@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,0CAA0C;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAE5D,YAAY,UAAU,EAAE,0CAA0C,EAQjE;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAuBlC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.js

@@ -0,0 +1,57 @@
+import { SimHttpApiRefused, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiRequestAuthorizer } from "../../api/authorizer/sim-http-api-request-authorizer.js";
+import { SimHttpApiAuthorizerDecisions } from "./sim-http-api-authorizer-decisions.js";
+import { SimHttpApiAuthorizerInvocation, } from "./sim-http-api-authorizer-invocation.js";
+/**
+ * Decides whether one request may have a `CUSTOM` route, by invoking the
+ * Lambda function the route's authorizer names.
+ *
+ * The steps are the ones real API Gateway takes, in this order:
+ *
+ * 1. the request has to carry every identity source the authorizer was
+ *    configured with, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for those same identity source values, and not
+ *    yet expired, is reused by `SimHttpApiAuthorizerDecisions`, and nothing
+ *    further happens;
+ * 3. otherwise `SimHttpApiAuthorizerInvocation` asks the function, and what it
+ *    answered decides.
+ *
+ * An authorizer with no `AuthorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the route.
+ */
+export class SimHttpApiRequestRouteAuthorizer {
+    decisions;
+    invocation;
+    constructor(properties) {
+        this.decisions = new SimHttpApiAuthorizerDecisions({
+            clock: properties.clock,
+        });
+        this.invocation = new SimHttpApiAuthorizerInvocation({
+            clock: properties.clock,
+            functions: properties.functions,
+        });
+    }
+    /**
+     * Authorize one request against the `CUSTOM` route that matched it.
+     */
+    async authorize(input) {
+        const { api, match, request } = input;
+        const authorizer = api.authorizers.find(match.route.authorizerId ?? "");
+        // A CUSTOM route always names a REQUEST authorizer, and that authorizer
+        // can still be deleted out from under it, so the two come to the same
+        // thing here: with nothing to ask, the route stays closed.
+        if (!(authorizer instanceof SimHttpApiRequestAuthorizer)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const identitySource = authorizer.identitySources.values({
+            request,
+            routeKey: match.route.routeKey,
+        });
+        if (identitySource === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return await this.decisions.decide(authorizer, identitySource, async () => this.invocation.invoke(input, authorizer, identitySource));
+    }
+}
+//# sourceMappingURL=sim-http-api-request-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-request-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AAajD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,gCAAgC;IAC1B,SAAS,CAAgC;IACzC,UAAU,CAAiC;IAE5D,YAAY,UAAsD;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,8BAA8B,CAAC;YACnD,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAoC;QAEpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QAExE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,CAAC,CAAC,UAAU,YAAY,2BAA2B,CAAC,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC;YACvD,OAAO;YACP,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,CACxE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,cAAc,CAAC,CAC1D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.d.ts

@@ -0,0 +1,28 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+import type { SimHttpApiMatch } from "../../api/sim-http-api-match.js";
+import type { SimHttpApi } from "../../api/sim-http-api.js";
+/**
+ * Everything a route authorization decision is made from.
+ *
+ * The whole match is carried rather than only the route, because an `AWS_IAM`
+ * route is authorized against an ARN naming the stage that served the request
+ * and the path it asked for, both of which the match settled.
+ */
+export interface SimHttpApiRouteAuthorizeInput {
+    readonly api: SimHttpApi;
+    readonly match: SimHttpApiMatch;
+    readonly request: Request;
+    /**
+     * The principal the serving boundary attributed the request to, from a
+     * signature or from a named caller, and anonymous when it carried neither.
+     */
+    readonly caller: SimAwsRequestCaller;
+    /**
+     * IAM of the Account that owns the API, which is what decides an `AWS_IAM`
+     * route. It is the API's own rather than the caller's, and rather than the
+     * integrated function's.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-http-api-route-authorize-input.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorize-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-http-api-route-authorize-input.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorize-input.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorize-input.ts"],"names":[],"mappings":""}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts

@@ -0,0 +1,40 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimHttpApiAuthorization } from "../../api/authorizer/sim-http-api-authorization.js";
+import type { SimHttpApiAuthorizerFunctions } from "./sim-http-api-authorizer-invocation.js";
+import type { SimHttpApiRouteAuthorizeInput } from "./sim-http-api-route-authorize-input.js";
+interface SimHttpApiRouteAuthorizerProperties {
+    /**
+     * Clock a JWT route's time claims are checked against, so advancing
+     * simulated time expires a token that was accepted before it, and the one a
+     * Lambda authorizer's own invocation event is stamped with.
+     */
+    readonly clock: SimClock;
+    /**
+     * Where a Lambda authorizer's function is found, which is the same router
+     * that finds an integration's.
+     */
+    readonly functions: SimHttpApiAuthorizerFunctions;
+}
+/**
+ * Decides whether one request may have the route that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration: a request presenting no credentials
+ * is refused whether or not the integration behind the route would have
+ * worked.
+ *
+ * Which kind of authorization the route asks for is settled here, and each
+ * kind decides on its own terms.
+ */
+export declare class SimHttpApiRouteAuthorizer {
+    private readonly jwtAuthorizer;
+    private readonly requestAuthorizer;
+    private readonly iamAuthorizer;
+    constructor(properties: SimHttpApiRouteAuthorizerProperties);
+    /**
+     * Authorize one request against the route that matched it.
+     */
+    authorize(input: SimHttpApiRouteAuthorizeInput): Promise<SimHttpApiAuthorization>;
+}
+export {};
+//# sourceMappingURL=sim-http-api-route-authorizer.d.ts.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAE7F,UAAU,mCAAmC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;CACnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IACrE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,UAAU,EAAE,mCAAmC,EAQ1D;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;CACF"}

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js

@@ -0,0 +1,51 @@
+import { SimHttpApiAdmitted, } from "../../api/authorizer/sim-http-api-authorization.js";
+import { SimHttpApiIamRouteAuthorizer } from "./sim-http-api-iam-route-authorizer.js";
+import { SimHttpApiJwtRouteAuthorizer } from "./sim-http-api-jwt-route-authorizer.js";
+import { SimHttpApiRequestRouteAuthorizer } from "./sim-http-api-request-route-authorizer.js";
+/**
+ * Decides whether one request may have the route that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration: a request presenting no credentials
+ * is refused whether or not the integration behind the route would have
+ * worked.
+ *
+ * Which kind of authorization the route asks for is settled here, and each
+ * kind decides on its own terms.
+ */
+export class SimHttpApiRouteAuthorizer {
+    jwtAuthorizer;
+    requestAuthorizer;
+    iamAuthorizer = new SimHttpApiIamRouteAuthorizer();
+    constructor(properties) {
+        this.jwtAuthorizer = new SimHttpApiJwtRouteAuthorizer({
+            clock: properties.clock,
+        });
+        this.requestAuthorizer = new SimHttpApiRequestRouteAuthorizer({
+            clock: properties.clock,
+            functions: properties.functions,
+        });
+    }
+    /**
+     * Authorize one request against the route that matched it.
+     */
+    async authorize(input) {
+        switch (input.match.route.authorizationType) {
+            case "NONE": {
+                // Nobody was authorized, so there is no caller to describe, which is
+                // what leaves requestContext.authorizer out of the event entirely.
+                return new SimHttpApiAdmitted();
+            }
+            case "JWT": {
+                return this.jwtAuthorizer.authorize(input);
+            }
+            case "AWS_IAM": {
+                return this.iamAuthorizer.authorize(input);
+            }
+            case "CUSTOM": {
+                return await this.requestAuthorizer.authorize(input);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-route-authorizer.js.map

package/dist/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-route-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/serve/auth/sim-http-api-route-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,GAEnB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AAEtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,4CAA4C,CAAC;AAiB9F;;;;;;;;;;GAUG;AACH,MAAM,OAAO,yBAAyB;IACnB,aAAa,CAA+B;IAC5C,iBAAiB,CAAmC;IACpD,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IAEpE,YAAY,UAA+C;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,4BAA4B,CAAC;YACpD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,GAAG,IAAI,gCAAgC,CAAC;YAC5D,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAoC;QAEpC,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts

@@ -0,0 +1,37 @@
+import type { SimAwsServiceController, SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+interface SimApiGatewayV2ServiceControllerProperties {
+    readonly simAws?: SimAws;
+    readonly router?: SimApiGatewayV2Router;
+}
+/**
+ * Localhost HTTP controller for simulated API Gateway HTTP APIs.
+ *
+ * A request reaching the generated endpoint is matched to a route, and the
+ * route's integration invokes a simulated Lambda function with a payload
+ * format 2.0 event. The function runs as its execution Role, as it does for
+ * any other invocation.
+ *
+ * A route that authorizes anybody is checked before any of that: a JWT route's
+ * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
+ * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
+ * Lambda authorizer has to allow the request, or the request is refused and the
+ * integration is never invoked. Whether the API may invoke a function is a
+ * separate question, and the API's own rather than the client's.
+ */
+export declare class SimApiGatewayV2ServiceController implements SimAwsServiceController {
+    private readonly router;
+    private readonly routeAuthorizer;
+    private readonly integration;
+    private readonly errorResponse;
+    private readonly refusalResponse;
+    constructor(properties?: SimApiGatewayV2ServiceControllerProperties);
+    /**
+     * Handle an HTTP request routed to a simulated HTTP API.
+     */
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
+    private invoke;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-v2-controller.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE,UAAU,0CAA0C;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,gCAAiC,YAAW,uBAAuB;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IACpE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IAEnE,YAAY,UAAU,GAAE,0CAA+C,EActE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;CAwCrB"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js

@@ -0,0 +1,91 @@
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimHttpApiRequest } from "../api/sim-http-api-request.js";
+import { SimHttpApiRouteAuthorizer } from "./auth/sim-http-api-route-authorizer.js";
+import { SimApiGatewayV2ErrorResponse } from "./sim-api-gateway-v2-error-response.js";
+import { SimApiGatewayV2Router } from "./sim-api-gateway-v2-router.js";
+import { SimHttpApiIntegrationInvocation } from "./sim-http-api-integration-invocation.js";
+import { SimHttpApiRefusalResponse } from "./sim-http-api-refusal-response.js";
+/**
+ * Localhost HTTP controller for simulated API Gateway HTTP APIs.
+ *
+ * A request reaching the generated endpoint is matched to a route, and the
+ * route's integration invokes a simulated Lambda function with a payload
+ * format 2.0 event. The function runs as its execution Role, as it does for
+ * any other invocation.
+ *
+ * A route that authorizes anybody is checked before any of that: a JWT route's
+ * token has to verify and meet the route's scopes, an `AWS_IAM` route's caller
+ * has to be allowed `execute-api:Invoke` on the route, and a `CUSTOM` route's
+ * Lambda authorizer has to allow the request, or the request is refused and the
+ * integration is never invoked. Whether the API may invoke a function is a
+ * separate question, and the API's own rather than the client's.
+ */
+export class SimApiGatewayV2ServiceController {
+    router;
+    routeAuthorizer;
+    integration;
+    errorResponse = new SimApiGatewayV2ErrorResponse();
+    refusalResponse = new SimHttpApiRefusalResponse();
+    constructor(properties = {}) {
+        const { simAws = new SimAws() } = properties;
+        this.router = properties.router ?? new SimApiGatewayV2Router({ simAws });
+        // The clock is taken from the router rather than from properties, so a
+        // supplied router, the event timestamps and the token expiry checks all
+        // belong to the same simulation.
+        this.routeAuthorizer = new SimHttpApiRouteAuthorizer({
+            clock: this.router.simAws,
+            functions: this.router,
+        });
+        this.integration = new SimHttpApiIntegrationInvocation({
+            router: this.router,
+            clock: this.router.simAws,
+        });
+    }
+    /**
+     * Handle an HTTP request routed to a simulated HTTP API.
+     */
+    async handleRequest(serviceRequest) {
+        const httpApi = this.router.route(serviceRequest.target);
+        if (httpApi === undefined) {
+            return this.errorResponse.notFound();
+        }
+        if (httpApi.disableExecuteApiEndpoint) {
+            // The API exists but has switched its generated endpoint off, which is
+            // how an API reachable only through a custom domain is configured.
+            return this.errorResponse.forbidden();
+        }
+        return await this.invoke(httpApi, serviceRequest);
+    }
+    async invoke(api, serviceRequest) {
+        const { request } = serviceRequest;
+        // The whole request path, stage segment and all: the stage takes its own
+        // segment off, and `rawPath` reports the path as the client sent it.
+        const match = api.match(new SimHttpApiRequest({
+            method: request.method,
+            path: new URL(request.url).pathname,
+        }));
+        if (match === undefined) {
+            return this.errorResponse.notFound();
+        }
+        // The client's own authorization comes first: a request with no
+        // credentials is refused whether or not the integration behind the route
+        // would work.
+        const authorization = await this.routeAuthorizer.authorize({
+            api,
+            match,
+            request,
+            caller: serviceRequest.caller,
+            iam: this.router.iamFor(api),
+        });
+        if (!authorization.admitted) {
+            return this.refusalResponse.build(authorization);
+        }
+        return await this.integration.invoke({
+            api,
+            match,
+            request,
+            authorization,
+        });
+    }
+}
+//# sourceMappingURL=sim-api-gateway-v2-controller.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-controller.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-controller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wCAAwC,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,0CAA0C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAO/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,gCAAgC;IAC1B,MAAM,CAAwB;IAC9B,eAAe,CAA4B;IAC3C,WAAW,CAAkC;IAC7C,aAAa,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACnD,eAAe,GAAG,IAAI,yBAAyB,EAAE,CAAC;IAEnE,YAAY,UAAU,GAA+C,EAAE;QACrE,MAAM,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,EAAE,GAAG,UAAU,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,iCAAiC;QACjC,IAAI,CAAC,eAAe,GAAG,IAAI,yBAAyB,CAAC;YACnD,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,+BAA+B,CAAC;YACrD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,cAAoC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;YACtC,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,GAAe,EACf,cAAoC;QAEpC,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CACrB,IAAI,iBAAiB,CAAC;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;SACpC,CAAC,CACH,CAAC;QAEF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACvC,CAAC;QAED,gEAAgE;QAChE,yEAAyE;QACzE,cAAc;QACd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACzD,GAAG;YACH,KAAK;YACL,OAAO;YACP,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACnC,GAAG;YACH,KAAK;YACL,OAAO;YACP,aAAa;SACd,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The error responses an HTTP API endpoint returns itself, before or instead
+ * of an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document rather than the
+ * handler's output. The field is lower-case `message`, which is what an HTTP
+ * API uses; a Lambda Function URL uses `Message` for the same thing, so the
+ * two are not interchangeable and client code reading one of them sees here
+ * what it would see on AWS.
+ */
+export declare class SimApiGatewayV2ErrorResponse {
+    /**
+     * The route's authorizer did not accept the request.
+     *
+     * Everything from a missing token to a claim that does not hold answers this
+     * one status and body, so a client learns that its token was not accepted
+     * and nothing about which check it failed. The `www-authenticate` header
+     * names the scheme, and carries a description only for the one case AWS
+     * publishes one for.
+     */
+    unauthorized(errorDescription?: string): Response;
+    /**
+     * Nothing at this API serves the request: no such API, or no route, or no
+     * stage to serve it from.
+     */
+    notFound(): Response;
+    /**
+     * The API's generated endpoint is switched off, the route asks for a scope
+     * the accepted token does not claim, or IAM denied the caller
+     * `execute-api:Invoke` on the `AWS_IAM` route being called.
+     *
+     * AWS publishes neither the status nor the body for any of these, so both
+     * are what the endpoint was observed to answer rather than something
+     * documented.
+     */
+    forbidden(): Response;
+    /**
+     * The integration failed to handle the request.
+     */
+    internalServerError(): Response;
+    /**
+     * The `www-authenticate` value a refused token gets back.
+     *
+     * Only the description AWS publishes is ever sent, and every other refusal
+     * names the scheme and nothing else, rather than inventing wording. AWS does
+     * not publish how it lays the parameters out around that description, so
+     * they are comma-separated as RFC 6750 writes them.
+     */
+    private bearerChallenge;
+    private jsonResponse;
+}
+//# sourceMappingURL=sim-api-gateway-v2-error-response.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-error-response.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,4BAA4B;IACvC;;;;;;;;OAQG;IACH,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAIhD;IAED;;;OAGG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;;;;;;;OAQG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,YAAY;CAarB"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.js

@@ -0,0 +1,72 @@
+/**
+ * The error responses an HTTP API endpoint returns itself, before or instead
+ * of an integration producing one.
+ *
+ * Real API Gateway answers these with a small JSON document rather than the
+ * handler's output. The field is lower-case `message`, which is what an HTTP
+ * API uses; a Lambda Function URL uses `Message` for the same thing, so the
+ * two are not interchangeable and client code reading one of them sees here
+ * what it would see on AWS.
+ */
+export class SimApiGatewayV2ErrorResponse {
+    /**
+     * The route's authorizer did not accept the request.
+     *
+     * Everything from a missing token to a claim that does not hold answers this
+     * one status and body, so a client learns that its token was not accepted
+     * and nothing about which check it failed. The `www-authenticate` header
+     * names the scheme, and carries a description only for the one case AWS
+     * publishes one for.
+     */
+    unauthorized(errorDescription) {
+        return this.jsonResponse(401, "Unauthorized", {
+            "www-authenticate": this.bearerChallenge(errorDescription),
+        });
+    }
+    /**
+     * Nothing at this API serves the request: no such API, or no route, or no
+     * stage to serve it from.
+     */
+    notFound() {
+        return this.jsonResponse(404, "Not Found");
+    }
+    /**
+     * The API's generated endpoint is switched off, the route asks for a scope
+     * the accepted token does not claim, or IAM denied the caller
+     * `execute-api:Invoke` on the `AWS_IAM` route being called.
+     *
+     * AWS publishes neither the status nor the body for any of these, so both
+     * are what the endpoint was observed to answer rather than something
+     * documented.
+     */
+    forbidden() {
+        return this.jsonResponse(403, "Forbidden");
+    }
+    /**
+     * The integration failed to handle the request.
+     */
+    internalServerError() {
+        return this.jsonResponse(500, "Internal Server Error");
+    }
+    /**
+     * The `www-authenticate` value a refused token gets back.
+     *
+     * Only the description AWS publishes is ever sent, and every other refusal
+     * names the scheme and nothing else, rather than inventing wording. AWS does
+     * not publish how it lays the parameters out around that description, so
+     * they are comma-separated as RFC 6750 writes them.
+     */
+    bearerChallenge(errorDescription) {
+        if (errorDescription === undefined) {
+            return "Bearer";
+        }
+        return `Bearer error="invalid_token", error_description="${errorDescription}"`;
+    }
+    jsonResponse(status, message, headers = {}) {
+        return Response.json({ message }, {
+            status,
+            headers: { "content-type": "application/json", ...headers },
+        });
+    }
+}
+//# sourceMappingURL=sim-api-gateway-v2-error-response.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-error-response.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,4BAA4B;IACvC;;;;;;;;OAQG;IACH,YAAY,CAAC,gBAAyB;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE;YAC5C,kBAAkB,EAAE,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,gBAAyB;QAC/C,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,oDAAoD,gBAAgB,GAAG,CAAC;IACjF,CAAC;IAEO,YAAY,CAClB,MAAc,EACd,OAAe,EACf,OAAO,GAA2B,EAAE;QAEpC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,EACX;YACE,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;SAC5D,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts

@@ -0,0 +1,71 @@
+import type { SimAwsServiceTarget } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import type { SimLambdaFunction } from "../../lambda/function/sim-lambda-function.js";
+import type { SimHttpApiIntegration } from "../api/integration/sim-http-api-integration.js";
+import type { SimHttpApiLambdaUri } from "../api/integration/sim-http-api-lambda-uri.js";
+import type { SimHttpApi } from "../api/sim-http-api.js";
+import type { SimIamInterServiceAuthZ } from "../../iam/authorize/sim-iam-inter-service-auth-z.js";
+interface SimApiGatewayV2RouterProperties {
+    readonly simAws?: SimAws;
+}
+/**
+ * A function the API invokes, and what decides whether it may.
+ */
+export interface SimHttpApiFunctionTarget {
+    readonly simFunction: SimLambdaFunction;
+    /**
+     * IAM of the Account that owns the function, which is what the API's invoke
+     * permission is evaluated against. It need not be the API's Account.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Routes a served HTTP API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the region, but not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export declare class SimApiGatewayV2Router {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators that need the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    readonly simAws: SimAws;
+    private readonly registry;
+    constructor(properties?: SimApiGatewayV2RouterProperties);
+    /**
+     * Find the API a request target addresses.
+     */
+    route(target: SimAwsServiceTarget): SimHttpApi | undefined;
+    /**
+     * IAM of the Account that owns an API, which is what an `AWS_IAM` route's
+     * authorization is evaluated against.
+     *
+     * It is the API's own Account rather than the caller's, so a caller from
+     * elsewhere is decided by the API's Account the way any cross-Account
+     * request is.
+     */
+    iamFor(api: SimHttpApi): SimIamInterServiceAuthZ;
+    /**
+     * Find the function an integration invokes, and the IAM deciding whether it
+     * may be invoked.
+     */
+    targetFor(integration: SimHttpApiIntegration): SimHttpApiFunctionTarget | undefined;
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names, not
+     * the API's, because an integration URI and an authorizer URI are each free
+     * to name either.
+     */
+    functionFor(lambdaUri: SimHttpApiLambdaUri): SimHttpApiFunctionTarget | undefined;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-v2-router.d.ts.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAE/F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qDAAqD,CAAC;AAEnG,UAAU,+BAA+B;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAqB;IAChC;;;;;;OAMG;IACH,SAAgB,MAAM,EAAE,MAAM,CAAC;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAE,+BAAoC,EAG3D;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,UAAU,GAAG,SAAS,CAWzD;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,uBAAuB,CAI/C;IAED;;;OAGG;IACH,SAAS,CACP,WAAW,EAAE,qBAAqB,GACjC,wBAAwB,GAAG,SAAS,CAEtC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAAS,EAAE,mBAAmB,GAC7B,wBAAwB,GAAG,SAAS,CActC;CACF"}

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js

@@ -0,0 +1,75 @@
+import { SimAws } from "../../aws/sim-aws.js";
+/**
+ * Routes a served HTTP API request to the API behind it, and an integration to
+ * the function behind that.
+ *
+ * The request hostname gives the API id and the region, but not the Account.
+ * The registry supplies that missing hop. The integrated function is a second
+ * hop again, because its ARN names its own Account and Region, which need not
+ * be the API's.
+ */
+export class SimApiGatewayV2Router {
+    /**
+     * The simulation this router routes within.
+     *
+     * Exposed so collaborators that need the same simulation, such as the clock
+     * stamping invocation events, take it from here rather than being given a
+     * second SimAws that could be a different one.
+     */
+    simAws;
+    registry;
+    constructor(properties = {}) {
+        this.simAws = properties.simAws ?? new SimAws();
+        this.registry = this.simAws.serviceFactory.httpApiRegistry;
+    }
+    /**
+     * Find the API a request target addresses.
+     */
+    route(target) {
+        const accountId = this.registry.accountIdForApi(target.resourceName);
+        if (accountId === undefined) {
+            return undefined;
+        }
+        return this.simAws
+            .accountRegionScope(accountId, target.regionName)
+            .apiGatewayV2()
+            .findApi(target.resourceName);
+    }
+    /**
+     * IAM of the Account that owns an API, which is what an `AWS_IAM` route's
+     * authorization is evaluated against.
+     *
+     * It is the API's own Account rather than the caller's, so a caller from
+     * elsewhere is decided by the API's Account the way any cross-Account
+     * request is.
+     */
+    iamFor(api) {
+        const { accountId, regionName } = api.accountRegionScope;
+        return this.simAws.accountRegionScope(accountId, regionName).iam();
+    }
+    /**
+     * Find the function an integration invokes, and the IAM deciding whether it
+     * may be invoked.
+     */
+    targetFor(integration) {
+        return this.functionFor(integration.lambdaUri);
+    }
+    /**
+     * Find the function a URI names, and the IAM deciding whether API Gateway
+     * may invoke it.
+     *
+     * The function is looked up in the Account and Region its own ARN names, not
+     * the API's, because an integration URI and an authorizer URI are each free
+     * to name either.
+     */
+    functionFor(lambdaUri) {
+        const { accountId, regionName, functionName } = lambdaUri;
+        const scope = this.simAws.accountRegionScope(accountId, regionName);
+        const simFunction = scope.lambda().getSimFunctionByName(functionName);
+        if (simFunction === undefined) {
+            return undefined;
+        }
+        return { simFunction, iam: scope.iam() };
+    }
+}
+//# sourceMappingURL=sim-api-gateway-v2-router.js.map

package/dist/service/apigatewayv2/serve/sim-api-gateway-v2-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-v2-router.js","sourceRoot":"","sources":["../../../../src/service/apigatewayv2/serve/sim-api-gateway-v2-router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAyB9C;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;;;;OAMG;IACa,MAAM,CAAS;IAEd,QAAQ,CAAqB;IAE9C,YAAY,UAAU,GAAoC,EAAE;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAA2B;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,MAAM;aACf,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAChD,YAAY,EAAE;aACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,GAAe;QACpB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,kBAAkB,CAAC;QAEzD,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,SAAS,CACP,WAAkC;QAElC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CACT,SAA8B;QAE9B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;QAE1D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC1C,SAA4B,EAC5B,UAA2B,CAC5B,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,CAAC;CACF"}