@mannyc1/ts-release 0.0.7 → 0.3.0

package/dist/operation-journal/aws/deadline.js

@@ -0,0 +1,38 @@
+export const operationJournalNetworkDeadlineMilliseconds = 10_000;
+export class OperationJournalNetworkDeadlineExceeded extends Error {
+    name = "OperationJournalNetworkDeadlineExceeded";
+    constructor() {
+        super("The operational-journal network deadline elapsed.");
+    }
+}
+/**
+ * Bound one complete network operation even when the underlying transport
+ * ignores AbortSignal. The signal still gives cooperative transports an
+ * immediate opportunity to close DNS, sockets, and response streams.
+ */
+export const withOperationJournalNetworkDeadline = async (run, milliseconds = operationJournalNetworkDeadlineMilliseconds) => {
+    if (!Number.isSafeInteger(milliseconds) || milliseconds < 1 ||
+        milliseconds > operationJournalNetworkDeadlineMilliseconds) {
+        throw new Error("The operational-journal network deadline is not canonical.");
+    }
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            const cause = new OperationJournalNetworkDeadlineExceeded();
+            controller.abort(cause);
+            reject(cause);
+        }, milliseconds);
+    });
+    try {
+        return await Promise.race([
+            Promise.resolve().then(() => run(controller.signal)),
+            deadline
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+};
+//# sourceMappingURL=deadline.js.map

package/dist/operation-journal/aws/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../../../src/operation-journal/aws/deadline.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,2CAA2C,GAAG,MAAM,CAAA;AAEjE,MAAM,OAAO,uCAAwC,SAAQ,KAAK;IACvD,IAAI,GAAG,yCAAyC,CAAA;IAEzD;QACE,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAC5D,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,EACtD,GAA4C,EAC5C,YAAY,GAAG,2CAA2C,EAC1C,EAAE;IAClB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QACvD,YAAY,GAAG,2CAA2C,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,IAAI,KAAgD,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,KAAK,GAAG,IAAI,uCAAuC,EAAE,CAAA;YAC3D,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvB,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,EAAE,YAAY,CAAC,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACpD,QAAQ;SACT,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC;AACH,CAAC,CAAA"}

package/dist/operation-journal/aws/oidc.d.ts

@@ -0,0 +1,27 @@
+import { STSClient, type STSClientConfig } from "@aws-sdk/client-sts";
+import * as Effect from "effect/Effect";
+import { S3JournalBoundaryError, type S3JournalAuthority, type S3JournalOidcClaims } from "../model.js";
+export interface AwsJournalCredentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken: string;
+    readonly expiration: Date;
+}
+export interface AwsJournalSession {
+    readonly credentials: AwsJournalCredentials;
+    readonly oidc: S3JournalOidcClaims;
+    readonly callerArn: string;
+}
+export interface AwsJournalOidcRuntime {
+    readonly environment: Record<string, string | undefined>;
+    readonly fileExists: (path: string) => boolean;
+    readonly fetch: typeof globalThis.fetch;
+    readonly now: () => Date;
+    readonly makeAnonymousSts: (config: STSClientConfig) => STSClient;
+    readonly makeSessionSts: (config: STSClientConfig) => STSClient;
+    /** Internal qualification seam; production always uses the fixed maximum. */
+    readonly networkDeadlineMilliseconds?: number;
+}
+export declare const defaultAwsJournalOidcRuntime: AwsJournalOidcRuntime;
+export declare const acquireAwsJournalSession: (authority: S3JournalAuthority, runtime?: AwsJournalOidcRuntime) => Effect.Effect<AwsJournalSession, S3JournalBoundaryError>;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/operation-journal/aws/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/operation-journal/aws/oidc.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,SAAS,EACT,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EACL,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAA;AAMpB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAA;IAC3C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACxD,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;IACxB,QAAQ,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAA;IACjE,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAA;IAC/D,6EAA6E;IAC7E,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAA;CAC9C;AAoSD,eAAO,MAAM,4BAA4B,EAAE,qBAO1C,CAAA;AAED,eAAO,MAAM,wBAAwB,GACnC,WAAW,kBAAkB,EAC7B,UAAS,qBAAoD,KAC5D,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,CA0FxD,CAAA"}

package/dist/operation-journal/aws/oidc.js

@@ -0,0 +1,361 @@
+import { Buffer } from "node:buffer";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { AssumeRoleWithWebIdentityCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+import * as Effect from "effect/Effect";
+import { parseStrictJson } from "../../model/canonical.js";
+import { validateS3JournalAuthority } from "../authority.js";
+import { S3JournalBoundaryError } from "../model.js";
+import { operationJournalNetworkDeadlineMilliseconds, withOperationJournalNetworkDeadline } from "./deadline.js";
+const maximumOidcResponseBytes = 16_384;
+const maximumOidcTokenCharacters = 12_000;
+const maximumOidcHeaderCharacters = 2_048;
+const maximumOidcPayloadCharacters = 8_192;
+const maximumOidcSignatureCharacters = 2_048;
+const fail = (reason) => {
+    throw S3JournalBoundaryError.make({
+        operation: "observe-authority",
+        commitment: "not-applicable",
+        reason
+    });
+};
+const boundaryError = (cause, reason) => cause instanceof S3JournalBoundaryError
+    ? cause
+    : S3JournalBoundaryError.make({
+        operation: "observe-authority",
+        commitment: "not-applicable",
+        reason
+    });
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const requireString = (object, field) => {
+    const value = object[field];
+    if (typeof value !== "string" || value.length === 0)
+        fail(`GitHub OIDC claim ${field} is missing or invalid.`);
+    return value;
+};
+const requireInteger = (object, field) => {
+    const value = object[field];
+    if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+        fail(`GitHub OIDC claim ${field} is missing or invalid.`);
+    }
+    return value;
+};
+const decodeBase64Url = (value, maximum, label) => {
+    if (value.length > maximum || !/^[A-Za-z0-9_-]+$/u.test(value)) {
+        fail(`${label} is not bounded canonical base64url.`);
+    }
+    const bytes = Buffer.from(value, "base64url");
+    if (bytes.toString("base64url") !== value)
+        fail(`${label} is not canonical base64url.`);
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return fail(`${label} is not UTF-8.`);
+    }
+};
+const decodeOidcToken = (token, now) => {
+    if (token.length < 64 || token.length > maximumOidcTokenCharacters ||
+        !/^[A-Za-z0-9_.-]+$/u.test(token)) {
+        fail("GitHub OIDC response is not one bounded compact JWT.");
+    }
+    const segments = token.split(".");
+    if (segments.length !== 3 || segments.some((segment) => segment.length === 0)) {
+        fail("GitHub OIDC response is not one compact JWT.");
+    }
+    const signature = segments[2];
+    if (signature.length > maximumOidcSignatureCharacters ||
+        Buffer.from(signature, "base64url").toString("base64url") !== signature) {
+        fail("GitHub OIDC signature is not bounded canonical base64url.");
+    }
+    let header;
+    let payload;
+    try {
+        header = parseStrictJson(decodeBase64Url(segments[0], maximumOidcHeaderCharacters, "GitHub OIDC header"));
+        payload = parseStrictJson(decodeBase64Url(segments[1], maximumOidcPayloadCharacters, "GitHub OIDC payload"));
+    }
+    catch (cause) {
+        if (cause instanceof S3JournalBoundaryError)
+            throw cause;
+        return fail("GitHub OIDC JWT does not contain strict JSON.");
+    }
+    if (!isObject(header) || header.alg !== "RS256" || header.typ !== "JWT" ||
+        typeof header.kid !== "string" || header.kid.length === 0) {
+        fail("GitHub OIDC JWT header is not the admitted RS256 identity.");
+    }
+    if (!isObject(payload))
+        fail("GitHub OIDC JWT payload must be an object.");
+    const claimsPayload = payload;
+    const nowSeconds = Math.floor(now.getTime() / 1000);
+    const issuedAt = requireInteger(claimsPayload, "iat");
+    const notBefore = requireInteger(claimsPayload, "nbf");
+    const expiresAt = requireInteger(claimsPayload, "exp");
+    if (issuedAt > nowSeconds + 30 || notBefore > nowSeconds + 30 || expiresAt <= nowSeconds + 30 ||
+        expiresAt <= issuedAt || expiresAt - issuedAt > 900) {
+        fail("GitHub OIDC JWT validity window is not current and bounded.");
+    }
+    const claims = {
+        issuer: requireString(claimsPayload, "iss"),
+        audience: requireString(claimsPayload, "aud"),
+        subject: requireString(claimsPayload, "sub"),
+        repository: requireString(claimsPayload, "repository"),
+        repositoryId: requireString(claimsPayload, "repository_id"),
+        repositoryOwnerId: requireString(claimsPayload, "repository_owner_id"),
+        repositoryVisibility: requireString(claimsPayload, "repository_visibility"),
+        eventName: requireString(claimsPayload, "event_name"),
+        ref: requireString(claimsPayload, "ref"),
+        refType: requireString(claimsPayload, "ref_type"),
+        sha: requireString(claimsPayload, "sha"),
+        environment: requireString(claimsPayload, "environment"),
+        runnerEnvironment: requireString(claimsPayload, "runner_environment"),
+        runId: requireString(claimsPayload, "run_id"),
+        runAttempt: requireString(claimsPayload, "run_attempt"),
+        workflow: requireString(claimsPayload, "workflow"),
+        workflowRef: requireString(claimsPayload, "workflow_ref"),
+        workflowSha: requireString(claimsPayload, "workflow_sha"),
+        jobWorkflowRef: requireString(claimsPayload, "job_workflow_ref"),
+        jobWorkflowSha: requireString(claimsPayload, "job_workflow_sha")
+    };
+    if (claims.issuer !== "https://token.actions.githubusercontent.com" || claims.audience !== "sts.amazonaws.com") {
+        fail("GitHub OIDC issuer or audience is not the admitted AWS exchange identity.");
+    }
+    const immutableJobWorkflow = claims.jobWorkflowRef.match(/@([a-f0-9]{40})$/u);
+    if (immutableJobWorkflow?.[1] !== claims.jobWorkflowSha) {
+        fail("GitHub OIDC called-workflow ref is not pinned to its exact source SHA.");
+    }
+    return claims;
+};
+const sameClaims = (left, right) => {
+    const fields = Object.keys(left);
+    return fields.length === Object.keys(right).length && fields.every((field) => left[field] === right[field]);
+};
+const requireCleanAwsEnvironment = (environment, fileExists) => {
+    const forbiddenHostVariables = new Set([
+        "ALL_PROXY",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "NO_PROXY",
+        "NODE_DEBUG",
+        "NODE_DEBUG_NATIVE",
+        "NODE_EXTRA_CA_CERTS",
+        "NODE_OPTIONS",
+        "NODE_PATH",
+        "NODE_TLS_REJECT_UNAUTHORIZED",
+        "NODE_USE_ENV_PROXY",
+        "OPENSSL_CONF",
+        "SSLKEYLOGFILE",
+        "SSL_CERT_DIR",
+        "SSL_CERT_FILE",
+        "all_proxy",
+        "http_proxy",
+        "https_proxy",
+        "no_proxy"
+    ]);
+    const ambient = Object.entries(environment)
+        .filter(([key, value]) => value !== undefined && value !== "" &&
+        (key.startsWith("AWS_") || forbiddenHostVariables.has(key)))
+        .map(([key]) => key)
+        .sort();
+    if (ambient.length > 0) {
+        fail(`Ambient AWS configuration is forbidden (${ambient.join(", ")}).`);
+    }
+    const homeDirectories = [environment.HOME, environment.USERPROFILE]
+        .filter((value) => value !== undefined && value.length > 0);
+    const sharedFiles = [...new Set(homeDirectories)]
+        .flatMap((home) => [join(home, ".aws", "credentials"), join(home, ".aws", "config")]);
+    if (sharedFiles.some(fileExists)) {
+        fail("Ambient AWS shared credential or configuration files are forbidden.");
+    }
+};
+const consumeGitHubOidcCoordinates = (environment) => {
+    const requestUrl = environment.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    delete environment.ACTIONS_ID_TOKEN_REQUEST_URL;
+    delete environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (environment.ACTIONS_ID_TOKEN_REQUEST_URL !== undefined ||
+        environment.ACTIONS_ID_TOKEN_REQUEST_TOKEN !== undefined) {
+        return fail("GitHub OIDC request coordinates could not be consumed from the process environment.");
+    }
+    if (requestUrl === undefined || requestUrl === "" || requestToken === undefined || requestToken === "") {
+        return fail("GitHub OIDC request coordinates are unavailable.");
+    }
+    if (requestUrl.length > 4_096 || requestToken.length > 8_192 ||
+        !/^[!-~]+$/u.test(requestUrl) || !/^[!-~]+$/u.test(requestToken)) {
+        return fail("GitHub OIDC request coordinates exceed their canonical bounds.");
+    }
+    return { requestUrl, requestToken };
+};
+const readOidcResponse = async (response) => {
+    const rawLength = response.headers.get("content-length");
+    if (rawLength === null || !/^[1-9][0-9]{0,5}$/u.test(rawLength)) {
+        return fail("GitHub OIDC token response lacks one bounded Content-Length.");
+    }
+    const contentLength = Number(rawLength);
+    if (contentLength > maximumOidcResponseBytes || response.body === null) {
+        return fail("GitHub OIDC token response exceeds its byte bound.");
+    }
+    const bytes = new Uint8Array(contentLength);
+    const reader = response.body.getReader();
+    let offset = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            if (offset + chunk.value.length > bytes.length) {
+                return fail("GitHub OIDC token response stream exceeded Content-Length.");
+            }
+            bytes.set(chunk.value, offset);
+            offset += chunk.value.length;
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (offset !== bytes.length) {
+        return fail("GitHub OIDC token response stream disagrees with Content-Length.");
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        return parseStrictJson(text);
+    }
+    catch {
+        return fail("GitHub OIDC token response is not strict UTF-8 JSON.");
+    }
+};
+const requestGitHubOidcToken = async (requestUrl, requestToken, fetchImpl, deadlineMilliseconds) => {
+    let url;
+    try {
+        url = new URL(requestUrl);
+    }
+    catch {
+        return fail("GitHub OIDC request URL is invalid.");
+    }
+    const rawAuthority = requestUrl.slice(requestUrl.indexOf("//") + 2).split(/[/?#]/u, 1)[0] ?? "";
+    if (url.protocol !== "https:" ||
+        !/^[a-z0-9-]+\.actions\.githubusercontent\.com$/u.test(url.hostname) ||
+        rawAuthority.includes(":") || url.port !== "" ||
+        url.username !== "" || url.password !== "" || url.hash !== "") {
+        return fail("GitHub OIDC request URL is not one authenticated Actions HTTPS endpoint.");
+    }
+    url.searchParams.set("audience", "sts.amazonaws.com");
+    if (url.href.length > 4_096 || !/^[!-~]+$/u.test(url.href)) {
+        return fail("GitHub OIDC request URL exceeds its canonical bounds after audience binding.");
+    }
+    return withOperationJournalNetworkDeadline(async (signal) => {
+        const response = await fetchImpl(url, {
+            method: "GET",
+            headers: {
+                Accept: "application/json",
+                "Accept-Encoding": "identity",
+                Authorization: `bearer ${requestToken}`
+            },
+            redirect: "error",
+            signal
+        });
+        if (!response.ok || response.redirected || response.url !== url.href) {
+            fail("GitHub OIDC token request did not return the exact requested endpoint.");
+        }
+        const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+        if (contentType !== "application/json")
+            fail("GitHub OIDC token response is not JSON.");
+        const body = await readOidcResponse(response);
+        if (!isObject(body) || Object.keys(body).length !== 1 || typeof body.value !== "string") {
+            return fail("GitHub OIDC token response fields are not the exact admitted set.");
+        }
+        return body.value;
+    }, deadlineMilliseconds);
+};
+const roleName = (roleArn) => roleArn.slice(roleArn.lastIndexOf("/") + 1);
+export const defaultAwsJournalOidcRuntime = {
+    environment: process.env,
+    fileExists: existsSync,
+    fetch: globalThis.fetch,
+    now: () => new Date(),
+    makeAnonymousSts: (config) => new STSClient(config),
+    makeSessionSts: (config) => new STSClient(config)
+};
+export const acquireAwsJournalSession = (authority, runtime = defaultAwsJournalOidcRuntime) => Effect.tryPromise({
+    try: async () => {
+        try {
+            validateS3JournalAuthority(authority);
+        }
+        catch {
+            fail("AWS journal activation contract is malformed.");
+        }
+        const coordinates = consumeGitHubOidcCoordinates(runtime.environment);
+        let runnerRequestToken = coordinates.requestToken;
+        let webIdentityToken = "";
+        try {
+            requireCleanAwsEnvironment(runtime.environment, runtime.fileExists);
+            const deadlineMilliseconds = runtime.networkDeadlineMilliseconds ??
+                operationJournalNetworkDeadlineMilliseconds;
+            webIdentityToken = await requestGitHubOidcToken(coordinates.requestUrl, runnerRequestToken, runtime.fetch, deadlineMilliseconds);
+            const observedClaims = decodeOidcToken(webIdentityToken, runtime.now());
+            if (!sameClaims(observedClaims, authority.oidc)) {
+                fail("GitHub OIDC claims drifted from the exact activation contract.");
+            }
+            const sessionName = `ts-release-journal-${observedClaims.runId}-${observedClaims.runAttempt}`;
+            if (!/^[A-Za-z0-9+=,.@-]{2,64}$/u.test(sessionName)) {
+                fail("Derived AWS journal session name is not canonical.");
+            }
+            const noAmbientCredentials = async () => {
+                throw new Error("Ambient AWS credential resolution is disabled.");
+            };
+            const anonymous = runtime.makeAnonymousSts({
+                region: authority.region,
+                maxAttempts: 1,
+                credentials: noAmbientCredentials
+            });
+            const assumed = await withOperationJournalNetworkDeadline((signal) => anonymous.send(new AssumeRoleWithWebIdentityCommand({
+                RoleArn: authority.roleArn,
+                RoleSessionName: sessionName,
+                WebIdentityToken: webIdentityToken,
+                DurationSeconds: 900
+            }), { abortSignal: signal }), deadlineMilliseconds);
+            const accessKeyId = assumed.Credentials?.AccessKeyId;
+            const secretAccessKey = assumed.Credentials?.SecretAccessKey;
+            const sessionToken = assumed.Credentials?.SessionToken;
+            const expiration = assumed.Credentials?.Expiration;
+            if (accessKeyId === undefined || secretAccessKey === undefined ||
+                sessionToken === undefined || expiration === undefined ||
+                accessKeyId.length === 0 || secretAccessKey.length === 0 || sessionToken.length === 0) {
+                fail("AWS STS did not return one complete temporary credential set.");
+            }
+            const now = runtime.now().getTime();
+            const validExpiration = expiration;
+            if (validExpiration.getTime() <= now + 5 * 60_000 || validExpiration.getTime() > now + 20 * 60_000) {
+                fail("AWS STS journal session expiration is not current and bounded.");
+            }
+            const sessionCredentials = {
+                accessKeyId: accessKeyId,
+                secretAccessKey: secretAccessKey,
+                sessionToken: sessionToken,
+                expiration: validExpiration
+            };
+            const authenticated = runtime.makeSessionSts({
+                region: authority.region,
+                maxAttempts: 1,
+                credentials: sessionCredentials
+            });
+            const caller = await withOperationJournalNetworkDeadline((signal) => authenticated.send(new GetCallerIdentityCommand({}), { abortSignal: signal }), deadlineMilliseconds);
+            const expectedArn = `arn:aws:sts::${authority.accountId}:assumed-role/${roleName(authority.roleArn)}/${sessionName}`;
+            if (caller.Account !== authority.accountId || caller.Arn !== expectedArn ||
+                assumed.AssumedRoleUser?.Arn !== expectedArn || caller.UserId === undefined || caller.UserId.length === 0) {
+                fail("AWS STS caller identity does not equal the exact admitted journal role session.");
+            }
+            return {
+                credentials: sessionCredentials,
+                oidc: observedClaims,
+                callerArn: expectedArn
+            };
+        }
+        finally {
+            runnerRequestToken = "";
+            webIdentityToken = "";
+        }
+    },
+    catch: (cause) => boundaryError(cause, "GitHub OIDC to AWS STS journal authentication failed.")
+});
+//# sourceMappingURL=oidc.js.map

package/dist/operation-journal/aws/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/operation-journal/aws/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,SAAS,EAEV,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,eAAe,EAAa,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EACL,sBAAsB,EAGvB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,2CAA2C,EAC3C,mCAAmC,EACpC,MAAM,eAAe,CAAA;AA0BtB,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,0BAA0B,GAAG,MAAM,CAAA;AACzC,MAAM,2BAA2B,GAAG,KAAK,CAAA;AACzC,MAAM,4BAA4B,GAAG,KAAK,CAAA;AAC1C,MAAM,8BAA8B,GAAG,KAAK,CAAA;AAE5C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE;IACrC,MAAM,sBAAsB,CAAC,IAAI,CAAC;QAChC,SAAS,EAAE,mBAAmB;QAC9B,UAAU,EAAE,gBAAgB;QAC5B,MAAM;KACP,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,MAAc,EAA0B,EAAE,CAC/E,KAAK,YAAY,sBAAsB;IACrC,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,mBAAmB;QAC9B,UAAU,EAAE,gBAAgB;QAC5B,MAAM;KACP,CAAC,CAAA;AAEN,MAAM,QAAQ,GAAG,CAAC,KAAW,EAA6C,EAAE,CAC1E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,MAAM,aAAa,GAAG,CACpB,MAAwC,EACxC,KAAa,EACL,EAAE;IACV,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,qBAAqB,KAAK,yBAAyB,CAAC,CAAA;IAC9G,OAAO,KAAe,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,MAAwC,EACxC,KAAa,EACL,EAAE;IACV,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,qBAAqB,KAAK,yBAAyB,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,KAAe,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,KAAa,EAAU,EAAE;IAChF,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;IACvF,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,KAAK,gBAAgB,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,KAAa,EAAE,GAAS,EAAuB,EAAE;IACxE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,0BAA0B;QAC9D,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,sDAAsD,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,8CAA8C,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAA;IAC9B,IAAI,SAAS,CAAC,MAAM,GAAG,8BAA8B;QACjD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,CAAC,2DAA2D,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,MAAY,CAAA;IAChB,IAAI,OAAa,CAAA;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,eAAe,CACtC,QAAQ,CAAC,CAAC,CAAE,EACZ,2BAA2B,EAC3B,oBAAoB,CACrB,CAAC,CAAA;QACF,OAAO,GAAG,eAAe,CAAC,eAAe,CACvC,QAAQ,CAAC,CAAC,CAAE,EACZ,4BAA4B,EAC5B,qBAAqB,CACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAA;QACxD,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;QACnE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,4DAA4D,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,IAAI,CAAC,4CAA4C,CAAC,CAAA;IAC1E,MAAM,aAAa,GAAG,OAA2C,CAAA;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACtD,IAAI,QAAQ,GAAG,UAAU,GAAG,EAAE,IAAI,SAAS,GAAG,UAAU,GAAG,EAAE,IAAI,SAAS,IAAI,UAAU,GAAG,EAAE;QACzF,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACxD,IAAI,CAAC,6DAA6D,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,MAAM,GAAwB;QAClC,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAkC;QAC5E,QAAQ,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAoC;QAChF,OAAO,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC;QAC5C,UAAU,EAAE,aAAa,CAAC,aAAa,EAAE,YAAY,CAAC;QACtD,YAAY,EAAE,aAAa,CAAC,aAAa,EAAE,eAAe,CAAC;QAC3D,iBAAiB,EAAE,aAAa,CAAC,aAAa,EAAE,qBAAqB,CAAC;QACtE,oBAAoB,EAAE,aAAa,CAAC,aAAa,EAAE,uBAAuB,CAAgD;QAC1H,SAAS,EAAE,aAAa,CAAC,aAAa,EAAE,YAAY,CAAqC;QACzF,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC;QACxC,OAAO,EAAE,aAAa,CAAC,aAAa,EAAE,UAAU,CAAmC;QACnF,GAAG,EAAE,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC;QACxC,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC;QACxD,iBAAiB,EAAE,aAAa,CAAC,aAAa,EAAE,oBAAoB,CAA6C;QACjH,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC7C,UAAU,EAAE,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC;QACvD,QAAQ,EAAE,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC;QAClD,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,cAAc,CAAC;QACzD,WAAW,EAAE,aAAa,CAAC,aAAa,EAAE,cAAc,CAAC;QACzD,cAAc,EAAE,aAAa,CAAC,aAAa,EAAE,kBAAkB,CAAC;QAChE,cAAc,EAAE,aAAa,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACjE,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,6CAA6C,IAAI,MAAM,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QAC/G,IAAI,CAAC,2EAA2E,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC7E,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;QACxD,IAAI,CAAC,wEAAwE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAyB,EAAE,KAA0B,EAAW,EAAE;IACpF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAA6C,CAAA;IAC5E,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7G,CAAC,CAAA;AAED,MAAM,0BAA0B,GAAG,CACjC,WAAyD,EACzD,UAAqC,EAC/B,EAAE;IACR,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;QACrC,WAAW;QACX,YAAY;QACZ,aAAa;QACb,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,qBAAqB;QACrB,cAAc;QACd,WAAW;QACX,8BAA8B;QAC9B,oBAAoB;QACpB,cAAc;QACd,eAAe;QACf,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;QACZ,aAAa;QACb,UAAU;KACX,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAC3D,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;SAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,EAAE,CAAA;IACT,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC;SAChE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9E,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;SAC9C,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACvF,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,qEAAqE,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC,CAAA;AAED,MAAM,4BAA4B,GAAG,CACnC,WAA+C,EACiB,EAAE;IAClE,MAAM,UAAU,GAAG,WAAW,CAAC,4BAA4B,CAAA;IAC3D,MAAM,YAAY,GAAG,WAAW,CAAC,8BAA8B,CAAA;IAC/D,OAAO,WAAW,CAAC,4BAA4B,CAAA;IAC/C,OAAO,WAAW,CAAC,8BAA8B,CAAA;IACjD,IAAI,WAAW,CAAC,4BAA4B,KAAK,SAAS;QACtD,WAAW,CAAC,8BAA8B,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,qFAAqF,CAAC,CAAA;IACpG,CAAC;IACD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;QACvG,OAAO,IAAI,CAAC,kDAAkD,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,KAAK,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK;QACxD,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC,gEAAgE,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAA;AACrC,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAkB,EAAiB,EAAE;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACxD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC,8DAA8D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACvC,IAAI,aAAa,GAAG,wBAAwB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,oDAAoD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACxC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YACjC,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAK;YACrB,IAAI,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,4DAA4D,CAAC,CAAA;YAC3E,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAC9B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAA;QAC9B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,kEAAkE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9D,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,sDAAsD,CAAC,CAAA;IACrE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,KAAK,EAClC,UAAkB,EAClB,YAAoB,EACpB,SAAkC,EAClC,oBAA4B,EACX,EAAE;IACnB,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,qCAAqC,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/F,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QACpE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE;QAC7C,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,0EAA0E,CAAC,CAAA;IACzF,CAAC;IACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC7F,CAAC;IACD,OAAO,mCAAmC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,iBAAiB,EAAE,UAAU;gBAC7B,aAAa,EAAE,UAAU,YAAY,EAAE;aACxC;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM;SACP,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,CAAC,wEAAwE,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAChG,IAAI,WAAW,KAAK,kBAAkB;YAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACvF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC,mEAAmE,CAAC,CAAA;QAClF,CAAC;QACD,OAAO,IAAI,CAAC,KAAe,CAAA;IAC7B,CAAC,EAAE,oBAAoB,CAAC,CAAA;AAC1B,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAEzF,MAAM,CAAC,MAAM,4BAA4B,GAA0B;IACjE,WAAW,EAAE,OAAO,CAAC,GAAG;IACxB,UAAU,EAAE,UAAU;IACtB,KAAK,EAAE,UAAU,CAAC,KAAK;IACvB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IACrB,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;IACnD,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC;CAClD,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,SAA6B,EAC7B,UAAiC,4BAA4B,EACH,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;IAC/E,GAAG,EAAE,KAAK,IAAI,EAAE;QACd,IAAI,CAAC;YACH,0BAA0B,CAAC,SAAS,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,+CAA+C,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACrE,IAAI,kBAAkB,GAAG,WAAW,CAAC,YAAY,CAAA;QACjD,IAAI,gBAAgB,GAAG,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACnE,MAAM,oBAAoB,GAAG,OAAO,CAAC,2BAA2B;gBAC9D,2CAA2C,CAAA;YAC7C,gBAAgB,GAAG,MAAM,sBAAsB,CAC7C,WAAW,CAAC,UAAU,EACtB,kBAAkB,EAClB,OAAO,CAAC,KAAK,EACb,oBAAoB,CACrB,CAAA;YACD,MAAM,cAAc,GAAG,eAAe,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;YACvE,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,CAAC,gEAAgE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,WAAW,GAAG,sBAAsB,cAAc,CAAC,KAAK,IAAI,cAAc,CAAC,UAAU,EAAE,CAAA;YAC7F,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,oDAAoD,CAAC,CAAA;YAC5D,CAAC;YACD,MAAM,oBAAoB,GAAG,KAAK,IAAoB,EAAE;gBACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;YACnE,CAAC,CAAA;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;gBACzC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAA;YACF,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAClF,IAAI,gCAAgC,CAAC;gBACnC,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,gBAAgB;gBAClC,eAAe,EAAE,GAAG;aACrB,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,EAAE,oBAAoB,CAAC,CAAA;YACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAA;YACpD,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,CAAA;YAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAA;YACtD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAA;YAClD,IAAI,WAAW,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS;gBAC1D,YAAY,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBACtD,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1F,IAAI,CAAC,+DAA+D,CAAC,CAAA;YACvE,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;YACnC,MAAM,eAAe,GAAG,UAAkB,CAAA;YAC1C,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,GAAG,GAAG,CAAC,GAAG,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;gBACnG,IAAI,CAAC,gEAAgE,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,kBAAkB,GAA0B;gBAChD,WAAW,EAAE,WAAqB;gBAClC,eAAe,EAAE,eAAyB;gBAC1C,YAAY,EAAE,YAAsB;gBACpC,UAAU,EAAE,eAAe;aAC5B,CAAA;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;gBAC3C,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,kBAAkB;aAChC,CAAC,CAAA;YACF,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CACrF,IAAI,wBAAwB,CAAC,EAAE,CAAC,EAChC,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,EAAE,oBAAoB,CAAC,CAAA;YACxB,MAAM,WAAW,GAAG,gBAAgB,SAAS,CAAC,SAAS,iBAAiB,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAA;YACpH,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW;gBACpE,OAAO,CAAC,eAAe,EAAE,GAAG,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9G,IAAI,CAAC,iFAAiF,CAAC,CAAA;YACzF,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,WAAW;aACvB,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,kBAAkB,GAAG,EAAE,CAAA;YACvB,gBAAgB,GAAG,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,uDAAuD,CAAC;CAChG,CAAC,CAAA"}

package/dist/operation-journal/aws/policy.d.ts

@@ -0,0 +1,42 @@
+import { type S3JournalAuthority, type S3JournalOidcTrustConditions } from "../model.js";
+interface NormalizedPrincipal {
+    readonly AWS?: ReadonlyArray<string>;
+    readonly Federated?: ReadonlyArray<string>;
+}
+interface NormalizedStatement {
+    readonly Sid: string;
+    readonly Effect: "Allow" | "Deny";
+    readonly Principal?: "*" | NormalizedPrincipal;
+    readonly Action: ReadonlyArray<string>;
+    readonly Resource?: ReadonlyArray<string>;
+    readonly NotResource?: ReadonlyArray<string>;
+    readonly Condition?: Readonly<Record<string, Readonly<Record<string, ReadonlyArray<string>>>>>;
+}
+interface NormalizedPolicy {
+    readonly Version: "2012-10-17";
+    readonly Statement: ReadonlyArray<NormalizedStatement>;
+}
+export interface AwsJournalPolicyCoordinates {
+    readonly accountId: string;
+    readonly bucketArn: string;
+    readonly roleArn: string;
+    readonly rolePolicyName: string;
+    readonly oidcTrust: S3JournalOidcTrustConditions;
+}
+export interface AwsJournalObservedPolicyDigests {
+    readonly bucketPolicyDigest: string;
+    readonly rolePolicyDigest: string;
+    readonly oidcTrustPolicyDigest: string;
+}
+export declare const makeAwsJournalTrustPolicy: (coordinates: AwsJournalPolicyCoordinates) => NormalizedPolicy;
+export declare const makeAwsJournalRolePolicy: (coordinates: AwsJournalPolicyCoordinates) => NormalizedPolicy;
+export declare const makeAwsJournalBucketPolicy: (coordinates: AwsJournalPolicyCoordinates) => NormalizedPolicy;
+export declare const validateAwsJournalPolicies: (input: {
+    readonly coordinates: AwsJournalPolicyCoordinates;
+    readonly trustPolicyDocument: string;
+    readonly rolePolicyDocument: string;
+    readonly bucketPolicyDocument: string;
+}) => AwsJournalObservedPolicyDigests;
+export declare const assertAwsJournalPolicyDigests: (authority: S3JournalAuthority, observed: AwsJournalObservedPolicyDigests) => void;
+export {};
+//# sourceMappingURL=policy.d.ts.map

package/dist/operation-journal/aws/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/operation-journal/aws/policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EAClC,MAAM,aAAa,CAAA;AAMpB,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAC3C;AAED,UAAU,mBAAmB;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,mBAAmB,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CAC/F;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAA;CACvD;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,4BAA4B,CAAA;CACjD;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;CACvC;AAuJD,eAAO,MAAM,yBAAyB,GACpC,aAAa,2BAA2B,KACvC,gBAwBF,CAAA;AAED,eAAO,MAAM,wBAAwB,GACnC,aAAa,2BAA2B,KACvC,gBAsHD,CAAA;AAEF,eAAO,MAAM,0BAA0B,GACrC,aAAa,2BAA2B,KACvC,gBA4FD,CAAA;AAcF,eAAO,MAAM,0BAA0B,GAAI,OAAO;IAChD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;IACjD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;CACtC,KAAG,+BAqBH,CAAA;AAED,eAAO,MAAM,6BAA6B,GACxC,WAAW,kBAAkB,EAC7B,UAAU,+BAA+B,KACxC,IAMF,CAAA"}