@kensio/yulin 0.45.0 → 1.0.0

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.d.ts

@@ -0,0 +1,29 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+/**
+ * One `components.securitySchemes` member, read into the CreateAuthorizer
+ * input the operations naming it ask for.
+ *
+ * The issuer and the audiences are handed to CreateAuthorizer as the document
+ * wrote them, so what an authorizer requires is stated where every other
+ * caller reads it. Only the translation is here: a document writes the
+ * identity sources as one comma-separated string, and the command takes a list.
+ */
+export declare class SimHttpApiOpenApiSecurityScheme {
+    private readonly scheme;
+    constructor(scheme: SimHttpApiOpenApiObject);
+    /**
+     * The CreateAuthorizer input this scheme asks for.
+     */
+    createAuthorizerInput(apiId: string, name: string): SimCreateAuthorizerCommandInput;
+    /**
+     * The `x-amazon-apigateway-authorizer` this scheme carries, refusing every
+     * other kind of scheme and every other kind of authorizer.
+     */
+    private jwtAuthorizer;
+    /**
+     * The one header or query string parameter the token is read from.
+     */
+    private identitySource;
+}
+//# sourceMappingURL=sim-http-api-openapi-security-scheme.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AACnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAehF;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,+BAA+B,CAcjC;IAED;;;OAGG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,cAAc;CAiBvB"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.js

@@ -0,0 +1,85 @@
+/**
+ * The security scheme types that are not a JWT authorizer.
+ *
+ * `openIdConnect` is refused rather than read. AWS finds the issuer by
+ * fetching the discovery document at `openIdConnectUrl`, and nothing here
+ * fetches anything over HTTP, so the URL itself would end up as the issuer and
+ * every token would fail its `iss` check with a silent 401.
+ */
+const openIdConnect = "AWS reads the issuer out of the discovery document published at " +
+    "openIdConnectUrl, and nothing here is fetched over HTTP. Declare the " +
+    "scheme as oauth2 with an explicit jwtConfiguration.issuer instead.";
+/**
+ * One `components.securitySchemes` member, read into the CreateAuthorizer
+ * input the operations naming it ask for.
+ *
+ * The issuer and the audiences are handed to CreateAuthorizer as the document
+ * wrote them, so what an authorizer requires is stated where every other
+ * caller reads it. Only the translation is here: a document writes the
+ * identity sources as one comma-separated string, and the command takes a list.
+ */
+export class SimHttpApiOpenApiSecurityScheme {
+    scheme;
+    constructor(scheme) {
+        this.scheme = scheme;
+    }
+    /**
+     * The CreateAuthorizer input this scheme asks for.
+     */
+    createAuthorizerInput(apiId, name) {
+        const authorizer = this.jwtAuthorizer();
+        const configuration = authorizer.member("jwtConfiguration").object();
+        return {
+            ApiId: apiId,
+            Name: name,
+            AuthorizerType: "JWT",
+            IdentitySource: this.identitySource(authorizer),
+            JwtConfiguration: {
+                Issuer: configuration.member("issuer").optionalString(),
+                Audience: configuration.member("audience").optionalStringList(),
+            },
+        };
+    }
+    /**
+     * The `x-amazon-apigateway-authorizer` this scheme carries, refusing every
+     * other kind of scheme and every other kind of authorizer.
+     */
+    jwtAuthorizer() {
+        const declared = this.scheme.member("type");
+        const type = declared.requiredString();
+        if (type === "openIdConnect") {
+            throw declared.refusal(openIdConnect);
+        }
+        if (type !== "oauth2") {
+            throw declared.refusal(`is '${type}', and only an oauth2 scheme carrying a JWT ` +
+                `x-amazon-apigateway-authorizer is simulated`);
+        }
+        const authorizer = this.scheme
+            .member("x-amazon-apigateway-authorizer")
+            .object();
+        if (authorizer.member("type").requiredString() !== "jwt") {
+            throw authorizer
+                .member("type")
+                .refusal("is not jwt, and a JWT authorizer is the only kind simulated: a " +
+                "Lambda authorizer runs code of its own to decide");
+        }
+        return authorizer;
+    }
+    /**
+     * The one header or query string parameter the token is read from.
+     */
+    identitySource(authorizer) {
+        const declared = authorizer.member("identitySource");
+        const sources = declared
+            .requiredString()
+            .split(",")
+            .map((source) => source.trim())
+            .filter((source) => source.length > 0);
+        if (sources.length > 1) {
+            throw declared.refusal(`carries ${String(sources.length)} identity sources, and only the ` +
+                `first would be read here`);
+        }
+        return sources;
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-security-scheme.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-scheme.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,aAAa,GACjB,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAA0B;IAEjD,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAa,EACb,IAAY;QAEZ,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;QAErE,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAC/C,gBAAgB,EAAE;gBAChB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE;gBACvD,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,kBAAkB,EAAE;aAChE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,aAAa;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAEvC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,OAAO,CACpB,OAAO,IAAI,8CAA8C;gBACvD,6CAA6C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;aAC3B,MAAM,CAAC,gCAAgC,CAAC;aACxC,MAAM,EAAE,CAAC;QAEZ,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,KAAK,KAAK,EAAE,CAAC;YACzD,MAAM,UAAU;iBACb,MAAM,CAAC,MAAM,CAAC;iBACd,OAAO,CACN,iEAAiE;gBAC/D,kDAAkD,CACrD,CAAC;QACN,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,UAAmC;QACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ;aACrB,cAAc,EAAE;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,OAAO,CACpB,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kCAAkC;gBACjE,0BAA0B,CAC7B,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.d.ts

@@ -0,0 +1,39 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimHttpApiOpenApiSecurityRequirement } from "./sim-http-api-openapi-operation.js";
+import type { SimHttpApiOpenApiValue } from "./sim-http-api-openapi-value.js";
+interface SimHttpApiOpenApiSecuritySchemesProperties {
+    readonly schemes: SimHttpApiOpenApiValue;
+}
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every operation naming
+ * it, which is what an HTTP API has: an authorizer belongs to the API rather
+ * than to a route. A scheme nothing names creates nothing, so it is never read
+ * and never refused.
+ */
+export declare class SimHttpApiOpenApiSecuritySchemes {
+    private readonly schemes;
+    private readonly created;
+    constructor(properties: SimHttpApiOpenApiSecuritySchemesProperties);
+    /**
+     * The CreateAuthorizer input the scheme a requirement names asks for.
+     */
+    authorizerInput(apiId: string, requirement: SimHttpApiOpenApiSecurityRequirement): SimCreateAuthorizerCommandInput;
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdId(schemeName: string): string | undefined;
+    /**
+     * Remember the authorizer created for a scheme, so the next operation naming
+     * it shares that one.
+     */
+    remember(schemeName: string, authorizerId: string): void;
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    private scheme;
+}
+export {};
+//# sourceMappingURL=sim-http-api-openapi-security-schemes.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-schemes.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAEhG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE9E,UAAU,0CAA0C;IAClD,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,oCAAoC,GAChD,+BAA+B,CAMjC;IAED;;OAEG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhD;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAEvD;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;CAcf"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.js

@@ -0,0 +1,49 @@
+import { SimHttpApiOpenApiSecurityScheme } from "./sim-http-api-openapi-security-scheme.js";
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every operation naming
+ * it, which is what an HTTP API has: an authorizer belongs to the API rather
+ * than to a route. A scheme nothing names creates nothing, so it is never read
+ * and never refused.
+ */
+export class SimHttpApiOpenApiSecuritySchemes {
+    schemes;
+    created = new Map();
+    constructor(properties) {
+        this.schemes = properties.schemes;
+    }
+    /**
+     * The CreateAuthorizer input the scheme a requirement names asks for.
+     */
+    authorizerInput(apiId, requirement) {
+        const scheme = new SimHttpApiOpenApiSecurityScheme(this.scheme(requirement));
+        return scheme.createAuthorizerInput(apiId, requirement.schemeName);
+    }
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdId(schemeName) {
+        return this.created.get(schemeName);
+    }
+    /**
+     * Remember the authorizer created for a scheme, so the next operation naming
+     * it shares that one.
+     */
+    remember(schemeName, authorizerId) {
+        this.created.set(schemeName, authorizerId);
+    }
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    scheme(requirement) {
+        const schemes = this.schemes.optionalObject();
+        if (schemes?.has(requirement.schemeName) !== true) {
+            throw requirement.value.refusal(`names the security scheme '${requirement.schemeName}', which ` +
+                `${this.schemes.pointer.toString()} does not define`);
+        }
+        return schemes.member(requirement.schemeName).object();
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-security-schemes.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-schemes.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAO5F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IAC1B,OAAO,CAAyB;IAChC,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,YAAY,UAAsD;QAChE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,eAAe,CACb,KAAa,EACb,WAAiD;QAEjD,MAAM,MAAM,GAAG,IAAI,+BAA+B,CAChD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CACzB,CAAC;QAEF,OAAO,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAkB,EAAE,YAAoB;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,WAAiD;QAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAC7B,8BAA8B,WAAW,CAAC,UAAU,WAAW;gBAC7D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.d.ts

@@ -0,0 +1,55 @@
+import type { JSONValue } from "../../../util/type-guard/json.js";
+import type { SimApiGatewayV2BadRequest } from "../error/sim-api-gateway-v2.error.js";
+import { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+import type { SimHttpApiOpenApiPointer } from "./sim-http-api-openapi-pointer.js";
+interface SimHttpApiOpenApiValueProperties {
+    readonly pointer: SimHttpApiOpenApiPointer;
+    readonly value: JSONValue | undefined;
+}
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export declare class SimHttpApiOpenApiValue {
+    readonly pointer: SimHttpApiOpenApiPointer;
+    private readonly value;
+    constructor(properties: SimHttpApiOpenApiValueProperties);
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent(): boolean;
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason: string): SimApiGatewayV2BadRequest;
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object(): SimHttpApiOpenApiObject;
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject(): SimHttpApiOpenApiObject | undefined;
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString(): string;
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString(): string | undefined;
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray(): readonly SimHttpApiOpenApiValue[] | undefined;
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList(): readonly string[] | undefined;
+}
+export {};
+//# sourceMappingURL=sim-http-api-openapi-value.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-value.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-value.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGlF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAID;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,IAAI,OAAO,CAEhB;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,CAEjD;IAED;;OAEG;IACH,MAAM,IAAI,uBAAuB,CAQhC;IAED;;OAEG;IACH,cAAc,IAAI,uBAAuB,GAAG,SAAS,CAiBpD;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,CAQvB;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;OAEG;IACH,aAAa,IAAI,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAgB7D;IAED;;OAEG;IACH,kBAAkB,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAElD;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.js

@@ -0,0 +1,102 @@
+import { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+import { simHttpApiOpenApiRefusal } from "./sim-http-api-openapi-refusal.js";
+const missing = "is required, and the document does not carry it";
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export class SimHttpApiOpenApiValue {
+    pointer;
+    value;
+    constructor(properties) {
+        this.pointer = properties.pointer;
+        this.value = properties.value;
+    }
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent() {
+        return this.value === undefined;
+    }
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason) {
+        return simHttpApiOpenApiRefusal(this.pointer, reason);
+    }
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object() {
+        const object = this.optionalObject();
+        if (object === undefined) {
+            throw this.refusal(missing);
+        }
+        return object;
+    }
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (typeof this.value !== "object" ||
+            this.value === null ||
+            Array.isArray(this.value)) {
+            throw this.refusal("has to be an object");
+        }
+        return new SimHttpApiOpenApiObject({
+            pointer: this.pointer,
+            members: new Map(Object.entries(this.value)),
+        });
+    }
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString() {
+        const text = this.optionalString();
+        if (text === undefined || text.length === 0) {
+            throw this.refusal(missing);
+        }
+        return text;
+    }
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (typeof this.value !== "string") {
+            throw this.refusal("has to be a string");
+        }
+        return this.value;
+    }
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(this.value)) {
+            throw this.refusal("has to be an array");
+        }
+        return this.value.map((entry, index) => new SimHttpApiOpenApiValue({
+            pointer: this.pointer.child(String(index)),
+            value: entry,
+        }));
+    }
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList() {
+        return this.optionalArray()?.map((entry) => entry.requiredString());
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-value.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-value.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-value.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAO7E,MAAM,OAAO,GAAG,iDAAiD,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAA2B;IACjC,KAAK,CAAwB;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,IAAI,CAAC,KAAK,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAEnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,IAAI,sBAAsB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,EAAE,KAAK;SACb,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/service/apigatewayv2/registry/sim-http-api-registry.d.ts

@@ -0,0 +1,31 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import { type SimHttpApiId } from "../api/sim-http-api-id.js";
+/**
+ * Simulated API Gateway cross-Account registry of API ids.
+ *
+ * A served request carries its region in the hostname, but not the Account.
+ * Simulated API Gateway state is per Account/Region, so the serving layer
+ * needs a way to get from an API id to the Account that owns it. This registry
+ * is that lookup, which is why API ids are allocated here and are unique
+ * across every Account and Region of one simulated AWS environment.
+ */
+export declare class SimHttpApiRegistry {
+    private readonly apiAccountIds;
+    /**
+     * Allocate an API id that is unique in this simulated AWS, and register it
+     * to the Account that will own it.
+     *
+     * Allocation and registration are one step because an id nothing owns is not
+     * a useful thing to hold: it would resolve to no Account and route nowhere.
+     */
+    allocateApiId(accountId: SimAwsAccountId): SimHttpApiId;
+    /**
+     * Forget a deleted API's id, so its endpoint stops resolving.
+     */
+    deregisterApi(apiId: SimHttpApiId): void;
+    /**
+     * Get the Account that owns an API id, if it is registered.
+     */
+    accountIdForApi(apiId: string): SimAwsAccountId | undefined;
+}
+//# sourceMappingURL=sim-http-api-registry.d.ts.map

package/dist/service/apigatewayv2/registry/sim-http-api-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/registry/sim-http-api-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEhF;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAE1E;;;;;;OAMG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,YAAY,CAWtD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEvC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE1D;CACF"}

package/dist/service/apigatewayv2/registry/sim-http-api-registry.js

@@ -0,0 +1,42 @@
+import { makeSimHttpApiId } from "../api/sim-http-api-id.js";
+/**
+ * Simulated API Gateway cross-Account registry of API ids.
+ *
+ * A served request carries its region in the hostname, but not the Account.
+ * Simulated API Gateway state is per Account/Region, so the serving layer
+ * needs a way to get from an API id to the Account that owns it. This registry
+ * is that lookup, which is why API ids are allocated here and are unique
+ * across every Account and Region of one simulated AWS environment.
+ */
+export class SimHttpApiRegistry {
+    apiAccountIds = new Map();
+    /**
+     * Allocate an API id that is unique in this simulated AWS, and register it
+     * to the Account that will own it.
+     *
+     * Allocation and registration are one step because an id nothing owns is not
+     * a useful thing to hold: it would resolve to no Account and route nowhere.
+     */
+    allocateApiId(accountId) {
+        let apiId = makeSimHttpApiId();
+        while (this.apiAccountIds.has(apiId)) {
+            /* v8 ignore next -- does not happen in practice */
+            apiId = makeSimHttpApiId();
+        }
+        this.apiAccountIds.set(apiId, accountId);
+        return apiId;
+    }
+    /**
+     * Forget a deleted API's id, so its endpoint stops resolving.
+     */
+    deregisterApi(apiId) {
+        this.apiAccountIds.delete(apiId);
+    }
+    /**
+     * Get the Account that owns an API id, if it is registered.
+     */
+    accountIdForApi(apiId) {
+        return this.apiAccountIds.get(apiId);
+    }
+}
+//# sourceMappingURL=sim-http-api-registry.js.map

package/dist/service/apigatewayv2/registry/sim-http-api-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-registry.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/registry/sim-http-api-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAqB,MAAM,2BAA2B,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACZ,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1E;;;;;;OAMG;IACH,aAAa,CAAC,SAA0B;QACtC,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;QAE/B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,mDAAmD;YACnD,KAAK,GAAG,gBAAgB,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAEzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmB;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.d.ts

@@ -0,0 +1,19 @@
+import { type SimSdkCommandRoute, type SimSdkCommandRouter } from "../../../sdk/index.js";
+import type { SimApiGatewayV2 } from "../sim-api-gateway-v2.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated API Gateway v2.
+ */
+export declare class SimApiGatewayV2SdkCommandRouter implements SimSdkCommandRouter {
+    private readonly routes;
+    constructor(simApiGatewayV2: SimApiGatewayV2);
+    /**
+     * The SDK Command names simulated API Gateway v2 can handle.
+     */
+    supportedCommandNames(): readonly string[];
+    /**
+     * Get the route for an SDK Command name, if simulated API Gateway v2
+     * supports it.
+     */
+    route(commandName: string): SimSdkCommandRoute | undefined;
+}
+//# sourceMappingURL=sim-api-gateway-v2-sdk-command-router.d.ts.map

package/dist/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-sdk-command-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AAyB/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;GAEG;AACH,qBAAa,+BAAgC,YAAW,mBAAmB;IACzE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YAAY,eAAe,EAAE,eAAe,EAmH3C;IAED;;OAEG;IACH,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEzD;CACF"}

package/dist/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.js

@@ -0,0 +1,81 @@
+import { simSdkCallerOptions, } from "../../../sdk/index.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated API Gateway v2.
+ */
+export class SimApiGatewayV2SdkCommandRouter {
+    routes;
+    constructor(simApiGatewayV2) {
+        this.routes = new Map([
+            [
+                "CreateApiCommand",
+                async (command, context) => await simApiGatewayV2.createApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "ImportApiCommand",
+                async (command, context) => await simApiGatewayV2.importApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetApiCommand",
+                async (command, context) => await simApiGatewayV2.getApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetApisCommand",
+                async (command, context) => await simApiGatewayV2.getApis(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteApiCommand",
+                async (command, context) => await simApiGatewayV2.deleteApi(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateAuthorizerCommand",
+                async (command, context) => await simApiGatewayV2.createAuthorizer(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetAuthorizersCommand",
+                async (command, context) => await simApiGatewayV2.getAuthorizers(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "DeleteAuthorizerCommand",
+                async (command, context) => await simApiGatewayV2.deleteAuthorizer(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateIntegrationCommand",
+                async (command, context) => await simApiGatewayV2.createIntegration(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetIntegrationsCommand",
+                async (command, context) => await simApiGatewayV2.getIntegrations(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateRouteCommand",
+                async (command, context) => await simApiGatewayV2.createRoute(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetRoutesCommand",
+                async (command, context) => await simApiGatewayV2.getRoutes(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "CreateStageCommand",
+                async (command, context) => await simApiGatewayV2.createStage(command, simSdkCallerOptions(context)),
+            ],
+            [
+                "GetStagesCommand",
+                async (command, context) => await simApiGatewayV2.getStages(command, simSdkCallerOptions(context)),
+            ],
+        ]);
+    }
+    /**
+     * The SDK Command names simulated API Gateway v2 can handle.
+     */
+    supportedCommandNames() {
+        return this.routes.keys().toArray();
+    }
+    /**
+     * Get the route for an SDK Command name, if simulated API Gateway v2
+     * supports it.
+     */
+    route(commandName) {
+        return this.routes.get(commandName);
+    }
+}
+//# sourceMappingURL=sim-api-gateway-v2-sdk-command-router.js.map

package/dist/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-sdk-command-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/sdk/sim-api-gateway-v2-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AA2B/B;;GAEG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAA0C;IAEjE,YAAY,eAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAA6B;YAChD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,SAAS,CAC7B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,SAAS,CAC7B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,eAAe;gBACf,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,MAAM,CAC1B,OAA2B,EAC3B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,gBAAgB;gBAChB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,OAAO,CAC3B,OAA4B,EAC5B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,SAAS,CAC7B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,yBAAyB;gBACzB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,gBAAgB,CACpC,OAAqC,EACrC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,uBAAuB;gBACvB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,cAAc,CAClC,OAAmC,EACnC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,yBAAyB;gBACzB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,gBAAgB,CACpC,OAAqC,EACrC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,0BAA0B;gBAC1B,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,iBAAiB,CACrC,OAAsC,EACtC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,wBAAwB;gBACxB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,eAAe,CACnC,OAAoC,EACpC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,WAAW,CAC/B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,SAAS,CAC7B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,oBAAoB;gBACpB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,WAAW,CAC/B,OAAgC,EAChC,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;YACD;gBACE,kBAAkB;gBAClB,KAAK,EAAE,OAAO,EAAE,OAAO,EAAoB,EAAE,CAC3C,MAAM,eAAe,CAAC,SAAS,CAC7B,OAA8B,EAC9B,mBAAmB,CAAC,OAAO,CAAC,CAC7B;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,qBAAqB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAmB;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.d.ts

@@ -0,0 +1,40 @@
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+/**
+ * The IAM action a request to an `AWS_IAM` route is authorized against.
+ *
+ * It is the only `execute-api` action evaluated here. The others AWS defines
+ * are WebSocket management and REST API cache invalidation, and nothing
+ * constrains the action string a policy may name, so a policy is free to grant
+ * one of them and nothing will ask about it.
+ */
+export declare const simExecuteApiInvokeAction = "execute-api:Invoke";
+/**
+ * Decides whether a caller may have an `AWS_IAM` route.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. An HTTP API has no
+ * resource policy, so no resource policies are supplied, and the caller's
+ * identity policies are the whole decision. That is also why a caller from
+ * another Account is always refused: a cross-Account request needs an Allow
+ * from each side, and there is nowhere on an HTTP API to put the resource side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ */
+export declare class SimHttpApiIamRouteAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the route being
+     * called.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): SimHttpApiAuthorization;
+    /**
+     * The `execute-api` ARN of the request being authorized.
+     *
+     * An identity policy is written by hand against the request a caller is
+     * making, so this names the concrete method and the concrete path, unlike
+     * the ARN the integration's invoke permission is matched against. The method
+     * is upper-cased because AWS puts a verb there and a policy names one, while
+     * a Fetch request may carry a method in any case.
+     */
+    private routeArn;
+}
+//# sourceMappingURL=sim-http-api-iam-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-iam-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-iam-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;;;;;;;;;GAUG;AACH,qBAAa,4BAA4B;IACvC;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,6BAA6B,GAAG,uBAAuB,CAYvE;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;CAWjB"}