@aws-cdk/aws-bedrock-agentcore-alpha 2.250.0-alpha.0 → 2.252.0-alpha.0

package/lib/policy/policy-engine-base.js

@@ -0,0 +1,193 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyEngineBase = void 0;
+const jsiiDeprecationWarnings = require("../../.warnings.jsii.js");
+const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const iam = require("aws-cdk-lib/aws-iam");
+// Internal imports
+const perms_1 = require("./perms");
+/******************************************************************************
+ *                        ABSTRACT BASE CLASS
+ *****************************************************************************/
+/**
+ * Abstract base class for a PolicyEngine.
+ * Contains methods and attributes valid for PolicyEngines either created with CDK or imported.
+ */
+class PolicyEngineBase extends aws_cdk_lib_1.Resource {
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.PolicyEngineBase", version: "2.252.0-alpha.0" };
+    /**
+     * A reference to this PolicyEngine resource.
+     */
+    get policyEngineRef() {
+        return {
+            policyEngineArn: this.policyEngineArn,
+        };
+    }
+    constructor(scope, id, props = {}) {
+        super(scope, id, props);
+    }
+    /**
+     * Grants IAM actions to the IAM Principal
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant permissions to
+     * @param actions - The actions to grant
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grant(grantee, ...actions) {
+        return iam.Grant.addToPrincipal({
+            grantee,
+            actions,
+            resourceArns: [this.policyEngineArn],
+        });
+    }
+    /**
+     * Grants read permissions on the PolicyEngine (data plane).
+     *
+     * This grants runtime read access to policy engine configuration. Use this for
+     * monitoring, observability, or read-only administrative roles that need to inspect
+     * policy engine settings at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant read permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantRead(grantee) {
+        return this.grant(grantee, ...perms_1.POLICY_ENGINE_READ_PERMS);
+    }
+    /**
+     * Grants permissions to evaluate policies at runtime (data plane operations).
+     *
+     * This is the primary permission needed by Gateway execution roles to evaluate
+     * authorization decisions during agent requests. Grant this to roles that need
+     * to call AuthorizeAction or PartiallyAuthorizeActions at runtime.
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal to grant evaluation permissions to
+     * @returns An IAM Grant object representing the granted permissions
+     */
+    grantEvaluate(grantee) {
+        return this.grant(grantee, ...perms_1.POLICY_ENGINE_EVALUATE_PERMS);
+    }
+    /**
+     * Grants the full set of permissions required for a gateway execution role to use
+     * this policy engine, correctly scoped to both the policy engine and gateway ARNs.
+     *
+     * Per the AWS docs:
+     * - `GetPolicyEngine` → policy engine ARN only
+     * - `AuthorizeAction` + `PartiallyAuthorizeActions` → policy engine ARN **and** gateway ARN
+     *
+     * [disable-awslint:no-grants]
+     *
+     * @param grantee - The IAM principal (gateway execution role) to grant permissions to
+     * @param gateway - The gateway that will use this policy engine [disable-awslint:prefer-ref-interface]
+     * @returns A combined IAM Grant representing all granted permissions
+     */
+    grantEvaluateForGateway(grantee, gateway) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_IGateway(gateway);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.grantEvaluateForGateway);
+            }
+            throw error;
+        }
+        const getPolicyEngineGrant = this.grant(grantee, 'bedrock-agentcore:GetPolicyEngine');
+        // using  gateway.name here to avoid a circular dependency between PolicyEngine and Gateway that
+        // arises if we try to reference gateway.gatewayArn.
+        // Additionally, BedrockAgentCore appends a random suffix to gateway names at creation time, so the exact ARN
+        // is unknowable at synthesis. Using `${gateway.name}-*` allows us to correctly match the actual ARN at runtime.
+        const gatewayResourceName = aws_cdk_lib_1.Token.isUnresolved(gateway.name) ? '*' : `${gateway.name}-*`;
+        const gatewayArn = aws_cdk_lib_1.Stack.of(this).formatArn({
+            service: 'bedrock-agentcore',
+            resource: 'gateway',
+            resourceName: gatewayResourceName,
+        });
+        const authorizationGrant = iam.Grant.addToPrincipal({
+            grantee,
+            actions: [
+                'bedrock-agentcore:AuthorizeAction',
+                'bedrock-agentcore:PartiallyAuthorizeActions',
+            ],
+            resourceArns: [this.policyEngineArn, gatewayArn],
+        });
+        return getPolicyEngineGrant.combine(authorizationGrant);
+    }
+    /**
+     * Return the given named metric for this policy engine.
+     *
+     * By default, the metric will be calculated as a sum over a period of 5 minutes.
+     * You can customize this by using the `statistic` and `period` properties.
+     *
+     * @param metricName The name of the metric
+     * @param dimensions Additional dimensions for the metric
+     * @param props Optional metric configuration
+     */
+    metric(metricName, dimensions, props) {
+        const metricProps = {
+            namespace: 'AWS/Bedrock-AgentCore',
+            metricName,
+            dimensionsMap: { ...dimensions, Resource: this.policyEngineArn },
+            ...props,
+        };
+        return this.configureMetric(metricProps);
+    }
+    /**
+     * Return a metric containing the total number of authorizations for this policy engine.
+     *
+     * This metric tracks all authorization requests processed by the policy engine.
+     *
+     * @param props Optional metric configuration
+     */
+    metricAuthorizations(props) {
+        return this.metric('Authorizations', {}, { statistic: aws_cloudwatch_1.Stats.SUM, ...props });
+    }
+    /**
+     * Return a metric measuring the authorization latency for this policy engine.
+     *
+     * This metric represents the time taken to evaluate authorization policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricAuthorizationLatency(props) {
+        return this.metric('AuthorizationLatency', {}, { statistic: aws_cloudwatch_1.Stats.AVERAGE, ...props });
+    }
+    /**
+     * Return a metric containing the number of denied authorization requests for this policy engine.
+     *
+     * This metric tracks authorization requests that were explicitly denied by policies.
+     *
+     * @param props Optional metric configuration
+     */
+    metricDeniedRequests(props) {
+        return this.metric('DeniedRequests', {}, { statistic: aws_cloudwatch_1.Stats.SUM, ...props });
+    }
+    /**
+     * Return a metric containing the number of errors during authorization for this policy engine.
+     *
+     * This metric tracks errors encountered during policy evaluation.
+     *
+     * @param props Optional metric configuration
+     */
+    metricErrors(props) {
+        return this.metric('Errors', {}, { statistic: aws_cloudwatch_1.Stats.SUM, ...props });
+    }
+    /**
+     * Internal method to create a metric.
+     */
+    configureMetric(props) {
+        return new aws_cloudwatch_1.Metric({
+            ...props,
+            region: props?.region ?? this.stack.region,
+            account: props?.account ?? this.stack.account,
+        });
+    }
+}
+exports.PolicyEngineBase = PolicyEngineBase;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9saWN5LWVuZ2luZS1iYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsicG9saWN5LWVuZ2luZS1iYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBY0EsNkNBQXFEO0FBR3JELCtEQUEyRDtBQUMzRCwyQ0FBMkM7QUFHM0MsbUJBQW1CO0FBQ25CLG1DQUFpRjtBQXlJakY7OytFQUUrRTtBQUUvRTs7O0dBR0c7QUFDSCxNQUFzQixnQkFBaUIsU0FBUSxzQkFBUTs7SUFZckQ7O09BRUc7SUFDSCxJQUFXLGVBQWU7UUFDeEIsT0FBTztZQUNMLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZTtTQUN0QyxDQUFDO0tBQ0g7SUFFRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLFFBQXVCLEVBQUU7UUFDakUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7S0FDekI7SUFFRDs7Ozs7Ozs7T0FRRztJQUNJLEtBQUssQ0FBQyxPQUF1QixFQUFFLEdBQUcsT0FBaUI7UUFDeEQsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQztZQUM5QixPQUFPO1lBQ1AsT0FBTztZQUNQLFlBQVksRUFBRSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7U0FDckMsQ0FBQyxDQUFDO0tBQ0o7SUFFRDs7Ozs7Ozs7Ozs7T0FXRztJQUNJLFNBQVMsQ0FBQyxPQUF1QjtRQUN0QyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsZ0NBQXdCLENBQUMsQ0FBQztLQUN6RDtJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0ksYUFBYSxDQUFDLE9BQXVCO1FBQzFDLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsR0FBRyxvQ0FBNEIsQ0FBQyxDQUFDO0tBQzdEO0lBRUQ7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNJLHVCQUF1QixDQUFDLE9BQXVCLEVBQUUsT0FBaUI7Ozs7Ozs7Ozs7UUFDdkUsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxtQ0FBbUMsQ0FBQyxDQUFDO1FBRXRGLGdHQUFnRztRQUNoRyxvREFBb0Q7UUFDcEQsNkdBQTZHO1FBQzdHLGdIQUFnSDtRQUNoSCxNQUFNLG1CQUFtQixHQUFHLG1CQUFLLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sQ0FBQyxJQUFJLElBQUksQ0FBQztRQUN6RixNQUFNLFVBQVUsR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUM7WUFDMUMsT0FBTyxFQUFFLG1CQUFtQjtZQUM1QixRQUFRLEVBQUUsU0FBUztZQUNuQixZQUFZLEVBQUUsbUJBQW1CO1NBQ2xDLENBQUMsQ0FBQztRQUVILE1BQU0sa0JBQWtCLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUM7WUFDbEQsT0FBTztZQUNQLE9BQU8sRUFBRTtnQkFDUCxtQ0FBbUM7Z0JBQ25DLDZDQUE2QzthQUM5QztZQUNELFlBQVksRUFBRSxDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDO1NBQ2pELENBQUMsQ0FBQztRQUVILE9BQU8sb0JBQW9CLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBQUM7S0FDekQ7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSSxNQUFNLENBQUMsVUFBa0IsRUFBRSxVQUF5QixFQUFFLEtBQXFCO1FBQ2hGLE1BQU0sV0FBVyxHQUFnQjtZQUMvQixTQUFTLEVBQUUsdUJBQXVCO1lBQ2xDLFVBQVU7WUFDVixhQUFhLEVBQUUsRUFBRSxHQUFHLFVBQVUsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRTtZQUNoRSxHQUFHLEtBQUs7U0FDVCxDQUFDO1FBQ0YsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0tBQzFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksb0JBQW9CLENBQUMsS0FBcUI7UUFDL0MsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGdCQUFnQixFQUFFLEVBQUUsRUFBRSxFQUFFLFNBQVMsRUFBRSxzQkFBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLEtBQUssRUFBRSxDQUFDLENBQUM7S0FDOUU7SUFFRDs7Ozs7O09BTUc7SUFDSSwwQkFBMEIsQ0FBQyxLQUFxQjtRQUNyRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLHNCQUFLLENBQUMsT0FBTyxFQUFFLEdBQUcsS0FBSyxFQUFFLENBQUMsQ0FBQztLQUN4RjtJQUVEOzs7Ozs7T0FNRztJQUNJLG9CQUFvQixDQUFDLEtBQXFCO1FBQy9DLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLEVBQUUsc0JBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRyxLQUFLLEVBQUUsQ0FBQyxDQUFDO0tBQzlFO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksWUFBWSxDQUFDLEtBQXFCO1FBQ3ZDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLHNCQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsS0FBSyxFQUFFLENBQUMsQ0FBQztLQUN0RTtJQUVEOztPQUVHO0lBQ0ssZUFBZSxDQUFDLEtBQWtCO1FBQ3hDLE9BQU8sSUFBSSx1QkFBTSxDQUFDO1lBQ2hCLEdBQUcsS0FBSztZQUNSLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTTtZQUMxQyxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU87U0FDOUMsQ0FBQyxDQUFDO0tBQ0o7O0FBM0xILDRDQTRMQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogIENvcHlyaWdodCBBbWF6b24uY29tLCBJbmMuIG9yIGl0cyBhZmZpbGlhdGVzLiBBbGwgUmlnaHRzIFJlc2VydmVkLlxuICpcbiAqICBMaWNlbnNlZCB1bmRlciB0aGUgQXBhY2hlIExpY2Vuc2UsIFZlcnNpb24gMi4wICh0aGUgXCJMaWNlbnNlXCIpLiBZb3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlXG4gKiAgd2l0aCB0aGUgTGljZW5zZS4gQSBjb3B5IG9mIHRoZSBMaWNlbnNlIGlzIGxvY2F0ZWQgYXRcbiAqXG4gKiAgICAgIGh0dHA6Ly93d3cuYXBhY2hlLm9yZy9saWNlbnNlcy9MSUNFTlNFLTIuMFxuICpcbiAqICBvciBpbiB0aGUgJ2xpY2Vuc2UnIGZpbGUgYWNjb21wYW55aW5nIHRoaXMgZmlsZS4gVGhpcyBmaWxlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICdBUyBJUycgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFU1xuICogIE9SIENPTkRJVElPTlMgT0YgQU5ZIEtJTkQsIGV4cHJlc3Mgb3IgaW1wbGllZC4gU2VlIHRoZSBMaWNlbnNlIGZvciB0aGUgc3BlY2lmaWMgbGFuZ3VhZ2UgZ292ZXJuaW5nIHBlcm1pc3Npb25zXG4gKiAgYW5kIGxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLlxuICovXG5cbmltcG9ydCB0eXBlIHsgSVJlc291cmNlLCBSZXNvdXJjZVByb3BzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHsgUmVzb3VyY2UsIFN0YWNrLCBUb2tlbiB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB0eXBlIHsgSVBvbGljeUVuZ2luZVJlZiwgUG9saWN5RW5naW5lUmVmZXJlbmNlIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWJlZHJvY2thZ2VudGNvcmUnO1xuaW1wb3J0IHR5cGUgeyBEaW1lbnNpb25zTWFwLCBNZXRyaWNPcHRpb25zLCBNZXRyaWNQcm9wcyB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1jbG91ZHdhdGNoJztcbmltcG9ydCB7IE1ldHJpYywgU3RhdHMgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtY2xvdWR3YXRjaCc7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSAqIGFzIGttcyBmcm9tICdhd3MtY2RrLWxpYi9hd3Mta21zJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG4vLyBJbnRlcm5hbCBpbXBvcnRzXG5pbXBvcnQgeyBQT0xJQ1lfRU5HSU5FX0VWQUxVQVRFX1BFUk1TLCBQT0xJQ1lfRU5HSU5FX1JFQURfUEVSTVMgfSBmcm9tICcuL3Blcm1zJztcbmltcG9ydCB0eXBlIHsgSUdhdGV3YXkgfSBmcm9tICcuLi9nYXRld2F5L2dhdGV3YXktYmFzZSc7XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBJbnRlcmZhY2VcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cblxuLyoqXG4gKiBDb250YWlucyBhbGwgcHJvcGVydGllcyBhbmQgbWV0aG9kcyBmb3IgYm90aCBjcmVhdGVkIGFuZCBpbXBvcnRlZCBwb2xpY3kgZW5naW5lcy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBJUG9saWN5RW5naW5lIGV4dGVuZHMgSVJlc291cmNlLCBJUG9saWN5RW5naW5lUmVmLCBpYW0uSUdyYW50YWJsZSB7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBwb2xpY3kgZW5naW5lIHJlc291cmNlXG4gICAqIEBhdHRyaWJ1dGVcbiAgICovXG4gIHJlYWRvbmx5IHBvbGljeUVuZ2luZUFybjogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgSUQgb2YgdGhlIHBvbGljeSBlbmdpbmVcbiAgICogQGF0dHJpYnV0ZVxuICAgKi9cbiAgcmVhZG9ubHkgcG9saWN5RW5naW5lSWQ6IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIG5hbWUgb2YgdGhlIHBvbGljeSBlbmdpbmVcbiAgICogQGF0dHJpYnV0ZVxuICAgKi9cbiAgcmVhZG9ubHkgcG9saWN5RW5naW5lTmFtZTogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgZGVzY3JpcHRpb24gb2YgdGhlIHBvbGljeSBlbmdpbmVcbiAgICovXG4gIHJlYWRvbmx5IGRlc2NyaXB0aW9uPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgS01TIGtleSB1c2VkIGZvciBlbmNyeXB0aW9uXG4gICAqL1xuICByZWFkb25seSBrbXNLZXk/OiBrbXMuSUtleTtcblxuICAvKipcbiAgICogR3JhbnRzIElBTSBhY3Rpb25zIHRvIHRoZSBJQU0gUHJpbmNpcGFsXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgdG8gZ3JhbnQgcGVybWlzc2lvbnMgdG9cbiAgICogQHBhcmFtIGFjdGlvbnMgLSBUaGUgYWN0aW9ucyB0byBncmFudFxuICAgKi9cbiAgZ3JhbnQoZ3JhbnRlZTogaWFtLklHcmFudGFibGUsIC4uLmFjdGlvbnM6IHN0cmluZ1tdKTogaWFtLkdyYW50O1xuXG4gIC8qKlxuICAgKiBHcmFudHMgcmVhZCBwZXJtaXNzaW9ucyBvbiB0aGUgUG9saWN5RW5naW5lLlxuICAgKlxuICAgKiBUaGlzIGdyYW50cyBydW50aW1lIHJlYWQgYWNjZXNzIHRvIHBvbGljeSBlbmdpbmUgY29uZmlndXJhdGlvbi4gVXNlIHRoaXMgZm9yXG4gICAqIG1vbml0b3JpbmcsIG9ic2VydmFiaWxpdHksIG9yIHJlYWQtb25seSBhZG1pbmlzdHJhdGl2ZSByb2xlcy5cbiAgICpcbiAgICogQHBhcmFtIGdyYW50ZWUgLSBUaGUgSUFNIHByaW5jaXBhbCB0byBncmFudCByZWFkIHBlcm1pc3Npb25zIHRvXG4gICAqL1xuICBncmFudFJlYWQoZ3JhbnRlZTogaWFtLklHcmFudGFibGUpOiBpYW0uR3JhbnQ7XG5cbiAgLyoqXG4gICAqIEdyYW50cyBwZXJtaXNzaW9ucyB0byBldmFsdWF0ZSBwb2xpY2llcyBhdCBydW50aW1lIC5cbiAgICpcbiAgICogVGhpcyBpcyB0aGUgcHJpbWFyeSBwZXJtaXNzaW9uIG5lZWRlZCBieSBHYXRld2F5IGV4ZWN1dGlvbiByb2xlcyB0byBldmFsdWF0ZVxuICAgKiBhdXRob3JpemF0aW9uIGRlY2lzaW9ucyBkdXJpbmcgYWdlbnQgcmVxdWVzdHMuIEdyYW50IHRoaXMgdG8gcm9sZXMgdGhhdCBuZWVkXG4gICAqIHRvIGNhbGwgQXV0aG9yaXplQWN0aW9uIG9yIFBhcnRpYWxseUF1dGhvcml6ZUFjdGlvbnMuXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgdG8gZ3JhbnQgZXZhbHVhdGlvbiBwZXJtaXNzaW9ucyB0b1xuICAgKi9cbiAgZ3JhbnRFdmFsdWF0ZShncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudDtcblxuICAvKipcbiAgICogR3JhbnRzIHRoZSBmdWxsIHNldCBvZiBwZXJtaXNzaW9ucyByZXF1aXJlZCBmb3IgYSBnYXRld2F5IGV4ZWN1dGlvbiByb2xlIHRvIHVzZVxuICAgKiB0aGlzIHBvbGljeSBlbmdpbmUsIGNvcnJlY3RseSBzY29wZWQgdG8gYm90aCB0aGUgcG9saWN5IGVuZ2luZSBhbmQgZ2F0ZXdheSBBUk5zLlxuICAgKlxuICAgKiBQZXIgdGhlIEFXUyBkb2NzLCBgQXV0aG9yaXplQWN0aW9uYCBhbmQgYFBhcnRpYWxseUF1dGhvcml6ZUFjdGlvbnNgIHJlcXVpcmVcbiAgICogYm90aCB0aGUgcG9saWN5IGVuZ2luZSBBUk4gYW5kIHRoZSBnYXRld2F5IEFSTiBhcyByZXNvdXJjZXMsIHdoaWxlXG4gICAqIGBHZXRQb2xpY3lFbmdpbmVgIG9ubHkgbmVlZHMgdGhlIHBvbGljeSBlbmdpbmUgQVJOLlxuICAgKlxuICAgKiBUaGlzIGZvbGxvd3MgdGhlIHNhbWUgcGF0dGVybiBhcyBMYW1iZGEncyBgZ3JhbnRJbnZva2VWZXJzaW9uKGdyYW50ZWUsIHZlcnNpb24pYC5cbiAgICpcbiAgICogQHBhcmFtIGdyYW50ZWUgLSBUaGUgSUFNIHByaW5jaXBhbCAoZ2F0ZXdheSBleGVjdXRpb24gcm9sZSkgdG8gZ3JhbnQgcGVybWlzc2lvbnMgdG9cbiAgICogQHBhcmFtIGdhdGV3YXkgLSBUaGUgZ2F0ZXdheSB0aGF0IHdpbGwgdXNlIHRoaXMgcG9saWN5IGVuZ2luZSBbZGlzYWJsZS1hd3NsaW50OnByZWZlci1yZWYtaW50ZXJmYWNlXVxuICAgKi9cbiAgZ3JhbnRFdmFsdWF0ZUZvckdhdGV3YXkoZ3JhbnRlZTogaWFtLklHcmFudGFibGUsIGdhdGV3YXk6IElHYXRld2F5KTogaWFtLkdyYW50O1xuXG4gIC8qKlxuICAgKiBSZXR1cm4gdGhlIGdpdmVuIG5hbWVkIG1ldHJpYyBmb3IgdGhpcyBwb2xpY3kgZW5naW5lLlxuICAgKlxuICAgKiBAcGFyYW0gbWV0cmljTmFtZSBUaGUgbmFtZSBvZiB0aGUgbWV0cmljXG4gICAqIEBwYXJhbSBkaW1lbnNpb25zIEFkZGl0aW9uYWwgZGltZW5zaW9ucyBmb3IgdGhlIG1ldHJpY1xuICAgKiBAcGFyYW0gcHJvcHMgT3B0aW9uYWwgbWV0cmljIGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIG1ldHJpYyhtZXRyaWNOYW1lOiBzdHJpbmcsIGRpbWVuc2lvbnM6IERpbWVuc2lvbnNNYXAsIHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYztcblxuICAvKipcbiAgICogUmV0dXJuIGEgbWV0cmljIG1lYXN1cmluZyB0aGUgYXV0aG9yaXphdGlvbiBsYXRlbmN5IGZvciB0aGlzIHBvbGljeSBlbmdpbmUuXG4gICAqXG4gICAqIFRoaXMgbWV0cmljIHJlcHJlc2VudHMgdGhlIHRpbWUgdGFrZW4gdG8gZXZhbHVhdGUgYXV0aG9yaXphdGlvbiBwb2xpY2llcy5cbiAgICpcbiAgICogQHBhcmFtIHByb3BzIE9wdGlvbmFsIG1ldHJpYyBjb25maWd1cmF0aW9uXG4gICAqL1xuICBtZXRyaWNBdXRob3JpemF0aW9uTGF0ZW5jeShwcm9wcz86IE1ldHJpY09wdGlvbnMpOiBNZXRyaWM7XG5cbiAgLyoqXG4gICAqIFJldHVybiBhIG1ldHJpYyBjb250YWluaW5nIHRoZSBudW1iZXIgb2YgZGVuaWVkIGF1dGhvcml6YXRpb24gcmVxdWVzdHMgZm9yIHRoaXMgcG9saWN5IGVuZ2luZS5cbiAgICpcbiAgICogVGhpcyBtZXRyaWMgdHJhY2tzIGF1dGhvcml6YXRpb24gcmVxdWVzdHMgdGhhdCB3ZXJlIGV4cGxpY2l0bHkgZGVuaWVkIGJ5IHBvbGljaWVzLlxuICAgKlxuICAgKiBAcGFyYW0gcHJvcHMgT3B0aW9uYWwgbWV0cmljIGNvbmZpZ3VyYXRpb25cbiAgICovXG4gIG1ldHJpY0RlbmllZFJlcXVlc3RzKHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYztcblxuICAvKipcbiAgICogUmV0dXJuIGEgbWV0cmljIGNvbnRhaW5pbmcgdGhlIG51bWJlciBvZiBlcnJvcnMgZHVyaW5nIGF1dGhvcml6YXRpb24gZm9yIHRoaXMgcG9saWN5IGVuZ2luZS5cbiAgICpcbiAgICogVGhpcyBtZXRyaWMgdHJhY2tzIGVycm9ycyBlbmNvdW50ZXJlZCBkdXJpbmcgcG9saWN5IGV2YWx1YXRpb24uXG4gICAqXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgbWV0cmljRXJyb3JzKHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYztcbn1cblxuLyoqXG4gKiBBdHRyaWJ1dGVzIGZvciBpbXBvcnRpbmcgYW4gZXhpc3RpbmcgUG9saWN5RW5naW5lXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUG9saWN5RW5naW5lQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBwb2xpY3kgZW5naW5lXG4gICAqL1xuICByZWFkb25seSBwb2xpY3lFbmdpbmVBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIEtNUyBrZXkgQVJOIHVzZWQgZm9yIGVuY3J5cHRpb24gKG9wdGlvbmFsKVxuICAgKlxuICAgKiBAZGVmYXVsdCAtIE5vIEtNUyBrZXlcbiAgICovXG4gIHJlYWRvbmx5IGttc0tleUFybj86IHN0cmluZztcbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICBBQlNUUkFDVCBCQVNFIENMQVNTXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQWJzdHJhY3QgYmFzZSBjbGFzcyBmb3IgYSBQb2xpY3lFbmdpbmUuXG4gKiBDb250YWlucyBtZXRob2RzIGFuZCBhdHRyaWJ1dGVzIHZhbGlkIGZvciBQb2xpY3lFbmdpbmVzIGVpdGhlciBjcmVhdGVkIHdpdGggQ0RLIG9yIGltcG9ydGVkLlxuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgUG9saWN5RW5naW5lQmFzZSBleHRlbmRzIFJlc291cmNlIGltcGxlbWVudHMgSVBvbGljeUVuZ2luZSB7XG4gIHB1YmxpYyBhYnN0cmFjdCByZWFkb25seSBwb2xpY3lFbmdpbmVBcm46IHN0cmluZztcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IHBvbGljeUVuZ2luZUlkOiBzdHJpbmc7XG4gIHB1YmxpYyBhYnN0cmFjdCByZWFkb25seSBwb2xpY3lFbmdpbmVOYW1lOiBzdHJpbmc7XG4gIHB1YmxpYyBhYnN0cmFjdCByZWFkb25seSBkZXNjcmlwdGlvbj86IHN0cmluZztcbiAgcHVibGljIGFic3RyYWN0IHJlYWRvbmx5IGttc0tleT86IGttcy5JS2V5O1xuXG4gIC8qKlxuICAgKiBUaGUgcHJpbmNpcGFsIHRvIGdyYW50IHBlcm1pc3Npb25zIHRvXG4gICAqL1xuICBwdWJsaWMgYWJzdHJhY3QgcmVhZG9ubHkgZ3JhbnRQcmluY2lwYWw6IGlhbS5JUHJpbmNpcGFsO1xuXG4gIC8qKlxuICAgKiBBIHJlZmVyZW5jZSB0byB0aGlzIFBvbGljeUVuZ2luZSByZXNvdXJjZS5cbiAgICovXG4gIHB1YmxpYyBnZXQgcG9saWN5RW5naW5lUmVmKCk6IFBvbGljeUVuZ2luZVJlZmVyZW5jZSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIHBvbGljeUVuZ2luZUFybjogdGhpcy5wb2xpY3lFbmdpbmVBcm4sXG4gICAgfTtcbiAgfVxuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBSZXNvdXJjZVByb3BzID0ge30pIHtcbiAgICBzdXBlcihzY29wZSwgaWQsIHByb3BzKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudHMgSUFNIGFjdGlvbnMgdG8gdGhlIElBTSBQcmluY2lwYWxcbiAgICpcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgdG8gZ3JhbnQgcGVybWlzc2lvbnMgdG9cbiAgICogQHBhcmFtIGFjdGlvbnMgLSBUaGUgYWN0aW9ucyB0byBncmFudFxuICAgKiBAcmV0dXJucyBBbiBJQU0gR3JhbnQgb2JqZWN0IHJlcHJlc2VudGluZyB0aGUgZ3JhbnRlZCBwZXJtaXNzaW9uc1xuICAgKi9cbiAgcHVibGljIGdyYW50KGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlLCAuLi5hY3Rpb25zOiBzdHJpbmdbXSk6IGlhbS5HcmFudCB7XG4gICAgcmV0dXJuIGlhbS5HcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlLFxuICAgICAgYWN0aW9ucyxcbiAgICAgIHJlc291cmNlQXJuczogW3RoaXMucG9saWN5RW5naW5lQXJuXSxcbiAgICB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudHMgcmVhZCBwZXJtaXNzaW9ucyBvbiB0aGUgUG9saWN5RW5naW5lIChkYXRhIHBsYW5lKS5cbiAgICpcbiAgICogVGhpcyBncmFudHMgcnVudGltZSByZWFkIGFjY2VzcyB0byBwb2xpY3kgZW5naW5lIGNvbmZpZ3VyYXRpb24uIFVzZSB0aGlzIGZvclxuICAgKiBtb25pdG9yaW5nLCBvYnNlcnZhYmlsaXR5LCBvciByZWFkLW9ubHkgYWRtaW5pc3RyYXRpdmUgcm9sZXMgdGhhdCBuZWVkIHRvIGluc3BlY3RcbiAgICogcG9saWN5IGVuZ2luZSBzZXR0aW5ncyBhdCBydW50aW1lLlxuICAgKlxuICAgKiBbZGlzYWJsZS1hd3NsaW50Om5vLWdyYW50c11cbiAgICpcbiAgICogQHBhcmFtIGdyYW50ZWUgLSBUaGUgSUFNIHByaW5jaXBhbCB0byBncmFudCByZWFkIHBlcm1pc3Npb25zIHRvXG4gICAqIEByZXR1cm5zIEFuIElBTSBHcmFudCBvYmplY3QgcmVwcmVzZW50aW5nIHRoZSBncmFudGVkIHBlcm1pc3Npb25zXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRSZWFkKGdyYW50ZWU6IGlhbS5JR3JhbnRhYmxlKTogaWFtLkdyYW50IHtcbiAgICByZXR1cm4gdGhpcy5ncmFudChncmFudGVlLCAuLi5QT0xJQ1lfRU5HSU5FX1JFQURfUEVSTVMpO1xuICB9XG5cbiAgLyoqXG4gICAqIEdyYW50cyBwZXJtaXNzaW9ucyB0byBldmFsdWF0ZSBwb2xpY2llcyBhdCBydW50aW1lIChkYXRhIHBsYW5lIG9wZXJhdGlvbnMpLlxuICAgKlxuICAgKiBUaGlzIGlzIHRoZSBwcmltYXJ5IHBlcm1pc3Npb24gbmVlZGVkIGJ5IEdhdGV3YXkgZXhlY3V0aW9uIHJvbGVzIHRvIGV2YWx1YXRlXG4gICAqIGF1dGhvcml6YXRpb24gZGVjaXNpb25zIGR1cmluZyBhZ2VudCByZXF1ZXN0cy4gR3JhbnQgdGhpcyB0byByb2xlcyB0aGF0IG5lZWRcbiAgICogdG8gY2FsbCBBdXRob3JpemVBY3Rpb24gb3IgUGFydGlhbGx5QXV0aG9yaXplQWN0aW9ucyBhdCBydW50aW1lLlxuICAgKlxuICAgKiBbZGlzYWJsZS1hd3NsaW50Om5vLWdyYW50c11cbiAgICpcbiAgICogQHBhcmFtIGdyYW50ZWUgLSBUaGUgSUFNIHByaW5jaXBhbCB0byBncmFudCBldmFsdWF0aW9uIHBlcm1pc3Npb25zIHRvXG4gICAqIEByZXR1cm5zIEFuIElBTSBHcmFudCBvYmplY3QgcmVwcmVzZW50aW5nIHRoZSBncmFudGVkIHBlcm1pc3Npb25zXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRFdmFsdWF0ZShncmFudGVlOiBpYW0uSUdyYW50YWJsZSk6IGlhbS5HcmFudCB7XG4gICAgcmV0dXJuIHRoaXMuZ3JhbnQoZ3JhbnRlZSwgLi4uUE9MSUNZX0VOR0lORV9FVkFMVUFURV9QRVJNUyk7XG4gIH1cblxuICAvKipcbiAgICogR3JhbnRzIHRoZSBmdWxsIHNldCBvZiBwZXJtaXNzaW9ucyByZXF1aXJlZCBmb3IgYSBnYXRld2F5IGV4ZWN1dGlvbiByb2xlIHRvIHVzZVxuICAgKiB0aGlzIHBvbGljeSBlbmdpbmUsIGNvcnJlY3RseSBzY29wZWQgdG8gYm90aCB0aGUgcG9saWN5IGVuZ2luZSBhbmQgZ2F0ZXdheSBBUk5zLlxuICAgKlxuICAgKiBQZXIgdGhlIEFXUyBkb2NzOlxuICAgKiAtIGBHZXRQb2xpY3lFbmdpbmVgIOKGkiBwb2xpY3kgZW5naW5lIEFSTiBvbmx5XG4gICAqIC0gYEF1dGhvcml6ZUFjdGlvbmAgKyBgUGFydGlhbGx5QXV0aG9yaXplQWN0aW9uc2Ag4oaSIHBvbGljeSBlbmdpbmUgQVJOICoqYW5kKiogZ2F0ZXdheSBBUk5cbiAgICpcbiAgICogW2Rpc2FibGUtYXdzbGludDpuby1ncmFudHNdXG4gICAqXG4gICAqIEBwYXJhbSBncmFudGVlIC0gVGhlIElBTSBwcmluY2lwYWwgKGdhdGV3YXkgZXhlY3V0aW9uIHJvbGUpIHRvIGdyYW50IHBlcm1pc3Npb25zIHRvXG4gICAqIEBwYXJhbSBnYXRld2F5IC0gVGhlIGdhdGV3YXkgdGhhdCB3aWxsIHVzZSB0aGlzIHBvbGljeSBlbmdpbmUgW2Rpc2FibGUtYXdzbGludDpwcmVmZXItcmVmLWludGVyZmFjZV1cbiAgICogQHJldHVybnMgQSBjb21iaW5lZCBJQU0gR3JhbnQgcmVwcmVzZW50aW5nIGFsbCBncmFudGVkIHBlcm1pc3Npb25zXG4gICAqL1xuICBwdWJsaWMgZ3JhbnRFdmFsdWF0ZUZvckdhdGV3YXkoZ3JhbnRlZTogaWFtLklHcmFudGFibGUsIGdhdGV3YXk6IElHYXRld2F5KTogaWFtLkdyYW50IHtcbiAgICBjb25zdCBnZXRQb2xpY3lFbmdpbmVHcmFudCA9IHRoaXMuZ3JhbnQoZ3JhbnRlZSwgJ2JlZHJvY2stYWdlbnRjb3JlOkdldFBvbGljeUVuZ2luZScpO1xuXG4gICAgLy8gdXNpbmcgIGdhdGV3YXkubmFtZSBoZXJlIHRvIGF2b2lkIGEgY2lyY3VsYXIgZGVwZW5kZW5jeSBiZXR3ZWVuIFBvbGljeUVuZ2luZSBhbmQgR2F0ZXdheSB0aGF0XG4gICAgLy8gYXJpc2VzIGlmIHdlIHRyeSB0byByZWZlcmVuY2UgZ2F0ZXdheS5nYXRld2F5QXJuLlxuICAgIC8vIEFkZGl0aW9uYWxseSwgQmVkcm9ja0FnZW50Q29yZSBhcHBlbmRzIGEgcmFuZG9tIHN1ZmZpeCB0byBnYXRld2F5IG5hbWVzIGF0IGNyZWF0aW9uIHRpbWUsIHNvIHRoZSBleGFjdCBBUk5cbiAgICAvLyBpcyB1bmtub3dhYmxlIGF0IHN5bnRoZXNpcy4gVXNpbmcgYCR7Z2F0ZXdheS5uYW1lfS0qYCBhbGxvd3MgdXMgdG8gY29ycmVjdGx5IG1hdGNoIHRoZSBhY3R1YWwgQVJOIGF0IHJ1bnRpbWUuXG4gICAgY29uc3QgZ2F0ZXdheVJlc291cmNlTmFtZSA9IFRva2VuLmlzVW5yZXNvbHZlZChnYXRld2F5Lm5hbWUpID8gJyonIDogYCR7Z2F0ZXdheS5uYW1lfS0qYDtcbiAgICBjb25zdCBnYXRld2F5QXJuID0gU3RhY2sub2YodGhpcykuZm9ybWF0QXJuKHtcbiAgICAgIHNlcnZpY2U6ICdiZWRyb2NrLWFnZW50Y29yZScsXG4gICAgICByZXNvdXJjZTogJ2dhdGV3YXknLFxuICAgICAgcmVzb3VyY2VOYW1lOiBnYXRld2F5UmVzb3VyY2VOYW1lLFxuICAgIH0pO1xuXG4gICAgY29uc3QgYXV0aG9yaXphdGlvbkdyYW50ID0gaWFtLkdyYW50LmFkZFRvUHJpbmNpcGFsKHtcbiAgICAgIGdyYW50ZWUsXG4gICAgICBhY3Rpb25zOiBbXG4gICAgICAgICdiZWRyb2NrLWFnZW50Y29yZTpBdXRob3JpemVBY3Rpb24nLFxuICAgICAgICAnYmVkcm9jay1hZ2VudGNvcmU6UGFydGlhbGx5QXV0aG9yaXplQWN0aW9ucycsXG4gICAgICBdLFxuICAgICAgcmVzb3VyY2VBcm5zOiBbdGhpcy5wb2xpY3lFbmdpbmVBcm4sIGdhdGV3YXlBcm5dLFxuICAgIH0pO1xuXG4gICAgcmV0dXJuIGdldFBvbGljeUVuZ2luZUdyYW50LmNvbWJpbmUoYXV0aG9yaXphdGlvbkdyYW50KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm4gdGhlIGdpdmVuIG5hbWVkIG1ldHJpYyBmb3IgdGhpcyBwb2xpY3kgZW5naW5lLlxuICAgKlxuICAgKiBCeSBkZWZhdWx0LCB0aGUgbWV0cmljIHdpbGwgYmUgY2FsY3VsYXRlZCBhcyBhIHN1bSBvdmVyIGEgcGVyaW9kIG9mIDUgbWludXRlcy5cbiAgICogWW91IGNhbiBjdXN0b21pemUgdGhpcyBieSB1c2luZyB0aGUgYHN0YXRpc3RpY2AgYW5kIGBwZXJpb2RgIHByb3BlcnRpZXMuXG4gICAqXG4gICAqIEBwYXJhbSBtZXRyaWNOYW1lIFRoZSBuYW1lIG9mIHRoZSBtZXRyaWNcbiAgICogQHBhcmFtIGRpbWVuc2lvbnMgQWRkaXRpb25hbCBkaW1lbnNpb25zIGZvciB0aGUgbWV0cmljXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgcHVibGljIG1ldHJpYyhtZXRyaWNOYW1lOiBzdHJpbmcsIGRpbWVuc2lvbnM6IERpbWVuc2lvbnNNYXAsIHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYyB7XG4gICAgY29uc3QgbWV0cmljUHJvcHM6IE1ldHJpY1Byb3BzID0ge1xuICAgICAgbmFtZXNwYWNlOiAnQVdTL0JlZHJvY2stQWdlbnRDb3JlJyxcbiAgICAgIG1ldHJpY05hbWUsXG4gICAgICBkaW1lbnNpb25zTWFwOiB7IC4uLmRpbWVuc2lvbnMsIFJlc291cmNlOiB0aGlzLnBvbGljeUVuZ2luZUFybiB9LFxuICAgICAgLi4ucHJvcHMsXG4gICAgfTtcbiAgICByZXR1cm4gdGhpcy5jb25maWd1cmVNZXRyaWMobWV0cmljUHJvcHMpO1xuICB9XG5cbiAgLyoqXG4gICAqIFJldHVybiBhIG1ldHJpYyBjb250YWluaW5nIHRoZSB0b3RhbCBudW1iZXIgb2YgYXV0aG9yaXphdGlvbnMgZm9yIHRoaXMgcG9saWN5IGVuZ2luZS5cbiAgICpcbiAgICogVGhpcyBtZXRyaWMgdHJhY2tzIGFsbCBhdXRob3JpemF0aW9uIHJlcXVlc3RzIHByb2Nlc3NlZCBieSB0aGUgcG9saWN5IGVuZ2luZS5cbiAgICpcbiAgICogQHBhcmFtIHByb3BzIE9wdGlvbmFsIG1ldHJpYyBjb25maWd1cmF0aW9uXG4gICAqL1xuICBwdWJsaWMgbWV0cmljQXV0aG9yaXphdGlvbnMocHJvcHM/OiBNZXRyaWNPcHRpb25zKTogTWV0cmljIHtcbiAgICByZXR1cm4gdGhpcy5tZXRyaWMoJ0F1dGhvcml6YXRpb25zJywge30sIHsgc3RhdGlzdGljOiBTdGF0cy5TVU0sIC4uLnByb3BzIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIFJldHVybiBhIG1ldHJpYyBtZWFzdXJpbmcgdGhlIGF1dGhvcml6YXRpb24gbGF0ZW5jeSBmb3IgdGhpcyBwb2xpY3kgZW5naW5lLlxuICAgKlxuICAgKiBUaGlzIG1ldHJpYyByZXByZXNlbnRzIHRoZSB0aW1lIHRha2VuIHRvIGV2YWx1YXRlIGF1dGhvcml6YXRpb24gcG9saWNpZXMuXG4gICAqXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgcHVibGljIG1ldHJpY0F1dGhvcml6YXRpb25MYXRlbmN5KHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYyB7XG4gICAgcmV0dXJuIHRoaXMubWV0cmljKCdBdXRob3JpemF0aW9uTGF0ZW5jeScsIHt9LCB7IHN0YXRpc3RpYzogU3RhdHMuQVZFUkFHRSwgLi4ucHJvcHMgfSk7XG4gIH1cblxuICAvKipcbiAgICogUmV0dXJuIGEgbWV0cmljIGNvbnRhaW5pbmcgdGhlIG51bWJlciBvZiBkZW5pZWQgYXV0aG9yaXphdGlvbiByZXF1ZXN0cyBmb3IgdGhpcyBwb2xpY3kgZW5naW5lLlxuICAgKlxuICAgKiBUaGlzIG1ldHJpYyB0cmFja3MgYXV0aG9yaXphdGlvbiByZXF1ZXN0cyB0aGF0IHdlcmUgZXhwbGljaXRseSBkZW5pZWQgYnkgcG9saWNpZXMuXG4gICAqXG4gICAqIEBwYXJhbSBwcm9wcyBPcHRpb25hbCBtZXRyaWMgY29uZmlndXJhdGlvblxuICAgKi9cbiAgcHVibGljIG1ldHJpY0RlbmllZFJlcXVlc3RzKHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYyB7XG4gICAgcmV0dXJuIHRoaXMubWV0cmljKCdEZW5pZWRSZXF1ZXN0cycsIHt9LCB7IHN0YXRpc3RpYzogU3RhdHMuU1VNLCAuLi5wcm9wcyB9KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBSZXR1cm4gYSBtZXRyaWMgY29udGFpbmluZyB0aGUgbnVtYmVyIG9mIGVycm9ycyBkdXJpbmcgYXV0aG9yaXphdGlvbiBmb3IgdGhpcyBwb2xpY3kgZW5naW5lLlxuICAgKlxuICAgKiBUaGlzIG1ldHJpYyB0cmFja3MgZXJyb3JzIGVuY291bnRlcmVkIGR1cmluZyBwb2xpY3kgZXZhbHVhdGlvbi5cbiAgICpcbiAgICogQHBhcmFtIHByb3BzIE9wdGlvbmFsIG1ldHJpYyBjb25maWd1cmF0aW9uXG4gICAqL1xuICBwdWJsaWMgbWV0cmljRXJyb3JzKHByb3BzPzogTWV0cmljT3B0aW9ucyk6IE1ldHJpYyB7XG4gICAgcmV0dXJuIHRoaXMubWV0cmljKCdFcnJvcnMnLCB7fSwgeyBzdGF0aXN0aWM6IFN0YXRzLlNVTSwgLi4ucHJvcHMgfSk7XG4gIH1cblxuICAvKipcbiAgICogSW50ZXJuYWwgbWV0aG9kIHRvIGNyZWF0ZSBhIG1ldHJpYy5cbiAgICovXG4gIHByaXZhdGUgY29uZmlndXJlTWV0cmljKHByb3BzOiBNZXRyaWNQcm9wcykge1xuICAgIHJldHVybiBuZXcgTWV0cmljKHtcbiAgICAgIC4uLnByb3BzLFxuICAgICAgcmVnaW9uOiBwcm9wcz8ucmVnaW9uID8/IHRoaXMuc3RhY2sucmVnaW9uLFxuICAgICAgYWNjb3VudDogcHJvcHM/LmFjY291bnQgPz8gdGhpcy5zdGFjay5hY2NvdW50LFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/policy/policy-engine.d.ts

@@ -0,0 +1,150 @@
+/**
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance
+ *  with the License. A copy of the License is located at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  or in the 'license' file accompanying this file. This file is distributed on an 'AS IS' BASIS, WITHOUT WARRANTIES
+ *  OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions
+ *  and limitations under the License.
+ */
+import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
+import type { Construct } from 'constructs';
+import { Policy } from './policy';
+import { PolicyEngineBase } from './policy-engine-base';
+import type { IPolicyEngine, PolicyEngineAttributes } from './policy-engine-base';
+import type { AddPolicyOptions } from './policy-types';
+/**
+ * Properties for creating a PolicyEngine resource
+ */
+export interface PolicyEngineProps {
+    /**
+     * The name of the policy engine.
+     * Valid characters: a-z, A-Z, 0-9, _ (underscore)
+     * Must start with a letter, 1-48 characters
+     * Pattern: ^[A-Za-z][A-Za-z0-9_]*$
+     *
+     * @default - Auto-generated unique name
+     */
+    readonly policyEngineName?: string;
+    /**
+     * Optional description for the policy engine.
+     * Maximum 4,096 characters.
+     *
+     * @default - No description
+     */
+    readonly description?: string;
+    /**
+     * Custom KMS key for encryption.
+     * [disable-awslint:prefer-ref-interface]
+     *
+     * @default - AWS owned key
+     */
+    readonly kmsKey?: kms.IKey;
+    /**
+     * Tags for the policy engine.
+     * Maximum 50 tags.
+     *
+     * @default - No tags
+     */
+    readonly tags?: {
+        [key: string]: string;
+    };
+}
+/**
+ * Container that manages Cedar authorization policies associated with gateways.
+ * PolicyEngine enables deterministic authorization control for Bedrock agents,
+ * allowing fine-grained access control to tools and actions via Cedar policy language.
+ *
+ * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/policy-engine.html
+ * @resource AWS::BedrockAgentCore::PolicyEngine
+ */
+export declare class PolicyEngine extends PolicyEngineBase {
+    /** Uniquely identifies this class. */
+    static readonly PROPERTY_INJECTION_ID: string;
+    /**
+     * Creates a PolicyEngine reference from an existing policy engine's attributes.
+     *
+     * @param scope - The construct scope
+     * @param id - Identifier of the construct
+     * @param attrs - Attributes of the existing policy engine
+     * @returns An IPolicyEngine reference to the existing policy engine
+     */
+    static fromPolicyEngineAttributes(scope: Construct, id: string, attrs: PolicyEngineAttributes): IPolicyEngine;
+    /**
+     * The ARN of the policy engine resource.
+     * @attribute
+     */
+    readonly policyEngineArn: string;
+    /**
+     * The name of the policy engine.
+     *
+     * [disable-awslint:attribute-tag]
+     */
+    readonly policyEngineName: string;
+    /**
+     * The ID of the policy engine.
+     * @attribute
+     */
+    readonly policyEngineId: string;
+    /**
+     * The description of the policy engine.
+     */
+    readonly description?: string;
+    /**
+     * Tags applied to this policy engine resource.
+     * @default - No tags applied
+     */
+    readonly tags?: {
+        [key: string]: string;
+    };
+    /**
+     * The principal to grant permissions to.
+     */
+    readonly grantPrincipal: iam.IPrincipal;
+    /**
+     * The KMS key used to encrypt the policy engine.
+     */
+    readonly kmsKey?: kms.IKey;
+    /**
+     * List of policies added to this policy engine via addPolicy().
+     * @internal
+     */
+    private readonly _policies;
+    /**
+     * The last policy added to this engine, used for automatic sequential chaining.
+     * @internal
+     */
+    private _lastPolicy?;
+    /**
+     * Get the list of policies added to this policy engine.
+     *
+     * Returns an array of Policy constructs that were added using addPolicy().
+     * This allows you to iterate over all policies associated with this engine.
+     *
+     * @returns A copy of the policies array
+     */
+    get policies(): Policy[];
+    private readonly __resource;
+    constructor(scope: Construct, id: string, props?: PolicyEngineProps);
+    /**
+     * Add a policy to this policy engine.
+     * Convenience method that creates a Policy construct with this engine as the parent.
+     *
+     * **Automatic Sequential Chaining**: By default, policies are automatically chained
+     * sequentially to prevent concurrent creation issues with the AWS Bedrock AgentCore
+     * service. Each new policy will depend on the previous policy added to this engine.
+     *
+     * This ensures policies are created one at a time, avoiding "Resource stabilization
+     * failed" errors that occur with concurrent policy operations.
+     *
+     * @param id - Unique identifier for the policy construct
+     * @param options - Options for creating the policy
+     * @returns The created Policy construct
+     *
+     */
+    addPolicy(id: string, options: AddPolicyOptions): Policy;
+}