@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.d.ts

@@ -0,0 +1,28 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+interface SimRestApiCognitoMethodAuthorizerProperties {
+    /**
+     * Clock the token's time claims are checked against, so advancing simulated
+     * time expires a token that was accepted before it.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have a `COGNITO_USER_POOLS` method.
+ *
+ * Nothing is invoked. The token has to verify against the keys one of the
+ * authorizer's pools publishes, and the scopes the method asks for have to be
+ * met.
+ */
+export declare class SimRestApiCognitoMethodAuthorizer {
+    private readonly clock;
+    constructor(properties: SimRestApiCognitoMethodAuthorizerProperties);
+    /**
+     * Authorize one request against the `COGNITO_USER_POOLS` method that
+     * matched it.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): SimRestApiAuthorization;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-cognito-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F,UAAU,2CAA2C;IACnD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,iCAAiC;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,2CAA2C,EAElE;IAED;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,8BAA8B,GAAG,uBAAuB,CAyBxE;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.js

@@ -0,0 +1,40 @@
+import { simJwtBearerToken } from "../../../../util/jwt/sim-jwt-bearer-token.js";
+import { SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiCognitoAuthorizer } from "../../api/authorizer/sim-rest-api-cognito-authorizer.js";
+import { SimRestApiCognitoVerification } from "../../api/authorizer/sim-rest-api-cognito-verification.js";
+/**
+ * Decides whether one request may have a `COGNITO_USER_POOLS` method.
+ *
+ * Nothing is invoked. The token has to verify against the keys one of the
+ * authorizer's pools publishes, and the scopes the method asks for have to be
+ * met.
+ */
+export class SimRestApiCognitoMethodAuthorizer {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Authorize one request against the `COGNITO_USER_POOLS` method that
+     * matched it.
+     */
+    authorize(input) {
+        const { restApi, match, request } = input;
+        const authorizer = restApi.authorizers.find(match.method.authorizerId ?? "");
+        // Such a method always names a Cognito authorizer, and that authorizer can
+        // still be deleted out from under it, so the two come to the same thing
+        // here: with nothing to verify against, the method stays closed.
+        if (!(authorizer instanceof SimRestApiCognitoAuthorizer)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const presented = simJwtBearerToken(authorizer.identitySource.value(request));
+        if (presented === undefined) {
+            return SimRestApiRefused.unauthorized();
+        }
+        return new SimRestApiCognitoVerification({
+            userPools: restApi.userPools,
+            clock: this.clock,
+        }).verify(authorizer, presented, match.method.authorizationScopes);
+    }
+}
+//# sourceMappingURL=sim-rest-api-cognito-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-cognito-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-cognito-method-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAEL,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAC;AAW1G;;;;;;GAMG;AACH,MAAM,OAAO,iCAAiC;IAC3B,KAAK,CAAW;IAEjC,YAAY,UAAuD;QACjE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CACzC,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAChC,CAAC;QAEF,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC,CAAC,UAAU,YAAY,2BAA2B,CAAC,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CACjC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CACzC,CAAC;QAEF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,6BAA6B,CAAC;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.d.ts

@@ -0,0 +1,24 @@
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+/**
+ * Decides whether a caller may have an `AWS_IAM` method.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. Resource policies on
+ * the API are a second mechanism a REST API has and this does not read, so the
+ * caller's identity policies are the whole decision, and a caller from another
+ * Account is refused: a cross-Account request needs an Allow from each side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ *
+ * A request carrying no credentials is anonymous rather than unauthenticated,
+ * so it comes here like any other and is refused because nothing allows an
+ * anonymous caller anything.
+ */
+export declare class SimRestApiIamMethodAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the method being
+     * called.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): SimRestApiAuthorization;
+}
+//# sourceMappingURL=sim-rest-api-iam-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-iam-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAG5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F;;;;;;;;;;;;;GAaG;AACH,qBAAa,6BAA6B;IACxC;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,8BAA8B,GAAG,uBAAuB,CAwBxE;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.js

