@kensio/yulin 1.21.12 → 1.21.14

package/dist/service/dynamodb/expression/projection/sim-dynamodb-projection-expression.js

@@ -19,12 +19,12 @@ export function readSimDynamoDbProjection(request) {
     const expression = request.ProjectionExpression;
     if (expression === undefined) {
         SimDynamoDbExpressionParameters.assertNoneWithout(request);
-        return undefined;
+        return { projection: undefined, attributes: [] };
     }
     const parameters = new SimDynamoDbExpressionParameters(request);
     const projection = parseSimDynamoDbProjection(expression, parameters);
     parameters.assertAllUsed();
-    return projection;
+    return { projection, attributes: parameters.attributes.topLevel };
 }
 /**
  * Read one ProjectionExpression against placeholders that have already been
@@ -35,16 +35,16 @@ export function readSimDynamoDbProjection(request) {
  * placeholders are checked once every expression has been read.
  */
 export function parseSimDynamoDbProjection(expression, parameters) {
-    const paths = projectedPaths(SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression names no attributes, and an expression cannot be empty"), parameters.names);
+    const paths = projectedPaths(SimDynamoDbExpressionTokens.of(expressionName, expression, "the expression names no attributes, and an expression cannot be empty"), parameters.attributes);
     return new SimDynamoDbProjection({ expressionName, paths });
 }
 /**
  * Read the comma-separated document paths a ProjectionExpression names.
  */
-function projectedPaths(tokens, names) {
+function projectedPaths(tokens, attributes) {
     const paths = [];
     do {
-        paths.push(new SimDynamoDbDocumentPathParser({ tokens, names }).parse());
+        paths.push(new SimDynamoDbDocumentPathParser({ tokens, attributes }).parse());
     } while (tokens.takeSymbol(","));
     assertReadToEnd(tokens);
     return paths;

package/dist/service/dynamodb/expression/sim-dynamodb-document-path-parser.d.ts

@@ -1,9 +1,9 @@
 import { SimDynamoDbDocumentPath } from "./sim-dynamodb-document-path.js";
-import type { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
+import type { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionTokens } from "./sim-dynamodb-expression-tokens.js";
 interface SimDynamoDbDocumentPathParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
 }
 /**
  * Reads one document path out of an expression.
@@ -15,7 +15,7 @@ interface SimDynamoDbDocumentPathParserProperties {
  */
 export declare class SimDynamoDbDocumentPathParser {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly segments;
     constructor(properties: SimDynamoDbDocumentPathParserProperties);
     /**

package/dist/service/dynamodb/expression/sim-dynamodb-document-path-parser.js

@@ -14,17 +14,21 @@ const greatestDepth = 32;
  */
 export class SimDynamoDbDocumentPathParser {
     tokens;
-    names;
+    attributes;
     segments = [];
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
     }
     /**
      * Read a path, from its first attribute to the last thing it dereferences.
      */
     parse() {
-        this.segments.push(this.attribute());
+        const first = this.attribute();
+        // The path starts here, so this is the top-level attribute it reaches.
+        // Whatever it dereferences afterwards is inside this one.
+        this.attributes.reach(first.name);
+        this.segments.push(first);
         while (this.continues()) {
             this.assertWithinDepth();
         }
@@ -54,7 +58,7 @@ export class SimDynamoDbDocumentPathParser {
             return { kind: "attribute", name: token.text };
         }
         if (token.kind === "namePlaceholder") {
-            return { kind: "attribute", name: this.names.required(token.text) };
+            return { kind: "attribute", name: this.attributes.required(token.text) };
         }
         throw this.tokens.error(`syntax error; an attribute name was expected${this.after()}, but ` +
             `'${token.text}' was given`);

package/dist/service/dynamodb/expression/sim-dynamodb-expression-attributes.d.ts

@@ -0,0 +1,33 @@
+import type { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
+/**
+ * The attribute names one request's expressions reach.
+ *
+ * Every expression kind names attributes the same way, either outright or
+ * behind a `#` placeholder, and every one of them reads those names through
+ * here. Noting the names as they are read is what lets a request say which
+ * attributes it names, which is what `dynamodb:Attributes` asks about.
+ *
+ * Only the attribute a document path starts at is noted. AWS counts a
+ * top-level attribute as reached where the request names it or anything nested
+ * inside it, so `Address.City` reaches `Address`.
+ */
+export declare class SimDynamoDbExpressionAttributes {
+    private readonly placeholders;
+    private readonly reached;
+    constructor(placeholders: SimDynamoDbExpressionPlaceholders<string>);
+    /**
+     * What a placeholder stands for, refusing one the request never defined.
+     *
+     * Resolving a placeholder says nothing about where in a path it sits, so
+     * nothing is noted here.
+     */
+    required(placeholder: string): string;
+    /**
+     * Note a top-level attribute an expression named.
+     */
+    reach(name: string): void;
+    /**
+     * The top-level attributes every expression of the request named.
+     */
+    get topLevel(): readonly string[];
+}

package/dist/service/dynamodb/expression/sim-dynamodb-expression-attributes.js

@@ -0,0 +1,40 @@
+/**
+ * The attribute names one request's expressions reach.
+ *
+ * Every expression kind names attributes the same way, either outright or
+ * behind a `#` placeholder, and every one of them reads those names through
+ * here. Noting the names as they are read is what lets a request say which
+ * attributes it names, which is what `dynamodb:Attributes` asks about.
+ *
+ * Only the attribute a document path starts at is noted. AWS counts a
+ * top-level attribute as reached where the request names it or anything nested
+ * inside it, so `Address.City` reaches `Address`.
+ */
+export class SimDynamoDbExpressionAttributes {
+    placeholders;
+    reached = new Set();
+    constructor(placeholders) {
+        this.placeholders = placeholders;
+    }
+    /**
+     * What a placeholder stands for, refusing one the request never defined.
+     *
+     * Resolving a placeholder says nothing about where in a path it sits, so
+     * nothing is noted here.
+     */
+    required(placeholder) {
+        return this.placeholders.required(placeholder);
+    }
+    /**
+     * Note a top-level attribute an expression named.
+     */
+    reach(name) {
+        this.reached.add(name);
+    }
+    /**
+     * The top-level attributes every expression of the request named.
+     */
+    get topLevel() {
+        return [...this.reached];
+    }
+}

package/dist/service/dynamodb/expression/sim-dynamodb-expression-parameters.d.ts

@@ -1,5 +1,6 @@
 import type { SimDynamoDbAttributeValue } from "../command/item/item.types.js";
 import type { SimDynamoDbValue } from "../item/sim-dynamodb-value.js";
+import { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
 /**
  * The two placeholder parameters a request can carry for its expressions.
@@ -19,6 +20,11 @@ export interface SimDynamoDbExpressionParameterInput {
 export declare class SimDynamoDbExpressionParameters {
     readonly names: SimDynamoDbExpressionPlaceholders<string>;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
+    /**
+     * The attribute names the request's expressions reach, gathered as they are
+     * read. Authorization asks for these as `dynamodb:Attributes`.
+     */
+    readonly attributes: SimDynamoDbExpressionAttributes;
     constructor(input: SimDynamoDbExpressionParameterInput);
     /**
      * Refuse placeholders defined for an expression the request does not carry.

package/dist/service/dynamodb/expression/sim-dynamodb-expression-parameters.js

@@ -1,5 +1,6 @@
 import { SimDynamoDbValidationException } from "../error/dynamodb.error.js";
 import { readSimDynamoDbValue } from "../item/sim-dynamodb-value-reader.js";
+import { SimDynamoDbExpressionAttributes } from "./sim-dynamodb-expression-attributes.js";
 import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-placeholders.js";
 /**
  * The placeholders one request defines for its expressions.
@@ -12,12 +13,18 @@ import { SimDynamoDbExpressionPlaceholders } from "./sim-dynamodb-expression-pla
 export class SimDynamoDbExpressionParameters {
     names;
     values;
+    /**
+     * The attribute names the request's expressions reach, gathered as they are
+     * read. Authorization asks for these as `dynamodb:Attributes`.
+     */
+    attributes;
     constructor(input) {
         this.names = new SimDynamoDbExpressionPlaceholders({
             parameterName: "ExpressionAttributeNames",
             marker: "#",
             entries: input.ExpressionAttributeNames,
         });
+        this.attributes = new SimDynamoDbExpressionAttributes(this.names);
         this.values = new SimDynamoDbExpressionPlaceholders({
             parameterName: "ExpressionAttributeValues",
             marker: ":",

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-clause.d.ts

@@ -1,9 +1,9 @@
-import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { SimDynamoDbUpdateTarget } from "./sim-dynamodb-update-target.js";
 interface SimDynamoDbUpdateClausesProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
 }
 /**
  * The clauses of an update expression, and the paths their actions write to.
@@ -14,7 +14,7 @@ interface SimDynamoDbUpdateClausesProperties {
  */
 export declare class SimDynamoDbUpdateClauses {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly read;
     constructor(properties: SimDynamoDbUpdateClausesProperties);
     /**

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-clause.js

@@ -19,11 +19,11 @@ const clauseWords = new Set([
  */
 export class SimDynamoDbUpdateClauses {
     tokens;
-    names;
+    attributes;
     read = new Set();
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
     }
     /**
      * Read the keyword the next clause starts with, refusing one already used.
@@ -47,7 +47,7 @@ export class SimDynamoDbUpdateClauses {
     target() {
         return new SimDynamoDbUpdateTarget(new SimDynamoDbDocumentPathParser({
             tokens: this.tokens,
-            names: this.names,
+            attributes: this.attributes,
         }).parse());
     }
     /**

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-expression.js

@@ -13,7 +13,7 @@ import { SimDynamoDbUpdateParser } from "./sim-dynamodb-update-parser.js";
 export function parseSimDynamoDbUpdate(expression, parameters) {
     return new SimDynamoDbUpdateParser({
         tokens: SimDynamoDbExpressionTokens.of(updateExpressionName, expression, "the expression says nothing, and an expression cannot be empty"),
-        names: parameters.names,
+        attributes: parameters.attributes,
         values: parameters.values,
     }).parse();
 }

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-operand-parser.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { type SimDynamoDbUpdateOperand, SimDynamoDbUpdatePathOperand, SimDynamoDbUpdateValueOperand } from "./sim-dynamodb-update-operand.js";
 interface SimDynamoDbUpdateOperandParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**
@@ -20,7 +21,7 @@ interface SimDynamoDbUpdateOperandParserProperties {
  */
 export declare class SimDynamoDbUpdateOperandParser {
     private readonly tokens;
-    private readonly names;
+    private readonly attributes;
     private readonly values;
     private readonly functions;
     constructor(properties: SimDynamoDbUpdateOperandParserProperties);

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-operand-parser.js

@@ -20,12 +20,12 @@ const operators = new Set(["+", "-"]);
  */
 export class SimDynamoDbUpdateOperandParser {
     tokens;
-    names;
+    attributes;
     values;
     functions;
     constructor(properties) {
         this.tokens = properties.tokens;
-        this.names = properties.names;
+        this.attributes = properties.attributes;
         this.values = properties.values;
         this.functions = new SimDynamoDbUpdateFunctionParser({
             tokens: properties.tokens,
@@ -80,7 +80,7 @@ export class SimDynamoDbUpdateOperandParser {
     path() {
         return new SimDynamoDbUpdatePathOperand(new SimDynamoDbDocumentPathParser({
             tokens: this.tokens,
-            names: this.names,
+            attributes: this.attributes,
         }).parse());
     }
     /**

package/dist/service/dynamodb/expression/update/sim-dynamodb-update-parser.d.ts

@@ -1,10 +1,11 @@
 import type { SimDynamoDbValue } from "../../item/sim-dynamodb-value.js";
+import type { SimDynamoDbExpressionAttributes } from "../sim-dynamodb-expression-attributes.js";
 import type { SimDynamoDbExpressionPlaceholders } from "../sim-dynamodb-expression-placeholders.js";
 import type { SimDynamoDbExpressionTokens } from "../sim-dynamodb-expression-tokens.js";
 import { SimDynamoDbUpdate } from "./sim-dynamodb-update.js";
 interface SimDynamoDbUpdateParserProperties {
     readonly tokens: SimDynamoDbExpressionTokens;
-    readonly names: SimDynamoDbExpressionPlaceholders<string>;
+    readonly attributes: SimDynamoDbExpressionAttributes;
     readonly values: SimDynamoDbExpressionPlaceholders<SimDynamoDbValue>;
 }
 /**

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.d.ts

@@ -11,8 +11,11 @@ import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
  */
 export declare class SimIamNegatedForAllValuesStringOperator implements SimIamConditionOperator {
     private readonly comparison;
-    readonly matchesAbsentKey = true;
     constructor(comparison: SimIamStringComparison);
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Check whether every request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-all-values-string-operator.js

@@ -9,10 +9,15 @@ import { simIamStringValues } from "../string/sim-iam-string-values.js";
  */
 export class SimIamNegatedForAllValuesStringOperator {
     comparison;
-    matchesAbsentKey = true;
     constructor(comparison) {
         this.comparison = comparison;
     }
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return true;
+    }
     /**
      * Check whether every request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.d.ts

@@ -12,8 +12,11 @@ import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
  */
 export declare class SimIamNegatedForAnyValueStringOperator implements SimIamConditionOperator {
     private readonly comparison;
-    readonly matchesAbsentKey = false;
     constructor(comparison: SimIamStringComparison);
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Check whether any request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-for-any-value-string-operator.js

@@ -10,10 +10,15 @@ import { simIamStringValues } from "../string/sim-iam-string-values.js";
  */
 export class SimIamNegatedForAnyValueStringOperator {
     comparison;
-    matchesAbsentKey = false;
     constructor(comparison) {
         this.comparison = comparison;
     }
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return false;
+    }
     /**
      * Check whether any request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.d.ts

@@ -11,8 +11,11 @@ import type { SimIamStringComparison } from "../sim-iam-string-comparison.js";
  */
 export declare class SimIamNegatedScalarStringOperator implements SimIamConditionOperator {
     private readonly comparison;
-    readonly matchesAbsentKey = true;
     constructor(comparison: SimIamStringComparison);
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Check whether a request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/negated/sim-iam-negated-scalar-string-operator.js

@@ -9,10 +9,15 @@ import { simIamStringValues } from "../string/sim-iam-string-values.js";
  */
 export class SimIamNegatedScalarStringOperator {
     comparison;
-    matchesAbsentKey = true;
     constructor(comparison) {
         this.comparison = comparison;
     }
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return true;
+    }
     /**
      * Check whether a request value differs from every policy value.
      */

package/dist/service/iam/authorize/match/condition/null/sim-iam-null.d.ts

@@ -0,0 +1,23 @@
+import type { SimIamConditionValue } from "../../../../policy/sim-iam-policy.js";
+import type { SimIamConditionOperator } from "../sim-iam-condition-operator.js";
+/**
+ * IAM `Null` condition operator.
+ *
+ * `Null` checks whether the request carries a value for a context key, rather
+ * than comparing one. `"true"` matches where the key is absent and `"false"`
+ * where it is present. AWS names it and the `...IfExists` suffix as the two
+ * exceptions to the rule that an absent key fails a condition.
+ *
+ * It is what guards a `ForAllValues` `Allow`, which matches an absent key on
+ * its own. See `SimIamForAllValuesStringConditionOperator`.
+ */
+export declare class SimIamNull implements SimIamConditionOperator {
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(expected: SimIamConditionValue): boolean;
+    /**
+     * Answer for a request carrying a value for the key.
+     */
+    matches(actual: SimIamConditionValue, expected: SimIamConditionValue): boolean;
+}

package/dist/service/iam/authorize/match/condition/null/sim-iam-null.js

@@ -0,0 +1,59 @@
+/**
+ * Read the policy value of a `Null` condition.
+ *
+ * AWS documents `"true"` and `"false"` as strings, which is the form a policy
+ * document and the CDK both write. The condition value type also admits a JSON
+ * boolean, and a policy written that way means the same thing. Anything else
+ * has no meaning here and leaves the condition matching nothing.
+ */
+function expectsAbsentKey(expected) {
+    if (typeof expected === "boolean") {
+        return expected;
+    }
+    if (expected === "true") {
+        return true;
+    }
+    return expected === "false" ? false : undefined;
+}
+/**
+ * Whether a request value counts as present for a `Null` check.
+ *
+ * AWS asks whether the key exists and its value is not null. A multi-valued key
+ * carrying no values resolves to a null dataset, and an empty string is the
+ * example AWS gives of one.
+ */
+function isPresent(actual) {
+    if (Array.isArray(actual)) {
+        return actual.length > 0;
+    }
+    return actual !== "";
+}
+/**
+ * IAM `Null` condition operator.
+ *
+ * `Null` checks whether the request carries a value for a context key, rather
+ * than comparing one. `"true"` matches where the key is absent and `"false"`
+ * where it is present. AWS names it and the `...IfExists` suffix as the two
+ * exceptions to the rule that an absent key fails a condition.
+ *
+ * It is what guards a `ForAllValues` `Allow`, which matches an absent key on
+ * its own. See `SimIamForAllValuesStringConditionOperator`.
+ */
+export class SimIamNull {
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(expected) {
+        return expectsAbsentKey(expected) === true;
+    }
+    /**
+     * Answer for a request carrying a value for the key.
+     */
+    matches(actual, expected) {
+        const absentExpected = expectsAbsentKey(expected);
+        if (absentExpected === undefined) {
+            return false;
+        }
+        return absentExpected !== isPresent(actual);
+    }
+}

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.d.ts

@@ -15,7 +15,10 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export declare class SimIamNumericLessThanEquals implements SimIamConditionOperator {
-    readonly matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/numeric/less-than-equals/sim-iam-number-lte.js

@@ -13,7 +13,12 @@
  * are rejected rather than being converted through JavaScript coercion rules.
  */
 export class SimIamNumericLessThanEquals {
-    matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return false;
+    }
     /**
      * Compare one request value with one or more policy limits.
      */

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator-parser.js

@@ -8,6 +8,7 @@ import { SimIamStringLike } from "./string/like/sim-iam-string-like.js";
 import { SimIamNumericLessThanEquals } from "./numeric/less-than-equals/sim-iam-number-lte.js";
 import { SimIamArnEquals } from "./arn/equals/sim-iam-arn-equals.js";
 import { SimIamArnLike } from "./arn/like/sim-iam-arn-like.js";
+import { SimIamNull } from "./null/sim-iam-null.js";
 const operatorFactories = new Map([
     ["ArnEquals", () => new SimIamArnEquals()],
     ["ArnLike", () => new SimIamArnLike()],
@@ -17,6 +18,7 @@ const operatorFactories = new Map([
     ],
     ["StringEquals", () => new SimIamStringEquals()],
     ["StringLike", () => new SimIamStringLike()],
+    ["Null", () => new SimIamNull()],
     [
         "ForAnyValue:StringEquals",
         () => new SimIamForAnyValueStringEquals(),

package/dist/service/iam/authorize/match/condition/sim-iam-condition-operator.d.ts

@@ -15,9 +15,16 @@ export interface SimIamConditionOperator {
      * there is none for the policy value to equal.
      *
      * A `ForAnyValue` operator answers false whatever it wraps, because no
-     * request value is there to satisfy it. AWS documents both rules.
+     * request value is there to satisfy it. A `ForAllValues` operator answers
+     * true, because every value the request carries matches vacuously. AWS
+     * documents all three rules, and warns that the `ForAllValues` rule leaves
+     * an `Allow` overly permissive without a `Null` guard beside it.
+     *
+     * The policy value is passed because `Null` reads it. Every comparison
+     * operator answers the same way whatever the policy says, and takes no
+     * argument.
      */
-    readonly matchesAbsentKey: boolean;
+    matchesAbsentKey(expected: SimIamConditionValue): boolean;
     /**
      * Determine whether an actual request value satisfies the expected policy value.
      */

package/dist/service/iam/authorize/match/condition/sim-iam-policy-condition-matcher.js

@@ -59,7 +59,7 @@ export class SimIamPolicyConditionMatcher {
     entryMatches(operator, key, expected) {
         const actual = this.conditionContext.get(this.normalizeContextKey(key));
         if (actual === undefined) {
-            return operator.matchesAbsentKey;
+            return operator.matchesAbsentKey(expected);
         }
         return operator.matches(actual, expected);
     }

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.d.ts

@@ -2,9 +2,16 @@ import type { SimIamConditionValue } from "../../../../../policy/sim-iam-policy.
 import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.js";
 /**
  * Base for `ForAllValues` IAM string operators.
+ *
+ * An absent context key matches. AWS answers true where the request carries
+ * no value for the key. A `ForAllValues` `Allow` therefore needs a `Null`
+ * guard beside it to stay tight.
  */
 export declare abstract class SimIamForAllValuesStringConditionOperator implements SimIamConditionOperator {
-    readonly matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/all-values/sim-iam-for-all-values-string-condition-operator.js

@@ -1,9 +1,18 @@
 import { simIamStringValues } from "../sim-iam-string-values.js";
 /**
  * Base for `ForAllValues` IAM string operators.
+ *
+ * An absent context key matches. AWS answers true where the request carries
+ * no value for the key. A `ForAllValues` `Allow` therefore needs a `Null`
+ * guard beside it to stay tight.
  */
 export class SimIamForAllValuesStringConditionOperator {
-    matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return true;
+    }
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.d.ts

@@ -4,7 +4,10 @@ import type { SimIamConditionOperator } from "../../sim-iam-condition-operator.j
  * Base for `ForAnyValue` IAM string operators.
  */
 export declare abstract class SimIamForAnyValueStringConditionOperator implements SimIamConditionOperator {
-    readonly matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey(): boolean;
     /**
      * Check whether a given value matches the expected value.
      */

package/dist/service/iam/authorize/match/condition/string/any-value/sim-iam-for-any-value-string-condition-operator.js

@@ -3,7 +3,12 @@ import { simIamStringValues } from "../sim-iam-string-values.js";
  * Base for `ForAnyValue` IAM string operators.
  */
 export class SimIamForAnyValueStringConditionOperator {
-    matchesAbsentKey = false;
+    /**
+     * Answer for a request carrying no value for the key.
+     */
+    matchesAbsentKey() {
+        return false;
+    }
     /**
      * Check whether a given value matches the expected value.
      */