iam-floyd 0.847.0 → 0.848.0

package/.markdownlint-cli2.yaml

@@ -0,0 +1,12 @@
+config:
+  # Long lines are wrapped by the reader
+  MD013: false
+  # Line breaks in lists, like the packages in README.md
+  MD033:
+    allowed_elements: [br]
+globs:
+  - "**/*.md"
+ignores:
+  - "**/node_modules/**"
+  - CHANGELOG.md
+  - dist/**

package/.prettierignore

@@ -0,0 +1,4 @@
+# Generated
+CHANGELOG.md
+lib/generated/
+docs/source/_static/managed-policies/

package/.yamllint.yaml

@@ -0,0 +1,13 @@
+extends: default
+
+ignore-from-file: .gitignore
+
+rules:
+  # Prettier formats the files and wraps long lines where it can
+  line-length: disable
+  comments:
+    min-spaces-from-content: 1
+  document-start: disable
+  truthy:
+    # `on` is a key in GitHub workflows
+    check-keys: false

package/AGENTS.md

@@ -22,7 +22,7 @@ IAM Floyd is an AWS IAM policy statement generator with a fluent interface. It g
 
 Built in 10 numbered layers (`lib/shared/policy-statement/`):
 
-```
+```text
 1-base → 2-conditions → 3-actions → 4-resources → 5-effect
        → 6-arn-defaults → 8-principals → 10-final (PolicyStatement)
 ```
@@ -46,6 +46,14 @@ One codebase produces two npm packages:
 
 Publishing: the npm package of `cdk-iam-floyd` includes the `.jsii` (`make package-jsii publish LANGUAGES=typescript`), Python goes to PyPI and .NET to NuGet (both trusted publishing), Java to Maven Central (`bin/publish-maven`, signed bundle via the Central Portal API). Go has no registry: `bin/go-proxy` writes the module zip, which is attached to the GitHub release, and a static Go module proxy for the newest 30 releases, served by GitHub Pages under `udondan.github.io/iam-floyd/go`.
 
+### Native Packages (transpiled core)
+
+The standalone `iam-floyd` is being built natively for other languages, without jsii and without Node.js. The hand-written code in `lib/shared/` (the core) and `lib/collection/`, and the names of the AWS managed policies (`lib/generated/aws-managed-policies/iam-floyd.ts`), are transpiled with ts-morph by `lib/generator/transpile/` (`index.ts` collects the files of a module in import order, one backend per language, currently `python.ts`). The only imports from outside a module are the generated service classes, imported from their file (e.g. `../generated/policy-statements/ec2`). The transpiler supports only a narrow subset of TypeScript: anything else fails with file and line, so rewrite the code in supported constructs rather than extending the transpiler for single cases. The service classes are emitted from the model by `lib/generator/emit/python.ts`, with the jsii naming rules (snake_case, `if_`, `in_`), into the package `statement/`, which imports a service on first access. `bin/transpile.ts` writes `python/iam_floyd/_shared.py`, `_collection.py`, `_aws_managed_policies.py` and `statement/` (not committed). The package imports the collection and the managed policies on first access. `python/iam_floyd/_js.py` is the hand-written runtime for JavaScript semantics (number formatting, `toISOString`, sorting by UTF-16 code units, regular expressions).
+
+`test/transpile/` runs the scenarios against TypeScript (the baseline) and each language, and diffs the output: those of `scenarios.json`, which test the core, and those that `services.ts` builds from the model, which call every method of every service. Then it runs the examples of the docs (`examples/<name>/<name>.py`) with the native package, through `python/examples.py`, which runs them with `iam_floyd` in place of `cdk_iam_floyd`, and compares them to the `.result` files with `test/jsii/examples/compare.py --standalone`, which skips the `*.cdk` examples. Last, it compares the AWS managed policies with those of TypeScript.
+
+The Python package is built with hatchling from `python/pyproject.toml`; `bin/transpile.ts` writes the version of package.json into `iam_floyd/_version.py`. It supports Python 3.9 and newer, and has no dependencies at runtime. CI builds it and tests the wheel with the oldest and the newest supported Python; for a release, the tested wheel and sdist go to PyPI as `iam-floyd` (trusted publishing, job `publish-iam-floyd-python`).
+
 ## Development Commands
 
 ### Build
@@ -54,6 +62,7 @@ Publishing: the npm package of `cdk-iam-floyd` includes the `.jsii` (`make packa
 make emit            # emit lib/generated/policy-statements/ and lib/generated/index.ts from the model
 make build           # emit + tsc --build --force tsconfig.main.json tsconfig.types.json
 make package         # build + npm pack
+make package-native  # transpile and build the native packages of iam-floyd into dist/iam-floyd/ (Python: uv build)
 make clean           # remove node_modules, *.js, *.d.ts
 make install         # clean + npm i
 ```
@@ -75,11 +84,12 @@ make changelog       # print the changes of the managed policies and the model s
 The project has **no unit test framework**. Tests are integration-style: TypeScript examples are compiled, run, and their output is diffed against stored `.result` files.
 
 ```bash
-make test            # compile examples/ + diff against *.result files (standalone)
-make test-typescript # same, via Test.TypeScript.Makefile
-make cdk-test        # CDK test: real deploy + destroy via AWS CDK
-make cdk-all         # cdk + install + build + cdk-test
-make test-jsii       # test the packages of `make package-jsii` against TypeScript; LANGUAGES=python limits the languages
+make test-typescript     # compile examples/ + diff against *.result files (standalone)
+make test-typescript-cdk # after `make cdk`: same for the CDK examples (examples/**/*.cdk.ts)
+make cdk-test            # CDK test: real deploy + destroy via AWS CDK
+make cdk-all             # cdk + install + build + cdk-test
+make test-jsii           # test the packages of `make package-jsii` against TypeScript; LANGUAGES=python limits the languages
+make test-transpile      # transpile, compare the scenarios of test/transpile/ with TypeScript and run the examples; PYTHON_WHEEL=<wheel> tests the built package
 ```
 
 **Run a single example test manually:**
@@ -91,9 +101,6 @@ npx tsc -p tsconfig.test-iam-floyd.json
 # 2. Run and compare output
 node examples/allow/allow.js > /tmp/out.txt
 diff /tmp/out.txt examples/allow/allow.result
-
-# Or run the integration test harness directly:
-npx ts-node test/main.ts
 ```
 
 **Regenerate expected results** (after intentional changes):
@@ -105,9 +112,32 @@ make regenerate-code-example-results
 ### Linting
 
 ```bash
-make eslint          # npx eslint .
+make lint            # emit + bin/lint: all linters, must pass in CI
+make lint-fix        # emit + bin/lint --fix: fixes what can be fixed
+make lint-cdk        # after `make cdk`: eslint on the CDK variant
 ```
 
+`bin/lint` runs:
+
+| Linter                       | Files                                                 |
+| ---------------------------- | ----------------------------------------------------- |
+| eslint (`eslint.config.mjs`) | TypeScript and JavaScript, with types                 |
+| prettier                     | everything prettier knows, except `.prettierignore`   |
+| markdownlint-cli2            | Markdown                                              |
+| exact versions               | the dependencies of all `package.json` files          |
+| ruff, ruff format            | Python (`ruff.toml`, the examples are not formatted)  |
+| yamllint                     | YAML (`.yamllint.yaml`)                               |
+| doc8                         | reStructuredText in `docs/source` (`doc8.ini`)        |
+| zizmor, actionlint           | GitHub workflows                                      |
+| shellcheck, shfmt            | shell scripts, found by their shebang                 |
+| gofmt                        | Go                                                    |
+| dotnet format whitespace     | C# in `examples/` and `test/jsii/`                    |
+| checkstyle (Google style)    | Java in `examples/` and `test/jsii/` (`lint/pom.xml`) |
+
+The versions of the linters are pinned, so Renovate updates them: npm packages in `package.json`, Python tools in `lint/requirements.txt` (run with `uv`), Go tools in `lint/go.mod` (`go tool`) and checkstyle in `lint/pom.xml`. Locally, linters whose runtime (uv, Go, .NET, Maven) is missing are skipped; in CI they fail. In the CDK variant, eslint uses `tsconfig.lint-cdk.json`, which resolves `cdk-iam-floyd` to `lib/`, and prettier is off because `mkcdk` writes unformatted code.
+
+The actions in the workflows are pinned to commit SHAs with the version as comment.
+
 ### CDK Variant
 
 ```bash
@@ -177,13 +207,13 @@ Allowed manual edits:
 - **No trailing whitespace**
 - Line endings: LF (`\n`)
 
-Run `make eslint` to check; Prettier is enforced via `eslint-plugin-prettier`.
+Run `make lint` to check; Prettier is enforced via `eslint-plugin-prettier` and for the other files by `bin/lint`. `.editorconfig` sets 4 spaces for Python and C#, and tabs for Go.
 
 ### TypeScript
 
 Strict settings enforced in `tsconfig.json`:
 
-```
+```text
 strict: true
 noImplicitAny: true
 strictNullChecks: true
@@ -198,7 +228,7 @@ target: ES2020, module: CommonJS
 - **Unused vars**: Prefix with `_` to suppress (`argsIgnorePattern: ^_`).
 - **Naming conventions**: Enforced via `@typescript-eslint/naming-convention`. Use `camelCase` for variables/functions, `PascalCase` for classes/interfaces.
 - **Template literals**: Prefer `` `${x}` `` over `'a' + x` (`prefer-template: error`).
-- **Deprecated APIs**: `deprecation/deprecation` rule is set to `error` — do not use deprecated APIs.
+- **Deprecated APIs**: `@typescript-eslint/no-deprecated` rule is set to `error` — do not use deprecated APIs.
 - **No `require()`**: Use ES `import`/`export`.
 
 ### Imports
@@ -261,6 +291,6 @@ Follow conventional commits:
 - `index-managed-policies.yml` - Weekly on Sunday: updates managed policies, opens a `feat:` PR with `automerge` label
 - `release-please.yml` - On push to main: release-please maintains the release PR (version in `package.json` and `docs/source/conf.py`, `CHANGELOG.md`). After each run, `bin/changelog-add-iam-changes` adds the changes of the managed policies and the model since the last release to the new changelog entry of the PR. Merging the PR creates the tag and a draft release, and starts `test-and-publish.yml` with the tag
 - `automerge-schedule.yml` - Weekly on Monday: merges the release PR
-- `test-and-publish.yml` - On PR: `make install test-typescript` + CDK deploy test + `make package-jsii test-jsii` per language. Started by `release-please.yml` with a tag: builds the packages from the tag, publishes to npm, PyPI, NuGet, Maven Central and the Go module proxy on GitHub Pages, sets the notes of the release from `CHANGELOG.md` and publishes the release
+- `test-and-publish.yml` - On PR: `make install lint` (job `lint`), `make install test-typescript` + `make lint-cdk` + CDK deploy test + `make package-jsii test-jsii` per language + `make package-native test-transpile` against the built Python package. Started by `release-please.yml` with a tag: builds the packages from the tag, publishes to npm, PyPI, NuGet, Maven Central and the Go module proxy on GitHub Pages, sets the notes of the release from `CHANGELOG.md` and publishes the release
 - `automerge.yml` - Auto-merges PRs labeled `automerge` after tests pass
 - `test-docs.yml` - Builds Sphinx docs on `docs/**` changes

package/README.md

@@ -13,12 +13,14 @@
 **AWS [IAM policy statement][statement] generator with fluent interface.**
 
 <!-- stats -->
+
 Support for:
 
 - 455 Services
 - 22036 Actions
 - 2329 Resource Types
 - 2484 Condition keys
+
 <!-- /stats -->
 
 ![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**
@@ -70,10 +72,9 @@ This project is not affiliated, funded, or in any way associated with AWS.
 
 IAM Floyd is licensed under [Apache License 2.0][license]. Dependencies might be released under different licenses.
 
-   [source]: https://github.com/udondan/iam-floyd
-   [documentation]: https://iam-floyd.readthedocs.io/en/latest/
-   [npm]: https://www.npmjs.com/package/iam-floyd
-   [license]: https://github.com/udondan/iam-floyd/blob/main/LICENSE
-   [statement]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html
-   [packages]: https://iam-floyd.readthedocs.io/en/latest/packages.html
-   [AWS CDK]: https://aws.amazon.com/cdk/
+[source]: https://github.com/udondan/iam-floyd
+[documentation]: https://iam-floyd.readthedocs.io/en/latest/
+[license]: https://github.com/udondan/iam-floyd/blob/main/LICENSE
+[statement]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html
+[packages]: https://iam-floyd.readthedocs.io/en/latest/packages.html
+[AWS CDK]: https://aws.amazon.com/cdk/

