@kensio/yulin 0.47.0 → 1.0.0

package/dist/serve/payload-2/sim-payload-2-event.type.d.ts

@@ -0,0 +1,123 @@
+/**
+ * A Lambda proxy invocation event in API Gateway HTTP API payload format 2.0.
+ *
+ * Two simulated services build this same event: an HTTP API with an `AWS_PROXY`
+ * integration, which is what the format is named after, and a Lambda Function
+ * URL, which real Lambda documents as using the same format. The fields that
+ * differ between them, such as the route key and the stage, are supplied by
+ * whichever endpoint received the request.
+ *
+ * This is a minimal structural equivalent of the `aws-lambda` typings package's
+ * `APIGatewayProxyEventV2` and `LambdaFunctionURLEvent`, so handlers typed
+ * against that package can be invoked unchanged.
+ */
+export interface SimPayload2Event {
+    version: "2.0";
+    routeKey: string;
+    rawPath: string;
+    rawQueryString: string;
+    cookies?: string[];
+    headers: Record<string, string>;
+    queryStringParameters?: Record<string, string>;
+    pathParameters?: Record<string, string>;
+    stageVariables?: Record<string, string>;
+    requestContext: SimPayload2RequestContext;
+    body?: string;
+    isBase64Encoded: boolean;
+}
+/**
+ * The requestContext block of a payload format 2.0 event.
+ */
+export interface SimPayload2RequestContext {
+    accountId: string;
+    apiId: string;
+    authorizer?: SimPayload2AuthorizerContext;
+    domainName: string;
+    domainPrefix: string;
+    http: SimPayload2HttpContext;
+    requestId: string;
+    routeKey: string;
+    stage: string;
+    time: string;
+    timeEpoch: number;
+}
+/**
+ * The requestContext.authorizer block, present only on an invocation the
+ * endpoint authorized.
+ *
+ * An endpoint that admits anyone has no caller to describe, so real AWS leaves
+ * this out entirely rather than filling it with blanks. Which member is
+ * present says which kind of authorizer admitted the request: `iam` for a
+ * SigV4-signed request, `jwt` for a JWT authorizer.
+ */
+export interface SimPayload2AuthorizerContext {
+    iam?: SimPayload2IamAuthorizer;
+    jwt?: SimPayload2JwtAuthorizer;
+}
+/**
+ * The IAM caller of a SigV4-authorized invocation.
+ *
+ * `userArn` and `accountId` describe the principal the request was attributed
+ * to, which is what makes a handler able to behave differently for different
+ * callers.
+ *
+ * `callerId` and `userId` carry the caller ARN rather than the opaque unique
+ * id (`AIDA...`, `AROA...:session`) real AWS puts there: the simulator has no
+ * unique-id namespace at the request boundary, and an ARN is what a test would
+ * assert on anyway. `accessKey` is empty, as the simulator does not carry the
+ * signing access key id past authentication. `cognitoIdentity` and
+ * `principalOrgId` are always null, as neither is simulated.
+ */
+export interface SimPayload2IamAuthorizer {
+    accessKey: string;
+    accountId: string;
+    callerId: string;
+    cognitoIdentity: null;
+    principalOrgId: null;
+    userArn: string;
+    userId: string;
+}
+/**
+ * The JWT the endpoint's authorizer accepted, as it reaches the handler.
+ *
+ * `scopes` is null when the token carries no `scope` claim, which is what real
+ * API Gateway puts there rather than an empty list.
+ */
+export interface SimPayload2JwtAuthorizer {
+    claims: Record<string, string>;
+    scopes: string[] | null;
+}
+/**
+ * The requestContext.http block of a payload format 2.0 event.
+ */
+export interface SimPayload2HttpContext {
+    method: string;
+    path: string;
+    protocol: string;
+    sourceIp: string;
+    userAgent: string;
+}
+/**
+ * Structured handler result for a payload format 2.0 invocation.
+ *
+ * A handler may also return any other value, in which case real AWS infers a
+ * 200 JSON response from it.
+ */
+export interface SimPayload2Result extends SimPayload2ResultBody {
+    statusCode?: number | undefined;
+}
+/**
+ * A handler result that carries a status code, which is what makes real AWS
+ * treat it as an HTTP response rather than a value to JSON-encode.
+ */
+export interface SimPayload2StructuredResult extends SimPayload2ResultBody {
+    statusCode: number;
+}
+interface SimPayload2ResultBody {
+    headers?: Record<string, string | number | boolean> | undefined;
+    cookies?: string[] | undefined;
+    body?: string | undefined;
+    isBase64Encoded?: boolean | undefined;
+}
+export {};
+//# sourceMappingURL=sim-payload-2-event.type.d.ts.map

package/dist/serve/payload-2/sim-payload-2-event.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-event.type.d.ts","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-event.type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,EAAE,yBAAyB,CAAC;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,4BAA4B,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,GAAG,CAAC,EAAE,wBAAwB,CAAC;IAC/B,GAAG,CAAC,EAAE,wBAAwB,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,IAAI,CAAC;IACtB,cAAc,EAAE,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,SAAS,CAAC;IAChE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACvC"}

package/dist/serve/payload-2/sim-payload-2-event.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-payload-2-event.type.js.map

package/dist/serve/payload-2/sim-payload-2-event.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-event.type.js","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-event.type.ts"],"names":[],"mappings":""}

package/dist/serve/payload-2/sim-payload-2-iam-caller.d.ts

@@ -0,0 +1,29 @@
+import type { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
+import type { SimPayload2AuthorizerContext } from "./sim-payload-2-event.type.js";
+/**
+ * What an endpoint reports as the Account of a caller it did not authenticate,
+ * which is every caller of an endpoint that admits anyone.
+ */
+export declare const simPayload2AnonymousAccountId = "anonymous";
+/**
+ * How the IAM caller of an invocation appears in the event.
+ *
+ * Everything here is derived from the caller's ARN. A caller without one is
+ * described the way an unauthenticated caller is, rather than filled in with
+ * something no real invocation would carry.
+ */
+export declare class SimPayload2IamCaller {
+    private readonly caller;
+    constructor(caller: SimAwsRequestCaller);
+    /**
+     * The Account this invocation is reported as coming from.
+     */
+    accountId(): string;
+    /**
+     * The `requestContext.authorizer` block describing this caller, or undefined
+     * when there is no IAM principal to describe.
+     */
+    authorizerContext(): SimPayload2AuthorizerContext | undefined;
+    private arn;
+}
+//# sourceMappingURL=sim-payload-2-iam-caller.d.ts.map

package/dist/serve/payload-2/sim-payload-2-iam-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-iam-caller.d.ts","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-iam-caller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,cAAc,CAAC;AAEzD;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAE7C,YAAY,MAAM,EAAE,mBAAmB,EAEtC;IAED;;OAEG;IACH,SAAS,IAAI,MAAM,CAQlB;IAED;;;OAGG;IACH,iBAAiB,IAAI,4BAA4B,GAAG,SAAS,CAkB5D;IAED,OAAO,CAAC,GAAG;CAKZ"}

package/dist/{service/lambda/serve/event/sim-lambda-url-iam-authorizer.js → serve/payload-2/sim-payload-2-iam-caller.js}

@@ -1,17 +1,16 @@
 /**
- * What a Function URL reports as the Account of a caller it did not
- * authenticate, which is every caller of a `NONE` URL.
+ * What an endpoint reports as the Account of a caller it did not authenticate,
+ * which is every caller of an endpoint that admits anyone.
  */
-export const simLambdaUrlAnonymousAccountId = "anonymous";
+export const simPayload2AnonymousAccountId = "anonymous";
 /**
- * How the caller of a Function URL invocation appears in the event.
+ * How the IAM caller of an invocation appears in the event.
  *
- * Real Lambda only ever authenticates an IAM principal at a Function URL, so
- * everything here is derived from the caller's ARN. A caller without one is
+ * Everything here is derived from the caller's ARN. A caller without one is
  * described the way an unauthenticated caller is, rather than filled in with
  * something no real invocation would carry.
  */
-export class SimLambdaUrlIamCaller {
+export class SimPayload2IamCaller {
     caller;
     constructor(caller) {
         this.caller = caller;
@@ -22,7 +21,7 @@ export class SimLambdaUrlIamCaller {
     accountId() {
         const arnAccountId = this.arn()?.split(":", 6)[4];
         if (arnAccountId === undefined || arnAccountId.length === 0) {
-            return simLambdaUrlAnonymousAccountId;
+            return simPayload2AnonymousAccountId;
         }
         return arnAccountId;
     }
@@ -52,4 +51,4 @@ export class SimLambdaUrlIamCaller {
         return principal.kind === "arn" ? principal.arn : undefined;
     }
 }
-//# sourceMappingURL=sim-lambda-url-iam-authorizer.js.map
+//# sourceMappingURL=sim-payload-2-iam-caller.js.map

package/dist/serve/payload-2/sim-payload-2-iam-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-iam-caller.js","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-iam-caller.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,WAAW,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAsB;IAE7C,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAElD,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,OAAO,6BAA6B,CAAC;QACvC,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,iBAAiB;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,GAAG,EAAE;gBACH,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC3B,QAAQ,EAAE,GAAG;gBACb,eAAe,EAAE,IAAI;gBACrB,cAAc,EAAE,IAAI;gBACpB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,GAAG;aACZ;SACF,CAAC;IACJ,CAAC;IAEO,GAAG;QACT,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAElC,OAAO,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF"}

package/dist/serve/payload-2/sim-payload-2-request-context.d.ts

@@ -0,0 +1,41 @@
+import type { SimAwsRequestCaller } from "../../service/iam/request/sim-aws-request-caller.js";
+import type { SimPayload2Endpoint } from "./sim-payload-2-endpoint.js";
+import type { SimPayload2JwtAuthorizer, SimPayload2RequestContext } from "./sim-payload-2-event.type.js";
+/**
+ * What the endpoint's authorizer knows about the caller, if it authorized one.
+ *
+ * The two members are the two kinds of authorizer a payload format 2.0
+ * endpoint has. Neither is present for an endpoint that admits anyone, which
+ * is what leaves the authorizer block out of the event.
+ */
+export interface SimPayload2Authorization {
+    /** The caller of a SigV4-signed request the endpoint authenticated. */
+    readonly caller?: SimAwsRequestCaller | undefined;
+    /** The token a JWT authorizer accepted. */
+    readonly jwt?: SimPayload2JwtAuthorizer | undefined;
+}
+interface SimPayload2RequestContextInput {
+    readonly request: Request;
+    readonly url: URL;
+    readonly endpoint: SimPayload2Endpoint;
+    /** The simulated instant the request is stamped with. */
+    readonly at: Date;
+    readonly authorization?: SimPayload2Authorization | undefined;
+}
+/**
+ * Builds the requestContext block of a payload format 2.0 event.
+ *
+ * This describes the AWS-shaped endpoint the request reached and, when the
+ * endpoint authorized one, the caller behind it. A caller is supplied only for
+ * an endpoint that authenticates, which is what makes the authorizer block
+ * present there and absent for an open endpoint, as it is on real AWS.
+ */
+export declare class SimPayload2RequestContextBuilder {
+    /**
+     * Build the requestContext for one request.
+     */
+    build(input: SimPayload2RequestContextInput): SimPayload2RequestContext;
+    private iamCaller;
+}
+export {};
+//# sourceMappingURL=sim-payload-2-request-context.d.ts.map

package/dist/serve/payload-2/sim-payload-2-request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-request-context.d.ts","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-request-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,+BAA+B,CAAC;AAOvC;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CACrD;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,aAAa,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;CAC/D;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C;;OAEG;IACH,KAAK,CAAC,KAAK,EAAE,8BAA8B,GAAG,yBAAyB,CAoCtE;IAED,OAAO,CAAC,SAAS;CAKlB"}

package/dist/serve/payload-2/sim-payload-2-request-context.js

@@ -0,0 +1,54 @@
+import { randomUUID } from "node:crypto";
+import { simPayload2SourceIp } from "./sim-payload-2-connection.js";
+import { simPayload2EventTime } from "./sim-payload-2-event-time.js";
+import { simPayload2AnonymousAccountId, SimPayload2IamCaller, } from "./sim-payload-2-iam-caller.js";
+/**
+ * Builds the requestContext block of a payload format 2.0 event.
+ *
+ * This describes the AWS-shaped endpoint the request reached and, when the
+ * endpoint authorized one, the caller behind it. A caller is supplied only for
+ * an endpoint that authenticates, which is what makes the authorizer block
+ * present there and absent for an open endpoint, as it is on real AWS.
+ */
+export class SimPayload2RequestContextBuilder {
+    /**
+     * Build the requestContext for one request.
+     */
+    build(input) {
+        const { request, url, endpoint, at } = input;
+        const iamCaller = this.iamCaller(input.authorization?.caller);
+        const requestContext = {
+            // An unauthenticated request has no Account behind it, and that is what
+            // AWS calls anonymous.
+            accountId: iamCaller?.accountId() ?? simPayload2AnonymousAccountId,
+            apiId: endpoint.apiId,
+            domainName: endpoint.domainName,
+            domainPrefix: endpoint.domainPrefix,
+            http: {
+                method: request.method,
+                path: url.pathname,
+                protocol: "HTTP/1.1",
+                sourceIp: simPayload2SourceIp,
+                userAgent: request.headers.get("user-agent") ?? "",
+            },
+            requestId: randomUUID(),
+            routeKey: endpoint.routeKey,
+            stage: endpoint.stage,
+            time: simPayload2EventTime(at),
+            timeEpoch: at.getTime(),
+        };
+        const jwt = input.authorization?.jwt;
+        if (jwt !== undefined) {
+            requestContext.authorizer = { jwt };
+        }
+        const authorizer = iamCaller?.authorizerContext();
+        if (authorizer !== undefined) {
+            requestContext.authorizer = authorizer;
+        }
+        return requestContext;
+    }
+    iamCaller(caller) {
+        return caller === undefined ? undefined : new SimPayload2IamCaller(caller);
+    }
+}
+//# sourceMappingURL=sim-payload-2-request-context.js.map

package/dist/serve/payload-2/sim-payload-2-request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-request-context.js","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAMpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAyBvC;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,KAAK,CAAC,KAAqC;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,cAAc,GAA8B;YAChD,wEAAwE;YACxE,uBAAuB;YACvB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,6BAA6B;YAClE,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,IAAI,EAAE;gBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,mBAAmB;gBAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;aACnD;YACD,SAAS,EAAE,UAAU,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC9B,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE;SACxB,CAAC;QAEF,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;QACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,cAAc,CAAC,UAAU,GAAG,EAAE,GAAG,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,EAAE,iBAAiB,EAAE,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,cAAc,CAAC,UAAU,GAAG,UAAU,CAAC;QACzC,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,SAAS,CACf,MAAuC;QAEvC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/{service/lambda/serve/event/sim-lambda-url-request-parts.d.ts → serve/payload-2/sim-payload-2-request-parts.d.ts}

@@ -1,3 +1,10 @@
+interface SimPayload2ProxiedRequest {
+    readonly request: Request;
+    /** The AWS-shaped hostname of the endpoint the request reached. */
+    readonly domainName: string;
+    readonly traceId: string;
+    readonly sourceIp: string;
+}
 /**
  * Reads the parts of an HTTP request that payload format 2.0 delivers in its
  * own event fields rather than as raw request data.
@@ -5,14 +12,17 @@
  * Keeping this separate leaves the event builder to assemble the event from
  * parts, without also owning the header, cookie and query conventions.
  */
-export declare class SimLambdaUrlRequestParts {
+export declare class SimPayload2RequestParts {
     /**
      * Collect request headers, which payload format 2.0 delivers as single
      * lowercased values.
      *
-     * Cookies are left out because they travel in their own event field.
+     * Cookies are left out because they travel in their own event field. The
+     * proxy headers are set rather than merged: AWS terminates the connection
+     * itself and rewrites them before the handler sees them, so whatever a
+     * client sent under those names does not survive.
      */
-    headers(request: Request): Record<string, string>;
+    headers(proxied: SimPayload2ProxiedRequest): Record<string, string>;
     /**
      * Collect the request cookies as the separate list the event carries.
      */
@@ -23,4 +33,5 @@ export declare class SimLambdaUrlRequestParts {
      */
     queryStringParameters(url: URL): Record<string, string>;
 }
-//# sourceMappingURL=sim-lambda-url-request-parts.d.ts.map
+export {};
+//# sourceMappingURL=sim-payload-2-request-parts.d.ts.map

package/dist/serve/payload-2/sim-payload-2-request-parts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-request-parts.d.ts","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-request-parts.ts"],"names":[],"mappings":"AAAA,UAAU,yBAAyB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,qBAAa,uBAAuB;IAClC;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBlE;IAED;;OAEG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAWlC;IAED;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAStD;CACF"}

package/dist/{service/lambda/serve/event/sim-lambda-url-request-parts.js → serve/payload-2/sim-payload-2-request-parts.js}

@@ -5,21 +5,33 @@
  * Keeping this separate leaves the event builder to assemble the event from
  * parts, without also owning the header, cookie and query conventions.
  */
-export class SimLambdaUrlRequestParts {
+export class SimPayload2RequestParts {
     /**
      * Collect request headers, which payload format 2.0 delivers as single
      * lowercased values.
      *
-     * Cookies are left out because they travel in their own event field.
+     * Cookies are left out because they travel in their own event field. The
+     * proxy headers are set rather than merged: AWS terminates the connection
+     * itself and rewrites them before the handler sees them, so whatever a
+     * client sent under those names does not survive.
      */
-    headers(request) {
+    headers(proxied) {
         // Fetch API header names are already lowercased, which is the case
         // payload format 2.0 delivers them in, and repeats are already joined.
         const headers = new Map();
-        request.headers.forEach((value, name) => {
+        proxied.request.headers.forEach((value, name) => {
             headers.set(name, value);
         });
         headers.delete("cookie");
+        // The endpoint's own hostname, not the localhost one the request arrived
+        // at, because that is the hostname the request named on real AWS.
+        headers.set("host", proxied.domainName);
+        headers.set("x-amzn-trace-id", proxied.traceId);
+        headers.set("x-forwarded-for", proxied.sourceIp);
+        // Simulated endpoints are reached over plain localhost HTTP, while a real
+        // one is only reachable over HTTPS, so these describe the AWS endpoint.
+        headers.set("x-forwarded-port", "443");
+        headers.set("x-forwarded-proto", "https");
         return Object.fromEntries(headers);
     }
     /**
@@ -47,4 +59,4 @@ export class SimLambdaUrlRequestParts {
         ]));
     }
 }
-//# sourceMappingURL=sim-lambda-url-request-parts.js.map
+//# sourceMappingURL=sim-payload-2-request-parts.js.map

package/dist/serve/payload-2/sim-payload-2-request-parts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-request-parts.js","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-request-parts.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IAClC;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAkC;QACxC,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzB,yEAAyE;QACzE,kEAAkE;QAClE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,0EAA0E;QAC1E,wEAAwE;QACxE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAE1C,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,OAAgB;QACtB,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEnD,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,YAAY;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,GAAQ;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAE9C,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAoB,EAAE,CAAC;YACvC,GAAG;YACH,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACvC,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}

package/dist/serve/payload-2/sim-payload-2-response-builder.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Turns a payload format 2.0 handler result into the HTTP response the client
+ * sees.
+ *
+ * Real AWS accepts two shapes here: a structured response carrying a
+ * statusCode, or any other value, which it wraps in a 200 JSON response. That
+ * second rule is why a handler returning `{ body: "hi" }` and nothing else
+ * produces a 200 whose body is the JSON `{"body":"hi"}`: without a statusCode
+ * there is no structured response to read, so the whole object is the value.
+ * Both are supported so handlers written either way behave as they would on
+ * AWS.
+ */
+export declare class SimPayload2ResponseBuilder {
+    private readonly bodyEncoding;
+    /**
+     * Build the HTTP response for one handler result.
+     */
+    build(result: unknown): Response;
+    /**
+     * Whether the handler returned a structured HTTP response rather than a
+     * value to be JSON-encoded.
+     */
+    private isStructuredResult;
+    private structuredResponse;
+}
+//# sourceMappingURL=sim-payload-2-response-builder.d.ts.map

package/dist/serve/payload-2/sim-payload-2-response-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-response-builder.d.ts","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-response-builder.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAE9D;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAS/B;IAED;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,kBAAkB;CAgC3B"}

package/dist/{service/lambda/serve/response/sim-lambda-url-response-builder.js → serve/payload-2/sim-payload-2-response-builder.js}

@@ -1,14 +1,19 @@
-import { SimLambdaUrlBodyEncoding } from "../event/sim-lambda-url-body-encoding.js";
+import { SimPayload2BodyEncoding } from "./sim-payload-2-body-encoding.js";
 const jsonContentType = "application/json";
 /**
- * Turns a Function URL handler result into the HTTP response the client sees.
+ * Turns a payload format 2.0 handler result into the HTTP response the client
+ * sees.
  *
- * Real Lambda accepts two shapes here: a structured response carrying a
- * statusCode, or any other value, which it wraps in a 200 JSON response. Both
- * are supported so handlers written either way behave as they would on AWS.
+ * Real AWS accepts two shapes here: a structured response carrying a
+ * statusCode, or any other value, which it wraps in a 200 JSON response. That
+ * second rule is why a handler returning `{ body: "hi" }` and nothing else
+ * produces a 200 whose body is the JSON `{"body":"hi"}`: without a statusCode
+ * there is no structured response to read, so the whole object is the value.
+ * Both are supported so handlers written either way behave as they would on
+ * AWS.
  */
-export class SimLambdaUrlResponseBuilder {
-    bodyEncoding = new SimLambdaUrlBodyEncoding();
+export class SimPayload2ResponseBuilder {
+    bodyEncoding = new SimPayload2BodyEncoding();
     /**
      * Build the HTTP response for one handler result.
      */
@@ -54,4 +59,4 @@ export class SimLambdaUrlResponseBuilder {
         });
     }
 }
-//# sourceMappingURL=sim-lambda-url-response-builder.js.map
+//# sourceMappingURL=sim-payload-2-response-builder.js.map

package/dist/serve/payload-2/sim-payload-2-response-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-payload-2-response-builder.js","sourceRoot":"","sources":["../../../src/serve/payload-2/sim-payload-2-response-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAM3E,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,0BAA0B;IACpB,YAAY,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAE9D;;OAEG;IACH,KAAK,CAAC,MAAe;QACnB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE;YACnC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,kBAAkB,CACxB,MAAe;QAEf,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,KAAK,IAAI;YACf,YAAY,IAAI,MAAM;YACtB,OAAQ,MAA4B,CAAC,UAAU,KAAK,QAAQ,CAC7D,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,MAAmC;QAC5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CACnC,MAAM,CAAC,IAAI,IAAI,EAAE,EACjB,MAAM,CAAC,eAAe,IAAI,KAAK,CAChC,CAAC;QAEF,OAAO,IAAI,QAAQ;QACjB,qEAAqE;QACrE,gDAAgD;QAChD,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAC/B;YACE,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,OAAO;SACR,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.d.ts

@@ -0,0 +1,29 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+import type { SimCognitoUserPoolRegistry } from "../../../cognito/registry/sim-cognito-user-pool-registry.js";
+import type { SimHttpApiJwtIssuerKeys } from "./sim-http-api-jwt-issuer-keys.js";
+interface SimCognitoHttpApiJwtIssuerKeysProperties {
+    readonly userPoolRegistry: SimCognitoUserPoolRegistry;
+}
+/**
+ * Simulated Cognito user pools as the issuers a JWT authorizer verifies
+ * against.
+ *
+ * All of the Cognito-shaped URL handling lives here rather than in API
+ * Gateway, which knows only that an authorizer names an issuer by URL. The
+ * registry spans simulated Accounts, matching an API Gateway authorizer that
+ * can name a pool in any Account.
+ */
+export declare class SimCognitoHttpApiJwtIssuerKeys implements SimHttpApiJwtIssuerKeys {
+    private readonly userPoolRegistry;
+    constructor(properties: SimCognitoHttpApiJwtIssuerKeysProperties);
+    /**
+     * The keys the pool this issuer URL names publishes.
+     *
+     * An issuer that is not a Cognito URL, names no pool this simulation has, or
+     * names one through another region's endpoint publishes nothing, and every
+     * token claiming it is refused.
+     */
+    publishedBy(issuerUrl: string): SimJwtKeys;
+}
+export {};
+//# sourceMappingURL=sim-cognito-http-api-jwt-issuer-keys.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-http-api-jwt-issuer-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAYjF,UAAU,wCAAwC;IAChD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAE9D,YAAY,UAAU,EAAE,wCAAwC,EAE/D;IAED;;;;;;OAMG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAczC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js

@@ -0,0 +1,43 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The issuer URL a simulated Cognito user pool's tokens name.
+ *
+ * The region appears twice, once in the hostname and once as the leading part
+ * of the pool id, and real Cognito only issues for a pool through its own
+ * region's endpoint. Both are captured so the two can be compared.
+ */
+const cognitoIssuerUrl = /^https:\/\/cognito-idp\.(?<hostRegion>[a-z0-9-]+)\.amazonaws\.com\/(?<poolId>(?<poolRegion>[a-z0-9-]+)_[A-Za-z0-9]+)$/;
+/**
+ * Simulated Cognito user pools as the issuers a JWT authorizer verifies
+ * against.
+ *
+ * All of the Cognito-shaped URL handling lives here rather than in API
+ * Gateway, which knows only that an authorizer names an issuer by URL. The
+ * registry spans simulated Accounts, matching an API Gateway authorizer that
+ * can name a pool in any Account.
+ */
+export class SimCognitoHttpApiJwtIssuerKeys {
+    userPoolRegistry;
+    constructor(properties) {
+        this.userPoolRegistry = properties.userPoolRegistry;
+    }
+    /**
+     * The keys the pool this issuer URL names publishes.
+     *
+     * An issuer that is not a Cognito URL, names no pool this simulation has, or
+     * names one through another region's endpoint publishes nothing, and every
+     * token claiming it is refused.
+     */
+    publishedBy(issuerUrl) {
+        const groups = cognitoIssuerUrl.exec(issuerUrl)?.groups;
+        if (groups === undefined || groups["hostRegion"] !== groups["poolRegion"]) {
+            return new SimJwtKeys([]);
+        }
+        const pool = this.userPoolRegistry.find(groups["poolId"] ?? "");
+        if (pool === undefined) {
+            return new SimJwtKeys([]);
+        }
+        return new SimJwtKeys(pool.jwks().keys);
+    }
+}
+//# sourceMappingURL=sim-cognito-http-api-jwt-issuer-keys.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-http-api-jwt-issuer-keys.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-cognito-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAIlE;;;;;;GAMG;AACH,MAAM,gBAAgB,GACpB,uHAAuH,CAAC;AAM1H;;;;;;;;GAQG;AACH,MAAM,OAAO,8BAA8B;IACxB,gBAAgB,CAA6B;IAE9D,YAAY,UAAoD;QAC9D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,SAAiB;QAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAExD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts

@@ -0,0 +1,66 @@
+import type { SimPayload2JwtAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+/**
+ * Why an endpoint refused a request, which decides the response it gets.
+ *
+ * `unauthorized` covers everything up to and including claim validation: real
+ * API Gateway answers all of it with one 401 and one body, so a client learns
+ * that its token was not accepted and nothing about which check it failed.
+ * `forbidden` is only ever an unmet route scope, which is a token that was
+ * accepted and does not allow this route.
+ */
+export type SimHttpApiRefusalKind = "unauthorized" | "forbidden";
+interface SimHttpApiAdmittedProperties {
+    /** The token a `JWT` route's authorizer accepted. */
+    readonly jwt?: SimPayload2JwtAuthorizer | undefined;
+    /** The principal an `AWS_IAM` route allowed the request. */
+    readonly caller?: SimAwsRequestCaller | undefined;
+}
+/**
+ * A request the endpoint admitted, and what its authorizer knows about the
+ * caller.
+ *
+ * Both members are absent on a route that authorizes nobody, since there is no
+ * caller to describe, which is what leaves `requestContext.authorizer` out of
+ * the event entirely. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export declare class SimHttpApiAdmitted {
+    readonly admitted: true;
+    readonly jwt: SimPayload2JwtAuthorizer | undefined;
+    readonly caller: SimAwsRequestCaller | undefined;
+    constructor(properties?: SimHttpApiAdmittedProperties);
+}
+/**
+ * A request the endpoint refused, before any integration was invoked.
+ *
+ * `errorDescription` is the one AWS publishes for a token whose audience does
+ * not match, and is absent everywhere else rather than filled in with text
+ * AWS was not seen to send.
+ *
+ * An `AWS_IAM` route refuses with `forbidden`, whoever the caller turned out
+ * to be: nothing about an unsigned request makes it a 401 here, because the
+ * boundary already resolved it to an anonymous caller and IAM then allows that
+ * caller nothing.
+ */
+export declare class SimHttpApiRefused {
+    readonly admitted: false;
+    readonly kind: SimHttpApiRefusalKind;
+    readonly errorDescription: string | undefined;
+    private constructor();
+    /**
+     * The token was missing, unreadable, or did not verify.
+     */
+    static unauthorized(errorDescription?: string): SimHttpApiRefused;
+    /**
+     * The token verified and none of its scopes is one the route asks for, or
+     * IAM did not allow the caller `execute-api:Invoke` on the route.
+     */
+    static forbidden(): SimHttpApiRefused;
+}
+/**
+ * What an endpoint decided about one request.
+ */
+export type SimHttpApiAuthorization = SimHttpApiAdmitted | SimHttpApiRefused;
+export {};
+//# sourceMappingURL=sim-http-api-authorization.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AACxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,WAAW,CAAC;AAEjE,UAAU,4BAA4B;IACpC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,GAAG,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAExD,YAAY,UAAU,GAAE,4BAAiC,EAGxD;CACF;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAErD,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEhE;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAEpC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}