@kensio/yulin 0.47.0 → 1.1.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.js

@@ -0,0 +1,75 @@
+import { isSimJwtClaimList, } from "../../../../util/jwt/sim-jwt-claims.js";
+/**
+ * The claims a scope can be written in.
+ *
+ * `scope` is what an OAuth 2.0 access token carries, and `scp` is what some
+ * issuers use instead. Cognito writes `scope`.
+ */
+const scopeClaimNames = ["scope", "scp"];
+/**
+ * The claims of an accepted token, as they reach the handler.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. And
+ * `scopes` is null, not an empty list, when the token carries no scope claim.
+ */
+export class SimHttpApiJwtClaims {
+    claims;
+    constructor(claims) {
+        this.claims = claims;
+    }
+    /**
+     * The `requestContext.authorizer.jwt` block for this token.
+     */
+    toAuthorizerContext() {
+        return { claims: this.claimStrings(), scopes: this.scopes() };
+    }
+    /**
+     * The scopes this token claims, or null when it claims none.
+     */
+    scopes() {
+        for (const name of scopeClaimNames) {
+            const claimed = this.claimedScopes(name);
+            if (claimed !== undefined) {
+                return claimed;
+            }
+        }
+        return null;
+    }
+    claimedScopes(name) {
+        const text = this.claims.text(name);
+        if (text !== undefined) {
+            return text.split(/\s+/).filter((scope) => scope.length > 0);
+        }
+        const list = this.claims.textList(name);
+        return list === undefined ? undefined : [...list];
+    }
+    claimStrings() {
+        return Object.fromEntries(Object.entries(this.claims.toRecord()).map(([name, value]) => [
+            name,
+            this.claimString(value),
+        ]));
+    }
+    /**
+     * One claim value as the string the handler receives.
+     *
+     * A nested object claim is JSON-encoded, which is the one shape here that
+     * was not observed on real AWS: no simulated issuer emits one, and neither
+     * does Cognito.
+     */
+    claimString(value) {
+        if (typeof value === "string") {
+            return value;
+        }
+        if (isSimJwtClaimList(value)) {
+            return `[${value.map((entry) => this.claimString(entry)).join(" ")}]`;
+        }
+        if (typeof value === "object" && value !== null) {
+            return JSON.stringify(value);
+        }
+        return String(value);
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-claims.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-claims.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-claims.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,GAGlB,MAAM,wCAAwC,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAe;IAEtC,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAEzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY;QAClB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC5D,IAAI;YACJ,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;SACxB,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,KAAuB;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Minimal structural view of a JWT authorizer's configuration, as the Create
+ * and Get commands carry it.
+ */
+export interface SimHttpApiJwtConfigurationView {
+    Issuer: string;
+    Audience: string[];
+}
+interface SimHttpApiJwtConfigurationProperties {
+    readonly issuer: string;
+    readonly audience: readonly string[];
+}
+/**
+ * Which issuer a JWT authorizer trusts, and which audiences it accepts.
+ *
+ * The issuer is compared to the token's `iss` exactly. Real API Gateway
+ * compares them as strings too, which is why a configured issuer with a
+ * trailing slash rejects tokens from the same issuer without one.
+ */
+export declare class SimHttpApiJwtConfiguration {
+    readonly issuer: string;
+    readonly audience: readonly string[];
+    constructor(properties: SimHttpApiJwtConfigurationProperties);
+    /**
+     * Whether a token's `iss` names the issuer this authorizer trusts.
+     */
+    trustsIssuer(issuer: string | undefined): boolean;
+    /**
+     * Whether any audience the token claims is one this authorizer accepts.
+     */
+    acceptsAudience(claimed: readonly string[]): boolean;
+    /**
+     * The AWS-like view of this configuration.
+     */
+    view(): SimHttpApiJwtConfigurationView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-configuration.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-configuration.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;;;;GAMG;AACH,qBAAa,0BAA0B;IACrC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAE5C,YAAY,UAAU,EAAE,oCAAoC,EAG3D;IAED;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEhD;IAED;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEnD;IAED;;OAEG;IACH,IAAI,IAAI,8BAA8B,CAErC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.js

@@ -0,0 +1,34 @@
+/**
+ * Which issuer a JWT authorizer trusts, and which audiences it accepts.
+ *
+ * The issuer is compared to the token's `iss` exactly. Real API Gateway
+ * compares them as strings too, which is why a configured issuer with a
+ * trailing slash rejects tokens from the same issuer without one.
+ */
+export class SimHttpApiJwtConfiguration {
+    issuer;
+    audience;
+    constructor(properties) {
+        this.issuer = properties.issuer;
+        this.audience = properties.audience;
+    }
+    /**
+     * Whether a token's `iss` names the issuer this authorizer trusts.
+     */
+    trustsIssuer(issuer) {
+        return issuer === this.issuer;
+    }
+    /**
+     * Whether any audience the token claims is one this authorizer accepts.
+     */
+    acceptsAudience(claimed) {
+        return claimed.some((audience) => this.audience.includes(audience));
+    }
+    /**
+     * The AWS-like view of this configuration.
+     */
+    view() {
+        return { Issuer: this.issuer, Audience: [...this.audience] };
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-configuration.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-configuration.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-configuration.ts"],"names":[],"mappings":"AAcA;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;IACrB,MAAM,CAAS;IACf,QAAQ,CAAoB;IAE5C,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAA0B;QACrC,OAAO,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.d.ts

@@ -0,0 +1,37 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The signing keys an issuer publishes, as a JWT authorizer sees them.
+ *
+ * A JWT authorizer accepts any OIDC issuer, so this port is how it reaches one
+ * without depending on whatever simulated service happens to be that issuer.
+ * A standalone SimApiGatewayV2 has the refusing implementation below, which is
+ * what makes an authorizer with nothing behind its issuer refuse every token
+ * rather than admit one it could not check.
+ *
+ * Nothing is fetched over HTTP. A pool's published OpenID configuration names
+ * the localhost origin it is served from, while its tokens name the real AWS
+ * URL, so a discovery client would reject its own issuer's tokens. Resolving
+ * in process compares the two strings that both come from the same getter.
+ */
+export interface SimHttpApiJwtIssuerKeys {
+    /**
+     * The keys published by the issuer this URL names, which is an empty set
+     * when nothing in the simulation issues for it.
+     */
+    publishedBy(issuerUrl: string): SimJwtKeys;
+}
+/**
+ * The keys available to an API Gateway that has no issuer to ask.
+ *
+ * Every issuer publishes nothing, so every token fails key selection and every
+ * request to a JWT route is refused. That is the safe answer for a simulated
+ * API Gateway standing on its own: a route configured to be closed stays
+ * closed.
+ */
+export declare class SimHttpApiNoJwtIssuerKeys implements SimHttpApiJwtIssuerKeys {
+    /**
+     * No issuer publishes anything here.
+     */
+    publishedBy(): SimJwtKeys;
+}
+//# sourceMappingURL=sim-http-api-jwt-issuer-keys.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-issuer-keys.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,qBAAa,yBAA0B,YAAW,uBAAuB;IACvE;;OAEG;IACH,WAAW,IAAI,UAAU,CAExB;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.js

@@ -0,0 +1,18 @@
+import { SimJwtKeys } from "../../../../util/jwt/sim-jwt-keys.js";
+/**
+ * The keys available to an API Gateway that has no issuer to ask.
+ *
+ * Every issuer publishes nothing, so every token fails key selection and every
+ * request to a JWT route is refused. That is the safe answer for a simulated
+ * API Gateway standing on its own: a route configured to be closed stays
+ * closed.
+ */
+export class SimHttpApiNoJwtIssuerKeys {
+    /**
+     * No issuer publishes anything here.
+     */
+    publishedBy() {
+        return new SimJwtKeys([]);
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-issuer-keys.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-issuer-keys.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-issuer-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAwBlE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts

@@ -0,0 +1,43 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import type { SimHttpApiJwtAuthorizer } from "./sim-http-api-jwt-authorizer.js";
+import { type SimHttpApiAuthorization } from "./sim-http-api-authorization.js";
+import type { SimHttpApiJwtIssuerKeys } from "./sim-http-api-jwt-issuer-keys.js";
+interface SimHttpApiJwtVerificationProperties {
+    readonly issuerKeys: SimHttpApiJwtIssuerKeys;
+    readonly clock: SimClock;
+}
+/**
+ * Verifies one token against one JWT authorizer.
+ *
+ * The checks run in the order AWS documents: decode the token, check its
+ * algorithm, find the key its `kid` names, verify the signature, then validate
+ * the claims. AWS lists the signature above the key id; the key has to be
+ * chosen before a signature can be checked, and every one of these answers the
+ * same 401, so the two are not distinguishable from outside.
+ *
+ * `token_use` is not checked, which is what real API Gateway does. An id token
+ * therefore passes an authorizer configured only with an audience, because its
+ * `aud` is the app client id. Route scopes are the only thing that tells the
+ * two token types apart, and they are the route's business rather than this
+ * one's.
+ */
+export declare class SimHttpApiJwtVerification {
+    private readonly issuerKeys;
+    private readonly claimChecks;
+    private readonly rs256;
+    constructor(properties: SimHttpApiJwtVerificationProperties);
+    /**
+     * Verify a token, answering what the endpoint should do with the request
+     * that carried it.
+     */
+    verify(authorizer: SimHttpApiJwtAuthorizer, token: string): SimHttpApiAuthorization;
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    private decode;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-verification.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,MAAM,GACZ,uBAAuB,CA0BzB;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.js

@@ -0,0 +1,70 @@
+import { SimJwtRs256 } from "../../../../util/jwt/sim-jwt-rs256.js";
+import { SimJwt } from "../../../../util/jwt/sim-jwt.js";
+import { SimHttpApiAdmitted, SimHttpApiRefused, } from "./sim-http-api-authorization.js";
+import { SimHttpApiJwtClaimChecks } from "./sim-http-api-jwt-claim-checks.js";
+import { SimHttpApiJwtClaims } from "./sim-http-api-jwt-claims.js";
+/**
+ * Verifies one token against one JWT authorizer.
+ *
+ * The checks run in the order AWS documents: decode the token, check its
+ * algorithm, find the key its `kid` names, verify the signature, then validate
+ * the claims. AWS lists the signature above the key id; the key has to be
+ * chosen before a signature can be checked, and every one of these answers the
+ * same 401, so the two are not distinguishable from outside.
+ *
+ * `token_use` is not checked, which is what real API Gateway does. An id token
+ * therefore passes an authorizer configured only with an audience, because its
+ * `aud` is the app client id. Route scopes are the only thing that tells the
+ * two token types apart, and they are the route's business rather than this
+ * one's.
+ */
+export class SimHttpApiJwtVerification {
+    issuerKeys;
+    claimChecks;
+    rs256 = new SimJwtRs256();
+    constructor(properties) {
+        this.issuerKeys = properties.issuerKeys;
+        this.claimChecks = new SimHttpApiJwtClaimChecks({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Verify a token, answering what the endpoint should do with the request
+     * that carried it.
+     */
+    verify(authorizer, token) {
+        const jwt = this.decode(token);
+        if (jwt === undefined) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        if (!this.rs256.isSupportedAlgorithm(jwt)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        const { jwtConfiguration } = authorizer;
+        const key = this.issuerKeys
+            .publishedBy(jwtConfiguration.issuer)
+            .find(jwt.header.kid);
+        if (key === undefined || !this.rs256.verify(jwt, key)) {
+            return SimHttpApiRefused.unauthorized();
+        }
+        return (this.claimChecks.check(jwt.claims, jwtConfiguration) ??
+            new SimHttpApiAdmitted({
+                jwt: new SimHttpApiJwtClaims(jwt.claims).toAuthorizerContext(),
+            }));
+    }
+    /**
+     * Read the token, or answer undefined for one that is not a JWT at all.
+     *
+     * The refusal for an unreadable token and for one that fails verification is
+     * the same, so nothing is gained by carrying the parse error further.
+     */
+    decode(token) {
+        try {
+            return SimJwt.parse(token);
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-verification.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAA0B;IACpC,WAAW,CAA2B;IACtC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAwB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAmC,EACnC,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;aACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC;aACpC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACpD,IAAI,kBAAkB,CAAC;gBACrB,GAAG,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE;aAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.d.ts

@@ -0,0 +1,56 @@
+import type { SimHttpApiLambdaUri } from "../integration/sim-http-api-lambda-uri.js";
+import type { SimHttpApiIdentitySources } from "./identity/sim-http-api-identity-sources.js";
+import { SimHttpApiAuthorizer, type SimHttpApiAuthorizerId, type SimHttpApiAuthorizerView } from "./sim-http-api-authorizer.js";
+import { SimHttpApiAuthorizerResultCache } from "./sim-http-api-authorizer-result-cache.js";
+/**
+ * The only authorizer payload format simulated, which is the one the rest of
+ * this simulation builds events in.
+ */
+export declare const simHttpApiAuthorizerPayloadFormatVersion = "2.0";
+interface SimHttpApiRequestAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly identitySources: SimHttpApiIdentitySources;
+    readonly enableSimpleResponses: boolean;
+    readonly resultTtlSeconds: number;
+}
+/**
+ * A simulated HTTP API Lambda `REQUEST` authorizer: the function a route sends
+ * a request to before it reaches its integration.
+ *
+ * The function decides, so nothing here says what a caller has to present. All
+ * this holds is which function to invoke, what has to be on the request before
+ * it is worth invoking, which of the two answer shapes the function replies in,
+ * and the decisions it has already made.
+ */
+export declare class SimHttpApiRequestAuthorizer extends SimHttpApiAuthorizer {
+    readonly authorizerType: "REQUEST";
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `AuthorizerUri`.
+     */
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly identitySources: SimHttpApiIdentitySources;
+    /**
+     * Whether the function answers `{ isAuthorized, context }` rather than a
+     * principal and an IAM policy document.
+     */
+    readonly enableSimpleResponses: boolean;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    readonly resultTtlSeconds: number;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * source values is served from rather than invoking the function again.
+     */
+    readonly results: SimHttpApiAuthorizerResultCache;
+    constructor(properties: SimHttpApiRequestAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-request-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,wCAAwC,QAAQ,CAAC;AAE9D,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,2BAA4B,SAAQ,oBAAoB;IACnE,SAAgB,cAAc,EAAG,SAAS,CAAU;IAEpD;;;OAGG;IACH,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAE/C,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAE3D;;;OAGG;IACH,SAAgB,qBAAqB,EAAE,OAAO,CAAC;IAE/C;;OAEG;IACH,SAAgB,gBAAgB,EAAE,MAAM,CAAC;IAEzC;;;OAGG;IACH,SAAgB,OAAO,EAAE,+BAA+B,CAAC;IAEzD,YAAY,UAAU,EAAE,qCAAqC,EAS5D;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAW/B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.js

@@ -0,0 +1,63 @@
+import { SimHttpApiAuthorizer, } from "./sim-http-api-authorizer.js";
+import { SimHttpApiAuthorizerResultCache } from "./sim-http-api-authorizer-result-cache.js";
+/**
+ * The only authorizer payload format simulated, which is the one the rest of
+ * this simulation builds events in.
+ */
+export const simHttpApiAuthorizerPayloadFormatVersion = "2.0";
+/**
+ * A simulated HTTP API Lambda `REQUEST` authorizer: the function a route sends
+ * a request to before it reaches its integration.
+ *
+ * The function decides, so nothing here says what a caller has to present. All
+ * this holds is which function to invoke, what has to be on the request before
+ * it is worth invoking, which of the two answer shapes the function replies in,
+ * and the decisions it has already made.
+ */
+export class SimHttpApiRequestAuthorizer extends SimHttpApiAuthorizer {
+    authorizerType = "REQUEST";
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `AuthorizerUri`.
+     */
+    lambdaUri;
+    identitySources;
+    /**
+     * Whether the function answers `{ isAuthorized, context }` rather than a
+     * principal and an IAM policy document.
+     */
+    enableSimpleResponses;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    resultTtlSeconds;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * source values is served from rather than invoking the function again.
+     */
+    results;
+    constructor(properties) {
+        super(properties);
+        this.lambdaUri = properties.lambdaUri;
+        this.identitySources = properties.identitySources;
+        this.enableSimpleResponses = properties.enableSimpleResponses;
+        this.resultTtlSeconds = properties.resultTtlSeconds;
+        this.results = new SimHttpApiAuthorizerResultCache(properties.resultTtlSeconds);
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            AuthorizerId: this.authorizerId,
+            Name: this.name,
+            AuthorizerType: this.authorizerType,
+            IdentitySource: this.identitySources.expressions,
+            AuthorizerUri: this.lambdaUri.uri,
+            AuthorizerPayloadFormatVersion: simHttpApiAuthorizerPayloadFormatVersion,
+            EnableSimpleResponses: this.enableSimpleResponses,
+            AuthorizerResultTtlInSeconds: this.resultTtlSeconds,
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-request-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-request-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,oBAAoB,GAGrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAE5F;;;GAGG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,KAAK,CAAC;AAW9D;;;;;;;;GAQG;AACH,MAAM,OAAO,2BAA4B,SAAQ,oBAAoB;IACnD,cAAc,GAAG,SAAkB,CAAC;IAEpD;;;OAGG;IACa,SAAS,CAAsB;IAE/B,eAAe,CAA4B;IAE3D;;;OAGG;IACa,qBAAqB,CAAU;IAE/C;;OAEG;IACa,gBAAgB,CAAS;IAEzC;;;OAGG;IACa,OAAO,CAAkC;IAEzD,YAAY,UAAiD;QAC3D,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;QAClD,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAAqB,CAAC;QAC9D,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,IAAI,+BAA+B,CAChD,UAAU,CAAC,gBAAgB,CAC5B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW;YAChD,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG;YACjC,8BAA8B,EAAE,wCAAwC;YACxE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;YACjD,4BAA4B,EAAE,IAAI,CAAC,gBAAgB;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.d.ts

@@ -0,0 +1,27 @@
+import { type SimHttpApiIntegration, type SimHttpApiIntegrationId } from "./sim-http-api-integration.js";
+/**
+ * The integrations of one API, keyed by the id the API allocated for them.
+ *
+ * Integrations belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export declare class SimHttpApiIntegrationStore {
+    private readonly integrations;
+    /**
+     * Allocate an integration id this API is not already using.
+     */
+    allocateId(): SimHttpApiIntegrationId;
+    /**
+     * Add an integration to this API.
+     */
+    add(integration: SimHttpApiIntegration): void;
+    /**
+     * Find an integration by id.
+     */
+    find(integrationId: string): SimHttpApiIntegration | undefined;
+    /**
+     * List every integration of this API, in the order they were created.
+     */
+    list(): SimHttpApiIntegration[];
+}
+//# sourceMappingURL=sim-http-api-integration-store.d.ts.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-store.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAE7B,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IAEJ;;OAEG;IACH,UAAU,IAAI,uBAAuB,CASpC;IAED;;OAEG;IACH,GAAG,CAAC,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAE5C;IAED;;OAEG;IACH,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAE7D;IAED;;OAEG;IACH,IAAI,IAAI,qBAAqB,EAAE,CAE9B;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.js

@@ -0,0 +1,40 @@
+import { makeSimHttpApiIntegrationId, } from "./sim-http-api-integration.js";
+/**
+ * The integrations of one API, keyed by the id the API allocated for them.
+ *
+ * Integrations belong to an API on real AWS, so ids only have to be unique
+ * within one, and this store is what makes them so.
+ */
+export class SimHttpApiIntegrationStore {
+    integrations = new Map();
+    /**
+     * Allocate an integration id this API is not already using.
+     */
+    allocateId() {
+        let integrationId = makeSimHttpApiIntegrationId();
+        while (this.integrations.has(integrationId)) {
+            /* v8 ignore next -- does not happen in practice */
+            integrationId = makeSimHttpApiIntegrationId();
+        }
+        return integrationId;
+    }
+    /**
+     * Add an integration to this API.
+     */
+    add(integration) {
+        this.integrations.set(integration.integrationId, integration);
+    }
+    /**
+     * Find an integration by id.
+     */
+    find(integrationId) {
+        return this.integrations.get(integrationId);
+    }
+    /**
+     * List every integration of this API, in the order they were created.
+     */
+    list() {
+        return this.integrations.values().toArray();
+    }
+}
+//# sourceMappingURL=sim-http-api-integration-store.js.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration-store.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,2BAA2B,GAC5B,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACpB,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,UAAU;QACR,IAAI,aAAa,GAAG,2BAA2B,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAC5C,mDAAmD;YACnD,aAAa,GAAG,2BAA2B,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,WAAkC;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,aAAqB;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,aAAwC,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.d.ts

@@ -0,0 +1,66 @@
+import type { Brand } from "../../../../util/brand.type.js";
+import type { SimHttpApiLambdaUri } from "./sim-http-api-lambda-uri.js";
+/**
+ * The id API Gateway allocates for one integration.
+ */
+export type SimHttpApiIntegrationId = Brand<string, "SimHttpApiIntegrationId">;
+/**
+ * The only integration type simulated: a Lambda proxy integration.
+ */
+export type SimHttpApiIntegrationType = "AWS_PROXY";
+/**
+ * The only payload format simulated. Format 1.0 is refused rather than quietly
+ * treated as 2.0, because a handler written for 1.0 reads event fields a 2.0
+ * event does not have.
+ */
+export type SimHttpApiPayloadFormatVersion = "2.0";
+/**
+ * Allocate an integration id.
+ *
+ * Real API Gateway ids are opaque short lowercase alphanumeric strings; the
+ * exact length is not part of the API contract, so only the shape is matched.
+ */
+export declare function makeSimHttpApiIntegrationId(): SimHttpApiIntegrationId;
+interface SimHttpApiIntegrationProperties {
+    readonly integrationId: SimHttpApiIntegrationId;
+    readonly integrationType: SimHttpApiIntegrationType;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly payloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    readonly description?: string | undefined;
+}
+/**
+ * Minimal structural integration view, as the Create and Get commands return.
+ */
+export interface SimHttpApiIntegrationView {
+    IntegrationId: string;
+    IntegrationType: SimHttpApiIntegrationType;
+    IntegrationUri: string;
+    PayloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    Description?: string;
+}
+/**
+ * A simulated HTTP API integration: what the API does with a request one of
+ * its routes matched.
+ *
+ * Only `AWS_PROXY` is modelled, so an integration is a Lambda function and the
+ * payload format that function is invoked with.
+ */
+export declare class SimHttpApiIntegration {
+    readonly integrationId: SimHttpApiIntegrationId;
+    readonly integrationType: SimHttpApiIntegrationType;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly payloadFormatVersion: SimHttpApiPayloadFormatVersion;
+    readonly description?: string | undefined;
+    constructor(properties: SimHttpApiIntegrationProperties);
+    /**
+     * The ARN of the Lambda function this integration invokes, as the request
+     * gave it and the API hands it back.
+     */
+    get integrationUri(): string;
+    /**
+     * Get the AWS-like view of this integration.
+     */
+    view(): SimHttpApiIntegrationView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-integration.d.ts.map

package/dist/service/apigatewayv2/api/integration/sim-http-api-integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-integration.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/integration/sim-http-api-integration.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,KAAK,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,KAAK,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,uBAAuB,CAErE;AAED,UAAU,+BAA+B;IACvC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,8BAA8B,CAAC;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,yBAAyB,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,8BAA8B,CAAC;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAChC,SAAgB,aAAa,EAAE,uBAAuB,CAAC;IACvD,SAAgB,eAAe,EAAE,yBAAyB,CAAC;IAC3D,SAAgB,SAAS,EAAE,mBAAmB,CAAC;IAC/C,SAAgB,oBAAoB,EAAE,8BAA8B,CAAC;IACrE,SAAgB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEjD,YAAY,UAAU,EAAE,+BAA+B,EAMtD;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;;OAEG;IACH,IAAI,IAAI,yBAAyB,CAahC;CACF"}