@kensio/yulin 0.35.0 → 0.37.0

package/README.md

@@ -27,6 +27,11 @@ npm i -D @kensio/yulin
 - [S3](./docs/services/s3 "Simulated S3 docs")
 - [STS](./docs/services/sts "Simulated STS docs")
 
+## Feature specific docs
+
+- [AWS SDK interception](./docs/sdk "Simulated AWS SDK docs")
+- [Simulated time](./docs/time "Simulated time docs")
+
 ## Usage
 
 ### Intercept AWS SDK clients
@@ -170,6 +175,38 @@ console.log(bucketWebsiteUrl.toString());
 const res = await fetch(new URL("/foo/", bucketWebsiteUrl));
 ```
 
+### Control simulated time
+
+Each simulated AWS has its own clock, which you can freeze, set, or advance. This lets a test
+exercise behaviour that only happens once time passes, without waiting for it and without replacing
+the clock for the whole process:
+
+```typescript
+import { SimAws } from "@kensio/yulin";
+import { AssumeRoleCommand } from "@aws-sdk/client-sts";
+
+const simAws = new SimAws();
+
+// Assumes a ReportingRole this Account is already allowed to assume; the
+// simulated time docs below show the same example with its IAM setup.
+const { Credentials } = await simAws.sts().assumeRole(
+  new AssumeRoleCommand({
+    RoleArn: `arn:aws:iam::${simAws.defaultAccountId}:role/ReportingRole`,
+    RoleSessionName: "reporting-session",
+    DurationSeconds: 900,
+  }),
+);
+
+await simAws.clock().advanceBy({ minutes: 20 });
+
+// Those session credentials have now expired.
+```
+
+Advancing runs whatever falls due during the interval and returns once the simulation has settled,
+so the next line can assert. Time belongs to the `SimAws` instance, so moving it never disturbs
+another simulation, or the real clock. See the
+[simulated time docs](./docs/time "Simulated time docs") for full usage.
+
 ## What is yulin?
 
 TLDR: yulin is an AWS simulator for testing Node.js applications.

package/dist/index.d.ts

@@ -1,4 +1,9 @@
 export { SimAws } from "./service/aws/sim-aws.js";
 export type { AwsRegionName } from "./service/aws/sim-aws-region.js";
 export type { SimAwsAccountId } from "./service/aws/sim-aws-account.js";
+export { type SimClock, SimFixedClock, SimRealClock, } from "./util/clock/sim-clock.js";
+export { SimControllableClock } from "./util/clock/sim-controllable-clock.js";
+export { SimClockControl } from "./util/clock/sim-clock-control.js";
+export { SimDuration, type SimDurationInput, SimInvalidDuration, } from "./util/clock/sim-duration.js";
+export { SimAwsTimeNotControllable } from "./service/aws/sim-aws-timekeeping.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,YAAY,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,KAAK,QAAQ,EACb,aAAa,EACb,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,WAAW,EACX,KAAK,gBAAgB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/index.js

@@ -1,2 +1,7 @@
 export { SimAws } from "./service/aws/sim-aws.js";
+export { SimFixedClock, SimRealClock, } from "./util/clock/sim-clock.js";
+export { SimControllableClock } from "./util/clock/sim-controllable-clock.js";
+export { SimClockControl } from "./util/clock/sim-clock-control.js";
+export { SimDuration, SimInvalidDuration, } from "./util/clock/sim-duration.js";
+export { SimAwsTimeNotControllable } from "./service/aws/sim-aws-timekeeping.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAGlD,OAAO,EAEL,aAAa,EACb,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,WAAW,EAEX,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/serve/controller/factory/sim-aws-service-controller-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-service-controller-factory.d.ts","sourceRoot":"","sources":["../../../../src/serve/controller/factory/sim-aws-service-controller-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAK9D;;GAEG;AACH,qBAAa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C;;OAEG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAmBnD;CACF"}
+{"version":3,"file":"sim-aws-service-controller-factory.d.ts","sourceRoot":"","sources":["../../../../src/serve/controller/factory/sim-aws-service-controller-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAM9D;;GAEG;AACH,qBAAa,8BAA8B;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAE/C;;OAEG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,uBAAuB,CAsBnD;CACF"}

package/dist/serve/controller/factory/sim-aws-service-controller-factory.js

@@ -1,4 +1,5 @@
 import { SimCloudFrontServiceController } from "../../../service/cloudfront/controller/sim-cloudfront-controller.js";
+import { SimLambdaServiceController } from "../../../service/lambda/serve/sim-lambda-controller.js";
 import { SimRoute53ServiceController } from "../../../service/route53/serve/sim-route53-controller.js";
 import { SimS3ServiceController } from "../../../service/s3/serve/sim-s3-controller.js";
 /**
@@ -22,6 +23,9 @@ export class SimAwsServiceControllerFactory {
                     simAws: this.simAws,
                 });
             }
+            case "lambda": {
+                return new SimLambdaServiceController({ simAws: this.simAws });
+            }
             case "route53": {
                 return new SimRoute53ServiceController({ simAws: this.simAws });
             }

package/dist/serve/controller/factory/sim-aws-service-controller-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-aws-service-controller-factory.js","sourceRoot":"","sources":["../../../../src/serve/controller/factory/sim-aws-service-controller-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AACrH,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAExF;;GAEG;AACH,MAAM,OAAO,8BAA8B;IACZ,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C;;OAEG;IACH,MAAM,CAAC,WAAmB;QACxB,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAI,8BAA8B,CAAC;oBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,2CAA2C,WAAW,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-aws-service-controller-factory.js","sourceRoot":"","sources":["../../../../src/serve/controller/factory/sim-aws-service-controller-factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,qEAAqE,CAAC;AACrH,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,2BAA2B,EAAE,MAAM,0DAA0D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAExF;;GAEG;AACH,MAAM,OAAO,8BAA8B;IACZ,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C;;OAEG;IACH,MAAM,CAAC,WAAmB;QACxB,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,IAAI,8BAA8B,CAAC;oBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,2CAA2C,WAAW,EAAE,CACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/serve/controller/sim-aws-service-signing-name.d.ts

@@ -0,0 +1,11 @@
+import type { SimAwsServiceTarget } from "./sim-service-controller.js";
+/**
+ * The SigV4 signing name of each simulated service a request can be routed to.
+ *
+ * Service targets use the simulator's own naming, which follows the SDK client
+ * names, while a credential scope names the service the way the signer does.
+ * They agree for most services and not for CloudFront, so the two vocabularies
+ * are mapped here rather than assumed to be the same string.
+ */
+export declare function simAwsServiceSigningName(service: SimAwsServiceTarget["service"]): string;
+//# sourceMappingURL=sim-aws-service-signing-name.d.ts.map

package/dist/serve/controller/sim-aws-service-signing-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-service-signing-name.d.ts","sourceRoot":"","sources":["../../../src/serve/controller/sim-aws-service-signing-name.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,CAAC,SAAS,CAAC,GACtC,MAAM,CAeR"}

package/dist/serve/controller/sim-aws-service-signing-name.js

@@ -0,0 +1,25 @@
+/**
+ * The SigV4 signing name of each simulated service a request can be routed to.
+ *
+ * Service targets use the simulator's own naming, which follows the SDK client
+ * names, while a credential scope names the service the way the signer does.
+ * They agree for most services and not for CloudFront, so the two vocabularies
+ * are mapped here rather than assumed to be the same string.
+ */
+export function simAwsServiceSigningName(service) {
+    switch (service) {
+        case "cloudFront": {
+            return "cloudfront";
+        }
+        case "s3": {
+            return "s3";
+        }
+        case "lambda": {
+            return "lambda";
+        }
+        case "route53": {
+            return "route53";
+        }
+    }
+}
+//# sourceMappingURL=sim-aws-service-signing-name.js.map

package/dist/serve/controller/sim-aws-service-signing-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-service-signing-name.js","sourceRoot":"","sources":["../../../src/serve/controller/sim-aws-service-signing-name.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAuC;IAEvC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,EAAE,CAAC;YAClB,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/serve/controller/sim-service-controller.d.ts

@@ -1,10 +1,36 @@
 import type { AwsRegionName } from "../../service/aws/sim-aws-region.js";
 import type { SimAws } from "../../service/aws/sim-aws.js";
+import { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
 export interface SimAwsServiceTarget {
-    readonly service: "s3" | "cloudFront" | "route53";
+    readonly service: "s3" | "cloudFront" | "lambda" | "route53";
     readonly resourceName: string;
     readonly regionName?: AwsRegionName;
 }
+interface SimAwsServiceRequestProperties {
+    readonly target: SimAwsServiceTarget;
+    readonly request: Request;
+    readonly caller?: SimAwsRequestCaller | undefined;
+    readonly body?: Uint8Array | undefined;
+}
+/**
+ * One HTTP request, routed to a simulated service and attributed to a
+ * principal.
