iam-floyd 0.847.0 → 0.849.0

package/.markdownlint-cli2.yaml

@@ -0,0 +1,16 @@
+config:
+  # Long lines are wrapped by the reader
+  MD013: false
+  # Line breaks in tables and the collapsible examples per language in README.md
+  MD033:
+    allowed_elements: [br, details, summary]
+  # gofmt indents with tabs
+  MD010:
+    ignore_code_languages: [go]
+globs:
+  - "**/*.md"
+ignores:
+  - "**/node_modules/**"
+  - CHANGELOG.md
+  - dist/**
+  - java/target/**

package/.prettierignore

@@ -0,0 +1,5 @@
+# Generated
+CHANGELOG.md
+lib/generated/
+docs/source/_static/managed-policies/
+docs/source/_static/policy-converter/

package/.yamllint.yaml

@@ -0,0 +1,13 @@
+extends: default
+
+ignore-from-file: .gitignore
+
+rules:
+  # Prettier formats the files and wraps long lines where it can
+  line-length: disable
+  comments:
+    min-spaces-from-content: 1
+  document-start: disable
+  truthy:
+    # `on` is a key in GitHub workflows
+    check-keys: false

package/AGENTS.md

@@ -16,13 +16,13 @@ IAM Floyd is an AWS IAM policy statement generator with a fluent interface. It g
 - `lib/generated/aws-managed-policies/` - Generated AWS managed policies (committed)
 - `lib/shared/` - Hand-written core: `PolicyStatement`, `All`, `Operator`, `AccessLevel`
 - `lib/collection/` - Predefined policy collection utilities
-- `lib/generator/` - Scrapes AWS docs with `cheerio` into the model (`model.ts`), and emits TypeScript from the model with `ts-morph` (`emit/typescript.ts`)
+- `lib/generator/` - Scrapes AWS docs with `cheerio` into the model (`model.ts`), and emits TypeScript from the model with `ts-morph` (`emit/typescript.ts`), and the index of the policy converter (`emit/converter.ts`)
 
 ### PolicyStatement Inheritance Chain
 
 Built in 10 numbered layers (`lib/shared/policy-statement/`):
 
-```
+```text
 1-base → 2-conditions → 3-actions → 4-resources → 5-effect
        → 6-arn-defaults → 8-principals → 10-final (PolicyStatement)
 ```
@@ -44,7 +44,33 @@ One codebase produces two npm packages:
 
 `test/jsii/` builds `floyd-consumer`, a jsii library that depends on `cdk-iam-floyd`, and runs the same scenarios in TypeScript (the baseline, without jsii), Python, Java, .NET and Go against `test/jsii/expected.json`. It also runs the examples of the docs in each language (`examples/<name>/<name>.{py,java,cs,go}`, through the runners in `test/jsii/examples/`) and compares them to the `.result` files. Every example needs a file in every language.
 
-Publishing: the npm package of `cdk-iam-floyd` includes the `.jsii` (`make package-jsii publish LANGUAGES=typescript`), Python goes to PyPI and .NET to NuGet (both trusted publishing), Java to Maven Central (`bin/publish-maven`, signed bundle via the Central Portal API). Go has no registry: `bin/go-proxy` writes the module zip, which is attached to the GitHub release, and a static Go module proxy for the newest 30 releases, served by GitHub Pages under `udondan.github.io/iam-floyd/go`.
+Publishing: the npm package of `cdk-iam-floyd` includes the `.jsii` (`make package-jsii publish LANGUAGES=typescript`), Python goes to PyPI and .NET to NuGet (both trusted publishing), Java to Maven Central (`bin/publish-maven`, signed bundle via the Central Portal API). Go has no registry: `bin/go-proxy` writes the module zip, which is attached to the GitHub release, and a static Go module proxy of both modules (`cdkiamfloyd` and the native `iamfloyd`) for the newest 30 releases, served by GitHub Pages under `udondan.github.io/iam-floyd/go` (job `publish-go-proxy`).
+
+### Native Packages (transpiled core)
+
+The standalone `iam-floyd` is being built natively for other languages, without jsii and without Node.js. The hand-written code in `lib/shared/` (the core) and `lib/collection/`, and the names of the AWS managed policies (`lib/generated/aws-managed-policies/iam-floyd.ts`), are transpiled with ts-morph by `lib/generator/transpile/` (`index.ts` collects the files of a module in import order, one backend per language: `python.ts`, `java.ts`, `csharp.ts`, `go.ts`). The only imports from outside a module are the generated service classes, imported from their file (e.g. `../generated/policy-statements/ec2`). The transpiler supports only a narrow subset of TypeScript: anything else fails with file and line, so rewrite the code in supported constructs rather than extending the transpiler for single cases. The service classes are emitted from the model by `lib/generator/emit/python.ts`, with the jsii naming rules (snake_case, `if_`, `in_`), into the package `statement/`, which imports a service on first access. `bin/transpile.ts` writes `python/iam_floyd/_shared.py`, `_collection.py`, `_aws_managed_policies.py` and `statement/` (not committed). The package imports the collection and the managed policies on first access. `python/iam_floyd/_js.py` is the hand-written runtime for JavaScript semantics (number formatting, `toISOString`, sorting by UTF-16 code units, regular expressions).
+
+Java: the core, the collection and `AwsManagedPolicy` go to the package `com.udondan.iamFloyd`, the service classes (emitted by `lib/generator/emit/java.ts`) and `All` to `com.udondan.iamFloyd.statement`, in `java/src/main/java/` (not committed, except the hand-written runtime `Js.java` and `Json.java`, which writes the JSON like `JSON.stringify`). The classes of the statement are generic (`PolicyStatement<T extends PolicyStatement<T>>`, `Ec2 extends PolicyStatement<Ec2>`), so the fluent methods return the class itself. Optional parameters and union types become overloads, reserved words get a prefix (`doIf`, `doFor`), static properties become constants (`Operator.STRING_EQUALS`).
+
+C#: the core, the collection and `AwsManagedPolicy` go to the namespace `IAM.Floyd`, the service classes (emitted by `lib/generator/emit/csharp.ts`) and `All` to `IAM.Floyd.Statement`, in `dotnet/src/IAM.Floyd/` (not committed, except the project `IAM.Floyd.csproj` and the hand-written runtime `Js.cs` and `Json.cs`). Like in Java, the classes of the statement are generic (`PolicyStatement<T> where T : PolicyStatement<T>`, `Ec2 : PolicyStatement<Ec2>`), optional parameters and union types become overloads and static properties constants. Names are PascalCase (`If`, `For`, `ToJSON`), public fields become properties (`Sid`), and the service classes hide methods of the core with the same name with `new` (e.g. `IfAwsRequestTag`).
+
+Go: the module `udondan.github.io/iam-floyd/go/iamfloyd` in `go/iamfloyd/` (not committed, except `go.mod`, the hand-written helpers `helpers.go` (`String`, `Strings`, `Number`, `Bool`) and the runtime in `internal/js/`). The core and `AwsManagedPolicy` go to the package `iamfloyd`, the collection to `collection`, the service classes (emitted by `lib/generator/emit/go.ts`) and `All` to `statement`. Inheritance becomes embedding of generic structs (`PolicyStatement[T]`, `type Ec2 struct{ iamfloyd.PolicyStatement[*Ec2] }`) with an `InitX` function per class, and the fluent methods return `T`. Parameters are pointers like in jsii (`*string`, `*[]*string`), optional ones are `nil`, union types `interface{}`. Static properties become constants (`Operator_STRING_EQUALS`), the classes with `toJSON` implement `MarshalJSON`. `bin/transpile.ts` runs `gofmt` on the output.
+
