@aws-cdk/aws-bedrock-agentcore-alpha 2.253.1-alpha.0 → 2.255.0-alpha.0

package/lib/gateway/inbound-auth/authorizer.js

@@ -24,7 +24,7 @@ var GatewayAuthorizerType;
  * Custom JWT authorizer configuration implementation
  */
 class CustomJwtAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.CustomJwtAuthorizer", version: "2.255.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.CUSTOM_JWT;
     discoveryUrl;
     allowedAudience;
@@ -73,7 +73,7 @@ exports.CustomJwtAuthorizer = CustomJwtAuthorizer;
  *
  */
 class IamAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.IamAuthorizer", version: "2.255.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.AWS_IAM;
     /**
      * @internal
@@ -92,7 +92,7 @@ exports.IamAuthorizer = IamAuthorizer;
  * No authorization configuration implementation
  */
 class NoAuthAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.NoAuthAuthorizer", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.NoAuthAuthorizer", version: "2.255.0-alpha.0" };
     authorizerType = GatewayAuthorizerType.NONE;
     /**
      * @internal
@@ -106,7 +106,7 @@ exports.NoAuthAuthorizer = NoAuthAuthorizer;
  * Factory class for creating Gateway Authorizers
  */
 class GatewayAuthorizer {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayAuthorizer", version: "2.255.0-alpha.0" };
     /**
      * AWS IAM authorizer instance
      */

package/lib/gateway/inbound-auth/custom-claim.js

@@ -29,7 +29,7 @@ class GatewayCustomClaim {
     valueType;
     operator;
     value;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCustomClaim", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCustomClaim", version: "2.255.0-alpha.0" };
     /**
      * Create a custom claim with a string value.
      * String claims must use the EQUALS operator.

package/lib/gateway/interceptor.js

@@ -34,7 +34,7 @@ var InterceptionPoint;
  * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-interceptors.html
  */
 class LambdaInterceptor {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaInterceptor", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.LambdaInterceptor", version: "2.255.0-alpha.0" };
     /**
      * Create a REQUEST interceptor that executes before the gateway calls the target
      *

package/lib/gateway/outbound-auth/api-key.d.ts

@@ -1,7 +1,7 @@
-import type { IRole } from 'aws-cdk-lib/aws-iam';
 import { Grant } from 'aws-cdk-lib/aws-iam';
 import type { ICredentialProviderConfig } from './credential-provider';
 import { CredentialProviderType } from './credential-provider';
+import type { IGateway } from '../gateway-base';
 /******************************************************************************
  *                                 API KEY
  *****************************************************************************/
@@ -65,7 +65,9 @@ export declare class ApiKeyCredentialLocation {
     private constructor();
 }
 /**
- * API Key configuration
+ * API key credential provider ARNs for gateway outbound auth (Token Vault identity).
+ *
+ * Pass this to {@link GatewayCredentialProvider.fromApiKeyIdentityArn} or to {@link ApiKeyCredentialProviderConfiguration}.
  */
 export interface ApiKeyCredentialProviderProps {
     /**
@@ -109,9 +111,16 @@ export declare class ApiKeyCredentialProviderConfiguration implements ICredentia
     readonly credentialLocation: ApiKeyCredentialLocation;
     constructor(configuration: ApiKeyCredentialProviderProps);
     /**
-     * Grant the needed permissions to the role for API key authentication
+     * Grant the needed permissions to the gateway role for API key authentication.
+     *
+     * Produces three scoped IAM statements matching the console-generated policy:
+     * 1. `GetWorkloadAccessToken` on the workload identity directory ARNs
+     * 2. `GetResourceApiKey` on the token vault, credential provider, directory, and identity ARNs
+     * 3. `secretsmanager:GetSecretValue` on the specific credential secret ARN
+     *
+     * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html
      */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    grantNeededPermissionsToRole(gateway: IGateway): Grant | undefined;
     /**
      * @internal
      */

package/lib/gateway/outbound-auth/api-key.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiKeyCredentialProviderConfiguration = exports.ApiKeyCredentialLocation = exports.ApiKeyCredentialLocationType = void 0;
 const jsiiDeprecationWarnings = require("../../../.warnings.jsii.js");
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
+const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const credential_provider_1 = require("./credential-provider");
 const perms_1 = require("../perms");
@@ -19,7 +20,7 @@ var ApiKeyCredentialLocationType;
  * API Key location within the request
  */
 class ApiKeyCredentialLocation {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.ApiKeyCredentialLocation", version: "2.255.0-alpha.0" };
     /**
      * Create a header-based API key credential location
      * @param config - Optional configuration for the credential location
@@ -98,27 +99,68 @@ class ApiKeyCredentialProviderConfiguration {
         this.credentialLocation = configuration.credentialLocation ?? ApiKeyCredentialLocation.header();
     }
     /**
-     * Grant the needed permissions to the role for API key authentication
+     * Grant the needed permissions to the gateway role for API key authentication.
+     *
+     * Produces three scoped IAM statements matching the console-generated policy:
+     * 1. `GetWorkloadAccessToken` on the workload identity directory ARNs
+     * 2. `GetResourceApiKey` on the token vault, credential provider, directory, and identity ARNs
+     * 3. `secretsmanager:GetSecretValue` on the specific credential secret ARN
+     *
+     * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html
      */
-    grantNeededPermissionsToRole(role) {
-        const statements = [
-            new aws_iam_1.PolicyStatement({
-                actions: [
-                    ...perms_1.GATEWAY_API_KEY_PERMS,
-                    ...perms_1.GATEWAY_WORKLOAD_IDENTITY_PERMS,
-                ],
-                resources: [this.providerArn],
-            }),
-            new aws_iam_1.PolicyStatement({
-                actions: perms_1.GATEWAY_SECRETS_PERMS,
-                resources: [this.secretArn],
-            }),
-        ];
-        return aws_iam_1.Grant.addToPrincipal({
-            grantee: role,
-            actions: statements.flatMap(s => s.actions),
-            resourceArns: statements.flatMap(s => s.resources),
+    grantNeededPermissionsToRole(gateway) {
+        const stack = aws_cdk_lib_1.Stack.of(gateway);
+        const directoryArn = stack.formatArn({
+            service: 'bedrock-agentcore',
+            resource: 'workload-identity-directory',
+            resourceName: 'default',
+            arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
         });
+        const identityWildcardArn = `${directoryArn}/workload-identity/${gateway.name}-*`;
+        const tokenVaultArn = stack.formatArn({
+            service: 'bedrock-agentcore',
+            resource: 'token-vault',
+            resourceName: 'default',
+            arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
+        });
+        const workloadIdentityGrant = aws_iam_1.Grant.addToPrincipal({
+            grantee: gateway.role,
+            actions: [...perms_1.GATEWAY_WORKLOAD_IDENTITY_PERMS],
+            resourceArns: [directoryArn, identityWildcardArn],
+            scope: gateway,
+        });
+        const apiKeyGrant = aws_iam_1.Grant.addToPrincipal({
+            grantee: gateway.role,
+            actions: [...perms_1.GATEWAY_API_KEY_PERMS],
+            resourceArns: [tokenVaultArn, this.providerArn, directoryArn, identityWildcardArn],
+            scope: gateway,
+        });
+        // The CFN attribute ApiKeySecretArn is an object { SecretArn: string }, not a
+        // plain string, so the Token resolves to an object which cannot be placed in
+        // IAM Resource fields. When the caller supplies a literal ARN string (e.g. via
+        // fromApiKeyIdentityArn) we can scope tightly; otherwise fall back to a
+        // service-managed prefix wildcard.
+        let secretResourceArns;
+        if (aws_cdk_lib_1.Token.isUnresolved(this.secretArn)) {
+            aws_cdk_lib_1.Annotations.of(gateway).addWarningV2('@aws-cdk/aws-bedrock-agentcore-alpha:wildcardSecretArnGrant', 'The secret ARN is an unresolved token. Granting access using a wildcard prefix (bedrock-agentcore-identity!*). ' +
+                'To scope the grant to a specific secret, supply a literal secret ARN via fromApiKeyIdentityArn.');
+            secretResourceArns = [stack.formatArn({
+                    service: 'secretsmanager',
+                    resource: 'secret',
+                    resourceName: 'bedrock-agentcore-identity!*',
+                    arnFormat: aws_cdk_lib_1.ArnFormat.COLON_RESOURCE_NAME,
+                })];
+        }
+        else {
+            secretResourceArns = [this.secretArn];
+        }
+        const secretGrant = aws_iam_1.Grant.addToPrincipal({
+            grantee: gateway.role,
+            actions: [...perms_1.GATEWAY_SECRETS_PERMS],
+            resourceArns: secretResourceArns,
+            scope: gateway,
+        });
+        return workloadIdentityGrant.combine(apiKeyGrant).combine(secretGrant);
     }
     /**
      * @internal
@@ -138,4 +180,4 @@ class ApiKeyCredentialProviderConfiguration {
     }
 }
 exports.ApiKeyCredentialProviderConfiguration = ApiKeyCredentialProviderConfiguration;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImFwaS1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFDQSxpREFBNkQ7QUFFN0QsK0RBQStEO0FBQy9ELG9DQUF5RztBQTZCekc7OztHQUdHO0FBQ0gsSUFBWSw0QkFHWDtBQUhELFdBQVksNEJBQTRCO0lBQ3RDLGlEQUFpQixDQUFBO0lBQ2pCLG1FQUFtQyxDQUFBO0FBQ3JDLENBQUMsRUFIVyw0QkFBNEIsNENBQTVCLDRCQUE0QixRQUd2QztBQUVEOztHQUVHO0FBQ0gsTUFBYSx3QkFBd0I7O0lBQ25DOzs7O09BSUc7SUFDSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQXNDOzs7Ozs7Ozs7O1FBQ3pELE9BQU8sSUFBSSx3QkFBd0IsQ0FDakMsNEJBQTRCLENBQUMsTUFBTSxFQUNuQyxNQUFNLEVBQUUsdUJBQXVCLElBQUksZUFBZSxFQUNsRCxNQUFNLEVBQUUsZ0JBQWdCLElBQUksU0FBUyxDQUN0QyxDQUFDO0tBQ0g7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFzQzs7Ozs7Ozs7OztRQUNqRSxPQUFPLElBQUksd0JBQXdCLENBQ2pDLDRCQUE0QixDQUFDLGVBQWUsRUFDNUMsTUFBTSxFQUFFLHVCQUF1QixJQUFJLFNBQVMsRUFDNUMsTUFBTSxFQUFFLGdCQUFnQixDQUN6QixDQUFDO0tBQ0g7SUFFRDs7T0FFRztJQUNhLHVCQUF1QixDQUFTO0lBQ2hEOztPQUVHO0lBQ2EsZ0JBQWdCLENBQVU7SUFDMUM7O09BRUc7SUFDYSxzQkFBc0IsQ0FBUztJQUUvQyxZQUNFLHNCQUE4QixFQUM5Qix1QkFBK0IsRUFDL0IsZ0JBQXlCO1FBRXpCLElBQUksQ0FBQyxzQkFBc0IsR0FBRyxzQkFBc0IsQ0FBQztRQUNyRCxJQUFJLENBQUMsdUJBQXVCLEdBQUcsdUJBQXVCLENBQUM7UUFDdkQsSUFBSSxDQUFDLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDO0tBQzFDOztBQWhESCw0REFpREM7QUE2QkQ7Ozs7R0FJRztBQUNILE1BQWEscUNBQXFDO0lBQ2hDLHNCQUFzQixHQUFHLDRDQUFzQixDQUFDLE9BQU8sQ0FBQztJQUN4RTs7T0FFRztJQUNhLFdBQVcsQ0FBUztJQUNwQzs7T0FFRztJQUNhLFNBQVMsQ0FBUztJQUNsQzs7T0FFRztJQUNhLGtCQUFrQixDQUEyQjtJQUU3RCxZQUFZLGFBQTRDO1FBQ3RELElBQUksQ0FBQyxXQUFXLEdBQUcsYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUM3QyxJQUFJLENBQUMsU0FBUyxHQUFHLGFBQWEsQ0FBQyxTQUFTLENBQUM7UUFDekMsSUFBSSxDQUFDLGtCQUFrQixHQUFHLGFBQWEsQ0FBQyxrQkFBa0IsSUFBSSx3QkFBd0IsQ0FBQyxNQUFNLEVBQUUsQ0FBQztLQUNqRztJQUVEOztPQUVHO0lBQ0gsNEJBQTRCLENBQUMsSUFBVztRQUN0QyxNQUFNLFVBQVUsR0FBRztZQUNqQixJQUFJLHlCQUFlLENBQUM7Z0JBQ2xCLE9BQU8sRUFBRTtvQkFDUCxHQUFHLDZCQUFxQjtvQkFDeEIsR0FBRyx1Q0FBK0I7aUJBQ25DO2dCQUNELFNBQVMsRUFBRSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7YUFDOUIsQ0FBQztZQUNGLElBQUkseUJBQWUsQ0FBQztnQkFDbEIsT0FBTyxFQUFFLDZCQUFxQjtnQkFDOUIsU0FBUyxFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQzthQUM1QixDQUFDO1NBQ0gsQ0FBQztRQUVGLE9BQU8sZUFBSyxDQUFDLGNBQWMsQ0FBQztZQUMxQixPQUFPLEVBQUUsSUFBSTtZQUNiLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztZQUMzQyxZQUFZLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7U0FDbkQsQ0FBQyxDQUFDO0tBQ0o7SUFFRDs7T0FFRztJQUNILE9BQU87UUFDTCxPQUFPO1lBQ0wsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLHNCQUFzQjtZQUNuRCxrQkFBa0IsRUFBRTtnQkFDbEIsd0JBQXdCLEVBQUU7b0JBQ3hCLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztvQkFDN0Isa0JBQWtCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLHNCQUFzQjtvQkFDbEUsdUJBQXVCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLHVCQUF1QjtvQkFDeEUsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLGdCQUFnQjtpQkFDM0Q7YUFDRjtTQUNGLENBQUM7S0FDSDtDQUNGO0FBOURELHNGQThEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IEdyYW50LCBQb2xpY3lTdGF0ZW1lbnQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB0eXBlIHsgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vY3JlZGVudGlhbC1wcm92aWRlcic7XG5pbXBvcnQgeyBDcmVkZW50aWFsUHJvdmlkZXJUeXBlIH0gZnJvbSAnLi9jcmVkZW50aWFsLXByb3ZpZGVyJztcbmltcG9ydCB7IEdBVEVXQVlfQVBJX0tFWV9QRVJNUywgR0FURVdBWV9XT1JLTE9BRF9JREVOVElUWV9QRVJNUywgR0FURVdBWV9TRUNSRVRTX1BFUk1TIH0gZnJvbSAnLi4vcGVybXMnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFQSSBLRVlcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cbi8qKlxuICogQVBJIEtleSBhZGRpdGlvbmFsIGNvbmZpZ3VyYXRpb25cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBBcGlLZXlBZGRpdGlvbmFsQ29uZmlndXJhdGlvbiB7XG5cbiAgLyoqXG4gICAqIFRoZSBuYW1lIG9mIHRoZSBjcmVkZW50aWFsIHBhcmFtZXRlciBmb3IgdGhlIEFQSSBrZXkuXG4gICAqIFRoaXMgcGFyYW1ldGVyIG5hbWUgaXMgdXNlZCB3aGVuIHNlbmRpbmcgdGhlIEFQSSBrZXkgdG8gdGhlIHRhcmdldCBlbmRwb2ludC5cbiAgICpcbiAgICogTGVuZ3RoIENvbnN0cmFpbnRzOiBNaW5pbXVtIGxlbmd0aCBvZiAxLiBNYXhpbXVtIGxlbmd0aCBvZiA2NC5cbiAgICogQGRlZmF1bHQgLSAnQXV0aG9yaXphdGlvbicgZm9yIEhFQURFUiwgJ2FwaV9rZXknIGZvciBRVUVSWV9QQVJBTUVURVJcbiAgICovXG4gIHJlYWRvbmx5IGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lPzogc3RyaW5nO1xuXG4gIC8qKlxuICAgKiBUaGUgcHJlZml4IGZvciB0aGUgQVBJIGtleSBjcmVkZW50aWFsLlxuICAgKiBUaGlzIHByZWZpeCBpcyBhZGRlZCB0byB0aGUgQVBJIGtleSB3aGVuIHNlbmRpbmcgaXQgdG8gdGhlIHRhcmdldCBlbmRwb2ludC5cbiAgICpcbiAgICogTGVuZ3RoIENvbnN0cmFpbnRzOiBNaW5pbXVtIGxlbmd0aCBvZiAxLiBNYXhpbXVtIGxlbmd0aCBvZiA2NC5cbiAgICogQGRlZmF1bHQgLSAnQmVhcmVyICcgZm9yIEhFQURFUiwgbm8gcHJlZml4IGZvciBRVUVSWV9QQVJBTUVURVJcbiAgICovXG4gIHJlYWRvbmx5IGNyZWRlbnRpYWxQcmVmaXg/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogQVBJIEtleSBjcmVkZW50aWFsIGxvY2F0aW9uIHR5cGVcbiAqIEBpbnRlcm5hbFxuICovXG5leHBvcnQgZW51bSBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb25UeXBlIHtcbiAgSEVBREVSID0gJ0hFQURFUicsXG4gIFFVRVJZX1BBUkFNRVRFUiA9ICdRVUVSWV9QQVJBTUVURVInLFxufVxuXG4vKipcbiAqIEFQSSBLZXkgbG9jYXRpb24gd2l0aGluIHRoZSByZXF1ZXN0XG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb24ge1xuICAvKipcbiAgICogQ3JlYXRlIGEgaGVhZGVyLWJhc2VkIEFQSSBrZXkgY3JlZGVudGlhbCBsb2NhdGlvblxuICAgKiBAcGFyYW0gY29uZmlnIC0gT3B0aW9uYWwgY29uZmlndXJhdGlvbiBmb3IgdGhlIGNyZWRlbnRpYWwgbG9jYXRpb25cbiAgICogQHJldHVybnMgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uIGNvbmZpZ3VyZWQgZm9yIGhlYWRlciBwbGFjZW1lbnRcbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgaGVhZGVyKGNvbmZpZz86IEFwaUtleUFkZGl0aW9uYWxDb25maWd1cmF0aW9uKSB7XG4gICAgcmV0dXJuIG5ldyBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb24oXG4gICAgICBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb25UeXBlLkhFQURFUixcbiAgICAgIGNvbmZpZz8uY3JlZGVudGlhbFBhcmFtZXRlck5hbWUgPz8gJ0F1dGhvcml6YXRpb24nLFxuICAgICAgY29uZmlnPy5jcmVkZW50aWFsUHJlZml4ID8/ICdCZWFyZXIgJyxcbiAgICApO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhIHF1ZXJ5IHBhcmFtZXRlci1iYXNlZCBBUEkga2V5IGNyZWRlbnRpYWwgbG9jYXRpb25cbiAgICogQHBhcmFtIGNvbmZpZyAtIE9wdGlvbmFsIGNvbmZpZ3VyYXRpb24gZm9yIHRoZSBjcmVkZW50aWFsIGxvY2F0aW9uXG4gICAqIEByZXR1cm5zIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbiBjb25maWd1cmVkIGZvciBxdWVyeSBwYXJhbWV0ZXIgcGxhY2VtZW50XG4gICAqL1xuICBwdWJsaWMgc3RhdGljIHF1ZXJ5UGFyYW1ldGVyKGNvbmZpZz86IEFwaUtleUFkZGl0aW9uYWxDb25maWd1cmF0aW9uKSB7XG4gICAgcmV0dXJuIG5ldyBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb24oXG4gICAgICBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb25UeXBlLlFVRVJZX1BBUkFNRVRFUixcbiAgICAgIGNvbmZpZz8uY3JlZGVudGlhbFBhcmFtZXRlck5hbWUgPz8gJ2FwaV9rZXknLFxuICAgICAgY29uZmlnPy5jcmVkZW50aWFsUHJlZml4LFxuICAgICk7XG4gIH1cblxuICAvKipcbiAgICogVGhlIG5hbWUgb2YgdGhlIGNyZWRlbnRpYWwgcGFyYW1ldGVyXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFBhcmFtZXRlck5hbWU6IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBwcmVmaXggZm9yIHRoZSBjcmVkZW50aWFsIHZhbHVlXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByZWZpeD86IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSB0eXBlIG9mIGNyZWRlbnRpYWwgbG9jYXRpb24gKEhFQURFUiBvciBRVUVSWV9QQVJBTUVURVIpXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbExvY2F0aW9uVHlwZTogc3RyaW5nO1xuXG4gIHByaXZhdGUgY29uc3RydWN0b3IoXG4gICAgY3JlZGVudGlhbExvY2F0aW9uVHlwZTogc3RyaW5nLFxuICAgIGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lOiBzdHJpbmcsXG4gICAgY3JlZGVudGlhbFByZWZpeD86IHN0cmluZyxcbiAgKSB7XG4gICAgdGhpcy5jcmVkZW50aWFsTG9jYXRpb25UeXBlID0gY3JlZGVudGlhbExvY2F0aW9uVHlwZTtcbiAgICB0aGlzLmNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lID0gY3JlZGVudGlhbFBhcmFtZXRlck5hbWU7XG4gICAgdGhpcy5jcmVkZW50aWFsUHJlZml4ID0gY3JlZGVudGlhbFByZWZpeDtcbiAgfVxufVxuXG4vKipcbiAqIEFQSSBLZXkgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXIgQVJOLlxuICAgKiBUaGlzIGlzIHJldHVybmVkIHdoZW4gY3JlYXRpbmcgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciB2aWEgQ29uc29sZSBvciBBUEkuXG4gICAqIEZvcm1hdDogYXJuOmF3czpiZWRyb2NrLWFnZW50Y29yZTpyZWdpb246YWNjb3VudDp0b2tlbi12YXVsdC9pZC9hcGlrZXljcmVkZW50aWFscHJvdmlkZXIvbmFtZVxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXJBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgU2VjcmV0cyBNYW5hZ2VyIHNlY3JldCBjb250YWluaW5nIHRoZSBBUEkga2V5LlxuICAgKiBUaGlzIGlzIHJldHVybmVkIHdoZW4gY3JlYXRpbmcgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciB2aWEgQ29uc29sZSBvciBBUEkuXG4gICAqIEZvcm1hdDogYXJuOmF3czpzZWNyZXRzbWFuYWdlcjpyZWdpb246YWNjb3VudDpzZWNyZXQ6bmFtZVxuICAgKi9cbiAgcmVhZG9ubHkgc2VjcmV0QXJuOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBsb2NhdGlvbiBvZiB0aGUgQVBJIGtleSBjcmVkZW50aWFsLlxuICAgKiBUaGlzIGZpZWxkIHNwZWNpZmllcyB3aGVyZSBpbiB0aGUgcmVxdWVzdCB0aGUgQVBJIGtleSBzaG91bGQgYmUgcGxhY2VkLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIEhFQURFUlxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbExvY2F0aW9uPzogQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uO1xufVxuXG4vKipcbiAqIEFQSSBLZXkgY3JlZGVudGlhbCBwcm92aWRlciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKiBDYW4gYmUgdXNlZCB3aXRoIE9wZW5BUEkgdGFyZ2V0c1xuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uIGltcGxlbWVudHMgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsUHJvdmlkZXJUeXBlID0gQ3JlZGVudGlhbFByb3ZpZGVyVHlwZS5BUElfS0VZO1xuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgQVBJIGtleSBwcm92aWRlclxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHByb3ZpZGVyQXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBTZWNyZXRzIE1hbmFnZXIgc2VjcmV0XG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgc2VjcmV0QXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgbG9jYXRpb24gY29uZmlndXJhdGlvbiBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbFxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxMb2NhdGlvbjogQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uO1xuXG4gIGNvbnN0cnVjdG9yKGNvbmZpZ3VyYXRpb246IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclByb3BzKSB7XG4gICAgdGhpcy5wcm92aWRlckFybiA9IGNvbmZpZ3VyYXRpb24ucHJvdmlkZXJBcm47XG4gICAgdGhpcy5zZWNyZXRBcm4gPSBjb25maWd1cmF0aW9uLnNlY3JldEFybjtcbiAgICB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbiA9IGNvbmZpZ3VyYXRpb24uY3JlZGVudGlhbExvY2F0aW9uID8/IEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbi5oZWFkZXIoKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgbmVlZGVkIHBlcm1pc3Npb25zIHRvIHRoZSByb2xlIGZvciBBUEkga2V5IGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBncmFudE5lZWRlZFBlcm1pc3Npb25zVG9Sb2xlKHJvbGU6IElSb2xlKTogR3JhbnQgfCB1bmRlZmluZWQge1xuICAgIGNvbnN0IHN0YXRlbWVudHMgPSBbXG4gICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgIC4uLkdBVEVXQVlfQVBJX0tFWV9QRVJNUyxcbiAgICAgICAgICAuLi5HQVRFV0FZX1dPUktMT0FEX0lERU5USVRZX1BFUk1TLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFt0aGlzLnByb3ZpZGVyQXJuXSxcbiAgICAgIH0pLFxuICAgICAgbmV3IFBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGFjdGlvbnM6IEdBVEVXQVlfU0VDUkVUU19QRVJNUyxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5zZWNyZXRBcm5dLFxuICAgICAgfSksXG4gICAgXTtcblxuICAgIHJldHVybiBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiByb2xlLFxuICAgICAgYWN0aW9uczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5hY3Rpb25zKSxcbiAgICAgIHJlc291cmNlQXJuczogc3RhdGVtZW50cy5mbGF0TWFwKHMgPT4gcy5yZXNvdXJjZXMpLFxuICAgIH0pO1xuICB9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXI6IHtcbiAgICAgICAgYXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyOiB7XG4gICAgICAgICAgcHJvdmlkZXJBcm46IHRoaXMucHJvdmlkZXJBcm4sXG4gICAgICAgICAgY3JlZGVudGlhbExvY2F0aW9uOiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsTG9jYXRpb25UeXBlLFxuICAgICAgICAgIGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lOiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsUGFyYW1ldGVyTmFtZSxcbiAgICAgICAgICBjcmVkZW50aWFsUHJlZml4OiB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbi5jcmVkZW50aWFsUHJlZml4LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9O1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBpLWtleS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImFwaS1rZXkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBbUU7QUFDbkUsaURBQTRDO0FBRTVDLCtEQUErRDtBQUUvRCxvQ0FBeUc7QUE2QnpHOzs7R0FHRztBQUNILElBQVksNEJBR1g7QUFIRCxXQUFZLDRCQUE0QjtJQUN0QyxpREFBaUIsQ0FBQTtJQUNqQixtRUFBbUMsQ0FBQTtBQUNyQyxDQUFDLEVBSFcsNEJBQTRCLDRDQUE1Qiw0QkFBNEIsUUFHdkM7QUFFRDs7R0FFRztBQUNILE1BQWEsd0JBQXdCOztJQUNuQzs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFzQzs7Ozs7Ozs7OztRQUN6RCxPQUFPLElBQUksd0JBQXdCLENBQ2pDLDRCQUE0QixDQUFDLE1BQU0sRUFDbkMsTUFBTSxFQUFFLHVCQUF1QixJQUFJLGVBQWUsRUFDbEQsTUFBTSxFQUFFLGdCQUFnQixJQUFJLFNBQVMsQ0FDdEMsQ0FBQztLQUNIO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxjQUFjLENBQUMsTUFBc0M7Ozs7Ozs7Ozs7UUFDakUsT0FBTyxJQUFJLHdCQUF3QixDQUNqQyw0QkFBNEIsQ0FBQyxlQUFlLEVBQzVDLE1BQU0sRUFBRSx1QkFBdUIsSUFBSSxTQUFTLEVBQzVDLE1BQU0sRUFBRSxnQkFBZ0IsQ0FDekIsQ0FBQztLQUNIO0lBRUQ7O09BRUc7SUFDYSx1QkFBdUIsQ0FBUztJQUNoRDs7T0FFRztJQUNhLGdCQUFnQixDQUFVO0lBQzFDOztPQUVHO0lBQ2Esc0JBQXNCLENBQVM7SUFFL0MsWUFDRSxzQkFBOEIsRUFDOUIsdUJBQStCLEVBQy9CLGdCQUF5QjtRQUV6QixJQUFJLENBQUMsc0JBQXNCLEdBQUcsc0JBQXNCLENBQUM7UUFDckQsSUFBSSxDQUFDLHVCQUF1QixHQUFHLHVCQUF1QixDQUFDO1FBQ3ZELElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQztLQUMxQzs7QUFoREgsNERBaURDO0FBK0JEOzs7O0dBSUc7QUFDSCxNQUFhLHFDQUFxQztJQUNoQyxzQkFBc0IsR0FBRyw0Q0FBc0IsQ0FBQyxPQUFPLENBQUM7SUFDeEU7O09BRUc7SUFDYSxXQUFXLENBQVM7SUFDcEM7O09BRUc7SUFDYSxTQUFTLENBQVM7SUFDbEM7O09BRUc7SUFDYSxrQkFBa0IsQ0FBMkI7SUFFN0QsWUFBWSxhQUE0QztRQUN0RCxJQUFJLENBQUMsV0FBVyxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUM7UUFDN0MsSUFBSSxDQUFDLFNBQVMsR0FBRyxhQUFhLENBQUMsU0FBUyxDQUFDO1FBQ3pDLElBQUksQ0FBQyxrQkFBa0IsR0FBRyxhQUFhLENBQUMsa0JBQWtCLElBQUksd0JBQXdCLENBQUMsTUFBTSxFQUFFLENBQUM7S0FDakc7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSCw0QkFBNEIsQ0FBQyxPQUFpQjtRQUM1QyxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNoQyxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ25DLE9BQU8sRUFBRSxtQkFBbUI7WUFDNUIsUUFBUSxFQUFFLDZCQUE2QjtZQUN2QyxZQUFZLEVBQUUsU0FBUztZQUN2QixTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7U0FDekMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxtQkFBbUIsR0FBRyxHQUFHLFlBQVksc0JBQXNCLE9BQU8sQ0FBQyxJQUFJLElBQUksQ0FBQztRQUNsRixNQUFNLGFBQWEsR0FBRyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ3BDLE9BQU8sRUFBRSxtQkFBbUI7WUFDNUIsUUFBUSxFQUFFLGFBQWE7WUFDdkIsWUFBWSxFQUFFLFNBQVM7WUFDdkIsU0FBUyxFQUFFLHVCQUFTLENBQUMsbUJBQW1CO1NBQ3pDLENBQUMsQ0FBQztRQUVILE1BQU0scUJBQXFCLEdBQUcsZUFBSyxDQUFDLGNBQWMsQ0FBQztZQUNqRCxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDckIsT0FBTyxFQUFFLENBQUMsR0FBRyx1Q0FBK0IsQ0FBQztZQUM3QyxZQUFZLEVBQUUsQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLENBQUM7WUFDakQsS0FBSyxFQUFFLE9BQU87U0FDZixDQUFDLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxlQUFLLENBQUMsY0FBYyxDQUFDO1lBQ3ZDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNyQixPQUFPLEVBQUUsQ0FBQyxHQUFHLDZCQUFxQixDQUFDO1lBQ25DLFlBQVksRUFBRSxDQUFDLGFBQWEsRUFBRSxJQUFJLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxtQkFBbUIsQ0FBQztZQUNsRixLQUFLLEVBQUUsT0FBTztTQUNmLENBQUMsQ0FBQztRQUNILDhFQUE4RTtRQUM5RSw2RUFBNkU7UUFDN0UsK0VBQStFO1FBQy9FLHdFQUF3RTtRQUN4RSxtQ0FBbUM7UUFDbkMsSUFBSSxrQkFBNEIsQ0FBQztRQUNqQyxJQUFJLG1CQUFLLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3ZDLHlCQUFXLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFlBQVksQ0FDbEMsNkRBQTZELEVBQzdELGlIQUFpSDtnQkFDakgsaUdBQWlHLENBQ2xHLENBQUM7WUFDRixrQkFBa0IsR0FBRyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7b0JBQ3BDLE9BQU8sRUFBRSxnQkFBZ0I7b0JBQ3pCLFFBQVEsRUFBRSxRQUFRO29CQUNsQixZQUFZLEVBQUUsOEJBQThCO29CQUM1QyxTQUFTLEVBQUUsdUJBQVMsQ0FBQyxtQkFBbUI7aUJBQ3pDLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQzthQUFNLENBQUM7WUFDTixrQkFBa0IsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN4QyxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsZUFBSyxDQUFDLGNBQWMsQ0FBQztZQUN2QyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUk7WUFDckIsT0FBTyxFQUFFLENBQUMsR0FBRyw2QkFBcUIsQ0FBQztZQUNuQyxZQUFZLEVBQUUsa0JBQWtCO1lBQ2hDLEtBQUssRUFBRSxPQUFPO1NBQ2YsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0tBQ3hFO0lBRUQ7O09BRUc7SUFDSCxPQUFPO1FBQ0wsT0FBTztZQUNMLHNCQUFzQixFQUFFLElBQUksQ0FBQyxzQkFBc0I7WUFDbkQsa0JBQWtCLEVBQUU7Z0JBQ2xCLHdCQUF3QixFQUFFO29CQUN4QixXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7b0JBQzdCLGtCQUFrQixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxzQkFBc0I7b0JBQ2xFLHVCQUF1QixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyx1QkFBdUI7b0JBQ3hFLGdCQUFnQixFQUFFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxnQkFBZ0I7aUJBQzNEO2FBQ0Y7U0FDRixDQUFDO0tBQ0g7Q0FDRjtBQXpHRCxzRkF5R0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBBbm5vdGF0aW9ucywgQXJuRm9ybWF0LCBTdGFjaywgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBHcmFudCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHR5cGUgeyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIH0gZnJvbSAnLi9jcmVkZW50aWFsLXByb3ZpZGVyJztcbmltcG9ydCB7IENyZWRlbnRpYWxQcm92aWRlclR5cGUgfSBmcm9tICcuL2NyZWRlbnRpYWwtcHJvdmlkZXInO1xuaW1wb3J0IHR5cGUgeyBJR2F0ZXdheSB9IGZyb20gJy4uL2dhdGV3YXktYmFzZSc7XG5pbXBvcnQgeyBHQVRFV0FZX0FQSV9LRVlfUEVSTVMsIEdBVEVXQVlfV09SS0xPQURfSURFTlRJVFlfUEVSTVMsIEdBVEVXQVlfU0VDUkVUU19QRVJNUyB9IGZyb20gJy4uL3Blcm1zJztcblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBUEkgS0VZXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIEFQSSBLZXkgYWRkaXRpb25hbCBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQXBpS2V5QWRkaXRpb25hbENvbmZpZ3VyYXRpb24ge1xuXG4gIC8qKlxuICAgKiBUaGUgbmFtZSBvZiB0aGUgY3JlZGVudGlhbCBwYXJhbWV0ZXIgZm9yIHRoZSBBUEkga2V5LlxuICAgKiBUaGlzIHBhcmFtZXRlciBuYW1lIGlzIHVzZWQgd2hlbiBzZW5kaW5nIHRoZSBBUEkga2V5IHRvIHRoZSB0YXJnZXQgZW5kcG9pbnQuXG4gICAqXG4gICAqIExlbmd0aCBDb25zdHJhaW50czogTWluaW11bSBsZW5ndGggb2YgMS4gTWF4aW11bSBsZW5ndGggb2YgNjQuXG4gICAqIEBkZWZhdWx0IC0gJ0F1dGhvcml6YXRpb24nIGZvciBIRUFERVIsICdhcGlfa2V5JyBmb3IgUVVFUllfUEFSQU1FVEVSXG4gICAqL1xuICByZWFkb25seSBjcmVkZW50aWFsUGFyYW1ldGVyTmFtZT86IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIHByZWZpeCBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbC5cbiAgICogVGhpcyBwcmVmaXggaXMgYWRkZWQgdG8gdGhlIEFQSSBrZXkgd2hlbiBzZW5kaW5nIGl0IHRvIHRoZSB0YXJnZXQgZW5kcG9pbnQuXG4gICAqXG4gICAqIExlbmd0aCBDb25zdHJhaW50czogTWluaW11bSBsZW5ndGggb2YgMS4gTWF4aW11bSBsZW5ndGggb2YgNjQuXG4gICAqIEBkZWZhdWx0IC0gJ0JlYXJlciAnIGZvciBIRUFERVIsIG5vIHByZWZpeCBmb3IgUVVFUllfUEFSQU1FVEVSXG4gICAqL1xuICByZWFkb25seSBjcmVkZW50aWFsUHJlZml4Pzogc3RyaW5nO1xufVxuXG4vKipcbiAqIEFQSSBLZXkgY3JlZGVudGlhbCBsb2NhdGlvbiB0eXBlXG4gKiBAaW50ZXJuYWxcbiAqL1xuZXhwb3J0IGVudW0gQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uVHlwZSB7XG4gIEhFQURFUiA9ICdIRUFERVInLFxuICBRVUVSWV9QQVJBTUVURVIgPSAnUVVFUllfUEFSQU1FVEVSJyxcbn1cblxuLyoqXG4gKiBBUEkgS2V5IGxvY2F0aW9uIHdpdGhpbiB0aGUgcmVxdWVzdFxuICovXG5leHBvcnQgY2xhc3MgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uIHtcbiAgLyoqXG4gICAqIENyZWF0ZSBhIGhlYWRlci1iYXNlZCBBUEkga2V5IGNyZWRlbnRpYWwgbG9jYXRpb25cbiAgICogQHBhcmFtIGNvbmZpZyAtIE9wdGlvbmFsIGNvbmZpZ3VyYXRpb24gZm9yIHRoZSBjcmVkZW50aWFsIGxvY2F0aW9uXG4gICAqIEByZXR1cm5zIEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbiBjb25maWd1cmVkIGZvciBoZWFkZXIgcGxhY2VtZW50XG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGhlYWRlcihjb25maWc/OiBBcGlLZXlBZGRpdGlvbmFsQ29uZmlndXJhdGlvbikge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uKFxuICAgICAgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uVHlwZS5IRUFERVIsXG4gICAgICBjb25maWc/LmNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lID8/ICdBdXRob3JpemF0aW9uJyxcbiAgICAgIGNvbmZpZz8uY3JlZGVudGlhbFByZWZpeCA/PyAnQmVhcmVyICcsXG4gICAgKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBDcmVhdGUgYSBxdWVyeSBwYXJhbWV0ZXItYmFzZWQgQVBJIGtleSBjcmVkZW50aWFsIGxvY2F0aW9uXG4gICAqIEBwYXJhbSBjb25maWcgLSBPcHRpb25hbCBjb25maWd1cmF0aW9uIGZvciB0aGUgY3JlZGVudGlhbCBsb2NhdGlvblxuICAgKiBAcmV0dXJucyBBcGlLZXlDcmVkZW50aWFsTG9jYXRpb24gY29uZmlndXJlZCBmb3IgcXVlcnkgcGFyYW1ldGVyIHBsYWNlbWVudFxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBxdWVyeVBhcmFtZXRlcihjb25maWc/OiBBcGlLZXlBZGRpdGlvbmFsQ29uZmlndXJhdGlvbikge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uKFxuICAgICAgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uVHlwZS5RVUVSWV9QQVJBTUVURVIsXG4gICAgICBjb25maWc/LmNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lID8/ICdhcGlfa2V5JyxcbiAgICAgIGNvbmZpZz8uY3JlZGVudGlhbFByZWZpeCxcbiAgICApO1xuICB9XG5cbiAgLyoqXG4gICAqIFRoZSBuYW1lIG9mIHRoZSBjcmVkZW50aWFsIHBhcmFtZXRlclxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgcHJlZml4IGZvciB0aGUgY3JlZGVudGlhbCB2YWx1ZVxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxQcmVmaXg/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiBjcmVkZW50aWFsIGxvY2F0aW9uIChIRUFERVIgb3IgUVVFUllfUEFSQU1FVEVSKVxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxMb2NhdGlvblR5cGU6IHN0cmluZztcblxuICBwcml2YXRlIGNvbnN0cnVjdG9yKFxuICAgIGNyZWRlbnRpYWxMb2NhdGlvblR5cGU6IHN0cmluZyxcbiAgICBjcmVkZW50aWFsUGFyYW1ldGVyTmFtZTogc3RyaW5nLFxuICAgIGNyZWRlbnRpYWxQcmVmaXg/OiBzdHJpbmcsXG4gICkge1xuICAgIHRoaXMuY3JlZGVudGlhbExvY2F0aW9uVHlwZSA9IGNyZWRlbnRpYWxMb2NhdGlvblR5cGU7XG4gICAgdGhpcy5jcmVkZW50aWFsUGFyYW1ldGVyTmFtZSA9IGNyZWRlbnRpYWxQYXJhbWV0ZXJOYW1lO1xuICAgIHRoaXMuY3JlZGVudGlhbFByZWZpeCA9IGNyZWRlbnRpYWxQcmVmaXg7XG4gIH1cbn1cblxuLyoqXG4gKiBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXIgQVJOcyBmb3IgZ2F0ZXdheSBvdXRib3VuZCBhdXRoIChUb2tlbiBWYXVsdCBpZGVudGl0eSkuXG4gKlxuICogUGFzcyB0aGlzIHRvIHtAbGluayBHYXRld2F5Q3JlZGVudGlhbFByb3ZpZGVyLmZyb21BcGlLZXlJZGVudGl0eUFybn0gb3IgdG8ge0BsaW5rIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb259LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclByb3BzIHtcbiAgLyoqXG4gICAqIFRoZSBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXIgQVJOLlxuICAgKiBUaGlzIGlzIHJldHVybmVkIHdoZW4gY3JlYXRpbmcgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciB2aWEgQ29uc29sZSBvciBBUEkuXG4gICAqIEZvcm1hdDogYXJuOmF3czpiZWRyb2NrLWFnZW50Y29yZTpyZWdpb246YWNjb3VudDp0b2tlbi12YXVsdC9pZC9hcGlrZXljcmVkZW50aWFscHJvdmlkZXIvbmFtZVxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXJBcm46IHN0cmluZztcblxuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgU2VjcmV0cyBNYW5hZ2VyIHNlY3JldCBjb250YWluaW5nIHRoZSBBUEkga2V5LlxuICAgKiBUaGlzIGlzIHJldHVybmVkIHdoZW4gY3JlYXRpbmcgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciB2aWEgQ29uc29sZSBvciBBUEkuXG4gICAqIEZvcm1hdDogYXJuOmF3czpzZWNyZXRzbWFuYWdlcjpyZWdpb246YWNjb3VudDpzZWNyZXQ6bmFtZVxuICAgKi9cbiAgcmVhZG9ubHkgc2VjcmV0QXJuOiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBsb2NhdGlvbiBvZiB0aGUgQVBJIGtleSBjcmVkZW50aWFsLlxuICAgKiBUaGlzIGZpZWxkIHNwZWNpZmllcyB3aGVyZSBpbiB0aGUgcmVxdWVzdCB0aGUgQVBJIGtleSBzaG91bGQgYmUgcGxhY2VkLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIEhFQURFUlxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbExvY2F0aW9uPzogQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uO1xufVxuXG4vKipcbiAqIEFQSSBLZXkgY3JlZGVudGlhbCBwcm92aWRlciBjb25maWd1cmF0aW9uIGltcGxlbWVudGF0aW9uXG4gKiBDYW4gYmUgdXNlZCB3aXRoIE9wZW5BUEkgdGFyZ2V0c1xuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBjbGFzcyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uIGltcGxlbWVudHMgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gIHB1YmxpYyByZWFkb25seSBjcmVkZW50aWFsUHJvdmlkZXJUeXBlID0gQ3JlZGVudGlhbFByb3ZpZGVyVHlwZS5BUElfS0VZO1xuICAvKipcbiAgICogVGhlIEFSTiBvZiB0aGUgQVBJIGtleSBwcm92aWRlclxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHByb3ZpZGVyQXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgQVJOIG9mIHRoZSBTZWNyZXRzIE1hbmFnZXIgc2VjcmV0XG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgc2VjcmV0QXJuOiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgbG9jYXRpb24gY29uZmlndXJhdGlvbiBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbFxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGNyZWRlbnRpYWxMb2NhdGlvbjogQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uO1xuXG4gIGNvbnN0cnVjdG9yKGNvbmZpZ3VyYXRpb246IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlclByb3BzKSB7XG4gICAgdGhpcy5wcm92aWRlckFybiA9IGNvbmZpZ3VyYXRpb24ucHJvdmlkZXJBcm47XG4gICAgdGhpcy5zZWNyZXRBcm4gPSBjb25maWd1cmF0aW9uLnNlY3JldEFybjtcbiAgICB0aGlzLmNyZWRlbnRpYWxMb2NhdGlvbiA9IGNvbmZpZ3VyYXRpb24uY3JlZGVudGlhbExvY2F0aW9uID8/IEFwaUtleUNyZWRlbnRpYWxMb2NhdGlvbi5oZWFkZXIoKTtcbiAgfVxuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgbmVlZGVkIHBlcm1pc3Npb25zIHRvIHRoZSBnYXRld2F5IHJvbGUgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb24uXG4gICAqXG4gICAqIFByb2R1Y2VzIHRocmVlIHNjb3BlZCBJQU0gc3RhdGVtZW50cyBtYXRjaGluZyB0aGUgY29uc29sZS1nZW5lcmF0ZWQgcG9saWN5OlxuICAgKiAxLiBgR2V0V29ya2xvYWRBY2Nlc3NUb2tlbmAgb24gdGhlIHdvcmtsb2FkIGlkZW50aXR5IGRpcmVjdG9yeSBBUk5zXG4gICAqIDIuIGBHZXRSZXNvdXJjZUFwaUtleWAgb24gdGhlIHRva2VuIHZhdWx0LCBjcmVkZW50aWFsIHByb3ZpZGVyLCBkaXJlY3RvcnksIGFuZCBpZGVudGl0eSBBUk5zXG4gICAqIDMuIGBzZWNyZXRzbWFuYWdlcjpHZXRTZWNyZXRWYWx1ZWAgb24gdGhlIHNwZWNpZmljIGNyZWRlbnRpYWwgc2VjcmV0IEFSTlxuICAgKlxuICAgKiBAc2VlIGh0dHBzOi8vZG9jcy5hd3MuYW1hem9uLmNvbS9iZWRyb2NrLWFnZW50Y29yZS9sYXRlc3QvZGV2Z3VpZGUvZ2F0ZXdheS1vdXRib3VuZC1hdXRoLmh0bWxcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUoZ2F0ZXdheTogSUdhdGV3YXkpOiBHcmFudCB8IHVuZGVmaW5lZCB7XG4gICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZihnYXRld2F5KTtcbiAgICBjb25zdCBkaXJlY3RvcnlBcm4gPSBzdGFjay5mb3JtYXRBcm4oe1xuICAgICAgc2VydmljZTogJ2JlZHJvY2stYWdlbnRjb3JlJyxcbiAgICAgIHJlc291cmNlOiAnd29ya2xvYWQtaWRlbnRpdHktZGlyZWN0b3J5JyxcbiAgICAgIHJlc291cmNlTmFtZTogJ2RlZmF1bHQnLFxuICAgICAgYXJuRm9ybWF0OiBBcm5Gb3JtYXQuU0xBU0hfUkVTT1VSQ0VfTkFNRSxcbiAgICB9KTtcbiAgICBjb25zdCBpZGVudGl0eVdpbGRjYXJkQXJuID0gYCR7ZGlyZWN0b3J5QXJufS93b3JrbG9hZC1pZGVudGl0eS8ke2dhdGV3YXkubmFtZX0tKmA7XG4gICAgY29uc3QgdG9rZW5WYXVsdEFybiA9IHN0YWNrLmZvcm1hdEFybih7XG4gICAgICBzZXJ2aWNlOiAnYmVkcm9jay1hZ2VudGNvcmUnLFxuICAgICAgcmVzb3VyY2U6ICd0b2tlbi12YXVsdCcsXG4gICAgICByZXNvdXJjZU5hbWU6ICdkZWZhdWx0JyxcbiAgICAgIGFybkZvcm1hdDogQXJuRm9ybWF0LlNMQVNIX1JFU09VUkNFX05BTUUsXG4gICAgfSk7XG5cbiAgICBjb25zdCB3b3JrbG9hZElkZW50aXR5R3JhbnQgPSBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiBnYXRld2F5LnJvbGUsXG4gICAgICBhY3Rpb25zOiBbLi4uR0FURVdBWV9XT1JLTE9BRF9JREVOVElUWV9QRVJNU10sXG4gICAgICByZXNvdXJjZUFybnM6IFtkaXJlY3RvcnlBcm4sIGlkZW50aXR5V2lsZGNhcmRBcm5dLFxuICAgICAgc2NvcGU6IGdhdGV3YXksXG4gICAgfSk7XG4gICAgY29uc3QgYXBpS2V5R3JhbnQgPSBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiBnYXRld2F5LnJvbGUsXG4gICAgICBhY3Rpb25zOiBbLi4uR0FURVdBWV9BUElfS0VZX1BFUk1TXSxcbiAgICAgIHJlc291cmNlQXJuczogW3Rva2VuVmF1bHRBcm4sIHRoaXMucHJvdmlkZXJBcm4sIGRpcmVjdG9yeUFybiwgaWRlbnRpdHlXaWxkY2FyZEFybl0sXG4gICAgICBzY29wZTogZ2F0ZXdheSxcbiAgICB9KTtcbiAgICAvLyBUaGUgQ0ZOIGF0dHJpYnV0ZSBBcGlLZXlTZWNyZXRBcm4gaXMgYW4gb2JqZWN0IHsgU2VjcmV0QXJuOiBzdHJpbmcgfSwgbm90IGFcbiAgICAvLyBwbGFpbiBzdHJpbmcsIHNvIHRoZSBUb2tlbiByZXNvbHZlcyB0byBhbiBvYmplY3Qgd2hpY2ggY2Fubm90IGJlIHBsYWNlZCBpblxuICAgIC8vIElBTSBSZXNvdXJjZSBmaWVsZHMuIFdoZW4gdGhlIGNhbGxlciBzdXBwbGllcyBhIGxpdGVyYWwgQVJOIHN0cmluZyAoZS5nLiB2aWFcbiAgICAvLyBmcm9tQXBpS2V5SWRlbnRpdHlBcm4pIHdlIGNhbiBzY29wZSB0aWdodGx5OyBvdGhlcndpc2UgZmFsbCBiYWNrIHRvIGFcbiAgICAvLyBzZXJ2aWNlLW1hbmFnZWQgcHJlZml4IHdpbGRjYXJkLlxuICAgIGxldCBzZWNyZXRSZXNvdXJjZUFybnM6IHN0cmluZ1tdO1xuICAgIGlmIChUb2tlbi5pc1VucmVzb2x2ZWQodGhpcy5zZWNyZXRBcm4pKSB7XG4gICAgICBBbm5vdGF0aW9ucy5vZihnYXRld2F5KS5hZGRXYXJuaW5nVjIoXG4gICAgICAgICdAYXdzLWNkay9hd3MtYmVkcm9jay1hZ2VudGNvcmUtYWxwaGE6d2lsZGNhcmRTZWNyZXRBcm5HcmFudCcsXG4gICAgICAgICdUaGUgc2VjcmV0IEFSTiBpcyBhbiB1bnJlc29sdmVkIHRva2VuLiBHcmFudGluZyBhY2Nlc3MgdXNpbmcgYSB3aWxkY2FyZCBwcmVmaXggKGJlZHJvY2stYWdlbnRjb3JlLWlkZW50aXR5ISopLiAnICtcbiAgICAgICAgJ1RvIHNjb3BlIHRoZSBncmFudCB0byBhIHNwZWNpZmljIHNlY3JldCwgc3VwcGx5IGEgbGl0ZXJhbCBzZWNyZXQgQVJOIHZpYSBmcm9tQXBpS2V5SWRlbnRpdHlBcm4uJyxcbiAgICAgICk7XG4gICAgICBzZWNyZXRSZXNvdXJjZUFybnMgPSBbc3RhY2suZm9ybWF0QXJuKHtcbiAgICAgICAgc2VydmljZTogJ3NlY3JldHNtYW5hZ2VyJyxcbiAgICAgICAgcmVzb3VyY2U6ICdzZWNyZXQnLFxuICAgICAgICByZXNvdXJjZU5hbWU6ICdiZWRyb2NrLWFnZW50Y29yZS1pZGVudGl0eSEqJyxcbiAgICAgICAgYXJuRm9ybWF0OiBBcm5Gb3JtYXQuQ09MT05fUkVTT1VSQ0VfTkFNRSxcbiAgICAgIH0pXTtcbiAgICB9IGVsc2Uge1xuICAgICAgc2VjcmV0UmVzb3VyY2VBcm5zID0gW3RoaXMuc2VjcmV0QXJuXTtcbiAgICB9XG4gICAgY29uc3Qgc2VjcmV0R3JhbnQgPSBHcmFudC5hZGRUb1ByaW5jaXBhbCh7XG4gICAgICBncmFudGVlOiBnYXRld2F5LnJvbGUsXG4gICAgICBhY3Rpb25zOiBbLi4uR0FURVdBWV9TRUNSRVRTX1BFUk1TXSxcbiAgICAgIHJlc291cmNlQXJuczogc2VjcmV0UmVzb3VyY2VBcm5zLFxuICAgICAgc2NvcGU6IGdhdGV3YXksXG4gICAgfSk7XG4gICAgcmV0dXJuIHdvcmtsb2FkSWRlbnRpdHlHcmFudC5jb21iaW5lKGFwaUtleUdyYW50KS5jb21iaW5lKHNlY3JldEdyYW50KTtcbiAgfVxuXG4gIC8qKlxuICAgKiBAaW50ZXJuYWxcbiAgICovXG4gIF9yZW5kZXIoKTogYW55IHtcbiAgICByZXR1cm4ge1xuICAgICAgY3JlZGVudGlhbFByb3ZpZGVyVHlwZTogdGhpcy5jcmVkZW50aWFsUHJvdmlkZXJUeXBlLFxuICAgICAgY3JlZGVudGlhbFByb3ZpZGVyOiB7XG4gICAgICAgIGFwaUtleUNyZWRlbnRpYWxQcm92aWRlcjoge1xuICAgICAgICAgIHByb3ZpZGVyQXJuOiB0aGlzLnByb3ZpZGVyQXJuLFxuICAgICAgICAgIGNyZWRlbnRpYWxMb2NhdGlvbjogdGhpcy5jcmVkZW50aWFsTG9jYXRpb24uY3JlZGVudGlhbExvY2F0aW9uVHlwZSxcbiAgICAgICAgICBjcmVkZW50aWFsUGFyYW1ldGVyTmFtZTogdGhpcy5jcmVkZW50aWFsTG9jYXRpb24uY3JlZGVudGlhbFBhcmFtZXRlck5hbWUsXG4gICAgICAgICAgY3JlZGVudGlhbFByZWZpeDogdGhpcy5jcmVkZW50aWFsTG9jYXRpb24uY3JlZGVudGlhbFByZWZpeCxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfTtcbiAgfVxufVxuIl19

package/lib/gateway/outbound-auth/credential-provider.d.ts

@@ -1,8 +1,11 @@
 import type { IResolvable } from 'aws-cdk-lib';
 import type { CfnGatewayTarget } from 'aws-cdk-lib/aws-bedrockagentcore';
-import type { Grant, IRole } from 'aws-cdk-lib/aws-iam';
-import type { ApiKeyCredentialProviderProps } from './api-key';
+import type { Grant } from 'aws-cdk-lib/aws-iam';
+import type { ApiKeyCredentialLocation, ApiKeyCredentialProviderProps } from './api-key';
 import type { OAuthConfiguration } from './oauth';
+import type { IApiKeyCredentialProvider } from '../../identity/api-key-credential-provider';
+import type { IOAuth2CredentialProvider } from '../../identity/oauth2-credential-provider';
+import type { IGateway } from '../gateway-base';
 /******************************************************************************
  *                                 Enums
  *****************************************************************************/
@@ -40,14 +43,49 @@ export interface ICredentialProviderConfig {
      */
     _render(): CfnGatewayTarget.CredentialProviderConfigurationProperty | IResolvable;
     /**
-     * Grant the role the permissions
+     * Grant the gateway's execution role the permissions needed for outbound authentication.
+     * @param gateway The gateway whose role needs outbound auth permissions [disable-awslint:prefer-ref-interface]
      */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    grantNeededPermissionsToRole(gateway: IGateway): Grant | undefined;
+}
+/**
+ * Optional gateway settings when binding an {@link IApiKeyCredentialProvider} to a target.
+ */
+export interface FromApiKeyIdentityOptions {
+    /**
+     * Where to place the API key on outbound requests.
+     *
+     * @default header `Authorization` with `Bearer ` prefix
+     */
+    readonly credentialLocation?: ApiKeyCredentialLocation;
+}
+/**
+ * OAuth scopes (and optional custom parameters) when binding an {@link IOAuth2CredentialProvider} to a gateway target.
+ */
+export interface FromOauthIdentityOptions {
+    /**
+     * OAuth scopes the gateway should request for this target.
+     */
+    readonly scopes: string[];
+    /**
+     * Additional OAuth parameters for the provider.
+     *
+     * @default - none
+     */
+    readonly customParameters?: {
+        [key: string]: string;
+    };
 }
 /**
  * Factory class for creating different Gateway Credential Providers
  */
 export declare abstract class GatewayCredentialProvider {
+    /**
+     * Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.
+     *
+     * Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.
+     */
+    static fromApiKeyIdentity(provider: IApiKeyCredentialProvider, options?: FromApiKeyIdentityOptions): ICredentialProviderConfig;
     /**
      * Create an API key credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string
@@ -55,6 +93,12 @@ export declare abstract class GatewayCredentialProvider {
      * @returns ICredentialProviderConfig configured for API key authentication
      */
     static fromApiKeyIdentityArn(props: ApiKeyCredentialProviderProps): ICredentialProviderConfig;
+    /**
+     * Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.
+     *
+     * Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.
+     */
+    static fromOauthIdentity(provider: IOAuth2CredentialProvider, options: FromOauthIdentityOptions): ICredentialProviderConfig;
     /**
      * Create an OAuth credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string

package/lib/gateway/outbound-auth/credential-provider.js

@@ -31,7 +31,30 @@ var CredentialProviderType;
  * Factory class for creating different Gateway Credential Providers
  */
 class GatewayCredentialProvider {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.253.1-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-bedrock-agentcore-alpha.GatewayCredentialProvider", version: "2.255.0-alpha.0" };
+    /**
+     * Create an API key outbound auth configuration from a Token Vault {@link IApiKeyCredentialProvider} construct.
+     *
+     * Prefer this over {@link GatewayCredentialProvider.fromApiKeyIdentityArn} when the provider is defined in CDK.
+     */
+    static fromApiKeyIdentity(provider, options = {}) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_IApiKeyCredentialProvider(provider);
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_FromApiKeyIdentityOptions(options);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.fromApiKeyIdentity);
+            }
+            throw error;
+        }
+        const binding = provider.bindForGatewayApiKeyTarget();
+        return new api_key_1.ApiKeyCredentialProviderConfiguration({
+            providerArn: binding.providerArn,
+            secretArn: binding.secretArn,
+            credentialLocation: options.credentialLocation,
+        });
+    }
     /**
      * Create an API key credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string
@@ -50,6 +73,30 @@ class GatewayCredentialProvider {
         }
         return new api_key_1.ApiKeyCredentialProviderConfiguration(props);
     }
+    /**
+     * Create an OAuth outbound auth configuration from a Token Vault {@link IOAuth2CredentialProvider} construct.
+     *
+     * Prefer this over {@link GatewayCredentialProvider.fromOauthIdentityArn} when the provider is defined in CDK.
+     */
+    static fromOauthIdentity(provider, options) {
+        try {
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_IOAuth2CredentialProvider(provider);
+            jsiiDeprecationWarnings._aws_cdk_aws_bedrock_agentcore_alpha_FromOauthIdentityOptions(options);
+        }
+        catch (error) {
+            if (process.env.JSII_DEBUG !== "1" && error.name === "DeprecationError") {
+                Error.captureStackTrace(error, this.fromOauthIdentity);
+            }
+            throw error;
+        }
+        const binding = provider.bindForGatewayOAuthTarget(options.scopes, options.customParameters);
+        return new oauth_1.OAuthCredentialProviderConfiguration({
+            providerArn: binding.providerArn,
+            secretArn: binding.secretArn,
+            scopes: binding.scopes,
+            customParameters: binding.customParameters,
+        });
+    }
     /**
      * Create an OAuth credential provider from Identity ARN
      * Use this method when you have the Identity ARN as a string
@@ -77,4 +124,4 @@ class GatewayCredentialProvider {
     }
 }
 exports.GatewayCredentialProvider = GatewayCredentialProvider;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1wcm92aWRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNyZWRlbnRpYWwtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFJQSx1Q0FBa0U7QUFDbEUseUNBQW9FO0FBRXBFLG1DQUErRDtBQUUvRDs7K0VBRStFO0FBQy9FOztHQUVHO0FBQ0gsSUFBWSxzQkFlWDtBQWZELFdBQVksc0JBQXNCO0lBQ2hDOztPQUVHO0lBQ0gsNkNBQW1CLENBQUE7SUFFbkI7O09BRUc7SUFDSCx5Q0FBZSxDQUFBO0lBRWY7O09BRUc7SUFDSCwrREFBcUMsQ0FBQTtBQUN2QyxDQUFDLEVBZlcsc0JBQXNCLHNDQUF0QixzQkFBc0IsUUFlakM7QUEyQkQ7O0dBRUc7QUFDSCxNQUFzQix5QkFBeUI7O0lBQzdDOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLHFCQUFxQixDQUFDLEtBQW9DOzs7Ozs7Ozs7O1FBQ3RFLE9BQU8sSUFBSSwrQ0FBcUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN6RDtJQUVEOzs7OztPQUtHO0lBQ0ksTUFBTSxDQUFDLG9CQUFvQixDQUFDLEtBQXlCOzs7Ozs7Ozs7O1FBQzFELE9BQU8sSUFBSSw0Q0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztLQUN4RDtJQUVEOzs7T0FHRztJQUNJLE1BQU0sQ0FBQyxXQUFXO1FBQ3ZCLE9BQU8sSUFBSSxpREFBc0MsRUFBRSxDQUFDO0tBQ3JEOztBQTNCSCw4REE0QkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgdHlwZSB7IElSZXNvbHZhYmxlIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBDZm5HYXRld2F5VGFyZ2V0IH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWJlZHJvY2thZ2VudGNvcmUnO1xuaW1wb3J0IHR5cGUgeyBHcmFudCwgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB0eXBlIHsgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUHJvcHMgfSBmcm9tICcuL2FwaS1rZXknO1xuaW1wb3J0IHsgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbiB9IGZyb20gJy4vYXBpLWtleSc7XG5pbXBvcnQgeyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB9IGZyb20gJy4vaWFtLXJvbGUnO1xuaW1wb3J0IHR5cGUgeyBPQXV0aENvbmZpZ3VyYXRpb24gfSBmcm9tICcuL29hdXRoJztcbmltcG9ydCB7IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbiB9IGZyb20gJy4vb2F1dGgnO1xuXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVudW1zXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG4vKipcbiAqIENyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZXMgc3VwcG9ydGVkIGJ5IGdhdGV3YXkgdGFyZ2V0XG4gKi9cbmV4cG9ydCBlbnVtIENyZWRlbnRpYWxQcm92aWRlclR5cGUge1xuICAvKipcbiAgICogQVBJIEtleSBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgQVBJX0tFWSA9ICdBUElfS0VZJyxcblxuICAvKipcbiAgICogT0F1dGggYXV0aGVudGljYXRpb25cbiAgICovXG4gIE9BVVRIID0gJ09BVVRIJyxcblxuICAvKipcbiAgICogSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIEdBVEVXQVlfSUFNX1JPTEUgPSAnR0FURVdBWV9JQU1fUk9MRScsXG59XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICBDcmVkZW50aWFsIFByb3ZpZGVyXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbi8qKlxuICogQWJzdHJhY3QgaW50ZXJmYWNlIGZvciBnYXRld2F5IGNyZWRlbnRpYWwgcHJvdmlkZXIgY29uZmlndXJhdGlvblxuICovXG5leHBvcnQgaW50ZXJmYWNlIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAvKipcbiAgICogVGhlIGNyZWRlbnRpYWwgcHJvdmlkZXIgdHlwZVxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZTogQ3JlZGVudGlhbFByb3ZpZGVyVHlwZTtcblxuICAvKipcbiAgICogUmVuZGVycyBhcyBDRk4gUHJvcGVydHlcbiAgICogIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBDZm5HYXRld2F5VGFyZ2V0LkNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb25Qcm9wZXJ0eSB8IElSZXNvbHZhYmxlO1xuXG4gIC8qKlxuICAgKiBHcmFudCB0aGUgcm9sZSB0aGUgcGVybWlzc2lvbnNcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUocm9sZTogSVJvbGUpOiBHcmFudCB8IHVuZGVmaW5lZDtcbn1cblxuLyoqXG4gKiBGYWN0b3J5IGNsYXNzIGZvciBjcmVhdGluZyBkaWZmZXJlbnQgR2F0ZXdheSBDcmVkZW50aWFsIFByb3ZpZGVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlciB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gQVBJIGtleSBjcmVkZW50aWFsIHByb3ZpZGVyIGZyb20gSWRlbnRpdHkgQVJOXG4gICAqIFVzZSB0aGlzIG1ldGhvZCB3aGVuIHlvdSBoYXZlIHRoZSBJZGVudGl0eSBBUk4gYXMgYSBzdHJpbmdcbiAgICogQHBhcmFtIHByb3BzIC0gVGhlIGNvbmZpZ3VyYXRpb24gcHJvcGVydGllcyBmb3IgdGhlIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIEFQSSBrZXkgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFwaUtleUlkZW50aXR5QXJuKHByb3BzOiBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyk6IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAgIHJldHVybiBuZXcgQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgZnJvbSBJZGVudGl0eSBBUk5cbiAgICogVXNlIHRoaXMgbWV0aG9kIHdoZW4geW91IGhhdmUgdGhlIElkZW50aXR5IEFSTiBhcyBhIHN0cmluZ1xuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgY29uZmlndXJhdGlvbiBwcm9wZXJ0aWVzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIE9BdXRoIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21PYXV0aElkZW50aXR5QXJuKHByb3BzOiBPQXV0aENvbmZpZ3VyYXRpb24pOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIElBTSByb2xlIGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUlhbVJvbGVDcmVkZW50aWFsUHJvdmlkZXIgY29uZmlndXJlZCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUlhbVJvbGUoKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZygpO1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlZGVudGlhbC1wcm92aWRlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbImNyZWRlbnRpYWwtcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFJQSx1Q0FBa0U7QUFDbEUseUNBQW9FO0FBRXBFLG1DQUErRDtBQUsvRDs7K0VBRStFO0FBQy9FOztHQUVHO0FBQ0gsSUFBWSxzQkFlWDtBQWZELFdBQVksc0JBQXNCO0lBQ2hDOztPQUVHO0lBQ0gsNkNBQW1CLENBQUE7SUFFbkI7O09BRUc7SUFDSCx5Q0FBZSxDQUFBO0lBRWY7O09BRUc7SUFDSCwrREFBcUMsQ0FBQTtBQUN2QyxDQUFDLEVBZlcsc0JBQXNCLHNDQUF0QixzQkFBc0IsUUFlakM7QUF5REQ7O0dBRUc7QUFDSCxNQUFzQix5QkFBeUI7O0lBQzdDOzs7O09BSUc7SUFDSSxNQUFNLENBQUMsa0JBQWtCLENBQzlCLFFBQW1DLEVBQ25DLFVBQXFDLEVBQUU7Ozs7Ozs7Ozs7O1FBRXZDLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ3RELE9BQU8sSUFBSSwrQ0FBcUMsQ0FBQztZQUMvQyxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVc7WUFDaEMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO1lBQzVCLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxrQkFBa0I7U0FDL0MsQ0FBQyxDQUFDO0tBQ0o7SUFFRDs7Ozs7T0FLRztJQUNJLE1BQU0sQ0FBQyxxQkFBcUIsQ0FBQyxLQUFvQzs7Ozs7Ozs7OztRQUN0RSxPQUFPLElBQUksK0NBQXFDLENBQUMsS0FBSyxDQUFDLENBQUM7S0FDekQ7SUFFRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGlCQUFpQixDQUM3QixRQUFtQyxFQUNuQyxPQUFpQzs7Ozs7Ozs7Ozs7UUFFakMsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLHlCQUF5QixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDN0YsT0FBTyxJQUFJLDRDQUFvQyxDQUFDO1lBQzlDLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVztZQUNoQyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFNO1lBQ3RCLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxnQkFBZ0I7U0FDM0MsQ0FBQyxDQUFDO0tBQ0o7SUFFRDs7Ozs7T0FLRztJQUNJLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxLQUF5Qjs7Ozs7Ozs7OztRQUMxRCxPQUFPLElBQUksNENBQW9DLENBQUMsS0FBSyxDQUFDLENBQUM7S0FDeEQ7SUFFRDs7O09BR0c7SUFDSSxNQUFNLENBQUMsV0FBVztRQUN2QixPQUFPLElBQUksaURBQXNDLEVBQUUsQ0FBQztLQUNyRDs7QUE5REgsOERBK0RDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHR5cGUgeyBJUmVzb2x2YWJsZSB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCB0eXBlIHsgQ2ZuR2F0ZXdheVRhcmdldCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1iZWRyb2NrYWdlbnRjb3JlJztcbmltcG9ydCB0eXBlIHsgR3JhbnQgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB0eXBlIHsgQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uLCBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJQcm9wcyB9IGZyb20gJy4vYXBpLWtleSc7XG5pbXBvcnQgeyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uIH0gZnJvbSAnLi9hcGkta2V5JztcbmltcG9ydCB7IEdhdGV3YXlJYW1Sb2xlQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIH0gZnJvbSAnLi9pYW0tcm9sZSc7XG5pbXBvcnQgdHlwZSB7IE9BdXRoQ29uZmlndXJhdGlvbiB9IGZyb20gJy4vb2F1dGgnO1xuaW1wb3J0IHsgT0F1dGhDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uIH0gZnJvbSAnLi9vYXV0aCc7XG5pbXBvcnQgdHlwZSB7IElBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXIgfSBmcm9tICcuLi8uLi9pZGVudGl0eS9hcGkta2V5LWNyZWRlbnRpYWwtcHJvdmlkZXInO1xuaW1wb3J0IHR5cGUgeyBJT0F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyIH0gZnJvbSAnLi4vLi4vaWRlbnRpdHkvb2F1dGgyLWNyZWRlbnRpYWwtcHJvdmlkZXInO1xuaW1wb3J0IHR5cGUgeyBJR2F0ZXdheSB9IGZyb20gJy4uL2dhdGV3YXktYmFzZSc7XG5cbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRW51bXNcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cbi8qKlxuICogQ3JlZGVudGlhbCBwcm92aWRlciB0eXBlcyBzdXBwb3J0ZWQgYnkgZ2F0ZXdheSB0YXJnZXRcbiAqL1xuZXhwb3J0IGVudW0gQ3JlZGVudGlhbFByb3ZpZGVyVHlwZSB7XG4gIC8qKlxuICAgKiBBUEkgS2V5IGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBBUElfS0VZID0gJ0FQSV9LRVknLFxuXG4gIC8qKlxuICAgKiBPQXV0aCBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgT0FVVEggPSAnT0FVVEgnLFxuXG4gIC8qKlxuICAgKiBJQU0gcm9sZSBhdXRoZW50aWNhdGlvblxuICAgKi9cbiAgR0FURVdBWV9JQU1fUk9MRSA9ICdHQVRFV0FZX0lBTV9ST0xFJyxcbn1cblxuLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxuICogICAgICAgICAgICAgICAgICAgICAgIENyZWRlbnRpYWwgUHJvdmlkZXJcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cblxuLyoqXG4gKiBBYnN0cmFjdCBpbnRlcmZhY2UgZm9yIGdhdGV3YXkgY3JlZGVudGlhbCBwcm92aWRlciBjb25maWd1cmF0aW9uXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gIC8qKlxuICAgKiBUaGUgY3JlZGVudGlhbCBwcm92aWRlciB0eXBlXG4gICAqL1xuICByZWFkb25seSBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiBDcmVkZW50aWFsUHJvdmlkZXJUeXBlO1xuXG4gIC8qKlxuICAgKiBSZW5kZXJzIGFzIENGTiBQcm9wZXJ0eVxuICAgKiAgQGludGVybmFsXG4gICAqL1xuICBfcmVuZGVyKCk6IENmbkdhdGV3YXlUYXJnZXQuQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvblByb3BlcnR5IHwgSVJlc29sdmFibGU7XG5cbiAgLyoqXG4gICAqIEdyYW50IHRoZSBnYXRld2F5J3MgZXhlY3V0aW9uIHJvbGUgdGhlIHBlcm1pc3Npb25zIG5lZWRlZCBmb3Igb3V0Ym91bmQgYXV0aGVudGljYXRpb24uXG4gICAqIEBwYXJhbSBnYXRld2F5IFRoZSBnYXRld2F5IHdob3NlIHJvbGUgbmVlZHMgb3V0Ym91bmQgYXV0aCBwZXJtaXNzaW9ucyBbZGlzYWJsZS1hd3NsaW50OnByZWZlci1yZWYtaW50ZXJmYWNlXVxuICAgKi9cbiAgZ3JhbnROZWVkZWRQZXJtaXNzaW9uc1RvUm9sZShnYXRld2F5OiBJR2F0ZXdheSk6IEdyYW50IHwgdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIE9wdGlvbmFsIGdhdGV3YXkgc2V0dGluZ3Mgd2hlbiBiaW5kaW5nIGFuIHtAbGluayBJQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyfSB0byBhIHRhcmdldC5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBGcm9tQXBpS2V5SWRlbnRpdHlPcHRpb25zIHtcbiAgLyoqXG4gICAqIFdoZXJlIHRvIHBsYWNlIHRoZSBBUEkga2V5IG9uIG91dGJvdW5kIHJlcXVlc3RzLlxuICAgKlxuICAgKiBAZGVmYXVsdCBoZWFkZXIgYEF1dGhvcml6YXRpb25gIHdpdGggYEJlYXJlciBgIHByZWZpeFxuICAgKi9cbiAgcmVhZG9ubHkgY3JlZGVudGlhbExvY2F0aW9uPzogQXBpS2V5Q3JlZGVudGlhbExvY2F0aW9uO1xufVxuXG4vKipcbiAqIE9BdXRoIHNjb3BlcyAoYW5kIG9wdGlvbmFsIGN1c3RvbSBwYXJhbWV0ZXJzKSB3aGVuIGJpbmRpbmcgYW4ge0BsaW5rIElPQXV0aDJDcmVkZW50aWFsUHJvdmlkZXJ9IHRvIGEgZ2F0ZXdheSB0YXJnZXQuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgRnJvbU9hdXRoSWRlbnRpdHlPcHRpb25zIHtcbiAgLyoqXG4gICAqIE9BdXRoIHNjb3BlcyB0aGUgZ2F0ZXdheSBzaG91bGQgcmVxdWVzdCBmb3IgdGhpcyB0YXJnZXQuXG4gICAqL1xuICByZWFkb25seSBzY29wZXM6IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBBZGRpdGlvbmFsIE9BdXRoIHBhcmFtZXRlcnMgZm9yIHRoZSBwcm92aWRlci5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBub25lXG4gICAqL1xuICByZWFkb25seSBjdXN0b21QYXJhbWV0ZXJzPzogeyBba2V5OiBzdHJpbmddOiBzdHJpbmcgfTtcbn1cblxuLyoqXG4gKiBGYWN0b3J5IGNsYXNzIGZvciBjcmVhdGluZyBkaWZmZXJlbnQgR2F0ZXdheSBDcmVkZW50aWFsIFByb3ZpZGVyc1xuICovXG5leHBvcnQgYWJzdHJhY3QgY2xhc3MgR2F0ZXdheUNyZWRlbnRpYWxQcm92aWRlciB7XG4gIC8qKlxuICAgKiBDcmVhdGUgYW4gQVBJIGtleSBvdXRib3VuZCBhdXRoIGNvbmZpZ3VyYXRpb24gZnJvbSBhIFRva2VuIFZhdWx0IHtAbGluayBJQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyfSBjb25zdHJ1Y3QuXG4gICAqXG4gICAqIFByZWZlciB0aGlzIG92ZXIge0BsaW5rIEdhdGV3YXlDcmVkZW50aWFsUHJvdmlkZXIuZnJvbUFwaUtleUlkZW50aXR5QXJufSB3aGVuIHRoZSBwcm92aWRlciBpcyBkZWZpbmVkIGluIENESy5cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUFwaUtleUlkZW50aXR5KFxuICAgIHByb3ZpZGVyOiBJQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyLFxuICAgIG9wdGlvbnM6IEZyb21BcGlLZXlJZGVudGl0eU9wdGlvbnMgPSB7fSxcbiAgKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgY29uc3QgYmluZGluZyA9IHByb3ZpZGVyLmJpbmRGb3JHYXRld2F5QXBpS2V5VGFyZ2V0KCk7XG4gICAgcmV0dXJuIG5ldyBBcGlLZXlDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uKHtcbiAgICAgIHByb3ZpZGVyQXJuOiBiaW5kaW5nLnByb3ZpZGVyQXJuLFxuICAgICAgc2VjcmV0QXJuOiBiaW5kaW5nLnNlY3JldEFybixcbiAgICAgIGNyZWRlbnRpYWxMb2NhdGlvbjogb3B0aW9ucy5jcmVkZW50aWFsTG9jYXRpb24sXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIEFQSSBrZXkgY3JlZGVudGlhbCBwcm92aWRlciBmcm9tIElkZW50aXR5IEFSTlxuICAgKiBVc2UgdGhpcyBtZXRob2Qgd2hlbiB5b3UgaGF2ZSB0aGUgSWRlbnRpdHkgQVJOIGFzIGEgc3RyaW5nXG4gICAqIEBwYXJhbSBwcm9wcyAtIFRoZSBjb25maWd1cmF0aW9uIHByb3BlcnRpZXMgZm9yIHRoZSBBUEkga2V5IGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyBjb25maWd1cmVkIGZvciBBUEkga2V5IGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21BcGlLZXlJZGVudGl0eUFybihwcm9wczogQXBpS2V5Q3JlZGVudGlhbFByb3ZpZGVyUHJvcHMpOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IEFwaUtleUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZ3VyYXRpb24ocHJvcHMpO1xuICB9XG5cbiAgLyoqXG4gICAqIENyZWF0ZSBhbiBPQXV0aCBvdXRib3VuZCBhdXRoIGNvbmZpZ3VyYXRpb24gZnJvbSBhIFRva2VuIFZhdWx0IHtAbGluayBJT0F1dGgyQ3JlZGVudGlhbFByb3ZpZGVyfSBjb25zdHJ1Y3QuXG4gICAqXG4gICAqIFByZWZlciB0aGlzIG92ZXIge0BsaW5rIEdhdGV3YXlDcmVkZW50aWFsUHJvdmlkZXIuZnJvbU9hdXRoSWRlbnRpdHlBcm59IHdoZW4gdGhlIHByb3ZpZGVyIGlzIGRlZmluZWQgaW4gQ0RLLlxuICAgKi9cbiAgcHVibGljIHN0YXRpYyBmcm9tT2F1dGhJZGVudGl0eShcbiAgICBwcm92aWRlcjogSU9BdXRoMkNyZWRlbnRpYWxQcm92aWRlcixcbiAgICBvcHRpb25zOiBGcm9tT2F1dGhJZGVudGl0eU9wdGlvbnMsXG4gICk6IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICAgIGNvbnN0IGJpbmRpbmcgPSBwcm92aWRlci5iaW5kRm9yR2F0ZXdheU9BdXRoVGFyZ2V0KG9wdGlvbnMuc2NvcGVzLCBvcHRpb25zLmN1c3RvbVBhcmFtZXRlcnMpO1xuICAgIHJldHVybiBuZXcgT0F1dGhDcmVkZW50aWFsUHJvdmlkZXJDb25maWd1cmF0aW9uKHtcbiAgICAgIHByb3ZpZGVyQXJuOiBiaW5kaW5nLnByb3ZpZGVyQXJuLFxuICAgICAgc2VjcmV0QXJuOiBiaW5kaW5nLnNlY3JldEFybixcbiAgICAgIHNjb3BlczogYmluZGluZy5zY29wZXMsXG4gICAgICBjdXN0b21QYXJhbWV0ZXJzOiBiaW5kaW5nLmN1c3RvbVBhcmFtZXRlcnMsXG4gICAgfSk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIE9BdXRoIGNyZWRlbnRpYWwgcHJvdmlkZXIgZnJvbSBJZGVudGl0eSBBUk5cbiAgICogVXNlIHRoaXMgbWV0aG9kIHdoZW4geW91IGhhdmUgdGhlIElkZW50aXR5IEFSTiBhcyBhIHN0cmluZ1xuICAgKiBAcGFyYW0gcHJvcHMgLSBUaGUgY29uZmlndXJhdGlvbiBwcm9wZXJ0aWVzIGZvciB0aGUgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlclxuICAgKiBAcmV0dXJucyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIGNvbmZpZ3VyZWQgZm9yIE9BdXRoIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICBwdWJsaWMgc3RhdGljIGZyb21PYXV0aElkZW50aXR5QXJuKHByb3BzOiBPQXV0aENvbmZpZ3VyYXRpb24pOiBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIHtcbiAgICByZXR1cm4gbmV3IE9BdXRoQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlndXJhdGlvbihwcm9wcyk7XG4gIH1cblxuICAvKipcbiAgICogQ3JlYXRlIGFuIElBTSByb2xlIGNyZWRlbnRpYWwgcHJvdmlkZXJcbiAgICogQHJldHVybnMgSUlhbVJvbGVDcmVkZW50aWFsUHJvdmlkZXIgY29uZmlndXJlZCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHB1YmxpYyBzdGF0aWMgZnJvbUlhbVJvbGUoKTogSUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyB7XG4gICAgcmV0dXJuIG5ldyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZygpO1xuICB9XG59XG4iXX0=