+ *
+ * Controllers are handed this rather than a bare request because everything
+ * they need has already been settled once at the boundary: which resource the
+ * hostname names, who is asking, and the request body, buffered so that both
+ * signature verification and the controller can read the same bytes.
+ *
+ * The request carries no simulator control headers, so a Lambda handler
+ * echoing `event.headers` sees the request as its client sent it.
+ */
+export declare class SimAwsServiceRequest {
+    readonly target: SimAwsServiceTarget;
+    readonly request: Request;
+    readonly caller: SimAwsRequestCaller;
+    readonly body?: Uint8Array | undefined;
+    constructor(properties: SimAwsServiceRequestProperties);
+}
 /**
  * Factory function for making instances of simulated AWS service controllers.
  */
@@ -16,6 +42,7 @@ export interface SimAwsServiceController {
     /**
      * Handle an HTTP request routed to this simulated AWS service.
      */
-    handleRequest(target: SimAwsServiceTarget, request: Request): Promise<Response>;
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
 }
+export {};
 //# sourceMappingURL=sim-service-controller.d.ts.map

package/dist/serve/controller/sim-service-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-service-controller.d.ts","sourceRoot":"","sources":["../../../src/serve/controller/sim-service-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAC3C,MAAM,EAAE,MAAM,KACX,uBAAuB,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB"}
+{"version":3,"file":"sim-service-controller.d.ts","sourceRoot":"","sources":["../../../src/serve/controller/sim-service-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE1F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CACxC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,oBAAoB;IAC/B,SAAgB,MAAM,EAAE,mBAAmB,CAAC;IAC5C,SAAgB,OAAO,EAAE,OAAO,CAAC;IACjC,SAAgB,MAAM,EAAE,mBAAmB,CAAC;IAC5C,SAAgB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAE9C,YAAY,UAAU,EAAE,8BAA8B,EAMrD;CACF;AAED;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAC3C,MAAM,EAAE,MAAM,KACX,uBAAuB,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxE"}

package/dist/serve/controller/sim-service-controller.js

@@ -1,2 +1,27 @@
-export {};
+import { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
+/**
+ * One HTTP request, routed to a simulated service and attributed to a
+ * principal.
+ *
+ * Controllers are handed this rather than a bare request because everything
+ * they need has already been settled once at the boundary: which resource the
+ * hostname names, who is asking, and the request body, buffered so that both
+ * signature verification and the controller can read the same bytes.
+ *
+ * The request carries no simulator control headers, so a Lambda handler
+ * echoing `event.headers` sees the request as its client sent it.
+ */
+export class SimAwsServiceRequest {
+    target;
+    request;
+    caller;
+    body;
+    constructor(properties) {
+        this.target = properties.target;
+        this.request = properties.request;
+        // An unattributed request is anonymous, never the Account root.
+        this.caller = properties.caller ?? SimAwsRequestCaller.anonymous();
+        this.body = properties.body;
+    }
+}
 //# sourceMappingURL=sim-service-controller.js.map

package/dist/serve/controller/sim-service-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-service-controller.js","sourceRoot":"","sources":["../../../src/serve/controller/sim-service-controller.ts"],"names":[],"mappings":""}
+{"version":3,"file":"sim-service-controller.js","sourceRoot":"","sources":["../../../src/serve/controller/sim-service-controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAgB1F;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,oBAAoB;IACf,MAAM,CAAsB;IAC5B,OAAO,CAAU;IACjB,MAAM,CAAsB;IAC5B,IAAI,CAA0B;IAE9C,YAAY,UAA0C;QACpD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,gEAAgE;QAChE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF"}

package/dist/serve/http/request/sim-aws-received-request.d.ts

@@ -0,0 +1,29 @@
+/**
+ * An HTTP request as it arrived at the simulated AWS boundary.
+ *
+ * The body is read exactly once, here, because a request body is a stream that
+ * cannot be consumed twice and two things need it: the SigV4 payload hash, and
+ * whatever the simulated service builds from the request. Everything
+ * downstream is handed the same bytes.
+ */
+export declare class SimAwsReceivedRequest {
+    /**
+     * The request body, or undefined when the request carried none.
+     */
+    readonly body?: Uint8Array | undefined;
+    private readonly received;
+    private constructor();
+    /**
+     * Take a request in, buffering its body.
+     */
+    static receive(request: Request): Promise<SimAwsReceivedRequest>;
+    /**
+     * The request as the simulated service should see it.
+     *
+     * Simulator control headers are stripped, so a Lambda handler echoing
+     * `event.headers` never sees them, and the buffered body is reattached so
+     * the service can read it as usual.
+     */
+    forService(): Request;
+}
+//# sourceMappingURL=sim-aws-received-request.d.ts.map

package/dist/serve/http/request/sim-aws-received-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-received-request.d.ts","sourceRoot":"","sources":["../../../../src/serve/http/request/sim-aws-received-request.ts"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,SAAgB,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAE9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IAEnC,OAAO,eAGN;IAED;;OAEG;IACH,OAAa,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAOrE;IAED;;;;;;OAMG;IACH,UAAU,IAAI,OAAO,CAYpB;CACF"}

package/dist/serve/http/request/sim-aws-received-request.js

@@ -0,0 +1,53 @@
+import { simAwsCallerHeaderName } from "../../../service/iam/request/sim-aws-caller-header.js";
+/**
+ * Header names that are instructions to the simulator rather than part of the
+ * request being simulated.
+ */
+const controlHeaderNames = [simAwsCallerHeaderName];
+/**
+ * An HTTP request as it arrived at the simulated AWS boundary.
+ *
+ * The body is read exactly once, here, because a request body is a stream that
+ * cannot be consumed twice and two things need it: the SigV4 payload hash, and
+ * whatever the simulated service builds from the request. Everything
+ * downstream is handed the same bytes.
+ */
+export class SimAwsReceivedRequest {
+    /**
+     * The request body, or undefined when the request carried none.
+     */
+    body;
+    received;
+    constructor(received, body) {
+        this.received = received;
+        this.body = body;
+    }
+    /**
+     * Take a request in, buffering its body.
+     */
+    static async receive(request) {
+        const body = request.body === null
+            ? undefined
+            : new Uint8Array(await request.arrayBuffer());
+        return new SimAwsReceivedRequest(request, body);
+    }
+    /**
+     * The request as the simulated service should see it.
+     *
+     * Simulator control headers are stripped, so a Lambda handler echoing
+     * `event.headers` never sees them, and the buffered body is reattached so
+     * the service can read it as usual.
+     */
+    forService() {
+        const headers = new Headers(this.received.headers);
+        for (const name of controlHeaderNames) {
+            headers.delete(name);
+        }
+        return new Request(this.received.url, {
+            method: this.received.method,
+            headers,
+            ...(this.body !== undefined && { body: this.body }),
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-received-request.js.map

package/dist/serve/http/request/sim-aws-received-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-received-request.js","sourceRoot":"","sources":["../../../../src/serve/http/request/sim-aws-received-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAE/F;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACa,IAAI,CAA0B;IAE7B,QAAQ,CAAU;IAEnC,YAAoB,QAAiB,EAAE,IAA4B;QACjE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAgB;QACnC,MAAM,IAAI,GACR,OAAO,CAAC,IAAI,KAAK,IAAI;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAElD,OAAO,IAAI,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEnD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/serve/http/request/sim-aws-request-authenticator.d.ts

@@ -0,0 +1,31 @@
+import type { SimAws } from "../../../service/aws/sim-aws.js";
+import { SimAwsServiceRequest, type SimAwsServiceTarget } from "../../controller/sim-service-controller.js";
+interface SimAwsRequestAuthenticatorProperties {
+    readonly simAws: SimAws;
+}
+/**
+ * Turns a received HTTP request into a request a simulated service can serve.
+ *
+ * This is where the serving layer meets simulated IAM: the body is buffered
+ * once, the principal is resolved by IAM, and the result is the request a
+ * controller is given. Controllers therefore never see an unattributed
+ * request, and never have to decide for themselves what an unsigned one means.
+ */
+export declare class SimAwsRequestAuthenticator {
+    private readonly simAws;
+    constructor(properties: SimAwsRequestAuthenticatorProperties);
+    /**
+     * Authenticate a request routed to a simulated service.
+     *
+     * The request handed to IAM is the one received, headers and all. A signature
+     * covers the host header as it arrived, and serving rewrites AWS hostnames to
+     * localhost ones, so reconstructing the real AWS hostname here would break
+     * every signature made against the URL actually called.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted.
+     */
+    authenticate(target: SimAwsServiceTarget, request: Request): Promise<SimAwsServiceRequest>;
+}
+export {};
+//# sourceMappingURL=sim-aws-request-authenticator.d.ts.map

package/dist/serve/http/request/sim-aws-request-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-authenticator.d.ts","sourceRoot":"","sources":["../../../../src/serve/http/request/sim-aws-request-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACzB,MAAM,4CAA4C,CAAC;AAGpD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;;;;;;;;OAUG;IACG,YAAY,CAChB,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,oBAAoB,CAAC,CAiB/B;CACF"}

package/dist/serve/http/request/sim-aws-request-authenticator.js

@@ -0,0 +1,45 @@
+import { simAwsServiceSigningName } from "../../controller/sim-aws-service-signing-name.js";
+import { SimAwsServiceRequest, } from "../../controller/sim-service-controller.js";
+import { SimAwsReceivedRequest } from "./sim-aws-received-request.js";
+/**
+ * Turns a received HTTP request into a request a simulated service can serve.
+ *
+ * This is where the serving layer meets simulated IAM: the body is buffered
+ * once, the principal is resolved by IAM, and the result is the request a
+ * controller is given. Controllers therefore never see an unattributed
+ * request, and never have to decide for themselves what an unsigned one means.
+ */
+export class SimAwsRequestAuthenticator {
+    simAws;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+    }
+    /**
+     * Authenticate a request routed to a simulated service.
+     *
+     * The request handed to IAM is the one received, headers and all. A signature
+     * covers the host header as it arrived, and serving rewrites AWS hostnames to
+     * localhost ones, so reconstructing the real AWS hostname here would break
+     * every signature made against the URL actually called.
+     *
+     * Throws a SimAwsRequestAuthFailure when the request states an identity that
+     * cannot be accepted.
+     */
+    async authenticate(target, request) {
+        const received = await SimAwsReceivedRequest.receive(request);
+        const caller = this.simAws.resolveRequestCaller(request, {
+            body: received.body,
+            expectedScope: {
+                serviceName: simAwsServiceSigningName(target.service),
+                regionName: target.regionName,
+            },
+        });
+        return new SimAwsServiceRequest({
+            target,
+            request: received.forService(),
+            caller,
+            body: received.body,
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-request-authenticator.js.map

package/dist/serve/http/request/sim-aws-request-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-request-authenticator.js","sourceRoot":"","sources":["../../../../src/serve/http/request/sim-aws-request-authenticator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kDAAkD,CAAC;AAC5F,OAAO,EACL,oBAAoB,GAErB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAMtE;;;;;;;GAOG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAAS;IAEhC,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAChB,MAA2B,EAC3B,OAAgB;QAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE;YACvD,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,aAAa,EAAE;gBACb,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC;gBACrD,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,oBAAoB,CAAC;YAC9B,MAAM;YACN,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;YAC9B,MAAM;YACN,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/serve/http/response/sim-aws-auth-failure-response.d.ts

@@ -0,0 +1,30 @@
+import { type SimAwsRequestAuthFailure } from "../../../service/iam/request/error/sim-aws-request-auth.error.js";
+/**
+ * The response a request refused at the authentication boundary gets.
+ *
+ * The body is the small JSON document AWS answers a rejected request with, and
+ * nothing more: real AWS does not explain itself here, and neither does this.
+ * Everything the simulator can say about the refusal goes into `x-sim-aws-*`
+ * headers, where it helps without changing the shape of the response any
+ * client is written against.
+ */
+export declare class SimAwsAuthFailureResponse {
+    private readonly hints;
+    /**
+     * Build the HTTP response for a failed request authentication.
+     */
+    build(failure: SimAwsRequestAuthFailure): Response;
+    private rejectedResponse;
+    /**
+     * Whether the request was malformed rather than unauthenticated.
+     *
+     * A caller header the simulator cannot read is a mistake in driving Yulin
+     * rather than a failed AWS authentication. A signature too incomplete to
+     * parse is the one SigV4 rejection real AWS also answers with a 400, because
+     * nothing was presented that could have been authenticated; every other SigV4
+     * rejection is a 403.
+     */
+    private isBadRequest;
+    private jsonResponse;
+}
+//# sourceMappingURL=sim-aws-auth-failure-response.d.ts.map

package/dist/serve/http/response/sim-aws-auth-failure-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-auth-failure-response.d.ts","sourceRoot":"","sources":["../../../../src/serve/http/response/sim-aws-auth-failure-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,kEAAkE,CAAC;AAI1E;;;;;;;;GAQG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IAEnD;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CAIjD;IAED,OAAO,CAAC,gBAAgB;IAQxB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,YAAY;CAgBrB"}

package/dist/serve/http/response/sim-aws-auth-failure-response.js

@@ -0,0 +1,51 @@
+import { SimAwsInvalidCallerHeader, } from "../../../service/iam/request/error/sim-aws-request-auth.error.js";
+import { SimIamIncompleteSignature } from "../../../service/iam/sigv4/error/sim-iam-sigv4.error.js";
+import { SimAwsResponseHints } from "./sim-aws-response-hints.js";
+/**
+ * The response a request refused at the authentication boundary gets.
+ *
+ * The body is the small JSON document AWS answers a rejected request with, and
+ * nothing more: real AWS does not explain itself here, and neither does this.
+ * Everything the simulator can say about the refusal goes into `x-sim-aws-*`
+ * headers, where it helps without changing the shape of the response any
+ * client is written against.
+ */
+export class SimAwsAuthFailureResponse {
+    hints = new SimAwsResponseHints();
+    /**
+     * Build the HTTP response for a failed request authentication.
+     */
+    build(failure) {
+        const rejected = this.rejectedResponse(failure);
+        return this.hints.stampAuthFailure(rejected, failure);
+    }
+    rejectedResponse(failure) {
+        if (this.isBadRequest(failure)) {
+            return this.jsonResponse(400, "Bad Request", failure.code);
+        }
+        return this.jsonResponse(403, "Forbidden", failure.code);
+    }
+    /**
+     * Whether the request was malformed rather than unauthenticated.
+     *
+     * A caller header the simulator cannot read is a mistake in driving Yulin
+     * rather than a failed AWS authentication. A signature too incomplete to
+     * parse is the one SigV4 rejection real AWS also answers with a 400, because
+     * nothing was presented that could have been authenticated; every other SigV4
+     * rejection is a 403.
+     */
+    isBadRequest(failure) {
+        return (failure instanceof SimAwsInvalidCallerHeader ||
+            failure instanceof SimIamIncompleteSignature);
+    }
+    jsonResponse(status, message, errorType) {
+        return Response.json({ Message: message }, {
+            status,
+            headers: {
+                "content-type": "application/json",
+                "x-amzn-errortype": errorType,
+            },
+        });
+    }
+}
+//# sourceMappingURL=sim-aws-auth-failure-response.js.map

package/dist/serve/http/response/sim-aws-auth-failure-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-auth-failure-response.js","sourceRoot":"","sources":["../../../../src/serve/http/response/sim-aws-auth-failure-response.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,kEAAkE,CAAC;AAC1E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAAyB;IACnB,KAAK,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAEnD;;OAEG;IACH,KAAK,CAAC,OAAiC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,gBAAgB,CAAC,OAAiC;QACxD,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,OAAiC;QACpD,OAAO,CACL,OAAO,YAAY,yBAAyB;YAC5C,OAAO,YAAY,yBAAyB,CAC7C,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,MAAc,EACd,OAAe,EACf,SAAiB;QAEjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;YACE,MAAM;YACN,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,SAAS;aAC9B;SACF,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/serve/http/response/sim-aws-response-hints.d.ts

@@ -0,0 +1,35 @@
+import type { SimAwsRequestAuthFailure } from "../../../service/iam/request/error/sim-aws-request-auth.error.js";
+import type { SimAwsRequestCaller } from "../../../service/iam/request/sim-aws-request-caller.js";
+/**
+ * How the caller was established, reported back on the response.
+ */
+export declare const simAwsAuthHeaderName = "x-sim-aws-auth";
+/**
+ * The AWS error code a rejected request was refused with.
+ */
+export declare const simAwsErrorHeaderName = "x-sim-aws-error";
+/**
+ * Why the request was refused, in more detail than the AWS response body has
+ * anywhere to put it.
+ */
+export declare const simAwsErrorDetailHeaderName = "x-sim-aws-error-detail";
+/**
+ * Stamps the simulator's own account of a request onto its response.
+ *
+ * These hints go in headers, never in the body, so that a response stays the
+ * shape the real service returns and client code parsing it is unaffected.
+ * That matters most where AWS is least forthcoming: a Function URL rejects a
+ * bad signature with nothing but `{"Message":"Forbidden"}`, which is faithful
+ * and useless to debug against, so the detail is carried alongside instead.
+ */
+export declare class SimAwsResponseHints {
+    /**
+     * Report who the simulator decided the caller was, and how.
+     */
+    stampCaller(response: Response, caller: SimAwsRequestCaller): Response;
+    /**
+     * Report that the request was refused before it reached a service, and why.
+     */
+    stampAuthFailure(response: Response, failure: SimAwsRequestAuthFailure): Response;
+}
+//# sourceMappingURL=sim-aws-response-hints.d.ts.map

package/dist/serve/http/response/sim-aws-response-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-response-hints.d.ts","sourceRoot":"","sources":["../../../../src/serve/http/response/sim-aws-response-hints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAEjH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAElG;;GAEG;AACH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;;GAGG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,GAAG,QAAQ,CAKrE;IAED;;OAEG;IACH,gBAAgB,CACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,wBAAwB,GAChC,QAAQ,CASV;CACF"}

package/dist/serve/http/response/sim-aws-response-hints.js

@@ -0,0 +1,49 @@
+import { simAwsCallerHeaderName } from "../../../service/iam/request/sim-aws-caller-header.js";
+/**
+ * How the caller was established, reported back on the response.
+ */
+export const simAwsAuthHeaderName = "x-sim-aws-auth";
+/**
+ * The AWS error code a rejected request was refused with.
+ */
+export const simAwsErrorHeaderName = "x-sim-aws-error";
+/**
+ * Why the request was refused, in more detail than the AWS response body has
+ * anywhere to put it.
+ */
+export const simAwsErrorDetailHeaderName = "x-sim-aws-error-detail";
+/**
+ * Stamps the simulator's own account of a request onto its response.
+ *
+ * These hints go in headers, never in the body, so that a response stays the
+ * shape the real service returns and client code parsing it is unaffected.
+ * That matters most where AWS is least forthcoming: a Function URL rejects a
+ * bad signature with nothing but `{"Message":"Forbidden"}`, which is faithful
+ * and useless to debug against, so the detail is carried alongside instead.
+ */
+export class SimAwsResponseHints {
+    /**
+     * Report who the simulator decided the caller was, and how.
+     */
+    stampCaller(response, caller) {
+        response.headers.set(simAwsCallerHeaderName, caller.toHeaderValue());
+        response.headers.set(simAwsAuthHeaderName, caller.authMethod);
+        return response;
+    }
+    /**
+     * Report that the request was refused before it reached a service, and why.
+     */
+    stampAuthFailure(response, failure) {
+        response.headers.set(simAwsAuthHeaderName, "rejected");
+        response.headers.set(simAwsErrorHeaderName, failure.code);
+        response.headers.set(simAwsErrorDetailHeaderName, singleLine(failure.message));
+        return response;
+    }
+}
+/**
+ * Flatten a message into something a header value can hold.
+ */
+function singleLine(message) {
+    return message.replaceAll(/\s+/g, " ").trim();
+}
+//# sourceMappingURL=sim-aws-response-hints.js.map

package/dist/serve/http/response/sim-aws-response-hints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-response-hints.js","sourceRoot":"","sources":["../../../../src/serve/http/response/sim-aws-response-hints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uDAAuD,CAAC;AAG/F;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;OAEG;IACH,WAAW,CAAC,QAAkB,EAAE,MAA2B;QACzD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACrE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAE9D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,QAAkB,EAClB,OAAiC;QAEjC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QACvD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,GAAG,CAClB,2BAA2B,EAC3B,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAC5B,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC"}