s3-secure-bucket 0.3.6 → 0.4.0

package/lib/bucket-types/bucket-type.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3SecureBucketType = void 0;
+/**
+ * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ *
+ * Each value selects encryption defaults and, for some types, additional bucket resource policies.
+ *
+ * @see {@link S3SecureBucketProps.bucketType}
+ */
+exports.S3SecureBucketType = {
+    /**
+     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
+     * (single- or multi-region deployments).
+     *
+     * Adds an `s3:*` grant for `cdk-<qualifier>-deploy-role` when the bootstrap qualifier is not default.
+     */
+    DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: 'DeploymentPipelineArtifactBucket',
+    /**
+     * Origin bucket for CloudFront distributions.
+     *
+     * Uses S3-managed encryption ({@link s3.BucketEncryption.S3_MANAGED}) by default.
+     */
+    CLOUDFRONT_ORIGIN_BUCKET: 'CloudFrontOriginBucket',
+    /**
+     * General-purpose secure bucket (default qualifier / standard use).
+     *
+     * Uses KMS-managed encryption unless overridden in props. No type-specific resource policies.
+     */
+    DEFAULT_BUCKET: 'DefaultBucket',
+    /**
+     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     *
+     * The regional ELBv2 log-delivery account ID (legacy path alongside the log delivery service principal)
+     * is resolved from `aws-cdk-lib/region-info` at synthesis time when {@link Stack#region} is known,
+     * or via a deploy-time mapping when it is a token.
+     */
+    ACCESS_LOG_BUCKET: 'AccessLogBucket',
+    /**
+     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
+     *
+     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
+     * stack account and region (see AWS docs for cross-account export).
+     */
+    CLOUD_WATCH_LOG_ARCHIVE_BUCKET: 'CloudWatchLogArchiveBucket',
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXR5cGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2J1Y2tldC10eXBlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7Ozs7R0FNRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7Ozs7O09BS0c7SUFDSCxtQ0FBbUMsRUFBRSxrQ0FBa0M7SUFDdkU7Ozs7T0FJRztJQUNILHdCQUF3QixFQUFFLHdCQUF3QjtJQUNsRDs7OztPQUlHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7T0FPRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtJQUNwQzs7Ozs7T0FLRztJQUNILDhCQUE4QixFQUFFLDRCQUE0QjtDQUNwRCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9yIHZhbHVlcyBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0uXG4gKlxuICogRWFjaCB2YWx1ZSBzZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kLCBmb3Igc29tZSB0eXBlcywgYWRkaXRpb25hbCBidWNrZXQgcmVzb3VyY2UgcG9saWNpZXMuXG4gKlxuICogQHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfVxuICovXG5leHBvcnQgY29uc3QgUzNTZWN1cmVCdWNrZXRUeXBlID0ge1xuICAvKipcbiAgICogUGlwZWxpbmUgYXJ0aWZhY3QgYnVja2V0IHdoZW4gdXNpbmcgYSBjdXN0b20gQ0RLIGJvb3RzdHJhcCBxdWFsaWZpZXJcbiAgICogKHNpbmdsZS0gb3IgbXVsdGktcmVnaW9uIGRlcGxveW1lbnRzKS5cbiAgICpcbiAgICogQWRkcyBhbiBgczM6KmAgZ3JhbnQgZm9yIGBjZGstPHF1YWxpZmllcj4tZGVwbG95LXJvbGVgIHdoZW4gdGhlIGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgbm90IGRlZmF1bHQuXG4gICAqL1xuICBERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVDogJ0RlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0QnVja2V0JyxcbiAgLyoqXG4gICAqIE9yaWdpbiBidWNrZXQgZm9yIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9ucy5cbiAgICpcbiAgICogVXNlcyBTMy1tYW5hZ2VkIGVuY3J5cHRpb24gKHtAbGluayBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUR9KSBieSBkZWZhdWx0LlxuICAgKi9cbiAgQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUOiAnQ2xvdWRGcm9udE9yaWdpbkJ1Y2tldCcsXG4gIC8qKlxuICAgKiBHZW5lcmFsLXB1cnBvc2Ugc2VjdXJlIGJ1Y2tldCAoZGVmYXVsdCBxdWFsaWZpZXIgLyBzdGFuZGFyZCB1c2UpLlxuICAgKlxuICAgKiBVc2VzIEtNUy1tYW5hZ2VkIGVuY3J5cHRpb24gdW5sZXNzIG92ZXJyaWRkZW4gaW4gcHJvcHMuIE5vIHR5cGUtc3BlY2lmaWMgcmVzb3VyY2UgcG9saWNpZXMuXG4gICAqL1xuICBERUZBVUxUX0JVQ0tFVDogJ0RlZmF1bHRCdWNrZXQnLFxuICAvKipcbiAgICogQ2VudHJhbGl6ZWQgYWNjZXNzIGxvZ3MgZm9yIHByb2R1Y2VycyBzdWNoIGFzIEFMQi9OTEIsIENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpLFxuICAgKiBhbmQgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nLiBHcmFudHMgYHMzOlB1dE9iamVjdGAgb24gYEFXU0xvZ3MvPGFjY291bnQ+LypgIG9ubHkgKG5vIHJlYWQvbGlzdCkuXG4gICAqXG4gICAqIFRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCBJRCAobGVnYWN5IHBhdGggYWxvbmdzaWRlIHRoZSBsb2cgZGVsaXZlcnkgc2VydmljZSBwcmluY2lwYWwpXG4gICAqIGlzIHJlc29sdmVkIGZyb20gYGF3cy1jZGstbGliL3JlZ2lvbi1pbmZvYCBhdCBzeW50aGVzaXMgdGltZSB3aGVuIHtAbGluayBTdGFjayNyZWdpb259IGlzIGtub3duLFxuICAgKiBvciB2aWEgYSBkZXBsb3ktdGltZSBtYXBwaW5nIHdoZW4gaXQgaXMgYSB0b2tlbi5cbiAgICovXG4gIEFDQ0VTU19MT0dfQlVDS0VUOiAnQWNjZXNzTG9nQnVja2V0JyxcbiAgLyoqXG4gICAqIEFyY2hpdmUgYnVja2V0IGZvciBsb2cgZGF0YSBleHBvcnRlZCBmcm9tIENsb3VkV2F0Y2ggTG9ncyB2aWEgZXhwb3J0IHRhc2tzLlxuICAgKlxuICAgKiBHcmFudHMgYGxvZ3MuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbWAgYHMzOkdldEJ1Y2tldEFjbGAgYW5kIGBzMzpQdXRPYmplY3RgIGZvciBsb2cgZ3JvdXBzIGluIHRoZVxuICAgKiBzdGFjayBhY2NvdW50IGFuZCByZWdpb24gKHNlZSBBV1MgZG9jcyBmb3IgY3Jvc3MtYWNjb3VudCBleHBvcnQpLlxuICAgKi9cbiAgQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUOiAnQ2xvdWRXYXRjaExvZ0FyY2hpdmVCdWNrZXQnLFxufSBhcyBjb25zdDtcblxuLyoqXG4gKiBEaXNjcmltaW5hdGVkIHVuaW9uIG9mIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGV9IHN0cmluZyBsaXRlcmFscy5cbiAqL1xuZXhwb3J0IHR5cGUgUzNTZWN1cmVCdWNrZXRUeXBlID0gdHlwZW9mIFMzU2VjdXJlQnVja2V0VHlwZVtrZXlvZiB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlXTtcbiJdfQ==

package/lib/bucket-types/encryption-default.d.ts

@@ -0,0 +1,14 @@
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { S3SecureBucketType } from './bucket-type';
+/**
+ * Resolves bucket encryption for a given {@link S3SecureBucketType}.
+ *
+ * {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}, {@link S3SecureBucketType.ACCESS_LOG_BUCKET},
+ * and {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET} always use S3-managed encryption.
+ * All other types use `propsEncryption` when provided, otherwise KMS-managed encryption.
+ *
+ * @param bucketType - Preset that determines the default encryption mode.
+ * @param propsEncryption - Optional caller override from {@link s3.BucketProps.encryption}.
+ * @returns The encryption mode to pass to {@link s3.Bucket}.
+ */
+export declare const resolveEncryptionDefault: (bucketType: S3SecureBucketType, propsEncryption?: s3.BucketEncryption) => s3.BucketEncryption;

package/lib/bucket-types/encryption-default.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEncryptionDefault = void 0;
+const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
+const bucket_type_1 = require("./bucket-type");
+/**
+ * Resolves bucket encryption for a given {@link S3SecureBucketType}.
+ *
+ * {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}, {@link S3SecureBucketType.ACCESS_LOG_BUCKET},
+ * and {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET} always use S3-managed encryption.
+ * All other types use `propsEncryption` when provided, otherwise KMS-managed encryption.
+ *
+ * @param bucketType - Preset that determines the default encryption mode.
+ * @param propsEncryption - Optional caller override from {@link s3.BucketProps.encryption}.
+ * @returns The encryption mode to pass to {@link s3.Bucket}.
+ */
+const resolveEncryptionDefault = (bucketType, propsEncryption) => {
+    if (bucketType === bucket_type_1.S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET
+        || bucketType === bucket_type_1.S3SecureBucketType.ACCESS_LOG_BUCKET
+        || bucketType === bucket_type_1.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
+        return s3.BucketEncryption.S3_MANAGED;
+    }
+    return propsEncryption ?? s3.BucketEncryption.KMS_MANAGED;
+};
+exports.resolveEncryptionDefault = resolveEncryptionDefault;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi1kZWZhdWx0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC10eXBlcy9lbmNyeXB0aW9uLWRlZmF1bHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXlDO0FBQ3pDLCtDQUFtRDtBQUVuRDs7Ozs7Ozs7OztHQVVHO0FBQ0ksTUFBTSx3QkFBd0IsR0FBRyxDQUN0QyxVQUE4QixFQUM5QixlQUFxQyxFQUNoQixFQUFFO0lBQ3ZCLElBQ0UsVUFBVSxLQUFLLGdDQUFrQixDQUFDLHdCQUF3QjtXQUN2RCxVQUFVLEtBQUssZ0NBQWtCLENBQUMsaUJBQWlCO1dBQ25ELFVBQVUsS0FBSyxnQ0FBa0IsQ0FBQyw4QkFBOEIsRUFDbkUsQ0FBQztRQUNELE9BQU8sRUFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsT0FBTyxlQUFlLElBQUksRUFBRSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQztBQUM1RCxDQUFDLENBQUM7QUFaVyxRQUFBLHdCQUF3Qiw0QkFZbkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi9idWNrZXQtdHlwZSc7XG5cbi8qKlxuICogUmVzb2x2ZXMgYnVja2V0IGVuY3J5cHRpb24gZm9yIGEgZ2l2ZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0uXG4gKlxuICoge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVR9LCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfSxcbiAqIGFuZCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVH0gYWx3YXlzIHVzZSBTMy1tYW5hZ2VkIGVuY3J5cHRpb24uXG4gKiBBbGwgb3RoZXIgdHlwZXMgdXNlIGBwcm9wc0VuY3J5cHRpb25gIHdoZW4gcHJvdmlkZWQsIG90aGVyd2lzZSBLTVMtbWFuYWdlZCBlbmNyeXB0aW9uLlxuICpcbiAqIEBwYXJhbSBidWNrZXRUeXBlIC0gUHJlc2V0IHRoYXQgZGV0ZXJtaW5lcyB0aGUgZGVmYXVsdCBlbmNyeXB0aW9uIG1vZGUuXG4gKiBAcGFyYW0gcHJvcHNFbmNyeXB0aW9uIC0gT3B0aW9uYWwgY2FsbGVyIG92ZXJyaWRlIGZyb20ge0BsaW5rIHMzLkJ1Y2tldFByb3BzLmVuY3J5cHRpb259LlxuICogQHJldHVybnMgVGhlIGVuY3J5cHRpb24gbW9kZSB0byBwYXNzIHRvIHtAbGluayBzMy5CdWNrZXR9LlxuICovXG5leHBvcnQgY29uc3QgcmVzb2x2ZUVuY3J5cHRpb25EZWZhdWx0ID0gKFxuICBidWNrZXRUeXBlOiBTM1NlY3VyZUJ1Y2tldFR5cGUsXG4gIHByb3BzRW5jcnlwdGlvbj86IHMzLkJ1Y2tldEVuY3J5cHRpb24sXG4pOiBzMy5CdWNrZXRFbmNyeXB0aW9uID0+IHtcbiAgaWYgKFxuICAgIGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVRcbiAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVRcbiAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUXG4gICkge1xuICAgIHJldHVybiBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQ7XG4gIH1cbiAgcmV0dXJuIHByb3BzRW5jcnlwdGlvbiA/PyBzMy5CdWNrZXRFbmNyeXB0aW9uLktNU19NQU5BR0VEO1xufTtcbiJdfQ==

package/lib/bucket-types/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Bucket type discriminators, construct props, and encryption defaults.
+ *
+ * @packageDocumentation
+ */
+export { S3SecureBucketType } from './bucket-type';
+export type { S3SecureBucketProps } from './props';
+export { resolveEncryptionDefault } from './encryption-default';

package/lib/bucket-types/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEncryptionDefault = exports.S3SecureBucketType = void 0;
+/**
+ * Bucket type discriminators, construct props, and encryption defaults.
+ *
+ * @packageDocumentation
+ */
+var bucket_type_1 = require("./bucket-type");
+Object.defineProperty(exports, "S3SecureBucketType", { enumerable: true, get: function () { return bucket_type_1.S3SecureBucketType; } });
+var encryption_default_1 = require("./encryption-default");
+Object.defineProperty(exports, "resolveEncryptionDefault", { enumerable: true, get: function () { return encryption_default_1.resolveEncryptionDefault; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7O0dBSUc7QUFDSCw2Q0FBbUQ7QUFBMUMsaUhBQUEsa0JBQWtCLE9BQUE7QUFFM0IsMkRBQWdFO0FBQXZELDhIQUFBLHdCQUF3QixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9ycywgY29uc3RydWN0IHByb3BzLCBhbmQgZW5jcnlwdGlvbiBkZWZhdWx0cy5cbiAqXG4gKiBAcGFja2FnZURvY3VtZW50YXRpb25cbiAqL1xuZXhwb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi9idWNrZXQtdHlwZSc7XG5leHBvcnQgdHlwZSB7IFMzU2VjdXJlQnVja2V0UHJvcHMgfSBmcm9tICcuL3Byb3BzJztcbmV4cG9ydCB7IHJlc29sdmVFbmNyeXB0aW9uRGVmYXVsdCB9IGZyb20gJy4vZW5jcnlwdGlvbi1kZWZhdWx0JztcbiJdfQ==

package/lib/bucket-types/props.d.ts

@@ -0,0 +1,16 @@
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import { S3SecureBucketType } from './bucket-type';
+/**
+ * Construction properties for {@link S3SecureBucket}.
+ *
+ * Extends {@link s3.BucketProps}. Several fields receive secure defaults inside the construct
+ * and may be overridden unless documented otherwise on {@link S3SecureBucket}.
+ */
+export interface S3SecureBucketProps extends s3.BucketProps {
+    /**
+     * Selects encryption defaults and optional resource-policy statements.
+     *
+     * @default {@link S3SecureBucketType.DEFAULT_BUCKET}
+     */
+    readonly bucketType?: S3SecureBucketType;
+}

package/lib/bucket-types/props.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvcHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL3Byb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXlDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGUnO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfS4gU2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3RcbiAqIGFuZCBtYXkgYmUgb3ZlcnJpZGRlbiB1bmxlc3MgZG9jdW1lbnRlZCBvdGhlcndpc2Ugb24ge0BsaW5rIFMzU2VjdXJlQnVja2V0fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTM1NlY3VyZUJ1Y2tldFByb3BzIGV4dGVuZHMgczMuQnVja2V0UHJvcHMge1xuXG4gIC8qKlxuICAgKiBTZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kIG9wdGlvbmFsIHJlc291cmNlLXBvbGljeSBzdGF0ZW1lbnRzLlxuICAgKlxuICAgKiBAZGVmYXVsdCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUfVxuICAgKi9cbiAgcmVhZG9ubHkgYnVja2V0VHlwZT86IFMzU2VjdXJlQnVja2V0VHlwZTtcbn1cbiJdfQ==

package/lib/index.d.ts

@@ -1,83 +1,8 @@
-import * as s3 from 'aws-cdk-lib/aws-s3';
-import { Construct, IDependable } from 'constructs';
 /**
- * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ * Public entry point for the `s3-secure-bucket` construct library.
  *
- * @see {@link S3SecureBucketProps.bucketType}
+ * @packageDocumentation
  */
-export declare const S3SecureBucketType: {
-    /**
-     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
-     * (single- or multi-region deployments).
-     */
-    readonly DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: "DeploymentPipelineArtifactBucket";
-    /**
-     * Origin bucket for CloudFront distributions.
-     */
-    readonly CLOUDFRONT_ORIGIN_BUCKET: "CloudFrontOriginBucket";
-    /**
-     * General-purpose secure bucket (default qualifier / standard use).
-     */
-    readonly DEFAULT_BUCKET: "DefaultBucket";
-    /**
-     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
-     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
-     *
-     * For {@link S3SecureBucketType.ACCESS_LOG_BUCKET}, the regional ELBv2 log-delivery account ID
-     * (legacy path alongside the log delivery service principal) is resolved from `aws-cdk-lib/region-info`
-     * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
-     */
-    readonly ACCESS_LOG_BUCKET: "AccessLogBucket";
-    /**
-     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
-     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
-     * stack account and region (see AWS docs for cross-account export).
-     */
-    readonly CLOUD_WATCH_LOG_ARCHIVE_BUCKET: "CloudWatchLogArchiveBucket";
-};
-/**
- * Discriminated union of {@link S3SecureBucketType} string literals.
- */
-export type S3SecureBucketType = typeof S3SecureBucketType[keyof typeof S3SecureBucketType];
-/**
- * Construction properties for {@link S3SecureBucket}.
- *
- * Extends {@link s3.BucketProps}; several fields receive secure defaults inside the construct.
- */
-export interface S3SecureBucketProps extends s3.BucketProps {
-    /**
-     * Selects encryption defaults and optional resource-policy statements.
-     *
-     * @default {@link S3SecureBucketType.DEFAULT_BUCKET}
-     */
-    readonly bucketType?: S3SecureBucketType;
-}
-/**
- * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
- * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
- *
- * @remarks
- * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
- * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
- * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
- */
-export declare class S3SecureBucket extends s3.Bucket {
-    /**
-     * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
-     * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
-     * exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
-     *
-     * Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
-     *
-     * @default undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
-     */
-    readonly accessLogBucketPolicyDependable?: IDependable;
-    /**
-     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
-     *
-     * @param scope - Parent construct, typically a {@link Stack}.
-     * @param id - Construct ID (stable logical ID segment).
-     * @param props - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
-     */
-    constructor(scope: Construct, id: string, props?: S3SecureBucketProps);
-}
+export { S3SecureBucket } from './s3-secure-bucket';
+export { S3SecureBucketType } from './bucket-types';
+export type { S3SecureBucketProps } from './bucket-types';

package/lib/index.js

@@ -1,260 +1,13 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.S3SecureBucket = exports.S3SecureBucketType = void 0;
-const JSII_RTTI_SYMBOL_1 = Symbol.for("jsii.rtti");
-const aws_cdk_lib_1 = require("aws-cdk-lib");
-const iam = __importStar(require("aws-cdk-lib/aws-iam"));
-const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
-const region_info_1 = require("aws-cdk-lib/region-info");
+exports.S3SecureBucketType = exports.S3SecureBucket = void 0;
 /**
- * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ * Public entry point for the `s3-secure-bucket` construct library.
  *
- * @see {@link S3SecureBucketProps.bucketType}
+ * @packageDocumentation
  */
-exports.S3SecureBucketType = {
-    /**
-     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
-     * (single- or multi-region deployments).
-     */
-    DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: 'DeploymentPipelineArtifactBucket',
-    /**
-     * Origin bucket for CloudFront distributions.
-     */
-    CLOUDFRONT_ORIGIN_BUCKET: 'CloudFrontOriginBucket',
-    /**
-     * General-purpose secure bucket (default qualifier / standard use).
-     */
-    DEFAULT_BUCKET: 'DefaultBucket',
-    /**
-     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
-     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
-     *
-     * For {@link S3SecureBucketType.ACCESS_LOG_BUCKET}, the regional ELBv2 log-delivery account ID
-     * (legacy path alongside the log delivery service principal) is resolved from `aws-cdk-lib/region-info`
-     * at synthesis time when {@link Stack#region} is known, or via a deploy-time mapping when it is a token.
-     */
-    ACCESS_LOG_BUCKET: 'AccessLogBucket',
-    /**
-     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
-     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
-     * stack account and region (see AWS docs for cross-account export).
-     */
-    CLOUD_WATCH_LOG_ARCHIVE_BUCKET: 'CloudWatchLogArchiveBucket',
-};
-/**
- * S3 bucket with opinionated secure defaults: private ACLs, block public access, TLS-only access,
- * and encryption (S3-managed for log/origin/archive types; KMS-managed by default otherwise).
- *
- * @remarks
- * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
- * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucketType.ACCESS_LOG_BUCKET} and {@link S3SecureBucket#accessLogBucketPolicyDependable}.
- * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
- */
-class S3SecureBucket extends s3.Bucket {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.3.6" };
-    /**
-     * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
-     * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
-     * exists (ELB performs an immediate validation `PutObject` that fails if the policy is not applied yet).
-     *
-     * Example: `loadBalancer.node.addDependency(bucket.accessLogBucketPolicyDependable!)`.
-     *
-     * @default undefined when `bucketType` is not {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
-     */
-    accessLogBucketPolicyDependable;
-    /**
-     * Creates a secure S3 bucket according to `bucketType` and merged `props`.
-     *
-     * @param scope - Parent construct, typically a {@link Stack}.
-     * @param id - Construct ID (stable logical ID segment).
-     * @param props - Optional {@link s3.BucketProps} plus {@link S3SecureBucketProps.bucketType} and `eventBridgeEnabled` (applied via L1 override when true).
-     */
-    constructor(scope, id, props) {
-        const bucketType = props?.bucketType || exports.S3SecureBucketType.DEFAULT_BUCKET;
-        super(scope, id, {
-            ...props,
-            removalPolicy: aws_cdk_lib_1.RemovalPolicy.RETAIN,
-            encryption: (() => {
-                if (bucketType === exports.S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET
-                    || bucketType === exports.S3SecureBucketType.ACCESS_LOG_BUCKET
-                    || bucketType === exports.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
-                    return s3.BucketEncryption.S3_MANAGED;
-                }
-                return props?.encryption || s3.BucketEncryption.KMS_MANAGED;
-            })(),
-            accessControl: (() => {
-                if (!props?.accessControl) {
-                    return s3.BucketAccessControl.PRIVATE;
-                }
-                return props.accessControl;
-            })(),
-            eventBridgeEnabled: undefined,
-            publicReadAccess: false,
-            blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
-            enforceSSL: true,
-            versioned: props?.versioned !== undefined ? props.versioned : true,
-            objectOwnership: (() => {
-                if (props?.objectOwnership) {
-                    return props.objectOwnership;
-                }
-                return s3.ObjectOwnership.BUCKET_OWNER_ENFORCED;
-            })(),
-        });
-        const cfnBucket = this.node.defaultChild;
-        if (props?.eventBridgeEnabled === true) {
-            cfnBucket.addPropertyOverride('NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled', true);
-        }
-        const account = aws_cdk_lib_1.Stack.of(this).account;
-        const region = aws_cdk_lib_1.Stack.of(this).region;
-        if (bucketType === exports.S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET) {
-            const qualifier = aws_cdk_lib_1.Stack.of(this).synthesizer.bootstrapQualifier;
-            if (qualifier && (qualifier != aws_cdk_lib_1.DefaultStackSynthesizer.DEFAULT_QUALIFIER)) {
-                this.addToResourcePolicy(new iam.PolicyStatement({
-                    actions: [
-                        's3:*',
-                    ],
-                    resources: [
-                        `${this.bucketArn}`,
-                        `${this.bucketArn}/*`,
-                    ],
-                    principals: [
-                        new iam.ArnPrincipal(`arn:aws:iam::${account}:role/cdk-${qualifier}-deploy-role-${account}-${region}`),
-                    ],
-                }));
-            }
-        }
-        if (bucketType === exports.S3SecureBucketType.ACCESS_LOG_BUCKET) {
-            const awsLogsPrefixResource = `${this.bucketArn}/AWSLogs/${account}/*`;
-            // Allow ALB / NLB log delivery (modern service principal path; also required in opt-in regions).
-            const albLogDeliveryPolicyResult = this.addToResourcePolicy(new iam.PolicyStatement({
-                effect: iam.Effect.ALLOW,
-                principals: [
-                    new iam.ServicePrincipal('logdelivery.elasticloadbalancing.amazonaws.com'),
-                ],
-                actions: [
-                    's3:PutObject',
-                ],
-                resources: [
-                    awsLogsPrefixResource,
-                ],
-            }));
-            // In non–opt-in regions (for example ap-northeast-1), access logs are often delivered using the
-            // regional ELBv2 account (root of that account) for s3:PutObject, not only the service principal above.
-            const stack = aws_cdk_lib_1.Stack.of(this);
-            const elbAccountId = aws_cdk_lib_1.Token.isUnresolved(stack.region)
-                ? stack.regionalFact(region_info_1.FactName.ELBV2_ACCOUNT)
-                : region_info_1.RegionInfo.get(stack.region).elbv2Account;
-            if (elbAccountId) {
-                this.addToResourcePolicy(new iam.PolicyStatement({
-                    effect: iam.Effect.ALLOW,
-                    principals: [
-                        new iam.AccountPrincipal(elbAccountId),
-                    ],
-                    actions: [
-                        's3:PutObject',
-                    ],
-                    resources: [
-                        awsLogsPrefixResource,
-                    ],
-                }));
-            }
-            this.accessLogBucketPolicyDependable = albLogDeliveryPolicyResult.policyDependable ?? this;
-            // Allow CloudFront standard logging (v2) to write logs
-            this.addToResourcePolicy(new iam.PolicyStatement({
-                effect: iam.Effect.ALLOW,
-                principals: [
-                    new iam.ServicePrincipal('delivery.logs.amazonaws.com'),
-                ],
-                actions: [
-                    's3:PutObject',
-                ],
-                resources: [
-                    awsLogsPrefixResource,
-                ],
-            }));
-            // Allow S3 server access logging to write logs when required by configuration
-            this.addToResourcePolicy(new iam.PolicyStatement({
-                effect: iam.Effect.ALLOW,
-                principals: [
-                    new iam.ServicePrincipal('logging.s3.amazonaws.com'),
-                ],
-                actions: [
-                    's3:PutObject',
-                ],
-                resources: [
-                    awsLogsPrefixResource,
-                ],
-            }));
-        }
-        if (bucketType === exports.S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET) {
-            const logsExportPrincipal = new iam.ServicePrincipal(`logs.${region}.amazonaws.com`);
-            const sourceLogGroupArn = `arn:aws:logs:${region}:${account}:log-group:*`;
-            this.addToResourcePolicy(new iam.PolicyStatement({
-                sid: 'AllowCloudWatchLogsExportGetBucketAcl',
-                effect: iam.Effect.ALLOW,
-                principals: [logsExportPrincipal],
-                actions: ['s3:GetBucketAcl'],
-                resources: [this.bucketArn],
-                conditions: {
-                    StringEquals: {
-                        'aws:SourceAccount': [account],
-                    },
-                    ArnLike: {
-                        'aws:SourceArn': [sourceLogGroupArn],
-                    },
-                },
-            }));
-            this.addToResourcePolicy(new iam.PolicyStatement({
-                sid: 'AllowCloudWatchLogsExportPutObject',
-                effect: iam.Effect.ALLOW,
-                principals: [logsExportPrincipal],
-                actions: ['s3:PutObject'],
-                resources: [`${this.bucketArn}/*`],
-                conditions: {
-                    StringEquals: {
-                        's3:x-amz-acl': 'bucket-owner-full-control',
-                        'aws:SourceAccount': [account],
-                    },
-                    ArnLike: {
-                        'aws:SourceArn': [sourceLogGroupArn],
-                    },
-                },
-            }));
-        }
-    }
-}
-exports.S3SecureBucket = S3SecureBucket;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLDZDQUFtRjtBQUNuRix5REFBMkM7QUFDM0MsdURBQXlDO0FBQ3pDLHlEQUErRDtBQUcvRDs7OztHQUlHO0FBQ1UsUUFBQSxrQkFBa0IsR0FBRztJQUNoQzs7O09BR0c7SUFDSCxtQ0FBbUMsRUFBRSxrQ0FBa0M7SUFDdkU7O09BRUc7SUFDSCx3QkFBd0IsRUFBRSx3QkFBd0I7SUFDbEQ7O09BRUc7SUFDSCxjQUFjLEVBQUUsZUFBZTtJQUMvQjs7Ozs7OztPQU9HO0lBQ0gsaUJBQWlCLEVBQUUsaUJBQWlCO0lBQ3BDOzs7O09BSUc7SUFDSCw4QkFBOEIsRUFBRSw0QkFBNEI7Q0FDcEQsQ0FBQztBQXNCWDs7Ozs7Ozs7R0FRRztBQUNILE1BQWEsY0FBZSxTQUFRLEVBQUUsQ0FBQyxNQUFNOztJQUMzQzs7Ozs7Ozs7T0FRRztJQUNhLCtCQUErQixDQUFlO0lBRTlEOzs7Ozs7T0FNRztJQUNILFlBQVksS0FBZ0IsRUFBRSxFQUFVLEVBQUUsS0FBMkI7UUFDbkUsTUFBTSxVQUFVLEdBQUcsS0FBSyxFQUFFLFVBQVUsSUFBSSwwQkFBa0IsQ0FBQyxjQUFjLENBQUM7UUFDMUUsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDZixHQUFHLEtBQUs7WUFDUixhQUFhLEVBQUUsMkJBQWEsQ0FBQyxNQUFNO1lBQ25DLFVBQVUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDaEIsSUFDRSxVQUFVLEtBQUssMEJBQWtCLENBQUMsd0JBQXdCO3VCQUN2RCxVQUFVLEtBQUssMEJBQWtCLENBQUMsaUJBQWlCO3VCQUNuRCxVQUFVLEtBQUssMEJBQWtCLENBQUMsOEJBQThCLEVBQ25FLENBQUM7b0JBQ0QsT0FBTyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDO2dCQUN4QyxDQUFDO2dCQUNELE9BQU8sS0FBSyxFQUFFLFVBQVUsSUFBSSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDO1lBQzlELENBQUMsQ0FBQyxFQUFFO1lBQ0osYUFBYSxFQUFFLENBQUMsR0FBRyxFQUFFO2dCQUNuQixJQUFJLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxDQUFDO29CQUMxQixPQUFPLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLENBQUMsYUFBYSxDQUFDO1lBQzdCLENBQUMsQ0FBQyxFQUFFO1lBQ0osa0JBQWtCLEVBQUUsU0FBUztZQUM3QixnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLGlCQUFpQixFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTO1lBQ2pELFVBQVUsRUFBRSxJQUFJO1lBQ2hCLFNBQVMsRUFBRSxLQUFLLEVBQUUsU0FBUyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUNsRSxlQUFlLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ3JCLElBQUksS0FBSyxFQUFFLGVBQWUsRUFBRSxDQUFDO29CQUMzQixPQUFPLEtBQUssQ0FBQyxlQUFlLENBQUM7Z0JBQy9CLENBQUM7Z0JBQ0QsT0FBTyxFQUFFLENBQUMsZUFBZSxDQUFDLHFCQUFxQixDQUFDO1lBQ2xELENBQUMsQ0FBQyxFQUFFO1NBQ0wsQ0FBQyxDQUFDO1FBRUgsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUE0QixDQUFDO1FBQ3pELElBQUksS0FBSyxFQUFFLGtCQUFrQixLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3ZDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyx1RUFBdUUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMvRyxDQUFDO1FBRUQsTUFBTSxPQUFPLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDO1FBQ3ZDLE1BQU0sTUFBTSxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUVyQyxJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyxtQ0FBbUMsRUFBRSxDQUFDO1lBRTFFLE1BQU0sU0FBUyxHQUFHLG1CQUFLLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQztZQUVoRSxJQUFJLFNBQVMsSUFBSSxDQUFDLFNBQVMsSUFBSSxxQ0FBdUIsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7Z0JBQzFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7b0JBQy9DLE9BQU8sRUFBRTt3QkFDUCxNQUFNO3FCQUNQO29CQUNELFNBQVMsRUFBRTt3QkFDVCxHQUFHLElBQUksQ0FBQyxTQUFTLEVBQUU7d0JBQ25CLEdBQUcsSUFBSSxDQUFDLFNBQVMsSUFBSTtxQkFDdEI7b0JBQ0QsVUFBVSxFQUFFO3dCQUNWLElBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsT0FBTyxhQUFhLFNBQVMsZ0JBQWdCLE9BQU8sSUFBSSxNQUFNLEVBQUUsQ0FBQztxQkFDdkc7aUJBQ0YsQ0FBQyxDQUFDLENBQUM7WUFDTixDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksVUFBVSxLQUFLLDBCQUFrQixDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDeEQsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLFlBQVksT0FBTyxJQUFJLENBQUM7WUFFdkUsaUdBQWlHO1lBQ2pHLE1BQU0sMEJBQTBCLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDbEYsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFO29CQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGdEQUFnRCxDQUFDO2lCQUMzRTtnQkFDRCxPQUFPLEVBQUU7b0JBQ1AsY0FBYztpQkFDZjtnQkFDRCxTQUFTLEVBQUU7b0JBQ1QscUJBQXFCO2lCQUN0QjthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosZ0dBQWdHO1lBQ2hHLHdHQUF3RztZQUN4RyxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM3QixNQUFNLFlBQVksR0FBRyxtQkFBSyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO2dCQUNuRCxDQUFDLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxzQkFBUSxDQUFDLGFBQWEsQ0FBQztnQkFDNUMsQ0FBQyxDQUFDLHdCQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxZQUFZLENBQUM7WUFDOUMsSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDakIsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztvQkFDL0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztvQkFDeEIsVUFBVSxFQUFFO3dCQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLFlBQVksQ0FBQztxQkFDdkM7b0JBQ0QsT0FBTyxFQUFFO3dCQUNQLGNBQWM7cUJBQ2Y7b0JBQ0QsU0FBUyxFQUFFO3dCQUNULHFCQUFxQjtxQkFDdEI7aUJBQ0YsQ0FBQyxDQUFDLENBQUM7WUFDTixDQUFDO1lBRUQsSUFBSSxDQUFDLCtCQUErQixHQUFHLDBCQUEwQixDQUFDLGdCQUFnQixJQUFJLElBQUksQ0FBQztZQUUzRix1REFBdUQ7WUFDdkQsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDL0MsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFO29CQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLDZCQUE2QixDQUFDO2lCQUN4RDtnQkFDRCxPQUFPLEVBQUU7b0JBQ1AsY0FBYztpQkFDZjtnQkFDRCxTQUFTLEVBQUU7b0JBQ1QscUJBQXFCO2lCQUN0QjthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosOEVBQThFO1lBQzlFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQy9DLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRTtvQkFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQywwQkFBMEIsQ0FBQztpQkFDckQ7Z0JBQ0QsT0FBTyxFQUFFO29CQUNQLGNBQWM7aUJBQ2Y7Z0JBQ0QsU0FBUyxFQUFFO29CQUNULHFCQUFxQjtpQkFDdEI7YUFDRixDQUFDLENBQUMsQ0FBQztRQUNOLENBQUM7UUFFRCxJQUFJLFVBQVUsS0FBSywwQkFBa0IsQ0FBQyw4QkFBOEIsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sbUJBQW1CLEdBQUcsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxNQUFNLGdCQUFnQixDQUFDLENBQUM7WUFDckYsTUFBTSxpQkFBaUIsR0FBRyxnQkFBZ0IsTUFBTSxJQUFJLE9BQU8sY0FBYyxDQUFDO1lBRTFFLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7Z0JBQy9DLEdBQUcsRUFBRSx1Q0FBdUM7Z0JBQzVDLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7Z0JBQ3hCLFVBQVUsRUFBRSxDQUFDLG1CQUFtQixDQUFDO2dCQUNqQyxPQUFPLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQztnQkFDNUIsU0FBUyxFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztnQkFDM0IsVUFBVSxFQUFFO29CQUNWLFlBQVksRUFBRTt3QkFDWixtQkFBbUIsRUFBRSxDQUFDLE9BQU8sQ0FBQztxQkFDL0I7b0JBQ0QsT0FBTyxFQUFFO3dCQUNQLGVBQWUsRUFBRSxDQUFDLGlCQUFpQixDQUFDO3FCQUNyQztpQkFDRjthQUNGLENBQUMsQ0FBQyxDQUFDO1lBRUosSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztnQkFDL0MsR0FBRyxFQUFFLG9DQUFvQztnQkFDekMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztnQkFDeEIsVUFBVSxFQUFFLENBQUMsbUJBQW1CLENBQUM7Z0JBQ2pDLE9BQU8sRUFBRSxDQUFDLGNBQWMsQ0FBQztnQkFDekIsU0FBUyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUM7Z0JBQ2xDLFVBQVUsRUFBRTtvQkFDVixZQUFZLEVBQUU7d0JBQ1osY0FBYyxFQUFFLDJCQUEyQjt3QkFDM0MsbUJBQW1CLEVBQUUsQ0FBQyxPQUFPLENBQUM7cUJBQy9CO29CQUNELE9BQU8sRUFBRTt3QkFDUCxlQUFlLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQztxQkFDckM7aUJBQ0Y7YUFDRixDQUFDLENBQUMsQ0FBQztRQUNOLENBQUM7SUFDSCxDQUFDOztBQTNMSCx3Q0E0TEMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBEZWZhdWx0U3RhY2tTeW50aGVzaXplciwgUmVtb3ZhbFBvbGljeSwgU3RhY2ssIFRva2VuIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgaWFtIGZyb20gJ2F3cy1jZGstbGliL2F3cy1pYW0nO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IEZhY3ROYW1lLCBSZWdpb25JbmZvIH0gZnJvbSAnYXdzLWNkay1saWIvcmVnaW9uLWluZm8nO1xuaW1wb3J0IHsgQ29uc3RydWN0LCBJRGVwZW5kYWJsZSB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIEJ1Y2tldCB0eXBlIGRpc2NyaW1pbmF0b3IgdmFsdWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfS5cbiAqXG4gKiBAc2VlIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9XG4gKi9cbmV4cG9ydCBjb25zdCBTM1NlY3VyZUJ1Y2tldFR5cGUgPSB7XG4gIC8qKlxuICAgKiBQaXBlbGluZSBhcnRpZmFjdCBidWNrZXQgd2hlbiB1c2luZyBhIGN1c3RvbSBDREsgYm9vdHN0cmFwIHF1YWxpZmllclxuICAgKiAoc2luZ2xlLSBvciBtdWx0aS1yZWdpb24gZGVwbG95bWVudHMpLlxuICAgKi9cbiAgREVQTE9ZTUVOVF9QSVBFTElORV9BUlRJRkFDVF9CVUNLRVQ6ICdEZXBsb3ltZW50UGlwZWxpbmVBcnRpZmFjdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBPcmlnaW4gYnVja2V0IGZvciBDbG91ZEZyb250IGRpc3RyaWJ1dGlvbnMuXG4gICAqL1xuICBDTE9VREZST05UX09SSUdJTl9CVUNLRVQ6ICdDbG91ZEZyb250T3JpZ2luQnVja2V0JyxcbiAgLyoqXG4gICAqIEdlbmVyYWwtcHVycG9zZSBzZWN1cmUgYnVja2V0IChkZWZhdWx0IHF1YWxpZmllciAvIHN0YW5kYXJkIHVzZSkuXG4gICAqL1xuICBERUZBVUxUX0JVQ0tFVDogJ0RlZmF1bHRCdWNrZXQnLFxuICAvKipcbiAgICogQ2VudHJhbGl6ZWQgYWNjZXNzIGxvZ3MgZm9yIHByb2R1Y2VycyBzdWNoIGFzIEFMQi9OTEIsIENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpLFxuICAgKiBhbmQgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nLiBHcmFudHMgYHMzOlB1dE9iamVjdGAgb24gYEFXU0xvZ3MvPGFjY291bnQ+LypgIG9ubHkgKG5vIHJlYWQvbGlzdCkuXG4gICAqXG4gICAqIEZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfSwgdGhlIHJlZ2lvbmFsIEVMQnYyIGxvZy1kZWxpdmVyeSBhY2NvdW50IElEXG4gICAqIChsZWdhY3kgcGF0aCBhbG9uZ3NpZGUgdGhlIGxvZyBkZWxpdmVyeSBzZXJ2aWNlIHByaW5jaXBhbCkgaXMgcmVzb2x2ZWQgZnJvbSBgYXdzLWNkay1saWIvcmVnaW9uLWluZm9gXG4gICAqIGF0IHN5bnRoZXNpcyB0aW1lIHdoZW4ge0BsaW5rIFN0YWNrI3JlZ2lvbn0gaXMga25vd24sIG9yIHZpYSBhIGRlcGxveS10aW1lIG1hcHBpbmcgd2hlbiBpdCBpcyBhIHRva2VuLlxuICAgKi9cbiAgQUNDRVNTX0xPR19CVUNLRVQ6ICdBY2Nlc3NMb2dCdWNrZXQnLFxuICAvKipcbiAgICogQXJjaGl2ZSBidWNrZXQgZm9yIGxvZyBkYXRhIGV4cG9ydGVkIGZyb20gQ2xvdWRXYXRjaCBMb2dzIHZpYSBleHBvcnQgdGFza3MuXG4gICAqIEdyYW50cyBgbG9ncy48cmVnaW9uPi5hbWF6b25hd3MuY29tYCBgczM6R2V0QnVja2V0QWNsYCBhbmQgYHMzOlB1dE9iamVjdGAgZm9yIGxvZyBncm91cHMgaW4gdGhlXG4gICAqIHN0YWNrIGFjY291bnQgYW5kIHJlZ2lvbiAoc2VlIEFXUyBkb2NzIGZvciBjcm9zcy1hY2NvdW50IGV4cG9ydCkuXG4gICAqL1xuICBDTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVQ6ICdDbG91ZFdhdGNoTG9nQXJjaGl2ZUJ1Y2tldCcsXG59IGFzIGNvbnN0O1xuXG4vKipcbiAqIERpc2NyaW1pbmF0ZWQgdW5pb24gb2Yge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0gc3RyaW5nIGxpdGVyYWxzLlxuICovXG5leHBvcnQgdHlwZSBTM1NlY3VyZUJ1Y2tldFR5cGUgPSB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlW2tleW9mIHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVdO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfTsgc2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3QuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUzNTZWN1cmVCdWNrZXRQcm9wcyBleHRlbmRzIHMzLkJ1Y2tldFByb3BzIHtcblxuICAvKipcbiAgICogU2VsZWN0cyBlbmNyeXB0aW9uIGRlZmF1bHRzIGFuZCBvcHRpb25hbCByZXNvdXJjZS1wb2xpY3kgc3RhdGVtZW50cy5cbiAgICpcbiAgICogQGRlZmF1bHQge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5ERUZBVUxUX0JVQ0tFVH1cbiAgICovXG4gIHJlYWRvbmx5IGJ1Y2tldFR5cGU/OiBTM1NlY3VyZUJ1Y2tldFR5cGU7XG59XG5cbi8qKlxuICogUzMgYnVja2V0IHdpdGggb3BpbmlvbmF0ZWQgc2VjdXJlIGRlZmF1bHRzOiBwcml2YXRlIEFDTHMsIGJsb2NrIHB1YmxpYyBhY2Nlc3MsIFRMUy1vbmx5IGFjY2VzcyxcbiAqIGFuZCBlbmNyeXB0aW9uIChTMy1tYW5hZ2VkIGZvciBsb2cvb3JpZ2luL2FyY2hpdmUgdHlwZXM7IEtNUy1tYW5hZ2VkIGJ5IGRlZmF1bHQgb3RoZXJ3aXNlKS5cbiAqXG4gKiBAcmVtYXJrc1xuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUfTogbWF5IGF0dGFjaCBhIGRlcGxveS1yb2xlIHBvbGljeSB3aGVuIGEgbm9uLWRlZmF1bHQgYm9vdHN0cmFwIHF1YWxpZmllciBpcyBwcmVzZW50LlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfTogYWRkcyBsb2ctd3JpdGVyIHByaW5jaXBhbHM7IHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfSBhbmQge0BsaW5rIFMzU2VjdXJlQnVja2V0I2FjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGV9LlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVH06IGFkZHMgQ2xvdWRXYXRjaCBMb2dzIGV4cG9ydCBwcmluY2lwYWxzIChgbG9ncy48cmVnaW9uPi5hbWF6b25hd3MuY29tYCkuXG4gKi9cbmV4cG9ydCBjbGFzcyBTM1NlY3VyZUJ1Y2tldCBleHRlbmRzIHMzLkJ1Y2tldCB7XG4gIC8qKlxuICAgKiBTZXQgb25seSB3aGVuIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9IGlzIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LlxuICAgKiBVc2UgYXMgYSBkZXBlbmRlbmN5IHRhcmdldCBzbyBsb2FkIGJhbGFuY2VyIGFjY2Vzcy1sb2cgZW5hYmxlbWVudCBydW5zIGFmdGVyIHRoZSBidWNrZXQgcG9saWN5XG4gICAqIGV4aXN0cyAoRUxCIHBlcmZvcm1zIGFuIGltbWVkaWF0ZSB2YWxpZGF0aW9uIGBQdXRPYmplY3RgIHRoYXQgZmFpbHMgaWYgdGhlIHBvbGljeSBpcyBub3QgYXBwbGllZCB5ZXQpLlxuICAgKlxuICAgKiBFeGFtcGxlOiBgbG9hZEJhbGFuY2VyLm5vZGUuYWRkRGVwZW5kZW5jeShidWNrZXQuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZSEpYC5cbiAgICpcbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIHdoZW4gYGJ1Y2tldFR5cGVgIGlzIG5vdCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfS5cbiAgICovXG4gIHB1YmxpYyByZWFkb25seSBhY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlPzogSURlcGVuZGFibGU7XG5cbiAgLyoqXG4gICAqIENyZWF0ZXMgYSBzZWN1cmUgUzMgYnVja2V0IGFjY29yZGluZyB0byBgYnVja2V0VHlwZWAgYW5kIG1lcmdlZCBgcHJvcHNgLlxuICAgKlxuICAgKiBAcGFyYW0gc2NvcGUgLSBQYXJlbnQgY29uc3RydWN0LCB0eXBpY2FsbHkgYSB7QGxpbmsgU3RhY2t9LlxuICAgKiBAcGFyYW0gaWQgLSBDb25zdHJ1Y3QgSUQgKHN0YWJsZSBsb2dpY2FsIElEIHNlZ21lbnQpLlxuICAgKiBAcGFyYW0gcHJvcHMgLSBPcHRpb25hbCB7QGxpbmsgczMuQnVja2V0UHJvcHN9IHBsdXMge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gYW5kIGBldmVudEJyaWRnZUVuYWJsZWRgIChhcHBsaWVkIHZpYSBMMSBvdmVycmlkZSB3aGVuIHRydWUpLlxuICAgKi9cbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM/OiBTM1NlY3VyZUJ1Y2tldFByb3BzKSB7XG4gICAgY29uc3QgYnVja2V0VHlwZSA9IHByb3BzPy5idWNrZXRUeXBlIHx8IFMzU2VjdXJlQnVja2V0VHlwZS5ERUZBVUxUX0JVQ0tFVDtcbiAgICBzdXBlcihzY29wZSwgaWQsIHtcbiAgICAgIC4uLnByb3BzLFxuICAgICAgcmVtb3ZhbFBvbGljeTogUmVtb3ZhbFBvbGljeS5SRVRBSU4sXG4gICAgICBlbmNyeXB0aW9uOiAoKCkgPT4ge1xuICAgICAgICBpZiAoXG4gICAgICAgICAgYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VERlJPTlRfT1JJR0lOX0JVQ0tFVFxuICAgICAgICAgIHx8IGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVFxuICAgICAgICAgIHx8IGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVRcbiAgICAgICAgKSB7XG4gICAgICAgICAgcmV0dXJuIHMzLkJ1Y2tldEVuY3J5cHRpb24uUzNfTUFOQUdFRDtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gcHJvcHM/LmVuY3J5cHRpb24gfHwgczMuQnVja2V0RW5jcnlwdGlvbi5LTVNfTUFOQUdFRDtcbiAgICAgIH0pKCksXG4gICAgICBhY2Nlc3NDb250cm9sOiAoKCkgPT4ge1xuICAgICAgICBpZiAoIXByb3BzPy5hY2Nlc3NDb250cm9sKSB7XG4gICAgICAgICAgcmV0dXJuIHMzLkJ1Y2tldEFjY2Vzc0NvbnRyb2wuUFJJVkFURTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gcHJvcHMuYWNjZXNzQ29udHJvbDtcbiAgICAgIH0pKCksXG4gICAgICBldmVudEJyaWRnZUVuYWJsZWQ6IHVuZGVmaW5lZCxcbiAgICAgIHB1YmxpY1JlYWRBY2Nlc3M6IGZhbHNlLFxuICAgICAgYmxvY2tQdWJsaWNBY2Nlc3M6IHMzLkJsb2NrUHVibGljQWNjZXNzLkJMT0NLX0FMTCxcbiAgICAgIGVuZm9yY2VTU0w6IHRydWUsXG4gICAgICB2ZXJzaW9uZWQ6IHByb3BzPy52ZXJzaW9uZWQgIT09IHVuZGVmaW5lZCA/IHByb3BzLnZlcnNpb25lZCA6IHRydWUsXG4gICAgICBvYmplY3RPd25lcnNoaXA6ICgoKSA9PiB7XG4gICAgICAgIGlmIChwcm9wcz8ub2JqZWN0T3duZXJzaGlwKSB7XG4gICAgICAgICAgcmV0dXJuIHByb3BzLm9iamVjdE93bmVyc2hpcDtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRDtcbiAgICAgIH0pKCksXG4gICAgfSk7XG5cbiAgICBjb25zdCBjZm5CdWNrZXQgPSB0aGlzLm5vZGUuZGVmYXVsdENoaWxkIGFzIHMzLkNmbkJ1Y2tldDtcbiAgICBpZiAocHJvcHM/LmV2ZW50QnJpZGdlRW5hYmxlZCA9PT0gdHJ1ZSkge1xuICAgICAgY2ZuQnVja2V0LmFkZFByb3BlcnR5T3ZlcnJpZGUoJ05vdGlmaWNhdGlvbkNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VDb25maWd1cmF0aW9uLkV2ZW50QnJpZGdlRW5hYmxlZCcsIHRydWUpO1xuICAgIH1cblxuICAgIGNvbnN0IGFjY291bnQgPSBTdGFjay5vZih0aGlzKS5hY2NvdW50O1xuICAgIGNvbnN0IHJlZ2lvbiA9IFN0YWNrLm9mKHRoaXMpLnJlZ2lvbjtcblxuICAgIGlmIChidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuREVQTE9ZTUVOVF9QSVBFTElORV9BUlRJRkFDVF9CVUNLRVQpIHtcblxuICAgICAgY29uc3QgcXVhbGlmaWVyID0gU3RhY2sub2YodGhpcykuc3ludGhlc2l6ZXIuYm9vdHN0cmFwUXVhbGlmaWVyO1xuXG4gICAgICBpZiAocXVhbGlmaWVyICYmIChxdWFsaWZpZXIgIT0gRGVmYXVsdFN0YWNrU3ludGhlc2l6ZXIuREVGQVVMVF9RVUFMSUZJRVIpKSB7XG4gICAgICAgIHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgICAgYWN0aW9uczogW1xuICAgICAgICAgICAgJ3MzOionLFxuICAgICAgICAgIF0sXG4gICAgICAgICAgcmVzb3VyY2VzOiBbXG4gICAgICAgICAgICBgJHt0aGlzLmJ1Y2tldEFybn1gLFxuICAgICAgICAgICAgYCR7dGhpcy5idWNrZXRBcm59LypgLFxuICAgICAgICAgIF0sXG4gICAgICAgICAgcHJpbmNpcGFsczogW1xuICAgICAgICAgICAgbmV3IGlhbS5Bcm5QcmluY2lwYWwoYGFybjphd3M6aWFtOjoke2FjY291bnR9OnJvbGUvY2RrLSR7cXVhbGlmaWVyfS1kZXBsb3ktcm9sZS0ke2FjY291bnR9LSR7cmVnaW9ufWApLFxuICAgICAgICAgIF0sXG4gICAgICAgIH0pKTtcbiAgICAgIH1cbiAgICB9XG5cbiAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUKSB7XG4gICAgICBjb25zdCBhd3NMb2dzUHJlZml4UmVzb3VyY2UgPSBgJHt0aGlzLmJ1Y2tldEFybn0vQVdTTG9ncy8ke2FjY291bnR9LypgO1xuXG4gICAgICAvLyBBbGxvdyBBTEIgLyBOTEIgbG9nIGRlbGl2ZXJ5IChtb2Rlcm4gc2VydmljZSBwcmluY2lwYWwgcGF0aDsgYWxzbyByZXF1aXJlZCBpbiBvcHQtaW4gcmVnaW9ucykuXG4gICAgICBjb25zdCBhbGJMb2dEZWxpdmVyeVBvbGljeVJlc3VsdCA9IHRoaXMuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgcHJpbmNpcGFsczogW1xuICAgICAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbG9nZGVsaXZlcnkuZWxhc3RpY2xvYWRiYWxhbmNpbmcuYW1hem9uYXdzLmNvbScpLFxuICAgICAgICBdLFxuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcblxuICAgICAgLy8gSW4gbm9u4oCTb3B0LWluIHJlZ2lvbnMgKGZvciBleGFtcGxlIGFwLW5vcnRoZWFzdC0xKSwgYWNjZXNzIGxvZ3MgYXJlIG9mdGVuIGRlbGl2ZXJlZCB1c2luZyB0aGVcbiAgICAgIC8vIHJlZ2lvbmFsIEVMQnYyIGFjY291bnQgKHJvb3Qgb2YgdGhhdCBhY2NvdW50KSBmb3IgczM6UHV0T2JqZWN0LCBub3Qgb25seSB0aGUgc2VydmljZSBwcmluY2lwYWwgYWJvdmUuXG4gICAgICBjb25zdCBzdGFjayA9IFN0YWNrLm9mKHRoaXMpO1xuICAgICAgY29uc3QgZWxiQWNjb3VudElkID0gVG9rZW4uaXNVbnJlc29sdmVkKHN0YWNrLnJlZ2lvbilcbiAgICAgICAgPyBzdGFjay5yZWdpb25hbEZhY3QoRmFjdE5hbWUuRUxCVjJfQUNDT1VOVClcbiAgICAgICAgOiBSZWdpb25JbmZvLmdldChzdGFjay5yZWdpb24pLmVsYnYyQWNjb3VudDtcbiAgICAgIGlmIChlbGJBY2NvdW50SWQpIHtcbiAgICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgICAgcHJpbmNpcGFsczogW1xuICAgICAgICAgICAgbmV3IGlhbS5BY2NvdW50UHJpbmNpcGFsKGVsYkFjY291bnRJZCksXG4gICAgICAgICAgXSxcbiAgICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICAgICAgICBdLFxuICAgICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgICAgICAgIF0sXG4gICAgICAgIH0pKTtcbiAgICAgIH1cblxuICAgICAgdGhpcy5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlID0gYWxiTG9nRGVsaXZlcnlQb2xpY3lSZXN1bHQucG9saWN5RGVwZW5kYWJsZSA/PyB0aGlzO1xuXG4gICAgICAvLyBBbGxvdyBDbG91ZEZyb250IHN0YW5kYXJkIGxvZ2dpbmcgKHYyKSB0byB3cml0ZSBsb2dzXG4gICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2RlbGl2ZXJ5LmxvZ3MuYW1hem9uYXdzLmNvbScpLFxuICAgICAgICBdLFxuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcblxuICAgICAgLy8gQWxsb3cgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nIHRvIHdyaXRlIGxvZ3Mgd2hlbiByZXF1aXJlZCBieSBjb25maWd1cmF0aW9uXG4gICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2xvZ2dpbmcuczMuYW1hem9uYXdzLmNvbScpLFxuICAgICAgICBdLFxuICAgICAgICBhY3Rpb25zOiBbXG4gICAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICAgIF0sXG4gICAgICAgIHJlc291cmNlczogW1xuICAgICAgICAgIGF3c0xvZ3NQcmVmaXhSZXNvdXJjZSxcbiAgICAgICAgXSxcbiAgICAgIH0pKTtcbiAgICB9XG5cbiAgICBpZiAoYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVCkge1xuICAgICAgY29uc3QgbG9nc0V4cG9ydFByaW5jaXBhbCA9IG5ldyBpYW0uU2VydmljZVByaW5jaXBhbChgbG9ncy4ke3JlZ2lvbn0uYW1hem9uYXdzLmNvbWApO1xuICAgICAgY29uc3Qgc291cmNlTG9nR3JvdXBBcm4gPSBgYXJuOmF3czpsb2dzOiR7cmVnaW9ufToke2FjY291bnR9OmxvZy1ncm91cDoqYDtcblxuICAgICAgdGhpcy5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgICAgc2lkOiAnQWxsb3dDbG91ZFdhdGNoTG9nc0V4cG9ydEdldEJ1Y2tldEFjbCcsXG4gICAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgICAgcHJpbmNpcGFsczogW2xvZ3NFeHBvcnRQcmluY2lwYWxdLFxuICAgICAgICBhY3Rpb25zOiBbJ3MzOkdldEJ1Y2tldEFjbCddLFxuICAgICAgICByZXNvdXJjZXM6IFt0aGlzLmJ1Y2tldEFybl0sXG4gICAgICAgIGNvbmRpdGlvbnM6IHtcbiAgICAgICAgICBTdHJpbmdFcXVhbHM6IHtcbiAgICAgICAgICAgICdhd3M6U291cmNlQWNjb3VudCc6IFthY2NvdW50XSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIEFybkxpa2U6IHtcbiAgICAgICAgICAgICdhd3M6U291cmNlQXJuJzogW3NvdXJjZUxvZ0dyb3VwQXJuXSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSkpO1xuXG4gICAgICB0aGlzLmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgICBzaWQ6ICdBbGxvd0Nsb3VkV2F0Y2hMb2dzRXhwb3J0UHV0T2JqZWN0JyxcbiAgICAgICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgICAgICBwcmluY2lwYWxzOiBbbG9nc0V4cG9ydFByaW5jaXBhbF0sXG4gICAgICAgIGFjdGlvbnM6IFsnczM6UHV0T2JqZWN0J10sXG4gICAgICAgIHJlc291cmNlczogW2Ake3RoaXMuYnVja2V0QXJufS8qYF0sXG4gICAgICAgIGNvbmRpdGlvbnM6IHtcbiAgICAgICAgICBTdHJpbmdFcXVhbHM6IHtcbiAgICAgICAgICAgICdzMzp4LWFtei1hY2wnOiAnYnVja2V0LW93bmVyLWZ1bGwtY29udHJvbCcsXG4gICAgICAgICAgICAnYXdzOlNvdXJjZUFjY291bnQnOiBbYWNjb3VudF0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBBcm5MaWtlOiB7XG4gICAgICAgICAgICAnYXdzOlNvdXJjZUFybic6IFtzb3VyY2VMb2dHcm91cEFybl0sXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgIH0pKTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==
+var s3_secure_bucket_1 = require("./s3-secure-bucket");
+Object.defineProperty(exports, "S3SecureBucket", { enumerable: true, get: function () { return s3_secure_bucket_1.S3SecureBucket; } });
+var bucket_types_1 = require("./bucket-types");
+Object.defineProperty(exports, "S3SecureBucketType", { enumerable: true, get: function () { return bucket_types_1.S3SecureBucketType; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUE7Ozs7R0FJRztBQUNILHVEQUFvRDtBQUEzQyxrSEFBQSxjQUFjLE9BQUE7QUFDdkIsK0NBQW9EO0FBQTNDLGtIQUFBLGtCQUFrQixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBQdWJsaWMgZW50cnkgcG9pbnQgZm9yIHRoZSBgczMtc2VjdXJlLWJ1Y2tldGAgY29uc3RydWN0IGxpYnJhcnkuXG4gKlxuICogQHBhY2thZ2VEb2N1bWVudGF0aW9uXG4gKi9cbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0IH0gZnJvbSAnLi9zMy1zZWN1cmUtYnVja2V0JztcbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbmV4cG9ydCB0eXBlIHsgUzNTZWN1cmVCdWNrZXRQcm9wcyB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbiJdfQ==