@actsecurity/iam-utils 0.1.82

package/dist/cjs/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuC7E"}

package/dist/cjs/actions.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionMatchesPattern = actionMatchesPattern;
+/**
+ * Checks to see if the action matches the provided IAM action pattern.
+ *
+ * @param action the action to check, should not contain wildcards
+ * @param pattern the pattern to match against, may contain wildcards
+ * @returns true if the action matches the pattern, false otherwise
+ */
+function actionMatchesPattern(action, pattern) {
+    const unescapedAction = unescapeUnicodeCharacters(action);
+    const unescapedPattern = unescapeUnicodeCharacters(pattern);
+    // Full wildcard matches everything
+    if (unescapedPattern === '*') {
+        return true;
+    }
+    // Split into service and action parts
+    const patternColonIndex = unescapedPattern.indexOf(':');
+    const actionColonIndex = unescapedAction.indexOf(':');
+    // If pattern has no colon, it must match the entire action exactly (case-insensitive)
+    if (patternColonIndex === -1) {
+        if (actionColonIndex === -1) {
+            return unescapedAction.toLowerCase() === unescapedPattern.toLowerCase();
+        }
+        return false;
+    }
+    // If action has no colon but pattern does, no match
+    if (actionColonIndex === -1) {
+        return false;
+    }
+    const patternService = unescapedPattern.substring(0, patternColonIndex);
+    const patternAction = unescapedPattern.substring(patternColonIndex + 1);
+    const actionService = unescapedAction.substring(0, actionColonIndex);
+    const actionAction = unescapedAction.substring(actionColonIndex + 1);
+    // Service must match exactly (case-insensitive), no wildcards allowed
+    if (patternService.toLowerCase() !== actionService.toLowerCase()) {
+        return false;
+    }
+    // Match the action part with wildcards
+    const regex = convertStringToPattern(patternAction);
+    return regex.test(actionAction);
+}
+/**
+ * Converts an action string pattern to a regular expression for matching.
+ *
+ * @param actionString the IAM action pattern string to convert
+ * @returns RegExp that matches the pattern (case-insensitive)
+ */
+function convertStringToPattern(actionString) {
+    const pattern = '^' + actionString.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Unescapes unicode characters in a string.
+ *
+ * @param str The string to unescape
+ * @returns The string with any escaped unicode characters replaced with their actual characters
+ */
+function unescapeUnicodeCharacters(str) {
+    return str.replace(/\\u([\dA-Fa-f]{4})/gi, (match, code) => {
+        return String.fromCharCode(parseInt(code, 16));
+    });
+}
+//# sourceMappingURL=actions.js.map

package/dist/cjs/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":";;AAOA,oDAuCC;AA9CD;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACzD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAE3D,mCAAmC;IACnC,IAAI,gBAAgB,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAErD,sFAAsF;IACtF,IAAI,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAA;QACzE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oDAAoD;IACpD,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACvE,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,aAAa,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAA;IAEpE,sEAAsE;IACtE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uCAAuC;IACvC,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAA;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,OAAO,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAClF,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzD,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/cjs/arn.d.ts

@@ -0,0 +1,48 @@
+export interface ArnParts {
+    /**
+     * The partition of the ARN such as aws, aws-cn, aws-us-gov
+     */
+    partition: string | undefined;
+    /**
+     * The service of the ARN such as s3, ec2, iam
+     */
+    service: string | undefined;
+    /**
+     * The region of the ARN such as us-east-1, us-west-2
+     */
+    region: string | undefined;
+    /**
+     * The account ID of the ARN
+     */
+    accountId: string | undefined;
+    /**
+     * The resource portion of the ARN, includes the resource type, path and name
+     */
+    resource: string | undefined;
+    /**
+     * The resource type of the ARN, such as instance, user, topic, may be undefined for
+     * some S3 buckets.
+     */
+    resourceType: string | undefined;
+    /**
+     * The resource path and name of the ARN, such as Development/user1, or MyTopic or my-bucket/my-object.txt
+     */
+    resourcePath: string | undefined;
+}
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+export declare function splitArnParts(arn: string): ArnParts;
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (without the separator) and the second segment being the resource id.
+ */
+export declare function getResourceSegments(service: string, accountId: string, region: string, resourceString: string): [string, string];
+//# sourceMappingURL=arn.d.ts.map

package/dist/cjs/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAE3B;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAE5B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC;;OAEG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAkBnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,CAAC,MAAM,EAAE,MAAM,CAAC,CA+BlB"}

package/dist/cjs/arn.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitArnParts = splitArnParts;
+exports.getResourceSegments = getResourceSegments;
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+function splitArnParts(arn) {
+    const parts = arn.split(':');
+    const partition = parts.at(1);
+    const service = parts.at(2);
+    const region = parts.at(3);
+    const accountId = parts.at(4);
+    const resource = parts.slice(5).join(':');
+    const [resourceType, resourcePath] = getResourceSegments(service, accountId, region, resource);
+    return {
+        partition,
+        service,
+        region,
+        accountId,
+        resource,
+        resourceType,
+        resourcePath
+    };
+}
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (without the separator) and the second segment being the resource id.
+ */
+function getResourceSegments(service, accountId, region, resourceString) {
+    // This is terrible, and I hate it
+    if ((service === 's3' && accountId === '' && region === '') ||
+        service === 'sns' ||
+        service === 'sqs') {
+        return ['', resourceString];
+    }
+    if (resourceString.startsWith('/')) {
+        resourceString = resourceString.slice(1);
+    }
+    const slashIndex = resourceString.indexOf('/');
+    const colonIndex = resourceString.indexOf(':');
+    let splitIndex = slashIndex;
+    if (slashIndex != -1 && colonIndex != -1) {
+        splitIndex = Math.min(slashIndex, colonIndex) + 1;
+    }
+    else if (slashIndex == -1 && colonIndex == -1) {
+        splitIndex = resourceString.length + 1;
+    }
+    else if (colonIndex == -1) {
+        splitIndex = slashIndex + 1;
+    }
+    else if (slashIndex == -1) {
+        splitIndex = colonIndex + 1;
+    }
+    else {
+        throw new Error(`Unable to split resource ${resourceString}`);
+    }
+    return [resourceString.slice(0, splitIndex - 1), resourceString.slice(splitIndex)];
+}
+//# sourceMappingURL=arn.js.map

