@actsecurity/iam-policy 0.1.109

package/dist/cjs/validate/validateTypes.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateIdentityPolicy = validateIdentityPolicy;
+exports.validateServiceControlPolicy = validateServiceControlPolicy;
+exports.validateResourcePolicy = validateResourcePolicy;
+exports.validateResourceControlPolicy = validateResourceControlPolicy;
+exports.validateTrustPolicy = validateTrustPolicy;
+exports.validateEndpointPolicy = validateEndpointPolicy;
+exports.validateSessionPolicy = validateSessionPolicy;
+const validate_js_1 = require("./validate.js");
+/**
+ * Validates an Identity Policy attached to an IAM role or user, or managed policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateIdentityPolicy(policy) {
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'an identity policy statement';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Service Control Policy (SCP)
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateServiceControlPolicy(policy) {
+    const policyType = 'a service control policy';
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Resource Policy attached to an S3 bucket, SQS queue, or other resource. \
+ *
+ * This is very generic and will not be able to validate all resource policies.
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateResourcePolicy(policy) {
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a resource policy';
+            const errors = [];
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a Resource Control Policy (RCP)
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateResourceControlPolicy(policy) {
+    const policyType = 'a resource control policy';
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateVersion: (version, path) => {
+            if (version !== '2012-10-17') {
+                return [
+                    {
+                        path: version === undefined ? path : `Version`,
+                        message: `Version must be "2012-10-17" in ${policyType}`
+                    }
+                ];
+            }
+            return [];
+        },
+        validateStatement: (statement, path) => {
+            const errors = [];
+            if (statement.Effect !== 'Deny') {
+                errors.push({
+                    path: `${path}.Effect`,
+                    message: `Effect must be "Deny" in ${policyType}`
+                });
+            }
+            if (statement.Principal !== '*') {
+                errors.push({
+                    path: statement.Principal == undefined ? path : `${path}.Principal`,
+                    message: `Principal must be "*" in ${policyType}`
+                });
+            }
+            errors.push(...validateProhibitedFields(statement, ['NotPrincipal', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        },
+        validateAction: (action, path) => {
+            if (action === '*') {
+                return [
+                    {
+                        path,
+                        message: `Action cannot be "*" in ${policyType}`
+                    }
+                ];
+            }
+            return [];
+        }
+    });
+}
+/**
+ * Validates a Trust Policy attached to a role
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateTrustPolicy(policy) {
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a trust policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Resource', 'NotResource'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates an VPC Endpoint Policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateEndpointPolicy(policy) {
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'an endpoint policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Principal'], path, policyType));
+            if (statement.Principal && statement.Principal !== '*') {
+                errors.push({
+                    message: `Principal must be "*" in ${policyType}`,
+                    path: `${path}.Principal`
+                });
+            }
+            return errors;
+        }
+    });
+}
+/**
+ * Validates a session policy
+ *
+ * @param policy the policy to validate
+ * @returns an array of validation errors
+ */
+function validateSessionPolicy(policy) {
+    return (0, validate_js_1.validatePolicySyntax)(policy, {
+        validateStatement: (statement, path) => {
+            const policyType = 'a session policy';
+            const errors = [];
+            errors.push(...validateProhibitedFields(statement, ['Principal', 'NotPrincipal'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Action', 'NotAction'], path, policyType));
+            errors.push(...validateAtLeastOneOf(statement, ['Resource', 'NotResource'], path, policyType));
+            return errors;
+        }
+    });
+}
+/**
+ * Validates that at least one of the specified fields is present in a statement
+ *
+ * @param statement the statement to validate
+ * @param requiredFields the list of fields, that at least one must be present
+ * @param path the path to the statement in the policy
+ * @param policyType the type of policy being validated
+ * @returns an array of validation errors
+ */
+function validateAtLeastOneOf(statement, requiredFields, path, policyType) {
+    const presentFields = requiredFields.filter((field) => statement[field]);
+    let message = `One of ${requiredFields.join(' or ')} is required in ${policyType}`;
+    if (requiredFields.length === 1) {
+        message = `${requiredFields[0]} is required in ${policyType}`;
+    }
+    if (presentFields.length === 0) {
+        return [
+            {
+                path,
+                message
+            }
+        ];
+    }
+    return [];
+}
+/**
+ * Validates prohibited fields do not exist in a statement
+ *
+ * @param statement the statement to validate
+ * @param prohibitedFields the list of fields that are not allowed
+ * @param path the path to the statement in the policy
+ * @param policyType the type of policy being validated
+ * @returns an array of validation errors
+ */
+function validateProhibitedFields(statement, prohibitedFields, path, policyType) {
+    const errors = [];
+    for (const field of prohibitedFields) {
+        if (statement[field]) {
+            errors.push({
+                path: `${path}.#${field}`,
+                message: `${field} is not allowed in ${policyType}`
+            });
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=validateTypes.js.map

package/dist/cjs/validate/validateTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateTypes.js","sourceRoot":"","sources":["../../../src/validate/validateTypes.ts"],"names":[],"mappings":";;AAQA,wDAaC;AAQD,oEAeC;AAUD,wDASC;AAQD,sEAoDC;AAQD,kDAeC;AAQD,wDAkBC;AAQD,sDAaC;AAjMD,+CAA0E;AAE1E;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,MAAW;IAChD,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,8BAA8B,CAAA;YACjD,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAAC,MAAW;IACtD,MAAM,UAAU,GAAG,0BAA0B,CAAA;IAE7C,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAE9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,MAAW;IAChD,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,mBAAmB,CAAA;YACtC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,6BAA6B,CAAC,MAAW;IACvD,MAAM,UAAU,GAAG,2BAA2B,CAAA;IAE9C,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,eAAe,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACjC,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,OAAO;oBACL;wBACE,IAAI,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;wBAC9C,OAAO,EAAE,mCAAmC,UAAU,EAAE;qBACzD;iBACF,CAAA;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC;QACD,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YAEpC,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,GAAG,IAAI,SAAS;oBACtB,OAAO,EAAE,4BAA4B,UAAU,EAAE;iBAClD,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY;oBACnE,OAAO,EAAE,4BAA4B,UAAU,EAAE;iBAClD,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC7E,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;QAED,cAAc,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;YAC/B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO;oBACL;wBACE,IAAI;wBACJ,OAAO,EAAE,2BAA2B,UAAU,EAAE;qBACjD;iBACF,CAAA;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,MAAW;IAC7C,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,gBAAgB,CAAA;YACnC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACtF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CACT,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACpF,CAAA;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,MAAW;IAChD,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,oBAAoB,CAAA;YACvC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YACvF,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAChF,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,4BAA4B,UAAU,EAAE;oBACjD,IAAI,EAAE,GAAG,IAAI,YAAY;iBAC1B,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,MAAW;IAC/C,OAAO,IAAA,kCAAoB,EAAC,MAAM,EAAE;QAClC,iBAAiB,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,UAAU,GAAG,kBAAkB,CAAA;YACrC,MAAM,MAAM,GAAsB,EAAE,CAAA;YACpC,MAAM,CAAC,IAAI,CACT,GAAG,wBAAwB,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CACxF,CAAA;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC1F,MAAM,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;YAC9F,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAC3B,SAAc,EACd,cAAwB,EACxB,IAAY,EACZ,UAAkB;IAElB,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,IAAI,OAAO,GAAG,UAAU,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,UAAU,EAAE,CAAA;IAClF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,mBAAmB,UAAU,EAAE,CAAA;IAC/D,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL;gBACE,IAAI;gBACJ,OAAO;aACR;SACF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAC/B,SAAc,EACd,gBAA0B,EAC1B,IAAY,EACZ,UAAkB;IAElB,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE;gBACzB,OAAO,EAAE,GAAG,KAAK,sBAAsB,UAAU,EAAE;aACpD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/cjs/validatedPolicy.d.ts

