cdk-rds-sql 7.3.2 → 8.0.1

package/.jsii

@@ -7,7 +7,7 @@
     ]
   },
   "bundled": {
-    "@types/aws-lambda": "^8.10.152"
+    "@types/aws-lambda": "^8.10.159"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.214.0",
@@ -4058,7 +4058,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/berenddeboer/cdk-rds-sql.git",
-  "jsiiVersion": "5.9.4 (build db676e9)",
+  "jsiiVersion": "5.9.20 (build 6e2b13a)",
   "keywords": [
     "aurora",
     "aws",
@@ -4080,7 +4080,7 @@
   },
   "name": "cdk-rds-sql",
   "readme": {
-    "markdown": "# About\n\nThis CDK construct library makes it possible to create databases,\nschemas, and roles in an Aurora Serverless v2, RDS Database Cluster,\nDatabase Instance, or AWS DSQL clusters. PostgreSQL, MySQL, and DSQL\ndatabases are supported.\n\nThis construct library is intended to be used in enterprise\nenvironments, and works in isolated subnets.\n\n<p align=\"left\">\n  <a href=\"https://github.com/semantic-release/semantic-release\"><img src=\"https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release\" alt=semantic-release: angular\"></a>\n  <a href=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml\"><img src=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml/badge.svg\" alt=\"Release badge\"></a>\n</p>\n\n# Requirements\n\n- CDK v2.\n\n# Installation\n\n     npm i cdk-rds-sql\n\n# Usage\n\n## Provider\n\nFirst setup your VPC and create your cluster:\n\n```ts\nimport { Duration, RemovalPolicy } from \"aws-cdk-lib\"\nimport * as ec2 from \"aws-cdk-lib/aws-ec2\"\nimport * as rds from \"aws-cdk-lib/aws-rds\"\n\nconst vpc = ec2.Vpc.fromLookup(this, \"Vpc\", {\n  vpcId: this.node.tryGetContext(\"vpc-id\"),\n})\n\nconst cluster = new rds.ServerlessCluster(this, \"Cluster\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,\n  },\n  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,\n  parameterGroup: rds.ParameterGroup.fromParameterGroupName(\n    this,\n    \"ParameterGroup\",\n    \"default.aurora-postgresql11\"\n  ),\n  removalPolicy: RemovalPolicy.DESTROY,\n  scaling: {\n    autoPause: Duration.minutes(60),\n    minCapacity: rds.AuroraCapacityUnit.ACU_2,\n    maxCapacity: rds.AuroraCapacityUnit.ACU_2,\n  },\n})\n```\n\nThen create a provider which will connect to your database. For a cluster:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\nFor an instance:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n})\n```\n\nThe provider will setup a lambda, which normally lives in the same VPC\nas the database. You can give a different VPC, as long as that VPC has\naccess to the VPC of the database. Only the provider lambda will talk\nto your database.\n\nThe provider will by default use the private isolated subnet of the\nVPC. Your isolated network must have a VPC endpoint to AWS Secrets Manager\nand possibly KMS as well. If you want to use a subnet with egress\naccess in case you have no such VPC endpoints, specify the subnet as\nfollows:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\n## Roles\n\nCreate a postgres role (or mysql user) for a cluster as follows:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n})\n```\n\nThis will automatically create a secret just like `ServerlessCluster`\ndoes, with all the connection info needed for this user. It's secret\nvalue is a JSON like:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"password\": \"very-long-and-boring\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myrole\"\n}\n```\n\nYou can access the secret via `role.secret`.\n\nInstead of `databaseName` you can also specify `database` to reference\nan existing database. The role will not be created until the database\nhas been created.\n\nIf you want to make the role the owner of a new database, just specify\nthe `databaseName` here, and create the database later.\n\n### IAM Authentication\n\nInstead of password-based authentication, you can create roles that\nuse AWS IAM database authentication. This eliminates the need to store\ndatabase passwords and provides enhanced security through AWS IAM\npolicies.\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst iamRole = new Role(this, \"IamRole\", {\n  provider: provider,\n  roleName: \"myiamrole\",\n  databaseName: \"mydb\",\n  enableIamAuth: true,\n})\n```\n\nFor IAM-authenticated roles, the secret will not contain a password field:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myiamrole\"\n}\n```\n\n**Requirements for IAM Authentication:**\n\n- SSL connections are required (enabled by default in this library)\n- Your application must have IAM permissions to connect to the database\n- The database user/role name must match the IAM identity\n\n**IAM Policy Example:**\n\nYour application will need an IAM policy like this to connect:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\"rds-db:connect\"],\n      \"Resource\": [\n        \"arn:aws:rds-db:region:account-id:dbuser:cluster-resource-id/myiamrole\"\n      ]\n    }\n  ]\n}\n```\n\nBoth PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).\n\n### MySQL support\n\nIn MySQL users are created with '%' as value for the host. It is hard\nto do this better:\n\n- Determine the CIDR blocks used by a VPC is not trivial.\n- For imported VPCs you cannot specify the IPv6 CIDR.\n- CIDRs might change without the system knowing, meaning applications\n  could lose access to the database at random times, such as when a\n  container is restarted.\n\n## Database\n\nCreate a database as follows:\n\n```ts\nimport { Database } from \"cdk-rds-sql\"\n\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n```\n\nYou can provide an owner, which makes it easy to create database owned\nby a new user:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n  owner: role,\n})\n```\n\n## Schema\n\nCreate a schema in the default database as follows:\n\n```ts\nimport { Schema } from \"cdk-rds-sql\"\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n})\n```\n\nOr in another database:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n})\n```\n\nOne may need a role permitted for using schema:\n\n```ts\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n  role: role,\n})\n```\n\n## Sql\n\nYou can insert arbitrary SQL into your database with the `Sql` construct:\n\n```ts\nimport { Sql } from \"cdk-rds-sql\"\n\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: \"create table t (i int)\",\n})\n```\n\nCreate a table if it does not exist, and grant a role privileges:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n})\n```\n\nRollback sql on stack deletion:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n  rollback: `\nDO $$BEGIN\n  IF EXISTS (select from pg_database WHERE datname = 't') THEN\n    IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = 'myrole') THEN\n      revoke select t from myrole;\n    END IF;\n    drop table t;\n  END IF;\nEND$$;\n`,\n})\n```\n\nNote that there is no synchronisation between various `Sql`\nconstructs, in particular the order in your code does not determine\nthe order in which your SQL is executed. This happens in parallel,\nunless you specify an explicit dependency via `sql.node.addDepency()`.\n\nThere are a lot of concerns when using `Sql`:\n\n- When you update your Sql, your previous Sql is not \"rolled back\",\n  the new Sql is simply executed again.\n- When you delete your `Sql` construct the rollback is executed if specified\n- When permission are granted via `Sql` they must be removed via\n  rollback to succesfully remove the role\n- Currently the `Sql` constructs has less than 5 minutes to execute\n  its work.\n- It is unknown how large your SQL can be.\n\n# Parameters\n\nSome lambda constructs, in particular [Bref](https://bref.sh/), do not\nsupport secrets out of the box. Use the `parameterPrefix` property to\ncreate SSM parameters in addition to a secret:\n\n```ts\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n  parameterPrefix: \"/my-app/\",\n})\n```\n\nThis will create `/my-app/username`, `/my-app/password` and such.\n\nTo access parameters you will need IAM permissions such as:\n\n```ts\ninitialPolicy: [\n  new iam.PolicyStatement({\n\tactions: [\"ssm:GetParameter\", \"ssm:GetParameters\"],\n\tresources: [\n\t  // Grant access to all parameters under the base path\n\t  `arn:aws:ssm:${this.region}:${this.account}:parameter/my-app/*`,\n\t],\n\teffect: iam.Effect.ALLOW,\n  })\n],\n```\n\nNote that your VPC will need an SSM Parameters interface endpoint to support this.\n\n# AWS DSQL Support\n\nThis construct also supports AWS DSQL. DSQL is a great number of\nlimitations around it's postgresql support, so there is some learing\ncurve. This library supports creating roles, schemas, and executing\nSQL on DSQL clusters. Creating databases is not supported by DSQL.\n\n## DSQL Provider Setup\n\nDSQL clusters don't require a VPC or secrets since they use IAM authentication:\n\n```ts\nimport * as dsql from \"aws-cdk-lib/aws-dsql\"\nimport { Provider } from \"cdk-rds-sql\"\n\nconst dsqlCluster = new dsql.CfnCluster(this, \"DsqlCluster\", {\n  deletionProtectionEnabled: false,\n})\n\nconst provider = new Provider(this, \"Provider\", {\n  cluster: dsqlCluster,\n  // No VPC or secret needed for DSQL\n})\n```\n\nYou can access DSQL from within a VPC, but cdk-rds-sql has not been\nspecifically tested with that scenario.\n\n## DSQL Roles\n\nDSQL always uses IAM authentication, so the `enableIamAuth` property is ignored:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n})\n```\n\n## Using DSQL\n\nConnecting to DSQL requires a couple of things:\n\n1. Your IAM role needs the `dsql:DbConnect` IAM permission to connect to the cluster.\n2. You probably want a normal postgres role (not \"admin\") to use from your apps.\n3. Your IAM role needs to be connected to your postgres role: use the `IamGrant` construct for that:\n\n   ```ts\n   new IamGrant(this, \"LambdaIamGrant\", {\n     provider: provider,\n     roleName: role.roleName,\n     resourceArn: queryLambda.role!.roleArn,\n   })\n   ```\n\n4. From your code use the Dsql signer to create the password:\n\n   ```ts\n   import { DsqlSigner } from \"@aws-sdk/dsql-signer\"\n   import { Client } from \"pg\"\n\n   const region =\n     process.env[\"AWS_REGION\"] || process.env[\"AWS_DEFAULT_REGION\"] || \"us-west-2\"\n\n   // Generate DSQL auth token using AWS SDK\n   const signer = new DsqlSigner({\n     hostname: host,\n     region,\n   })\n\n   const authToken = await signer.getDbConnectAuthToken()\n\n   const client = new Client({\n     host,\n     port: 5432,\n     user: dbUser,\n     database: dbName,\n     password: authToken,\n     ssl: { rejectUnauthorized: false },\n   })\n\n   await client.connect()\n   ```\n\n# IPv6\n\nIf you use the provider in an IPv6 subnet you probably need these settings:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  ...\n  functionProps: {\n\tipv6AllowedForDualStack: true,\n\tallowAllIpv6Outbound: true,\n  },\n}\n```\n\n# Disabling SSL\n\nThe default connection to RDS is ssl enabled. You can disable ssl by\nsetting the `ssl` option to `false`:\n\n```ts\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n  ssl: false, // default is true\n})\n```\n\n# Working on this code\n\nThis code is managed by\n[projen](https://github.com/projen/projen/blob/main/README.md). In\naddition [pre-commit](https://pre-commit.com/) is used.\n\nSo after git clone and `npm ci` you would do:\n\n```\npre-commit install --install-hooks --hook-type commit-msg --hook-type pre-commit\n```\n\nto install the pre-commit hooks.\n\n## Testing\n\nTest code via projen with:\n\n    npx projen test\n\nYou can run the sample stack with:\n\n    npx projen integ:deploy:serverless\n\nIf you want to use an existing vpc:\n\n    npx cdk deploy --context vpc-id=vpc-0123456789 TestServerlessV2Stack\n\nYou can also test DSQL support with:\n\n    npx projen integ:deploy:dsql\n\n# To do\n\n- Update role: will not revoke connect to previous database if database name has changed.\n"
+    "markdown": "# About\n\nThis CDK construct library makes it possible to create databases,\nschemas, and roles in an Aurora Serverless v2, RDS Database Cluster,\nDatabase Instance, or AWS DSQL clusters. PostgreSQL, MySQL, and DSQL\ndatabases are supported.\n\nThis construct library is intended to be used in enterprise\nenvironments, and works in isolated subnets.\n\n<p align=\"left\">\n  <a href=\"https://github.com/semantic-release/semantic-release\"><img src=\"https://img.shields.io/badge/semantic--release-angular-e10079?logo=semantic-release\" alt=semantic-release: angular\"></a>\n  <a href=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml\"><img src=\"https://github.com/berenddeboer/cdk-rds-sql/actions/workflows/release.yml/badge.svg\" alt=\"Release badge\"></a>\n</p>\n\n# Requirements\n\n- CDK v2.\n\n# Installation\n\n     npm i cdk-rds-sql\n\n# Usage\n\n## Provider\n\nFirst setup your VPC and create your cluster:\n\n```ts\nimport { Duration, RemovalPolicy } from \"aws-cdk-lib\"\nimport * as ec2 from \"aws-cdk-lib/aws-ec2\"\nimport * as rds from \"aws-cdk-lib/aws-rds\"\n\nconst vpc = ec2.Vpc.fromLookup(this, \"Vpc\", {\n  vpcId: this.node.tryGetContext(\"vpc-id\"),\n})\n\nconst cluster = new rds.ServerlessCluster(this, \"Cluster\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_ISOLATED,\n  },\n  engine: rds.DatabaseClusterEngine.AURORA_POSTGRESQL,\n  parameterGroup: rds.ParameterGroup.fromParameterGroupName(\n    this,\n    \"ParameterGroup\",\n    \"default.aurora-postgresql11\"\n  ),\n  removalPolicy: RemovalPolicy.DESTROY,\n  scaling: {\n    autoPause: Duration.minutes(60),\n    minCapacity: rds.AuroraCapacityUnit.ACU_2,\n    maxCapacity: rds.AuroraCapacityUnit.ACU_2,\n  },\n})\n```\n\nThen create a provider which will connect to your database. For a cluster:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\nFor an instance:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n})\n```\n\nThe provider will setup a lambda, which normally lives in the same VPC\nas the database. You can give a different VPC, as long as that VPC has\naccess to the VPC of the database. Only the provider lambda will talk\nto your database.\n\nThe provider will by default use the private isolated subnet of the\nVPC. Your isolated network must have a VPC endpoint to AWS Secrets Manager\nand possibly KMS as well. If you want to use a subnet with egress\naccess in case you have no such VPC endpoints, specify the subnet as\nfollows:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  vpcSubnets: {\n    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,\n  },\n  cluster: cluster,\n  secret: cluster.secret!,\n})\n```\n\n## Roles\n\nCreate a postgres role (or mysql user) for a cluster as follows:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n})\n```\n\nThis will automatically create a secret just like `ServerlessCluster`\ndoes, with all the connection info needed for this user. It's secret\nvalue is a JSON like:\n\n```json\n{\n  \"dbClusterIdentifier\": \"teststack-clustereb1186t9-sh4wpqfdyfvu\",\n  \"password\": \"very-long-and-boring\",\n  \"dbname\": \"mydb\",\n  \"engine\": \"postgres\",\n  \"port\": 5432,\n  \"host\": \"teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com\",\n  \"username\": \"myrole\"\n}\n```\n\nYou can access the secret via `role.secret`.\n\nInstead of `databaseName` you can also specify `database` to reference\nan existing database. The role will not be created until the database\nhas been created.\n\nIf you want to make the role the owner of a new database, just specify\nthe `databaseName` here, and create the database later.\n\n### IAM Authentication\n\nInstead of password-based authentication, you can create roles that\nuse AWS IAM database authentication. This eliminates the need to store\ndatabase passwords and provides enhanced security through AWS IAM\npolicies.\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst iamRole = new Role(this, \"IamRole\", {\n  provider: provider,\n  roleName: \"myiamrole\",\n  databaseName: \"mydb\",\n  enableIamAuth: true,\n})\n```\n\nWhen `enableIamAuth` is set to `true`:\n\n- **No secret is created** - the `role.secret` property will be `undefined`\n- The database role is created without a password\n- Your application must generate an IAM authentication token at runtime\n\nThis is the same behavior as DSQL clusters, which always use IAM authentication.\n\n**Requirements for IAM Authentication:**\n\n- SSL connections are required (enabled by default in this library)\n- Your application must have IAM permissions to connect to the database\n- The database user/role name must match the IAM identity\n\n**IAM Policy Example:**\n\nYour application will need an IAM policy like this to connect:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\"rds-db:connect\"],\n      \"Resource\": [\n        \"arn:aws:rds-db:region:account-id:dbuser:cluster-resource-id/myiamrole\"\n      ]\n    }\n  ]\n}\n```\n\n**Generating an IAM Authentication Token:**\n\nAt runtime, your application needs to generate an authentication token\nusing the AWS SDK. Here's an example using the AWS SDK for JavaScript:\n\n```ts\nimport { Signer } from \"@aws-sdk/rds-signer\"\nimport { Client } from \"pg\"\n\nconst signer = new Signer({\n  hostname: \"your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com\",\n  port: 5432,\n  username: \"myiamrole\",\n  region: \"us-east-1\",\n})\n\nconst token = await signer.getAuthToken()\n\nconst client = new Client({\n  host: \"your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com\",\n  port: 5432,\n  user: \"myiamrole\",\n  database: \"mydb\",\n  password: token,\n  ssl: { rejectUnauthorized: true },\n})\n\nawait client.connect()\n```\n\nBoth PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).\n\n### MySQL support\n\nIn MySQL users are created with '%' as value for the host. It is hard\nto do this better:\n\n- Determine the CIDR blocks used by a VPC is not trivial.\n- For imported VPCs you cannot specify the IPv6 CIDR.\n- CIDRs might change without the system knowing, meaning applications\n  could lose access to the database at random times, such as when a\n  container is restarted.\n\n## Database\n\nCreate a database as follows:\n\n```ts\nimport { Database } from \"cdk-rds-sql\"\n\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n```\n\nYou can provide an owner, which makes it easy to create database owned\nby a new user:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n  owner: role,\n})\n```\n\n## Schema\n\nCreate a schema in the default database as follows:\n\n```ts\nimport { Schema } from \"cdk-rds-sql\"\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n})\n```\n\nOr in another database:\n\n```ts\nconst database = new Database(this, \"Database\", {\n  provider: provider,\n  databaseName: \"mydb\",\n})\n\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n})\n```\n\nOne may need a role permitted for using schema:\n\n```ts\nnew Schema(this, \"Schema\", {\n  provider: provider,\n  schemaName: \"myschema\",\n  databaseName: database.databaseName,\n  role: role,\n})\n```\n\n## Sql\n\nYou can insert arbitrary SQL into your database with the `Sql` construct:\n\n```ts\nimport { Sql } from \"cdk-rds-sql\"\n\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: \"create table t (i int)\",\n})\n```\n\nCreate a table if it does not exist, and grant a role privileges:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n})\n```\n\nRollback sql on stack deletion:\n\n```ts\nconst sql = new Sql(this, \"Sql\", {\n  provider: provider,\n  database: database,\n  statement: `\ncreate table if not exists t (i int);\ngrant select on t to myrole;\n`,\n  rollback: `\nDO $$BEGIN\n  IF EXISTS (select from pg_database WHERE datname = 't') THEN\n    IF EXISTS (select from pg_catalog.pg_roles WHERE rolname = 'myrole') THEN\n      revoke select t from myrole;\n    END IF;\n    drop table t;\n  END IF;\nEND$$;\n`,\n})\n```\n\nNote that there is no synchronisation between various `Sql`\nconstructs, in particular the order in your code does not determine\nthe order in which your SQL is executed. This happens in parallel,\nunless you specify an explicit dependency via `sql.node.addDepency()`.\n\nThere are a lot of concerns when using `Sql`:\n\n- When you update your Sql, your previous Sql is not \"rolled back\",\n  the new Sql is simply executed again.\n- When you delete your `Sql` construct the rollback is executed if specified\n- When permission are granted via `Sql` they must be removed via\n  rollback to succesfully remove the role\n- Currently the `Sql` constructs has less than 5 minutes to execute\n  its work.\n- It is unknown how large your SQL can be.\n\n# Parameters\n\nSome lambda constructs, in particular [Bref](https://bref.sh/), do not\nsupport secrets out of the box. Use the `parameterPrefix` property to\ncreate SSM parameters in addition to a secret:\n\n```ts\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n  databaseName: \"mydb\",\n  parameterPrefix: \"/my-app/\",\n})\n```\n\nThis will create `/my-app/username`, `/my-app/password` and such.\n\nTo access parameters you will need IAM permissions such as:\n\n```ts\ninitialPolicy: [\n  new iam.PolicyStatement({\n\tactions: [\"ssm:GetParameter\", \"ssm:GetParameters\"],\n\tresources: [\n\t  // Grant access to all parameters under the base path\n\t  `arn:aws:ssm:${this.region}:${this.account}:parameter/my-app/*`,\n\t],\n\teffect: iam.Effect.ALLOW,\n  })\n],\n```\n\nNote that your VPC will need an SSM Parameters interface endpoint to support this.\n\n# AWS DSQL Support\n\nThis construct also supports AWS DSQL. DSQL is a great number of\nlimitations around it's postgresql support, so there is some learing\ncurve. This library supports creating roles, schemas, and executing\nSQL on DSQL clusters. Creating databases is not supported by DSQL.\n\n## DSQL Provider Setup\n\nDSQL clusters don't require a VPC or secrets since they use IAM authentication:\n\n```ts\nimport * as dsql from \"aws-cdk-lib/aws-dsql\"\nimport { Provider } from \"cdk-rds-sql\"\n\nconst dsqlCluster = new dsql.CfnCluster(this, \"DsqlCluster\", {\n  deletionProtectionEnabled: false,\n})\n\nconst provider = new Provider(this, \"Provider\", {\n  cluster: dsqlCluster,\n  // No VPC or secret needed for DSQL\n})\n```\n\nYou can access DSQL from within a VPC, but cdk-rds-sql has not been\nspecifically tested with that scenario.\n\n## DSQL Roles\n\nDSQL always uses IAM authentication, so the `enableIamAuth` property is ignored:\n\n```ts\nimport { Role } from \"cdk-rds-sql\"\n\nconst role = new Role(this, \"Role\", {\n  provider: provider,\n  roleName: \"myrole\",\n})\n```\n\n## Using DSQL\n\nConnecting to DSQL requires a couple of things:\n\n1. Your IAM role needs the `dsql:DbConnect` IAM permission to connect to the cluster.\n2. You probably want a normal postgres role (not \"admin\") to use from your apps.\n3. Your IAM role needs to be connected to your postgres role: use the `IamGrant` construct for that:\n\n   ```ts\n   new IamGrant(this, \"LambdaIamGrant\", {\n     provider: provider,\n     roleName: role.roleName,\n     resourceArn: queryLambda.role!.roleArn,\n   })\n   ```\n\n4. From your code use the Dsql signer to create the password:\n\n   ```ts\n   import { DsqlSigner } from \"@aws-sdk/dsql-signer\"\n   import { Client } from \"pg\"\n\n   const region =\n     process.env[\"AWS_REGION\"] || process.env[\"AWS_DEFAULT_REGION\"] || \"us-west-2\"\n\n   // Generate DSQL auth token using AWS SDK\n   const signer = new DsqlSigner({\n     hostname: host,\n     region,\n   })\n\n   const authToken = await signer.getDbConnectAuthToken()\n\n   const client = new Client({\n     host,\n     port: 5432,\n     user: dbUser,\n     database: dbName,\n     password: authToken,\n     ssl: { rejectUnauthorized: false },\n   })\n\n   await client.connect()\n   ```\n\n# IPv6\n\nIf you use the provider in an IPv6 subnet you probably need these settings:\n\n```ts\nimport { Provider } from \"cdk-rds-sql\"\n\nconst provider = new Provider(this, \"Provider\", {\n  ...\n  functionProps: {\n\tipv6AllowedForDualStack: true,\n\tallowAllIpv6Outbound: true,\n  },\n}\n```\n\n# Disabling SSL\n\nThe default connection to RDS is ssl enabled. You can disable ssl by\nsetting the `ssl` option to `false`:\n\n```ts\nconst provider = new Provider(this, \"Provider\", {\n  vpc: vpc,\n  instance: instance,\n  secret: cluster.secret!,\n  ssl: false, // default is true\n})\n```\n\n# Working on this code\n\nThis code is managed by\n[projen](https://github.com/projen/projen/blob/main/README.md). In\naddition [pre-commit](https://pre-commit.com/) is used.\n\nSo after git clone and `npm ci` you would do:\n\n```\npre-commit install --install-hooks --hook-type commit-msg --hook-type pre-commit\n```\n\nto install the pre-commit hooks.\n\n## Testing\n\nTest code via projen with:\n\n    npx projen test\n\nYou can run the sample stack with:\n\n    npx projen integ:deploy:serverless\n\nIf you want to use an existing vpc:\n\n    npx cdk deploy --context vpc-id=vpc-0123456789 TestServerlessV2Stack\n\nYou can also test DSQL support with:\n\n    npx projen integ:deploy:dsql\n\n# To do\n\n- Update role: will not revoke connect to previous database if database name has changed.\n"
   },
   "repository": {
     "type": "git",
@@ -5095,7 +5095,7 @@
         },
         "locationInModule": {
           "filename": "src/role.ts",
-          "line": 156
+          "line": 165
         },
         "parameters": [
           {
@@ -5121,7 +5121,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/role.ts",
-        "line": 144
+        "line": 147
       },
       "name": "Role",
       "properties": [
@@ -5133,7 +5133,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/role.ts",
-            "line": 148
+            "line": 151
           },
           "name": "roleName",
           "type": {
@@ -5142,14 +5142,14 @@
         },
         {
           "docs": {
-            "remarks": "Only available for non-DSQL clusters as DSQL uses IAM authentication.",
+            "remarks": "This is only available when:\n- The provider is not a DSQL cluster (DSQL uses IAM authentication)\n- `enableIamAuth` is not set to `true`\n\nWhen using IAM authentication, no secret is created as the password\nis generated dynamically using IAM credentials.",
             "stability": "stable",
-            "summary": "The generated secret."
+            "summary": "The generated secret containing connection information and password."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/role.ts",
-            "line": 154
+            "line": 163
           },
           "name": "secret",
           "optional": true,
@@ -5246,7 +5246,7 @@
           "abstract": true,
           "docs": {
             "default": "false - use password authentication",
-            "remarks": "When enabled, the role will be created without a password and\nconfigured for AWS IAM database authentication. The secret\nwill not contain a password field.\n\nNote: For DSQL clusters, this property is ignored as DSQL always\nuses IAM authentication.",
+            "remarks": "When enabled, the role will be created without a password and\nconfigured for AWS IAM database authentication. No secret will\nbe created for this role.\n\nNote: For DSQL clusters, this property is ignored as DSQL always\nuses IAM authentication.",
             "stability": "stable",
             "summary": "Enable IAM authentication for this role."
           },
@@ -5594,6 +5594,6 @@
       "symbolId": "src/sql:SqlProps"
     }
   },
-  "version": "7.3.2",
-  "fingerprint": "2Nt5HipkT3qGvOwwy3MgCUGWmXl40w4EVbXW8C8dBJo="
+  "version": "8.0.1",
+  "fingerprint": "kd/6afjq9ix4cOJibriTPyWOoG/cXXl1haYdhlC5BVE="
 }

package/README.md

@@ -161,18 +161,13 @@ const iamRole = new Role(this, "IamRole", {
 })
 ```
 
-For IAM-authenticated roles, the secret will not contain a password field:
+When `enableIamAuth` is set to `true`:
 
-```json
-{
-  "dbClusterIdentifier": "teststack-clustereb1186t9-sh4wpqfdyfvu",
-  "dbname": "mydb",
-  "engine": "postgres",
-  "port": 5432,
-  "host": "teststack-clustereb1186t9-sh4wpqfdyfvu.cluster-cgudolabssna.us-east-1.rds.amazonaws.com",
-  "username": "myiamrole"
-}
-```
+- **No secret is created** - the `role.secret` property will be `undefined`
+- The database role is created without a password
+- Your application must generate an IAM authentication token at runtime
+
+This is the same behavior as DSQL clusters, which always use IAM authentication.
 
 **Requirements for IAM Authentication:**
 
@@ -199,6 +194,36 @@ Your application will need an IAM policy like this to connect:
 }
 ```
 
+**Generating an IAM Authentication Token:**
+
+At runtime, your application needs to generate an authentication token
+using the AWS SDK. Here's an example using the AWS SDK for JavaScript:
+
+```ts
+import { Signer } from "@aws-sdk/rds-signer"
+import { Client } from "pg"
+
+const signer = new Signer({
+  hostname: "your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com",
+  port: 5432,
+  username: "myiamrole",
+  region: "us-east-1",
+})
+
+const token = await signer.getAuthToken()
+
+const client = new Client({
+  host: "your-cluster.cluster-xxxxx.us-east-1.rds.amazonaws.com",
+  port: 5432,
+  user: "myiamrole",
+  database: "mydb",
+  password: token,
+  ssl: { rejectUnauthorized: true },
+})
+
+await client.connect()
+```
+
 Both PostgreSQL and MySQL databases support IAM authentication. For more details, see the [AWS RDS IAM Database Authentication documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.html).
 
 ### MySQL support

package/lib/database.js

@@ -45,5 +45,5 @@ class Database extends aws_cdk_lib_1.CustomResource {
 }
 exports.Database = Database;
 _a = JSII_RTTI_SYMBOL_1;
-Database[_a] = { fqn: "cdk-rds-sql.Database", version: "7.3.2" };
+Database[_a] = { fqn: "cdk-rds-sql.Database", version: "8.0.1" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGF0YWJhc2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvZGF0YWJhc2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBNEM7QUFDNUMsMkNBQXNDO0FBQ3RDLGlDQUF1QztBQUN2Qyx5Q0FBc0Q7QUEwQnRELE1BQU0sZ0JBQWlCLFNBQVEsc0JBQVM7SUFHdEMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUF5QjtRQUNqRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBQ2hCLElBQUksQ0FBQyxZQUFZLEdBQUcsS0FBSyxDQUFDLFlBQVksQ0FBQTtJQUN4QyxDQUFDO0NBQ0Y7QUFFRCxNQUFhLFFBQVMsU0FBUSw0QkFBYztJQUMxQzs7T0FFRztJQUNILE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFnQixFQUFFLEVBQVUsRUFBRSxZQUFvQjtRQUN4RSxPQUFPLElBQUksZ0JBQWdCLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNyQyxZQUFZLEVBQUUsWUFBWTtTQUMzQixDQUFDLENBQUE7SUFDSixDQUFDO0lBSUQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFvQjtRQUM1RCw0REFBNEQ7UUFDNUQsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyx5QkFBYyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQ2IscUZBQXFGLENBQ3RGLENBQUE7UUFDSCxDQUFDO1FBRUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3pDLFVBQVUsRUFBRTtnQkFDVixRQUFRLEVBQUUscUJBQWMsQ0FBQyxRQUFRO2dCQUNqQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFlBQVk7Z0JBQzlCLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUTthQUM3QjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLENBQUMsWUFBWSxHQUFHLEtBQUssQ0FBQyxZQUFZLENBQUE7UUFDdEMsSUFBSSxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDaEIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ3RDLENBQUM7SUFDSCxDQUFDOztBQWxDSCw0QkFtQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyLCBEYXRhYmFzZUVuZ2luZSB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgfSBmcm9tIFwiLi9yb2xlXCJcblxuaW50ZXJmYWNlIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBOYW1lIG9mIGRhdGFiYXNlIHRvIGNyZWF0ZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIGRhdGFiYXNlIG93bmVyLlxuICAgKi9cbiAgcmVhZG9ubHkgb3duZXI/OiBSb2xlXG59XG5cbmV4cG9ydCBpbnRlcmZhY2UgRGF0YWJhc2VQcm9wcyBleHRlbmRzIERhdGFiYXNlQXR0cmlidXRlcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJUHJvdmlkZXJcbn1cblxuZXhwb3J0IGludGVyZmFjZSBJRGF0YWJhc2Uge1xuICByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xufVxuXG5jbGFzcyBJbXBvcnRlZERhdGFiYXNlIGV4dGVuZHMgQ29uc3RydWN0IGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgcHVibGljIHJlYWRvbmx5IGRhdGFiYXNlTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IERhdGFiYXNlQXR0cmlidXRlcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZClcbiAgICB0aGlzLmRhdGFiYXNlTmFtZSA9IHByb3BzLmRhdGFiYXNlTmFtZVxuICB9XG59XG5cbmV4cG9ydCBjbGFzcyBEYXRhYmFzZSBleHRlbmRzIEN1c3RvbVJlc291cmNlIGltcGxlbWVudHMgSURhdGFiYXNlIHtcbiAgLyoqXG4gICAqIFJldHVybiBhIERhdGFiYXNlIGJhc2VkIHVwb24gbmFtZSBvbmx5LiBVc2UgZm9yIGltcG9ydGluZyBleGlzdGluZyBkYXRhYmFzZXMuXG4gICAqL1xuICBzdGF0aWMgZnJvbURhdGFiYXNlTmFtZShzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBkYXRhYmFzZU5hbWU6IHN0cmluZyk6IElEYXRhYmFzZSB7XG4gICAgcmV0dXJuIG5ldyBJbXBvcnRlZERhdGFiYXNlKHNjb3BlLCBpZCwge1xuICAgICAgZGF0YWJhc2VOYW1lOiBkYXRhYmFzZU5hbWUsXG4gICAgfSlcbiAgfVxuXG4gIHB1YmxpYyByZWFkb25seSBkYXRhYmFzZU5hbWU6IHN0cmluZ1xuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBEYXRhYmFzZVByb3BzKSB7XG4gICAgLy8gQ2hlY2sgaWYgdXNpbmcgRFNRTCBwcm92aWRlciBhbmQgZm9yYmlkIGRhdGFiYXNlIGNyZWF0aW9uXG4gICAgaWYgKHByb3BzLnByb3ZpZGVyLmVuZ2luZSA9PT0gRGF0YWJhc2VFbmdpbmUuRFNRTCkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICBcIkRhdGFiYXNlIGNyZWF0aW9uIGlzIG5vdCBzdXBwb3J0ZWQgd2l0aCBEU1FMLiBEU1FMIGFsd2F5cyB1c2VzICdwb3N0Z3JlcycgZGF0YWJhc2UuXCJcbiAgICAgIClcbiAgICB9XG5cbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIHNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBSZXNvdXJjZTogUmRzU3FsUmVzb3VyY2UuREFUQUJBU0UsXG4gICAgICAgIFJlc291cmNlSWQ6IHByb3BzLmRhdGFiYXNlTmFtZSxcbiAgICAgICAgLi4uKHByb3BzLnByb3ZpZGVyLnNlY3JldCA/IHsgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuIH0gOiB7fSksXG4gICAgICAgIE93bmVyOiBwcm9wcy5vd25lcj8ucm9sZU5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucHJvdmlkZXIpXG4gICAgdGhpcy5kYXRhYmFzZU5hbWUgPSBwcm9wcy5kYXRhYmFzZU5hbWVcbiAgICBpZiAocHJvcHMub3duZXIpIHtcbiAgICAgIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLm93bmVyKVxuICAgIH1cbiAgfVxufVxuIl19

