s3-secure-bucket 0.5.6 → 0.6.1

package/.editorconfig

@@ -0,0 +1,12 @@
+# ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".
+
+root=true
+
+[*]
+end_of_line=lf
+charset=utf-8
+
+[*\.{js,ts}]
+indent_style=space
+indent_size=2
+max_line_length=120

package/.jsii

@@ -8440,7 +8440,7 @@
     "stability": "stable"
   },
   "homepage": "https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket.git",
-  "jsiiVersion": "6.0.16 (build 15002ec)",
+  "jsiiVersion": "6.0.17 (build e6a458c)",
   "keywords": [
     "cdk"
   ],
@@ -8456,7 +8456,7 @@
   },
   "name": "s3-secure-bucket",
   "readme": {
-    "markdown": "# S3 Secure Bucket (AWS CDK v2)\n\n[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)\n[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)\n\nAWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)\n- **`bucketType` presets**\n  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`). Writers default to `AWSLogs/<stack account>/*`; override with `accessLogDelivery` (`allowedSourceAccountIds` or `organizationId`)\n  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## Installation\n\n**npm**\n\n```shell\nnpm install s3-secure-bucket\n```\n\n**yarn**\n\n```shell\nyarn add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### CDK deployment pipeline artifact bucket\n\nWhen the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {\n  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,\n});\n```\n\n### CloudFront origin bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst originBucket = new S3SecureBucket(stack, 'OriginBucket', {\n  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,\n});\n```\n\nWire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nTo accept logs from other accounts, set **exactly one** of the following on `accessLogDelivery` (the stack account is **not** added automatically):\n\n```typescript\nconst multiAccountLogBucket = new S3SecureBucket(stack, 'MultiAccountAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    allowedSourceAccountIds: ['111111111111', '222222222222'],\n  },\n});\n\nconst organizationLogBucket = new S3SecureBucket(stack, 'OrganizationAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    organizationId: 'o-xxxxxxxxxx',\n  },\n});\n```\n\nOrganization scope uses resource `AWSLogs/*` and `aws:SourceOrgID` on the log-delivery **service** principals. The regional ELBv2 account statement is not organization-conditioned (that principal is not an organization member).\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n### CloudWatch Logs export archive bucket\n\nStore log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {\n  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,\n});\n```\n\nFor cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| `accessLogDelivery` | `AccessLogDeliveryScope` | stack account only | `ACCESS_LOG_BUCKET` only. Exactly one of `allowedSourceAccountIds` or `organizationId`. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` by default; widen with `accessLogDelivery`) |\n| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\nSee [API.md](./API.md) for the full API reference.\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
+    "markdown": "# S3 Secure Bucket (CDK v2)\n\n[![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![license](https://img.shields.io/npm/l/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![Node.js](https://img.shields.io/node/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)\n[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)\n\n[![View on Construct Hub](https://constructs.dev/badge?package=s3-secure-bucket)](https://constructs.dev/packages/s3-secure-bucket)\n\nAWS CDK v2 construct for an Amazon S3 bucket with private access, TLS-only requests, encryption, and versioning. `bucketType` selects encryption and, where needed, a bucket policy for pipeline artifacts, CloudFront origins, access logs, or CloudWatch Logs exports.\n\n## Features\n\n- Private access, block public access, and deny insecure transport (`enforceSSL`)\n- **Default bucket**: KMS-managed encryption (`aws:kms`) unless overridden\n- **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`\n- Versioning on by default; object ownership `BucketOwnerEnforced` by default\n- `RemovalPolicy.RETAIN` on the bucket\n- Optional EventBridge notifications via `eventBridgeEnabled`\n- **`bucketType` presets**\n  - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)\n  - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier\n  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for a CloudFront origin. `S3BucketOrigin.withOriginAccessControl` adds `s3:GetObject` for that distribution. Call `grantCloudFrontRead` only when the distribution cannot update the bucket policy (`cloudfront.amazonaws.com`, conditioned on the distribution ARN)\n  - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`). Writers default to `AWSLogs/<stack account>/*`; override with `accessLogDelivery` (`allowedSourceAccountIds` or `organizationId`)\n  - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)\n- **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)\n\n## How it works\n\nCreating an `S3SecureBucket` applies private access, block public access, TLS-only requests, versioning, and `RemovalPolicy.RETAIN`. `bucketType` selects the encryption default and, for some types, a bucket policy: deploy-role access for a non-default CDK bootstrap qualifier, CloudFront `s3:GetObject` when you call `grantCloudFrontRead`, log delivery for access logs, or CloudWatch Logs export. Load balancers that write access logs should depend on `accessLogBucketPolicyDependable` so the policy exists before AWS validates the log destination.\n\n## Installation\n\n### npm\n\n```bash\nnpm install s3-secure-bucket\n```\n\n### yarn\n\n```bash\nyarn add s3-secure-bucket\n```\n\n### pnpm\n\n```bash\npnpm add s3-secure-bucket\n```\n\n## Usage\n\n### Default secure bucket\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst bucket = new S3SecureBucket(stack, 'S3SecureBucket', {\n  bucketName: 'example-secure-bucket',\n});\n```\n\n### CDK deployment pipeline artifact bucket\n\nWhen the stack uses a **non-default** CDK bootstrap qualifier, the construct grants `s3:*` on the bucket to the regional `cdk-<qualifier>-deploy-role`.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {\n  bucketType: S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET,\n});\n```\n\n### CloudFront origin bucket\n\nThe bucket stays private. CloudFront reads objects through origin access control. The bucket policy allows `s3:GetObject` for `cloudfront.amazonaws.com` only when `AWS:SourceArn` is that distribution. Put the origin access control on the distribution origin. The access control ID is not part of the bucket policy.\n\n`origins.S3BucketOrigin.withOriginAccessControl` adds that statement. Do not also call `grantCloudFrontRead` for that distribution.\n\nCall `grantCloudFrontRead` only when the distribution cannot update this bucket policy, for example when the bucket is referenced from another stack. It adds the same `s3:GetObject` statement.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport * as cloudfront from 'aws-cdk-lib/aws-cloudfront';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\ndeclare const distribution: cloudfront.IDistribution;\n\nconst originBucket = new S3SecureBucket(stack, 'OriginBucket', {\n  bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,\n});\n\noriginBucket.grantCloudFrontRead(distribution);\n```\n\n### Centralized access log bucket (ALB / NLB / CloudFront / S3)\n\nFor `ACCESS_LOG_BUCKET`, the stack **`env.region` must be a concrete region** at synthesis time (not a token) so the regional ELBv2 log-delivery account ID can be resolved when the region is known.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst accessLogBucket = new S3SecureBucket(stack, 'AccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n});\n\n// After creating your load balancer (e.g. elbv2.ApplicationLoadBalancer), depend on the bucket policy\n// so ELB's validation PutObject runs after the policy exists:\n// loadBalancer.node.addDependency(accessLogBucket.accessLogBucketPolicyDependable!);\n```\n\nTo accept logs from other accounts, set **exactly one** of the following on `accessLogDelivery` (the stack account is **not** added automatically):\n\n```typescript\nconst multiAccountLogBucket = new S3SecureBucket(stack, 'MultiAccountAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    allowedSourceAccountIds: ['111111111111', '222222222222'],\n  },\n});\n\nconst organizationLogBucket = new S3SecureBucket(stack, 'OrganizationAccessLogBucket', {\n  bucketType: S3SecureBucketType.ACCESS_LOG_BUCKET,\n  accessLogDelivery: {\n    organizationId: 'o-xxxxxxxxxx',\n  },\n});\n```\n\nOrganization scope uses resource `AWSLogs/*` and `aws:SourceOrgID` on the log-delivery **service** principals. The regional ELBv2 account statement is not organization-conditioned (that principal is not an organization member).