@@ -0,0 +1,43 @@
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { simExecuteApiInvokeAction } from "./sim-rest-api-authorizer-policy.js";
+/**
+ * Decides whether a caller may have an `AWS_IAM` method.
+ *
+ * This is the client's own authorization, evaluated against the identity
+ * policies of the caller the serving boundary resolved. Resource policies on
+ * the API are a second mechanism a REST API has and this does not read, so the
+ * caller's identity policies are the whole decision, and a caller from another
+ * Account is refused: a cross-Account request needs an Allow from each side.
+ * The way through, here as on AWS, is to assume a Role in the API's Account.
+ *
+ * A request carrying no credentials is anonymous rather than unauthenticated,
+ * so it comes here like any other and is refused because nothing allows an
+ * anonymous caller anything.
+ */
+export class SimRestApiIamMethodAuthorizer {
+    /**
+     * Evaluate `execute-api:Invoke` for the caller against the method being
+     * called.
+     */
+    authorize(input) {
+        const { restApi, match, request, caller, iam } = input;
+        const decision = iam.authorize({
+            action: simExecuteApiInvokeAction,
+            // The ARN of the request the client made, which names the concrete path
+            // rather than the resource template, because an identity policy is
+            // written by hand against the request being made.
+            resource: SimRestApiExecuteApiArn.forRequest(restApi, match, request.method).toString(),
+            caller: caller.toCaller(),
+        });
+        if (decision.isDenied) {
+            // Whether a Deny statement matched or nothing allowed the method is not
+            // told apart, because a service-facing decision does not carry it. Both
+            // are the 403 real API Gateway answers, with the body it gives a caller
+            // its policies left short.
+            return SimRestApiRefused.implicitDeny();
+        }
+        return new SimRestApiAdmitted({ caller });
+    }
+}
+//# sourceMappingURL=sim-rest-api-iam-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-iam-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-iam-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAGhF;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,6BAA6B;IACxC;;;OAGG;IACH,SAAS,CAAC,KAAqC;QAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE,yBAAyB;YACjC,wEAAwE;YACxE,mEAAmE;YACnE,kDAAkD;YAClD,QAAQ,EAAE,uBAAuB,CAAC,UAAU,CAC1C,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE;YACZ,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;SAC1B,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,2BAA2B;YAC3B,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.d.ts

@@ -0,0 +1,16 @@
+import type { SimRestApiAuthorizer } from "../../api/authorizer/sim-rest-api-authorizer.js";
+import type { SimRestApi } from "../../api/sim-rest-api.js";
+import type { SimRestApiFunctionTarget } from "../sim-rest-api-function-target.js";
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the
+ * decision is made there. What this adds is the part only API Gateway knows,
+ * which is what the function is being invoked for.
+ *
+ * The source ARN names the authorizer rather than any method, so a function
+ * granted the invoke action for the API's methods is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export declare function simRestApiMayNotInvokeAuthorizer(restApi: SimRestApi, authorizer: SimRestApiAuthorizer, target: SimRestApiFunctionTarget): boolean;
+//# sourceMappingURL=sim-rest-api-invoke-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-invoke-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAE5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,oBAAoB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAUT"}

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.js

@@ -0,0 +1,23 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { simApiGatewayServicePrincipal } from "../../sim-api-gateway-service-principal.js";
+/**
+ * Whether the API may not invoke a function as one of its authorizers.
+ *
+ * Whether a service may invoke a function is Lambda's own rule, so the
+ * decision is made there. What this adds is the part only API Gateway knows,
+ * which is what the function is being invoked for.
+ *
+ * The source ARN names the authorizer rather than any method, so a function
+ * granted the invoke action for the API's methods is not thereby usable as its
+ * authorizer, as on real AWS.
+ */
+export function simRestApiMayNotInvokeAuthorizer(restApi, authorizer, target) {
+    return new SimLambdaServiceInvokeAuthorizer({ iam: target.iam }).authorize({
+        resource: target.resource,
+        servicePrincipal: simApiGatewayServicePrincipal,
+        sourceArn: SimRestApiExecuteApiArn.forAuthorizer(restApi, authorizer.authorizerId).toString(),
+        sourceAccount: restApi.accountRegionScope.accountId,
+    }).isDenied;
+}
+//# sourceMappingURL=sim-rest-api-invoke-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-invoke-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-invoke-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAE7H,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AAEpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,4CAA4C,CAAC;AAG3F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAAmB,EACnB,UAAgC,EAChC,MAAgC;IAEhC,OAAO,IAAI,gCAAgC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;QACzE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,gBAAgB,EAAE,6BAA6B;QAC/C,SAAS,EAAE,uBAAuB,CAAC,aAAa,CAC9C,OAAO,EACP,UAAU,CAAC,YAAY,CACxB,CAAC,QAAQ,EAAE;QACZ,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC,SAAS;KACpD,CAAC,CAAC,QAAQ,CAAC;AACd,CAAC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.d.ts

@@ -0,0 +1,28 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimAwsRequestCaller } from "../../../iam/request/sim-aws-request-caller.js";
+import type { SimRestApiMatch } from "../../api/match/sim-rest-api-match.js";
+import type { SimRestApi } from "../../api/sim-rest-api.js";
+/**
+ * Everything a method authorization decision is made from.
+ *
+ * The whole match is carried rather than only the method, because the
+ * `methodArn` an authorizer is handed names the stage that served the request
+ * and the path it asked for, both of which the match settled.
+ */
+export interface SimRestApiMethodAuthorizeInput {
+    readonly restApi: SimRestApi;
+    readonly match: SimRestApiMatch;
+    readonly request: Request;
+    /**
+     * The principal the serving boundary attributed the request to, from a
+     * signature or from a named caller, and anonymous when it carried neither.
+     */
+    readonly caller: SimAwsRequestCaller;
+    /**
+     * IAM of the Account that owns the API, which is what decides an `AWS_IAM`
+     * method. It is the API's own rather than the caller's, and rather than the
+     * integrated function's.
+     */
+    readonly iam: SimIamInterServiceAuthZ;
+}
+//# sourceMappingURL=sim-rest-api-method-authorize-input.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorize-input.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC"}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sim-rest-api-method-authorize-input.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorize-input.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorize-input.ts"],"names":[],"mappings":""}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.d.ts

@@ -0,0 +1,59 @@
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+import { type SimRestApiAuthorization } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { type SimRestApiAuthorizerFunctions } from "./sim-rest-api-authorizer-invocation.js";
+import type { SimRestApiMethodAuthorizeInput } from "./sim-rest-api-method-authorize-input.js";
+interface SimRestApiMethodAuthorizerProperties {
+    /**
+     * Where an authorizer's function is found, which is the same router that
+     * finds an integration's.
+     */
+    readonly functions: SimRestApiAuthorizerFunctions;
+    /**
+     * Clock an authorizer's invocation event is stamped with, a verified
+     * token's time claims are checked against, and a held decision expires
+     * against, so advancing simulated time expires a token that was accepted
+     * before it and drops a decision that was being reused.
+     */
+    readonly clock: SimClock;
+}
+/**
+ * Decides whether one request may have the method that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration. A request presenting no credentials
+ * is refused whether or not the integration behind the method would have
+ * worked.
+ *
+ * Which kind of authorization the method asks for is settled here, and each
+ * kind decides on its own terms. The steps for a `CUSTOM` method are the ones
+ * real API Gateway takes:
+ *
+ * 1. the request has to carry something at every one of the authorizer's
+ *    identity sources, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for that same identity at that same method, and
+ *    not yet expired, is reused by `SimRestApiAuthorizerDecisions`, and
+ *    nothing further happens;
+ * 3. otherwise the function is asked, and the policy it answers with is
+ *    evaluated against the ARN of the request being made.
+ *
+ * An authorizer with no `authorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the method.
+ */
+export declare class SimRestApiMethodAuthorizer {
+    private readonly invocation;
+    private readonly decisions;
+    private readonly iamAuthorizer;
+    private readonly cognito;
+    constructor(properties: SimRestApiMethodAuthorizerProperties);
+    /**
+     * Authorize one request against the method that matched it.
+     */
+    authorize(input: SimRestApiMethodAuthorizeInput): Promise<SimRestApiAuthorization>;
+    /**
+     * Authorize one request against the `CUSTOM` method that matched it.
+     */
+    private custom;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-method-authorizer.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EACL,KAAK,6BAA6B,EAEnC,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/F,UAAU,oCAAoC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,YAAY,UAAU,EAAE,oCAAoC,EAW3D;IAED;;OAEG;IACG,SAAS,CACb,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAiBlC;IAED;;OAEG;YACW,MAAM;CAuCrB"}

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.js

@@ -0,0 +1,90 @@
+import { SimRestApiAdmitted, SimRestApiRefused, } from "../../api/authorizer/sim-rest-api-authorization.js";
+import { SimRestApiLambdaAuthorizer } from "../../api/authorizer/sim-rest-api-lambda-authorizer.js";
+import { SimRestApiExecuteApiArn } from "../../api/sim-rest-api-execute-api-arn.js";
+import { SimRestApiAuthorizerDecisions } from "./sim-rest-api-authorizer-decisions.js";
+import { SimRestApiAuthorizerInvocation, } from "./sim-rest-api-authorizer-invocation.js";
+import { SimRestApiCognitoMethodAuthorizer } from "./sim-rest-api-cognito-method-authorizer.js";
+import { SimRestApiIamMethodAuthorizer } from "./sim-rest-api-iam-method-authorizer.js";
+/**
+ * Decides whether one request may have the method that matched it.
+ *
+ * This is the client's side of the question, and it runs before the API asks
+ * whether it may invoke the integration. A request presenting no credentials
+ * is refused whether or not the integration behind the method would have
+ * worked.
+ *
+ * Which kind of authorization the method asks for is settled here, and each
+ * kind decides on its own terms. The steps for a `CUSTOM` method are the ones
+ * real API Gateway takes:
+ *
+ * 1. the request has to carry something at every one of the authorizer's
+ *    identity sources, or it is refused with a 401 and the function is never
+ *    invoked;
+ * 2. a decision already made for that same identity at that same method, and
+ *    not yet expired, is reused by `SimRestApiAuthorizerDecisions`, and
+ *    nothing further happens;
+ * 3. otherwise the function is asked, and the policy it answers with is
+ *    evaluated against the ARN of the request being made.
+ *
+ * An authorizer with no `authorizerResultTtlInSeconds` holds nothing, so its
+ * function is invoked once per request reaching the method.
+ */
+export class SimRestApiMethodAuthorizer {
+    invocation;
+    decisions;
+    iamAuthorizer = new SimRestApiIamMethodAuthorizer();
+    cognito;
+    constructor(properties) {
+        this.invocation = new SimRestApiAuthorizerInvocation({
+            functions: properties.functions,
+            clock: properties.clock,
+        });
+        this.decisions = new SimRestApiAuthorizerDecisions({
+            clock: properties.clock,
+        });
+        this.cognito = new SimRestApiCognitoMethodAuthorizer({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Authorize one request against the method that matched it.
+     */
+    async authorize(input) {
+        switch (input.match.method.authorizationType) {
+            case "NONE": {
+                // Nobody was authorized, so there is no caller to describe, which is
+                // what leaves requestContext.authorizer out of the event entirely.
+                return new SimRestApiAdmitted();
+            }
+            case "AWS_IAM": {
+                return this.iamAuthorizer.authorize(input);
+            }
+            case "COGNITO_USER_POOLS": {
+                return this.cognito.authorize(input);
+            }
+            case "CUSTOM": {
+                return await this.custom(input);
+            }
+        }
+    }
+    /**
+     * Authorize one request against the `CUSTOM` method that matched it.
+     */
+    async custom(input) {
+        const { restApi, match, request } = input;
+        const authorizer = restApi.authorizers.find(match.method.authorizerId ?? "");
+        // A CUSTOM method always names a Lambda authorizer, and that authorizer
+        // can still be deleted out from under it, so the two come to the same
+        // thing here: with nothing to ask, the method stays closed.
+        if (!(authorizer instanceof SimRestApiLambdaAuthorizer)) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const identityValues = authorizer.identitySources.values(request);
+        if (identityValues === undefined) {
+            return SimRestApiRefused.unauthorized();
+        }
+        const methodArn = SimRestApiExecuteApiArn.forRequest(restApi, match, request.method).toString();
+        return await this.decisions.decide(authorizer, { methodArn, identityValues }, async () => await this.invocation.invoke(input, authorizer, identityValues, methodArn));
+    }
+}
+//# sourceMappingURL=sim-rest-api-method-authorizer.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-method-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-method-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-method-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAElB,iBAAiB,GAClB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EAEL,8BAA8B,GAC/B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAkBxF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,0BAA0B;IACpB,UAAU,CAAiC;IAC3C,SAAS,CAAgC;IACzC,aAAa,GAAG,IAAI,6BAA6B,EAAE,CAAC;IACpD,OAAO,CAAoC;IAE5D,YAAY,UAAgD;QAC1D,IAAI,CAAC,UAAU,GAAG,IAAI,8BAA8B,CAAC;YACnD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,6BAA6B,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,iCAAiC,CAAC;YACnD,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CACb,KAAqC;QAErC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,KAAK,MAAM,EAAE,CAAC;gBACZ,qEAAqE;gBACrE,mEAAmE;gBACnE,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,KAAK,QAAQ,EAAE,CAAC;gBACd,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,MAAM,CAClB,KAAqC;QAErC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CACzC,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAChC,CAAC;QAEF,wEAAwE;QACxE,sEAAsE;QACtE,4DAA4D;QAC5D,IAAI,CAAC,CAAC,UAAU,YAAY,0BAA0B,CAAC,EAAE,CAAC;YACxD,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,cAAc,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,iBAAiB,CAAC,YAAY,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAClD,OAAO,EACP,KAAK,EACL,OAAO,CAAC,MAAM,CACf,CAAC,QAAQ,EAAE,CAAC;QAEb,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAChC,UAAU,EACV,EAAE,SAAS,EAAE,cAAc,EAAE,EAC7B,KAAK,IAAI,EAAE,CACT,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAC1B,KAAK,EACL,UAAU,EACV,cAAc,EACd,SAAS,CACV,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.d.ts

@@ -0,0 +1,62 @@
+import type { SimPayload1Endpoint } from "../../../../serve/payload-1/sim-payload-1-endpoint.js";
+import type { SimPayload1RequestContext } from "../../../../serve/payload-1/sim-payload-1-event.type.js";
+import type { SimClock } from "../../../../util/clock/sim-clock.js";
+/**
+ * The event a `REQUEST` authorizer's function is invoked with.
+ *
+ * It is the payload format 1.0 request event with `type` and `methodArn` added
+ * and the body left out. AWS's own example of this event carries no `body` and
+ * no `isBase64Encoded`, which is the one published account of what an
+ * authorizer receives, so neither is sent here.
+ *
+ * The maps are empty rather than `null` for the same reason. An integration
+ * event sends `null` where nothing was supplied, and the published authorizer
+ * event sends `{}`, so a `REQUEST` authorizer reading
+ * `event.queryStringParameters.token` finds nothing rather than throwing.
+ */
+export interface SimRestApiRequestAuthorizerEvent {
+    type: "REQUEST";
+    /**
+     * The `execute-api` ARN of the request being authorized. The policy the
+     * function answers with is evaluated against this same ARN.
+     */
+    methodArn: string;
+    /** The resource path template the request matched, without the stage. */
+    resource: string;
+    /** The request path, stage segment and all. */
+    path: string;
+    httpMethod: string;
+    headers: Record<string, string>;
+    multiValueHeaders: Record<string, string[]>;
+    queryStringParameters: Record<string, string>;
+    multiValueQueryStringParameters: Record<string, string[]>;
+    pathParameters: Record<string, string>;
+    stageVariables: Record<string, string>;
+    requestContext: SimPayload1RequestContext;
+}
+interface SimRestApiRequestAuthorizerEventInput {
+    readonly request: Request;
+    readonly endpoint: SimPayload1Endpoint;
+    readonly methodArn: string;
+}
+interface SimRestApiRequestAuthorizerEventBuilderProperties {
+    /** Clock stamping the event's requestContext time. */
+    readonly clock: SimClock;
+}
+/**
+ * Builds the event a `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export declare class SimRestApiRequestAuthorizerEventBuilder {
+    private readonly eventBuilder;
+    constructor(properties: SimRestApiRequestAuthorizerEventBuilderProperties);
+    /**
+     * Build the authorizer event for one request.
+     */
+    build(input: SimRestApiRequestAuthorizerEventInput): Promise<SimRestApiRequestAuthorizerEvent>;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-request-authorizer-event.d.ts.map

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-request-authorizer-event.d.ts","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AAEjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACzG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,+BAA+B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,cAAc,EAAE,yBAAyB,CAAC;CAC3C;AAED,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,UAAU,iDAAiD;IACzD,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,uCAAuC;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IAEvD,YAAY,UAAU,EAAE,iDAAiD,EAIxE;IAED;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,gCAAgC,CAAC,CAwB3C;CACF"}

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.js

@@ -0,0 +1,40 @@
+import { SimPayload1EventBuilder } from "../../../../serve/payload-1/sim-payload-1-event-builder.js";
+/**
+ * Builds the event a `REQUEST` authorizer is invoked with.
+ *
+ * The members are copied across one at a time rather than spread, so what an
+ * authorizer receives is stated here rather than following from whatever the
+ * integration event happens to hold.
+ */
+export class SimRestApiRequestAuthorizerEventBuilder {
+    eventBuilder;
+    constructor(properties) {
+        this.eventBuilder = new SimPayload1EventBuilder({
+            clock: properties.clock,
+        });
+    }
+    /**
+     * Build the authorizer event for one request.
+     */
+    async build(input) {
+        // The request is cloned because reading it consumes its body, and the
+        // integration behind the method still has to build an event of its own
+        // from the same request.
+        const requestEvent = await this.eventBuilder.build(input.request.clone(), input.endpoint);
+        return {
+            type: "REQUEST",
+            methodArn: input.methodArn,
+            resource: requestEvent.resource,
+            path: requestEvent.path,
+            httpMethod: requestEvent.httpMethod,
+            headers: requestEvent.headers ?? {},
+            multiValueHeaders: requestEvent.multiValueHeaders ?? {},
+            queryStringParameters: requestEvent.queryStringParameters ?? {},
+            multiValueQueryStringParameters: requestEvent.multiValueQueryStringParameters ?? {},
+            pathParameters: requestEvent.pathParameters ?? {},
+            stageVariables: requestEvent.stageVariables ?? {},
+            requestContext: requestEvent.requestContext,
+        };
+    }
+}
+//# sourceMappingURL=sim-rest-api-request-authorizer-event.js.map

package/dist/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-request-authorizer-event.js","sourceRoot":"","sources":["../../../../../src/service/apigateway/serve/auth/sim-rest-api-request-authorizer-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,4DAA4D,CAAC;AAiDrG;;;;;;GAMG;AACH,MAAM,OAAO,uCAAuC;IACjC,YAAY,CAA0B;IAEvD,YAAY,UAA6D;QACvE,IAAI,CAAC,YAAY,GAAG,IAAI,uBAAuB,CAAC;YAC9C,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CACT,KAA4C;QAE5C,sEAAsE;QACtE,uEAAuE;QACvE,yBAAyB;QACzB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAChD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EACrB,KAAK,CAAC,QAAQ,CACf,CAAC;QAEF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,YAAY,CAAC,OAAO,IAAI,EAAE;YACnC,iBAAiB,EAAE,YAAY,CAAC,iBAAiB,IAAI,EAAE;YACvD,qBAAqB,EAAE,YAAY,CAAC,qBAAqB,IAAI,EAAE;YAC/D,+BAA+B,EAC7B,YAAY,CAAC,+BAA+B,IAAI,EAAE;YACpD,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,EAAE;YACjD,cAAc,EAAE,YAAY,CAAC,cAAc,IAAI,EAAE;YACjD,cAAc,EAAE,YAAY,CAAC,cAAc;SAC5C,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/serve/sim-api-gateway-controller.d.ts

@@ -0,0 +1,50 @@
+import type { SimAwsServiceController, SimAwsServiceRequest } from "../../../serve/controller/sim-service-controller.js";
+import { SimAws } from "../../aws/sim-aws.js";
+import { SimApiGatewayRouter } from "./sim-api-gateway-router.js";
+interface SimApiGatewayServiceControllerProperties {
+    readonly simAws?: SimAws;
+    readonly router?: SimApiGatewayRouter;
+}
+/**
+ * Localhost HTTP controller for simulated API Gateway REST APIs.
+ *
+ * A request reaching the generated endpoint is matched to a stage, then walked
+ * down the resource tree to a method, and that method's integration invokes a
+ * simulated Lambda function with a payload format 1.0 event. The function runs
+ * as its execution Role, as it does for any other invocation.
+ *
+ * A method that authorizes anybody is checked before any of that. An `AWS_IAM`
+ * method's caller has to be allowed `execute-api:Invoke` on the method, and a
+ * `CUSTOM` method's Lambda authorizer has to allow the request, or the request
+ * is refused and the integration is never invoked. Whether the API may invoke a
+ * function is a separate question, and the API's own rather than the client's.
+ *
+ * A web ACL in front of the stage comes ahead of all of it, as it does on real
+ * API Gateway. A request the web ACL blocks is answered before the method is
+ * matched, so neither the authorizer nor the integration sees it.
+ */
+export declare class SimApiGatewayServiceController implements SimAwsServiceController {
+    private readonly router;
+    private readonly methodAuthorizer;
+    private readonly integration;
+    private readonly errorResponse;
+    private readonly refusalResponse;
+    private readonly webAcl;
+    constructor(properties?: SimApiGatewayServiceControllerProperties);
+    /**
+     * Handle an HTTP request routed to a simulated REST API.
+     */
+    handleRequest(serviceRequest: SimAwsServiceRequest): Promise<Response>;
+    private invoke;
+    /**
+     * What a request that reached nothing is answered with.
+     *
+     * Real API Gateway tells the two apart. A stage the API does not serve is a
+     * plain `Forbidden`, while a request that found the stage and matched no
+     * method gets `Missing Authentication Token`, whether or not it carried
+     * credentials.
+     */
+    private missResponse;
+}
+export {};
+//# sourceMappingURL=sim-api-gateway-controller.d.ts.map

package/dist/service/apigateway/serve/sim-api-gateway-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-api-gateway-controller.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/serve/sim-api-gateway-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAS9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAKlE,UAAU,wCAAwC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,8BAA+B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAE3D,YAAY,UAAU,GAAE,wCAA6C,EAapE;IAED;;OAEG;IACG,aAAa,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAc3E;YAEa,MAAM;IAoDpB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;CAKrB"}