@actsecurity/iam-utils 0.1.82

package/dist/esm/principals.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Transform an assumed role session ARN into a role ARN
+ *
+ * @param assumedRoleArn the assumed role session ARN
+ * @returns the role ARN for the assumed role session
+ */
+export declare function convertAssumedRoleArnToRoleArn(assumedRoleArn: string): string;
+/**
+ * Create an assumed role ARN from a role ARN and a session name
+ *
+ * @param roleArn the role ARN to create an assumed role ARN from
+ * @param sessionName the session name to use
+ * @returns the assumed role ARN
+ */
+export declare function convertRoleArnToAssumedRoleArn(roleArn: string, sessionName: string): string;
+/**
+ * Tests if a principal string is an assumed role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an assumed role ARN, false otherwise
+ */
+export declare function isAssumedRoleArn(principal: string): boolean;
+/**
+ * Test if a principal string is an IAM user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM user ARN, false otherwise
+ */
+export declare function isIamUserArn(principal: string): boolean;
+/**
+ * Test if a principal string is an IAM Role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM role ARN, false otherwise
+ */
+export declare function isIamRoleArn(principal: string): boolean;
+/**
+ * Test if a principal string is a federated user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a federated user ARN, false otherwise
+ */
+export declare function isFederatedUserArn(principal: string): boolean;
+/**
+ * Test if a principal string is an ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an ARN, false otherwise
+ */
+export declare function isArnPrincipal(principal: string): boolean;
+/**
+ * Test if a principal string is a service principal
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a service principal, false otherwise
+ */
+export declare function isServicePrincipal(principal: string): boolean;
+//# sourceMappingURL=principals.d.ts.map

package/dist/esm/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAI3F;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEvD;AAID;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/esm/principals.js

@@ -0,0 +1,83 @@
+import { splitArnParts } from './arn.js';
+/**
+ * Transform an assumed role session ARN into a role ARN
+ *
+ * @param assumedRoleArn the assumed role session ARN
+ * @returns the role ARN for the assumed role session
+ */
+export function convertAssumedRoleArnToRoleArn(assumedRoleArn) {
+    const arnParts = splitArnParts(assumedRoleArn);
+    const rolePathAndName = arnParts.resourcePath?.split('/').slice(0, -1).join('/');
+    return `arn:${arnParts.partition}:iam::${arnParts.accountId}:role/${rolePathAndName}`;
+}
+/**
+ * Create an assumed role ARN from a role ARN and a session name
+ *
+ * @param roleArn the role ARN to create an assumed role ARN from
+ * @param sessionName the session name to use
+ * @returns the assumed role ARN
+ */
+export function convertRoleArnToAssumedRoleArn(roleArn, sessionName) {
+    const arnParts = splitArnParts(roleArn);
+    const rolePathAndName = arnParts.resourcePath;
+    return `arn:${arnParts.partition}:sts::${arnParts.accountId}:assumed-role/${rolePathAndName}/${sessionName}`;
+}
+const assumedRoleArnRegex = /^arn:[a-zA-Z\-]+:sts::\d{12}:assumed-role\/.*$/;
+/**
+ * Tests if a principal string is an assumed role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an assumed role ARN, false otherwise
+ */
+export function isAssumedRoleArn(principal) {
+    return assumedRoleArnRegex.test(principal);
+}
+const userArnRegex = /^arn:[a-zA-Z\-]+:iam::\d{12}:user\/.*$/;
+/**
+ * Test if a principal string is an IAM user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM user ARN, false otherwise
+ */
+export function isIamUserArn(principal) {
+    return userArnRegex.test(principal);
+}
+const iamRoleArnRegex = /^arn:[a-zA-Z\-]+:iam::\d{12}:role\/.*$/;
+/**
+ * Test if a principal string is an IAM Role ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an IAM role ARN, false otherwise
+ */
+export function isIamRoleArn(principal) {
+    return iamRoleArnRegex.test(principal);
+}
+const federatedUserArnRegex = /^arn:[a-zA-Z\-]+:sts::\d{12}:federated-user\/.*$/;
+/**
+ * Test if a principal string is a federated user ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a federated user ARN, false otherwise
+ */
+export function isFederatedUserArn(principal) {
+    return federatedUserArnRegex.test(principal);
+}
+/**
+ * Test if a principal string is an ARN
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is an ARN, false otherwise
+ */
+export function isArnPrincipal(principal) {
+    return principal.startsWith('arn:');
+}
+/**
+ * Test if a principal string is a service principal
+ *
+ * @param principal the principal string to test
+ * @returns true if the principal is a service principal, false otherwise
+ */
+export function isServicePrincipal(principal) {
+    return !isArnPrincipal(principal) && principal.endsWith('amazonaws.com');
+}
+//# sourceMappingURL=principals.js.map

package/dist/esm/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../../src/principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,cAAsB;IACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IAC9C,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAChF,OAAO,OAAO,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,SAAS,eAAe,EAAE,CAAA;AACvF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAAe,EAAE,WAAmB;IACjF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAA;IAC7C,OAAO,OAAO,QAAQ,CAAC,SAAS,SAAS,QAAQ,CAAC,SAAS,iBAAiB,eAAe,IAAI,WAAW,EAAE,CAAA;AAC9G,CAAC;AAED,MAAM,mBAAmB,GAAG,gDAAgD,CAAA;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,YAAY,GAAG,wCAAwC,CAAA;AAE7D;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC;AAED,MAAM,eAAe,GAAG,wCAAwC,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,qBAAqB,GAAG,kDAAkD,CAAA;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;AAC1E,CAAC"}

package/dist/esm/resourceInfoContextKeys.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Checks whether an IAM action is excluded from AWS resource-information context keys.
+ *
+ * AWS does not populate `aws:ResourceAccount`, `aws:ResourceOrgID`, or
+ * `aws:ResourceOrgPaths` for every action. This predicate captures the documented
+ * excluded actions currently used by Cloud Copilot request-context generation.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when AWS resource-information context keys are not available.
+ */
+export declare function isAwsResourceInfoExcludedAction(action: string): boolean;
+/**
+ * Checks whether AWS resource-information context keys are available for an IAM action.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when `aws:ResourceAccount`, `aws:ResourceOrgID`, and `aws:ResourceOrgPaths` may be populated.
+ */
+export declare function actionSupportsAwsResourceInfoContextKeys(action: string): boolean;
+//# sourceMappingURL=resourceInfoContextKeys.d.ts.map

package/dist/esm/resourceInfoContextKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceInfoContextKeys.d.ts","sourceRoot":"","sources":["../../src/resourceInfoContextKeys.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGvE;AAED;;;;;GAKG;AACH,wBAAgB,wCAAwC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhF"}

