@kensio/yulin 0.47.0 → 1.1.0

package/dist/util/jwt/sim-jwt-claims.d.ts

@@ -0,0 +1,54 @@
+/**
+ * One value a JWT claim can hold, which is whatever JSON can hold.
+ */
+export type SimJwtClaimValue = string | number | boolean | null | readonly SimJwtClaimValue[] | {
+    readonly [name: string]: SimJwtClaimValue;
+};
+/**
+ * The claim set of one JWT, as it was signed.
+ */
+export type SimJwtClaimRecord = Readonly<Record<string, SimJwtClaimValue>>;
+/**
+ * Whether a claim holds a list, narrowed to the element type rather than to
+ * the `any[]` Array.isArray gives on its own.
+ */
+export declare function isSimJwtClaimList(value: SimJwtClaimValue | undefined): value is readonly SimJwtClaimValue[];
+/**
+ * The payload of a JWT, read by claim name.
+ *
+ * A claim is whatever the issuer put there, so every accessor here answers
+ * undefined for a claim that is absent and for one holding something other
+ * than the type asked for. That keeps the checks a verifier makes uniform: a
+ * missing `exp` and an `exp` holding a string both fail the same way, rather
+ * than one failing and the other throwing.
+ */
+export declare class SimJwtClaims {
+    private readonly values;
+    constructor(values: SimJwtClaimRecord);
+    /**
+     * Whether the token carries this claim at all, whatever it holds.
+     */
+    has(name: string): boolean;
+    /**
+     * A claim holding a string.
+     */
+    text(name: string): string | undefined;
+    /**
+     * A claim holding a number, which is how the time claims are carried.
+     */
+    number(name: string): number | undefined;
+    /**
+     * A claim holding either one string or a list of them, as `aud` does.
+     *
+     * A list with anything but strings in it answers undefined rather than the
+     * strings it happens to hold, since a claim that shape was not written by an
+     * issuer this understands.
+     */
+    textList(name: string): readonly string[] | undefined;
+    /**
+     * Every claim, for a consumer that passes the whole set on rather than
+     * asking for one.
+     */
+    toRecord(): SimJwtClaimRecord;
+}
+//# sourceMappingURL=sim-jwt-claims.d.ts.map

package/dist/util/jwt/sim-jwt-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-claims.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-claims.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,gBAAgB,EAAE,GAC3B;IAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAA;CAAE,CAAC;AAElD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3E;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAClC,KAAK,IAAI,SAAS,gBAAgB,EAAE,CAEtC;AAED;;;;;;;;GAQG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAE3C,YAAY,MAAM,EAAE,iBAAiB,EAEpC;IAED;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIrC;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIvC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAsBpD;IAED;;;OAGG;IACH,QAAQ,IAAI,iBAAiB,CAE5B;CACF"}

package/dist/util/jwt/sim-jwt-claims.js

@@ -0,0 +1,77 @@
+/* eslint-disable security/detect-object-injection -- every lookup here is a
+   claim name this simulation asks for, such as `iss` or `exp`, read out of a
+   plain object that JSON.parse produced. */
+/**
+ * Whether a claim holds a list, narrowed to the element type rather than to
+ * the `any[]` Array.isArray gives on its own.
+ */
+export function isSimJwtClaimList(value) {
+    return Array.isArray(value);
+}
+/**
+ * The payload of a JWT, read by claim name.
+ *
+ * A claim is whatever the issuer put there, so every accessor here answers
+ * undefined for a claim that is absent and for one holding something other
+ * than the type asked for. That keeps the checks a verifier makes uniform: a
+ * missing `exp` and an `exp` holding a string both fail the same way, rather
+ * than one failing and the other throwing.
+ */
+export class SimJwtClaims {
+    values;
+    constructor(values) {
+        this.values = values;
+    }
+    /**
+     * Whether the token carries this claim at all, whatever it holds.
+     */
+    has(name) {
+        return this.values[name] !== undefined;
+    }
+    /**
+     * A claim holding a string.
+     */
+    text(name) {
+        const value = this.values[name];
+        return typeof value === "string" ? value : undefined;
+    }
+    /**
+     * A claim holding a number, which is how the time claims are carried.
+     */
+    number(name) {
+        const value = this.values[name];
+        return typeof value === "number" ? value : undefined;
+    }
+    /**
+     * A claim holding either one string or a list of them, as `aud` does.
+     *
+     * A list with anything but strings in it answers undefined rather than the
+     * strings it happens to hold, since a claim that shape was not written by an
+     * issuer this understands.
+     */
+    textList(name) {
+        const value = this.values[name];
+        if (typeof value === "string") {
+            return [value];
+        }
+        if (!isSimJwtClaimList(value)) {
+            return undefined;
+        }
+        const strings = [];
+        for (const entry of value) {
+            if (typeof entry !== "string") {
+                return undefined;
+            }
+            strings.push(entry);
+        }
+        return strings;
+    }
+    /**
+     * Every claim, for a consumer that passes the whole set on rather than
+     * asking for one.
+     */
+    toRecord() {
+        return this.values;
+    }
+}
+//# sourceMappingURL=sim-jwt-claims.js.map

package/dist/util/jwt/sim-jwt-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-claims.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-claims.ts"],"names":[],"mappings":"AAAA;;4CAE4C;AAkB5C;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmC;IAEnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IACN,MAAM,CAAoB;IAE3C,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,IAAY;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/util/jwt/sim-jwt-keys.d.ts

@@ -0,0 +1,32 @@
+/**
+ * One public key as an issuer publishes it in its JWKS.
+ *
+ * The fields are the ones an RSA signing key carries. They are typed as plain
+ * strings rather than as literals so that a JWKS from any simulated issuer is
+ * assignable here without being converted first.
+ */
+export interface SimJwk {
+    readonly kty: string;
+    readonly kid: string;
+    readonly n: string;
+    readonly e: string;
+    readonly alg?: string | undefined;
+    readonly use?: string | undefined;
+}
+/**
+ * The keys one issuer publishes, selected by the `kid` a token names.
+ *
+ * A verifier picks the key by id rather than trying each one, which is what
+ * makes an unknown `kid` a refusal rather than a slow failure. An issuer that
+ * publishes no keys at all therefore matches nothing, which is the answer for
+ * an issuer this simulation knows nothing about.
+ */
+export declare class SimJwtKeys {
+    private readonly keys;
+    constructor(keys: readonly SimJwk[]);
+    /**
+     * The key with this id, if the issuer published one.
+     */
+    find(kid: string | undefined): SimJwk | undefined;
+}
+//# sourceMappingURL=sim-jwt-keys.d.ts.map

package/dist/util/jwt/sim-jwt-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-keys.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,YAAY,IAAI,EAAE,SAAS,MAAM,EAAE,EAElC;IAED;;OAEG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhD;CACF"}

package/dist/util/jwt/sim-jwt-keys.js

@@ -0,0 +1,24 @@
+/**
+ * The keys one issuer publishes, selected by the `kid` a token names.
+ *
+ * A verifier picks the key by id rather than trying each one, which is what
+ * makes an unknown `kid` a refusal rather than a slow failure. An issuer that
+ * publishes no keys at all therefore matches nothing, which is the answer for
+ * an issuer this simulation knows nothing about.
+ */
+export class SimJwtKeys {
+    keys;
+    constructor(keys) {
+        this.keys = keys;
+    }
+    /**
+     * The key with this id, if the issuer published one.
+     */
+    find(kid) {
+        if (kid === undefined) {
+            return undefined;
+        }
+        return this.keys.find((key) => key.kid === kid);
+    }
+}
+//# sourceMappingURL=sim-jwt-keys.js.map

package/dist/util/jwt/sim-jwt-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-keys.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-keys.ts"],"names":[],"mappings":"AAgBA;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACJ,IAAI,CAAoB;IAEzC,YAAY,IAAuB;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,GAAuB;QAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClD,CAAC;CACF"}

package/dist/util/jwt/sim-jwt-rs256.d.ts

@@ -0,0 +1,38 @@
+import type { SimJwk } from "./sim-jwt-keys.js";
+import type { SimJwt } from "./sim-jwt.js";
+/**
+ * The one signature algorithm simulated, which is the one Cognito signs with.
+ *
+ * The allow-list is a single value on purpose. `none` and the `HS*` family are
+ * the two ways a verifier that trusts the header is talked out of checking
+ * anything, and neither is a value any issuer here uses.
+ */
+export declare const simJwtRs256Algorithm = "RS256";
+/**
+ * Verifies the RS256 signature of a JWT against a published JWK.
+ *
+ * The signature check is real: the public key is reconstructed from the JWK's
+ * modulus and exponent, and `node:crypto` verifies the real signature over the
+ * real signing input. Nothing here trusts the token's own header beyond
+ * reading which key it names.
+ */
+export declare class SimJwtRs256 {
+    /**
+     * Whether this token's header names the one algorithm that is verified.
+     */
+    isSupportedAlgorithm(jwt: SimJwt): boolean;
+    /**
+     * Whether this token carries a genuine RS256 signature by this key.
+     */
+    verify(jwt: SimJwt, jwk: SimJwk): boolean;
+    /**
+     * Reconstruct the public key from the published JWK.
+     *
+     * A JWK that cannot be read is treated as a key that verifies nothing,
+     * rather than as an error: it comes from an issuer document, so refusing the
+     * token is the right answer and there is nothing for a caller to do about
+     * the key itself.
+     */
+    private publicKey;
+}
+//# sourceMappingURL=sim-jwt-rs256.d.ts.map

package/dist/util/jwt/sim-jwt-rs256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-rs256.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-rs256.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;;;GAOG;AACH,qBAAa,WAAW;IACtB;;OAEG;IACH,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzC;IAED;;OAEG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAUxC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,SAAS;CAalB"}

package/dist/util/jwt/sim-jwt-rs256.js

@@ -0,0 +1,60 @@
+import { createPublicKey, createVerify } from "node:crypto";
+/**
+ * The one signature algorithm simulated, which is the one Cognito signs with.
+ *
+ * The allow-list is a single value on purpose. `none` and the `HS*` family are
+ * the two ways a verifier that trusts the header is talked out of checking
+ * anything, and neither is a value any issuer here uses.
+ */
+export const simJwtRs256Algorithm = "RS256";
+/**
+ * Verifies the RS256 signature of a JWT against a published JWK.
+ *
+ * The signature check is real: the public key is reconstructed from the JWK's
+ * modulus and exponent, and `node:crypto` verifies the real signature over the
+ * real signing input. Nothing here trusts the token's own header beyond
+ * reading which key it names.
+ */
+export class SimJwtRs256 {
+    /**
+     * Whether this token's header names the one algorithm that is verified.
+     */
+    isSupportedAlgorithm(jwt) {
+        return jwt.header.alg === simJwtRs256Algorithm;
+    }
+    /**
+     * Whether this token carries a genuine RS256 signature by this key.
+     */
+    verify(jwt, jwk) {
+        const publicKey = this.publicKey(jwk);
+        if (publicKey === undefined) {
+            return false;
+        }
+        return createVerify("RSA-SHA256")
+            .update(jwt.signingInput)
+            .verify(publicKey, jwt.signature);
+    }
+    /**
+     * Reconstruct the public key from the published JWK.
+     *
+     * A JWK that cannot be read is treated as a key that verifies nothing,
+     * rather than as an error: it comes from an issuer document, so refusing the
+     * token is the right answer and there is nothing for a caller to do about
+     * the key itself.
+     */
+    publicKey(jwk) {
+        try {
+            // Only the key type and the RSA parameters take part in the
+            // reconstruction. `kid`, `alg` and `use` describe how the key is meant
+            // to be chosen and used, not what it is.
+            return createPublicKey({
+                key: { kty: jwk.kty, n: jwk.n, e: jwk.e },
+                format: "jwk",
+            });
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-jwt-rs256.js.map

package/dist/util/jwt/sim-jwt-rs256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-rs256.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-rs256.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAK5E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACtB;;OAEG;IACH,oBAAoB,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,oBAAoB,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW,EAAE,GAAW;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,YAAY,CAAC,YAAY,CAAC;aAC9B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;aACxB,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACK,SAAS,CAAC,GAAW;QAC3B,IAAI,CAAC;YACH,4DAA4D;YAC5D,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,eAAe,CAAC;gBACrB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;gBACzC,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/util/jwt/sim-jwt.d.ts

@@ -0,0 +1,43 @@
+import { SimJwtClaims } from "./sim-jwt-claims.js";
+/**
+ * The header of a JWT: which algorithm signed it, and with which key.
+ *
+ * `kid` is optional in the JWT specification and present on every token from
+ * an issuer publishing more than one key, so it is read when it is there and
+ * left undefined when it is not.
+ */
+export interface SimJwtHeader {
+    readonly alg: string;
+    readonly kid?: string | undefined;
+}
+/**
+ * One parsed JWT: its header, its claims, and the bytes a verifier needs.
+ *
+ * Parsing says nothing about whether the token is genuine. It says only that
+ * the string is shaped like a JWT and that its header and payload are JSON
+ * objects, which is what has to be true before a signature can be checked at
+ * all.
+ */
+export declare class SimJwt {
+    readonly header: SimJwtHeader;
+    readonly claims: SimJwtClaims;
+    /**
+     * The signed bytes: the encoded header and payload joined by a dot, exactly
+     * as they arrived. Re-encoding them would change the signing input, since
+     * two encodings of the same JSON are different strings.
+     */
+    readonly signingInput: string;
+    readonly signature: Buffer;
+    private constructor();
+    /**
+     * Read a token string as a JWT, or refuse it.
+     */
+    static parse(token: string): SimJwt;
+    private static readHeader;
+    /**
+     * Decode one base64url part into the JSON object it has to hold.
+     */
+    private static readObject;
+    private static readJson;
+}
+//# sourceMappingURL=sim-jwt.d.ts.map

package/dist/util/jwt/sim-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,YAAY,EAEb,MAAM,qBAAqB,CAAC;AAmB7B;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,MAAM;IACjB,SAAgB,MAAM,EAAE,YAAY,CAAC;IACrC,SAAgB,MAAM,EAAE,YAAY,CAAC;IAErC;;;;OAIG;IACH,SAAgB,YAAY,EAAE,MAAM,CAAC;IAErC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAElC,OAAO,eAKN;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BlC;IAED,OAAO,CAAC,MAAM,CAAC,UAAU;IAiBzB;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,UAAU;IAczB,OAAO,CAAC,MAAM,CAAC,QAAQ;CAYxB"}

package/dist/util/jwt/sim-jwt.error.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A token that cannot be read as a JWT.
+ *
+ * Everything that goes wrong before a signature can be checked is one of
+ * these: the wrong number of parts, a segment that is not base64url JSON, or a
+ * header missing the fields a JWT header has. Whether that refusal is worth a
+ * 401 or something else is the caller's decision, so nothing here carries a
+ * status code.
+ */
+export declare class SimJwtError extends Error {
+    readonly name = "SimJwtError";
+}
+//# sourceMappingURL=sim-jwt.error.d.ts.map

package/dist/util/jwt/sim-jwt.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt.error.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt.error.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAyB,IAAI,iBAAiB;CAC/C"}

package/dist/util/jwt/sim-jwt.error.js

@@ -0,0 +1,13 @@
+/**
+ * A token that cannot be read as a JWT.
+ *
+ * Everything that goes wrong before a signature can be checked is one of
+ * these: the wrong number of parts, a segment that is not base64url JSON, or a
+ * header missing the fields a JWT header has. Whether that refusal is worth a
+ * 401 or something else is the caller's decision, so nothing here carries a
+ * status code.
+ */
+export class SimJwtError extends Error {
+    name = "SimJwtError";
+}
+//# sourceMappingURL=sim-jwt.error.js.map

package/dist/util/jwt/sim-jwt.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt.error.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt.error.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACX,IAAI,GAAG,aAAa,CAAC;CAC/C"}

package/dist/util/jwt/sim-jwt.js

@@ -0,0 +1,94 @@
+import { isSimJwtClaimList, SimJwtClaims, } from "./sim-jwt-claims.js";
+import { SimJwtError } from "./sim-jwt.error.js";
+/**
+ * How many dot-separated parts a signed JWT has.
+ *
+ * A JWE has five, and an unsecured JWT has three with an empty signature.
+ * Neither is a token anything here accepts, so both are refused by this count
+ * or by the empty-part check beside it.
+ */
+const signedJwtParts = 3;
+/**
+ * One parsed JWT: its header, its claims, and the bytes a verifier needs.
+ *
+ * Parsing says nothing about whether the token is genuine. It says only that
+ * the string is shaped like a JWT and that its header and payload are JSON
+ * objects, which is what has to be true before a signature can be checked at
+ * all.
+ */
+export class SimJwt {
+    header;
+    claims;
+    /**
+     * The signed bytes: the encoded header and payload joined by a dot, exactly
+     * as they arrived. Re-encoding them would change the signing input, since
+     * two encodings of the same JSON are different strings.
+     */
+    signingInput;
+    signature;
+    constructor(properties) {
+        this.header = properties.header;
+        this.claims = properties.claims;
+        this.signingInput = properties.signingInput;
+        this.signature = properties.signature;
+    }
+    /**
+     * Read a token string as a JWT, or refuse it.
+     */
+    static parse(token) {
+        const parts = token.split(".");
+        if (parts.length !== signedJwtParts) {
+            throw new SimJwtError(`A JWT has ${String(signedJwtParts)} dot-separated parts, and this ` +
+                `token has ${String(parts.length)}`);
+        }
+        const [encodedHeader = "", encodedPayload = "", encodedSignature = ""] = parts;
+        if (encodedHeader.length === 0 ||
+            encodedPayload.length === 0 ||
+            encodedSignature.length === 0) {
+            throw new SimJwtError("A JWT has no empty parts");
+        }
+        return new SimJwt({
+            header: this.readHeader(encodedHeader),
+            claims: new SimJwtClaims(this.readObject(encodedPayload, "payload")),
+            signingInput: `${encodedHeader}.${encodedPayload}`,
+            signature: Buffer.from(encodedSignature, "base64url"),
+        });
+    }
+    static readHeader(encoded) {
+        const values = this.readObject(encoded, "header");
+        const alg = values["alg"];
+        if (typeof alg !== "string") {
+            throw new SimJwtError("A JWT header names its algorithm in alg");
+        }
+        const kid = values["kid"];
+        if (kid !== undefined && typeof kid !== "string") {
+            throw new SimJwtError("A JWT header kid is the name of one key");
+        }
+        return { alg, ...(kid !== undefined && { kid }) };
+    }
+    /**
+     * Decode one base64url part into the JSON object it has to hold.
+     */
+    static readObject(encoded, part) {
+        const decoded = this.readJson(encoded, part);
+        if (typeof decoded !== "object" ||
+            decoded === null ||
+            isSimJwtClaimList(decoded)) {
+            throw new SimJwtError(`A JWT ${part} is a JSON object`);
+        }
+        return decoded;
+    }
+    static readJson(encoded, part) {
+        const text = Buffer.from(encoded, "base64url").toString("utf8");
+        try {
+            // The decoded text is JSON from a token nothing has verified yet, so its
+            // type is asserted rather than known. Everything that reads it goes
+            // through SimJwtClaims, which checks the type of each claim it answers.
+            return JSON.parse(text);
+        }
+        catch {
+            throw new SimJwtError(`A JWT ${part} is base64url-encoded JSON`);
+        }
+    }
+}
+//# sourceMappingURL=sim-jwt.js.map

package/dist/util/jwt/sim-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAEjB,YAAY,GAEb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC;AAqBzB;;;;;;;GAOG;AACH,MAAM,OAAO,MAAM;IACD,MAAM,CAAe;IACrB,MAAM,CAAe;IAErC;;;;OAIG;IACa,YAAY,CAAS;IAErB,SAAS,CAAS;IAElC,YAAoB,UAA4B;QAC9C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,WAAW,CACnB,aAAa,MAAM,CAAC,cAAc,CAAC,iCAAiC;gBAClE,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CACtC,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,aAAa,GAAG,EAAE,EAAE,cAAc,GAAG,EAAE,EAAE,gBAAgB,GAAG,EAAE,CAAC,GACpE,KAAK,CAAC;QAER,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;YAC1B,cAAc,CAAC,MAAM,KAAK,CAAC;YAC3B,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,0BAA0B,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,MAAM,CAAC;YAChB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YACtC,MAAM,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YACpE,YAAY,EAAE,GAAG,aAAa,IAAI,cAAc,EAAE;YAClD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,OAAe;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,WAAW,CAAC,yCAAyC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,IAAY;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE7C,IACE,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,KAAK,IAAI;YAChB,iBAAiB,CAAC,OAAO,CAAC,EAC1B,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,OAAe,EAAE,IAAY;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,yEAAyE;YACzE,oEAAoE;YACpE,wEAAwE;YACxE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "0.47.0",
+  "version": "1.1.0",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": {
     "type": "git",
@@ -26,6 +26,10 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./apigatewayv2": {
+      "import": "./dist/service/apigatewayv2/index.js",
+      "types": "./dist/service/apigatewayv2/index.d.ts"
+    },
     "./cloudformation": {
       "import": "./dist/service/cloudformation/index.js",
       "types": "./dist/service/cloudformation/index.d.ts"
@@ -101,52 +105,53 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-crypto/sha256-js": "^5.2.0",
-    "@aws-sdk/client-acm": "^3.1095.0",
-    "@aws-sdk/client-cloudformation": "^3.1095.0",
-    "@aws-sdk/client-cloudfront": "^3.1095.0",
-    "@aws-sdk/client-cognito-identity-provider": "^3.1096.0",
-    "@aws-sdk/client-dynamodb": "^3.1095.0",
-    "@aws-sdk/client-iam": "^3.1095.0",
-    "@aws-sdk/client-kms": "^3.1095.0",
-    "@aws-sdk/client-lambda": "^3.1095.0",
-    "@aws-sdk/client-route-53": "^3.1095.0",
-    "@aws-sdk/client-s3": "^3.1095.0",
-    "@aws-sdk/client-secrets-manager": "^3.1095.0",
-    "@aws-sdk/client-sqs": "^3.1097.0",
-    "@aws-sdk/client-ssm": "^3.1095.0",
-    "@aws-sdk/client-sts": "^3.1095.0",
-    "@aws-sdk/lib-dynamodb": "^3.1100.0",
-    "@aws-sdk/s3-request-presigner": "^3.1095.0",
+    "@aws-sdk/client-acm": "^3.1101.0",
+    "@aws-sdk/client-apigatewayv2": "^3.1101.0",
+    "@aws-sdk/client-cloudformation": "^3.1101.0",
+    "@aws-sdk/client-cloudfront": "^3.1101.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.1101.0",
+    "@aws-sdk/client-dynamodb": "^3.1101.0",
+    "@aws-sdk/client-iam": "^3.1101.0",
+    "@aws-sdk/client-kms": "^3.1101.0",
+    "@aws-sdk/client-lambda": "^3.1101.0",
+    "@aws-sdk/client-route-53": "^3.1101.0",
+    "@aws-sdk/client-s3": "^3.1101.0",
+    "@aws-sdk/client-secrets-manager": "^3.1101.0",
+    "@aws-sdk/client-sqs": "^3.1101.0",
+    "@aws-sdk/client-ssm": "^3.1101.0",
+    "@aws-sdk/client-sts": "^3.1101.0",
+    "@aws-sdk/lib-dynamodb": "^3.1101.0",
+    "@aws-sdk/s3-request-presigner": "^3.1101.0",
     "@eslint/js": "^10.0.1",
-    "@kensio/smartass": "^1.34.0",
-    "@smithy/signature-v4": "^5.6.10",
-    "@smithy/smithy-client": "^4.14.8",
+    "@kensio/smartass": "^1.36.0",
+    "@smithy/signature-v4": "^5.6.12",
+    "@smithy/smithy-client": "^4.14.16",
     "@smithy/types": "^4.16.1",
     "@types/eslint-plugin-security": "^3.0.1",
     "@types/lodash-es": "^4.17.12",
-    "@types/node": "^24.0.0",
+    "@types/node": "^24.13.3",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitest/coverage-v8": "^4.1.10",
-    "@vitest/eslint-plugin": "^1.6.23",
-    "aws-cdk": "^2.1130.0",
-    "aws-cdk-lib": "^2.261.0",
+    "@vitest/eslint-plugin": "^1.6.24",
+    "aws-cdk": "^2.1134.0",
+    "aws-cdk-lib": "^2.263.0",
     "aws-jwt-verify": "^5.2.1",
     "aws-sdk-client-mock": "^4.1.0",
-    "constructs": "^10.6.0",
-    "eslint": "^10.7.0",
+    "constructs": "^10.8.0",
+    "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^63.0.13",
+    "eslint-plugin-jsdoc": "^63.3.2",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-security": "^4.0.1",
-    "eslint-plugin-unicorn": "^69.0.0",
+    "eslint-plugin-unicorn": "^70.0.0",
     "execa": "^9.6.1",
     "fta-cli": "^3.0.0",
-    "globals": "^17.7.0",
+    "globals": "^17.8.0",
     "jiti": "^2.7.0",
-    "prettier": "^3.9.5",
+    "prettier": "^3.9.6",
     "tsx": "^4.23.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "typescript-eslint": "^8.64.0",
+    "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   },
   "dependencies": {

package/dist/service/lambda/serve/event/sim-lambda-url-body-encoding.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-lambda-url-body-encoding.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/event/sim-lambda-url-body-encoding.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC;;;;;OAKG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAgB1C;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAM5D;IAED;;OAEG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAMlE;CACF"}

package/dist/service/lambda/serve/event/sim-lambda-url-body-encoding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sim-lambda-url-body-encoding.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/event/sim-lambda-url-body-encoding.ts"],"names":[],"mappings":"AAAA,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,wBAAwB;IACxB,kBAAkB;IAClB,mCAAmC;IACnC,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IACnC;;;;;OAKG;IACH,MAAM,CAAC,WAA0B;QAC/B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QAE3E,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAiB,EAAE,WAA0B;QAClD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAY,EAAE,eAAwB;QAC3C,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service/lambda/serve/event/sim-lambda-url-event-builder.d.ts

@@ -1,36 +0,0 @@
-import type { SimLambdaFunctionUrl } from "../../function/url/sim-lambda-function-url.js";
-import type { SimLambdaFunctionUrlEvent } from "./sim-lambda-url-event.type.js";
-import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
-import { type SimClock } from "../../../../util/clock/sim-clock.js";
-interface SimLambdaUrlEventBuilderProperties {
-    /**
-     * Clock stamping the event's requestContext time, so a handler sees the same
-     * "now" as the rest of the simulation.
-     */
-    readonly clock?: SimClock;
-}
-/**
- * Builds the payload format 2.0 event a Function URL invocation passes to the
- * function handler.
- *
- * Real Function URLs only speak payload format 2.0, so there is no version to
- * choose. Request headers are passed through as received, including the local
- * Host, while the requestContext describes the AWS-shaped endpoint the URL
- * identifies and the caller, if any, that it authenticated.
- */
-export declare class SimLambdaUrlEventBuilder {
-    private readonly bodyEncoding;
-    private readonly requestParts;
-    private readonly requestContext;
-    constructor(properties?: SimLambdaUrlEventBuilderProperties);
-    /**
-     * Build the invocation event for one Function URL request.
-     *
-     * A caller is supplied only when the Function URL authenticated one, which
-     * is what makes the authorizer block present for an `AWS_IAM` invocation and
-     * absent for a `NONE` one.
-     */
-    build(request: Request, functionUrl: SimLambdaFunctionUrl, authenticatedCaller?: SimAwsRequestCaller): Promise<SimLambdaFunctionUrlEvent>;
-}
-export {};
-//# sourceMappingURL=sim-lambda-url-event-builder.d.ts.map