package/dist/cjs/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":";;AA4CA,sCAkBC;AAUD,kDAoCC;AAtED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAE9F,OAAO;QACL,SAAS;QACT,OAAO;QACP,MAAM;QACN,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,YAAY;KACb,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,kCAAkC;IAClC,IACE,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;QACvD,OAAO,KAAK,KAAK;QACjB,OAAO,KAAK,KAAK,EACjB,CAAC;QACD,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9C,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;IACxC,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,cAAc,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;AACpF,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,9 @@
+export { actionMatchesPattern } from './actions.js';
+export { getResourceSegments, splitArnParts, type ArnParts } from './arn.js';
+export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
+export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { mostSpecificMatchingResourceTypePatterns, resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
+export { actionSupportsAwsResourceInfoContextKeys, isAwsResourceInfoExcludedAction } from './resourceInfoContextKeys.js';
+export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EACL,wCAAwC,EACxC,wCAAwC,EACzC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,wCAAwC,EACxC,+BAA+B,EAChC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/cjs/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isS3BucketOrObjectArn = exports.bucketArn = exports.isAwsResourceInfoExcludedAction = exports.actionSupportsAwsResourceInfoContextKeys = exports.resourceStringMatchesResourceTypePattern = exports.mostSpecificMatchingResourceTypePatterns = exports.resourceArnWithWildcardsToRegex = exports.convertResourcePatternToRegex = exports.isServicePrincipal = exports.isIamUserArn = exports.isIamRoleArn = exports.isFederatedUserArn = exports.isAssumedRoleArn = exports.isArnPrincipal = exports.convertRoleArnToAssumedRoleArn = exports.convertAssumedRoleArnToRoleArn = exports.splitArnParts = exports.getResourceSegments = exports.actionMatchesPattern = void 0;
+var actions_js_1 = require("./actions.js");
+Object.defineProperty(exports, "actionMatchesPattern", { enumerable: true, get: function () { return actions_js_1.actionMatchesPattern; } });
+var arn_js_1 = require("./arn.js");
+Object.defineProperty(exports, "getResourceSegments", { enumerable: true, get: function () { return arn_js_1.getResourceSegments; } });
+Object.defineProperty(exports, "splitArnParts", { enumerable: true, get: function () { return arn_js_1.splitArnParts; } });
+var principals_js_1 = require("./principals.js");
+Object.defineProperty(exports, "convertAssumedRoleArnToRoleArn", { enumerable: true, get: function () { return principals_js_1.convertAssumedRoleArnToRoleArn; } });
+Object.defineProperty(exports, "convertRoleArnToAssumedRoleArn", { enumerable: true, get: function () { return principals_js_1.convertRoleArnToAssumedRoleArn; } });
+Object.defineProperty(exports, "isArnPrincipal", { enumerable: true, get: function () { return principals_js_1.isArnPrincipal; } });
+Object.defineProperty(exports, "isAssumedRoleArn", { enumerable: true, get: function () { return principals_js_1.isAssumedRoleArn; } });
+Object.defineProperty(exports, "isFederatedUserArn", { enumerable: true, get: function () { return principals_js_1.isFederatedUserArn; } });
+Object.defineProperty(exports, "isIamRoleArn", { enumerable: true, get: function () { return principals_js_1.isIamRoleArn; } });
+Object.defineProperty(exports, "isIamUserArn", { enumerable: true, get: function () { return principals_js_1.isIamUserArn; } });
+Object.defineProperty(exports, "isServicePrincipal", { enumerable: true, get: function () { return principals_js_1.isServicePrincipal; } });
+var resourcePatterns_js_1 = require("./resourcePatterns.js");
+Object.defineProperty(exports, "convertResourcePatternToRegex", { enumerable: true, get: function () { return resourcePatterns_js_1.convertResourcePatternToRegex; } });
+var resources_js_1 = require("./resources.js");
+Object.defineProperty(exports, "resourceArnWithWildcardsToRegex", { enumerable: true, get: function () { return resources_js_1.resourceArnWithWildcardsToRegex; } });
+var resourceTypes_js_1 = require("./resourceTypes.js");
+Object.defineProperty(exports, "mostSpecificMatchingResourceTypePatterns", { enumerable: true, get: function () { return resourceTypes_js_1.mostSpecificMatchingResourceTypePatterns; } });
+Object.defineProperty(exports, "resourceStringMatchesResourceTypePattern", { enumerable: true, get: function () { return resourceTypes_js_1.resourceStringMatchesResourceTypePattern; } });
+var resourceInfoContextKeys_js_1 = require("./resourceInfoContextKeys.js");
+Object.defineProperty(exports, "actionSupportsAwsResourceInfoContextKeys", { enumerable: true, get: function () { return resourceInfoContextKeys_js_1.actionSupportsAwsResourceInfoContextKeys; } });
+Object.defineProperty(exports, "isAwsResourceInfoExcludedAction", { enumerable: true, get: function () { return resourceInfoContextKeys_js_1.isAwsResourceInfoExcludedAction; } });
+var s3_js_1 = require("./s3.js");
+Object.defineProperty(exports, "bucketArn", { enumerable: true, get: function () { return s3_js_1.bucketArn; } });
+Object.defineProperty(exports, "isS3BucketOrObjectArn", { enumerable: true, get: function () { return s3_js_1.isS3BucketOrObjectArn; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAAmD;AAA1C,kHAAA,oBAAoB,OAAA;AAC7B,mCAA4E;AAAnE,6GAAA,mBAAmB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAC3C,iDASwB;AARtB,+HAAA,8BAA8B,OAAA;AAC9B,+HAAA,8BAA8B,OAAA;AAC9B,+GAAA,cAAc,OAAA;AACd,iHAAA,gBAAgB,OAAA;AAChB,mHAAA,kBAAkB,OAAA;AAClB,6GAAA,YAAY,OAAA;AACZ,6GAAA,YAAY,OAAA;AACZ,mHAAA,kBAAkB,OAAA;AAEpB,6DAAqE;AAA5D,oIAAA,6BAA6B,OAAA;AACtC,+CAAgE;AAAvD,+HAAA,+BAA+B,OAAA;AACxC,uDAG2B;AAFzB,4IAAA,wCAAwC,OAAA;AACxC,4IAAA,wCAAwC,OAAA;AAE1C,2EAGqC;AAFnC,sJAAA,wCAAwC,OAAA;AACxC,6IAAA,+BAA+B,OAAA;AAEjC,iCAA0D;AAAjD,kGAAA,SAAS,OAAA;AAAE,8GAAA,qBAAqB,OAAA"}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "commonjs"
+}

