@ashishpandeyone/cdk-lambda-web-function 0.1.8 → 0.1.9

package/lib/private/code-bucket.js

@@ -37,6 +37,7 @@ exports.codeBucket = codeBucket;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
+const nag_1 = require("./nag");
 const provider_1 = require("./provider");
 const provider_protocol_1 = require("./provider-protocol");
 const ID = 'LambdaWebFunctionCodeBucket';
@@ -68,6 +69,7 @@ function codeBucket(scope) {
                 abortIncompleteMultipartUploadAfter: aws_cdk_lib_1.Duration.days(1),
             }],
     });
+    (0, nag_1.acknowledgeNagRules)(bucket.node.defaultChild, ['AwsSolutions-S1'], 'Holds only copies of this stack\'s code assets, written by the stack\'s own custom resource provider');
     bucket.addToResourcePolicy(new iam.PolicyStatement({
         sid: 'LambdaWebFunctionsReadCode',
         principals: [new iam.ServicePrincipal('lambda.amazonaws.com')],
@@ -89,4 +91,4 @@ function codeBucket(scope) {
     });
     return bucket;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS1idWNrZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9jb2RlLWJ1Y2tldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQW9CQSxnQ0FzQ0M7QUExREQsNkNBQW1GO0FBQ25GLHlEQUEyQztBQUMzQyx1REFBeUM7QUFFekMseUNBQWtFO0FBQ2xFLDJEQUErSDtBQUUvSCxNQUFNLEVBQUUsR0FBRyw2QkFBNkIsQ0FBQztBQUV6Qzs7Ozs7Ozs7OztHQVVHO0FBQ0gsU0FBZ0IsVUFBVSxDQUFDLEtBQWdCO0lBQ3pDLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzlCLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBMEIsQ0FBQztJQUN0RSxJQUFJLFFBQVE7UUFBRSxPQUFPLFFBQVEsQ0FBQztJQUU5QixNQUFNLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtRQUN0QyxTQUFTLEVBQUUsSUFBSTtRQUNmLFVBQVUsRUFBRSxJQUFJO1FBQ2hCLGlCQUFpQixFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTO1FBQ2pELFVBQVUsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsVUFBVTtRQUMxQyxhQUFhLEVBQUUsMkJBQWEsQ0FBQyxPQUFPO1FBQ3BDLGNBQWMsRUFBRSxDQUFDO2dCQUNmLEVBQUUsRUFBRSxzQkFBc0I7Z0JBQzFCLDJCQUEyQixFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsbUNBQW1DLEVBQUUsc0JBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO2FBQ3RELENBQUM7S0FDSCxDQUFDLENBQUM7SUFDSCxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1FBQ2pELEdBQUcsRUFBRSw0QkFBNEI7UUFDakMsVUFBVSxFQUFFLENBQUMsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUM5RCxPQUFPLEVBQUUsQ0FBQyxjQUFjLEVBQUUscUJBQXFCLENBQUM7UUFDaEQsU0FBUyxFQUFFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0QyxVQUFVLEVBQUUsRUFBRSxZQUFZLEVBQUUsRUFBRSxtQkFBbUIsRUFBRSxLQUFLLENBQUMsT0FBTyxFQUFFLEVBQUU7S0FDckUsQ0FBQyxDQUFDLENBQUM7SUFFSiw2REFBNkQ7SUFDN0Qsa0JBQUksQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxDQUFDLHVDQUFtQixDQUFDLEdBQUcsRUFBRSx1Q0FBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN4RSxNQUFNLFFBQVEsR0FBRyxJQUFBLDhCQUFtQixFQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzVDLElBQUEsMEJBQWUsRUFBQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyx1QkFBdUIsRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNwSCxJQUFBLDBCQUFlLEVBQUMsUUFBUSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsaUJBQWlCLEVBQUUsd0JBQXdCLENBQUMsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDMUgsTUFBTSxVQUFVLEdBQWdDLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztJQUNsRixxR0FBcUc7SUFDckcsSUFBSSw0QkFBYyxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsU0FBUyxFQUFFO1FBQ3hDLFlBQVksRUFBRSxRQUFRLENBQUMsWUFBWTtRQUNuQyxZQUFZLEVBQUUscURBQWlDO1FBQy9DLFVBQVUsRUFBRSxFQUFFLEdBQUcsVUFBVSxFQUFFO0tBQzlCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSwgRHVyYXRpb24sIFJlbW92YWxQb2xpY3ksIFN0YWNrLCBUYWdzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBncmFudFRvUHJvdmlkZXIsIHdlYkZ1bmN0aW9uUHJvdmlkZXIgfSBmcm9tICcuL3Byb3ZpZGVyJztcbmltcG9ydCB7IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSwgRU1QVFlfT05fREVMRVRFX1RBRywgdHlwZSBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcblxuY29uc3QgSUQgPSAnTGFtYmRhV2ViRnVuY3Rpb25Db2RlQnVja2V0JztcblxuLyoqXG4gKiBUaGUgc3RhY2sncyBjb2RlIGJ1Y2tldCAob25lIHBlciBzdGFjaykuXG4gKlxuICogTGFtYmRhIFdlYiBGdW5jdGlvbnMgZG93bmxvYWQgY29kZSBhcyB0aGUgYGxhbWJkYS5hbWF6b25hd3MuY29tYCBzZXJ2aWNlIHByaW5jaXBhbCBhbmRcbiAqIHJlamVjdCB1bnZlcnNpb25lZCBidWNrZXRzOyB0aGUgQ0RLIGJvb3RzdHJhcCBidWNrZXQgYWxsb3dzIG5laXRoZXIsIHNvIGNvZGUgaXMgY29waWVkIGhlcmUuXG4gKiBSZXZpc2lvbnMgY2FwdHVyZSB0aGVpciBjb2RlIHdoZW4gdGhleSdyZSBjcmVhdGVkLCBzbyBzdXBlcnNlZGVkIHZlcnNpb25zIGNhbiBleHBpcmUsIGJ1dFxuICogY3VycmVudCBvYmplY3RzIG11c3Qgc3RheTogYSBsYXRlciByZXZpc2lvbiBtYXkgYmUgY3JlYXRlZCBmcm9tIHRoZSBzYW1lIG9iamVjdC5cbiAqXG4gKiBUaGUgc2hhcmVkIHByb3ZpZGVyIGVtcHRpZXMgaXQgd2hlbiBpdCdzIGRlbGV0ZWQgKGluc3RlYWQgb2YgYGF1dG9EZWxldGVPYmplY3RzYCwgd2hpY2ggYWRkcyBhbm90aGVyXG4gKiBMYW1iZGEgZnVuY3Rpb24gd2hvc2UgbG9nIGdyb3VwIG91dGxpdmVzIHRoZSBzdGFjaykuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb2RlQnVja2V0KHNjb3BlOiBDb25zdHJ1Y3QpOiBzMy5CdWNrZXQge1xuICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChJRCkgYXMgczMuQnVja2V0IHwgdW5kZWZpbmVkO1xuICBpZiAoZXhpc3RpbmcpIHJldHVybiBleGlzdGluZztcblxuICBjb25zdCBidWNrZXQgPSBuZXcgczMuQnVja2V0KHN0YWNrLCBJRCwge1xuICAgIHZlcnNpb25lZDogdHJ1ZSxcbiAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgZW5jcnlwdGlvbjogczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VELFxuICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuREVTVFJPWSxcbiAgICBsaWZlY3ljbGVSdWxlczogW3tcbiAgICAgIGlkOiAnRXhwaXJlU3VwZXJzZWRlZENvZGUnLFxuICAgICAgbm9uY3VycmVudFZlcnNpb25FeHBpcmF0aW9uOiBEdXJhdGlvbi5kYXlzKDMwKSxcbiAgICAgIGFib3J0SW5jb21wbGV0ZU11bHRpcGFydFVwbG9hZEFmdGVyOiBEdXJhdGlvbi5kYXlzKDEpLFxuICAgIH1dLFxuICB9KTtcbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0xhbWJkYVdlYkZ1bmN0aW9uc1JlYWRDb2RlJyxcbiAgICBwcmluY2lwYWxzOiBbbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpXSxcbiAgICBhY3Rpb25zOiBbJ3MzOkdldE9iamVjdCcsICdzMzpHZXRPYmplY3RWZXJzaW9uJ10sXG4gICAgcmVzb3VyY2VzOiBbYnVja2V0LmFybkZvck9iamVjdHMoJyonKV0sXG4gICAgY29uZGl0aW9uczogeyBTdHJpbmdFcXVhbHM6IHsgJ2F3czpTb3VyY2VBY2NvdW50Jzogc3RhY2suYWNjb3VudCB9IH0sXG4gIH0pKTtcblxuICAvLyBPbmx5IGEgdGFnZ2VkIGJ1Y2tldCBpcyBlbXB0aWVkIChzZWUgRU1QVFlfT05fREVMRVRFX1RBRykuXG4gIFRhZ3Mub2YoYnVja2V0KS5hZGQoRU1QVFlfT05fREVMRVRFX1RBRy5rZXksIEVNUFRZX09OX0RFTEVURV9UQUcudmFsdWUpO1xuICBjb25zdCBwcm92aWRlciA9IHdlYkZ1bmN0aW9uUHJvdmlkZXIoc3RhY2spO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkxpc3RCdWNrZXRWZXJzaW9ucycsICdzMzpHZXRCdWNrZXRUYWdnaW5nJ10sIFJlc291cmNlOiBidWNrZXQuYnVja2V0QXJuIH0pO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkRlbGV0ZU9iamVjdCcsICdzMzpEZWxldGVPYmplY3RWZXJzaW9uJ10sIFJlc291cmNlOiBidWNrZXQuYXJuRm9yT2JqZWN0cygnKicpIH0pO1xuICBjb25zdCBwcm9wZXJ0aWVzOiBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgPSB7IEJ1Y2tldE5hbWU6IGJ1Y2tldC5idWNrZXROYW1lIH07XG4gIC8vIERlcGVuZHMgb24gdGhlIGJ1Y2tldCAodGhyb3VnaCBpdHMgbmFtZSksIHNvIGl0J3MgZGVsZXRlZCwgYW5kIGVtcHRpZXMgaXQsIGp1c3QgYmVmb3JlIHRoZSBidWNrZXQuXG4gIG5ldyBDdXN0b21SZXNvdXJjZShzdGFjaywgYCR7SUR9Q2xlYW51cGAsIHtcbiAgICBzZXJ2aWNlVG9rZW46IHByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICByZXNvdXJjZVR5cGU6IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSxcbiAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgfSk7XG4gIHJldHVybiBidWNrZXQ7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29kZS1idWNrZXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcHJpdmF0ZS9jb2RlLWJ1Y2tldC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQXFCQSxnQ0F3Q0M7QUE3REQsNkNBQW1GO0FBQ25GLHlEQUEyQztBQUMzQyx1REFBeUM7QUFFekMsK0JBQTRDO0FBQzVDLHlDQUFrRTtBQUNsRSwyREFBK0g7QUFFL0gsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7QUFFekM7Ozs7Ozs7Ozs7R0FVRztBQUNILFNBQWdCLFVBQVUsQ0FBQyxLQUFnQjtJQUN6QyxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM5QixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQTBCLENBQUM7SUFDdEUsSUFBSSxRQUFRO1FBQUUsT0FBTyxRQUFRLENBQUM7SUFFOUIsTUFBTSxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7UUFDdEMsU0FBUyxFQUFFLElBQUk7UUFDZixVQUFVLEVBQUUsSUFBSTtRQUNoQixpQkFBaUIsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsU0FBUztRQUNqRCxVQUFVLEVBQUUsRUFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVU7UUFDMUMsYUFBYSxFQUFFLDJCQUFhLENBQUMsT0FBTztRQUNwQyxjQUFjLEVBQUUsQ0FBQztnQkFDZixFQUFFLEVBQUUsc0JBQXNCO2dCQUMxQiwyQkFBMkIsRUFBRSxzQkFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7Z0JBQzlDLG1DQUFtQyxFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQzthQUN0RCxDQUFDO0tBQ0gsQ0FBQyxDQUFDO0lBQ0gsSUFBQSx5QkFBbUIsRUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFlBQTRCLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxFQUMvRSxzR0FBc0csQ0FBQyxDQUFDO0lBQzFHLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsR0FBRyxFQUFFLDRCQUE0QjtRQUNqQyxVQUFVLEVBQUUsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQzlELE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQztRQUNoRCxTQUFTLEVBQUUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RDLFVBQVUsRUFBRSxFQUFFLFlBQVksRUFBRSxFQUFFLG1CQUFtQixFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsRUFBRTtLQUNyRSxDQUFDLENBQUMsQ0FBQztJQUVKLDZEQUE2RDtJQUM3RCxrQkFBSSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsdUNBQW1CLENBQUMsR0FBRyxFQUFFLHVDQUFtQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sUUFBUSxHQUFHLElBQUEsOEJBQW1CLEVBQUMsS0FBSyxDQUFDLENBQUM7SUFDNUMsSUFBQSwwQkFBZSxFQUFDLFFBQVEsRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLHVCQUF1QixFQUFFLHFCQUFxQixDQUFDLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ3BILElBQUEsMEJBQWUsRUFBQyxRQUFRLEVBQUUsRUFBRSxNQUFNLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSx3QkFBd0IsQ0FBQyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMxSCxNQUFNLFVBQVUsR0FBZ0MsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ2xGLHFHQUFxRztJQUNyRyxJQUFJLDRCQUFjLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUU7UUFDeEMsWUFBWSxFQUFFLFFBQVEsQ0FBQyxZQUFZO1FBQ25DLFlBQVksRUFBRSxxREFBaUM7UUFDL0MsVUFBVSxFQUFFLEVBQUUsR0FBRyxVQUFVLEVBQUU7S0FDOUIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEN1c3RvbVJlc291cmNlLCBEdXJhdGlvbiwgUmVtb3ZhbFBvbGljeSwgU3RhY2ssIFRhZ3MgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHR5cGUgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFja25vd2xlZGdlTmFnUnVsZXMgfSBmcm9tICcuL25hZyc7XG5pbXBvcnQgeyBncmFudFRvUHJvdmlkZXIsIHdlYkZ1bmN0aW9uUHJvdmlkZXIgfSBmcm9tICcuL3Byb3ZpZGVyJztcbmltcG9ydCB7IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSwgRU1QVFlfT05fREVMRVRFX1RBRywgdHlwZSBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcblxuY29uc3QgSUQgPSAnTGFtYmRhV2ViRnVuY3Rpb25Db2RlQnVja2V0JztcblxuLyoqXG4gKiBUaGUgc3RhY2sncyBjb2RlIGJ1Y2tldCAob25lIHBlciBzdGFjaykuXG4gKlxuICogTGFtYmRhIFdlYiBGdW5jdGlvbnMgZG93bmxvYWQgY29kZSBhcyB0aGUgYGxhbWJkYS5hbWF6b25hd3MuY29tYCBzZXJ2aWNlIHByaW5jaXBhbCBhbmRcbiAqIHJlamVjdCB1bnZlcnNpb25lZCBidWNrZXRzOyB0aGUgQ0RLIGJvb3RzdHJhcCBidWNrZXQgYWxsb3dzIG5laXRoZXIsIHNvIGNvZGUgaXMgY29waWVkIGhlcmUuXG4gKiBSZXZpc2lvbnMgY2FwdHVyZSB0aGVpciBjb2RlIHdoZW4gdGhleSdyZSBjcmVhdGVkLCBzbyBzdXBlcnNlZGVkIHZlcnNpb25zIGNhbiBleHBpcmUsIGJ1dFxuICogY3VycmVudCBvYmplY3RzIG11c3Qgc3RheTogYSBsYXRlciByZXZpc2lvbiBtYXkgYmUgY3JlYXRlZCBmcm9tIHRoZSBzYW1lIG9iamVjdC5cbiAqXG4gKiBUaGUgc2hhcmVkIHByb3ZpZGVyIGVtcHRpZXMgaXQgd2hlbiBpdCdzIGRlbGV0ZWQgKGluc3RlYWQgb2YgYGF1dG9EZWxldGVPYmplY3RzYCwgd2hpY2ggYWRkcyBhbm90aGVyXG4gKiBMYW1iZGEgZnVuY3Rpb24gd2hvc2UgbG9nIGdyb3VwIG91dGxpdmVzIHRoZSBzdGFjaykuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBjb2RlQnVja2V0KHNjb3BlOiBDb25zdHJ1Y3QpOiBzMy5CdWNrZXQge1xuICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHNjb3BlKTtcbiAgY29uc3QgZXhpc3RpbmcgPSBzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChJRCkgYXMgczMuQnVja2V0IHwgdW5kZWZpbmVkO1xuICBpZiAoZXhpc3RpbmcpIHJldHVybiBleGlzdGluZztcblxuICBjb25zdCBidWNrZXQgPSBuZXcgczMuQnVja2V0KHN0YWNrLCBJRCwge1xuICAgIHZlcnNpb25lZDogdHJ1ZSxcbiAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgZW5jcnlwdGlvbjogczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VELFxuICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuREVTVFJPWSxcbiAgICBsaWZlY3ljbGVSdWxlczogW3tcbiAgICAgIGlkOiAnRXhwaXJlU3VwZXJzZWRlZENvZGUnLFxuICAgICAgbm9uY3VycmVudFZlcnNpb25FeHBpcmF0aW9uOiBEdXJhdGlvbi5kYXlzKDMwKSxcbiAgICAgIGFib3J0SW5jb21wbGV0ZU11bHRpcGFydFVwbG9hZEFmdGVyOiBEdXJhdGlvbi5kYXlzKDEpLFxuICAgIH1dLFxuICB9KTtcbiAgYWNrbm93bGVkZ2VOYWdSdWxlcyhidWNrZXQubm9kZS5kZWZhdWx0Q2hpbGQgYXMgczMuQ2ZuQnVja2V0LCBbJ0F3c1NvbHV0aW9ucy1TMSddLFxuICAgICdIb2xkcyBvbmx5IGNvcGllcyBvZiB0aGlzIHN0YWNrXFwncyBjb2RlIGFzc2V0cywgd3JpdHRlbiBieSB0aGUgc3RhY2tcXCdzIG93biBjdXN0b20gcmVzb3VyY2UgcHJvdmlkZXInKTtcbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIHNpZDogJ0xhbWJkYVdlYkZ1bmN0aW9uc1JlYWRDb2RlJyxcbiAgICBwcmluY2lwYWxzOiBbbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpXSxcbiAgICBhY3Rpb25zOiBbJ3MzOkdldE9iamVjdCcsICdzMzpHZXRPYmplY3RWZXJzaW9uJ10sXG4gICAgcmVzb3VyY2VzOiBbYnVja2V0LmFybkZvck9iamVjdHMoJyonKV0sXG4gICAgY29uZGl0aW9uczogeyBTdHJpbmdFcXVhbHM6IHsgJ2F3czpTb3VyY2VBY2NvdW50Jzogc3RhY2suYWNjb3VudCB9IH0sXG4gIH0pKTtcblxuICAvLyBPbmx5IGEgdGFnZ2VkIGJ1Y2tldCBpcyBlbXB0aWVkIChzZWUgRU1QVFlfT05fREVMRVRFX1RBRykuXG4gIFRhZ3Mub2YoYnVja2V0KS5hZGQoRU1QVFlfT05fREVMRVRFX1RBRy5rZXksIEVNUFRZX09OX0RFTEVURV9UQUcudmFsdWUpO1xuICBjb25zdCBwcm92aWRlciA9IHdlYkZ1bmN0aW9uUHJvdmlkZXIoc3RhY2spO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkxpc3RCdWNrZXRWZXJzaW9ucycsICdzMzpHZXRCdWNrZXRUYWdnaW5nJ10sIFJlc291cmNlOiBidWNrZXQuYnVja2V0QXJuIH0pO1xuICBncmFudFRvUHJvdmlkZXIocHJvdmlkZXIsIHsgQWN0aW9uOiBbJ3MzOkRlbGV0ZU9iamVjdCcsICdzMzpEZWxldGVPYmplY3RWZXJzaW9uJ10sIFJlc291cmNlOiBidWNrZXQuYXJuRm9yT2JqZWN0cygnKicpIH0pO1xuICBjb25zdCBwcm9wZXJ0aWVzOiBDb2RlQnVja2V0Q2xlYW51cFByb3BlcnRpZXMgPSB7IEJ1Y2tldE5hbWU6IGJ1Y2tldC5idWNrZXROYW1lIH07XG4gIC8vIERlcGVuZHMgb24gdGhlIGJ1Y2tldCAodGhyb3VnaCBpdHMgbmFtZSksIHNvIGl0J3MgZGVsZXRlZCwgYW5kIGVtcHRpZXMgaXQsIGp1c3QgYmVmb3JlIHRoZSBidWNrZXQuXG4gIG5ldyBDdXN0b21SZXNvdXJjZShzdGFjaywgYCR7SUR9Q2xlYW51cGAsIHtcbiAgICBzZXJ2aWNlVG9rZW46IHByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICByZXNvdXJjZVR5cGU6IENPREVfQlVDS0VUX0NMRUFOVVBfUkVTT1VSQ0VfVFlQRSxcbiAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgfSk7XG4gIHJldHVybiBidWNrZXQ7XG59XG4iXX0=

package/lib/private/nag.d.ts

@@ -0,0 +1,19 @@
+import { CfnResource } from 'aws-cdk-lib';
+import type { IConstruct } from 'constructs';
+/**
+ * Acknowledges cdk-nag AwsSolutions findings on resources this library creates, so teams that run cdk-nag don't have
+ * to acknowledge our internals. Written for both major versions, without depending on cdk-nag:
+ * - cdk-nag 3 reads CDK's `Validations.of(resource).acknowledge()`, one id per finding (`AwsSolutions::<rule>[<finding>]`);
+ * - cdk-nag 2 reads `cdk_nag` metadata, where a rule without `applies_to` covers all its findings.
+ */
+export declare function acknowledgeNagRules(resource: CfnResource, rules: string[], reason: string): void;
+/**
+ * Acknowledges the IAM findings of a role or policy whose permissions are all this library's: wildcards (IAM5) and,
+ * with `managedPolicies`, AWS managed policies (IAM4). Finding ids depend on the resolved policy (logical IDs, the
+ * stack's environment), so they're computed when the app is synthesized.
+ */
+export declare function acknowledgeIamFindings(resource: CfnResource, reason: string, options?: {
+    managedPolicies?: boolean;
+}): void;
+/** Acknowledges IAM findings on every role and policy under `scope`, and the given rules on matching resources. */
+export declare function acknowledgeNagUnder(scope: IConstruct, reason: string, rulesByType?: Record<string, string[]>): void;

package/lib/private/nag.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acknowledgeNagRules = acknowledgeNagRules;
+exports.acknowledgeIamFindings = acknowledgeIamFindings;
+exports.acknowledgeNagUnder = acknowledgeNagUnder;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const iam = __importStar(require("aws-cdk-lib/aws-iam"));
+/**
+ * Acknowledges cdk-nag AwsSolutions findings on resources this library creates, so teams that run cdk-nag don't have
+ * to acknowledge our internals. Written for both major versions, without depending on cdk-nag:
+ * - cdk-nag 3 reads CDK's `Validations.of(resource).acknowledge()`, one id per finding (`AwsSolutions::<rule>[<finding>]`);
+ * - cdk-nag 2 reads `cdk_nag` metadata, where a rule without `applies_to` covers all its findings.
+ */
+function acknowledgeNagRules(resource, rules, reason) {
+    for (const rule of rules)
+        aws_cdk_lib_1.Validations.of(resource).acknowledge({ id: `AwsSolutions::${rule}`, reason });
+    addV2Suppressions(resource, rules, reason);
+}
+/**
+ * Acknowledges the IAM findings of a role or policy whose permissions are all this library's: wildcards (IAM5) and,
+ * with `managedPolicies`, AWS managed policies (IAM4). Finding ids depend on the resolved policy (logical IDs, the
+ * stack's environment), so they're computed when the app is synthesized.
+ */
+function acknowledgeIamFindings(resource, reason, options = {}) {
+    addV2Suppressions(resource, ['AwsSolutions-IAM5', ...(options.managedPolicies ? ['AwsSolutions-IAM4'] : [])], reason);
+    resource.node.addValidation({
+        validate: () => {
+            for (const finding of iamFindings(resource, options.managedPolicies ?? false)) {
+                aws_cdk_lib_1.Validations.of(resource).acknowledge({ id: `AwsSolutions::${finding}`, reason });
+            }
+            return [];
+        },
+    });
+}
+/** Acknowledges IAM findings on every role and policy under `scope`, and the given rules on matching resources. */
+function acknowledgeNagUnder(scope, reason, rulesByType = {}) {
+    for (const child of scope.node.findAll()) {
+        if (!aws_cdk_lib_1.CfnResource.isCfnResource(child))
+            continue;
+        if (child instanceof iam.CfnRole || child instanceof iam.CfnPolicy)
+            acknowledgeIamFindings(child, reason, { managedPolicies: true });
+        const rules = rulesByType[child.cfnResourceType];
+        if (rules)
+            acknowledgeNagRules(child, rules, reason);
+    }
+}
+function iamFindings(resource, managedPolicies) {
+    const stack = aws_cdk_lib_1.Stack.of(resource);
+    const documents = [];
+    const findings = [];
+    if (resource instanceof iam.CfnPolicy) {
+        documents.push(stack.resolve(resource.policyDocument));
+    }
+    else if (resource instanceof iam.CfnRole) {
+        for (const policy of stack.resolve(resource.policies) ?? [])
+            documents.push(stack.resolve(stack.resolve(policy).policyDocument));
+        if (managedPolicies) {
+            for (const arn of stack.resolve(resource.managedPolicyArns) ?? [])
+                findings.push(`AwsSolutions-IAM4[Policy::${flatten(arn)}]`);
+        }
+    }
+    for (const document of documents) {
+        for (const statement of document?.Statement ?? []) {
+            if (statement.Effect !== 'Allow')
+                continue;
+            for (const action of list(statement.Action))
+                if (String(action).includes('*'))
+                    findings.push(`AwsSolutions-IAM5[Action::${action}]`);
+            for (const r of list(statement.Resource)) {
+                const flat = flatten(r);
+                if (flat.includes('*'))
+                    findings.push(`AwsSolutions-IAM5[Resource::${flat}]`);
+            }
+        }
+    }
+    return [...new Set(findings)];
+}
+/** cdk-nag's own flattening of CloudFormation references in finding ids (`utils/flatten-cfn-reference`). */
+function flatten(node) {
+    if (node === undefined)
+        return '';
+    if (typeof node === 'string')
+        return node.replace(/\$\{/g, '<').replace(/}/g, '>');
+    if (node['Fn::Join']) {
+        const [delimiter, items] = node['Fn::Join'];
+        return items.map(flatten).join(delimiter);
+    }
+    if (node['Fn::Sub'])
+        return flatten(node['Fn::Sub']);
+    if (node['Fn::GetAtt'])
+        return `<${flatten(node['Fn::GetAtt'][0])}.${flatten(node['Fn::GetAtt'][1])}>`;
+    if (node['Fn::ImportValue'])
+        return flatten(node['Fn::ImportValue']);
+    if (node.Ref)
+        return `<${flatten(node.Ref)}>`;
+    return JSON.stringify(node);
+}
+function addV2Suppressions(resource, rules, reason) {
+    const existing = resource.getMetadata('cdk_nag')?.rules_to_suppress ?? [];
+    const ids = new Set(existing.map((r) => r.id));
+    resource.addMetadata('cdk_nag', { rules_to_suppress: [...existing, ...rules.filter((id) => !ids.has(id)).map((id) => ({ id, reason }))] });
+}
+function list(value) {
+    return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFnLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ByaXZhdGUvbmFnLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBVUEsa0RBR0M7QUFPRCx3REFVQztBQUdELGtEQU9DO0FBeENELDZDQUE4RDtBQUM5RCx5REFBMkM7QUFHM0M7Ozs7O0dBS0c7QUFDSCxTQUFnQixtQkFBbUIsQ0FBQyxRQUFxQixFQUFFLEtBQWUsRUFBRSxNQUFjO0lBQ3hGLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSztRQUFFLHlCQUFXLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxpQkFBaUIsSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUN4RyxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0FBQzdDLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsU0FBZ0Isc0JBQXNCLENBQUMsUUFBcUIsRUFBRSxNQUFjLEVBQUUsVUFBeUMsRUFBRTtJQUN2SCxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxtQkFBbUIsRUFBRSxHQUFHLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RILFFBQVEsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQzFCLFFBQVEsRUFBRSxHQUFHLEVBQUU7WUFDYixLQUFLLE1BQU0sT0FBTyxJQUFJLFdBQVcsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLGVBQWUsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUM5RSx5QkFBVyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsaUJBQWlCLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDbkYsQ0FBQztZQUNELE9BQU8sRUFBRSxDQUFDO1FBQ1osQ0FBQztLQUNGLENBQUMsQ0FBQztBQUNMLENBQUM7QUFFRCxtSEFBbUg7QUFDbkgsU0FBZ0IsbUJBQW1CLENBQUMsS0FBaUIsRUFBRSxNQUFjLEVBQUUsY0FBd0MsRUFBRTtJQUMvRyxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMseUJBQVcsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO1lBQUUsU0FBUztRQUNoRCxJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsT0FBTyxJQUFJLEtBQUssWUFBWSxHQUFHLENBQUMsU0FBUztZQUFFLHNCQUFzQixDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNySSxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2pELElBQUksS0FBSztZQUFFLG1CQUFtQixDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdkQsQ0FBQztBQUNILENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxRQUFxQixFQUFFLGVBQXdCO0lBQ2xFLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sU0FBUyxHQUFVLEVBQUUsQ0FBQztJQUM1QixNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFDOUIsSUFBSSxRQUFRLFlBQVksR0FBRyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUN6RCxDQUFDO1NBQU0sSUFBSSxRQUFRLFlBQVksR0FBRyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzNDLEtBQUssTUFBTSxNQUFNLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRTtZQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDakksSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUNwQixLQUFLLE1BQU0sR0FBRyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLElBQUksRUFBRTtnQkFBRSxRQUFRLENBQUMsSUFBSSxDQUFDLDZCQUE2QixPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pJLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLFFBQVEsSUFBSSxTQUFTLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sU0FBUyxJQUFJLFFBQVEsRUFBRSxTQUFTLElBQUksRUFBRSxFQUFFLENBQUM7WUFDbEQsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQUUsU0FBUztZQUMzQyxLQUFLLE1BQU0sTUFBTSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDO2dCQUFFLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7b0JBQUUsUUFBUSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsTUFBTSxHQUFHLENBQUMsQ0FBQztZQUNySSxLQUFLLE1BQU0sQ0FBQyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztnQkFDekMsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUN4QixJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO29CQUFFLFFBQVEsQ0FBQyxJQUFJLENBQUMsK0JBQStCLElBQUksR0FBRyxDQUFDLENBQUM7WUFDaEYsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUNoQyxDQUFDO0FBRUQsNEdBQTRHO0FBQzVHLFNBQVMsT0FBTyxDQUFDLElBQVM7SUFDeEIsSUFBSSxJQUFJLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xDLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUTtRQUFFLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQztJQUNuRixJQUFJLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVDLE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUFFLE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3JELElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFDdkcsSUFBSSxJQUFJLENBQUMsaUJBQWlCLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLElBQUksSUFBSSxDQUFDLEdBQUc7UUFBRSxPQUFPLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO0lBQzlDLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUM5QixDQUFDO0FBRUQsU0FBUyxpQkFBaUIsQ0FBQyxRQUFxQixFQUFFLEtBQWUsRUFBRSxNQUFjO0lBQy9FLE1BQU0sUUFBUSxHQUFJLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUEwRSxFQUFFLGlCQUFpQixJQUFJLEVBQUUsQ0FBQztJQUNwSixNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMvQyxRQUFRLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxFQUFFLGlCQUFpQixFQUFFLENBQUMsR0FBRyxRQUFRLEVBQUUsR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzdJLENBQUM7QUFFRCxTQUFTLElBQUksQ0FBQyxLQUFjO0lBQzFCLE9BQU8sS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDM0UsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENmblJlc291cmNlLCBTdGFjaywgVmFsaWRhdGlvbnMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSB7IElDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBBY2tub3dsZWRnZXMgY2RrLW5hZyBBd3NTb2x1dGlvbnMgZmluZGluZ3Mgb24gcmVzb3VyY2VzIHRoaXMgbGlicmFyeSBjcmVhdGVzLCBzbyB0ZWFtcyB0aGF0IHJ1biBjZGstbmFnIGRvbid0IGhhdmVcbiAqIHRvIGFja25vd2xlZGdlIG91ciBpbnRlcm5hbHMuIFdyaXR0ZW4gZm9yIGJvdGggbWFqb3IgdmVyc2lvbnMsIHdpdGhvdXQgZGVwZW5kaW5nIG9uIGNkay1uYWc6XG4gKiAtIGNkay1uYWcgMyByZWFkcyBDREsncyBgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKClgLCBvbmUgaWQgcGVyIGZpbmRpbmcgKGBBd3NTb2x1dGlvbnM6OjxydWxlPls8ZmluZGluZz5dYCk7XG4gKiAtIGNkay1uYWcgMiByZWFkcyBgY2RrX25hZ2AgbWV0YWRhdGEsIHdoZXJlIGEgcnVsZSB3aXRob3V0IGBhcHBsaWVzX3RvYCBjb3ZlcnMgYWxsIGl0cyBmaW5kaW5ncy5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGFja25vd2xlZGdlTmFnUnVsZXMocmVzb3VyY2U6IENmblJlc291cmNlLCBydWxlczogc3RyaW5nW10sIHJlYXNvbjogc3RyaW5nKTogdm9pZCB7XG4gIGZvciAoY29uc3QgcnVsZSBvZiBydWxlcykgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKHsgaWQ6IGBBd3NTb2x1dGlvbnM6OiR7cnVsZX1gLCByZWFzb24gfSk7XG4gIGFkZFYyU3VwcHJlc3Npb25zKHJlc291cmNlLCBydWxlcywgcmVhc29uKTtcbn1cblxuLyoqXG4gKiBBY2tub3dsZWRnZXMgdGhlIElBTSBmaW5kaW5ncyBvZiBhIHJvbGUgb3IgcG9saWN5IHdob3NlIHBlcm1pc3Npb25zIGFyZSBhbGwgdGhpcyBsaWJyYXJ5J3M6IHdpbGRjYXJkcyAoSUFNNSkgYW5kLFxuICogd2l0aCBgbWFuYWdlZFBvbGljaWVzYCwgQVdTIG1hbmFnZWQgcG9saWNpZXMgKElBTTQpLiBGaW5kaW5nIGlkcyBkZXBlbmQgb24gdGhlIHJlc29sdmVkIHBvbGljeSAobG9naWNhbCBJRHMsIHRoZVxuICogc3RhY2sncyBlbnZpcm9ubWVudCksIHNvIHRoZXkncmUgY29tcHV0ZWQgd2hlbiB0aGUgYXBwIGlzIHN5bnRoZXNpemVkLlxuICovXG5leHBvcnQgZnVuY3Rpb24gYWNrbm93bGVkZ2VJYW1GaW5kaW5ncyhyZXNvdXJjZTogQ2ZuUmVzb3VyY2UsIHJlYXNvbjogc3RyaW5nLCBvcHRpb25zOiB7IG1hbmFnZWRQb2xpY2llcz86IGJvb2xlYW4gfSA9IHt9KTogdm9pZCB7XG4gIGFkZFYyU3VwcHJlc3Npb25zKHJlc291cmNlLCBbJ0F3c1NvbHV0aW9ucy1JQU01JywgLi4uKG9wdGlvbnMubWFuYWdlZFBvbGljaWVzID8gWydBd3NTb2x1dGlvbnMtSUFNNCddIDogW10pXSwgcmVhc29uKTtcbiAgcmVzb3VyY2Uubm9kZS5hZGRWYWxpZGF0aW9uKHtcbiAgICB2YWxpZGF0ZTogKCkgPT4ge1xuICAgICAgZm9yIChjb25zdCBmaW5kaW5nIG9mIGlhbUZpbmRpbmdzKHJlc291cmNlLCBvcHRpb25zLm1hbmFnZWRQb2xpY2llcyA/PyBmYWxzZSkpIHtcbiAgICAgICAgVmFsaWRhdGlvbnMub2YocmVzb3VyY2UpLmFja25vd2xlZGdlKHsgaWQ6IGBBd3NTb2x1dGlvbnM6OiR7ZmluZGluZ31gLCByZWFzb24gfSk7XG4gICAgICB9XG4gICAgICByZXR1cm4gW107XG4gICAgfSxcbiAgfSk7XG59XG5cbi8qKiBBY2tub3dsZWRnZXMgSUFNIGZpbmRpbmdzIG9uIGV2ZXJ5IHJvbGUgYW5kIHBvbGljeSB1bmRlciBgc2NvcGVgLCBhbmQgdGhlIGdpdmVuIHJ1bGVzIG9uIG1hdGNoaW5nIHJlc291cmNlcy4gKi9cbmV4cG9ydCBmdW5jdGlvbiBhY2tub3dsZWRnZU5hZ1VuZGVyKHNjb3BlOiBJQ29uc3RydWN0LCByZWFzb246IHN0cmluZywgcnVsZXNCeVR5cGU6IFJlY29yZDxzdHJpbmcsIHN0cmluZ1tdPiA9IHt9KTogdm9pZCB7XG4gIGZvciAoY29uc3QgY2hpbGQgb2Ygc2NvcGUubm9kZS5maW5kQWxsKCkpIHtcbiAgICBpZiAoIUNmblJlc291cmNlLmlzQ2ZuUmVzb3VyY2UoY2hpbGQpKSBjb250aW51ZTtcbiAgICBpZiAoY2hpbGQgaW5zdGFuY2VvZiBpYW0uQ2ZuUm9sZSB8fCBjaGlsZCBpbnN0YW5jZW9mIGlhbS5DZm5Qb2xpY3kpIGFja25vd2xlZGdlSWFtRmluZGluZ3MoY2hpbGQsIHJlYXNvbiwgeyBtYW5hZ2VkUG9saWNpZXM6IHRydWUgfSk7XG4gICAgY29uc3QgcnVsZXMgPSBydWxlc0J5VHlwZVtjaGlsZC5jZm5SZXNvdXJjZVR5cGVdO1xuICAgIGlmIChydWxlcykgYWNrbm93bGVkZ2VOYWdSdWxlcyhjaGlsZCwgcnVsZXMsIHJlYXNvbik7XG4gIH1cbn1cblxuZnVuY3Rpb24gaWFtRmluZGluZ3MocmVzb3VyY2U6IENmblJlc291cmNlLCBtYW5hZ2VkUG9saWNpZXM6IGJvb2xlYW4pOiBzdHJpbmdbXSB7XG4gIGNvbnN0IHN0YWNrID0gU3RhY2sub2YocmVzb3VyY2UpO1xuICBjb25zdCBkb2N1bWVudHM6IGFueVtdID0gW107XG4gIGNvbnN0IGZpbmRpbmdzOiBzdHJpbmdbXSA9IFtdO1xuICBpZiAocmVzb3VyY2UgaW5zdGFuY2VvZiBpYW0uQ2ZuUG9saWN5KSB7XG4gICAgZG9jdW1lbnRzLnB1c2goc3RhY2sucmVzb2x2ZShyZXNvdXJjZS5wb2xpY3lEb2N1bWVudCkpO1xuICB9IGVsc2UgaWYgKHJlc291cmNlIGluc3RhbmNlb2YgaWFtLkNmblJvbGUpIHtcbiAgICBmb3IgKGNvbnN0IHBvbGljeSBvZiBzdGFjay5yZXNvbHZlKHJlc291cmNlLnBvbGljaWVzKSA/PyBbXSkgZG9jdW1lbnRzLnB1c2goc3RhY2sucmVzb2x2ZShzdGFjay5yZXNvbHZlKHBvbGljeSkucG9saWN5RG9jdW1lbnQpKTtcbiAgICBpZiAobWFuYWdlZFBvbGljaWVzKSB7XG4gICAgICBmb3IgKGNvbnN0IGFybiBvZiBzdGFjay5yZXNvbHZlKHJlc291cmNlLm1hbmFnZWRQb2xpY3lBcm5zKSA/PyBbXSkgZmluZGluZ3MucHVzaChgQXdzU29sdXRpb25zLUlBTTRbUG9saWN5Ojoke2ZsYXR0ZW4oYXJuKX1dYCk7XG4gICAgfVxuICB9XG4gIGZvciAoY29uc3QgZG9jdW1lbnQgb2YgZG9jdW1lbnRzKSB7XG4gICAgZm9yIChjb25zdCBzdGF0ZW1lbnQgb2YgZG9jdW1lbnQ/LlN0YXRlbWVudCA/PyBbXSkge1xuICAgICAgaWYgKHN0YXRlbWVudC5FZmZlY3QgIT09ICdBbGxvdycpIGNvbnRpbnVlO1xuICAgICAgZm9yIChjb25zdCBhY3Rpb24gb2YgbGlzdChzdGF0ZW1lbnQuQWN0aW9uKSkgaWYgKFN0cmluZyhhY3Rpb24pLmluY2x1ZGVzKCcqJykpIGZpbmRpbmdzLnB1c2goYEF3c1NvbHV0aW9ucy1JQU01W0FjdGlvbjo6JHthY3Rpb259XWApO1xuICAgICAgZm9yIChjb25zdCByIG9mIGxpc3Qoc3RhdGVtZW50LlJlc291cmNlKSkge1xuICAgICAgICBjb25zdCBmbGF0ID0gZmxhdHRlbihyKTtcbiAgICAgICAgaWYgKGZsYXQuaW5jbHVkZXMoJyonKSkgZmluZGluZ3MucHVzaChgQXdzU29sdXRpb25zLUlBTTVbUmVzb3VyY2U6OiR7ZmxhdH1dYCk7XG4gICAgICB9XG4gICAgfVxuICB9XG4gIHJldHVybiBbLi4ubmV3IFNldChmaW5kaW5ncyldO1xufVxuXG4vKiogY2RrLW5hZydzIG93biBmbGF0dGVuaW5nIG9mIENsb3VkRm9ybWF0aW9uIHJlZmVyZW5jZXMgaW4gZmluZGluZyBpZHMgKGB1dGlscy9mbGF0dGVuLWNmbi1yZWZlcmVuY2VgKS4gKi9cbmZ1bmN0aW9uIGZsYXR0ZW4obm9kZTogYW55KTogc3RyaW5nIHtcbiAgaWYgKG5vZGUgPT09IHVuZGVmaW5lZCkgcmV0dXJuICcnO1xuICBpZiAodHlwZW9mIG5vZGUgPT09ICdzdHJpbmcnKSByZXR1cm4gbm9kZS5yZXBsYWNlKC9cXCRcXHsvZywgJzwnKS5yZXBsYWNlKC99L2csICc+Jyk7XG4gIGlmIChub2RlWydGbjo6Sm9pbiddKSB7XG4gICAgY29uc3QgW2RlbGltaXRlciwgaXRlbXNdID0gbm9kZVsnRm46OkpvaW4nXTtcbiAgICByZXR1cm4gaXRlbXMubWFwKGZsYXR0ZW4pLmpvaW4oZGVsaW1pdGVyKTtcbiAgfVxuICBpZiAobm9kZVsnRm46OlN1YiddKSByZXR1cm4gZmxhdHRlbihub2RlWydGbjo6U3ViJ10pO1xuICBpZiAobm9kZVsnRm46OkdldEF0dCddKSByZXR1cm4gYDwke2ZsYXR0ZW4obm9kZVsnRm46OkdldEF0dCddWzBdKX0uJHtmbGF0dGVuKG5vZGVbJ0ZuOjpHZXRBdHQnXVsxXSl9PmA7XG4gIGlmIChub2RlWydGbjo6SW1wb3J0VmFsdWUnXSkgcmV0dXJuIGZsYXR0ZW4obm9kZVsnRm46OkltcG9ydFZhbHVlJ10pO1xuICBpZiAobm9kZS5SZWYpIHJldHVybiBgPCR7ZmxhdHRlbihub2RlLlJlZil9PmA7XG4gIHJldHVybiBKU09OLnN0cmluZ2lmeShub2RlKTtcbn1cblxuZnVuY3Rpb24gYWRkVjJTdXBwcmVzc2lvbnMocmVzb3VyY2U6IENmblJlc291cmNlLCBydWxlczogc3RyaW5nW10sIHJlYXNvbjogc3RyaW5nKTogdm9pZCB7XG4gIGNvbnN0IGV4aXN0aW5nID0gKHJlc291cmNlLmdldE1ldGFkYXRhKCdjZGtfbmFnJykgYXMgeyBydWxlc190b19zdXBwcmVzcz86IHsgaWQ6IHN0cmluZzsgcmVhc29uOiBzdHJpbmcgfVtdIH0gfCB1bmRlZmluZWQpPy5ydWxlc190b19zdXBwcmVzcyA/PyBbXTtcbiAgY29uc3QgaWRzID0gbmV3IFNldChleGlzdGluZy5tYXAoKHIpID0+IHIuaWQpKTtcbiAgcmVzb3VyY2UuYWRkTWV0YWRhdGEoJ2Nka19uYWcnLCB7IHJ1bGVzX3RvX3N1cHByZXNzOiBbLi4uZXhpc3RpbmcsIC4uLnJ1bGVzLmZpbHRlcigoaWQpID0+ICFpZHMuaGFzKGlkKSkubWFwKChpZCkgPT4gKHsgaWQsIHJlYXNvbiB9KSldIH0pO1xufVxuXG5mdW5jdGlvbiBsaXN0KHZhbHVlOiB1bmtub3duKTogdW5rbm93bltdIHtcbiAgcmV0dXJuIHZhbHVlID09PSB1bmRlZmluZWQgPyBbXSA6IEFycmF5LmlzQXJyYXkodmFsdWUpID8gdmFsdWUgOiBbdmFsdWVdO1xufVxuIl19

package/lib/private/traffic-shift.js

@@ -42,6 +42,7 @@ const lambda = __importStar(require("aws-cdk-lib/aws-lambda"));
 const logs = __importStar(require("aws-cdk-lib/aws-logs"));
 const cr = __importStar(require("aws-cdk-lib/custom-resources"));
 const constructs_1 = require("constructs");
+const nag_1 = require("./nag");
 const provider_protocol_1 = require("./provider-protocol");
 /** The Provider framework gives up after this long and fails the deployment (with a message), before CloudFormation's own 1-hour limit. */
 const TOTAL_TIMEOUT = aws_cdk_lib_1.Duration.minutes(55);
@@ -61,15 +62,14 @@ class DeploymentProvider extends constructs_1.Construct {
     granted = new Set();
     constructor(scope, id) {
         super(scope, id);
-        this.role = new iam.Role(this, 'Role', {
-            assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
-            managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')],
-        });
+        const logGroup = new logs.LogGroup(this, 'Logs', { retention: logs.RetentionDays.ONE_MONTH, removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY });
+        this.role = new iam.Role(this, 'Role', { assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com') });
+        // Its own log group only (not AWSLambdaBasicExecutionRole, which can create any group).
+        this.grant({ actions: ['logs:CreateLogStream', 'logs:PutLogEvents'], resources: [logGroup.logGroupArn] });
         // Rollback detection: is the stack rolling back? (the provider's own stack only).
         this.grant({ actions: ['cloudformation:DescribeStacks'], resources: [aws_cdk_lib_1.Stack.of(this).stackId] });
         // Composite alarms are only returned with DescribeAlarms on '*'.
         this.grant({ actions: ['cloudwatch:DescribeAlarms'], resources: ['*'] });
-        const logGroup = new logs.LogGroup(this, 'Logs', { retention: logs.RetentionDays.ONE_MONTH, removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY });
         const handler = (name, handlerName, description) => new lambda.Function(this, name, {
             runtime: lambda.Runtime.NODEJS_24_X,
             architecture: lambda.Architecture.ARM_64,
@@ -90,6 +90,10 @@ class DeploymentProvider extends constructs_1.Construct {
             logGroup,
         });
         this.serviceToken = provider.serviceToken;
+        (0, nag_1.acknowledgeIamFindings)(this.role.node.findChild('DefaultPolicy').node.defaultChild, 'The deployment handlers\' own log group, DescribeAlarms (composite alarms need *), and the revisions and endpoints of the functions they deploy');
+        (0, nag_1.acknowledgeNagUnder)(provider, 'The CDK custom resource Provider framework\'s own functions and waiter state machine', {
+            'AWS::StepFunctions::StateMachine': ['AwsSolutions-SF1', 'AwsSolutions-SF2'],
+        });
     }
     /**
      * Adds a statement to the handlers' role, once. Like the shared provider's grants, they must be stable across
@@ -141,4 +145,4 @@ class TrafficShift extends constructs_1.Construct {
     }
 }
 exports.TrafficShift = TrafficShift;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhZmZpYy1zaGlmdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL3RyYWZmaWMtc2hpZnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQXlDO0FBQ3pDLGdEQUFrQztBQUNsQyw2Q0FBd0Y7QUFDeEYseURBQTJDO0FBQzNDLCtEQUFpRDtBQUNqRCwyREFBNkM7QUFDN0MsaUVBQW1EO0FBQ25ELDJDQUF1QztBQUN2QywyREFBK0Y7QUFHL0YsMklBQTJJO0FBQzNJLE1BQU0sYUFBYSxHQUFHLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzNDLE1BQU0sV0FBVyxHQUFHLDZCQUE2QixDQUFDO0FBRWxEOzs7O0dBSUc7QUFDSCxNQUFNLGtCQUFtQixTQUFRLHNCQUFTO0lBQ2pDLE1BQU0sQ0FBQyxFQUFFLENBQUMsS0FBZ0I7UUFDL0IsTUFBTSxLQUFLLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUIsT0FBUSxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQW9DLElBQUksSUFBSSxrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDaEksQ0FBQztJQUVlLFlBQVksQ0FBUztJQUNwQixJQUFJLENBQVc7SUFDZixPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUU3QyxZQUFvQixLQUFnQixFQUFFLEVBQVU7UUFDOUMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFO1lBQ3JDLFNBQVMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxzQkFBc0IsQ0FBQztZQUMzRCxlQUFlLEVBQUUsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLHdCQUF3QixDQUFDLDBDQUEwQyxDQUFDLENBQUM7U0FDMUcsQ0FBQyxDQUFDO1FBQ0gsa0ZBQWtGO1FBQ2xGLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQywrQkFBK0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNoRyxpRUFBaUU7UUFDakUsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLDJCQUEyQixDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBRXpFLE1BQU0sUUFBUSxHQUFHLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxFQUFFLGFBQWEsRUFBRSwyQkFBYSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDcEksTUFBTSxPQUFPLEdBQUcsQ0FBQyxJQUFZLEVBQUUsV0FBbUIsRUFBRSxXQUFtQixFQUFFLEVBQUUsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksRUFBRTtZQUMxRyxPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXO1lBQ25DLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLE1BQU07WUFDeEMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLHlCQUF5QixDQUFDLENBQUM7WUFDbEcsT0FBTyxFQUFFLFNBQVMsV0FBVyxFQUFFO1lBQy9CLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtZQUNmLHNHQUFzRztZQUN0RyxPQUFPLEVBQUUsc0JBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQzVCLFVBQVUsRUFBRSxHQUFHO1lBQ2YsUUFBUTtZQUNSLFdBQVc7U0FDWixDQUFDLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxJQUFJLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUNqRCxjQUFjLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsdUVBQXVFLENBQUM7WUFDdEgsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsNEVBQTRFLENBQUM7WUFDcEksYUFBYSxFQUFFLHNCQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNuQyxZQUFZLEVBQUUsYUFBYTtZQUMzQixRQUFRO1NBQ1QsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLFlBQVksR0FBRyxRQUFRLENBQUMsWUFBWSxDQUFDO0lBQzVDLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsU0FBcUQ7UUFDaEUsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUM5RCxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU87UUFDbEMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDdEIsSUFBSSxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0NBQ0Y7QUFlRDs7R0FFRztBQUNILE1BQWEsWUFBYSxTQUFRLHNCQUFTO0lBQ3pCLFFBQVEsQ0FBaUI7SUFFekMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF3QjtRQUNoRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLGtCQUFrQixDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QyxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ2xDLE9BQU8sRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVksRUFBRSxTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7U0FDeEgsQ0FBQyxDQUFDO1FBQ0gsbUZBQW1GO1FBQ25GLFFBQVEsQ0FBQyxLQUFLLENBQUM7WUFDYixPQUFPLEVBQUUsQ0FBQywrQkFBK0IsRUFBRSxrQ0FBa0MsQ0FBQztZQUM5RSxTQUFTLEVBQUUsQ0FBQyxXQUFXLEVBQUUsR0FBRyxXQUFXLGFBQWEsRUFBRSxHQUFHLFdBQVcsYUFBYSxDQUFDO1NBQ25GLENBQUMsQ0FBQztRQUVILE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDcEMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM3RixNQUFNLFVBQVUsR0FBMkI7WUFDekMsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO1lBQzlCLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWTtZQUNoQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7WUFDNUIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztZQUNsQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7WUFDNUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDdkQsY0FBYyxFQUFFLElBQUEsd0JBQVUsRUFBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDO1NBQzVILENBQUM7UUFDRixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksNEJBQWMsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFO1lBQ25ELFlBQVksRUFBRSxRQUFRLENBQUMsWUFBWTtZQUNuQyxZQUFZLEVBQUUsK0NBQTJCO1lBQ3pDLFVBQVUsRUFBRSxFQUFFLEdBQUcsVUFBVSxFQUFFO1lBQzdCLHVGQUF1RjtZQUN2RixjQUFjLEVBQUUsc0JBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1NBQ2xDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQW5DRCxvQ0FtQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBjcmVhdGVIYXNoIH0gZnJvbSAnbm9kZTpjcnlwdG8nO1xuaW1wb3J0ICogYXMgcGF0aCBmcm9tICdub2RlOnBhdGgnO1xuaW1wb3J0IHsgQXJuRm9ybWF0LCBDdXN0b21SZXNvdXJjZSwgRHVyYXRpb24sIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgbGFtYmRhIGZyb20gJ2F3cy1jZGstbGliL2F3cy1sYW1iZGEnO1xuaW1wb3J0ICogYXMgbG9ncyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtbG9ncyc7XG5pbXBvcnQgKiBhcyBjciBmcm9tICdhd3MtY2RrLWxpYi9jdXN0b20tcmVzb3VyY2VzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgVFJBRkZJQ19TSElGVF9SRVNPVVJDRV9UWVBFLCB0eXBlIFRyYWZmaWNTaGlmdFByb3BlcnRpZXMgfSBmcm9tICcuL3Byb3ZpZGVyLXByb3RvY29sJztcbmltcG9ydCB0eXBlIHsgV2ViRnVuY3Rpb25EZXBsb3ltZW50IH0gZnJvbSAnLi4vd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnQnO1xuXG4vKiogVGhlIFByb3ZpZGVyIGZyYW1ld29yayBnaXZlcyB1cCBhZnRlciB0aGlzIGxvbmcgYW5kIGZhaWxzIHRoZSBkZXBsb3ltZW50ICh3aXRoIGEgbWVzc2FnZSksIGJlZm9yZSBDbG91ZEZvcm1hdGlvbidzIG93biAxLWhvdXIgbGltaXQuICovXG5jb25zdCBUT1RBTF9USU1FT1VUID0gRHVyYXRpb24ubWludXRlcyg1NSk7XG5jb25zdCBQUk9WSURFUl9JRCA9ICdMYW1iZGFXZWJEZXBsb3ltZW50UHJvdmlkZXInO1xuXG4vKipcbiAqIFRoZSBzdGFjaydzIGRlcGxveW1lbnQgcHJvdmlkZXI6IGEgQ0RLIFByb3ZpZGVyIGZyYW1ld29yayAoYSBTdGVwIEZ1bmN0aW9ucyB3YWl0ZXIpIGFyb3VuZCBgb25FdmVudGAgYW5kIGBpc0NvbXBsZXRlYFxuICogZnJvbSBgaGFuZGxlcnMvd2ViLWZ1bmN0aW9uLWRlcGxveW1lbnRgLCBiZWNhdXNlIGEgY2FuYXJ5IG9yIGxpbmVhciBkZXBsb3ltZW50IGNhbiBydW4gZm9yIHVwIHRvIGFuIGhvdXIuXG4gKiBPbmUgcGVyIHN0YWNrLCBzaGFyZWQgYnkgZXZlcnkgZW5kcG9pbnQgdGhhdCBkZXBsb3lzIGluIHN0ZXBzLlxuICovXG5jbGFzcyBEZXBsb3ltZW50UHJvdmlkZXIgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBwdWJsaWMgc3RhdGljIG9mKHNjb3BlOiBDb25zdHJ1Y3QpOiBEZXBsb3ltZW50UHJvdmlkZXIge1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2Yoc2NvcGUpO1xuICAgIHJldHVybiAoc3RhY2subm9kZS50cnlGaW5kQ2hpbGQoUFJPVklERVJfSUQpIGFzIERlcGxveW1lbnRQcm92aWRlciB8IHVuZGVmaW5lZCkgPz8gbmV3IERlcGxveW1lbnRQcm92aWRlcihzdGFjaywgUFJPVklERVJfSUQpO1xuICB9XG5cbiAgcHVibGljIHJlYWRvbmx5IHNlcnZpY2VUb2tlbjogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IHJvbGU6IGlhbS5Sb2xlO1xuICBwcml2YXRlIHJlYWRvbmx5IGdyYW50ZWQgPSBuZXcgU2V0PHN0cmluZz4oKTtcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIHRoaXMucm9sZSA9IG5ldyBpYW0uUm9sZSh0aGlzLCAnUm9sZScsIHtcbiAgICAgIGFzc3VtZWRCeTogbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsYW1iZGEuYW1hem9uYXdzLmNvbScpLFxuICAgICAgbWFuYWdlZFBvbGljaWVzOiBbaWFtLk1hbmFnZWRQb2xpY3kuZnJvbUF3c01hbmFnZWRQb2xpY3lOYW1lKCdzZXJ2aWNlLXJvbGUvQVdTTGFtYmRhQmFzaWNFeGVjdXRpb25Sb2xlJyldLFxuICAgIH0pO1xuICAgIC8vIFJvbGxiYWNrIGRldGVjdGlvbjogaXMgdGhlIHN0YWNrIHJvbGxpbmcgYmFjaz8gKHRoZSBwcm92aWRlcidzIG93biBzdGFjayBvbmx5KS5cbiAgICB0aGlzLmdyYW50KHsgYWN0aW9uczogWydjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcyddLCByZXNvdXJjZXM6IFtTdGFjay5vZih0aGlzKS5zdGFja0lkXSB9KTtcbiAgICAvLyBDb21wb3NpdGUgYWxhcm1zIGFyZSBvbmx5IHJldHVybmVkIHdpdGggRGVzY3JpYmVBbGFybXMgb24gJyonLlxuICAgIHRoaXMuZ3JhbnQoeyBhY3Rpb25zOiBbJ2Nsb3Vkd2F0Y2g6RGVzY3JpYmVBbGFybXMnXSwgcmVzb3VyY2VzOiBbJyonXSB9KTtcblxuICAgIGNvbnN0IGxvZ0dyb3VwID0gbmV3IGxvZ3MuTG9nR3JvdXAodGhpcywgJ0xvZ3MnLCB7IHJldGVudGlvbjogbG9ncy5SZXRlbnRpb25EYXlzLk9ORV9NT05USCwgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5ERVNUUk9ZIH0pO1xuICAgIGNvbnN0IGhhbmRsZXIgPSAobmFtZTogc3RyaW5nLCBoYW5kbGVyTmFtZTogc3RyaW5nLCBkZXNjcmlwdGlvbjogc3RyaW5nKSA9PiBuZXcgbGFtYmRhLkZ1bmN0aW9uKHRoaXMsIG5hbWUsIHtcbiAgICAgIHJ1bnRpbWU6IGxhbWJkYS5SdW50aW1lLk5PREVKU18yNF9YLFxuICAgICAgYXJjaGl0ZWN0dXJlOiBsYW1iZGEuQXJjaGl0ZWN0dXJlLkFSTV82NCxcbiAgICAgIGNvZGU6IGxhbWJkYS5Db2RlLmZyb21Bc3NldChwYXRoLmpvaW4oX19kaXJuYW1lLCAnLi4nLCAnLi4nLCAnYXNzZXRzJywgJ3dlYi1mdW5jdGlvbi1kZXBsb3ltZW50JykpLFxuICAgICAgaGFuZGxlcjogYGluZGV4LiR7aGFuZGxlck5hbWV9YCxcbiAgICAgIHJvbGU6IHRoaXMucm9sZSxcbiAgICAgIC8vIGlzQ29tcGxldGUgd2FpdHMgdXAgdG8gNSBtaW51dGVzIGZvciBhIHJlc3RvcmUgdG8gcmVhY2ggZXZlcnkgcmVnaW9uIGJlZm9yZSBmYWlsaW5nIHRoZSBkZXBsb3ltZW50LlxuICAgICAgdGltZW91dDogRHVyYXRpb24ubWludXRlcyg3KSxcbiAgICAgIG1lbW9yeVNpemU6IDI1NixcbiAgICAgIGxvZ0dyb3VwLFxuICAgICAgZGVzY3JpcHRpb24sXG4gICAgfSk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBuZXcgY3IuUHJvdmlkZXIodGhpcywgJ1Byb3ZpZGVyJywge1xuICAgICAgb25FdmVudEhhbmRsZXI6IGhhbmRsZXIoJ09uRXZlbnQnLCAnb25FdmVudCcsICdTdGFydHMgY2FuYXJ5IGFuZCBsaW5lYXIgZGVwbG95bWVudHMgb2YgTGFtYmRhIFdlYiBGdW5jdGlvbiBlbmRwb2ludHMnKSxcbiAgICAgIGlzQ29tcGxldGVIYW5kbGVyOiBoYW5kbGVyKCdJc0NvbXBsZXRlJywgJ2lzQ29tcGxldGUnLCAnTW92ZXMgTGFtYmRhIFdlYiBGdW5jdGlvbiBlbmRwb2ludCB0cmFmZmljIHN0ZXAgYnkgc3RlcCBhbmQgd2F0Y2hlcyBhbGFybXMnKSxcbiAgICAgIHF1ZXJ5SW50ZXJ2YWw6IER1cmF0aW9uLnNlY29uZHMoMTUpLFxuICAgICAgdG90YWxUaW1lb3V0OiBUT1RBTF9USU1FT1VULFxuICAgICAgbG9nR3JvdXAsXG4gICAgfSk7XG4gICAgdGhpcy5zZXJ2aWNlVG9rZW4gPSBwcm92aWRlci5zZXJ2aWNlVG9rZW47XG4gIH1cblxuICAvKipcbiAgICogQWRkcyBhIHN0YXRlbWVudCB0byB0aGUgaGFuZGxlcnMnIHJvbGUsIG9uY2UuIExpa2UgdGhlIHNoYXJlZCBwcm92aWRlcidzIGdyYW50cywgdGhleSBtdXN0IGJlIHN0YWJsZSBhY3Jvc3NcbiAgICogdXBkYXRlcyAocHJlZml4ZXMsIG5vdCBuYW1lcyB0aGF0IGNoYW5nZSkgYW5kIG5ldmVyIHJlZmVyZW5jZSBhdHRyaWJ1dGVzIG9mIHJlc291cmNlcyB0aGF0IHVzZSB0aGUgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgZ3JhbnQoc3RhdGVtZW50OiB7IGFjdGlvbnM6IHN0cmluZ1tdOyByZXNvdXJjZXM6IHN0cmluZ1tdIH0pOiB2b2lkIHtcbiAgICBjb25zdCBrZXkgPSBKU09OLnN0cmluZ2lmeShTdGFjay5vZih0aGlzKS5yZXNvbHZlKHN0YXRlbWVudCkpO1xuICAgIGlmICh0aGlzLmdyYW50ZWQuaGFzKGtleSkpIHJldHVybjtcbiAgICB0aGlzLmdyYW50ZWQuYWRkKGtleSk7XG4gICAgdGhpcy5yb2xlLmFkZFRvUHJpbmNpcGFsUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHN0YXRlbWVudCkpO1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0UHJvcHMge1xuICAvKiogTGl0ZXJhbCBmdW5jdGlvbiBuYW1lLCBmb3Igc3RhYmxlIElBTSBncmFudHMuICovXG4gIHJlYWRvbmx5IGZ1bmN0aW9uTmFtZTogc3RyaW5nO1xuICByZWFkb25seSBmdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBlbmRwb2ludE5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcmV2aXNpb25JZDogc3RyaW5nO1xuICByZWFkb25seSBkZXBsb3ltZW50OiBXZWJGdW5jdGlvbkRlcGxveW1lbnQ7XG4gIC8qKiBBUk5zIG9mIGFsYXJtcyB0aGUgZW5kcG9pbnQgY3JlYXRlZCAoYHJvbGxiYWNrT25gKSwgd2F0Y2hlZCB3aXRoIHRoZSBkZXBsb3ltZW50J3Mgb3duIGBhbGFybXNgLiAqL1xuICByZWFkb25seSBhbGFybUFybnM/OiBzdHJpbmdbXTtcbiAgLyoqIFRoZSBlbmRwb2ludCdzIG90aGVyIHNldHRpbmdzOiBhbnkgY2hhbmdlIG1ha2VzIHRoZSBzaGlmdCBydW4sIHNvIGl0IGNhbiByZS1jaGVjayB0aGUgdHJhZmZpYyBiZWZvcmUgQ2xvdWRGb3JtYXRpb24gd3JpdGVzIGl0LiAqL1xuICByZWFkb25seSBlbmRwb2ludENvbmZpZzogdW5rbm93bjtcbn1cblxuLyoqXG4gKiBNb3ZlcyBhbiBlbmRwb2ludCdzIHRyYWZmaWMgdG8gYHJldmlzaW9uSWRgIGluIHN0ZXBzIGJlZm9yZSBDbG91ZEZvcm1hdGlvbiB1cGRhdGVzIHRoZSBlbmRwb2ludCAod2hpY2ggbXVzdCBkZXBlbmQgb24gaXQpLlxuICovXG5leHBvcnQgY2xhc3MgVHJhZmZpY1NoaWZ0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHJlc291cmNlOiBDdXN0b21SZXNvdXJjZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVHJhZmZpY1NoaWZ0UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBEZXBsb3ltZW50UHJvdmlkZXIub2YodGhpcyk7XG4gICAgY29uc3QgZnVuY3Rpb25Bcm4gPSBzdGFjay5mb3JtYXRBcm4oe1xuICAgICAgc2VydmljZTogJ2xhbWJkYScsIHJlc291cmNlOiAnd2ViLWZ1bmN0aW9uJywgcmVzb3VyY2VOYW1lOiBwcm9wcy5mdW5jdGlvbk5hbWUsIGFybkZvcm1hdDogQXJuRm9ybWF0LlNMQVNIX1JFU09VUkNFX05BTUUsXG4gICAgfSk7XG4gICAgLy8gU3RhYmxlIGdyYW50IChzZWUgZ3JhbnRUb1Byb3ZpZGVyKTogZXZlcnkgZW5kcG9pbnQgYW5kIHJldmlzaW9uIG9mIHRoZSBmdW5jdGlvbi5cbiAgICBwcm92aWRlci5ncmFudCh7XG4gICAgICBhY3Rpb25zOiBbJ2xhbWJkYTpHZXRXZWJGdW5jdGlvbkVuZHBvaW50JywgJ2xhbWJkYTpVcGRhdGVXZWJGdW5jdGlvbkVuZHBvaW50J10sXG4gICAgICByZXNvdXJjZXM6IFtmdW5jdGlvbkFybiwgYCR7ZnVuY3Rpb25Bcm59L2VuZHBvaW50LypgLCBgJHtmdW5jdGlvbkFybn0vcmV2aXNpb24vKmBdLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZGVwbG95bWVudCA9IHByb3BzLmRlcGxveW1lbnQ7XG4gICAgY29uc3QgYWxhcm1Bcm5zID0gWy4uLmRlcGxveW1lbnQuX2FsYXJtcy5tYXAoKGEpID0+IGEuYWxhcm1Bcm4pLCAuLi4ocHJvcHMuYWxhcm1Bcm5zID8/IFtdKV07XG4gICAgY29uc3QgcHJvcGVydGllczogVHJhZmZpY1NoaWZ0UHJvcGVydGllcyA9IHtcbiAgICAgIEZ1bmN0aW9uQXJuOiBwcm9wcy5mdW5jdGlvbkFybixcbiAgICAgIEVuZHBvaW50TmFtZTogcHJvcHMuZW5kcG9pbnROYW1lLFxuICAgICAgUmV2aXNpb25JZDogcHJvcHMucmV2aXNpb25JZCxcbiAgICAgIFN0ZXBzOiBkZXBsb3ltZW50Ll9zdGVwcy5qb2luKCcsJyksXG4gICAgICBXYWl0U2Vjb25kczogU3RyaW5nKGRlcGxveW1lbnQuX3dhaXRTZWNvbmRzKSxcbiAgICAgIEFsYXJtQXJuczogYWxhcm1Bcm5zLmxlbmd0aCA+IDAgPyBhbGFybUFybnMgOiB1bmRlZmluZWQsXG4gICAgICBFbmRwb2ludENvbmZpZzogY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KHN0YWNrLnJlc29sdmUocHJvcHMuZW5kcG9pbnRDb25maWcpKSkuZGlnZXN0KCdoZXgnKS5zbGljZSgwLCAxNiksXG4gICAgfTtcbiAgICB0aGlzLnJlc291cmNlID0gbmV3IEN1c3RvbVJlc291cmNlKHRoaXMsICdSZXNvdXJjZScsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcmVzb3VyY2VUeXBlOiBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsXG4gICAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgICAgIC8vIENsb3VkRm9ybWF0aW9uJ3MgbWF4aW11bTsgdGhlIHByb3ZpZGVyIGZhaWxzIHRoZSBkZXBsb3ltZW50IGl0c2VsZiBhZnRlciA1NSBtaW51dGVzLlxuICAgICAgc2VydmljZVRpbWVvdXQ6IER1cmF0aW9uLmhvdXJzKDEpLFxuICAgIH0pO1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHJhZmZpYy1zaGlmdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9wcml2YXRlL3RyYWZmaWMtc2hpZnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQXlDO0FBQ3pDLGdEQUFrQztBQUNsQyw2Q0FBMEc7QUFDMUcseURBQTJDO0FBQzNDLCtEQUFpRDtBQUNqRCwyREFBNkM7QUFDN0MsaUVBQW1EO0FBQ25ELDJDQUF1QztBQUN2QywrQkFBb0U7QUFDcEUsMkRBQStGO0FBRy9GLDJJQUEySTtBQUMzSSxNQUFNLGFBQWEsR0FBRyxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMzQyxNQUFNLFdBQVcsR0FBRyw2QkFBNkIsQ0FBQztBQUVsRDs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBbUIsU0FBUSxzQkFBUztJQUNqQyxNQUFNLENBQUMsRUFBRSxDQUFDLEtBQWdCO1FBQy9CLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzlCLE9BQVEsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFvQyxJQUFJLElBQUksa0JBQWtCLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ2hJLENBQUM7SUFFZSxZQUFZLENBQVM7SUFDcEIsSUFBSSxDQUFXO0lBQ2YsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFFN0MsWUFBb0IsS0FBZ0IsRUFBRSxFQUFVO1FBQzlDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakIsTUFBTSxRQUFRLEdBQUcsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLEVBQUUsYUFBYSxFQUFFLDJCQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUNwSSxJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3hHLHdGQUF3RjtRQUN4RixJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsc0JBQXNCLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzFHLGtGQUFrRjtRQUNsRixJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxFQUFFLENBQUMsK0JBQStCLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDaEcsaUVBQWlFO1FBQ2pFLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RSxNQUFNLE9BQU8sR0FBRyxDQUFDLElBQVksRUFBRSxXQUFtQixFQUFFLFdBQW1CLEVBQUUsRUFBRSxDQUFDLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsSUFBSSxFQUFFO1lBQzFHLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVc7WUFDbkMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsTUFBTTtZQUN4QyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUseUJBQXlCLENBQUMsQ0FBQztZQUNsRyxPQUFPLEVBQUUsU0FBUyxXQUFXLEVBQUU7WUFDL0IsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1lBQ2Ysc0dBQXNHO1lBQ3RHLE9BQU8sRUFBRSxzQkFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7WUFDNUIsVUFBVSxFQUFFLEdBQUc7WUFDZixRQUFRO1lBQ1IsV0FBVztTQUNaLENBQUMsQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLElBQUksRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsVUFBVSxFQUFFO1lBQ2pELGNBQWMsRUFBRSxPQUFPLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSx1RUFBdUUsQ0FBQztZQUN0SCxpQkFBaUIsRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLFlBQVksRUFBRSw0RUFBNEUsQ0FBQztZQUNwSSxhQUFhLEVBQUUsc0JBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ25DLFlBQVksRUFBRSxhQUFhO1lBQzNCLFFBQVE7U0FDVCxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsWUFBWSxHQUFHLFFBQVEsQ0FBQyxZQUFZLENBQUM7UUFFMUMsSUFBQSw0QkFBc0IsRUFBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxDQUFDLFlBQTJCLEVBQy9GLGlKQUFpSixDQUFDLENBQUM7UUFDckosSUFBQSx5QkFBbUIsRUFBQyxRQUFRLEVBQUUsc0ZBQXNGLEVBQUU7WUFDcEgsa0NBQWtDLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBQztTQUM3RSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFNBQXFEO1FBQ2hFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDOUQsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7WUFBRSxPQUFPO1FBQ2xDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RCLElBQUksQ0FBQyxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDckUsQ0FBQztDQUNGO0FBZUQ7O0dBRUc7QUFDSCxNQUFhLFlBQWEsU0FBUSxzQkFBUztJQUN6QixRQUFRLENBQWlCO0lBRXpDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBd0I7UUFDaEUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqQixNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixNQUFNLFFBQVEsR0FBRyxrQkFBa0IsQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0MsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFNBQVMsQ0FBQztZQUNsQyxPQUFPLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLHVCQUFTLENBQUMsbUJBQW1CO1NBQ3hILENBQUMsQ0FBQztRQUNILG1GQUFtRjtRQUNuRixRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ2IsT0FBTyxFQUFFLENBQUMsK0JBQStCLEVBQUUsa0NBQWtDLENBQUM7WUFDOUUsU0FBUyxFQUFFLENBQUMsV0FBVyxFQUFFLEdBQUcsV0FBVyxhQUFhLEVBQUUsR0FBRyxXQUFXLGFBQWEsQ0FBQztTQUNuRixDQUFDLENBQUM7UUFFSCxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3BDLE1BQU0sU0FBUyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDN0YsTUFBTSxVQUFVLEdBQTJCO1lBQ3pDLFdBQVcsRUFBRSxLQUFLLENBQUMsV0FBVztZQUM5QixZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVk7WUFDaEMsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVO1lBQzVCLEtBQUssRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDbEMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQzVDLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTO1lBQ3ZELGNBQWMsRUFBRSxJQUFBLHdCQUFVLEVBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztTQUM1SCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLDRCQUFjLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRTtZQUNuRCxZQUFZLEVBQUUsUUFBUSxDQUFDLFlBQVk7WUFDbkMsWUFBWSxFQUFFLCtDQUEyQjtZQUN6QyxVQUFVLEVBQUUsRUFBRSxHQUFHLFVBQVUsRUFBRTtZQUM3Qix1RkFBdUY7WUFDdkYsY0FBYyxFQUFFLHNCQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUNsQyxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUFuQ0Qsb0NBbUNDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgY3JlYXRlSGFzaCB9IGZyb20gJ25vZGU6Y3J5cHRvJztcbmltcG9ydCAqIGFzIHBhdGggZnJvbSAnbm9kZTpwYXRoJztcbmltcG9ydCB7IEFybkZvcm1hdCwgdHlwZSBDZm5SZXNvdXJjZSwgQ3VzdG9tUmVzb3VyY2UsIER1cmF0aW9uLCBSZW1vdmFsUG9saWN5LCBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCAqIGFzIGxhbWJkYSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtbGFtYmRhJztcbmltcG9ydCAqIGFzIGxvZ3MgZnJvbSAnYXdzLWNkay1saWIvYXdzLWxvZ3MnO1xuaW1wb3J0ICogYXMgY3IgZnJvbSAnYXdzLWNkay1saWIvY3VzdG9tLXJlc291cmNlcyc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFja25vd2xlZGdlSWFtRmluZGluZ3MsIGFja25vd2xlZGdlTmFnVW5kZXIgfSBmcm9tICcuL25hZyc7XG5pbXBvcnQgeyBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsIHR5cGUgVHJhZmZpY1NoaWZ0UHJvcGVydGllcyB9IGZyb20gJy4vcHJvdmlkZXItcHJvdG9jb2wnO1xuaW1wb3J0IHR5cGUgeyBXZWJGdW5jdGlvbkRlcGxveW1lbnQgfSBmcm9tICcuLi93ZWItZnVuY3Rpb24tZGVwbG95bWVudCc7XG5cbi8qKiBUaGUgUHJvdmlkZXIgZnJhbWV3b3JrIGdpdmVzIHVwIGFmdGVyIHRoaXMgbG9uZyBhbmQgZmFpbHMgdGhlIGRlcGxveW1lbnQgKHdpdGggYSBtZXNzYWdlKSwgYmVmb3JlIENsb3VkRm9ybWF0aW9uJ3Mgb3duIDEtaG91ciBsaW1pdC4gKi9cbmNvbnN0IFRPVEFMX1RJTUVPVVQgPSBEdXJhdGlvbi5taW51dGVzKDU1KTtcbmNvbnN0IFBST1ZJREVSX0lEID0gJ0xhbWJkYVdlYkRlcGxveW1lbnRQcm92aWRlcic7XG5cbi8qKlxuICogVGhlIHN0YWNrJ3MgZGVwbG95bWVudCBwcm92aWRlcjogYSBDREsgUHJvdmlkZXIgZnJhbWV3b3JrIChhIFN0ZXAgRnVuY3Rpb25zIHdhaXRlcikgYXJvdW5kIGBvbkV2ZW50YCBhbmQgYGlzQ29tcGxldGVgXG4gKiBmcm9tIGBoYW5kbGVycy93ZWItZnVuY3Rpb24tZGVwbG95bWVudGAsIGJlY2F1c2UgYSBjYW5hcnkgb3IgbGluZWFyIGRlcGxveW1lbnQgY2FuIHJ1biBmb3IgdXAgdG8gYW4gaG91ci5cbiAqIE9uZSBwZXIgc3RhY2ssIHNoYXJlZCBieSBldmVyeSBlbmRwb2ludCB0aGF0IGRlcGxveXMgaW4gc3RlcHMuXG4gKi9cbmNsYXNzIERlcGxveW1lbnRQcm92aWRlciBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHB1YmxpYyBzdGF0aWMgb2Yoc2NvcGU6IENvbnN0cnVjdCk6IERlcGxveW1lbnRQcm92aWRlciB7XG4gICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZihzY29wZSk7XG4gICAgcmV0dXJuIChzdGFjay5ub2RlLnRyeUZpbmRDaGlsZChQUk9WSURFUl9JRCkgYXMgRGVwbG95bWVudFByb3ZpZGVyIHwgdW5kZWZpbmVkKSA/PyBuZXcgRGVwbG95bWVudFByb3ZpZGVyKHN0YWNrLCBQUk9WSURFUl9JRCk7XG4gIH1cblxuICBwdWJsaWMgcmVhZG9ubHkgc2VydmljZVRva2VuOiBzdHJpbmc7XG4gIHByaXZhdGUgcmVhZG9ubHkgcm9sZTogaWFtLlJvbGU7XG4gIHByaXZhdGUgcmVhZG9ubHkgZ3JhbnRlZCA9IG5ldyBTZXQ8c3RyaW5nPigpO1xuXG4gIHByaXZhdGUgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgY29uc3QgbG9nR3JvdXAgPSBuZXcgbG9ncy5Mb2dHcm91cCh0aGlzLCAnTG9ncycsIHsgcmV0ZW50aW9uOiBsb2dzLlJldGVudGlvbkRheXMuT05FX01PTlRILCByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LkRFU1RST1kgfSk7XG4gICAgdGhpcy5yb2xlID0gbmV3IGlhbS5Sb2xlKHRoaXMsICdSb2xlJywgeyBhc3N1bWVkQnk6IG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbGFtYmRhLmFtYXpvbmF3cy5jb20nKSB9KTtcbiAgICAvLyBJdHMgb3duIGxvZyBncm91cCBvbmx5IChub3QgQVdTTGFtYmRhQmFzaWNFeGVjdXRpb25Sb2xlLCB3aGljaCBjYW4gY3JlYXRlIGFueSBncm91cCkuXG4gICAgdGhpcy5ncmFudCh7IGFjdGlvbnM6IFsnbG9nczpDcmVhdGVMb2dTdHJlYW0nLCAnbG9nczpQdXRMb2dFdmVudHMnXSwgcmVzb3VyY2VzOiBbbG9nR3JvdXAubG9nR3JvdXBBcm5dIH0pO1xuICAgIC8vIFJvbGxiYWNrIGRldGVjdGlvbjogaXMgdGhlIHN0YWNrIHJvbGxpbmcgYmFjaz8gKHRoZSBwcm92aWRlcidzIG93biBzdGFjayBvbmx5KS5cbiAgICB0aGlzLmdyYW50KHsgYWN0aW9uczogWydjbG91ZGZvcm1hdGlvbjpEZXNjcmliZVN0YWNrcyddLCByZXNvdXJjZXM6IFtTdGFjay5vZih0aGlzKS5zdGFja0lkXSB9KTtcbiAgICAvLyBDb21wb3NpdGUgYWxhcm1zIGFyZSBvbmx5IHJldHVybmVkIHdpdGggRGVzY3JpYmVBbGFybXMgb24gJyonLlxuICAgIHRoaXMuZ3JhbnQoeyBhY3Rpb25zOiBbJ2Nsb3Vkd2F0Y2g6RGVzY3JpYmVBbGFybXMnXSwgcmVzb3VyY2VzOiBbJyonXSB9KTtcbiAgICBjb25zdCBoYW5kbGVyID0gKG5hbWU6IHN0cmluZywgaGFuZGxlck5hbWU6IHN0cmluZywgZGVzY3JpcHRpb246IHN0cmluZykgPT4gbmV3IGxhbWJkYS5GdW5jdGlvbih0aGlzLCBuYW1lLCB7XG4gICAgICBydW50aW1lOiBsYW1iZGEuUnVudGltZS5OT0RFSlNfMjRfWCxcbiAgICAgIGFyY2hpdGVjdHVyZTogbGFtYmRhLkFyY2hpdGVjdHVyZS5BUk1fNjQsXG4gICAgICBjb2RlOiBsYW1iZGEuQ29kZS5mcm9tQXNzZXQocGF0aC5qb2luKF9fZGlybmFtZSwgJy4uJywgJy4uJywgJ2Fzc2V0cycsICd3ZWItZnVuY3Rpb24tZGVwbG95bWVudCcpKSxcbiAgICAgIGhhbmRsZXI6IGBpbmRleC4ke2hhbmRsZXJOYW1lfWAsXG4gICAgICByb2xlOiB0aGlzLnJvbGUsXG4gICAgICAvLyBpc0NvbXBsZXRlIHdhaXRzIHVwIHRvIDUgbWludXRlcyBmb3IgYSByZXN0b3JlIHRvIHJlYWNoIGV2ZXJ5IHJlZ2lvbiBiZWZvcmUgZmFpbGluZyB0aGUgZGVwbG95bWVudC5cbiAgICAgIHRpbWVvdXQ6IER1cmF0aW9uLm1pbnV0ZXMoNyksXG4gICAgICBtZW1vcnlTaXplOiAyNTYsXG4gICAgICBsb2dHcm91cCxcbiAgICAgIGRlc2NyaXB0aW9uLFxuICAgIH0pO1xuICAgIGNvbnN0IHByb3ZpZGVyID0gbmV3IGNyLlByb3ZpZGVyKHRoaXMsICdQcm92aWRlcicsIHtcbiAgICAgIG9uRXZlbnRIYW5kbGVyOiBoYW5kbGVyKCdPbkV2ZW50JywgJ29uRXZlbnQnLCAnU3RhcnRzIGNhbmFyeSBhbmQgbGluZWFyIGRlcGxveW1lbnRzIG9mIExhbWJkYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnRzJyksXG4gICAgICBpc0NvbXBsZXRlSGFuZGxlcjogaGFuZGxlcignSXNDb21wbGV0ZScsICdpc0NvbXBsZXRlJywgJ01vdmVzIExhbWJkYSBXZWIgRnVuY3Rpb24gZW5kcG9pbnQgdHJhZmZpYyBzdGVwIGJ5IHN0ZXAgYW5kIHdhdGNoZXMgYWxhcm1zJyksXG4gICAgICBxdWVyeUludGVydmFsOiBEdXJhdGlvbi5zZWNvbmRzKDE1KSxcbiAgICAgIHRvdGFsVGltZW91dDogVE9UQUxfVElNRU9VVCxcbiAgICAgIGxvZ0dyb3VwLFxuICAgIH0pO1xuICAgIHRoaXMuc2VydmljZVRva2VuID0gcHJvdmlkZXIuc2VydmljZVRva2VuO1xuXG4gICAgYWNrbm93bGVkZ2VJYW1GaW5kaW5ncyh0aGlzLnJvbGUubm9kZS5maW5kQ2hpbGQoJ0RlZmF1bHRQb2xpY3knKS5ub2RlLmRlZmF1bHRDaGlsZCBhcyBDZm5SZXNvdXJjZSxcbiAgICAgICdUaGUgZGVwbG95bWVudCBoYW5kbGVyc1xcJyBvd24gbG9nIGdyb3VwLCBEZXNjcmliZUFsYXJtcyAoY29tcG9zaXRlIGFsYXJtcyBuZWVkICopLCBhbmQgdGhlIHJldmlzaW9ucyBhbmQgZW5kcG9pbnRzIG9mIHRoZSBmdW5jdGlvbnMgdGhleSBkZXBsb3knKTtcbiAgICBhY2tub3dsZWRnZU5hZ1VuZGVyKHByb3ZpZGVyLCAnVGhlIENESyBjdXN0b20gcmVzb3VyY2UgUHJvdmlkZXIgZnJhbWV3b3JrXFwncyBvd24gZnVuY3Rpb25zIGFuZCB3YWl0ZXIgc3RhdGUgbWFjaGluZScsIHtcbiAgICAgICdBV1M6OlN0ZXBGdW5jdGlvbnM6OlN0YXRlTWFjaGluZSc6IFsnQXdzU29sdXRpb25zLVNGMScsICdBd3NTb2x1dGlvbnMtU0YyJ10sXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogQWRkcyBhIHN0YXRlbWVudCB0byB0aGUgaGFuZGxlcnMnIHJvbGUsIG9uY2UuIExpa2UgdGhlIHNoYXJlZCBwcm92aWRlcidzIGdyYW50cywgdGhleSBtdXN0IGJlIHN0YWJsZSBhY3Jvc3NcbiAgICogdXBkYXRlcyAocHJlZml4ZXMsIG5vdCBuYW1lcyB0aGF0IGNoYW5nZSkgYW5kIG5ldmVyIHJlZmVyZW5jZSBhdHRyaWJ1dGVzIG9mIHJlc291cmNlcyB0aGF0IHVzZSB0aGUgcHJvdmlkZXIuXG4gICAqL1xuICBwdWJsaWMgZ3JhbnQoc3RhdGVtZW50OiB7IGFjdGlvbnM6IHN0cmluZ1tdOyByZXNvdXJjZXM6IHN0cmluZ1tdIH0pOiB2b2lkIHtcbiAgICBjb25zdCBrZXkgPSBKU09OLnN0cmluZ2lmeShTdGFjay5vZih0aGlzKS5yZXNvbHZlKHN0YXRlbWVudCkpO1xuICAgIGlmICh0aGlzLmdyYW50ZWQuaGFzKGtleSkpIHJldHVybjtcbiAgICB0aGlzLmdyYW50ZWQuYWRkKGtleSk7XG4gICAgdGhpcy5yb2xlLmFkZFRvUHJpbmNpcGFsUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHN0YXRlbWVudCkpO1xuICB9XG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgVHJhZmZpY1NoaWZ0UHJvcHMge1xuICAvKiogTGl0ZXJhbCBmdW5jdGlvbiBuYW1lLCBmb3Igc3RhYmxlIElBTSBncmFudHMuICovXG4gIHJlYWRvbmx5IGZ1bmN0aW9uTmFtZTogc3RyaW5nO1xuICByZWFkb25seSBmdW5jdGlvbkFybjogc3RyaW5nO1xuICByZWFkb25seSBlbmRwb2ludE5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgcmV2aXNpb25JZDogc3RyaW5nO1xuICByZWFkb25seSBkZXBsb3ltZW50OiBXZWJGdW5jdGlvbkRlcGxveW1lbnQ7XG4gIC8qKiBBUk5zIG9mIGFsYXJtcyB0aGUgZW5kcG9pbnQgY3JlYXRlZCAoYHJvbGxiYWNrT25gKSwgd2F0Y2hlZCB3aXRoIHRoZSBkZXBsb3ltZW50J3Mgb3duIGBhbGFybXNgLiAqL1xuICByZWFkb25seSBhbGFybUFybnM/OiBzdHJpbmdbXTtcbiAgLyoqIFRoZSBlbmRwb2ludCdzIG90aGVyIHNldHRpbmdzOiBhbnkgY2hhbmdlIG1ha2VzIHRoZSBzaGlmdCBydW4sIHNvIGl0IGNhbiByZS1jaGVjayB0aGUgdHJhZmZpYyBiZWZvcmUgQ2xvdWRGb3JtYXRpb24gd3JpdGVzIGl0LiAqL1xuICByZWFkb25seSBlbmRwb2ludENvbmZpZzogdW5rbm93bjtcbn1cblxuLyoqXG4gKiBNb3ZlcyBhbiBlbmRwb2ludCdzIHRyYWZmaWMgdG8gYHJldmlzaW9uSWRgIGluIHN0ZXBzIGJlZm9yZSBDbG91ZEZvcm1hdGlvbiB1cGRhdGVzIHRoZSBlbmRwb2ludCAod2hpY2ggbXVzdCBkZXBlbmQgb24gaXQpLlxuICovXG5leHBvcnQgY2xhc3MgVHJhZmZpY1NoaWZ0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IHJlc291cmNlOiBDdXN0b21SZXNvdXJjZTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVHJhZmZpY1NoaWZ0UHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcHJvdmlkZXIgPSBEZXBsb3ltZW50UHJvdmlkZXIub2YodGhpcyk7XG4gICAgY29uc3QgZnVuY3Rpb25Bcm4gPSBzdGFjay5mb3JtYXRBcm4oe1xuICAgICAgc2VydmljZTogJ2xhbWJkYScsIHJlc291cmNlOiAnd2ViLWZ1bmN0aW9uJywgcmVzb3VyY2VOYW1lOiBwcm9wcy5mdW5jdGlvbk5hbWUsIGFybkZvcm1hdDogQXJuRm9ybWF0LlNMQVNIX1JFU09VUkNFX05BTUUsXG4gICAgfSk7XG4gICAgLy8gU3RhYmxlIGdyYW50IChzZWUgZ3JhbnRUb1Byb3ZpZGVyKTogZXZlcnkgZW5kcG9pbnQgYW5kIHJldmlzaW9uIG9mIHRoZSBmdW5jdGlvbi5cbiAgICBwcm92aWRlci5ncmFudCh7XG4gICAgICBhY3Rpb25zOiBbJ2xhbWJkYTpHZXRXZWJGdW5jdGlvbkVuZHBvaW50JywgJ2xhbWJkYTpVcGRhdGVXZWJGdW5jdGlvbkVuZHBvaW50J10sXG4gICAgICByZXNvdXJjZXM6IFtmdW5jdGlvbkFybiwgYCR7ZnVuY3Rpb25Bcm59L2VuZHBvaW50LypgLCBgJHtmdW5jdGlvbkFybn0vcmV2aXNpb24vKmBdLFxuICAgIH0pO1xuXG4gICAgY29uc3QgZGVwbG95bWVudCA9IHByb3BzLmRlcGxveW1lbnQ7XG4gICAgY29uc3QgYWxhcm1Bcm5zID0gWy4uLmRlcGxveW1lbnQuX2FsYXJtcy5tYXAoKGEpID0+IGEuYWxhcm1Bcm4pLCAuLi4ocHJvcHMuYWxhcm1Bcm5zID8/IFtdKV07XG4gICAgY29uc3QgcHJvcGVydGllczogVHJhZmZpY1NoaWZ0UHJvcGVydGllcyA9IHtcbiAgICAgIEZ1bmN0aW9uQXJuOiBwcm9wcy5mdW5jdGlvbkFybixcbiAgICAgIEVuZHBvaW50TmFtZTogcHJvcHMuZW5kcG9pbnROYW1lLFxuICAgICAgUmV2aXNpb25JZDogcHJvcHMucmV2aXNpb25JZCxcbiAgICAgIFN0ZXBzOiBkZXBsb3ltZW50Ll9zdGVwcy5qb2luKCcsJyksXG4gICAgICBXYWl0U2Vjb25kczogU3RyaW5nKGRlcGxveW1lbnQuX3dhaXRTZWNvbmRzKSxcbiAgICAgIEFsYXJtQXJuczogYWxhcm1Bcm5zLmxlbmd0aCA+IDAgPyBhbGFybUFybnMgOiB1bmRlZmluZWQsXG4gICAgICBFbmRwb2ludENvbmZpZzogY3JlYXRlSGFzaCgnc2hhMjU2JykudXBkYXRlKEpTT04uc3RyaW5naWZ5KHN0YWNrLnJlc29sdmUocHJvcHMuZW5kcG9pbnRDb25maWcpKSkuZGlnZXN0KCdoZXgnKS5zbGljZSgwLCAxNiksXG4gICAgfTtcbiAgICB0aGlzLnJlc291cmNlID0gbmV3IEN1c3RvbVJlc291cmNlKHRoaXMsICdSZXNvdXJjZScsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcmVzb3VyY2VUeXBlOiBUUkFGRklDX1NISUZUX1JFU09VUkNFX1RZUEUsXG4gICAgICBwcm9wZXJ0aWVzOiB7IC4uLnByb3BlcnRpZXMgfSxcbiAgICAgIC8vIENsb3VkRm9ybWF0aW9uJ3MgbWF4aW11bTsgdGhlIHByb3ZpZGVyIGZhaWxzIHRoZSBkZXBsb3ltZW50IGl0c2VsZiBhZnRlciA1NSBtaW51dGVzLlxuICAgICAgc2VydmljZVRpbWVvdXQ6IER1cmF0aW9uLmhvdXJzKDEpLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/web-function-deployment.js