package/doc8.ini

@@ -0,0 +1,3 @@
+[doc8]
+# Prose isn't wrapped
+ignore = D001

package/eslint.config.mjs

@@ -0,0 +1,122 @@
+import eslint from '@eslint/js';
+import prettierRecommended from 'eslint-plugin-prettier/recommended';
+import { defineConfig } from 'eslint/config';
+import { readFileSync } from 'fs';
+import globals from 'globals';
+import tseslint from 'typescript-eslint';
+
+// These files use the CDK variant, which only exists after `make cdk`. Before, they are linted without
+// type information. After, all files are linted with tsconfig.lint-cdk.json, which resolves
+// `cdk-iam-floyd` to lib/.
+const cdkFiles = [
+  'lib/**/*.CDK.ts',
+  'lib/**/*-CDK.ts',
+  'examples/**/*.cdk.ts',
+  'test/cdk.ts',
+  'test/jsii/consumer/**/*.ts',
+];
+const isCdk =
+  JSON.parse(readFileSync('package.json', 'utf8')).name === 'cdk-iam-floyd';
+
+export default defineConfig(
+  {
+    ignores: [
+      '**/node_modules/',
+      '**/cdk.out/',
+      '**/*.d.ts',
+      'lib/**/*.js',
+      'bin/**/*.js',
+      'examples/**/*.js',
+      'helper/**/*.js',
+      'test/**/*.js',
+      'tooter/**/*.js',
+      'lib/generated/',
+      'dist/',
+      'docs/build/',
+    ],
+  },
+  {
+    files: ['**/*.ts'],
+    extends: [
+      eslint.configs.recommended,
+      tseslint.configs.recommendedTypeChecked,
+      tseslint.configs.stylisticTypeChecked,
+    ],
+    languageOptions: {
+      parserOptions: isCdk
+        ? { project: 'tsconfig.lint-cdk.json' }
+        : { projectService: true },
+    },
+    rules: {
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
+      '@typescript-eslint/no-deprecated': 'error',
+      '@typescript-eslint/naming-convention': [
+        'error',
+        {
+          selector: 'default',
+          format: ['camelCase'],
+          leadingUnderscore: 'allow',
+        },
+        { selector: 'import', format: ['camelCase', 'PascalCase'] },
+        {
+          selector: 'variable',
+          modifiers: ['const'],
+          format: ['camelCase', 'PascalCase', 'UPPER_CASE'],
+          leadingUnderscore: 'allow',
+        },
+        { selector: 'typeLike', format: ['PascalCase'] },
+        { selector: 'enumMember', format: ['camelCase', 'PascalCase'] },
+        // Keys of objects are given by the format, like IAM policies or AWS APIs
+        { selector: 'objectLiteralProperty', format: null },
+        { selector: 'typeProperty', format: null },
+      ],
+      'prefer-template': 'error',
+      // `@ts-expect-error` fails where the line is valid in the other variant
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        { 'ts-ignore': 'allow-with-description' },
+      ],
+    },
+  },
+  {
+    // The layers call methods of the base class of the variant, which the standalone variant
+    // doesn't have
+    files: ['lib/shared/policy-statement/*.ts'],
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-this-alias': 'off',
+      '@typescript-eslint/no-unsafe-assignment': 'off',
+      '@typescript-eslint/no-unsafe-call': 'off',
+      '@typescript-eslint/no-unsafe-member-access': 'off',
+      '@typescript-eslint/no-unsafe-return': 'off',
+    },
+  },
+  {
+    files: cdkFiles,
+    extends: isCdk ? [] : [tseslint.configs.disableTypeChecked],
+  },
+  {
+    files: ['**/*.js', '**/*.mjs'],
+    extends: [eslint.configs.recommended],
+    languageOptions: { globals: globals.node },
+  },
+  {
+    files: ['docs/source/_static/js/**/*.js'],
+    languageOptions: {
+      globals: { ...globals.browser, $: 'readonly' },
+      sourceType: 'script',
+    },
+  },
+  prettierRecommended,
+  {
+    // `make cdk` writes code that isn't formatted. The formatting is checked in the standalone variant.
+    rules: isCdk ? { 'prettier/prettier': 'off' } : {},
+  },
+);

package/lib/collection/allowEc2InstanceDeleteByOwner.d.ts

@@ -1,7 +1,7 @@
-import { Statement } from '..';
+import { Ec2 } from '../generated/policy-statements/ec2';
 /**
  * Allows stopping EC2 instance only for the user who started them
  *
  * @param tag The tag name, where the user information will be stored - default: `Owner`
  */
-export declare function allowEc2InstanceDeleteByOwner(tag?: string): Statement.Ec2[];
+export declare function allowEc2InstanceDeleteByOwner(tag?: string): Ec2[];

package/lib/collection/allowEc2InstanceDeleteByOwner.js

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.allowEc2InstanceDeleteByOwner = allowEc2InstanceDeleteByOwner;
-const __1 = require("..");
+const ec2_1 = require("../generated/policy-statements/ec2");
 function allowEc2InstanceDeleteByOwner(tag) {
     const tagName = tag ?? 'Owner';
     return [
-        new __1.Statement.Ec2()
+        new ec2_1.Ec2()
             .allow()
             .toStartInstances()
             .ifAwsRequestTag(tagName, '${aws:username}'),
-        new __1.Statement.Ec2()
+        new ec2_1.Ec2()
             .allow()
             .toStopInstances()
             .ifResourceTag(tagName, '${aws:username}'),

package/lib/collection/index.d.ts

@@ -1,3 +1,4 @@
+import { Ec2 } from '../generated/policy-statements/ec2';
 export declare class Collection {
-    allowEc2InstanceDeleteByOwner(): import("../generated").Ec2[];
+    allowEc2InstanceDeleteByOwner(): Ec2[];
 }

package/lib/shared/compact.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Condenses a list of action names to wildcard patterns, e.g. `List*` or `*Vpn*`.
+ *
+ * A pattern is made from a substring that at least two of the selected actions have in common and that none of the
+ * excluded actions contains. IAM matches action names case-insensitive, so substrings are compared in lower case.
+ * The substrings are picked greedily, the one that covers the most actions not yet covered first. Actions that are not
+ * covered by any pattern are returned by name.
+ *
+ * @param selected Names of the actions to condense, without service prefix
+ * @param excluded Names of all other actions of the service, which the patterns must not match
+ */
+export declare function compactActionNames(selected: string[], excluded: string[]): string[];

package/lib/shared/compact.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compactActionNames = compactActionNames;
+const minLength = 3;
+function compactActionNames(selected, excluded) {
+    const forbidden = new Set();
+    for (const name of excluded) {
+        const marked = `^${name}$`.toLowerCase();
+        for (let start = 0; start < marked.length; start++) {
+            for (let end = start + minLength; end <= marked.length; end++) {
+                forbidden.add(marked.substring(start, end));
+            }
+        }
+    }
+    const sources = new Map();
+    const spellings = new Map();
+    for (let index = 0; index < selected.length; index++) {
+        const marked = `^${selected[index]}$`;
+        const lower = marked.toLowerCase();
+        for (let start = 0; start < marked.length; start++) {
+            for (let end = start + minLength; end <= marked.length; end++) {
+                const key = lower.substring(start, end);
+                if (forbidden.has(key)) {
+                    continue;
+                }
+                let indexes = sources.get(key);
+                if (indexes === undefined) {
+                    indexes = [];
+                    sources.set(key, indexes);
+                    spellings.set(key, marked.substring(start, end));
+                }
+                if (indexes.length == 0 || indexes[indexes.length - 1] != index) {
+                    indexes.push(index);
+                }
+            }
+        }
+    }
+    const redundant = new Set();
+    for (const [key, indexes] of sources) {
+        if (key.length <= minLength || indexes.length < 2) {
+            continue;
+        }
+        const shorter = [key.substring(1), key.substring(0, key.length - 1)];
+        for (const candidate of shorter) {
+            if ((sources.get(candidate) ?? []).length == indexes.length) {
+                redundant.add(candidate);
+            }
+        }
+    }
+    let candidates = [];
+    for (const [key, indexes] of sources) {
+        if (indexes.length >= 2 && !redundant.has(key)) {
+            candidates.push(key);
+        }
+    }
+    const covered = selected.map(() => false);
+    const patterns = [];
+    while (candidates.length > 0) {
+        let best = '';
+        let bestCount = 0;
+        const remaining = [];
+        for (const candidate of candidates) {
+            let count = 0;
+            for (const index of sources.get(candidate)) {
+                if (!covered[index]) {
+                    count++;
+                }
+            }
+            if (count < 2) {
+                continue;
+            }
+            remaining.push(candidate);
+            if (count > bestCount ||
+                (count == bestCount && isBetter(candidate, best))) {
+                best = candidate;
+                bestCount = count;
+            }
+        }
+        if (bestCount == 0) {
+            break;
+        }
+        for (const index of sources.get(best)) {
+            covered[index] = true;
+        }
+        patterns.push(toPattern(spellings.get(best)));
+        candidates = remaining;
+    }
+    for (let index = 0; index < selected.length; index++) {
+        if (!covered[index]) {
+            patterns.push(selected[index]);
+        }
+    }
+    return patterns;
+}
+function isBetter(candidate, best) {
+    const candidateIsStart = candidate.startsWith('^');
+    const bestIsStart = best.startsWith('^');
+    if (candidateIsStart != bestIsStart) {
+        return candidateIsStart;
+    }
+    if (candidate.length != best.length) {
+        return candidate.length > best.length;
+    }
+    return candidate < best;
+}
+function toPattern(substring) {
+    let pattern = substring;
+    if (pattern.startsWith('^')) {
+        pattern = pattern.substring(1);
+    }
+    else {
+        pattern = `*${pattern}`;
+    }
+    if (pattern.endsWith('$')) {
+        pattern = pattern.substring(0, pattern.length - 1);
+    }
+    else {
+        pattern = `${pattern}*`;
+    }
+    return pattern;
+}

package/lib/shared/policy-statement/1-base.d.ts

@@ -8,10 +8,4 @@ export declare class PolicyStatementBase {
      */
     servicePrefix: string;
     constructor(sid?: string);
-    /**
-     * JSON-ify the policy statement
-     *
-     * Used when JSON.stringify() is called
-     */
-    toJSON(): any;
 }

package/lib/shared/policy-statement/1-base.js

@@ -9,12 +9,5 @@ class PolicyStatementBase {
             this.sid = sid;
         }
     }
-    toJSON() {
-        const statement = {};
-        if (this.sid.length) {
-            statement.Sid = this.sid;
-        }
-        return statement;
-    }
 }
 exports.PolicyStatementBase = PolicyStatementBase;

package/lib/shared/policy-statement/10-final.d.ts

@@ -3,7 +3,6 @@ import { PolicyStatementWithPrincipal } from './8-principals';
  * Represents a statement in an IAM policy document
  */
 export declare class PolicyStatement extends PolicyStatementWithPrincipal {
-    protected cdkApplied: boolean;
     /**
      * JSON-ify the policy statement
      */

package/lib/shared/policy-statement/10-final.js

@@ -3,12 +3,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyStatement = void 0;
 const _8_principals_1 = require("./8-principals");
 class PolicyStatement extends _8_principals_1.PolicyStatementWithPrincipal {
-    constructor() {
-        super(...arguments);
-        this.cdkApplied = false;
-    }
     toJSON() {
-        return super.toJSON();
+        const statement = {};
+        if (this.sid.length) {
+            statement.Sid = this.sid;
+        }
+        if (this.hasConditions()) {
+            statement.Condition = this.floydConditions;
+        }
+        if (this.hasActions()) {
+            const actions = this.uniqueActions();
+            const mode = this.useNotAction ? 'NotAction' : 'Action';
+            statement[mode] = actions.length > 1 ? actions : actions[0];
+        }
+        this.ensureResource();
+        if (this.hasResources()) {
+            const resources = this.uniqueResources();
+            const mode = this.useNotResource ? 'NotResource' : 'Resource';
+            statement[mode] = resources.length > 1 ? resources : resources[0];
+        }
+        statement.Effect = this.effect;
+        if (this.hasPrincipals()) {
+            const mode = this.useNotPrincipal ? 'NotPrincipal' : 'Principal';
+            statement[mode] = this.myPrincipals;
+        }
+        return statement;
     }
 }
 exports.PolicyStatement = PolicyStatement;

package/lib/shared/policy-statement/2-conditions.d.ts

@@ -13,16 +13,6 @@ export type Conditions = Record<string, Condition>;
  */
 export declare class PolicyStatementWithCondition extends PolicyStatementBase {
     protected floydConditions: Conditions;
-    private cdkConditionsApplied;
-    /**
-     * Injects conditions into the statement.
-     *
-     * Only relevant for the main package. In CDK mode this only calls super.
-     */
-    toJSON(): any;
-    toStatementJson(): any;
-    freeze(): any;
-    private cdkApplyConditions;
     /**
      * Checks weather a condition was applied to the policy.
      */