@aws-cdk/aws-mediapackagev2-alpha 2.257.0-alpha.0 → 2.258.0-alpha.0

package/.warnings.jsii.js

@@ -211,17 +211,6 @@ const VALIDATORS = { _aws_cdk_aws_mediapackagev2_alpha_FilterConfiguration: func
         finally {
             visitedObjects.delete(p);
         }
-    }, _aws_cdk_aws_mediapackagev2_alpha_MediaPackageV2OriginProps: function _aws_cdk_aws_mediapackagev2_alpha_MediaPackageV2OriginProps(p) {
-        if (p == null)
-            return;
-        visitedObjects.add(p);
-        try {
-            if (!visitedObjects.has(p.cdnAuth))
-                module.exports._aws_cdk_aws_mediapackagev2_alpha_CdnAuthConfiguration(p.cdnAuth);
-        }
-        finally {
-            visitedObjects.delete(p);
-        }
     } };
 function print(name, deprecationMessage) {
     const deprecated = process.env.JSII_DEPRECATED;

package/README.md

@@ -243,6 +243,50 @@ origin.addToResourcePolicy(new PolicyStatement({
 }));
 ```
 
+### CDN Authorization
+
+MediaPackage V2 supports two ways to lock an origin endpoint to your CDN:
+
+- **AWS Signature Version 4 (SigV4)** — the CDN signs requests with an IAM
+  role. For Amazon CloudFront, see [CloudFront Integration](#cloudfront-integration).
+  See the [SigV4 authentication guide][sigv4-auth].
+- **Header-based CDN authorization** — the CDN attaches a shared secret in
+  a request header that MediaPackage validates. Use this when your CDN
+  doesn't support SigV4. See the [CDN authorization guide][cdn-auth].
+
+[sigv4-auth]: https://docs.aws.amazon.com/mediapackage/latest/userguide/sig-v4-authenticating-requests.html
+[cdn-auth]: https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth.html
+
+To configure header-based authorization, set `cdnAuth` on the `OriginEndpoint`
+props. The L2 auto-creates the endpoint policy with:
+
+- a `PolicyStatement` requiring the `mediapackagev2:RequestHasMatchingCdnAuthHeader`
+  condition on every `GetObject` request
+- the `CdnAuthConfiguration` block that references the secrets and the read role
+
+If you don't supply a role, one is created with the needed Secrets Manager
+and KMS permissions.
+
+```ts
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+
+declare const channel: Channel;
+declare const mySecret: secretsmanager.ISecret;
+
+new OriginEndpoint(this, 'OriginEndpoint', {
+  channel,
+  segment: Segment.ts(),
+  manifests: [Manifest.hls({ manifestName: 'index' })],
+  cdnAuth: {
+    secrets: [mySecret],
+  },
+});
+```
+
+You can still call `addToResourcePolicy()` to add extra statements (e.g. a
+harvester allow); they're appended to the auto-created policy alongside the
+gating statement.
+
 ## Granting Permissions
 
 ### Granting Ingest Access to MediaLive

package/lib/channel-policy.js

@@ -76,7 +76,7 @@ let ChannelPolicy = (() => {
             ChannelPolicy = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.ChannelPolicy", version: "2.257.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.ChannelPolicy", version: "2.258.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-mediapackagev2-alpha.ChannelPolicy';
         /**

package/lib/channel.js

@@ -80,7 +80,7 @@ var IngestEndpoint;
  */
 class HeadersCMSD {
     value;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.HeadersCMSD", version: "2.257.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.HeadersCMSD", version: "2.258.0-alpha.0" };
     /**
      * Media Quality Confidence Score
      */
@@ -111,7 +111,7 @@ class InputConfiguration {
     inputType;
     inputSwitchConfiguration;
     outputHeaders;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.InputConfiguration", version: "2.257.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.InputConfiguration", version: "2.258.0-alpha.0" };
     /**
      * Create an HLS input configuration
      */
@@ -357,7 +357,7 @@ let Channel = (() => {
             Channel = _classThis = _classDescriptor.value;
             if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
-        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.Channel", version: "2.257.0-alpha.0" };
+        static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.Channel", version: "2.258.0-alpha.0" };
         /** Uniquely identifies this class. */
         static PROPERTY_INJECTION_ID = '@aws-cdk.aws-mediapackagev2-alpha.Channel';
         channelGroupName;

package/lib/cloudfront-origin.d.ts

@@ -2,7 +2,6 @@ import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import type { Construct } from 'constructs';
 import type { IOriginEndpoint } from './endpoint';
 import type { IChannelGroup } from './group';
-import type { CdnAuthConfiguration } from './origin-endpoint-policy';
 /**
  * Properties for a MediaPackage V2 Origin with OAC.
  */
@@ -19,16 +18,6 @@ export interface MediaPackageV2OriginProps extends cloudfront.OriginProps {
      * @default - an Origin Access Control will be created automatically.
      */
     readonly originAccessControl?: cloudfront.IOriginAccessControlRef;
-    /**
-     * Optional CDN authorization configuration.
-     *
-     * If you need CDN auth on this endpoint, provide it here so it is configured
-     * on the first `addToResourcePolicy` call. If CDN auth is added separately
-     * after this origin is bound, it will be ignored.
-     *
-     * @default - no CDN authorization
-     */
-    readonly cdnAuth?: CdnAuthConfiguration;
 }
 /**
  * A CloudFront Origin for AWS Elemental MediaPackage V2 endpoints.
@@ -58,7 +47,6 @@ export interface MediaPackageV2OriginProps extends cloudfront.OriginProps {
 export declare class MediaPackageV2Origin extends cloudfront.OriginBase {
     private originAccessControl?;
     private readonly endpoint;
-    private readonly cdnAuth?;
     constructor(endpoint: IOriginEndpoint, props: MediaPackageV2OriginProps);
     protected renderCustomOriginConfig(): cloudfront.CfnDistribution.CustomOriginConfigProperty | undefined;
     bind(scope: Construct, options: cloudfront.OriginBindOptions): cloudfront.OriginBindConfig;

package/lib/cloudfront-origin.js

@@ -1,10 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MediaPackageV2Origin = void 0;
 const jsiiDeprecationWarnings = require("../.warnings.jsii.js");
 const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
-const cdk = require("aws-cdk-lib");
-const cloudfront = require("aws-cdk-lib/aws-cloudfront");
+const cdk = __importStar(require("aws-cdk-lib"));
+const cloudfront = __importStar(require("aws-cdk-lib/aws-cloudfront"));
 const aws_iam_1 = require("aws-cdk-lib/aws-iam");
 const core_1 = require("aws-cdk-lib/core");
 const helpers_internal_1 = require("aws-cdk-lib/core/lib/helpers-internal");
@@ -34,10 +67,9 @@ const helpers_internal_1 = require("aws-cdk-lib/core/lib/helpers-internal");
  * @see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-mediapackage.html
  */
 class MediaPackageV2Origin extends cloudfront.OriginBase {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.MediaPackageV2Origin", version: "2.257.0-alpha.0" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@aws-cdk/aws-mediapackagev2-alpha.MediaPackageV2Origin", version: "2.258.0-alpha.0" };
     originAccessControl;
     endpoint;
-    cdnAuth;
     constructor(endpoint, props) {
         try {
             jsiiDeprecationWarnings._aws_cdk_aws_mediapackagev2_alpha_IOriginEndpoint(endpoint);
@@ -55,7 +87,6 @@ class MediaPackageV2Origin extends cloudfront.OriginBase {
         super(props.channelGroup.egressDomain, props);
         this.endpoint = endpoint;
         this.originAccessControl = props.originAccessControl;
-        this.cdnAuth = props.cdnAuth;
     }
     renderCustomOriginConfig() {
         return {
@@ -87,7 +118,7 @@ class MediaPackageV2Origin extends cloudfront.OriginBase {
                     }),
                 },
             },
-        }), this.cdnAuth);
+        }));
         return {
             ...originBindConfig,
             originProperty: {
@@ -98,4 +129,4 @@ class MediaPackageV2Origin extends cloudfront.OriginBase {
     }
 }
 exports.MediaPackageV2Origin = MediaPackageV2Origin;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xvdWRmcm9udC1vcmlnaW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJjbG91ZGZyb250LW9yaWdpbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLG1DQUFtQztBQUNuQyx5REFBeUQ7QUFDekQsaURBQWdGO0FBQ2hGLDJDQUEyRDtBQUMzRCw0RUFBNEQ7QUFvQzVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0F3Qkc7QUFDSCxNQUFhLG9CQUFxQixTQUFRLFVBQVUsQ0FBQyxVQUFVOztJQUNyRCxtQkFBbUIsQ0FBc0M7SUFDaEQsUUFBUSxDQUFrQjtJQUMxQixPQUFPLENBQXdCO0lBRWhELFlBQVksUUFBeUIsRUFBRSxLQUFnQzs7Ozs7OzsrQ0FMNUQsb0JBQW9COzs7O1FBTTdCLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSw4QkFBdUIsQ0FDL0IsSUFBQSxzQkFBRyxFQUFBLHFCQUFxQixFQUN4QixtSUFBbUksQ0FDcEksQ0FBQztRQUNKLENBQUM7UUFDRCxLQUFLLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUM7UUFDekIsSUFBSSxDQUFDLG1CQUFtQixHQUFHLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQztRQUNyRCxJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUM7S0FDOUI7SUFFUyx3QkFBd0I7UUFDaEMsT0FBTztZQUNMLGtCQUFrQixFQUFFLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUM7WUFDekQsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQixDQUFDLFVBQVU7U0FDakUsQ0FBQztLQUNIO0lBRU0sSUFBSSxDQUFDLEtBQWdCLEVBQUUsT0FBcUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUVwRCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLG1CQUFtQixHQUFHLElBQUksVUFBVSxDQUFDLGlDQUFpQyxDQUFDLEtBQUssRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO1FBQzFHLENBQUM7UUFFRCxrRkFBa0Y7UUFDbEYsMkVBQTJFO1FBQzNFLGtJQUFrSTtRQUNsSSxJQUFJLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUMvQixJQUFJLHlCQUFlLENBQUM7WUFDbEIsR0FBRyxFQUFFLGlDQUFpQztZQUN0QyxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLFVBQVUsRUFBRSxDQUFDLElBQUksMEJBQWdCLENBQUMsMEJBQTBCLENBQUMsQ0FBQztZQUM5RCxPQUFPLEVBQUUsQ0FBQywwQkFBMEIsRUFBRSw4QkFBOEIsQ0FBQztZQUNyRSxTQUFTLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDO1lBQzVDLFVBQVUsRUFBRTtnQkFDVixZQUFZLEVBQUU7b0JBQ1osZUFBZSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQzt3QkFDN0MsT0FBTyxFQUFFLFlBQVk7d0JBQ3JCLE1BQU0sRUFBRSxFQUFFO3dCQUNWLFFBQVEsRUFBRSxjQUFjO3dCQUN4QixZQUFZLEVBQUUsT0FBTyxDQUFDLGNBQWM7cUJBQ3JDLENBQUM7aUJBQ0g7YUFDRjtTQUNGLENBQUMsRUFDRixJQUFJLENBQUMsT0FBTyxDQUNiLENBQUM7UUFFRixPQUFPO1lBQ0wsR0FBRyxnQkFBZ0I7WUFDbkIsY0FBYyxFQUFFO2dCQUNkLEdBQUcsZ0JBQWdCLENBQUMsY0FBZTtnQkFDbkMscUJBQXFCLEVBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLHNCQUFzQixDQUFDLHFCQUFxQjthQUM3RjtTQUNGLENBQUM7S0FDSDs7QUEvREgsb0RBZ0VDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgY2RrIGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGNsb3VkZnJvbnQgZnJvbSAnYXdzLWNkay1saWIvYXdzLWNsb3VkZnJvbnQnO1xuaW1wb3J0IHsgRWZmZWN0LCBQb2xpY3lTdGF0ZW1lbnQsIFNlcnZpY2VQcmluY2lwYWwgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFVuc2NvcGVkVmFsaWRhdGlvbkVycm9yIH0gZnJvbSAnYXdzLWNkay1saWIvY29yZSc7XG5pbXBvcnQgeyBsaXQgfSBmcm9tICdhd3MtY2RrLWxpYi9jb3JlL2xpYi9oZWxwZXJzLWludGVybmFsJztcbmltcG9ydCB0eXBlIHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgdHlwZSB7IElPcmlnaW5FbmRwb2ludCB9IGZyb20gJy4vZW5kcG9pbnQnO1xuaW1wb3J0IHR5cGUgeyBJQ2hhbm5lbEdyb3VwIH0gZnJvbSAnLi9ncm91cCc7XG5pbXBvcnQgdHlwZSB7IENkbkF1dGhDb25maWd1cmF0aW9uIH0gZnJvbSAnLi9vcmlnaW4tZW5kcG9pbnQtcG9saWN5JztcblxuLyoqXG4gKiBQcm9wZXJ0aWVzIGZvciBhIE1lZGlhUGFja2FnZSBWMiBPcmlnaW4gd2l0aCBPQUMuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgTWVkaWFQYWNrYWdlVjJPcmlnaW5Qcm9wcyBleHRlbmRzIGNsb3VkZnJvbnQuT3JpZ2luUHJvcHMge1xuICAvKipcbiAgICogVGhlIGNoYW5uZWwgZ3JvdXAgdGhhdCB0aGUgb3JpZ2luIGVuZHBvaW50IGJlbG9uZ3MgdG8uXG4gICAqXG4gICAqIFVzZWQgdG8gZGVyaXZlIHRoZSBlZ3Jlc3MgZG9tYWluIGZvciB0aGUgQ2xvdWRGcm9udCBvcmlnaW4uXG4gICAqL1xuICByZWFkb25seSBjaGFubmVsR3JvdXA6IElDaGFubmVsR3JvdXA7XG5cbiAgLyoqXG4gICAqIEFuIG9wdGlvbmFsIE9yaWdpbiBBY2Nlc3MgQ29udHJvbC5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBhbiBPcmlnaW4gQWNjZXNzIENvbnRyb2wgd2lsbCBiZSBjcmVhdGVkIGF1dG9tYXRpY2FsbHkuXG4gICAqL1xuICByZWFkb25seSBvcmlnaW5BY2Nlc3NDb250cm9sPzogY2xvdWRmcm9udC5JT3JpZ2luQWNjZXNzQ29udHJvbFJlZjtcblxuICAvKipcbiAgICogT3B0aW9uYWwgQ0ROIGF1dGhvcml6YXRpb24gY29uZmlndXJhdGlvbi5cbiAgICpcbiAgICogSWYgeW91IG5lZWQgQ0ROIGF1dGggb24gdGhpcyBlbmRwb2ludCwgcHJvdmlkZSBpdCBoZXJlIHNvIGl0IGlzIGNvbmZpZ3VyZWRcbiAgICogb24gdGhlIGZpcnN0IGBhZGRUb1Jlc291cmNlUG9saWN5YCBjYWxsLiBJZiBDRE4gYXV0aCBpcyBhZGRlZCBzZXBhcmF0ZWx5XG4gICAqIGFmdGVyIHRoaXMgb3JpZ2luIGlzIGJvdW5kLCBpdCB3aWxsIGJlIGlnbm9yZWQuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gQ0ROIGF1dGhvcml6YXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGNkbkF1dGg/OiBDZG5BdXRoQ29uZmlndXJhdGlvbjtcbn1cblxuLyoqXG4gKiBBIENsb3VkRnJvbnQgT3JpZ2luIGZvciBBV1MgRWxlbWVudGFsIE1lZGlhUGFja2FnZSBWMiBlbmRwb2ludHMuXG4gKlxuICogQXV0b21hdGljYWxseSBjcmVhdGVzIGFuIE9BQyBhbmQgd2lyZXMgdGhlIG9yaWdpbiBlbmRwb2ludCBwb2xpY3lcbiAqIHRvIGdyYW50IHRoZSBDbG91ZEZyb250IGRpc3RyaWJ1dGlvbiBhY2Nlc3MuXG4gKlxuICogVXNlcyBgYWRkVG9SZXNvdXJjZVBvbGljeSgpYCBvbiB0aGUgb3JpZ2luIGVuZHBvaW50LCB3aGljaCBpcyBjb21wYXRpYmxlXG4gKiB3aXRoIG90aGVyIHBvbGljeSBzdGF0ZW1lbnRzIGFkZGVkIHRvIHRoZSBzYW1lIGVuZHBvaW50LiBEbyBub3QgdXNlIHRoaXNcbiAqIGFsb25nc2lkZSBhIG1hbnVhbGx5IGNyZWF0ZWQgYE9yaWdpbkVuZHBvaW50UG9saWN5YCBjb25zdHJ1Y3QgZm9yIHRoZSBzYW1lIGVuZHBvaW50LlxuICpcbiAqIEBleGFtcGxlXG4gKlxuICogICAgZGVjbGFyZSBjb25zdCBlbmRwb2ludDogT3JpZ2luRW5kcG9pbnQ7XG4gKiAgICBkZWNsYXJlIGNvbnN0IGdyb3VwOiBDaGFubmVsR3JvdXA7XG4gKlxuICogICAgbmV3IGNsb3VkZnJvbnQuRGlzdHJpYnV0aW9uKHRoaXMsICdEaXN0Jywge1xuICogICAgICBkZWZhdWx0QmVoYXZpb3I6IHtcbiAqICAgICAgICBvcmlnaW46IG5ldyBNZWRpYVBhY2thZ2VWMk9yaWdpbihlbmRwb2ludCwge1xuICogICAgICAgICAgY2hhbm5lbEdyb3VwOiBncm91cCxcbiAqICAgICAgICB9KSxcbiAqICAgICAgfSxcbiAqICAgIH0pO1xuICpcbiAqIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL0FtYXpvbkNsb3VkRnJvbnQvbGF0ZXN0L0RldmVsb3Blckd1aWRlL3ByaXZhdGUtY29udGVudC1yZXN0cmljdGluZy1hY2Nlc3MtdG8tbWVkaWFwYWNrYWdlLmh0bWxcbiAqL1xuZXhwb3J0IGNsYXNzIE1lZGlhUGFja2FnZVYyT3JpZ2luIGV4dGVuZHMgY2xvdWRmcm9udC5PcmlnaW5CYXNlIHtcbiAgcHJpdmF0ZSBvcmlnaW5BY2Nlc3NDb250cm9sPzogY2xvdWRmcm9udC5JT3JpZ2luQWNjZXNzQ29udHJvbFJlZjtcbiAgcHJpdmF0ZSByZWFkb25seSBlbmRwb2ludDogSU9yaWdpbkVuZHBvaW50O1xuICBwcml2YXRlIHJlYWRvbmx5IGNkbkF1dGg/OiBDZG5BdXRoQ29uZmlndXJhdGlvbjtcblxuICBjb25zdHJ1Y3RvcihlbmRwb2ludDogSU9yaWdpbkVuZHBvaW50LCBwcm9wczogTWVkaWFQYWNrYWdlVjJPcmlnaW5Qcm9wcykge1xuICAgIGlmICghcHJvcHMuY2hhbm5lbEdyb3VwLmVncmVzc0RvbWFpbikge1xuICAgICAgdGhyb3cgbmV3IFVuc2NvcGVkVmFsaWRhdGlvbkVycm9yKFxuICAgICAgICBsaXRgTWlzc2luZ0VncmVzc0RvbWFpbmAsXG4gICAgICAgICdUaGUgY2hhbm5lbCBncm91cCBtdXN0IGhhdmUgYW4gZWdyZXNzRG9tYWluIHRvIHVzZSBhcyBhIENsb3VkRnJvbnQgb3JpZ2luLiBQcm92aWRlIGVncmVzc0RvbWFpbiB3aGVuIGltcG9ydGluZyB0aGUgY2hhbm5lbCBncm91cC4nLFxuICAgICAgKTtcbiAgICB9XG4gICAgc3VwZXIocHJvcHMuY2hhbm5lbEdyb3VwLmVncmVzc0RvbWFpbiwgcHJvcHMpO1xuICAgIHRoaXMuZW5kcG9pbnQgPSBlbmRwb2ludDtcbiAgICB0aGlzLm9yaWdpbkFjY2Vzc0NvbnRyb2wgPSBwcm9wcy5vcmlnaW5BY2Nlc3NDb250cm9sO1xuICAgIHRoaXMuY2RuQXV0aCA9IHByb3BzLmNkbkF1dGg7XG4gIH1cblxuICBwcm90ZWN0ZWQgcmVuZGVyQ3VzdG9tT3JpZ2luQ29uZmlnKCk6IGNsb3VkZnJvbnQuQ2ZuRGlzdHJpYnV0aW9uLkN1c3RvbU9yaWdpbkNvbmZpZ1Byb3BlcnR5IHwgdW5kZWZpbmVkIHtcbiAgICByZXR1cm4ge1xuICAgICAgb3JpZ2luU3NsUHJvdG9jb2xzOiBbY2xvdWRmcm9udC5PcmlnaW5Tc2xQb2xpY3kuVExTX1YxXzJdLFxuICAgICAgb3JpZ2luUHJvdG9jb2xQb2xpY3k6IGNsb3VkZnJvbnQuT3JpZ2luUHJvdG9jb2xQb2xpY3kuSFRUUFNfT05MWSxcbiAgICB9O1xuICB9XG5cbiAgcHVibGljIGJpbmQoc2NvcGU6IENvbnN0cnVjdCwgb3B0aW9uczogY2xvdWRmcm9udC5PcmlnaW5CaW5kT3B0aW9ucyk6IGNsb3VkZnJvbnQuT3JpZ2luQmluZENvbmZpZyB7XG4gICAgY29uc3Qgb3JpZ2luQmluZENvbmZpZyA9IHN1cGVyLmJpbmQoc2NvcGUsIG9wdGlvbnMpO1xuXG4gICAgaWYgKCF0aGlzLm9yaWdpbkFjY2Vzc0NvbnRyb2wpIHtcbiAgICAgIHRoaXMub3JpZ2luQWNjZXNzQ29udHJvbCA9IG5ldyBjbG91ZGZyb250Lk1lZGlhUGFja2FnZVYyT3JpZ2luQWNjZXNzQ29udHJvbChzY29wZSwgJ01lZGlhUGFja2FnZVYyT0FDJyk7XG4gICAgfVxuXG4gICAgLy8gR3JhbnQgdGhlIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9uIGFjY2VzcyB0byB0aGUgTWVkaWFQYWNrYWdlIFYyIG9yaWdpbiBlbmRwb2ludFxuICAgIC8vIEluY2x1ZGVzIEdldEhlYWRPYmplY3QgZm9yIE1RQVIgKE1lZGlhIFF1YWxpdHktQXdhcmUgUmVzaWxpZW5jeSkgc3VwcG9ydFxuICAgIC8vIEBzZWUgaHR0cHM6Ly9kb2NzLmF3cy5hbWF6b24uY29tL0FtYXpvbkNsb3VkRnJvbnQvbGF0ZXN0L0RldmVsb3Blckd1aWRlL3ByaXZhdGUtY29udGVudC1yZXN0cmljdGluZy1hY2Nlc3MtdG8tbWVkaWFwYWNrYWdlLmh0bWxcbiAgICB0aGlzLmVuZHBvaW50LmFkZFRvUmVzb3VyY2VQb2xpY3koXG4gICAgICBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgc2lkOiAnQWxsb3dDbG91ZEZyb250U2VydmljZVByaW5jaXBhbCcsXG4gICAgICAgIGVmZmVjdDogRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbbmV3IFNlcnZpY2VQcmluY2lwYWwoJ2Nsb3VkZnJvbnQuYW1hem9uYXdzLmNvbScpXSxcbiAgICAgICAgYWN0aW9uczogWydtZWRpYXBhY2thZ2V2MjpHZXRPYmplY3QnLCAnbWVkaWFwYWNrYWdldjI6R2V0SGVhZE9iamVjdCddLFxuICAgICAgICByZXNvdXJjZXM6IFt0aGlzLmVuZHBvaW50Lm9yaWdpbkVuZHBvaW50QXJuXSxcbiAgICAgICAgY29uZGl0aW9uczoge1xuICAgICAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAgICAgJ2F3czpTb3VyY2VBcm4nOiBjZGsuU3RhY2sub2Yoc2NvcGUpLmZvcm1hdEFybih7XG4gICAgICAgICAgICAgIHNlcnZpY2U6ICdjbG91ZGZyb250JyxcbiAgICAgICAgICAgICAgcmVnaW9uOiAnJyxcbiAgICAgICAgICAgICAgcmVzb3VyY2U6ICdkaXN0cmlidXRpb24nLFxuICAgICAgICAgICAgICByZXNvdXJjZU5hbWU6IG9wdGlvbnMuZGlzdHJpYnV0aW9uSWQsXG4gICAgICAgICAgICB9KSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSksXG4gICAgICB0aGlzLmNkbkF1dGgsXG4gICAgKTtcblxuICAgIHJldHVybiB7XG4gICAgICAuLi5vcmlnaW5CaW5kQ29uZmlnLFxuICAgICAgb3JpZ2luUHJvcGVydHk6IHtcbiAgICAgICAgLi4ub3JpZ2luQmluZENvbmZpZy5vcmlnaW5Qcm9wZXJ0eSEsXG4gICAgICAgIG9yaWdpbkFjY2Vzc0NvbnRyb2xJZDogdGhpcy5vcmlnaW5BY2Nlc3NDb250cm9sLm9yaWdpbkFjY2Vzc0NvbnRyb2xSZWYub3JpZ2luQWNjZXNzQ29udHJvbElkLFxuICAgICAgfSxcbiAgICB9O1xuICB9XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xvdWRmcm9udC1vcmlnaW4uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJjbG91ZGZyb250LW9yaWdpbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLGlEQUFtQztBQUNuQyx1RUFBeUQ7QUFDekQsaURBQWdGO0FBQ2hGLDJDQUEyRDtBQUMzRCw0RUFBNEQ7QUF3QjVEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0F3Qkc7QUFDSCxNQUFhLG9CQUFxQixTQUFRLFVBQVUsQ0FBQyxVQUFVOztJQUNyRCxtQkFBbUIsQ0FBc0M7SUFDaEQsUUFBUSxDQUFrQjtJQUUzQyxZQUFZLFFBQXlCLEVBQUUsS0FBZ0M7Ozs7Ozs7K0NBSjVELG9CQUFvQjs7OztRQUs3QixJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksOEJBQXVCLENBQy9CLElBQUEsc0JBQUcsRUFBQSxxQkFBcUIsRUFDeEIsbUlBQW1JLENBQ3BJLENBQUM7UUFDSixDQUFDO1FBQ0QsS0FBSyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFDO1FBQ3pCLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxLQUFLLENBQUMsbUJBQW1CLENBQUM7S0FDdEQ7SUFFUyx3QkFBd0I7UUFDaEMsT0FBTztZQUNMLGtCQUFrQixFQUFFLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUM7WUFDekQsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQixDQUFDLFVBQVU7U0FDakUsQ0FBQztLQUNIO0lBRU0sSUFBSSxDQUFDLEtBQWdCLEVBQUUsT0FBcUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQztRQUVwRCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLG1CQUFtQixHQUFHLElBQUksVUFBVSxDQUFDLGlDQUFpQyxDQUFDLEtBQUssRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO1FBQzFHLENBQUM7UUFFRCxrRkFBa0Y7UUFDbEYsMkVBQTJFO1FBQzNFLGtJQUFrSTtRQUNsSSxJQUFJLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUMvQixJQUFJLHlCQUFlLENBQUM7WUFDbEIsR0FBRyxFQUFFLGlDQUFpQztZQUN0QyxNQUFNLEVBQUUsZ0JBQU0sQ0FBQyxLQUFLO1lBQ3BCLFVBQVUsRUFBRSxDQUFDLElBQUksMEJBQWdCLENBQUMsMEJBQTBCLENBQUMsQ0FBQztZQUM5RCxPQUFPLEVBQUUsQ0FBQywwQkFBMEIsRUFBRSw4QkFBOEIsQ0FBQztZQUNyRSxTQUFTLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDO1lBQzVDLFVBQVUsRUFBRTtnQkFDVixZQUFZLEVBQUU7b0JBQ1osZUFBZSxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQzt3QkFDN0MsT0FBTyxFQUFFLFlBQVk7d0JBQ3JCLE1BQU0sRUFBRSxFQUFFO3dCQUNWLFFBQVEsRUFBRSxjQUFjO3dCQUN4QixZQUFZLEVBQUUsT0FBTyxDQUFDLGNBQWM7cUJBQ3JDLENBQUM7aUJBQ0g7YUFDRjtTQUNGLENBQUMsQ0FDSCxDQUFDO1FBRUYsT0FBTztZQUNMLEdBQUcsZ0JBQWdCO1lBQ25CLGNBQWMsRUFBRTtnQkFDZCxHQUFHLGdCQUFnQixDQUFDLGNBQWU7Z0JBQ25DLHFCQUFxQixFQUFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxzQkFBc0IsQ0FBQyxxQkFBcUI7YUFDN0Y7U0FDRixDQUFDO0tBQ0g7O0FBNURILG9EQTZEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIGNkayBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBjbG91ZGZyb250IGZyb20gJ2F3cy1jZGstbGliL2F3cy1jbG91ZGZyb250JztcbmltcG9ydCB7IEVmZmVjdCwgUG9saWN5U3RhdGVtZW50LCBTZXJ2aWNlUHJpbmNpcGFsIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBVbnNjb3BlZFZhbGlkYXRpb25FcnJvciB9IGZyb20gJ2F3cy1jZGstbGliL2NvcmUnO1xuaW1wb3J0IHsgbGl0IH0gZnJvbSAnYXdzLWNkay1saWIvY29yZS9saWIvaGVscGVycy1pbnRlcm5hbCc7XG5pbXBvcnQgdHlwZSB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHR5cGUgeyBJT3JpZ2luRW5kcG9pbnQgfSBmcm9tICcuL2VuZHBvaW50JztcbmltcG9ydCB0eXBlIHsgSUNoYW5uZWxHcm91cCB9IGZyb20gJy4vZ3JvdXAnO1xuXG4vKipcbiAqIFByb3BlcnRpZXMgZm9yIGEgTWVkaWFQYWNrYWdlIFYyIE9yaWdpbiB3aXRoIE9BQy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBNZWRpYVBhY2thZ2VWMk9yaWdpblByb3BzIGV4dGVuZHMgY2xvdWRmcm9udC5PcmlnaW5Qcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgY2hhbm5lbCBncm91cCB0aGF0IHRoZSBvcmlnaW4gZW5kcG9pbnQgYmVsb25ncyB0by5cbiAgICpcbiAgICogVXNlZCB0byBkZXJpdmUgdGhlIGVncmVzcyBkb21haW4gZm9yIHRoZSBDbG91ZEZyb250IG9yaWdpbi5cbiAgICovXG4gIHJlYWRvbmx5IGNoYW5uZWxHcm91cDogSUNoYW5uZWxHcm91cDtcblxuICAvKipcbiAgICogQW4gb3B0aW9uYWwgT3JpZ2luIEFjY2VzcyBDb250cm9sLlxuICAgKlxuICAgKiBAZGVmYXVsdCAtIGFuIE9yaWdpbiBBY2Nlc3MgQ29udHJvbCB3aWxsIGJlIGNyZWF0ZWQgYXV0b21hdGljYWxseS5cbiAgICovXG4gIHJlYWRvbmx5IG9yaWdpbkFjY2Vzc0NvbnRyb2w/OiBjbG91ZGZyb250LklPcmlnaW5BY2Nlc3NDb250cm9sUmVmO1xufVxuXG4vKipcbiAqIEEgQ2xvdWRGcm9udCBPcmlnaW4gZm9yIEFXUyBFbGVtZW50YWwgTWVkaWFQYWNrYWdlIFYyIGVuZHBvaW50cy5cbiAqXG4gKiBBdXRvbWF0aWNhbGx5IGNyZWF0ZXMgYW4gT0FDIGFuZCB3aXJlcyB0aGUgb3JpZ2luIGVuZHBvaW50IHBvbGljeVxuICogdG8gZ3JhbnQgdGhlIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9uIGFjY2Vzcy5cbiAqXG4gKiBVc2VzIGBhZGRUb1Jlc291cmNlUG9saWN5KClgIG9uIHRoZSBvcmlnaW4gZW5kcG9pbnQsIHdoaWNoIGlzIGNvbXBhdGlibGVcbiAqIHdpdGggb3RoZXIgcG9saWN5IHN0YXRlbWVudHMgYWRkZWQgdG8gdGhlIHNhbWUgZW5kcG9pbnQuIERvIG5vdCB1c2UgdGhpc1xuICogYWxvbmdzaWRlIGEgbWFudWFsbHkgY3JlYXRlZCBgT3JpZ2luRW5kcG9pbnRQb2xpY3lgIGNvbnN0cnVjdCBmb3IgdGhlIHNhbWUgZW5kcG9pbnQuXG4gKlxuICogQGV4YW1wbGVcbiAqXG4gKiAgICBkZWNsYXJlIGNvbnN0IGVuZHBvaW50OiBPcmlnaW5FbmRwb2ludDtcbiAqICAgIGRlY2xhcmUgY29uc3QgZ3JvdXA6IENoYW5uZWxHcm91cDtcbiAqXG4gKiAgICBuZXcgY2xvdWRmcm9udC5EaXN0cmlidXRpb24odGhpcywgJ0Rpc3QnLCB7XG4gKiAgICAgIGRlZmF1bHRCZWhhdmlvcjoge1xuICogICAgICAgIG9yaWdpbjogbmV3IE1lZGlhUGFja2FnZVYyT3JpZ2luKGVuZHBvaW50LCB7XG4gKiAgICAgICAgICBjaGFubmVsR3JvdXA6IGdyb3VwLFxuICogICAgICAgIH0pLFxuICogICAgICB9LFxuICogICAgfSk7XG4gKlxuICogQHNlZSBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQW1hem9uQ2xvdWRGcm9udC9sYXRlc3QvRGV2ZWxvcGVyR3VpZGUvcHJpdmF0ZS1jb250ZW50LXJlc3RyaWN0aW5nLWFjY2Vzcy10by1tZWRpYXBhY2thZ2UuaHRtbFxuICovXG5leHBvcnQgY2xhc3MgTWVkaWFQYWNrYWdlVjJPcmlnaW4gZXh0ZW5kcyBjbG91ZGZyb250Lk9yaWdpbkJhc2Uge1xuICBwcml2YXRlIG9yaWdpbkFjY2Vzc0NvbnRyb2w/OiBjbG91ZGZyb250LklPcmlnaW5BY2Nlc3NDb250cm9sUmVmO1xuICBwcml2YXRlIHJlYWRvbmx5IGVuZHBvaW50OiBJT3JpZ2luRW5kcG9pbnQ7XG5cbiAgY29uc3RydWN0b3IoZW5kcG9pbnQ6IElPcmlnaW5FbmRwb2ludCwgcHJvcHM6IE1lZGlhUGFja2FnZVYyT3JpZ2luUHJvcHMpIHtcbiAgICBpZiAoIXByb3BzLmNoYW5uZWxHcm91cC5lZ3Jlc3NEb21haW4pIHtcbiAgICAgIHRocm93IG5ldyBVbnNjb3BlZFZhbGlkYXRpb25FcnJvcihcbiAgICAgICAgbGl0YE1pc3NpbmdFZ3Jlc3NEb21haW5gLFxuICAgICAgICAnVGhlIGNoYW5uZWwgZ3JvdXAgbXVzdCBoYXZlIGFuIGVncmVzc0RvbWFpbiB0byB1c2UgYXMgYSBDbG91ZEZyb250IG9yaWdpbi4gUHJvdmlkZSBlZ3Jlc3NEb21haW4gd2hlbiBpbXBvcnRpbmcgdGhlIGNoYW5uZWwgZ3JvdXAuJyxcbiAgICAgICk7XG4gICAgfVxuICAgIHN1cGVyKHByb3BzLmNoYW5uZWxHcm91cC5lZ3Jlc3NEb21haW4sIHByb3BzKTtcbiAgICB0aGlzLmVuZHBvaW50ID0gZW5kcG9pbnQ7XG4gICAgdGhpcy5vcmlnaW5BY2Nlc3NDb250cm9sID0gcHJvcHMub3JpZ2luQWNjZXNzQ29udHJvbDtcbiAgfVxuXG4gIHByb3RlY3RlZCByZW5kZXJDdXN0b21PcmlnaW5Db25maWcoKTogY2xvdWRmcm9udC5DZm5EaXN0cmlidXRpb24uQ3VzdG9tT3JpZ2luQ29uZmlnUHJvcGVydHkgfCB1bmRlZmluZWQge1xuICAgIHJldHVybiB7XG4gICAgICBvcmlnaW5Tc2xQcm90b2NvbHM6IFtjbG91ZGZyb250Lk9yaWdpblNzbFBvbGljeS5UTFNfVjFfMl0sXG4gICAgICBvcmlnaW5Qcm90b2NvbFBvbGljeTogY2xvdWRmcm9udC5PcmlnaW5Qcm90b2NvbFBvbGljeS5IVFRQU19PTkxZLFxuICAgIH07XG4gIH1cblxuICBwdWJsaWMgYmluZChzY29wZTogQ29uc3RydWN0LCBvcHRpb25zOiBjbG91ZGZyb250Lk9yaWdpbkJpbmRPcHRpb25zKTogY2xvdWRmcm9udC5PcmlnaW5CaW5kQ29uZmlnIHtcbiAgICBjb25zdCBvcmlnaW5CaW5kQ29uZmlnID0gc3VwZXIuYmluZChzY29wZSwgb3B0aW9ucyk7XG5cbiAgICBpZiAoIXRoaXMub3JpZ2luQWNjZXNzQ29udHJvbCkge1xuICAgICAgdGhpcy5vcmlnaW5BY2Nlc3NDb250cm9sID0gbmV3IGNsb3VkZnJvbnQuTWVkaWFQYWNrYWdlVjJPcmlnaW5BY2Nlc3NDb250cm9sKHNjb3BlLCAnTWVkaWFQYWNrYWdlVjJPQUMnKTtcbiAgICB9XG5cbiAgICAvLyBHcmFudCB0aGUgQ2xvdWRGcm9udCBkaXN0cmlidXRpb24gYWNjZXNzIHRvIHRoZSBNZWRpYVBhY2thZ2UgVjIgb3JpZ2luIGVuZHBvaW50XG4gICAgLy8gSW5jbHVkZXMgR2V0SGVhZE9iamVjdCBmb3IgTVFBUiAoTWVkaWEgUXVhbGl0eS1Bd2FyZSBSZXNpbGllbmN5KSBzdXBwb3J0XG4gICAgLy8gQHNlZSBodHRwczovL2RvY3MuYXdzLmFtYXpvbi5jb20vQW1hem9uQ2xvdWRGcm9udC9sYXRlc3QvRGV2ZWxvcGVyR3VpZGUvcHJpdmF0ZS1jb250ZW50LXJlc3RyaWN0aW5nLWFjY2Vzcy10by1tZWRpYXBhY2thZ2UuaHRtbFxuICAgIHRoaXMuZW5kcG9pbnQuYWRkVG9SZXNvdXJjZVBvbGljeShcbiAgICAgIG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBzaWQ6ICdBbGxvd0Nsb3VkRnJvbnRTZXJ2aWNlUHJpbmNpcGFsJyxcbiAgICAgICAgZWZmZWN0OiBFZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtuZXcgU2VydmljZVByaW5jaXBhbCgnY2xvdWRmcm9udC5hbWF6b25hd3MuY29tJyldLFxuICAgICAgICBhY3Rpb25zOiBbJ21lZGlhcGFja2FnZXYyOkdldE9iamVjdCcsICdtZWRpYXBhY2thZ2V2MjpHZXRIZWFkT2JqZWN0J10sXG4gICAgICAgIHJlc291cmNlczogW3RoaXMuZW5kcG9pbnQub3JpZ2luRW5kcG9pbnRBcm5dLFxuICAgICAgICBjb25kaXRpb25zOiB7XG4gICAgICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICAgICAnYXdzOlNvdXJjZUFybic6IGNkay5TdGFjay5vZihzY29wZSkuZm9ybWF0QXJuKHtcbiAgICAgICAgICAgICAgc2VydmljZTogJ2Nsb3VkZnJvbnQnLFxuICAgICAgICAgICAgICByZWdpb246ICcnLFxuICAgICAgICAgICAgICByZXNvdXJjZTogJ2Rpc3RyaWJ1dGlvbicsXG4gICAgICAgICAgICAgIHJlc291cmNlTmFtZTogb3B0aW9ucy5kaXN0cmlidXRpb25JZCxcbiAgICAgICAgICAgIH0pLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICB9KSxcbiAgICApO1xuXG4gICAgcmV0dXJuIHtcbiAgICAgIC4uLm9yaWdpbkJpbmRDb25maWcsXG4gICAgICBvcmlnaW5Qcm9wZXJ0eToge1xuICAgICAgICAuLi5vcmlnaW5CaW5kQ29uZmlnLm9yaWdpblByb3BlcnR5ISxcbiAgICAgICAgb3JpZ2luQWNjZXNzQ29udHJvbElkOiB0aGlzLm9yaWdpbkFjY2Vzc0NvbnRyb2wub3JpZ2luQWNjZXNzQ29udHJvbFJlZi5vcmlnaW5BY2Nlc3NDb250cm9sSWQsXG4gICAgICB9LFxuICAgIH07XG4gIH1cbn1cbiJdfQ==

package/lib/endpoint.d.ts

@@ -3,7 +3,8 @@ import { RemovalPolicy, Duration, Resource } from 'aws-cdk-lib';
 import type { ICertificate } from 'aws-cdk-lib/aws-certificatemanager';
 import type { MetricOptions } from 'aws-cdk-lib/aws-cloudwatch';
 import { Metric } from 'aws-cdk-lib/aws-cloudwatch';
-import type { IRole, PolicyStatement, AddToResourcePolicyResult } from 'aws-cdk-lib/aws-iam';
+import type { IRole, AddToResourcePolicyResult } from 'aws-cdk-lib/aws-iam';
+import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
 import { CfnOriginEndpoint } from 'aws-cdk-lib/aws-mediapackagev2';
 import type { IOriginEndpointRef, OriginEndpointReference } from 'aws-cdk-lib/aws-mediapackagev2';
 import type { Construct } from 'constructs';
@@ -617,9 +618,8 @@ export interface IOriginEndpoint extends IResource, IOriginEndpointRef {
      * If you have already defined one, it will append to the policy already created.
      *
      * @param statement - The policy statement to add
-     * @param cdnAuth - Optional CDN authorization configuration. Only the first CDN auth configuration is used if provided multiple times.
      */
-    addToResourcePolicy(statement: PolicyStatement, cdnAuth?: CdnAuthConfiguration): AddToResourcePolicyResult;
+    addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
     /**
      * Create a CloudWatch metric.
      *
@@ -1343,6 +1343,35 @@ export interface OriginEndpointOptions {
     /**
      * Provide access to MediaPackage V2 Origin Endpoint via secret header.
      *
+     * Use this when your CDN doesn't support AWS Signature Version 4 (SigV4)
+     * authentication. For SigV4-based access with Amazon CloudFront, see
+     * `MediaPackageV2Origin`.
+     *
+     * Setting `cdnAuth` auto-creates the following policy on the OriginEndpoint:
+     *
+     * ```json
+     * {
+     *   "Version":"2012-10-17",
+     *   "Statement": [
+     *     {
+     *       "Sid": "AllowGetObjectAccessForAuthorizedRequest",
+     *       "Effect": "Allow",
+     *       "Principal": "*",
+     *       "Action": "mediapackagev2:GetObject",
+     *       "Resource": "arn:aws:mediapackagev2:us-east-1:111122223333:channelGroup/channelGroupName/channel/channelName/originEndpoint/originEndpointName",
+     *       "Condition": {
+     *         "Bool": {
+     *           "mediapackagev2:RequestHasMatchingCdnAuthHeader": "true"
+     *         }
+     *       }
+     *     }
+     *   ]
+     * }
+     * ```
+     *
+     * @see https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth.html
+     * @see https://docs.aws.amazon.com/mediapackage/latest/userguide/cdn-auth-setup.html
+     *
      * @default undefined - Not configured on endpoint
      */
     readonly cdnAuth?: CdnAuthConfiguration;
@@ -1869,20 +1898,20 @@ declare abstract class OriginEndpointBase extends Resource implements IOriginEnd
     protected abstract autoCreatePolicy: boolean;
     /**
      * CDN authorization configuration to be applied when the policy is created.
+     * Set by subclass constructors when `cdnAuth` is provided in props.
      */
-    private cdnAuthConfig?;
+    protected cdnAuthConfig?: CdnAuthConfiguration;
     /**
      * Configure origin endpoint policy.
      *
-     * You can only add 1 OriginEndpointPolicy to an OriginEndpoint.
-     * If you have already defined one, it will append to the policy already created.
+     * You can only add 1 OriginEndpointPolicy to an OriginEndpoint. If you have already
+     * defined one, this will append to the policy already created.
+     *
+     * To configure CDN authentication, set `cdnAuth` on the construct's props instead.
      *
      * @param statement - The policy statement to add
-     * @param cdnAuth - Optional CDN authorization configuration. If provided, the policy will be
-     *                  created with CDN authentication enabled using secrets from AWS Secrets Manager.
-     *                  If cdnAuth is provided multiple times, only the first configuration is used.
      */
-    addToResourcePolicy(statement: PolicyStatement, cdnAuth?: CdnAuthConfiguration): AddToResourcePolicyResult;
+    addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult;
     /**
      * Validate and modify Segment configuration for endpoint.
      */