+`test/transpile/` runs the scenarios against TypeScript (the baseline) and each language, and diffs the output: those of `scenarios.json`, which test the core, and those that `services.ts` builds from the model, which call every method of every service. Then it runs the examples of the docs (`examples/<name>/<name>.{py,java,cs,go}`) with the native package, through `python/examples.py`, which runs them with `iam_floyd` in place of `cdk_iam_floyd`, `java/Examples.java`, which compiles them with `com.udondan.iamFloyd` and a stand-in of the `PolicyDocument` of the AWS CDK (`java/stubs/`), `dotnet/` (`run.sh` rewrites them for `IAM.Floyd`, the project compiles them with a stand-in of the `PolicyDocument` in `Stubs.cs`) and `go/` (`run.sh` rewrites them for `iamfloyd` and the stand-in `awsiam`, and writes `registry.go` with `registry.ts`, as Go cannot look up classes and constants by name), and compares them to the `.result` files with `test/jsii/examples/compare.py --standalone`, which skips the `*.cdk` examples. Last, it compares the AWS managed policies with those of TypeScript.
+
+The Python package is built with hatchling from `python/pyproject.toml`; `bin/transpile.ts` writes the version of package.json into `iam_floyd/_version.py`. It supports Python 3.9 and newer, and has no dependencies at runtime. CI builds it and tests the wheel with the oldest and the newest supported Python; for a release, the tested wheel and sdist go to PyPI as `iam-floyd` (trusted publishing, job `publish-iam-floyd-python`).
+
+The Java package is built with Maven from `java/pom.xml` (`-Drevision=<version of package.json>`), with `--release 11`, into the Maven repository `dist/iam-floyd/java`. CI builds it with the newest Java LTS and tests the jar with Java 11 and the newest LTS; for a release, `bin/publish-maven dist/iam-floyd/java` publishes it to Maven Central as `com.udondan:iam-floyd` (job `publish-iam-floyd-java`).
+
+The .NET package is built with `dotnet pack` from `dotnet/src/IAM.Floyd/IAM.Floyd.csproj` (`-p:Version=<version of package.json>`), for .NET 8, into `dist/iam-floyd/dotnet`. CI builds it with the newest .NET SDK and tests the package with .NET 8 and the newest .NET (`DOTNET_PACKAGES`, `DOTNET_FRAMEWORK`); for a release, it goes to NuGet as `IAM.Floyd` (trusted publishing, job `publish-iam-floyd-dotnet`).
+
+The Go module is zipped by `bin/go-proxy zip` into `dist/iam-floyd/go`, with the LICENSE. It supports Go 1.21 and newer, and has no dependencies. CI tests the zip with Go 1.21 and the newest Go (`GO_MODULE`); for a release, the zip is attached to the GitHub release (job `publish-iam-floyd-go`) and served by the Go module proxy.
+
+### Policy Converter
+
+The policy converter of the docs (`docs/source/policy-converter.rst`) converts an IAM policy to IAM Floyd code in TypeScript, JavaScript, Python, Java, C# and Go, for both variants. The conversion is in `docs/source/_static/js/converter.js`, without dependencies, which runs in the browser and in Node.js; `policy-converter.js` is the UI. It knows the classes and actions from `docs/source/_static/policy-converter/services.json`, which `lib/generator/emit/converter.ts` writes from the model on `make emit` and `make generate` (committed, as Read the Docs builds the docs without Node.js).
+
+`test/converter/cases.ts` converts the policies of `test/converter/policies/` and all AWS managed policies to JavaScript, runs the code against `lib/` and checks that the policy allows and denies the same as the input. Then it writes the code of the other languages as examples (`converter-<name>`) with their `.result` into a copy of `examples/`, which `test/transpile/run.sh` (Standalone) and `test/jsii/run.sh` (CDK) run with the other examples.
 
 ## Development Commands
 
@@ -54,6 +80,7 @@ Publishing: the npm package of `cdk-iam-floyd` includes the `.jsii` (`make packa
 make emit            # emit lib/generated/policy-statements/ and lib/generated/index.ts from the model
 make build           # emit + tsc --build --force tsconfig.main.json tsconfig.types.json
 make package         # build + npm pack
+make package-native  # transpile and build the native packages of iam-floyd into dist/iam-floyd/ (Python: uv build, Java: mvn, .NET: dotnet pack, Go: module zip); LANGUAGES=python limits the languages
 make clean           # remove node_modules, *.js, *.d.ts
 make install         # clean + npm i
 ```
@@ -75,11 +102,12 @@ make changelog       # print the changes of the managed policies and the model s
 The project has **no unit test framework**. Tests are integration-style: TypeScript examples are compiled, run, and their output is diffed against stored `.result` files.
 
 ```bash
-make test            # compile examples/ + diff against *.result files (standalone)
-make test-typescript # same, via Test.TypeScript.Makefile
-make cdk-test        # CDK test: real deploy + destroy via AWS CDK
-make cdk-all         # cdk + install + build + cdk-test
-make test-jsii       # test the packages of `make package-jsii` against TypeScript; LANGUAGES=python limits the languages
+make test-typescript     # compile examples/ + diff against *.result files (standalone)
+make test-typescript-cdk # after `make cdk`: same for the CDK examples (examples/**/*.cdk.ts)
+make cdk-test            # CDK test: real deploy + destroy via AWS CDK
+make cdk-all             # cdk + install + build + cdk-test
+make test-jsii           # test the packages of `make package-jsii` against TypeScript; LANGUAGES=python limits the languages
+make test-transpile      # transpile, compare the scenarios of test/transpile/ with TypeScript and run the examples; PYTHON_WHEEL=<wheel>, JAVA_JAR=<jar>, DOTNET_PACKAGES=<dir of the nupkg> and GO_MODULE=<zip> test the built packages
 ```
 
 **Run a single example test manually:**
@@ -91,9 +119,6 @@ npx tsc -p tsconfig.test-iam-floyd.json
 # 2. Run and compare output
 node examples/allow/allow.js > /tmp/out.txt
 diff /tmp/out.txt examples/allow/allow.result
-
-# Or run the integration test harness directly:
-npx ts-node test/main.ts
 ```
 
 **Regenerate expected results** (after intentional changes):
@@ -105,9 +130,32 @@ make regenerate-code-example-results
 ### Linting
 
 ```bash
-make eslint          # npx eslint .
+make lint            # emit + bin/lint: all linters, must pass in CI
+make lint-fix        # emit + bin/lint --fix: fixes what can be fixed
+make lint-cdk        # after `make cdk`: eslint on the CDK variant
 ```
 
+`bin/lint` runs:
+
+| Linter                       | Files                                                   |
+| ---------------------------- | ------------------------------------------------------- |
+| eslint (`eslint.config.mjs`) | TypeScript and JavaScript, with types                   |
+| prettier                     | everything prettier knows, except `.prettierignore`     |
+| markdownlint-cli2            | Markdown                                                |
+| exact versions               | the dependencies of all `package.json` files            |
+| ruff, ruff format            | Python (`ruff.toml`, the examples are not formatted)    |
+| yamllint                     | YAML (`.yamllint.yaml`)                                 |
+| doc8                         | reStructuredText in `docs/source` (`doc8.ini`)          |
+| zizmor, actionlint           | GitHub workflows                                        |
+| shellcheck, shfmt            | shell scripts, found by their shebang                   |
+| gofmt                        | Go                                                      |
+| dotnet format whitespace     | C# in `examples/`, `test/` and the runtime of `dotnet/` |
+| checkstyle (Google style)    | Java in `examples/` and `test/jsii/` (`lint/pom.xml`)   |
+
+The versions of the linters are pinned, so Renovate updates them: npm packages in `package.json`, Python tools in `lint/requirements.txt` (run with `uv`), Go tools in `lint/go.mod` (`go tool`) and checkstyle in `lint/pom.xml`. Locally, linters whose runtime (uv, Go, .NET, Maven) is missing are skipped; in CI they fail. In the CDK variant, eslint uses `tsconfig.lint-cdk.json`, which resolves `cdk-iam-floyd` to `lib/`, and prettier is off because `mkcdk` writes unformatted code.
+
+The actions in the workflows are pinned to commit SHAs with the version as comment.
+
 ### CDK Variant
 
 ```bash
@@ -177,13 +225,13 @@ Allowed manual edits:
 - **No trailing whitespace**
 - Line endings: LF (`\n`)
 
-Run `make eslint` to check; Prettier is enforced via `eslint-plugin-prettier`.
+Run `make lint` to check; Prettier is enforced via `eslint-plugin-prettier` and for the other files by `bin/lint`. `.editorconfig` sets 4 spaces for Python and C#, and tabs for Go.
 
 ### TypeScript
 
 Strict settings enforced in `tsconfig.json`:
 
-```
+```text
 strict: true
 noImplicitAny: true
 strictNullChecks: true
@@ -198,7 +246,7 @@ target: ES2020, module: CommonJS
 - **Unused vars**: Prefix with `_` to suppress (`argsIgnorePattern: ^_`).
 - **Naming conventions**: Enforced via `@typescript-eslint/naming-convention`. Use `camelCase` for variables/functions, `PascalCase` for classes/interfaces.
 - **Template literals**: Prefer `` `${x}` `` over `'a' + x` (`prefer-template: error`).
-- **Deprecated APIs**: `deprecation/deprecation` rule is set to `error` — do not use deprecated APIs.
+- **Deprecated APIs**: `@typescript-eslint/no-deprecated` rule is set to `error` — do not use deprecated APIs.
 - **No `require()`**: Use ES `import`/`export`.
 
 ### Imports
@@ -261,6 +309,6 @@ Follow conventional commits:
 - `index-managed-policies.yml` - Weekly on Sunday: updates managed policies, opens a `feat:` PR with `automerge` label
 - `release-please.yml` - On push to main: release-please maintains the release PR (version in `package.json` and `docs/source/conf.py`, `CHANGELOG.md`). After each run, `bin/changelog-add-iam-changes` adds the changes of the managed policies and the model since the last release to the new changelog entry of the PR. Merging the PR creates the tag and a draft release, and starts `test-and-publish.yml` with the tag
 - `automerge-schedule.yml` - Weekly on Monday: merges the release PR
-- `test-and-publish.yml` - On PR: `make install test-typescript` + CDK deploy test + `make package-jsii test-jsii` per language. Started by `release-please.yml` with a tag: builds the packages from the tag, publishes to npm, PyPI, NuGet, Maven Central and the Go module proxy on GitHub Pages, sets the notes of the release from `CHANGELOG.md` and publishes the release
+- `test-and-publish.yml` - On PR: `make install lint` (job `lint`), `make install test-typescript` + `make lint-cdk` + CDK deploy test + `make package-jsii test-jsii` per language + `make package-native test-transpile` against the built Python, Java, .NET and Go packages. Started by `release-please.yml` with a tag: builds the packages from the tag, publishes to npm, PyPI, NuGet, Maven Central and the Go module proxy on GitHub Pages, sets the notes of the release from `CHANGELOG.md` and publishes the release
 - `automerge.yml` - Auto-merges PRs labeled `automerge` after tests pass
 - `test-docs.yml` - Builds Sphinx docs on `docs/**` changes

package/README.md

@@ -1,68 +1,171 @@
 # IAM Floyd
 
-[![Source](https://img.shields.io/github/stars/udondan/iam-floyd?logo=github&label=GitHub%20Stars)][source]
-[![iam-floyd](https://img.shields.io/github/v/release/udondan/iam-floyd)][source]
-[![Packages](https://img.shields.io/badge/Packages-npm%20%7C%20PyPI%20%7C%20Maven%20%7C%20NuGet%20%7C%20Go-yellow)][packages]
-[![Documentation](https://img.shields.io/badge/Documentation-Read%20the%20Docs-orange)][documentation]
-[![GitHub](https://img.shields.io/github/license/udondan/iam-floyd)][license]
-
-<!-- put back - when we actually have tests
-[![Test Coverage](https://api.codeclimate.com/v1/badges/cdb84b5646c6805b1a23/test_coverage)](https://codeclimate.com/github/udondan/iam-floyd/test_coverage)
--->
-
-**AWS [IAM policy statement][statement] generator with fluent interface.**
+[![Release](https://img.shields.io/github/v/release/udondan/iam-floyd?label=release)](https://github.com/udondan/iam-floyd/releases)
+[![Documentation](https://img.shields.io/readthedocs/iam-floyd?label=docs)](https://iam-floyd.readthedocs.io/en/latest/)
+[![Construct Hub](https://img.shields.io/badge/Construct%20Hub-cdk--iam--floyd-blue)](https://constructs.dev/packages/cdk-iam-floyd)
+[![License](https://img.shields.io/github/license/udondan/iam-floyd)](https://github.com/udondan/iam-floyd/blob/main/LICENSE)
+
+**AWS [IAM policy statement][statement] generator with a fluent interface, for TypeScript, JavaScript, Python, Java, C# and Go.**
+
+IAM Floyd has a class for every AWS service, with a method for every action, resource type and condition key. Your IDE completes them and shows their documentation, so you neither look up action names and ARN formats, nor deploy policies with typos.
+
+```ts
+import { Statement } from 'iam-floyd';
+
+const statement = new Statement.Ec2()
+  .allow()
+  .toStartInstances()
+  .toStopInstances()
+  .ifResourceTag('Owner', '${aws:username}');
+```
+
+```json
+{
+  "Condition": {
+    "StringLike": {
+      "ec2:ResourceTag/Owner": "${aws:username}"
+    }
+  },
+  "Action": ["ec2:StartInstances", "ec2:StopInstances"],
+  "Resource": "*",
+  "Effect": "Allow"
+}
+```
+
+<details>
+<summary>Python</summary>
+
+```python
+from iam_floyd import Statement
+
+statement = (
+    Statement.Ec2()
+        .allow()
+        .to_start_instances()
+        .to_stop_instances()
+        .if_resource_tag('Owner', '${aws:username}')
+)
+```
+
+</details>
+
+<details>
+<summary>Java</summary>
+
+```java
+import com.udondan.iamFloyd.statement.Ec2;
+
+Ec2 statement = new Ec2()
+    .allow()
+    .toStartInstances()
+    .toStopInstances()
+    .ifResourceTag("Owner", "${aws:username}");
+```
+
+</details>
+
+<details>
+<summary>C#</summary>
+
+```csharp
+using Statement = IAM.Floyd.Statement;
+
+var statement = new Statement.Ec2()
+    .Allow()
+    .ToStartInstances()
+    .ToStopInstances()
+    .IfResourceTag("Owner", "${aws:username}");
+```
+
+</details>
+
+<details>
+<summary>Go</summary>
+
+```go
+import (
+	"udondan.github.io/iam-floyd/go/iamfloyd"
+	"udondan.github.io/iam-floyd/go/iamfloyd/statement"
+)
+
+s := statement.NewEc2(nil).
+	Allow().
+	ToStartInstances().
+	ToStopInstances().
+	IfResourceTag(iamfloyd.String("Owner"), iamfloyd.String("${aws:username}"), nil)
+```
+
+</details>
 
 <!-- stats -->
+
 Support for:
 
 - 455 Services
 - 22036 Actions
 - 2329 Resource Types
 - 2484 Condition keys
+
 <!-- /stats -->
 
-![EXPERIMENTAL](https://img.shields.io/badge/stability-experimantal-orange?style=for-the-badge)**<br>This is an early version of the package. The API will change while I implement new features. Therefore make sure you use an exact version in your `package.json` before it reaches 1.0.0.**
+## Features
 
-## Documentation
+- **Complete**: generated from the [AWS documentation][aws-docs], and updated every week
+- **Access levels**: add all actions of an access level, e.g. `allReadActions()` or `allWriteActions()`
+- **Regular expressions**: add all actions that match a pattern with `allMatchingActions('/vpn/i')`
+- **Resources**: build ARNs with a method per resource type, e.g. `onBucket('example-bucket')`, with defaults for partition, region and account
+- **Conditions**: a method per condition key, with operators like `ForAnyValue:StringEquals` or `IfExists`
+- **AWS CDK**: `cdk-iam-floyd` statements are an [`iam.PolicyStatement`][cdk-policy-statement] of the AWS CDK
+- **Collections** of common statements, and the names of all AWS managed policies
+- **Policy converter**: turn an existing JSON policy into IAM Floyd code with the [online converter][converter]
 
-Find the documentation at [Read the Docs][documentation].
+## Packages
 
-[![Auto completion demo](https://raw.githubusercontent.com/udondan/iam-floyd/main/docs/movie-preview.png)](https://www.youtube.com/watch?v=4dHY8qPHbKA 'Auto completion demo')
+IAM Floyd comes in two variants, with the same API and the same version number in every language:
 
-## Packages
+- **`iam-floyd`** creates statements as JSON, for the AWS SDKs, CloudFormation, Terraform or anything else that takes an IAM policy. The packages have no dependencies. In Python, Java, C# and Go, they are native and do not need Node.js.
+- **`cdk-iam-floyd`** creates statements of the [AWS CDK][aws-cdk] v2. In Python, Java, C# and Go, they are built with [jsii][jsii], like the AWS CDK itself, and need Node.js.
 
-There are two different package variants available:
+| Language                | `iam-floyd`                            | `cdk-iam-floyd`                                |
+| ----------------------- | -------------------------------------- | ---------------------------------------------- |
+| TypeScript / JavaScript | [![npm][npm-badge]][npm]               | [![npm][cdk-npm-badge]][cdk-npm]               |
+| Python                  | [![PyPI][pypi-badge]][pypi]            | [![PyPI][cdk-pypi-badge]][cdk-pypi]            |
+| Java                    | [![Maven Central][maven-badge]][maven] | [![Maven Central][cdk-maven-badge]][cdk-maven] |
+| C# / .NET               | [![NuGet][nuget-badge]][nuget]         | [![NuGet][cdk-nuget-badge]][cdk-nuget]         |
+| Go                      | [![Go][go-badge]][go]                  | [![Go][go-badge]][cdk-go]                      |
 
-- **iam-floyd**: Can be used in AWS SDK or for whatever you need an IAM policy statement for <br>[![npm](https://img.shields.io/npm/dt/iam-floyd?label=npm&color=blueviolet)](https://www.npmjs.com/package/iam-floyd)
-- **cdk-iam-floyd**: Integrates into [AWS CDK] and extends [`iam.PolicyStatement`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.PolicyStatement.html)<br>[![npm](https://img.shields.io/npm/dt/cdk-iam-floyd?label=npm&color=orange)](https://www.npmjs.com/package/cdk-iam-floyd)
+### Installation
 
-  **Starting with version 0.300.0, the packages are compatible with CDK v2.** For CDK v1 you can use any version up to:<br>
-  [![npm CDK v1](https://img.shields.io/badge/npm-0.286.0-yellow)](https://www.npmjs.com/package/cdk-iam-floyd/v/0.286.0)
+```bash
+# TypeScript / JavaScript
+npm install iam-floyd           # or cdk-iam-floyd
 
-  cdk-iam-floyd is also available for Python, Java, .NET and Go:<br>
-  [![PyPI](https://img.shields.io/pypi/v/cdk-iam-floyd?label=PyPI)](https://pypi.org/project/cdk-iam-floyd/)
-  [![Maven Central](https://img.shields.io/maven-central/v/com.udondan/cdk-iam-floyd?label=Maven%20Central)](https://central.sonatype.com/artifact/com.udondan/cdk-iam-floyd)
-  [![NuGet](https://img.shields.io/nuget/v/CDK.IAM.Floyd?label=NuGet)](https://www.nuget.org/packages/CDK.IAM.Floyd)
-  `go get udondan.github.io/iam-floyd/go/cdkiamfloyd`
+# Python
+pip install iam-floyd           # or cdk-iam-floyd
 
-## CDK Compatibility Matrix
+# Java (Maven), with the version of the release
+#   com.udondan:iam-floyd       # or com.udondan:cdk-iam-floyd
 
-| CDK        | cdk-iam-floyd              |
-| ---------- | -------------------------- |
-| <= 1.151.0 | <= 0.285.0                 |
-| >= 1.152.0 | 0.286.0                    |
-| >= 1.158.0 | **No compatible version!** |
-| >= 2.0.0   | >= 0.300.0                 |
-| >= 2.20.0  | >= 0.351.0                 |
-| >= 2.26.0  | >= 0.377.0                 |
-| 2.29.x     | **No compatible version!** |
-| >= 2.30.0  | >= 0.391.0                 |
+# C# / .NET
+dotnet add package IAM.Floyd    # or CDK.IAM.Floyd
 
----
+# Go
+go get udondan.github.io/iam-floyd/go/iamfloyd   # or .../go/cdkiamfloyd
+```
+
+IAM Floyd has not reached 1.0.0 yet, and the API can still change between releases. Pin the exact version.
+
+The requirements of each package and the compatibility with the AWS CDK are listed in the [documentation][packages].
+
+## Documentation
+
+The [documentation][documentation] explains all features, with examples in every language.
+
+[![Auto completion demo](https://raw.githubusercontent.com/udondan/iam-floyd/main/docs/movie-preview.png)](https://www.youtube.com/watch?v=4dHY8qPHbKA 'Auto completion demo')
 
 ## Legal
 
-The service models in the [lib/generated/model](https://github.com/udondan/iam-floyd/tree/main/lib/generated/model) folder, and the code generated from them, are derived from the [AWS documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html). The class- and function-names and their description therefore are property of AWS.
+The service models in the [lib/generated/model](https://github.com/udondan/iam-floyd/tree/main/lib/generated/model) folder, and the code generated from them, are derived from the [AWS documentation][aws-docs]. The class- and function-names and their description therefore are property of AWS.
 
 AWS and their services are trademarks, registered trademarks or trade dress of AWS in the U.S. and/or other countries.
 
@@ -70,10 +173,31 @@ This project is not affiliated, funded, or in any way associated with AWS.
 
 IAM Floyd is licensed under [Apache License 2.0][license]. Dependencies might be released under different licenses.
 
-   [source]: https://github.com/udondan/iam-floyd
-   [documentation]: https://iam-floyd.readthedocs.io/en/latest/
-   [npm]: https://www.npmjs.com/package/iam-floyd
-   [license]: https://github.com/udondan/iam-floyd/blob/main/LICENSE
-   [statement]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html
-   [packages]: https://iam-floyd.readthedocs.io/en/latest/packages.html
-   [AWS CDK]: https://aws.amazon.com/cdk/
+[statement]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_statement.html
+[aws-docs]: https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html
+[aws-cdk]: https://aws.amazon.com/cdk/
+[cdk-policy-statement]: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iam.PolicyStatement.html
+[jsii]: https://aws.github.io/jsii/
+[documentation]: https://iam-floyd.readthedocs.io/en/latest/
+[packages]: https://iam-floyd.readthedocs.io/en/latest/packages.html
+[converter]: https://iam-floyd.readthedocs.io/en/latest/policy-converter.html
+[license]: https://github.com/udondan/iam-floyd/blob/main/LICENSE
+[npm]: https://www.npmjs.com/package/iam-floyd
+[npm-badge]: https://img.shields.io/npm/v/iam-floyd?label=npm&color=3178C6&logo=typescript&logoColor=white
+[pypi]: https://pypi.org/project/iam-floyd/
+[pypi-badge]: https://img.shields.io/pypi/v/iam-floyd?label=PyPI&color=3776AB&logo=python&logoColor=white
+[maven]: https://central.sonatype.com/artifact/com.udondan/iam-floyd
+[maven-badge]: https://img.shields.io/maven-central/v/com.udondan/iam-floyd?label=Maven%20Central&color=ED8B00&logo=openjdk&logoColor=white
+[nuget]: https://www.nuget.org/packages/IAM.Floyd
+[nuget-badge]: https://img.shields.io/nuget/v/IAM.Floyd?label=NuGet&color=512BD4&logo=dotnet&logoColor=white
+[cdk-npm]: https://www.npmjs.com/package/cdk-iam-floyd
+[cdk-npm-badge]: https://img.shields.io/npm/v/cdk-iam-floyd?label=npm&color=3178C6&logo=typescript&logoColor=white
+[cdk-pypi]: https://pypi.org/project/cdk-iam-floyd/
+[cdk-pypi-badge]: https://img.shields.io/pypi/v/cdk-iam-floyd?label=PyPI&color=3776AB&logo=python&logoColor=white
+[cdk-maven]: https://central.sonatype.com/artifact/com.udondan/cdk-iam-floyd
+[cdk-maven-badge]: https://img.shields.io/maven-central/v/com.udondan/cdk-iam-floyd?label=Maven%20Central&color=ED8B00&logo=openjdk&logoColor=white
+[cdk-nuget]: https://www.nuget.org/packages/CDK.IAM.Floyd
+[cdk-nuget-badge]: https://img.shields.io/nuget/v/CDK.IAM.Floyd?label=NuGet&color=512BD4&logo=dotnet&logoColor=white
+[go]: https://pkg.go.dev/udondan.github.io/iam-floyd/go/iamfloyd
+[cdk-go]: https://pkg.go.dev/udondan.github.io/iam-floyd/go/cdkiamfloyd
+[go-badge]: https://img.shields.io/github/v/release/udondan/iam-floyd?label=Go&color=00ADD8&logo=go&logoColor=white

package/doc8.ini

@@ -0,0 +1,3 @@
+[doc8]
+# Prose isn't wrapped
+ignore = D001

package/dotnet/src/IAM.Floyd/IAM.Floyd.csproj

@@ -0,0 +1,36 @@
+<!--
+  The native .NET package of iam-floyd. Most of the sources are written by bin/transpile.ts.
+  `make package-native` packs it with the version of package.json into dist/iam-floyd/dotnet.
+-->
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <LangVersion>12</LangVersion>
+    <Nullable>disable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <RootNamespace>IAM.Floyd</RootNamespace>
+    <AssemblyName>IAM.Floyd</AssemblyName>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <!-- protected members have no documentation -->
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
+    <Deterministic>true</Deterministic>
+    <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
+
+    <Version>0.0.0</Version>
+    <PackageId>IAM.Floyd</PackageId>
+    <Title>iam-floyd</Title>
+    <Description>AWS IAM policy statement generator with fluent interface</Description>
+    <Authors>Daniel Schroeder</Authors>
+    <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
+    <PackageProjectUrl>https://github.com/udondan/iam-floyd</PackageProjectUrl>
+    <RepositoryUrl>https://github.com/udondan/iam-floyd.git</RepositoryUrl>
+    <RepositoryType>git</RepositoryType>
+    <PackageTags>aws;iam;policy;statement;generator</PackageTags>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <None Include="../../README.md" Pack="true" PackagePath="/" />
+    <None Include="../../../LICENSE" Pack="true" PackagePath="/" />
+  </ItemGroup>
+</Project>