@@ -11,7 +11,7 @@ const MAX_STEPS = 20;
  * How an endpoint moves its traffic to a new revision.
  */
 class WebFunctionDeployment {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.8" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.9" };
     /**
      * All traffic moves to the new revision at once, as soon as it's ready (the default).
      */

package/lib/web-function-endpoint.js

@@ -53,7 +53,7 @@ const web_function_grants_1 = require("./web-function-grants");
  * Endpoints are created only through `WebFunction`, which owns their log groups in every region, so the constructor is private.
  */
 class WebFunctionEndpoint extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.8" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.9" };
     /**
      * Creates an endpoint of a Web Function. Used by `WebFunction`.
      *

package/lib/web-function-grants.js

@@ -42,7 +42,7 @@ const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 class WebFunctionGrants {
     endpointArns;
     webFunction;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants", version: "0.1.8" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants", version: "0.1.9" };
     /**
      * @internal
      */

package/lib/web-function-origin.js

@@ -54,7 +54,7 @@ const OPT_IN_REGIONS = [
  * and only your distribution may call the endpoint. `new WebFunctionOrigin(endpoint)` is for a public (`NONE`) endpoint.
  */
 class WebFunctionOrigin extends cloudfront.OriginBase {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin", version: "0.1.8" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin", version: "0.1.9" };
     /**
      * An origin for an `AWS_IAM` endpoint, with origin access control: CloudFront signs every request to the endpoint
      * (`always-amz-auth`, which keeps the viewer's `Authorization` header for your application), and the function's

package/lib/web-function-revision.js

@@ -11,7 +11,7 @@ const constructs_1 = require("constructs");
  * only revisions within `revisionRetention`, or that an endpoint routes to, are kept.
  */
 class WebFunctionRevision extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.8" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.9" };
     /**
      * References an existing revision of `webFunction`, e.g. to pin an endpoint to it or split traffic with it.
      */

package/lib/web-function.d.ts

@@ -364,6 +364,12 @@ export declare class WebFunction extends WebFunctionBase implements iam.IGrantab
      */
     addPermission(id: string, permission: WebFunctionPermission): void;
     private createEndpoint;
+    /**
+     * The default execution role: write to the function's own log groups only (the home region's and every region's
+     * `.local` copy), the minimum AWS documents for Web Functions. Not `AWSLambdaBasicExecutionRole`, whose
+     * `logs:CreateLogGroup` on `*` lets environments still shutting down re-create a deleted or renamed group.
+     */
+    private createRole;
     private createLogGroups;
     private logGroupIn;
 }