@@ -0,0 +1,40 @@
+import type { ValidationError } from './validate/validate.js';
+/**
+ * A policy document that has been validated. Carries the raw policy document,
+ * optional metadata, and the validation result so that downstream consumers
+ * can skip re-validation.
+ *
+ * Every field is a plain value — no class instances — so the entire object
+ * survives JSON serialization (e.g. through SharedArrayBuffer) unchanged.
+ */
+export interface ValidatedPolicy<T = undefined> {
+    /** Discriminant for runtime detection via {@link isValidatedPolicy}. */
+    readonly __validated: true;
+    /** The raw policy JSON document. */
+    readonly policyDocument: any;
+    /** Optional metadata carried through to {@link loadPolicy} (e.g. `{ name: string }` for error reporting). */
+    readonly metadata?: T;
+    /** Validation errors. An empty array means the policy is valid. */
+    readonly errors: readonly ValidationError[];
+}
+/**
+ * Validates a policy document using the provided validation function and
+ * bundles the result with the raw document and optional metadata.
+ *
+ * The caller chooses the validation function, so this factory is agnostic
+ * to the policy type (identity, SCP, RCP, resource, trust, endpoint, etc.).
+ *
+ * @param policyDocument the raw policy JSON document
+ * @param validateFn a validation function that returns an array of errors (empty if valid)
+ * @param metadata optional metadata to carry with the validated policy
+ * @returns a ValidatedPolicy containing the raw document, metadata, and validation errors
+ */
+export declare function createValidatedPolicy<T = undefined>(policyDocument: any, validateFn: (policy: any) => ValidationError[], metadata?: T): ValidatedPolicy<T>;
+/**
+ * Type guard that checks whether a value is a {@link ValidatedPolicy}.
+ *
+ * @param value the value to check
+ * @returns true if the value is a ValidatedPolicy
+ */
+export declare function isValidatedPolicy(value: any): value is ValidatedPolicy;
+//# sourceMappingURL=validatedPolicy.d.ts.map

package/dist/cjs/validatedPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validatedPolicy.d.ts","sourceRoot":"","sources":["../../src/validatedPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,SAAS;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;IAE1B,oCAAoC;IACpC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAA;IAE5B,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAErB,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,GAAG,SAAS,EACjD,cAAc,EAAE,GAAG,EACnB,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,KAAK,eAAe,EAAE,EAC9C,QAAQ,CAAC,EAAE,CAAC,GACX,eAAe,CAAC,CAAC,CAAC,CAGpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,GAAG,KAAK,IAAI,eAAe,CAEtE"}

package/dist/cjs/validatedPolicy.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createValidatedPolicy = createValidatedPolicy;
+exports.isValidatedPolicy = isValidatedPolicy;
+/**
+ * Validates a policy document using the provided validation function and
+ * bundles the result with the raw document and optional metadata.
+ *
+ * The caller chooses the validation function, so this factory is agnostic
+ * to the policy type (identity, SCP, RCP, resource, trust, endpoint, etc.).
+ *
+ * @param policyDocument the raw policy JSON document
+ * @param validateFn a validation function that returns an array of errors (empty if valid)
+ * @param metadata optional metadata to carry with the validated policy
+ * @returns a ValidatedPolicy containing the raw document, metadata, and validation errors
+ */
+function createValidatedPolicy(policyDocument, validateFn, metadata) {
+    const errors = validateFn(policyDocument);
+    return { __validated: true, policyDocument, metadata, errors };
+}
+/**
+ * Type guard that checks whether a value is a {@link ValidatedPolicy}.
+ *
+ * @param value the value to check
+ * @returns true if the value is a ValidatedPolicy
+ */
+function isValidatedPolicy(value) {
+    return !!value && value.__validated === true;
+}
+//# sourceMappingURL=validatedPolicy.js.map

package/dist/cjs/validatedPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validatedPolicy.js","sourceRoot":"","sources":["../../src/validatedPolicy.ts"],"names":[],"mappings":";;AAoCA,sDAOC;AAQD,8CAEC;AA7BD;;;;;;;;;;;GAWG;AACH,SAAgB,qBAAqB,CACnC,cAAmB,EACnB,UAA8C,EAC9C,QAAY;IAEZ,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACzC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,KAAU;IAC1C,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAA;AAC9C,CAAC"}

package/dist/esm/actions/action.d.ts

@@ -0,0 +1,68 @@
+export type ActionType = 'service' | 'wildcard';
+/**
+ * An Action string in an IAM policy
+ */
+export interface Action {
+    /**
+     * The type of actions
+     */
+    type(): ActionType;
+    /**
+     * The raw string of the action
+     */
+    value(): string;
+    /**
+     * Whether the action is a wildcard action: `"*"`
+     */
+    isWildcardAction(): this is WildcardAction;
+    /**
+     * Whether the action is a service action: `"service:Action"`
+     */
+    isServiceAction(): this is ServiceAction;
+    /**
+     * The path to the action string in the policy
+     */
+    path(): string;
+}
+/**
+ * A wildcard action: `"*"`
+ */
+export interface WildcardAction extends Action {
+    /**
+     * The wildcard character `"*"`
+     *
+     * This mainly exists to differentiate between this interface and the Action interface
+     */
+    wildcardValue(): '*';
+}
+/**
+ * A service action: `"service:Action"`
+ */
+export interface ServiceAction extends Action {
+    /**
+     * The service of the action
+     *
+     * Guaranteed to be lowercase
+     */
+    service(): string;
+    /**
+     * The action within the service
+     */
+    action(): string;
+}
+export declare class ActionImpl implements Action, WildcardAction, ServiceAction {
+    private readonly rawValue;
+    private readonly otherProps;
+    constructor(rawValue: string, otherProps: {
+        path: string;
+    });
+    path(): string;
+    type(): ActionType;
+    wildcardValue(): '*';
+    value(): string;
+    isWildcardAction(): this is WildcardAction;
+    isServiceAction(): this is ServiceAction;
+    service(): string;
+    action(): string;
+}
+//# sourceMappingURL=action.d.ts.map

package/dist/esm/actions/action.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/actions/action.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;AAE/C;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB;;OAEG;IACH,IAAI,IAAI,UAAU,CAAA;IAElB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;IAEf;;OAEG;IACH,gBAAgB,IAAI,IAAI,IAAI,cAAc,CAAA;IAE1C;;OAEG;IACH,eAAe,IAAI,IAAI,IAAI,aAAa,CAAA;IAExC;;OAEG;IACH,IAAI,IAAI,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,MAAM;IAC5C;;;;OAIG;IACH,aAAa,IAAI,GAAG,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C;;;;OAIG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,MAAM,IAAI,MAAM,CAAA;CACjB;AAED,qBAAa,UAAW,YAAW,MAAM,EAAE,cAAc,EAAE,aAAa;IAEpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE;QAC3B,IAAI,EAAE,MAAM,CAAA;KACb;IAGI,IAAI,IAAI,MAAM;IAId,IAAI,IAAI,UAAU;IAOlB,aAAa,IAAI,GAAG;IAIpB,KAAK,IAAI,MAAM;IAIf,gBAAgB,IAAI,IAAI,IAAI,cAAc;IAI1C,eAAe,IAAI,IAAI,IAAI,aAAa;IAIxC,OAAO,IAAI,MAAM;IAIjB,MAAM,IAAI,MAAM;CAGxB"}

package/dist/esm/actions/action.js

@@ -0,0 +1,35 @@
+import { delimitedSegmentAt, isAllWildcards } from '../utils.js';
+export class ActionImpl {
+    constructor(rawValue, otherProps) {
+        this.rawValue = rawValue;
+        this.otherProps = otherProps;
+    }
+    path() {
+        return this.otherProps.path;
+    }
+    type() {
+        if (isAllWildcards(this.rawValue)) {
+            return 'wildcard';
+        }
+        return 'service';
+    }
+    wildcardValue() {
+        return '*';
+    }
+    value() {
+        return this.rawValue;
+    }
+    isWildcardAction() {
+        return this.type() === 'wildcard';
+    }
+    isServiceAction() {
+        return this.type() === 'service';
+    }
+    service() {
+        return delimitedSegmentAt(this.rawValue, ':', 0).toLowerCase();
+    }
+    action() {
+        return delimitedSegmentAt(this.rawValue, ':', 1);
+    }
+}
+//# sourceMappingURL=action.js.map

