the concrete value is authoritative
+ * @param explicitlyConfigured whether any configured constraint matched
+ * @returns an effective constraint in one of the valid knowledge states
+ */
+function effectiveConstraint(presenceIsKnown, valueIsKnown, explicitlyConfigured) {
+    return { ...storedConstraint(presenceIsKnown, valueIsKnown), explicitlyConfigured };
+}
+/**
+ * Extracts a lower-case literal prefix from simple anchored regex patterns.
+ *
+ * Only simple patterns such as `^aws:ResourceTag/.*` are converted. More
+ * complex patterns return undefined and are evaluated with RegExp directly.
+ *
+ * @param patternText the regex source without surrounding slashes
+ * @returns a lower-case prefix if the pattern is reducible to startsWith
+ */
+function regexPrefix(patternText) {
+    const match = patternText.match(/^\^([A-Za-z0-9:_/-]+)(?:\.\*|\.\*\?)?\/?$/);
+    if (!match) {
+        return undefined;
+    }
+    return match[1].toLowerCase();
+}
+//# sourceMappingURL=discoveryContextKeyConstraints.js.map

package/dist/esm/context_keys/discoveryContextKeyConstraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoveryContextKeyConstraints.js","sourceRoot":"","sources":["../../../src/context_keys/discoveryContextKeyConstraints.ts"],"names":[],"mappings":"AAoFA,MAAM,aAAa,GAA2C;IAC5D,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAiCD;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IAMzC;;;;OAIG;IACH,YAAY,cAA+C,EAAE;QAVrD,uBAAkB,GAAkC,IAAI,GAAG,EAAE,CAAA;QAC7D,+BAA0B,GAAoC,IAAI,GAAG,EAAE,CAAA;QACvE,qBAAgB,GAAsB,EAAE,CAAA;QACxC,kBAAa,GAAwD,IAAI,GAAG,EAAE,CAAA;QAQpF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,iBAAiB,GAAG,UAIzB,CAAA;YACD,IAAI,CAAC,iBAAiB,CAAC,eAAe,IAAI,iBAAiB,CAAC,YAAY,EAAE,CAAC;gBACzE,MAAM,IAAI,KAAK,CACb,gDAAgD,iBAAiB,CAAC,OAAO,yCAAyC,CACnH,CAAA;YACH,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,aAAa,CAAC,GAAW;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAA;QACf,CAAC;QAED,IAAI,MAAM,GAA2C,EAAE,GAAG,aAAa,EAAE,CAAA;QACzE,MAAM,KAAK,GAAG,CAAC,UAA4B,EAAE,EAAE;YAC7C,MAAM,GAAG,mBAAmB,CAC1B,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,eAAe,EACpD,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC,YAAY,EAC9C,IAAI,CACL,CAAA;QACH,CAAC,CAAA;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,OAAO,CAAC,CAAA;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QAC5E,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;YAC3C,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,UAAU,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,UAAU,CAAC,CAAA;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACxC,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;;;;;;;OAQG;IACK,aAAa,CAAC,UAAyC;QAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;QAEpF,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;YACvC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpC,MAAM,WAAW,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBACtE,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;gBACpD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YAC3D,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,CAAmB,EAAE,CAAmB;IAC3D,OAAO,gBAAgB,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,CAAA;AACnG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,eAAwB,EAAE,YAAqB;IACvE,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACtD,CAAC;IACD,OAAO,eAAe;QACpB,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;QAChD,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,eAAwB,EACxB,YAAqB,EACrB,oBAA6B;IAE7B,OAAO,EAAE,GAAG,gBAAgB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;AACrF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAC/B,CAAC"}

package/dist/esm/context_keys/findContextKeys.d.ts

@@ -0,0 +1,19 @@
+import { type Policy } from '@actsecurity/iam-policy';
+/**
+ * Find all the context keys in a list of policies
+ *
+ * @param policies - The list of policies to search
+ * @returns The list of valid and invalid context keys found in the policies
+ */
+export declare function findContextKeys(policies: Policy[]): Promise<{
+    validKeys: string[];
+    invalidKeys: string[];
+}>;
+/**
+ * Get the context variables used in a policy
+ *
+ * @param policy - The policy to extract variables from
+ * @returns The list of variables used in the policy
+ */
+export declare function getContextKeysFromPolicy(policy: Policy): string[];
+//# sourceMappingURL=findContextKeys.d.ts.map

package/dist/esm/context_keys/findContextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findContextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/findContextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAIrD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAqBzD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBjE"}

package/dist/esm/context_keys/findContextKeys.js

@@ -0,0 +1,55 @@
+import {} from '@actsecurity/iam-policy';
+import { getVariablesFromString } from '../util.js';
+import { isActualContextKey, normalizeContextKeyCase } from './contextKeys.js';
+/**
+ * Find all the context keys in a list of policies
+ *
+ * @param policies - The list of policies to search
+ * @returns The list of valid and invalid context keys found in the policies
+ */
+export async function findContextKeys(policies) {
+    const rawKeys = new Set();
+    for (const policy of policies) {
+        getContextKeysFromPolicy(policy).forEach((v) => rawKeys.add(v));
+    }
+    const validKeys = new Set();
+    const invalidKeys = new Set();
+    for (const key of rawKeys) {
+        const valid = await isActualContextKey(key);
+        if (valid) {
+            const normalizedKey = await normalizeContextKeyCase(key);
+            validKeys.add(normalizedKey);
+        }
+        else {
+            invalidKeys.add(key);
+        }
+    }
+    return {
+        validKeys: Array.from(validKeys),
+        invalidKeys: Array.from(invalidKeys)
+    };
+}
+/**
+ * Get the context variables used in a policy
+ *
+ * @param policy - The policy to extract variables from
+ * @returns The list of variables used in the policy
+ */
+export function getContextKeysFromPolicy(policy) {
+    const variables = [];
+    for (const statement of policy.statements()) {
+        if (statement.isResourceStatement()) {
+            statement.resources().forEach((r) => {
+                variables.push(...getVariablesFromString(r.value()));
+            });
+            for (const condition of statement.conditions()) {
+                variables.push(condition.conditionKey());
+                condition.conditionValues().forEach((v) => {
+                    variables.push(...getVariablesFromString(v));
+                });
+            }
+        }
+    }
+    return variables;
+}
+//# sourceMappingURL=findContextKeys.js.map

package/dist/esm/context_keys/findContextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findContextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/findContextKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,wBAAwB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAA;YACxD,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC9B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACpC,SAAS,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,SAAS,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC,CAAC,CAAA;YACF,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC/C,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAA;gBACxC,SAAS,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxC,SAAS,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;gBAC9C,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC"}