package/lib/gateway/outbound-auth/iam-role.d.ts

@@ -1,9 +1,10 @@
 /******************************************************************************
  *                                 IAM Role
  *****************************************************************************/
-import type { Grant, IRole } from 'aws-cdk-lib/aws-iam';
+import type { Grant } from 'aws-cdk-lib/aws-iam';
 import type { ICredentialProviderConfig } from './credential-provider';
 import { CredentialProviderType } from './credential-provider';
+import type { IGateway } from '../gateway-base';
 /**
  * Gateway IAM Role credential provider configuration implementation
  * Can be used with Lambda and Smithy targets
@@ -22,8 +23,8 @@ export declare class GatewayIamRoleCredentialProviderConfig implements ICredenti
      * role to authenticate with the target endpoint. Unlike API Key and OAuth credential providers
      * which require permissions to access external credential stores (Secrets Manager, Token Vault),
      * IAM role authentication leverages AWS IAM's native authentication without additional resources.
-     * @param role The gateway's execution role (unused - no credential provider permissions needed)
+     * @param _gateway The gateway (unused - no credential provider permissions needed)
      * @returns undefined - no additional credential provider permissions to grant
      */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    grantNeededPermissionsToRole(_gateway: IGateway): Grant | undefined;
 }

package/lib/gateway/outbound-auth/iam-role.js

@@ -27,14 +27,12 @@ class GatewayIamRoleCredentialProviderConfig {
      * role to authenticate with the target endpoint. Unlike API Key and OAuth credential providers
      * which require permissions to access external credential stores (Secrets Manager, Token Vault),
      * IAM role authentication leverages AWS IAM's native authentication without additional resources.
-     * @param role The gateway's execution role (unused - no credential provider permissions needed)
+     * @param _gateway The gateway (unused - no credential provider permissions needed)
      * @returns undefined - no additional credential provider permissions to grant
      */
-    grantNeededPermissionsToRole(role) {
-        if (role) {
-        }
+    grantNeededPermissionsToRole(_gateway) {
         return undefined;
     }
 }
 exports.GatewayIamRoleCredentialProviderConfig = GatewayIamRoleCredentialProviderConfig;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLXJvbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpYW0tcm9sZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQ0E7OytFQUUrRTs7O0FBSS9FLCtEQUErRDtBQUUvRDs7OztHQUlHO0FBQ0gsTUFBYSxzQ0FBc0M7SUFDakMsc0JBQXNCLEdBQUcsNENBQXNCLENBQUMsZ0JBQWdCLENBQUM7SUFFakYsaUJBQWdCO0lBRWhCOztPQUVHO0lBQ0gsT0FBTztRQUNMLE9BQU87WUFDTCxzQkFBc0IsRUFBRSxJQUFJLENBQUMsc0JBQXNCO1NBQ3BELENBQUM7S0FDSDtJQUVEOzs7Ozs7OztPQVFHO0lBQ0gsNEJBQTRCLENBQUMsSUFBVztRQUN0QyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ1gsQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDO0tBQ2xCO0NBQ0Y7QUE1QkQsd0ZBNEJDIiwic291cmNlc0NvbnRlbnQiOlsiXG4vKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqXG4gKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElBTSBSb2xlXG4gKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovXG5cbmltcG9ydCB0eXBlIHsgR3JhbnQsIElSb2xlIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgdHlwZSB7IElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcgfSBmcm9tICcuL2NyZWRlbnRpYWwtcHJvdmlkZXInO1xuaW1wb3J0IHsgQ3JlZGVudGlhbFByb3ZpZGVyVHlwZSB9IGZyb20gJy4vY3JlZGVudGlhbC1wcm92aWRlcic7XG5cbi8qKlxuICogR2F0ZXdheSBJQU0gUm9sZSBjcmVkZW50aWFsIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqIENhbiBiZSB1c2VkIHdpdGggTGFtYmRhIGFuZCBTbWl0aHkgdGFyZ2V0c1xuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBjbGFzcyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyBpbXBsZW1lbnRzIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZSA9IENyZWRlbnRpYWxQcm92aWRlclR5cGUuR0FURVdBWV9JQU1fUk9MRTtcblxuICBjb25zdHJ1Y3RvcigpIHt9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgfTtcbiAgfVxuXG4gIC8qKlxuICAgKiBOby1vcCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb24gLSBubyBhZGRpdGlvbmFsIHBlcm1pc3Npb25zIGFyZSByZXF1aXJlZC5cbiAgICogV2hlbiB1c2luZyBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBmb3Igb3V0Ym91bmQgY2FsbHMsIHRoZSBnYXRld2F5IHVzZXMgaXRzIG93biBleGVjdXRpb25cbiAgICogcm9sZSB0byBhdXRoZW50aWNhdGUgd2l0aCB0aGUgdGFyZ2V0IGVuZHBvaW50LiBVbmxpa2UgQVBJIEtleSBhbmQgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlcnNcbiAgICogd2hpY2ggcmVxdWlyZSBwZXJtaXNzaW9ucyB0byBhY2Nlc3MgZXh0ZXJuYWwgY3JlZGVudGlhbCBzdG9yZXMgKFNlY3JldHMgTWFuYWdlciwgVG9rZW4gVmF1bHQpLFxuICAgKiBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBsZXZlcmFnZXMgQVdTIElBTSdzIG5hdGl2ZSBhdXRoZW50aWNhdGlvbiB3aXRob3V0IGFkZGl0aW9uYWwgcmVzb3VyY2VzLlxuICAgKiBAcGFyYW0gcm9sZSBUaGUgZ2F0ZXdheSdzIGV4ZWN1dGlvbiByb2xlICh1bnVzZWQgLSBubyBjcmVkZW50aWFsIHByb3ZpZGVyIHBlcm1pc3Npb25zIG5lZWRlZClcbiAgICogQHJldHVybnMgdW5kZWZpbmVkIC0gbm8gYWRkaXRpb25hbCBjcmVkZW50aWFsIHByb3ZpZGVyIHBlcm1pc3Npb25zIHRvIGdyYW50XG4gICAqL1xuICBncmFudE5lZWRlZFBlcm1pc3Npb25zVG9Sb2xlKHJvbGU6IElSb2xlKTogR3JhbnQgfCB1bmRlZmluZWQge1xuICAgIGlmIChyb2xlKSB7XG4gICAgfVxuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLXJvbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpYW0tcm9sZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiO0FBQ0E7OytFQUUrRTs7O0FBSS9FLCtEQUErRDtBQUcvRDs7OztHQUlHO0FBQ0gsTUFBYSxzQ0FBc0M7SUFDakMsc0JBQXNCLEdBQUcsNENBQXNCLENBQUMsZ0JBQWdCLENBQUM7SUFFakYsaUJBQWdCO0lBRWhCOztPQUVHO0lBQ0gsT0FBTztRQUNMLE9BQU87WUFDTCxzQkFBc0IsRUFBRSxJQUFJLENBQUMsc0JBQXNCO1NBQ3BELENBQUM7S0FDSDtJQUVEOzs7Ozs7OztPQVFHO0lBQ0gsNEJBQTRCLENBQUMsUUFBa0I7UUFDN0MsT0FBTyxTQUFTLENBQUM7S0FDbEI7Q0FDRjtBQTFCRCx3RkEwQkMiLCJzb3VyY2VzQ29udGVudCI6WyJcbi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcbiAqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSUFNIFJvbGVcbiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKi9cblxuaW1wb3J0IHR5cGUgeyBHcmFudCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0IHR5cGUgeyBJQ3JlZGVudGlhbFByb3ZpZGVyQ29uZmlnIH0gZnJvbSAnLi9jcmVkZW50aWFsLXByb3ZpZGVyJztcbmltcG9ydCB7IENyZWRlbnRpYWxQcm92aWRlclR5cGUgfSBmcm9tICcuL2NyZWRlbnRpYWwtcHJvdmlkZXInO1xuaW1wb3J0IHR5cGUgeyBJR2F0ZXdheSB9IGZyb20gJy4uL2dhdGV3YXktYmFzZSc7XG5cbi8qKlxuICogR2F0ZXdheSBJQU0gUm9sZSBjcmVkZW50aWFsIHByb3ZpZGVyIGNvbmZpZ3VyYXRpb24gaW1wbGVtZW50YXRpb25cbiAqIENhbiBiZSB1c2VkIHdpdGggTGFtYmRhIGFuZCBTbWl0aHkgdGFyZ2V0c1xuICogQGludGVybmFsXG4gKi9cbmV4cG9ydCBjbGFzcyBHYXRld2F5SWFtUm9sZUNyZWRlbnRpYWxQcm92aWRlckNvbmZpZyBpbXBsZW1lbnRzIElDcmVkZW50aWFsUHJvdmlkZXJDb25maWcge1xuICBwdWJsaWMgcmVhZG9ubHkgY3JlZGVudGlhbFByb3ZpZGVyVHlwZSA9IENyZWRlbnRpYWxQcm92aWRlclR5cGUuR0FURVdBWV9JQU1fUk9MRTtcblxuICBjb25zdHJ1Y3RvcigpIHt9XG5cbiAgLyoqXG4gICAqIEBpbnRlcm5hbFxuICAgKi9cbiAgX3JlbmRlcigpOiBhbnkge1xuICAgIHJldHVybiB7XG4gICAgICBjcmVkZW50aWFsUHJvdmlkZXJUeXBlOiB0aGlzLmNyZWRlbnRpYWxQcm92aWRlclR5cGUsXG4gICAgfTtcbiAgfVxuXG4gIC8qKlxuICAgKiBOby1vcCBmb3IgSUFNIHJvbGUgYXV0aGVudGljYXRpb24gLSBubyBhZGRpdGlvbmFsIHBlcm1pc3Npb25zIGFyZSByZXF1aXJlZC5cbiAgICogV2hlbiB1c2luZyBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBmb3Igb3V0Ym91bmQgY2FsbHMsIHRoZSBnYXRld2F5IHVzZXMgaXRzIG93biBleGVjdXRpb25cbiAgICogcm9sZSB0byBhdXRoZW50aWNhdGUgd2l0aCB0aGUgdGFyZ2V0IGVuZHBvaW50LiBVbmxpa2UgQVBJIEtleSBhbmQgT0F1dGggY3JlZGVudGlhbCBwcm92aWRlcnNcbiAgICogd2hpY2ggcmVxdWlyZSBwZXJtaXNzaW9ucyB0byBhY2Nlc3MgZXh0ZXJuYWwgY3JlZGVudGlhbCBzdG9yZXMgKFNlY3JldHMgTWFuYWdlciwgVG9rZW4gVmF1bHQpLFxuICAgKiBJQU0gcm9sZSBhdXRoZW50aWNhdGlvbiBsZXZlcmFnZXMgQVdTIElBTSdzIG5hdGl2ZSBhdXRoZW50aWNhdGlvbiB3aXRob3V0IGFkZGl0aW9uYWwgcmVzb3VyY2VzLlxuICAgKiBAcGFyYW0gX2dhdGV3YXkgVGhlIGdhdGV3YXkgKHVudXNlZCAtIG5vIGNyZWRlbnRpYWwgcHJvdmlkZXIgcGVybWlzc2lvbnMgbmVlZGVkKVxuICAgKiBAcmV0dXJucyB1bmRlZmluZWQgLSBubyBhZGRpdGlvbmFsIGNyZWRlbnRpYWwgcHJvdmlkZXIgcGVybWlzc2lvbnMgdG8gZ3JhbnRcbiAgICovXG4gIGdyYW50TmVlZGVkUGVybWlzc2lvbnNUb1JvbGUoX2dhdGV3YXk6IElHYXRld2F5KTogR3JhbnQgfCB1bmRlZmluZWQge1xuICAgIHJldHVybiB1bmRlZmluZWQ7XG4gIH1cbn1cbiJdfQ==

package/lib/gateway/outbound-auth/oauth.d.ts

@@ -1,7 +1,7 @@
-import type { IRole } from 'aws-cdk-lib/aws-iam';
 import { Grant } from 'aws-cdk-lib/aws-iam';
 import type { ICredentialProviderConfig } from './credential-provider';
 import { CredentialProviderType } from './credential-provider';
+import type { IGateway } from '../gateway-base';
 /******************************************************************************
  *                                OAuth
  *****************************************************************************/
@@ -72,9 +72,17 @@ export declare class OAuthCredentialProviderConfiguration implements ICredential
     readonly customParameters?: Record<string, string>;
     constructor(configuration: OAuthConfiguration);
     /**
-     * Grant the needed permissions to the role for OAuth authentication
+     * Grant the needed permissions to the gateway role for OAuth authentication.
+     *
+     * Produces four scoped IAM statements matching the console-generated policy:
+     * 1. `GetWorkloadAccessToken[ForJWT|ForUserId]` on the workload identity directory ARNs
+     * 2. `CompleteResourceTokenAuth` on the token vault, credential provider, directory, and identity ARNs
+     * 3. `GetResourceOauth2Token` on the token vault, credential provider, directory, and identity ARNs
+     * 4. `secretsmanager:GetSecretValue` on the specific credential secret ARN
+     *
+     * @see https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway-outbound-auth.html
      */
-    grantNeededPermissionsToRole(role: IRole): Grant | undefined;
+    grantNeededPermissionsToRole(gateway: IGateway): Grant | undefined;
     /**
      * @internal
      */