@kensio/yulin 0.47.0 → 1.0.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js

@@ -0,0 +1,53 @@
+/**
+ * A request the endpoint admitted, and what its authorizer knows about the
+ * caller.
+ *
+ * Both members are absent on a route that authorizes nobody, since there is no
+ * caller to describe, which is what leaves `requestContext.authorizer` out of
+ * the event entirely. Which one is present says which kind of authorization
+ * admitted the request.
+ */
+export class SimHttpApiAdmitted {
+    admitted = true;
+    jwt;
+    caller;
+    constructor(properties = {}) {
+        this.jwt = properties.jwt;
+        this.caller = properties.caller;
+    }
+}
+/**
+ * A request the endpoint refused, before any integration was invoked.
+ *
+ * `errorDescription` is the one AWS publishes for a token whose audience does
+ * not match, and is absent everywhere else rather than filled in with text
+ * AWS was not seen to send.
+ *
+ * An `AWS_IAM` route refuses with `forbidden`, whoever the caller turned out
+ * to be: nothing about an unsigned request makes it a 401 here, because the
+ * boundary already resolved it to an anonymous caller and IAM then allows that
+ * caller nothing.
+ */
+export class SimHttpApiRefused {
+    admitted = false;
+    kind;
+    errorDescription;
+    constructor(kind, errorDescription) {
+        this.kind = kind;
+        this.errorDescription = errorDescription;
+    }
+    /**
+     * The token was missing, unreadable, or did not verify.
+     */
+    static unauthorized(errorDescription) {
+        return new SimHttpApiRefused("unauthorized", errorDescription);
+    }
+    /**
+     * The token verified and none of its scopes is one the route asks for, or
+     * IAM did not allow the caller `execute-api:Invoke` on the route.
+     */
+    static forbidden() {
+        return new SimHttpApiRefused("forbidden");
+    }
+}
+//# sourceMappingURL=sim-http-api-authorization.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAqBA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,GAAG,CAAuC;IAC1C,MAAM,CAAkC;IAExD,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAC5B,gBAAgB,CAAqB;IAErD,YAAoB,IAA2B,EAAE,gBAAyB;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAyB;QAC3C,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.d.ts

@@ -0,0 +1,31 @@
+import { type SimHttpApiAuthorizer, type SimHttpApiAuthorizerId } from "./sim-http-api-authorizer.js";
+/**
+ * The authorizers of one API, keyed by the id the API allocated for them.
+ *
+ * Authorizers belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimHttpApiAuthorizerStore {
+    private readonly authorizers;
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId(): SimHttpApiAuthorizerId;
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer: SimHttpApiAuthorizer): void;
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId: string): SimHttpApiAuthorizer | undefined;
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId: SimHttpApiAuthorizerId): void;
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list(): SimHttpApiAuthorizer[];
+}
+//# sourceMappingURL=sim-http-api-authorizer-store.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC5B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;OAEG;IACH,UAAU,IAAI,sBAAsB,CASnC;IAED;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAE1C;IAED;;OAEG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE3D;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAEjD;IAED;;OAEG;IACH,IAAI,IAAI,oBAAoB,EAAE,CAE7B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.js

@@ -0,0 +1,46 @@
+import { makeSimHttpApiAuthorizerId, } from "./sim-http-api-authorizer.js";
+/**
+ * The authorizers of one API, keyed by the id the API allocated for them.
+ *
+ * Authorizers belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimHttpApiAuthorizerStore {
+    authorizers = new Map();
+    /**
+     * Allocate an authorizer id this API is not already using.
+     */
+    allocateId() {
+        let authorizerId = makeSimHttpApiAuthorizerId();
+        while (this.authorizers.has(authorizerId)) {
+            /* v8 ignore next -- does not happen in practice */
+            authorizerId = makeSimHttpApiAuthorizerId();
+        }
+        return authorizerId;
+    }
+    /**
+     * Add an authorizer to this API.
+     */
+    add(authorizer) {
+        this.authorizers.set(authorizer.authorizerId, authorizer);
+    }
+    /**
+     * Find an authorizer by id.
+     */
+    find(authorizerId) {
+        return this.authorizers.get(authorizerId);
+    }
+    /**
+     * Forget a deleted authorizer.
+     */
+    remove(authorizerId) {
+        this.authorizers.delete(authorizerId);
+    }
+    /**
+     * List every authorizer of this API, in the order they were created.
+     */
+    list() {
+        return this.authorizers.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-store.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-store.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAG3B,MAAM,8BAA8B,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,OAAO,yBAAyB;IACnB,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAEhD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,mDAAmD;YACnD,YAAY,GAAG,0BAA0B,EAAE,CAAC;QAC9C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,UAAgC;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,YAAoB;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAsC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAoC;QACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts

@@ -0,0 +1,59 @@
+import type { Brand } from "../../../../util/brand.type.js";
+import type { SimHttpApiIdentitySource } from "./sim-http-api-identity-source.js";
+import type { SimHttpApiJwtConfiguration, SimHttpApiJwtConfigurationView } from "./sim-http-api-jwt-configuration.js";
+/**
+ * The id API Gateway allocates for one authorizer.
+ */
+export type SimHttpApiAuthorizerId = Brand<string, "SimHttpApiAuthorizerId">;
+/**
+ * The only authorizer type simulated.
+ *
+ * A Lambda `REQUEST` authorizer runs code of its own to make the decision, and
+ * none of that is simulated, so it is refused at creation rather than created
+ * and ignored.
+ */
+export type SimHttpApiAuthorizerType = "JWT";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a route id.
+ */
+export declare function makeSimHttpApiAuthorizerId(): SimHttpApiAuthorizerId;
+interface SimHttpApiAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+}
+/**
+ * Minimal structural authorizer view, as the Create and Get commands return.
+ */
+export interface SimHttpApiAuthorizerView {
+    AuthorizerId: string;
+    Name: string;
+    AuthorizerType: SimHttpApiAuthorizerType;
+    IdentitySource: string[];
+    JwtConfiguration: SimHttpApiJwtConfigurationView;
+}
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * An authorizer belongs to an API and is attached to routes by id, so one
+ * authorizer covers as many routes of the API as name it.
+ */
+export declare class SimHttpApiAuthorizer {
+    /**
+     * The type of authorizer this is, which is the only one simulated.
+     */
+    readonly authorizerType: SimHttpApiAuthorizerType;
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+    constructor(properties: SimHttpApiAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qCAAqC,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAE7C;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,wBAAwB,CAAC;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,EAAE,8BAA8B,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,SAAgB,cAAc,EAAE,wBAAwB,CAAS;IAEjE,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAE7D,YAAY,UAAU,EAAE,8BAA8B,EAKrD;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAQ/B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js

@@ -0,0 +1,43 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Allocate an authorizer id, in the same opaque shape as a route id.
+ */
+export function makeSimHttpApiAuthorizerId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{6}/);
+}
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * An authorizer belongs to an API and is attached to routes by id, so one
+ * authorizer covers as many routes of the API as name it.
+ */
+export class SimHttpApiAuthorizer {
+    /**
+     * The type of authorizer this is, which is the only one simulated.
+     */
+    authorizerType = "JWT";
+    authorizerId;
+    name;
+    identitySource;
+    jwtConfiguration;
+    constructor(properties) {
+        this.authorizerId = properties.authorizerId;
+        this.name = properties.name;
+        this.identitySource = properties.identitySource;
+        this.jwtConfiguration = properties.jwtConfiguration;
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            AuthorizerId: this.authorizerId,
+            Name: this.name,
+            AuthorizerType: this.authorizerType,
+            IdentitySource: [this.identitySource.expression],
+            JwtConfiguration: this.jwtConfiguration.view(),
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAuBxC;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AAoBD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACa,cAAc,GAA6B,KAAK,CAAC;IAEjD,YAAY,CAAyB;IACrC,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,gBAAgB,CAA6B;IAE7D,YAAY,UAA0C;QACpD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Where a JWT authorizer takes the token from.
+ *
+ * An identity source is a request mapping expression naming one header or one
+ * query string parameter. Anything else is refused rather than accepted and
+ * looked for nowhere, since a route whose authorizer never finds a token
+ * refuses every request, which looks like a signing problem rather than a
+ * configuration one.
+ */
+export declare class SimHttpApiIdentitySource {
+    /**
+     * The expression as it was written, which is what the API reports back.
+     */
+    readonly expression: string;
+    private readonly headerName;
+    private readonly queryStringName;
+    private constructor();
+    /**
+     * Read an identity source expression, or refuse it.
+     */
+    static parse(expression: string): SimHttpApiIdentitySource;
+    /**
+     * The token this request carries, if it carries one at all.
+     *
+     * An empty value is the same as no value here: real API Gateway has nothing
+     * to decode either way, and both answer the same 401.
+     */
+    token(request: Request): string | undefined;
+    private rawValue;
+}
+//# sourceMappingURL=sim-http-api-identity-source.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-source.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.ts"],"names":[],"mappings":"AAiBA;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,SAAgB,UAAU,EAAE,MAAM,CAAC;IAEnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IAErD,OAAO,eAQN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,CAmBzD;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAU1C;IAED,OAAO,CAAC,QAAQ;CAUjB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.js

@@ -0,0 +1,78 @@
+import { SimApiGatewayV2BadRequest } from "../../error/sim-api-gateway-v2.error.js";
+/**
+ * The two request mapping expressions an identity source is written with.
+ */
+const headerPrefix = "$request.header.";
+const queryStringPrefix = "$request.querystring.";
+/**
+ * The authorization scheme a bearer token is usually sent under.
+ *
+ * API Gateway takes the token with or without it, so it is stripped when it is
+ * there rather than required. The comparison is case-insensitive, since HTTP
+ * authorization schemes are.
+ */
+const bearerPrefix = /^bearer\s+/i;
+/**
+ * Where a JWT authorizer takes the token from.
+ *
+ * An identity source is a request mapping expression naming one header or one
+ * query string parameter. Anything else is refused rather than accepted and
+ * looked for nowhere, since a route whose authorizer never finds a token
+ * refuses every request, which looks like a signing problem rather than a
+ * configuration one.
+ */
+export class SimHttpApiIdentitySource {
+    /**
+     * The expression as it was written, which is what the API reports back.
+     */
+    expression;
+    headerName;
+    queryStringName;
+    constructor(properties) {
+        this.expression = properties.expression;
+        this.headerName = properties.headerName;
+        this.queryStringName = properties.queryStringName;
+    }
+    /**
+     * Read an identity source expression, or refuse it.
+     */
+    static parse(expression) {
+        if (expression.startsWith(headerPrefix)) {
+            return new SimHttpApiIdentitySource({
+                expression,
+                headerName: expression.slice(headerPrefix.length),
+            });
+        }
+        if (expression.startsWith(queryStringPrefix)) {
+            return new SimHttpApiIdentitySource({
+                expression,
+                queryStringName: expression.slice(queryStringPrefix.length),
+            });
+        }
+        throw new SimApiGatewayV2BadRequest(`IdentitySource '${expression}' is not simulated: an identity source ` +
+            `is '${headerPrefix}<name>' or '${queryStringPrefix}<name>'`);
+    }
+    /**
+     * The token this request carries, if it carries one at all.
+     *
+     * An empty value is the same as no value here: real API Gateway has nothing
+     * to decode either way, and both answer the same 401.
+     */
+    token(request) {
+        const value = this.rawValue(request);
+        if (value === undefined) {
+            return undefined;
+        }
+        const token = value.replace(bearerPrefix, "").trim();
+        return token.length === 0 ? undefined : token;
+    }
+    rawValue(request) {
+        if (this.headerName !== undefined) {
+            return request.headers.get(this.headerName) ?? undefined;
+        }
+        /* v8 ignore next -- one of the two names is always set by the parser */
+        const name = this.queryStringName ?? "";
+        return new URL(request.url).searchParams.get(name) ?? undefined;
+    }
+}
+//# sourceMappingURL=sim-http-api-identity-source.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-identity-source.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAEpF;;GAEG;AACH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IACnC;;OAEG;IACa,UAAU,CAAS;IAElB,UAAU,CAAqB;IAC/B,eAAe,CAAqB;IAErD,YAAoB,UAInB;QACC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,UAAkB;QAC7B,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,wBAAwB,CAAC;gBAClC,UAAU;gBACV,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,wBAAwB,CAAC;gBAClC,UAAU;gBACV,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,mBAAmB,UAAU,yCAAyC;YACpE,OAAO,YAAY,eAAe,iBAAiB,SAAS,CAC/D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAgB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAErC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,CAAC;IAEO,QAAQ,CAAC,OAAgB;QAC/B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAC3D,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;QAExC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClE,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.d.ts

@@ -0,0 +1,60 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimJwtClaims } from "../../../../util/jwt/sim-jwt-claims.js";
+import { SimHttpApiRefused } from "./sim-http-api-authorization.js";
+import type { SimHttpApiJwtConfiguration } from "./sim-http-api-jwt-configuration.js";
+/**
+ * The only description AWS publishes for a refused token.
+ *
+ * Every other refusal here sends no description at all, rather than text AWS
+ * was not seen to send.
+ */
+export declare const simHttpApiInvalidAudience = "the token does not have a valid audience";
+interface SimHttpApiJwtClaimChecksProperties {
+    readonly clock: SimClock;
+}
+/**
+ * The claim validation a JWT authorizer does once a token's signature is known
+ * to be genuine.
+ *
+ * The order is the one AWS documents: the issuer, then the audience, then the
+ * time claims. It is only visible in which description a refusal carries,
+ * since every one of them answers the same 401.
+ *
+ * The time claims are compared with no allowance for clock skew. That is what
+ * makes advancing the simulation's clock past a token's `exp` turn an accepted
+ * request into a refused one with nothing else changed.
+ */
+export declare class SimHttpApiJwtClaimChecks {
+    private readonly clock;
+    constructor(properties: SimHttpApiJwtClaimChecksProperties);
+    /**
+     * Check the claims of a verified token, answering the refusal to send when
+     * one of them does not hold.
+     */
+    check(claims: SimJwtClaims, configuration: SimHttpApiJwtConfiguration): SimHttpApiRefused | undefined;
+    /**
+     * The audiences a token claims.
+     *
+     * `client_id` is consulted only when there is no `aud` claim at all, which
+     * is what makes an access token bound to a resource server fail rather than
+     * fall back to the app client it was issued to. An `aud` holding something
+     * that is not a string or a list of them claims no audience, rather than
+     * being read past.
+     */
+    private claimedAudience;
+    /**
+     * Check `exp`, `nbf` and `iat` against the simulation's clock.
+     *
+     * A token with no `exp` is refused rather than treated as one that never
+     * expires: real Cognito always sets it, and admitting a token nothing can
+     * expire is the divergence worth failing on.
+     */
+    private checkTimes;
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    private isBefore;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-claim-checks.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claim-checks.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,6CACM,CAAC;AAE7C,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,kCAAkC,EAEzD;IAED;;;OAGG;IACH,KAAK,CACH,MAAM,EAAE,YAAY,EACpB,aAAa,EAAE,0BAA0B,GACxC,iBAAiB,GAAG,SAAS,CAU/B;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAmBlB;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.js

@@ -0,0 +1,84 @@
+import { SimHttpApiRefused } from "./sim-http-api-authorization.js";
+/**
+ * The only description AWS publishes for a refused token.
+ *
+ * Every other refusal here sends no description at all, rather than text AWS
+ * was not seen to send.
+ */
+export const simHttpApiInvalidAudience = "the token does not have a valid audience";
+/**
+ * The claim validation a JWT authorizer does once a token's signature is known
+ * to be genuine.
+ *
+ * The order is the one AWS documents: the issuer, then the audience, then the
+ * time claims. It is only visible in which description a refusal carries,
+ * since every one of them answers the same 401.
+ *
+ * The time claims are compared with no allowance for clock skew. That is what
+ * makes advancing the simulation's clock past a token's `exp` turn an accepted
+ * request into a refused one with nothing else changed.
+ */
+export class SimHttpApiJwtClaimChecks {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Check the claims of a verified token, answering the refusal to send when
+     * one of them does not hold.
+     */
+    check(claims, configuration) {
+        if (!configuration.trustsIssuer(claims.text("iss"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (!configuration.acceptsAudience(this.claimedAudience(claims))) {
+            return SimHttpApiRefused.unauthorized(simHttpApiInvalidAudience);
+        }
+        return this.checkTimes(claims);
+    }
+    /**
+     * The audiences a token claims.
+     *
+     * `client_id` is consulted only when there is no `aud` claim at all, which
+     * is what makes an access token bound to a resource server fail rather than
+     * fall back to the app client it was issued to. An `aud` holding something
+     * that is not a string or a list of them claims no audience, rather than
+     * being read past.
+     */
+    claimedAudience(claims) {
+        if (claims.has("aud")) {
+            return claims.textList("aud") ?? [];
+        }
+        const clientId = claims.text("client_id");
+        return clientId === undefined ? [] : [clientId];
+    }
+    /**
+     * Check `exp`, `nbf` and `iat` against the simulation's clock.
+     *
+     * A token with no `exp` is refused rather than treated as one that never
+     * expires: real Cognito always sets it, and admitting a token nothing can
+     * expire is the divergence worth failing on.
+     */
+    checkTimes(claims) {
+        const now = Math.floor(this.clock.now().getTime() / 1000);
+        const expiresAt = claims.number("exp");
+        if (expiresAt === undefined || now >= expiresAt) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.isBefore(now, claims.number("nbf"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (this.isBefore(now, claims.number("iat"))) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return undefined;
+    }
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    isBefore(now, claimed) {
+        return claimed !== undefined && now < claimed;
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-claim-checks.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claim-checks.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claim-checks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,0CAA0C,CAAC;AAM7C;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAClB,KAAK,CAAW;IAEjC,YAAY,UAA8C;QACxD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CACH,MAAoB,EACpB,aAAyC;QAEzC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,iBAAiB,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,MAAoB;QAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE1C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,MAAoB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,GAAW,EAAE,OAA2B;QACvD,OAAO,OAAO,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC;IAChD,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.d.ts

@@ -0,0 +1,34 @@
+import type { SimPayload2JwtAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import { type SimJwtClaims } from "../../../../util/jwt/sim-jwt-claims.js";
+/**
+ * The claims of an accepted token, as they reach the handler.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. And
+ * `scopes` is null, not an empty list, when the token carries no scope claim.
+ */
+export declare class SimHttpApiJwtClaims {
+    private readonly claims;
+    constructor(claims: SimJwtClaims);
+    /**
+     * The `requestContext.authorizer.jwt` block for this token.
+     */
+    toAuthorizerContext(): SimPayload2JwtAuthorizer;
+    /**
+     * The scopes this token claims, or null when it claims none.
+     */
+    scopes(): string[] | null;
+    private claimedScopes;
+    private claimStrings;
+    /**
+     * One claim value as the string the handler receives.
+     *
+     * A nested object claim is JSON-encoded, which is the one shape here that
+     * was not observed on real AWS: no simulated issuer emits one, and neither
+     * does Cognito.
+     */
+    private claimString;
+}
+//# sourceMappingURL=sim-http-api-jwt-claims.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claims.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AACxG,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,wCAAwC,CAAC;AAUhD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,YAAY,MAAM,EAAE,YAAY,EAE/B;IAED;;OAEG;IACH,mBAAmB,IAAI,wBAAwB,CAE9C;IAED;;OAEG;IACH,MAAM,IAAI,MAAM,EAAE,GAAG,IAAI,CAUxB;IAED,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IASpB;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;CAepB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.js

@@ -0,0 +1,75 @@
+import { isSimJwtClaimList, } from "../../../../util/jwt/sim-jwt-claims.js";
+/**
+ * The claims a scope can be written in.
+ *
+ * `scope` is what an OAuth 2.0 access token carries, and `scp` is what some
+ * issuers use instead. Cognito writes `scope`.
+ */
+const scopeClaimNames = ["scope", "scp"];
+/**
+ * The claims of an accepted token, as they reach the handler.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. And
+ * `scopes` is null, not an empty list, when the token carries no scope claim.
+ */
+export class SimHttpApiJwtClaims {
+    claims;
+    constructor(claims) {
+        this.claims = claims;
+    }
+    /**
+     * The `requestContext.authorizer.jwt` block for this token.
+     */
+    toAuthorizerContext() {
+        return { claims: this.claimStrings(), scopes: this.scopes() };
+    }
+    /**
+     * The scopes this token claims, or null when it claims none.
+     */
+    scopes() {
+        for (const name of scopeClaimNames) {
+            const claimed = this.claimedScopes(name);
+            if (claimed !== undefined) {
+                return claimed;
+            }
+        }
+        return null;
+    }
+    claimedScopes(name) {
+        const text = this.claims.text(name);
+        if (text !== undefined) {
+            return text.split(/\s+/).filter((scope) => scope.length > 0);
+        }
+        const list = this.claims.textList(name);
+        return list === undefined ? undefined : [...list];
+    }
+    claimStrings() {
+        return Object.fromEntries(Object.entries(this.claims.toRecord()).map(([name, value]) => [
+            name,
+            this.claimString(value),
+        ]));
+    }
+    /**
+     * One claim value as the string the handler receives.
+     *
+     * A nested object claim is JSON-encoded, which is the one shape here that
+     * was not observed on real AWS: no simulated issuer emits one, and neither
+     * does Cognito.
+     */
+    claimString(value) {
+        if (typeof value === "string") {
+            return value;
+        }
+        if (isSimJwtClaimList(value)) {
+            return `[${value.map((entry) => this.claimString(entry)).join(" ")}]`;
+        }
+        if (typeof value === "object" && value !== null) {
+            return JSON.stringify(value);
+        }
+        return String(value);
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-claims.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claims.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,GAGlB,MAAM,wCAAwC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAe;IAEtC,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAEzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY;QAClB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC5D,IAAI;YACJ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;SACxB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,KAAuB;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;CACF"}