@cloud-copilot/iam-shrink 0.1.0

package/dist/esm/shrink.js

@@ -0,0 +1,343 @@
+import { expandIamActions } from '@cloud-copilot/iam-expand';
+import { ShrinkValidationError } from './errors.js';
+import { validateShrinkResults } from './validate.js';
+const defaultOptions = {
+    iterations: 2
+};
+//TODO: Add stats for how many iterations were run?
+/**
+ * Shrink the list of desired patterns minus the excluded patterns to the smallest list of patterns
+ * that still includes the actions you want and only the actions you want.
+ *
+ * This will create a Target Set of actions that match the patterns in {@link desiredPatterns}, and do
+ * not match any pattern in {@link excludedPatterns}.
+ *
+ * It will then derive the list of wildcard patterns that match the Target Set and no other actions.
+ *
+ * @param desiredPatterns the list of patterns you want to include, e.g. ['s3:Get*', 's3:PutObject', 's3:*Tag*']
+ * @param iterations the number of iterations to run the shrink operations
+ * @returns the smallest list of patterns that will match only the actions specified by desiredPatterns and not match any of the excludedPatterns or any actions not specified by desiredPatterns.
+ */
+export async function shrink(desiredPatterns, shrinkOptions) {
+    //Check for an all actions wildcard
+    const wildCard = desiredPatterns.find(pattern => collapseAsterisks(pattern) === '*');
+    if (wildCard) {
+        return ["*"];
+    }
+    const options = { ...defaultOptions, ...shrinkOptions };
+    const targetActions = await expandIamActions(desiredPatterns, { expandServiceAsterisk: true });
+    const expandedActionsByService = groupActionsByService(targetActions);
+    const services = Array.from(expandedActionsByService.keys()).sort();
+    const reducedActions = [];
+    for (const service of services) {
+        const desiredActions = expandedActionsByService.get(service);
+        const possibleActions = mapActions(await expandIamActions(`${service}:*`, { expandServiceAsterisk: true }));
+        const reducedServiceActions = shrinkResolvedList(desiredActions.withoutService, possibleActions, options.iterations);
+        //Validation
+        const reducedServiceActionsWithService = reducedServiceActions.map(action => `${service}:${action}`);
+        const invalidMatch = await validateShrinkResults(desiredActions.withService, reducedServiceActionsWithService);
+        if (invalidMatch) {
+            throw new ShrinkValidationError(desiredPatterns, invalidMatch);
+        }
+        reducedActions.push(...reducedServiceActionsWithService);
+    }
+    return reducedActions;
+}
+/**
+ * Map an array of service:action strings to just the action
+ *
+ * @param actions the array of service:action strings such as ['s3:GetObject', 'ec2:DescribeInstances']
+ * @returns an array of just the action strings such as ['GetObject', 'DescribeInstances']
+ */
+export function mapActions(actions) {
+    return actions.map(action => action.split(":")[1]);
+}
+/**
+ * Groups an array of service:action strings by service
+ *
+ * Returns a map of service to an object with two arrays: withService and withoutService
+ * * withService contains the full service:action strings
+ * * withoutService contains just the action strings
+ *
+ * @param actions the array of service:action strings such as ['s3:GetObject', 'ec2:DescribeInstances']
+ * @returns a map of service to an object with two arrays: withService and withoutService
+ */
+export function groupActionsByService(actions) {
+    const serviceMap = new Map();
+    actions.forEach(actionString => {
+        const [service, action] = actionString.split(":");
+        if (!serviceMap.has(service)) {
+            serviceMap.set(service, { withService: [], withoutService: [] });
+        }
+        serviceMap.get(service).withService.push(actionString);
+        serviceMap.get(service).withoutService.push(action);
+    });
+    return serviceMap;
+}
+/**
+ * Shrink a list of desired actions to the smallest number of patterns that match the desired actions
+ * from the possible actions and no other actions.
+ *
+ * @param desiredActions the list of actions you want to include
+ * @param possibleActions the list of actions that are possible
+ * @param iterations the number of iterations to run the shrink operations
+ * @returns the smallest list of patterns that when compared to possibleActions will match only the desiredActions and no others
+ */
+export function shrinkResolvedList(desiredActions, possibleActions, iterations) {
+    const desiredActionSet = new Set(desiredActions);
+    const undesiredActions = possibleActions.filter(action => !desiredActionSet.has(action));
+    if (undesiredActions.length === 0) {
+        // If there are no undesired actions, that means we want all actions
+        return ["*"];
+    }
+    // Iteratively shrink based on the most commmon sequence until we can't shrink anymore
+    let previousActionListLength = desiredActions.length;
+    let actionList = desiredActions.slice();
+    do {
+        previousActionListLength = actionList.length;
+        actionList = shrinkIteration(actionList, undesiredActions, false);
+        iterations = iterations - 1;
+        if (iterations <= 0) {
+            return actionList;
+        }
+    } while (actionList.length < previousActionListLength);
+    // Iteratively shrink based on all common sequences until we can't shrink anymore
+    do {
+        previousActionListLength = actionList.length;
+        actionList = shrinkIteration(actionList, undesiredActions, true);
+        iterations = iterations - 1;
+        if (iterations <= 0) {
+            return actionList;
+        }
+    } while (actionList.length < previousActionListLength);
+    return actionList;
+}
+/**
+ * Shrink the list of desired actions for while excluding the undesired actions
+ *
+ * @param desiredActions the list of actions you want to include, can be a mix of full actions and wildcards
+ * @param undesiredActions the list of actions you want to exclude no matter what
+ * @param deep if true, will shrink based on all common sequences, otherwise will only shrink based on the most common sequence
+ * @returns the smallest list of actions that will match only the desiredActions and not match any of the undesiredActions or any actions not specified by desiredActions.
+ */
+export function shrinkIteration(desiredActions, undesiredActions, deep) {
+    // Find all common words in the strings in the desiredActions array
+    const commonSequences = findCommonSequences(desiredActions).filter(sequence => sequence.sequence != "*");
+    ;
+    commonSequences.sort((a, b) => {
+        return b.frequency - a.frequency;
+    });
+    const sequencesToProcess = deep ? commonSequences : commonSequences.slice(0, 1);
+    // Reduce the actions based on the common sequences
+    let reducedActions = desiredActions;
+    for (const sequence of sequencesToProcess) {
+        const reducedIteration = Array.from(new Set(reducedActions.map(action => reduceAction(action, sequence.sequence, undesiredActions))));
+        reducedActions = consolidateWildcardPatterns(reducedIteration);
+    }
+    return reducedActions;
+}
+/**
+ * Reduces a singele action into a smaller number of parts by replace one part at a time with an asterisk
+ * and validating that there are no undesired actions that match the new action
+ *
+ * @param desiredAction the action to reduce
+ * @param sequence the sequence to reduce the action by
+ * @param undesiredActions the list of actions that should not match the reduced action
+ * @returns the reduced action with as many parts replaced with asterisks as possible while still matching the desired actions and not matching any of the undesired actions
+ */
+export function reduceAction(desiredAction, sequence, undesiredActions) {
+    const testArray = splitActionIntoParts(desiredAction);
+    if (testArray.length === 1) {
+        return desiredAction;
+    }
+    const indexOfSequence = testArray.indexOf(sequence);
+    let shorterValue = desiredAction;
+    if (indexOfSequence === 0) {
+        const tempArray = testArray.slice();
+        //Iterate though ever following element and see if replacing the sequence with the first common sequence results in a failure
+        for (let i = 1; i < testArray.length; i++) {
+            tempArray[i] = "*";
+            const tempString = collapseAsterisks(tempArray.join(""));
+            const problemMatch = wildcardActionMatchesAnyString(tempString, undesiredActions);
+            if (problemMatch) {
+                // Stopping here seems to work the best
+                break;
+            }
+            shorterValue = tempString;
+        }
+        //its at the beginning
+    }
+    else if (indexOfSequence === testArray.length - 1) {
+        //its at the end
+        const tempArray = testArray.slice();
+        //Iterate through the array backwards and see if replace the items with * results in a failure
+        for (let i = testArray.length - 2; i >= 0; i--) {
+            tempArray[i] = "*";
+            const tempString = collapseAsterisks(tempArray.join(""));
+            const problemMatch = wildcardActionMatchesAnyString(tempString, undesiredActions);
+            if (problemMatch) {
+                // Stopping here seems to work the best
+                break;
+            }
+            shorterValue = tempString;
+        }
+    }
+    else if (indexOfSequence > 0) {
+        //its in the middle
+        const tempArray = testArray.slice();
+        //Iterate forward through the array and see if replacing the items with * results in a failure
+        for (let i = indexOfSequence + 1; i < testArray.length; i++) {
+            tempArray[i] = "*";
+            const tempString = collapseAsterisks(tempArray.join(""));
+            const problemMatch = wildcardActionMatchesAnyString(tempString, undesiredActions);
+            if (problemMatch) {
+                //This replacement cased a prolem match, so revert it before going backwards in the strings
+                tempArray[i] = testArray[i];
+                // Stopping here seems to work the best
+                break;
+            }
+            shorterValue = tempString;
+        }
+        //Iterate through the array backwards and see if replace the items with * results in a failure
+        for (let i = indexOfSequence - 1; i >= 0; i--) {
+            tempArray[i] = "*";
+            const tempString = collapseAsterisks(tempArray.join(""));
+            const problemMatch = wildcardActionMatchesAnyString(tempString, undesiredActions);
+            if (problemMatch) {
+                // Stopping here seems to work the best
+                break;
+            }
+            shorterValue = tempString;
+        }
+    }
+    return shorterValue;
+}
+/**
+ * Consolidate multile consecutive asterisks into a single asterisk
+ *
+ * @param wildcardAction the action to collapse
+ * @returns the action with consecutive asterisks collapsed into a single asterisk
+ */
+export function collapseAsterisks(wildcardAction) {
+    return wildcardAction.replace(/\*+/g, '*');
+}
+/**
+ * Convert a wildcard action into a regular expression
+ *
+ * @param wildcardAction the wildcard action to convert
+ * @returns a regular expression that will match the wildcard action
+ */
+export function regexForWildcardAction(wildcardAction) {
+    wildcardAction = collapseAsterisks(wildcardAction);
+    const pattern = "^" + wildcardAction.replace(/\*/g, '.*?') + "$";
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Checks to see if a wildcard action matches any of the strings in a list
+ *
+ * @param wildcardAction the wildcard action to check
+ * @param strings the list of strings to check against
+ * @returns true if the wildcard action matches any of the strings
+ */
+export function wildcardActionMatchesAnyString(wildcardAction, strings) {
+    const regex = regexForWildcardAction(wildcardAction);
+    for (const string of strings) {
+        if (regex.test(string)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Split an IAM Action into parts based on capital letters and asterisks
+ * For a new part to start there must be a transition from a lowercase letter to an uppercase letter or an asterisk
+ * For example :
+ * * "CreateAccessPointForObjectLambda" would be split into ["Create", "Access", "Point", "For", "Object", "Lambda"]
+ * * "*ObjectTagging*" would be split into ["*", "Object", "Tagging", "*"]
+ *
+ * @param input the IAM Action to split
+ * @returns the parts of the IAM Action
+ */
+export function splitActionIntoParts(input) {
+    // Split the string using a regex that finds transitions from lower to upper case or asterisks
+    // and keeps sequences of uppercase letters together
+    // return input.split(/(?<=[a-z])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/);
+    return input.split(/(?<=[a-z])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|(?=[*])|(?<=[*])/);
+}
+/**
+ * Given a list of strings and a list of strings those parts are in, count the number of times each part appears in the strings
+ *
+ * @param substrings the sub strings to count
+ * @param actions the list of strings to count the substrings in
+ * @returns Returns a map of the substring to the number of times it appears in the actions
+ */
+export function countSubstrings(substrings, actions) {
+    const substringCount = new Map();
+    substrings.forEach(substring => {
+        let count = 0;
+        actions.forEach(action => {
+            if (action.includes(substring)) {
+                count++;
+            }
+        });
+        if (count > 0) {
+            substringCount.set(substring, count);
+        }
+    });
+    return substringCount;
+}
+/**
+ * Finds all the the common sequences in a list of actions strings and counts their frequency and length.
+ *
+ * @param actions the list of actions to find common sequences in
+ * @returns an array of objects with the sequence, frequency, and length of the common sequences
+ */
+export function findCommonSequences(actions) {
+    const allSubstrings = new Set();
+    actions.forEach(action => {
+        splitActionIntoParts(action).forEach(substring => allSubstrings.add(substring));
+    });
+    const substringCount = countSubstrings(Array.from(allSubstrings), actions);
+    const result = [];
+    substringCount.forEach((frequency, sequence) => {
+        result.push({ sequence, frequency, length: sequence.length });
+    });
+    return result;
+}
+/**
+ * Consolidates overlapping wildcards into their most general form
+ *
+ * For example:
+ *   ['*Object', 'Object*', '*Object*'] will be consolidated into ['*Object*']
+ *   ['Get*', '*Get*'] will be consolidated into ['*Get*']
+ *
+ * @param patterns the list of patterns to consolidate
+ * @returns the consolidated list of patterns
+ */
+export function consolidateWildcardPatterns(patterns) {
+    // Sort patterns to handle simpler cases first
+    patterns.sort((a, b) => b.length - a.length);
+    let consolidatedPatterns = [];
+    for (const pattern of patterns) {
+        //If it's already covered, skip it
+        const coveredByExistingPattern = consolidatedPatterns.some(consolidated => matchesPattern(consolidated, pattern));
+        if (coveredByExistingPattern) {
+            continue;
+        }
+        //If it subsumes any existing patterns, remove them
+        consolidatedPatterns = consolidatedPatterns.filter(consolidated => !matchesPattern(pattern, consolidated));
+        consolidatedPatterns.push(pattern);
+    }
+    return consolidatedPatterns;
+}
+/**
+ * Checks a specific string against a general pattern
+ * @param general the general pattern, e.g. 's3:Get*'
+ * @param specific the specific string, e.g. 's3:GetObject'
+ * @returns true if the specific string matches the general pattern
+ */
+function matchesPattern(general, specific) {
+    const regex = new RegExp("^" + general.replace(/\*/g, ".*") + "$");
+    return regex.test(specific);
+}
+//# sourceMappingURL=shrink.js.map

package/dist/esm/shrink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shrink.js","sourceRoot":"","sources":["../../src/shrink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAMtD,MAAM,cAAc,GAAkB;IACpC,UAAU,EAAE,CAAC;CACd,CAAA;AAED,mDAAmD;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,eAAyB,EAAE,aAAsC;IAC5F,mCAAmC;IACnC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACrF,IAAG,QAAQ,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,EAAC,GAAG,cAAc,EAAE,GAAG,aAAa,EAAC,CAAA;IACrD,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,eAAe,EAAE,EAAC,qBAAqB,EAAE,IAAI,EAAC,CAAC,CAAA;IAC5F,MAAM,wBAAwB,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpE,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAI,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAA;QAC7D,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,gBAAgB,CAAC,GAAG,OAAO,IAAI,EAAE,EAAC,qBAAqB,EAAE,IAAI,EAAC,CAAC,CAAC,CAAA;QACzG,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,cAAc,CAAC,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAEpH,YAAY;QACZ,MAAM,gCAAgC,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;QACrG,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,cAAc,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QAC/G,IAAG,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,GAAG,gCAAgC,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAiB;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAiB;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6D,CAAC;IACxF,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QAC7B,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAC,CAAC,CAAC;QACjE,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEvD,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAwB,EAAE,eAAyB,EAAE,UAAkB;IACxG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAExF,IAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,oEAAoE;QACpE,OAAO,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,sFAAsF;IACtF,IAAI,wBAAwB,GAAG,cAAc,CAAC,MAAM,CAAC;IACrD,IAAI,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,CAAA;IAEvC,GAAG,CAAC;QACF,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC;QAC7C,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QAClE,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;QAC3B,IAAG,UAAU,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC,QAAQ,UAAU,CAAC,MAAM,GAAG,wBAAwB,EAAE;IAGvD,iFAAiF;IACjF,GAAG,CAAC;QACF,wBAAwB,GAAG,UAAU,CAAC,MAAM,CAAC;QAC7C,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACjE,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;QAC3B,IAAG,UAAU,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,UAAU,CAAA;QACnB,CAAC;IACH,CAAC,QAAQ,UAAU,CAAC,MAAM,GAAG,wBAAwB,EAAE;IAEvD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,cAAwB,EAAE,gBAA0B,EAAE,IAAa;IACjG,mEAAmE;IACnE,MAAM,eAAe,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAAA,CAAC;IAC1G,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC5B,OAAO,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhF,mDAAmD;IACnD,IAAI,cAAc,GAAG,cAAc,CAAA;IACnC,KAAI,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CACjG,CAAC;QACF,cAAc,GAAG,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,aAAqB,EAAE,QAAgB,EAAE,gBAA0B;IAC9F,MAAM,SAAS,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACtD,IAAG,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,YAAY,GAAG,aAAa,CAAE;IAElC,IAAG,eAAe,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,6HAA6H;QAC7H,KAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAG,YAAY,EAAE,CAAC;gBAChB,uCAAuC;gBACvC,MAAM;YACR,CAAC;YACD,YAAY,GAAG,UAAU,CAAC;QAC5B,CAAC;QAED,sBAAsB;IACxB,CAAC;SAAM,IAAG,eAAe,KAAK,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,gBAAgB;QAChB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,8FAA8F;QAC9F,KAAI,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAG,YAAY,EAAE,CAAC;gBAChB,uCAAuC;gBACvC,MAAM;YACR,CAAC;YAED,YAAY,GAAG,UAAU,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,IAAG,eAAe,GAAG,CAAC,EAAE,CAAC;QAC9B,mBAAmB;QACnB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,8FAA8F;QAC9F,KAAI,IAAI,CAAC,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3D,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAG,YAAY,EAAE,CAAC;gBAChB,2FAA2F;gBAC3F,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;gBAC3B,uCAAuC;gBACvC,MAAM;YACR,CAAC;YACD,YAAY,GAAG,UAAU,CAAC;QAC5B,CAAC;QACD,8FAA8F;QAC9F,KAAI,IAAI,CAAC,GAAG,eAAe,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAClF,IAAG,YAAY,EAAE,CAAC;gBAChB,uCAAuC;gBACvC,MAAM;YACR,CAAC;YACD,YAAY,GAAG,UAAU,CAAC;QAC5B,CAAC;IAEH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB;IACtD,OAAO,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAChE,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,cAAsB,EAAE,OAAiB;IACtF,MAAM,KAAK,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAA;IACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,8FAA8F;IAC9F,oDAAoD;IACpD,sEAAsE;IACtE,OAAO,KAAK,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACtF,CAAC;AAGD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,UAAoB,EAAE,OAAiB;IACrE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACjD,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAiB;IACnD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;QACvB,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAU,EAAE,CAAC;IACzB,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;QAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,oBAAoB,GAAa,EAAE,CAAC;IACxC,KAAI,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC9B,kCAAkC;QAClC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;QACjH,IAAG,wBAAwB,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,oBAAoB,GAAG,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAE,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAE5G,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,oBAAoB,CAAA;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAe,EAAE,QAAgB;IACvD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/dist/esm/shrink_file.d.ts

@@ -0,0 +1,12 @@
+import { ShrinkOptions } from "./shrink.js";
+/**
+ * Takes any JSON document and shrinks any Action or NotAction array of strings in the document.
+ * *MODIFIES THE DOCUMENT IN PLACE*
+ *
+ * @param options the options to use when shrinking the actions
+ * @param document the JSON document to expand
+ * @param key the key of the current node in the document
+ * @returns the original JSON document with any actions expanded in place
+ */
+export declare function shrinkJsonDocument(options: Partial<ShrinkOptions>, document: any, key?: string): Promise<any>;
+//# sourceMappingURL=shrink_file.d.ts.map

package/dist/esm/shrink_file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shrink_file.d.ts","sourceRoot":"","sources":["../../src/shrink_file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,aAAa,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CA0BnH"}

package/dist/esm/shrink_file.js

@@ -0,0 +1,35 @@
+import { shrink } from "./shrink.js";
+/**
+ * Takes any JSON document and shrinks any Action or NotAction array of strings in the document.
+ * *MODIFIES THE DOCUMENT IN PLACE*
+ *
+ * @param options the options to use when shrinking the actions
+ * @param document the JSON document to expand
+ * @param key the key of the current node in the document
+ * @returns the original JSON document with any actions expanded in place
+ */
+export async function shrinkJsonDocument(options, document, key) {
+    if (key === 'Action' || key === 'NotAction') {
+        // if (typeof document === 'string') {
+        //   // return shrink([document], options);
+        // }
+        if (Array.isArray(document) && document.length > 0 && typeof document[0] === 'string') {
+            return shrink(document, options);
+        }
+    }
+    if (Array.isArray(document)) {
+        const results = [];
+        for (const item of document) {
+            results.push(await shrinkJsonDocument(options, item));
+        }
+        return results;
+    }
+    if (typeof document === 'object' && document !== null) {
+        for (const key of Object.keys(document)) {
+            document[key] = await shrinkJsonDocument(options, document[key], key);
+        }
+        return document;
+    }
+    return document;
+}
+//# sourceMappingURL=shrink_file.js.map

package/dist/esm/shrink_file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shrink_file.js","sourceRoot":"","sources":["../../src/shrink_file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,MAAM,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA+B,EAAE,QAAa,EAAE,GAAY;IACnG,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QAC5C,sCAAsC;QACtC,2CAA2C;QAC3C,IAAI;QACJ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtF,OAAO,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/esm/stdin.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Read from stdin until the stream ends, timeout, or an error occurs
+ *
+ * @returns the string input from stdin
+ */
+export declare function readStdin(readWait: number | undefined): Promise<string>;
+//# sourceMappingURL=stdin.d.ts.map

package/dist/esm/stdin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.d.ts","sourceRoot":"","sources":["../../src/stdin.ts"],"names":[],"mappings":"AACA;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7E"}

package/dist/esm/stdin.js

@@ -0,0 +1,31 @@
+import { stdin } from 'process';
+/**
+ * Read from stdin until the stream ends, timeout, or an error occurs
+ *
+ * @returns the string input from stdin
+ */
+export async function readStdin(readWait) {
+    return new Promise((resolve, reject) => {
+        // If the input is not a TTY, we are most likely receiving data from a pipe.
+        const definitelyReceivingData = !process.stdin.isTTY;
+        if (!readWait || readWait <= 0) {
+            readWait = definitelyReceivingData ? 10000 : 20;
+        }
+        let data = '';
+        setTimeout(() => {
+            if (data.length === 0) {
+                resolve(data);
+            }
+        }, readWait);
+        stdin.on('data', (chunk) => {
+            data += chunk;
+        });
+        stdin.on('end', () => {
+            resolve(data);
+        });
+        stdin.on('error', (err) => {
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=stdin.js.map

package/dist/esm/stdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.js","sourceRoot":"","sources":["../../src/stdin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAA4B;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,4EAA4E;QAC5E,MAAM,uBAAuB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAA;QACpD,IAAG,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAC9B,QAAQ,GAAG,uBAAuB,CAAC,CAAC,CAAC,KAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAClD,CAAC;QAED,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,UAAU,CAAC,GAAG,EAAE;YACd,IAAG,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,EAAE,QAAQ,CAAC,CAAA;QAEZ,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/validate.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Checks a list of patterns against a list of desired actions to validate:
+ * * All desired actions are matched by the patterns
+ * * No undesired actions are matched by the patterns
+ *
+ * @param desiredActions The actions that should be in the list
+ * @param patterns The list of patterns that the algorithm has derived
+ * @returns the first match error if any, otherwise undefined
+ */
+export declare function validateShrinkResults(desiredActions: string[], patterns: string[]): Promise<string | undefined>;
+//# sourceMappingURL=validate.d.ts.map

package/dist/esm/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiBrH"}

package/dist/esm/validate.js

@@ -0,0 +1,27 @@
+import { expandIamActions } from "@cloud-copilot/iam-expand";
+/**
+ * Checks a list of patterns against a list of desired actions to validate:
+ * * All desired actions are matched by the patterns
+ * * No undesired actions are matched by the patterns
+ *
+ * @param desiredActions The actions that should be in the list
+ * @param patterns The list of patterns that the algorithm has derived
+ * @returns the first match error if any, otherwise undefined
+ */
+export async function validateShrinkResults(desiredActions, patterns) {
+    const desiredActionSet = new Set(desiredActions);
+    const expandedAfterActions = await expandIamActions(patterns, { expandServiceAsterisk: true });
+    const expandedAfterActionSet = new Set(expandedAfterActions);
+    for (const afterAction of expandedAfterActions) {
+        if (!desiredActionSet.has(afterAction)) {
+            return `Undesired action: ${afterAction}`;
+        }
+    }
+    for (const desiredAction of desiredActions) {
+        if (!expandedAfterActionSet.has(desiredAction)) {
+            return `Missing action ${desiredAction}`;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=validate.js.map

package/dist/esm/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAE7D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,cAAwB,EAAE,QAAkB;IACtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACjD,MAAM,oBAAoB,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,EAAC,qBAAqB,EAAE,IAAI,EAAC,CAAC,CAAC;IAC7F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7D,KAAI,MAAM,WAAW,IAAI,oBAAoB,EAAE,CAAC;QAC9C,IAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,qBAAqB,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAI,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC1C,IAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,OAAO,kBAAkB,aAAa,EAAE,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@cloud-copilot/iam-shrink",
+  "version": "0.1.0",
+  "description": "Shrink IAM Policies",
+  "scripts": {
+    "build": "npx tsc -p tsconfig.cjs.json && npx tsc -p tsconfig.esm.json && ./postbuild.sh",
+    "test": "npx vitest --run --coverage"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cloud-copilot/iam-shrink.git"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    }
+  },
+  "types": "dist/cjs/index.d.ts",
+  "bin": {
+    "iam-shrink": "dist/esm/cli.js"
+  },
+  "keywords": [
+    "AWS",
+    "IAM"
+  ],
+  "author": "David Kerber <dave@cloudcopilot.io>",
+  "license": "GPL-3.0-or-later",
+  "bugs": {
+    "url": "https://github.com/cloud-copilot/iam-shrink/issues"
+  },
+  "homepage": "https://github.com/cloud-copilot/iam-shrink#readme",
+  "devDependencies": {
+    "@types/node": "^22.5.0",
+    "@vitest/coverage-v8": "^2.0.5",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  },
+  "peerDependencies": {
+    "@cloud-copilot/iam-data": ">=0.5.0 <1.0.0",
+    "@cloud-copilot/iam-expand": ">=0.2.0 <1.0.0"
+  }
+}

package/postbuild.sh

@@ -0,0 +1,13 @@
+cat >dist/cjs/package.json <<!EOF
+{
+    "type": "commonjs"
+}
+!EOF
+
+cat >dist/esm/package.json <<!EOF
+{
+    "type": "module"
+}
+!EOF
+
+chmod +x dist/**/cli.js

package/src/cli.ts

@@ -0,0 +1,83 @@
+import { iamDataUpdatedAt, iamDataVersion } from "@cloud-copilot/iam-data"
+import { convertOptions, parseStdIn } from "./cli_utils.js"
+import { shrink, ShrinkOptions } from "./shrink.js"
+
+const commandName = 'iam-shrink'
+const dataPackage = '@cloud-copilot/iam-data'
+
+async function shrinkAandPrint(actions: string[], shrinkOptions: Partial<ShrinkOptions>) {
+  try {
+    const result = await shrink(actions, shrinkOptions)
+    for (const action of result) {
+      console.log(action)
+    }
+  } catch (e: any) {
+    console.error(e.message)
+    process.exit(1)
+  }
+}
+
+function printUsage() {
+  console.log('No arguments provided or input from stdin')
+  console.log('Usage:')
+  console.log(`  ${commandName} [options] [action1] [action2] ...`)
+  console.log(`  <input from stdout> | ${commandName} [options]`)
+  console.log('Shrink ActionOptions:')
+  console.log('  --iterations: How many iterations of shrinking should be executed, defaults to 2; zero or less means no limit')
+  console.log('                Example: --iterations=5')
+  console.log('                Example: --iterations=-1')
+  console.log('CLI Behavior Options:')
+  console.log('  --show-data-version: Print the version of the iam-data package being used and exit')
+  console.log('  --read-wait-ms: Millisenconds to wait for the first byte from stdin before timing out.')
+  console.log('                  Example: --read-wait-ms=10_000')
+  process.exit(1)
+}
+
+const args = process.argv.slice(2); // Ignore the first two elements
+const actionStrings: string[] = []
+const optionStrings: string[] = []
+
+for (const arg of args) {
+  if(arg.startsWith('--')) {
+    optionStrings.push(arg)
+  } else {
+    actionStrings.push(arg)
+  }
+}
+
+async function run() {
+  const options = convertOptions(optionStrings)
+  if(options.showDataVersion) {
+    const version = await iamDataVersion()
+    console.log(`${dataPackage} version: ${version}`)
+    console.log(`Data last updated: ${await iamDataUpdatedAt()}`)
+    console.log(`Update with either:`)
+    console.log(`  npm update ${dataPackage}`)
+    console.log(`  npm update -g ${dataPackage}`)
+    return
+  }
+
+  if(actionStrings.length === 0) {
+    //If no actions are provided, read from stdin
+    const stdInResult = await parseStdIn(options)
+    if(stdInResult.object) {
+      console.log(JSON.stringify(stdInResult.object, null, 2))
+      return
+    } else if (stdInResult.strings) {
+      actionStrings.push(...stdInResult.strings)
+    }
+  }
+
+  if(actionStrings.length > 0) {
+    await shrinkAandPrint(actionStrings, options)
+    return
+  }
+
+  printUsage()
+
+}
+
+run().catch((e) => {
+  console.error(e)
+  process.exit(1)
+}).then(() => {}).finally(() => {})