s3-secure-bucket 0.4.4 → 0.5.0

package/.jsii

@@ -8456,7 +8456,7 @@
   },
   "name": "s3-secure-bucket",
   "readme": {
-    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)\n- **`bucketType` presets**\n  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)\n  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### CDK deployment pipeline artifact bucket\n\nWhen the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {\n  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,\n});\n```\n\n### CloudFront origin bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst originBucket = new S3SecureBucket(stack, 'OriginBucket', {\n  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,\n});\n```\n\nWire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n### CloudWatch Logs export archive bucket\n\nStore log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {\n  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,\n});\n```\n\nFor cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |\n| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)\n- **`bucketType` presets**\n  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`). Writers default to `AWSLogs/<stack account>/*`; override with `accessLogDelivery` (`allowedSourceAccountIds` or `organizationId`)\n  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### CDK deployment pipeline artifact bucket\n\nWhen the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {\n  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,\n});\n```\n\n### CloudFront origin bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst originBucket = new S3SecureBucket(stack, 'OriginBucket', {\n  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,\n});\n```\n\nWire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nTo accept logs from other accounts, set **exactly one** of the following on `accessLogDelivery` (the stack account is **not** added automatically):\n\n```typescript\nconst multiAccountLogBucket = new S3SecureBucket(stack, 'MultiAccountAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    allowedSourceAccountIds: ['111111111111', '222222222222'],\n  },\n});\n\nconst organizationLogBucket = new S3SecureBucket(stack, 'OrganizationAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    organizationId: 'o-xxxxxxxxxx',\n  },\n});\n```\n\nOrganization scope uses resource `AWSLogs/*` and `aws:SourceOrgID` on the log-delivery **service** principals. The regional ELBv2 account statement is not organization-conditioned (that principal is not an organization member).\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n### CloudWatch Logs export archive bucket\n\nStore log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {\n  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,\n});\n```\n\nFor cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| `accessLogDelivery` | `AccessLogDeliveryScope` | stack account only | `ACCESS_LOG_BUCKET` only. Exactly one of `allowedSourceAccountIds` or `organizationId`. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` by default; widen with `accessLogDelivery`) |\n| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8469,12 +8469,74 @@
     }
   },
   "types": {
+    "s3-secure-bucket.AccessLogDeliveryScope": {
+      "assembly": "s3-secure-bucket",
+      "datatype": true,
+      "docs": {
+        "remarks": "Specify **exactly one** of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or\n{@link AccessLogDeliveryScope.organizationId}. Omit {@link S3SecureBucketProps.accessLogDelivery }\nto allow only the stack account (default).\n\njsii does not support a discriminated union of structs, so exclusivity is enforced at construct time.",
+        "stability": "stable",
+        "summary": "Account scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET } resource policies."
+      },
+      "fqn": "s3-secure-bucket.AccessLogDeliveryScope",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/bucket-types/access-log-delivery-scope.ts",
+        "line": 10
+      },
+      "name": "AccessLogDeliveryScope",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "undefined (do not use an explicit account list)",
+            "remarks": "The list is used as specified; include the stack account if that account should also deliver logs.\nDuplicate IDs are ignored. Mutually exclusive with {@link AccessLogDeliveryScope.organizationId}.",
+            "stability": "stable",
+            "summary": "Account IDs allowed to write under `AWSLogs/<accountId>/*`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/bucket-types/access-log-delivery-scope.ts",
+            "line": 19
+          },
+          "name": "allowedSourceAccountIds",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "undefined (do not use an organization-wide policy)",
+            "remarks": "Allows log delivery from accounts in the organization via `aws:SourceOrgID`,\nwith resource `AWSLogs/*`. Mutually exclusive with {@link AccessLogDeliveryScope.allowedSourceAccountIds}.",
+            "stability": "stable",
+            "summary": "AWS Organizations ID (`o-` followed by 10–32 lowercase letters or digits)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/bucket-types/access-log-delivery-scope.ts",
+            "line": 29
+          },
+          "name": "organizationId",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/bucket-types/access-log-delivery-scope:AccessLogDeliveryScope"
+    },
     "s3-secure-bucket.S3SecureBucket": {
       "assembly": "s3-secure-bucket",
       "base": "aws-cdk-lib.aws_s3.Bucket",
       "docs": {
         "custom": {
-          "remarks": "Secure defaults applied regardless of `props`:\n- `removalPolicy`: {@link RemovalPolicy.RETAIN }\n- `publicReadAccess`: `false`\n- `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL }\n- `enforceSSL`: `true`\n- `versioned`: `true` unless explicitly set in `props`\n- `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED } unless overridden\n- `accessControl`: {@link s3.BucketAccessControl.PRIVATE } unless overridden\n\nBucket-type-specific behavior:\n- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
+          "remarks": "Secure defaults applied regardless of `props`:\n- `removalPolicy`: {@link RemovalPolicy.RETAIN }\n- `publicReadAccess`: `false`\n- `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL }\n- `enforceSSL`: `true`\n- `versioned`: `true` unless explicitly set in `props`\n- `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED } unless overridden\n- `accessControl`: {@link s3.BucketAccessControl.PRIVATE } unless overridden\n\nBucket-type-specific behavior:\n- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable }\n  and {@link S3SecureBucketProps.accessLogDelivery }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
         },
         "remarks": "KMS-managed by default otherwise).",
         "stability": "stable",
@@ -8488,7 +8550,7 @@
         },
         "locationInModule": {
           "filename": "src/s3-secure-bucket.ts",
-          "line": 50
+          "line": 51
         },
         "parameters": [
           {
@@ -8525,7 +8587,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/s3-secure-bucket.ts",
-        "line": 30
+        "line": 31
       },
       "name": "S3SecureBucket",
       "properties": [
@@ -8539,7 +8601,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/s3-secure-bucket.ts",
-            "line": 40
+            "line": 41
           },
           "name": "accessLogBucketPolicyDependable",
           "optional": true,
@@ -8565,10 +8627,29 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/bucket-types/props.ts",
-        "line": 10
+        "line": 11
       },
       "name": "S3SecureBucketProps",
       "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "stack account only",
+            "remarks": "Specify exactly one of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or\n{@link AccessLogDeliveryScope.organizationId}. When omitted, only the stack account\nmay deliver logs (`AWSLogs/<stack account>/*`).\n\nSupported only when {@link S3SecureBucketProps.bucketType} is\n{@link S3SecureBucketType.ACCESS_LOG_BUCKET}.",
+            "stability": "stable",
+            "summary": "Account or organization scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET} writers."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/bucket-types/props.ts",
+            "line": 32
+          },
+          "name": "accessLogDelivery",
+          "optional": true,
+          "type": {
+            "fqn": "s3-secure-bucket.AccessLogDeliveryScope"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -8579,7 +8660,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/bucket-types/props.ts",
-            "line": 17
+            "line": 18
           },
           "name": "bucketType",
           "optional": true,
@@ -8591,6 +8672,6 @@
       "symbolId": "src/bucket-types/props:S3SecureBucketProps"
     }
   },
-  "version": "0.4.4",
-  "fingerprint": "gVaatSIXJvO6r+S0+/GPOHy3nP+t7uyu2PMH7GuYIP0="
+  "version": "0.5.0",
+  "fingerprint": "nvK17FwH8pGzYr+bm69kCg5PnIhuAZGOA/uLz/68tKM="
 }

package/API.md

@@ -1352,6 +1352,65 @@ Uniquely identifies this class.
 
 ## Structs <a name="Structs" id="Structs"></a>
 
+### AccessLogDeliveryScope <a name="AccessLogDeliveryScope" id="s3-secure-bucket.AccessLogDeliveryScope"></a>
+
+Account scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET } resource policies.
+
+Specify **exactly one** of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or
+{@link AccessLogDeliveryScope.organizationId}. Omit {@link S3SecureBucketProps.accessLogDelivery }
+to allow only the stack account (default).
+
+jsii does not support a discriminated union of structs, so exclusivity is enforced at construct time.
+
+#### Initializer <a name="Initializer" id="s3-secure-bucket.AccessLogDeliveryScope.Initializer"></a>
+
+```typescript
+import { AccessLogDeliveryScope } from 's3-secure-bucket'
+
+const accessLogDeliveryScope: AccessLogDeliveryScope = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#s3-secure-bucket.AccessLogDeliveryScope.property.allowedSourceAccountIds">allowedSourceAccountIds</a></code> | <code>string[]</code> | Account IDs allowed to write under `AWSLogs/<accountId>/*`. |
+| <code><a href="#s3-secure-bucket.AccessLogDeliveryScope.property.organizationId">organizationId</a></code> | <code>string</code> | AWS Organizations ID (`o-` followed by 10–32 lowercase letters or digits). |
+
+---
+
+##### `allowedSourceAccountIds`<sup>Optional</sup> <a name="allowedSourceAccountIds" id="s3-secure-bucket.AccessLogDeliveryScope.property.allowedSourceAccountIds"></a>
+
+```typescript
+public readonly allowedSourceAccountIds: string[];
+```
+
+- *Type:* string[]
+- *Default:* undefined (do not use an explicit account list)
+
+Account IDs allowed to write under `AWSLogs/<accountId>/*`.
+
+The list is used as specified; include the stack account if that account should also deliver logs.
+Duplicate IDs are ignored. Mutually exclusive with {@link AccessLogDeliveryScope.organizationId}.
+
+---
+
+##### `organizationId`<sup>Optional</sup> <a name="organizationId" id="s3-secure-bucket.AccessLogDeliveryScope.property.organizationId"></a>
+
+```typescript
+public readonly organizationId: string;
+```
+
+- *Type:* string
+- *Default:* undefined (do not use an organization-wide policy)
+
+AWS Organizations ID (`o-` followed by 10–32 lowercase letters or digits).
+
+Allows log delivery from accounts in the organization via `aws:SourceOrgID`,
+with resource `AWSLogs/*`. Mutually exclusive with {@link AccessLogDeliveryScope.allowedSourceAccountIds}.
+
+---
+
 ### S3SecureBucketProps <a name="S3SecureBucketProps" id="s3-secure-bucket.S3SecureBucketProps"></a>
 
 Construction properties for {@link S3SecureBucket }.
@@ -1405,6 +1464,7 @@ const s3SecureBucketProps: S3SecureBucketProps = { ... }
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteIndexDocument">websiteIndexDocument</a></code> | <code>string</code> | The name of the index document (e.g. "index.html") for the website. Enables static website hosting for this bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRedirect">websiteRedirect</a></code> | <code>aws-cdk-lib.aws_s3.RedirectTarget</code> | Specifies the redirect behavior of all requests to a website endpoint of a bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.websiteRoutingRules">websiteRoutingRules</a></code> | <code>aws-cdk-lib.aws_s3.RoutingRule[]</code> | Rules that define when a redirect is applied and the redirect behavior. |
+| <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.accessLogDelivery">accessLogDelivery</a></code> | <code><a href="#s3-secure-bucket.AccessLogDeliveryScope">AccessLogDeliveryScope</a></code> | Account or organization scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET} writers. |
 | <code><a href="#s3-secure-bucket.S3SecureBucketProps.property.bucketType">bucketType</a></code> | <code>string</code> | Selects encryption defaults and optional resource-policy statements. |
 
 ---
@@ -1919,6 +1979,26 @@ Rules that define when a redirect is applied and the redirect behavior.
 
 ---
 
+##### `accessLogDelivery`<sup>Optional</sup> <a name="accessLogDelivery" id="s3-secure-bucket.S3SecureBucketProps.property.accessLogDelivery"></a>
+
+```typescript
+public readonly accessLogDelivery: AccessLogDeliveryScope;
+```
+
+- *Type:* <a href="#s3-secure-bucket.AccessLogDeliveryScope">AccessLogDeliveryScope</a>
+- *Default:* stack account only
+
+Account or organization scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET} writers.
+
+Specify exactly one of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or
+{@link AccessLogDeliveryScope.organizationId}. When omitted, only the stack account
+may deliver logs (`AWSLogs/<stack account>/*`).
+
+Supported only when {@link S3SecureBucketProps.bucketType} is
+{@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+
+---
+
 ##### `bucketType`<sup>Optional</sup> <a name="bucketType" id="s3-secure-bucket.S3SecureBucketProps.property.bucketType"></a>
 
 ```typescript

package/README.md

@@ -20,7 +20,7 @@ AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/a
   - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)
   - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier
   - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use
-  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` on `AWSLogs/<account>/*` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`)
+  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`). Writers default to `AWSLogs/<stack account>/*`; override with `accessLogDelivery` (`allowedSourceAccountIds` or `organizationId`)
   - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)
 - **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)
 
@@ -102,6 +102,26 @@ const accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {
 // loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);
 ```
 
+To accept logs from other accounts, set **exactly one** of the following on `accessLogDelivery` (the stack account is **not** added automatically):
+
+```typescript
+const multiAccountLogBucket = new S3SecureBucket(stack, 'MultiAccountAccessLogBucket', {
+  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,
+  accessLogDelivery: {
+    allowedSourceAccountIds: ['111111111111', '222222222222'],
+  },
+});
+
+const organizationLogBucket = new S3SecureBucket(stack, 'OrganizationAccessLogBucket', {
+  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,
+  accessLogDelivery: {
+    organizationId: 'o-xxxxxxxxxx',
+  },
+});
+```
+
+Organization scope uses resource `AWSLogs/*` and `aws:SourceOrgID` on the log-delivery **service** principals. The regional ELBv2 account statement is not organization-conditioned (that principal is not an organization member).
+
 Wire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.
 
 ### CloudWatch Logs export archive bucket
@@ -130,6 +150,7 @@ For cross-account export, extend the bucket policy with additional `aws:SourceAc
 | Property | Type | Default | Description |
 | --- | --- | --- | --- |
 | `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |
+| `accessLogDelivery` | `AccessLogDeliveryScope` | stack account only | `ACCESS_LOG_BUCKET` only. Exactly one of `allowedSourceAccountIds` or `organizationId`. |
 | *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |
 
 ### `S3SecureBucketType` values
@@ -139,7 +160,7 @@ For cross-account export, extend the bucket policy with additional `aws:SourceAc
 | `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |
 | `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |
 | `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |
-| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` writers only) |
+| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` by default; widen with `accessLogDelivery`) |
 | `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |
 
 ### Read-only: `accessLogBucketPolicyDependable`

package/lib/bucket-policies/access-log-bucket-policy.d.ts

@@ -2,14 +2,17 @@ import { BucketPolicyApplyResult, BucketPolicyContext } from './types';
 /**
  * Adds resource policies for ALB/NLB, CloudFront standard logging (v2), and S3 server access logging.
  *
- * Grants `s3:PutObject` on `AWSLogs/<stack.account>/*` to:
+ * Grants `s3:PutObject` on `AWSLogs/...` prefixes to:
  * - `logdelivery.elasticloadbalancing.amazonaws.com`
  * - The regional ELBv2 log-delivery account (when known)
  * - `delivery.logs.amazonaws.com`
  * - `logging.s3.amazonaws.com`
  *
- * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * Prefixes default to `AWSLogs/<stack.account>/*`. {@link BucketPolicyContext.accessLogDelivery}
+ * can widen this to an explicit account list or to `AWSLogs/*` constrained by `aws:SourceOrgID`.
+ *
+ * @param context - Bucket, owning stack, and optional delivery scope.
  * @returns A result containing {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable} for the
  * first (ELB) policy statement so load balancer log enablement can wait until the bucket policy exists.
  */
-export declare const applyAccessLogBucketPolicy: ({ bucket, stack, }: BucketPolicyContext) => BucketPolicyApplyResult;
+export declare const applyAccessLogBucketPolicy: ({ bucket, stack, accessLogDelivery, }: BucketPolicyContext) => BucketPolicyApplyResult;

package/lib/bucket-policies/access-log-bucket-policy.js

@@ -37,21 +37,43 @@ exports.applyAccessLogBucketPolicy = void 0;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 const region_info_1 = require("aws-cdk-lib/region-info");
+const resolve_access_log_delivery_1 = require("./resolve-access-log-delivery");
+const ELB_SOURCE_ARN = 'arn:aws:elasticloadbalancing:*:*:loadbalancer/*';
 /**
  * Adds resource policies for ALB/NLB, CloudFront standard logging (v2), and S3 server access logging.
  *
- * Grants `s3:PutObject` on `AWSLogs/<stack.account>/*` to:
+ * Grants `s3:PutObject` on `AWSLogs/...` prefixes to:
  * - `logdelivery.elasticloadbalancing.amazonaws.com`
  * - The regional ELBv2 log-delivery account (when known)
  * - `delivery.logs.amazonaws.com`
  * - `logging.s3.amazonaws.com`
  *
- * @param context - Bucket and owning stack (account and region are read from `stack`).
+ * Prefixes default to `AWSLogs/<stack.account>/*`. {@link BucketPolicyContext.accessLogDelivery}
+ * can widen this to an explicit account list or to `AWSLogs/*` constrained by `aws:SourceOrgID`.
+ *
+ * @param context - Bucket, owning stack, and optional delivery scope.
  * @returns A result containing {@link BucketPolicyApplyResult.accessLogBucketPolicyDependable} for the
  * first (ELB) policy statement so load balancer log enablement can wait until the bucket policy exists.
  */
-const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
-    const awsLogsPrefixResource = `${bucket.bucketArn}/AWSLogs/${stack.account}/*`;
+const applyAccessLogBucketPolicy = ({ bucket, stack, accessLogDelivery, }) => {
+    const { awsLogsResources, organizationId } = (0, resolve_access_log_delivery_1.resolveAccessLogDelivery)(bucket.bucketArn, stack.account, accessLogDelivery);
+    const organizationConditions = organizationId === undefined
+        ? undefined
+        : {
+            StringEquals: {
+                'aws:SourceOrgID': organizationId,
+            },
+        };
+    const albOrganizationConditions = organizationId === undefined
+        ? undefined
+        : {
+            StringEquals: {
+                'aws:SourceOrgID': organizationId,
+            },
+            ArnLike: {
+                'aws:SourceArn': ELB_SOURCE_ARN,
+            },
+        };
     // Allow ALB / NLB log delivery (modern service principal path; also required in opt-in regions).
     const albLogDeliveryPolicyResult = bucket.addToResourcePolicy(new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
@@ -61,9 +83,8 @@ const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
         actions: [
             's3:PutObject',
         ],
-        resources: [
-            awsLogsPrefixResource,
-        ],
+        resources: awsLogsResources,
+        conditions: albOrganizationConditions,
     }));
     // In non–opt-in regions (for example ap-northeast-1), access logs are often delivered using the
     // regional ELBv2 account (root of that account) for s3:PutObject, not only the service principal above.
@@ -79,9 +100,8 @@ const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
             actions: [
                 's3:PutObject',
             ],
-            resources: [
-                awsLogsPrefixResource,
-            ],
+            resources: awsLogsResources,
+            // The ELBv2 delivery account is not an organization member; do not attach aws:SourceOrgID.
         }));
     }
     // Allow CloudFront standard logging (v2) to write logs
@@ -93,9 +113,8 @@ const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
         actions: [
             's3:PutObject',
         ],
-        resources: [
-            awsLogsPrefixResource,
-        ],
+        resources: awsLogsResources,
+        conditions: organizationConditions,
     }));
     // Allow S3 server access logging to write logs when required by configuration
     bucket.addToResourcePolicy(new iam.PolicyStatement({
@@ -106,13 +125,12 @@ const applyAccessLogBucketPolicy = ({ bucket, stack, }) => {
         actions: [
             's3:PutObject',
         ],
-        resources: [
-            awsLogsPrefixResource,
-        ],
+        resources: awsLogsResources,
+        conditions: organizationConditions,
     }));
     return {
         accessLogBucketPolicyDependable: albLogDeliveryPolicyResult.policyDependable ?? bucket,
     };
 };
 exports.applyAccessLogBucketPolicy = applyAccessLogBucketPolicy;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWxvZy1idWNrZXQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC1wb2xpY2llcy9hY2Nlc3MtbG9nLWJ1Y2tldC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQW9DO0FBQ3BDLHlEQUEyQztBQUMzQyx5REFBK0Q7QUFHL0Q7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEVBQ3pDLE1BQU0sRUFDTixLQUFLLEdBQ2UsRUFBMkIsRUFBRTtJQUNqRCxNQUFNLHFCQUFxQixHQUFHLEdBQUcsTUFBTSxDQUFDLFNBQVMsWUFBWSxLQUFLLENBQUMsT0FBTyxJQUFJLENBQUM7SUFFL0UsaUdBQWlHO0lBQ2pHLE1BQU0sMEJBQTBCLEdBQUcsTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztRQUNwRixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO1FBQ3hCLFVBQVUsRUFBRTtZQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLGdEQUFnRCxDQUFDO1NBQzNFO1FBQ0QsT0FBTyxFQUFFO1lBQ1AsY0FBYztTQUNmO1FBQ0QsU0FBUyxFQUFFO1lBQ1QscUJBQXFCO1NBQ3RCO0tBQ0YsQ0FBQyxDQUFDLENBQUM7SUFFSixnR0FBZ0c7SUFDaEcsd0dBQXdHO0lBQ3hHLE1BQU0sWUFBWSxHQUFHLG1CQUFLLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDbkQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsc0JBQVEsQ0FBQyxhQUFhLENBQUM7UUFDNUMsQ0FBQyxDQUFDLHdCQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxZQUFZLENBQUM7SUFDOUMsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNqQixNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1lBQ2pELE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7WUFDeEIsVUFBVSxFQUFFO2dCQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLFlBQVksQ0FBQzthQUN2QztZQUNELE9BQU8sRUFBRTtnQkFDUCxjQUFjO2FBQ2Y7WUFDRCxTQUFTLEVBQUU7Z0JBQ1QscUJBQXFCO2FBQ3RCO1NBQ0YsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRUQsdURBQXVEO0lBQ3ZELE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztRQUN4QixVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyw2QkFBNkIsQ0FBQztTQUN4RDtRQUNELE9BQU8sRUFBRTtZQUNQLGNBQWM7U0FDZjtRQUNELFNBQVMsRUFBRTtZQUNULHFCQUFxQjtTQUN0QjtLQUNGLENBQUMsQ0FBQyxDQUFDO0lBRUosOEVBQThFO0lBQzlFLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDakQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztRQUN4QixVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQywwQkFBMEIsQ0FBQztTQUNyRDtRQUNELE9BQU8sRUFBRTtZQUNQLGNBQWM7U0FDZjtRQUNELFNBQVMsRUFBRTtZQUNULHFCQUFxQjtTQUN0QjtLQUNGLENBQUMsQ0FBQyxDQUFDO0lBRUosT0FBTztRQUNMLCtCQUErQixFQUFFLDBCQUEwQixDQUFDLGdCQUFnQixJQUFJLE1BQU07S0FDdkYsQ0FBQztBQUNKLENBQUMsQ0FBQztBQXZFVyxRQUFBLDBCQUEwQiw4QkF1RXJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBGYWN0TmFtZSwgUmVnaW9uSW5mbyB9IGZyb20gJ2F3cy1jZGstbGliL3JlZ2lvbi1pbmZvJztcbmltcG9ydCB7IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LCBCdWNrZXRQb2xpY3lDb250ZXh0IH0gZnJvbSAnLi90eXBlcyc7XG5cbi8qKlxuICogQWRkcyByZXNvdXJjZSBwb2xpY2llcyBmb3IgQUxCL05MQiwgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MiksIGFuZCBTMyBzZXJ2ZXIgYWNjZXNzIGxvZ2dpbmcuXG4gKlxuICogR3JhbnRzIGBzMzpQdXRPYmplY3RgIG9uIGBBV1NMb2dzLzxzdGFjay5hY2NvdW50Pi8qYCB0bzpcbiAqIC0gYGxvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb21gXG4gKiAtIFRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCAod2hlbiBrbm93bilcbiAqIC0gYGRlbGl2ZXJ5LmxvZ3MuYW1hem9uYXdzLmNvbWBcbiAqIC0gYGxvZ2dpbmcuczMuYW1hem9uYXdzLmNvbWBcbiAqXG4gKiBAcGFyYW0gY29udGV4dCAtIEJ1Y2tldCBhbmQgb3duaW5nIHN0YWNrIChhY2NvdW50IGFuZCByZWdpb24gYXJlIHJlYWQgZnJvbSBgc3RhY2tgKS5cbiAqIEByZXR1cm5zIEEgcmVzdWx0IGNvbnRhaW5pbmcge0BsaW5rIEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGV9IGZvciB0aGVcbiAqIGZpcnN0IChFTEIpIHBvbGljeSBzdGF0ZW1lbnQgc28gbG9hZCBiYWxhbmNlciBsb2cgZW5hYmxlbWVudCBjYW4gd2FpdCB1bnRpbCB0aGUgYnVja2V0IHBvbGljeSBleGlzdHMuXG4gKi9cbmV4cG9ydCBjb25zdCBhcHBseUFjY2Vzc0xvZ0J1Y2tldFBvbGljeSA9ICh7XG4gIGJ1Y2tldCxcbiAgc3RhY2ssXG59OiBCdWNrZXRQb2xpY3lDb250ZXh0KTogQnVja2V0UG9saWN5QXBwbHlSZXN1bHQgPT4ge1xuICBjb25zdCBhd3NMb2dzUHJlZml4UmVzb3VyY2UgPSBgJHtidWNrZXQuYnVja2V0QXJufS9BV1NMb2dzLyR7c3RhY2suYWNjb3VudH0vKmA7XG5cbiAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICBjb25zdCBhbGJMb2dEZWxpdmVyeVBvbGljeVJlc3VsdCA9IGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgcHJpbmNpcGFsczogW1xuICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dkZWxpdmVyeS5lbGFzdGljbG9hZGJhbGFuY2luZy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogW1xuICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgIF0sXG4gIH0pKTtcblxuICAvLyBJbiBub27igJNvcHQtaW4gcmVnaW9ucyAoZm9yIGV4YW1wbGUgYXAtbm9ydGhlYXN0LTEpLCBhY2Nlc3MgbG9ncyBhcmUgb2Z0ZW4gZGVsaXZlcmVkIHVzaW5nIHRoZVxuICAvLyByZWdpb25hbCBFTEJ2MiBhY2NvdW50IChyb290IG9mIHRoYXQgYWNjb3VudCkgZm9yIHMzOlB1dE9iamVjdCwgbm90IG9ubHkgdGhlIHNlcnZpY2UgcHJpbmNpcGFsIGFib3ZlLlxuICBjb25zdCBlbGJBY2NvdW50SWQgPSBUb2tlbi5pc1VucmVzb2x2ZWQoc3RhY2sucmVnaW9uKVxuICAgID8gc3RhY2sucmVnaW9uYWxGYWN0KEZhY3ROYW1lLkVMQlYyX0FDQ09VTlQpXG4gICAgOiBSZWdpb25JbmZvLmdldChzdGFjay5yZWdpb24pLmVsYnYyQWNjb3VudDtcbiAgaWYgKGVsYkFjY291bnRJZCkge1xuICAgIGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICAgIHByaW5jaXBhbHM6IFtcbiAgICAgICAgbmV3IGlhbS5BY2NvdW50UHJpbmNpcGFsKGVsYkFjY291bnRJZCksXG4gICAgICBdLFxuICAgICAgYWN0aW9uczogW1xuICAgICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICAgIF0sXG4gICAgICByZXNvdXJjZXM6IFtcbiAgICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgICAgXSxcbiAgICB9KSk7XG4gIH1cblxuICAvLyBBbGxvdyBDbG91ZEZyb250IHN0YW5kYXJkIGxvZ2dpbmcgKHYyKSB0byB3cml0ZSBsb2dzXG4gIGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgcHJpbmNpcGFsczogW1xuICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdkZWxpdmVyeS5sb2dzLmFtYXpvbmF3cy5jb20nKSxcbiAgICBdLFxuICAgIGFjdGlvbnM6IFtcbiAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgIF0sXG4gICAgcmVzb3VyY2VzOiBbXG4gICAgICBhd3NMb2dzUHJlZml4UmVzb3VyY2UsXG4gICAgXSxcbiAgfSkpO1xuXG4gIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICBidWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgIHByaW5jaXBhbHM6IFtcbiAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbG9nZ2luZy5zMy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogW1xuICAgICAgYXdzTG9nc1ByZWZpeFJlc291cmNlLFxuICAgIF0sXG4gIH0pKTtcblxuICByZXR1cm4ge1xuICAgIGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU6IGFsYkxvZ0RlbGl2ZXJ5UG9saWN5UmVzdWx0LnBvbGljeURlcGVuZGFibGUgPz8gYnVja2V0LFxuICB9O1xufTtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWxvZy1idWNrZXQtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC1wb2xpY2llcy9hY2Nlc3MtbG9nLWJ1Y2tldC1wb2xpY3kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsNkNBQW9DO0FBQ3BDLHlEQUEyQztBQUMzQyx5REFBK0Q7QUFDL0QsK0VBQXlFO0FBR3pFLE1BQU0sY0FBYyxHQUFHLGlEQUFpRCxDQUFDO0FBRXpFOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUNJLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxFQUN6QyxNQUFNLEVBQ04sS0FBSyxFQUNMLGlCQUFpQixHQUNHLEVBQTJCLEVBQUU7SUFDakQsTUFBTSxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxHQUFHLElBQUEsc0RBQXdCLEVBQ25FLE1BQU0sQ0FBQyxTQUFTLEVBQ2hCLEtBQUssQ0FBQyxPQUFPLEVBQ2IsaUJBQWlCLENBQ2xCLENBQUM7SUFFRixNQUFNLHNCQUFzQixHQUFHLGNBQWMsS0FBSyxTQUFTO1FBQ3pELENBQUMsQ0FBQyxTQUFTO1FBQ1gsQ0FBQyxDQUFDO1lBQ0EsWUFBWSxFQUFFO2dCQUNaLGlCQUFpQixFQUFFLGNBQWM7YUFDbEM7U0FDRixDQUFDO0lBRUosTUFBTSx5QkFBeUIsR0FBRyxjQUFjLEtBQUssU0FBUztRQUM1RCxDQUFDLENBQUMsU0FBUztRQUNYLENBQUMsQ0FBQztZQUNBLFlBQVksRUFBRTtnQkFDWixpQkFBaUIsRUFBRSxjQUFjO2FBQ2xDO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLGVBQWUsRUFBRSxjQUFjO2FBQ2hDO1NBQ0YsQ0FBQztJQUVKLGlHQUFpRztJQUNqRyxNQUFNLDBCQUEwQixHQUFHLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7UUFDcEYsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztRQUN4QixVQUFVLEVBQUU7WUFDVixJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxnREFBZ0QsQ0FBQztTQUMzRTtRQUNELE9BQU8sRUFBRTtZQUNQLGNBQWM7U0FDZjtRQUNELFNBQVMsRUFBRSxnQkFBZ0I7UUFDM0IsVUFBVSxFQUFFLHlCQUF5QjtLQUN0QyxDQUFDLENBQUMsQ0FBQztJQUVKLGdHQUFnRztJQUNoRyx3R0FBd0c7SUFDeEcsTUFBTSxZQUFZLEdBQUcsbUJBQUssQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUNuRCxDQUFDLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxzQkFBUSxDQUFDLGFBQWEsQ0FBQztRQUM1QyxDQUFDLENBQUMsd0JBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUM5QyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ2pCLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxlQUFlLENBQUM7WUFDakQsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsS0FBSztZQUN4QixVQUFVLEVBQUU7Z0JBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsWUFBWSxDQUFDO2FBQ3ZDO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLGNBQWM7YUFDZjtZQUNELFNBQVMsRUFBRSxnQkFBZ0I7WUFDM0IsMkZBQTJGO1NBQzVGLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVELHVEQUF1RDtJQUN2RCxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDO1FBQ2pELE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUs7UUFDeEIsVUFBVSxFQUFFO1lBQ1YsSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsNkJBQTZCLENBQUM7U0FDeEQ7UUFDRCxPQUFPLEVBQUU7WUFDUCxjQUFjO1NBQ2Y7UUFDRCxTQUFTLEVBQUUsZ0JBQWdCO1FBQzNCLFVBQVUsRUFBRSxzQkFBc0I7S0FDbkMsQ0FBQyxDQUFDLENBQUM7SUFFSiw4RUFBOEU7SUFDOUUsTUFBTSxDQUFDLG1CQUFtQixDQUFDLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQztRQUNqRCxNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLO1FBQ3hCLFVBQVUsRUFBRTtZQUNWLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLDBCQUEwQixDQUFDO1NBQ3JEO1FBQ0QsT0FBTyxFQUFFO1lBQ1AsY0FBYztTQUNmO1FBQ0QsU0FBUyxFQUFFLGdCQUFnQjtRQUMzQixVQUFVLEVBQUUsc0JBQXNCO0tBQ25DLENBQUMsQ0FBQyxDQUFDO0lBRUosT0FBTztRQUNMLCtCQUErQixFQUFFLDBCQUEwQixDQUFDLGdCQUFnQixJQUFJLE1BQU07S0FDdkYsQ0FBQztBQUNKLENBQUMsQ0FBQztBQTNGVyxRQUFBLDBCQUEwQiw4QkEyRnJDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgKiBhcyBpYW0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWlhbSc7XG5pbXBvcnQgeyBGYWN0TmFtZSwgUmVnaW9uSW5mbyB9IGZyb20gJ2F3cy1jZGstbGliL3JlZ2lvbi1pbmZvJztcbmltcG9ydCB7IHJlc29sdmVBY2Nlc3NMb2dEZWxpdmVyeSB9IGZyb20gJy4vcmVzb2x2ZS1hY2Nlc3MtbG9nLWRlbGl2ZXJ5JztcbmltcG9ydCB7IEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0LCBCdWNrZXRQb2xpY3lDb250ZXh0IH0gZnJvbSAnLi90eXBlcyc7XG5cbmNvbnN0IEVMQl9TT1VSQ0VfQVJOID0gJ2Fybjphd3M6ZWxhc3RpY2xvYWRiYWxhbmNpbmc6KjoqOmxvYWRiYWxhbmNlci8qJztcblxuLyoqXG4gKiBBZGRzIHJlc291cmNlIHBvbGljaWVzIGZvciBBTEIvTkxCLCBDbG91ZEZyb250IHN0YW5kYXJkIGxvZ2dpbmcgKHYyKSwgYW5kIFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZy5cbiAqXG4gKiBHcmFudHMgYHMzOlB1dE9iamVjdGAgb24gYEFXU0xvZ3MvLi4uYCBwcmVmaXhlcyB0bzpcbiAqIC0gYGxvZ2RlbGl2ZXJ5LmVsYXN0aWNsb2FkYmFsYW5jaW5nLmFtYXpvbmF3cy5jb21gXG4gKiAtIFRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCAod2hlbiBrbm93bilcbiAqIC0gYGRlbGl2ZXJ5LmxvZ3MuYW1hem9uYXdzLmNvbWBcbiAqIC0gYGxvZ2dpbmcuczMuYW1hem9uYXdzLmNvbWBcbiAqXG4gKiBQcmVmaXhlcyBkZWZhdWx0IHRvIGBBV1NMb2dzLzxzdGFjay5hY2NvdW50Pi8qYC4ge0BsaW5rIEJ1Y2tldFBvbGljeUNvbnRleHQuYWNjZXNzTG9nRGVsaXZlcnl9XG4gKiBjYW4gd2lkZW4gdGhpcyB0byBhbiBleHBsaWNpdCBhY2NvdW50IGxpc3Qgb3IgdG8gYEFXU0xvZ3MvKmAgY29uc3RyYWluZWQgYnkgYGF3czpTb3VyY2VPcmdJRGAuXG4gKlxuICogQHBhcmFtIGNvbnRleHQgLSBCdWNrZXQsIG93bmluZyBzdGFjaywgYW5kIG9wdGlvbmFsIGRlbGl2ZXJ5IHNjb3BlLlxuICogQHJldHVybnMgQSByZXN1bHQgY29udGFpbmluZyB7QGxpbmsgQnVja2V0UG9saWN5QXBwbHlSZXN1bHQuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZX0gZm9yIHRoZVxuICogZmlyc3QgKEVMQikgcG9saWN5IHN0YXRlbWVudCBzbyBsb2FkIGJhbGFuY2VyIGxvZyBlbmFibGVtZW50IGNhbiB3YWl0IHVudGlsIHRoZSBidWNrZXQgcG9saWN5IGV4aXN0cy5cbiAqL1xuZXhwb3J0IGNvbnN0IGFwcGx5QWNjZXNzTG9nQnVja2V0UG9saWN5ID0gKHtcbiAgYnVja2V0LFxuICBzdGFjayxcbiAgYWNjZXNzTG9nRGVsaXZlcnksXG59OiBCdWNrZXRQb2xpY3lDb250ZXh0KTogQnVja2V0UG9saWN5QXBwbHlSZXN1bHQgPT4ge1xuICBjb25zdCB7IGF3c0xvZ3NSZXNvdXJjZXMsIG9yZ2FuaXphdGlvbklkIH0gPSByZXNvbHZlQWNjZXNzTG9nRGVsaXZlcnkoXG4gICAgYnVja2V0LmJ1Y2tldEFybixcbiAgICBzdGFjay5hY2NvdW50LFxuICAgIGFjY2Vzc0xvZ0RlbGl2ZXJ5LFxuICApO1xuXG4gIGNvbnN0IG9yZ2FuaXphdGlvbkNvbmRpdGlvbnMgPSBvcmdhbml6YXRpb25JZCA9PT0gdW5kZWZpbmVkXG4gICAgPyB1bmRlZmluZWRcbiAgICA6IHtcbiAgICAgIFN0cmluZ0VxdWFsczoge1xuICAgICAgICAnYXdzOlNvdXJjZU9yZ0lEJzogb3JnYW5pemF0aW9uSWQsXG4gICAgICB9LFxuICAgIH07XG5cbiAgY29uc3QgYWxiT3JnYW5pemF0aW9uQ29uZGl0aW9ucyA9IG9yZ2FuaXphdGlvbklkID09PSB1bmRlZmluZWRcbiAgICA/IHVuZGVmaW5lZFxuICAgIDoge1xuICAgICAgU3RyaW5nRXF1YWxzOiB7XG4gICAgICAgICdhd3M6U291cmNlT3JnSUQnOiBvcmdhbml6YXRpb25JZCxcbiAgICAgIH0sXG4gICAgICBBcm5MaWtlOiB7XG4gICAgICAgICdhd3M6U291cmNlQXJuJzogRUxCX1NPVVJDRV9BUk4sXG4gICAgICB9LFxuICAgIH07XG5cbiAgLy8gQWxsb3cgQUxCIC8gTkxCIGxvZyBkZWxpdmVyeSAobW9kZXJuIHNlcnZpY2UgcHJpbmNpcGFsIHBhdGg7IGFsc28gcmVxdWlyZWQgaW4gb3B0LWluIHJlZ2lvbnMpLlxuICBjb25zdCBhbGJMb2dEZWxpdmVyeVBvbGljeVJlc3VsdCA9IGJ1Y2tldC5hZGRUb1Jlc291cmNlUG9saWN5KG5ldyBpYW0uUG9saWN5U3RhdGVtZW50KHtcbiAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgcHJpbmNpcGFsczogW1xuICAgICAgbmV3IGlhbS5TZXJ2aWNlUHJpbmNpcGFsKCdsb2dkZWxpdmVyeS5lbGFzdGljbG9hZGJhbGFuY2luZy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogYXdzTG9nc1Jlc291cmNlcyxcbiAgICBjb25kaXRpb25zOiBhbGJPcmdhbml6YXRpb25Db25kaXRpb25zLFxuICB9KSk7XG5cbiAgLy8gSW4gbm9u4oCTb3B0LWluIHJlZ2lvbnMgKGZvciBleGFtcGxlIGFwLW5vcnRoZWFzdC0xKSwgYWNjZXNzIGxvZ3MgYXJlIG9mdGVuIGRlbGl2ZXJlZCB1c2luZyB0aGVcbiAgLy8gcmVnaW9uYWwgRUxCdjIgYWNjb3VudCAocm9vdCBvZiB0aGF0IGFjY291bnQpIGZvciBzMzpQdXRPYmplY3QsIG5vdCBvbmx5IHRoZSBzZXJ2aWNlIHByaW5jaXBhbCBhYm92ZS5cbiAgY29uc3QgZWxiQWNjb3VudElkID0gVG9rZW4uaXNVbnJlc29sdmVkKHN0YWNrLnJlZ2lvbilcbiAgICA/IHN0YWNrLnJlZ2lvbmFsRmFjdChGYWN0TmFtZS5FTEJWMl9BQ0NPVU5UKVxuICAgIDogUmVnaW9uSW5mby5nZXQoc3RhY2sucmVnaW9uKS5lbGJ2MkFjY291bnQ7XG4gIGlmIChlbGJBY2NvdW50SWQpIHtcbiAgICBidWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgICBlZmZlY3Q6IGlhbS5FZmZlY3QuQUxMT1csXG4gICAgICBwcmluY2lwYWxzOiBbXG4gICAgICAgIG5ldyBpYW0uQWNjb3VudFByaW5jaXBhbChlbGJBY2NvdW50SWQpLFxuICAgICAgXSxcbiAgICAgIGFjdGlvbnM6IFtcbiAgICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgICBdLFxuICAgICAgcmVzb3VyY2VzOiBhd3NMb2dzUmVzb3VyY2VzLFxuICAgICAgLy8gVGhlIEVMQnYyIGRlbGl2ZXJ5IGFjY291bnQgaXMgbm90IGFuIG9yZ2FuaXphdGlvbiBtZW1iZXI7IGRvIG5vdCBhdHRhY2ggYXdzOlNvdXJjZU9yZ0lELlxuICAgIH0pKTtcbiAgfVxuXG4gIC8vIEFsbG93IENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpIHRvIHdyaXRlIGxvZ3NcbiAgYnVja2V0LmFkZFRvUmVzb3VyY2VQb2xpY3kobmV3IGlhbS5Qb2xpY3lTdGF0ZW1lbnQoe1xuICAgIGVmZmVjdDogaWFtLkVmZmVjdC5BTExPVyxcbiAgICBwcmluY2lwYWxzOiBbXG4gICAgICBuZXcgaWFtLlNlcnZpY2VQcmluY2lwYWwoJ2RlbGl2ZXJ5LmxvZ3MuYW1hem9uYXdzLmNvbScpLFxuICAgIF0sXG4gICAgYWN0aW9uczogW1xuICAgICAgJ3MzOlB1dE9iamVjdCcsXG4gICAgXSxcbiAgICByZXNvdXJjZXM6IGF3c0xvZ3NSZXNvdXJjZXMsXG4gICAgY29uZGl0aW9uczogb3JnYW5pemF0aW9uQ29uZGl0aW9ucyxcbiAgfSkpO1xuXG4gIC8vIEFsbG93IFMzIHNlcnZlciBhY2Nlc3MgbG9nZ2luZyB0byB3cml0ZSBsb2dzIHdoZW4gcmVxdWlyZWQgYnkgY29uZmlndXJhdGlvblxuICBidWNrZXQuYWRkVG9SZXNvdXJjZVBvbGljeShuZXcgaWFtLlBvbGljeVN0YXRlbWVudCh7XG4gICAgZWZmZWN0OiBpYW0uRWZmZWN0LkFMTE9XLFxuICAgIHByaW5jaXBhbHM6IFtcbiAgICAgIG5ldyBpYW0uU2VydmljZVByaW5jaXBhbCgnbG9nZ2luZy5zMy5hbWF6b25hd3MuY29tJyksXG4gICAgXSxcbiAgICBhY3Rpb25zOiBbXG4gICAgICAnczM6UHV0T2JqZWN0JyxcbiAgICBdLFxuICAgIHJlc291cmNlczogYXdzTG9nc1Jlc291cmNlcyxcbiAgICBjb25kaXRpb25zOiBvcmdhbml6YXRpb25Db25kaXRpb25zLFxuICB9KSk7XG5cbiAgcmV0dXJuIHtcbiAgICBhY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlOiBhbGJMb2dEZWxpdmVyeVBvbGljeVJlc3VsdC5wb2xpY3lEZXBlbmRhYmxlID8/IGJ1Y2tldCxcbiAgfTtcbn07XG4iXX0=

package/lib/bucket-policies/resolve-access-log-delivery.d.ts

@@ -0,0 +1,24 @@
+import { AccessLogDeliveryScope } from '../bucket-types/access-log-delivery-scope';
+/**
+ * Resolved `AWSLogs` resource ARNs and optional organization condition value.
+ */
+export interface ResolvedAccessLogDelivery {
+    /**
+     * Bucket object ARNs granted `s3:PutObject` for log writers.
+     */
+    readonly awsLogsResources: string[];
+    /**
+     * Set when delivery is scoped to an AWS Organization (`aws:SourceOrgID`).
+     */
+    readonly organizationId?: string;
+}
+/**
+ * Resolves `AWSLogs` resource ARNs (and organization ID when used) for an access-log bucket policy.
+ *
+ * @param bucketArn - Destination bucket ARN.
+ * @param stackAccount - Owning stack account; used when `scope` is omitted.
+ * @param scope - Optional exclusive account-list or organization scope.
+ * @returns Resource ARNs and optional `organizationId` for policy conditions.
+ * @throws If `scope` sets both fields, neither field, an empty account list, or invalid IDs.
+ */
+export declare const resolveAccessLogDelivery: (bucketArn: string, stackAccount: string, scope?: AccessLogDeliveryScope) => ResolvedAccessLogDelivery;

package/lib/bucket-policies/resolve-access-log-delivery.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAccessLogDelivery = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const access_log_delivery_scope_1 = require("../bucket-types/access-log-delivery-scope");
+const EXCLUSIVE_FIELDS_ERROR = 'accessLogDelivery must specify exactly one of allowedSourceAccountIds or organizationId';
+const assertAccountId = (accountId) => {
+    if (aws_cdk_lib_1.Token.isUnresolved(accountId)) {
+        return;
+    }
+    if ((0, access_log_delivery_scope_1.isAwsAccountId)(accountId)) {
+        return;
+    }
+    throw new Error(`allowedSourceAccountIds contains an invalid AWS account ID: ${accountId}`);
+};
+const resolveOrganizationDelivery = (bucketArn, organizationId) => {
+    if (!aws_cdk_lib_1.Token.isUnresolved(organizationId) && !(0, access_log_delivery_scope_1.isAwsOrganizationId)(organizationId)) {
+        throw new Error(`organizationId must be an AWS Organizations ID (o-...), got: ${organizationId}`);
+    }
+    return {
+        awsLogsResources: [`${bucketArn}/AWSLogs/*`],
+        organizationId,
+    };
+};
+const resolveAccountListDelivery = (bucketArn, accountIds) => {
+    if (accountIds.length === 0) {
+        throw new Error('allowedSourceAccountIds must contain at least one account ID');
+    }
+    const uniqueAccountIds = [...new Set(accountIds)];
+    for (const accountId of uniqueAccountIds) {
+        assertAccountId(accountId);
+    }
+    return {
+        awsLogsResources: uniqueAccountIds.map((accountId) => `${bucketArn}/AWSLogs/${accountId}/*`),
+    };
+};
+/**
+ * Resolves `AWSLogs` resource ARNs (and organization ID when used) for an access-log bucket policy.
+ *
+ * @param bucketArn - Destination bucket ARN.
+ * @param stackAccount - Owning stack account; used when `scope` is omitted.
+ * @param scope - Optional exclusive account-list or organization scope.
+ * @returns Resource ARNs and optional `organizationId` for policy conditions.
+ * @throws If `scope` sets both fields, neither field, an empty account list, or invalid IDs.
+ */
+const resolveAccessLogDelivery = (bucketArn, stackAccount, scope) => {
+    if (scope === undefined) {
+        return {
+            awsLogsResources: [`${bucketArn}/AWSLogs/${stackAccount}/*`],
+        };
+    }
+    const { allowedSourceAccountIds, organizationId } = scope;
+    if (organizationId !== undefined) {
+        if (allowedSourceAccountIds !== undefined) {
+            throw new Error(EXCLUSIVE_FIELDS_ERROR);
+        }
+        return resolveOrganizationDelivery(bucketArn, organizationId);
+    }
+    if (allowedSourceAccountIds !== undefined) {
+        return resolveAccountListDelivery(bucketArn, allowedSourceAccountIds);
+    }
+    throw new Error(EXCLUSIVE_FIELDS_ERROR);
+};
+exports.resolveAccessLogDelivery = resolveAccessLogDelivery;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb2x2ZS1hY2Nlc3MtbG9nLWRlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC1wb2xpY2llcy9yZXNvbHZlLWFjY2Vzcy1sb2ctZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkNBQW9DO0FBQ3BDLHlGQUltRDtBQWdCbkQsTUFBTSxzQkFBc0IsR0FDMUIseUZBQXlGLENBQUM7QUFFNUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxTQUFpQixFQUFRLEVBQUU7SUFDbEQsSUFBSSxtQkFBSyxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxJQUFBLDBDQUFjLEVBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5QixPQUFPO0lBQ1QsQ0FBQztJQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsK0RBQStELFNBQVMsRUFBRSxDQUFDLENBQUM7QUFDOUYsQ0FBQyxDQUFDO0FBRUYsTUFBTSwyQkFBMkIsR0FBRyxDQUNsQyxTQUFpQixFQUNqQixjQUFzQixFQUNLLEVBQUU7SUFDN0IsSUFBSSxDQUFDLG1CQUFLLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBQSwrQ0FBbUIsRUFBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLGNBQWMsRUFBRSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELE9BQU87UUFDTCxnQkFBZ0IsRUFBRSxDQUFDLEdBQUcsU0FBUyxZQUFZLENBQUM7UUFDNUMsY0FBYztLQUNmLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLDBCQUEwQixHQUFHLENBQ2pDLFNBQWlCLEVBQ2pCLFVBQTZCLEVBQ0YsRUFBRTtJQUM3QixJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxNQUFNLGdCQUFnQixHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2xELEtBQUssTUFBTSxTQUFTLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztRQUN6QyxlQUFlLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDN0IsQ0FBQztJQUNELE9BQU87UUFDTCxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLEdBQUcsU0FBUyxZQUFZLFNBQVMsSUFBSSxDQUFDO0tBQzdGLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNJLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsU0FBaUIsRUFDakIsWUFBb0IsRUFDcEIsS0FBOEIsRUFDSCxFQUFFO0lBQzdCLElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3hCLE9BQU87WUFDTCxnQkFBZ0IsRUFBRSxDQUFDLEdBQUcsU0FBUyxZQUFZLFlBQVksSUFBSSxDQUFDO1NBQzdELENBQUM7SUFDSixDQUFDO0lBRUQsTUFBTSxFQUFFLHVCQUF1QixFQUFFLGNBQWMsRUFBRSxHQUFHLEtBQUssQ0FBQztJQUMxRCxJQUFJLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNqQyxJQUFJLHVCQUF1QixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzFDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUMxQyxDQUFDO1FBQ0QsT0FBTywyQkFBMkIsQ0FBQyxTQUFTLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELElBQUksdUJBQXVCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUMsT0FBTywwQkFBMEIsQ0FBQyxTQUFTLEVBQUUsdUJBQXVCLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO0FBQzFDLENBQUMsQ0FBQztBQXRCVyxRQUFBLHdCQUF3Qiw0QkFzQm5DIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgVG9rZW4gfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQge1xuICBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLFxuICBpc0F3c0FjY291bnRJZCxcbiAgaXNBd3NPcmdhbml6YXRpb25JZCxcbn0gZnJvbSAnLi4vYnVja2V0LXR5cGVzL2FjY2Vzcy1sb2ctZGVsaXZlcnktc2NvcGUnO1xuXG4vKipcbiAqIFJlc29sdmVkIGBBV1NMb2dzYCByZXNvdXJjZSBBUk5zIGFuZCBvcHRpb25hbCBvcmdhbml6YXRpb24gY29uZGl0aW9uIHZhbHVlLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFJlc29sdmVkQWNjZXNzTG9nRGVsaXZlcnkge1xuICAvKipcbiAgICogQnVja2V0IG9iamVjdCBBUk5zIGdyYW50ZWQgYHMzOlB1dE9iamVjdGAgZm9yIGxvZyB3cml0ZXJzLlxuICAgKi9cbiAgcmVhZG9ubHkgYXdzTG9nc1Jlc291cmNlczogc3RyaW5nW107XG4gIC8qKlxuICAgKiBTZXQgd2hlbiBkZWxpdmVyeSBpcyBzY29wZWQgdG8gYW4gQVdTIE9yZ2FuaXphdGlvbiAoYGF3czpTb3VyY2VPcmdJRGApLlxuICAgKi9cbiAgcmVhZG9ubHkgb3JnYW5pemF0aW9uSWQ/OiBzdHJpbmc7XG59XG5cbmNvbnN0IEVYQ0xVU0lWRV9GSUVMRFNfRVJST1IgPVxuICAnYWNjZXNzTG9nRGVsaXZlcnkgbXVzdCBzcGVjaWZ5IGV4YWN0bHkgb25lIG9mIGFsbG93ZWRTb3VyY2VBY2NvdW50SWRzIG9yIG9yZ2FuaXphdGlvbklkJztcblxuY29uc3QgYXNzZXJ0QWNjb3VudElkID0gKGFjY291bnRJZDogc3RyaW5nKTogdm9pZCA9PiB7XG4gIGlmIChUb2tlbi5pc1VucmVzb2x2ZWQoYWNjb3VudElkKSkge1xuICAgIHJldHVybjtcbiAgfVxuICBpZiAoaXNBd3NBY2NvdW50SWQoYWNjb3VudElkKSkge1xuICAgIHJldHVybjtcbiAgfVxuICB0aHJvdyBuZXcgRXJyb3IoYGFsbG93ZWRTb3VyY2VBY2NvdW50SWRzIGNvbnRhaW5zIGFuIGludmFsaWQgQVdTIGFjY291bnQgSUQ6ICR7YWNjb3VudElkfWApO1xufTtcblxuY29uc3QgcmVzb2x2ZU9yZ2FuaXphdGlvbkRlbGl2ZXJ5ID0gKFxuICBidWNrZXRBcm46IHN0cmluZyxcbiAgb3JnYW5pemF0aW9uSWQ6IHN0cmluZyxcbik6IFJlc29sdmVkQWNjZXNzTG9nRGVsaXZlcnkgPT4ge1xuICBpZiAoIVRva2VuLmlzVW5yZXNvbHZlZChvcmdhbml6YXRpb25JZCkgJiYgIWlzQXdzT3JnYW5pemF0aW9uSWQob3JnYW5pemF0aW9uSWQpKSB7XG4gICAgdGhyb3cgbmV3IEVycm9yKGBvcmdhbml6YXRpb25JZCBtdXN0IGJlIGFuIEFXUyBPcmdhbml6YXRpb25zIElEIChvLS4uLiksIGdvdDogJHtvcmdhbml6YXRpb25JZH1gKTtcbiAgfVxuICByZXR1cm4ge1xuICAgIGF3c0xvZ3NSZXNvdXJjZXM6IFtgJHtidWNrZXRBcm59L0FXU0xvZ3MvKmBdLFxuICAgIG9yZ2FuaXphdGlvbklkLFxuICB9O1xufTtcblxuY29uc3QgcmVzb2x2ZUFjY291bnRMaXN0RGVsaXZlcnkgPSAoXG4gIGJ1Y2tldEFybjogc3RyaW5nLFxuICBhY2NvdW50SWRzOiByZWFkb25seSBzdHJpbmdbXSxcbik6IFJlc29sdmVkQWNjZXNzTG9nRGVsaXZlcnkgPT4ge1xuICBpZiAoYWNjb3VudElkcy5sZW5ndGggPT09IDApIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2FsbG93ZWRTb3VyY2VBY2NvdW50SWRzIG11c3QgY29udGFpbiBhdCBsZWFzdCBvbmUgYWNjb3VudCBJRCcpO1xuICB9XG4gIGNvbnN0IHVuaXF1ZUFjY291bnRJZHMgPSBbLi4ubmV3IFNldChhY2NvdW50SWRzKV07XG4gIGZvciAoY29uc3QgYWNjb3VudElkIG9mIHVuaXF1ZUFjY291bnRJZHMpIHtcbiAgICBhc3NlcnRBY2NvdW50SWQoYWNjb3VudElkKTtcbiAgfVxuICByZXR1cm4ge1xuICAgIGF3c0xvZ3NSZXNvdXJjZXM6IHVuaXF1ZUFjY291bnRJZHMubWFwKChhY2NvdW50SWQpID0+IGAke2J1Y2tldEFybn0vQVdTTG9ncy8ke2FjY291bnRJZH0vKmApLFxuICB9O1xufTtcblxuLyoqXG4gKiBSZXNvbHZlcyBgQVdTTG9nc2AgcmVzb3VyY2UgQVJOcyAoYW5kIG9yZ2FuaXphdGlvbiBJRCB3aGVuIHVzZWQpIGZvciBhbiBhY2Nlc3MtbG9nIGJ1Y2tldCBwb2xpY3kuXG4gKlxuICogQHBhcmFtIGJ1Y2tldEFybiAtIERlc3RpbmF0aW9uIGJ1Y2tldCBBUk4uXG4gKiBAcGFyYW0gc3RhY2tBY2NvdW50IC0gT3duaW5nIHN0YWNrIGFjY291bnQ7IHVzZWQgd2hlbiBgc2NvcGVgIGlzIG9taXR0ZWQuXG4gKiBAcGFyYW0gc2NvcGUgLSBPcHRpb25hbCBleGNsdXNpdmUgYWNjb3VudC1saXN0IG9yIG9yZ2FuaXphdGlvbiBzY29wZS5cbiAqIEByZXR1cm5zIFJlc291cmNlIEFSTnMgYW5kIG9wdGlvbmFsIGBvcmdhbml6YXRpb25JZGAgZm9yIHBvbGljeSBjb25kaXRpb25zLlxuICogQHRocm93cyBJZiBgc2NvcGVgIHNldHMgYm90aCBmaWVsZHMsIG5laXRoZXIgZmllbGQsIGFuIGVtcHR5IGFjY291bnQgbGlzdCwgb3IgaW52YWxpZCBJRHMuXG4gKi9cbmV4cG9ydCBjb25zdCByZXNvbHZlQWNjZXNzTG9nRGVsaXZlcnkgPSAoXG4gIGJ1Y2tldEFybjogc3RyaW5nLFxuICBzdGFja0FjY291bnQ6IHN0cmluZyxcbiAgc2NvcGU/OiBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLFxuKTogUmVzb2x2ZWRBY2Nlc3NMb2dEZWxpdmVyeSA9PiB7XG4gIGlmIChzY29wZSA9PT0gdW5kZWZpbmVkKSB7XG4gICAgcmV0dXJuIHtcbiAgICAgIGF3c0xvZ3NSZXNvdXJjZXM6IFtgJHtidWNrZXRBcm59L0FXU0xvZ3MvJHtzdGFja0FjY291bnR9LypgXSxcbiAgICB9O1xuICB9XG5cbiAgY29uc3QgeyBhbGxvd2VkU291cmNlQWNjb3VudElkcywgb3JnYW5pemF0aW9uSWQgfSA9IHNjb3BlO1xuICBpZiAob3JnYW5pemF0aW9uSWQgIT09IHVuZGVmaW5lZCkge1xuICAgIGlmIChhbGxvd2VkU291cmNlQWNjb3VudElkcyAhPT0gdW5kZWZpbmVkKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoRVhDTFVTSVZFX0ZJRUxEU19FUlJPUik7XG4gICAgfVxuICAgIHJldHVybiByZXNvbHZlT3JnYW5pemF0aW9uRGVsaXZlcnkoYnVja2V0QXJuLCBvcmdhbml6YXRpb25JZCk7XG4gIH1cbiAgaWYgKGFsbG93ZWRTb3VyY2VBY2NvdW50SWRzICE9PSB1bmRlZmluZWQpIHtcbiAgICByZXR1cm4gcmVzb2x2ZUFjY291bnRMaXN0RGVsaXZlcnkoYnVja2V0QXJuLCBhbGxvd2VkU291cmNlQWNjb3VudElkcyk7XG4gIH1cbiAgdGhyb3cgbmV3IEVycm9yKEVYQ0xVU0lWRV9GSUVMRFNfRVJST1IpO1xufTtcbiJdfQ==

package/lib/bucket-policies/types.d.ts

@@ -1,6 +1,7 @@
 import { Stack } from 'aws-cdk-lib';
 import * as s3 from 'aws-cdk-lib/aws-s3';
 import { IDependable } from 'constructs';
+import type { AccessLogDeliveryScope } from '../bucket-types';
 /**
  * Inputs shared by bucket-type resource policy appliers.
  */
@@ -9,6 +10,11 @@ export interface BucketPolicyContext {
     readonly bucket: s3.Bucket;
     /** Stack that owns the bucket; used for account, region, and synthesizer metadata. */
     readonly stack: Stack;
+    /**
+     * Optional writer scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     * Ignored by other bucket types.
+     */
+    readonly accessLogDelivery?: AccessLogDeliveryScope;
 }
 /**
  * Optional side effects returned after applying type-specific bucket policies.

package/lib/bucket-policies/types.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXBvbGljaWVzL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIHMzIGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBJRGVwZW5kYWJsZSB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG4vKipcbiAqIElucHV0cyBzaGFyZWQgYnkgYnVja2V0LXR5cGUgcmVzb3VyY2UgcG9saWN5IGFwcGxpZXJzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeUNvbnRleHQge1xuICAvKiogVGhlIGJ1Y2tldCB0byBhdHRhY2ggcmVzb3VyY2UgcG9saWNpZXMgdG8uICovXG4gIHJlYWRvbmx5IGJ1Y2tldDogczMuQnVja2V0O1xuICAvKiogU3RhY2sgdGhhdCBvd25zIHRoZSBidWNrZXQ7IHVzZWQgZm9yIGFjY291bnQsIHJlZ2lvbiwgYW5kIHN5bnRoZXNpemVyIG1ldGFkYXRhLiAqL1xuICByZWFkb25seSBzdGFjazogU3RhY2s7XG59XG5cbi8qKlxuICogT3B0aW9uYWwgc2lkZSBlZmZlY3RzIHJldHVybmVkIGFmdGVyIGFwcGx5aW5nIHR5cGUtc3BlY2lmaWMgYnVja2V0IHBvbGljaWVzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0IHtcbiAgLyoqXG4gICAqIFNldCB3aGVuIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9IHBvbGljaWVzIGFyZSBhcHBsaWVkLlxuICAgKiBEZXBlbmQgb24gdGhpcyBiZWZvcmUgZW5hYmxpbmcgQUxCL05MQiBhY2Nlc3MgbG9nZ2luZy5cbiAgICovXG4gIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcbn1cbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXBvbGljaWVzL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBTdGFjayB9IGZyb20gJ2F3cy1jZGstbGliJztcbmltcG9ydCAqIGFzIHMzIGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBJRGVwZW5kYWJsZSB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHR5cGUgeyBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlIH0gZnJvbSAnLi4vYnVja2V0LXR5cGVzJztcblxuLyoqXG4gKiBJbnB1dHMgc2hhcmVkIGJ5IGJ1Y2tldC10eXBlIHJlc291cmNlIHBvbGljeSBhcHBsaWVycy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBCdWNrZXRQb2xpY3lDb250ZXh0IHtcbiAgLyoqIFRoZSBidWNrZXQgdG8gYXR0YWNoIHJlc291cmNlIHBvbGljaWVzIHRvLiAqL1xuICByZWFkb25seSBidWNrZXQ6IHMzLkJ1Y2tldDtcbiAgLyoqIFN0YWNrIHRoYXQgb3ducyB0aGUgYnVja2V0OyB1c2VkIGZvciBhY2NvdW50LCByZWdpb24sIGFuZCBzeW50aGVzaXplciBtZXRhZGF0YS4gKi9cbiAgcmVhZG9ubHkgc3RhY2s6IFN0YWNrO1xuICAvKipcbiAgICogT3B0aW9uYWwgd3JpdGVyIHNjb3BlIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfS5cbiAgICogSWdub3JlZCBieSBvdGhlciBidWNrZXQgdHlwZXMuXG4gICAqL1xuICByZWFkb25seSBhY2Nlc3NMb2dEZWxpdmVyeT86IEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGU7XG59XG5cbi8qKlxuICogT3B0aW9uYWwgc2lkZSBlZmZlY3RzIHJldHVybmVkIGFmdGVyIGFwcGx5aW5nIHR5cGUtc3BlY2lmaWMgYnVja2V0IHBvbGljaWVzLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEJ1Y2tldFBvbGljeUFwcGx5UmVzdWx0IHtcbiAgLyoqXG4gICAqIFNldCB3aGVuIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9IHBvbGljaWVzIGFyZSBhcHBsaWVkLlxuICAgKiBEZXBlbmQgb24gdGhpcyBiZWZvcmUgZW5hYmxpbmcgQUxCL05MQiBhY2Nlc3MgbG9nZ2luZy5cbiAgICovXG4gIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcbn1cbiJdfQ==

package/lib/bucket-types/access-log-delivery-scope.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Account scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET} resource policies.
+ *
+ * Specify **exactly one** of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or
+ * {@link AccessLogDeliveryScope.organizationId}. Omit {@link S3SecureBucketProps.accessLogDelivery}
+ * to allow only the stack account (default).
+ *
+ * jsii does not support a discriminated union of structs, so exclusivity is enforced at construct time.
+ */
+export interface AccessLogDeliveryScope {
+    /**
+     * Account IDs allowed to write under `AWSLogs/<accountId>/*`.
+     *
+     * The list is used as specified; include the stack account if that account should also deliver logs.
+     * Duplicate IDs are ignored. Mutually exclusive with {@link AccessLogDeliveryScope.organizationId}.
+     *
+     * @default undefined (do not use an explicit account list)
+     */
+    readonly allowedSourceAccountIds?: string[];
+    /**
+     * AWS Organizations ID (`o-` followed by 10–32 lowercase letters or digits).
+     *
+     * Allows log delivery from accounts in the organization via `aws:SourceOrgID`,
+     * with resource `AWSLogs/*`. Mutually exclusive with {@link AccessLogDeliveryScope.allowedSourceAccountIds}.
+     *
+     * @default undefined (do not use an organization-wide policy)
+     */
+    readonly organizationId?: string;
+}
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.allowedSourceAccountIds}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the account-list field is present.
+ */
+export declare const hasAllowedSourceAccountIds: (scope: AccessLogDeliveryScope) => boolean;
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.organizationId}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the organization field is present.
+ */
+export declare const hasOrganizationId: (scope: AccessLogDeliveryScope) => boolean;
+/**
+ * Returns whether `scope` sets exactly one of the mutually exclusive delivery fields.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when exactly one of the two fields is present.
+ */
+export declare const isExclusiveAccessLogDeliveryScope: (scope: AccessLogDeliveryScope) => boolean;
+/**
+ * Returns whether `value` is a 12-digit AWS account ID.
+ *
+ * @param value - Candidate account ID.
+ * @returns `true` when `value` matches `^[0-9]{12}$`.
+ */
+export declare const isAwsAccountId: (value: string) => boolean;
+/**
+ * Returns whether `value` is an AWS Organizations ID.
+ *
+ * @param value - Candidate organization ID.
+ * @returns `true` when `value` matches `^o-[a-z0-9]{10,32}$`.
+ */
+export declare const isAwsOrganizationId: (value: string) => boolean;

package/lib/bucket-types/access-log-delivery-scope.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAwsOrganizationId = exports.isAwsAccountId = exports.isExclusiveAccessLogDeliveryScope = exports.hasOrganizationId = exports.hasAllowedSourceAccountIds = void 0;
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.allowedSourceAccountIds}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the account-list field is present.
+ */
+const hasAllowedSourceAccountIds = (scope) => {
+    return scope.allowedSourceAccountIds !== undefined;
+};
+exports.hasAllowedSourceAccountIds = hasAllowedSourceAccountIds;
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.organizationId}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the organization field is present.
+ */
+const hasOrganizationId = (scope) => {
+    return scope.organizationId !== undefined;
+};
+exports.hasOrganizationId = hasOrganizationId;
+/**
+ * Returns whether `scope` sets exactly one of the mutually exclusive delivery fields.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when exactly one of the two fields is present.
+ */
+const isExclusiveAccessLogDeliveryScope = (scope) => {
+    return (0, exports.hasAllowedSourceAccountIds)(scope) !== (0, exports.hasOrganizationId)(scope);
+};
+exports.isExclusiveAccessLogDeliveryScope = isExclusiveAccessLogDeliveryScope;
+/**
+ * Returns whether `value` is a 12-digit AWS account ID.
+ *
+ * @param value - Candidate account ID.
+ * @returns `true` when `value` matches `^[0-9]{12}$`.
+ */
+const isAwsAccountId = (value) => {
+    return /^\d{12}$/.test(value);
+};
+exports.isAwsAccountId = isAwsAccountId;
+/**
+ * Returns whether `value` is an AWS Organizations ID.
+ *
+ * @param value - Candidate organization ID.
+ * @returns `true` when `value` matches `^o-[a-z0-9]{10,32}$`.
+ */
+const isAwsOrganizationId = (value) => {
+    return /^o-[a-z0-9]{10,32}$/.test(value);
+};
+exports.isAwsOrganizationId = isAwsOrganizationId;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWxvZy1kZWxpdmVyeS1zY29wZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9idWNrZXQtdHlwZXMvYWNjZXNzLWxvZy1kZWxpdmVyeS1zY29wZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUErQkE7Ozs7O0dBS0c7QUFDSSxNQUFNLDBCQUEwQixHQUFHLENBQUMsS0FBNkIsRUFBVyxFQUFFO0lBQ25GLE9BQU8sS0FBSyxDQUFDLHVCQUF1QixLQUFLLFNBQVMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFGVyxRQUFBLDBCQUEwQiw4QkFFckM7QUFFRjs7Ozs7R0FLRztBQUNJLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUE2QixFQUFXLEVBQUU7SUFDMUUsT0FBTyxLQUFLLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFGVyxRQUFBLGlCQUFpQixxQkFFNUI7QUFFRjs7Ozs7R0FLRztBQUNJLE1BQU0saUNBQWlDLEdBQUcsQ0FBQyxLQUE2QixFQUFXLEVBQUU7SUFDMUYsT0FBTyxJQUFBLGtDQUEwQixFQUFDLEtBQUssQ0FBQyxLQUFLLElBQUEseUJBQWlCLEVBQUMsS0FBSyxDQUFDLENBQUM7QUFDeEUsQ0FBQyxDQUFDO0FBRlcsUUFBQSxpQ0FBaUMscUNBRTVDO0FBRUY7Ozs7O0dBS0c7QUFDSSxNQUFNLGNBQWMsR0FBRyxDQUFDLEtBQWEsRUFBVyxFQUFFO0lBQ3ZELE9BQU8sVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNoQyxDQUFDLENBQUM7QUFGVyxRQUFBLGNBQWMsa0JBRXpCO0FBRUY7Ozs7O0dBS0c7QUFDSSxNQUFNLG1CQUFtQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDNUQsT0FBTyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDM0MsQ0FBQyxDQUFDO0FBRlcsUUFBQSxtQkFBbUIsdUJBRTlCIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBBY2NvdW50IHNjb3BlIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfSByZXNvdXJjZSBwb2xpY2llcy5cbiAqXG4gKiBTcGVjaWZ5ICoqZXhhY3RseSBvbmUqKiBvZiB7QGxpbmsgQWNjZXNzTG9nRGVsaXZlcnlTY29wZS5hbGxvd2VkU291cmNlQWNjb3VudElkc30gb3JcbiAqIHtAbGluayBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLm9yZ2FuaXphdGlvbklkfS4gT21pdCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5hY2Nlc3NMb2dEZWxpdmVyeX1cbiAqIHRvIGFsbG93IG9ubHkgdGhlIHN0YWNrIGFjY291bnQgKGRlZmF1bHQpLlxuICpcbiAqIGpzaWkgZG9lcyBub3Qgc3VwcG9ydCBhIGRpc2NyaW1pbmF0ZWQgdW5pb24gb2Ygc3RydWN0cywgc28gZXhjbHVzaXZpdHkgaXMgZW5mb3JjZWQgYXQgY29uc3RydWN0IHRpbWUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgQWNjZXNzTG9nRGVsaXZlcnlTY29wZSB7XG4gIC8qKlxuICAgKiBBY2NvdW50IElEcyBhbGxvd2VkIHRvIHdyaXRlIHVuZGVyIGBBV1NMb2dzLzxhY2NvdW50SWQ+LypgLlxuICAgKlxuICAgKiBUaGUgbGlzdCBpcyB1c2VkIGFzIHNwZWNpZmllZDsgaW5jbHVkZSB0aGUgc3RhY2sgYWNjb3VudCBpZiB0aGF0IGFjY291bnQgc2hvdWxkIGFsc28gZGVsaXZlciBsb2dzLlxuICAgKiBEdXBsaWNhdGUgSURzIGFyZSBpZ25vcmVkLiBNdXR1YWxseSBleGNsdXNpdmUgd2l0aCB7QGxpbmsgQWNjZXNzTG9nRGVsaXZlcnlTY29wZS5vcmdhbml6YXRpb25JZH0uXG4gICAqXG4gICAqIEBkZWZhdWx0IHVuZGVmaW5lZCAoZG8gbm90IHVzZSBhbiBleHBsaWNpdCBhY2NvdW50IGxpc3QpXG4gICAqL1xuICByZWFkb25seSBhbGxvd2VkU291cmNlQWNjb3VudElkcz86IHN0cmluZ1tdO1xuXG4gIC8qKlxuICAgKiBBV1MgT3JnYW5pemF0aW9ucyBJRCAoYG8tYCBmb2xsb3dlZCBieSAxMOKAkzMyIGxvd2VyY2FzZSBsZXR0ZXJzIG9yIGRpZ2l0cykuXG4gICAqXG4gICAqIEFsbG93cyBsb2cgZGVsaXZlcnkgZnJvbSBhY2NvdW50cyBpbiB0aGUgb3JnYW5pemF0aW9uIHZpYSBgYXdzOlNvdXJjZU9yZ0lEYCxcbiAgICogd2l0aCByZXNvdXJjZSBgQVdTTG9ncy8qYC4gTXV0dWFsbHkgZXhjbHVzaXZlIHdpdGgge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUuYWxsb3dlZFNvdXJjZUFjY291bnRJZHN9LlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgKGRvIG5vdCB1c2UgYW4gb3JnYW5pemF0aW9uLXdpZGUgcG9saWN5KVxuICAgKi9cbiAgcmVhZG9ubHkgb3JnYW5pemF0aW9uSWQ/OiBzdHJpbmc7XG59XG5cbi8qKlxuICogUmV0dXJucyB3aGV0aGVyIGBzY29wZWAgc2V0cyB7QGxpbmsgQWNjZXNzTG9nRGVsaXZlcnlTY29wZS5hbGxvd2VkU291cmNlQWNjb3VudElkc30uXG4gKlxuICogQHBhcmFtIHNjb3BlIC0gQ2FsbGVyLXN1cHBsaWVkIGRlbGl2ZXJ5IHNjb3BlLlxuICogQHJldHVybnMgYHRydWVgIHdoZW4gdGhlIGFjY291bnQtbGlzdCBmaWVsZCBpcyBwcmVzZW50LlxuICovXG5leHBvcnQgY29uc3QgaGFzQWxsb3dlZFNvdXJjZUFjY291bnRJZHMgPSAoc2NvcGU6IEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUpOiBib29sZWFuID0+IHtcbiAgcmV0dXJuIHNjb3BlLmFsbG93ZWRTb3VyY2VBY2NvdW50SWRzICE9PSB1bmRlZmluZWQ7XG59O1xuXG4vKipcbiAqIFJldHVybnMgd2hldGhlciBgc2NvcGVgIHNldHMge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUub3JnYW5pemF0aW9uSWR9LlxuICpcbiAqIEBwYXJhbSBzY29wZSAtIENhbGxlci1zdXBwbGllZCBkZWxpdmVyeSBzY29wZS5cbiAqIEByZXR1cm5zIGB0cnVlYCB3aGVuIHRoZSBvcmdhbml6YXRpb24gZmllbGQgaXMgcHJlc2VudC5cbiAqL1xuZXhwb3J0IGNvbnN0IGhhc09yZ2FuaXphdGlvbklkID0gKHNjb3BlOiBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlKTogYm9vbGVhbiA9PiB7XG4gIHJldHVybiBzY29wZS5vcmdhbml6YXRpb25JZCAhPT0gdW5kZWZpbmVkO1xufTtcblxuLyoqXG4gKiBSZXR1cm5zIHdoZXRoZXIgYHNjb3BlYCBzZXRzIGV4YWN0bHkgb25lIG9mIHRoZSBtdXR1YWxseSBleGNsdXNpdmUgZGVsaXZlcnkgZmllbGRzLlxuICpcbiAqIEBwYXJhbSBzY29wZSAtIENhbGxlci1zdXBwbGllZCBkZWxpdmVyeSBzY29wZS5cbiAqIEByZXR1cm5zIGB0cnVlYCB3aGVuIGV4YWN0bHkgb25lIG9mIHRoZSB0d28gZmllbGRzIGlzIHByZXNlbnQuXG4gKi9cbmV4cG9ydCBjb25zdCBpc0V4Y2x1c2l2ZUFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUgPSAoc2NvcGU6IEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUpOiBib29sZWFuID0+IHtcbiAgcmV0dXJuIGhhc0FsbG93ZWRTb3VyY2VBY2NvdW50SWRzKHNjb3BlKSAhPT0gaGFzT3JnYW5pemF0aW9uSWQoc2NvcGUpO1xufTtcblxuLyoqXG4gKiBSZXR1cm5zIHdoZXRoZXIgYHZhbHVlYCBpcyBhIDEyLWRpZ2l0IEFXUyBhY2NvdW50IElELlxuICpcbiAqIEBwYXJhbSB2YWx1ZSAtIENhbmRpZGF0ZSBhY2NvdW50IElELlxuICogQHJldHVybnMgYHRydWVgIHdoZW4gYHZhbHVlYCBtYXRjaGVzIGBeWzAtOV17MTJ9JGAuXG4gKi9cbmV4cG9ydCBjb25zdCBpc0F3c0FjY291bnRJZCA9ICh2YWx1ZTogc3RyaW5nKTogYm9vbGVhbiA9PiB7XG4gIHJldHVybiAvXlxcZHsxMn0kLy50ZXN0KHZhbHVlKTtcbn07XG5cbi8qKlxuICogUmV0dXJucyB3aGV0aGVyIGB2YWx1ZWAgaXMgYW4gQVdTIE9yZ2FuaXphdGlvbnMgSUQuXG4gKlxuICogQHBhcmFtIHZhbHVlIC0gQ2FuZGlkYXRlIG9yZ2FuaXphdGlvbiBJRC5cbiAqIEByZXR1cm5zIGB0cnVlYCB3aGVuIGB2YWx1ZWAgbWF0Y2hlcyBgXm8tW2EtejAtOV17MTAsMzJ9JGAuXG4gKi9cbmV4cG9ydCBjb25zdCBpc0F3c09yZ2FuaXphdGlvbklkID0gKHZhbHVlOiBzdHJpbmcpOiBib29sZWFuID0+IHtcbiAgcmV0dXJuIC9eby1bYS16MC05XXsxMCwzMn0kLy50ZXN0KHZhbHVlKTtcbn07XG4iXX0=

package/lib/bucket-types/bucket-type.d.ts

@@ -27,7 +27,10 @@ export declare const S3SecureBucketType: {
     readonly DEFAULT_BUCKET: "DefaultBucket";
     /**
      * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
-     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/...` prefixes only (no read/list).
+     *
+     * By default the prefix is `AWSLogs/<stack account>/*`. Override with
+     * {@link S3SecureBucketProps.accessLogDelivery} to allow an explicit account list or an AWS Organization.
      *
      * The regional ELBv2 log-delivery account ID (legacy path alongside the log delivery service principal)
      * is resolved from `aws-cdk-lib/region-info` at synthesis time when {@link Stack#region} is known,

package/lib/bucket-types/bucket-type.js

@@ -30,7 +30,10 @@ exports.S3SecureBucketType = {
     DEFAULT_BUCKET: 'DefaultBucket',
     /**
      * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
-     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/<account>/*` only (no read/list).
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/...` prefixes only (no read/list).
+     *
+     * By default the prefix is `AWSLogs/<stack account>/*`. Override with
+     * {@link S3SecureBucketProps.accessLogDelivery} to allow an explicit account list or an AWS Organization.
      *
      * The regional ELBv2 log-delivery account ID (legacy path alongside the log delivery service principal)
      * is resolved from `aws-cdk-lib/region-info` at synthesis time when {@link Stack#region} is known,
@@ -45,4 +48,4 @@ exports.S3SecureBucketType = {
      */
     CLOUD_WATCH_LOG_ARCHIVE_BUCKET: 'CloudWatchLogArchiveBucket',
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXR5cGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2J1Y2tldC10eXBlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7Ozs7R0FNRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7Ozs7O09BS0c7SUFDSCxtQ0FBbUMsRUFBRSxrQ0FBa0M7SUFDdkU7Ozs7T0FJRztJQUNILHdCQUF3QixFQUFFLHdCQUF3QjtJQUNsRDs7OztPQUlHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7T0FPRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtJQUNwQzs7Ozs7T0FLRztJQUNILDhCQUE4QixFQUFFLDRCQUE0QjtDQUNwRCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9yIHZhbHVlcyBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0uXG4gKlxuICogRWFjaCB2YWx1ZSBzZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kLCBmb3Igc29tZSB0eXBlcywgYWRkaXRpb25hbCBidWNrZXQgcmVzb3VyY2UgcG9saWNpZXMuXG4gKlxuICogQHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfVxuICovXG5leHBvcnQgY29uc3QgUzNTZWN1cmVCdWNrZXRUeXBlID0ge1xuICAvKipcbiAgICogUGlwZWxpbmUgYXJ0aWZhY3QgYnVja2V0IHdoZW4gdXNpbmcgYSBjdXN0b20gQ0RLIGJvb3RzdHJhcCBxdWFsaWZpZXJcbiAgICogKHNpbmdsZS0gb3IgbXVsdGktcmVnaW9uIGRlcGxveW1lbnRzKS5cbiAgICpcbiAgICogQWRkcyBhbiBgczM6KmAgZ3JhbnQgZm9yIGBjZGstPHF1YWxpZmllcj4tZGVwbG95LXJvbGVgIHdoZW4gdGhlIGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgbm90IGRlZmF1bHQuXG4gICAqL1xuICBERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVDogJ0RlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0QnVja2V0JyxcbiAgLyoqXG4gICAqIE9yaWdpbiBidWNrZXQgZm9yIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9ucy5cbiAgICpcbiAgICogVXNlcyBTMy1tYW5hZ2VkIGVuY3J5cHRpb24gKHtAbGluayBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUR9KSBieSBkZWZhdWx0LlxuICAgKi9cbiAgQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUOiAnQ2xvdWRGcm9udE9yaWdpbkJ1Y2tldCcsXG4gIC8qKlxuICAgKiBHZW5lcmFsLXB1cnBvc2Ugc2VjdXJlIGJ1Y2tldCAoZGVmYXVsdCBxdWFsaWZpZXIgLyBzdGFuZGFyZCB1c2UpLlxuICAgKlxuICAgKiBVc2VzIEtNUy1tYW5hZ2VkIGVuY3J5cHRpb24gdW5sZXNzIG92ZXJyaWRkZW4gaW4gcHJvcHMuIE5vIHR5cGUtc3BlY2lmaWMgcmVzb3VyY2UgcG9saWNpZXMuXG4gICAqL1xuICBERUZBVUxUX0JVQ0tFVDogJ0RlZmF1bHRCdWNrZXQnLFxuICAvKipcbiAgICogQ2VudHJhbGl6ZWQgYWNjZXNzIGxvZ3MgZm9yIHByb2R1Y2VycyBzdWNoIGFzIEFMQi9OTEIsIENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpLFxuICAgKiBhbmQgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nLiBHcmFudHMgYHMzOlB1dE9iamVjdGAgb24gYEFXU0xvZ3MvPGFjY291bnQ+LypgIG9ubHkgKG5vIHJlYWQvbGlzdCkuXG4gICAqXG4gICAqIFRoZSByZWdpb25hbCBFTEJ2MiBsb2ctZGVsaXZlcnkgYWNjb3VudCBJRCAobGVnYWN5IHBhdGggYWxvbmdzaWRlIHRoZSBsb2cgZGVsaXZlcnkgc2VydmljZSBwcmluY2lwYWwpXG4gICAqIGlzIHJlc29sdmVkIGZyb20gYGF3cy1jZGstbGliL3JlZ2lvbi1pbmZvYCBhdCBzeW50aGVzaXMgdGltZSB3aGVuIHtAbGluayBTdGFjayNyZWdpb259IGlzIGtub3duLFxuICAgKiBvciB2aWEgYSBkZXBsb3ktdGltZSBtYXBwaW5nIHdoZW4gaXQgaXMgYSB0b2tlbi5cbiAgICovXG4gIEFDQ0VTU19MT0dfQlVDS0VUOiAnQWNjZXNzTG9nQnVja2V0JyxcbiAgLyoqXG4gICAqIEFyY2hpdmUgYnVja2V0IGZvciBsb2cgZGF0YSBleHBvcnRlZCBmcm9tIENsb3VkV2F0Y2ggTG9ncyB2aWEgZXhwb3J0IHRhc2tzLlxuICAgKlxuICAgKiBHcmFudHMgYGxvZ3MuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbWAgYHMzOkdldEJ1Y2tldEFjbGAgYW5kIGBzMzpQdXRPYmplY3RgIGZvciBsb2cgZ3JvdXBzIGluIHRoZVxuICAgKiBzdGFjayBhY2NvdW50IGFuZCByZWdpb24gKHNlZSBBV1MgZG9jcyBmb3IgY3Jvc3MtYWNjb3VudCBleHBvcnQpLlxuICAgKi9cbiAgQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUOiAnQ2xvdWRXYXRjaExvZ0FyY2hpdmVCdWNrZXQnLFxufSBhcyBjb25zdDtcblxuLyoqXG4gKiBEaXNjcmltaW5hdGVkIHVuaW9uIG9mIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGV9IHN0cmluZyBsaXRlcmFscy5cbiAqL1xuZXhwb3J0IHR5cGUgUzNTZWN1cmVCdWNrZXRUeXBlID0gdHlwZW9mIFMzU2VjdXJlQnVja2V0VHlwZVtrZXlvZiB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlXTtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXR5cGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2J1Y2tldC10eXBlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7Ozs7R0FNRztBQUNVLFFBQUEsa0JBQWtCLEdBQUc7SUFDaEM7Ozs7O09BS0c7SUFDSCxtQ0FBbUMsRUFBRSxrQ0FBa0M7SUFDdkU7Ozs7T0FJRztJQUNILHdCQUF3QixFQUFFLHdCQUF3QjtJQUNsRDs7OztPQUlHO0lBQ0gsY0FBYyxFQUFFLGVBQWU7SUFDL0I7Ozs7Ozs7Ozs7T0FVRztJQUNILGlCQUFpQixFQUFFLGlCQUFpQjtJQUNwQzs7Ozs7T0FLRztJQUNILDhCQUE4QixFQUFFLDRCQUE0QjtDQUNwRCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9yIHZhbHVlcyBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0uXG4gKlxuICogRWFjaCB2YWx1ZSBzZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kLCBmb3Igc29tZSB0eXBlcywgYWRkaXRpb25hbCBidWNrZXQgcmVzb3VyY2UgcG9saWNpZXMuXG4gKlxuICogQHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfVxuICovXG5leHBvcnQgY29uc3QgUzNTZWN1cmVCdWNrZXRUeXBlID0ge1xuICAvKipcbiAgICogUGlwZWxpbmUgYXJ0aWZhY3QgYnVja2V0IHdoZW4gdXNpbmcgYSBjdXN0b20gQ0RLIGJvb3RzdHJhcCBxdWFsaWZpZXJcbiAgICogKHNpbmdsZS0gb3IgbXVsdGktcmVnaW9uIGRlcGxveW1lbnRzKS5cbiAgICpcbiAgICogQWRkcyBhbiBgczM6KmAgZ3JhbnQgZm9yIGBjZGstPHF1YWxpZmllcj4tZGVwbG95LXJvbGVgIHdoZW4gdGhlIGJvb3RzdHJhcCBxdWFsaWZpZXIgaXMgbm90IGRlZmF1bHQuXG4gICAqL1xuICBERVBMT1lNRU5UX1BJUEVMSU5FX0FSVElGQUNUX0JVQ0tFVDogJ0RlcGxveW1lbnRQaXBlbGluZUFydGlmYWN0QnVja2V0JyxcbiAgLyoqXG4gICAqIE9yaWdpbiBidWNrZXQgZm9yIENsb3VkRnJvbnQgZGlzdHJpYnV0aW9ucy5cbiAgICpcbiAgICogVXNlcyBTMy1tYW5hZ2VkIGVuY3J5cHRpb24gKHtAbGluayBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUR9KSBieSBkZWZhdWx0LlxuICAgKi9cbiAgQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUOiAnQ2xvdWRGcm9udE9yaWdpbkJ1Y2tldCcsXG4gIC8qKlxuICAgKiBHZW5lcmFsLXB1cnBvc2Ugc2VjdXJlIGJ1Y2tldCAoZGVmYXVsdCBxdWFsaWZpZXIgLyBzdGFuZGFyZCB1c2UpLlxuICAgKlxuICAgKiBVc2VzIEtNUy1tYW5hZ2VkIGVuY3J5cHRpb24gdW5sZXNzIG92ZXJyaWRkZW4gaW4gcHJvcHMuIE5vIHR5cGUtc3BlY2lmaWMgcmVzb3VyY2UgcG9saWNpZXMuXG4gICAqL1xuICBERUZBVUxUX0JVQ0tFVDogJ0RlZmF1bHRCdWNrZXQnLFxuICAvKipcbiAgICogQ2VudHJhbGl6ZWQgYWNjZXNzIGxvZ3MgZm9yIHByb2R1Y2VycyBzdWNoIGFzIEFMQi9OTEIsIENsb3VkRnJvbnQgc3RhbmRhcmQgbG9nZ2luZyAodjIpLFxuICAgKiBhbmQgUzMgc2VydmVyIGFjY2VzcyBsb2dnaW5nLiBHcmFudHMgYHMzOlB1dE9iamVjdGAgb24gYEFXU0xvZ3MvLi4uYCBwcmVmaXhlcyBvbmx5IChubyByZWFkL2xpc3QpLlxuICAgKlxuICAgKiBCeSBkZWZhdWx0IHRoZSBwcmVmaXggaXMgYEFXU0xvZ3MvPHN0YWNrIGFjY291bnQ+LypgLiBPdmVycmlkZSB3aXRoXG4gICAqIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmFjY2Vzc0xvZ0RlbGl2ZXJ5fSB0byBhbGxvdyBhbiBleHBsaWNpdCBhY2NvdW50IGxpc3Qgb3IgYW4gQVdTIE9yZ2FuaXphdGlvbi5cbiAgICpcbiAgICogVGhlIHJlZ2lvbmFsIEVMQnYyIGxvZy1kZWxpdmVyeSBhY2NvdW50IElEIChsZWdhY3kgcGF0aCBhbG9uZ3NpZGUgdGhlIGxvZyBkZWxpdmVyeSBzZXJ2aWNlIHByaW5jaXBhbClcbiAgICogaXMgcmVzb2x2ZWQgZnJvbSBgYXdzLWNkay1saWIvcmVnaW9uLWluZm9gIGF0IHN5bnRoZXNpcyB0aW1lIHdoZW4ge0BsaW5rIFN0YWNrI3JlZ2lvbn0gaXMga25vd24sXG4gICAqIG9yIHZpYSBhIGRlcGxveS10aW1lIG1hcHBpbmcgd2hlbiBpdCBpcyBhIHRva2VuLlxuICAgKi9cbiAgQUNDRVNTX0xPR19CVUNLRVQ6ICdBY2Nlc3NMb2dCdWNrZXQnLFxuICAvKipcbiAgICogQXJjaGl2ZSBidWNrZXQgZm9yIGxvZyBkYXRhIGV4cG9ydGVkIGZyb20gQ2xvdWRXYXRjaCBMb2dzIHZpYSBleHBvcnQgdGFza3MuXG4gICAqXG4gICAqIEdyYW50cyBgbG9ncy48cmVnaW9uPi5hbWF6b25hd3MuY29tYCBgczM6R2V0QnVja2V0QWNsYCBhbmQgYHMzOlB1dE9iamVjdGAgZm9yIGxvZyBncm91cHMgaW4gdGhlXG4gICAqIHN0YWNrIGFjY291bnQgYW5kIHJlZ2lvbiAoc2VlIEFXUyBkb2NzIGZvciBjcm9zcy1hY2NvdW50IGV4cG9ydCkuXG4gICAqL1xuICBDTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVQ6ICdDbG91ZFdhdGNoTG9nQXJjaGl2ZUJ1Y2tldCcsXG59IGFzIGNvbnN0O1xuXG4vKipcbiAqIERpc2NyaW1pbmF0ZWQgdW5pb24gb2Yge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0gc3RyaW5nIGxpdGVyYWxzLlxuICovXG5leHBvcnQgdHlwZSBTM1NlY3VyZUJ1Y2tldFR5cGUgPSB0eXBlb2YgUzNTZWN1cmVCdWNrZXRUeXBlW2tleW9mIHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVdO1xuIl19

package/lib/bucket-types/index.d.ts

@@ -4,5 +4,6 @@
  * @packageDocumentation
  */
 export { S3SecureBucketType } from './bucket-type';
+export type { AccessLogDeliveryScope } from './access-log-delivery-scope';
 export type { S3SecureBucketProps } from './props';
 export { resolveEncryptionDefault } from './encryption-default';

package/lib/bucket-types/index.js

@@ -10,4 +10,4 @@ var bucket_type_1 = require("./bucket-type");
 Object.defineProperty(exports, "S3SecureBucketType", { enumerable: true, get: function () { return bucket_type_1.S3SecureBucketType; } });
 var encryption_default_1 = require("./encryption-default");
 Object.defineProperty(exports, "resolveEncryptionDefault", { enumerable: true, get: function () { return encryption_default_1.resolveEncryptionDefault; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7O0dBSUc7QUFDSCw2Q0FBbUQ7QUFBMUMsaUhBQUEsa0JBQWtCLE9BQUE7QUFFM0IsMkRBQWdFO0FBQXZELDhIQUFBLHdCQUF3QixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9ycywgY29uc3RydWN0IHByb3BzLCBhbmQgZW5jcnlwdGlvbiBkZWZhdWx0cy5cbiAqXG4gKiBAcGFja2FnZURvY3VtZW50YXRpb25cbiAqL1xuZXhwb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi9idWNrZXQtdHlwZSc7XG5leHBvcnQgdHlwZSB7IFMzU2VjdXJlQnVja2V0UHJvcHMgfSBmcm9tICcuL3Byb3BzJztcbmV4cG9ydCB7IHJlc29sdmVFbmNyeXB0aW9uRGVmYXVsdCB9IGZyb20gJy4vZW5jcnlwdGlvbi1kZWZhdWx0JztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBOzs7O0dBSUc7QUFDSCw2Q0FBbUQ7QUFBMUMsaUhBQUEsa0JBQWtCLE9BQUE7QUFHM0IsMkRBQWdFO0FBQXZELDhIQUFBLHdCQUF3QixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBCdWNrZXQgdHlwZSBkaXNjcmltaW5hdG9ycywgY29uc3RydWN0IHByb3BzLCBhbmQgZW5jcnlwdGlvbiBkZWZhdWx0cy5cbiAqXG4gKiBAcGFja2FnZURvY3VtZW50YXRpb25cbiAqL1xuZXhwb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi9idWNrZXQtdHlwZSc7XG5leHBvcnQgdHlwZSB7IEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUgfSBmcm9tICcuL2FjY2Vzcy1sb2ctZGVsaXZlcnktc2NvcGUnO1xuZXhwb3J0IHR5cGUgeyBTM1NlY3VyZUJ1Y2tldFByb3BzIH0gZnJvbSAnLi9wcm9wcyc7XG5leHBvcnQgeyByZXNvbHZlRW5jcnlwdGlvbkRlZmF1bHQgfSBmcm9tICcuL2VuY3J5cHRpb24tZGVmYXVsdCc7XG4iXX0=

package/lib/bucket-types/props.d.ts

@@ -1,4 +1,5 @@
 import * as s3 from 'aws-cdk-lib/aws-s3';
+import { AccessLogDeliveryScope } from './access-log-delivery-scope';
 import { S3SecureBucketType } from './bucket-type';
 /**
  * Construction properties for {@link S3SecureBucket}.
@@ -13,4 +14,17 @@ export interface S3SecureBucketProps extends s3.BucketProps {
      * @default {@link S3SecureBucketType.DEFAULT_BUCKET}
      */
     readonly bucketType?: S3SecureBucketType;
+    /**
+     * Account or organization scope for {@link S3SecureBucketType.ACCESS_LOG_BUCKET} writers.
+     *
+     * Specify exactly one of {@link AccessLogDeliveryScope.allowedSourceAccountIds} or
+     * {@link AccessLogDeliveryScope.organizationId}. When omitted, only the stack account
+     * may deliver logs (`AWSLogs/<stack account>/*`).
+     *
+     * Supported only when {@link S3SecureBucketProps.bucketType} is
+     * {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
+     *
+     * @default stack account only
+     */
+    readonly accessLogDelivery?: AccessLogDeliveryScope;
 }

package/lib/bucket-types/props.js

@@ -34,4 +34,5 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const s3 = __importStar(require("aws-cdk-lib/aws-s3"));
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvcHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL3Byb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXlDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGUnO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfS4gU2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3RcbiAqIGFuZCBtYXkgYmUgb3ZlcnJpZGRlbiB1bmxlc3MgZG9jdW1lbnRlZCBvdGhlcndpc2Ugb24ge0BsaW5rIFMzU2VjdXJlQnVja2V0fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTM1NlY3VyZUJ1Y2tldFByb3BzIGV4dGVuZHMgczMuQnVja2V0UHJvcHMge1xuXG4gIC8qKlxuICAgKiBTZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kIG9wdGlvbmFsIHJlc291cmNlLXBvbGljeSBzdGF0ZW1lbnRzLlxuICAgKlxuICAgKiBAZGVmYXVsdCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUfVxuICAgKi9cbiAgcmVhZG9ubHkgYnVja2V0VHlwZT86IFMzU2VjdXJlQnVja2V0VHlwZTtcbn1cbiJdfQ==
+const bucket_type_1 = require("./bucket-type");
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvcHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvYnVja2V0LXR5cGVzL3Byb3BzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXlDO0FBRXpDLCtDQUFtRCIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCAqIGFzIHMzIGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlIH0gZnJvbSAnLi9hY2Nlc3MtbG9nLWRlbGl2ZXJ5LXNjb3BlJztcbmltcG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGUnO1xuXG4vKipcbiAqIENvbnN0cnVjdGlvbiBwcm9wZXJ0aWVzIGZvciB7QGxpbmsgUzNTZWN1cmVCdWNrZXR9LlxuICpcbiAqIEV4dGVuZHMge0BsaW5rIHMzLkJ1Y2tldFByb3BzfS4gU2V2ZXJhbCBmaWVsZHMgcmVjZWl2ZSBzZWN1cmUgZGVmYXVsdHMgaW5zaWRlIHRoZSBjb25zdHJ1Y3RcbiAqIGFuZCBtYXkgYmUgb3ZlcnJpZGRlbiB1bmxlc3MgZG9jdW1lbnRlZCBvdGhlcndpc2Ugb24ge0BsaW5rIFMzU2VjdXJlQnVja2V0fS5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBTM1NlY3VyZUJ1Y2tldFByb3BzIGV4dGVuZHMgczMuQnVja2V0UHJvcHMge1xuXG4gIC8qKlxuICAgKiBTZWxlY3RzIGVuY3J5cHRpb24gZGVmYXVsdHMgYW5kIG9wdGlvbmFsIHJlc291cmNlLXBvbGljeSBzdGF0ZW1lbnRzLlxuICAgKlxuICAgKiBAZGVmYXVsdCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUfVxuICAgKi9cbiAgcmVhZG9ubHkgYnVja2V0VHlwZT86IFMzU2VjdXJlQnVja2V0VHlwZTtcblxuICAvKipcbiAgICogQWNjb3VudCBvciBvcmdhbml6YXRpb24gc2NvcGUgZm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9IHdyaXRlcnMuXG4gICAqXG4gICAqIFNwZWNpZnkgZXhhY3RseSBvbmUgb2Yge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUuYWxsb3dlZFNvdXJjZUFjY291bnRJZHN9IG9yXG4gICAqIHtAbGluayBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLm9yZ2FuaXphdGlvbklkfS4gV2hlbiBvbWl0dGVkLCBvbmx5IHRoZSBzdGFjayBhY2NvdW50XG4gICAqIG1heSBkZWxpdmVyIGxvZ3MgKGBBV1NMb2dzLzxzdGFjayBhY2NvdW50Pi8qYCkuXG4gICAqXG4gICAqIFN1cHBvcnRlZCBvbmx5IHdoZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gaXNcbiAgICoge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqXG4gICAqIEBkZWZhdWx0IHN0YWNrIGFjY291bnQgb25seVxuICAgKi9cbiAgcmVhZG9ubHkgYWNjZXNzTG9nRGVsaXZlcnk/OiBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlO1xufVxuIl19

package/lib/index.d.ts

@@ -5,4 +5,4 @@
  */
 export { S3SecureBucket } from './s3-secure-bucket';
 export { S3SecureBucketType } from './bucket-types';
-export type { S3SecureBucketProps } from './bucket-types';
+export type { AccessLogDeliveryScope, S3SecureBucketProps } from './bucket-types';

package/lib/index.js

@@ -10,4 +10,4 @@ var s3_secure_bucket_1 = require("./s3-secure-bucket");
 Object.defineProperty(exports, "S3SecureBucket", { enumerable: true, get: function () { return s3_secure_bucket_1.S3SecureBucket; } });
 var bucket_types_1 = require("./bucket-types");
 Object.defineProperty(exports, "S3SecureBucketType", { enumerable: true, get: function () { return bucket_types_1.S3SecureBucketType; } });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUE7Ozs7R0FJRztBQUNILHVEQUFvRDtBQUEzQyxrSEFBQSxjQUFjLE9BQUE7QUFDdkIsK0NBQW9EO0FBQTNDLGtIQUFBLGtCQUFrQixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBQdWJsaWMgZW50cnkgcG9pbnQgZm9yIHRoZSBgczMtc2VjdXJlLWJ1Y2tldGAgY29uc3RydWN0IGxpYnJhcnkuXG4gKlxuICogQHBhY2thZ2VEb2N1bWVudGF0aW9uXG4gKi9cbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0IH0gZnJvbSAnLi9zMy1zZWN1cmUtYnVja2V0JztcbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbmV4cG9ydCB0eXBlIHsgUzNTZWN1cmVCdWNrZXRQcm9wcyB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUE7Ozs7R0FJRztBQUNILHVEQUFvRDtBQUEzQyxrSEFBQSxjQUFjLE9BQUE7QUFDdkIsK0NBQW9EO0FBQTNDLGtIQUFBLGtCQUFrQixPQUFBIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBQdWJsaWMgZW50cnkgcG9pbnQgZm9yIHRoZSBgczMtc2VjdXJlLWJ1Y2tldGAgY29uc3RydWN0IGxpYnJhcnkuXG4gKlxuICogQHBhY2thZ2VEb2N1bWVudGF0aW9uXG4gKi9cbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0IH0gZnJvbSAnLi9zMy1zZWN1cmUtYnVja2V0JztcbmV4cG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbmV4cG9ydCB0eXBlIHsgQWNjZXNzTG9nRGVsaXZlcnlTY29wZSwgUzNTZWN1cmVCdWNrZXRQcm9wcyB9IGZyb20gJy4vYnVja2V0LXR5cGVzJztcbiJdfQ==

package/lib/s3-secure-bucket.d.ts

@@ -17,7 +17,8 @@ import { S3SecureBucketProps } from './bucket-types';
  *
  * Bucket-type-specific behavior:
  * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
- * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}
+ *   and {@link S3SecureBucketProps.accessLogDelivery}.
  * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
  */
 export declare class S3SecureBucket extends s3.Bucket {

package/lib/s3-secure-bucket.js

@@ -55,11 +55,12 @@ const bucket_types_1 = require("./bucket-types");
  *
  * Bucket-type-specific behavior:
  * - {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET}: may attach a deploy-role policy when a non-default bootstrap qualifier is present.
- * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}.
+ * - {@link S3SecureBucketType.ACCESS_LOG_BUCKET}: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable}
+ *   and {@link S3SecureBucketProps.accessLogDelivery}.
  * - {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET}: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).
  */
 class S3SecureBucket extends s3.Bucket {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.4.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "s3-secure-bucket.S3SecureBucket", version: "0.5.0" };
     /**
      * Set only when {@link S3SecureBucketProps.bucketType} is {@link S3SecureBucketType.ACCESS_LOG_BUCKET}.
      * Use as a dependency target so load balancer access-log enablement runs after the bucket policy
@@ -107,12 +108,16 @@ class S3SecureBucket extends s3.Bucket {
             cfnBucket.addPropertyOverride('NotificationConfiguration.EventBridgeConfiguration.EventBridgeEnabled', true);
         }
         const stack = aws_cdk_lib_1.Stack.of(this);
+        if (props?.accessLogDelivery !== undefined && bucketType !== bucket_types_1.S3SecureBucketType.ACCESS_LOG_BUCKET) {
+            throw new Error('accessLogDelivery is only supported when bucketType is ACCESS_LOG_BUCKET');
+        }
         const policyResult = (0, bucket_policies_1.applyBucketPolicies)(bucketType, {
             bucket: this,
             stack,
+            accessLogDelivery: props?.accessLogDelivery,
         });
         this.accessLogBucketPolicyDependable = policyResult.accessLogBucketPolicyDependable;
     }
 }
 exports.S3SecureBucket = S3SecureBucket;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiczMtc2VjdXJlLWJ1Y2tldC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9zMy1zZWN1cmUtYnVja2V0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBbUQ7QUFDbkQsdURBQXlDO0FBRXpDLHVEQUF3RDtBQUN4RCxpREFJd0I7QUFFeEI7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQWtCRztBQUNILE1BQWEsY0FBZSxTQUFRLEVBQUUsQ0FBQyxNQUFNOztJQUMzQzs7Ozs7Ozs7T0FRRztJQUNhLCtCQUErQixDQUFlO0lBRTlEOzs7Ozs7O09BT0c7SUFDSCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTJCO1FBQ25FLE1BQU0sVUFBVSxHQUFHLEtBQUssRUFBRSxVQUFVLElBQUksaUNBQWtCLENBQUMsY0FBYyxDQUFDO1FBQzFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2YsR0FBRyxLQUFLO1lBQ1IsYUFBYSxFQUFFLDJCQUFhLENBQUMsTUFBTTtZQUNuQyxVQUFVLEVBQUUsSUFBQSx1Q0FBd0IsRUFBQyxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQztZQUNuRSxhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ25CLElBQUksQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7b0JBQzFCLE9BQU8sRUFBRSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQztnQkFDeEMsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDN0IsQ0FBQyxDQUFDLEVBQUU7WUFDSixrQkFBa0IsRUFBRSxTQUFTO1lBQzdCLGdCQUFnQixFQUFFLEtBQUs7WUFDdkIsaUJBQWlCLEVBQUUsRUFBRSxDQUFDLGlCQUFpQixDQUFDLFNBQVM7WUFDakQsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUyxFQUFFLEtBQUssRUFBRSxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ2xFLGVBQWUsRUFBRSxDQUFDLEdBQUcsRUFBRTtnQkFDckIsSUFBSSxLQUFLLEVBQUUsZUFBZSxFQUFFLENBQUM7b0JBQzNCLE9BQU8sS0FBSyxDQUFDLGVBQWUsQ0FBQztnQkFDL0IsQ0FBQztnQkFDRCxPQUFPLEVBQUUsQ0FBQyxlQUFlLENBQUMscUJBQXFCLENBQUM7WUFDbEQsQ0FBQyxDQUFDLEVBQUU7U0FDTCxDQUFDLENBQUM7UUFFSCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQTRCLENBQUM7UUFDekQsSUFBSSxLQUFLLEVBQUUsa0JBQWtCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDdkMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLHVFQUF1RSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxtQkFBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM3QixNQUFNLFlBQVksR0FBRyxJQUFBLHFDQUFtQixFQUFDLFVBQVUsRUFBRTtZQUNuRCxNQUFNLEVBQUUsSUFBSTtZQUNaLEtBQUs7U0FDTixDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsK0JBQStCLEdBQUcsWUFBWSxDQUFDLCtCQUErQixDQUFDO0lBQ3RGLENBQUM7O0FBeERILHdDQXlEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IENvbnN0cnVjdCwgSURlcGVuZGFibGUgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFwcGx5QnVja2V0UG9saWNpZXMgfSBmcm9tICcuL2J1Y2tldC1wb2xpY2llcyc7XG5pbXBvcnQge1xuICByZXNvbHZlRW5jcnlwdGlvbkRlZmF1bHQsXG4gIFMzU2VjdXJlQnVja2V0UHJvcHMsXG4gIFMzU2VjdXJlQnVja2V0VHlwZSxcbn0gZnJvbSAnLi9idWNrZXQtdHlwZXMnO1xuXG4vKipcbiAqIFMzIGJ1Y2tldCB3aXRoIG9waW5pb25hdGVkIHNlY3VyZSBkZWZhdWx0czogcHJpdmF0ZSBBQ0xzLCBibG9jayBwdWJsaWMgYWNjZXNzLCBUTFMtb25seSBhY2Nlc3MsXG4gKiBhbmQgZW5jcnlwdGlvbiAoUzMtbWFuYWdlZCBmb3IgbG9nL29yaWdpbi9hcmNoaXZlIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIFNlY3VyZSBkZWZhdWx0cyBhcHBsaWVkIHJlZ2FyZGxlc3Mgb2YgYHByb3BzYDpcbiAqIC0gYHJlbW92YWxQb2xpY3lgOiB7QGxpbmsgUmVtb3ZhbFBvbGljeS5SRVRBSU59XG4gKiAtIGBwdWJsaWNSZWFkQWNjZXNzYDogYGZhbHNlYFxuICogLSBgYmxvY2tQdWJsaWNBY2Nlc3NgOiB7QGxpbmsgczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMfVxuICogLSBgZW5mb3JjZVNTTGA6IGB0cnVlYFxuICogLSBgdmVyc2lvbmVkYDogYHRydWVgIHVubGVzcyBleHBsaWNpdGx5IHNldCBpbiBgcHJvcHNgXG4gKiAtIGBvYmplY3RPd25lcnNoaXBgOiB7QGxpbmsgczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRH0gdW5sZXNzIG92ZXJyaWRkZW5cbiAqIC0gYGFjY2Vzc0NvbnRyb2xgOiB7QGxpbmsgczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFfSB1bmxlc3Mgb3ZlcnJpZGRlblxuICpcbiAqIEJ1Y2tldC10eXBlLXNwZWNpZmljIGJlaGF2aW9yOlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUfTogbWF5IGF0dGFjaCBhIGRlcGxveS1yb2xlIHBvbGljeSB3aGVuIGEgbm9uLWRlZmF1bHQgYm9vdHN0cmFwIHF1YWxpZmllciBpcyBwcmVzZW50LlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfTogYWRkcyBsb2ctd3JpdGVyIHByaW5jaXBhbHM7IHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXQjYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZX0uXG4gKiAtIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUfTogYWRkcyBDbG91ZFdhdGNoIExvZ3MgZXhwb3J0IHByaW5jaXBhbHMgKGBsb2dzLjxyZWdpb24+LmFtYXpvbmF3cy5jb21gKS5cbiAqL1xuZXhwb3J0IGNsYXNzIFMzU2VjdXJlQnVja2V0IGV4dGVuZHMgczMuQnVja2V0IHtcbiAgLyoqXG4gICAqIFNldCBvbmx5IHdoZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX0gaXMge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqIFVzZSBhcyBhIGRlcGVuZGVuY3kgdGFyZ2V0IHNvIGxvYWQgYmFsYW5jZXIgYWNjZXNzLWxvZyBlbmFibGVtZW50IHJ1bnMgYWZ0ZXIgdGhlIGJ1Y2tldCBwb2xpY3lcbiAgICogZXhpc3RzIChFTEIgcGVyZm9ybXMgYW4gaW1tZWRpYXRlIHZhbGlkYXRpb24gYFB1dE9iamVjdGAgdGhhdCBmYWlscyBpZiB0aGUgcG9saWN5IGlzIG5vdCBhcHBsaWVkIHlldCkuXG4gICAqXG4gICAqIEV4YW1wbGU6IGBsb2FkQmFsYW5jZXIubm9kZS5hZGREZXBlbmRlbmN5KGJ1Y2tldC5hY2Nlc3NMb2dCdWNrZXRQb2xpY3lEZXBlbmRhYmxlISlgLlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgd2hlbiBgYnVja2V0VHlwZWAgaXMgbm90IHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVR9LlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGU/OiBJRGVwZW5kYWJsZTtcblxuICAvKipcbiAgICogQ3JlYXRlcyBhIHNlY3VyZSBTMyBidWNrZXQgYWNjb3JkaW5nIHRvIGBidWNrZXRUeXBlYCBhbmQgbWVyZ2VkIGBwcm9wc2AuXG4gICAqXG4gICAqIEBwYXJhbSBzY29wZSAtIFBhcmVudCBjb25zdHJ1Y3QsIHR5cGljYWxseSBhIHtAbGluayBTdGFja30uXG4gICAqIEBwYXJhbSBpZCAtIENvbnN0cnVjdCBJRCAoc3RhYmxlIGxvZ2ljYWwgSUQgc2VnbWVudCkuXG4gICAqIEBwYXJhbSBwcm9wcyAtIE9wdGlvbmFsIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzfTsgc2VjdXJlIGRlZmF1bHRzIG92ZXJyaWRlIHNldmVyYWwge0BsaW5rIHMzLkJ1Y2tldFByb3BzfSBmaWVsZHMuXG4gICAqIFdoZW4gYGV2ZW50QnJpZGdlRW5hYmxlZGAgaXMgYHRydWVgLCBFdmVudEJyaWRnZSBub3RpZmljYXRpb24gaXMgZW5hYmxlZCB2aWEgYW4gTDEgcHJvcGVydHkgb3ZlcnJpZGUuXG4gICAqL1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wcz86IFMzU2VjdXJlQnVja2V0UHJvcHMpIHtcbiAgICBjb25zdCBidWNrZXRUeXBlID0gcHJvcHM/LmJ1Y2tldFR5cGUgfHwgUzNTZWN1cmVCdWNrZXRUeXBlLkRFRkFVTFRfQlVDS0VUO1xuICAgIHN1cGVyKHNjb3BlLCBpZCwge1xuICAgICAgLi4ucHJvcHMsXG4gICAgICByZW1vdmFsUG9saWN5OiBSZW1vdmFsUG9saWN5LlJFVEFJTixcbiAgICAgIGVuY3J5cHRpb246IHJlc29sdmVFbmNyeXB0aW9uRGVmYXVsdChidWNrZXRUeXBlLCBwcm9wcz8uZW5jcnlwdGlvbiksXG4gICAgICBhY2Nlc3NDb250cm9sOiAoKCkgPT4ge1xuICAgICAgICBpZiAoIXByb3BzPy5hY2Nlc3NDb250cm9sKSB7XG4gICAgICAgICAgcmV0dXJuIHMzLkJ1Y2tldEFjY2Vzc0NvbnRyb2wuUFJJVkFURTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gcHJvcHMuYWNjZXNzQ29udHJvbDtcbiAgICAgIH0pKCksXG4gICAgICBldmVudEJyaWRnZUVuYWJsZWQ6IHVuZGVmaW5lZCxcbiAgICAgIHB1YmxpY1JlYWRBY2Nlc3M6IGZhbHNlLFxuICAgICAgYmxvY2tQdWJsaWNBY2Nlc3M6IHMzLkJsb2NrUHVibGljQWNjZXNzLkJMT0NLX0FMTCxcbiAgICAgIGVuZm9yY2VTU0w6IHRydWUsXG4gICAgICB2ZXJzaW9uZWQ6IHByb3BzPy52ZXJzaW9uZWQgIT09IHVuZGVmaW5lZCA/IHByb3BzLnZlcnNpb25lZCA6IHRydWUsXG4gICAgICBvYmplY3RPd25lcnNoaXA6ICgoKSA9PiB7XG4gICAgICAgIGlmIChwcm9wcz8ub2JqZWN0T3duZXJzaGlwKSB7XG4gICAgICAgICAgcmV0dXJuIHByb3BzLm9iamVjdE93bmVyc2hpcDtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm4gczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRDtcbiAgICAgIH0pKCksXG4gICAgfSk7XG5cbiAgICBjb25zdCBjZm5CdWNrZXQgPSB0aGlzLm5vZGUuZGVmYXVsdENoaWxkIGFzIHMzLkNmbkJ1Y2tldDtcbiAgICBpZiAocHJvcHM/LmV2ZW50QnJpZGdlRW5hYmxlZCA9PT0gdHJ1ZSkge1xuICAgICAgY2ZuQnVja2V0LmFkZFByb3BlcnR5T3ZlcnJpZGUoJ05vdGlmaWNhdGlvbkNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VDb25maWd1cmF0aW9uLkV2ZW50QnJpZGdlRW5hYmxlZCcsIHRydWUpO1xuICAgIH1cblxuICAgIGNvbnN0IHN0YWNrID0gU3RhY2sub2YodGhpcyk7XG4gICAgY29uc3QgcG9saWN5UmVzdWx0ID0gYXBwbHlCdWNrZXRQb2xpY2llcyhidWNrZXRUeXBlLCB7XG4gICAgICBidWNrZXQ6IHRoaXMsXG4gICAgICBzdGFjayxcbiAgICB9KTtcbiAgICB0aGlzLmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGUgPSBwb2xpY3lSZXN1bHQuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZTtcbiAgfVxufVxuIl19
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiczMtc2VjdXJlLWJ1Y2tldC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NyYy9zMy1zZWN1cmUtYnVja2V0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBbUQ7QUFDbkQsdURBQXlDO0FBRXpDLHVEQUF3RDtBQUN4RCxpREFJd0I7QUFFeEI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxNQUFhLGNBQWUsU0FBUSxFQUFFLENBQUMsTUFBTTs7SUFDM0M7Ozs7Ozs7O09BUUc7SUFDYSwrQkFBK0IsQ0FBZTtJQUU5RDs7Ozs7OztPQU9HO0lBQ0gsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUEyQjtRQUNuRSxNQUFNLFVBQVUsR0FBRyxLQUFLLEVBQUUsVUFBVSxJQUFJLGlDQUFrQixDQUFDLGNBQWMsQ0FBQztRQUMxRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNmLEdBQUcsS0FBSztZQUNSLGFBQWEsRUFBRSwyQkFBYSxDQUFDLE1BQU07WUFDbkMsVUFBVSxFQUFFLElBQUEsdUNBQXdCLEVBQUMsVUFBVSxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUM7WUFDbkUsYUFBYSxFQUFFLENBQUMsR0FBRyxFQUFFO2dCQUNuQixJQUFJLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxDQUFDO29CQUMxQixPQUFPLEVBQUUsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUM7Z0JBQ3hDLENBQUM7Z0JBQ0QsT0FBTyxLQUFLLENBQUMsYUFBYSxDQUFDO1lBQzdCLENBQUMsQ0FBQyxFQUFFO1lBQ0osa0JBQWtCLEVBQUUsU0FBUztZQUM3QixnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLGlCQUFpQixFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTO1lBQ2pELFVBQVUsRUFBRSxJQUFJO1lBQ2hCLFNBQVMsRUFBRSxLQUFLLEVBQUUsU0FBUyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUNsRSxlQUFlLEVBQUUsQ0FBQyxHQUFHLEVBQUU7Z0JBQ3JCLElBQUksS0FBSyxFQUFFLGVBQWUsRUFBRSxDQUFDO29CQUMzQixPQUFPLEtBQUssQ0FBQyxlQUFlLENBQUM7Z0JBQy9CLENBQUM7Z0JBQ0QsT0FBTyxFQUFFLENBQUMsZUFBZSxDQUFDLHFCQUFxQixDQUFDO1lBQ2xELENBQUMsQ0FBQyxFQUFFO1NBQ0wsQ0FBQyxDQUFDO1FBRUgsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUE0QixDQUFDO1FBQ3pELElBQUksS0FBSyxFQUFFLGtCQUFrQixLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3ZDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyx1RUFBdUUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUMvRyxDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQUcsbUJBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0IsSUFBSSxLQUFLLEVBQUUsaUJBQWlCLEtBQUssU0FBUyxJQUFJLFVBQVUsS0FBSyxpQ0FBa0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ2xHLE1BQU0sSUFBSSxLQUFLLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsSUFBQSxxQ0FBbUIsRUFBQyxVQUFVLEVBQUU7WUFDbkQsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLO1lBQ0wsaUJBQWlCLEVBQUUsS0FBSyxFQUFFLGlCQUFpQjtTQUM1QyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsK0JBQStCLEdBQUcsWUFBWSxDQUFDLCtCQUErQixDQUFDO0lBQ3RGLENBQUM7O0FBNURILHdDQTZEQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFJlbW92YWxQb2xpY3ksIFN0YWNrIH0gZnJvbSAnYXdzLWNkay1saWInO1xuaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IENvbnN0cnVjdCwgSURlcGVuZGFibGUgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IGFwcGx5QnVja2V0UG9saWNpZXMgfSBmcm9tICcuL2J1Y2tldC1wb2xpY2llcyc7XG5pbXBvcnQge1xuICByZXNvbHZlRW5jcnlwdGlvbkRlZmF1bHQsXG4gIFMzU2VjdXJlQnVja2V0UHJvcHMsXG4gIFMzU2VjdXJlQnVja2V0VHlwZSxcbn0gZnJvbSAnLi9idWNrZXQtdHlwZXMnO1xuXG4vKipcbiAqIFMzIGJ1Y2tldCB3aXRoIG9waW5pb25hdGVkIHNlY3VyZSBkZWZhdWx0czogcHJpdmF0ZSBBQ0xzLCBibG9jayBwdWJsaWMgYWNjZXNzLCBUTFMtb25seSBhY2Nlc3MsXG4gKiBhbmQgZW5jcnlwdGlvbiAoUzMtbWFuYWdlZCBmb3IgbG9nL29yaWdpbi9hcmNoaXZlIHR5cGVzOyBLTVMtbWFuYWdlZCBieSBkZWZhdWx0IG90aGVyd2lzZSkuXG4gKlxuICogQHJlbWFya3NcbiAqIFNlY3VyZSBkZWZhdWx0cyBhcHBsaWVkIHJlZ2FyZGxlc3Mgb2YgYHByb3BzYDpcbiAqIC0gYHJlbW92YWxQb2xpY3lgOiB7QGxpbmsgUmVtb3ZhbFBvbGljeS5SRVRBSU59XG4gKiAtIGBwdWJsaWNSZWFkQWNjZXNzYDogYGZhbHNlYFxuICogLSBgYmxvY2tQdWJsaWNBY2Nlc3NgOiB7QGxpbmsgczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMfVxuICogLSBgZW5mb3JjZVNTTGA6IGB0cnVlYFxuICogLSBgdmVyc2lvbmVkYDogYHRydWVgIHVubGVzcyBleHBsaWNpdGx5IHNldCBpbiBgcHJvcHNgXG4gKiAtIGBvYmplY3RPd25lcnNoaXBgOiB7QGxpbmsgczMuT2JqZWN0T3duZXJzaGlwLkJVQ0tFVF9PV05FUl9FTkZPUkNFRH0gdW5sZXNzIG92ZXJyaWRkZW5cbiAqIC0gYGFjY2Vzc0NvbnRyb2xgOiB7QGxpbmsgczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFfSB1bmxlc3Mgb3ZlcnJpZGRlblxuICpcbiAqIEJ1Y2tldC10eXBlLXNwZWNpZmljIGJlaGF2aW9yOlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkRFUExPWU1FTlRfUElQRUxJTkVfQVJUSUZBQ1RfQlVDS0VUfTogbWF5IGF0dGFjaCBhIGRlcGxveS1yb2xlIHBvbGljeSB3aGVuIGEgbm9uLWRlZmF1bHQgYm9vdHN0cmFwIHF1YWxpZmllciBpcyBwcmVzZW50LlxuICogLSB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfTogYWRkcyBsb2ctd3JpdGVyIHByaW5jaXBhbHM7IHNlZSB7QGxpbmsgUzNTZWN1cmVCdWNrZXQjYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZX1cbiAqICAgYW5kIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmFjY2Vzc0xvZ0RlbGl2ZXJ5fS5cbiAqIC0ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVR9OiBhZGRzIENsb3VkV2F0Y2ggTG9ncyBleHBvcnQgcHJpbmNpcGFscyAoYGxvZ3MuPHJlZ2lvbj4uYW1hem9uYXdzLmNvbWApLlxuICovXG5leHBvcnQgY2xhc3MgUzNTZWN1cmVCdWNrZXQgZXh0ZW5kcyBzMy5CdWNrZXQge1xuICAvKipcbiAgICogU2V0IG9ubHkgd2hlbiB7QGxpbmsgUzNTZWN1cmVCdWNrZXRQcm9wcy5idWNrZXRUeXBlfSBpcyB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfS5cbiAgICogVXNlIGFzIGEgZGVwZW5kZW5jeSB0YXJnZXQgc28gbG9hZCBiYWxhbmNlciBhY2Nlc3MtbG9nIGVuYWJsZW1lbnQgcnVucyBhZnRlciB0aGUgYnVja2V0IHBvbGljeVxuICAgKiBleGlzdHMgKEVMQiBwZXJmb3JtcyBhbiBpbW1lZGlhdGUgdmFsaWRhdGlvbiBgUHV0T2JqZWN0YCB0aGF0IGZhaWxzIGlmIHRoZSBwb2xpY3kgaXMgbm90IGFwcGxpZWQgeWV0KS5cbiAgICpcbiAgICogRXhhbXBsZTogYGxvYWRCYWxhbmNlci5ub2RlLmFkZERlcGVuZGVuY3koYnVja2V0LmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGUhKWAuXG4gICAqXG4gICAqIEBkZWZhdWx0IHVuZGVmaW5lZCB3aGVuIGBidWNrZXRUeXBlYCBpcyBub3Qge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0uXG4gICAqL1xuICBwdWJsaWMgcmVhZG9ubHkgYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZT86IElEZXBlbmRhYmxlO1xuXG4gIC8qKlxuICAgKiBDcmVhdGVzIGEgc2VjdXJlIFMzIGJ1Y2tldCBhY2NvcmRpbmcgdG8gYGJ1Y2tldFR5cGVgIGFuZCBtZXJnZWQgYHByb3BzYC5cbiAgICpcbiAgICogQHBhcmFtIHNjb3BlIC0gUGFyZW50IGNvbnN0cnVjdCwgdHlwaWNhbGx5IGEge0BsaW5rIFN0YWNrfS5cbiAgICogQHBhcmFtIGlkIC0gQ29uc3RydWN0IElEIChzdGFibGUgbG9naWNhbCBJRCBzZWdtZW50KS5cbiAgICogQHBhcmFtIHByb3BzIC0gT3B0aW9uYWwge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHN9OyBzZWN1cmUgZGVmYXVsdHMgb3ZlcnJpZGUgc2V2ZXJhbCB7QGxpbmsgczMuQnVja2V0UHJvcHN9IGZpZWxkcy5cbiAgICogV2hlbiBgZXZlbnRCcmlkZ2VFbmFibGVkYCBpcyBgdHJ1ZWAsIEV2ZW50QnJpZGdlIG5vdGlmaWNhdGlvbiBpcyBlbmFibGVkIHZpYSBhbiBMMSBwcm9wZXJ0eSBvdmVycmlkZS5cbiAgICovXG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzPzogUzNTZWN1cmVCdWNrZXRQcm9wcykge1xuICAgIGNvbnN0IGJ1Y2tldFR5cGUgPSBwcm9wcz8uYnVja2V0VHlwZSB8fCBTM1NlY3VyZUJ1Y2tldFR5cGUuREVGQVVMVF9CVUNLRVQ7XG4gICAgc3VwZXIoc2NvcGUsIGlkLCB7XG4gICAgICAuLi5wcm9wcyxcbiAgICAgIHJlbW92YWxQb2xpY3k6IFJlbW92YWxQb2xpY3kuUkVUQUlOLFxuICAgICAgZW5jcnlwdGlvbjogcmVzb2x2ZUVuY3J5cHRpb25EZWZhdWx0KGJ1Y2tldFR5cGUsIHByb3BzPy5lbmNyeXB0aW9uKSxcbiAgICAgIGFjY2Vzc0NvbnRyb2w6ICgoKSA9PiB7XG4gICAgICAgIGlmICghcHJvcHM/LmFjY2Vzc0NvbnRyb2wpIHtcbiAgICAgICAgICByZXR1cm4gczMuQnVja2V0QWNjZXNzQ29udHJvbC5QUklWQVRFO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwcm9wcy5hY2Nlc3NDb250cm9sO1xuICAgICAgfSkoKSxcbiAgICAgIGV2ZW50QnJpZGdlRW5hYmxlZDogdW5kZWZpbmVkLFxuICAgICAgcHVibGljUmVhZEFjY2VzczogZmFsc2UsXG4gICAgICBibG9ja1B1YmxpY0FjY2VzczogczMuQmxvY2tQdWJsaWNBY2Nlc3MuQkxPQ0tfQUxMLFxuICAgICAgZW5mb3JjZVNTTDogdHJ1ZSxcbiAgICAgIHZlcnNpb25lZDogcHJvcHM/LnZlcnNpb25lZCAhPT0gdW5kZWZpbmVkID8gcHJvcHMudmVyc2lvbmVkIDogdHJ1ZSxcbiAgICAgIG9iamVjdE93bmVyc2hpcDogKCgpID0+IHtcbiAgICAgICAgaWYgKHByb3BzPy5vYmplY3RPd25lcnNoaXApIHtcbiAgICAgICAgICByZXR1cm4gcHJvcHMub2JqZWN0T3duZXJzaGlwO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBzMy5PYmplY3RPd25lcnNoaXAuQlVDS0VUX09XTkVSX0VORk9SQ0VEO1xuICAgICAgfSkoKSxcbiAgICB9KTtcblxuICAgIGNvbnN0IGNmbkJ1Y2tldCA9IHRoaXMubm9kZS5kZWZhdWx0Q2hpbGQgYXMgczMuQ2ZuQnVja2V0O1xuICAgIGlmIChwcm9wcz8uZXZlbnRCcmlkZ2VFbmFibGVkID09PSB0cnVlKSB7XG4gICAgICBjZm5CdWNrZXQuYWRkUHJvcGVydHlPdmVycmlkZSgnTm90aWZpY2F0aW9uQ29uZmlndXJhdGlvbi5FdmVudEJyaWRnZUNvbmZpZ3VyYXRpb24uRXZlbnRCcmlkZ2VFbmFibGVkJywgdHJ1ZSk7XG4gICAgfVxuXG4gICAgY29uc3Qgc3RhY2sgPSBTdGFjay5vZih0aGlzKTtcbiAgICBpZiAocHJvcHM/LmFjY2Vzc0xvZ0RlbGl2ZXJ5ICE9PSB1bmRlZmluZWQgJiYgYnVja2V0VHlwZSAhPT0gUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUKSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ2FjY2Vzc0xvZ0RlbGl2ZXJ5IGlzIG9ubHkgc3VwcG9ydGVkIHdoZW4gYnVja2V0VHlwZSBpcyBBQ0NFU1NfTE9HX0JVQ0tFVCcpO1xuICAgIH1cbiAgICBjb25zdCBwb2xpY3lSZXN1bHQgPSBhcHBseUJ1Y2tldFBvbGljaWVzKGJ1Y2tldFR5cGUsIHtcbiAgICAgIGJ1Y2tldDogdGhpcyxcbiAgICAgIHN0YWNrLFxuICAgICAgYWNjZXNzTG9nRGVsaXZlcnk6IHByb3BzPy5hY2Nlc3NMb2dEZWxpdmVyeSxcbiAgICB9KTtcbiAgICB0aGlzLmFjY2Vzc0xvZ0J1Y2tldFBvbGljeURlcGVuZGFibGUgPSBwb2xpY3lSZXN1bHQuYWNjZXNzTG9nQnVja2V0UG9saWN5RGVwZW5kYWJsZTtcbiAgfVxufVxuIl19

package/package.json

@@ -81,7 +81,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.4.4",
+  "version": "0.5.0",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [