@actsecurity/iam-policy 0.1.109

package/dist/esm/validate/validateTypes.js

@@ -0,0 +1,215 @@
+import { validatePolicySyntax } from './validate.js';
+/**
+ * Validates an Identity Policy attached to an IAM role or user, or managed policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateIdentityPolicy(policy) {
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'an identity policy statement';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Service Control Policy (SCP)
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateServiceControlPolicy(policy) {
+    const policyType = 'a service control policy';
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Resource Policy attached to an S3 bucket, SQS queue, or other resource. \
+ *
+ * This is very generic and will not be able to validate all resource policies.
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateResourcePolicy(policy) {
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a resource policy';
+            const errors = [];
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Resource Control Policy (RCP)
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateResourceControlPolicy(policy) {
+    const policyType = 'a resource control policy';
+    return validatePolicySyntax(policy, {
+        validateVersion: (version, path) => {
+            if (version !== '2012-10-17') {
+                return [
+                    {
+                        path: version === undefined ? path : `Version`,
+                        message: `Version must be "2012-10-17" in ${policyType}`
+                    }
+                ];
+            }
+            return [];
+        },
+        validateStatement: (statement, path) => {
+            const errors = [];
+            if (statement.Effect !== 'Deny') {
+                errors.push({
+                    path: `${path}.Effect`,
+                    message: `Effect must be "Deny" in ${policyType}`
+                });
+            }
+            if (statement.Principal !== '*') {
+                errors.push({
+                    path: statement.Principal == undefined ? path : `${path}.Principal`,
+                    message: `Principal must be "*" in ${policyType}`
+                });
+            }
+            errors.push(...validateProhibitedFields(statement, ['NotPrincipal', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        },
+        validateAction: (action, path) => {
+            if (action === '*') {
+                return [
+                    {
+                        path,
+                        message: `Action cannot be "*" in ${policyType}`
+                    }
+                ];
+            }
+            return [];
+        }
+    });
+}
+/**
+ * Validates a Trust Policy attached to a role
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateTrustPolicy(policy) {
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a trust policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Resource', 'NotResource'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates an VPC Endpoint Policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateEndpointPolicy(policy) {
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'an endpoint policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Principal'], path, policyType));
+            if (statement.Principal && statement.Principal !== '*') {
+                errors.push({
+                    message: `Principal must be "*" in ${policyType}`,
+                    path: `${path}.Principal`
+                });
+            }
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a session policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+export function validateSessionPolicy(policy) {
+    return validatePolicySyntax(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a session policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates that at least one of the specified fields is present in a statement
+ *
+ * @param statement the statement to validate
+ * @param requiredFields the list of fields, that at least one must be present
+ * @param path the path to the statement in the policy
+ * @param policyType the type of policy being validated
+ * @returns an array of validation errors
+ */
+function validateAtLeastOneOf(statement, requiredFields, path, policyType) {
+    const presentFields = requiredFields.filter((field) => statement[field]);
+    let message = `One of ${requiredFields.join(' or ')} is required in ${policyType}`;
+    if (requiredFields.length === 1) {
+        message = `${requiredFields[0]} is required in ${policyType}`;
+    }
+    if (presentFields.length === 0) {
+        return [
+            {
+                path,
+                message
+            }
+        ];
+    }
+    return [];
+}
+/**
+ * Validates prohibited fields do not exist in a statement
+ *
+ * @param statement the statement to validate
+ * @param prohibitedFields the list of fields that are not allowed
+ * @param path the path to the statement in the policy
+ * @param policyType the type of policy being validated
+ * @returns an array of validation errors
+ */
+function validateProhibitedFields(statement, prohibitedFields, path, policyType) {
+    const errors = [];
+    for (const field of prohibitedFields) {
+        if (statement[field]) {
+            errors.push({
+                path: `${path}.#${field}`,
+                message: `${field} is not allowed in ${policyType}`
+            });
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=validateTypes.js.map