package/dist/esm/actions/action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../../../src/actions/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AA+DhE,MAAM,OAAO,UAAU;IACrB,YACmB,QAAgB,EAChB,UAEhB;QAHgB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,eAAU,GAAV,UAAU,CAE1B;IACA,CAAC;IAEG,IAAI;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAA;IAC7B,CAAC;IAEM,IAAI;QACT,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,aAAa;QAClB,OAAO,GAAG,CAAA;IACZ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAEM,gBAAgB;QACrB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,UAAU,CAAA;IACnC,CAAC;IAEM,eAAe;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAA;IAClC,CAAC;IAEM,OAAO;QACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;IACjE,CAAC;IAEM,MAAM;QACX,OAAO,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAE,CAAA;IACnD,CAAC;CACF"}

package/dist/esm/conditions/condition.d.ts

@@ -0,0 +1,62 @@
+import { type ConditionOperation } from './conditionOperation.js';
+export interface Condition {
+    /**
+     * Returns the operation of the condition. For example "StringEquals" or "StringLike".
+     *
+     * @returns the operation of the condition.
+     */
+    operation(): ConditionOperation;
+    /**
+     * Returns the key of the condition. For example "aws:PrincipalOrgID".
+     *
+     * @returns the condition key of the action
+     */
+    conditionKey(): string;
+    /**
+     * Returns the values of the condition. For example ["o-1234567890abcdef0"].
+     * Boolean literals in the policy are converted to their string equivalents.
+     *
+     * @returns the values of the condition.
+     */
+    conditionValues(): string[];
+    /**
+     * Checks if the the condition values are an array.
+     *
+     * @returns true if the condition values are an array, false otherwise.
+     */
+    valueIsArray(): boolean;
+    /**
+     * Returns the path to the operator key in the policy.
+     */
+    operatorKeyPath(): string;
+    /**
+     * Returns the path to the operator value in the policy.
+     */
+    operatorValuePath(): string;
+    /**
+     * Returns the path to the condition key for the policy.
+     */
+    keyPath(): string;
+    /**
+     * Returns the path to the condition values in the policy.
+     */
+    valuesPath(): string;
+}
+export declare class ConditionImpl implements Condition {
+    private readonly op;
+    private readonly key;
+    private readonly values;
+    private readonly otherProps;
+    constructor(op: string, key: string, values: string | boolean | (string | boolean)[], otherProps: {
+        conditionPath: string;
+    });
+    operation(): ConditionOperation;
+    conditionKey(): string;
+    conditionValues(): string[];
+    valueIsArray(): boolean;
+    operatorKeyPath(): string;
+    operatorValuePath(): string;
+    keyPath(): string;
+    valuesPath(): string;
+}
+//# sourceMappingURL=condition.d.ts.map

package/dist/esm/conditions/condition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.d.ts","sourceRoot":"","sources":["../../../src/conditions/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,kBAAkB,EAA0B,MAAM,yBAAyB,CAAA;AAEzF,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,SAAS,IAAI,kBAAkB,CAAA;IAE/B;;;;OAIG;IACH,YAAY,IAAI,MAAM,CAAA;IAEtB;;;;;OAKG;IACH,eAAe,IAAI,MAAM,EAAE,CAAA;IAE3B;;;;OAIG;IACH,YAAY,IAAI,OAAO,CAAA;IAEvB;;OAEG;IACH,eAAe,IAAI,MAAM,CAAA;IAEzB;;OAEG;IACH,iBAAiB,IAAI,MAAM,CAAA;IAE3B;;OAEG;IACH,OAAO,IAAI,MAAM,CAAA;IAEjB;;OAEG;IACH,UAAU,IAAI,MAAM,CAAA;CACrB;AAED,qBAAa,aAAc,YAAW,SAAS;IAE3C,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAHV,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,EAC/C,UAAU,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAA;KACtB;IAGI,SAAS,IAAI,kBAAkB;IAI/B,YAAY,IAAI,MAAM;IAItB,eAAe,IAAI,MAAM,EAAE;IAK3B,YAAY,IAAI,OAAO;IAIvB,eAAe,IAAI,MAAM;IAIzB,iBAAiB,IAAI,MAAM;IAI3B,OAAO,IAAI,MAAM;IAIjB,UAAU,IAAI,MAAM;CAG5B"}