package/dist/cjs/principals.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Transform an assumed role session ARN into a role ARN
+ *
+ * @param assumedRoleArn the assumed role session ARN
+ * @returns the role ARN for the assumed role session
+ */
+export declare function convertAssumedRoleArnToRoleArn(assumedRoleArn: string): string;
+/**
+ * Create an assumed role ARN from a role ARN and a session name
+ *
+ * @param roleArn the role ARN to create an assumed role ARN from
+ * @param sessionName the session name to use
+ * @returns the assumed role ARN
+ */
+export declare function convertRoleArnToAssumedRoleArn(roleArn: string, sessionName: string): string;
+/**
+ * Tests if a principal string is an assumed role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an assumed role ARN, false otherwise
+ */
+export declare function isAssumedRoleArn(principal: string): boolean;
+/**
+ * Test if a principal string is an IAM user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM user ARN, false otherwise
+ */
+export declare function isIamUserArn(principal: string): boolean;
+/**
+ * Test if a principal string is an IAM Role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM role ARN, false otherwise
+ */
+export declare function isIamRoleArn(principal: string): boolean;
+/**
+ * Test if a principal string is a federated user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a federated user ARN, false otherwise
+ */
+export declare function isFederatedUserArn(principal: string): boolean;
+/**
+ * Test if a principal string is an ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an ARN, false otherwise
+ */
+export declare function isArnPrincipal(principal: string): boolean;
+/**
+ * Test if a principal string is a service principal
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a service principal, false otherwise
+ */
+export declare function isServicePrincipal(principal: string): boolean;
+//# sourceMappingURL=principals.d.ts.map

package/dist/cjs/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAI3F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/cjs/principals.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertAssumedRoleArnToRoleArn = convertAssumedRoleArnToRoleArn;
+exports.convertRoleArnToAssumedRoleArn = convertRoleArnToAssumedRoleArn;
+exports.isAssumedRoleArn = isAssumedRoleArn;
+exports.isIamUserArn = isIamUserArn;
+exports.isIamRoleArn = isIamRoleArn;
+exports.isFederatedUserArn = isFederatedUserArn;
+exports.isArnPrincipal = isArnPrincipal;
+exports.isServicePrincipal = isServicePrincipal;
+const arn_js_1 = require("./arn.js");
+/**
+ * Transform an assumed role session ARN into a role ARN
+ *
+ * @param assumedRoleArn the assumed role session ARN
+ * @returns the role ARN for the assumed role session
+ */
+function convertAssumedRoleArnToRoleArn(assumedRoleArn) {
+    const arnParts = (0, arn_js_1.splitArnParts)(assumedRoleArn);
+    const rolePathAndName = arnParts.resourcePath?.split('/').slice(0, -1).join('/');
+    return `arn:${arnParts.partition}:iam::${arnParts.accountId}:role/${rolePathAndName}`;
+}
+/**
+ * Create an assumed role ARN from a role ARN and a session name
+ *
+ * @param roleArn the role ARN to create an assumed role ARN from
+ * @param sessionName the session name to use
+ * @returns the assumed role ARN
+ */
+function convertRoleArnToAssumedRoleArn(roleArn, sessionName) {
+    const arnParts = (0, arn_js_1.splitArnParts)(roleArn);
+    const rolePathAndName = arnParts.resourcePath;
+    return `arn:${arnParts.partition}:sts::${arnParts.accountId}:assumed-role/${rolePathAndName}/${sessionName}`;
+}
+const assumedRoleArnRegex = /^arn:[a-zA-Z\-]+:sts::\d{12}:assumed-role\/.*$/;
+/**
+ * Tests if a principal string is an assumed role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an assumed role ARN, false otherwise
+ */
+function isAssumedRoleArn(principal) {
+    return assumedRoleArnRegex.test(principal);
+}
+const userArnRegex = /^arn:[a-zA-Z\-]+:iam::\d{12}:user\/.*$/;
+/**
+ * Test if a principal string is an IAM user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM user ARN, false otherwise
+ */
+function isIamUserArn(principal) {
+    return userArnRegex.test(principal);
+}
+const iamRoleArnRegex = /^arn:[a-zA-Z\-]+:iam::\d{12}:role\/.*$/;
+/**
+ * Test if a principal string is an IAM Role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM role ARN, false otherwise
+ */
+function isIamRoleArn(principal) {
+    return iamRoleArnRegex.test(principal);
+}
+const federatedUserArnRegex = /^arn:[a-zA-Z\-]+:sts::\d{12}:federated-user\/.*$/;
+/**
+ * Test if a principal string is a federated user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a federated user ARN, false otherwise
+ */
+function isFederatedUserArn(principal) {
+    return federatedUserArnRegex.test(principal);
+}
+/**
+ * Test if a principal string is an ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an ARN, false otherwise
+ */
+function isArnPrincipal(principal) {
+    return principal.startsWith('arn:');
+}
+/**
+ * Test if a principal string is a service principal
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a service principal, false otherwise
+ */
+function isServicePrincipal(principal) {
+    return !isArnPrincipal(principal) && principal.endsWith('amazonaws.com');
+}
+//# sourceMappingURL=principals.js.map

package/dist/cjs/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":";;AAQA,wEAIC;AASD,wEAIC;AAUD,4CAEC;AAUD,oCAEC;AAUD,oCAEC;AAUD,gDAEC;AAQD,wCAEC;AAQD,gDAEC;AA7FD,qCAAwC;AAExC;;;;;GAKG;AACH,SAAgB,8BAA8B,CAAC,cAAsB;IACnE,MAAM,QAAQ,GAAG,IAAA,sBAAa,EAAC,cAAc,CAAC,CAAA;IAC9C,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChF,OAAO,OAAO,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,SAAS,eAAe,EAAE,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,8BAA8B,CAAC,OAAe,EAAE,WAAmB;IACjF,MAAM,QAAQ,GAAG,IAAA,sBAAa,EAAC,OAAO,CAAC,CAAA;IACvC,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAA;IAC7C,OAAO,OAAO,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,iBAAiB,eAAe,IAAI,WAAW,EAAE,CAAA;AAC9G,CAAC;AAED,MAAM,mBAAmB,GAAG,gDAAgD,CAAA;AAE5E;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,YAAY,GAAG,wCAAwC,CAAA;AAE7D;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,SAAiB;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,eAAe,GAAG,wCAAwC,CAAA;AAEhE;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,SAAiB;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,qBAAqB,GAAG,kDAAkD,CAAA;AAEhF;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AAC1E,CAAC"}

package/dist/cjs/resourceInfoContextKeys.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Checks whether an IAM action is excluded from AWS resource-information context keys.
+ *
+ * AWS does not populate `aws:ResourceAccount`, `aws:ResourceOrgID`, or
+ * `aws:ResourceOrgPaths` for every action. This predicate captures the documented
+ * excluded actions currently used by Cloud Copilot request-context generation.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when AWS resource-information context keys are not available.
+ */
+export declare function isAwsResourceInfoExcludedAction(action: string): boolean;
+/**
+ * Checks whether AWS resource-information context keys are available for an IAM action.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when `aws:ResourceAccount`, `aws:ResourceOrgID`, and `aws:ResourceOrgPaths` may be populated.
+ */
+export declare function actionSupportsAwsResourceInfoContextKeys(action: string): boolean;
+//# sourceMappingURL=resourceInfoContextKeys.d.ts.map

package/dist/cjs/resourceInfoContextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceInfoContextKeys.d.ts","sourceRoot":"","sources":["../../src/resourceInfoContextKeys.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGvE;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhF"}

package/dist/cjs/resourceInfoContextKeys.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAwsResourceInfoExcludedAction = isAwsResourceInfoExcludedAction;
+exports.actionSupportsAwsResourceInfoContextKeys = actionSupportsAwsResourceInfoContextKeys;
+const awsResourceInfoExcludedActions = new Set([
+    'auditmanager:updateassessmentframeworkshare',
+    'detective:acceptinvitation',
+    'ds:acceptshareddirectory',
+    'ec2:accepttransitgatewaypeeringattachment',
+    'ec2:acceptvpcendpointconnections',
+    'ec2:acceptvpcpeeringconnection',
+    'ec2:copysnapshot',
+    'ec2:createtransitgatewaypeeringattachment',
+    'ec2:createvpcendpoint',
+    'ec2:createvpcpeeringconnection',
+    'ec2:deletetransitgatewaypeeringattachment',
+    'ec2:deletevpcpeeringconnection',
+    'ec2:rejecttransitgatewaypeeringattachment',
+    'ec2:rejectvpcendpointconnections',
+    'ec2:rejectvpcpeeringconnection',
+    'guardduty:acceptadministratorinvitation',
+    'macie2:acceptinvitation',
+    'es:acceptinboundconnection',
+    'route53:associatevpcwithhostedzone',
+    'route53:createvpcassociationauthorization',
+    'route53:deletevpcassociationauthorization',
+    'route53:disassociatevpcfromhostedzone',
+    'route53:listhostedzonesbyvpc',
+    'securityhub:acceptadministratorinvitation'
+]);
+/**
+ * Checks whether an IAM action is excluded from AWS resource-information context keys.
+ *
+ * AWS does not populate `aws:ResourceAccount`, `aws:ResourceOrgID`, or
+ * `aws:ResourceOrgPaths` for every action. This predicate captures the documented
+ * excluded actions currently used by Cloud Copilot request-context generation.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when AWS resource-information context keys are not available.
+ */
+function isAwsResourceInfoExcludedAction(action) {
+    const lowerCaseAction = action.toLowerCase();
+    return lowerCaseAction.startsWith('ebs:') || awsResourceInfoExcludedActions.has(lowerCaseAction);
+}
+/**
+ * Checks whether AWS resource-information context keys are available for an IAM action.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when `aws:ResourceAccount`, `aws:ResourceOrgID`, and `aws:ResourceOrgPaths` may be populated.
+ */
+function actionSupportsAwsResourceInfoContextKeys(action) {
+    return !isAwsResourceInfoExcludedAction(action);
+}
+//# sourceMappingURL=resourceInfoContextKeys.js.map

package/dist/cjs/resourceInfoContextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceInfoContextKeys.js","sourceRoot":"","sources":["../../src/resourceInfoContextKeys.ts"],"names":[],"mappings":";;AAqCA,0EAGC;AAQD,4FAEC;AAlDD,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,6CAA6C;IAC7C,4BAA4B;IAC5B,0BAA0B;IAC1B,2CAA2C;IAC3C,kCAAkC;IAClC,gCAAgC;IAChC,kBAAkB;IAClB,2CAA2C;IAC3C,uBAAuB;IACvB,gCAAgC;IAChC,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAC3C,kCAAkC;IAClC,gCAAgC;IAChC,yCAAyC;IACzC,yBAAyB;IACzB,4BAA4B;IAC5B,oCAAoC;IACpC,2CAA2C;IAC3C,2CAA2C;IAC3C,uCAAuC;IACvC,8BAA8B;IAC9B,2CAA2C;CAC5C,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,SAAgB,+BAA+B,CAAC,MAAc;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAC5C,OAAO,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AAClG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,wCAAwC,CAAC,MAAc;IACrE,OAAO,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAA;AACjD,CAAC"}

package/dist/cjs/resourcePatterns.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export declare function convertResourcePatternToRegex(pattern: string): string;
+//# sourceMappingURL=resourcePatterns.d.ts.map

package/dist/cjs/resourcePatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.d.ts","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/cjs/resourcePatterns.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertResourcePatternToRegex = convertResourcePatternToRegex;
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+function convertResourcePatternToRegex(pattern) {
+    const regex = pattern.replace(/\$\{.*?\}/g, (match) => {
+        const name = match.substring(2, match.length - 1);
+        const camelName = name.at(0)?.toLowerCase() + name.substring(1);
+        return `(?<${camelName}>(.+?))`;
+    });
+    return `^${regex}$`;
+}
+//# sourceMappingURL=resourcePatterns.js.map

package/dist/cjs/resourcePatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.js","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":";;AAOA,sEAOC;AAdD;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC"}

package/dist/cjs/resourceTypes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * This is a compatibility check: it returns true when there is at least one
+ * concrete ARN that could satisfy both the resource string and the resource
+ * type pattern. Resource type variables may span resource-component separators
+ * such as `:` and `/`.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export declare function resourceStringMatchesResourceTypePattern(resourceString: string, resourcePattern: string): boolean;
+/**
+ * Reduce resource type patterns to the most specific patterns that match a resource string.
+ *
+ * This helper does not know about iam-data or service-specific resource type ordering. It uses
+ * the provided pattern set as context and removes matching parent patterns when a matching child
+ * pattern has all of the parent's literal structure plus additional literal structure. Wildcard
+ * resource strings preserve all matches because the wildcard may refer to parent and child resources.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePatterns - Candidate resource type ARN patterns
+ * @returns Matching resource type patterns with less-specific parent patterns removed, in input order
+ */
+export declare function mostSpecificMatchingResourceTypePatterns(resourceString: string, resourcePatterns: string[]): string[];
+//# sourceMappingURL=resourceTypes.d.ts.map

package/dist/cjs/resourceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAgCT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,EAAE,CAiBV"}