package/dist/esm/validate/validateTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateTypes.js","sourceRoot":"","sources":["../../../src/validate/validateTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAwB,MAAM,eAAe,CAAA;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAW;IAChD,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,8BAA8B,CAAA;YACjD,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAW;IACtD,MAAM,UAAU,GAAG,0BAA0B,CAAA;IAE7C,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAE9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAW;IAChD,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,mBAAmB,CAAA;YACtC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAW;IACvD,MAAM,UAAU,GAAG,2BAA2B,CAAA;IAE9C,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,eAAe,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACjC,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,OAAO;oBACL;wBACE,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC9C,OAAO,EAAE,mCAAmC,UAAU,EAAE;qBACzD;iBACF,CAAA;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC;QACD,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YAEpC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,IAAI,SAAS;oBACtB,OAAO,EAAE,4BAA4B,UAAU,EAAE;iBAClD,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY;oBACnE,OAAO,EAAE,4BAA4B,UAAU,EAAE;iBAClD,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;QAED,cAAc,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC/B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO;oBACL;wBACE,IAAI;wBACJ,OAAO,EAAE,2BAA2B,UAAU,EAAE;qBACjD;iBACF,CAAA;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAW;IAC7C,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAA;YACnC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACtF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACpF,CAAA;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAW;IAChD,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,oBAAoB,CAAA;YACvC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YACvF,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAChF,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,4BAA4B,UAAU,EAAE;oBACjD,IAAI,EAAE,GAAG,IAAI,YAAY;iBAC1B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAW;IAC/C,OAAO,oBAAoB,CAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,kBAAkB,CAAA;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,SAAc,EACd,cAAwB,EACxB,IAAY,EACZ,UAAkB;IAElB,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,IAAI,OAAO,GAAG,UAAU,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,UAAU,EAAE,CAAA;IAClF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,mBAAmB,UAAU,EAAE,CAAA;IAC/D,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL;gBACE,IAAI;gBACJ,OAAO;aACR;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,SAAc,EACd,gBAA0B,EAC1B,IAAY,EACZ,UAAkB;IAElB,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE;gBACzB,OAAO,EAAE,GAAG,KAAK,sBAAsB,UAAU,EAAE;aACpD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/esm/validatedPolicy.d.ts

@@ -0,0 +1,40 @@
+import type { ValidationError } from './validate/validate.js';
+/**
+ * A policy document that has been validated. Carries the raw policy document,
+ * optional metadata, and the validation result so that downstream consumers
+ * can skip re-validation.
+ *
+ * Every field is a plain value — no class instances — so the entire object
+ * survives JSON serialization (e.g. through SharedArrayBuffer) unchanged.
+ */
+export interface ValidatedPolicy<T = undefined> {
+    /** Discriminant for runtime detection via {@link isValidatedPolicy}. */
+    readonly __validated: true;
+    /** The raw policy JSON document. */
+    readonly policyDocument: any;
+    /** Optional metadata carried through to {@link loadPolicy} (e.g. `{ name: string }` for error reporting). */
+    readonly metadata?: T;
+    /** Validation errors. An empty array means the policy is valid. */
+    readonly errors: readonly ValidationError[];
+}
+/**
+ * Validates a policy document using the provided validation function and
+ * bundles the result with the raw document and optional metadata.
+ *
+ * The caller chooses the validation function, so this factory is agnostic
+ * to the policy type (identity, SCP, RCP, resource, trust, endpoint, etc.).
+ *
+ * @param policyDocument the raw policy JSON document
+ * @param validateFn a validation function that returns an array of errors (empty if valid)
+ * @param metadata optional metadata to carry with the validated policy
+ * @returns a ValidatedPolicy containing the raw document, metadata, and validation errors
+ */
+export declare function createValidatedPolicy<T = undefined>(policyDocument: any, validateFn: (policy: any) => ValidationError[], metadata?: T): ValidatedPolicy<T>;
+/**
+ * Type guard that checks whether a value is a {@link ValidatedPolicy}.
+ *
+ * @param value the value to check
+ * @returns true if the value is a ValidatedPolicy
+ */
+export declare function isValidatedPolicy(value: any): value is ValidatedPolicy;
+//# sourceMappingURL=validatedPolicy.d.ts.map

package/dist/esm/validatedPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validatedPolicy.d.ts","sourceRoot":"","sources":["../../src/validatedPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,SAAS;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;IAE1B,oCAAoC;IACpC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAA;IAE5B,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAErB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,GAAG,SAAS,EACjD,cAAc,EAAE,GAAG,EACnB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,eAAe,EAAE,EAC9C,QAAQ,CAAC,EAAE,CAAC,GACX,eAAe,CAAC,CAAC,CAAC,CAGpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK,IAAI,eAAe,CAEtE"}

package/dist/esm/validatedPolicy.js

@@ -0,0 +1,26 @@
+/**
+ * Validates a policy document using the provided validation function and
+ * bundles the result with the raw document and optional metadata.
+ *
+ * The caller chooses the validation function, so this factory is agnostic
+ * to the policy type (identity, SCP, RCP, resource, trust, endpoint, etc.).
+ *
+ * @param policyDocument the raw policy JSON document
+ * @param validateFn a validation function that returns an array of errors (empty if valid)
+ * @param metadata optional metadata to carry with the validated policy
+ * @returns a ValidatedPolicy containing the raw document, metadata, and validation errors
+ */
+export function createValidatedPolicy(policyDocument, validateFn, metadata) {
+    const errors = validateFn(policyDocument);
+    return { __validated: true, policyDocument, metadata, errors };
+}
+/**
+ * Type guard that checks whether a value is a {@link ValidatedPolicy}.
+ *
+ * @param value the value to check
+ * @returns true if the value is a ValidatedPolicy
+ */
+export function isValidatedPolicy(value) {
+    return !!value && value.__validated === true;
+}
+//# sourceMappingURL=validatedPolicy.js.map

package/dist/esm/validatedPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validatedPolicy.js","sourceRoot":"","sources":["../../src/validatedPolicy.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAAmB,EACnB,UAA8C,EAC9C,QAAY;IAEZ,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACzC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAU;IAC1C,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAA;AAC9C,CAAC"}

package/package.json

@@ -0,0 +1,114 @@
+{
+  "name": "@actsecurity/iam-policy",
+  "version": "0.1.109",
+  "description": "An ORM for AWS IAM policies",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/act-security-labs/iam-policy.git"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    }
+  },
+  "files": [
+    "dist/**/*"
+  ],
+  "types": "dist/cjs/index.d.ts",
+  "scripts": {
+    "build": "npx tsc -p tsconfig.cjs.json && npx tsc -p tsconfig.esm.json && ./postbuild.sh",
+    "clean": "rm -rf dist",
+    "test": "npx vitest --run --coverage",
+    "release": "npm install && npm run clean && npm run build && npm test && npm run format-check && npm publish",
+    "format": "npx prettier --write src/",
+    "format-check": "npx prettier --check src/"
+  },
+  "keywords": [
+    "AWS",
+    "IAM"
+  ],
+  "author": "Act Security",
+  "license": "AGPL-3.0-or-later",
+  "bugs": {
+    "url": "https://github.com/act-security-labs/iam-policy/issues"
+  },
+  "homepage": "https://github.com/act-security-labs/iam-policy#readme",
+  "devDependencies": {
+    "@actsecurity/prettier-config": "^0.1.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/exec": "^7.1.0",    
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.4",
+    "@semantic-release/release-notes-generator": "^14.0.3",
+    "@types/node": "^22.5.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "semantic-release": "^25.0.3",
+    "typescript": "^5.5.4",
+    "vitest": "^4.0.18"
+  },
+  "prettier": "@actsecurity/prettier-config",
+  "release": {
+    "branches": [
+      "main"
+    ],
+    "plugins": [
+      [
+        "@semantic-release/commit-analyzer",
+        {
+          "releaseRules": [
+            {
+              "type": "feat",
+              "release": "patch"
+            },
+            {
+              "type": "fix",
+              "release": "patch"
+            },
+            {
+              "breaking": true,
+              "release": "patch"
+            },
+            {
+              "type": "*",
+              "release": "patch"
+            }
+          ]
+        }
+      ],
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      [
+        "@semantic-release/npm",
+        {
+          "npmPublish": true
+        }
+      ],
+      [
+        "@semantic-release/exec",
+        {
+          "successCmd": "echo published=true >> $GITHUB_OUTPUT && echo version=${nextRelease.version} >> $GITHUB_OUTPUT && echo package_name=$(node -p \"require('./package.json').name\") >> $GITHUB_OUTPUT"
+        }
+      ],
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "package-lock.json",
+            "CHANGELOG.md"
+          ],
+          "message": "chore(release): ${nextRelease.version} [skip ci]"
+        }
+      ],
+      [
+        "@semantic-release/github",
+        {
+          "assets": []
+        }
+      ]
+    ]
+  }
+}