package/dist/esm/resourceInfoContextKeys.js

@@ -0,0 +1,50 @@
+const awsResourceInfoExcludedActions = new Set([
+    'auditmanager:updateassessmentframeworkshare',
+    'detective:acceptinvitation',
+    'ds:acceptshareddirectory',
+    'ec2:accepttransitgatewaypeeringattachment',
+    'ec2:acceptvpcendpointconnections',
+    'ec2:acceptvpcpeeringconnection',
+    'ec2:copysnapshot',
+    'ec2:createtransitgatewaypeeringattachment',
+    'ec2:createvpcendpoint',
+    'ec2:createvpcpeeringconnection',
+    'ec2:deletetransitgatewaypeeringattachment',
+    'ec2:deletevpcpeeringconnection',
+    'ec2:rejecttransitgatewaypeeringattachment',
+    'ec2:rejectvpcendpointconnections',
+    'ec2:rejectvpcpeeringconnection',
+    'guardduty:acceptadministratorinvitation',
+    'macie2:acceptinvitation',
+    'es:acceptinboundconnection',
+    'route53:associatevpcwithhostedzone',
+    'route53:createvpcassociationauthorization',
+    'route53:deletevpcassociationauthorization',
+    'route53:disassociatevpcfromhostedzone',
+    'route53:listhostedzonesbyvpc',
+    'securityhub:acceptadministratorinvitation'
+]);
+/**
+ * Checks whether an IAM action is excluded from AWS resource-information context keys.
+ *
+ * AWS does not populate `aws:ResourceAccount`, `aws:ResourceOrgID`, or
+ * `aws:ResourceOrgPaths` for every action. This predicate captures the documented
+ * excluded actions currently used by Cloud Copilot request-context generation.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when AWS resource-information context keys are not available.
+ */
+export function isAwsResourceInfoExcludedAction(action) {
+    const lowerCaseAction = action.toLowerCase();
+    return lowerCaseAction.startsWith('ebs:') || awsResourceInfoExcludedActions.has(lowerCaseAction);
+}
+/**
+ * Checks whether AWS resource-information context keys are available for an IAM action.
+ *
+ * @param action - IAM action to inspect, such as `s3:GetObject`.
+ * @returns True when `aws:ResourceAccount`, `aws:ResourceOrgID`, and `aws:ResourceOrgPaths` may be populated.
+ */
+export function actionSupportsAwsResourceInfoContextKeys(action) {
+    return !isAwsResourceInfoExcludedAction(action);
+}
+//# sourceMappingURL=resourceInfoContextKeys.js.map

package/dist/esm/resourceInfoContextKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceInfoContextKeys.js","sourceRoot":"","sources":["../../src/resourceInfoContextKeys.ts"],"names":[],"mappings":"AAAA,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,6CAA6C;IAC7C,4BAA4B;IAC5B,0BAA0B;IAC1B,2CAA2C;IAC3C,kCAAkC;IAClC,gCAAgC;IAChC,kBAAkB;IAClB,2CAA2C;IAC3C,uBAAuB;IACvB,gCAAgC;IAChC,2CAA2C;IAC3C,gCAAgC;IAChC,2CAA2C;IAC3C,kCAAkC;IAClC,gCAAgC;IAChC,yCAAyC;IACzC,yBAAyB;IACzB,4BAA4B;IAC5B,oCAAoC;IACpC,2CAA2C;IAC3C,2CAA2C;IAC3C,uCAAuC;IACvC,8BAA8B;IAC9B,2CAA2C;CAC5C,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAC5C,OAAO,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wCAAwC,CAAC,MAAc;IACrE,OAAO,CAAC,+BAA+B,CAAC,MAAM,CAAC,CAAA;AACjD,CAAC"}

package/dist/esm/resourcePatterns.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export declare function convertResourcePatternToRegex(pattern: string): string;
+//# sourceMappingURL=resourcePatterns.d.ts.map

package/dist/esm/resourcePatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.d.ts","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/esm/resourcePatterns.js

@@ -0,0 +1,16 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export function convertResourcePatternToRegex(pattern) {
+    const regex = pattern.replace(/\$\{.*?\}/g, (match) => {
+        const name = match.substring(2, match.length - 1);
+        const camelName = name.at(0)?.toLowerCase() + name.substring(1);
+        return `(?<${camelName}>(.+?))`;
+    });
+    return `^${regex}$`;
+}
+//# sourceMappingURL=resourcePatterns.js.map

package/dist/esm/resourcePatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.js","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC"}

package/dist/esm/resourceTypes.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * This is a compatibility check: it returns true when there is at least one
+ * concrete ARN that could satisfy both the resource string and the resource
+ * type pattern. Resource type variables may span resource-component separators
+ * such as `:` and `/`.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export declare function resourceStringMatchesResourceTypePattern(resourceString: string, resourcePattern: string): boolean;
+/**
+ * Reduce resource type patterns to the most specific patterns that match a resource string.
+ *
+ * This helper does not know about iam-data or service-specific resource type ordering. It uses
+ * the provided pattern set as context and removes matching parent patterns when a matching child
+ * pattern has all of the parent's literal structure plus additional literal structure. Wildcard
+ * resource strings preserve all matches because the wildcard may refer to parent and child resources.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePatterns - Candidate resource type ARN patterns
+ * @returns Matching resource type patterns with less-specific parent patterns removed, in input order
+ */
+export declare function mostSpecificMatchingResourceTypePatterns(resourceString: string, resourcePatterns: string[]): string[];
+//# sourceMappingURL=resourceTypes.d.ts.map

package/dist/esm/resourceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAsCA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAgCT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,EAAE,CAiBV"}

package/dist/esm/resourceTypes.js

@@ -0,0 +1,263 @@
+import { splitArnParts } from './arn.js';
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * This is a compatibility check: it returns true when there is at least one
+ * concrete ARN that could satisfy both the resource string and the resource
+ * type pattern. Resource type variables may span resource-component separators
+ * such as `:` and `/`.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export function resourceStringMatchesResourceTypePattern(resourceString, resourcePattern) {
+    if (resourceString === '*') {
+        return true;
+    }
+    const resourceParts = splitArnParts(resourceString);
+    const patternParts = splitArnParts(resourcePattern);
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.partition, patternParts.partition)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.service, patternParts.service)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.region, patternParts.region)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.accountId, patternParts.accountId)) {
+        return false;
+    }
+    return resourceComponentMatchesResourceTypeComponent(resourceParts.resource, patternParts.resource);
+}
+/**
+ * Reduce resource type patterns to the most specific patterns that match a resource string.
+ *
+ * This helper does not know about iam-data or service-specific resource type ordering. It uses
+ * the provided pattern set as context and removes matching parent patterns when a matching child
+ * pattern has all of the parent's literal structure plus additional literal structure. Wildcard
+ * resource strings preserve all matches because the wildcard may refer to parent and child resources.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePatterns - Candidate resource type ARN patterns
+ * @returns Matching resource type patterns with less-specific parent patterns removed, in input order
+ */
+export function mostSpecificMatchingResourceTypePatterns(resourceString, resourcePatterns) {
+    const matchingPatterns = resourcePatterns.filter((pattern) => resourceStringMatchesResourceTypePattern(resourceString, pattern));
+    if (resourceString.includes('*') || resourceString.includes('?')) {
+        return matchingPatterns;
+    }
+    return matchingPatterns.filter((candidatePattern, candidateIndex) => {
+        return !matchingPatterns.some((otherPattern, otherIndex) => {
+            return (otherIndex !== candidateIndex &&
+                resourceTypePatternIsMoreSpecific(otherPattern, candidatePattern));
+        });
+    });
+}
+/**
+ * Check whether one resource type pattern is more specific than another.
+ *
+ * @param possibleChildPattern - The pattern that may be more specific
+ * @param possibleParentPattern - The pattern that may be less specific
+ * @returns Whether the possible child has all parent literal structure plus more literal structure
+ */
+function resourceTypePatternIsMoreSpecific(possibleChildPattern, possibleParentPattern) {
+    const childLiteralText = literalTextFromResourceTypePattern(possibleChildPattern);
+    const parentLiteralText = literalTextFromResourceTypePattern(possibleParentPattern);
+    return (childLiteralText.length > parentLiteralText.length &&
+        childLiteralText.startsWith(parentLiteralText));
+}
+/**
+ * Extract the literal text from a resource type pattern by removing variable placeholders.
+ *
+ * @param pattern - The resource type pattern to inspect
+ * @returns Literal pattern text without `${Variable}` placeholders
+ */
+function literalTextFromResourceTypePattern(pattern) {
+    return tokenizeResourceTypePattern(pattern)
+        .filter((token) => token.type === 'literal')
+        .map((token) => token.value)
+        .join('');
+}
+/**
+ * Check whether a resource string component is compatible with a resource type pattern component.
+ *
+ * @param resourceComponent - The component value from the concrete or wildcard ARN
+ * @param resourceTypeComponent - The component value from the resource type pattern ARN
+ * @returns Whether at least one concrete component can satisfy both component patterns
+ */
+function resourceComponentMatchesResourceTypeComponent(resourceComponent, resourceTypeComponent) {
+    if (resourceTypeComponent === '*') {
+        return true;
+    }
+    if (resourceComponent === undefined || resourceTypeComponent === undefined) {
+        return false;
+    }
+    if (resourceComponent === '' || resourceTypeComponent === '') {
+        return (resourceComponent.localeCompare(resourceTypeComponent, undefined, {
+            sensitivity: 'accent'
+        }) === 0);
+    }
+    return patternsHaveIntersection(createResourceStringAutomaton(resourceComponent), createResourceTypePatternAutomaton(resourceTypeComponent));
+}
+/**
+ * Check whether two resource pattern automata accept at least one common string.
+ *
+ * @param first - The first pattern automaton to compare
+ * @param second - The second pattern automaton to compare
+ * @returns Whether the pattern languages have a non-empty intersection
+ */
+function patternsHaveIntersection(first, second) {
+    const visited = new Set();
+    const queue = [[0, 0]];
+    while (queue.length > 0) {
+        const [firstState, secondState] = queue.shift();
+        const key = `${firstState}:${secondState}`;
+        if (visited.has(key)) {
+            continue;
+        }
+        visited.add(key);
+        if (firstState === first.acceptingState && secondState === second.acceptingState) {
+            return true;
+        }
+        const firstTransitions = first.transitions(firstState);
+        const secondTransitions = second.transitions(secondState);
+        for (const transition of firstTransitions) {
+            if (!transition.consumes) {
+                queue.push([transition.nextState, secondState]);
+            }
+        }
+        for (const transition of secondTransitions) {
+            if (!transition.consumes) {
+                queue.push([firstState, transition.nextState]);
+            }
+        }
+        for (const firstTransition of firstTransitions) {
+            if (!firstTransition.consumes) {
+                continue;
+            }
+            for (const secondTransition of secondTransitions) {
+                if (!secondTransition.consumes) {
+                    continue;
+                }
+                if (characterMatchersIntersect(firstTransition.consumes, secondTransition.consumes)) {
+                    queue.push([firstTransition.nextState, secondTransition.nextState]);
+                }
+            }
+        }
+    }
+    return false;
+}
+/**
+ * Create an automaton for a resource string that may contain IAM wildcards.
+ *
+ * @param resourceString - The resource string component to convert
+ * @returns An automaton accepting concrete strings matched by the resource string
+ */
+function createResourceStringAutomaton(resourceString) {
+    const chars = [...resourceString];
+    return {
+        acceptingState: chars.length,
+        transitions(state) {
+            if (state >= chars.length) {
+                return [];
+            }
+            const char = chars[state];
+            if (char === '*') {
+                return [{ nextState: state + 1 }, { nextState: state, consumes: 'any' }];
+            }
+            if (char === '?') {
+                return [{ nextState: state + 1, consumes: 'any' }];
+            }
+            return [{ nextState: state + 1, consumes: { char } }];
+        }
+    };
+}
+/**
+ * Create an automaton for a Service Authorization Reference resource type component.
+ *
+ * @param resourceTypePattern - The resource type component to convert
+ * @returns An automaton accepting concrete strings matched by the resource type component
+ */
+function createResourceTypePatternAutomaton(resourceTypePattern) {
+    const tokens = tokenizeResourceTypePattern(resourceTypePattern);
+    return {
+        acceptingState: tokens.length,
+        transitions(state) {
+            if (state >= tokens.length) {
+                return [];
+            }
+            const token = tokens[state];
+            if (token.type === 'variable') {
+                return [
+                    { nextState: state, consumes: token.characterMatcher },
+                    { nextState: state + 1, consumes: token.characterMatcher }
+                ];
+            }
+            return [{ nextState: state + 1, consumes: { char: token.value } }];
+        }
+    };
+}
+/**
+ * Tokenize a Service Authorization Reference resource type pattern.
+ *
+ * @param pattern - The resource type pattern component to tokenize
+ * @returns Tokens representing literals and `${Variable}` placeholders
+ */
+function tokenizeResourceTypePattern(pattern) {
+    const tokens = [];
+    const variableMatches = [...pattern.matchAll(/\$\{[0-9a-zA-Z]+\}/g)];
+    const patternIsSingleVariable = variableMatches.length === 1 && variableMatches[0][0] === pattern;
+    for (let i = 0; i < pattern.length;) {
+        if (pattern[i] === '$' && pattern[i + 1] === '{') {
+            const endIndex = pattern.indexOf('}', i + 2);
+            if (endIndex !== -1) {
+                tokens.push({
+                    type: 'variable',
+                    characterMatcher: patternIsSingleVariable ? 'nonSeparator' : 'any'
+                });
+                i = endIndex + 1;
+                continue;
+            }
+        }
+        tokens.push({ type: 'literal', value: pattern[i] });
+        i++;
+    }
+    return tokens;
+}
+/**
+ * Check whether two character matchers can consume the same character.
+ *
+ * @param first - The first character matcher
+ * @param second - The second character matcher
+ * @returns Whether the matchers have a non-empty intersection
+ */
+function characterMatchersIntersect(first, second) {
+    if (first === 'any' || second === 'any') {
+        return true;
+    }
+    if (first === 'nonSeparator' && second === 'nonSeparator') {
+        return true;
+    }
+    if (first === 'nonSeparator') {
+        return typeof second === 'object' && !isResourceComponentSeparator(second.char);
+    }
+    if (second === 'nonSeparator') {
+        return typeof first === 'object' && !isResourceComponentSeparator(first.char);
+    }
+    return first.char.localeCompare(second.char, undefined, { sensitivity: 'accent' }) === 0;
+}
+/**
+ * Check whether a character is a resource component separator.
+ *
+ * @param char - The character to check
+ * @returns Whether the character separates resource component segments
+ */
+function isResourceComponentSeparator(char) {
+    return char === ':' || char === '/';
+}
+//# sourceMappingURL=resourceTypes.js.map