package/dist/esm/conditions/condition.js

@@ -0,0 +1,35 @@
+import { ConditionOperationImpl } from './conditionOperation.js';
+export class ConditionImpl {
+    constructor(op, key, values, otherProps) {
+        this.op = op;
+        this.key = key;
+        this.values = values;
+        this.otherProps = otherProps;
+    }
+    operation() {
+        return new ConditionOperationImpl(this.op);
+    }
+    conditionKey() {
+        return this.key;
+    }
+    conditionValues() {
+        const values = Array.isArray(this.values) ? this.values : [this.values];
+        return values.map((v) => String(v));
+    }
+    valueIsArray() {
+        return Array.isArray(this.values);
+    }
+    operatorKeyPath() {
+        return `${this.otherProps.conditionPath}.#${this.op}`;
+    }
+    operatorValuePath() {
+        return `${this.otherProps.conditionPath}.${this.op}`;
+    }
+    keyPath() {
+        return `${this.otherProps.conditionPath}.${this.op}.#${this.key}`;
+    }
+    valuesPath() {
+        return `${this.otherProps.conditionPath}.${this.op}.${this.key}`;
+    }
+}
+//# sourceMappingURL=condition.js.map

package/dist/esm/conditions/condition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"condition.js","sourceRoot":"","sources":["../../../src/conditions/condition.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAqDzF,MAAM,OAAO,aAAa;IACxB,YACmB,EAAU,EACV,GAAW,EACX,MAA+C,EAC/C,UAEhB;QALgB,OAAE,GAAF,EAAE,CAAQ;QACV,QAAG,GAAH,GAAG,CAAQ;QACX,WAAM,GAAN,MAAM,CAAyC;QAC/C,eAAU,GAAV,UAAU,CAE1B;IACA,CAAC;IAEG,SAAS;QACd,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5C,CAAC;IAEM,YAAY;QACjB,OAAO,IAAI,CAAC,GAAG,CAAA;IACjB,CAAC;IAEM,eAAe;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC;IAEM,YAAY;QACjB,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAEM,eAAe;QACpB,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,KAAK,IAAI,CAAC,EAAE,EAAE,CAAA;IACvD,CAAC;IAEM,iBAAiB;QACtB,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,EAAE,CAAA;IACtD,CAAC;IAEM,OAAO;QACZ,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAA;IACnE,CAAC;IAEM,UAAU;QACf,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IAClE,CAAC;CACF"}

package/dist/esm/conditions/conditionOperation.d.ts

@@ -0,0 +1,31 @@
+export type SetOperator = 'ForAllValues' | 'ForAnyValue';
+/**
+ * ConditionOperation is a string that represents the operation of a condition.
+ */
+export interface ConditionOperation {
+    /**
+     * Returns the set modifier if present.
+     */
+    setOperator(): SetOperator | undefined;
+    /**
+     * Returns the base operator of the condition without the set modifier or IfExists.
+     */
+    baseOperator(): string;
+    /**
+     * Returns true if the condition operation ends with IfExists.
+     */
+    isIfExists(): boolean;
+    /**
+     * Returns the raw string of the condition operation.
+     */
+    value(): string;
+}
+export declare class ConditionOperationImpl implements ConditionOperation {
+    private readonly op;
+    constructor(op: string);
+    setOperator(): SetOperator | undefined;
+    isIfExists(): boolean;
+    baseOperator(): string;
+    value(): string;
+}
+//# sourceMappingURL=conditionOperation.d.ts.map

package/dist/esm/conditions/conditionOperation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditionOperation.d.ts","sourceRoot":"","sources":["../../../src/conditions/conditionOperation.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,aAAa,CAAA;AAExD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,WAAW,IAAI,WAAW,GAAG,SAAS,CAAA;IAEtC;;OAEG;IACH,YAAY,IAAI,MAAM,CAAA;IAEtB;;OAEG;IACH,UAAU,IAAI,OAAO,CAAA;IAErB;;OAEG;IACH,KAAK,IAAI,MAAM,CAAA;CAChB;AAID,qBAAa,sBAAuB,YAAW,kBAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,MAAM;IAEhC,WAAW,IAAI,WAAW,GAAG,SAAS;IAatC,UAAU,IAAI,OAAO;IAIrB,YAAY,IAAI,MAAM;IAQtB,KAAK,IAAI,MAAM;CAGvB"}

package/dist/esm/conditions/conditionOperation.js

@@ -0,0 +1,34 @@
+import { caseInsensitiveEndsWith, caseInsensitiveEquals, delimitedSegmentAt, lastDelimitedSegment } from '../utils.js';
+const ifExistsSlice = 'IfExists'.length * -1;
+export class ConditionOperationImpl {
+    constructor(op) {
+        this.op = op;
+    }
+    setOperator() {
+        if (!this.op.includes(':')) {
+            return undefined;
+        }
+        const setOp = delimitedSegmentAt(this.op, ':', 0);
+        if (caseInsensitiveEquals(setOp, 'ForAllValues')) {
+            return 'ForAllValues';
+        }
+        else if (caseInsensitiveEquals(setOp, 'ForAnyValue')) {
+            return 'ForAnyValue';
+        }
+        throw new Error(`Unknown set operator: ${setOp}`);
+    }
+    isIfExists() {
+        return caseInsensitiveEndsWith(this.op, 'IfExists');
+    }
+    baseOperator() {
+        const base = lastDelimitedSegment(this.op, ':');
+        if (caseInsensitiveEndsWith(base, 'IfExists')) {
+            return base.slice(0, ifExistsSlice);
+        }
+        return base;
+    }
+    value() {
+        return this.op;
+    }
+}
+//# sourceMappingURL=conditionOperation.js.map

package/dist/esm/conditions/conditionOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditionOperation.js","sourceRoot":"","sources":["../../../src/conditions/conditionOperation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,aAAa,CAAA;AA6BpB,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAE5C,MAAM,OAAO,sBAAsB;IACjC,YAA6B,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IAEpC,WAAW;QAChB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAE,CAAA;QAClD,IAAI,qBAAqB,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;YACjD,OAAO,cAAc,CAAA;QACvB,CAAC;aAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YACvD,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;IAEM,UAAU;QACf,OAAO,uBAAuB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;IACrD,CAAC;IAEM,YAAY;QACjB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/C,IAAI,uBAAuB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QACrC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;CACF"}

package/dist/esm/index.d.ts

@@ -0,0 +1,13 @@
+export type { Action, ActionType, ServiceAction, WildcardAction } from './actions/action.js';
+export type { Condition } from './conditions/condition.js';
+export type { ConditionOperation, SetOperator } from './conditions/conditionOperation.js';
+export { loadPolicy } from './parser.js';
+export type { Policy } from './policies/policy.js';
+export type { AccountPrincipal, AwsPrincipal, CanonicalUserPrincipal, FederatedPrincipal, Principal, PrincipalType, ServicePrincipal, WildcardPrincipal } from './principals/principal.js';
+export type { Resource, ArnResource } from './resources/resource.js';
+export type { ActionStatement, NotActionStatement, NotPrincipalStatement, NotResourceStatement, PrincipalStatement, ResourceStatement, Statement } from './statements/statement.js';
+export { lintPolicy, lintResourcePolicy } from './lint/lint.js';
+export { createValidatedPolicy, isValidatedPolicy, type ValidatedPolicy } from './validatedPolicy.js';
+export { validatePolicySyntax, type ValidationError } from './validate/validate.js';
+export { validateEndpointPolicy, validateIdentityPolicy, validateResourceControlPolicy, validateResourcePolicy, validateServiceControlPolicy, validateSessionPolicy, validateTrustPolicy } from './validate/validateTypes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC5F,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAC1D,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACpE,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACV,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACnF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,6BAA6B,CAAA"}

package/dist/esm/index.js

@@ -0,0 +1,6 @@
+export { loadPolicy } from './parser.js';
+export { lintPolicy, lintResourcePolicy } from './lint/lint.js';
+export { createValidatedPolicy, isValidatedPolicy } from './validatedPolicy.js';
+export { validatePolicySyntax } from './validate/validate.js';
+export { validateEndpointPolicy, validateIdentityPolicy, validateResourceControlPolicy, validateResourcePolicy, validateServiceControlPolicy, validateSessionPolicy, validateTrustPolicy } from './validate/validateTypes.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAsBxC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EAElB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,oBAAoB,EAAwB,MAAM,wBAAwB,CAAA;AACnF,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,6BAA6B,CAAA"}