agent-claw: automated task changes

cdk/node_modules/aws-cdk-lib/aws-s3/lib/notifications-resource/index.d.ts

@@ -0,0 +1 @@
+export * from './notifications-resource';

cdk/node_modules/aws-cdk-lib/aws-s3/lib/notifications-resource/index.js

@@ -0,0 +1 @@
+"use strict";var __createBinding=exports&&exports.__createBinding||(Object.create?(function(o,m,k,k2){k2===void 0&&(k2=k);var desc=Object.getOwnPropertyDescriptor(m,k);(!desc||("get"in desc?!m.__esModule:desc.writable||desc.configurable))&&(desc={enumerable:!0,get:function(){return m[k]}}),Object.defineProperty(o,k2,desc)}):(function(o,m,k,k2){k2===void 0&&(k2=k),o[k2]=m[k]})),__exportStar=exports&&exports.__exportStar||function(m,exports2){for(var p in m)p!=="default"&&!Object.prototype.hasOwnProperty.call(exports2,p)&&__createBinding(exports2,m,p)};Object.defineProperty(exports,"__esModule",{value:!0});var _noFold;exports.BucketNotifications=void 0,Object.defineProperty(exports,_noFold="BucketNotifications",{enumerable:!0,configurable:!0,get:()=>{var value=require("./notifications-resource").BucketNotifications;return Object.defineProperty(exports,_noFold="BucketNotifications",{enumerable:!0,configurable:!0,value}),value}});

cdk/node_modules/aws-cdk-lib/aws-s3/lib/notifications-resource/notifications-resource-handler.d.ts

@@ -0,0 +1,42 @@
+import { Construct } from 'constructs';
+import * as iam from '../../../aws-iam';
+export declare class NotificationsResourceHandlerProps {
+    role?: iam.IRole;
+}
+/**
+ * A Lambda-based custom resource handler that provisions S3 bucket
+ * notifications for a bucket.
+ *
+ * The resource property schema is:
+ *
+ * {
+ *   BucketName: string, NotificationConfiguration: { see
+ *   PutBucketNotificationConfiguration }
+ * }
+ *
+ * For 'Delete' operations, we send an empty NotificationConfiguration as
+ * required. We propagate errors and results as-is.
+ *
+ * Sadly, we can't use aws-cdk-lib/aws-lambda as it will introduce a dependency
+ * cycle, so this uses raw `cdk.Resource`s.
+ */
+export declare class NotificationsResourceHandler extends Construct {
+    /**
+     * Defines a stack-singleton lambda function with the logic for a CloudFormation custom
+     * resource that provisions bucket notification configuration for a bucket.
+     *
+     * @returns The ARN of the custom resource lambda function.
+     */
+    static singleton(context: Construct, props?: NotificationsResourceHandlerProps): NotificationsResourceHandler;
+    /**
+     * The ARN of the handler's lambda function. Used as a service token in the
+     * custom resource.
+     */
+    readonly functionArn: string;
+    /**
+     * The role of the handler's lambda function.
+     */
+    readonly role: iam.IRole;
+    constructor(scope: Construct, id: string, props?: NotificationsResourceHandlerProps);
+    addToRolePolicy(statement: iam.PolicyStatement): void;
+}

cdk/node_modules/aws-cdk-lib/aws-s3/lib/notifications-resource/notifications-resource-handler.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.NotificationsResourceHandler=exports.NotificationsResourceHandlerProps=void 0;var fs=()=>{var tmp=require("fs");return fs=()=>tmp,tmp},path=()=>{var tmp=require("path");return path=()=>tmp,tmp},constructs_1=()=>{var tmp=require("constructs");return constructs_1=()=>tmp,tmp},iam=()=>{var tmp=require("../../../aws-iam");return iam=()=>tmp,tmp},runtime_1=()=>{var tmp=require("../../../aws-lambda/lib/runtime");return runtime_1=()=>tmp,tmp},cdk=()=>{var tmp=require("../../../core");return cdk=()=>tmp,tmp};class NotificationsResourceHandlerProps{role}exports.NotificationsResourceHandlerProps=NotificationsResourceHandlerProps;class NotificationsResourceHandler extends constructs_1().Construct{static singleton(context,props={}){const root=cdk().Stack.of(context),logicalId="BucketNotificationsHandler050a0587b7544547bf325f094a3db834";let lambda=root.node.tryFindChild(logicalId);return lambda||(lambda=new NotificationsResourceHandler(root,logicalId,props)),lambda}functionArn;role;constructor(scope,id,props={}){super(scope,id),this.role=props.role??new(iam()).Role(this,"Role",{assumedBy:new(iam()).ServicePrincipal("lambda.amazonaws.com")}),this.role.addManagedPolicy(iam().ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"));const resourceType="AWS::Lambda::Function";class InLineLambda extends cdk().CfnResource{tags=new(cdk()).TagManager(cdk().TagType.STANDARD,resourceType);renderProperties(properties){return properties.Tags=cdk().listMapper(cdk().cfnTagToCloudFormation)(this.tags.renderTags()),delete properties.tags,properties}}const handlerSourceWithoutComments=fs().readFileSync(path().join(__dirname,"..","..","..","custom-resource-handlers","dist","aws-s3","notifications-resource-handler","index.py"),"utf8").replace(/^ *#.*\n?/gm,""),resource=new InLineLambda(this,"Resource",{type:resourceType,properties:{Description:'AWS CloudFormation handler for "Custom::S3BucketNotifications" resources (@aws-cdk/aws-s3)',Code:{ZipFile:handlerSourceWithoutComments},Handler:"index.handler",Role:this.role.roleArn,Runtime:runtime_1().Runtime.determineLatestPythonRuntime(this).name,Timeout:300}});resource.node.addDependency(this.role),this.functionArn=resource.getAtt("Arn").toString()}addToRolePolicy(statement){this.role.addToPrincipalPolicy(statement)}}exports.NotificationsResourceHandler=NotificationsResourceHandler;

cdk/node_modules/aws-cdk-lib/aws-s3/lib/notifications-resource/notifications-resource.d.ts

@@ -0,0 +1,73 @@
+import { Construct } from 'constructs';
+import * as iam from '../../../aws-iam';
+import type { IBucket, EventType, NotificationKeyFilter } from '../bucket';
+import type { IBucketNotificationDestination } from '../destination';
+interface NotificationsProps {
+    /**
+     * The bucket to manage notifications for.
+     */
+    bucket: IBucket;
+    /**
+     * The role to be used by the lambda handler
+     */
+    handlerRole?: iam.IRole;
+    /**
+     * Skips notification validation of Amazon SQS, Amazon SNS, and Lambda destinations.
+     */
+    skipDestinationValidation: boolean;
+}
+/**
+ * A custom CloudFormation resource that updates bucket notifications for a
+ * bucket. The reason we need it is because the AWS::S3::Bucket notification
+ * configuration is defined on the bucket itself, which makes it impossible to
+ * provision notifications at the same time as the target (since
+ * PutBucketNotifications validates the targets).
+ *
+ * Since only a single BucketNotifications resource is allowed for each Bucket,
+ * this construct is not exported in the public API of this module. Instead, it
+ * is created just-in-time by `s3.Bucket.onEvent`, so a 1:1 relationship is
+ * ensured.
+ *
+ * @see
+ * https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html
+ */
+export declare class BucketNotifications extends Construct {
+    private eventBridgeEnabled;
+    private readonly lambdaNotifications;
+    private readonly queueNotifications;
+    private readonly topicNotifications;
+    private resource?;
+    private readonly bucket;
+    private readonly handlerRole?;
+    private readonly skipDestinationValidation;
+    constructor(scope: Construct, id: string, props: NotificationsProps);
+    /**
+     * Adds a notification subscription for this bucket.
+     * If this is the first notification, a BucketNotification resource is added to the stack.
+     *
+     * @param event The type of event
+     * @param target The target construct
+     * @param filters A set of S3 key filters
+     */
+    addNotification(event: EventType, target: IBucketNotificationDestination, ...filters: NotificationKeyFilter[]): void;
+    enableEventBridgeNotification(): void;
+    private renderNotificationConfiguration;
+    /**
+     * Defines the bucket notifications resources in the stack only once.
+     * This is called lazily as we add notifications, so that if notifications are not added,
+     * there is no notifications resource.
+     */
+    private createResourceOnce;
+    /**
+     * Add scoped permissions for managing bucket notifications to the handler's role.
+     *
+     * Grants specific IAM permissions to the bucket ARN instead of using wildcard permissions.
+     * This implements the principle of least privilege by limiting the handler's access to only
+     * the buckets it needs to manage.
+     *
+     * @param handler The notifications resource handler
+     * @param managed Whether this is a managed (CDK-created) bucket
+     */
+    private addHandlerPermissions;
+}
+export {};