package/dist/esm/resourceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAsCxC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAsB,EACtB,eAAuB;IAEvB,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;IAEnD,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,6CAA6C,CAClD,aAAa,CAAC,QAAQ,EACtB,YAAY,CAAC,QAAQ,CACtB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAsB,EACtB,gBAA0B;IAE1B,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3D,wCAAwC,CAAC,cAAc,EAAE,OAAO,CAAC,CAClE,CAAA;IAED,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,EAAE;QAClE,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE;YACzD,OAAO,CACL,UAAU,KAAK,cAAc;gBAC7B,iCAAiC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAClE,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iCAAiC,CACxC,oBAA4B,EAC5B,qBAA6B;IAE7B,MAAM,gBAAgB,GAAG,kCAAkC,CAAC,oBAAoB,CAAC,CAAA;IACjF,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,qBAAqB,CAAC,CAAA;IAEnF,OAAO,CACL,gBAAgB,CAAC,MAAM,GAAG,iBAAiB,CAAC,MAAM;QAClD,gBAAgB,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAC/C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,OAAe;IACzD,OAAO,2BAA2B,CAAC,OAAO,CAAC;SACxC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;SAC3B,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,6CAA6C,CACpD,iBAAqC,EACrC,qBAAyC;IAEzC,IAAI,qBAAqB,KAAK,GAAG,EAAE,CAAC;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,iBAAiB,KAAK,SAAS,IAAI,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,iBAAiB,KAAK,EAAE,IAAI,qBAAqB,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,CACL,iBAAiB,CAAC,aAAa,CAAC,qBAAqB,EAAE,SAAS,EAAE;YAChE,WAAW,EAAE,QAAQ;SACtB,CAAC,KAAK,CAAC,CACT,CAAA;IACH,CAAC;IAED,OAAO,wBAAwB,CAC7B,6BAA6B,CAAC,iBAAiB,CAAC,EAChD,kCAAkC,CAAC,qBAAqB,CAAC,CAC1D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAAC,KAAuB,EAAE,MAAwB;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,MAAM,KAAK,GAAuB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAE1C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAA;QAChD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,WAAW,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEhB,IAAI,UAAU,KAAK,KAAK,CAAC,cAAc,IAAI,WAAW,KAAK,MAAM,CAAC,cAAc,EAAE,CAAC;YACjF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QACtD,MAAM,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAEzD,KAAK,MAAM,UAAU,IAAI,gBAAgB,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;YACjD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;gBAC9B,SAAQ;YACV,CAAC;YAED,KAAK,MAAM,gBAAgB,IAAI,iBAAiB,EAAE,CAAC;gBACjD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;oBAC/B,SAAQ;gBACV,CAAC;gBAED,IAAI,0BAA0B,CAAC,eAAe,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpF,KAAK,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,cAAsB;IAC3D,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAA;IACjC,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,WAAW,CAAC,KAAa;YACvB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YAC1E,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACvD,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CAAC,mBAA2B;IACrE,MAAM,MAAM,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,CAAA;IAC/D,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,WAAW,CAAC,KAAa;YACvB,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAA;YACX,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC9B,OAAO;oBACL,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE;oBACtD,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,gBAAgB,EAAE;iBAC3D,CAAA;YACH,CAAC;YACD,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpE,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,OAAe;IAClD,MAAM,MAAM,GAAwB,EAAE,CAAA;IACtC,MAAM,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAA;IACpE,MAAM,uBAAuB,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAA;IAElG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;QACpC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,UAAU;oBAChB,gBAAgB,EAAE,uBAAuB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK;iBACnE,CAAC,CAAA;gBACF,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAA;gBAChB,SAAQ;YACV,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,KAAuB,EAAE,MAAwB;IACnF,IAAI,KAAK,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,KAAK,cAAc,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,IAAY;IAChD,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAA;AACrC,CAAC"}

package/dist/esm/resources.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Convert an AWS wildcard ARN pattern (e.g. "arn:aws:s3:::bucket/*") into a RegExp.
+ *
+ * @param pattern The ARN pattern string with wildcards
+ * @returns RegExp that matches ARNs according to the wildcard pattern
+ */
+export declare function resourceArnWithWildcardsToRegex(pattern: string): RegExp;
+//# sourceMappingURL=resources.d.ts.map

package/dist/esm/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGvE"}

package/dist/esm/resources.js

@@ -0,0 +1,11 @@
+/**
+ * Convert an AWS wildcard ARN pattern (e.g. "arn:aws:s3:::bucket/*") into a RegExp.
+ *
+ * @param pattern The ARN pattern string with wildcards
+ * @returns RegExp that matches ARNs according to the wildcard pattern
+ */
+export function resourceArnWithWildcardsToRegex(pattern) {
+    const parts = pattern.split('*').map((s) => s.replace(/[-/\\^$+?.()|[\]{}]/g, '\\$&'));
+    return new RegExp('^' + parts.join('.*?') + '$');
+}
+//# sourceMappingURL=resources.js.map

package/dist/esm/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/resources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAA;IACtF,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAA;AAClD,CAAC"}

package/dist/esm/s3.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Checks to see if an ARN is an S3 bucket or object ARN
+ *
+ * @param arn the ARN to check
+ * @returns whether the ARN is an S3 bucket or object ARN
+ */
+export declare function isS3BucketOrObjectArn(arn: string): boolean;
+/**
+ * Get the bucket ARN from an S3 bucket or object ARN. Does not validate the input ARN.
+ *
+ * @param bucketOrObjectArn the ARN of the S3 bucket or object
+ * @returns the ARN of the S3 bucket
+ */
+export declare function bucketArn(bucketOrObjectArn: string): string;
+//# sourceMappingURL=s3.d.ts.map

package/dist/esm/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/s3.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE3D"}