cdk-nextjs 0.7.12 → 0.7.14

package/README.md

@@ -36,6 +36,17 @@ Deploy [Next.js](https://nextjs.org/) apps on [AWS](https://aws.amazon.com/) wit
 - [Bring Your Own Resources](#bring-your-own-resources) — import existing AWS resources (CloudFront distributions, ECS clusters, ALBs, S3 buckets, DynamoDB tables).
 - [AWS GovCloud (US)](https://aws.amazon.com/govcloud-us) compatible with `NextjsRegionalFunctions` and `NextjsRegionalContainers`.
 
+## Why
+
+The simplest path to deploy Next.js is on [Vercel](https://vercel.com/) - the Platform-as-a-Service company behind Next.js. However, deploying to Vercel can be expensive and some developers want all of their workloads running _directly_ on AWS. Developers can deploy Next.js on AWS through [AWS Amplify Hosting](https://docs.aws.amazon.com/amplify/latest/userguide/ssr-Amplifysupport.html), but Amplify does not support all Next.js features and manages AWS resources for you so they cannot be customized. If Amplify meets your requirements we recommend you use it, but if you want to use all Next.js features or want more visibility into the AWS resources then this construct is for you.
+
+## Design Principles
+
+- Integrate through Next.js's official interfaces. Build on the [Deployment Adapter](https://nextjs.org/docs/app/guides/deployment-adapters) API and [`@next/routing`](https://www.npmjs.com/package/@next/routing) rather than Next.js internals, so new Next.js versions rarely break this construct. Where no public interface exists yet, the dependency is listed in [Next.js private APIs](docs/nextjs-private-apis.md).
+- Security first.
+- One architecture does not fit all.
+- Enable customization everywhere.
+
 ## Prerequisites
 
 - Next.js app running v16.3 or higher (`next build` fails on older versions). If you don't have one yet - follow [these steps](https://nextjs.org/docs/getting-started) to create one.
@@ -102,6 +113,34 @@ new WebStack(app, "web-stack");
 
 See [examples/](./examples/) for more usage examples.
 
+## Architecture
+
+How requests are served inside the compute — the adapter runtime, and where it deliberately differs from `next start` — is in [docs/adapter-runtime.md](./docs/adapter-runtime.md).
+
+### `NextjsGlobalFunctions`
+
+Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this construct when you have unpredictable traffic, can afford occasional latency (i.e. cold starts - [typically 1% of production traffic](https://aws.amazon.com/blogs/compute/operating-lambda-performance-optimization-part-1/)), and/or want the most granular pricing model. ([code](./src/root-constructs/nextjs-global-functions.ts))
+
+![NextjsGlobalFunctions architecture: User to CloudFront, which serves S3 static assets and forwards to a Lambda function backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-global-functions.svg)
+
+### `NextjsGlobalContainers`
+
+Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this option when you have predictable traffic, need the lowest latency, and/or can afford a less granular pricing model. ([code](./src/root-constructs/nextjs-global-containers.ts))
+
+![NextjsGlobalContainers architecture: User to CloudFront, which serves S3 static assets and forwards to an Application Load Balancer and ECS Fargate containers in a VPC, backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-global-containers.svg)
+
+### `NextjsRegionalContainers`
+
+Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) to regionally serve requests. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-containers.ts#L41))
+
+![NextjsRegionalContainers architecture: User to an Application Load Balancer and ECS Fargate containers in a VPC, backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-regional-containers.svg)
+
+### `NextjsRegionalFunctions`
+
+Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [API Gateway REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-rest-api.html) to regionally serve requests and distribute static assets. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-functions.ts))
+
+![NextjsRegionalFunctions architecture: User to an API Gateway REST API, which serves S3 static assets and forwards to a Lambda function backed by a DynamoDB table and S3 cache bucket](https://raw.githubusercontent.com/cdklabs/cdk-nextjs/main/docs/diagrams/nextjs-regional-functions.svg)
+
 ## Configuration
 
 The variables below are read at runtime by the cache handler inside your deployed
@@ -415,114 +454,90 @@ Notes:
 - Per-group `overrides` let you size each function independently:
   `{ name: "reports", routes: [...], overrides: { functionProps: { memorySize: 2048 } } }`.
 
-## Architecture
+## Running Code on Every Viewer Request
 
-How requests are served inside the compute — the adapter runtime, and where it deliberately differs from `next start` — is in [docs/adapter-runtime.md](./docs/adapter-runtime.md).
-
-### `NextjsGlobalFunctions`
-
-Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this construct when you have unpredictable traffic, can afford occasional latency (i.e. cold starts - [typically 1% of production traffic](https://aws.amazon.com/blogs/compute/operating-lambda-performance-optimization-part-1/)), and/or want the most granular pricing model. ([code](./src/root-constructs/nextjs-global-functions.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service cloudfront(server)[CloudFront Distribution] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service lambda(server)[Lambda Function] in aws
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:cloudfront
-    cloudfront:R --> L:s3static
-    cloudfront:R --> L:lambda
-    lambda:R --> L:dynamodb
-    lambda:R --> L:s3cache
-```
-
-### `NextjsGlobalContainers`
-
-Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html) Distribution to globally serve requests and distribute static assets. Use this option when you have predictable traffic, need the lowest latency, and/or can afford a less granular pricing model. ([code](./src/root-constructs/nextjs-global-containers.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group vpc[VPC] in aws
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service cloudfront(server)[CloudFront Distribution] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service alb(server)[Application Load Balancer] in vpc
-    service fargate(server)[ECS Fargate Containers] in vpc
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:cloudfront
-    cloudfront:R --> L:s3static
-    cloudfront:R --> L:alb
-    alb:R --> L:fargate
-    fargate:R --> L:dynamodb
-    fargate:R --> L:s3cache
-```
-
-### `NextjsRegionalContainers`
+`NextjsGlobalFunctions` and `NextjsGlobalContainers` take a
+`viewerRequestFunctionCode` prop: CloudFront Function code that runs first on
+every request, on every behavior cdk-nextjs adds — pages, API routes,
+`_next/image`, `_next/static` and `public/` files alike. It's the place for a
+gate the whole site has to pass, such as HTTP Basic auth before launch:
 
-Architecture includes [ECS Fargate](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html) containers to respond to dynamic requests and [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) to regionally serve requests. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-containers.ts#L41))
+```ts
+import { FunctionCode, KeyValueStore } from "aws-cdk-lib/aws-cloudfront";
 
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group vpc[VPC] in aws
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service alb(server)[Application Load Balancer] in vpc
-    service fargate(server)[ECS Fargate Containers] in vpc
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:alb
-    alb:R --> L:fargate
-    fargate:R --> L:dynamodb
-    fargate:R --> L:s3cache
+const credentials = new KeyValueStore(this, "Credentials");
+new NextjsGlobalFunctions(this, "Nextjs", {
+  buildDirectory: join(import.meta.dirname),
+  viewerRequestKeyValueStore: credentials,
+  viewerRequestFunctionCode: FunctionCode.fromInline(`
+    import cf from "cloudfront";
+    const kvs = cf.kvs();
+    async function viewerRequest(event) {
+      const auth = event.request.headers.authorization;
+      try {
+        if (auth && auth.value === "Basic " + (await kvs.get("basic-auth"))) {
+          // verified: don't pass the site's credentials on to the origin
+          delete event.request.headers.authorization;
+          return;
+        }
+      } catch (e) {
+        // no "basic-auth" key yet: stay locked
+      }
+      return {
+        statusCode: 401,
+        statusDescription: "Unauthorized",
+        headers: { "www-authenticate": { value: 'Basic realm="preview"' } },
+      };
+    }
+  `),
+});
 ```
 
-### `NextjsRegionalFunctions`
+Then put the credentials in the store, outside the template:
 
-Architecture includes [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) Functions to respond to dynamic requests and [API Gateway REST API](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-rest-api.html) to regionally serve requests and distribute static assets. Use this options when you cannot use Amazon CloudFront (i.e. [AWS GovCloud](https://aws.amazon.com/govcloud-us/?whats-new.sort-by=item.additionalFields.postDateTime&whats-new.sort-order=desc)). ([code](./src/root-constructs/nextjs-regional-functions.ts))
-
-```mermaid
-architecture-beta
-    group aws(cloud)[AWS Cloud]
-    group cache[Cache Layer] in aws
-
-    service user(internet)[User]
-    service apigateway(server)[API Gateway REST API] in aws
-    service s3static(disk)[S3 Static Assets] in aws
-    service lambda(server)[Lambda Function] in aws
-    service dynamodb(database)[DynamoDB Table] in cache
-    service s3cache(disk)[S3 Cache Bucket] in cache
-
-    user:R --> L:apigateway
-    apigateway:R --> L:s3static
-    apigateway:R --> L:lambda
-    lambda:R --> L:dynamodb
-    lambda:R --> L:s3cache
+```sh
+KVS_ARN=... # the store's ARN
+aws cloudfront-keyvaluestore put-key --kvs-arn "$KVS_ARN" \
+  --key basic-auth --value "$(printf 'user:pass' | base64 | tr -d '\n')" \
+  --if-match "$(aws cloudfront-keyvaluestore describe-key-value-store \
+    --kvs-arn "$KVS_ARN" --query ETag --output text)"
 ```
 
-## Why
-
-The simplest path to deploy Next.js is on [Vercel](https://vercel.com/) - the Platform-as-a-Service company behind Next.js. However, deploying to Vercel can be expensive and some developers want all of their workloads running _directly_ on AWS. Developers can deploy Next.js on AWS through [AWS Amplify Hosting](https://docs.aws.amazon.com/amplify/latest/userguide/ssr-Amplifysupport.html), but Amplify does not support all Next.js features and manages AWS resources for you so they cannot be customized. If Amplify meets your requirements we recommend you use it, but if you want to use all Next.js features or want more visibility into the AWS resources then this construct is for you.
-
-## Design Principles
-
-- Integrate through Next.js's official interfaces. Build on the [Deployment Adapter](https://nextjs.org/docs/app/guides/deployment-adapters) API and [`@next/routing`](https://www.npmjs.com/package/@next/routing) rather than Next.js internals, so new Next.js versions rarely break this construct. Where no public interface exists yet, the dependency is listed in [Next.js private APIs](docs/nextjs-private-apis.md).
-- Security first.
-- One architecture does not fit all.
-- Enable customization everywhere.
+The code must define `viewerRequest(event)`, as a function (`async` or not)
+or a `var`/`let`/`const`. It's a CloudFront Function handler in all but name:
+return a response to answer the viewer, or the request (or nothing) to carry
+on.
+
+Why not a function of your own on viewer-request? CloudFront allows one per
+event type per behavior, and on Global Functions cdk-nextjs's own one
+overwrites `X-Forwarded-Host` and redirects repeated slashes. So your code is
+spliced into that function, ahead of cdk-nextjs's logic, which still runs after
+it, so your code can't undo the `X-Forwarded-Host` overwrite. Middleware can't
+do this instead: on Global Functions CloudFront signs the request to the
+Function URL with the `Authorization` header, and static assets never reach the
+server at all.
+
+- cdk-nextjs's CloudFront Functions run on `cloudfront-js-2.0`, so your code
+  can be `async`, and `import cf from "cloudfront"` works when it comes first,
+  as it does above.
+- `viewerRequestKeyValueStore` is associated with every viewer-request function
+  your code is copied into (up to three, one per kind of behavior), so
+  `cf.kvs()` reads it with no ID wherever the code runs. Credentials written
+  inline in the code instead end up in the CloudFormation template.
+- The combined function, cdk-nextjs's code included, must fit CloudFront's
+  10 KB limit; synth fails if it doesn't (or warns, if the code contains a
+  CDK token, whose size isn't known until deploy).
+- Your code shares the file with cdk-nextjs's `handler`, so it can't use the
+  name `handler` at all, even in a comment or a string; synth refuses it.
+- A viewer-request association in `overrides.*BehaviorOptions.functionAssociations`
+  on a behavior this covers is refused at synth; put that logic in
+  `viewerRequestFunctionCode` instead. So is
+  `overrides.distributionProps.defaultBehavior` without a `basePath`, since it
+  would replace the default behavior the code runs on; customize it through
+  `overrides.dynamicBehaviorOptions`.
+- A bring-your-own `distribution`'s default behavior is yours, so it isn't
+  covered. Only the behaviors cdk-nextjs adds are; under a `basePath`, those
+  include the ones that stand in for the default behavior.
 
 ## Bring Your Own Resources
 

package/docs/breaking-changes.md

@@ -447,8 +447,10 @@ absolute URLs, cached for other viewers). Now:
 
 - associations on other event types (viewer-response, say) are added next to it;
 - an association on viewer-request throws at synth, since CloudFront allows one
-  function per event type per behavior. Move that logic to viewer-response or
-  into middleware.
+  function per event type per behavior. Move that logic into the
+  `viewerRequestFunctionCode` prop, which runs it inside cdk-nextjs's own
+  viewer-request function on every behavior, static assets included (see
+  [Running Code on Every Viewer Request](../README.md#running-code-on-every-viewer-request)).
 
 The runtime trusts `X-Forwarded-Host` only on a request Lambda reports as
 IAM-authenticated, so a Function URL overridden to `authType: NONE` builds its

package/docs/development-guide.md

@@ -66,3 +66,13 @@ Both `build` and `dev` chain it explicitly (`npm run sync-cdk-nextjs && next …
 For iterative development, just run `pnpm build` from the root to rebuild the adapter, then `pnpm build` in the example app—the sync step will copy the latest version.
 
 Note that `pnpm install` recreates the `link:../..` symlink, so always go through `pnpm build` / `pnpm dev`. Invoking `next build` or `next dev` directly skips the sync and Turbopack then fails on the symlinked path, e.g. `FileSystemPath("app-playground").join("./../../lib/adapter/cache-handler.mjs") leaves the filesystem root`.
+
+## Architecture Diagrams
+
+The README's architecture diagrams are Mermaid [`architecture-beta`](https://mermaid.js.org/syntax/architecture.html) sources in [`docs/diagrams/`](./diagrams/), rendered to SVG with AWS icons from the Iconify [`logos`](https://icon-sets.iconify.design/logos/?keyword=aws) set (`logos:aws-lambda`, `logos:aws-cloudfront`, ...). After editing a `.mmd` file:
+
+```bash
+pnpm diagrams
+```
+
+Commit the `.mmd` and the regenerated `.svg` together. `pnpm test` fails if an SVG is stale against its source. The README links the SVGs on `main`, so a PR's README preview shows the old diagrams until it merges; open the SVG in the PR's files view to see the new one.

package/docs/harness-coverage.md

@@ -39,8 +39,8 @@ verify, which every e2e-harness run does in shard 1).
 | edge-free (the hard ceiling)  | 1009    |
 | candidates after every screen | **165** |
 | deployed and screened         | 472     |
-| in `rules.include`            | 421     |
-| plus, per-case, in `suites`   | 14      |
+| in `rules.include`            | 419     |
+| plus, per-case, in `suites`   | 16      |
 
 16.4 reopened the candidate pool. next.js replaced most `skipDeployment: true`
 calls with `// @force-gate !deploy` pragmas, and in doing so dropped the deploy
@@ -57,7 +57,7 @@ included files passing on each scheduled run.
 
 | Verdict       | Files                                                                                                                                                                                                                                                                                                                                                                        |
 | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| pass          | 421 whole files, plus the passing cases of the 14 `suites` files                                                                                                                                                                                                                                                                                                             |
+| pass          | 419 whole files, plus the passing cases of the 16 `suites` files                                                                                                                                                                                                                                                                                                             |
 | fixed         | the defects in the table below                                                                                                                                                                                                                                                                                                                                               |
 | bug           | none open                                                                                                                                                                                                                                                                                                                                                                    |
 | upstream      | 2 — `rewrites-destination-query-array`, `incremental-cache-path-traversal`                                                                                                                                                                                                                                                                                                   |
@@ -136,9 +136,10 @@ The list is the manifest's `rules.include`; it is not duplicated here. Notes wor
 having when one of them goes red:
 
 - **Retry passes.** `app-dir/router-autoscroll`, `app-dir/bfcache-regression` and
-  `app-dir/third-parties` each failed attempt 0 once on their own scroll or embed
-  assertions, with no cdk-nextjs error, and passed on retry 1. The harness runs
-  `--retries 1`. Suspect these first if a run goes red for no other reason.
+  `app-dir/third-parties` (now in `suites`) each failed attempt 0 once on their
+  own scroll or embed assertions, with no cdk-nextjs error, and passed on retry 1.
+  The harness runs `--retries 1`. Suspect these first if a run goes red for no
+  other reason.
 - **Slowest file:** `instrumentation-client-hook`, ~677s.
 - **Weakest coverage:** the three `chrome-devtools-workspace` files assert only
   `status: 404` in deploy mode (the dev-only endpoint must not be reachable in
@@ -178,6 +179,15 @@ verdict below.
 | `app-dir/metadata-streaming-parallel-routes`                       | 4 / 6      | 2 `should only bundle the selected metadata resolution implementation` — no signal (`@gate !deploy` inversion) |
 | `app-dir/segment-cache/metadata`                                   | 2 / 3      | `requests only the head when the page segments are cached` — no signal (`@gate !deploy` inversion)             |
 | `app-dir/segment-cache/cached-navigations`                         | 19 / 20    | `caches a fully static on-demand param for repeated navigations` — unsupported (`next start` serving)          |
+| `third-parties` (+ `app-dir/third-parties/basic`)                  | 3 / 4 each | `renders GTM` — no signal (counts Google's live `dataLayer` events)                                            |
+
+Both `third-parties` files' `renders GTM` expects `window.dataLayer` to hold
+exactly the entry the page pushes. Around 2026-10-08 googletagmanager.com started
+answering the fixtures' `GTM-XYZ` with a 200 instead of a 404, so Google's script
+runs and adds its own events; the length came back 3 on every NextjsType, both
+attempts, in the 2026-10-13 scheduled run. Upstream rewrote both cases to look for
+its own entries after v16.4.0 (vercel/next.js#99896). Drop the entries once the
+pin includes that change.
 
 The `next-form` case submits right after the page loads and waits for the loading
 state the router prefetched; where the prefetch has not landed, `#loading` never

package/docs/next-build-output-guide.md

@@ -42,7 +42,7 @@ We could ship this off to Lambda/Fargate and call it a day, but then we wouldn't
 
 ## S3
 
-.next/static is simply copied to S3 and then CloudFront is configured to forward requests with paths match `\_next/static` or any paths in `public` folder to S3. `NextjsStaticAssets` is responsible for this. We also add S3 User Metadata with `BUILD_ID` to track which static files are apart of which deployment so we can prune later. The two trees are uploaded by separate `BucketDeployment`s so that `_next/static` objects get `Cache-Control: public, max-age=31536000, immutable`, the header Next.js itself sends for them (a third gives `_next/static/service-worker` the `public, max-age=0, must-revalidate` Next.js sends for a service worker, which keeps its URL across builds): CloudFront and API Gateway serve them straight from S3, so the object's metadata is the only `Cache-Control` a browser gets. `public` files keep their names when they change, so they get no header unless `overrides.nextjsStaticAssets.bucketDeploymentProps.cacheControl` sets one.
+.next/static is simply copied to S3 and then CloudFront is configured to forward requests with paths match `\_next/static` or any paths in `public` folder to S3. `NextjsStaticAssets` is responsible for this. We also add S3 User Metadata with `BUILD_ID` to track which static files are apart of which deployment so we can prune later. The two trees are uploaded by separate `BucketDeployment`s so that `_next/static` objects get `Cache-Control: public, max-age=31536000, immutable`, the header Next.js itself sends for them (a third gives `_next/static/service-worker` the `public, max-age=0, must-revalidate` Next.js sends for a service worker, which keeps its URL across builds): CloudFront and API Gateway serve them straight from S3, so the object's metadata is the only `Cache-Control` a browser gets. S3 can't send the `Service-Worker-Allowed` header Next.js adds for a service worker (the app's `basePath`, or `/`), which lets it register at a scope above its own directory, so a build with service workers gets a `_next/static/service-worker/*` cache behavior (CloudFront, one more against the behavior quota) or resource (API Gateway) that sends it. `public` files keep their names when they change, so they get no header unless `overrides.nextjsStaticAssets.bucketDeploymentProps.cacheControl` sets one.
 
 Note, with `NextjsRegionalContainers`, we unfortunately cannot configure ALB to forward static requests directly to S3 because the host header dictates which bucket you can route requests to and it's not reliable to manually name buckets based on your domain. Therefore, static assets are copied into the container image to be served in ECS Fargate.
 

package/lib/adapter/adapter.mjs

@@ -829,6 +829,8 @@ var require_package = __commonJS({
         compat: "pnpm dlx projen compat",
         compile: "pnpm dlx projen compile",
         default: "pnpm dlx projen default",
+        diagrams: "pnpm dlx projen diagrams",
+        "diagrams:check": "pnpm dlx projen diagrams:check",
         docgen: "pnpm dlx projen docgen",
         eject: "pnpm dlx projen eject",
         eslint: "pnpm dlx projen eslint",
@@ -866,6 +868,7 @@ var require_package = __commonJS({
         "@aws-sdk/client-s3": "^3.1141.0",
         "@aws-sdk/client-ssm": "^3.1141.0",
         "@aws-sdk/lib-storage": "^3.1141.0",
+        "@iconify-json/logos": "1.2.16",
         "@mrgrain/jsii-struct-builder": "^0.7.64",
         "@next/routing": "16.4.0",
         "@smithy/signature-v4": "^2.3.0",
@@ -948,7 +951,7 @@ var require_package = __commonJS({
       publishConfig: {
         access: "public"
       },
-      version: "0.7.12",
+      version: "0.7.14",
       packageManager: "pnpm@10.32.1",
       jest: {
         coverageProvider: "v8",

package/lib/generated-structs/OptionalNextjsApiProps.d.ts

@@ -20,6 +20,12 @@ export interface OptionalNextjsApiProps {
      * @stability stable
      */
     readonly staticAssetsKeyPrefix?: string;
+    /**
+     * The `Service-Worker-Allowed` header for `_next/static/service-worker/*`, which Next.js sends so a compiled service worker can register at a scope wider than its own directory, such as `/`. S3 can't send an arbitrary header, so setting this adds a resource for those files whose integration response does. Next.js uses the app's `basePath`, or `/` for none.
+     * @default - no resource; the build has no service worker
+     * @stability stable
+     */
+    readonly serviceWorkerAllowed?: string;
     /**
      * Required if `NextjsRegionalFunctions`.
      * The Lambda function for server-side rendering

package/lib/generated-structs/OptionalNextjsApiProps.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNBcGlQcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0FwaVByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2VjMiwgYXdzX2xhbWJkYSwgYXdzX3MzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBQdWJsaWNEaXJFbnRyeSB9IGZyb20gJy4uLyc7XG5cbi8qKlxuICogT3B0aW9uYWxOZXh0anNBcGlQcm9wc1xuICovXG5leHBvcnQgaW50ZXJmYWNlIE9wdGlvbmFsTmV4dGpzQXBpUHJvcHMge1xuICAvKipcbiAgICogW0Z1dHVyZV0gUmVxdWlyZWQgaWYgYE5leHRqc1JlZ2lvbmFsQ29udGFpbmVyc2AuXG4gICAqIFZQQyB0byBjcmVhdGUgVlBDIExpbmsgYW5kIEVDUyBTZXJ2aWNlIERpc2NvdmVyeVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgdnBjPzogYXdzX2VjMi5JVnBjO1xuICAvKipcbiAgICogUzMga2V5IHByZWZpeCB0aGUgc3RhdGljIGFzc2V0cyB3ZXJlIHVwbG9hZGVkIHVuZGVyLCBpLmUuIGBOZXh0anNTdGF0aWNBc3NldHMua2V5UHJlZml4YCwgd2hpY2ggbmFtZXNwYWNlcyBhIHNoYXJlZCBidWNrZXQuXG4gICAqIEluZGVwZW5kZW50IG9mIGBiYXNlUGF0aGAgYWJvdmU6IHRoYXQgb25lIGlzIHRoZSBVUkwgcHJlZml4IHRoZSBSRVNUIEFQSVxuICAgKiBzZXJ2ZXMgdGhlIGFwcCBhdCAoY29tbW9ubHkgdGhlIEFQSSBHYXRld2F5IHN0YWdlKSwgd2hpbGUgdGhpcyBvbmUgaXMgd2hlcmVcbiAgICogdGhlIG9iamVjdHMgbGl2ZSBpbiB0aGUgYnVja2V0LiBgX25leHQvc3RhdGljYCBhbmQgcHVibGljIGRpcmVjdG9yeVxuICAgKiByZXF1ZXN0cyBhcmUgbWFwcGVkIHRvIFMzIGtleXMgZGlyZWN0bHksIHNvIHRoZXkgNDA0IHVubGVzcyB0aGlzIHByZWZpeCBpc1xuICAgKiBhcHBsaWVkLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGljQXNzZXRzS2V5UHJlZml4Pzogc3RyaW5nO1xuICAvKipcbiAgICogUmVxdWlyZWQgaWYgYE5leHRqc1JlZ2lvbmFsRnVuY3Rpb25zYC5cbiAgICogVGhlIExhbWJkYSBmdW5jdGlvbiBmb3Igc2VydmVyLXNpZGUgcmVuZGVyaW5nXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBzZXJ2ZXJGdW5jdGlvbj86IGF3c19sYW1iZGEuSUZ1bmN0aW9uO1xuICAvKipcbiAgICogRGVwbG95IHRoZSBzdGFnZSBhZ2FpbiBvbmNlIGVhY2ggc3RhY2sgdXBkYXRlIGhhcyBmaW5pc2hlZCwgc28gaXQgc2VydmVzIHRoZSBBUEkgYXMgaXQgaXMgYWZ0ZXIgdGhlIHVwZGF0ZS5cbiAgICogQ2xvdWRGb3JtYXRpb24gc25hcHNob3RzIHRoZSBBUEkgaW50byBhIG5ldyBkZXBsb3ltZW50IHdoaWxlIHJlc291cmNlc1xuICAgKiByZW1vdmVkIGZyb20gdGhlIHRlbXBsYXRlIHN0aWxsIGV4aXN0IOKAlCBpdCBkZWxldGVzIHRoZW0gb25seSBkdXJpbmdcbiAgICogY2xlYW51cCDigJQgc28gdGhlIHN0YWdlIGtlZXBzIHNlcnZpbmcgdGhlbS4gQWZ0ZXIgcmVtb3ZpbmcgYSBmdW5jdGlvblxuICAgKiBncm91cCwgaXRzIHJvdXRlcyB0aGVuIHBvaW50IGF0IGEgZGVsZXRlZCBMYW1iZGEgYW5kIGFuc3dlciA1MDAgdW50aWwgdGhlXG4gICAqIG5leHQgZGVwbG95bWVudC4gQW4gRXZlbnRCcmlkZ2UgcnVsZSBvbiB0aGlzIHN0YWNrJ3MgYFVQREFURV9DT01QTEVURWBcbiAgICogKGFuZCBgVVBEQVRFX1JPTExCQUNLX0NPTVBMRVRFYCkgaW52b2tlcyBhIHNtYWxsIGZ1bmN0aW9uIHRoYXQgZGVwbG95cyB0aGVcbiAgICogc3RhZ2UgZnJvbSB0aGUgbGl2ZSBBUEkgYW5kIGRlbGV0ZXMgdGhlIGRlcGxveW1lbnRzIGl0cyBlYXJsaWVyIHJ1bnMgbWFkZS5cbiAgICpcbiAgICogSWdub3JlZCB3aGVuIGBvdmVycmlkZXMucmVzdEFwaVByb3BzLmRlcGxveWAgaXMgYGZhbHNlYDogdGhlcmUgaXMgbm8gc3RhZ2UuXG4gICAqIEBkZWZhdWx0IHRydWVcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHJlZGVwbG95QWZ0ZXJVcGRhdGU/OiBib29sZWFuO1xuICAvKipcbiAgICogT3B0aW9uYWwgYmFzZSBwYXRoIGZvciB0aGUgYXBwbGljYXRpb24uXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBiYXNlUGF0aD86IHN0cmluZztcbiAgLyoqXG4gICAqIFRoZSBTMyBidWNrZXQgY29udGFpbmluZyBzdGF0aWMgYXNzZXRzLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGljQXNzZXRzQnVja2V0PzogYXdzX3MzLklCdWNrZXQ7XG4gIC8qKlxuICAgKiBQYXRoIHRvIGRpcmVjdG9yeSBvZiBOZXh0LmpzIGFwcCdzIHB1YmxpYyBkaXJlY3RvcnkuIFVzZWQgdG8gYWRkIHJlc291cmNlcyB0byBBUEkgR2F0ZXdheSBSRVNUIEFQSSBmb3IgcHVibGljIGRpcmVjdG9yeSB0byBnbyBkaXJlY3RseSB0byBTMy5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHB1YmxpY0RpckVudHJpZXM/OiBBcnJheTxQdWJsaWNEaXJFbnRyeT47XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNBcGlQcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0FwaVByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2VjMiwgYXdzX2xhbWJkYSwgYXdzX3MzIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0IHR5cGUgeyBQdWJsaWNEaXJFbnRyeSB9IGZyb20gJy4uLyc7XG5cbi8qKlxuICogT3B0aW9uYWxOZXh0anNBcGlQcm9wc1xuICovXG5leHBvcnQgaW50ZXJmYWNlIE9wdGlvbmFsTmV4dGpzQXBpUHJvcHMge1xuICAvKipcbiAgICogW0Z1dHVyZV0gUmVxdWlyZWQgaWYgYE5leHRqc1JlZ2lvbmFsQ29udGFpbmVyc2AuXG4gICAqIFZQQyB0byBjcmVhdGUgVlBDIExpbmsgYW5kIEVDUyBTZXJ2aWNlIERpc2NvdmVyeVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgdnBjPzogYXdzX2VjMi5JVnBjO1xuICAvKipcbiAgICogUzMga2V5IHByZWZpeCB0aGUgc3RhdGljIGFzc2V0cyB3ZXJlIHVwbG9hZGVkIHVuZGVyLCBpLmUuIGBOZXh0anNTdGF0aWNBc3NldHMua2V5UHJlZml4YCwgd2hpY2ggbmFtZXNwYWNlcyBhIHNoYXJlZCBidWNrZXQuXG4gICAqIEluZGVwZW5kZW50IG9mIGBiYXNlUGF0aGAgYWJvdmU6IHRoYXQgb25lIGlzIHRoZSBVUkwgcHJlZml4IHRoZSBSRVNUIEFQSVxuICAgKiBzZXJ2ZXMgdGhlIGFwcCBhdCAoY29tbW9ubHkgdGhlIEFQSSBHYXRld2F5IHN0YWdlKSwgd2hpbGUgdGhpcyBvbmUgaXMgd2hlcmVcbiAgICogdGhlIG9iamVjdHMgbGl2ZSBpbiB0aGUgYnVja2V0LiBgX25leHQvc3RhdGljYCBhbmQgcHVibGljIGRpcmVjdG9yeVxuICAgKiByZXF1ZXN0cyBhcmUgbWFwcGVkIHRvIFMzIGtleXMgZGlyZWN0bHksIHNvIHRoZXkgNDA0IHVubGVzcyB0aGlzIHByZWZpeCBpc1xuICAgKiBhcHBsaWVkLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGljQXNzZXRzS2V5UHJlZml4Pzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIGBTZXJ2aWNlLVdvcmtlci1BbGxvd2VkYCBoZWFkZXIgZm9yIGBfbmV4dC9zdGF0aWMvc2VydmljZS13b3JrZXIvKmAsIHdoaWNoIE5leHQuanMgc2VuZHMgc28gYSBjb21waWxlZCBzZXJ2aWNlIHdvcmtlciBjYW4gcmVnaXN0ZXIgYXQgYSBzY29wZSB3aWRlciB0aGFuIGl0cyBvd24gZGlyZWN0b3J5LCBzdWNoIGFzIGAvYC4gUzMgY2FuJ3Qgc2VuZCBhbiBhcmJpdHJhcnkgaGVhZGVyLCBzbyBzZXR0aW5nIHRoaXMgYWRkcyBhIHJlc291cmNlIGZvciB0aG9zZSBmaWxlcyB3aG9zZSBpbnRlZ3JhdGlvbiByZXNwb25zZSBkb2VzLiBOZXh0LmpzIHVzZXMgdGhlIGFwcCdzIGBiYXNlUGF0aGAsIG9yIGAvYCBmb3Igbm9uZS5cbiAgICogQGRlZmF1bHQgLSBubyByZXNvdXJjZTsgdGhlIGJ1aWxkIGhhcyBubyBzZXJ2aWNlIHdvcmtlclxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgc2VydmljZVdvcmtlckFsbG93ZWQ/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBSZXF1aXJlZCBpZiBgTmV4dGpzUmVnaW9uYWxGdW5jdGlvbnNgLlxuICAgKiBUaGUgTGFtYmRhIGZ1bmN0aW9uIGZvciBzZXJ2ZXItc2lkZSByZW5kZXJpbmdcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHNlcnZlckZ1bmN0aW9uPzogYXdzX2xhbWJkYS5JRnVuY3Rpb247XG4gIC8qKlxuICAgKiBEZXBsb3kgdGhlIHN0YWdlIGFnYWluIG9uY2UgZWFjaCBzdGFjayB1cGRhdGUgaGFzIGZpbmlzaGVkLCBzbyBpdCBzZXJ2ZXMgdGhlIEFQSSBhcyBpdCBpcyBhZnRlciB0aGUgdXBkYXRlLlxuICAgKiBDbG91ZEZvcm1hdGlvbiBzbmFwc2hvdHMgdGhlIEFQSSBpbnRvIGEgbmV3IGRlcGxveW1lbnQgd2hpbGUgcmVzb3VyY2VzXG4gICAqIHJlbW92ZWQgZnJvbSB0aGUgdGVtcGxhdGUgc3RpbGwgZXhpc3Qg4oCUIGl0IGRlbGV0ZXMgdGhlbSBvbmx5IGR1cmluZ1xuICAgKiBjbGVhbnVwIOKAlCBzbyB0aGUgc3RhZ2Uga2VlcHMgc2VydmluZyB0aGVtLiBBZnRlciByZW1vdmluZyBhIGZ1bmN0aW9uXG4gICAqIGdyb3VwLCBpdHMgcm91dGVzIHRoZW4gcG9pbnQgYXQgYSBkZWxldGVkIExhbWJkYSBhbmQgYW5zd2VyIDUwMCB1bnRpbCB0aGVcbiAgICogbmV4dCBkZXBsb3ltZW50LiBBbiBFdmVudEJyaWRnZSBydWxlIG9uIHRoaXMgc3RhY2sncyBgVVBEQVRFX0NPTVBMRVRFYFxuICAgKiAoYW5kIGBVUERBVEVfUk9MTEJBQ0tfQ09NUExFVEVgKSBpbnZva2VzIGEgc21hbGwgZnVuY3Rpb24gdGhhdCBkZXBsb3lzIHRoZVxuICAgKiBzdGFnZSBmcm9tIHRoZSBsaXZlIEFQSSBhbmQgZGVsZXRlcyB0aGUgZGVwbG95bWVudHMgaXRzIGVhcmxpZXIgcnVucyBtYWRlLlxuICAgKlxuICAgKiBJZ25vcmVkIHdoZW4gYG92ZXJyaWRlcy5yZXN0QXBpUHJvcHMuZGVwbG95YCBpcyBgZmFsc2VgOiB0aGVyZSBpcyBubyBzdGFnZS5cbiAgICogQGRlZmF1bHQgdHJ1ZVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgcmVkZXBsb3lBZnRlclVwZGF0ZT86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBPcHRpb25hbCBiYXNlIHBhdGggZm9yIHRoZSBhcHBsaWNhdGlvbi5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGJhc2VQYXRoPzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIFMzIGJ1Y2tldCBjb250YWluaW5nIHN0YXRpYyBhc3NldHMuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBzdGF0aWNBc3NldHNCdWNrZXQ/OiBhd3NfczMuSUJ1Y2tldDtcbiAgLyoqXG4gICAqIFBhdGggdG8gZGlyZWN0b3J5IG9mIE5leHQuanMgYXBwJ3MgcHVibGljIGRpcmVjdG9yeS4gVXNlZCB0byBhZGQgcmVzb3VyY2VzIHRvIEFQSSBHYXRld2F5IFJFU1QgQVBJIGZvciBwdWJsaWMgZGlyZWN0b3J5IHRvIGdvIGRpcmVjdGx5IHRvIFMzLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgcHVibGljRGlyRW50cmllcz86IEFycmF5PFB1YmxpY0RpckVudHJ5Pjtcbn1cbiJdfQ==

package/lib/generated-structs/OptionalNextjsDistributionProps.d.ts

@@ -4,6 +4,33 @@ import type { NextjsType, PublicDirEntry } from '../';
  * OptionalNextjsDistributionProps
  */
 export interface OptionalNextjsDistributionProps {
+    /**
+     * A CloudFront KeyValueStore associated with every viewer-request function {@link viewerRequestFunctionCode} is copied into (up to three, one per kind of behavior), so values it reads — Basic auth credentials, an allowlist — live outside the CloudFormation template and change without a deploy.
+     * Read it with `cf.kvs()`, no ID needed.
+     * @default - none
+     * @stability stable
+     */
+    readonly viewerRequestKeyValueStore?: aws_cloudfront.IKeyValueStore;
+    /**
+     * CloudFront Function code run first on every viewer request, on every behavior cdk-nextjs adds, static assets included — HTTP Basic auth on a pre-launch site, geo-gating.
+     * It must define `viewerRequest(event)` (a function, sync or async, or a
+     * `var`/`let`/`const`): return a response to answer the viewer, or the
+     * request (or nothing) to carry on. It is spliced into cdk-nextjs's own
+     * viewer-request functions, ahead of their logic, so it may not use the
+     * name `handler`, and the combined function must fit CloudFront's 10 KB.
+     * It runs on `cloudfront-js-2.0`, so it may be async and read
+     * {@link viewerRequestKeyValueStore} with `cf.kvs()`. A bring-your-own
+     * {@link distribution}'s default behavior isn't covered.
+     * @default - none
+     * @stability stable
+     */
+    readonly viewerRequestFunctionCode?: aws_cloudfront.FunctionCode;
+    /**
+     * The `Service-Worker-Allowed` header for `_next/static/service-worker/*`, which Next.js sends so a compiled service worker can register at a scope wider than its own directory, such as `/`. S3 can't send an arbitrary header, so setting this adds a behavior for those files whose response headers policy does. Next.js uses the app's `basePath`, or `/` for none.
+     * @default - no behavior; the build has no service worker
+     * @stability stable
+     */
+    readonly serviceWorkerAllowed?: string;
     /**
      * The most cache behaviors the distribution may have, the default one included.
      * cdk-nextjs counts what it adds against this at synth, so running

