@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.js

@@ -0,0 +1,20 @@
+import { simRestApiHeaderIdentityPrefix } from "../api/authorizer/identity/sim-rest-api-header-identity-source.js";
+/**
+ * The header an `apiKey` security scheme names, which is where AWS reads the
+ * identity source of a `TOKEN` or `COGNITO_USER_POOLS` authorizer from.
+ *
+ * Both kinds read one header and nothing else, and the scheme's own `name` and
+ * `in` are what say which. An `x-amazon-apigateway-authorizer` of either kind
+ * carries no `identitySource` of its own, so a scheme that writes one is
+ * refused where it wrote it rather than importing as a header it did not name.
+ */
+export function simRestApiOpenApiSchemeIdentitySource(scheme) {
+    const where = scheme.member("in");
+    const declared = where.requiredString();
+    if (declared !== "header") {
+        throw where.refusal(`is '${declared}', and the authorizer this scheme declares reads one ` +
+            `request header, so the scheme names that header with 'in: header'`);
+    }
+    return `${simRestApiHeaderIdentityPrefix}${scheme.member("name").requiredString()}`;
+}
+//# sourceMappingURL=sim-rest-api-openapi-scheme-identity-source.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-scheme-identity-source.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-scheme-identity-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,mEAAmE,CAAC;AAGnH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAExC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CACjB,OAAO,QAAQ,uDAAuD;YACpE,mEAAmE,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;AACtF,CAAC"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.d.ts

@@ -0,0 +1,26 @@
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+/**
+ * One `components.securitySchemes` member, read into what the methods naming
+ * it are gated by.
+ *
+ * Which of the three kinds of authorization a scheme declares is decided here,
+ * by `x-amazon-apigateway-authtype`, and reading each kind of authorizer is
+ * the class named after it. A scheme whose authtype and whose authorizer type
+ * disagree is refused rather than resolved either way.
+ */
+export declare class SimRestApiOpenApiSecurityScheme {
+    private readonly scheme;
+    constructor(scheme: SimRestApiOpenApiObject);
+    /**
+     * The CreateAuthorizer input this scheme asks for, or nothing at all when it
+     * declares a method decided by IAM.
+     */
+    createAuthorizerInput(restApiId: string, name: string): SimCreateAuthorizerCommandInput | undefined;
+    /**
+     * The kind of authorization this scheme declares, refusing a scheme a REST
+     * API method cannot be gated by.
+     */
+    private authType;
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-scheme.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAOnG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAmChF;;;;;;;;GAQG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,MAAM,EAAE,uBAAuB,EAE1C;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,+BAA+B,GAAG,SAAS,CA6B7C;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAwBjB"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.js

@@ -0,0 +1,88 @@
+import { simRestApiOpenApiAuthorizerType, simRestApiOpenApiDeclaresAuthorizer, } from "./sim-rest-api-openapi-authorizer-type.js";
+import { SimRestApiOpenApiCognitoAuthorizerScheme } from "./sim-rest-api-openapi-cognito-authorizer-scheme.js";
+import { SimRestApiOpenApiLambdaAuthorizerScheme } from "./sim-rest-api-openapi-lambda-authorizer-scheme.js";
+/**
+ * The security scheme type a REST API declares every authorizer under.
+ *
+ * `custom`, `cognito_user_pools` and `awsSigv4` are all written as an `apiKey`
+ * scheme naming the header the caller presents, and told apart by
+ * `x-amazon-apigateway-authtype`.
+ */
+const apiKeySchemeType = "apiKey";
+/**
+ * The `x-amazon-apigateway-authtype` of a method decided by IAM, which
+ * declares no authorizer of its own.
+ */
+const iamAuthType = "awsSigv4";
+const schemeTypeRefusal = `is not '${apiKeySchemeType}', and a REST API declares every authorizer it ` +
+    `has as an apiKey scheme naming the header the caller presents. An http, ` +
+    `oauth2 or openIdConnect scheme names nothing a REST API method is gated by.`;
+const apiKeyRefusal = "is required: an apiKey scheme carrying no x-amazon-apigateway-authtype " +
+    "declares an API key, and API keys and usage plans are not simulated";
+const authTypeRefusal = `and a REST API method is decided by a 'custom' Lambda authorizer, a ` +
+    `'cognito_user_pools' one, or '${iamAuthType}' IAM authorization`;
+const iamAuthorizerRefusal = `declares an authorizer to invoke or verify a token with, and the scheme ` +
+    `carrying it declares x-amazon-apigateway-authtype '${iamAuthType}', which ` +
+    `is decided by IAM and asks nothing else`;
+/**
+ * One `components.securitySchemes` member, read into what the methods naming
+ * it are gated by.
+ *
+ * Which of the three kinds of authorization a scheme declares is decided here,
+ * by `x-amazon-apigateway-authtype`, and reading each kind of authorizer is
+ * the class named after it. A scheme whose authtype and whose authorizer type
+ * disagree is refused rather than resolved either way.
+ */
+export class SimRestApiOpenApiSecurityScheme {
+    scheme;
+    constructor(scheme) {
+        this.scheme = scheme;
+    }
+    /**
+     * The CreateAuthorizer input this scheme asks for, or nothing at all when it
+     * declares a method decided by IAM.
+     */
+    createAuthorizerInput(restApiId, name) {
+        const authType = this.authType();
+        if (authType === iamAuthType) {
+            this.scheme.refuseMember("x-amazon-apigateway-authorizer", iamAuthorizerRefusal);
+            return undefined;
+        }
+        const authorizer = this.scheme
+            .member("x-amazon-apigateway-authorizer")
+            .object();
+        const type = simRestApiOpenApiAuthorizerType(authorizer, authType);
+        if (type === "COGNITO_USER_POOLS") {
+            return new SimRestApiOpenApiCognitoAuthorizerScheme({
+                scheme: this.scheme,
+                authorizer,
+            }).createAuthorizerInput(restApiId, name);
+        }
+        return new SimRestApiOpenApiLambdaAuthorizerScheme({
+            scheme: this.scheme,
+            authorizer,
+            type,
+        }).createAuthorizerInput(restApiId, name);
+    }
+    /**
+     * The kind of authorization this scheme declares, refusing a scheme a REST
+     * API method cannot be gated by.
+     */
+    authType() {
+        const schemeType = this.scheme.member("type");
+        if (schemeType.requiredString() !== apiKeySchemeType) {
+            throw schemeType.refusal(schemeTypeRefusal);
+        }
+        const declared = this.scheme.member("x-amazon-apigateway-authtype");
+        if (declared.absent()) {
+            throw declared.refusal(apiKeyRefusal);
+        }
+        const authType = declared.requiredString();
+        if (authType !== iamAuthType &&
+            !simRestApiOpenApiDeclaresAuthorizer(authType)) {
+            throw declared.refusal(`is '${authType}', ${authTypeRefusal}`);
+        }
+        return authType;
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-scheme.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-scheme.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-scheme.ts"],"names":[],"mappings":"AACA,OAAO,EACL,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,qDAAqD,CAAC;AAC/G,OAAO,EAAE,uCAAuC,EAAE,MAAM,oDAAoD,CAAC;AAG7G;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC;;;GAGG;AACH,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,MAAM,iBAAiB,GACrB,WAAW,gBAAgB,iDAAiD;IAC5E,0EAA0E;IAC1E,6EAA6E,CAAC;AAEhF,MAAM,aAAa,GACjB,yEAAyE;IACzE,qEAAqE,CAAC;AAExE,MAAM,eAAe,GACnB,sEAAsE;IACtE,iCAAiC,WAAW,qBAAqB,CAAC;AAEpE,MAAM,oBAAoB,GACxB,0EAA0E;IAC1E,sDAAsD,WAAW,WAAW;IAC5E,yCAAyC,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACzB,MAAM,CAA0B;IAEjD,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,qBAAqB,CACnB,SAAiB,EACjB,IAAY;QAEZ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,gCAAgC,EAChC,oBAAoB,CACrB,CAAC;YAEF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;aAC3B,MAAM,CAAC,gCAAgC,CAAC;aACxC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,+BAA+B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,OAAO,IAAI,wCAAwC,CAAC;gBAClD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU;aACX,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,uCAAuC,CAAC;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,IAAI;SACL,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACK,QAAQ;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE9C,IAAI,UAAU,CAAC,cAAc,EAAE,KAAK,gBAAgB,EAAE,CAAC;YACrD,MAAM,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;QAE3C,IACE,QAAQ,KAAK,WAAW;YACxB,CAAC,mCAAmC,CAAC,QAAQ,CAAC,EAC9C,CAAC;YACD,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,QAAQ,MAAM,eAAe,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.d.ts

@@ -0,0 +1,53 @@
+import type { SimRestApiAuthorizerView } from "../api/authorizer/sim-rest-api-authorizer.js";
+import type { SimCreateAuthorizerCommandInput } from "../command/authorizer/authorizer.command.js";
+import type { SimRestApiOpenApiSecurityRequirement } from "./sim-rest-api-openapi-operation.js";
+import type { SimRestApiOpenApiPointer } from "./sim-rest-api-openapi-pointer.js";
+import type { SimRestApiOpenApiValue } from "./sim-rest-api-openapi-value.js";
+/**
+ * What one security scheme comes to.
+ */
+export interface SimRestApiOpenApiSchemeAuthorizer {
+    /**
+     * The authorizer to create, or nothing when the scheme declares a method
+     * decided by IAM, which asks no authorizer anything.
+     */
+    readonly input: SimCreateAuthorizerCommandInput | undefined;
+    /** Where the scheme is, for a refusal CreateAuthorizer makes about it. */
+    readonly pointer: SimRestApiOpenApiPointer;
+}
+interface SimRestApiOpenApiSecuritySchemesProperties {
+    readonly schemes: SimRestApiOpenApiValue;
+}
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every method naming it,
+ * which is what a REST API has: an authorizer belongs to the API rather than
+ * to a method. A scheme nothing names creates nothing, so it is never read and
+ * never refused.
+ */
+export declare class SimRestApiOpenApiSecuritySchemes {
+    private readonly schemes;
+    private readonly created;
+    constructor(properties: SimRestApiOpenApiSecuritySchemesProperties);
+    /**
+     * What the scheme a requirement names gates its methods with.
+     */
+    authorizer(restApiId: string, requirement: SimRestApiOpenApiSecurityRequirement): SimRestApiOpenApiSchemeAuthorizer;
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName: string): SimRestApiAuthorizerView | undefined;
+    /**
+     * Remember the authorizer created for a scheme, so the next method naming it
+     * shares that one.
+     */
+    remember(schemeName: string, authorizer: SimRestApiAuthorizerView): void;
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    private scheme;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-openapi-security-schemes.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-schemes.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,6CAA6C,CAAC;AAEnG,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,+BAA+B,GAAG,SAAS,CAAC;IAC5D,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;CAC5C;AAED,UAAU,0CAA0C;IAClD,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,qBAAa,gCAAgC;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+C;IAEvE,YAAY,UAAU,EAAE,0CAA0C,EAEjE;IAED;;OAEG;IACH,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,oCAAoC,GAChD,iCAAiC,CAUnC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAE1E;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAEvE;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;CAcf"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.js

@@ -0,0 +1,52 @@
+import { SimRestApiOpenApiSecurityScheme } from "./sim-rest-api-openapi-security-scheme.js";
+/**
+ * The `components.securitySchemes` an operation's security requirement names.
+ *
+ * One authorizer is created per scheme name, shared by every method naming it,
+ * which is what a REST API has: an authorizer belongs to the API rather than
+ * to a method. A scheme nothing names creates nothing, so it is never read and
+ * never refused.
+ */
+export class SimRestApiOpenApiSecuritySchemes {
+    schemes;
+    created = new Map();
+    constructor(properties) {
+        this.schemes = properties.schemes;
+    }
+    /**
+     * What the scheme a requirement names gates its methods with.
+     */
+    authorizer(restApiId, requirement) {
+        const scheme = this.scheme(requirement);
+        return {
+            input: new SimRestApiOpenApiSecurityScheme(scheme).createAuthorizerInput(restApiId, requirement.schemeName),
+            pointer: scheme.pointer,
+        };
+    }
+    /**
+     * The authorizer already created for a scheme, if one was.
+     */
+    createdAuthorizer(schemeName) {
+        return this.created.get(schemeName);
+    }
+    /**
+     * Remember the authorizer created for a scheme, so the next method naming it
+     * shares that one.
+     */
+    remember(schemeName, authorizer) {
+        this.created.set(schemeName, authorizer);
+    }
+    /**
+     * The security scheme a requirement names, refusing one the document does
+     * not define.
+     */
+    scheme(requirement) {
+        const schemes = this.schemes.optionalObject();
+        if (schemes?.has(requirement.schemeName) !== true) {
+            throw requirement.value.refusal(`names the security scheme '${requirement.schemeName}', which ` +
+                `${this.schemes.pointer.toString()} does not define`);
+        }
+        return schemes.member(requirement.schemeName).object();
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-security-schemes.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-security-schemes.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-security-schemes.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAoB5F;;;;;;;GAOG;AACH,MAAM,OAAO,gCAAgC;IAC1B,OAAO,CAAyB;IAChC,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAEvE,YAAY,UAAsD;QAChE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,UAAU,CACR,SAAiB,EACjB,WAAiD;QAEjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAExC,OAAO;YACL,KAAK,EAAE,IAAI,+BAA+B,CAAC,MAAM,CAAC,CAAC,qBAAqB,CACtE,SAAS,EACT,WAAW,CAAC,UAAU,CACvB;YACD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,UAAkB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAoC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,MAAM,CACZ,WAAiD;QAEjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAE9C,IAAI,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAC7B,8BAA8B,WAAW,CAAC,UAAU,WAAW;gBAC7D,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CACvD,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,CAAC;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.d.ts

@@ -0,0 +1,60 @@
+import type { JSONValue } from "../../../util/type-guard/json.js";
+import type { SimApiGatewayBadRequest } from "../error/sim-api-gateway.error.js";
+import { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+import type { SimRestApiOpenApiPointer } from "./sim-rest-api-openapi-pointer.js";
+interface SimRestApiOpenApiValueProperties {
+    readonly pointer: SimRestApiOpenApiPointer;
+    readonly value: JSONValue | undefined;
+}
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export declare class SimRestApiOpenApiValue {
+    readonly pointer: SimRestApiOpenApiPointer;
+    private readonly value;
+    constructor(properties: SimRestApiOpenApiValueProperties);
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent(): boolean;
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason: string): SimApiGatewayBadRequest;
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object(): SimRestApiOpenApiObject;
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject(): SimRestApiOpenApiObject | undefined;
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString(): string;
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString(): string | undefined;
+    /**
+     * This value as a number when the document carries one, which is the shape
+     * an authorizer's `authorizerResultTtlInSeconds` takes.
+     */
+    optionalNumber(): number | undefined;
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray(): readonly SimRestApiOpenApiValue[] | undefined;
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList(): readonly string[] | undefined;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-openapi-value.d.ts.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-value.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-value.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGlF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACvC;AAID;;;;;;;GAOG;AACH,qBAAa,sBAAsB;IACjC,SAAgB,OAAO,EAAE,wBAAwB,CAAC;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAGvD;IAED;;OAEG;IACH,MAAM,IAAI,OAAO,CAEhB;IAED;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAE/C;IAED;;OAEG;IACH,MAAM,IAAI,uBAAuB,CAQhC;IAED;;OAEG;IACH,cAAc,IAAI,uBAAuB,GAAG,SAAS,CAiBpD;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,CAQvB;IAED;;OAEG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;;OAGG;IACH,cAAc,IAAI,MAAM,GAAG,SAAS,CAUnC;IAED;;OAEG;IACH,aAAa,IAAI,SAAS,sBAAsB,EAAE,GAAG,SAAS,CAgB7D;IAED;;OAEG;IACH,kBAAkB,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,CAElD;CACF"}

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.js

@@ -0,0 +1,115 @@
+import { SimRestApiOpenApiObject } from "./sim-rest-api-openapi-object.js";
+import { simRestApiOpenApiRefusal } from "./sim-rest-api-openapi-refusal.js";
+const missing = "is required, and the document does not carry it";
+/**
+ * One value of the document being imported, at the pointer that reaches it.
+ *
+ * A document arrives as whatever JSON held, so every read narrows a value and
+ * refuses the shapes it cannot be. Nothing here knows what any member means:
+ * that is the readers above, which is what keeps the narrowing in one place
+ * and the meaning in classes named after the thing they read.
+ */
+export class SimRestApiOpenApiValue {
+    pointer;
+    value;
+    constructor(properties) {
+        this.pointer = properties.pointer;
+        this.value = properties.value;
+    }
+    /**
+     * Whether the document leaves this member out.
+     */
+    absent() {
+        return this.value === undefined;
+    }
+    /**
+     * Refuse this member, naming where it is in the document.
+     */
+    refusal(reason) {
+        return simRestApiOpenApiRefusal(this.pointer, reason);
+    }
+    /**
+     * This value as an object, refusing a document that left it out.
+     */
+    object() {
+        const object = this.optionalObject();
+        if (object === undefined) {
+            throw this.refusal(missing);
+        }
+        return object;
+    }
+    /**
+     * This value as an object when the document carries one.
+     */
+    optionalObject() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (typeof this.value !== "object" ||
+            this.value === null ||
+            Array.isArray(this.value)) {
+            throw this.refusal("has to be an object");
+        }
+        return new SimRestApiOpenApiObject({
+            pointer: this.pointer,
+            members: new Map(Object.entries(this.value)),
+        });
+    }
+    /**
+     * This value as a string, refusing a document that left it out.
+     */
+    requiredString() {
+        const text = this.optionalString();
+        if (text === undefined || text.length === 0) {
+            throw this.refusal(missing);
+        }
+        return text;
+    }
+    /**
+     * This value as a string when the document carries one.
+     */
+    optionalString() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (typeof this.value !== "string") {
+            throw this.refusal("has to be a string");
+        }
+        return this.value;
+    }
+    /**
+     * This value as a number when the document carries one, which is the shape
+     * an authorizer's `authorizerResultTtlInSeconds` takes.
+     */
+    optionalNumber() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (typeof this.value !== "number") {
+            throw this.refusal("has to be a number");
+        }
+        return this.value;
+    }
+    /**
+     * The entries of this value as an array, when the document carries one.
+     */
+    optionalArray() {
+        if (this.value === undefined) {
+            return undefined;
+        }
+        if (!Array.isArray(this.value)) {
+            throw this.refusal("has to be an array");
+        }
+        return this.value.map((entry, index) => new SimRestApiOpenApiValue({
+            pointer: this.pointer.child(String(index)),
+            value: entry,
+        }));
+    }
+    /**
+     * The entries of this value as strings, when the document carries them.
+     */
+    optionalStringList() {
+        return this.optionalArray()?.map((entry) => entry.requiredString());
+    }
+}
+//# sourceMappingURL=sim-rest-api-openapi-value.js.map

package/dist/service/apigateway/openapi/sim-rest-api-openapi-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-openapi-value.js","sourceRoot":"","sources":["../../../../src/service/apigateway/openapi/sim-rest-api-openapi-value.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAO7E,MAAM,OAAO,GAAG,iDAAiD,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,OAAO,sBAAsB;IACjB,OAAO,CAA2B;IACjC,KAAK,CAAwB;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC9B,IAAI,CAAC,KAAK,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACzB,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAEnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CACnB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACf,IAAI,sBAAsB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1C,KAAK,EAAE,KAAK;SACb,CAAC,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/service/apigateway/registry/sim-rest-api-registry.d.ts

@@ -0,0 +1,36 @@
+import type { SimAwsAccountId } from "../../aws/sim-aws-account.js";
+import { type SimRestApiId } from "../api/sim-rest-api-id.js";
+/**
+ * Simulated API Gateway cross-Account registry of REST API ids.
+ *
+ * A served request carries its Region in the hostname and no Account, while
+ * simulated API Gateway state is per Account and Region. This registry is the
+ * hop from an API id to the Account owning it, which is why REST API ids are
+ * allocated here and are unique across every Account and Region of one
+ * simulated AWS environment.
+ *
+ * REST APIs and HTTP APIs share the `execute-api` hostname namespace on real
+ * AWS, and their ids have the same shape. Each service registers its own ids
+ * here and in the HTTP API registry, and resolving a served hostname across
+ * both belongs with the serving layer that does the resolving.
+ */
+export declare class SimRestApiRegistry {
+    private readonly apiAccountIds;
+    /**
+     * Allocate a REST API id that is unique in this simulated AWS, and register
+     * it to the Account that will own it.
+     *
+     * Allocation and registration are one step, because an id nothing owns
+     * resolves to no Account and routes nowhere.
+     */
+    allocateApiId(accountId: SimAwsAccountId): SimRestApiId;
+    /**
+     * Forget a deleted API's id, so its endpoint stops resolving.
+     */
+    deregisterApi(apiId: SimRestApiId): void;
+    /**
+     * Get the Account that owns a REST API id, if it is registered.
+     */
+    accountIdForApi(apiId: string): SimAwsAccountId | undefined;
+}
+//# sourceMappingURL=sim-rest-api-registry.d.ts.map

package/dist/service/apigateway/registry/sim-rest-api-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-registry.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/registry/sim-rest-api-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA4C;IAE1E;;;;;;OAMG;IACH,aAAa,CAAC,SAAS,EAAE,eAAe,GAAG,YAAY,CAWtD;IAED;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAEvC;IAED;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAE1D;CACF"}

package/dist/service/apigateway/registry/sim-rest-api-registry.js

@@ -0,0 +1,47 @@
+import { makeSimRestApiId } from "../api/sim-rest-api-id.js";
+/**
+ * Simulated API Gateway cross-Account registry of REST API ids.
+ *
+ * A served request carries its Region in the hostname and no Account, while
+ * simulated API Gateway state is per Account and Region. This registry is the
+ * hop from an API id to the Account owning it, which is why REST API ids are
+ * allocated here and are unique across every Account and Region of one
+ * simulated AWS environment.
+ *
+ * REST APIs and HTTP APIs share the `execute-api` hostname namespace on real
+ * AWS, and their ids have the same shape. Each service registers its own ids
+ * here and in the HTTP API registry, and resolving a served hostname across
+ * both belongs with the serving layer that does the resolving.
+ */
+export class SimRestApiRegistry {
+    apiAccountIds = new Map();
+    /**
+     * Allocate a REST API id that is unique in this simulated AWS, and register
+     * it to the Account that will own it.
+     *
+     * Allocation and registration are one step, because an id nothing owns
+     * resolves to no Account and routes nowhere.
+     */
+    allocateApiId(accountId) {
+        let apiId = makeSimRestApiId();
+        while (this.apiAccountIds.has(apiId)) {
+            /* v8 ignore next -- does not happen in practice */
+            apiId = makeSimRestApiId();
+        }
+        this.apiAccountIds.set(apiId, accountId);
+        return apiId;
+    }
+    /**
+     * Forget a deleted API's id, so its endpoint stops resolving.
+     */
+    deregisterApi(apiId) {
+        this.apiAccountIds.delete(apiId);
+    }
+    /**
+     * Get the Account that owns a REST API id, if it is registered.
+     */
+    accountIdForApi(apiId) {
+        return this.apiAccountIds.get(apiId);
+    }
+}
+//# sourceMappingURL=sim-rest-api-registry.js.map

package/dist/service/apigateway/registry/sim-rest-api-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-registry.js","sourceRoot":"","sources":["../../../../src/service/apigateway/registry/sim-rest-api-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAqB,MAAM,2BAA2B,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IACZ,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1E;;;;;;OAMG;IACH,aAAa,CAAC,SAA0B;QACtC,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;QAE/B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,mDAAmD;YACnD,KAAK,GAAG,gBAAgB,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAEzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAmB;QAC/B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAqB,CAAC,CAAC;IACvD,CAAC;CACF"}

package/dist/service/apigateway/sdk/sim-api-gateway-sdk-command-router.d.ts

@@ -0,0 +1,23 @@
+import { type SimSdkCommandRoute, type SimSdkCommandRouter } from "../../../sdk/index.js";
+import type { SimApiGateway } from "../sim-api-gateway.js";
+/**
+ * Routes intercepted SDK Commands to one scoped simulated API Gateway.
+ *
+ * These are the `@aws-sdk/client-api-gateway` Command names, which are the v1
+ * REST API ones. The v2 client has its own router, and no Command name is
+ * shared between the two.
+ */
+export declare class SimApiGatewaySdkCommandRouter implements SimSdkCommandRouter {
+    private readonly routes;
+    constructor(simApiGateway: SimApiGateway);
+    /**
+     * The SDK Command names simulated API Gateway can handle.
+     */
+    supportedCommandNames(): readonly string[];
+    /**
+     * Get the route for an SDK Command name, if simulated API Gateway supports
+     * it.
+     */
+    route(commandName: string): SimSdkCommandRoute | undefined;
+}
+//# sourceMappingURL=sim-api-gateway-sdk-command-router.d.ts.map

package/dist/service/apigateway/sdk/sim-api-gateway-sdk-command-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-sdk-command-router.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/sdk/sim-api-gateway-sdk-command-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,uBAAuB,CAAC;AA4B/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;;;;GAMG;AACH,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,YAAY,aAAa,EAAE,aAAa,EA2MvC;IAED;;OAEG;IACH,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAEzD;CACF"}