s3-secure-bucket 0.1.6 → 0.2.1

package/.jsii

@@ -8455,7 +8455,7 @@
   },
   "name": "s3-secure-bucket",
   "readme": {
-    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAn [AWS CDK](https://aws.amazon.com/cdk/) construct that defines an S3 bucket with security-focused defaults. It wraps the standard `s3.Bucket` and applies settings that follow AWS best practices, so you can create buckets without accidentally leaving them open or unencrypted. You can still override any option or use it as a drop-in replacement where a regular `s3.Bucket` is expected. For CDK pipeline artifact buckets or CloudFront origins, use the `bucketType` option so encryption and resource policies are set appropriately.\n\n## Features\n\n- Security-focused defaults for S3 buckets (private, block public access, enforce SSL)\n- Encryption enabled by default\n- Versioning enabled by default\n- Object ownership enforced by default (`BucketOwnerEnforced`)\n- `RemovalPolicy.RETAIN` by default (prevent accidental deletion)\n- Bucket-type presets via `bucketType` for common production use cases\n  - `DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`: CDK pipeline artifact buckets with custom qualifier support\n  - `CLOUDFRONT_ORIGIN_BUCKET`: CloudFront origin buckets using S3-managed encryption\n  - `ACCESS_LOG_BUCKET`: Centralized access log buckets with minimal log-delivery permissions\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { S3SecureBucket } from 's3-secure-bucket';\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### Centralized access log bucket (ALB / CloudFront / S3)\n\n```typescript\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n```\n\n## Options\n\nThe `S3SecureBucket` constructor accepts `S3SecureBucketProps`. Since it extends `s3.BucketProps`, you can also use standard S3 bucket options such as `bucketName`, `versioned`, and `encryption`.\n\n### S3SecureBucket-specific options\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `S3SecureBucketType.DEFAULT_BUCKET` | Determines encryption and resource policy behavior. |\n\n### S3SecureBucketType values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | Default bucket when not using a custom qualifier |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access log bucket for ALB / CloudFront / S3 (RETAIN + minimal log-delivery permissions) |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (when using a custom qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- AWS CDK v2 (`aws-cdk-lib`)\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` for pipeline artifacts, CloudFront origins, and centralized access logs so encryption and bucket policies match each workload.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET` and `CLOUDFRONT_ORIGIN_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- **`bucketType` presets**\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, and `lifecycleRules` work as usual alongside the secure defaults.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8472,32 +8472,46 @@
       "assembly": "s3-secure-bucket",
       "base": "aws-cdk-lib.aws_s3.Bucket",
       "docs": {
+        "custom": {
+          "remarks": "- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET } and {@link S3SecureBucket#accessLogBucketPolicyDependable }."
+        },
+        "remarks": "KMS-managed by default otherwise).",
         "stability": "stable",
-        "summary": "An S3 bucket with secure defaults: private access, SSL enforced, public access blocked, and encryption required."
+        "summary": "S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin types;"
       },
       "fqn": "s3-secure-bucket.S3SecureBucket",
       "initializer": {
         "docs": {
-          "stability": "stable"
+          "stability": "stable",
+          "summary": "Creates a secure S3 bucket according to `bucketType` and merged `props`."
         },
         "locationInModule": {
           "filename": "src/index.ts",
-          "line": 49
+          "line": 84
         },
         "parameters": [
           {
+            "docs": {
+              "summary": "- Parent construct, typically a {@link Stack}."
+            },
             "name": "scope",
             "type": {
               "fqn": "constructs.Construct"
             }
           },
           {
+            "docs": {
+              "summary": "- Construct ID (stable logical ID segment)."
+            },
             "name": "id",
             "type": {
               "primitive": "string"
             }
           },
           {
+            "docs": {
+              "summary": "- Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true)."
+            },
             "name": "props",
             "optional": true,
             "type": {
@@ -8509,18 +8523,38 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/index.ts",
-        "line": 48
+        "line": 65
       },
       "name": "S3SecureBucket",
+      "properties": [
+        {
+          "docs": {
+            "default": "undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET }.",
+            "remarks": "Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.",
+            "stability": "stable",
+            "summary": "Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}. Use as a dependency target so load balancer access-log enablement runs after the bucket policy exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/index.ts",
+            "line": 75
+          },
+          "name": "accessLogBucketPolicyDependable",
+          "optional": true,
+          "type": {
+            "fqn": "constructs.IDependable"
+          }
+        }
+      ],
       "symbolId": "src/index:S3SecureBucket"
     },
     "s3-secure-bucket.S3SecureBucketProps": {
       "assembly": "s3-secure-bucket",
       "datatype": true,
       "docs": {
-        "remarks": "Extends `s3.BucketProps` with a bucket type for secure defaults.",
+        "remarks": "Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.",
         "stability": "stable",
-        "summary": "Props for {@link S3SecureBucket}."
+        "summary": "Construction properties for {@link S3SecureBucket}."
       },
       "fqn": "s3-secure-bucket.S3SecureBucketProps",
       "interfaces": [
@@ -8529,22 +8563,21 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/index.ts",
-        "line": 36
+        "line": 47
       },
       "name": "S3SecureBucketProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "default": "S3SecureBucketType.DEFAULT_BUCKET",
-            "remarks": "Determines encryption and resource policy behavior.",
+            "default": "{@link S3SecureBucketType.DEFAULT_BUCKET }",
             "stability": "stable",
-            "summary": "The type of the bucket."
+            "summary": "Selects encryption defaults and optional resource-policy statements."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 42
+            "line": 54
           },
           "name": "bucketType",
           "optional": true,
@@ -8556,6 +8589,6 @@
       "symbolId": "src/index:S3SecureBucketProps"
     }
   },
-  "version": "0.1.6",
-  "fingerprint": "0kEfMWeqRChTf87wSYgg0YgUuUKNes2RMuHCmJaDU2g="
+  "version": "0.2.1",
+  "fingerprint": "xlXsC0RrVqg4UJOgmJhEODMfux8HAPA3glSh/bLKJ3o="
 }

package/API.md

@@ -4,7 +4,9 @@
 
 ### S3SecureBucket <a name="S3SecureBucket" id="s3-secure-bucket.S3SecureBucket"></a>
 
-An S3 bucket with secure defaults: private access, SSL enforced, public access blocked, and encryption required.
+S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin types;
+
+KMS-managed by default otherwise).
 
 #### Initializers <a name="Initializers" id="s3-secure-bucket.S3SecureBucket.Initializer"></a>
 
@@ -16,9 +18,9 @@ new S3SecureBucket(scope: Construct, id: string, props?: S3SecureBucketProps)
 
 | **Name** | **Type** | **Description** |
 | --- | --- | --- |
-| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | *No description.* |
-| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.id">id</a></code> | <code>string</code> | *No description.* |
-| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.props">props</a></code> | <code><a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a></code> | *No description.* |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.scope">scope</a></code> | <code>constructs.Construct</code> | - Parent construct, typically a {@link Stack}. |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.id">id</a></code> | <code>string</code> | - Construct ID (stable logical ID segment). |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.Initializer.parameter.props">props</a></code> | <code><a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a></code> | - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true). |
 
 ---
 
@@ -26,18 +28,24 @@ new S3SecureBucket(scope: Construct, id: string, props?: S3SecureBucketProps)
 
 - *Type:* constructs.Construct
 
+Parent construct, typically a {@link Stack}.
+
 ---
 
 ##### `id`<sup>Required</sup> <a name="id" id="s3-secure-bucket.S3SecureBucket.Initializer.parameter.id"></a>
 
 - *Type:* string
 
+Construct ID (stable logical ID segment).
+
 ---
 
 ##### `props`<sup>Optional</sup> <a name="props" id="s3-secure-bucket.S3SecureBucket.Initializer.parameter.props"></a>
 
 - *Type:* <a href="#s3-secure-bucket.S3SecureBucketProps">S3SecureBucketProps</a>
 
+Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
+
 ---
 
 #### Methods <a name="Methods" id="Methods"></a>
@@ -1085,6 +1093,7 @@ allow legacy bucket naming style, default is false.
 | <code><a href="#s3-secure-bucket.S3SecureBucket.property.disallowPublicAccess">disallowPublicAccess</a></code> | <code>boolean</code> | Whether to disallow public access. |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.property.policy">policy</a></code> | <code>aws-cdk-lib.aws_s3.BucketPolicy</code> | The resource policy associated with this bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.property.replicationRoleArn">replicationRoleArn</a></code> | <code>string</code> | Role used to set up permissions on this bucket for replication. |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.property.accessLogBucketPolicyDependable">accessLogBucketPolicyDependable</a></code> | <code>constructs.IDependable</code> | Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}. Use as a dependency target so load balancer access-log enablement runs after the bucket policy exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet). |
 
 ---
 
@@ -1303,6 +1312,21 @@ Role used to set up permissions on this bucket for replication.
 
 ---
 
+##### `accessLogBucketPolicyDependable`<sup>Optional</sup> <a name="accessLogBucketPolicyDependable" id="s3-secure-bucket.S3SecureBucket.property.accessLogBucketPolicyDependable"></a>
+
+```typescript
+public readonly accessLogBucketPolicyDependable: IDependable;
+```
+
+- *Type:* constructs.IDependable
+- *Default:* undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET }.
+
+Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}. Use as a dependency target so load balancer access-log enablement runs after the bucket policy exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
+
+Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
+
+---
+
 #### Constants <a name="Constants" id="Constants"></a>
 
 | **Name** | **Type** | **Description** |
@@ -1327,9 +1351,9 @@ Uniquely identifies this class.
 
 ### S3SecureBucketProps <a name="S3SecureBucketProps" id="s3-secure-bucket.S3SecureBucketProps"></a>
 
-Props for {@link S3SecureBucket}.
+Construction properties for {@link S3SecureBucket}.
 
-Extends `s3.BucketProps` with a bucket type for secure defaults.
+Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.
 
 #### Initializer <a name="Initializer" id="s3-secure-bucket.S3SecureBucketProps.Initializer"></a>
 
@@ -1377,7 +1401,7 @@ const s3SecureBucketProps: S3SecureBucketProps = { ... }
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteIndexDocument">websiteIndexDocument</a></code> | <code>string</code> | The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRedirect">websiteRedirect</a></code> | <code>aws-cdk-lib.aws_s3.RedirectTarget</code> | Specifies the redirect behavior of all requests to a website endpoint of a bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRoutingRules">websiteRoutingRules</a></code> | <code>aws-cdk-lib.aws_s3.RoutingRule[]</code> | Rules that define when a redirect is applied and the redirect behavior. |
-| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketType">bucketType</a></code> | <code>string</code> | The type of the bucket. |
+| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketType">bucketType</a></code> | <code>string</code> | Selects encryption defaults and optional resource-policy statements. |
 
 ---
 
@@ -1898,11 +1922,9 @@ public readonly bucketType: string;
 ```
 
 - *Type:* string
-- *Default:* S3SecureBucketType.DEFAULT_BUCKET
-
-The type of the bucket.
+- *Default:* {@link S3SecureBucketType.DEFAULT_BUCKET }
 
-Determines encryption and resource policy behavior.
+Selects encryption defaults and optional resource-policy statements.
 
 ---
 

package/README.md

@@ -6,19 +6,20 @@
 [![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)
 [![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)
 
-An [AWS CDK](https://aws.amazon.com/cdk/) construct that defines an S3 bucket with security-focused defaults. It wraps the standard `s3.Bucket` and applies settings that follow AWS best practices, so you can create buckets without accidentally leaving them open or unencrypted. You can still override any option or use it as a drop-in replacement where a regular `s3.Bucket` is expected. For CDK pipeline artifact buckets or CloudFront origins, use the `bucketType` option so encryption and resource policies are set appropriately.
+AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` for pipeline artifacts, CloudFront origins, and centralized access logs so encryption and bucket policies match each workload.
 
 ## Features
 
-- Security-focused defaults for S3 buckets (private, block public access, enforce SSL)
-- Encryption enabled by default
-- Versioning enabled by default
-- Object ownership enforced by default (`BucketOwnerEnforced`)
-- `RemovalPolicy.RETAIN` by default (prevent accidental deletion)
-- Bucket-type presets via `bucketType` for common production use cases
-  - `DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`: CDK pipeline artifact buckets with custom qualifier support
-  - `CLOUDFRONT_ORIGIN_BUCKET`: CloudFront origin buckets using S3-managed encryption
-  - `ACCESS_LOG_BUCKET`: Centralized access log buckets with minimal log-delivery permissions
+- Private access, block public access, and deny insecure transport (`enforceSSL`)
+- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden
+- **Log / origin types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET` and `CLOUDFRONT_ORIGIN_BUCKET`
+- Versioning on by default; object ownership `BucketOwnerEnforced` by default
+- `RemovalPolicy.RETAIN` on the bucket
+- **`bucketType` presets**
+  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier
+  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical origin use
+  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)
+- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)
 
 ## Installation
 
@@ -39,48 +40,69 @@ yarn add s3-secure-bucket
 ### Default secure bucket
 
 ```typescript
+import { Stack } from 'aws-cdk-lib';
 import { S3SecureBucket } from 's3-secure-bucket';
 
+declare const stack: Stack;
+
 const bucket = new S3SecureBucket(stack, 'S3SecureBucket', {
   bucketName: 'example-secure-bucket',
 });
 ```
 
-### Centralized access log bucket (ALB / CloudFront / S3)
+### Centralized access log bucket (ALB / NLB / CloudFront / S3)
+
+For `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved.
 