\n\nWire logging on the load balancer using your normal approach (for example L1 attributes or another construct). This library only configures the **bucket** and its **resource policy**.\n\n### CloudWatch Logs export archive bucket\n\nStore log data exported from CloudWatch Logs via [export tasks](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3Export.html). The bucket must be in the **same Region** as the log groups you export. Create export tasks with your usual workflow (console, CLI, or API); this library configures the **bucket** and **resource policy** for same-account exports.\n\n```typescript\nimport { Stack } from 'aws-cdk-lib';\nimport { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';\n\ndeclare const stack: Stack;\n\nconst logArchiveBucket = new S3SecureBucket(stack, 'LogArchiveBucket', {\n  bucketType: S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET,\n});\n```\n\nFor cross-account export, extend the bucket policy with additional `aws:SourceAccount` and `aws:SourceArn` entries per [AWS documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/S3ExportTasks.html).\n\n## Options\n\n`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled on the bucket.\n\n### Construct props (`S3SecureBucketProps`)\n\n| Property | Type | Default | Description |\n| --- | --- | --- | --- |\n| `bucketType` | `S3SecureBucketType` | `DEFAULT_BUCKET` | Selects encryption defaults and optional resource-policy statements. |\n| `accessLogDelivery` | `AccessLogDeliveryScope` | stack account only | `ACCESS_LOG_BUCKET` only. Exactly one of `allowedSourceAccountIds` or `organizationId`. |\n| *(inherited)* | `s3.BucketProps` | — | All other `Bucket` properties are passed through (some receive overrides inside the construct). |\n\n### `S3SecureBucketType` values\n\n| Constant | Use case |\n| --- | --- |\n| `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |\n| `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |\n| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket. `grantCloudFrontRead` adds `s3:GetObject` only when the distribution cannot update the bucket policy. `S3BucketOrigin.withOriginAccessControl` adds that statement itself |\n| `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` by default; widen with `accessLogDelivery`) |\n| `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |\n\n### Read-only: `accessLogBucketPolicyDependable`\n\n| Property | Type | When set | Description |\n| --- | --- | --- | --- |\n| `accessLogBucketPolicyDependable` | `IDependable \\| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |\n\n## API\n\nSee [API.md](./API.md).\n\n## Requirements\n\n- Node.js >= 20\n- Peer dependencies: `aws-cdk-lib` ^2.232.0, `constructs` ^10.5.1\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n"
   },
   "repository": {
     "type": "git",
@@ -8480,7 +8480,7 @@
       "fqn": "s3-secure-bucket.AccessLogDeliveryScope",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/bucket-types/access-log-delivery-scope.ts",
+        "filename": "src/core/access-log-delivery-scope.ts",
         "line": 10
       },
       "name": "AccessLogDeliveryScope",
@@ -8495,7 +8495,7 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/bucket-types/access-log-delivery-scope.ts",
+            "filename": "src/core/access-log-delivery-scope.ts",
             "line": 19
           },
           "name": "allowedSourceAccountIds",
@@ -8519,7 +8519,7 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/bucket-types/access-log-delivery-scope.ts",
+            "filename": "src/core/access-log-delivery-scope.ts",
             "line": 29
           },
           "name": "organizationId",
@@ -8529,14 +8529,14 @@
           }
         }
       ],
-      "symbolId": "src/bucket-types/access-log-delivery-scope:AccessLogDeliveryScope"
+      "symbolId": "src/core/access-log-delivery-scope:AccessLogDeliveryScope"
     },
     "s3-secure-bucket.S3SecureBucket": {
       "assembly": "s3-secure-bucket",
       "base": "aws-cdk-lib.aws_s3.Bucket",
       "docs": {
         "custom": {
-          "remarks": "Secure defaults applied regardless of `props`:\n- `removalPolicy`: {@link RemovalPolicy.RETAIN }\n- `publicReadAccess`: `false`\n- `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL }\n- `enforceSSL`: `true`\n- `versioned`: `true` unless explicitly set in `props`\n- `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED } unless overridden\n- `accessControl`: {@link s3.BucketAccessControl.PRIVATE } unless overridden\n\nBucket-type-specific behavior:\n- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable }\n  and {@link S3SecureBucketProps.accessLogDelivery }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`)."
+          "remarks": "Secure defaults applied regardless of `props`:\n- `removalPolicy`: {@link RemovalPolicy.RETAIN }\n- `publicReadAccess`: `false`\n- `blockPublicAccess`: {@link s3.BlockPublicAccess.BLOCK_ALL }\n- `enforceSSL`: `true`\n- `versioned`: `true` unless explicitly set in `props`\n- `objectOwnership`: {@link s3.ObjectOwnership.BUCKET_OWNER_ENFORCED } unless overridden\n- `accessControl`: {@link s3.BucketAccessControl.PRIVATE } unless overridden\n\nBucket-type-specific behavior:\n- {@link S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET }: may attach a deploy-role policy when a non-default bootstrap qualifier is present.\n- {@link S3SecureBucketType.ACCESS_LOG_BUCKET }: adds log-writer principals; see {@link S3SecureBucket#accessLogBucketPolicyDependable }\n  and {@link S3SecureBucketProps.accessLogDelivery }.\n- {@link S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET }: adds CloudWatch Logs export principals (`logs.<region>.amazonaws.com`).\n- {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET }: S3-managed encryption.\n  {@link S3SecureBucket#grantCloudFrontRead } allows `s3:GetObject` when the distribution cannot update this bucket policy.\n  `S3BucketOrigin.withOriginAccessControl` adds that statement itself."
         },
         "remarks": "KMS-managed by default otherwise).",
         "stability": "stable",
@@ -8550,7 +8550,7 @@
         },
         "locationInModule": {
           "filename": "src/s3-secure-bucket.ts",
-          "line": 51
+          "line": 59
         },
         "parameters": [
           {
@@ -8587,8 +8587,36 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/s3-secure-bucket.ts",
-        "line": 31
+        "line": 34
       },
+      "methods": [
+        {
+          "docs": {
+            "custom": {
+              "throws": "Error when `bucketType` is not {@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET }."
+            },
+            "remarks": "Adds `s3:GetObject` for `cloudfront.amazonaws.com` when `AWS:SourceArn` is\n{@link cloudfront.IDistribution.distributionArn}. Call once per distribution.\n\n`S3BucketOrigin.withOriginAccessControl` adds this same statement. Do not call\nthis method for a distribution created with that helper.\n\nCall this method only when the distribution cannot update this bucket policy,\nfor example when the bucket is referenced from another stack.\n\nSupported only when {@link S3SecureBucketProps.bucketType} is\n{@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}.",
+            "stability": "stable",
+            "summary": "Allows one CloudFront distribution to read objects through origin access control."
+          },
+          "locationInModule": {
+            "filename": "src/s3-secure-bucket.ts",
+            "line": 111
+          },
+          "name": "grantCloudFrontRead",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "- Distribution that fetches objects from this bucket."
+              },
+              "name": "distribution",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_cloudfront.IDistribution"
+              }
+            }
+          ]
+        }
+      ],
       "name": "S3SecureBucket",
       "properties": [
         {
@@ -8601,7 +8629,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/s3-secure-bucket.ts",
-            "line": 41
+            "line": 49
           },
           "name": "accessLogBucketPolicyDependable",
           "optional": true,
@@ -8626,7 +8654,7 @@
       ],
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/bucket-types/props.ts",
+        "filename": "src/core/props.ts",
         "line": 11
       },
       "name": "S3SecureBucketProps",
@@ -8641,7 +8669,7 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/bucket-types/props.ts",
+            "filename": "src/core/props.ts",
             "line": 32
           },
           "name": "accessLogDelivery",
@@ -8659,7 +8687,7 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/bucket-types/props.ts",
+            "filename": "src/core/props.ts",
             "line": 18
           },
           "name": "bucketType",
@@ -8669,9 +8697,9 @@
           }
         }
       ],
-      "symbolId": "src/bucket-types/props:S3SecureBucketProps"
+      "symbolId": "src/core/props:S3SecureBucketProps"
     }
   },
-  "version": "0.5.6",
-  "fingerprint": "t8AWbWWwDBXHXUzsTLJSwwr3YN7yT/p9UqzGEelVA7M="
+  "version": "0.6.1",
+  "fingerprint": "VVVMFNoAS/xmECKw64ClEw4fddWPaj+et6XBjSCilak="
 }

package/API.md

@@ -85,6 +85,7 @@ When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an
 | <code><a href="#s3-secure-bucket.S3SecureBucket.addInventory">addInventory</a></code> | Add an inventory configuration. |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.addLifecycleRule">addLifecycleRule</a></code> | Add a lifecycle rule to the bucket. |
 | <code><a href="#s3-secure-bucket.S3SecureBucket.addMetric">addMetric</a></code> | Adds a metrics configuration for the CloudWatch request metrics from the bucket. |
+| <code><a href="#s3-secure-bucket.S3SecureBucket.grantCloudFrontRead">grantCloudFrontRead</a></code> | Allows one CloudFront distribution to read objects through origin access control. |
 
 ---
 
@@ -865,6 +866,34 @@ The metric configuration to add.
 
 ---
 
+##### `grantCloudFrontRead` <a name="grantCloudFrontRead" id="s3-secure-bucket.S3SecureBucket.grantCloudFrontRead"></a>
+
+```typescript
+public grantCloudFrontRead(distribution: IDistribution): void
+```
+
+Allows one CloudFront distribution to read objects through origin access control.
+
+Adds `s3:GetObject` for `cloudfront.amazonaws.com` when `AWS:SourceArn` is
+{@link cloudfront.IDistribution.distributionArn}. Call once per distribution.
+
+`S3BucketOrigin.withOriginAccessControl` adds this same statement. Do not call
+this method for a distribution created with that helper.
+
+Call this method only when the distribution cannot update this bucket policy,
+for example when the bucket is referenced from another stack.
+
+Supported only when {@link S3SecureBucketProps.bucketType} is
+{@link S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET}.
+
+###### `distribution`<sup>Required</sup> <a name="distribution" id="s3-secure-bucket.S3SecureBucket.grantCloudFrontRead.parameter.distribution"></a>
+
+- *Type:* aws-cdk-lib.aws_cloudfront.IDistribution
+
+Distribution that fetches objects from this bucket.
+
+---
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |

package/README.md

@@ -1,12 +1,13 @@
-# S3 Secure Bucket (AWS CDK v2)
+# S3 Secure Bucket (CDK v2)
 
-[![GitHub](https://img.shields.io/github/license/gammarers-aws-cdk-resources/s3-secure-bucket?style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/blob/main/LICENSE)
 [![npm version](https://img.shields.io/npm/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)
-[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?branch=main&label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)
-[![GitHub Workflow Status (branch)](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/release.yml?branch=main&label=release&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/release.yml)
-[![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/gammarers-aws-cdk-resources/s3-secure-bucket?sort=semver&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/releases)
+[![license](https://img.shields.io/npm/l/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)
+[![Node.js](https://img.shields.io/node/v/s3-secure-bucket?style=flat-square)](https://www.npmjs.com/package/s3-secure-bucket)
+[![build](https://img.shields.io/github/actions/workflow/status/gammarers-aws-cdk-resources/s3-secure-bucket/build.yml?label=build&style=flat-square)](https://github.com/gammarers-aws-cdk-resources/s3-secure-bucket/actions/workflows/build.yml)
 
-AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.Bucket.html) with security-focused defaults (private ACLs, block public access, TLS-only access, encryption, versioning, `BucketOwnerEnforced`, `RemovalPolicy.RETAIN`). Use `bucketType` so encryption and bucket policies match pipeline artifacts, CloudFront origins, centralized access logs, and CloudWatch Logs export archives.
+[![View on Construct Hub](https://constructs.dev/badge?package=s3-secure-bucket)](https://constructs.dev/packages/s3-secure-bucket)
+
+AWS CDK v2 construct for an Amazon S3 bucket with private access, TLS-only requests, encryption, and versioning. `bucketType` selects encryption and, where needed, a bucket policy for pipeline artifacts, CloudFront origins, access logs, or CloudWatch Logs exports.
 
 ## Features
 
@@ -15,29 +16,39 @@ AWS CDK v2 construct library: an [`s3.Bucket`](https://docs.aws.amazon.com/cdk/a
 - **Log / origin / archive types**: S3-managed encryption (`AES256`) for `ACCESS_LOG_BUCKET`, `CLOUDFRONT_ORIGIN_BUCKET`, and `CLOUD_WATCH_LOG_ARCHIVE_BUCKET`
 - Versioning on by default; object ownership `BucketOwnerEnforced` by default
 - `RemovalPolicy.RETAIN` on the bucket
-- Optional EventBridge notifications via `eventBridgeEnabled` (applied through an L1 property override when `true`)
+- Optional EventBridge notifications via `eventBridgeEnabled`
 - **`bucketType` presets**
   - **`DEFAULT_BUCKET`**: general-purpose secure bucket (KMS-managed encryption by default)
   - **`DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET`**: optional `s3:*` grant for the CDK deploy role when using a **non-default** bootstrap qualifier
-  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for typical CloudFront origin use
+  - **`CLOUDFRONT_ORIGIN_BUCKET`**: S3-managed encryption for a CloudFront origin. `S3BucketOrigin.withOriginAccessControl` adds `s3:GetObject` for that distribution. Call `grantCloudFrontRead` only when the distribution cannot update the bucket policy (`cloudfront.amazonaws.com`, conditioned on the distribution ARN)
   - **`ACCESS_LOG_BUCKET`**: `s3:PutObject` for ALB/NLB (`logdelivery.elasticloadbalancing.amazonaws.com` + regional **ELBv2 account** from `aws-cdk-lib/region-info` when known), CloudFront standard logging (`delivery.logs.amazonaws.com`), and S3 server access logging (`logging.s3.amazonaws.com`). Writers default to `AWSLogs/<stack account>/*`; override with `accessLogDelivery` (`allowedSourceAccountIds` or `organizationId`)
   - **`CLOUD_WATCH_LOG_ARCHIVE_BUCKET`**: `s3:GetBucketAcl` and `s3:PutObject` (`bucket-owner-full-control`) for CloudWatch Logs export tasks (`logs.<region>.amazonaws.com`, same-account log groups in the stack Region)
 - **`accessLogBucketPolicyDependable`** (access-log buckets only): use with `loadBalancer.node.addDependency(...)` so ALB/NLB access-log enablement runs after the bucket policy exists (avoids validation `PutObject` failures)
 
+## How it works
+
+Creating an `S3SecureBucket` applies private access, block public access, TLS-only requests, versioning, and `RemovalPolicy.RETAIN`. `bucketType` selects the encryption default and, for some types, a bucket policy: deploy-role access for a non-default CDK bootstrap qualifier, CloudFront `s3:GetObject` when you call `grantCloudFrontRead`, log delivery for access logs, or CloudWatch Logs export. Load balancers that write access logs should depend on `accessLogBucketPolicyDependable` so the policy exists before AWS validates the log destination.
+
 ## Installation
 
-**npm**
+### npm
 
-```shell
+```bash
 npm install s3-secure-bucket
 ```
 
-**yarn**
+### yarn
 
-```shell
+```bash
 yarn add s3-secure-bucket
 ```
 
+### pnpm
+
+```bash
+pnpm add s3-secure-bucket
+```
+
 ## Usage
 
 ### Default secure bucket
@@ -70,18 +81,26 @@ const artifactBucket = new S3SecureBucket(stack, 'ArtifactBucket', {
 
 ### CloudFront origin bucket
 
+The bucket stays private. CloudFront reads objects through origin access control. The bucket policy allows `s3:GetObject` for `cloudfront.amazonaws.com` only when `AWS:SourceArn` is that distribution. Put the origin access control on the distribution origin. The access control ID is not part of the bucket policy.
+
+`origins.S3BucketOrigin.withOriginAccessControl` adds that statement. Do not also call `grantCloudFrontRead` for that distribution.
+
+Call `grantCloudFrontRead` only when the distribution cannot update this bucket policy, for example when the bucket is referenced from another stack. It adds the same `s3:GetObject` statement.
+
 ```typescript
 import { Stack } from 'aws-cdk-lib';
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 import { S3SecureBucket, S3SecureBucketType } from 's3-secure-bucket';
 
 declare const stack: Stack;
+declare const distribution: cloudfront.IDistribution;
 
 const originBucket = new S3SecureBucket(stack, 'OriginBucket', {
   bucketType: S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET,
 });
-```
 
-Wire the bucket to CloudFront (for example `origins.S3Origin`) using your usual approach. This library only configures the **bucket** defaults and encryption.
+originBucket.grantCloudFrontRead(distribution);
+```
 
 ### Centralized access log bucket (ALB / NLB / CloudFront / S3)
 
@@ -143,7 +162,7 @@ For cross-account export, extend the bucket policy with additional `aws:SourceAc
 
 ## Options
 
-`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled via an L1 override on the underlying `AWS::S3::Bucket`.
+`S3SecureBucket` accepts `S3SecureBucketProps`, which extends [`s3.BucketProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_s3.BucketProps.html). Standard options such as `bucketName`, `versioned`, `encryption`, `lifecycleRules`, and `eventBridgeEnabled` work as usual alongside the secure defaults. When `eventBridgeEnabled` is `true`, EventBridge notification is enabled on the bucket.
 
 ### Construct props (`S3SecureBucketProps`)
 
@@ -159,7 +178,7 @@ For cross-account export, extend the bucket policy with additional `aws:SourceAc
 | --- | --- |
 | `S3SecureBucketType.DEFAULT_BUCKET` | General-purpose secure bucket |
 | `S3SecureBucketType.DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET` | CDK pipeline artifact bucket (custom bootstrap qualifier) |
-| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket |
+| `S3SecureBucketType.CLOUDFRONT_ORIGIN_BUCKET` | CloudFront origin bucket. `grantCloudFrontRead` adds `s3:GetObject` only when the distribution cannot update the bucket policy. `S3BucketOrigin.withOriginAccessControl` adds that statement itself |
 | `S3SecureBucketType.ACCESS_LOG_BUCKET` | Centralized access logs (`AWSLogs/<account>/*` by default; widen with `accessLogDelivery`) |
 | `S3SecureBucketType.CLOUD_WATCH_LOG_ARCHIVE_BUCKET` | CloudWatch Logs export archive |
 
@@ -169,7 +188,9 @@ For cross-account export, extend the bucket policy with additional `aws:SourceAc
 | --- | --- | --- | --- |
 | `accessLogBucketPolicyDependable` | `IDependable \| undefined` | `bucketType === ACCESS_LOG_BUCKET` | Depend on this from ALB/NLB so access-log configuration waits for the bucket policy resource. |
 
-See [API.md](./API.md) for the full API reference.
+## API
+
+See [API.md](./API.md).
 
 ## Requirements
 

package/lib/core/access-log-delivery-scope.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAwsOrganizationId = exports.isAwsAccountId = exports.isExclusiveAccessLogDeliveryScope = exports.hasOrganizationId = exports.hasAllowedSourceAccountIds = void 0;
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.allowedSourceAccountIds}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the account-list field is present.
+ */
+const hasAllowedSourceAccountIds = (scope) => {
+    return scope.allowedSourceAccountIds !== undefined;
+};
+exports.hasAllowedSourceAccountIds = hasAllowedSourceAccountIds;
+/**
+ * Returns whether `scope` sets {@link AccessLogDeliveryScope.organizationId}.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when the organization field is present.
+ */
+const hasOrganizationId = (scope) => {
+    return scope.organizationId !== undefined;
+};
+exports.hasOrganizationId = hasOrganizationId;
+/**
+ * Returns whether `scope` sets exactly one of the mutually exclusive delivery fields.
+ *
+ * @param scope - Caller-supplied delivery scope.
+ * @returns `true` when exactly one of the two fields is present.
+ */
+const isExclusiveAccessLogDeliveryScope = (scope) => {
+    return (0, exports.hasAllowedSourceAccountIds)(scope) !== (0, exports.hasOrganizationId)(scope);
+};
+exports.isExclusiveAccessLogDeliveryScope = isExclusiveAccessLogDeliveryScope;
+/**
+ * Returns whether `value` is a 12-digit AWS account ID.
+ *
+ * @param value - Candidate account ID.
+ * @returns `true` when `value` matches `^[0-9]{12}$`.
+ */
+const isAwsAccountId = (value) => {
+    return /^\d{12}$/.test(value);
+};
+exports.isAwsAccountId = isAwsAccountId;
+/**
+ * Returns whether `value` is an AWS Organizations ID.
+ *
+ * @param value - Candidate organization ID.
+ * @returns `true` when `value` matches `^o-[a-z0-9]{10,32}$`.
+ */
+const isAwsOrganizationId = (value) => {
+    return /^o-[a-z0-9]{10,32}$/.test(value);
+};
+exports.isAwsOrganizationId = isAwsOrganizationId;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLWxvZy1kZWxpdmVyeS1zY29wZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb3JlL2FjY2Vzcy1sb2ctZGVsaXZlcnktc2NvcGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBK0JBOzs7OztHQUtHO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEtBQTZCLEVBQVcsRUFBRTtJQUNuRixPQUFPLEtBQUssQ0FBQyx1QkFBdUIsS0FBSyxTQUFTLENBQUM7QUFDckQsQ0FBQyxDQUFDO0FBRlcsUUFBQSwwQkFBMEIsOEJBRXJDO0FBRUY7Ozs7O0dBS0c7QUFDSSxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBNkIsRUFBVyxFQUFFO0lBQzFFLE9BQU8sS0FBSyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBRlcsUUFBQSxpQkFBaUIscUJBRTVCO0FBRUY7Ozs7O0dBS0c7QUFDSSxNQUFNLGlDQUFpQyxHQUFHLENBQUMsS0FBNkIsRUFBVyxFQUFFO0lBQzFGLE9BQU8sSUFBQSxrQ0FBMEIsRUFBQyxLQUFLLENBQUMsS0FBSyxJQUFBLHlCQUFpQixFQUFDLEtBQUssQ0FBQyxDQUFDO0FBQ3hFLENBQUMsQ0FBQztBQUZXLFFBQUEsaUNBQWlDLHFDQUU1QztBQUVGOzs7OztHQUtHO0FBQ0ksTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUFhLEVBQVcsRUFBRTtJQUN2RCxPQUFPLFVBQVUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDaEMsQ0FBQyxDQUFDO0FBRlcsUUFBQSxjQUFjLGtCQUV6QjtBQUVGOzs7OztHQUtHO0FBQ0ksTUFBTSxtQkFBbUIsR0FBRyxDQUFDLEtBQWEsRUFBVyxFQUFFO0lBQzVELE9BQU8scUJBQXFCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBQzNDLENBQUMsQ0FBQztBQUZXLFFBQUEsbUJBQW1CLHVCQUU5QiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQWNjb3VudCBzY29wZSBmb3Ige0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0gcmVzb3VyY2UgcG9saWNpZXMuXG4gKlxuICogU3BlY2lmeSAqKmV4YWN0bHkgb25lKiogb2Yge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUuYWxsb3dlZFNvdXJjZUFjY291bnRJZHN9IG9yXG4gKiB7QGxpbmsgQWNjZXNzTG9nRGVsaXZlcnlTY29wZS5vcmdhbml6YXRpb25JZH0uIE9taXQge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYWNjZXNzTG9nRGVsaXZlcnl9XG4gKiB0byBhbGxvdyBvbmx5IHRoZSBzdGFjayBhY2NvdW50IChkZWZhdWx0KS5cbiAqXG4gKiBqc2lpIGRvZXMgbm90IHN1cHBvcnQgYSBkaXNjcmltaW5hdGVkIHVuaW9uIG9mIHN0cnVjdHMsIHNvIGV4Y2x1c2l2aXR5IGlzIGVuZm9yY2VkIGF0IGNvbnN0cnVjdCB0aW1lLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUge1xuICAvKipcbiAgICogQWNjb3VudCBJRHMgYWxsb3dlZCB0byB3cml0ZSB1bmRlciBgQVdTTG9ncy88YWNjb3VudElkPi8qYC5cbiAgICpcbiAgICogVGhlIGxpc3QgaXMgdXNlZCBhcyBzcGVjaWZpZWQ7IGluY2x1ZGUgdGhlIHN0YWNrIGFjY291bnQgaWYgdGhhdCBhY2NvdW50IHNob3VsZCBhbHNvIGRlbGl2ZXIgbG9ncy5cbiAgICogRHVwbGljYXRlIElEcyBhcmUgaWdub3JlZC4gTXV0dWFsbHkgZXhjbHVzaXZlIHdpdGgge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUub3JnYW5pemF0aW9uSWR9LlxuICAgKlxuICAgKiBAZGVmYXVsdCB1bmRlZmluZWQgKGRvIG5vdCB1c2UgYW4gZXhwbGljaXQgYWNjb3VudCBsaXN0KVxuICAgKi9cbiAgcmVhZG9ubHkgYWxsb3dlZFNvdXJjZUFjY291bnRJZHM/OiBzdHJpbmdbXTtcblxuICAvKipcbiAgICogQVdTIE9yZ2FuaXphdGlvbnMgSUQgKGBvLWAgZm9sbG93ZWQgYnkgMTDigJMzMiBsb3dlcmNhc2UgbGV0dGVycyBvciBkaWdpdHMpLlxuICAgKlxuICAgKiBBbGxvd3MgbG9nIGRlbGl2ZXJ5IGZyb20gYWNjb3VudHMgaW4gdGhlIG9yZ2FuaXphdGlvbiB2aWEgYGF3czpTb3VyY2VPcmdJRGAsXG4gICAqIHdpdGggcmVzb3VyY2UgYEFXU0xvZ3MvKmAuIE11dHVhbGx5IGV4Y2x1c2l2ZSB3aXRoIHtAbGluayBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLmFsbG93ZWRTb3VyY2VBY2NvdW50SWRzfS5cbiAgICpcbiAgICogQGRlZmF1bHQgdW5kZWZpbmVkIChkbyBub3QgdXNlIGFuIG9yZ2FuaXphdGlvbi13aWRlIHBvbGljeSlcbiAgICovXG4gIHJlYWRvbmx5IG9yZ2FuaXphdGlvbklkPzogc3RyaW5nO1xufVxuXG4vKipcbiAqIFJldHVybnMgd2hldGhlciBgc2NvcGVgIHNldHMge0BsaW5rIEFjY2Vzc0xvZ0RlbGl2ZXJ5U2NvcGUuYWxsb3dlZFNvdXJjZUFjY291bnRJZHN9LlxuICpcbiAqIEBwYXJhbSBzY29wZSAtIENhbGxlci1zdXBwbGllZCBkZWxpdmVyeSBzY29wZS5cbiAqIEByZXR1cm5zIGB0cnVlYCB3aGVuIHRoZSBhY2NvdW50LWxpc3QgZmllbGQgaXMgcHJlc2VudC5cbiAqL1xuZXhwb3J0IGNvbnN0IGhhc0FsbG93ZWRTb3VyY2VBY2NvdW50SWRzID0gKHNjb3BlOiBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlKTogYm9vbGVhbiA9PiB7XG4gIHJldHVybiBzY29wZS5hbGxvd2VkU291cmNlQWNjb3VudElkcyAhPT0gdW5kZWZpbmVkO1xufTtcblxuLyoqXG4gKiBSZXR1cm5zIHdoZXRoZXIgYHNjb3BlYCBzZXRzIHtAbGluayBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlLm9yZ2FuaXphdGlvbklkfS5cbiAqXG4gKiBAcGFyYW0gc2NvcGUgLSBDYWxsZXItc3VwcGxpZWQgZGVsaXZlcnkgc2NvcGUuXG4gKiBAcmV0dXJucyBgdHJ1ZWAgd2hlbiB0aGUgb3JnYW5pemF0aW9uIGZpZWxkIGlzIHByZXNlbnQuXG4gKi9cbmV4cG9ydCBjb25zdCBoYXNPcmdhbml6YXRpb25JZCA9IChzY29wZTogQWNjZXNzTG9nRGVsaXZlcnlTY29wZSk6IGJvb2xlYW4gPT4ge1xuICByZXR1cm4gc2NvcGUub3JnYW5pemF0aW9uSWQgIT09IHVuZGVmaW5lZDtcbn07XG5cbi8qKlxuICogUmV0dXJucyB3aGV0aGVyIGBzY29wZWAgc2V0cyBleGFjdGx5IG9uZSBvZiB0aGUgbXV0dWFsbHkgZXhjbHVzaXZlIGRlbGl2ZXJ5IGZpZWxkcy5cbiAqXG4gKiBAcGFyYW0gc2NvcGUgLSBDYWxsZXItc3VwcGxpZWQgZGVsaXZlcnkgc2NvcGUuXG4gKiBAcmV0dXJucyBgdHJ1ZWAgd2hlbiBleGFjdGx5IG9uZSBvZiB0aGUgdHdvIGZpZWxkcyBpcyBwcmVzZW50LlxuICovXG5leHBvcnQgY29uc3QgaXNFeGNsdXNpdmVBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlID0gKHNjb3BlOiBBY2Nlc3NMb2dEZWxpdmVyeVNjb3BlKTogYm9vbGVhbiA9PiB7XG4gIHJldHVybiBoYXNBbGxvd2VkU291cmNlQWNjb3VudElkcyhzY29wZSkgIT09IGhhc09yZ2FuaXphdGlvbklkKHNjb3BlKTtcbn07XG5cbi8qKlxuICogUmV0dXJucyB3aGV0aGVyIGB2YWx1ZWAgaXMgYSAxMi1kaWdpdCBBV1MgYWNjb3VudCBJRC5cbiAqXG4gKiBAcGFyYW0gdmFsdWUgLSBDYW5kaWRhdGUgYWNjb3VudCBJRC5cbiAqIEByZXR1cm5zIGB0cnVlYCB3aGVuIGB2YWx1ZWAgbWF0Y2hlcyBgXlswLTldezEyfSRgLlxuICovXG5leHBvcnQgY29uc3QgaXNBd3NBY2NvdW50SWQgPSAodmFsdWU6IHN0cmluZyk6IGJvb2xlYW4gPT4ge1xuICByZXR1cm4gL15cXGR7MTJ9JC8udGVzdCh2YWx1ZSk7XG59O1xuXG4vKipcbiAqIFJldHVybnMgd2hldGhlciBgdmFsdWVgIGlzIGFuIEFXUyBPcmdhbml6YXRpb25zIElELlxuICpcbiAqIEBwYXJhbSB2YWx1ZSAtIENhbmRpZGF0ZSBvcmdhbml6YXRpb24gSUQuXG4gKiBAcmV0dXJucyBgdHJ1ZWAgd2hlbiBgdmFsdWVgIG1hdGNoZXMgYF5vLVthLXowLTldezEwLDMyfSRgLlxuICovXG5leHBvcnQgY29uc3QgaXNBd3NPcmdhbml6YXRpb25JZCA9ICh2YWx1ZTogc3RyaW5nKTogYm9vbGVhbiA9PiB7XG4gIHJldHVybiAvXm8tW2EtejAtOV17MTAsMzJ9JC8udGVzdCh2YWx1ZSk7XG59O1xuIl19

package/lib/{bucket-types → core}/bucket-type.d.ts

@@ -17,6 +17,9 @@ export declare const S3SecureBucketType: {
      * Origin bucket for CloudFront distributions.
      *
      * Uses S3-managed encryption ({@link s3.BucketEncryption.S3_MANAGED}) by default.
+     * `S3SecureBucket.grantCloudFrontRead` allows `s3:GetObject` from one distribution
+     * through origin access control when that distribution cannot update this bucket policy.
+     * `S3BucketOrigin.withOriginAccessControl` adds the same statement itself.
      */
     readonly CLOUDFRONT_ORIGIN_BUCKET: "CloudFrontOriginBucket";
     /**

package/lib/core/bucket-type.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.S3SecureBucketType = void 0;
+/**
+ * Bucket type discriminator values for {@link S3SecureBucketProps.bucketType}.
+ *
+ * Each value selects encryption defaults and, for some types, additional bucket resource policies.
+ *
+ * @see {@link S3SecureBucketProps.bucketType}
+ */
+exports.S3SecureBucketType = {
+    /**
+     * Pipeline artifact bucket when using a custom CDK bootstrap qualifier
+     * (single- or multi-region deployments).
+     *
+     * Adds an `s3:*` grant for `cdk-<qualifier>-deploy-role` when the bootstrap qualifier is not default.
+     */
+    DEPLOYMENT_PIPELINE_ARTIFACT_BUCKET: 'DeploymentPipelineArtifactBucket',
+    /**
+     * Origin bucket for CloudFront distributions.
+     *
+     * Uses S3-managed encryption ({@link s3.BucketEncryption.S3_MANAGED}) by default.
+     * `S3SecureBucket.grantCloudFrontRead` allows `s3:GetObject` from one distribution
+     * through origin access control when that distribution cannot update this bucket policy.
+     * `S3BucketOrigin.withOriginAccessControl` adds the same statement itself.
+     */
+    CLOUDFRONT_ORIGIN_BUCKET: 'CloudFrontOriginBucket',
+    /**
+     * General-purpose secure bucket (default qualifier / standard use).
+     *
+     * Uses KMS-managed encryption unless overridden in props. No type-specific resource policies.
+     */
+    DEFAULT_BUCKET: 'DefaultBucket',
+    /**
+     * Centralized access logs for producers such as ALB/NLB, CloudFront standard logging (v2),
+     * and S3 server access logging. Grants `s3:PutObject` on `AWSLogs/...` prefixes only (no read/list).
+     *
+     * By default the prefix is `AWSLogs/<stack account>/*`. Override with
+     * {@link S3SecureBucketProps.accessLogDelivery} to allow an explicit account list or an AWS Organization.
+     *
+     * The regional ELBv2 log-delivery account ID (legacy path alongside the log delivery service principal)
+     * is resolved from `aws-cdk-lib/region-info` at synthesis time when {@link Stack#region} is known,
+     * or via a deploy-time mapping when it is a token.
+     */
+    ACCESS_LOG_BUCKET: 'AccessLogBucket',
+    /**
+     * Archive bucket for log data exported from CloudWatch Logs via export tasks.
+     *
+     * Grants `logs.<region>.amazonaws.com` `s3:GetBucketAcl` and `s3:PutObject` for log groups in the
+     * stack account and region (see AWS docs for cross-account export).
+     */
+    CLOUD_WATCH_LOG_ARCHIVE_BUCKET: 'CloudWatchLogArchiveBucket',
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYnVja2V0LXR5cGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29yZS9idWNrZXQtdHlwZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQTs7Ozs7O0dBTUc7QUFDVSxRQUFBLGtCQUFrQixHQUFHO0lBQ2hDOzs7OztPQUtHO0lBQ0gsbUNBQW1DLEVBQUUsa0NBQWtDO0lBQ3ZFOzs7Ozs7O09BT0c7SUFDSCx3QkFBd0IsRUFBRSx3QkFBd0I7SUFDbEQ7Ozs7T0FJRztJQUNILGNBQWMsRUFBRSxlQUFlO0lBQy9COzs7Ozs7Ozs7O09BVUc7SUFDSCxpQkFBaUIsRUFBRSxpQkFBaUI7SUFDcEM7Ozs7O09BS0c7SUFDSCw4QkFBOEIsRUFBRSw0QkFBNEI7Q0FDcEQsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQnVja2V0IHR5cGUgZGlzY3JpbWluYXRvciB2YWx1ZXMgZm9yIHtAbGluayBTM1NlY3VyZUJ1Y2tldFByb3BzLmJ1Y2tldFR5cGV9LlxuICpcbiAqIEVhY2ggdmFsdWUgc2VsZWN0cyBlbmNyeXB0aW9uIGRlZmF1bHRzIGFuZCwgZm9yIHNvbWUgdHlwZXMsIGFkZGl0aW9uYWwgYnVja2V0IHJlc291cmNlIHBvbGljaWVzLlxuICpcbiAqIEBzZWUge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYnVja2V0VHlwZX1cbiAqL1xuZXhwb3J0IGNvbnN0IFMzU2VjdXJlQnVja2V0VHlwZSA9IHtcbiAgLyoqXG4gICAqIFBpcGVsaW5lIGFydGlmYWN0IGJ1Y2tldCB3aGVuIHVzaW5nIGEgY3VzdG9tIENESyBib290c3RyYXAgcXVhbGlmaWVyXG4gICAqIChzaW5nbGUtIG9yIG11bHRpLXJlZ2lvbiBkZXBsb3ltZW50cykuXG4gICAqXG4gICAqIEFkZHMgYW4gYHMzOipgIGdyYW50IGZvciBgY2RrLTxxdWFsaWZpZXI+LWRlcGxveS1yb2xlYCB3aGVuIHRoZSBib290c3RyYXAgcXVhbGlmaWVyIGlzIG5vdCBkZWZhdWx0LlxuICAgKi9cbiAgREVQTE9ZTUVOVF9QSVBFTElORV9BUlRJRkFDVF9CVUNLRVQ6ICdEZXBsb3ltZW50UGlwZWxpbmVBcnRpZmFjdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBPcmlnaW4gYnVja2V0IGZvciBDbG91ZEZyb250IGRpc3RyaWJ1dGlvbnMuXG4gICAqXG4gICAqIFVzZXMgUzMtbWFuYWdlZCBlbmNyeXB0aW9uICh7QGxpbmsgczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VEfSkgYnkgZGVmYXVsdC5cbiAgICogYFMzU2VjdXJlQnVja2V0LmdyYW50Q2xvdWRGcm9udFJlYWRgIGFsbG93cyBgczM6R2V0T2JqZWN0YCBmcm9tIG9uZSBkaXN0cmlidXRpb25cbiAgICogdGhyb3VnaCBvcmlnaW4gYWNjZXNzIGNvbnRyb2wgd2hlbiB0aGF0IGRpc3RyaWJ1dGlvbiBjYW5ub3QgdXBkYXRlIHRoaXMgYnVja2V0IHBvbGljeS5cbiAgICogYFMzQnVja2V0T3JpZ2luLndpdGhPcmlnaW5BY2Nlc3NDb250cm9sYCBhZGRzIHRoZSBzYW1lIHN0YXRlbWVudCBpdHNlbGYuXG4gICAqL1xuICBDTE9VREZST05UX09SSUdJTl9CVUNLRVQ6ICdDbG91ZEZyb250T3JpZ2luQnVja2V0JyxcbiAgLyoqXG4gICAqIEdlbmVyYWwtcHVycG9zZSBzZWN1cmUgYnVja2V0IChkZWZhdWx0IHF1YWxpZmllciAvIHN0YW5kYXJkIHVzZSkuXG4gICAqXG4gICAqIFVzZXMgS01TLW1hbmFnZWQgZW5jcnlwdGlvbiB1bmxlc3Mgb3ZlcnJpZGRlbiBpbiBwcm9wcy4gTm8gdHlwZS1zcGVjaWZpYyByZXNvdXJjZSBwb2xpY2llcy5cbiAgICovXG4gIERFRkFVTFRfQlVDS0VUOiAnRGVmYXVsdEJ1Y2tldCcsXG4gIC8qKlxuICAgKiBDZW50cmFsaXplZCBhY2Nlc3MgbG9ncyBmb3IgcHJvZHVjZXJzIHN1Y2ggYXMgQUxCL05MQiwgQ2xvdWRGcm9udCBzdGFuZGFyZCBsb2dnaW5nICh2MiksXG4gICAqIGFuZCBTMyBzZXJ2ZXIgYWNjZXNzIGxvZ2dpbmcuIEdyYW50cyBgczM6UHV0T2JqZWN0YCBvbiBgQVdTTG9ncy8uLi5gIHByZWZpeGVzIG9ubHkgKG5vIHJlYWQvbGlzdCkuXG4gICAqXG4gICAqIEJ5IGRlZmF1bHQgdGhlIHByZWZpeCBpcyBgQVdTTG9ncy88c3RhY2sgYWNjb3VudD4vKmAuIE92ZXJyaWRlIHdpdGhcbiAgICoge0BsaW5rIFMzU2VjdXJlQnVja2V0UHJvcHMuYWNjZXNzTG9nRGVsaXZlcnl9IHRvIGFsbG93IGFuIGV4cGxpY2l0IGFjY291bnQgbGlzdCBvciBhbiBBV1MgT3JnYW5pemF0aW9uLlxuICAgKlxuICAgKiBUaGUgcmVnaW9uYWwgRUxCdjIgbG9nLWRlbGl2ZXJ5IGFjY291bnQgSUQgKGxlZ2FjeSBwYXRoIGFsb25nc2lkZSB0aGUgbG9nIGRlbGl2ZXJ5IHNlcnZpY2UgcHJpbmNpcGFsKVxuICAgKiBpcyByZXNvbHZlZCBmcm9tIGBhd3MtY2RrLWxpYi9yZWdpb24taW5mb2AgYXQgc3ludGhlc2lzIHRpbWUgd2hlbiB7QGxpbmsgU3RhY2sjcmVnaW9ufSBpcyBrbm93bixcbiAgICogb3IgdmlhIGEgZGVwbG95LXRpbWUgbWFwcGluZyB3aGVuIGl0IGlzIGEgdG9rZW4uXG4gICAqL1xuICBBQ0NFU1NfTE9HX0JVQ0tFVDogJ0FjY2Vzc0xvZ0J1Y2tldCcsXG4gIC8qKlxuICAgKiBBcmNoaXZlIGJ1Y2tldCBmb3IgbG9nIGRhdGEgZXhwb3J0ZWQgZnJvbSBDbG91ZFdhdGNoIExvZ3MgdmlhIGV4cG9ydCB0YXNrcy5cbiAgICpcbiAgICogR3JhbnRzIGBsb2dzLjxyZWdpb24+LmFtYXpvbmF3cy5jb21gIGBzMzpHZXRCdWNrZXRBY2xgIGFuZCBgczM6UHV0T2JqZWN0YCBmb3IgbG9nIGdyb3VwcyBpbiB0aGVcbiAgICogc3RhY2sgYWNjb3VudCBhbmQgcmVnaW9uIChzZWUgQVdTIGRvY3MgZm9yIGNyb3NzLWFjY291bnQgZXhwb3J0KS5cbiAgICovXG4gIENMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVDogJ0Nsb3VkV2F0Y2hMb2dBcmNoaXZlQnVja2V0Jyxcbn0gYXMgY29uc3Q7XG5cbi8qKlxuICogRGlzY3JpbWluYXRlZCB1bmlvbiBvZiB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlfSBzdHJpbmcgbGl0ZXJhbHMuXG4gKi9cbmV4cG9ydCB0eXBlIFMzU2VjdXJlQnVja2V0VHlwZSA9IHR5cGVvZiBTM1NlY3VyZUJ1Y2tldFR5cGVba2V5b2YgdHlwZW9mIFMzU2VjdXJlQnVja2V0VHlwZV07XG4iXX0=

package/lib/{bucket-types → core}/encryption-default.js

@@ -56,4 +56,4 @@ const resolveEncryptionDefault = (bucketType, propsEncryption) => {
     return propsEncryption ?? s3.BucketEncryption.KMS_MANAGED;
 };
 exports.resolveEncryptionDefault = resolveEncryptionDefault;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi1kZWZhdWx0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2J1Y2tldC10eXBlcy9lbmNyeXB0aW9uLWRlZmF1bHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBQUEsdURBQXlDO0FBQ3pDLCtDQUFtRDtBQUVuRDs7Ozs7Ozs7OztHQVVHO0FBQ0ksTUFBTSx3QkFBd0IsR0FBRyxDQUN0QyxVQUE4QixFQUM5QixlQUFxQyxFQUNoQixFQUFFO0lBQ3ZCLElBQ0UsVUFBVSxLQUFLLGdDQUFrQixDQUFDLHdCQUF3QjtXQUN2RCxVQUFVLEtBQUssZ0NBQWtCLENBQUMsaUJBQWlCO1dBQ25ELFVBQVUsS0FBSyxnQ0FBa0IsQ0FBQyw4QkFBOEIsRUFDbkUsQ0FBQztRQUNELE9BQU8sRUFBRSxDQUFDLGdCQUFnQixDQUFDLFVBQVUsQ0FBQztJQUN4QyxDQUFDO0lBQ0QsT0FBTyxlQUFlLElBQUksRUFBRSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQztBQUM1RCxDQUFDLENBQUM7QUFaVyxRQUFBLHdCQUF3Qiw0QkFZbkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBzMyBmcm9tICdhd3MtY2RrLWxpYi9hd3MtczMnO1xuaW1wb3J0IHsgUzNTZWN1cmVCdWNrZXRUeXBlIH0gZnJvbSAnLi9idWNrZXQtdHlwZSc7XG5cbi8qKlxuICogUmVzb2x2ZXMgYnVja2V0IGVuY3J5cHRpb24gZm9yIGEgZ2l2ZW4ge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZX0uXG4gKlxuICoge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVR9LCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUfSxcbiAqIGFuZCB7QGxpbmsgUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVH0gYWx3YXlzIHVzZSBTMy1tYW5hZ2VkIGVuY3J5cHRpb24uXG4gKiBBbGwgb3RoZXIgdHlwZXMgdXNlIGBwcm9wc0VuY3J5cHRpb25gIHdoZW4gcHJvdmlkZWQsIG90aGVyd2lzZSBLTVMtbWFuYWdlZCBlbmNyeXB0aW9uLlxuICpcbiAqIEBwYXJhbSBidWNrZXRUeXBlIC0gUHJlc2V0IHRoYXQgZGV0ZXJtaW5lcyB0aGUgZGVmYXVsdCBlbmNyeXB0aW9uIG1vZGUuXG4gKiBAcGFyYW0gcHJvcHNFbmNyeXB0aW9uIC0gT3B0aW9uYWwgY2FsbGVyIG92ZXJyaWRlIGZyb20ge0BsaW5rIHMzLkJ1Y2tldFByb3BzLmVuY3J5cHRpb259LlxuICogQHJldHVybnMgVGhlIGVuY3J5cHRpb24gbW9kZSB0byBwYXNzIHRvIHtAbGluayBzMy5CdWNrZXR9LlxuICovXG5leHBvcnQgY29uc3QgcmVzb2x2ZUVuY3J5cHRpb25EZWZhdWx0ID0gKFxuICBidWNrZXRUeXBlOiBTM1NlY3VyZUJ1Y2tldFR5cGUsXG4gIHByb3BzRW5jcnlwdGlvbj86IHMzLkJ1Y2tldEVuY3J5cHRpb24sXG4pOiBzMy5CdWNrZXRFbmNyeXB0aW9uID0+IHtcbiAgaWYgKFxuICAgIGJ1Y2tldFR5cGUgPT09IFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VREZST05UX09SSUdJTl9CVUNLRVRcbiAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQUNDRVNTX0xPR19CVUNLRVRcbiAgICB8fCBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURfV0FUQ0hfTE9HX0FSQ0hJVkVfQlVDS0VUXG4gICkge1xuICAgIHJldHVybiBzMy5CdWNrZXRFbmNyeXB0aW9uLlMzX01BTkFHRUQ7XG4gIH1cbiAgcmV0dXJuIHByb3BzRW5jcnlwdGlvbiA/PyBzMy5CdWNrZXRFbmNyeXB0aW9uLktNU19NQU5BR0VEO1xufTtcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdGlvbi1kZWZhdWx0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvcmUvZW5jcnlwdGlvbi1kZWZhdWx0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHVEQUF5QztBQUN6QywrQ0FBbUQ7QUFFbkQ7Ozs7Ozs7Ozs7R0FVRztBQUNJLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsVUFBOEIsRUFDOUIsZUFBcUMsRUFDaEIsRUFBRTtJQUN2QixJQUNFLFVBQVUsS0FBSyxnQ0FBa0IsQ0FBQyx3QkFBd0I7V0FDdkQsVUFBVSxLQUFLLGdDQUFrQixDQUFDLGlCQUFpQjtXQUNuRCxVQUFVLEtBQUssZ0NBQWtCLENBQUMsOEJBQThCLEVBQ25FLENBQUM7UUFDRCxPQUFPLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUM7SUFDeEMsQ0FBQztJQUNELE9BQU8sZUFBZSxJQUFJLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUM7QUFDNUQsQ0FBQyxDQUFDO0FBWlcsUUFBQSx3QkFBd0IsNEJBWW5DIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0ICogYXMgczMgZnJvbSAnYXdzLWNkay1saWIvYXdzLXMzJztcbmltcG9ydCB7IFMzU2VjdXJlQnVja2V0VHlwZSB9IGZyb20gJy4vYnVja2V0LXR5cGUnO1xuXG4vKipcbiAqIFJlc29sdmVzIGJ1Y2tldCBlbmNyeXB0aW9uIGZvciBhIGdpdmVuIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGV9LlxuICpcbiAqIHtAbGluayBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUfSwge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5BQ0NFU1NfTE9HX0JVQ0tFVH0sXG4gKiBhbmQge0BsaW5rIFMzU2VjdXJlQnVja2V0VHlwZS5DTE9VRF9XQVRDSF9MT0dfQVJDSElWRV9CVUNLRVR9IGFsd2F5cyB1c2UgUzMtbWFuYWdlZCBlbmNyeXB0aW9uLlxuICogQWxsIG90aGVyIHR5cGVzIHVzZSBgcHJvcHNFbmNyeXB0aW9uYCB3aGVuIHByb3ZpZGVkLCBvdGhlcndpc2UgS01TLW1hbmFnZWQgZW5jcnlwdGlvbi5cbiAqXG4gKiBAcGFyYW0gYnVja2V0VHlwZSAtIFByZXNldCB0aGF0IGRldGVybWluZXMgdGhlIGRlZmF1bHQgZW5jcnlwdGlvbiBtb2RlLlxuICogQHBhcmFtIHByb3BzRW5jcnlwdGlvbiAtIE9wdGlvbmFsIGNhbGxlciBvdmVycmlkZSBmcm9tIHtAbGluayBzMy5CdWNrZXRQcm9wcy5lbmNyeXB0aW9ufS5cbiAqIEByZXR1cm5zIFRoZSBlbmNyeXB0aW9uIG1vZGUgdG8gcGFzcyB0byB7QGxpbmsgczMuQnVja2V0fS5cbiAqL1xuZXhwb3J0IGNvbnN0IHJlc29sdmVFbmNyeXB0aW9uRGVmYXVsdCA9IChcbiAgYnVja2V0VHlwZTogUzNTZWN1cmVCdWNrZXRUeXBlLFxuICBwcm9wc0VuY3J5cHRpb24/OiBzMy5CdWNrZXRFbmNyeXB0aW9uLFxuKTogczMuQnVja2V0RW5jcnlwdGlvbiA9PiB7XG4gIGlmIChcbiAgICBidWNrZXRUeXBlID09PSBTM1NlY3VyZUJ1Y2tldFR5cGUuQ0xPVURGUk9OVF9PUklHSU5fQlVDS0VUXG4gICAgfHwgYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkFDQ0VTU19MT0dfQlVDS0VUXG4gICAgfHwgYnVja2V0VHlwZSA9PT0gUzNTZWN1cmVCdWNrZXRUeXBlLkNMT1VEX1dBVENIX0xPR19BUkNISVZFX0JVQ0tFVFxuICApIHtcbiAgICByZXR1cm4gczMuQnVja2V0RW5jcnlwdGlvbi5TM19NQU5BR0VEO1xuICB9XG4gIHJldHVybiBwcm9wc0VuY3J5cHRpb24gPz8gczMuQnVja2V0RW5jcnlwdGlvbi5LTVNfTUFOQUdFRDtcbn07XG4iXX0=