@kensio/yulin 1.0.0 → 1.1.0

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts

@@ -1,4 +1,4 @@
-import type { SimPayload2JwtAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
+import type { SimPayload2JwtAuthorizer, SimPayload2LambdaAuthorizer } from "../../../../serve/payload-2/sim-payload-2-event.type.js";
 import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
 /**
  * Why an endpoint refused a request, which decides the response it gets.
@@ -6,21 +6,27 @@ import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-c
  * `unauthorized` covers everything up to and including claim validation: real
  * API Gateway answers all of it with one 401 and one body, so a client learns
  * that its token was not accepted and nothing about which check it failed.
- * `forbidden` is only ever an unmet route scope, which is a token that was
- * accepted and does not allow this route.
+ * `forbidden` is an accepted caller the route does not allow, such as an unmet
+ * route scope or an authorizer that said no. `error` is the authorizer itself
+ * failing, which is the API's problem rather than the caller's.
  */
-export type SimHttpApiRefusalKind = "unauthorized" | "forbidden";
+export type SimHttpApiRefusalKind = "unauthorized" | "forbidden" | "error";
 interface SimHttpApiAdmittedProperties {
     /** The token a `JWT` route's authorizer accepted. */
     readonly jwt?: SimPayload2JwtAuthorizer | undefined;
     /** The principal an `AWS_IAM` route allowed the request. */
     readonly caller?: SimAwsRequestCaller | undefined;
+    /**
+     * What a `CUSTOM` route's Lambda authorizer passed on to the integration,
+     * which is `null` when it allowed the request and returned no context.
+     */
+    readonly lambda?: SimPayload2LambdaAuthorizer | null | undefined;
 }
 /**
  * A request the endpoint admitted, and what its authorizer knows about the
  * caller.
  *
- * Both members are absent on a route that authorizes nobody, since there is no
+ * Every member is absent on a route that authorizes nobody, since there is no
  * caller to describe, which is what leaves `requestContext.authorizer` out of
  * the event entirely. Which one is present says which kind of authorization
  * admitted the request.
@@ -29,6 +35,7 @@ export declare class SimHttpApiAdmitted {
     readonly admitted: true;
     readonly jwt: SimPayload2JwtAuthorizer | undefined;
     readonly caller: SimAwsRequestCaller | undefined;
+    readonly lambda: SimPayload2LambdaAuthorizer | null | undefined;
     constructor(properties?: SimHttpApiAdmittedProperties);
 }
 /**
@@ -49,14 +56,23 @@ export declare class SimHttpApiRefused {
     readonly errorDescription: string | undefined;
     private constructor();
     /**
-     * The token was missing, unreadable, or did not verify.
+     * The token was missing, unreadable, or did not verify, or the request did
+     * not carry an identity source a Lambda authorizer was told to read.
      */
     static unauthorized(errorDescription?: string): SimHttpApiRefused;
     /**
-     * The token verified and none of its scopes is one the route asks for, or
-     * IAM did not allow the caller `execute-api:Invoke` on the route.
+     * The token verified and none of its scopes is one the route asks for, IAM
+     * did not allow the caller `execute-api:Invoke` on the route, or a Lambda
+     * authorizer decided against the request.
      */
     static forbidden(): SimHttpApiRefused;
+    /**
+     * The route's authorizer could not answer at all: its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the same 500 an
+     * integration failure gets rather than a refusal the caller could act on.
+     */
+    static error(): SimHttpApiRefused;
 }
 /**
  * What an endpoint decided about one request.

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yDAAyD,CAAC;AACxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,WAAW,CAAC;AAEjE,UAAU,4BAA4B;IACpC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,GAAG,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAExD,YAAY,UAAU,GAAE,4BAAiC,EAGxD;CACF;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAErD,OAAO,eAGN;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEhE;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAEpC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}
+{"version":3,"file":"sim-http-api-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC5B,MAAM,yDAAyD,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAE1F;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3E,UAAU,4BAA4B;IACpC,qDAAqD;IACrD,QAAQ,CAAC,GAAG,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,2BAA2B,GAAG,IAAI,GAAG,SAAS,CAAC;CAClE;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAC7B,SAAgB,QAAQ,OAAiB;IACzC,SAAgB,GAAG,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,SAAgB,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACxD,SAAgB,MAAM,EAAE,2BAA2B,GAAG,IAAI,GAAG,SAAS,CAAC;IAEvE,YAAY,UAAU,GAAE,4BAAiC,EAIxD;CACF;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAC5B,SAAgB,QAAQ,QAAkB;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;IAC5C,SAAgB,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAErD,OAAO,eAGN;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEhE;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAS,IAAI,iBAAiB,CAEpC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAEhC;CACF;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,GAAG,iBAAiB,CAAC"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js

@@ -2,7 +2,7 @@
  * A request the endpoint admitted, and what its authorizer knows about the
  * caller.
  *
- * Both members are absent on a route that authorizes nobody, since there is no
+ * Every member is absent on a route that authorizes nobody, since there is no
  * caller to describe, which is what leaves `requestContext.authorizer` out of
  * the event entirely. Which one is present says which kind of authorization
  * admitted the request.
@@ -11,9 +11,11 @@ export class SimHttpApiAdmitted {
     admitted = true;
     jwt;
     caller;
+    lambda;
     constructor(properties = {}) {
         this.jwt = properties.jwt;
         this.caller = properties.caller;
+        this.lambda = properties.lambda;
     }
 }
 /**
@@ -37,17 +39,28 @@ export class SimHttpApiRefused {
         this.errorDescription = errorDescription;
     }
     /**
-     * The token was missing, unreadable, or did not verify.
+     * The token was missing, unreadable, or did not verify, or the request did
+     * not carry an identity source a Lambda authorizer was told to read.
      */
     static unauthorized(errorDescription) {
         return new SimHttpApiRefused("unauthorized", errorDescription);
     }
     /**
-     * The token verified and none of its scopes is one the route asks for, or
-     * IAM did not allow the caller `execute-api:Invoke` on the route.
+     * The token verified and none of its scopes is one the route asks for, IAM
+     * did not allow the caller `execute-api:Invoke` on the route, or a Lambda
+     * authorizer decided against the request.
      */
     static forbidden() {
         return new SimHttpApiRefused("forbidden");
     }
+    /**
+     * The route's authorizer could not answer at all: its function is missing,
+     * may not be invoked, failed, or replied in a shape API Gateway does not
+     * understand. None of that is the caller's doing, so it is the same 500 an
+     * integration failure gets rather than a refusal the caller could act on.
+     */
+    static error() {
+        return new SimHttpApiRefused("error");
+    }
 }
 //# sourceMappingURL=sim-http-api-authorization.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AAqBA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,GAAG,CAAuC;IAC1C,MAAM,CAAkC;IAExD,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAC5B,gBAAgB,CAAqB;IAErD,YAAoB,IAA2B,EAAE,gBAAyB;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAyB;QAC3C,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-authorization.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorization.ts"],"names":[],"mappings":"AA8BA;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACb,QAAQ,GAAG,IAAa,CAAC;IACzB,GAAG,CAAuC;IAC1C,MAAM,CAAkC;IACxC,MAAM,CAAiD;IAEvE,YAAY,UAAU,GAAiC,EAAE;QACvD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IACZ,QAAQ,GAAG,KAAc,CAAC;IAC1B,IAAI,CAAwB;IAC5B,gBAAgB,CAAqB;IAErD,YAAoB,IAA2B,EAAE,gBAAyB;QACxE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAC,gBAAyB;QAC3C,OAAO,IAAI,iBAAiB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,SAAS;QACd,OAAO,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK;QACV,OAAO,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.d.ts

@@ -0,0 +1,49 @@
+import type { SimHttpApiAuthorization } from "./sim-http-api-authorization.js";
+/**
+ * The decisions one Lambda `REQUEST` authorizer has already made, held for as
+ * long as its `AuthorizerResultTtlInSeconds` says.
+ *
+ * Real API Gateway keys this on the values of the authorizer's identity
+ * sources and nothing else, so by default one decision covers every route of
+ * the API that uses the authorizer. That is the behaviour AWS warns about, and
+ * `$context.routeKey` as an identity source is the documented way to put the
+ * route in the key.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export declare class SimHttpApiAuthorizerResultCache {
+    private readonly ttlSeconds;
+    private readonly results;
+    constructor(ttlSeconds: number);
+    /**
+     * Whether this authorizer caches anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled(): boolean;
+    /**
+     * The decision already made for these identity source values, if one was
+     * made and has not expired.
+     */
+    find(identitySource: readonly string[], at: Date): SimHttpApiAuthorization | undefined;
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: the cache holds the authorizer's answer, whatever it was.
+     */
+    store(identitySource: readonly string[], at: Date, authorization: SimHttpApiAuthorization): void;
+    /**
+     * The key one set of identity source values is held under.
+     *
+     * The values are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    private key;
+}
+//# sourceMappingURL=sim-http-api-authorizer-result-cache.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-result-cache.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAU/E;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,YAAY,UAAU,EAAE,MAAM,EAE7B;IAED;;;;;OAKG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED;;;OAGG;IACH,IAAI,CACF,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,EAAE,EAAE,IAAI,GACP,uBAAuB,GAAG,SAAS,CAerC;IAED;;;;;OAKG;IACH,KAAK,CACH,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,EAAE,EAAE,IAAI,EACR,aAAa,EAAE,uBAAuB,GACrC,IAAI,CASN;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAG;CAGZ"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.js

@@ -0,0 +1,74 @@
+/**
+ * The decisions one Lambda `REQUEST` authorizer has already made, held for as
+ * long as its `AuthorizerResultTtlInSeconds` says.
+ *
+ * Real API Gateway keys this on the values of the authorizer's identity
+ * sources and nothing else, so by default one decision covers every route of
+ * the API that uses the authorizer. That is the behaviour AWS warns about, and
+ * `$context.routeKey` as an identity source is the documented way to put the
+ * route in the key.
+ *
+ * The cache belongs to the authorizer rather than to whatever is serving,
+ * because it outlives one request and one server the way the authorizer does.
+ * It holds no clock of its own: the caller passes the instant it is asking
+ * about, so expiry follows the simulation's clock and a test advances time
+ * rather than waiting.
+ */
+export class SimHttpApiAuthorizerResultCache {
+    ttlSeconds;
+    results = new Map();
+    constructor(ttlSeconds) {
+        this.ttlSeconds = ttlSeconds;
+    }
+    /**
+     * Whether this authorizer caches anything at all.
+     *
+     * A TTL of zero is what switches caching off, and is what an authorizer that
+     * says nothing about it gets.
+     */
+    get isEnabled() {
+        return this.ttlSeconds > 0;
+    }
+    /**
+     * The decision already made for these identity source values, if one was
+     * made and has not expired.
+     */
+    find(identitySource, at) {
+        const cached = this.results.get(this.key(identitySource));
+        if (cached === undefined) {
+            return undefined;
+        }
+        if (cached.expiresAt.getTime() <= at.getTime()) {
+            // Dropped rather than left to be overwritten, so an authorizer that is
+            // never called with these values again does not hold them for ever.
+            this.results.delete(this.key(identitySource));
+            return undefined;
+        }
+        return cached.authorization;
+    }
+    /**
+     * Hold a decision for this authorizer's TTL.
+     *
+     * A refusal is held the same way an admission is, which is what real API
+     * Gateway does: the cache holds the authorizer's answer, whatever it was.
+     */
+    store(identitySource, at, authorization) {
+        if (!this.isEnabled) {
+            return;
+        }
+        this.results.set(this.key(identitySource), {
+            authorization,
+            expiresAt: new Date(at.getTime() + this.ttlSeconds * 1000),
+        });
+    }
+    /**
+     * The key one set of identity source values is held under.
+     *
+     * The values are JSON-encoded rather than joined, so two sets that differ
+     * only in where one value ends and the next begins are different keys.
+     */
+    key(identitySource) {
+        return JSON.stringify(identitySource);
+    }
+}
+//# sourceMappingURL=sim-http-api-authorizer-result-cache.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-authorizer-result-cache.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer-result-cache.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,+BAA+B;IACzB,UAAU,CAAS;IACnB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI,CACF,cAAiC,EACjC,EAAQ;QAER,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,uEAAuE;YACvE,oEAAoE;YACpE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CACH,cAAiC,EACjC,EAAQ,EACR,aAAsC;QAEtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE;YACzC,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,GAAG,CAAC,cAAiC;QAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts

@@ -1,18 +1,17 @@
 import type { Brand } from "../../../../util/brand.type.js";
-import type { SimHttpApiIdentitySource } from "./sim-http-api-identity-source.js";
-import type { SimHttpApiJwtConfiguration, SimHttpApiJwtConfigurationView } from "./sim-http-api-jwt-configuration.js";
+import type { SimHttpApiJwtConfigurationView } from "./sim-http-api-jwt-configuration.js";
 /**
  * The id API Gateway allocates for one authorizer.
  */
 export type SimHttpApiAuthorizerId = Brand<string, "SimHttpApiAuthorizerId">;
 /**
- * The only authorizer type simulated.
+ * The two kinds of authorizer an HTTP API has.
  *
- * A Lambda `REQUEST` authorizer runs code of its own to make the decision, and
- * none of that is simulated, so it is refused at creation rather than created
- * and ignored.
+ * A `JWT` authorizer verifies a token against the keys its issuer publishes. A
+ * `REQUEST` authorizer invokes a Lambda function of its own and does whatever
+ * that function decides.
  */
-export type SimHttpApiAuthorizerType = "JWT";
+export type SimHttpApiAuthorizerType = "JWT" | "REQUEST";
 /**
  * Allocate an authorizer id, in the same opaque shape as a route id.
  */
@@ -20,40 +19,47 @@ export declare function makeSimHttpApiAuthorizerId(): SimHttpApiAuthorizerId;
 interface SimHttpApiAuthorizerProperties {
     readonly authorizerId: SimHttpApiAuthorizerId;
     readonly name: string;
-    readonly identitySource: SimHttpApiIdentitySource;
-    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
 }
 /**
  * Minimal structural authorizer view, as the Create and Get commands return.
+ *
+ * The members below the identity sources belong to one kind of authorizer
+ * each, and only the kind that has them reports them, which is what real API
+ * Gateway answers with.
  */
 export interface SimHttpApiAuthorizerView {
     AuthorizerId: string;
     Name: string;
     AuthorizerType: SimHttpApiAuthorizerType;
     IdentitySource: string[];
-    JwtConfiguration: SimHttpApiJwtConfigurationView;
+    JwtConfiguration?: SimHttpApiJwtConfigurationView;
+    AuthorizerUri?: string;
+    AuthorizerPayloadFormatVersion?: string;
+    EnableSimpleResponses?: boolean;
+    AuthorizerResultTtlInSeconds?: number;
 }
 /**
- * A simulated HTTP API JWT authorizer: which token a route asks for, and which
- * issuer signed it.
+ * A simulated HTTP API authorizer: what a route sends a request through before
+ * it reaches an integration.
  *
  * An authorizer belongs to an API and is attached to routes by id, so one
- * authorizer covers as many routes of the API as name it.
+ * authorizer covers as many routes of the API as name it. What it does with a
+ * request is the subclass's business: the two kinds share an id, a name and
+ * nothing else.
  */
-export declare class SimHttpApiAuthorizer {
-    /**
-     * The type of authorizer this is, which is the only one simulated.
-     */
-    readonly authorizerType: SimHttpApiAuthorizerType;
+export declare abstract class SimHttpApiAuthorizer {
     readonly authorizerId: SimHttpApiAuthorizerId;
     readonly name: string;
-    readonly identitySource: SimHttpApiIdentitySource;
-    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+    /**
+     * The kind of authorizer this is, which is what a route's own authorization
+     * type has to agree with.
+     */
+    abstract readonly authorizerType: SimHttpApiAuthorizerType;
     constructor(properties: SimHttpApiAuthorizerProperties);
     /**
      * Get the AWS-like view of this authorizer.
      */
-    view(): SimHttpApiAuthorizerView;
+    abstract view(): SimHttpApiAuthorizerView;
 }
 export {};
 //# sourceMappingURL=sim-http-api-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EACV,0BAA0B,EAC1B,8BAA8B,EAC/B,MAAM,qCAAqC,CAAC;AAE7C;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAE7C;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,wBAAwB,CAAC;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,EAAE,8BAA8B,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,SAAgB,cAAc,EAAE,wBAAwB,CAAS;IAEjE,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAE7D,YAAY,UAAU,EAAE,8BAA8B,EAKrD;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAQ/B;CACF"}
+{"version":3,"file":"sim-http-api-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAE1F;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,SAAS,CAAC;AAEzD;;GAEG;AACH,wBAAgB,0BAA0B,IAAI,sBAAsB,CAEnE;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,wBAAwB,CAAC;IACzC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,8BAA8B,CAAC;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,8BAAsB,oBAAoB;IACxC,SAAgB,YAAY,EAAE,sBAAsB,CAAC;IACrD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAE3D,YAAY,UAAU,EAAE,8BAA8B,EAGrD;IAED;;OAEG;IACH,QAAQ,CAAC,IAAI,IAAI,wBAAwB,CAAC;CAC3C"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js

@@ -6,38 +6,20 @@ export function makeSimHttpApiAuthorizerId() {
     return faker.helpers.fromRegExp(/[a-z0-9]{6}/);
 }
 /**
- * A simulated HTTP API JWT authorizer: which token a route asks for, and which
- * issuer signed it.
+ * A simulated HTTP API authorizer: what a route sends a request through before
+ * it reaches an integration.
  *
  * An authorizer belongs to an API and is attached to routes by id, so one
- * authorizer covers as many routes of the API as name it.
+ * authorizer covers as many routes of the API as name it. What it does with a
+ * request is the subclass's business: the two kinds share an id, a name and
+ * nothing else.
  */
 export class SimHttpApiAuthorizer {
-    /**
-     * The type of authorizer this is, which is the only one simulated.
-     */
-    authorizerType = "JWT";
     authorizerId;
     name;
-    identitySource;
-    jwtConfiguration;
     constructor(properties) {
         this.authorizerId = properties.authorizerId;
         this.name = properties.name;
-        this.identitySource = properties.identitySource;
-        this.jwtConfiguration = properties.jwtConfiguration;
-    }
-    /**
-     * Get the AWS-like view of this authorizer.
-     */
-    view() {
-        return {
-            AuthorizerId: this.authorizerId,
-            Name: this.name,
-            AuthorizerType: this.authorizerType,
-            IdentitySource: [this.identitySource.expression],
-            JwtConfiguration: this.jwtConfiguration.view(),
-        };
     }
 }
 //# sourceMappingURL=sim-http-api-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAuBxC;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AAoBD;;;;;;GAMG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACa,cAAc,GAA6B,KAAK,CAAC;IAEjD,YAAY,CAAyB;IACrC,IAAI,CAAS;IACb,cAAc,CAA2B;IACzC,gBAAgB,CAA6B;IAE7D,YAAY,UAA0C;QACpD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAmBxC;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAA2B,CAAC;AAC3E,CAAC;AA0BD;;;;;;;;GAQG;AACH,MAAM,OAAgB,oBAAoB;IACxB,YAAY,CAAyB;IACrC,IAAI,CAAS;IAQ7B,YAAY,UAA0C;QACpD,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IAC9B,CAAC;CAMF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The token an identity source value carries, if it carries one at all.
+ *
+ * This is a JWT authorizer's reading of the value. A Lambda `REQUEST`
+ * authorizer is handed the value as it arrived instead, since what it names
+ * may be a cookie or an API key rather than a bearer token.
+ */
+export declare function simHttpApiBearerToken(value: string | undefined): string | undefined;
+//# sourceMappingURL=sim-http-api-bearer-token.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-bearer-token.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.js

@@ -0,0 +1,23 @@
+/**
+ * The authorization scheme a bearer token is usually sent under.
+ *
+ * API Gateway takes the token with or without it, so it is stripped when it is
+ * there rather than required. The comparison is case-insensitive, since HTTP
+ * authorization schemes are.
+ */
+const bearerPrefix = /^bearer\s+/i;
+/**
+ * The token an identity source value carries, if it carries one at all.
+ *
+ * This is a JWT authorizer's reading of the value. A Lambda `REQUEST`
+ * authorizer is handed the value as it arrived instead, since what it names
+ * may be a cookie or an API key rather than a bearer token.
+ */
+export function simHttpApiBearerToken(value) {
+    const token = value?.replace(bearerPrefix, "").trim();
+    if (token === undefined || token.length === 0) {
+        return undefined;
+    }
+    return token;
+}
+//# sourceMappingURL=sim-http-api-bearer-token.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-bearer-token.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,aAAa,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAyB;IAEzB,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.d.ts

@@ -0,0 +1,29 @@
+import { SimHttpApiAuthorizer, type SimHttpApiAuthorizerId, type SimHttpApiAuthorizerView } from "./sim-http-api-authorizer.js";
+import type { SimHttpApiIdentitySource } from "./identity/sim-http-api-identity-source.js";
+import type { SimHttpApiJwtConfiguration } from "./sim-http-api-jwt-configuration.js";
+interface SimHttpApiJwtAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+}
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * There is one identity source rather than a list, which is what a JWT
+ * authorizer takes: a token arrives in one place, and API Gateway refuses a
+ * second source on this kind of authorizer.
+ */
+export declare class SimHttpApiJwtAuthorizer extends SimHttpApiAuthorizer {
+    readonly authorizerType: "JWT";
+    readonly identitySource: SimHttpApiIdentitySource;
+    readonly jwtConfiguration: SimHttpApiJwtConfiguration;
+    constructor(properties: SimHttpApiJwtAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-jwt-authorizer.d.ts.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEtF,UAAU,iCAAiC;IACzC,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAC;CACvD;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,oBAAoB;IAC/D,SAAgB,cAAc,EAAG,KAAK,CAAU;IAEhD,SAAgB,cAAc,EAAE,wBAAwB,CAAC;IACzD,SAAgB,gBAAgB,EAAE,0BAA0B,CAAC;IAE7D,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;OAEG;IACH,IAAI,IAAI,wBAAwB,CAQ/B;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.js

@@ -0,0 +1,32 @@
+import { SimHttpApiAuthorizer, } from "./sim-http-api-authorizer.js";
+/**
+ * A simulated HTTP API JWT authorizer: which token a route asks for, and which
+ * issuer signed it.
+ *
+ * There is one identity source rather than a list, which is what a JWT
+ * authorizer takes: a token arrives in one place, and API Gateway refuses a
+ * second source on this kind of authorizer.
+ */
+export class SimHttpApiJwtAuthorizer extends SimHttpApiAuthorizer {
+    authorizerType = "JWT";
+    identitySource;
+    jwtConfiguration;
+    constructor(properties) {
+        super(properties);
+        this.identitySource = properties.identitySource;
+        this.jwtConfiguration = properties.jwtConfiguration;
+    }
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view() {
+        return {
+            AuthorizerId: this.authorizerId,
+            Name: this.name,
+            AuthorizerType: this.authorizerType,
+            IdentitySource: [this.identitySource.expression],
+            JwtConfiguration: this.jwtConfiguration.view(),
+        };
+    }
+}
+//# sourceMappingURL=sim-http-api-jwt-authorizer.js.map

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-http-api-jwt-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAGrB,MAAM,8BAA8B,CAAC;AAWtC;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,oBAAoB;IAC/C,cAAc,GAAG,KAAc,CAAC;IAEhC,cAAc,CAA2B;IACzC,gBAAgB,CAA6B;IAE7D,YAAY,UAA6C;QACvD,KAAK,CAAC,UAAU,CAAC,CAAC;QAClB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;SAC/C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts

@@ -1,5 +1,5 @@
 import type { SimClock } from "../../../../util/clock/sim-clock.js";
-import type { SimHttpApiAuthorizer } from "./sim-http-api-authorizer.js";
+import type { SimHttpApiJwtAuthorizer } from "./sim-http-api-jwt-authorizer.js";
 import { type SimHttpApiAuthorization } from "./sim-http-api-authorization.js";
 import type { SimHttpApiJwtIssuerKeys } from "./sim-http-api-jwt-issuer-keys.js";
 interface SimHttpApiJwtVerificationProperties {
@@ -30,7 +30,7 @@ export declare class SimHttpApiJwtVerification {
      * Verify a token, answering what the endpoint should do with the request
      * that carried it.
      */
-    verify(authorizer: SimHttpApiAuthorizer, token: string): SimHttpApiAuthorization;
+    verify(authorizer: SimHttpApiJwtAuthorizer, token: string): SimHttpApiAuthorization;
     /**
      * Read the token, or answer undefined for one that is not a JWT at all.
      *

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,oBAAoB,EAChC,KAAK,EAAE,MAAM,GACZ,uBAAuB,CA0BzB;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}
+{"version":3,"file":"sim-http-api-jwt-verification.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IACvD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YAAY,UAAU,EAAE,mCAAmC,EAK1D;IAED;;;OAGG;IACH,MAAM,CACJ,UAAU,EAAE,uBAAuB,EACnC,KAAK,EAAE,MAAM,GACZ,uBAAuB,CA0BzB;IAED;;;;;OAKG;IACH,OAAO,CAAC,MAAM;CAOf"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-http-api-jwt-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAA0B;IACpC,WAAW,CAA2B;IACtC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAwB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAgC,EAChC,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;aACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC;aACpC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACpD,IAAI,kBAAkB,CAAC;gBACrB,GAAG,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE;aAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-http-api-jwt-verification.js","sourceRoot":"","sources":["../../../../../src/service/apigatewayv2/api/authorizer/sim-http-api-jwt-verification.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAQnE;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,yBAAyB;IACnB,UAAU,CAA0B;IACpC,WAAW,CAA2B;IACtC,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAE3C,YAAY,UAA+C;QACzD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,IAAI,wBAAwB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,UAAmC,EACnC,KAAa;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU;aACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC;aACpC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,CACL,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC;YACpD,IAAI,kBAAkB,CAAC;gBACrB,GAAG,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE;aAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/service/apigatewayv2/api/authorizer/sim-http-api-request-authorizer.d.ts

@@ -0,0 +1,56 @@
+import type { SimHttpApiLambdaUri } from "../integration/sim-http-api-lambda-uri.js";
+import type { SimHttpApiIdentitySources } from "./identity/sim-http-api-identity-sources.js";
+import { SimHttpApiAuthorizer, type SimHttpApiAuthorizerId, type SimHttpApiAuthorizerView } from "./sim-http-api-authorizer.js";
+import { SimHttpApiAuthorizerResultCache } from "./sim-http-api-authorizer-result-cache.js";
+/**
+ * The only authorizer payload format simulated, which is the one the rest of
+ * this simulation builds events in.
+ */
+export declare const simHttpApiAuthorizerPayloadFormatVersion = "2.0";
+interface SimHttpApiRequestAuthorizerProperties {
+    readonly authorizerId: SimHttpApiAuthorizerId;
+    readonly name: string;
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly identitySources: SimHttpApiIdentitySources;
+    readonly enableSimpleResponses: boolean;
+    readonly resultTtlSeconds: number;
+}
+/**
+ * A simulated HTTP API Lambda `REQUEST` authorizer: the function a route sends
+ * a request to before it reaches its integration.
+ *
+ * The function decides, so nothing here says what a caller has to present. All
+ * this holds is which function to invoke, what has to be on the request before
+ * it is worth invoking, which of the two answer shapes the function replies in,
+ * and the decisions it has already made.
+ */
+export declare class SimHttpApiRequestAuthorizer extends SimHttpApiAuthorizer {
+    readonly authorizerType: "REQUEST";
+    /**
+     * The Lambda function this authorizer invokes, read from its
+     * `AuthorizerUri`.
+     */
+    readonly lambdaUri: SimHttpApiLambdaUri;
+    readonly identitySources: SimHttpApiIdentitySources;
+    /**
+     * Whether the function answers `{ isAuthorized, context }` rather than a
+     * principal and an IAM policy document.
+     */
+    readonly enableSimpleResponses: boolean;
+    /**
+     * How long a decision is held for, in seconds, with zero meaning none.
+     */
+    readonly resultTtlSeconds: number;
+    /**
+     * The decisions already made, which a request presenting the same identity
+     * source values is served from rather than invoking the function again.
+     */
+    readonly results: SimHttpApiAuthorizerResultCache;
+    constructor(properties: SimHttpApiRequestAuthorizerProperties);
+    /**
+     * Get the AWS-like view of this authorizer.
+     */
+    view(): SimHttpApiAuthorizerView;
+}
+export {};
+//# sourceMappingURL=sim-http-api-request-authorizer.d.ts.map