 ```typescript
+import { Stack } from 'aws-cdk-lib';
 import { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';
 
+declare const stack: Stack;
+
 const accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {
   bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,
 });
+
+// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy
+// so ELB's validation PutObject runs after the policy exists:
+// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);
 ```
 
+Wire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.
+
 ## Options
 
-The `S3SecureBucket` constructor accepts `S3SecureBucketProps`. Since it extends `s3.BucketProps`, you can also use standard S3 bucket options such as `bucketName`, `versioned`, and `encryption`.
+`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, and `lifecycleRules` work as usual alongside the secure defaults.
 
-### S3SecureBucket-specific options
+### Construct props (`S3SecureBucketProps`)
 
 | Property | Type | Default | Description |
 | --- | --- | --- | --- |
-| `bucketType` | `S3SecureBucketType` | `S3SecureBucketType.DEFAULT_BUCKET` | Determines encryption and resource policy behavior. |
+| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |
+| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |
 
-### S3SecureBucketType values
+### `S3SecureBucketType` values
 
 | Constant | Use case |
 | --- | --- |
-| `S3SecureBucketType.DEFAULT_BUCKET` | Default bucket when not using a custom qualifier |
-| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access log bucket for ALB / CloudFront / S3 (RETAIN + minimal log-delivery permissions) |
-| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (when using a custom qualifier) |
+| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |
+| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |
+| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |
 | `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |
 
+### Read-only: `accessLogBucketPolicyDependable`
+
+| Property | Type | When set | Description |
+| --- | --- | --- | --- |
+| `accessLogBucketPolicyDependable` | `IDependable \| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |
+
 See [API.md](./API.md) for the full API reference.
 
 ## Requirements
 
 - Node.js >= 20
-- AWS CDK v2 (`aws-cdk-lib`)
+- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1
 
 ## License
 

package/lib/index.d.ts

@@ -1,43 +1,76 @@
 import * as s3 from 'aws-cdk-lib/aws-s3';
-import { Construct } from 'constructs';
+import { Construct, IDependable } from 'constructs';
 /**
- * Bucket type constants. Use these values for the {@link S3SecureBucketProps.bucketType} property.
+ * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ *
+ * @see {@link S3SecureBucketProps.bucketType}
  */
 export declare const S3SecureBucketType: {
     /**
-     * Select when using this bucket as the CDK pipeline artifact bucket with a custom Qualifier
-     * (single-region or multi-region deployment).
+     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
+     * (single- or multi-region deployments).
      */
     readonly DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: "DeploymentPipelineArtifactBucket";
     /**
-     * Select when using this bucket as the CloudFront origin.
+     * Origin bucket for CloudFront distributions.
      */
     readonly CLOUDFRONT_ORIGIN_BUCKET: "CloudFrontOriginBucket";
     /**
-     * Select for the default bucket when not using a custom Qualifier.
+     * General-purpose secure bucket (default qualifier / standard use).
      */
     readonly DEFAULT_BUCKET: "DefaultBucket";
     /**
-     * Select when using this bucket as a centralized access log bucket
-     * for ALB, CloudFront, S3 server access logging, and similar producers.
+     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     *
+     * For {@link S3SecureBucketType.ACCESS_LOG_BUCKET}, the regional ELBv2 log-delivery account ID
+     * (legacy path alongside the log delivery service principal) is resolved from `aws-cdk-lib/region-info`
+     * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
      */
     readonly ACCESS_LOG_BUCKET: "AccessLogBucket";
 };
-/** Bucket type: one of the {@link S3SecureBucketType} constant values. */
+/**
+ * Discriminated union of {@link S3SecureBucketType} string literals.
+ */
 export type S3SecureBucketType = typeof S3SecureBucketType[keyof typeof S3SecureBucketType];
 /**
- * Props for {@link S3SecureBucket}. Extends `s3.BucketProps` with a bucket type for secure defaults.
+ * Construction properties for {@link S3SecureBucket}.
+ *
+ * Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.
  */
 export interface S3SecureBucketProps extends s3.BucketProps {
     /**
-     * The type of the bucket. Determines encryption and resource policy behavior.
-     * @default S3SecureBucketType.DEFAULT_BUCKET
+     * Selects encryption defaults and optional resource-policy statements.
+     *
+     * @default {@link S3SecureBucketType.DEFAULT_BUCKET}
      */
     readonly bucketType?: S3SecureBucketType;
 }
 /**
- * An S3 bucket with secure defaults: private access, SSL enforced, public access blocked, and encryption required.
+ * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
+ * and encryption (S3-managed for log/origin types; KMS-managed by default otherwise).
+ *
+ * @remarks
+ * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
  */
 export declare class S3SecureBucket extends s3.Bucket {
+    /**
+     * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
+     * exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
+     *
+     * Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
+     *
+     * @default undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     */
+    readonly accessLogBucketPolicyDependable?: IDependable;
+    /**
+     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
+     *
+     * @param scope - Parent construct, typically a {@link Stack}.
+     * @param id - Construct ID (stable logical ID segment).
+     * @param props - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
+     */
     constructor(scope: Construct, id: string, props?: S3SecureBucketProps);
 }

package/lib/index.js

@@ -6,33 +6,52 @@ const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const iam = require("aws-cdk-lib/aws-iam");
 const s3 = require("aws-cdk-lib/aws-s3");
+const region_info_1 = require("aws-cdk-lib/region-info");
 /**
- * Bucket type constants. Use these values for the {@link S3SecureBucketProps.bucketType} property.
+ * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ *
+ * @see {@link S3SecureBucketProps.bucketType}
  */
 exports.S3SecureBucketType = {
     /**
-     * Select when using this bucket as the CDK pipeline artifact bucket with a custom Qualifier
-     * (single-region or multi-region deployment).
+     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
+     * (single- or multi-region deployments).
      */
     DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: 'DeploymentPipelineArtifactBucket',
     /**
-     * Select when using this bucket as the CloudFront origin.
+     * Origin bucket for CloudFront distributions.
      */
     CLOUDFRONT_ORIGIN_BUCKET: 'CloudFrontOriginBucket',
     /**
-     * Select for the default bucket when not using a custom Qualifier.
+     * General-purpose secure bucket (default qualifier / standard use).
      */
     DEFAULT_BUCKET: 'DefaultBucket',
     /**
-     * Select when using this bucket as a centralized access log bucket
-     * for ALB, CloudFront, S3 server access logging, and similar producers.
+     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     *
+     * For {@link S3SecureBucketType.ACCESS_LOG_BUCKET}, the regional ELBv2 log-delivery account ID
+     * (legacy path alongside the log delivery service principal) is resolved from `aws-cdk-lib/region-info`
+     * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
      */
     ACCESS_LOG_BUCKET: 'AccessLogBucket',
 };
 /**
- * An S3 bucket with secure defaults: private access, SSL enforced, public access blocked, and encryption required.
+ * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
+ * and encryption (S3-managed for log/origin types; KMS-managed by default otherwise).
+ *
+ * @remarks
+ * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
  */
 class S3SecureBucket extends s3.Bucket {
+    /**
+     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
+     *
+     * @param scope - Parent construct, typically a {@link Stack}.
+     * @param id - Construct ID (stable logical ID segment).
+     * @param props - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
+     */
     constructor(scope, id, props) {
         const bucketType = props?.bucketType || exports.S3SecureBucketType.DEFAULT_BUCKET;
         super(scope, id, {
@@ -86,8 +105,9 @@ class S3SecureBucket extends s3.Bucket {
             }
         }
         if (bucketType === exports.S3SecureBucketType.ACCESS_LOG_BUCKET) {
-            // Allow ALB / NLB log delivery to put objects (no read or list)
-            this.addToResourcePolicy(new iam.PolicyStatement({
+            const awsLogsPrefixResource = `${this.bucketArn}/AWSLogs/${account}/*`;
+            // Allow ALB / NLB log delivery (modern service principal path; also required in opt-in regions).
+            const albLogDeliveryPolicyResult = this.addToResourcePolicy(new iam.PolicyStatement({
                 effect: iam.Effect.ALLOW,
                 principals: [
                     new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com'),
@@ -96,9 +116,30 @@ class S3SecureBucket extends s3.Bucket {
                     's3:PutObject',
                 ],
                 resources: [
-                    `${this.bucketArn}/AWSLogs/${account}/*`,
+                    awsLogsPrefixResource,
                 ],
             }));
+            // In non–opt-in regions (for example ap-northeast-1), access logs are often delivered using the
+            // regional ELBv2 account (root of that account) for s3:PutObject, not only the service principal above.
+            const stack = aws_cdk_lib_1.Stack.of(this);
+            const elbAccountId = aws_cdk_lib_1.Token.isUnresolved(stack.region)
+                ? stack.regionalFact(region_info_1.FactName.ELBV2_ACCOUNT)
+                : region_info_1.RegionInfo.get(stack.region).elbv2Account;
+            if (elbAccountId) {
+                this.addToResourcePolicy(new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    principals: [
+                        new iam.AccountPrincipal(elbAccountId),
+                    ],
+                    actions: [
+                        's3:PutObject',
+                    ],
+                    resources: [
+                        awsLogsPrefixResource,
+                    ],
+                }));
+            }
+            this.accessLogBucketPolicyDependable = albLogDeliveryPolicyResult.policyDependable ?? this;
             // Allow CloudFront standard logging (v2) to write logs
             this.addToResourcePolicy(new iam.PolicyStatement({
                 effect: iam.Effect.ALLOW,
@@ -109,7 +150,7 @@ class S3SecureBucket extends s3.Bucket {
                     's3:PutObject',
                 ],
                 resources: [
-                    `${this.bucketArn}/AWSLogs/${account}/*`,
+                    awsLogsPrefixResource,
                 ],
             }));
             // Allow S3 server access logging to write logs when required by configuration
@@ -122,7 +163,7 @@ class S3SecureBucket extends s3.Bucket {
                     's3:PutObject',
                 ],
                 resources: [
-                    `${this.bucketArn}/AWSLogs/${account}/*`,
+                    awsLogsPrefixResource,
                 ],
             }));
         }
@@ -130,5 +171,5 @@ class S3SecureBucket extends s3.Bucket {
 }
 exports.S3SecureBucket = S3SecureBucket;
 _a = JSII_RTTI_SYMBOL_1;
-S3SecureBucket[_a] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.1.6" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBNEU7QUFDNUUsMkNBQTJDO0FBQzNDLHlDQUF5QztBQUd6Qzs7R0FFRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7OztPQUdHO0lBQ0gsbUNBQW1DLEVBQUUsa0NBQWtDO0lBQ3ZFOztPQUVHO0lBQ0gsd0JBQXdCLEVBQUUsd0JBQXdCO0lBQ2xEOztPQUVHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7OztPQUdHO0lBQ0gsaUJBQWlCLEVBQUUsaUJBQWlCO0NBQzVCLENBQUM7QUFpQlg7O0dBRUc7QUFDSCxNQUFhLGNBQWUsU0FBUSxFQUFFLENBQUMsTUFBTTtJQUMzQyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksMEJBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ2hCLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLHdCQUF3QixJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO29CQUN0SCxPQUFPLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLEVBQUUsVUFBVSxJQUFJLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUM7WUFDOUQsQ0FBQyxDQUFDLEVBQUU7WUFDSixhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ25CLElBQUksQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzFCLE9BQU8sRUFBRSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixrQkFBa0IsRUFBRSxTQUFTO1lBQzdCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ2xFLGVBQWUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDckIsSUFBSSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUM7b0JBQzNCLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFDL0IsQ0FBQztnQkFDRCxPQUFPLEVBQUUsQ0FBQyxlQUFlLENBQUMscUJBQXFCLENBQUM7WUFDbEQsQ0FBQyxDQUFDLEVBQUU7U0FDTCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQTRCLENBQUM7UUFDekQsSUFBSSxLQUFLLEVBQUUsa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLHVFQUF1RSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDdkMsTUFBTSxNQUFNLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDO1FBRXJDLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLG1DQUFtQyxFQUFFLENBQUM7WUFFMUUsTUFBTSxTQUFTLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDO1lBRWhFLElBQUksU0FBUyxJQUFJLENBQUMsU0FBUyxJQUFJLHFDQUF1QixDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztnQkFDMUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztvQkFDL0MsT0FBTyxFQUFFO3dCQUNQLE1BQU07cUJBQ1A7b0JBQ0QsU0FBUyxFQUFFO3dCQUNULEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRTt3QkFDbkIsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJO3FCQUN0QjtvQkFDRCxVQUFVLEVBQUU7d0JBQ1YsSUFBSSxHQUFHLENBQUMsWUFBWSxDQUFDLGdCQUFnQixPQUFPLGFBQWEsU0FBUyxnQkFBZ0IsT0FBTyxJQUFJLE1BQU0sRUFBRSxDQUFDO3FCQUN2RztpQkFDRixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxVQUFVLEtBQUssMEJBQWtCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN4RCxnRUFBZ0U7WUFDaEUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDL0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFO29CQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGdEQUFnRCxDQUFDO2lCQUMzRTtnQkFDRCxPQUFPLEVBQUU7b0JBQ1AsY0FBYztpQkFDZjtnQkFDRCxTQUFTLEVBQUU7b0JBQ1QsR0FBRyxJQUFJLENBQUMsU0FBUyxZQUFZLE9BQU8sSUFBSTtpQkFDekM7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLHVEQUF1RDtZQUN2RCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsNkJBQTZCLENBQUM7aUJBQ3hEO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxHQUFHLElBQUksQ0FBQyxTQUFTLFlBQVksT0FBTyxJQUFJO2lCQUN6QzthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosOEVBQThFO1lBQzlFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQy9DLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRTtvQkFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQywwQkFBMEIsQ0FBQztpQkFDckQ7Z0JBQ0QsT0FBTyxFQUFFO29CQUNQLGNBQWM7aUJBQ2Y7Z0JBQ0QsU0FBUyxFQUFFO29CQUNULEdBQUcsSUFBSSxDQUFDLFNBQVMsWUFBWSxPQUFPLElBQUk7aUJBQ3pDO2FBQ0YsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO0lBQ0gsQ0FBQzs7QUF0R0gsd0NBdUdDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRGVmYXVsdFN0YWNrU3ludGhlc2l6ZXIsIFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIEJ1Y2tldCB0eXBlIGNvbnN0YW50cy4gVXNlIHRoZXNlIHZhbHVlcyBmb3IgdGhlIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9IHByb3BlcnR5LlxuICovXG5leHBvcnQgY29uc3QgUzNTZWN1cmVCdWNrZXRUeXBlID0ge1xuICAvKipcbiAgICogU2VsZWN0IHdoZW4gdXNpbmcgdGhpcyBidWNrZXQgYXMgdGhlIENESyBwaXBlbGluZSBhcnRpZmFjdCBidWNrZXQgd2l0aCBhIGN1c3RvbSBRdWFsaWZpZXJcbiAgICogKHNpbmdsZS1yZWdpb24gb3IgbXVsdGktcmVnaW9uIGRlcGxveW1lbnQpLlxuICAgKi9cbiAgREVQTE9ZTUVOVF9QSVBFTElORV9BUlRJRkFDVF9CVUNLRVQ6ICdEZXBsb3ltZW50UGlwZWxpbmVBcnRpZmFjdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBTZWxlY3Qgd2hlbiB1c2luZyB0aGlzIGJ1Y2tldCBhcyB0aGUgQ2xvdWRGcm9udCBvcmlnaW4uXG4gICAqL1xuICBDTE9VREZST05UX09SSUdJTl9CVUNLRVQ6ICdDbG91ZEZyb250T3JpZ2luQnVja2V0JyxcbiAgLyoqXG4gICAqIFNlbGVjdCBmb3IgdGhlIGRlZmF1bHQgYnVja2V0IHdoZW4gbm90IHVzaW5nIGEgY3VzdG9tIFF1YWxpZmllci5cbiAgICovXG4gIERFRkFVTFRfQlVDS0VUOiAnRGVmYXVsdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBTZWxlY3Qgd2hlbiB1c2luZyB0aGlzIGJ1Y2tldCBhcyBhIGNlbnRyYWxpemVkIGFjY2VzcyBsb2cgYnVja2V0XG4gICAqIGZvciBBTEIsIENsb3VkRnJvbnQsIFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZywgYW5kIHNpbWlsYXIgcHJvZHVjZXJzLlxuICAgKi9cbiAgQUNDRVNTX0xPR19CVUNLRVQ6ICdBY2Nlc3NMb2dCdWNrZXQnLFxufSBhcyBjb25zdDtcblxuLyoqIEJ1Y2tldCB0eXBlOiBvbmUgb2YgdGhlIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGV9IGNvbnN0YW50IHZhbHVlcy4gKi9cbmV4cG9ydCB0eXBlIFMzU2VjdXJlQnVja2V0VHlwZSA9IHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVba2V5b2YgdHlwZW9mIFMzU2VjdXJlQnVja2V0VHlwZV07XG5cbi8qKlxuICogUHJvcHMgZm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldH0uIEV4dGVuZHMgYHMzLkJ1Y2tldFByb3BzYCB3aXRoIGEgYnVja2V0IHR5cGUgZm9yIHNlY3VyZSBkZWZhdWx0cy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTM1NlY3VyZUJ1Y2tldFByb3BzIGV4dGVuZHMgczMuQnVja2V0UHJvcHMge1xuXG4gIC8qKlxuICAgKiBUaGUgdHlwZSBvZiB0aGUgYnVja2V0LiBEZXRlcm1pbmVzIGVuY3J5cHRpb24gYW5kIHJlc291cmNlIHBvbGljeSBiZWhhdmlvci5cbiAgICogQGRlZmF1bHQgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUXG4gICAqL1xuICByZWFkb25seSBidWNrZXRUeXBlPzogUzNTZWN1cmVCdWNrZXRUeXBlO1xufVxuXG4vKipcbiAqIEFuIFMzIGJ1Y2tldCB3aXRoIHNlY3VyZSBkZWZhdWx0czogcHJpdmF0ZSBhY2Nlc3MsIFNTTCBlbmZvcmNlZCwgcHVibGljIGFjY2VzcyBibG9ja2VkLCBhbmQgZW5jcnlwdGlvbiByZXF1aXJlZC5cbiAqL1xuZXhwb3J0IGNsYXNzIFMzU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM/OiBTM1NlY3VyZUJ1Y2tldFByb3BzKSB7XG4gICAgY29uc3QgYnVja2V0VHlwZSA9IHByb3BzPy5idWNrZXRUeXBlIHx8IFMzU2VjdXJlQnVja2V0VHlwZS5ERUZBVUxUX0JVQ0tFVDtcbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIC4uLnByb3BzLFxuICAgICAgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5SRVRBSU4sXG4gICAgICBlbmNyeXB0aW9uOiAoKCkgPT4ge1xuICAgICAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VERlJPTlRfT1JJR0lOX0JVQ0tFVCB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVQpIHtcbiAgICAgICAgICByZXR1cm4gczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VEO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwcm9wcz8uZW5jcnlwdGlvbiB8fCBzMy5CdWNrZXRFbmNyeXB0aW9uLktNU19NQU5BR0VEO1xuICAgICAgfSkoKSxcbiAgICAgIGFjY2Vzc0NvbnRyb2w6ICgoKSA9PiB7XG4gICAgICAgIGlmICghcHJvcHM/LmFjY2Vzc0NvbnRyb2wpIHtcbiAgICAgICAgICByZXR1cm4gczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwcm9wcy5hY2Nlc3NDb250cm9sO1xuICAgICAgfSkoKSxcbiAgICAgIGV2ZW50QnJpZGdlRW5hYmxlZDogdW5kZWZpbmVkLFxuICAgICAgcHVibGljUmVhZEFjY2VzczogZmFsc2UsXG4gICAgICBibG9ja1B1YmxpY0FjY2VzczogczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMLFxuICAgICAgZW5mb3JjZVNTTDogdHJ1ZSxcbiAgICAgIHZlcnNpb25lZDogcHJvcHM/LnZlcnNpb25lZCAhPT0gdW5kZWZpbmVkID8gcHJvcHMudmVyc2lvbmVkIDogdHJ1ZSxcbiAgICAgIG9iamVjdE93bmVyc2hpcDogKCgpID0+IHtcbiAgICAgICAgaWYgKHByb3BzPy5vYmplY3RPd25lcnNoaXApIHtcbiAgICAgICAgICByZXR1cm4gcHJvcHMub2JqZWN0T3duZXJzaGlwO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBzMy5PYmplY3RPd25lcnNoaXAuQlVDS0VUX09XTkVSX0VORk9SQ0VEO1xuICAgICAgfSkoKSxcbiAgICB9KTtcblxuICAgIGNvbnN0IGNmbkJ1Y2tldCA9IHRoaXMubm9kZS5kZWZhdWx0Q2hpbGQgYXMgczMuQ2ZuQnVja2V0O1xuICAgIGlmIChwcm9wcz8uZXZlbnRCcmlkZ2VFbmFibGVkID09PSB0cnVlKSB7XG4gICAgICBjZm5CdWNrZXQuYWRkUHJvcGVydHlPdmVycmlkZSgnTm90aWZpY2F0aW9uQ29uZmlndXJhdGlvbi5FdmVudEJyaWRnZUNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VFbmFibGVkJywgdHJ1ZSk7XG4gICAgfVxuXG4gICAgY29uc3QgYWNjb3VudCA9IFN0YWNrLm9mKHRoaXMpLmFjY291bnQ7XG4gICAgY29uc3QgcmVnaW9uID0gU3RhY2sub2YodGhpcykucmVnaW9uO1xuXG4gICAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5ERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVCkge1xuXG4gICAgICBjb25zdCBxdWFsaWZpZXIgPSBTdGFjay5vZih0aGlzKS5zeW50aGVzaXplci5ib290c3RyYXBRdWFsaWZpZXI7XG5cbiAgICAgIGlmIChxdWFsaWZpZXIgJiYgKHF1YWxpZmllciAhPSBEZWZhdWx0U3RhY2tTeW50aGVzaXplci5ERUZBVUxUX1FVQUxJRklFUikpIHtcbiAgICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgICAnczM6KicsXG4gICAgICAgICAgXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufWAsXG4gICAgICAgICAgICBgJHt0aGlzLmJ1Y2tldEFybn0vKmAsXG4gICAgICAgICAgXSxcbiAgICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgICBuZXcgaWFtLkFyblByaW5jaXBhbChgYXJuOmF3czppYW06OiR7YWNjb3VudH06cm9sZS9jZGstJHtxdWFsaWZpZXJ9LWRlcGxveS1yb2xlLSR7YWNjb3VudH0tJHtyZWdpb259YCksXG4gICAgICAgICAgXSxcbiAgICAgICAgfSkpO1xuICAgICAgfVxuICAgIH1cblxuICAgIGlmIChidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVQpIHtcbiAgICAgIC8vIEFsbG93IEFMQiAvIE5MQiBsb2cgZGVsaXZlcnkgdG8gcHV0IG9iamVjdHMgKG5vIHJlYWQgb3IgbGlzdClcbiAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgcHJpbmNpcGFsczogW1xuICAgICAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbG9nZGVsaXZlcnkuZWxhc3RpY2xvYWRiYWxhbmNpbmcuYW1hem9uYXdzLmNvbScpLFxuICAgICAgICBdLFxuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufS9BV1NMb2dzLyR7YWNjb3VudH0vKmAsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEFsbG93IENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpIHRvIHdyaXRlIGxvZ3NcbiAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgcHJpbmNpcGFsczogW1xuICAgICAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnZGVsaXZlcnkubG9ncy5hbWF6b25hd3MuY29tJyksXG4gICAgICAgIF0sXG4gICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICAgICAgXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgICAgYCR7dGhpcy5idWNrZXRBcm59L0FXU0xvZ3MvJHthY2NvdW50fS8qYCxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcblxuICAgICAgLy8gQWxsb3cgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nIHRvIHdyaXRlIGxvZ3Mgd2hlbiByZXF1aXJlZCBieSBjb25maWd1cmF0aW9uXG4gICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2xvZ2dpbmcuczMuYW1hem9uYXdzLmNvbScpLFxuICAgICAgICBdLFxuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufS9BV1NMb2dzLyR7YWNjb3VudH0vKmAsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG4gICAgfVxuICB9XG59XG4iXX0=
+S3SecureBucket[_a] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.2.1" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBbUY7QUFDbkYsMkNBQTJDO0FBQzNDLHlDQUF5QztBQUN6Qyx5REFBK0Q7QUFHL0Q7Ozs7R0FJRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7OztPQUdHO0lBQ0gsbUNBQW1DLEVBQUUsa0NBQWtDO0lBQ3ZFOztPQUVHO0lBQ0gsd0JBQXdCLEVBQUUsd0JBQXdCO0lBQ2xEOztPQUVHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7T0FPRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtDQUM1QixDQUFDO0FBc0JYOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLGNBQWUsU0FBUSxFQUFFLENBQUMsTUFBTTtJQVkzQzs7Ozs7O09BTUc7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksMEJBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ2hCLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLHdCQUF3QixJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO29CQUN0SCxPQUFPLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLEVBQUUsVUFBVSxJQUFJLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUM7WUFDOUQsQ0FBQyxDQUFDLEVBQUU7WUFDSixhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ25CLElBQUksQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzFCLE9BQU8sRUFBRSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixrQkFBa0IsRUFBRSxTQUFTO1lBQzdCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ2xFLGVBQWUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDckIsSUFBSSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUM7b0JBQzNCLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFDL0IsQ0FBQztnQkFDRCxPQUFPLEVBQUUsQ0FBQyxlQUFlLENBQUMscUJBQXFCLENBQUM7WUFDbEQsQ0FBQyxDQUFDLEVBQUU7U0FDTCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQTRCLENBQUM7UUFDekQsSUFBSSxLQUFLLEVBQUUsa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLHVFQUF1RSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDdkMsTUFBTSxNQUFNLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDO1FBRXJDLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLG1DQUFtQyxFQUFFLENBQUM7WUFFMUUsTUFBTSxTQUFTLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDO1lBRWhFLElBQUksU0FBUyxJQUFJLENBQUMsU0FBUyxJQUFJLHFDQUF1QixDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztnQkFDMUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztvQkFDL0MsT0FBTyxFQUFFO3dCQUNQLE1BQU07cUJBQ1A7b0JBQ0QsU0FBUyxFQUFFO3dCQUNULEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRTt3QkFDbkIsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJO3FCQUN0QjtvQkFDRCxVQUFVLEVBQUU7d0JBQ1YsSUFBSSxHQUFHLENBQUMsWUFBWSxDQUFDLGdCQUFnQixPQUFPLGFBQWEsU0FBUyxnQkFBZ0IsT0FBTyxJQUFJLE1BQU0sRUFBRSxDQUFDO3FCQUN2RztpQkFDRixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxVQUFVLEtBQUssMEJBQWtCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN4RCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsWUFBWSxPQUFPLElBQUksQ0FBQztZQUV2RSxpR0FBaUc7WUFDakcsTUFBTSwwQkFBMEIsR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUNsRixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsZ0RBQWdELENBQUM7aUJBQzNFO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxxQkFBcUI7aUJBQ3RCO2FBQ0YsQ0FBQyxDQUFDLENBQUM7WUFFSixnR0FBZ0c7WUFDaEcsd0dBQXdHO1lBQ3hHLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzdCLE1BQU0sWUFBWSxHQUFHLG1CQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7Z0JBQ25ELENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLHNCQUFRLENBQUMsYUFBYSxDQUFDO2dCQUM1QyxDQUFDLENBQUMsd0JBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksQ0FBQztZQUM5QyxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUNqQixJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO29CQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO29CQUN4QixVQUFVLEVBQUU7d0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDO3FCQUN2QztvQkFDRCxPQUFPLEVBQUU7d0JBQ1AsY0FBYztxQkFDZjtvQkFDRCxTQUFTLEVBQUU7d0JBQ1QscUJBQXFCO3FCQUN0QjtpQkFDRixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7WUFFRCxJQUFJLENBQUMsK0JBQStCLEdBQUcsMEJBQTBCLENBQUMsZ0JBQWdCLElBQUksSUFBSSxDQUFDO1lBRTNGLHVEQUF1RDtZQUN2RCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsNkJBQTZCLENBQUM7aUJBQ3hEO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxxQkFBcUI7aUJBQ3RCO2FBQ0YsQ0FBQyxDQUFDLENBQUM7WUFFSiw4RUFBOEU7WUFDOUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDL0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFO29CQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLDBCQUEwQixDQUFDO2lCQUNyRDtnQkFDRCxPQUFPLEVBQUU7b0JBQ1AsY0FBYztpQkFDZjtnQkFDRCxTQUFTLEVBQUU7b0JBQ1QscUJBQXFCO2lCQUN0QjthQUNGLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQztJQUNILENBQUM7O0FBakpILHdDQWtKQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERlZmF1bHRTdGFja1N5bnRoZXNpemVyLCBSZW1vdmFsUG9saWN5LCBTdGFjaywgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHsgRmFjdE5hbWUsIFJlZ2lvbkluZm8gfSBmcm9tICdhd3MtY2RrLWxpYi9yZWdpb24taW5mbyc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QsIElEZXBlbmRhYmxlIH0gZnJvbSAnY29uc3RydWN0cyc7XG5cbi8qKlxuICogQnVja2V0IHR5cGUgZGlzY3JpbWluYXRvciB2YWx1ZXMgZm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9LlxuICpcbiAqIEBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX1cbiAqL1xuZXhwb3J0IGNvbnN0IFMzU2VjdXJlQnVja2V0VHlwZSA9IHtcbiAgLyoqXG4gICAqIFBpcGVsaW5lIGFydGlmYWN0IGJ1Y2tldCB3aGVuIHVzaW5nIGEgY3VzdG9tIENESyBib290c3RyYXAgcXVhbGlmaWVyXG4gICAqIChzaW5nbGUtIG9yIG11bHRpLXJlZ2lvbiBkZXBsb3ltZW50cykuXG4gICAqL1xuICBERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVDogJ0RlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0QnVja2V0JyxcbiAgLyoqXG4gICAqIE9yaWdpbiBidWNrZXQgZm9yIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9ucy5cbiAgICovXG4gIENMT1VERlJPTlRfT1JJR0lOX0JVQ0tFVDogJ0Nsb3VkRnJvbnRPcmlnaW5CdWNrZXQnLFxuICAvKipcbiAgICogR2VuZXJhbC1wdXJwb3NlIHNlY3VyZSBidWNrZXQgKGRlZmF1bHQgcXVhbGlmaWVyIC8gc3RhbmRhcmQgdXNlKS5cbiAgICovXG4gIERFRkFVTFRfQlVDS0VUOiAnRGVmYXVsdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBDZW50cmFsaXplZCBhY2Nlc3MgbG9ncyBmb3IgcHJvZHVjZXJzIHN1Y2ggYXMgQUxCL05MQiwgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MiksXG4gICAqIGFuZCBTMyBzZXJ2ZXIgYWNjZXNzIGxvZ2dpbmcuIEdyYW50cyBgczM6UHV0T2JqZWN0YCBvbiBgQVdTTG9ncy88YWNjb3VudD4vKmAgb25seSAobm8gcmVhZC9saXN0KS5cbiAgICpcbiAgICogRm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LCB0aGUgcmVnaW9uYWwgRUxCdjIgbG9nLWRlbGl2ZXJ5IGFjY291bnQgSURcbiAgICogKGxlZ2FjeSBwYXRoIGFsb25nc2lkZSB0aGUgbG9nIGRlbGl2ZXJ5IHNlcnZpY2UgcHJpbmNpcGFsKSBpcyByZXNvbHZlZCBmcm9tIGBhd3MtY2RrLWxpYi9yZWdpb24taW5mb2BcbiAgICogYXQgc3ludGhlc2lzIHRpbWUgd2hlbiB7QGxpbmsgU3RhY2sjcmVnaW9ufSBpcyBrbm93biwgb3IgdmlhIGEgZGVwbG95LXRpbWUgbWFwcGluZyB3aGVuIGl0IGlzIGEgdG9rZW4uXG4gICAqL1xuICBBQ0NFU1NfTE9HX0JVQ0tFVDogJ0FjY2Vzc0xvZ0J1Y2tldCcsXG59IGFzIGNvbnN0O1xuXG4vKipcbiAqIERpc2NyaW1pbmF0ZWQgdW5pb24gb2Yge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0gc3RyaW5nIGxpdGVyYWxzLlxuICovXG5leHBvcnQgdHlwZSBTM1NlY3VyZUJ1Y2tldFR5cGUgPSB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlW2tleW9mIHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVdO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfTsgc2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3QuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUzNTZWN1cmVCdWNrZXRQcm9wcyBleHRlbmRzIHMzLkJ1Y2tldFByb3BzIHtcblxuICAvKipcbiAgICogU2VsZWN0cyBlbmNyeXB0aW9uIGRlZmF1bHRzIGFuZCBvcHRpb25hbCByZXNvdXJjZS1wb2xpY3kgc3RhdGVtZW50cy5cbiAgICpcbiAgICogQGRlZmF1bHQge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERUZBVUxUX0JVQ0tFVH1cbiAgICovXG4gIHJlYWRvbmx5IGJ1Y2tldFR5cGU/OiBTM1NlY3VyZUJ1Y2tldFR5cGU7XG59XG5cbi8qKlxuICogUzMgYnVja2V0IHdpdGggb3BpbmlvbmF0ZWQgc2VjdXJlIGRlZmF1bHRzOiBwcml2YXRlIEFDTHMsIGJsb2NrIHB1YmxpYyBhY2Nlc3MsIFRMUy1vbmx5IGFjY2VzcyxcbiAqIGFuZCBlbmNyeXB0aW9uIChTMy1tYW5hZ2VkIGZvciBsb2cvb3JpZ2luIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVH06IG1heSBhdHRhY2ggYSBkZXBsb3ktcm9sZSBwb2xpY3kgd2hlbiBhIG5vbi1kZWZhdWx0IGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgcHJlc2VudC5cbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH06IGFkZHMgbG9nLXdyaXRlciBwcmluY2lwYWxzOyBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0gYW5kIHtAbGluayBTM1NlY3VyZUJ1Y2tldCNhY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlfS5cbiAqL1xuZXhwb3J0IGNsYXNzIFMzU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgLyoqXG4gICAqIFNldCBvbmx5IHdoZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gaXMge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqIFVzZSBhcyBhIGRlcGVuZGVuY3kgdGFyZ2V0IHNvIGxvYWQgYmFsYW5jZXIgYWNjZXNzLWxvZyBlbmFibGVtZW50IHJ1bnMgYWZ0ZXIgdGhlIGJ1Y2tldCBwb2xpY3lcbiAgICogZXhpc3RzIChFTEIgcGVyZm9ybXMgYW4gaW1tZWRpYXRlIHZhbGlkYXRpb24gYFB1dE9iamVjdGAgdGhhdCBmYWlscyBpZiB0aGUgcG9saWN5IGlzIG5vdCBhcHBsaWVkIHlldCkuXG4gICAqXG4gICAqIEV4YW1wbGU6IGBsb2FkQmFsYW5jZXIubm9kZS5hZGREZXBlbmRlbmN5KGJ1Y2tldC5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlISlgLlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgd2hlbiBgYnVja2V0VHlwZWAgaXMgbm90IHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcblxuICAvKipcbiAgICogQ3JlYXRlcyBhIHNlY3VyZSBTMyBidWNrZXQgYWNjb3JkaW5nIHRvIGBidWNrZXRUeXBlYCBhbmQgbWVyZ2VkIGBwcm9wc2AuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSAtIFBhcmVudCBjb25zdHJ1Y3QsIHR5cGljYWxseSBhIHtAbGluayBTdGFja30uXG4gICAqIEBwYXJhbSBpZCAtIENvbnN0cnVjdCBJRCAoc3RhYmxlIGxvZ2ljYWwgSUQgc2VnbWVudCkuXG4gICAqIEBwYXJhbSBwcm9wcyAtIE9wdGlvbmFsIHtAbGluayBzMy5CdWNrZXRQcm9wc30gcGx1cyB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfSBhbmQgYGV2ZW50QnJpZGdlRW5hYmxlZGAgKGFwcGxpZWQgdmlhIEwxIG92ZXJyaWRlIHdoZW4gdHJ1ZSkuXG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wcz86IFMzU2VjdXJlQnVja2V0UHJvcHMpIHtcbiAgICBjb25zdCBidWNrZXRUeXBlID0gcHJvcHM/LmJ1Y2tldFR5cGUgfHwgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUO1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LlJFVEFJTixcbiAgICAgIGVuY3J5cHRpb246ICgoKSA9PiB7XG4gICAgICAgIGlmIChidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUIHx8IGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQ7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzPy5lbmNyeXB0aW9uIHx8IHMzLkJ1Y2tldEVuY3J5cHRpb24uS01TX01BTkFHRUQ7XG4gICAgICB9KSgpLFxuICAgICAgYWNjZXNzQ29udHJvbDogKCgpID0+IHtcbiAgICAgICAgaWYgKCFwcm9wcz8uYWNjZXNzQ29udHJvbCkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRBY2Nlc3NDb250cm9sLlBSSVZBVEU7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzLmFjY2Vzc0NvbnRyb2w7XG4gICAgICB9KSgpLFxuICAgICAgZXZlbnRCcmlkZ2VFbmFibGVkOiB1bmRlZmluZWQsXG4gICAgICBwdWJsaWNSZWFkQWNjZXNzOiBmYWxzZSxcbiAgICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgICAgdmVyc2lvbmVkOiBwcm9wcz8udmVyc2lvbmVkICE9PSB1bmRlZmluZWQgPyBwcm9wcy52ZXJzaW9uZWQgOiB0cnVlLFxuICAgICAgb2JqZWN0T3duZXJzaGlwOiAoKCkgPT4ge1xuICAgICAgICBpZiAocHJvcHM/Lm9iamVjdE93bmVyc2hpcCkge1xuICAgICAgICAgIHJldHVybiBwcm9wcy5vYmplY3RPd25lcnNoaXA7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHMzLk9iamVjdE93bmVyc2hpcC5CVUNLRVRfT1dORVJfRU5GT1JDRUQ7XG4gICAgICB9KSgpLFxuICAgIH0pO1xuXG4gICAgY29uc3QgY2ZuQnVja2V0ID0gdGhpcy5ub2RlLmRlZmF1bHRDaGlsZCBhcyBzMy5DZm5CdWNrZXQ7XG4gICAgaWYgKHByb3BzPy5ldmVudEJyaWRnZUVuYWJsZWQgPT09IHRydWUpIHtcbiAgICAgIGNmbkJ1Y2tldC5hZGRQcm9wZXJ0eU92ZXJyaWRlKCdOb3RpZmljYXRpb25Db25maWd1cmF0aW9uLkV2ZW50QnJpZGdlQ29uZmlndXJhdGlvbi5FdmVudEJyaWRnZUVuYWJsZWQnLCB0cnVlKTtcbiAgICB9XG5cbiAgICBjb25zdCBhY2NvdW50ID0gU3RhY2sub2YodGhpcykuYWNjb3VudDtcbiAgICBjb25zdCByZWdpb24gPSBTdGFjay5vZih0aGlzKS5yZWdpb247XG5cbiAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUKSB7XG5cbiAgICAgIGNvbnN0IHF1YWxpZmllciA9IFN0YWNrLm9mKHRoaXMpLnN5bnRoZXNpemVyLmJvb3RzdHJhcFF1YWxpZmllcjtcblxuICAgICAgaWYgKHF1YWxpZmllciAmJiAocXVhbGlmaWVyICE9IERlZmF1bHRTdGFja1N5bnRoZXNpemVyLkRFRkFVTFRfUVVBTElGSUVSKSkge1xuICAgICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAgICdzMzoqJyxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgICAgYCR7dGhpcy5idWNrZXRBcm59YCxcbiAgICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufS8qYCxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQXJuUHJpbmNpcGFsKGBhcm46YXdzOmlhbTo6JHthY2NvdW50fTpyb2xlL2Nkay0ke3F1YWxpZmllcn0tZGVwbG95LXJvbGUtJHthY2NvdW50fS0ke3JlZ2lvbn1gKSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgICAgY29uc3QgYXdzTG9nc1ByZWZpeFJlc291cmNlID0gYCR7dGhpcy5idWNrZXRBcm59L0FXU0xvZ3MvJHthY2NvdW50fS8qYDtcblxuICAgICAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICAgICAgY29uc3QgYWxiTG9nRGVsaXZlcnlQb2xpY3lSZXN1bHQgPSB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2xvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEluIG5vbuKAk29wdC1pbiByZWdpb25zIChmb3IgZXhhbXBsZSBhcC1ub3J0aGVhc3QtMSksIGFjY2VzcyBsb2dzIGFyZSBvZnRlbiBkZWxpdmVyZWQgdXNpbmcgdGhlXG4gICAgICAvLyByZWdpb25hbCBFTEJ2MiBhY2NvdW50IChyb290IG9mIHRoYXQgYWNjb3VudCkgZm9yIHMzOlB1dE9iamVjdCwgbm90IG9ubHkgdGhlIHNlcnZpY2UgcHJpbmNpcGFsIGFib3ZlLlxuICAgICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZih0aGlzKTtcbiAgICAgIGNvbnN0IGVsYkFjY291bnRJZCA9IFRva2VuLmlzVW5yZXNvbHZlZChzdGFjay5yZWdpb24pXG4gICAgICAgID8gc3RhY2sucmVnaW9uYWxGYWN0KEZhY3ROYW1lLkVMQlYyX0FDQ09VTlQpXG4gICAgICAgIDogUmVnaW9uSW5mby5nZXQoc3RhY2sucmVnaW9uKS5lbGJ2MkFjY291bnQ7XG4gICAgICBpZiAoZWxiQWNjb3VudElkKSB7XG4gICAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQWNjb3VudFByaW5jaXBhbChlbGJBY2NvdW50SWQpLFxuICAgICAgICAgIF0sXG4gICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgICAgXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG5cbiAgICAgIHRoaXMuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZSA9IGFsYkxvZ0RlbGl2ZXJ5UG9saWN5UmVzdWx0LnBvbGljeURlcGVuZGFibGUgPz8gdGhpcztcblxuICAgICAgLy8gQWxsb3cgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MikgdG8gd3JpdGUgbG9nc1xuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdkZWxpdmVyeS5sb2dzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dnaW5nLnMzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG4gICAgfVxuICB9XG59XG4iXX0=

package/package.json

@@ -79,7 +79,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.6",
+  "version": "0.2.1",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [