@actsecurity/iam-utils 0.1.82

package/dist/cjs/resourceTypes.js

@@ -0,0 +1,267 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceStringMatchesResourceTypePattern = resourceStringMatchesResourceTypePattern;
+exports.mostSpecificMatchingResourceTypePatterns = mostSpecificMatchingResourceTypePatterns;
+const arn_js_1 = require("./arn.js");
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * This is a compatibility check: it returns true when there is at least one
+ * concrete ARN that could satisfy both the resource string and the resource
+ * type pattern. Resource type variables may span resource-component separators
+ * such as `:` and `/`.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+function resourceStringMatchesResourceTypePattern(resourceString, resourcePattern) {
+    if (resourceString === '*') {
+        return true;
+    }
+    const resourceParts = (0, arn_js_1.splitArnParts)(resourceString);
+    const patternParts = (0, arn_js_1.splitArnParts)(resourcePattern);
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.partition, patternParts.partition)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.service, patternParts.service)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.region, patternParts.region)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.accountId, patternParts.accountId)) {
+        return false;
+    }
+    return resourceComponentMatchesResourceTypeComponent(resourceParts.resource, patternParts.resource);
+}
+/**
+ * Reduce resource type patterns to the most specific patterns that match a resource string.
+ *
+ * This helper does not know about iam-data or service-specific resource type ordering. It uses
+ * the provided pattern set as context and removes matching parent patterns when a matching child
+ * pattern has all of the parent's literal structure plus additional literal structure. Wildcard
+ * resource strings preserve all matches because the wildcard may refer to parent and child resources.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePatterns - Candidate resource type ARN patterns
+ * @returns Matching resource type patterns with less-specific parent patterns removed, in input order
+ */
+function mostSpecificMatchingResourceTypePatterns(resourceString, resourcePatterns) {
+    const matchingPatterns = resourcePatterns.filter((pattern) => resourceStringMatchesResourceTypePattern(resourceString, pattern));
+    if (resourceString.includes('*') || resourceString.includes('?')) {
+        return matchingPatterns;
+    }
+    return matchingPatterns.filter((candidatePattern, candidateIndex) => {
+        return !matchingPatterns.some((otherPattern, otherIndex) => {
+            return (otherIndex !== candidateIndex &&
+                resourceTypePatternIsMoreSpecific(otherPattern, candidatePattern));
+        });
+    });
+}
+/**
+ * Check whether one resource type pattern is more specific than another.
+ *
+ * @param possibleChildPattern - The pattern that may be more specific
+ * @param possibleParentPattern - The pattern that may be less specific
+ * @returns Whether the possible child has all parent literal structure plus more literal structure
+ */
+function resourceTypePatternIsMoreSpecific(possibleChildPattern, possibleParentPattern) {
+    const childLiteralText = literalTextFromResourceTypePattern(possibleChildPattern);
+    const parentLiteralText = literalTextFromResourceTypePattern(possibleParentPattern);
+    return (childLiteralText.length > parentLiteralText.length &&
+        childLiteralText.startsWith(parentLiteralText));
+}
+/**
+ * Extract the literal text from a resource type pattern by removing variable placeholders.
+ *
+ * @param pattern - The resource type pattern to inspect
+ * @returns Literal pattern text without `${Variable}` placeholders
+ */
+function literalTextFromResourceTypePattern(pattern) {
+    return tokenizeResourceTypePattern(pattern)
+        .filter((token) => token.type === 'literal')
+        .map((token) => token.value)
+        .join('');
+}
+/**
+ * Check whether a resource string component is compatible with a resource type pattern component.
+ *
+ * @param resourceComponent - The component value from the concrete or wildcard ARN
+ * @param resourceTypeComponent - The component value from the resource type pattern ARN
+ * @returns Whether at least one concrete component can satisfy both component patterns
+ */
+function resourceComponentMatchesResourceTypeComponent(resourceComponent, resourceTypeComponent) {
+    if (resourceTypeComponent === '*') {
+        return true;
+    }
+    if (resourceComponent === undefined || resourceTypeComponent === undefined) {
+        return false;
+    }
+    if (resourceComponent === '' || resourceTypeComponent === '') {
+        return (resourceComponent.localeCompare(resourceTypeComponent, undefined, {
+            sensitivity: 'accent'
+        }) === 0);
+    }
+    return patternsHaveIntersection(createResourceStringAutomaton(resourceComponent), createResourceTypePatternAutomaton(resourceTypeComponent));
+}
+/**
+ * Check whether two resource pattern automata accept at least one common string.
+ *
+ * @param first - The first pattern automaton to compare
+ * @param second - The second pattern automaton to compare
+ * @returns Whether the pattern languages have a non-empty intersection
+ */
+function patternsHaveIntersection(first, second) {
+    const visited = new Set();
+    const queue = [[0, 0]];
+    while (queue.length > 0) {
+        const [firstState, secondState] = queue.shift();
+        const key = `${firstState}:${secondState}`;
+        if (visited.has(key)) {
+            continue;
+        }
+        visited.add(key);
+        if (firstState === first.acceptingState && secondState === second.acceptingState) {
+            return true;
+        }
+        const firstTransitions = first.transitions(firstState);
+        const secondTransitions = second.transitions(secondState);
+        for (const transition of firstTransitions) {
+            if (!transition.consumes) {
+                queue.push([transition.nextState, secondState]);
+            }
+        }
+        for (const transition of secondTransitions) {
+            if (!transition.consumes) {
+                queue.push([firstState, transition.nextState]);
+            }
+        }
+        for (const firstTransition of firstTransitions) {
+            if (!firstTransition.consumes) {
+                continue;
+            }
+            for (const secondTransition of secondTransitions) {
+                if (!secondTransition.consumes) {
+                    continue;
+                }
+                if (characterMatchersIntersect(firstTransition.consumes, secondTransition.consumes)) {
+                    queue.push([firstTransition.nextState, secondTransition.nextState]);
+                }
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Create an automaton for a resource string that may contain IAM wildcards.
+ *
+ * @param resourceString - The resource string component to convert
+ * @returns An automaton accepting concrete strings matched by the resource string
+ */
+function createResourceStringAutomaton(resourceString) {
+    const chars = [...resourceString];
+    return {
+        acceptingState: chars.length,
+        transitions(state) {
+            if (state >= chars.length) {
+                return [];
+            }
+            const char = chars[state];
+            if (char === '*') {
+                return [{ nextState: state + 1 }, { nextState: state, consumes: 'any' }];
+            }
+            if (char === '?') {
+                return [{ nextState: state + 1, consumes: 'any' }];
+            }
+            return [{ nextState: state + 1, consumes: { char } }];
+        }
+    };
+}
+/**
+ * Create an automaton for a Service Authorization Reference resource type component.
+ *
+ * @param resourceTypePattern - The resource type component to convert
+ * @returns An automaton accepting concrete strings matched by the resource type component
+ */
+function createResourceTypePatternAutomaton(resourceTypePattern) {
+    const tokens = tokenizeResourceTypePattern(resourceTypePattern);
+    return {
+        acceptingState: tokens.length,
+        transitions(state) {
+            if (state >= tokens.length) {
+                return [];
+            }
+            const token = tokens[state];
+            if (token.type === 'variable') {
+                return [
+                    { nextState: state, consumes: token.characterMatcher },
+                    { nextState: state + 1, consumes: token.characterMatcher }
+                ];
+            }
+            return [{ nextState: state + 1, consumes: { char: token.value } }];
+        }
+    };
+}
+/**
+ * Tokenize a Service Authorization Reference resource type pattern.
+ *
+ * @param pattern - The resource type pattern component to tokenize
+ * @returns Tokens representing literals and `${Variable}` placeholders
+ */
+function tokenizeResourceTypePattern(pattern) {
+    const tokens = [];
+    const variableMatches = [...pattern.matchAll(/\$\{[0-9a-zA-Z]+\}/g)];
+    const patternIsSingleVariable = variableMatches.length === 1 && variableMatches[0][0] === pattern;
+    for (let i = 0; i < pattern.length;) {
+        if (pattern[i] === '$' && pattern[i + 1] === '{') {
+            const endIndex = pattern.indexOf('}', i + 2);
+            if (endIndex !== -1) {
+                tokens.push({
+                    type: 'variable',
+                    characterMatcher: patternIsSingleVariable ? 'nonSeparator' : 'any'
+                });
+                i = endIndex + 1;
+                continue;
+            }
+        }
+        tokens.push({ type: 'literal', value: pattern[i] });
+        i++;
+    }
+    return tokens;
+}
+/**
+ * Check whether two character matchers can consume the same character.
+ *
+ * @param first - The first character matcher
+ * @param second - The second character matcher
+ * @returns Whether the matchers have a non-empty intersection
+ */
+function characterMatchersIntersect(first, second) {
+    if (first === 'any' || second === 'any') {
+        return true;
+    }
+    if (first === 'nonSeparator' && second === 'nonSeparator') {
+        return true;
+    }
+    if (first === 'nonSeparator') {
+        return typeof second === 'object' && !isResourceComponentSeparator(second.char);
+    }
+    if (second === 'nonSeparator') {
+        return typeof first === 'object' && !isResourceComponentSeparator(first.char);
+    }
+    return first.char.localeCompare(second.char, undefined, { sensitivity: 'accent' }) === 0;
+}
+/**
+ * Check whether a character is a resource component separator.
+ *
+ * @param char - The character to check
+ * @returns Whether the character separates resource component segments
+ */
+function isResourceComponentSeparator(char) {
+    return char === ':' || char === '/';
+}
+//# sourceMappingURL=resourceTypes.js.map

package/dist/cjs/resourceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":";;AAqDA,4FAmCC;AAcD,4FAoBC;AA1HD,qCAAwC;AAsCxC;;;;;;;;;;;;;;GAcG;AACH,SAAgB,wCAAwC,CACtD,cAAsB,EACtB,eAAuB;IAEvB,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,sBAAa,EAAC,cAAc,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,IAAA,sBAAa,EAAC,eAAe,CAAC,CAAA;IAEnD,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,6CAA6C,CAClD,aAAa,CAAC,QAAQ,EACtB,YAAY,CAAC,QAAQ,CACtB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,wCAAwC,CACtD,cAAsB,EACtB,gBAA0B;IAE1B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3D,wCAAwC,CAAC,cAAc,EAAE,OAAO,CAAC,CAClE,CAAA;IAED,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,EAAE;QAClE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE;YACzD,OAAO,CACL,UAAU,KAAK,cAAc;gBAC7B,iCAAiC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAClE,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iCAAiC,CACxC,oBAA4B,EAC5B,qBAA6B;IAE7B,MAAM,gBAAgB,GAAG,kCAAkC,CAAC,oBAAoB,CAAC,CAAA;IACjF,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,qBAAqB,CAAC,CAAA;IAEnF,OAAO,CACL,gBAAgB,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM;QAClD,gBAAgB,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAC/C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,OAAe;IACzD,OAAO,2BAA2B,CAAC,OAAO,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6CAA6C,CACpD,iBAAqC,EACrC,qBAAyC;IAEzC,IAAI,qBAAqB,KAAK,GAAG,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,iBAAiB,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,iBAAiB,KAAK,EAAE,IAAI,qBAAqB,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,CACL,iBAAiB,CAAC,aAAa,CAAC,qBAAqB,EAAE,SAAS,EAAE;YAChE,WAAW,EAAE,QAAQ;SACtB,CAAC,KAAK,CAAC,CACT,CAAA;IACH,CAAC;IAED,OAAO,wBAAwB,CAC7B,6BAA6B,CAAC,iBAAiB,CAAC,EAChD,kCAAkC,CAAC,qBAAqB,CAAC,CAC1D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,KAAuB,EAAE,MAAwB;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAE1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,WAAW,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEhB,IAAI,UAAU,KAAK,KAAK,CAAC,cAAc,IAAI,WAAW,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YACjF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAEzD,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;YACjD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE,CAAC;gBACjD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;oBAC/B,SAAQ;gBACV,CAAC;gBAED,IAAI,0BAA0B,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpF,KAAK,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,cAAsB;IAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAA;IACjC,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,WAAW,CAAC,KAAa;YACvB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACvD,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,mBAA2B;IACrE,MAAM,MAAM,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAA;IAC/D,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,WAAW,CAAC,KAAa;YACvB,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,OAAO;oBACL,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE;oBACtD,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE;iBAC3D,CAAA;YACH,CAAC;YACD,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpE,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,MAAM,GAAwB,EAAE,CAAA;IACtC,MAAM,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAA;IACpE,MAAM,uBAAuB,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAA;IAElG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACpC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,UAAU;oBAChB,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;iBACnE,CAAC,CAAA;gBACF,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAA;gBAChB,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAAuB,EAAE,MAAwB;IACnF,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,KAAK,cAAc,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,IAAY;IAChD,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAA;AACrC,CAAC"}

package/dist/cjs/resources.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Convert an AWS wildcard ARN pattern (e.g. "arn:aws:s3:::bucket/*") into a RegExp.
+ *
+ * @param pattern The ARN pattern string with wildcards
+ * @returns RegExp that matches ARNs according to the wildcard pattern
+ */
+export declare function resourceArnWithWildcardsToRegex(pattern: string): RegExp;
+//# sourceMappingURL=resources.d.ts.map

package/dist/cjs/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvE"}

package/dist/cjs/resources.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceArnWithWildcardsToRegex = resourceArnWithWildcardsToRegex;
+/**
+ * Convert an AWS wildcard ARN pattern (e.g. "arn:aws:s3:::bucket/*") into a RegExp.
+ *
+ * @param pattern The ARN pattern string with wildcards
+ * @returns RegExp that matches ARNs according to the wildcard pattern
+ */
+function resourceArnWithWildcardsToRegex(pattern) {
+    const parts = pattern.split('*').map((s) => s.replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&'));
+    return new RegExp('^' + parts.join('.*?') + '$');
+}
+//# sourceMappingURL=resources.js.map

package/dist/cjs/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":";;AAMA,0EAGC;AATD;;;;;GAKG;AACH,SAAgB,+BAA+B,CAAC,OAAe;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAA;IACtF,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;AAClD,CAAC"}

package/dist/cjs/s3.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Checks to see if an ARN is an S3 bucket or object ARN
+ *
+ * @param arn the ARN to check
+ * @returns whether the ARN is an S3 bucket or object ARN
+ */
+export declare function isS3BucketOrObjectArn(arn: string): boolean;
+/**
+ * Get the bucket ARN from an S3 bucket or object ARN. Does not validate the input ARN.
+ *
+ * @param bucketOrObjectArn the ARN of the S3 bucket or object
+ * @returns the ARN of the S3 bucket
+ */
+export declare function bucketArn(bucketOrObjectArn: string): string;
+//# sourceMappingURL=s3.d.ts.map

package/dist/cjs/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/s3.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE3D"}

package/dist/cjs/s3.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isS3BucketOrObjectArn = isS3BucketOrObjectArn;
+exports.bucketArn = bucketArn;
+const arn_js_1 = require("./arn.js");
+/**
+ * Checks to see if an ARN is an S3 bucket or object ARN
+ *
+ * @param arn the ARN to check
+ * @returns whether the ARN is an S3 bucket or object ARN
+ */
+function isS3BucketOrObjectArn(arn) {
+    const arnParts = (0, arn_js_1.splitArnParts)(arn);
+    if (arnParts.service !== 's3') {
+        return false;
+    }
+    if (!arnParts.resource) {
+        return false;
+    }
+    // S3 bucket or object ARNs have no account ID or region
+    if (arnParts.accountId || arnParts.region) {
+        return false;
+    }
+    return true;
+}
+/**
+ * Get the bucket ARN from an S3 bucket or object ARN. Does not validate the input ARN.
+ *
+ * @param bucketOrObjectArn the ARN of the S3 bucket or object
+ * @returns the ARN of the S3 bucket
+ */
+function bucketArn(bucketOrObjectArn) {
+    return bucketOrObjectArn.split('/').at(0);
+}
+//# sourceMappingURL=s3.js.map

package/dist/cjs/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../src/s3.ts"],"names":[],"mappings":";;AAQA,sDAaC;AAQD,8BAEC;AA/BD,qCAAwC;AAExC;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,MAAM,QAAQ,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAA;IACnC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,wDAAwD;IACxD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,iBAAyB;IACjD,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;AAC5C,CAAC"}

package/dist/esm/actions.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Checks to see if the action matches the provided IAM action pattern.
+ *
+ * @param action the action to check, should not contain wildcards
+ * @param pattern the pattern to match against, may contain wildcards
+ * @returns true if the action matches the pattern, false otherwise
+ */
+export declare function actionMatchesPattern(action: string, pattern: string): boolean;
+//# sourceMappingURL=actions.d.ts.map

package/dist/esm/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAuC7E"}

package/dist/esm/actions.js

@@ -0,0 +1,62 @@
+/**
+ * Checks to see if the action matches the provided IAM action pattern.
+ *
+ * @param action the action to check, should not contain wildcards
+ * @param pattern the pattern to match against, may contain wildcards
+ * @returns true if the action matches the pattern, false otherwise
+ */
+export function actionMatchesPattern(action, pattern) {
+    const unescapedAction = unescapeUnicodeCharacters(action);
+    const unescapedPattern = unescapeUnicodeCharacters(pattern);
+    // Full wildcard matches everything
+    if (unescapedPattern === '*') {
+        return true;
+    }
+    // Split into service and action parts
+    const patternColonIndex = unescapedPattern.indexOf(':');
+    const actionColonIndex = unescapedAction.indexOf(':');
+    // If pattern has no colon, it must match the entire action exactly (case-insensitive)
+    if (patternColonIndex === -1) {
+        if (actionColonIndex === -1) {
+            return unescapedAction.toLowerCase() === unescapedPattern.toLowerCase();
+        }
+        return false;
+    }
+    // If action has no colon but pattern does, no match
+    if (actionColonIndex === -1) {
+        return false;
+    }
+    const patternService = unescapedPattern.substring(0, patternColonIndex);
+    const patternAction = unescapedPattern.substring(patternColonIndex + 1);
+    const actionService = unescapedAction.substring(0, actionColonIndex);
+    const actionAction = unescapedAction.substring(actionColonIndex + 1);
+    // Service must match exactly (case-insensitive), no wildcards allowed
+    if (patternService.toLowerCase() !== actionService.toLowerCase()) {
+        return false;
+    }
+    // Match the action part with wildcards
+    const regex = convertStringToPattern(patternAction);
+    return regex.test(actionAction);
+}
+/**
+ * Converts an action string pattern to a regular expression for matching.
+ *
+ * @param actionString the IAM action pattern string to convert
+ * @returns RegExp that matches the pattern (case-insensitive)
+ */
+function convertStringToPattern(actionString) {
+    const pattern = '^' + actionString.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+    return new RegExp(pattern, 'i');
+}
+/**
+ * Unescapes unicode characters in a string.
+ *
+ * @param str The string to unescape
+ * @returns The string with any escaped unicode characters replaced with their actual characters
+ */
+function unescapeUnicodeCharacters(str) {
+    return str.replace(/\\u([\dA-Fa-f]{4})/gi, (match, code) => {
+        return String.fromCharCode(parseInt(code, 16));
+    });
+}
+//# sourceMappingURL=actions.js.map

package/dist/esm/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAClE,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;IACzD,MAAM,gBAAgB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAA;IAE3D,mCAAmC;IACnC,IAAI,gBAAgB,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,sCAAsC;IACtC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAErD,sFAAsF;IACtF,IAAI,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7B,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5B,OAAO,eAAe,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAAA;QACzE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,oDAAoD;IACpD,IAAI,gBAAgB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACvE,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAA;IACvE,MAAM,aAAa,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAA;IAEpE,sEAAsE;IACtE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,uCAAuC;IACvC,MAAM,KAAK,GAAG,sBAAsB,CAAC,aAAa,CAAC,CAAA;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,YAAoB;IAClD,MAAM,OAAO,GAAG,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;IAClF,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACzD,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/esm/arn.d.ts

@@ -0,0 +1,48 @@
+export interface ArnParts {
+    /**
+     * The partition of the ARN such as aws, aws-cn, aws-us-gov
+     */
+    partition: string | undefined;
+    /**
+     * The service of the ARN such as s3, ec2, iam
+     */
+    service: string | undefined;
+    /**
+     * The region of the ARN such as us-east-1, us-west-2
+     */
+    region: string | undefined;
+    /**
+     * The account ID of the ARN
+     */
+    accountId: string | undefined;
+    /**
+     * The resource portion of the ARN, includes the resource type, path and name
+     */
+    resource: string | undefined;
+    /**
+     * The resource type of the ARN, such as instance, user, topic, may be undefined for
+     * some S3 buckets.
+     */
+    resourceType: string | undefined;
+    /**
+     * The resource path and name of the ARN, such as Development/user1, or MyTopic or my-bucket/my-object.txt
+     */
+    resourcePath: string | undefined;
+}
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+export declare function splitArnParts(arn: string): ArnParts;
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (without the separator) and the second segment being the resource id.
+ */
+export declare function getResourceSegments(service: string, accountId: string, region: string, resourceString: string): [string, string];
+//# sourceMappingURL=arn.d.ts.map

package/dist/esm/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAE3B;;OAEG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B;;OAEG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IAE7B;;OAEG;IACH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAE5B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC;;OAEG;IACH,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CAkBnD;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,GACrB,CAAC,MAAM,EAAE,MAAM,CAAC,CA+BlB"}

package/dist/esm/arn.js

@@ -0,0 +1,63 @@
+/**
+ * Split an ARN into its parts
+ *
+ * @param arn the arn to split
+ * @returns the parts of the ARN
+ */
+export function splitArnParts(arn) {
+    const parts = arn.split(':');
+    const partition = parts.at(1);
+    const service = parts.at(2);
+    const region = parts.at(3);
+    const accountId = parts.at(4);
+    const resource = parts.slice(5).join(':');
+    const [resourceType, resourcePath] = getResourceSegments(service, accountId, region, resource);
+    return {
+        partition,
+        service,
+        region,
+        accountId,
+        resource,
+        resourceType,
+        resourcePath
+    };
+}
+/**
+ * Get the product/id segments of the resource portion of an ARN.
+ * The first segment is the product segment and the second segment is the resource id segment.
+ * This could be split by a colon or a slash, so it checks for both. It also checks for S3 buckets/objects.
+ *
+ * @param resource The resource to get the resource segments. Must be an ARN resource.
+ * @returns a tuple with the first segment being the product segment (without the separator) and the second segment being the resource id.
+ */
+export function getResourceSegments(service, accountId, region, resourceString) {
+    // This is terrible, and I hate it
+    if ((service === 's3' && accountId === '' && region === '') ||
+        service === 'sns' ||
+        service === 'sqs') {
+        return ['', resourceString];
+    }
+    if (resourceString.startsWith('/')) {
+        resourceString = resourceString.slice(1);
+    }
+    const slashIndex = resourceString.indexOf('/');
+    const colonIndex = resourceString.indexOf(':');
+    let splitIndex = slashIndex;
+    if (slashIndex != -1 && colonIndex != -1) {
+        splitIndex = Math.min(slashIndex, colonIndex) + 1;
+    }
+    else if (slashIndex == -1 && colonIndex == -1) {
+        splitIndex = resourceString.length + 1;
+    }
+    else if (colonIndex == -1) {
+        splitIndex = slashIndex + 1;
+    }
+    else if (slashIndex == -1) {
+        splitIndex = colonIndex + 1;
+    }
+    else {
+        throw new Error(`Unable to split resource ${resourceString}`);
+    }
+    return [resourceString.slice(0, splitIndex - 1), resourceString.slice(splitIndex)];
+}
+//# sourceMappingURL=arn.js.map

package/dist/esm/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAsCA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAA;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAE9F,OAAO;QACL,SAAS;QACT,OAAO;QACP,MAAM;QACN,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,YAAY;KACb,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,cAAsB;IAEtB,kCAAkC;IAClC,IACE,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;QACvD,OAAO,KAAK,KAAK;QACjB,OAAO,KAAK,KAAK,EACjB,CAAC;QACD,OAAO,CAAC,EAAE,EAAE,cAAc,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9C,IAAI,UAAU,GAAG,UAAU,CAAA;IAC3B,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QACzC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAA;IACxC,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,UAAU,GAAG,UAAU,GAAG,CAAC,CAAA;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,4BAA4B,cAAc,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;AACpF,CAAC"}

package/dist/esm/index.d.ts

@@ -0,0 +1,9 @@
+export { actionMatchesPattern } from './actions.js';
+export { getResourceSegments, splitArnParts, type ArnParts } from './arn.js';
+export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
+export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { mostSpecificMatchingResourceTypePatterns, resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
+export { actionSupportsAwsResourceInfoContextKeys, isAwsResourceInfoExcludedAction } from './resourceInfoContextKeys.js';
+export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EACL,wCAAwC,EACxC,wCAAwC,EACzC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,wCAAwC,EACxC,+BAA+B,EAChC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/esm/index.js

@@ -0,0 +1,9 @@
+export { actionMatchesPattern } from './actions.js';
+export { getResourceSegments, splitArnParts } from './arn.js';
+export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
+export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { mostSpecificMatchingResourceTypePatterns, resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
+export { actionSupportsAwsResourceInfoContextKeys, isAwsResourceInfoExcludedAction } from './resourceInfoContextKeys.js';
+export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EACL,wCAAwC,EACxC,wCAAwC,EACzC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,wCAAwC,EACxC,+BAA+B,EAChC,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+    "type": "module"
+}