@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-pointer.js

@@ -0,0 +1,49 @@
+/**
+ * An RFC 6901 JSON pointer into the document being imported.
+ *
+ * Every refusal names one, so a reader can find the member in their own
+ * document rather than in a paraphrase of it. Pointers are built up as the
+ * readers descend, so a member inside an operation carries the whole route to
+ * itself:
+ *
+ *   #/paths/~1orders~1{orderId}/get/x-amazon-apigateway-integration/uri
+ */
+export class SimHttpApiOpenApiPointer {
+    tokens;
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+    /**
+     * The pointer to the document itself.
+     */
+    static root() {
+        return new SimHttpApiOpenApiPointer([]);
+    }
+    /**
+     * The pointer to a member of whatever this one points at.
+     */
+    child(token) {
+        return new SimHttpApiOpenApiPointer([...this.tokens, token]);
+    }
+    /**
+     * The pointer written as RFC 6901 writes it, in the URI fragment form, with
+     * `~` escaped as `~0` and `/` as `~1`. A path template is therefore
+     * `~1orders~1{orderId}` rather than the path itself.
+     */
+    toString() {
+        return ["#", ...this.tokens.map((token) => escapeToken(token))].join("/");
+    }
+}
+/**
+ * Escape the two characters RFC 6901 gives a meaning to inside a token.
+ */
+function escapeToken(token) {
+    return token.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+/**
+ * Read back a token of a pointer written in a `$ref`.
+ */
+export function simHttpApiOpenApiUnescapeToken(token) {
+    return token.replaceAll("~1", "/").replaceAll("~0", "~");
+}
+//# sourceMappingURL=sim-http-api-openapi-pointer.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-pointer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-pointer.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-pointer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,wBAAwB;IAClB,MAAM,CAAoB;IAE3C,YAAoB,MAAyB;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI;QACT,OAAO,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAa;QACjB,OAAO,IAAI,wBAAwB,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACH,QAAQ;QACN,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;CACF;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.d.ts

@@ -0,0 +1,11 @@
+import { SimApiGatewayV2BadRequest } from "../error/sim-api-gateway-v2.error.js";
+import type { SimHttpApiOpenApiPointer } from "./sim-http-api-openapi-pointer.js";
+/**
+ * Refuse a member of the document being imported, naming where it is.
+ *
+ * Every refusal an import makes is one of these, including the ones the
+ * ordinary commands make about an input the document produced, so a reader
+ * always has a pointer to follow into their own document.
+ */
+export declare function simHttpApiOpenApiRefusal(pointer: SimHttpApiOpenApiPointer, reason: string): SimApiGatewayV2BadRequest;
+//# sourceMappingURL=sim-http-api-openapi-refusal.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-refusal.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,MAAM,GACb,yBAAyB,CAI3B"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.js

@@ -0,0 +1,12 @@
+import { SimApiGatewayV2BadRequest } from "../error/sim-api-gateway-v2.error.js";
+/**
+ * Refuse a member of the document being imported, naming where it is.
+ *
+ * Every refusal an import makes is one of these, including the ones the
+ * ordinary commands make about an input the document produced, so a reader
+ * always has a pointer to follow into their own document.
+ */
+export function simHttpApiOpenApiRefusal(pointer, reason) {
+    return new SimApiGatewayV2BadRequest(`ImportApi refused ${pointer.toString()}: ${reason}`);
+}
+//# sourceMappingURL=sim-http-api-openapi-refusal.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-refusal.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAGjF;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAiC,EACjC,MAAc;IAEd,OAAO,IAAI,yBAAyB,CAClC,qBAAqB,OAAO,CAAC,QAAQ,EAAE,KAAK,MAAM,EAAE,CACrD,CAAC;AACJ,CAAC"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.d.ts

@@ -0,0 +1,21 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+/**
+ * An `x-amazon-apigateway-authorizer` of `type: request`, read into the
+ * CreateAuthorizer input it asks for.
+ *
+ * The values are handed to CreateAuthorizer as the document wrote them, so what
+ * a Lambda `REQUEST` authorizer requires is stated where an SDK caller and a
+ * template already meet it. That covers the function URI, and an
+ * `authorizerPayloadFormatVersion` of `1.0`, which builds a different event and
+ * is refused across this simulation.
+ */
+export declare class SimHttpApiOpenApiRequestAuthorizerScheme {
+    private readonly authorizer;
+    constructor(authorizer: SimHttpApiOpenApiObject);
+    /**
+     * The CreateAuthorizer input this authorizer asks for.
+     */
+    createAuthorizerInput(apiId: string, name: string): SimCreateAuthorizerCommandInput;
+}
+//# sourceMappingURL=sim-http-api-openapi-request-authorizer-scheme.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-request-authorizer-scheme.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAiBhF;;;;;;;;;GASG;AACH,qBAAa,wCAAwC;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IAErD,YAAY,UAAU,EAAE,uBAAuB,EAE9C;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,+BAA+B,CAyBjC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.js

@@ -0,0 +1,51 @@
+import { SimHttpApiOpenApiIdentitySource } from "./sim-http-api-openapi-identity-source.js";
+const authorizerCredentials = "names an IAM Role for API Gateway to assume before invoking the authorizer " +
+    "function, and nothing here assumes one: the function's own resource policy " +
+    "is what admits the call";
+/**
+ * The members that belong to a REST API's authorizers rather than an HTTP
+ * API's, refused rather than ignored so a document written for a REST API does
+ * not import as something quieter than it says.
+ */
+const restOnlyMembers = ["identityValidationExpression", "providerARNs"];
+const restOnly = "configures a REST API authorizer, and an HTTP API applies none of it";
+/**
+ * An `x-amazon-apigateway-authorizer` of `type: request`, read into the
+ * CreateAuthorizer input it asks for.
+ *
+ * The values are handed to CreateAuthorizer as the document wrote them, so what
+ * a Lambda `REQUEST` authorizer requires is stated where an SDK caller and a
+ * template already meet it. That covers the function URI, and an
+ * `authorizerPayloadFormatVersion` of `1.0`, which builds a different event and
+ * is refused across this simulation.
+ */
+export class SimHttpApiOpenApiRequestAuthorizerScheme {
+    authorizer;
+    constructor(authorizer) {
+        this.authorizer = authorizer;
+    }
+    /**
+     * The CreateAuthorizer input this authorizer asks for.
+     */
+    createAuthorizerInput(apiId, name) {
+        this.authorizer.refuseMember("authorizerCredentials", authorizerCredentials);
+        this.authorizer.refuseMembers(restOnlyMembers, restOnly);
+        return {
+            ApiId: apiId,
+            Name: name,
+            AuthorizerType: "REQUEST",
+            IdentitySource: new SimHttpApiOpenApiIdentitySource(this.authorizer).all(),
+            AuthorizerUri: this.authorizer.member("authorizerUri").optionalString(),
+            AuthorizerPayloadFormatVersion: this.authorizer
+                .member("authorizerPayloadFormatVersion")
+                .optionalString(),
+            EnableSimpleResponses: this.authorizer
+                .member("enableSimpleResponses")
+                .optionalBoolean(),
+            AuthorizerResultTtlInSeconds: this.authorizer
+                .member("authorizerResultTtlInSeconds")
+                .optionalNumber(),
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-request-authorizer-scheme.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-request-authorizer-scheme.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-request-authorizer-scheme.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAG5F,MAAM,qBAAqB,GACzB,6EAA6E;IAC7E,6EAA6E;IAC7E,yBAAyB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;AAEzE,MAAM,QAAQ,GACZ,sEAAsE,CAAC;AAEzE;;;;;;;;;GASG;AACH,MAAM,OAAO,wCAAwC;IAClC,UAAU,CAA0B;IAErD,YAAY,UAAmC;QAC7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAa,EACb,IAAY;QAEZ,IAAI,CAAC,UAAU,CAAC,YAAY,CAC1B,uBAAuB,EACvB,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEzD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,IAAI,+BAA+B,CACjD,IAAI,CAAC,UAAU,CAChB,CAAC,GAAG,EAAE;YACP,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,cAAc,EAAE;YACvE,8BAA8B,EAAE,IAAI,CAAC,UAAU;iBAC5C,MAAM,CAAC,gCAAgC,CAAC;iBACxC,cAAc,EAAE;YACnB,qBAAqB,EAAE,IAAI,CAAC,UAAU;iBACnC,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,eAAe,EAAE;YACpB,4BAA4B,EAAE,IAAI,CAAC,UAAU;iBAC1C,MAAM,CAAC,8BAA8B,CAAC;iBACtC,cAAc,EAAE;SACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.d.ts

@@ -0,0 +1,44 @@
+import type { SimHttpApiAuthorizerCommands } from "../command/authorizer/sim-http-api-authorizer-commands.js";
+import type { SimCreateRouteCommandInput } from "../command/route/route.command.js";
+import type { SimHttpApiOpenApiCommand } from "./sim-http-api-openapi-command.js";
+import type { SimHttpApiOpenApiOperation } from "./sim-http-api-openapi-operation.js";
+import type { SimHttpApiOpenApiSecuritySchemes } from "./sim-http-api-openapi-security-schemes.js";
+/**
+ * The authorization a route created from a document asks for.
+ */
+export type SimHttpApiOpenApiRouteAuthorization = Pick<SimCreateRouteCommandInput, "AuthorizationType" | "AuthorizerId" | "AuthorizationScopes">;
+interface SimHttpApiOpenApiAuthorizationProperties {
+    readonly authorizerCommands: SimHttpApiAuthorizerCommands;
+    readonly command: SimHttpApiOpenApiCommand;
+}
+/**
+ * Turns an operation's security requirement into the authorization its route
+ * is created with, creating the authorizer the requirement names.
+ *
+ * An operation with no requirement is open, which is what an imported route
+ * with no authorizer is on AWS.
+ */
+export declare class SimHttpApiOpenApiAuthorization {
+    private readonly authorizerCommands;
+    private readonly command;
+    constructor(properties: SimHttpApiOpenApiAuthorizationProperties);
+    /**
+     * How the route one operation becomes says who may call it.
+     */
+    of(apiId: string, operation: SimHttpApiOpenApiOperation, schemes: SimHttpApiOpenApiSecuritySchemes): SimHttpApiOpenApiRouteAuthorization;
+    /**
+     * Create the authorizer a requirement's scheme declares, remembering it for
+     * the next operation naming the same scheme.
+     */
+    private create;
+    /**
+     * A route the named authorizer decides, of the type that authorizer is.
+     *
+     * A Lambda `REQUEST` authorizer makes a `CUSTOM` route, and the requirement's
+     * scopes go with it rather than being dropped: AWS applies route scopes to a
+     * `JWT` route only, so CreateRoute refuses them here.
+     */
+    private authorization;
+}
+export {};
+//# sourceMappingURL=sim-http-api-openapi-route-authorization.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-route-authorization.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AAC9G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EACV,0BAA0B,EAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAEnG;;GAEG;AACH,MAAM,MAAM,mCAAmC,GAAG,IAAI,CACpD,0BAA0B,EAC1B,mBAAmB,GAAG,cAAc,GAAG,qBAAqB,CAC7D,CAAC;AAEF,UAAU,wCAAwC;IAChD,QAAQ,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA+B;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IAEnD,YAAY,UAAU,EAAE,wCAAwC,EAG/D;IAED;;OAEG;IACH,EAAE,CACA,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,0BAA0B,EACrC,OAAO,EAAE,gCAAgC,GACxC,mCAAmC,CAgBrC;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;IAcd;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;CAkBtB"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.js

@@ -0,0 +1,62 @@
+/**
+ * Turns an operation's security requirement into the authorization its route
+ * is created with, creating the authorizer the requirement names.
+ *
+ * An operation with no requirement is open, which is what an imported route
+ * with no authorizer is on AWS.
+ */
+export class SimHttpApiOpenApiAuthorization {
+    authorizerCommands;
+    command;
+    constructor(properties) {
+        this.authorizerCommands = properties.authorizerCommands;
+        this.command = properties.command;
+    }
+    /**
+     * How the route one operation becomes says who may call it.
+     */
+    of(apiId, operation, schemes) {
+        const requirement = operation.security();
+        if (requirement === undefined) {
+            return { AuthorizationType: "NONE" };
+        }
+        const shared = schemes.createdAuthorizer(requirement.schemeName);
+        if (shared !== undefined) {
+            return this.authorization(shared, requirement.scopes);
+        }
+        const created = this.create(apiId, requirement, schemes);
+        return this.authorization(created, requirement.scopes);
+    }
+    /**
+     * Create the authorizer a requirement's scheme declares, remembering it for
+     * the next operation naming the same scheme.
+     */
+    create(apiId, requirement, schemes) {
+        const input = schemes.authorizerInput(apiId, requirement);
+        const created = this.command.run(requirement.value.pointer, () => this.authorizerCommands.createAuthorizer({ input }));
+        schemes.remember(requirement.schemeName, created);
+        return created;
+    }
+    /**
+     * A route the named authorizer decides, of the type that authorizer is.
+     *
+     * A Lambda `REQUEST` authorizer makes a `CUSTOM` route, and the requirement's
+     * scopes go with it rather than being dropped: AWS applies route scopes to a
+     * `JWT` route only, so CreateRoute refuses them here.
+     */
+    authorization(authorizer, scopes) {
+        if (authorizer.AuthorizerType === "REQUEST") {
+            return {
+                AuthorizationType: "CUSTOM",
+                AuthorizerId: authorizer.AuthorizerId,
+                AuthorizationScopes: scopes,
+            };
+        }
+        return {
+            AuthorizationType: "JWT",
+            AuthorizerId: authorizer.AuthorizerId,
+            AuthorizationScopes: scopes,
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-route-authorization.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-route-authorization.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-route-authorization.ts"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IACxB,kBAAkB,CAA+B;IACjD,OAAO,CAA2B;IAEnD,YAAY,UAAoD;QAC9D,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,EAAE,CACA,KAAa,EACb,SAAqC,EACrC,OAAyC;QAEzC,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;QAEzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAEjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAEzD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,KAAa,EACb,WAAiD,EACjD,OAAyC;QAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAC/D,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CACnB,UAAoC,EACpC,MAAyB;QAEzB,IAAI,UAAU,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO;gBACL,iBAAiB,EAAE,QAAQ;gBAC3B,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,mBAAmB,EAAE,MAAM;aAC5B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,KAAK;YACxB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,mBAAmB,EAAE,MAAM;SAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.d.ts

@@ -0,0 +1,29 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+/**
+ * One `components.securitySchemes` member, read into the CreateAuthorizer
+ * input the operations naming it ask for.
+ *
+ * Which of the two kinds of authorizer a scheme carries is decided here, and
+ * reading each kind is the class named after it. A scheme whose type and
+ * whose extension disagree is refused rather than resolved either way.
+ */
+export declare class SimHttpApiOpenApiSecurityScheme {
+    private readonly scheme;
+    constructor(scheme: SimHttpApiOpenApiObject);
+    /**
+     * The CreateAuthorizer input this scheme asks for.
+     */
+    createAuthorizerInput(apiId: string, name: string): SimCreateAuthorizerCommandInput;
+    /**
+     * The kind of authorizer this scheme's own type declares, refusing every
+     * scheme type an HTTP API route cannot use.
+     */
+    private authorizerType;
+    /**
+     * The `x-amazon-apigateway-authorizer` this scheme carries, refusing one of a
+     * kind the scheme's own type does not declare.
+     */
+    private authorizer;
+}
+//# sourceMappingURL=sim-http-api-openapi-security-scheme.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AA0BhF;;;;;;;GAOG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,+BAA+B,CAajC;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IAoBtB;;;OAGG;IACH,OAAO,CAAC,UAAU;CAiBnB"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.js

@@ -0,0 +1,82 @@
+import { SimHttpApiOpenApiJwtAuthorizerScheme } from "./sim-http-api-openapi-jwt-authorizer-scheme.js";
+import { SimHttpApiOpenApiRequestAuthorizerScheme } from "./sim-http-api-openapi-request-authorizer-scheme.js";
+/**
+ * The security scheme types that are not a JWT authorizer.
+ *
+ * `openIdConnect` is refused rather than read. AWS finds the issuer by
+ * fetching the discovery document at `openIdConnectUrl`, and nothing here
+ * fetches anything over HTTP, so the URL itself would end up as the issuer and
+ * every token would fail its `iss` check with a silent 401.
+ */
+const openIdConnect = "AWS reads the issuer out of the discovery document published at " +
+    "openIdConnectUrl, and nothing here is fetched over HTTP. Declare the " +
+    "scheme as oauth2 with an explicit jwtConfiguration.issuer instead.";
+/**
+ * The `x-amazon-apigateway-authorizer` type each security scheme type carries,
+ * which is what AWS documents for an HTTP API: a JWT authorizer under `oauth2`,
+ * and a Lambda `REQUEST` authorizer under `apiKey`.
+ */
+const authorizerTypes = new Map([
+    ["oauth2", "jwt"],
+    ["apiKey", "request"],
+]);
+/**
+ * One `components.securitySchemes` member, read into the CreateAuthorizer
+ * input the operations naming it ask for.
+ *
+ * Which of the two kinds of authorizer a scheme carries is decided here, and
+ * reading each kind is the class named after it. A scheme whose type and
+ * whose extension disagree is refused rather than resolved either way.
+ */
+export class SimHttpApiOpenApiSecurityScheme {
+    scheme;
+    constructor(scheme) {
+        this.scheme = scheme;
+    }
+    /**
+     * The CreateAuthorizer input this scheme asks for.
+     */
+    createAuthorizerInput(apiId, name) {
+        const authorizerType = this.authorizerType();
+        const authorizer = this.authorizer(authorizerType);
+        if (authorizerType === "request") {
+            return new SimHttpApiOpenApiRequestAuthorizerScheme(authorizer).createAuthorizerInput(apiId, name);
+        }
+        return new SimHttpApiOpenApiJwtAuthorizerScheme(authorizer).createAuthorizerInput(apiId, name);
+    }
+    /**
+     * The kind of authorizer this scheme's own type declares, refusing every
+     * scheme type an HTTP API route cannot use.
+     */
+    authorizerType() {
+        const declared = this.scheme.member("type");
+        const schemeType = declared.requiredString();
+        if (schemeType === "openIdConnect") {
+            throw declared.refusal(openIdConnect);
+        }
+        const authorizerType = authorizerTypes.get(schemeType);
+        if (authorizerType === undefined) {
+            throw declared.refusal(`is '${schemeType}', and an HTTP API declares a JWT authorizer under ` +
+                `oauth2 and a Lambda REQUEST authorizer under apiKey`);
+        }
+        return authorizerType;
+    }
+    /**
+     * The `x-amazon-apigateway-authorizer` this scheme carries, refusing one of a
+     * kind the scheme's own type does not declare.
+     */
+    authorizer(authorizerType) {
+        const authorizer = this.scheme
+            .member("x-amazon-apigateway-authorizer")
+            .object();
+        const declared = authorizer.member("type");
+        const declaredType = declared.requiredString();
+        if (declaredType !== authorizerType) {
+            throw declared.refusal(`is '${declaredType}', and the security scheme carrying it declares a ` +
+                `'${authorizerType}' authorizer. A JWT authorizer and a Lambda ` +
+                `REQUEST authorizer are the two an HTTP API has.`);
+        }
+        return authorizer;
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-security-scheme.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-scheme.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-scheme.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oCAAoC,EAAE,MAAM,iDAAiD,CAAC;AAEvG,OAAO,EAAE,wCAAwC,EAAE,MAAM,qDAAqD,CAAC;AAE/G;;;;;;;GAOG;AACH,MAAM,aAAa,GACjB,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE,CAAC;AAEvE;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,CAAC,QAAQ,EAAE,KAAK,CAAC;IACjB,CAAC,QAAQ,EAAE,SAAS,CAAC;CACtB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAA0B;IAEjD,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,qBAAqB,CACnB,KAAa,EACb,IAAY;QAEZ,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAEnD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,wCAAwC,CACjD,UAAU,CACX,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,oCAAoC,CAC7C,UAAU,CACX,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,cAAc;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE7C,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,QAAQ,CAAC,OAAO,CACpB,OAAO,UAAU,qDAAqD;gBACpE,qDAAqD,CACxD,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,cAAsB;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;aAC3B,MAAM,CAAC,gCAAgC,CAAC;aACxC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE/C,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,QAAQ,CAAC,OAAO,CACpB,OAAO,YAAY,oDAAoD;gBACrE,IAAI,cAAc,8CAA8C;gBAChE,iDAAiD,CACpD,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.d.ts

@@ -0,0 +1,40 @@
+import type { SimHttpApiAuthorizerView } from "../api/authorizer/sim-http-api-authorizer.js";
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimHttpApiOpenApiSecurityRequirement } from "./sim-http-api-openapi-operation.js";
+import type { SimHttpApiOpenApiValue } from "./sim-http-api-openapi-value.js";
+interface SimHttpApiOpenApiSecuritySchemesProperties {
+    readonly schemes: SimHttpApiOpenApiValue;
+}
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every operation naming
+ * it, which is what an HTTP API has: an authorizer belongs to the API rather
+ * than to a route. A scheme nothing names creates nothing, so it is never read
+ * and never refused.
+ */
+export declare class SimHttpApiOpenApiSecuritySchemes {
+    private readonly schemes;
+    private readonly created;
+    constructor(properties: SimHttpApiOpenApiSecuritySchemesProperties);
+    /**
+     * The CreateAuthorizer input the scheme a requirement names asks for.
+     */
+    authorizerInput(apiId: string, requirement: SimHttpApiOpenApiSecurityRequirement): SimCreateAuthorizerCommandInput;
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName: string): SimHttpApiAuthorizerView | undefined;
+    /**
+     * Remember the authorizer created for a scheme, so the next operation naming
+     * it shares that one.
+     */
+    remember(schemeName: string, authorizer: SimHttpApiAuthorizerView): void;
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    private scheme;
+}
+export {};
+//# sourceMappingURL=sim-http-api-openapi-security-schemes.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-schemes.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAEhG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE9E,UAAU,0CAA0C;IAClD,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+C;IAEvE,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,oCAAoC,GAChD,+BAA+B,CAMjC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAE1E;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAEvE;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;CAcf"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.js

@@ -0,0 +1,49 @@
+import { SimHttpApiOpenApiSecurityScheme } from "./sim-http-api-openapi-security-scheme.js";
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every operation naming
+ * it, which is what an HTTP API has: an authorizer belongs to the API rather
+ * than to a route. A scheme nothing names creates nothing, so it is never read
+ * and never refused.
+ */
+export class SimHttpApiOpenApiSecuritySchemes {
+    schemes;
+    created = new Map();
+    constructor(properties) {
+        this.schemes = properties.schemes;
+    }
+    /**
+     * The CreateAuthorizer input the scheme a requirement names asks for.
+     */
+    authorizerInput(apiId, requirement) {
+        const scheme = new SimHttpApiOpenApiSecurityScheme(this.scheme(requirement));
+        return scheme.createAuthorizerInput(apiId, requirement.schemeName);
+    }
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName) {
+        return this.created.get(schemeName);
+    }
+    /**
+     * Remember the authorizer created for a scheme, so the next operation naming
+     * it shares that one.
+     */
+    remember(schemeName, authorizer) {
+        this.created.set(schemeName, authorizer);
+    }
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    scheme(requirement) {
+        const schemes = this.schemes.optionalObject();
+        if (schemes?.has(requirement.schemeName) !== true) {
+            throw requirement.value.refusal(`names the security scheme '${requirement.schemeName}', which ` +
+                `${this.schemes.pointer.toString()} does not define`);
+        }
+        return schemes.member(requirement.schemeName).object();
+    }
+}
+//# sourceMappingURL=sim-http-api-openapi-security-schemes.js.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-security-schemes.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAO5F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IAC1B,OAAO,CAAyB;IAChC,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEvE,YAAY,UAAsD;QAChE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,eAAe,CACb,KAAa,EACb,WAAiD;QAEjD,MAAM,MAAM,GAAG,IAAI,+BAA+B,CAChD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CACzB,CAAC;QAEF,OAAO,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAoC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,WAAiD;QAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAC7B,8BAA8B,WAAW,CAAC,UAAU,WAAW;gBAC7D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;CACF"}

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.d.ts

@@ -0,0 +1,65 @@
+import type { JSONValue } from "../../../util/type-guard/json.js";
+import type { SimApiGatewayV2BadRequest } from "../error/sim-api-gateway-v2.error.js";
+import { SimHttpApiOpenApiObject } from "./sim-http-api-openapi-object.js";
+import type { SimHttpApiOpenApiPointer } from "./sim-http-api-openapi-pointer.js";
+interface SimHttpApiOpenApiValueProperties {
+    readonly pointer: SimHttpApiOpenApiPointer;
+    readonly value: JSONValue | undefined;
+}
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export declare class SimHttpApiOpenApiValue {
+    readonly pointer: SimHttpApiOpenApiPointer;
+    private readonly value;
+    constructor(properties: SimHttpApiOpenApiValueProperties);
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent(): boolean;
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason: string): SimApiGatewayV2BadRequest;
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object(): SimHttpApiOpenApiObject;
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject(): SimHttpApiOpenApiObject | undefined;
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString(): string;
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString(): string | undefined;
+    /**
+     * This value as a boolean when the document carries one, which is the shape
+     * an authorizer's `enableSimpleResponses` takes.
+     */
+    optionalBoolean(): boolean | undefined;
+    /**
+     * This value as a number when the document carries one, which is the shape
+     * an authorizer's `authorizerResultTtlInSeconds` takes.
+     */
+    optionalNumber(): number | undefined;
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray(): readonly SimHttpApiOpenApiValue[] | undefined;
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList(): readonly string[] | undefined;
+}
+export {};
+//# sourceMappingURL=sim-http-api-openapi-value.d.ts.map

package/dist/service/apigatewayv2/openapi/sim-http-api-openapi-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-openapi-value.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/openapi/sim-http-api-openapi-value.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGlF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAID;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,IAAI,OAAO,CAEhB;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,yBAAyB,CAEjD;IAED;;OAEG;IACH,MAAM,IAAI,uBAAuB,CAQhC;IAED;;OAEG;IACH,cAAc,IAAI,uBAAuB,GAAG,SAAS,CAiBpD;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,CAQvB;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;;OAGG;IACH,eAAe,IAAI,OAAO,GAAG,SAAS,CAUrC;IAED;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;OAEG;IACH,aAAa,IAAI,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAgB7D;IAED;;OAEG;IACH,kBAAkB,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAElD;CACF"}