@cloud-copilot/iam-utils 0.1.53 → 0.1.55

package/dist/cjs/index.d.ts

@@ -1,6 +1,8 @@
 export { actionMatchesPattern } from './actions.js';
 export { getResourceSegments, splitArnParts, type ArnParts } from './arn.js';
 export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
 export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
 export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,wCAAwC,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isS3BucketOrObjectArn = exports.bucketArn = exports.resourceArnWithWildcardsToRegex = exports.isServicePrincipal = exports.isIamUserArn = exports.isIamRoleArn = exports.isFederatedUserArn = exports.isAssumedRoleArn = exports.isArnPrincipal = exports.convertRoleArnToAssumedRoleArn = exports.convertAssumedRoleArnToRoleArn = exports.splitArnParts = exports.getResourceSegments = exports.actionMatchesPattern = void 0;
+exports.isS3BucketOrObjectArn = exports.bucketArn = exports.resourceStringMatchesResourceTypePattern = exports.resourceArnWithWildcardsToRegex = exports.convertResourcePatternToRegex = exports.isServicePrincipal = exports.isIamUserArn = exports.isIamRoleArn = exports.isFederatedUserArn = exports.isAssumedRoleArn = exports.isArnPrincipal = exports.convertRoleArnToAssumedRoleArn = exports.convertAssumedRoleArnToRoleArn = exports.splitArnParts = exports.getResourceSegments = exports.actionMatchesPattern = void 0;
 var actions_js_1 = require("./actions.js");
 Object.defineProperty(exports, "actionMatchesPattern", { enumerable: true, get: function () { return actions_js_1.actionMatchesPattern; } });
 var arn_js_1 = require("./arn.js");
@@ -15,8 +15,12 @@ Object.defineProperty(exports, "isFederatedUserArn", { enumerable: true, get: fu
 Object.defineProperty(exports, "isIamRoleArn", { enumerable: true, get: function () { return principals_js_1.isIamRoleArn; } });
 Object.defineProperty(exports, "isIamUserArn", { enumerable: true, get: function () { return principals_js_1.isIamUserArn; } });
 Object.defineProperty(exports, "isServicePrincipal", { enumerable: true, get: function () { return principals_js_1.isServicePrincipal; } });
+var resourcePatterns_js_1 = require("./resourcePatterns.js");
+Object.defineProperty(exports, "convertResourcePatternToRegex", { enumerable: true, get: function () { return resourcePatterns_js_1.convertResourcePatternToRegex; } });
 var resources_js_1 = require("./resources.js");
 Object.defineProperty(exports, "resourceArnWithWildcardsToRegex", { enumerable: true, get: function () { return resources_js_1.resourceArnWithWildcardsToRegex; } });
+var resourceTypes_js_1 = require("./resourceTypes.js");
+Object.defineProperty(exports, "resourceStringMatchesResourceTypePattern", { enumerable: true, get: function () { return resourceTypes_js_1.resourceStringMatchesResourceTypePattern; } });
 var s3_js_1 = require("./s3.js");
 Object.defineProperty(exports, "bucketArn", { enumerable: true, get: function () { return s3_js_1.bucketArn; } });
 Object.defineProperty(exports, "isS3BucketOrObjectArn", { enumerable: true, get: function () { return s3_js_1.isS3BucketOrObjectArn; } });

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAAmD;AAA1C,kHAAA,oBAAoB,OAAA;AAC7B,mCAA4E;AAAnE,6GAAA,mBAAmB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAC3C,iDASwB;AARtB,+HAAA,8BAA8B,OAAA;AAC9B,+HAAA,8BAA8B,OAAA;AAC9B,+GAAA,cAAc,OAAA;AACd,iHAAA,gBAAgB,OAAA;AAChB,mHAAA,kBAAkB,OAAA;AAClB,6GAAA,YAAY,OAAA;AACZ,6GAAA,YAAY,OAAA;AACZ,mHAAA,kBAAkB,OAAA;AAEpB,+CAAgE;AAAvD,+HAAA,+BAA+B,OAAA;AACxC,iCAA0D;AAAjD,kGAAA,SAAS,OAAA;AAAE,8GAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,2CAAmD;AAA1C,kHAAA,oBAAoB,OAAA;AAC7B,mCAA4E;AAAnE,6GAAA,mBAAmB,OAAA;AAAE,uGAAA,aAAa,OAAA;AAC3C,iDASwB;AARtB,+HAAA,8BAA8B,OAAA;AAC9B,+HAAA,8BAA8B,OAAA;AAC9B,+GAAA,cAAc,OAAA;AACd,iHAAA,gBAAgB,OAAA;AAChB,mHAAA,kBAAkB,OAAA;AAClB,6GAAA,YAAY,OAAA;AACZ,6GAAA,YAAY,OAAA;AACZ,mHAAA,kBAAkB,OAAA;AAEpB,6DAAqE;AAA5D,oIAAA,6BAA6B,OAAA;AACtC,+CAAgE;AAAvD,+HAAA,+BAA+B,OAAA;AACxC,uDAA6E;AAApE,4IAAA,wCAAwC,OAAA;AACjD,iCAA0D;AAAjD,kGAAA,SAAS,OAAA;AAAE,8GAAA,qBAAqB,OAAA"}

package/dist/cjs/resourcePatterns.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export declare function convertResourcePatternToRegex(pattern: string): string;
+//# sourceMappingURL=resourcePatterns.d.ts.map

package/dist/cjs/resourcePatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.d.ts","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/cjs/resourcePatterns.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.convertResourcePatternToRegex = convertResourcePatternToRegex;
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+function convertResourcePatternToRegex(pattern) {
+    const regex = pattern.replace(/\$\{.*?\}/g, (match) => {
+        const name = match.substring(2, match.length - 1);
+        const camelName = name.at(0)?.toLowerCase() + name.substring(1);
+        return `(?<${camelName}>(.+?))`;
+    });
+    return `^${regex}$`;
+}
+//# sourceMappingURL=resourcePatterns.js.map

package/dist/cjs/resourcePatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.js","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":";;AAOA,sEAOC;AAdD;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC"}

package/dist/cjs/resourceTypes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export declare function resourceStringMatchesResourceTypePattern(resourceString: string, resourcePattern: string): boolean;
+//# sourceMappingURL=resourceTypes.d.ts.map

package/dist/cjs/resourceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAsGT"}

package/dist/cjs/resourceTypes.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourceStringMatchesResourceTypePattern = resourceStringMatchesResourceTypePattern;
+const arn_js_1 = require("./arn.js");
+const resourcePatterns_js_1 = require("./resourcePatterns.js");
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+function resourceStringMatchesResourceTypePattern(resourceString, resourcePattern) {
+    if (resourceString === '*') {
+        return true;
+    }
+    const resourceParts = (0, arn_js_1.splitArnParts)(resourceString);
+    const patternParts = (0, arn_js_1.splitArnParts)(resourcePattern);
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.partition, patternParts.partition)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.service, patternParts.service)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.region, patternParts.region)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.accountId, patternParts.accountId)) {
+        return false;
+    }
+    const [resourceResourcePartsSegments, resourceResourceParts] = splitResourceTypeComponent(resourceParts.resource);
+    const [patternResourcePartsSegments, patternResourceParts] = splitResourceTypeComponent(patternParts.resource);
+    // If there are more segments in the resource than the pattern, it cannot match,
+    // unless the final pattern component is a variable (e.g. ${ObjectName}) which
+    // can span multiple segments (like S3 object keys with slashes).
+    if (resourceResourcePartsSegments > patternResourcePartsSegments) {
+        const lastPatternComponent = patternResourceParts.at(-1);
+        if (!isResourceTypeVariable(lastPatternComponent) || patternResourcePartsSegments === 1) {
+            return false;
+        }
+    }
+    // If there are fewer segments with contents in the resource than the pattern, and the last segment of the resource
+    // does not end with a wildcard, it cannot match
+    if (resourceResourceParts.length < patternResourceParts.length &&
+        !resourceResourceParts.at(-1)?.endsWith('*')) {
+        return false;
+    }
+    const compareLen = Math.min(resourceResourceParts.length, patternResourceParts.length);
+    for (let i = 0; i < compareLen; i++) {
+        const resourceComponent = resourceResourceParts[i];
+        const isLastPattern = i === patternResourceParts.length - 1;
+        const patternComponent = patternResourceParts[i];
+        if (!patternComponent) {
+            return false;
+        }
+        if (isResourceTypeVariable(patternComponent)) {
+            if (isLastPattern &&
+                resourceResourcePartsSegments > patternResourcePartsSegments &&
+                patternResourcePartsSegments > 1) {
+                // Variable at the end can absorb additional segments.
+                return true;
+            }
+            if (isLastPattern && resourceComponent?.endsWith('*')) {
+                // If the resource component ends with a wildcard, it matches everything after
+                break;
+            }
+            // These match anything, move along.
+            continue;
+        }
+        if (!resourceComponent) {
+            return false;
+        }
+        const resourceComponentPattern = '^' + resourceComponent.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+        const regex = new RegExp(resourceComponentPattern);
+        const match = patternComponent.match(regex);
+        if (match) {
+            if (isLastPattern && resourceComponent.endsWith('*')) {
+                // If the resource component ends with a wildcard, it matches everything after
+                break;
+            }
+            continue;
+        }
+        else {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Split a resource component on colons and slashes into its segments.
+ *
+ * @param component - The resource portion of an ARN
+ * @returns A tuple of [total segment count, non-empty segments]
+ */
+function splitResourceTypeComponent(component) {
+    const parts = component?.split(/[:/]/) ?? [];
+    return [parts.length, parts.filter((p) => p && p !== '')];
+}
+/**
+ * Check whether a single ARN component from a resource string matches
+ * the corresponding component from a resource-type pattern.
+ *
+ * @param resourceComponent - The component value from the concrete ARN
+ * @param resourceTypeComponent - The component value from the pattern ARN
+ * @returns Whether the resource component matches the pattern component
+ */
+function resourceComponentMatchesResourceTypeComponent(resourceComponent, resourceTypeComponent) {
+    if (resourceTypeComponent === '*' || resourceTypeComponent === resourceComponent) {
+        return true;
+    }
+    if (!resourceComponent || !resourceTypeComponent) {
+        return false;
+    }
+    if (isResourceTypeVariable(resourceTypeComponent)) {
+        // If the entire component is a single variable, it matches anything
+        return true;
+    }
+    const pattern = (0, resourcePatterns_js_1.convertResourcePatternToRegex)(resourceTypeComponent);
+    const regex = new RegExp(pattern);
+    const match = resourceComponent.match(regex);
+    return !!match;
+}
+/**
+ * Check whether a pattern component is a single IAM variable placeholder (e.g. `${BucketName}`).
+ *
+ * @param component - The component string to check
+ * @returns Whether the component is a variable placeholder
+ */
+function isResourceTypeVariable(component) {
+    if (!component) {
+        return false;
+    }
+    return component.match(/^\$\{[0-9a-zA-Z]+\}$/) !== null;
+}
+//# sourceMappingURL=resourceTypes.js.map

package/dist/cjs/resourceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":";;AAaA,4FAyGC;AAtHD,qCAAwC;AACxC,+DAAqE;AAErE;;;;;;;;;GASG;AACH,SAAgB,wCAAwC,CACtD,cAAsB,EACtB,eAAuB;IAEvB,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,sBAAa,EAAC,cAAc,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,IAAA,sBAAa,EAAC,eAAe,CAAC,CAAA;IAEnD,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,GAAG,0BAA0B,CACvF,aAAa,CAAC,QAAQ,CACvB,CAAA;IACD,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC,GAAG,0BAA0B,CACrF,YAAY,CAAC,QAAQ,CACtB,CAAA;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,6BAA6B,GAAG,4BAA4B,EAAE,CAAC;QACjE,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,4BAA4B,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,mHAAmH;IACnH,gDAAgD;IAChD,IACE,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM;QAC1D,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAC5C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,CAAC,KAAK,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAEhD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7C,IACE,aAAa;gBACb,6BAA6B,GAAG,4BAA4B;gBAC5D,4BAA4B,GAAG,CAAC,EAChC,CAAC;gBACD,sDAAsD;gBACtD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,aAAa,IAAI,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,8EAA8E;gBAC9E,MAAK;YACP,CAAC;YAED,oCAAoC;YACpC,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,wBAAwB,GAC5B,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;QACzE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,aAAa,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,8EAA8E;gBAC9E,MAAK;YACP,CAAC;YACD,SAAQ;QACV,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,SAA6B;IAC/D,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC5C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6CAA6C,CACpD,iBAAqC,EACrC,qBAAyC;IAEzC,IAAI,qBAAqB,KAAK,GAAG,IAAI,qBAAqB,KAAK,iBAAiB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAClD,oEAAoE;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,mDAA6B,EAAC,qBAAqB,CAAC,CAAA;IACpE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAC,KAAK,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAA6B;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,IAAI,CAAA;AACzD,CAAC"}

package/dist/esm/index.d.ts

@@ -1,6 +1,8 @@
 export { actionMatchesPattern } from './actions.js';
 export { getResourceSegments, splitArnParts, type ArnParts } from './arn.js';
 export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
 export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
 export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,wCAAwC,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/esm/index.js

@@ -1,6 +1,8 @@
 export { actionMatchesPattern } from './actions.js';
 export { getResourceSegments, splitArnParts } from './arn.js';
 export { convertAssumedRoleArnToRoleArn, convertRoleArnToAssumedRoleArn, isArnPrincipal, isAssumedRoleArn, isFederatedUserArn, isIamRoleArn, isIamUserArn, isServicePrincipal } from './principals.js';
+export { convertResourcePatternToRegex } from './resourcePatterns.js';
 export { resourceArnWithWildcardsToRegex } from './resources.js';
+export { resourceStringMatchesResourceTypePattern } from './resourceTypes.js';
 export { bucketArn, isS3BucketOrObjectArn } from './s3.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAA;AAC5E,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gBAAgB,CAAA;AAChE,OAAO,EAAE,wCAAwC,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/esm/resourcePatterns.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export declare function convertResourcePatternToRegex(pattern: string): string;
+//# sourceMappingURL=resourcePatterns.d.ts.map

package/dist/esm/resourcePatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.d.ts","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/esm/resourcePatterns.js

@@ -0,0 +1,16 @@
+/**
+ * Convert a resource pattern from iam-data to a regex pattern.
+ * Variables like `${BucketName}` become named capture groups.
+ *
+ * @param pattern - The IAM resource type ARN pattern (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns A regex string anchored with `^...$` that matches concrete ARNs against the pattern
+ */
+export function convertResourcePatternToRegex(pattern) {
+    const regex = pattern.replace(/\$\{.*?\}/g, (match) => {
+        const name = match.substring(2, match.length - 1);
+        const camelName = name.at(0)?.toLowerCase() + name.substring(1);
+        return `(?<${camelName}>(.+?))`;
+    });
+    return `^${regex}$`;
+}
+//# sourceMappingURL=resourcePatterns.js.map

package/dist/esm/resourcePatterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourcePatterns.js","sourceRoot":"","sources":["../../src/resourcePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/D,OAAO,MAAM,SAAS,SAAS,CAAA;IACjC,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,KAAK,GAAG,CAAA;AACrB,CAAC"}

package/dist/esm/resourceTypes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export declare function resourceStringMatchesResourceTypePattern(resourceString: string, resourcePattern: string): boolean;
+//# sourceMappingURL=resourceTypes.d.ts.map

package/dist/esm/resourceTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.d.ts","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH,wBAAgB,wCAAwC,CACtD,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GACtB,OAAO,CAsGT"}

package/dist/esm/resourceTypes.js

@@ -0,0 +1,135 @@
+import { splitArnParts } from './arn.js';
+import { convertResourcePatternToRegex } from './resourcePatterns.js';
+/**
+ * Checks whether a concrete resource ARN (possibly with wildcards) matches
+ * a resource-type ARN pattern from the Service Authorization Reference.
+ *
+ * A wildcard resource string (`"*"`) always matches.
+ *
+ * @param resourceString - A concrete resource ARN or wildcard (`"*"`)
+ * @param resourcePattern - An ARN pattern from iam-data (e.g. `arn:${Partition}:s3:::${BucketName}/${ObjectName}`)
+ * @returns Whether the resource string matches the pattern
+ */
+export function resourceStringMatchesResourceTypePattern(resourceString, resourcePattern) {
+    if (resourceString === '*') {
+        return true;
+    }
+    const resourceParts = splitArnParts(resourceString);
+    const patternParts = splitArnParts(resourcePattern);
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.partition, patternParts.partition)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.service, patternParts.service)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.region, patternParts.region)) {
+        return false;
+    }
+    if (!resourceComponentMatchesResourceTypeComponent(resourceParts.accountId, patternParts.accountId)) {
+        return false;
+    }
+    const [resourceResourcePartsSegments, resourceResourceParts] = splitResourceTypeComponent(resourceParts.resource);
+    const [patternResourcePartsSegments, patternResourceParts] = splitResourceTypeComponent(patternParts.resource);
+    // If there are more segments in the resource than the pattern, it cannot match,
+    // unless the final pattern component is a variable (e.g. ${ObjectName}) which
+    // can span multiple segments (like S3 object keys with slashes).
+    if (resourceResourcePartsSegments > patternResourcePartsSegments) {
+        const lastPatternComponent = patternResourceParts.at(-1);
+        if (!isResourceTypeVariable(lastPatternComponent) || patternResourcePartsSegments === 1) {
+            return false;
+        }
+    }
+    // If there are fewer segments with contents in the resource than the pattern, and the last segment of the resource
+    // does not end with a wildcard, it cannot match
+    if (resourceResourceParts.length < patternResourceParts.length &&
+        !resourceResourceParts.at(-1)?.endsWith('*')) {
+        return false;
+    }
+    const compareLen = Math.min(resourceResourceParts.length, patternResourceParts.length);
+    for (let i = 0; i < compareLen; i++) {
+        const resourceComponent = resourceResourceParts[i];
+        const isLastPattern = i === patternResourceParts.length - 1;
+        const patternComponent = patternResourceParts[i];
+        if (!patternComponent) {
+            return false;
+        }
+        if (isResourceTypeVariable(patternComponent)) {
+            if (isLastPattern &&
+                resourceResourcePartsSegments > patternResourcePartsSegments &&
+                patternResourcePartsSegments > 1) {
+                // Variable at the end can absorb additional segments.
+                return true;
+            }
+            if (isLastPattern && resourceComponent?.endsWith('*')) {
+                // If the resource component ends with a wildcard, it matches everything after
+                break;
+            }
+            // These match anything, move along.
+            continue;
+        }
+        if (!resourceComponent) {
+            return false;
+        }
+        const resourceComponentPattern = '^' + resourceComponent.replace(/\?/g, '.').replace(/\*/g, '.*?') + '$';
+        const regex = new RegExp(resourceComponentPattern);
+        const match = patternComponent.match(regex);
+        if (match) {
+            if (isLastPattern && resourceComponent.endsWith('*')) {
+                // If the resource component ends with a wildcard, it matches everything after
+                break;
+            }
+            continue;
+        }
+        else {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Split a resource component on colons and slashes into its segments.
+ *
+ * @param component - The resource portion of an ARN
+ * @returns A tuple of [total segment count, non-empty segments]
+ */
+function splitResourceTypeComponent(component) {
+    const parts = component?.split(/[:/]/) ?? [];
+    return [parts.length, parts.filter((p) => p && p !== '')];
+}
+/**
+ * Check whether a single ARN component from a resource string matches
+ * the corresponding component from a resource-type pattern.
+ *
+ * @param resourceComponent - The component value from the concrete ARN
+ * @param resourceTypeComponent - The component value from the pattern ARN
+ * @returns Whether the resource component matches the pattern component
+ */
+function resourceComponentMatchesResourceTypeComponent(resourceComponent, resourceTypeComponent) {
+    if (resourceTypeComponent === '*' || resourceTypeComponent === resourceComponent) {
+        return true;
+    }
+    if (!resourceComponent || !resourceTypeComponent) {
+        return false;
+    }
+    if (isResourceTypeVariable(resourceTypeComponent)) {
+        // If the entire component is a single variable, it matches anything
+        return true;
+    }
+    const pattern = convertResourcePatternToRegex(resourceTypeComponent);
+    const regex = new RegExp(pattern);
+    const match = resourceComponent.match(regex);
+    return !!match;
+}
+/**
+ * Check whether a pattern component is a single IAM variable placeholder (e.g. `${BucketName}`).
+ *
+ * @param component - The component string to check
+ * @returns Whether the component is a variable placeholder
+ */
+function isResourceTypeVariable(component) {
+    if (!component) {
+        return false;
+    }
+    return component.match(/^\$\{[0-9a-zA-Z]+\}$/) !== null;
+}
+//# sourceMappingURL=resourceTypes.js.map

package/dist/esm/resourceTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceTypes.js","sourceRoot":"","sources":["../../src/resourceTypes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAA;AAErE;;;;;;;;;GASG;AACH,MAAM,UAAU,wCAAwC,CACtD,cAAsB,EACtB,eAAuB;IAEvB,IAAI,cAAc,KAAK,GAAG,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,cAAc,CAAC,CAAA;IACnD,MAAM,YAAY,GAAG,aAAa,CAAC,eAAe,CAAC,CAAA;IAEnD,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,6CAA6C,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IACE,CAAC,6CAA6C,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,EAC/F,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,GAAG,0BAA0B,CACvF,aAAa,CAAC,QAAQ,CACvB,CAAA;IACD,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC,GAAG,0BAA0B,CACrF,YAAY,CAAC,QAAQ,CACtB,CAAA;IAED,gFAAgF;IAChF,8EAA8E;IAC9E,iEAAiE;IACjE,IAAI,6BAA6B,GAAG,4BAA4B,EAAE,CAAC;QACjE,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,sBAAsB,CAAC,oBAAoB,CAAC,IAAI,4BAA4B,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,mHAAmH;IACnH,gDAAgD;IAChD,IACE,qBAAqB,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM;QAC1D,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAC5C,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,CAAC,KAAK,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAA;QAEhD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7C,IACE,aAAa;gBACb,6BAA6B,GAAG,4BAA4B;gBAC5D,4BAA4B,GAAG,CAAC,EAChC,CAAC;gBACD,sDAAsD;gBACtD,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,aAAa,IAAI,iBAAiB,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,8EAA8E;gBAC9E,MAAK;YACP,CAAC;YAED,oCAAoC;YACpC,SAAQ;QACV,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,wBAAwB,GAC5B,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,GAAG,CAAA;QACzE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,wBAAwB,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,aAAa,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,8EAA8E;gBAC9E,MAAK;YACP,CAAC;YACD,SAAQ;QACV,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,SAA6B;IAC/D,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC5C,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6CAA6C,CACpD,iBAAqC,EACrC,qBAAyC;IAEzC,IAAI,qBAAqB,KAAK,GAAG,IAAI,qBAAqB,KAAK,iBAAiB,EAAE,CAAC;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,sBAAsB,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAClD,oEAAoE;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,6BAA6B,CAAC,qBAAqB,CAAC,CAAA;IACpE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5C,OAAO,CAAC,CAAC,KAAK,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,SAA6B;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,IAAI,CAAA;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloud-copilot/iam-utils",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "description": "Various utilities for working with AWS IAM information",
   "exports": {
     ".": {