package/lib/handler/handler.js

@@ -4233,8 +4233,8 @@ var require_split2 = __commonJS({
     "use strict";
     var { Transform } = require("stream");
     var { StringDecoder } = require("string_decoder");
-    var kLast = Symbol("last");
-    var kDecoder = Symbol("decoder");
+    var kLast = /* @__PURE__ */ Symbol("last");
+    var kDecoder = /* @__PURE__ */ Symbol("decoder");
     function transform(chunk, enc, cb) {
       let list;
       if (this.overflow) {
@@ -17408,7 +17408,7 @@ var require_column_definition = __commonJS({
           decimals: this.decimals
         };
       }
-      [Symbol.for("nodejs.util.inspect.custom")](depth, inspectOptions, inspect) {
+      [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")](depth, inspectOptions, inspect) {
         const Types = require_types();
         const typeNames = [];
         for (const t in Types) {
@@ -18587,6 +18587,7 @@ var require_sha256_password = __commonJS({
     var PLUGIN_NAME = "sha256_password";
     var crypto2 = require("crypto");
     var { xorRotating } = require_auth_41();
+    var Tls = require("tls");
     var REQUEST_SERVER_KEY_PACKET = Buffer.from([1]);
     var STATE_INITIAL = 0;
     var STATE_WAIT_SERVER_KEY = 1;
@@ -18607,6 +18608,9 @@ var require_sha256_password = __commonJS({
       return (data) => {
         switch (state) {
           case STATE_INITIAL:
+            if (connection.stream instanceof Tls.TLSSocket && connection.stream.encrypted === true) {
+              return Buffer.from(`${password}\0`, "utf8");
+            }
             scramble = data.slice(0, 20);
             if (pluginOptions.serverPublicKey) {
               return authWithKey(pluginOptions.serverPublicKey);
@@ -21615,7 +21619,7 @@ var require_package = __commonJS({
   "node_modules/mysql2/package.json"(exports2, module2) {
     module2.exports = {
       name: "mysql2",
-      version: "3.14.5",
+      version: "3.16.0",
       description: "fast mysql driver. Implements core protocol, prepared statements, ssl and compression in native JS",
       main: "index.js",
       typings: "typings/mysql/index",
@@ -21675,7 +21679,7 @@ var require_package = __commonJS({
         "@eslint/eslintrc": "^3.3.0",
         "@eslint/js": "^9.21.0",
         "@eslint/markdown": "^7.0.0",
-        "@types/node": "^24.0.0",
+        "@types/node": "^25.0.2",
         "@typescript-eslint/eslint-plugin": "^8.26.0",
         "@typescript-eslint/parser": "^8.26.0",
         "assert-diff": "^3.0.2",
@@ -21931,7 +21935,8 @@ var require_connection_config = __commonJS({
       Promise: 1,
       queueLimit: 1,
       waitForConnections: 1,
-      jsonStrings: 1
+      jsonStrings: 1,
+      gracefulEnd: 1
     };
     var ConnectionConfig = class _ConnectionConfig {
       constructor(options) {
@@ -22024,6 +22029,7 @@ var require_connection_config = __commonJS({
         };
         this.maxPreparedStatements = options.maxPreparedStatements || 16e3;
         this.jsonStrings = options.jsonStrings || false;
+        this.gracefulEnd = options.gracefulEnd || false;
       }
       static mergeFlags(default_flags, user_flags) {
         let flags = 0, i;
@@ -23552,7 +23558,7 @@ var require_connection2 = __commonJS({
         });
         const rejectUnauthorized = this.config.ssl.rejectUnauthorized;
         const verifyIdentity = this.config.ssl.verifyIdentity;
-        const servername = this.config.host;
+        const servername = Net.isIP(this.config.host) ? void 0 : this.config.host;
         let secureEstablished = false;
         this.stream.removeAllListeners("data");
         const secureSocket = Tls.connect(
@@ -23606,6 +23612,24 @@ var require_connection2 = __commonJS({
         err.code = code || "PROTOCOL_ERROR";
         this.emit("error", err);
       }
+      get state() {
+        if (this._fatalError || this._protocolError) {
+          return "error";
+        }
+        if (this._closing || this.stream && this.stream.destroyed) {
+          return "disconnected";
+        }
+        if (this.authorized) {
+          return "authenticated";
+        }
+        if (this._handshakePacket) {
+          return "connected";
+        }
+        if (this.stream && !this.stream.destroyed) {
+          return "protocol_handshake";
+        }
+        return "disconnected";
+      }
       get fatalError() {
         return this._fatalError;
       }
@@ -24092,6 +24116,11 @@ var require_pool_connection = __commonJS({
         this._pool.releaseConnection(this);
       }
       end() {
+        if (this.config.gracefulEnd) {
+          this._removeFromPool();
+          super.end();
+          return;
+        }
         const err = new Error(
           "Calling conn.end() to release a pooled connection is deprecated. In next version calling conn.end() will be restored to default conn.end() behavior. Use conn.release() instead."
         );
@@ -24617,7 +24646,11 @@ var require_pool = __commonJS({
         this._removeIdleTimeoutConnectionsTimer = setTimeout(() => {
           try {
             while (this._freeConnections.length > this.config.maxIdle || this._freeConnections.length > 0 && Date.now() - this._freeConnections.get(0).lastActiveTime > this.config.idleTimeout) {
-              this._freeConnections.get(0).destroy();
+              if (this.config.connectionConfig.gracefulEnd) {
+                this._freeConnections.get(0).end();
+              } else {
+                this._freeConnections.get(0).destroy();
+              }
             }
           } finally {
             this._removeIdleTimeoutConnections();

package/lib/iam-grant.js

@@ -26,5 +26,5 @@ class IamGrant extends aws_cdk_lib_1.CustomResource {
 }
 exports.IamGrant = IamGrant;
 _a = JSII_RTTI_SYMBOL_1;
-IamGrant[_a] = { fqn: "cdk-rds-sql.IamGrant", version: "7.3.2" };
+IamGrant[_a] = { fqn: "cdk-rds-sql.IamGrant", version: "8.0.1" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaWFtLWdyYW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2lhbS1ncmFudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUU1QyxpQ0FBdUM7QUFDdkMseUNBQXNEO0FBbUJ0RCxNQUFhLFFBQVMsU0FBUSw0QkFBYztJQUMxQyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQW9CO1FBQzVELHdDQUF3QztRQUN4QyxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLHlCQUFjLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbEQsTUFBTSxJQUFJLEtBQUssQ0FDYixnSEFBZ0gsQ0FDakgsQ0FBQTtRQUNILENBQUM7UUFFRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsWUFBWSxFQUFFLHNCQUFzQjtZQUNwQyxVQUFVLEVBQUU7Z0JBQ1YsUUFBUSxFQUFFLHFCQUFjLENBQUMsU0FBUztnQkFDbEMsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO2dCQUN4QixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7YUFDL0I7U0FDRixDQUFDLENBQUE7UUFDRixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7SUFDekMsQ0FBQzs7QUFuQkgsNEJBb0JDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ3VzdG9tUmVzb3VyY2UgfSBmcm9tIFwiYXdzLWNkay1saWJcIlxuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSBcImNvbnN0cnVjdHNcIlxuaW1wb3J0IHsgUmRzU3FsUmVzb3VyY2UgfSBmcm9tIFwiLi9lbnVtXCJcbmltcG9ydCB7IElQcm92aWRlciwgRGF0YWJhc2VFbmdpbmUgfSBmcm9tIFwiLi9wcm92aWRlclwiXG5cbmV4cG9ydCBpbnRlcmZhY2UgSWFtR3JhbnRQcm9wcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJUHJvdmlkZXJcblxuICAvKipcbiAgICogRGF0YWJhc2Ugcm9sZSBuYW1lIHRvIGdyYW50IElBTSBhY2Nlc3MgdG8uXG4gICAqL1xuICByZWFkb25seSByb2xlTmFtZTogc3RyaW5nXG5cbiAgLyoqXG4gICAqIElBTSByZXNvdXJjZSBBUk4gKHJvbGUsIHVzZXIsIG9yIG90aGVyIElBTSBwcmluY2lwYWwpLlxuICAgKi9cbiAgcmVhZG9ubHkgcmVzb3VyY2VBcm46IHN0cmluZ1xufVxuXG5leHBvcnQgY2xhc3MgSWFtR3JhbnQgZXh0ZW5kcyBDdXN0b21SZXNvdXJjZSB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBJYW1HcmFudFByb3BzKSB7XG4gICAgLy8gSUFNIGdyYW50cyBhcmUgb25seSBzdXBwb3J0ZWQgb24gRFNRTFxuICAgIGlmIChwcm9wcy5wcm92aWRlci5lbmdpbmUgIT09IERhdGFiYXNlRW5naW5lLkRTUUwpIHtcbiAgICAgIHRocm93IG5ldyBFcnJvcihcbiAgICAgICAgXCJJQU0gZ3JhbnRzIGFyZSBvbmx5IHN1cHBvcnRlZCB3aXRoIERTUUwgY2x1c3RlcnMuIFVzZSByZWd1bGFyIGRhdGFiYXNlIGF1dGhlbnRpY2F0aW9uIGZvciBSRFMvQXVyb3JhIGNsdXN0ZXJzLlwiXG4gICAgICApXG4gICAgfVxuXG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHJlc291cmNlVHlwZTogXCJDdXN0b206OkRzcWxJYW1HcmFudFwiLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBSZXNvdXJjZTogUmRzU3FsUmVzb3VyY2UuSUFNX0dSQU5ULFxuICAgICAgICBSb2xlTmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgIFJlc291cmNlQXJuOiBwcm9wcy5yZXNvdXJjZUFybixcbiAgICAgIH0sXG4gICAgfSlcbiAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcbiAgfVxufVxuIl19

package/lib/provider.js

@@ -209,7 +209,7 @@ class Provider extends constructs_1.Construct {
 }
 exports.Provider = Provider;
 _a = JSII_RTTI_SYMBOL_1;
-Provider[_a] = { fqn: "cdk-rds-sql.Provider", version: "7.3.2" };
+Provider[_a] = { fqn: "cdk-rds-sql.Provider", version: "8.0.1" };
 class ImportedProvider extends constructs_1.Construct {
     constructor(scope, id, attrs) {
         super(scope, id);

package/lib/role.d.ts

@@ -62,8 +62,8 @@ export interface RoleProps {
      * Enable IAM authentication for this role.
      *
      * When enabled, the role will be created without a password and
-     * configured for AWS IAM database authentication. The secret
-     * will not contain a password field.
+     * configured for AWS IAM database authentication. No secret will
+     * be created for this role.
      *
      * Note: For DSQL clusters, this property is ignored as DSQL always
      * uses IAM authentication.
@@ -78,8 +78,14 @@ export declare class Role extends Construct {
      */
     readonly roleName: string;
     /**
-     * The generated secret.
-     * Only available for non-DSQL clusters as DSQL uses IAM authentication.
+     * The generated secret containing connection information and password.
+     *
+     * This is only available when:
+     * - The provider is not a DSQL cluster (DSQL uses IAM authentication)
+     * - `enableIamAuth` is not set to `true`
+     *
+     * When using IAM authentication, no secret is created as the password
+     * is generated dynamically using IAM credentials.
      */
     readonly secret?: ISecret;
     constructor(scope: Construct, id: string, props: RoleProps);

package/lib/role.js

@@ -25,22 +25,25 @@ class Parameters extends constructs_1.Construct {
             }
         });
         // For password, use the existing provider to store it in SSM
-        const passwordParameterName = `${props.parameterPrefix}password`;
-        const password_parameter = new aws_cdk_lib_1.CustomResource(this, "PasswordParameter", {
-            serviceToken: props.providerServiceToken,
-            properties: {
-                SecretArn: props.secretArn,
-                Resource: enum_1.RdsSqlResource.PARAMETER_PASSWORD,
-                PasswordArn: props.passwordArn,
-                ParameterName: passwordParameterName,
-            },
-        });
-        password_parameter.node.addDependency(props.provider);
-        const paramArn = `arn:aws:ssm:${aws_cdk_lib_1.Stack.of(this).region}:${aws_cdk_lib_1.Stack.of(this).account}:parameter${passwordParameterName.startsWith("/") ? "" : "/"}${passwordParameterName}`;
-        props.provider.handler.addToRolePolicy(new iam.PolicyStatement({
-            actions: ["ssm:PutParameter", "ssm:AddTagsToResource", "ssm:GetParameters"],
-            resources: [paramArn],
-        }));
+        // Skip password parameter for IAM auth roles (no passwordArn)
+        if (props.passwordArn) {
+            const passwordParameterName = `${props.parameterPrefix}password`;
+            const password_parameter = new aws_cdk_lib_1.CustomResource(this, "PasswordParameter", {
+                serviceToken: props.providerServiceToken,
+                properties: {
+                    SecretArn: props.secretArn,
+                    Resource: enum_1.RdsSqlResource.PARAMETER_PASSWORD,
+                    PasswordArn: props.passwordArn,
+                    ParameterName: passwordParameterName,
+                },
+            });
+            password_parameter.node.addDependency(props.provider);
+            const paramArn = `arn:aws:ssm:${aws_cdk_lib_1.Stack.of(this).region}:${aws_cdk_lib_1.Stack.of(this).account}:parameter${passwordParameterName.startsWith("/") ? "" : "/"}${passwordParameterName}`;
+            props.provider.handler.addToRolePolicy(new iam.PolicyStatement({
+                actions: ["ssm:PutParameter", "ssm:AddTagsToResource", "ssm:GetParameters"],
+                resources: [paramArn],
+            }));
+        }
     }
 }
 class Role extends constructs_1.Construct {
@@ -57,7 +60,9 @@ class Role extends constructs_1.Construct {
             }
         }
         super(scope, id);
-        // DSQL doesn't use secrets - it always uses IAM authentication
+        // Skip secret creation for DSQL (always uses IAM auth) or when enableIamAuth is true
+        const useIamAuth = props.enableIamAuth || props.provider.engine === provider_1.DatabaseEngine.DSQL;
+        // For non-DSQL providers, we need cluster info for secrets and/or parameters
         if (props.provider.engine !== provider_1.DatabaseEngine.DSQL) {
             // For imported providers without cluster details, provide helpful error message
             if (!props.provider.cluster) {
@@ -75,35 +80,33 @@ class Role extends constructs_1.Construct {
             const identifier = props.provider.cluster.clusterIdentifier
                 ? props.provider.cluster.clusterIdentifier
                 : props.provider.cluster.instanceIdentifier;
-            const secretTemplate = {
-                dbClusterIdentifier: identifier,
-                engine: props.provider.engine,
-                host: host,
-                port: port,
-                username: props.roleName,
-                dbname: props.database ? props.database.databaseName : props.databaseName,
-            };
-            this.secret = new aws_secretsmanager_1.Secret(this, "Secret", {
-                secretName: props.secretName,
-                encryptionKey: props.encryptionKey,
-                description: `Generated secret for ${props.provider.engine} role ${props.roleName}`,
-                ...(props.enableIamAuth
-                    ? {
-                        // For IAM auth, create secret without password generation
+            const databaseName = props.database
+                ? props.database.databaseName
+                : props.databaseName;
+            // Create secret only for password auth (not IAM auth)
+            if (!useIamAuth) {
+                const secretTemplate = {
+                    dbClusterIdentifier: identifier,
+                    engine: props.provider.engine,
+                    host: host,
+                    port: port,
+                    username: props.roleName,
+                    dbname: databaseName,
+                };
+                this.secret = new aws_secretsmanager_1.Secret(this, "Secret", {
+                    secretName: props.secretName,
+                    encryptionKey: props.encryptionKey,
+                    description: `Generated secret for ${props.provider.engine} role ${props.roleName}`,
+                    generateSecretString: {
+                        passwordLength: 30, // Oracle password cannot have more than 30 characters
                         secretStringTemplate: JSON.stringify(secretTemplate),
-                    }
-                    : {
-                        // For password auth, generate password
-                        generateSecretString: {
-                            passwordLength: 30, // Oracle password cannot have more than 30 characters
-                            secretStringTemplate: JSON.stringify(secretTemplate),
-                            generateStringKey: "password",
-                            excludeCharacters: " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
-                        },
-                    }),
-                removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY,
-            });
-            // Create Parameters if parameterPrefix is provided
+                        generateStringKey: "password",
+                        excludeCharacters: " %+~`#$&*()|[]{}:;<>?!'/@\"\\",
+                    },
+                    removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY,
+                });
+            }
+            // Create Parameters if parameterPrefix is provided (for both password and IAM auth)
             if (props.parameterPrefix) {
                 const paramData = {
                     dbClusterIdentifier: identifier,
@@ -111,12 +114,14 @@ class Role extends constructs_1.Construct {
                     host: host,
                     port: port,
                     username: props.roleName,
-                    dbname: props.database ? props.database.databaseName : props.databaseName,
                 };
+                if (databaseName) {
+                    paramData.dbname = databaseName;
+                }
                 new Parameters(this, "Parameters", {
                     secretArn: props.provider.secret?.secretArn || "",
                     parameterPrefix: props.parameterPrefix,
-                    passwordArn: props.enableIamAuth ? "" : this.secret.secretArn,
+                    passwordArn: this.secret?.secretArn, // undefined for IAM auth - skips password param
                     providerServiceToken: props.provider.serviceToken,
                     provider: props.provider,
                     paramData,
@@ -126,12 +131,10 @@ class Role extends constructs_1.Construct {
         const role = new role_custom_resource_1.Role(this, "PostgresRole", {
             provider: props.provider,
             roleName: props.roleName,
-            passwordArn: props.enableIamAuth || props.provider.engine === provider_1.DatabaseEngine.DSQL
-                ? ""
-                : this.secret.secretArn,
+            passwordArn: useIamAuth ? "" : this.secret.secretArn,
             database: props.database,
             databaseName: props.databaseName,
-            enableIamAuth: props.enableIamAuth || props.provider.engine === provider_1.DatabaseEngine.DSQL,
+            enableIamAuth: useIamAuth,
         });
         if (this.secret) {
             role.node.addDependency(this.secret);
@@ -146,5 +149,5 @@ class Role extends constructs_1.Construct {
 }
 exports.Role = Role;
 _a = JSII_RTTI_SYMBOL_1;
-Role[_a] = { fqn: "cdk-rds-sql.Role", version: "7.3.2" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsNkNBQWtFO0FBQ2xFLDJDQUEwQztBQUcxQyx1RUFBZ0U7QUFDaEUsMkNBQTBDO0FBQzFDLDJDQUFzQztBQUV0QyxpQ0FBdUM7QUFDdkMseUNBQXNEO0FBQ3RELGlFQUFtRTtBQStFbkUsOENBQThDO0FBQzlDLE1BQU0sVUFBVyxTQUFRLHNCQUFTO0lBQ2hDLFlBQ0UsS0FBZ0IsRUFDaEIsRUFBVSxFQUNWLEtBT0M7UUFFRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBRWhCLDRDQUE0QztRQUM1QyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFO1lBQ3ZELElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUN4QixJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLGFBQWEsR0FBRyxFQUFFLEVBQUU7b0JBQ2hELGFBQWEsRUFBRSxHQUFHLEtBQUssQ0FBQyxlQUFlLEdBQUcsR0FBRyxFQUFFO29CQUMvQyxXQUFXLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRTtpQkFDOUIsQ0FBQyxDQUFBO1lBQ0osQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFBO1FBRUYsNkRBQTZEO1FBQzdELE1BQU0scUJBQXFCLEdBQUcsR0FBRyxLQUFLLENBQUMsZUFBZSxVQUFVLENBQUE7UUFDaEUsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLDRCQUFjLENBQUMsSUFBSSxFQUFFLG1CQUFtQixFQUFFO1lBQ3ZFLFlBQVksRUFBRSxLQUFLLENBQUMsb0JBQW9CO1lBQ3hDLFVBQVUsRUFBRTtnQkFDVixTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7Z0JBQzFCLFFBQVEsRUFBRSxxQkFBYyxDQUFDLGtCQUFrQjtnQkFDM0MsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO2dCQUM5QixhQUFhLEVBQUUscUJBQXFCO2FBQ3JDO1NBQ0YsQ0FBQyxDQUFBO1FBQ0Ysa0JBQWtCLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7UUFFckQsTUFBTSxRQUFRLEdBQUcsZUFBZSxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLElBQ25ELG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQ2pCLGFBQ0UscUJBQXFCLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEdBQy9DLEdBQUcscUJBQXFCLEVBQUUsQ0FBQTtRQUUxQixLQUFLLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQ3BDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztZQUN0QixPQUFPLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsQ0FBQztZQUMzRSxTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUM7U0FDdEIsQ0FBQyxDQUNILENBQUE7SUFDSCxDQUFDO0NBQ0Y7QUFFRCxNQUFhLElBQUssU0FBUSxzQkFBUztJQVlqQyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQWdCO1FBQ3hELElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUsseUJBQWMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsRCxJQUFJLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUN6QyxNQUFNLHlDQUF5QyxDQUFBO1lBQ2pELENBQUM7WUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztnQkFDM0Msb0dBQW9HO2dCQUNwRyx5RUFBeUU7Z0JBQ3pFLHNEQUFzRDtnQkFDdEQsTUFBTSx5Q0FBeUMsQ0FBQTtZQUNqRCxDQUFDO1FBQ0gsQ0FBQztRQUNELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUE7UUFFaEIsK0RBQStEO1FBQy9ELElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUsseUJBQWMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsRCxnRkFBZ0Y7WUFDaEYsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQzVCLE1BQU0sSUFBSSxLQUFLLENBQ2IsNkVBQTZFO29CQUMzRSxnRkFBZ0Y7b0JBQ2hGLDRGQUE0RixDQUMvRixDQUFBO1lBQ0gsQ0FBQztZQUVELDhEQUE4RDtZQUM5RCxNQUFNLElBQUksR0FBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsZUFBZTtnQkFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlLENBQUMsUUFBUTtnQkFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUE7WUFFM0UsTUFBTSxJQUFJLEdBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE0QixDQUFDLGVBQWU7Z0JBQ3ZFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsZUFBZSxDQUFDLElBQUk7Z0JBQ25FLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTZCLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFBO1lBRXZFLE1BQU0sVUFBVSxHQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxpQkFBaUI7Z0JBQy9FLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsaUJBQWlCO2dCQUNoRSxDQUFDLENBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE2QixDQUFDLGtCQUFrQixDQUFBO1lBRXBFLE1BQU0sY0FBYyxHQUFHO2dCQUNyQixtQkFBbUIsRUFBRSxVQUFVO2dCQUMvQixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO2dCQUM3QixJQUFJLEVBQUUsSUFBSTtnQkFDVixJQUFJLEVBQUUsSUFBSTtnQkFDVixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7Z0JBQ3hCLE1BQU0sRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFlBQVk7YUFDMUUsQ0FBQTtZQUVELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSwyQkFBTSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUU7Z0JBQ3ZDLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtnQkFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO2dCQUNsQyxXQUFXLEVBQUUsd0JBQXdCLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxTQUFTLEtBQUssQ0FBQyxRQUFRLEVBQUU7Z0JBQ25GLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYTtvQkFDckIsQ0FBQyxDQUFDO3dCQUNFLDBEQUEwRDt3QkFDMUQsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7cUJBQ3JEO29CQUNILENBQUMsQ0FBQzt3QkFDRSx1Q0FBdUM7d0JBQ3ZDLG9CQUFvQixFQUFFOzRCQUNwQixjQUFjLEVBQUUsRUFBRSxFQUFFLHNEQUFzRDs0QkFDMUUsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7NEJBQ3BELGlCQUFpQixFQUFFLFVBQVU7NEJBQzdCLGlCQUFpQixFQUFFLCtCQUErQjt5QkFDbkQ7cUJBQ0YsQ0FBQztnQkFDTixhQUFhLEVBQUUsMkJBQWEsQ0FBQyxPQUFPO2FBQ3JDLENBQUMsQ0FBQTtZQUVGLG1EQUFtRDtZQUNuRCxJQUFJLEtBQUssQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDMUIsTUFBTSxTQUFTLEdBQUc7b0JBQ2hCLG1CQUFtQixFQUFFLFVBQVU7b0JBQy9CLE1BQU0sRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU07b0JBQzdCLElBQUksRUFBRSxJQUFJO29CQUNWLElBQUksRUFBRSxJQUFJO29CQUNWLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtvQkFDeEIsTUFBTSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtpQkFDMUUsQ0FBQTtnQkFFRCxJQUFJLFVBQVUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFO29CQUNqQyxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsU0FBUyxJQUFJLEVBQUU7b0JBQ2pELGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZTtvQkFDdEMsV0FBVyxFQUFFLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTO29CQUM3RCxvQkFBb0IsRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7b0JBQ2pELFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtvQkFDeEIsU0FBUztpQkFDVixDQUFDLENBQUE7WUFDSixDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sSUFBSSxHQUFHLElBQUksMkJBQWtCLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRTtZQUN4RCxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFdBQVcsRUFDVCxLQUFLLENBQUMsYUFBYSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLHlCQUFjLENBQUMsSUFBSTtnQkFDbEUsQ0FBQyxDQUFDLEVBQUU7Z0JBQ0osQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFPLENBQUMsU0FBUztZQUM1QixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZO1lBQ2hDLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLHlCQUFjLENBQUMsSUFBSTtTQUNwRixDQUFDLENBQUE7UUFFRixJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUE7WUFDcEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUM3QyxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQzlCLGdEQUFnRDtnQkFDaEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUE7WUFDaEUsQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7SUFDaEMsQ0FBQzs7QUE1SEgsb0JBNkhDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ3VzdG9tUmVzb3VyY2UsIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCAqIGFzIGlhbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWlhbVwiXG5pbXBvcnQgKiBhcyBrbXMgZnJvbSBcImF3cy1jZGstbGliL2F3cy1rbXNcIlxuaW1wb3J0IHsgSURhdGFiYXNlQ2x1c3RlciwgSURhdGFiYXNlSW5zdGFuY2UgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXJkc1wiXG5pbXBvcnQgeyBJU2VjcmV0LCBTZWNyZXQgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNlY3JldHNtYW5hZ2VyXCJcbmltcG9ydCAqIGFzIHNzbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNzbVwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyLCBEYXRhYmFzZUVuZ2luZSB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgYXMgQ3VzdG9tUmVzb3VyY2VSb2xlIH0gZnJvbSBcIi4vcm9sZS5jdXN0b20tcmVzb3VyY2VcIlxuXG5leHBvcnQgaW50ZXJmYWNlIFJvbGVQcm9wcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJUHJvdmlkZXJcblxuICAvKipcbiAgICogU1FMLlxuICAgKi9cbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBJZiB0aGUgZGF0YWJhc2UgZXhpc3RzLCBjb25uZWN0IHByaXZpbGVnZXMgYXJlIGdyYW50ZWQuXG4gICAqXG4gICAqIFNwZWNpZnkgb25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAuIFRoaXMgaXMgdGhlIG5hbWVcbiAgICogdGhhdCB3aWxsIGJlIHN0b3JlZCBpbiB0aGUgcm9sZSdzIHNlY3JldCBhcyB0aGUgZGF0YWJhc2UgbmFtZSB0b1xuICAgKiB1c2UuXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZT86IElEYXRhYmFzZVxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSBuYW1lIHRoaXMgdXNlciBpcyBleHBlY3RlZCB0byB1c2UuXG4gICAqXG4gICAqIElmIHRoZSBkYXRhYmFzZSBleGlzdHMsIGNvbm5lY3QgcHJpdmlsZWdlcyBhcmUgZ3JhbnRlZC5cbiAgICpcbiAgICogU3BlY2lmeSBvbmUgb2YgYGRhdGFiYXNlYCBvciBgZGF0YWJhc2VOYW1lYC4gVGhpcyBpcyB0aGUgbmFtZVxuICAgKiB0aGF0IHdpbGwgYmUgc3RvcmVkIGluIHRoZSByb2xlJ3Mgc2VjcmV0IGFzIHRoZSBkYXRhYmFzZSBuYW1lIHRvXG4gICAqIHVzZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZT86IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBBIG5ldyBzZWNyZXQgaXMgY3JlYXRlZCBmb3IgdGhpcyB1c2VyLlxuICAgKlxuICAgKiBPcHRpb25hbGx5IGVuY3J5cHQgaXQgd2l0aCB0aGUgZ2l2ZW4ga2V5LlxuICAgKi9cbiAgcmVhZG9ubHkgZW5jcnlwdGlvbktleT86IGttcy5JS2V5XG5cbiAgLyoqXG4gICAqIEEgbmV3IHNlY3JldCBpcyBjcmVhdGVkIGZvciB0aGlzIHVzZXIuXG4gICAqXG4gICAqIE9wdGlvbmFsbHkgYWRkIHNlY3JldCBuYW1lIHRvIHRoZSBzZWNyZXQuXG4gICAqL1xuICByZWFkb25seSBzZWNyZXROYW1lPzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIFByZWZpeCBmb3IgU1NNIHBhcmFtZXRlcnMgdG8gc3RvcmUgY3JlZGVudGlhbHMgaW4gUGFyYW1ldGVyIFN0b3JlLlxuICAgKiBXaGVuIGRlZmluZWQsIGNyZWRlbnRpYWxzIHdpbGwgYWxzbyBiZSBzdG9yZWQgYXMgcGFyYW1ldGVycy5cbiAgICpcbiAgICogVGhlIHBhcmFtZXRlciBuYW1lcyBzdWNoIGFzIFwicGFzc3dvcmRcIiBpcyBzaW1wbHkgYXBwZW5kZWQgdG9cbiAgICogYHBhcmFtZXRlclByZWZpeGAsIHNvIG1ha2Ugc3VyZSB0aGUgcHJlZml4IGVuZHMgd2l0aCBhIHNsYXNoIGlmXG4gICAqICB5b3UgaGF2ZSB5b3VyIHBhcmFtZXRlciBuYW1lcyBzbGFzaCBzZXBhcmF0ZWQuXG4gICAqXG4gICAqIE5vdGUgdGhhdCB0aGUgcGFzc3dvcmQgZnJvbSB0aGUgc2VjcmV0IGlzIGNvcGllZCBqdXN0IG9uY2UsIHRoZXlcbiAgICogYXJlIG5vdCBrZXB0IGluIHN5bmMuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gY3JlZGVudGlhbHMgYXJlIG9ubHkgc3RvcmVkIGluIFNlY3JldHMgTWFuYWdlclxuICAgKi9cbiAgcmVhZG9ubHkgcGFyYW1ldGVyUHJlZml4Pzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIEVuYWJsZSBJQU0gYXV0aGVudGljYXRpb24gZm9yIHRoaXMgcm9sZS5cbiAgICpcbiAgICogV2hlbiBlbmFibGVkLCB0aGUgcm9sZSB3aWxsIGJlIGNyZWF0ZWQgd2l0aG91dCBhIHBhc3N3b3JkIGFuZFxuICAgKiBjb25maWd1cmVkIGZvciBBV1MgSUFNIGRhdGFiYXNlIGF1dGhlbnRpY2F0aW9uLiBUaGUgc2VjcmV0XG4gICAqIHdpbGwgbm90IGNvbnRhaW4gYSBwYXNzd29yZCBmaWVsZC5cbiAgICpcbiAgICogTm90ZTogRm9yIERTUUwgY2x1c3RlcnMsIHRoaXMgcHJvcGVydHkgaXMgaWdub3JlZCBhcyBEU1FMIGFsd2F5c1xuICAgKiB1c2VzIElBTSBhdXRoZW50aWNhdGlvbi5cbiAgICpcbiAgICogQGRlZmF1bHQgZmFsc2UgLSB1c2UgcGFzc3dvcmQgYXV0aGVudGljYXRpb25cbiAgICovXG4gIHJlYWRvbmx5IGVuYWJsZUlhbUF1dGg/OiBib29sZWFuXG59XG5cbi8vIFByaXZhdGUgUGFyYW1ldGVycyBjb25zdHJ1Y3QgKG5vdCBleHBvcnRlZClcbmNsYXNzIFBhcmFtZXRlcnMgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihcbiAgICBzY29wZTogQ29uc3RydWN0LFxuICAgIGlkOiBzdHJpbmcsXG4gICAgcHJvcHM6IHtcbiAgICAgIHByb3ZpZGVyOiBJUHJvdmlkZXJcbiAgICAgIHNlY3JldEFybjogc3RyaW5nXG4gICAgICBwYXJhbWV0ZXJQcmVmaXg6IHN0cmluZ1xuICAgICAgcGFzc3dvcmRBcm46IHN0cmluZ1xuICAgICAgcHJvdmlkZXJTZXJ2aWNlVG9rZW46IHN0cmluZ1xuICAgICAgcGFyYW1EYXRhOiBSZWNvcmQ8c3RyaW5nLCBhbnk+XG4gICAgfVxuICApIHtcbiAgICBzdXBlcihzY29wZSwgaWQpXG5cbiAgICAvLyBDcmVhdGUgcGFyYW1ldGVycyBmb3IgZWFjaCBrZXktdmFsdWUgcGFpclxuICAgIE9iamVjdC5lbnRyaWVzKHByb3BzLnBhcmFtRGF0YSkuZm9yRWFjaCgoW2tleSwgdmFsdWVdKSA9PiB7XG4gICAgICBpZiAodmFsdWUgIT09IHVuZGVmaW5lZCkge1xuICAgICAgICBuZXcgc3NtLlN0cmluZ1BhcmFtZXRlcih0aGlzLCBgUGFyYW1ldGVyLSR7a2V5fWAsIHtcbiAgICAgICAgICBwYXJhbWV0ZXJOYW1lOiBgJHtwcm9wcy5wYXJhbWV0ZXJQcmVmaXh9JHtrZXl9YCxcbiAgICAgICAgICBzdHJpbmdWYWx1ZTogdmFsdWUudG9TdHJpbmcoKSxcbiAgICAgICAgfSlcbiAgICAgIH1cbiAgICB9KVxuXG4gICAgLy8gRm9yIHBhc3N3b3JkLCB1c2UgdGhlIGV4aXN0aW5nIHByb3ZpZGVyIHRvIHN0b3JlIGl0IGluIFNTTVxuICAgIGNvbnN0IHBhc3N3b3JkUGFyYW1ldGVyTmFtZSA9IGAke3Byb3BzLnBhcmFtZXRlclByZWZpeH1wYXNzd29yZGBcbiAgICBjb25zdCBwYXNzd29yZF9wYXJhbWV0ZXIgPSBuZXcgQ3VzdG9tUmVzb3VyY2UodGhpcywgXCJQYXNzd29yZFBhcmFtZXRlclwiLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyU2VydmljZVRva2VuLFxuICAgICAgcHJvcGVydGllczoge1xuICAgICAgICBTZWNyZXRBcm46IHByb3BzLnNlY3JldEFybixcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLlBBUkFNRVRFUl9QQVNTV09SRCxcbiAgICAgICAgUGFzc3dvcmRBcm46IHByb3BzLnBhc3N3b3JkQXJuLFxuICAgICAgICBQYXJhbWV0ZXJOYW1lOiBwYXNzd29yZFBhcmFtZXRlck5hbWUsXG4gICAgICB9LFxuICAgIH0pXG4gICAgcGFzc3dvcmRfcGFyYW1ldGVyLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcblxuICAgIGNvbnN0IHBhcmFtQXJuID0gYGFybjphd3M6c3NtOiR7U3RhY2sub2YodGhpcykucmVnaW9ufToke1xuICAgICAgU3RhY2sub2YodGhpcykuYWNjb3VudFxuICAgIH06cGFyYW1ldGVyJHtcbiAgICAgIHBhc3N3b3JkUGFyYW1ldGVyTmFtZS5zdGFydHNXaXRoKFwiL1wiKSA/IFwiXCIgOiBcIi9cIlxuICAgIH0ke3Bhc3N3b3JkUGFyYW1ldGVyTmFtZX1gXG5cbiAgICBwcm9wcy5wcm92aWRlci5oYW5kbGVyLmFkZFRvUm9sZVBvbGljeShcbiAgICAgIG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgYWN0aW9uczogW1wic3NtOlB1dFBhcmFtZXRlclwiLCBcInNzbTpBZGRUYWdzVG9SZXNvdXJjZVwiLCBcInNzbTpHZXRQYXJhbWV0ZXJzXCJdLFxuICAgICAgICByZXNvdXJjZXM6IFtwYXJhbUFybl0sXG4gICAgICB9KVxuICAgIClcbiAgfVxufVxuXG5leHBvcnQgY2xhc3MgUm9sZSBleHRlbmRzIENvbnN0cnVjdCB7XG4gIC8qKlxuICAgKiBUaGUgcm9sZSBuYW1lLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHJvbGVOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogVGhlIGdlbmVyYXRlZCBzZWNyZXQuXG4gICAqIE9ubHkgYXZhaWxhYmxlIGZvciBub24tRFNRTCBjbHVzdGVycyBhcyBEU1FMIHVzZXMgSUFNIGF1dGhlbnRpY2F0aW9uLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IHNlY3JldD86IElTZWNyZXRcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogUm9sZVByb3BzKSB7XG4gICAgaWYgKHByb3BzLnByb3ZpZGVyLmVuZ2luZSAhPT0gRGF0YWJhc2VFbmdpbmUuRFNRTCkge1xuICAgICAgaWYgKHByb3BzLmRhdGFiYXNlICYmIHByb3BzLmRhdGFiYXNlTmFtZSkge1xuICAgICAgICB0aHJvdyBcIlNwZWNpZnkgZWl0aGVyIGRhdGFiYXNlIG9yIGRhdGFiYXNlTmFtZVwiXG4gICAgICB9XG4gICAgICBpZiAoIXByb3BzLmRhdGFiYXNlICYmICFwcm9wcy5kYXRhYmFzZU5hbWUpIHtcbiAgICAgICAgLy8gSWYgbmVpdGhlciBpcyBzcGVjaWZpZWQsIHdlIG1pZ2h0IG5lZWQgYSBkZWZhdWx0IG9yIHRocm93IGFuIGVycm9yIGRlcGVuZGluZyBvbiBkZXNpcmVkIGJlaGF2aW9yLlxuICAgICAgICAvLyBGb3Igbm93LCBsZXQncyBhc3N1bWUgaXQncyBhbGxvd2VkIGJ1dCB0aGUgc2VjcmV0IHdvbid0IGhhdmUgYSBkYm5hbWUuXG4gICAgICAgIC8vIElmIGl0IHNob3VsZCBiZSByZXF1aXJlZCwgdW5jb21tZW50IHRoZSBsaW5lIGJlbG93OlxuICAgICAgICB0aHJvdyBcIlNwZWNpZnkgZWl0aGVyIGRhdGFiYXNlIG9yIGRhdGFiYXNlTmFtZVwiXG4gICAgICB9XG4gICAgfVxuICAgIHN1cGVyKHNjb3BlLCBpZClcblxuICAgIC8vIERTUUwgZG9lc24ndCB1c2Ugc2VjcmV0cyAtIGl0IGFsd2F5cyB1c2VzIElBTSBhdXRoZW50aWNhdGlvblxuICAgIGlmIChwcm9wcy5wcm92aWRlci5lbmdpbmUgIT09IERhdGFiYXNlRW5naW5lLkRTUUwpIHtcbiAgICAgIC8vIEZvciBpbXBvcnRlZCBwcm92aWRlcnMgd2l0aG91dCBjbHVzdGVyIGRldGFpbHMsIHByb3ZpZGUgaGVscGZ1bCBlcnJvciBtZXNzYWdlXG4gICAgICBpZiAoIXByb3BzLnByb3ZpZGVyLmNsdXN0ZXIpIHtcbiAgICAgICAgdGhyb3cgbmV3IEVycm9yKFxuICAgICAgICAgIFwiUm9sZSBjcmVhdGlvbiByZXF1aXJlcyBjbHVzdGVyIGluZm9ybWF0aW9uLiBXaGVuIGltcG9ydGluZyBhIHByb3ZpZGVyIHdpdGggXCIgK1xuICAgICAgICAgICAgXCJQcm92aWRlci5mcm9tUHJvdmlkZXJBdHRyaWJ1dGVzKCksIGluY2x1ZGUgdGhlICdjbHVzdGVyJyBwcm9wZXJ0eSBpZiB5b3UgcGxhbiBcIiArXG4gICAgICAgICAgICBcInRvIGNyZWF0ZSBuZXcgcm9sZXMuIEFsdGVybmF0aXZlbHksIHVzZSBleGlzdGluZyByb2xlcyBjcmVhdGVkIHdpdGggdGhlIG9yaWdpbmFsIHByb3ZpZGVyLlwiXG4gICAgICAgIClcbiAgICAgIH1cblxuICAgICAgLy8gRm9yIFJEUy9BdXJvcmEgY2x1c3RlcnMgYW5kIGluc3RhbmNlcywgZ2V0IGVuZHBvaW50IGRldGFpbHNcbiAgICAgIGNvbnN0IGhvc3QgPSAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnRcbiAgICAgICAgPyAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnQuaG9zdG5hbWVcbiAgICAgICAgOiAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VJbnN0YW5jZSkuaW5zdGFuY2VFbmRwb2ludC5ob3N0bmFtZVxuXG4gICAgICBjb25zdCBwb3J0ID0gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlckVuZHBvaW50XG4gICAgICAgID8gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlckVuZHBvaW50LnBvcnRcbiAgICAgICAgOiAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VJbnN0YW5jZSkuaW5zdGFuY2VFbmRwb2ludC5wb3J0XG5cbiAgICAgIGNvbnN0IGlkZW50aWZpZXIgPSAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVySWRlbnRpZmllclxuICAgICAgICA/IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJJZGVudGlmaWVyXG4gICAgICAgIDogKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlSW5zdGFuY2UpLmluc3RhbmNlSWRlbnRpZmllclxuXG4gICAgICBjb25zdCBzZWNyZXRUZW1wbGF0ZSA9IHtcbiAgICAgICAgZGJDbHVzdGVySWRlbnRpZmllcjogaWRlbnRpZmllcixcbiAgICAgICAgZW5naW5lOiBwcm9wcy5wcm92aWRlci5lbmdpbmUsXG4gICAgICAgIGhvc3Q6IGhvc3QsXG4gICAgICAgIHBvcnQ6IHBvcnQsXG4gICAgICAgIHVzZXJuYW1lOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgICAgZGJuYW1lOiBwcm9wcy5kYXRhYmFzZSA/IHByb3BzLmRhdGFiYXNlLmRhdGFiYXNlTmFtZSA6IHByb3BzLmRhdGFiYXNlTmFtZSxcbiAgICAgIH1cblxuICAgICAgdGhpcy5zZWNyZXQgPSBuZXcgU2VjcmV0KHRoaXMsIFwiU2VjcmV0XCIsIHtcbiAgICAgICAgc2VjcmV0TmFtZTogcHJvcHMuc2VjcmV0TmFtZSxcbiAgICAgICAgZW5jcnlwdGlvbktleTogcHJvcHMuZW5jcnlwdGlvbktleSxcbiAgICAgICAgZGVzY3JpcHRpb246IGBHZW5lcmF0ZWQgc2VjcmV0IGZvciAke3Byb3BzLnByb3ZpZGVyLmVuZ2luZX0gcm9sZSAke3Byb3BzLnJvbGVOYW1lfWAsXG4gICAgICAgIC4uLihwcm9wcy5lbmFibGVJYW1BdXRoXG4gICAgICAgICAgPyB7XG4gICAgICAgICAgICAgIC8vIEZvciBJQU0gYXV0aCwgY3JlYXRlIHNlY3JldCB3aXRob3V0IHBhc3N3b3JkIGdlbmVyYXRpb25cbiAgICAgICAgICAgICAgc2VjcmV0U3RyaW5nVGVtcGxhdGU6IEpTT04uc3RyaW5naWZ5KHNlY3JldFRlbXBsYXRlKSxcbiAgICAgICAgICAgIH1cbiAgICAgICAgICA6IHtcbiAgICAgICAgICAgICAgLy8gRm9yIHBhc3N3b3JkIGF1dGgsIGdlbmVyYXRlIHBhc3N3b3JkXG4gICAgICAgICAgICAgIGdlbmVyYXRlU2VjcmV0U3RyaW5nOiB7XG4gICAgICAgICAgICAgICAgcGFzc3dvcmRMZW5ndGg6IDMwLCAvLyBPcmFjbGUgcGFzc3dvcmQgY2Fubm90IGhhdmUgbW9yZSB0aGFuIDMwIGNoYXJhY3RlcnNcbiAgICAgICAgICAgICAgICBzZWNyZXRTdHJpbmdUZW1wbGF0ZTogSlNPTi5zdHJpbmdpZnkoc2VjcmV0VGVtcGxhdGUpLFxuICAgICAgICAgICAgICAgIGdlbmVyYXRlU3RyaW5nS2V5OiBcInBhc3N3b3JkXCIsXG4gICAgICAgICAgICAgICAgZXhjbHVkZUNoYXJhY3RlcnM6IFwiICUrfmAjJCYqKCl8W117fTo7PD4/IScvQFxcXCJcXFxcXCIsXG4gICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICB9KSxcbiAgICAgICAgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5ERVNUUk9ZLFxuICAgICAgfSlcblxuICAgICAgLy8gQ3JlYXRlIFBhcmFtZXRlcnMgaWYgcGFyYW1ldGVyUHJlZml4IGlzIHByb3ZpZGVkXG4gICAgICBpZiAocHJvcHMucGFyYW1ldGVyUHJlZml4KSB7XG4gICAgICAgIGNvbnN0IHBhcmFtRGF0YSA9IHtcbiAgICAgICAgICBkYkNsdXN0ZXJJZGVudGlmaWVyOiBpZGVudGlmaWVyLFxuICAgICAgICAgIGVuZ2luZTogcHJvcHMucHJvdmlkZXIuZW5naW5lLFxuICAgICAgICAgIGhvc3Q6IGhvc3QsXG4gICAgICAgICAgcG9ydDogcG9ydCxcbiAgICAgICAgICB1c2VybmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgICAgZGJuYW1lOiBwcm9wcy5kYXRhYmFzZSA/IHByb3BzLmRhdGFiYXNlLmRhdGFiYXNlTmFtZSA6IHByb3BzLmRhdGFiYXNlTmFtZSxcbiAgICAgICAgfVxuXG4gICAgICAgIG5ldyBQYXJhbWV0ZXJzKHRoaXMsIFwiUGFyYW1ldGVyc1wiLCB7XG4gICAgICAgICAgc2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQ/LnNlY3JldEFybiB8fCBcIlwiLFxuICAgICAgICAgIHBhcmFtZXRlclByZWZpeDogcHJvcHMucGFyYW1ldGVyUHJlZml4LFxuICAgICAgICAgIHBhc3N3b3JkQXJuOiBwcm9wcy5lbmFibGVJYW1BdXRoID8gXCJcIiA6IHRoaXMuc2VjcmV0LnNlY3JldEFybixcbiAgICAgICAgICBwcm92aWRlclNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgICAgIHByb3ZpZGVyOiBwcm9wcy5wcm92aWRlcixcbiAgICAgICAgICBwYXJhbURhdGEsXG4gICAgICAgIH0pXG4gICAgICB9XG4gICAgfVxuXG4gICAgY29uc3Qgcm9sZSA9IG5ldyBDdXN0b21SZXNvdXJjZVJvbGUodGhpcywgXCJQb3N0Z3Jlc1JvbGVcIiwge1xuICAgICAgcHJvdmlkZXI6IHByb3BzLnByb3ZpZGVyLFxuICAgICAgcm9sZU5hbWU6IHByb3BzLnJvbGVOYW1lLFxuICAgICAgcGFzc3dvcmRBcm46XG4gICAgICAgIHByb3BzLmVuYWJsZUlhbUF1dGggfHwgcHJvcHMucHJvdmlkZXIuZW5naW5lID09PSBEYXRhYmFzZUVuZ2luZS5EU1FMXG4gICAgICAgICAgPyBcIlwiXG4gICAgICAgICAgOiB0aGlzLnNlY3JldCEuc2VjcmV0QXJuLFxuICAgICAgZGF0YWJhc2U6IHByb3BzLmRhdGFiYXNlLFxuICAgICAgZGF0YWJhc2VOYW1lOiBwcm9wcy5kYXRhYmFzZU5hbWUsXG4gICAgICBlbmFibGVJYW1BdXRoOiBwcm9wcy5lbmFibGVJYW1BdXRoIHx8IHByb3BzLnByb3ZpZGVyLmVuZ2luZSA9PT0gRGF0YWJhc2VFbmdpbmUuRFNRTCxcbiAgICB9KVxuXG4gICAgaWYgKHRoaXMuc2VjcmV0KSB7XG4gICAgICByb2xlLm5vZGUuYWRkRGVwZW5kZW5jeSh0aGlzLnNlY3JldClcbiAgICAgIHRoaXMuc2VjcmV0LmdyYW50UmVhZChwcm9wcy5wcm92aWRlci5oYW5kbGVyKVxuICAgICAgaWYgKHRoaXMuc2VjcmV0LmVuY3J5cHRpb25LZXkpIHtcbiAgICAgICAgLy8gSXQgc2VlbXMgd2UgbmVlZCB0byBncmFudCBleHBsaWNpdCBwZXJtaXNzaW9uXG4gICAgICAgIHRoaXMuc2VjcmV0LmVuY3J5cHRpb25LZXkuZ3JhbnREZWNyeXB0KHByb3BzLnByb3ZpZGVyLmhhbmRsZXIpXG4gICAgICB9XG4gICAgfVxuXG4gICAgdGhpcy5yb2xlTmFtZSA9IHByb3BzLnJvbGVOYW1lXG4gIH1cbn1cbiJdfQ==
+Role[_a] = { fqn: "cdk-rds-sql.Role", version: "8.0.1" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicm9sZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9yb2xlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEsNkNBQWtFO0FBQ2xFLDJDQUEwQztBQUcxQyx1RUFBZ0U7QUFDaEUsMkNBQTBDO0FBQzFDLDJDQUFzQztBQUV0QyxpQ0FBdUM7QUFDdkMseUNBQXNEO0FBQ3RELGlFQUFtRTtBQStFbkUsOENBQThDO0FBQzlDLE1BQU0sVUFBVyxTQUFRLHNCQUFTO0lBQ2hDLFlBQ0UsS0FBZ0IsRUFDaEIsRUFBVSxFQUNWLEtBT0M7UUFFRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFBO1FBRWhCLDRDQUE0QztRQUM1QyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFO1lBQ3ZELElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUN4QixJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLGFBQWEsR0FBRyxFQUFFLEVBQUU7b0JBQ2hELGFBQWEsRUFBRSxHQUFHLEtBQUssQ0FBQyxlQUFlLEdBQUcsR0FBRyxFQUFFO29CQUMvQyxXQUFXLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRTtpQkFDOUIsQ0FBQyxDQUFBO1lBQ0osQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFBO1FBRUYsNkRBQTZEO1FBQzdELDhEQUE4RDtRQUM5RCxJQUFJLEtBQUssQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN0QixNQUFNLHFCQUFxQixHQUFHLEdBQUcsS0FBSyxDQUFDLGVBQWUsVUFBVSxDQUFBO1lBQ2hFLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSw0QkFBYyxDQUFDLElBQUksRUFBRSxtQkFBbUIsRUFBRTtnQkFDdkUsWUFBWSxFQUFFLEtBQUssQ0FBQyxvQkFBb0I7Z0JBQ3hDLFVBQVUsRUFBRTtvQkFDVixTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7b0JBQzFCLFFBQVEsRUFBRSxxQkFBYyxDQUFDLGtCQUFrQjtvQkFDM0MsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO29CQUM5QixhQUFhLEVBQUUscUJBQXFCO2lCQUNyQzthQUNGLENBQUMsQ0FBQTtZQUNGLGtCQUFrQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO1lBRXJELE1BQU0sUUFBUSxHQUFHLGVBQWUsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxJQUNuRCxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUNqQixhQUNFLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUMvQyxHQUFHLHFCQUFxQixFQUFFLENBQUE7WUFFMUIsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUNwQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQ3RCLE9BQU8sRUFBRSxDQUFDLGtCQUFrQixFQUFFLHVCQUF1QixFQUFFLG1CQUFtQixDQUFDO2dCQUMzRSxTQUFTLEVBQUUsQ0FBQyxRQUFRLENBQUM7YUFDdEIsQ0FBQyxDQUNILENBQUE7UUFDSCxDQUFDO0lBQ0gsQ0FBQztDQUNGO0FBRUQsTUFBYSxJQUFLLFNBQVEsc0JBQVM7SUFrQmpDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZ0I7UUFDeEQsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyx5QkFBYyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xELElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQ3pDLE1BQU0seUNBQXlDLENBQUE7WUFDakQsQ0FBQztZQUNELElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUMzQyxvR0FBb0c7Z0JBQ3BHLHlFQUF5RTtnQkFDekUsc0RBQXNEO2dCQUN0RCxNQUFNLHlDQUF5QyxDQUFBO1lBQ2pELENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQTtRQUVoQixxRkFBcUY7UUFDckYsTUFBTSxVQUFVLEdBQ2QsS0FBSyxDQUFDLGFBQWEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyx5QkFBYyxDQUFDLElBQUksQ0FBQTtRQUV0RSw2RUFBNkU7UUFDN0UsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyx5QkFBYyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xELGdGQUFnRjtZQUNoRixJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLEtBQUssQ0FDYiw2RUFBNkU7b0JBQzNFLGdGQUFnRjtvQkFDaEYsNEZBQTRGLENBQy9GLENBQUE7WUFDSCxDQUFDO1lBRUQsOERBQThEO1lBQzlELE1BQU0sSUFBSSxHQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlO2dCQUN2RSxDQUFDLENBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE0QixDQUFDLGVBQWUsQ0FBQyxRQUFRO2dCQUN2RSxDQUFDLENBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE2QixDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQTtZQUUzRSxNQUFNLElBQUksR0FBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTRCLENBQUMsZUFBZTtnQkFDdkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxlQUFlLENBQUMsSUFBSTtnQkFDbkUsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUE7WUFFdkUsTUFBTSxVQUFVLEdBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUE0QixDQUFDLGlCQUFpQjtnQkFDL0UsQ0FBQyxDQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBNEIsQ0FBQyxpQkFBaUI7Z0JBQ2hFLENBQUMsQ0FBRSxLQUFLLENBQUMsUUFBUSxDQUFDLE9BQTZCLENBQUMsa0JBQWtCLENBQUE7WUFFcEUsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLFFBQVE7Z0JBQ2pDLENBQUMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7Z0JBQzdCLENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFBO1lBRXRCLHNEQUFzRDtZQUN0RCxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sY0FBYyxHQUFHO29CQUNyQixtQkFBbUIsRUFBRSxVQUFVO29CQUMvQixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO29CQUM3QixJQUFJLEVBQUUsSUFBSTtvQkFDVixJQUFJLEVBQUUsSUFBSTtvQkFDVixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7b0JBQ3hCLE1BQU0sRUFBRSxZQUFZO2lCQUNyQixDQUFBO2dCQUVELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSwyQkFBTSxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUU7b0JBQ3ZDLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtvQkFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO29CQUNsQyxXQUFXLEVBQUUsd0JBQXdCLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxTQUFTLEtBQUssQ0FBQyxRQUFRLEVBQUU7b0JBQ25GLG9CQUFvQixFQUFFO3dCQUNwQixjQUFjLEVBQUUsRUFBRSxFQUFFLHNEQUFzRDt3QkFDMUUsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7d0JBQ3BELGlCQUFpQixFQUFFLFVBQVU7d0JBQzdCLGlCQUFpQixFQUFFLCtCQUErQjtxQkFDbkQ7b0JBQ0QsYUFBYSxFQUFFLDJCQUFhLENBQUMsT0FBTztpQkFDckMsQ0FBQyxDQUFBO1lBQ0osQ0FBQztZQUVELG9GQUFvRjtZQUNwRixJQUFJLEtBQUssQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDMUIsTUFBTSxTQUFTLEdBQW9DO29CQUNqRCxtQkFBbUIsRUFBRSxVQUFVO29CQUMvQixNQUFNLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNO29CQUM3QixJQUFJLEVBQUUsSUFBSTtvQkFDVixJQUFJLEVBQUUsSUFBSTtvQkFDVixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7aUJBQ3pCLENBQUE7Z0JBQ0QsSUFBSSxZQUFZLEVBQUUsQ0FBQztvQkFDakIsU0FBUyxDQUFDLE1BQU0sR0FBRyxZQUFZLENBQUE7Z0JBQ2pDLENBQUM7Z0JBRUQsSUFBSSxVQUFVLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRTtvQkFDakMsU0FBUyxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLFNBQVMsSUFBSSxFQUFFO29CQUNqRCxlQUFlLEVBQUUsS0FBSyxDQUFDLGVBQWU7b0JBQ3RDLFdBQVcsRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxnREFBZ0Q7b0JBQ3JGLG9CQUFvQixFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWTtvQkFDakQsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO29CQUN4QixTQUFTO2lCQUNWLENBQUMsQ0FBQTtZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsSUFBSSwyQkFBa0IsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFO1lBQ3hELFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtZQUN4QixRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsTUFBTyxDQUFDLFNBQVM7WUFDckQsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRO1lBQ3hCLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWTtZQUNoQyxhQUFhLEVBQUUsVUFBVTtTQUMxQixDQUFDLENBQUE7UUFFRixJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUE7WUFDcEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQTtZQUM3QyxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQzlCLGdEQUFnRDtnQkFDaEQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUE7WUFDaEUsQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLENBQUE7SUFDaEMsQ0FBQzs7QUFwSUgsb0JBcUlDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ3VzdG9tUmVzb3VyY2UsIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSBcImF3cy1jZGstbGliXCJcbmltcG9ydCAqIGFzIGlhbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLWlhbVwiXG5pbXBvcnQgKiBhcyBrbXMgZnJvbSBcImF3cy1jZGstbGliL2F3cy1rbXNcIlxuaW1wb3J0IHsgSURhdGFiYXNlQ2x1c3RlciwgSURhdGFiYXNlSW5zdGFuY2UgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXJkc1wiXG5pbXBvcnQgeyBJU2VjcmV0LCBTZWNyZXQgfSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNlY3JldHNtYW5hZ2VyXCJcbmltcG9ydCAqIGFzIHNzbSBmcm9tIFwiYXdzLWNkay1saWIvYXdzLXNzbVwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyLCBEYXRhYmFzZUVuZ2luZSB9IGZyb20gXCIuL3Byb3ZpZGVyXCJcbmltcG9ydCB7IFJvbGUgYXMgQ3VzdG9tUmVzb3VyY2VSb2xlIH0gZnJvbSBcIi4vcm9sZS5jdXN0b20tcmVzb3VyY2VcIlxuXG5leHBvcnQgaW50ZXJmYWNlIFJvbGVQcm9wcyB7XG4gIC8qKlxuICAgKiBQcm92aWRlci5cbiAgICovXG4gIHJlYWRvbmx5IHByb3ZpZGVyOiBJUHJvdmlkZXJcblxuICAvKipcbiAgICogU1FMLlxuICAgKi9cbiAgcmVhZG9ubHkgcm9sZU5hbWU6IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSB0aGlzIHVzZXIgaXMgZXhwZWN0ZWQgdG8gdXNlLlxuICAgKlxuICAgKiBJZiB0aGUgZGF0YWJhc2UgZXhpc3RzLCBjb25uZWN0IHByaXZpbGVnZXMgYXJlIGdyYW50ZWQuXG4gICAqXG4gICAqIFNwZWNpZnkgb25lIG9mIGBkYXRhYmFzZWAgb3IgYGRhdGFiYXNlTmFtZWAuIFRoaXMgaXMgdGhlIG5hbWVcbiAgICogdGhhdCB3aWxsIGJlIHN0b3JlZCBpbiB0aGUgcm9sZSdzIHNlY3JldCBhcyB0aGUgZGF0YWJhc2UgbmFtZSB0b1xuICAgKiB1c2UuXG4gICAqL1xuICByZWFkb25seSBkYXRhYmFzZT86IElEYXRhYmFzZVxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZSBuYW1lIHRoaXMgdXNlciBpcyBleHBlY3RlZCB0byB1c2UuXG4gICAqXG4gICAqIElmIHRoZSBkYXRhYmFzZSBleGlzdHMsIGNvbm5lY3QgcHJpdmlsZWdlcyBhcmUgZ3JhbnRlZC5cbiAgICpcbiAgICogU3BlY2lmeSBvbmUgb2YgYGRhdGFiYXNlYCBvciBgZGF0YWJhc2VOYW1lYC4gVGhpcyBpcyB0aGUgbmFtZVxuICAgKiB0aGF0IHdpbGwgYmUgc3RvcmVkIGluIHRoZSByb2xlJ3Mgc2VjcmV0IGFzIHRoZSBkYXRhYmFzZSBuYW1lIHRvXG4gICAqIHVzZS5cbiAgICovXG4gIHJlYWRvbmx5IGRhdGFiYXNlTmFtZT86IHN0cmluZ1xuXG4gIC8qKlxuICAgKiBBIG5ldyBzZWNyZXQgaXMgY3JlYXRlZCBmb3IgdGhpcyB1c2VyLlxuICAgKlxuICAgKiBPcHRpb25hbGx5IGVuY3J5cHQgaXQgd2l0aCB0aGUgZ2l2ZW4ga2V5LlxuICAgKi9cbiAgcmVhZG9ubHkgZW5jcnlwdGlvbktleT86IGttcy5JS2V5XG5cbiAgLyoqXG4gICAqIEEgbmV3IHNlY3JldCBpcyBjcmVhdGVkIGZvciB0aGlzIHVzZXIuXG4gICAqXG4gICAqIE9wdGlvbmFsbHkgYWRkIHNlY3JldCBuYW1lIHRvIHRoZSBzZWNyZXQuXG4gICAqL1xuICByZWFkb25seSBzZWNyZXROYW1lPzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIFByZWZpeCBmb3IgU1NNIHBhcmFtZXRlcnMgdG8gc3RvcmUgY3JlZGVudGlhbHMgaW4gUGFyYW1ldGVyIFN0b3JlLlxuICAgKiBXaGVuIGRlZmluZWQsIGNyZWRlbnRpYWxzIHdpbGwgYWxzbyBiZSBzdG9yZWQgYXMgcGFyYW1ldGVycy5cbiAgICpcbiAgICogVGhlIHBhcmFtZXRlciBuYW1lcyBzdWNoIGFzIFwicGFzc3dvcmRcIiBpcyBzaW1wbHkgYXBwZW5kZWQgdG9cbiAgICogYHBhcmFtZXRlclByZWZpeGAsIHNvIG1ha2Ugc3VyZSB0aGUgcHJlZml4IGVuZHMgd2l0aCBhIHNsYXNoIGlmXG4gICAqICB5b3UgaGF2ZSB5b3VyIHBhcmFtZXRlciBuYW1lcyBzbGFzaCBzZXBhcmF0ZWQuXG4gICAqXG4gICAqIE5vdGUgdGhhdCB0aGUgcGFzc3dvcmQgZnJvbSB0aGUgc2VjcmV0IGlzIGNvcGllZCBqdXN0IG9uY2UsIHRoZXlcbiAgICogYXJlIG5vdCBrZXB0IGluIHN5bmMuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gY3JlZGVudGlhbHMgYXJlIG9ubHkgc3RvcmVkIGluIFNlY3JldHMgTWFuYWdlclxuICAgKi9cbiAgcmVhZG9ubHkgcGFyYW1ldGVyUHJlZml4Pzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIEVuYWJsZSBJQU0gYXV0aGVudGljYXRpb24gZm9yIHRoaXMgcm9sZS5cbiAgICpcbiAgICogV2hlbiBlbmFibGVkLCB0aGUgcm9sZSB3aWxsIGJlIGNyZWF0ZWQgd2l0aG91dCBhIHBhc3N3b3JkIGFuZFxuICAgKiBjb25maWd1cmVkIGZvciBBV1MgSUFNIGRhdGFiYXNlIGF1dGhlbnRpY2F0aW9uLiBObyBzZWNyZXQgd2lsbFxuICAgKiBiZSBjcmVhdGVkIGZvciB0aGlzIHJvbGUuXG4gICAqXG4gICAqIE5vdGU6IEZvciBEU1FMIGNsdXN0ZXJzLCB0aGlzIHByb3BlcnR5IGlzIGlnbm9yZWQgYXMgRFNRTCBhbHdheXNcbiAgICogdXNlcyBJQU0gYXV0aGVudGljYXRpb24uXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlIC0gdXNlIHBhc3N3b3JkIGF1dGhlbnRpY2F0aW9uXG4gICAqL1xuICByZWFkb25seSBlbmFibGVJYW1BdXRoPzogYm9vbGVhblxufVxuXG4vLyBQcml2YXRlIFBhcmFtZXRlcnMgY29uc3RydWN0IChub3QgZXhwb3J0ZWQpXG5jbGFzcyBQYXJhbWV0ZXJzIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3IoXG4gICAgc2NvcGU6IENvbnN0cnVjdCxcbiAgICBpZDogc3RyaW5nLFxuICAgIHByb3BzOiB7XG4gICAgICBwcm92aWRlcjogSVByb3ZpZGVyXG4gICAgICBzZWNyZXRBcm46IHN0cmluZ1xuICAgICAgcGFyYW1ldGVyUHJlZml4OiBzdHJpbmdcbiAgICAgIHBhc3N3b3JkQXJuPzogc3RyaW5nXG4gICAgICBwcm92aWRlclNlcnZpY2VUb2tlbjogc3RyaW5nXG4gICAgICBwYXJhbURhdGE6IFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IG51bWJlcj5cbiAgICB9XG4gICkge1xuICAgIHN1cGVyKHNjb3BlLCBpZClcblxuICAgIC8vIENyZWF0ZSBwYXJhbWV0ZXJzIGZvciBlYWNoIGtleS12YWx1ZSBwYWlyXG4gICAgT2JqZWN0LmVudHJpZXMocHJvcHMucGFyYW1EYXRhKS5mb3JFYWNoKChba2V5LCB2YWx1ZV0pID0+IHtcbiAgICAgIGlmICh2YWx1ZSAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICAgIG5ldyBzc20uU3RyaW5nUGFyYW1ldGVyKHRoaXMsIGBQYXJhbWV0ZXItJHtrZXl9YCwge1xuICAgICAgICAgIHBhcmFtZXRlck5hbWU6IGAke3Byb3BzLnBhcmFtZXRlclByZWZpeH0ke2tleX1gLFxuICAgICAgICAgIHN0cmluZ1ZhbHVlOiB2YWx1ZS50b1N0cmluZygpLFxuICAgICAgICB9KVxuICAgICAgfVxuICAgIH0pXG5cbiAgICAvLyBGb3IgcGFzc3dvcmQsIHVzZSB0aGUgZXhpc3RpbmcgcHJvdmlkZXIgdG8gc3RvcmUgaXQgaW4gU1NNXG4gICAgLy8gU2tpcCBwYXNzd29yZCBwYXJhbWV0ZXIgZm9yIElBTSBhdXRoIHJvbGVzIChubyBwYXNzd29yZEFybilcbiAgICBpZiAocHJvcHMucGFzc3dvcmRBcm4pIHtcbiAgICAgIGNvbnN0IHBhc3N3b3JkUGFyYW1ldGVyTmFtZSA9IGAke3Byb3BzLnBhcmFtZXRlclByZWZpeH1wYXNzd29yZGBcbiAgICAgIGNvbnN0IHBhc3N3b3JkX3BhcmFtZXRlciA9IG5ldyBDdXN0b21SZXNvdXJjZSh0aGlzLCBcIlBhc3N3b3JkUGFyYW1ldGVyXCIsIHtcbiAgICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlclNlcnZpY2VUb2tlbixcbiAgICAgICAgcHJvcGVydGllczoge1xuICAgICAgICAgIFNlY3JldEFybjogcHJvcHMuc2VjcmV0QXJuLFxuICAgICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5QQVJBTUVURVJfUEFTU1dPUkQsXG4gICAgICAgICAgUGFzc3dvcmRBcm46IHByb3BzLnBhc3N3b3JkQXJuLFxuICAgICAgICAgIFBhcmFtZXRlck5hbWU6IHBhc3N3b3JkUGFyYW1ldGVyTmFtZSxcbiAgICAgICAgfSxcbiAgICAgIH0pXG4gICAgICBwYXNzd29yZF9wYXJhbWV0ZXIubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLnByb3ZpZGVyKVxuXG4gICAgICBjb25zdCBwYXJhbUFybiA9IGBhcm46YXdzOnNzbToke1N0YWNrLm9mKHRoaXMpLnJlZ2lvbn06JHtcbiAgICAgICAgU3RhY2sub2YodGhpcykuYWNjb3VudFxuICAgICAgfTpwYXJhbWV0ZXIke1xuICAgICAgICBwYXNzd29yZFBhcmFtZXRlck5hbWUuc3RhcnRzV2l0aChcIi9cIikgPyBcIlwiIDogXCIvXCJcbiAgICAgIH0ke3Bhc3N3b3JkUGFyYW1ldGVyTmFtZX1gXG5cbiAgICAgIHByb3BzLnByb3ZpZGVyLmhhbmRsZXIuYWRkVG9Sb2xlUG9saWN5KFxuICAgICAgICBuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgYWN0aW9uczogW1wic3NtOlB1dFBhcmFtZXRlclwiLCBcInNzbTpBZGRUYWdzVG9SZXNvdXJjZVwiLCBcInNzbTpHZXRQYXJhbWV0ZXJzXCJdLFxuICAgICAgICAgIHJlc291cmNlczogW3BhcmFtQXJuXSxcbiAgICAgICAgfSlcbiAgICAgIClcbiAgICB9XG4gIH1cbn1cblxuZXhwb3J0IGNsYXNzIFJvbGUgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICAvKipcbiAgICogVGhlIHJvbGUgbmFtZS5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSByb2xlTmFtZTogc3RyaW5nXG5cbiAgLyoqXG4gICAqIFRoZSBnZW5lcmF0ZWQgc2VjcmV0IGNvbnRhaW5pbmcgY29ubmVjdGlvbiBpbmZvcm1hdGlvbiBhbmQgcGFzc3dvcmQuXG4gICAqXG4gICAqIFRoaXMgaXMgb25seSBhdmFpbGFibGUgd2hlbjpcbiAgICogLSBUaGUgcHJvdmlkZXIgaXMgbm90IGEgRFNRTCBjbHVzdGVyIChEU1FMIHVzZXMgSUFNIGF1dGhlbnRpY2F0aW9uKVxuICAgKiAtIGBlbmFibGVJYW1BdXRoYCBpcyBub3Qgc2V0IHRvIGB0cnVlYFxuICAgKlxuICAgKiBXaGVuIHVzaW5nIElBTSBhdXRoZW50aWNhdGlvbiwgbm8gc2VjcmV0IGlzIGNyZWF0ZWQgYXMgdGhlIHBhc3N3b3JkXG4gICAqIGlzIGdlbmVyYXRlZCBkeW5hbWljYWxseSB1c2luZyBJQU0gY3JlZGVudGlhbHMuXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgc2VjcmV0PzogSVNlY3JldFxuXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBSb2xlUHJvcHMpIHtcbiAgICBpZiAocHJvcHMucHJvdmlkZXIuZW5naW5lICE9PSBEYXRhYmFzZUVuZ2luZS5EU1FMKSB7XG4gICAgICBpZiAocHJvcHMuZGF0YWJhc2UgJiYgcHJvcHMuZGF0YWJhc2VOYW1lKSB7XG4gICAgICAgIHRocm93IFwiU3BlY2lmeSBlaXRoZXIgZGF0YWJhc2Ugb3IgZGF0YWJhc2VOYW1lXCJcbiAgICAgIH1cbiAgICAgIGlmICghcHJvcHMuZGF0YWJhc2UgJiYgIXByb3BzLmRhdGFiYXNlTmFtZSkge1xuICAgICAgICAvLyBJZiBuZWl0aGVyIGlzIHNwZWNpZmllZCwgd2UgbWlnaHQgbmVlZCBhIGRlZmF1bHQgb3IgdGhyb3cgYW4gZXJyb3IgZGVwZW5kaW5nIG9uIGRlc2lyZWQgYmVoYXZpb3IuXG4gICAgICAgIC8vIEZvciBub3csIGxldCdzIGFzc3VtZSBpdCdzIGFsbG93ZWQgYnV0IHRoZSBzZWNyZXQgd29uJ3QgaGF2ZSBhIGRibmFtZS5cbiAgICAgICAgLy8gSWYgaXQgc2hvdWxkIGJlIHJlcXVpcmVkLCB1bmNvbW1lbnQgdGhlIGxpbmUgYmVsb3c6XG4gICAgICAgIHRocm93IFwiU3BlY2lmeSBlaXRoZXIgZGF0YWJhc2Ugb3IgZGF0YWJhc2VOYW1lXCJcbiAgICAgIH1cbiAgICB9XG4gICAgc3VwZXIoc2NvcGUsIGlkKVxuXG4gICAgLy8gU2tpcCBzZWNyZXQgY3JlYXRpb24gZm9yIERTUUwgKGFsd2F5cyB1c2VzIElBTSBhdXRoKSBvciB3aGVuIGVuYWJsZUlhbUF1dGggaXMgdHJ1ZVxuICAgIGNvbnN0IHVzZUlhbUF1dGggPVxuICAgICAgcHJvcHMuZW5hYmxlSWFtQXV0aCB8fCBwcm9wcy5wcm92aWRlci5lbmdpbmUgPT09IERhdGFiYXNlRW5naW5lLkRTUUxcblxuICAgIC8vIEZvciBub24tRFNRTCBwcm92aWRlcnMsIHdlIG5lZWQgY2x1c3RlciBpbmZvIGZvciBzZWNyZXRzIGFuZC9vciBwYXJhbWV0ZXJzXG4gICAgaWYgKHByb3BzLnByb3ZpZGVyLmVuZ2luZSAhPT0gRGF0YWJhc2VFbmdpbmUuRFNRTCkge1xuICAgICAgLy8gRm9yIGltcG9ydGVkIHByb3ZpZGVycyB3aXRob3V0IGNsdXN0ZXIgZGV0YWlscywgcHJvdmlkZSBoZWxwZnVsIGVycm9yIG1lc3NhZ2VcbiAgICAgIGlmICghcHJvcHMucHJvdmlkZXIuY2x1c3Rlcikge1xuICAgICAgICB0aHJvdyBuZXcgRXJyb3IoXG4gICAgICAgICAgXCJSb2xlIGNyZWF0aW9uIHJlcXVpcmVzIGNsdXN0ZXIgaW5mb3JtYXRpb24uIFdoZW4gaW1wb3J0aW5nIGEgcHJvdmlkZXIgd2l0aCBcIiArXG4gICAgICAgICAgICBcIlByb3ZpZGVyLmZyb21Qcm92aWRlckF0dHJpYnV0ZXMoKSwgaW5jbHVkZSB0aGUgJ2NsdXN0ZXInIHByb3BlcnR5IGlmIHlvdSBwbGFuIFwiICtcbiAgICAgICAgICAgIFwidG8gY3JlYXRlIG5ldyByb2xlcy4gQWx0ZXJuYXRpdmVseSwgdXNlIGV4aXN0aW5nIHJvbGVzIGNyZWF0ZWQgd2l0aCB0aGUgb3JpZ2luYWwgcHJvdmlkZXIuXCJcbiAgICAgICAgKVxuICAgICAgfVxuXG4gICAgICAvLyBGb3IgUkRTL0F1cm9yYSBjbHVzdGVycyBhbmQgaW5zdGFuY2VzLCBnZXQgZW5kcG9pbnQgZGV0YWlsc1xuICAgICAgY29uc3QgaG9zdCA9IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJFbmRwb2ludFxuICAgICAgICA/IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJFbmRwb2ludC5ob3N0bmFtZVxuICAgICAgICA6IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUluc3RhbmNlKS5pbnN0YW5jZUVuZHBvaW50Lmhvc3RuYW1lXG5cbiAgICAgIGNvbnN0IHBvcnQgPSAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnRcbiAgICAgICAgPyAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VDbHVzdGVyKS5jbHVzdGVyRW5kcG9pbnQucG9ydFxuICAgICAgICA6IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUluc3RhbmNlKS5pbnN0YW5jZUVuZHBvaW50LnBvcnRcblxuICAgICAgY29uc3QgaWRlbnRpZmllciA9IChwcm9wcy5wcm92aWRlci5jbHVzdGVyIGFzIElEYXRhYmFzZUNsdXN0ZXIpLmNsdXN0ZXJJZGVudGlmaWVyXG4gICAgICAgID8gKHByb3BzLnByb3ZpZGVyLmNsdXN0ZXIgYXMgSURhdGFiYXNlQ2x1c3RlcikuY2x1c3RlcklkZW50aWZpZXJcbiAgICAgICAgOiAocHJvcHMucHJvdmlkZXIuY2x1c3RlciBhcyBJRGF0YWJhc2VJbnN0YW5jZSkuaW5zdGFuY2VJZGVudGlmaWVyXG5cbiAgICAgIGNvbnN0IGRhdGFiYXNlTmFtZSA9IHByb3BzLmRhdGFiYXNlXG4gICAgICAgID8gcHJvcHMuZGF0YWJhc2UuZGF0YWJhc2VOYW1lXG4gICAgICAgIDogcHJvcHMuZGF0YWJhc2VOYW1lXG5cbiAgICAgIC8vIENyZWF0ZSBzZWNyZXQgb25seSBmb3IgcGFzc3dvcmQgYXV0aCAobm90IElBTSBhdXRoKVxuICAgICAgaWYgKCF1c2VJYW1BdXRoKSB7XG4gICAgICAgIGNvbnN0IHNlY3JldFRlbXBsYXRlID0ge1xuICAgICAgICAgIGRiQ2x1c3RlcklkZW50aWZpZXI6IGlkZW50aWZpZXIsXG4gICAgICAgICAgZW5naW5lOiBwcm9wcy5wcm92aWRlci5lbmdpbmUsXG4gICAgICAgICAgaG9zdDogaG9zdCxcbiAgICAgICAgICBwb3J0OiBwb3J0LFxuICAgICAgICAgIHVzZXJuYW1lOiBwcm9wcy5yb2xlTmFtZSxcbiAgICAgICAgICBkYm5hbWU6IGRhdGFiYXNlTmFtZSxcbiAgICAgICAgfVxuXG4gICAgICAgIHRoaXMuc2VjcmV0ID0gbmV3IFNlY3JldCh0aGlzLCBcIlNlY3JldFwiLCB7XG4gICAgICAgICAgc2VjcmV0TmFtZTogcHJvcHMuc2VjcmV0TmFtZSxcbiAgICAgICAgICBlbmNyeXB0aW9uS2V5OiBwcm9wcy5lbmNyeXB0aW9uS2V5LFxuICAgICAgICAgIGRlc2NyaXB0aW9uOiBgR2VuZXJhdGVkIHNlY3JldCBmb3IgJHtwcm9wcy5wcm92aWRlci5lbmdpbmV9IHJvbGUgJHtwcm9wcy5yb2xlTmFtZX1gLFxuICAgICAgICAgIGdlbmVyYXRlU2VjcmV0U3RyaW5nOiB7XG4gICAgICAgICAgICBwYXNzd29yZExlbmd0aDogMzAsIC8vIE9yYWNsZSBwYXNzd29yZCBjYW5ub3QgaGF2ZSBtb3JlIHRoYW4gMzAgY2hhcmFjdGVyc1xuICAgICAgICAgICAgc2VjcmV0U3RyaW5nVGVtcGxhdGU6IEpTT04uc3RyaW5naWZ5KHNlY3JldFRlbXBsYXRlKSxcbiAgICAgICAgICAgIGdlbmVyYXRlU3RyaW5nS2V5OiBcInBhc3N3b3JkXCIsXG4gICAgICAgICAgICBleGNsdWRlQ2hhcmFjdGVyczogXCIgJSt+YCMkJiooKXxbXXt9Ojs8Pj8hJy9AXFxcIlxcXFxcIixcbiAgICAgICAgICB9LFxuICAgICAgICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuREVTVFJPWSxcbiAgICAgICAgfSlcbiAgICAgIH1cblxuICAgICAgLy8gQ3JlYXRlIFBhcmFtZXRlcnMgaWYgcGFyYW1ldGVyUHJlZml4IGlzIHByb3ZpZGVkIChmb3IgYm90aCBwYXNzd29yZCBhbmQgSUFNIGF1dGgpXG4gICAgICBpZiAocHJvcHMucGFyYW1ldGVyUHJlZml4KSB7XG4gICAgICAgIGNvbnN0IHBhcmFtRGF0YTogUmVjb3JkPHN0cmluZywgc3RyaW5nIHwgbnVtYmVyPiA9IHtcbiAgICAgICAgICBkYkNsdXN0ZXJJZGVudGlmaWVyOiBpZGVudGlmaWVyLFxuICAgICAgICAgIGVuZ2luZTogcHJvcHMucHJvdmlkZXIuZW5naW5lLFxuICAgICAgICAgIGhvc3Q6IGhvc3QsXG4gICAgICAgICAgcG9ydDogcG9ydCxcbiAgICAgICAgICB1c2VybmFtZTogcHJvcHMucm9sZU5hbWUsXG4gICAgICAgIH1cbiAgICAgICAgaWYgKGRhdGFiYXNlTmFtZSkge1xuICAgICAgICAgIHBhcmFtRGF0YS5kYm5hbWUgPSBkYXRhYmFzZU5hbWVcbiAgICAgICAgfVxuXG4gICAgICAgIG5ldyBQYXJhbWV0ZXJzKHRoaXMsIFwiUGFyYW1ldGVyc1wiLCB7XG4gICAgICAgICAgc2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQ/LnNlY3JldEFybiB8fCBcIlwiLFxuICAgICAgICAgIHBhcmFtZXRlclByZWZpeDogcHJvcHMucGFyYW1ldGVyUHJlZml4LFxuICAgICAgICAgIHBhc3N3b3JkQXJuOiB0aGlzLnNlY3JldD8uc2VjcmV0QXJuLCAvLyB1bmRlZmluZWQgZm9yIElBTSBhdXRoIC0gc2tpcHMgcGFzc3dvcmQgcGFyYW1cbiAgICAgICAgICBwcm92aWRlclNlcnZpY2VUb2tlbjogcHJvcHMucHJvdmlkZXIuc2VydmljZVRva2VuLFxuICAgICAgICAgIHByb3ZpZGVyOiBwcm9wcy5wcm92aWRlcixcbiAgICAgICAgICBwYXJhbURhdGEsXG4gICAgICAgIH0pXG4gICAgICB9XG4gICAgfVxuXG4gICAgY29uc3Qgcm9sZSA9IG5ldyBDdXN0b21SZXNvdXJjZVJvbGUodGhpcywgXCJQb3N0Z3Jlc1JvbGVcIiwge1xuICAgICAgcHJvdmlkZXI6IHByb3BzLnByb3ZpZGVyLFxuICAgICAgcm9sZU5hbWU6IHByb3BzLnJvbGVOYW1lLFxuICAgICAgcGFzc3dvcmRBcm46IHVzZUlhbUF1dGggPyBcIlwiIDogdGhpcy5zZWNyZXQhLnNlY3JldEFybixcbiAgICAgIGRhdGFiYXNlOiBwcm9wcy5kYXRhYmFzZSxcbiAgICAgIGRhdGFiYXNlTmFtZTogcHJvcHMuZGF0YWJhc2VOYW1lLFxuICAgICAgZW5hYmxlSWFtQXV0aDogdXNlSWFtQXV0aCxcbiAgICB9KVxuXG4gICAgaWYgKHRoaXMuc2VjcmV0KSB7XG4gICAgICByb2xlLm5vZGUuYWRkRGVwZW5kZW5jeSh0aGlzLnNlY3JldClcbiAgICAgIHRoaXMuc2VjcmV0LmdyYW50UmVhZChwcm9wcy5wcm92aWRlci5oYW5kbGVyKVxuICAgICAgaWYgKHRoaXMuc2VjcmV0LmVuY3J5cHRpb25LZXkpIHtcbiAgICAgICAgLy8gSXQgc2VlbXMgd2UgbmVlZCB0byBncmFudCBleHBsaWNpdCBwZXJtaXNzaW9uXG4gICAgICAgIHRoaXMuc2VjcmV0LmVuY3J5cHRpb25LZXkuZ3JhbnREZWNyeXB0KHByb3BzLnByb3ZpZGVyLmhhbmRsZXIpXG4gICAgICB9XG4gICAgfVxuXG4gICAgdGhpcy5yb2xlTmFtZSA9IHByb3BzLnJvbGVOYW1lXG4gIH1cbn1cbiJdfQ==

package/lib/schema.js

@@ -27,5 +27,5 @@ class Schema extends aws_cdk_lib_1.CustomResource {
 }
 exports.Schema = Schema;
 _a = JSII_RTTI_SYMBOL_1;
-Schema[_a] = { fqn: "cdk-rds-sql.Schema", version: "7.3.2" };
+Schema[_a] = { fqn: "cdk-rds-sql.Schema", version: "8.0.1" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3NjaGVtYS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUc1QyxpQ0FBdUM7QUE4QnZDLE1BQWEsTUFBTyxTQUFRLDRCQUFjO0lBR3hDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBa0I7UUFDMUQsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixZQUFZLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxZQUFZO1lBQ3pDLFVBQVUsRUFBRTtnQkFDVixRQUFRLEVBQUUscUJBQWMsQ0FBQyxNQUFNO2dCQUMvQixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVU7Z0JBQzVCLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsWUFBWSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTO2dCQUN0RSxRQUFRLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVM7YUFDdkQ7U0FDRixDQUFDLENBQUE7UUFDRixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDdkMsSUFBSSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFBO1FBQ2xDLElBQUksS0FBSyxDQUFDLFFBQVE7WUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDM0QsSUFBSSxLQUFLLENBQUMsSUFBSTtZQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQTtJQUNyRCxDQUFDOztBQWxCSCx3QkFtQkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyIH0gZnJvbSBcIi4vcHJvdmlkZXJcIlxuaW1wb3J0IHsgUm9sZSB9IGZyb20gXCIuL3JvbGVcIlxuXG5leHBvcnQgaW50ZXJmYWNlIFNjaGVtYVByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IElQcm92aWRlclxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSB1c2UgZGVmYXVsdCBkYXRhYmFzZVxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogU2NoZW1hIG5hbWUuXG4gICAqL1xuICByZWFkb25seSBzY2hlbWFOYW1lOiBzdHJpbmdcblxuICAvKipcbiAgICogT3B0aW9uYWwgcm9sZSB3aGljaCB3aWxsIGJlIGdyYW50ZWQgdXNhZ2UgYW5kIGNyZWF0ZSBwZXJtaXNzaW9uc1xuICAgKiB0byB0aGlzIHNjaGVtYS4gVGhpcyB3YXkgdGhlIHJvbGUgY2FuIHJlYWQgaXRzIG93biB0YWJsZXMsIGJ1dFxuICAgKiBjYW5ub3Qgc2VlIG9yIGFjY2VzcyB0YWJsZXMgY3JlYXRlZCBieSBvdGhlcnMuXG4gICAqL1xuICByZWFkb25seSByb2xlPzogUm9sZVxufVxuXG5leHBvcnQgY2xhc3MgU2NoZW1hIGV4dGVuZHMgQ3VzdG9tUmVzb3VyY2Uge1xuICBwdWJsaWMgcmVhZG9ubHkgc2NoZW1hTmFtZTogc3RyaW5nXG5cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFNjaGVtYVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICBzZXJ2aWNlVG9rZW46IHByb3BzLnByb3ZpZGVyLnNlcnZpY2VUb2tlbixcbiAgICAgIHByb3BlcnRpZXM6IHtcbiAgICAgICAgUmVzb3VyY2U6IFJkc1NxbFJlc291cmNlLlNDSEVNQSxcbiAgICAgICAgUmVzb3VyY2VJZDogcHJvcHMuc2NoZW1hTmFtZSxcbiAgICAgICAgLi4uKHByb3BzLnByb3ZpZGVyLnNlY3JldCA/IHsgU2VjcmV0QXJuOiBwcm9wcy5wcm92aWRlci5zZWNyZXQuc2VjcmV0QXJuIH0gOiB7fSksXG4gICAgICAgIERhdGFiYXNlTmFtZTogcHJvcHMuZGF0YWJhc2UgPyBwcm9wcy5kYXRhYmFzZS5kYXRhYmFzZU5hbWUgOiB1bmRlZmluZWQsXG4gICAgICAgIFJvbGVOYW1lOiBwcm9wcy5yb2xlID8gcHJvcHMucm9sZS5yb2xlTmFtZSA6IHVuZGVmaW5lZCxcbiAgICAgIH0sXG4gICAgfSlcbiAgICB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5wcm92aWRlcilcbiAgICB0aGlzLnNjaGVtYU5hbWUgPSBwcm9wcy5zY2hlbWFOYW1lXG4gICAgaWYgKHByb3BzLmRhdGFiYXNlKSB0aGlzLm5vZGUuYWRkRGVwZW5kZW5jeShwcm9wcy5kYXRhYmFzZSlcbiAgICBpZiAocHJvcHMucm9sZSkgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMucm9sZSlcbiAgfVxufVxuIl19

package/lib/sql.js

@@ -24,5 +24,5 @@ class Sql extends aws_cdk_lib_1.CustomResource {
 }
 exports.Sql = Sql;
 _a = JSII_RTTI_SYMBOL_1;
-Sql[_a] = { fqn: "cdk-rds-sql.Sql", version: "7.3.2" };
+Sql[_a] = { fqn: "cdk-rds-sql.Sql", version: "8.0.1" };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3FsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3NxbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDZDQUE0QztBQUc1QyxpQ0FBdUM7QUEyQnZDLE1BQWEsR0FBSSxTQUFRLDRCQUFjO0lBQ3JDLFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBZTtRQUN2RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLFlBQVksRUFBRSxLQUFLLENBQUMsUUFBUSxDQUFDLFlBQVk7WUFDekMsVUFBVSxFQUFFO2dCQUNWLFFBQVEsRUFBRSxxQkFBYyxDQUFDLEdBQUc7Z0JBQzVCLEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsWUFBWSxFQUFFLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTO2dCQUN0RSxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVM7Z0JBQzFCLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTthQUN6QjtTQUNGLENBQUMsQ0FBQTtRQUNGLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQTtRQUN2QyxJQUFJLEtBQUssQ0FBQyxRQUFRO1lBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFBO0lBQzdELENBQUM7O0FBZEgsa0JBZUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDdXN0b21SZXNvdXJjZSB9IGZyb20gXCJhd3MtY2RrLWxpYlwiXG5pbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tIFwiY29uc3RydWN0c1wiXG5pbXBvcnQgeyBJRGF0YWJhc2UgfSBmcm9tIFwiLi9kYXRhYmFzZVwiXG5pbXBvcnQgeyBSZHNTcWxSZXNvdXJjZSB9IGZyb20gXCIuL2VudW1cIlxuaW1wb3J0IHsgSVByb3ZpZGVyIH0gZnJvbSBcIi4vcHJvdmlkZXJcIlxuXG5leHBvcnQgaW50ZXJmYWNlIFNxbFByb3BzIHtcbiAgLyoqXG4gICAqIFByb3ZpZGVyLlxuICAgKi9cbiAgcmVhZG9ubHkgcHJvdmlkZXI6IElQcm92aWRlclxuXG4gIC8qKlxuICAgKiBPcHRpb25hbCBkYXRhYmFzZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSB1c2UgZGVmYXVsdCBkYXRhYmFzZVxuICAgKi9cbiAgcmVhZG9ubHkgZGF0YWJhc2U/OiBJRGF0YWJhc2VcblxuICAvKipcbiAgICogU1FMLlxuICAgKi9cbiAgcmVhZG9ubHkgc3RhdGVtZW50Pzogc3RyaW5nXG5cbiAgLyoqXG4gICAqIE9wdGlvbmFsIHN0YXRtZW50IHRvIGJlIGV4ZWN1dGVkIHdoZW4gdGhlIHJlc291cmNlIGlzIGRlbGV0ZWRcbiAgICovXG4gIHJlYWRvbmx5IHJvbGxiYWNrPzogc3RyaW5nXG59XG5cbmV4cG9ydCBjbGFzcyBTcWwgZXh0ZW5kcyBDdXN0b21SZXNvdXJjZSB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBTcWxQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgc2VydmljZVRva2VuOiBwcm9wcy5wcm92aWRlci5zZXJ2aWNlVG9rZW4sXG4gICAgICBwcm9wZXJ0aWVzOiB7XG4gICAgICAgIFJlc291cmNlOiBSZHNTcWxSZXNvdXJjZS5TUUwsXG4gICAgICAgIC4uLihwcm9wcy5wcm92aWRlci5zZWNyZXQgPyB7IFNlY3JldEFybjogcHJvcHMucHJvdmlkZXIuc2VjcmV0LnNlY3JldEFybiB9IDoge30pLFxuICAgICAgICBEYXRhYmFzZU5hbWU6IHByb3BzLmRhdGFiYXNlID8gcHJvcHMuZGF0YWJhc2UuZGF0YWJhc2VOYW1lIDogdW5kZWZpbmVkLFxuICAgICAgICBTdGF0ZW1lbnQ6IHByb3BzLnN0YXRlbWVudCxcbiAgICAgICAgUm9sbGJhY2s6IHByb3BzLnJvbGxiYWNrLFxuICAgICAgfSxcbiAgICB9KVxuICAgIHRoaXMubm9kZS5hZGREZXBlbmRlbmN5KHByb3BzLnByb3ZpZGVyKVxuICAgIGlmIChwcm9wcy5kYXRhYmFzZSkgdGhpcy5ub2RlLmFkZERlcGVuZGVuY3kocHJvcHMuZGF0YWJhc2UpXG4gIH1cbn1cbiJdfQ==

package/node_modules/@types/aws-lambda/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for aws-lambda (http://docs.aws.amazon.co
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/aws-lambda.
 
 ### Additional Details
- * Last updated: Sat, 19 Jul 2025 08:38:38 GMT
+ * Last updated: Tue, 18 Nov 2025 15:02:12 GMT
  * Dependencies: none
 
 # Credits

package/node_modules/@types/aws-lambda/common/api-gateway.d.ts

@@ -80,4 +80,6 @@ export interface APIGatewayEventIdentity {
     user: string | null;
     userAgent: string | null;
     userArn: string | null;
+    vpcId?: string | undefined;
+    vpceId?: string | undefined;
 }

package/node_modules/@types/aws-lambda/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/aws-lambda",
-    "version": "8.10.152",
+    "version": "8.10.159",
     "description": "TypeScript definitions for aws-lambda",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/aws-lambda",
     "license": "MIT",
@@ -221,6 +221,6 @@
     "scripts": {},
     "dependencies": {},
     "peerDependencies": {},
-    "typesPublisherContentHash": "7ac21f912f5d39e38f9916d81a153b602cba17acc60370d4bd76dbb98d403494",
-    "typeScriptVersion": "5.1"
+    "typesPublisherContentHash": "05cdbd1b79b9a9c0f6de57fc2e695fcf893c4491dac3280a93338882cc96129d",
+    "typeScriptVersion": "5.2"
 }

package/node_modules/@types/aws-lambda/trigger/cognito-user-pool-trigger/custom-email-sender.d.ts

@@ -50,6 +50,10 @@ export interface CustomEmailSenderAdminCreateUserTriggerEvent
     extends BaseCustomEmailSenderTriggerEvent<"CustomEmailSender_AdminCreateUser">
 {}
 
+export interface CustomEmailSenderAuthenticationTriggerEvent
+    extends BaseCustomEmailSenderTriggerEvent<"CustomEmailSender_Authentication">
+{}
+
 export interface CustomEmailSenderAccountTakeOverNotificationTriggerEvent
     extends BaseTriggerEvent<"CustomEmailSender_AccountTakeOverNotification">
 {
@@ -71,6 +75,7 @@ export type CustomEmailSenderTriggerEvent =
     | CustomEmailSenderUpdateUserAttributeTriggerEvent
     | CustomEmailSenderVerifyUserAttributeTriggerEvent
     | CustomEmailSenderAdminCreateUserTriggerEvent
+    | CustomEmailSenderAuthenticationTriggerEvent
     | CustomEmailSenderAccountTakeOverNotificationTriggerEvent;
 
 export type CustomEmailSenderTriggerHandler = Handler<CustomEmailSenderTriggerEvent>;

package/node_modules/@types/aws-lambda/trigger/connect-contact-flow.d.ts

@@ -29,7 +29,7 @@ export interface ConnectContactFlowEvent {
     Name: "ContactFlowEvent";
 }
 
-export type ConnectContactFlowChannel = "VOICE" | "CHAT";
+export type ConnectContactFlowChannel = "VOICE" | "CHAT" | "EMAIL";
 
 export type ConnectContactFlowInitiationMethod = "INBOUND" | "OUTBOUND" | "TRANSFER" | "CALLBACK" | "API";
 

package/node_modules/@types/aws-lambda/trigger/dynamodb-stream.d.ts

@@ -3,19 +3,27 @@ import { Handler } from "../handler";
 // eslint-disable-next-line @typescript-eslint/no-invalid-void-type
 export type DynamoDBStreamHandler = Handler<DynamoDBStreamEvent, DynamoDBBatchResponse | void>;
 
+// eslint-disable-next-line @definitelytyped/strict-export-declare-modifiers, @definitelytyped/no-single-element-tuple-type
+type Merge<T> = [{ [K in keyof T]: T[K] }][number];
+
+// eslint-disable-next-line @definitelytyped/strict-export-declare-modifiers
+type ExclusivePropertyUnion<T, P = keyof T> = P extends any
+    ? Merge<{ [K in Extract<keyof T, P>]: T[K] } & { [K in Exclude<keyof T, P>]?: never }>
+    : never;
+
 // http://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_AttributeValue.html
-export interface AttributeValue {
-    B?: string | undefined;
-    BS?: string[] | undefined;
-    BOOL?: boolean | undefined;
-    L?: AttributeValue[] | undefined;
-    M?: { [id: string]: AttributeValue } | undefined;
-    N?: string | undefined;
-    NS?: string[] | undefined;
-    NULL?: boolean | undefined;
-    S?: string | undefined;
-    SS?: string[] | undefined;
-}
+export type AttributeValue = ExclusivePropertyUnion<{
+    B: string;
+    BOOL: boolean;
+    BS: string[];
+    L: AttributeValue[];
+    M: Record<string, AttributeValue>;
+    N: string;
+    NS: string[];
+    NULL: boolean;
+    S: string;
+    SS: string[];
+}>;
 
 // http://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_streams_StreamRecord.html
 export interface StreamRecord {

package/node_modules/@types/aws-lambda/trigger/sns.d.ts

@@ -16,12 +16,12 @@ export interface SNSMessage {
     SignatureVersion: string;
     Timestamp: string;
     Signature: string;
-    SigningCertUrl: string;
+    SigningCertUrl: string; // Not SigningCertURL; see https://github.com/DefinitelyTyped/DefinitelyTyped/pull/73817#issuecomment-3367340170
     MessageId: string;
     Message: string;
     MessageAttributes: SNSMessageAttributes;
     Type: string;
-    UnsubscribeUrl: string;
+    UnsubscribeUrl: string; // Not UnsubscribeURL; see https://github.com/DefinitelyTyped/DefinitelyTyped/pull/73817#issuecomment-3367340170
     TopicArn: string;
     Subject?: string;
     Token?: string;

package/package.json

@@ -42,9 +42,9 @@
     "organization": false
   },
   "devDependencies": {
-    "@aws-sdk/client-secrets-manager": "^3.888.0",
-    "@aws-sdk/client-ssm": "^3.888.0",
-    "@aws-sdk/dsql-signer": "^3.888.0",
+    "@aws-sdk/client-secrets-manager": "^3.953.0",
+    "@aws-sdk/client-ssm": "^3.953.0",
+    "@aws-sdk/dsql-signer": "^3.953.0",
     "@types/jest": "~30",
     "@types/node": "^22",
     "@types/pg": "^8.11.11",
@@ -53,24 +53,24 @@
     "aws-cdk-lib": "2.214.0",
     "commit-and-tag-version": "^12",
     "constructs": "10.4.2",
-    "esbuild": "0.25.9",
+    "esbuild": "0.27.2",
     "eslint": "^9",
     "eslint-config-prettier": "^8.10.2",
     "eslint-import-resolver-typescript": "^3.10.1",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^4.2.5",
-    "exponential-backoff": "^3.1.2",
+    "exponential-backoff": "^3.1.3",
     "jest": "~30",
     "jest-junit": "^16",
     "jsii": "~5.9.0",
-    "jsii-diff": "^1.114.1",
-    "jsii-pacmak": "^1.114.1",
+    "jsii-diff": "^1.121.0",
+    "jsii-pacmak": "^1.121.0",
     "jsii-rosetta": "~5.9.0",
-    "mysql2": "^3.14.5",
+    "mysql2": "^3.16.0",
     "node-pg-format": "^1.3.5",
     "pg": "^8.13.3",
     "prettier": "^2.8.8",
-    "projen": "^0.96.1",
+    "projen": "^0.98.30",
     "source-map-support": "^0.5.21",
     "testcontainers": "11",
     "ts-jest": "^29",
@@ -82,7 +82,7 @@
     "constructs": "^10.4.2"
   },
   "dependencies": {
-    "@types/aws-lambda": "^8.10.152"
+    "@types/aws-lambda": "^8.10.159"
   },
   "bundledDependencies": [
     "@types/aws-lambda"
@@ -105,7 +105,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "7.3.2",
+  "version": "8.0.1",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [