s3-secure-bucket 0.2.4 → 0.3.0

package/.jsii

@@ -8435,7 +8435,7 @@
       }
     }
   },
-  "description": "s3-secure-bucket",
+  "description": "S3 Secure Bucket is a construct that creates a secure bucket with encryption, logging, and other security features.",
   "docs": {
     "stability": "stable"
   },
@@ -8455,7 +8455,7 @@
   },
   "name": "s3-secure-bucket",
   "readme": {
-    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` for pipeline artifacts, CloudFront origins, and centralized access logs so encryption and bucket policies match each workload.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET` and `CLOUDFRONT_ORIGIN_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- **`bucketType` presets**\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, and `lifecycleRules` work as usual alongside the secure defaults.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)\n- **`bucketType` presets**\n  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)\n  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### CDK deployment pipeline artifact bucket\n\nWhen the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {\n  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,\n});\n```\n\n### CloudFront origin bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst originBucket = new S3SecureBucket(stack, 'OriginBucket', {\n  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,\n});\n```\n\nWire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n### CloudWatch Logs export archive bucket\n\nStore log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {\n  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,\n});\n```\n\nFor cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |\n| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8473,11 +8473,11 @@
       "base": "aws-cdk-lib.aws_s3.Bucket",
       "docs": {
         "custom": {
-          "remarks": "- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET } and {@link S3SecureBucket#accessLogBucketPolicyDependable }."
+          "remarks": "- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET } and {@link S3SecureBucket#accessLogBucketPolicyDependable }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
         },
         "remarks": "KMS-managed by default otherwise).",
         "stability": "stable",
-        "summary": "S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin types;"
+        "summary": "S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin/archive types;"
       },
       "fqn": "s3-secure-bucket.S3SecureBucket",
       "initializer": {
@@ -8487,7 +8487,7 @@
         },
         "locationInModule": {
           "filename": "src/index.ts",
-          "line": 84
+          "line": 91
         },
         "parameters": [
           {
@@ -8523,7 +8523,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/index.ts",
-        "line": 65
+        "line": 72
       },
       "name": "S3SecureBucket",
       "properties": [
@@ -8537,7 +8537,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 75
+            "line": 82
           },
           "name": "accessLogBucketPolicyDependable",
           "optional": true,
@@ -8563,7 +8563,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/index.ts",
-        "line": 47
+        "line": 53
       },
       "name": "S3SecureBucketProps",
       "properties": [
@@ -8577,7 +8577,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/index.ts",
-            "line": 54
+            "line": 60
           },
           "name": "bucketType",
           "optional": true,
@@ -8589,6 +8589,6 @@
       "symbolId": "src/index:S3SecureBucketProps"
     }
   },
-  "version": "0.2.4",
-  "fingerprint": "7IGHq3dhaFEcE1v9WBKumAZeMCgEoSpNElud72qbXuo="
+  "version": "0.3.0",
+  "fingerprint": "hhQPJW81zI62o3lJ6Mcst9S+cY6VwNfDUiiyJpk0LRI="
 }

package/API.md

@@ -4,7 +4,7 @@
 
 ### S3SecureBucket <a name="S3SecureBucket" id="s3-secure-bucket.S3SecureBucket"></a>
 
-S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin types;
+S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access, and encryption (S3-managed for log/origin/archive types;
 
 KMS-managed by default otherwise).
 

package/README.md

@@ -6,19 +6,22 @@
 [![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)
 [![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)
 
-AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` for pipeline artifacts, CloudFront origins, and centralized access logs so encryption and bucket policies match each workload.
+AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.
 
 ## Features
 
 - Private access, block public access, and deny insecure transport (`enforceSSL`)
 - **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden
-- **Log / origin types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET` and `CLOUDFRONT_ORIGIN_BUCKET`
+- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`
 - Versioning on by default; object ownership `BucketOwnerEnforced` by default
 - `RemovalPolicy.RETAIN` on the bucket
+- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)
 - **`bucketType` presets**
+  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)
   - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier
-  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical origin use
+  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use
   - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)
+  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)
 - **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)
 
 ## Installation
@@ -50,9 +53,39 @@ const bucket = new S3SecureBucket(stack, 'S3SecureBucket', {
 });
 ```
 
+### CDK deployment pipeline artifact bucket
+
+When the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.
+
+```typescript
+import { Stack } from 'aws-cdk-lib';
+import { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';
+
+declare const stack: Stack;
+
+const artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {
+  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,
+});
+```
+
+### CloudFront origin bucket
+
+```typescript
+import { Stack } from 'aws-cdk-lib';
+import { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';
+
+declare const stack: Stack;
+
+const originBucket = new S3SecureBucket(stack, 'OriginBucket', {
+  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,
+});
+```
+
+Wire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.
+
 ### Centralized access log bucket (ALB / NLB / CloudFront / S3)
 
-For `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved.
+For `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.
 
 ```typescript
 import { Stack } from 'aws-cdk-lib';
@@ -71,9 +104,26 @@ const accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {
 
 Wire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.
 
+### CloudWatch Logs export archive bucket
+
+Store log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.
+
+```typescript
+import { Stack } from 'aws-cdk-lib';
+import { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';
+
+declare const stack: Stack;
+
+const logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {
+  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,
+});
+```
+
+For cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).
+
 ## Options
 
-`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, and `lifecycleRules` work as usual alongside the secure defaults.
+`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.
 
 ### Construct props (`S3SecureBucketProps`)
 
@@ -87,9 +137,10 @@ Wire logging on the load balancer using your normal approach (for example L1 att
 | Constant | Use case |
 | --- | --- |
 | `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |
-| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |
 | `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |
 | `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |
+| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |
+| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |
 
 ### Read-only: `accessLogBucketPolicyDependable`
 

package/lib/index.d.ts

@@ -28,6 +28,12 @@ export declare const S3SecureBucketType: {
      * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
      */
     readonly ACCESS_LOG_BUCKET: "AccessLogBucket";
+    /**
+     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
+     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
+     * stack account and region (see AWS docs for cross-account export).
+     */
+    readonly CLOUD_WATCH_LOG_ARCHIVE_BUCKET: "CloudWatchLogArchiveBucket";
 };
 /**
  * Discriminated union of {@link S3SecureBucketType} string literals.
@@ -48,11 +54,12 @@ export interface S3SecureBucketProps extends s3.BucketProps {
 }
 /**
  * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
- * and encryption (S3-managed for log/origin types; KMS-managed by default otherwise).
+ * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
  *
  * @remarks
  * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
  * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
  */
 export declare class S3SecureBucket extends s3.Bucket {
     /**

package/lib/index.js

@@ -35,14 +35,21 @@ exports.S3SecureBucketType = {
      * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
      */
     ACCESS_LOG_BUCKET: 'AccessLogBucket',
+    /**
+     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
+     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
+     * stack account and region (see AWS docs for cross-account export).
+     */
+    CLOUD_WATCH_LOG_ARCHIVE_BUCKET: 'CloudWatchLogArchiveBucket',
 };
 /**
  * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
- * and encryption (S3-managed for log/origin types; KMS-managed by default otherwise).
+ * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
  *
  * @remarks
  * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
  * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
  */
 class S3SecureBucket extends s3.Bucket {
     /**
@@ -58,7 +65,9 @@ class S3SecureBucket extends s3.Bucket {
             ...props,
             removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
             encryption: (() => {
-                if (bucketType === exports.S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET || bucketType === exports.S3SecureBucketType.ACCESS_LOG_BUCKET) {
+                if (bucketType === exports.S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET
+                    || bucketType === exports.S3SecureBucketType.ACCESS_LOG_BUCKET
+                    || bucketType === exports.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
                     return s3.BucketEncryption.S3_MANAGED;
                 }
                 return props?.encryption || s3.BucketEncryption.KMS_MANAGED;
@@ -167,9 +176,44 @@ class S3SecureBucket extends s3.Bucket {
                 ],
             }));
         }
+        if (bucketType === exports.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
+            const logsExportPrincipal = new iam.ServicePrincipal(`logs.${region}.amazonaws.com`);
+            const sourceLogGroupArn = `arn:aws:logs:${region}:${account}:log-group:*`;
+            this.addToResourcePolicy(new iam.PolicyStatement({
+                sid: 'AllowCloudWatchLogsExportGetBucketAcl',
+                effect: iam.Effect.ALLOW,
+                principals: [logsExportPrincipal],
+                actions: ['s3:GetBucketAcl'],
+                resources: [this.bucketArn],
+                conditions: {
+                    StringEquals: {
+                        'aws:SourceAccount': [account],
+                    },
+                    ArnLike: {
+                        'aws:SourceArn': [sourceLogGroupArn],
+                    },
+                },
+            }));
+            this.addToResourcePolicy(new iam.PolicyStatement({
+                sid: 'AllowCloudWatchLogsExportPutObject',
+                effect: iam.Effect.ALLOW,
+                principals: [logsExportPrincipal],
+                actions: ['s3:PutObject'],
+                resources: [`${this.bucketArn}/*`],
+                conditions: {
+                    StringEquals: {
+                        's3:x-amz-acl': 'bucket-owner-full-control',
+                        'aws:SourceAccount': [account],
+                    },
+                    ArnLike: {
+                        'aws:SourceArn': [sourceLogGroupArn],
+                    },
+                },
+            }));
+        }
     }
 }
 exports.S3SecureBucket = S3SecureBucket;
 _a = JSII_RTTI_SYMBOL_1;
-S3SecureBucket[_a] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.2.4" };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBbUY7QUFDbkYsMkNBQTJDO0FBQzNDLHlDQUF5QztBQUN6Qyx5REFBK0Q7QUFHL0Q7Ozs7R0FJRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7OztPQUdHO0lBQ0gsbUNBQW1DLEVBQUUsa0NBQWtDO0lBQ3ZFOztPQUVHO0lBQ0gsd0JBQXdCLEVBQUUsd0JBQXdCO0lBQ2xEOztPQUVHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7T0FPRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtDQUM1QixDQUFDO0FBc0JYOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLGNBQWUsU0FBUSxFQUFFLENBQUMsTUFBTTtJQVkzQzs7Ozs7O09BTUc7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksMEJBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ2hCLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLHdCQUF3QixJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO29CQUN0SCxPQUFPLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLEVBQUUsVUFBVSxJQUFJLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUM7WUFDOUQsQ0FBQyxDQUFDLEVBQUU7WUFDSixhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ25CLElBQUksQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzFCLE9BQU8sRUFBRSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixrQkFBa0IsRUFBRSxTQUFTO1lBQzdCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ2xFLGVBQWUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDckIsSUFBSSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUM7b0JBQzNCLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFDL0IsQ0FBQztnQkFDRCxPQUFPLEVBQUUsQ0FBQyxlQUFlLENBQUMscUJBQXFCLENBQUM7WUFDbEQsQ0FBQyxDQUFDLEVBQUU7U0FDTCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQTRCLENBQUM7UUFDekQsSUFBSSxLQUFLLEVBQUUsa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLHVFQUF1RSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDdkMsTUFBTSxNQUFNLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDO1FBRXJDLElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLG1DQUFtQyxFQUFFLENBQUM7WUFFMUUsTUFBTSxTQUFTLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDO1lBRWhFLElBQUksU0FBUyxJQUFJLENBQUMsU0FBUyxJQUFJLHFDQUF1QixDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztnQkFDMUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztvQkFDL0MsT0FBTyxFQUFFO3dCQUNQLE1BQU07cUJBQ1A7b0JBQ0QsU0FBUyxFQUFFO3dCQUNULEdBQUcsSUFBSSxDQUFDLFNBQVMsRUFBRTt3QkFDbkIsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJO3FCQUN0QjtvQkFDRCxVQUFVLEVBQUU7d0JBQ1YsSUFBSSxHQUFHLENBQUMsWUFBWSxDQUFDLGdCQUFnQixPQUFPLGFBQWEsU0FBUyxnQkFBZ0IsT0FBTyxJQUFJLE1BQU0sRUFBRSxDQUFDO3FCQUN2RztpQkFDRixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7UUFDSCxDQUFDO1FBRUQsSUFBSSxVQUFVLEtBQUssMEJBQWtCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN4RCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsWUFBWSxPQUFPLElBQUksQ0FBQztZQUV2RSxpR0FBaUc7WUFDakcsTUFBTSwwQkFBMEIsR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUNsRixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsZ0RBQWdELENBQUM7aUJBQzNFO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxxQkFBcUI7aUJBQ3RCO2FBQ0YsQ0FBQyxDQUFDLENBQUM7WUFFSixnR0FBZ0c7WUFDaEcsd0dBQXdHO1lBQ3hHLE1BQU0sS0FBSyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzdCLE1BQU0sWUFBWSxHQUFHLG1CQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7Z0JBQ25ELENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLHNCQUFRLENBQUMsYUFBYSxDQUFDO2dCQUM1QyxDQUFDLENBQUMsd0JBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksQ0FBQztZQUM5QyxJQUFJLFlBQVksRUFBRSxDQUFDO2dCQUNqQixJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO29CQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO29CQUN4QixVQUFVLEVBQUU7d0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDO3FCQUN2QztvQkFDRCxPQUFPLEVBQUU7d0JBQ1AsY0FBYztxQkFDZjtvQkFDRCxTQUFTLEVBQUU7d0JBQ1QscUJBQXFCO3FCQUN0QjtpQkFDRixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7WUFFRCxJQUFJLENBQUMsK0JBQStCLEdBQUcsMEJBQTBCLENBQUMsZ0JBQWdCLElBQUksSUFBSSxDQUFDO1lBRTNGLHVEQUF1RDtZQUN2RCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsNkJBQTZCLENBQUM7aUJBQ3hEO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxxQkFBcUI7aUJBQ3RCO2FBQ0YsQ0FBQyxDQUFDLENBQUM7WUFFSiw4RUFBOEU7WUFDOUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDL0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFO29CQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLDBCQUEwQixDQUFDO2lCQUNyRDtnQkFDRCxPQUFPLEVBQUU7b0JBQ1AsY0FBYztpQkFDZjtnQkFDRCxTQUFTLEVBQUU7b0JBQ1QscUJBQXFCO2lCQUN0QjthQUNGLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQztJQUNILENBQUM7O0FBakpILHdDQWtKQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IERlZmF1bHRTdGFja1N5bnRoZXNpemVyLCBSZW1vdmFsUG9saWN5LCBTdGFjaywgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHsgRmFjdE5hbWUsIFJlZ2lvbkluZm8gfSBmcm9tICdhd3MtY2RrLWxpYi9yZWdpb24taW5mbyc7XG5pbXBvcnQgeyBDb25zdHJ1Y3QsIElEZXBlbmRhYmxlIH0gZnJvbSAnY29uc3RydWN0cyc7XG5cbi8qKlxuICogQnVja2V0IHR5cGUgZGlzY3JpbWluYXRvciB2YWx1ZXMgZm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9LlxuICpcbiAqIEBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX1cbiAqL1xuZXhwb3J0IGNvbnN0IFMzU2VjdXJlQnVja2V0VHlwZSA9IHtcbiAgLyoqXG4gICAqIFBpcGVsaW5lIGFydGlmYWN0IGJ1Y2tldCB3aGVuIHVzaW5nIGEgY3VzdG9tIENESyBib290c3RyYXAgcXVhbGlmaWVyXG4gICAqIChzaW5nbGUtIG9yIG11bHRpLXJlZ2lvbiBkZXBsb3ltZW50cykuXG4gICAqL1xuICBERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVDogJ0RlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0QnVja2V0JyxcbiAgLyoqXG4gICAqIE9yaWdpbiBidWNrZXQgZm9yIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9ucy5cbiAgICovXG4gIENMT1VERlJPTlRfT1JJR0lOX0JVQ0tFVDogJ0Nsb3VkRnJvbnRPcmlnaW5CdWNrZXQnLFxuICAvKipcbiAgICogR2VuZXJhbC1wdXJwb3NlIHNlY3VyZSBidWNrZXQgKGRlZmF1bHQgcXVhbGlmaWVyIC8gc3RhbmRhcmQgdXNlKS5cbiAgICovXG4gIERFRkFVTFRfQlVDS0VUOiAnRGVmYXVsdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBDZW50cmFsaXplZCBhY2Nlc3MgbG9ncyBmb3IgcHJvZHVjZXJzIHN1Y2ggYXMgQUxCL05MQiwgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MiksXG4gICAqIGFuZCBTMyBzZXJ2ZXIgYWNjZXNzIGxvZ2dpbmcuIEdyYW50cyBgczM6UHV0T2JqZWN0YCBvbiBgQVdTTG9ncy88YWNjb3VudD4vKmAgb25seSAobm8gcmVhZC9saXN0KS5cbiAgICpcbiAgICogRm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LCB0aGUgcmVnaW9uYWwgRUxCdjIgbG9nLWRlbGl2ZXJ5IGFjY291bnQgSURcbiAgICogKGxlZ2FjeSBwYXRoIGFsb25nc2lkZSB0aGUgbG9nIGRlbGl2ZXJ5IHNlcnZpY2UgcHJpbmNpcGFsKSBpcyByZXNvbHZlZCBmcm9tIGBhd3MtY2RrLWxpYi9yZWdpb24taW5mb2BcbiAgICogYXQgc3ludGhlc2lzIHRpbWUgd2hlbiB7QGxpbmsgU3RhY2sjcmVnaW9ufSBpcyBrbm93biwgb3IgdmlhIGEgZGVwbG95LXRpbWUgbWFwcGluZyB3aGVuIGl0IGlzIGEgdG9rZW4uXG4gICAqL1xuICBBQ0NFU1NfTE9HX0JVQ0tFVDogJ0FjY2Vzc0xvZ0J1Y2tldCcsXG59IGFzIGNvbnN0O1xuXG4vKipcbiAqIERpc2NyaW1pbmF0ZWQgdW5pb24gb2Yge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0gc3RyaW5nIGxpdGVyYWxzLlxuICovXG5leHBvcnQgdHlwZSBTM1NlY3VyZUJ1Y2tldFR5cGUgPSB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlW2tleW9mIHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVdO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfTsgc2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3QuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUzNTZWN1cmVCdWNrZXRQcm9wcyBleHRlbmRzIHMzLkJ1Y2tldFByb3BzIHtcblxuICAvKipcbiAgICogU2VsZWN0cyBlbmNyeXB0aW9uIGRlZmF1bHRzIGFuZCBvcHRpb25hbCByZXNvdXJjZS1wb2xpY3kgc3RhdGVtZW50cy5cbiAgICpcbiAgICogQGRlZmF1bHQge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERUZBVUxUX0JVQ0tFVH1cbiAgICovXG4gIHJlYWRvbmx5IGJ1Y2tldFR5cGU/OiBTM1NlY3VyZUJ1Y2tldFR5cGU7XG59XG5cbi8qKlxuICogUzMgYnVja2V0IHdpdGggb3BpbmlvbmF0ZWQgc2VjdXJlIGRlZmF1bHRzOiBwcml2YXRlIEFDTHMsIGJsb2NrIHB1YmxpYyBhY2Nlc3MsIFRMUy1vbmx5IGFjY2VzcyxcbiAqIGFuZCBlbmNyeXB0aW9uIChTMy1tYW5hZ2VkIGZvciBsb2cvb3JpZ2luIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVH06IG1heSBhdHRhY2ggYSBkZXBsb3ktcm9sZSBwb2xpY3kgd2hlbiBhIG5vbi1kZWZhdWx0IGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgcHJlc2VudC5cbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH06IGFkZHMgbG9nLXdyaXRlciBwcmluY2lwYWxzOyBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0gYW5kIHtAbGluayBTM1NlY3VyZUJ1Y2tldCNhY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlfS5cbiAqL1xuZXhwb3J0IGNsYXNzIFMzU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgLyoqXG4gICAqIFNldCBvbmx5IHdoZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gaXMge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqIFVzZSBhcyBhIGRlcGVuZGVuY3kgdGFyZ2V0IHNvIGxvYWQgYmFsYW5jZXIgYWNjZXNzLWxvZyBlbmFibGVtZW50IHJ1bnMgYWZ0ZXIgdGhlIGJ1Y2tldCBwb2xpY3lcbiAgICogZXhpc3RzIChFTEIgcGVyZm9ybXMgYW4gaW1tZWRpYXRlIHZhbGlkYXRpb24gYFB1dE9iamVjdGAgdGhhdCBmYWlscyBpZiB0aGUgcG9saWN5IGlzIG5vdCBhcHBsaWVkIHlldCkuXG4gICAqXG4gICAqIEV4YW1wbGU6IGBsb2FkQmFsYW5jZXIubm9kZS5hZGREZXBlbmRlbmN5KGJ1Y2tldC5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlISlgLlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgd2hlbiBgYnVja2V0VHlwZWAgaXMgbm90IHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcblxuICAvKipcbiAgICogQ3JlYXRlcyBhIHNlY3VyZSBTMyBidWNrZXQgYWNjb3JkaW5nIHRvIGBidWNrZXRUeXBlYCBhbmQgbWVyZ2VkIGBwcm9wc2AuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSAtIFBhcmVudCBjb25zdHJ1Y3QsIHR5cGljYWxseSBhIHtAbGluayBTdGFja30uXG4gICAqIEBwYXJhbSBpZCAtIENvbnN0cnVjdCBJRCAoc3RhYmxlIGxvZ2ljYWwgSUQgc2VnbWVudCkuXG4gICAqIEBwYXJhbSBwcm9wcyAtIE9wdGlvbmFsIHtAbGluayBzMy5CdWNrZXRQcm9wc30gcGx1cyB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfSBhbmQgYGV2ZW50QnJpZGdlRW5hYmxlZGAgKGFwcGxpZWQgdmlhIEwxIG92ZXJyaWRlIHdoZW4gdHJ1ZSkuXG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wcz86IFMzU2VjdXJlQnVja2V0UHJvcHMpIHtcbiAgICBjb25zdCBidWNrZXRUeXBlID0gcHJvcHM/LmJ1Y2tldFR5cGUgfHwgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUO1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LlJFVEFJTixcbiAgICAgIGVuY3J5cHRpb246ICgoKSA9PiB7XG4gICAgICAgIGlmIChidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUIHx8IGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQ7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzPy5lbmNyeXB0aW9uIHx8IHMzLkJ1Y2tldEVuY3J5cHRpb24uS01TX01BTkFHRUQ7XG4gICAgICB9KSgpLFxuICAgICAgYWNjZXNzQ29udHJvbDogKCgpID0+IHtcbiAgICAgICAgaWYgKCFwcm9wcz8uYWNjZXNzQ29udHJvbCkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRBY2Nlc3NDb250cm9sLlBSSVZBVEU7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzLmFjY2Vzc0NvbnRyb2w7XG4gICAgICB9KSgpLFxuICAgICAgZXZlbnRCcmlkZ2VFbmFibGVkOiB1bmRlZmluZWQsXG4gICAgICBwdWJsaWNSZWFkQWNjZXNzOiBmYWxzZSxcbiAgICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgICAgdmVyc2lvbmVkOiBwcm9wcz8udmVyc2lvbmVkICE9PSB1bmRlZmluZWQgPyBwcm9wcy52ZXJzaW9uZWQgOiB0cnVlLFxuICAgICAgb2JqZWN0T3duZXJzaGlwOiAoKCkgPT4ge1xuICAgICAgICBpZiAocHJvcHM/Lm9iamVjdE93bmVyc2hpcCkge1xuICAgICAgICAgIHJldHVybiBwcm9wcy5vYmplY3RPd25lcnNoaXA7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHMzLk9iamVjdE93bmVyc2hpcC5CVUNLRVRfT1dORVJfRU5GT1JDRUQ7XG4gICAgICB9KSgpLFxuICAgIH0pO1xuXG4gICAgY29uc3QgY2ZuQnVja2V0ID0gdGhpcy5ub2RlLmRlZmF1bHRDaGlsZCBhcyBzMy5DZm5CdWNrZXQ7XG4gICAgaWYgKHByb3BzPy5ldmVudEJyaWRnZUVuYWJsZWQgPT09IHRydWUpIHtcbiAgICAgIGNmbkJ1Y2tldC5hZGRQcm9wZXJ0eU92ZXJyaWRlKCdOb3RpZmljYXRpb25Db25maWd1cmF0aW9uLkV2ZW50QnJpZGdlQ29uZmlndXJhdGlvbi5FdmVudEJyaWRnZUVuYWJsZWQnLCB0cnVlKTtcbiAgICB9XG5cbiAgICBjb25zdCBhY2NvdW50ID0gU3RhY2sub2YodGhpcykuYWNjb3VudDtcbiAgICBjb25zdCByZWdpb24gPSBTdGFjay5vZih0aGlzKS5yZWdpb247XG5cbiAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUKSB7XG5cbiAgICAgIGNvbnN0IHF1YWxpZmllciA9IFN0YWNrLm9mKHRoaXMpLnN5bnRoZXNpemVyLmJvb3RzdHJhcFF1YWxpZmllcjtcblxuICAgICAgaWYgKHF1YWxpZmllciAmJiAocXVhbGlmaWVyICE9IERlZmF1bHRTdGFja1N5bnRoZXNpemVyLkRFRkFVTFRfUVVBTElGSUVSKSkge1xuICAgICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAgICdzMzoqJyxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgICAgYCR7dGhpcy5idWNrZXRBcm59YCxcbiAgICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufS8qYCxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQXJuUHJpbmNpcGFsKGBhcm46YXdzOmlhbTo6JHthY2NvdW50fTpyb2xlL2Nkay0ke3F1YWxpZmllcn0tZGVwbG95LXJvbGUtJHthY2NvdW50fS0ke3JlZ2lvbn1gKSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgICAgY29uc3QgYXdzTG9nc1ByZWZpeFJlc291cmNlID0gYCR7dGhpcy5idWNrZXRBcm59L0FXU0xvZ3MvJHthY2NvdW50fS8qYDtcblxuICAgICAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICAgICAgY29uc3QgYWxiTG9nRGVsaXZlcnlQb2xpY3lSZXN1bHQgPSB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2xvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEluIG5vbuKAk29wdC1pbiByZWdpb25zIChmb3IgZXhhbXBsZSBhcC1ub3J0aGVhc3QtMSksIGFjY2VzcyBsb2dzIGFyZSBvZnRlbiBkZWxpdmVyZWQgdXNpbmcgdGhlXG4gICAgICAvLyByZWdpb25hbCBFTEJ2MiBhY2NvdW50IChyb290IG9mIHRoYXQgYWNjb3VudCkgZm9yIHMzOlB1dE9iamVjdCwgbm90IG9ubHkgdGhlIHNlcnZpY2UgcHJpbmNpcGFsIGFib3ZlLlxuICAgICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZih0aGlzKTtcbiAgICAgIGNvbnN0IGVsYkFjY291bnRJZCA9IFRva2VuLmlzVW5yZXNvbHZlZChzdGFjay5yZWdpb24pXG4gICAgICAgID8gc3RhY2sucmVnaW9uYWxGYWN0KEZhY3ROYW1lLkVMQlYyX0FDQ09VTlQpXG4gICAgICAgIDogUmVnaW9uSW5mby5nZXQoc3RhY2sucmVnaW9uKS5lbGJ2MkFjY291bnQ7XG4gICAgICBpZiAoZWxiQWNjb3VudElkKSB7XG4gICAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQWNjb3VudFByaW5jaXBhbChlbGJBY2NvdW50SWQpLFxuICAgICAgICAgIF0sXG4gICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgICAgXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG5cbiAgICAgIHRoaXMuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZSA9IGFsYkxvZ0RlbGl2ZXJ5UG9saWN5UmVzdWx0LnBvbGljeURlcGVuZGFibGUgPz8gdGhpcztcblxuICAgICAgLy8gQWxsb3cgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MikgdG8gd3JpdGUgbG9nc1xuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdkZWxpdmVyeS5sb2dzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dnaW5nLnMzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG4gICAgfVxuICB9XG59XG4iXX0=
+S3SecureBucket[_a] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.3.0" };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7QUFBQSw2Q0FBbUY7QUFDbkYsMkNBQTJDO0FBQzNDLHlDQUF5QztBQUN6Qyx5REFBK0Q7QUFHL0Q7Ozs7R0FJRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7OztPQUdHO0lBQ0gsbUNBQW1DLEVBQUUsa0NBQWtDO0lBQ3ZFOztPQUVHO0lBQ0gsd0JBQXdCLEVBQUUsd0JBQXdCO0lBQ2xEOztPQUVHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7T0FPRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtJQUNwQzs7OztPQUlHO0lBQ0gsOEJBQThCLEVBQUUsNEJBQTRCO0NBQ3BELENBQUM7QUFzQlg7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFhLGNBQWUsU0FBUSxFQUFFLENBQUMsTUFBTTtJQVkzQzs7Ozs7O09BTUc7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksMEJBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ2hCLElBQ0UsVUFBVSxLQUFLLDBCQUFrQixDQUFDLHdCQUF3Qjt1QkFDdkQsVUFBVSxLQUFLLDBCQUFrQixDQUFDLGlCQUFpQjt1QkFDbkQsVUFBVSxLQUFLLDBCQUFrQixDQUFDLDhCQUE4QixFQUNuRSxDQUFDO29CQUNELE9BQU8sRUFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssRUFBRSxVQUFVLElBQUksRUFBRSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQztZQUM5RCxDQUFDLENBQUMsRUFBRTtZQUNKLGFBQWEsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDbkIsSUFBSSxDQUFDLEtBQUssRUFBRSxhQUFhLEVBQUUsQ0FBQztvQkFDMUIsT0FBTyxFQUFFLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDO2dCQUN4QyxDQUFDO2dCQUNELE9BQU8sS0FBSyxDQUFDLGFBQWEsQ0FBQztZQUM3QixDQUFDLENBQUMsRUFBRTtZQUNKLGtCQUFrQixFQUFFLFNBQVM7WUFDN0IsZ0JBQWdCLEVBQUUsS0FBSztZQUN2QixpQkFBaUIsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsU0FBUztZQUNqRCxVQUFVLEVBQUUsSUFBSTtZQUNoQixTQUFTLEVBQUUsS0FBSyxFQUFFLFNBQVMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDbEUsZUFBZSxFQUFFLENBQUMsR0FBRyxFQUFFO2dCQUNyQixJQUFJLEtBQUssRUFBRSxlQUFlLEVBQUUsQ0FBQztvQkFDM0IsT0FBTyxLQUFLLENBQUMsZUFBZSxDQUFDO2dCQUMvQixDQUFDO2dCQUNELE9BQU8sRUFBRSxDQUFDLGVBQWUsQ0FBQyxxQkFBcUIsQ0FBQztZQUNsRCxDQUFDLENBQUMsRUFBRTtTQUNMLENBQUMsQ0FBQztRQUVILE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBNEIsQ0FBQztRQUN6RCxJQUFJLEtBQUssRUFBRSxrQkFBa0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUN2QyxTQUFTLENBQUMsbUJBQW1CLENBQUMsdUVBQXVFLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDL0csQ0FBQztRQUVELE1BQU0sT0FBTyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUN2QyxNQUFNLE1BQU0sR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUM7UUFFckMsSUFBSSxVQUFVLEtBQUssMEJBQWtCLENBQUMsbUNBQW1DLEVBQUUsQ0FBQztZQUUxRSxNQUFNLFNBQVMsR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLENBQUMsa0JBQWtCLENBQUM7WUFFaEUsSUFBSSxTQUFTLElBQUksQ0FBQyxTQUFTLElBQUkscUNBQXVCLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO2dCQUMxRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO29CQUMvQyxPQUFPLEVBQUU7d0JBQ1AsTUFBTTtxQkFDUDtvQkFDRCxTQUFTLEVBQUU7d0JBQ1QsR0FBRyxJQUFJLENBQUMsU0FBUyxFQUFFO3dCQUNuQixHQUFHLElBQUksQ0FBQyxTQUFTLElBQUk7cUJBQ3RCO29CQUNELFVBQVUsRUFBRTt3QkFDVixJQUFJLEdBQUcsQ0FBQyxZQUFZLENBQUMsZ0JBQWdCLE9BQU8sYUFBYSxTQUFTLGdCQUFnQixPQUFPLElBQUksTUFBTSxFQUFFLENBQUM7cUJBQ3ZHO2lCQUNGLENBQUMsQ0FBQyxDQUFDO1lBQ04sQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3hELE1BQU0scUJBQXFCLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxZQUFZLE9BQU8sSUFBSSxDQUFDO1lBRXZFLGlHQUFpRztZQUNqRyxNQUFNLDBCQUEwQixHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQ2xGLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRTtvQkFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxnREFBZ0QsQ0FBQztpQkFDM0U7Z0JBQ0QsT0FBTyxFQUFFO29CQUNQLGNBQWM7aUJBQ2Y7Z0JBQ0QsU0FBUyxFQUFFO29CQUNULHFCQUFxQjtpQkFDdEI7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLGdHQUFnRztZQUNoRyx3R0FBd0c7WUFDeEcsTUFBTSxLQUFLLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDN0IsTUFBTSxZQUFZLEdBQUcsbUJBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztnQkFDbkQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsc0JBQVEsQ0FBQyxhQUFhLENBQUM7Z0JBQzVDLENBQUMsQ0FBQyx3QkFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsWUFBWSxDQUFDO1lBQzlDLElBQUksWUFBWSxFQUFFLENBQUM7Z0JBQ2pCLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7b0JBQy9DLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7b0JBQ3hCLFVBQVUsRUFBRTt3QkFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxZQUFZLENBQUM7cUJBQ3ZDO29CQUNELE9BQU8sRUFBRTt3QkFDUCxjQUFjO3FCQUNmO29CQUNELFNBQVMsRUFBRTt3QkFDVCxxQkFBcUI7cUJBQ3RCO2lCQUNGLENBQUMsQ0FBQyxDQUFDO1lBQ04sQ0FBQztZQUVELElBQUksQ0FBQywrQkFBK0IsR0FBRywwQkFBMEIsQ0FBQyxnQkFBZ0IsSUFBSSxJQUFJLENBQUM7WUFFM0YsdURBQXVEO1lBQ3ZELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQy9DLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRTtvQkFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyw2QkFBNkIsQ0FBQztpQkFDeEQ7Z0JBQ0QsT0FBTyxFQUFFO29CQUNQLGNBQWM7aUJBQ2Y7Z0JBQ0QsU0FBUyxFQUFFO29CQUNULHFCQUFxQjtpQkFDdEI7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLDhFQUE4RTtZQUM5RSxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUMvQyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUU7b0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsMEJBQTBCLENBQUM7aUJBQ3JEO2dCQUNELE9BQU8sRUFBRTtvQkFDUCxjQUFjO2lCQUNmO2dCQUNELFNBQVMsRUFBRTtvQkFDVCxxQkFBcUI7aUJBQ3RCO2FBQ0YsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO1FBRUQsSUFBSSxVQUFVLEtBQUssMEJBQWtCLENBQUMsOEJBQThCLEVBQUUsQ0FBQztZQUNyRSxNQUFNLG1CQUFtQixHQUFHLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsTUFBTSxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3JGLE1BQU0saUJBQWlCLEdBQUcsZ0JBQWdCLE1BQU0sSUFBSSxPQUFPLGNBQWMsQ0FBQztZQUUxRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO2dCQUMvQyxHQUFHLEVBQUUsdUNBQXVDO2dCQUM1QyxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO2dCQUN4QixVQUFVLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQztnQkFDakMsT0FBTyxFQUFFLENBQUMsaUJBQWlCLENBQUM7Z0JBQzVCLFNBQVMsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7Z0JBQzNCLFVBQVUsRUFBRTtvQkFDVixZQUFZLEVBQUU7d0JBQ1osbUJBQW1CLEVBQUUsQ0FBQyxPQUFPLENBQUM7cUJBQy9CO29CQUNELE9BQU8sRUFBRTt3QkFDUCxlQUFlLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQztxQkFDckM7aUJBQ0Y7YUFDRixDQUFDLENBQUMsQ0FBQztZQUVKLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQy9DLEdBQUcsRUFBRSxvQ0FBb0M7Z0JBQ3pDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRSxDQUFDLG1CQUFtQixDQUFDO2dCQUNqQyxPQUFPLEVBQUUsQ0FBQyxjQUFjLENBQUM7Z0JBQ3pCLFNBQVMsRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQVMsSUFBSSxDQUFDO2dCQUNsQyxVQUFVLEVBQUU7b0JBQ1YsWUFBWSxFQUFFO3dCQUNaLGNBQWMsRUFBRSwyQkFBMkI7d0JBQzNDLG1CQUFtQixFQUFFLENBQUMsT0FBTyxDQUFDO3FCQUMvQjtvQkFDRCxPQUFPLEVBQUU7d0JBQ1AsZUFBZSxFQUFFLENBQUMsaUJBQWlCLENBQUM7cUJBQ3JDO2lCQUNGO2FBQ0YsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO0lBQ0gsQ0FBQzs7QUEzTEgsd0NBNExDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgRGVmYXVsdFN0YWNrU3ludGhlc2l6ZXIsIFJlbW92YWxQb2xpY3ksIFN0YWNrLCBUb2tlbiB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIGlhbSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCAqIGFzIHMzIGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBGYWN0TmFtZSwgUmVnaW9uSW5mbyB9IGZyb20gJ2F3cy1jZGstbGliL3JlZ2lvbi1pbmZvJztcbmltcG9ydCB7IENvbnN0cnVjdCwgSURlcGVuZGFibGUgfSBmcm9tICdjb25zdHJ1Y3RzJztcblxuLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9yIHZhbHVlcyBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0uXG4gKlxuICogQHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfVxuICovXG5leHBvcnQgY29uc3QgUzNTZWN1cmVCdWNrZXRUeXBlID0ge1xuICAvKipcbiAgICogUGlwZWxpbmUgYXJ0aWZhY3QgYnVja2V0IHdoZW4gdXNpbmcgYSBjdXN0b20gQ0RLIGJvb3RzdHJhcCBxdWFsaWZpZXJcbiAgICogKHNpbmdsZS0gb3IgbXVsdGktcmVnaW9uIGRlcGxveW1lbnRzKS5cbiAgICovXG4gIERFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUOiAnRGVwbG95bWVudFBpcGVsaW5lQXJ0aWZhY3RCdWNrZXQnLFxuICAvKipcbiAgICogT3JpZ2luIGJ1Y2tldCBmb3IgQ2xvdWRGcm9udCBkaXN0cmlidXRpb25zLlxuICAgKi9cbiAgQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUOiAnQ2xvdWRGcm9udE9yaWdpbkJ1Y2tldCcsXG4gIC8qKlxuICAgKiBHZW5lcmFsLXB1cnBvc2Ugc2VjdXJlIGJ1Y2tldCAoZGVmYXVsdCBxdWFsaWZpZXIgLyBzdGFuZGFyZCB1c2UpLlxuICAgKi9cbiAgREVGQVVMVF9CVUNLRVQ6ICdEZWZhdWx0QnVja2V0JyxcbiAgLyoqXG4gICAqIENlbnRyYWxpemVkIGFjY2VzcyBsb2dzIGZvciBwcm9kdWNlcnMgc3VjaCBhcyBBTEIvTkxCLCBDbG91ZEZyb250IHN0YW5kYXJkIGxvZ2dpbmcgKHYyKSxcbiAgICogYW5kIFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZy4gR3JhbnRzIGBzMzpQdXRPYmplY3RgIG9uIGBBV1NMb2dzLzxhY2NvdW50Pi8qYCBvbmx5IChubyByZWFkL2xpc3QpLlxuICAgKlxuICAgKiBGb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0sIHRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCBJRFxuICAgKiAobGVnYWN5IHBhdGggYWxvbmdzaWRlIHRoZSBsb2cgZGVsaXZlcnkgc2VydmljZSBwcmluY2lwYWwpIGlzIHJlc29sdmVkIGZyb20gYGF3cy1jZGstbGliL3JlZ2lvbi1pbmZvYFxuICAgKiBhdCBzeW50aGVzaXMgdGltZSB3aGVuIHtAbGluayBTdGFjayNyZWdpb259IGlzIGtub3duLCBvciB2aWEgYSBkZXBsb3ktdGltZSBtYXBwaW5nIHdoZW4gaXQgaXMgYSB0b2tlbi5cbiAgICovXG4gIEFDQ0VTU19MT0dfQlVDS0VUOiAnQWNjZXNzTG9nQnVja2V0JyxcbiAgLyoqXG4gICAqIEFyY2hpdmUgYnVja2V0IGZvciBsb2cgZGF0YSBleHBvcnRlZCBmcm9tIENsb3VkV2F0Y2ggTG9ncyB2aWEgZXhwb3J0IHRhc2tzLlxuICAgKiBHcmFudHMgYGxvZ3MuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbWAgYHMzOkdldEJ1Y2tldEFjbGAgYW5kIGBzMzpQdXRPYmplY3RgIGZvciBsb2cgZ3JvdXBzIGluIHRoZVxuICAgKiBzdGFjayBhY2NvdW50IGFuZCByZWdpb24gKHNlZSBBV1MgZG9jcyBmb3IgY3Jvc3MtYWNjb3VudCBleHBvcnQpLlxuICAgKi9cbiAgQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUOiAnQ2xvdWRXYXRjaExvZ0FyY2hpdmVCdWNrZXQnLFxufSBhcyBjb25zdDtcblxuLyoqXG4gKiBEaXNjcmltaW5hdGVkIHVuaW9uIG9mIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGV9IHN0cmluZyBsaXRlcmFscy5cbiAqL1xuZXhwb3J0IHR5cGUgUzNTZWN1cmVCdWNrZXRUeXBlID0gdHlwZW9mIFMzU2VjdXJlQnVja2V0VHlwZVtrZXlvZiB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlXTtcblxuLyoqXG4gKiBDb25zdHJ1Y3Rpb24gcHJvcGVydGllcyBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0fS5cbiAqXG4gKiBFeHRlbmRzIHtAbGluayBzMy5CdWNrZXRQcm9wc307IHNldmVyYWwgZmllbGRzIHJlY2VpdmUgc2VjdXJlIGRlZmF1bHRzIGluc2lkZSB0aGUgY29uc3RydWN0LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFMzU2VjdXJlQnVja2V0UHJvcHMgZXh0ZW5kcyBzMy5CdWNrZXRQcm9wcyB7XG5cbiAgLyoqXG4gICAqIFNlbGVjdHMgZW5jcnlwdGlvbiBkZWZhdWx0cyBhbmQgb3B0aW9uYWwgcmVzb3VyY2UtcG9saWN5IHN0YXRlbWVudHMuXG4gICAqXG4gICAqIEBkZWZhdWx0IHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuREVGQVVMVF9CVUNLRVR9XG4gICAqL1xuICByZWFkb25seSBidWNrZXRUeXBlPzogUzNTZWN1cmVCdWNrZXRUeXBlO1xufVxuXG4vKipcbiAqIFMzIGJ1Y2tldCB3aXRoIG9waW5pb25hdGVkIHNlY3VyZSBkZWZhdWx0czogcHJpdmF0ZSBBQ0xzLCBibG9jayBwdWJsaWMgYWNjZXNzLCBUTFMtb25seSBhY2Nlc3MsXG4gKiBhbmQgZW5jcnlwdGlvbiAoUzMtbWFuYWdlZCBmb3IgbG9nL29yaWdpbi9hcmNoaXZlIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVH06IG1heSBhdHRhY2ggYSBkZXBsb3ktcm9sZSBwb2xpY3kgd2hlbiBhIG5vbi1kZWZhdWx0IGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgcHJlc2VudC5cbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH06IGFkZHMgbG9nLXdyaXRlciBwcmluY2lwYWxzOyBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0gYW5kIHtAbGluayBTM1NlY3VyZUJ1Y2tldCNhY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlfS5cbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVR9OiBhZGRzIENsb3VkV2F0Y2ggTG9ncyBleHBvcnQgcHJpbmNpcGFscyAoYGxvZ3MuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbWApLlxuICovXG5leHBvcnQgY2xhc3MgUzNTZWN1cmVCdWNrZXQgZXh0ZW5kcyBzMy5CdWNrZXQge1xuICAvKipcbiAgICogU2V0IG9ubHkgd2hlbiB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfSBpcyB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfS5cbiAgICogVXNlIGFzIGEgZGVwZW5kZW5jeSB0YXJnZXQgc28gbG9hZCBiYWxhbmNlciBhY2Nlc3MtbG9nIGVuYWJsZW1lbnQgcnVucyBhZnRlciB0aGUgYnVja2V0IHBvbGljeVxuICAgKiBleGlzdHMgKEVMQiBwZXJmb3JtcyBhbiBpbW1lZGlhdGUgdmFsaWRhdGlvbiBgUHV0T2JqZWN0YCB0aGF0IGZhaWxzIGlmIHRoZSBwb2xpY3kgaXMgbm90IGFwcGxpZWQgeWV0KS5cbiAgICpcbiAgICogRXhhbXBsZTogYGxvYWRCYWxhbmNlci5ub2RlLmFkZERlcGVuZGVuY3koYnVja2V0LmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGUhKWAuXG4gICAqXG4gICAqIEBkZWZhdWx0IHVuZGVmaW5lZCB3aGVuIGBidWNrZXRUeXBlYCBpcyBub3Qge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZT86IElEZXBlbmRhYmxlO1xuXG4gIC8qKlxuICAgKiBDcmVhdGVzIGEgc2VjdXJlIFMzIGJ1Y2tldCBhY2NvcmRpbmcgdG8gYGJ1Y2tldFR5cGVgIGFuZCBtZXJnZWQgYHByb3BzYC5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIC0gUGFyZW50IGNvbnN0cnVjdCwgdHlwaWNhbGx5IGEge0BsaW5rIFN0YWNrfS5cbiAgICogQHBhcmFtIGlkIC0gQ29uc3RydWN0IElEIChzdGFibGUgbG9naWNhbCBJRCBzZWdtZW50KS5cbiAgICogQHBhcmFtIHByb3BzIC0gT3B0aW9uYWwge0BsaW5rIHMzLkJ1Y2tldFByb3BzfSBwbHVzIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9IGFuZCBgZXZlbnRCcmlkZ2VFbmFibGVkYCAoYXBwbGllZCB2aWEgTDEgb3ZlcnJpZGUgd2hlbiB0cnVlKS5cbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzPzogUzNTZWN1cmVCdWNrZXRQcm9wcykge1xuICAgIGNvbnN0IGJ1Y2tldFR5cGUgPSBwcm9wcz8uYnVja2V0VHlwZSB8fCBTM1NlY3VyZUJ1Y2tldFR5cGUuREVGQVVMVF9CVUNLRVQ7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5wcm9wcyxcbiAgICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuUkVUQUlOLFxuICAgICAgZW5jcnlwdGlvbjogKCgpID0+IHtcbiAgICAgICAgaWYgKFxuICAgICAgICAgIGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVRcbiAgICAgICAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVRcbiAgICAgICAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUXG4gICAgICAgICkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQ7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzPy5lbmNyeXB0aW9uIHx8IHMzLkJ1Y2tldEVuY3J5cHRpb24uS01TX01BTkFHRUQ7XG4gICAgICB9KSgpLFxuICAgICAgYWNjZXNzQ29udHJvbDogKCgpID0+IHtcbiAgICAgICAgaWYgKCFwcm9wcz8uYWNjZXNzQ29udHJvbCkge1xuICAgICAgICAgIHJldHVybiBzMy5CdWNrZXRBY2Nlc3NDb250cm9sLlBSSVZBVEU7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHByb3BzLmFjY2Vzc0NvbnRyb2w7XG4gICAgICB9KSgpLFxuICAgICAgZXZlbnRCcmlkZ2VFbmFibGVkOiB1bmRlZmluZWQsXG4gICAgICBwdWJsaWNSZWFkQWNjZXNzOiBmYWxzZSxcbiAgICAgIGJsb2NrUHVibGljQWNjZXNzOiBzMy5CbG9ja1B1YmxpY0FjY2Vzcy5CTE9DS19BTEwsXG4gICAgICBlbmZvcmNlU1NMOiB0cnVlLFxuICAgICAgdmVyc2lvbmVkOiBwcm9wcz8udmVyc2lvbmVkICE9PSB1bmRlZmluZWQgPyBwcm9wcy52ZXJzaW9uZWQgOiB0cnVlLFxuICAgICAgb2JqZWN0T3duZXJzaGlwOiAoKCkgPT4ge1xuICAgICAgICBpZiAocHJvcHM/Lm9iamVjdE93bmVyc2hpcCkge1xuICAgICAgICAgIHJldHVybiBwcm9wcy5vYmplY3RPd25lcnNoaXA7XG4gICAgICAgIH1cbiAgICAgICAgcmV0dXJuIHMzLk9iamVjdE93bmVyc2hpcC5CVUNLRVRfT1dORVJfRU5GT1JDRUQ7XG4gICAgICB9KSgpLFxuICAgIH0pO1xuXG4gICAgY29uc3QgY2ZuQnVja2V0ID0gdGhpcy5ub2RlLmRlZmF1bHRDaGlsZCBhcyBzMy5DZm5CdWNrZXQ7XG4gICAgaWYgKHByb3BzPy5ldmVudEJyaWRnZUVuYWJsZWQgPT09IHRydWUpIHtcbiAgICAgIGNmbkJ1Y2tldC5hZGRQcm9wZXJ0eU92ZXJyaWRlKCdOb3RpZmljYXRpb25Db25maWd1cmF0aW9uLkV2ZW50QnJpZGdlQ29uZmlndXJhdGlvbi5FdmVudEJyaWRnZUVuYWJsZWQnLCB0cnVlKTtcbiAgICB9XG5cbiAgICBjb25zdCBhY2NvdW50ID0gU3RhY2sub2YodGhpcykuYWNjb3VudDtcbiAgICBjb25zdCByZWdpb24gPSBTdGFjay5vZih0aGlzKS5yZWdpb247XG5cbiAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUKSB7XG5cbiAgICAgIGNvbnN0IHF1YWxpZmllciA9IFN0YWNrLm9mKHRoaXMpLnN5bnRoZXNpemVyLmJvb3RzdHJhcFF1YWxpZmllcjtcblxuICAgICAgaWYgKHF1YWxpZmllciAmJiAocXVhbGlmaWVyICE9IERlZmF1bHRTdGFja1N5bnRoZXNpemVyLkRFRkFVTFRfUVVBTElGSUVSKSkge1xuICAgICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgICAgICdzMzoqJyxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgICAgYCR7dGhpcy5idWNrZXRBcm59YCxcbiAgICAgICAgICAgIGAke3RoaXMuYnVja2V0QXJufS8qYCxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQXJuUHJpbmNpcGFsKGBhcm46YXdzOmlhbTo6JHthY2NvdW50fTpyb2xlL2Nkay0ke3F1YWxpZmllcn0tZGVwbG95LXJvbGUtJHthY2NvdW50fS0ke3JlZ2lvbn1gKSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG4gICAgfVxuXG4gICAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVCkge1xuICAgICAgY29uc3QgYXdzTG9nc1ByZWZpeFJlc291cmNlID0gYCR7dGhpcy5idWNrZXRBcm59L0FXU0xvZ3MvJHthY2NvdW50fS8qYDtcblxuICAgICAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICAgICAgY29uc3QgYWxiTG9nRGVsaXZlcnlQb2xpY3lSZXN1bHQgPSB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2xvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEluIG5vbuKAk29wdC1pbiByZWdpb25zIChmb3IgZXhhbXBsZSBhcC1ub3J0aGVhc3QtMSksIGFjY2VzcyBsb2dzIGFyZSBvZnRlbiBkZWxpdmVyZWQgdXNpbmcgdGhlXG4gICAgICAvLyByZWdpb25hbCBFTEJ2MiBhY2NvdW50IChyb290IG9mIHRoYXQgYWNjb3VudCkgZm9yIHMzOlB1dE9iamVjdCwgbm90IG9ubHkgdGhlIHNlcnZpY2UgcHJpbmNpcGFsIGFib3ZlLlxuICAgICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZih0aGlzKTtcbiAgICAgIGNvbnN0IGVsYkFjY291bnRJZCA9IFRva2VuLmlzVW5yZXNvbHZlZChzdGFjay5yZWdpb24pXG4gICAgICAgID8gc3RhY2sucmVnaW9uYWxGYWN0KEZhY3ROYW1lLkVMQlYyX0FDQ09VTlQpXG4gICAgICAgIDogUmVnaW9uSW5mby5nZXQoc3RhY2sucmVnaW9uKS5lbGJ2MkFjY291bnQ7XG4gICAgICBpZiAoZWxiQWNjb3VudElkKSB7XG4gICAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICAgIG5ldyBpYW0uQWNjb3VudFByaW5jaXBhbChlbGJBY2NvdW50SWQpLFxuICAgICAgICAgIF0sXG4gICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgICAgXSxcbiAgICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSk7XG4gICAgICB9XG5cbiAgICAgIHRoaXMuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZSA9IGFsYkxvZ0RlbGl2ZXJ5UG9saWN5UmVzdWx0LnBvbGljeURlcGVuZGFibGUgPz8gdGhpcztcblxuICAgICAgLy8gQWxsb3cgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MikgdG8gd3JpdGUgbG9nc1xuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdkZWxpdmVyeS5sb2dzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG5cbiAgICAgIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dnaW5nLnMzLmFtYXpvbmF3cy5jb20nKSxcbiAgICAgICAgXSxcbiAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICBdLFxuICAgICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgICAgIF0sXG4gICAgICB9KSk7XG4gICAgfVxuXG4gICAgaWYgKGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVQpIHtcbiAgICAgIGNvbnN0IGxvZ3NFeHBvcnRQcmluY2lwYWwgPSBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoYGxvZ3MuJHtyZWdpb259LmFtYXpvbmF3cy5jb21gKTtcbiAgICAgIGNvbnN0IHNvdXJjZUxvZ0dyb3VwQXJuID0gYGFybjphd3M6bG9nczoke3JlZ2lvbn06JHthY2NvdW50fTpsb2ctZ3JvdXA6KmA7XG5cbiAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIHNpZDogJ0FsbG93Q2xvdWRXYXRjaExvZ3NFeHBvcnRHZXRCdWNrZXRBY2wnLFxuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtsb2dzRXhwb3J0UHJpbmNpcGFsXSxcbiAgICAgICAgYWN0aW9uczogWydzMzpHZXRCdWNrZXRBY2wnXSxcbiAgICAgICAgcmVzb3VyY2VzOiBbdGhpcy5idWNrZXRBcm5dLFxuICAgICAgICBjb25kaXRpb25zOiB7XG4gICAgICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICAgICAnYXdzOlNvdXJjZUFjY291bnQnOiBbYWNjb3VudF0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBBcm5MaWtlOiB7XG4gICAgICAgICAgICAnYXdzOlNvdXJjZUFybic6IFtzb3VyY2VMb2dHcm91cEFybl0sXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIH0pKTtcblxuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgc2lkOiAnQWxsb3dDbG91ZFdhdGNoTG9nc0V4cG9ydFB1dE9iamVjdCcsXG4gICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgcHJpbmNpcGFsczogW2xvZ3NFeHBvcnRQcmluY2lwYWxdLFxuICAgICAgICBhY3Rpb25zOiBbJ3MzOlB1dE9iamVjdCddLFxuICAgICAgICByZXNvdXJjZXM6IFtgJHt0aGlzLmJ1Y2tldEFybn0vKmBdLFxuICAgICAgICBjb25kaXRpb25zOiB7XG4gICAgICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICAgICAnczM6eC1hbXotYWNsJzogJ2J1Y2tldC1vd25lci1mdWxsLWNvbnRyb2wnLFxuICAgICAgICAgICAgJ2F3czpTb3VyY2VBY2NvdW50JzogW2FjY291bnRdLFxuICAgICAgICAgIH0sXG4gICAgICAgICAgQXJuTGlrZToge1xuICAgICAgICAgICAgJ2F3czpTb3VyY2VBcm4nOiBbc291cmNlTG9nR3JvdXBBcm5dLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICB9KSk7XG4gICAgfVxuICB9XG59XG4iXX0=

package/package.json

@@ -1,5 +1,6 @@
 {
   "name": "s3-secure-bucket",
+  "description": "S3 Secure Bucket is a construct that creates a secure bucket with encryption, logging, and other security features.",
   "repository": {
     "type": "git",
     "url": "https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket.git"
@@ -79,7 +80,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.2.4",
+  "version": "0.3.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [