@actsecurity/iam-simulate 0.1.173

package/dist/cjs/condition/string/StringLike.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StringLike = void 0;
+const util_js_1 = require("../../util.js");
+const conditionUtil_js_1 = require("../conditionUtil.js");
+exports.StringLike = {
+    name: 'StringLike',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = (0, util_js_1.convertIamString)(value, request, { replaceWildcards: true });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = pattern.test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: (0, conditionUtil_js_1.resolvedValue)(value, request)
+            };
+        });
+        const overallMatch = explains.some((explain) => explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: true,
+    isNegative: false
+};
+//# sourceMappingURL=StringLike.js.map

package/dist/cjs/condition/string/StringLike.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringLike.js","sourceRoot":"","sources":["../../../../src/condition/string/StringLike.ts"],"names":[],"mappings":";;;AACA,2CAAgD;AAEhD,0DAAmD;AAEtC,QAAA,UAAU,GAA0B;IAC/C,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACtC,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,IAAA,gCAAa,EAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAChE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,KAAK;CAClB,CAAA"}

package/dist/cjs/condition/string/StringNotEquals.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const StringNotEquals: BaseConditionOperator;
+//# sourceMappingURL=StringNotEquals.d.ts.map

package/dist/cjs/condition/string/StringNotEquals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEquals.d.ts","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEquals.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,eAAe,EAAE,qBA8B7B,CAAA"}

package/dist/cjs/condition/string/StringNotEquals.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StringNotEquals = void 0;
+const util_js_1 = require("../../util.js");
+const conditionUtil_js_1 = require("../conditionUtil.js");
+exports.StringNotEquals = {
+    name: 'StringNotEquals',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = (0, util_js_1.convertIamString)(value, request, { replaceWildcards: false });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = !pattern.test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: (0, conditionUtil_js_1.resolvedValue)(value, request)
+            };
+        });
+        const overallMatch = !explains.some((explain) => !explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: false,
+    isNegative: true
+};
+//# sourceMappingURL=StringNotEquals.js.map

package/dist/cjs/condition/string/StringNotEquals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEquals.js","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEquals.ts"],"names":[],"mappings":";;;AACA,2CAAgD;AAEhD,0DAAmD;AAEtC,QAAA,eAAe,GAA0B;IACpD,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;YACzF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,IAAA,gCAAa,EAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/cjs/condition/string/StringNotEqualsIgnoreCase.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const StringNotEqualsIgnoreCase: BaseConditionOperator;
+//# sourceMappingURL=StringNotEqualsIgnoreCase.d.ts.map

package/dist/cjs/condition/string/StringNotEqualsIgnoreCase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEqualsIgnoreCase.d.ts","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEqualsIgnoreCase.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,yBAAyB,EAAE,qBA8BvC,CAAA"}

package/dist/cjs/condition/string/StringNotEqualsIgnoreCase.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StringNotEqualsIgnoreCase = void 0;
+const util_js_1 = require("../../util.js");
+const conditionUtil_js_1 = require("../conditionUtil.js");
+exports.StringNotEqualsIgnoreCase = {
+    name: 'StringNotEqualsIgnoreCase',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = (0, util_js_1.convertIamString)(value, request, { replaceWildcards: false });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = !new RegExp(pattern, 'i').test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: (0, conditionUtil_js_1.resolvedValue)(value, request)
+            };
+        });
+        const overallMatch = !explains.some((explain) => !explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: false,
+    isNegative: true
+};
+//# sourceMappingURL=StringNotEqualsIgnoreCase.js.map

package/dist/cjs/condition/string/StringNotEqualsIgnoreCase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotEqualsIgnoreCase.js","sourceRoot":"","sources":["../../../../src/condition/string/StringNotEqualsIgnoreCase.ts"],"names":[],"mappings":";;;AACA,2CAAgD;AAEhD,0DAAmD;AAEtC,QAAA,yBAAyB,GAA0B;IAC9D,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;YACzF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACxD,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,IAAA,gCAAa,EAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/cjs/condition/string/StringNotLike.d.ts

@@ -0,0 +1,3 @@
+import { type BaseConditionOperator } from '../BaseConditionOperator.js';
+export declare const StringNotLike: BaseConditionOperator;
+//# sourceMappingURL=StringNotLike.d.ts.map

package/dist/cjs/condition/string/StringNotLike.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotLike.d.ts","sourceRoot":"","sources":["../../../../src/condition/string/StringNotLike.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAGxE,eAAO,MAAM,aAAa,EAAE,qBA8B3B,CAAA"}

package/dist/cjs/condition/string/StringNotLike.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StringNotLike = void 0;
+const util_js_1 = require("../../util.js");
+const conditionUtil_js_1 = require("../conditionUtil.js");
+exports.StringNotLike = {
+    name: 'StringNotLike',
+    matches: (request, keyValue, policyValues) => {
+        const explains = policyValues.map((value) => {
+            const { pattern, errors } = (0, util_js_1.convertIamString)(value, request, { replaceWildcards: true });
+            if (errors && errors.length > 0) {
+                return {
+                    value,
+                    matches: false,
+                    errors
+                };
+            }
+            const matches = !pattern.test(keyValue);
+            return {
+                value,
+                matches,
+                resolvedValue: (0, conditionUtil_js_1.resolvedValue)(value, request)
+            };
+        });
+        const overallMatch = !explains.some((explain) => !explain.matches);
+        return {
+            matches: overallMatch,
+            explains
+        };
+    },
+    allowsVariables: true,
+    allowsWildcards: true,
+    isNegative: true
+};
+//# sourceMappingURL=StringNotLike.js.map

package/dist/cjs/condition/string/StringNotLike.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StringNotLike.js","sourceRoot":"","sources":["../../../../src/condition/string/StringNotLike.ts"],"names":[],"mappings":";;;AACA,2CAAgD;AAEhD,0DAAmD;AAEtC,QAAA,aAAa,GAA0B;IAClD,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAA4B,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAA,0BAAgB,EAAC,KAAK,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;YACxF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM;iBACP,CAAA;YACH,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACvC,OAAO;gBACL,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,IAAA,gCAAa,EAAC,KAAK,EAAE,OAAO,CAAC;aAC7C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAClE,OAAO;YACL,OAAO,EAAE,YAAY;YACrB,QAAQ;SACT,CAAA;IACH,CAAC;IACD,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,IAAI;CACjB,CAAA"}

package/dist/cjs/context_keys/contextKeyTypes.d.ts

@@ -0,0 +1,19 @@
+export type BaseConditionKeyType = 'String' | 'ARN' | 'Numeric' | 'Bool' | 'Date' | 'IPAddress' | 'Binary';
+export type ArrayConditionKeyType = `ArrayOf${BaseConditionKeyType}`;
+export type ConditionKeyType = BaseConditionKeyType | ArrayConditionKeyType;
+/**
+ * Check if a condition key is an array types
+ *
+ * @param key the condition key type to check
+ * @returns true if the key is an array type, otherwise false
+ */
+export declare function isConditionKeyArray(key: ConditionKeyType): key is ArrayConditionKeyType;
+/**
+ * Get the BaseConditionKeyType from an ArrayConditionKeyType
+ *
+ * @param key the ArrayConditionKeyType to get the base type from
+ * @returns the base type of the array key
+ * @throws if the key is not an array type
+ */
+export declare function getBaseConditionKeyType(key: ArrayConditionKeyType): BaseConditionKeyType;
+//# sourceMappingURL=contextKeyTypes.d.ts.map

package/dist/cjs/context_keys/contextKeyTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeyTypes.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeyTypes.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAC9B,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAA;AACzE,MAAM,MAAM,qBAAqB,GAAG,UAAU,oBAAoB,EAAE,CAAA;AACpE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,qBAAqB,CAAA;AAE3E;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,gBAAgB,GAAG,GAAG,IAAI,qBAAqB,CAEvF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,oBAAoB,CAKxF"}

package/dist/cjs/context_keys/contextKeyTypes.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isConditionKeyArray = isConditionKeyArray;
+exports.getBaseConditionKeyType = getBaseConditionKeyType;
+/**
+ * Check if a condition key is an array types
+ *
+ * @param key the condition key type to check
+ * @returns true if the key is an array type, otherwise false
+ */
+function isConditionKeyArray(key) {
+    return key.startsWith('ArrayOf');
+}
+/**
+ * Get the BaseConditionKeyType from an ArrayConditionKeyType
+ *
+ * @param key the ArrayConditionKeyType to get the base type from
+ * @returns the base type of the array key
+ * @throws if the key is not an array type
+ */
+function getBaseConditionKeyType(key) {
+    if (!isConditionKeyArray(key)) {
+        throw new Error(`Expected ArrayConditionType, got ${key}`);
+    }
+    return key.slice(7);
+}
+//# sourceMappingURL=contextKeyTypes.js.map

package/dist/cjs/context_keys/contextKeyTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeyTypes.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeyTypes.ts"],"names":[],"mappings":";;AAWA,kDAEC;AASD,0DAKC;AAtBD;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,GAAqB;IACvD,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,GAA0B;IAChE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAyB,CAAA;AAC7C,CAAC"}

package/dist/cjs/context_keys/contextKeys.d.ts

@@ -0,0 +1,24 @@
+import { type ConditionKeyType } from './contextKeyTypes.js';
+/**
+ * Check if a context key actually exists
+ *
+ * @param key The context key to check
+ * @returns true if the context key is valid, false otherwise
+ */
+export declare function isActualContextKey(key: string): Promise<boolean>;
+/**
+ * Check the capitalization of a context key and return the correct capitalization
+ *
+ * @param contextKey the condition key to check
+ * @returns if the condition key is an array type
+ */
+export declare function normalizeContextKeyCase(contextKey: string): Promise<string>;
+/**
+ * Get the type of a context key
+ *
+ * @param contextKey - The string condition key to get the type for
+ * @returns The type of the condition key
+ * @throws an error if the condition key is not found
+ */
+export declare function typeForContextKey(contextKey: string): Promise<ConditionKeyType>;
+//# sourceMappingURL=contextKeys.d.ts.map

package/dist/cjs/context_keys/contextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.d.ts","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AA0B5D;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtE;AAYD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBjF;AAmBD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAYrF"}

package/dist/cjs/context_keys/contextKeys.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isActualContextKey = isActualContextKey;
+exports.normalizeContextKeyCase = normalizeContextKeyCase;
+exports.typeForContextKey = typeForContextKey;
+const iam_data_1 = require("@actsecurity/iam-data");
+const globalConditionKeys_js_1 = require("../global_conditions/globalConditionKeys.js");
+const oidcKeys = new Set([
+    'amr',
+    'aud',
+    'email',
+    'oaud',
+    'sub',
+    'actor',
+    'actor_id',
+    'job_workflow_ref',
+    'repository',
+    'repository_id',
+    'workflow',
+    'ref',
+    'environment',
+    'enterprise_id',
+    'app_id',
+    'user_id',
+    'id',
+    'project_id',
+    'rpst_id',
+    'google/organization_number'
+]);
+const oidcProviderPattern = /^[0-9a-zA-Z\._\-]+$/;
+/**
+ * Check if a context key actually exists
+ *
+ * @param key The context key to check
+ * @returns true if the context key is valid, false otherwise
+ */
+async function isActualContextKey(key) {
+    if (isOidcConditionKey(key)) {
+        return true;
+    }
+    const dataKey = await (0, iam_data_1.findConditionKey)(key);
+    return !!dataKey;
+}
+/**
+ * Takes context key and returns the details for it, accounting for any variables in the key
+ *
+ * @param contextKey The context key to get the details for
+ * @returns The details for the context key if it exists. if the key has variables in it it will return the details for the variable key
+ */
+async function serviceContextKeyDetails(contextKey) {
+    return (0, iam_data_1.findConditionKey)(contextKey);
+}
+/**
+ * Check the capitalization of a context key and return the correct capitalization
+ *
+ * @param contextKey the condition key to check
+ * @returns if the condition key is an array type
+ */
+async function normalizeContextKeyCase(contextKey) {
+    const serviceKey = await serviceContextKeyDetails(contextKey);
+    if (serviceKey) {
+        return replaceVariableInContextKey(serviceKey.key, contextKey);
+    }
+    const globalConditionKey = (0, globalConditionKeys_js_1.getGlobalConditionKeyWithOrWithoutPrefix)(contextKey);
+    if (globalConditionKey) {
+        return replaceVariableInContextKey(globalConditionKey.key, contextKey);
+    }
+    if (isOidcConditionKey(contextKey)) {
+        return contextKey;
+    }
+    throw new Error(`Context key ${contextKey} not found`);
+}
+/**
+ * Replaces a variable in a context key with the actual value from a policy
+ *
+ * @param specKey the string value of the condition key spec
+ * @param actualKey the string value of the condition key in the policy
+ * @returns the spec condition key with the variable portion replaced with the actual value
+ */
+function replaceVariableInContextKey(specKey, actualKey) {
+    const slashIndex = specKey.indexOf('/');
+    if (slashIndex === -1) {
+        return specKey;
+    }
+    const prefix = specKey.slice(0, slashIndex);
+    const suffix = actualKey.slice(slashIndex);
+    return prefix + suffix;
+}
+/**
+ * Get the type of a context key
+ *
+ * @param contextKey - The string condition key to get the type for
+ * @returns The type of the condition key
+ * @throws an error if the condition key is not found
+ */
+async function typeForContextKey(contextKey) {
+    const globalConditionKey = (0, globalConditionKeys_js_1.getGlobalConditionKeyWithOrWithoutPrefix)(contextKey);
+    if (globalConditionKey) {
+        return globalConditionKey.type;
+    }
+    const keyDetails = await serviceContextKeyDetails(contextKey);
+    if (keyDetails) {
+        return keyDetails.type;
+    }
+    throw new Error(`Condition key ${contextKey} not found`);
+}
+/**
+ * Checks if a string is a valid OIDC condition key
+ *
+ * @param key the key to check
+ * @returns true if the key is a valid OIDC condition key
+ */
+function isOidcConditionKey(key) {
+    const parts = key.split(':');
+    if (parts.length !== 2) {
+        return false;
+    }
+    const [service, action] = parts;
+    return oidcKeys.has(action) && oidcProviderPattern.test(service);
+}
+//# sourceMappingURL=contextKeys.js.map

package/dist/cjs/context_keys/contextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextKeys.js","sourceRoot":"","sources":["../../../src/context_keys/contextKeys.ts"],"names":[],"mappings":";;AAkCA,gDAOC;AAkBD,0DAgBC;AA0BD,8CAYC;AAjHD,oDAA2E;AAC3E,wFAAsG;AAGtG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,kBAAkB;IAClB,YAAY;IACZ,eAAe;IACf,UAAU;IACV,KAAK;IACL,aAAa;IACb,eAAe;IACf,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,SAAS;IACT,4BAA4B;CAC7B,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,qBAAqB,CAAA;AAEjD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAgB,EAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IACxD,OAAO,IAAA,2BAAgB,EAAC,UAAU,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAA2B,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAChE,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,YAAY,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAe,EAAE,SAAiB;IACrE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,kBAAkB,GAAG,IAAA,iEAAwC,EAAC,UAAU,CAAC,CAAA;IAC/E,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,kBAAkB,CAAC,IAAwB,CAAA;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC7D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,IAAwB,CAAA;IAC5C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,YAAY,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAC/B,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAClE,CAAC"}

package/dist/cjs/context_keys/discoveryContextKeyConstraints.d.ts

@@ -0,0 +1,103 @@
+/** Shared key or pattern field for Discovery context-key constraints. */
+interface DiscoveryContextKeyConstraintKey {
+    /**
+     * Context key name or slash-delimited regular expression pattern.
+     *
+     * Literal names are matched case-insensitively. Regex-style names such as
+     * a ResourceTag-prefix pattern are also matched case-insensitively.
+     */
+    keyName: string;
+}
+/**
+ * Discovery knowledge for a key whose presence and concrete value are both known.
+ */
+interface KnownPresenceKnownValueConstraint {
+    /** Presence/absence in the request context is authoritative. */
+    presenceIsKnown: true;
+    /** The concrete value in the request context is authoritative when the key is present. */
+    valueIsKnown: true;
+}
+/**
+ * Discovery knowledge for a key whose presence is known but concrete value is not.
+ */
+interface KnownPresenceUnknownValueConstraint {
+    /** Presence/absence in the request context is authoritative. */
+    presenceIsKnown: true;
+    /** The concrete value in the request context is not authoritative. */
+    valueIsKnown: false;
+}
+/**
+ * Discovery knowledge for a key whose presence is unknown.
+ *
+ * Value knowledge must also be unknown because a value cannot be authoritative
+ * when the key might not exist.
+ */
+interface UnknownPresenceConstraint {
+    /** Presence/absence in the request context is not authoritative. */
+    presenceIsKnown: false;
+    /** Must be false because value knowledge requires known presence. */
+    valueIsKnown: false;
+}
+/**
+ * Caller-provided Discovery-mode knowledge about a single context key or key pattern.
+ *
+ * These constraints do not add context keys to the request. The request context
+ * still determines whether a key is actually present. A constraint only tells
+ * Discovery mode whether it can trust that presence and/or the concrete value.
+ *
+ * The discriminated union intentionally makes `{ presenceIsKnown: false,
+ * valueIsKnown: true }` unrepresentable in TypeScript.
+ */
+export type DiscoveryContextKeyConstraint = DiscoveryContextKeyConstraintKey & (KnownPresenceKnownValueConstraint | KnownPresenceUnknownValueConstraint | UnknownPresenceConstraint);
+/**
+ * Resolved Discovery-mode knowledge for a specific context key lookup.
+ *
+ * This is the effective result after merging all matching literal, prefix, and
+ * regex constraints. If no constraint matches, both booleans are false and
+ * `explicitlyConfigured` is false, which tells condition evaluation to preserve
+ * the current unconstrained Discovery behavior for that key.
+ *
+ * The discriminated union intentionally makes `{ presenceIsKnown: false,
+ * valueIsKnown: true }` unrepresentable in TypeScript.
+ */
+export type EffectiveDiscoveryContextKeyConstraint = (KnownPresenceKnownValueConstraint | KnownPresenceUnknownValueConstraint | UnknownPresenceConstraint) & {
+    /** Whether at least one caller-provided constraint matched the looked-up key. */
+    explicitlyConfigured: boolean;
+};
+/**
+ * Discovery-only context key knowledge constraints.
+ *
+ * The request context still determines whether a key is present. These constraints
+ * describe whether Discovery mode can trust that presence and/or concrete value.
+ */
+export declare class DiscoveryContextKeyConstraints {
+    private literalConstraints;
+    private prefixConstraintsByService;
+    private regexConstraints;
+    private resolvedCache;
+    /**
+     * Create Discovery context key constraints.
+     *
+     * @param constraints the constraint definitions to index
+     */
+    constructor(constraints?: DiscoveryContextKeyConstraint[]);
+    /**
+     * Get the effective Discovery constraint for a context key.
+     *
+     * @param key the context key to look up
+     * @returns the merged matching constraint, or an unconstrained result
+     */
+    constraintFor(key: string): EffectiveDiscoveryContextKeyConstraint;
+    /**
+     * Adds a caller-provided constraint to the appropriate lookup index.
+     *
+     * Literal keys are stored in a case-insensitive map. Simple prefix-like regex
+     * patterns are stored in prefix buckets, and complex regex patterns fall back
+     * to the regex list.
+     *
+     * @param constraint the caller-provided constraint to index
+     */
+    private addConstraint;
+}
+export {};
+//# sourceMappingURL=discoveryContextKeyConstraints.d.ts.map

package/dist/cjs/context_keys/discoveryContextKeyConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discoveryContextKeyConstraints.d.ts","sourceRoot":"","sources":["../../../src/context_keys/discoveryContextKeyConstraints.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,UAAU,gCAAgC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,UAAU,iCAAiC;IACzC,gEAAgE;IAChE,eAAe,EAAE,IAAI,CAAA;IAErB,0FAA0F;IAC1F,YAAY,EAAE,IAAI,CAAA;CACnB;AAED;;GAEG;AACH,UAAU,mCAAmC;IAC3C,gEAAgE;IAChE,eAAe,EAAE,IAAI,CAAA;IAErB,sEAAsE;IACtE,YAAY,EAAE,KAAK,CAAA;CACpB;AAED;;;;;GAKG;AACH,UAAU,yBAAyB;IACjC,oEAAoE;IACpE,eAAe,EAAE,KAAK,CAAA;IAEtB,qEAAqE;IACrE,YAAY,EAAE,KAAK,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,6BAA6B,GAAG,gCAAgC,GAC1E,CACI,iCAAiC,GACjC,mCAAmC,GACnC,yBAAyB,CAC5B,CAAA;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sCAAsC,GAAG,CACjD,iCAAiC,GACjC,mCAAmC,GACnC,yBAAyB,CAC5B,GAAG;IACF,iFAAiF;IACjF,oBAAoB,EAAE,OAAO,CAAA;CAC9B,CAAA;AAuCD;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,kBAAkB,CAA2C;IACrE,OAAO,CAAC,0BAA0B,CAA6C;IAC/E,OAAO,CAAC,gBAAgB,CAAwB;IAChD,OAAO,CAAC,aAAa,CAAiE;IAEtF;;;;OAIG;gBACS,WAAW,GAAE,6BAA6B,EAAO;IAgB7D;;;;;OAKG;IACI,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,sCAAsC;IAuCzE;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;CAoBtB"}