package/lib/generated-structs/OptionalNextjsDistributionProps.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2NlcnRpZmljYXRlbWFuYWdlciwgYXdzX2Nsb3VkZnJvbnQsIGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLCBhd3NfbGFtYmRhLCBhd3NfczMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IE5leHRqc1R5cGUsIFB1YmxpY0RpckVudHJ5IH0gZnJvbSAnLi4vJztcblxuLyoqXG4gKiBPcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcyB7XG4gIC8qKlxuICAgKiBUaGUgbW9zdCBjYWNoZSBiZWhhdmlvcnMgdGhlIGRpc3RyaWJ1dGlvbiBtYXkgaGF2ZSwgdGhlIGRlZmF1bHQgb25lIGluY2x1ZGVkLlxuICAgKiBjZGstbmV4dGpzIGNvdW50cyB3aGF0IGl0IGFkZHMgYWdhaW5zdCB0aGlzIGF0IHN5bnRoLCBzbyBydW5uaW5nXG4gICAqIG91dCBpcyBhIHN5bnRoIGVycm9yIG5hbWluZyB3aGF0IHVzZWQgdGhlbSByYXRoZXIgdGhhbiBhIGZhaWxlZCBkZXBsb3kuXG4gICAqXG4gICAqIFJhaXNlIGl0IGFmdGVyIHJhaXNpbmcgdGhlIFwiQ2FjaGUgYmVoYXZpb3JzIHBlciBkaXN0cmlidXRpb25cIiBxdW90YSBmb3JcbiAgICogeW91ciBhY2NvdW50LiBMb3dlciBpdCBieSB0aGUgYmVoYXZpb3JzIGEgc3VwcGxpZWQge0BsaW5rIGRpc3RyaWJ1dGlvbn1cbiAgICogKG9yIGBvdmVycmlkZXMuZGlzdHJpYnV0aW9uUHJvcHNgKSBhbHJlYWR5IGhhcywgd2hpY2ggYXJlIG5vdCBjb3VudGVkLlxuICAgKiBAZGVmYXVsdCA3NSAtIENsb3VkRnJvbnQncyBkZWZhdWx0IHF1b3RhXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBtYXhDYWNoZUJlaGF2aW9ycz86IG51bWJlcjtcbiAgLyoqXG4gICAqIFJlcXVpcmVkIGlmIGBOZXh0anNUeXBlLkdMT0JBTF9DT05UQUlORVJTYCBvciBgTmV4dGpzVHlwZS5SRUdJT05BTF9DT05UQUlORVJTYC5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGxvYWRCYWxhbmNlcj86IGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLklBcHBsaWNhdGlvbkxvYWRCYWxhbmNlcjtcbiAgLyoqXG4gICAqIFJlcXVpcmVkIGlmIGBOZXh0anNUeXBlLkdMT0JBTF9GVU5DVElPTlNgLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgZnVuY3Rpb25Vcmw/OiBhd3NfbGFtYmRhLklGdW5jdGlvblVybDtcbiAgLyoqXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBkaXN0cmlidXRpb24/OiBhd3NfY2xvdWRmcm9udC5EaXN0cmlidXRpb247XG4gIC8qKlxuICAgKiBPcHRpb25hbCBidXQgb25seSBhcHBsaWNhYmxlIGZvciBgTmV4dGpzVHlwZS5HTE9CQUxfQ09OVEFJTkVSU2AuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBjZXJ0aWZpY2F0ZT86IGF3c19jZXJ0aWZpY2F0ZW1hbmFnZXIuSUNlcnRpZmljYXRlO1xuICAvKipcbiAgICogVVJJIHBhdGggcHJlZml4IHRoZSBhcHAgaXMgc2VydmVkIGF0LlxuICAgKiBTdXJyb3VuZGluZyBzbGFzaGVzIGFyZSBub3JtYWxpemVkXG4gICAqIGF3YXksIHNvIFwiL2Jhc2VcIiwgXCJiYXNlXCIgYW5kIFwiL2Jhc2UvXCIgYWxsIHByb2R1Y2UgdGhlIHNhbWUgY2FjaGUgYmVoYXZpb3JzLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgYmFzZVBhdGg/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBUaGUgYXBwJ3Mgb3duIGBhc3NldFByZWZpeGAuXG4gICAqIE5leHQuanMgZW1pdHMgYDxhc3NldFByZWZpeD4vX25leHQvc3RhdGljLy4uLmBcbiAgICogZm9yIGV2ZXJ5IGJ1bmRsZSB3aGlsZSB0aGUgb2JqZWN0cyBzdGF5IGF0IGA8YmFzZVBhdGg+L19uZXh0L3N0YXRpYy8uLi5gIGluXG4gICAqIFMzLCBzbyB0aGUgcHJlZml4J3MgcGF0aCBnZXRzIGEgY2FjaGUgYmVoYXZpb3Igb2YgaXRzIG93biB0aGF0IHJld3JpdGVzIGl0XG4gICAqIGF3YXkuXG4gICAqXG4gICAqIEVpdGhlciBmb3JtIGlzIGFjY2VwdGVkOiBhIHBhdGggKFwiL2NkblwiKSwgb3IgYW4gYWJzb2x1dGUgVVJMLCBpbiB3aGljaCBjYXNlXG4gICAqIG9ubHkgaXRzIHBhdGggY291bnRzIChcImh0dHBzOi8vY2RuLmV4YW1wbGUuY29tL2NkblwiIGJlaGF2ZXMgYXMgXCIvY2RuXCIsIGFuZFxuICAgKiBcImh0dHBzOi8vY2RuLmV4YW1wbGUuY29tXCIgbmVlZHMgbm8gYmVoYXZpb3IgYXQgYWxsKS4gQW4gYWJzb2x1dGUgcHJlZml4J3MgcGF0aFxuICAgKiBtYXR0ZXJzIGJlY2F1c2UgYG5leHQgYnVpbGRgIGNvbXBpbGVzIGEgYC9jZG4vX25leHQvOnBhdGgrYCByZXdyaXRlIG9mIGl0c1xuICAgKiBvd24sIHNvIGBuZXh0IHN0YXJ0YCBzZXJ2ZXMgZXZlcnkgYnVuZGxlIHVuZGVyIGl0IOKAlCBhIENETiBmcm9udGluZyB0aGlzXG4gICAqIGRpc3RyaWJ1dGlvbiB0aGVyZSBoYXMgdG8gYmUgYW5zd2VyZWQgdG9vLlxuICAgKlxuICAgKiBBcHBsaWVkIG9uIHRvcCBvZiBgYmFzZVBhdGhgLCBub3QgdW5kZXIgaXQsIGJlY2F1c2UgdGhhdCBpcyBob3cgTmV4dC5qc1xuICAgKiBidWlsZHMgdGhlIFVSTC5cbiAgICogQGRlZmF1bHQgLSBub25lOyBwYXNzIGBOZXh0anNCdWlsZC5uZXh0Q29uZmlnQXNzZXRQcmVmaXhQYXRoYFxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgYXNzZXRQcmVmaXg/OiBzdHJpbmc7XG4gIC8qKlxuICAgKiBFbnRyaWVzIChmaWxlcy9kaXJlY3Rvcmllcykgd2l0aGluIE5leHQuanMgYXBwJ3MgcHVibGljIGRpcmVjdG9yeS4gVXNlZCB0byBhZGQgc3RhdGljIGJlaGF2aW9ycyB0byBkaXN0cmlidXRpb24uXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBwdWJsaWNEaXJFbnRyaWVzPzogQXJyYXk8UHVibGljRGlyRW50cnk+O1xuICAvKipcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IG5leHRqc1R5cGU/OiBOZXh0anNUeXBlO1xuICAvKipcbiAgICogQnVja2V0IGNvbnRhaW5pbmcgc3RhdGljIGFzc2V0cy5cbiAgICogTXVzdCBiZSBwcm92aWRlZCBpZiB5b3Ugd2FudCB0byBzZXJ2ZSBzdGF0aWMgZmlsZXMuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBhc3NldHNCdWNrZXQ/OiBhd3NfczMuSUJ1Y2tldDtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQtc3RydWN0cy9PcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyIvLyB+fiBHZW5lcmF0ZWQgYnkgcHJvamVuLiBUbyBtb2RpZnksIGVkaXQgLnByb2plbnJjLnRzIGFuZCBydW4gXCJwbnBtIGRseCBwcm9qZW5cIi5cbmltcG9ydCB0eXBlIHsgYXdzX2NlcnRpZmljYXRlbWFuYWdlciwgYXdzX2Nsb3VkZnJvbnQsIGF3c19lbGFzdGljbG9hZGJhbGFuY2luZ3YyLCBhd3NfbGFtYmRhLCBhd3NfczMgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgdHlwZSB7IE5leHRqc1R5cGUsIFB1YmxpY0RpckVudHJ5IH0gZnJvbSAnLi4vJztcblxuLyoqXG4gKiBPcHRpb25hbE5leHRqc0Rpc3RyaWJ1dGlvblByb3BzXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT3B0aW9uYWxOZXh0anNEaXN0cmlidXRpb25Qcm9wcyB7XG4gIC8qKlxuICAgKiBBIENsb3VkRnJvbnQgS2V5VmFsdWVTdG9yZSBhc3NvY2lhdGVkIHdpdGggZXZlcnkgdmlld2VyLXJlcXVlc3QgZnVuY3Rpb24ge0BsaW5rIHZpZXdlclJlcXVlc3RGdW5jdGlvbkNvZGV9IGlzIGNvcGllZCBpbnRvICh1cCB0byB0aHJlZSwgb25lIHBlciBraW5kIG9mIGJlaGF2aW9yKSwgc28gdmFsdWVzIGl0IHJlYWRzIOKAlCBCYXNpYyBhdXRoIGNyZWRlbnRpYWxzLCBhbiBhbGxvd2xpc3Qg4oCUIGxpdmUgb3V0c2lkZSB0aGUgQ2xvdWRGb3JtYXRpb24gdGVtcGxhdGUgYW5kIGNoYW5nZSB3aXRob3V0IGEgZGVwbG95LlxuICAgKiBSZWFkIGl0IHdpdGggYGNmLmt2cygpYCwgbm8gSUQgbmVlZGVkLlxuICAgKiBAZGVmYXVsdCAtIG5vbmVcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHZpZXdlclJlcXVlc3RLZXlWYWx1ZVN0b3JlPzogYXdzX2Nsb3VkZnJvbnQuSUtleVZhbHVlU3RvcmU7XG4gIC8qKlxuICAgKiBDbG91ZEZyb250IEZ1bmN0aW9uIGNvZGUgcnVuIGZpcnN0IG9uIGV2ZXJ5IHZpZXdlciByZXF1ZXN0LCBvbiBldmVyeSBiZWhhdmlvciBjZGstbmV4dGpzIGFkZHMsIHN0YXRpYyBhc3NldHMgaW5jbHVkZWQg4oCUIEhUVFAgQmFzaWMgYXV0aCBvbiBhIHByZS1sYXVuY2ggc2l0ZSwgZ2VvLWdhdGluZy5cbiAgICogSXQgbXVzdCBkZWZpbmUgYHZpZXdlclJlcXVlc3QoZXZlbnQpYCAoYSBmdW5jdGlvbiwgc3luYyBvciBhc3luYywgb3IgYVxuICAgKiBgdmFyYC9gbGV0YC9gY29uc3RgKTogcmV0dXJuIGEgcmVzcG9uc2UgdG8gYW5zd2VyIHRoZSB2aWV3ZXIsIG9yIHRoZVxuICAgKiByZXF1ZXN0IChvciBub3RoaW5nKSB0byBjYXJyeSBvbi4gSXQgaXMgc3BsaWNlZCBpbnRvIGNkay1uZXh0anMncyBvd25cbiAgICogdmlld2VyLXJlcXVlc3QgZnVuY3Rpb25zLCBhaGVhZCBvZiB0aGVpciBsb2dpYywgc28gaXQgbWF5IG5vdCB1c2UgdGhlXG4gICAqIG5hbWUgYGhhbmRsZXJgLCBhbmQgdGhlIGNvbWJpbmVkIGZ1bmN0aW9uIG11c3QgZml0IENsb3VkRnJvbnQncyAxMCBLQi5cbiAgICogSXQgcnVucyBvbiBgY2xvdWRmcm9udC1qcy0yLjBgLCBzbyBpdCBtYXkgYmUgYXN5bmMgYW5kIHJlYWRcbiAgICoge0BsaW5rIHZpZXdlclJlcXVlc3RLZXlWYWx1ZVN0b3JlfSB3aXRoIGBjZi5rdnMoKWAuIEEgYnJpbmcteW91ci1vd25cbiAgICoge0BsaW5rIGRpc3RyaWJ1dGlvbn0ncyBkZWZhdWx0IGJlaGF2aW9yIGlzbid0IGNvdmVyZWQuXG4gICAqIEBkZWZhdWx0IC0gbm9uZVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgdmlld2VyUmVxdWVzdEZ1bmN0aW9uQ29kZT86IGF3c19jbG91ZGZyb250LkZ1bmN0aW9uQ29kZTtcbiAgLyoqXG4gICAqIFRoZSBgU2VydmljZS1Xb3JrZXItQWxsb3dlZGAgaGVhZGVyIGZvciBgX25leHQvc3RhdGljL3NlcnZpY2Utd29ya2VyLypgLCB3aGljaCBOZXh0LmpzIHNlbmRzIHNvIGEgY29tcGlsZWQgc2VydmljZSB3b3JrZXIgY2FuIHJlZ2lzdGVyIGF0IGEgc2NvcGUgd2lkZXIgdGhhbiBpdHMgb3duIGRpcmVjdG9yeSwgc3VjaCBhcyBgL2AuIFMzIGNhbid0IHNlbmQgYW4gYXJiaXRyYXJ5IGhlYWRlciwgc28gc2V0dGluZyB0aGlzIGFkZHMgYSBiZWhhdmlvciBmb3IgdGhvc2UgZmlsZXMgd2hvc2UgcmVzcG9uc2UgaGVhZGVycyBwb2xpY3kgZG9lcy4gTmV4dC5qcyB1c2VzIHRoZSBhcHAncyBgYmFzZVBhdGhgLCBvciBgL2AgZm9yIG5vbmUuXG4gICAqIEBkZWZhdWx0IC0gbm8gYmVoYXZpb3I7IHRoZSBidWlsZCBoYXMgbm8gc2VydmljZSB3b3JrZXJcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IHNlcnZpY2VXb3JrZXJBbGxvd2VkPzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIG1vc3QgY2FjaGUgYmVoYXZpb3JzIHRoZSBkaXN0cmlidXRpb24gbWF5IGhhdmUsIHRoZSBkZWZhdWx0IG9uZSBpbmNsdWRlZC5cbiAgICogY2RrLW5leHRqcyBjb3VudHMgd2hhdCBpdCBhZGRzIGFnYWluc3QgdGhpcyBhdCBzeW50aCwgc28gcnVubmluZ1xuICAgKiBvdXQgaXMgYSBzeW50aCBlcnJvciBuYW1pbmcgd2hhdCB1c2VkIHRoZW0gcmF0aGVyIHRoYW4gYSBmYWlsZWQgZGVwbG95LlxuICAgKlxuICAgKiBSYWlzZSBpdCBhZnRlciByYWlzaW5nIHRoZSBcIkNhY2hlIGJlaGF2aW9ycyBwZXIgZGlzdHJpYnV0aW9uXCIgcXVvdGEgZm9yXG4gICAqIHlvdXIgYWNjb3VudC4gTG93ZXIgaXQgYnkgdGhlIGJlaGF2aW9ycyBhIHN1cHBsaWVkIHtAbGluayBkaXN0cmlidXRpb259XG4gICAqIChvciBgb3ZlcnJpZGVzLmRpc3RyaWJ1dGlvblByb3BzYCkgYWxyZWFkeSBoYXMsIHdoaWNoIGFyZSBub3QgY291bnRlZC5cbiAgICogQGRlZmF1bHQgNzUgLSBDbG91ZEZyb250J3MgZGVmYXVsdCBxdW90YVxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgbWF4Q2FjaGVCZWhhdmlvcnM/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBSZXF1aXJlZCBpZiBgTmV4dGpzVHlwZS5HTE9CQUxfQ09OVEFJTkVSU2Agb3IgYE5leHRqc1R5cGUuUkVHSU9OQUxfQ09OVEFJTkVSU2AuXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBsb2FkQmFsYW5jZXI/OiBhd3NfZWxhc3RpY2xvYWRiYWxhbmNpbmd2Mi5JQXBwbGljYXRpb25Mb2FkQmFsYW5jZXI7XG4gIC8qKlxuICAgKiBSZXF1aXJlZCBpZiBgTmV4dGpzVHlwZS5HTE9CQUxfRlVOQ1RJT05TYC5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGZ1bmN0aW9uVXJsPzogYXdzX2xhbWJkYS5JRnVuY3Rpb25Vcmw7XG4gIC8qKlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgZGlzdHJpYnV0aW9uPzogYXdzX2Nsb3VkZnJvbnQuRGlzdHJpYnV0aW9uO1xuICAvKipcbiAgICogT3B0aW9uYWwgYnV0IG9ubHkgYXBwbGljYWJsZSBmb3IgYE5leHRqc1R5cGUuR0xPQkFMX0NPTlRBSU5FUlNgLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgY2VydGlmaWNhdGU/OiBhd3NfY2VydGlmaWNhdGVtYW5hZ2VyLklDZXJ0aWZpY2F0ZTtcbiAgLyoqXG4gICAqIFVSSSBwYXRoIHByZWZpeCB0aGUgYXBwIGlzIHNlcnZlZCBhdC5cbiAgICogU3Vycm91bmRpbmcgc2xhc2hlcyBhcmUgbm9ybWFsaXplZFxuICAgKiBhd2F5LCBzbyBcIi9iYXNlXCIsIFwiYmFzZVwiIGFuZCBcIi9iYXNlL1wiIGFsbCBwcm9kdWNlIHRoZSBzYW1lIGNhY2hlIGJlaGF2aW9ycy5cbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGJhc2VQYXRoPzogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIGFwcCdzIG93biBgYXNzZXRQcmVmaXhgLlxuICAgKiBOZXh0LmpzIGVtaXRzIGA8YXNzZXRQcmVmaXg+L19uZXh0L3N0YXRpYy8uLi5gXG4gICAqIGZvciBldmVyeSBidW5kbGUgd2hpbGUgdGhlIG9iamVjdHMgc3RheSBhdCBgPGJhc2VQYXRoPi9fbmV4dC9zdGF0aWMvLi4uYCBpblxuICAgKiBTMywgc28gdGhlIHByZWZpeCdzIHBhdGggZ2V0cyBhIGNhY2hlIGJlaGF2aW9yIG9mIGl0cyBvd24gdGhhdCByZXdyaXRlcyBpdFxuICAgKiBhd2F5LlxuICAgKlxuICAgKiBFaXRoZXIgZm9ybSBpcyBhY2NlcHRlZDogYSBwYXRoIChcIi9jZG5cIiksIG9yIGFuIGFic29sdXRlIFVSTCwgaW4gd2hpY2ggY2FzZVxuICAgKiBvbmx5IGl0cyBwYXRoIGNvdW50cyAoXCJodHRwczovL2Nkbi5leGFtcGxlLmNvbS9jZG5cIiBiZWhhdmVzIGFzIFwiL2NkblwiLCBhbmRcbiAgICogXCJodHRwczovL2Nkbi5leGFtcGxlLmNvbVwiIG5lZWRzIG5vIGJlaGF2aW9yIGF0IGFsbCkuIEFuIGFic29sdXRlIHByZWZpeCdzIHBhdGhcbiAgICogbWF0dGVycyBiZWNhdXNlIGBuZXh0IGJ1aWxkYCBjb21waWxlcyBhIGAvY2RuL19uZXh0LzpwYXRoK2AgcmV3cml0ZSBvZiBpdHNcbiAgICogb3duLCBzbyBgbmV4dCBzdGFydGAgc2VydmVzIGV2ZXJ5IGJ1bmRsZSB1bmRlciBpdCDigJQgYSBDRE4gZnJvbnRpbmcgdGhpc1xuICAgKiBkaXN0cmlidXRpb24gdGhlcmUgaGFzIHRvIGJlIGFuc3dlcmVkIHRvby5cbiAgICpcbiAgICogQXBwbGllZCBvbiB0b3Agb2YgYGJhc2VQYXRoYCwgbm90IHVuZGVyIGl0LCBiZWNhdXNlIHRoYXQgaXMgaG93IE5leHQuanNcbiAgICogYnVpbGRzIHRoZSBVUkwuXG4gICAqIEBkZWZhdWx0IC0gbm9uZTsgcGFzcyBgTmV4dGpzQnVpbGQubmV4dENvbmZpZ0Fzc2V0UHJlZml4UGF0aGBcbiAgICogQHN0YWJpbGl0eSBzdGFibGVcbiAgICovXG4gIHJlYWRvbmx5IGFzc2V0UHJlZml4Pzogc3RyaW5nO1xuICAvKipcbiAgICogRW50cmllcyAoZmlsZXMvZGlyZWN0b3JpZXMpIHdpdGhpbiBOZXh0LmpzIGFwcCdzIHB1YmxpYyBkaXJlY3RvcnkuIFVzZWQgdG8gYWRkIHN0YXRpYyBiZWhhdmlvcnMgdG8gZGlzdHJpYnV0aW9uLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgcHVibGljRGlyRW50cmllcz86IEFycmF5PFB1YmxpY0RpckVudHJ5PjtcbiAgLyoqXG4gICAqIEBzdGFiaWxpdHkgc3RhYmxlXG4gICAqL1xuICByZWFkb25seSBuZXh0anNUeXBlPzogTmV4dGpzVHlwZTtcbiAgLyoqXG4gICAqIEJ1Y2tldCBjb250YWluaW5nIHN0YXRpYyBhc3NldHMuXG4gICAqIE11c3QgYmUgcHJvdmlkZWQgaWYgeW91IHdhbnQgdG8gc2VydmUgc3RhdGljIGZpbGVzLlxuICAgKiBAc3RhYmlsaXR5IHN0YWJsZVxuICAgKi9cbiAgcmVhZG9ubHkgYXNzZXRzQnVja2V0PzogYXdzX3MzLklCdWNrZXQ7XG59XG4iXX0=

package/lib/nextjs-api.d.ts

@@ -51,6 +51,15 @@ export interface NextjsApiProps {
      * applied.
      */
     readonly staticAssetsKeyPrefix?: string;
+    /**
+     * The `Service-Worker-Allowed` header for `_next/static/service-worker/*`,
+     * which Next.js sends so a compiled service worker can register at a scope
+     * wider than its own directory, such as `/`. S3 can't send an arbitrary
+     * header, so setting this adds a resource for those files whose integration
+     * response does. Next.js uses the app's `basePath`, or `/` for none.
+     * @default - no resource; the build has no service worker
+     */
+    readonly serviceWorkerAllowed?: string;
     /**
      * [Future] Required if `NextjsRegionalContainers`. VPC to create VPC Link and ECS Service Discovery
      */
@@ -155,8 +164,10 @@ export declare class NextjsApi extends Construct {
      * Maps API request to S3 request.
      * @see https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-parameter-mapping-sources.html
      * @see https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-s3.html#api-items-in-folder-as-s3-objects-in-bucket
+     * @param headers fixed response headers, sent with a 200 and a 304
      */
     private createS3Integration;
+    /** @param headers the fixed headers `createS3Integration` was given */
     private getStaticMethodOptions;
     /**
      * One resource subtree per function group pattern.