@kensio/yulin 1.17.1 → 1.18.0

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.js

@@ -0,0 +1,18 @@
+import { SimWafInvalidParameterException } from "../error/sim-wafv2.error.js";
+import { SimWafAction } from "./sim-waf-action.js";
+/**
+ * Read the action a request no rule claims is given.
+ *
+ * Only `Allow` and `Block` are valid here on real WAF, and `Count` is the one
+ * worth refusing by name: a default action that counted would leave every
+ * unmatched request unanswered.
+ */
+export function readSimWafDefaultAction(configuration) {
+    const action = SimWafAction.read(configuration.defaultAction, "the web ACL default action", configuration.customResponseBodies ?? {});
+    if (action.kind === "COUNT") {
+        throw new SimWafInvalidParameterException("Error reason: A web ACL DefaultAction is Allow or Block, field: " +
+            "DEFAULT_ACTION, parameter: Count");
+    }
+    return action;
+}
+//# sourceMappingURL=sim-waf-web-acl-configuration.js.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl-configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl-configuration.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl-configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAgBnD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAwC;IAExC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAC9B,aAAa,CAAC,aAAa,EAC3B,4BAA4B,EAC5B,aAAa,CAAC,oBAAoB,IAAI,EAAE,CACzC,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,+BAA+B,CACvC,kEAAkE;YAChE,kCAAkC,CACrC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/wafv2/web-acl/sim-waf-web-acl.d.ts

@@ -0,0 +1,52 @@
+import { type SimWafDecision } from "../evaluate/sim-waf-decision.js";
+import type { SimWafInspectedRequest } from "../evaluate/sim-waf-inspected-request.js";
+import { SimWafResource, type SimWafResourceProperties } from "../resource/sim-waf-resource.js";
+import type { SimWafWebAclRuleScope } from "./sim-waf-rule.type.js";
+import { type SimWafWebAclConfiguration } from "./sim-waf-web-acl-configuration.js";
+interface SimWafWebAclProperties extends SimWafResourceProperties, SimWafWebAclRuleScope {
+    readonly configuration: SimWafWebAclConfiguration;
+}
+/**
+ * One web ACL: an ordered list of rules and what to do with a request none of
+ * them claims.
+ *
+ * Evaluating is the whole of what a web ACL is for, and it happens in
+ * ascending rule priority. The first rule that matches and carries a
+ * terminating action decides the request; a `Count` action records the match
+ * and lets the next rule have a look. A request no rule terminates gets the
+ * default action.
+ */
+export declare class SimWafWebAcl extends SimWafResource {
+    #private;
+    /**
+     * The prefix every label a rule of this web ACL adds is qualified by.
+     *
+     * AWS writes it `awswaf:<account ID>:webacl:<web ACL name>:`, and a
+     * `LabelMatchStatement` in another web ACL is written against it. Nothing
+     * here prefixes a label with it, because a rule matching a label of its own
+     * web ACL matches the unqualified name.
+     */
+    readonly labelNamespace: string;
+    constructor(properties: SimWafWebAclProperties);
+    /**
+     * What this web ACL's rules add up to in capacity units.
+     */
+    get capacity(): number;
+    /**
+     * What this web ACL was last written with, as the API reports it.
+     */
+    get configuration(): SimWafWebAclConfiguration;
+    /**
+     * Write a new configuration over this one.
+     *
+     * The rules are compiled before anything is replaced, so a web ACL that
+     * refuses an update keeps the rules it had rather than being left with none.
+     */
+    reconfigure(configuration: SimWafWebAclConfiguration, lockToken: string | undefined): void;
+    /**
+     * Decide what happens to one request.
+     */
+    evaluate(request: SimWafInspectedRequest): SimWafDecision;
+}
+export {};
+//# sourceMappingURL=sim-waf-web-acl.d.ts.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl.d.ts","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAEvF,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC9B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oCAAoC,CAAC;AAE5C,UAAU,sBACR,SAAQ,wBAAwB,EAAE,qBAAqB;IACvD,QAAQ,CAAC,aAAa,EAAE,yBAAyB,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,qBAAa,YAAa,SAAQ,cAAc;;IAC9C;;;;;;;OAOG;IACH,SAAgB,cAAc,EAAE,MAAM,CAAC;IASvC,YAAY,UAAU,EAAE,sBAAsB,EAc7C;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;OAEG;IACH,IAAI,aAAa,IAAI,yBAAyB,CAE7C;IAED;;;;;OAKG;IACH,WAAW,CACT,aAAa,EAAE,yBAAyB,EACxC,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAUN;IAED;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,cAAc,CAUxD;CACF"}

package/dist/service/wafv2/web-acl/sim-waf-web-acl.js

@@ -0,0 +1,85 @@
+import { simWafDecision, } from "../evaluate/sim-waf-decision.js";
+import { simWafEvaluateRules } from "../evaluate/sim-waf-evaluate-rules.js";
+import { SimWafResource, } from "../resource/sim-waf-resource.js";
+import { compileSimWafWebAclRules } from "./sim-waf-rules.js";
+import { simWafWebAclCapacity } from "./sim-waf-web-acl-capacity.js";
+import { readSimWafDefaultAction, } from "./sim-waf-web-acl-configuration.js";
+/**
+ * One web ACL: an ordered list of rules and what to do with a request none of
+ * them claims.
+ *
+ * Evaluating is the whole of what a web ACL is for, and it happens in
+ * ascending rule priority. The first rule that matches and carries a
+ * terminating action decides the request; a `Count` action records the match
+ * and lets the next rule have a look. A request no rule terminates gets the
+ * default action.
+ */
+export class SimWafWebAcl extends SimWafResource {
+    /**
+     * The prefix every label a rule of this web ACL adds is qualified by.
+     *
+     * AWS writes it `awswaf:<account ID>:webacl:<web ACL name>:`, and a
+     * `LabelMatchStatement` in another web ACL is written against it. Nothing
+     * here prefixes a label with it, because a rule matching a label of its own
+     * web ACL matches the unqualified name.
+     */
+    labelNamespace;
+    #scope;
+    #configuration;
+    #defaultAction;
+    #rules;
+    #capacity;
+    constructor(properties) {
+        super("webacl", properties);
+        this.#scope = properties;
+        this.#configuration = properties.configuration;
+        this.#defaultAction = readSimWafDefaultAction(properties.configuration);
+        this.#rules = compileSimWafWebAclRules(properties.configuration, this.#scope);
+        this.#capacity = simWafWebAclCapacity(properties.configuration.rules);
+        this.labelNamespace =
+            `awswaf:${properties.accountRegionScope.accountId}:webacl:` +
+                `${properties.name}:`;
+    }
+    /**
+     * What this web ACL's rules add up to in capacity units.
+     */
+    get capacity() {
+        return this.#capacity;
+    }
+    /**
+     * What this web ACL was last written with, as the API reports it.
+     */
+    get configuration() {
+        return this.#configuration;
+    }
+    /**
+     * Write a new configuration over this one.
+     *
+     * The rules are compiled before anything is replaced, so a web ACL that
+     * refuses an update keeps the rules it had rather than being left with none.
+     */
+    reconfigure(configuration, lockToken) {
+        const defaultAction = readSimWafDefaultAction(configuration);
+        const rules = compileSimWafWebAclRules(configuration, this.#scope);
+        this.takeLock(lockToken);
+        this.replaceDescription(configuration.description);
+        this.#configuration = configuration;
+        this.#defaultAction = defaultAction;
+        this.#rules = rules;
+        this.#capacity = simWafWebAclCapacity(configuration.rules);
+    }
+    /**
+     * Decide what happens to one request.
+     */
+    evaluate(request) {
+        const outcome = simWafEvaluateRules(this.#rules, request);
+        return simWafDecision({
+            ...outcome,
+            action: outcome.action ?? this.#defaultAction,
+            webAclName: this.name,
+            webAclArn: this.arn,
+            labels: request.labels.all(),
+        });
+    }
+}
+//# sourceMappingURL=sim-waf-web-acl.js.map

package/dist/service/wafv2/web-acl/sim-waf-web-acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-waf-web-acl.js","sourceRoot":"","sources":["../../../../src/service/wafv2/web-acl/sim-waf-web-acl.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,GAEf,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EACL,cAAc,GAEf,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EACL,uBAAuB,GAExB,MAAM,oCAAoC,CAAC;AAO5C;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAa,SAAQ,cAAc;IAC9C;;;;;;;OAOG;IACa,cAAc,CAAS;IAE9B,MAAM,CAAwB;IAEvC,cAAc,CAA4B;IAC1C,cAAc,CAAe;IAC7B,MAAM,CAAwB;IAC9B,SAAS,CAAS;IAElB,YAAY,UAAkC;QAC5C,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE5B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,uBAAuB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,GAAG,wBAAwB,CACpC,UAAU,CAAC,aAAa,EACxB,IAAI,CAAC,MAAM,CACZ,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,cAAc;YACjB,UAAU,UAAU,CAAC,kBAAkB,CAAC,SAAS,UAAU;gBAC3D,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,WAAW,CACT,aAAwC,EACxC,SAA6B;QAE7B,MAAM,aAAa,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,oBAAoB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,OAA+B;QACtC,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,cAAc,CAAC;YACpB,GAAG,OAAO;YACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc;YAC7C,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/util/filesystem/test-sam-endpoint-methods.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The methods of one path the SAM CLI reported.
+ *
+ * It spells them as the path followed by the Swagger operation keys under it,
+ * as in `/rates/{id}['post', 'get']`, and each one comes back as the
+ * `POST /rates/{id}` an API Gateway method is read as here.
+ */
+export declare function samEndpointMethods(endpoint: string): string[];
+//# sourceMappingURL=test-sam-endpoint-methods.d.ts.map

package/dist/util/filesystem/test-sam-endpoint-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-sam-endpoint-methods.d.ts","sourceRoot":"","sources":["../../../src/util/filesystem/test-sam-endpoint-methods.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D"}

package/dist/util/filesystem/test-sam-endpoint-methods.js

@@ -0,0 +1,25 @@
+/**
+ * The Swagger extension SAM writes a path with no method of its own under.
+ */
+const anyMethodKey = "x-amazon-apigateway-any-method";
+/**
+ * The methods of one path the SAM CLI reported.
+ *
+ * It spells them as the path followed by the Swagger operation keys under it,
+ * as in `/rates/{id}['post', 'get']`, and each one comes back as the
+ * `POST /rates/{id}` an API Gateway method is read as here.
+ */
+export function samEndpointMethods(endpoint) {
+    const [path = endpoint, keys = ""] = endpoint.split("[", 2);
+    return keys
+        .replaceAll(/[[\]']/g, "")
+        .split(",")
+        .map((key) => `${samHttpMethod(key.trim())} ${path}`);
+}
+/**
+ * One Swagger operation key as the HTTP method it stands for.
+ */
+function samHttpMethod(key) {
+    return key === anyMethodKey ? "ANY" : key.toUpperCase();
+}
+//# sourceMappingURL=test-sam-endpoint-methods.js.map

package/dist/util/filesystem/test-sam-endpoint-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-sam-endpoint-methods.js","sourceRoot":"","sources":["../../../src/util/filesystem/test-sam-endpoint-methods.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE5D,OAAO,IAAI;SACR,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;SACzB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC"}

package/dist/util/filesystem/test-sam-project.d.ts

@@ -0,0 +1,57 @@
+import { TemporaryDirectory } from "./temporary-directory.js";
+interface TestSamProjectProperties {
+    projectDirectory?: TemporaryDirectory;
+}
+/**
+ * One API of a template, and the methods the SAM CLI says it serves.
+ */
+export interface TestSamEndpoint {
+    /** The logical ID the expansion gave the API. */
+    readonly logicalId: string;
+    /** One `GET /rates/{currency}` per method, in no particular order. */
+    readonly methods: readonly string[];
+}
+/**
+ * The version of the SAM CLI on the PATH, or nothing where there is none.
+ *
+ * A test comparing against real SAM asks for this first, because a machine
+ * without the CLI has to skip rather than fail.
+ */
+export declare function testSamCliVersion(): Promise<string | undefined>;
+/**
+ * Convenience wrapper for temporary SAM projects used in tests.
+ *
+ * The SAM CLI expands a template through `aws-sam-translator`, the Python
+ * library AWS runs the real transform in. `sam list` reads a template off disk
+ * and reports what deploying it would create, which is the expansion itself
+ * with nothing built and no AWS account involved.
+ */
+export declare class TestSamProject {
+    readonly projectDirectory: TemporaryDirectory;
+    constructor(properties?: TestSamProjectProperties);
+    /**
+     * Write the SAM template this project is expanded from.
+     *
+     * The template is written as JSON, which the SAM CLI reads as readily as
+     * YAML, so one template object drives both the CLI and a simulated
+     * deployment of the same thing.
+     */
+    writeTemplate(template: object): Promise<void>;
+    /**
+     * The logical IDs of the Resources deploying this template would create.
+     */
+    listResources(): Promise<string[]>;
+    /**
+     * The APIs this template deploys, and the methods each of them serves.
+     *
+     * A function is listed here too, with `Methods` set to a placeholder rather
+     * than a list, and is left out.
+     */
+    listEndpoints(): Promise<TestSamEndpoint[]>;
+    /**
+     * Run one `sam list` command over this project's template.
+     */
+    private list;
+}
+export {};
+//# sourceMappingURL=test-sam-project.d.ts.map

package/dist/util/filesystem/test-sam-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-sam-project.d.ts","sourceRoot":"","sources":["../../../src/util/filesystem/test-sam-project.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,UAAU,wBAAwB;IAChC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAqBD;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAUrE;AAED;;;;;;;GAOG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAE9C,YAAY,UAAU,GAAE,wBAA6B,EAGpD;IAED;;;;;;OAMG;IACG,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnD;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAIvC;IAED;;;;;OAKG;IACG,aAAa,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAYhD;IAED;;OAEG;YACW,IAAI;CAoBnB"}

package/dist/util/filesystem/test-sam-project.js

@@ -0,0 +1,101 @@
+import { execa } from "execa";
+import { samEndpointMethods } from "./test-sam-endpoint-methods.js";
+import { TemporaryDirectory } from "./temporary-directory.js";
+/**
+ * The name the SAM CLI is invoked by. It installs through pip, Homebrew or the
+ * AWS installer and has no npm package, so it is whatever the machine put on
+ * the PATH rather than something under `node_modules`.
+ */
+const samBinaryName = "sam";
+/**
+ * The Region every command is given. The SAM CLI refuses to read a template at
+ * all without one, and nothing here talks to AWS.
+ */
+const regionName = "us-east-1";
+/**
+ * The environment the SAM CLI runs under. Telemetry is off because these are
+ * tests, and they run on every CI build.
+ */
+const samEnvironment = { SAM_CLI_TELEMETRY: "0" };
+/**
+ * The version of the SAM CLI on the PATH, or nothing where there is none.
+ *
+ * A test comparing against real SAM asks for this first, because a machine
+ * without the CLI has to skip rather than fail.
+ */
+export async function testSamCliVersion() {
+    try {
+        const { stdout } = await execa(samBinaryName, ["--version"], {
+            env: samEnvironment,
+        });
+        return stdout.trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Convenience wrapper for temporary SAM projects used in tests.
+ *
+ * The SAM CLI expands a template through `aws-sam-translator`, the Python
+ * library AWS runs the real transform in. `sam list` reads a template off disk
+ * and reports what deploying it would create, which is the expansion itself
+ * with nothing built and no AWS account involved.
+ */
+export class TestSamProject {
+    projectDirectory;
+    constructor(properties = {}) {
+        const { projectDirectory = new TemporaryDirectory() } = properties;
+        this.projectDirectory = projectDirectory;
+    }
+    /**
+     * Write the SAM template this project is expanded from.
+     *
+     * The template is written as JSON, which the SAM CLI reads as readily as
+     * YAML, so one template object drives both the CLI and a simulated
+     * deployment of the same thing.
+     */
+    async writeTemplate(template) {
+        await this.projectDirectory.writeFile("template.json", JSON.stringify(template, undefined, 2));
+    }
+    /**
+     * The logical IDs of the Resources deploying this template would create.
+     */
+    async listResources() {
+        const listed = await this.list("resources");
+        return listed.map((resource) => resource.LogicalResourceId);
+    }
+    /**
+     * The APIs this template deploys, and the methods each of them serves.
+     *
+     * A function is listed here too, with `Methods` set to a placeholder rather
+     * than a list, and is left out.
+     */
+    async listEndpoints() {
+        const listed = await this.list("endpoints");
+        return listed
+            .filter((endpoint) => Array.isArray(endpoint.Methods))
+            .map((endpoint) => ({
+            logicalId: endpoint.LogicalResourceId,
+            methods: [endpoint.Methods].flat().flatMap(samEndpointMethods),
+        }));
+    }
+    /**
+     * Run one `sam list` command over this project's template.
+     */
+    async list(area) {
+        await this.projectDirectory.resolvePath();
+        const { stdout } = await execa(samBinaryName, [
+            "list",
+            area,
+            "--output",
+            "json",
+            "--region",
+            regionName,
+            "--template-file",
+            this.projectDirectory.join("template.json"),
+        ], { env: samEnvironment });
+        return JSON.parse(stdout);
+    }
+}
+//# sourceMappingURL=test-sam-project.js.map

package/dist/util/filesystem/test-sam-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-sam-project.js","sourceRoot":"","sources":["../../../src/util/filesystem/test-sam-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAgB9D;;;;GAIG;AACH,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B;;;GAGG;AACH,MAAM,cAAc,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3D,GAAG,EAAE,cAAc;SACpB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IAChB,gBAAgB,CAAqB;IAE9C,YAAY,UAAU,GAA6B,EAAE;QACnD,MAAM,EAAE,gBAAgB,GAAG,IAAI,kBAAkB,EAAE,EAAE,GAAG,UAAU,CAAC;QACnE,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,QAAgB;QAClC,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAgC,WAAW,CAAC,CAAC;QAE3E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAG3B,WAAW,CAAC,CAAC;QAEhB,OAAO,MAAM;aACV,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAClB,SAAS,EAAE,QAAQ,CAAC,iBAAiB;YACrC,OAAO,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAC/D,CAAC,CAAC,CAAC;IACR,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,IAAI,CAAS,IAAY;QACrC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAE1C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAC5B,aAAa,EACb;YACE,MAAM;YACN,IAAI;YACJ,UAAU;YACV,MAAM;YACN,UAAU;YACV,UAAU;YACV,iBAAiB;YACjB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC;SAC5C,EACD,EAAE,GAAG,EAAE,cAAc,EAAE,CACxB,CAAC;QAEF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAa,CAAC;IACxC,CAAC;CACF"}

package/dist/util/jwt/sim-jwt-bearer-token.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The token an identity source value carries, if it carries one at all.
+ *
+ * This is how a verifier of tokens reads the value. A Lambda authorizer is
+ * handed the value as it arrived instead, since what it names may be a cookie
+ * or an API key rather than a bearer token.
+ */
+export declare function simJwtBearerToken(value: string | undefined): string | undefined;
+//# sourceMappingURL=sim-jwt-bearer-token.d.ts.map

package/dist/util/jwt/sim-jwt-bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-bearer-token.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-bearer-token.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/{service/apigatewayv2/api/authorizer/sim-http-api-bearer-token.js → util/jwt/sim-jwt-bearer-token.js}

@@ -5,19 +5,19 @@
  * there rather than required. The comparison is case-insensitive, since HTTP
  * authorization schemes are.
  */
-const bearerPrefix = /^bearer\s+/i;
+const bearerPrefix = /^bearer\s+/iu;
 /**
  * The token an identity source value carries, if it carries one at all.
  *
- * This is a JWT authorizer's reading of the value. A Lambda `REQUEST`
- * authorizer is handed the value as it arrived instead, since what it names
- * may be a cookie or an API key rather than a bearer token.
+ * This is how a verifier of tokens reads the value. A Lambda authorizer is
+ * handed the value as it arrived instead, since what it names may be a cookie
+ * or an API key rather than a bearer token.
  */
-export function simHttpApiBearerToken(value) {
+export function simJwtBearerToken(value) {
     const token = value?.replace(bearerPrefix, "").trim();
     if (token === undefined || token.length === 0) {
         return undefined;
     }
     return token;
 }
-//# sourceMappingURL=sim-http-api-bearer-token.js.map
+//# sourceMappingURL=sim-jwt-bearer-token.js.map

package/dist/util/jwt/sim-jwt-bearer-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-bearer-token.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-bearer-token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAyB;IAEzB,MAAM,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/util/jwt/sim-jwt-claim-strings.d.ts

@@ -0,0 +1,13 @@
+import { type SimJwtClaims } from "./sim-jwt-claims.js";
+/**
+ * The claims of an accepted token, as they reach a handler behind API Gateway.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. Both
+ * API Gateway versions render them the same way, which is why this is here
+ * rather than in one of them.
+ */
+export declare function simJwtClaimStrings(claims: SimJwtClaims): Record<string, string>;
+//# sourceMappingURL=sim-jwt-claim-strings.d.ts.map

package/dist/util/jwt/sim-jwt-claim-strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-claim-strings.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-claim-strings.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,YAAY,GACnB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB"}

package/dist/util/jwt/sim-jwt-claim-strings.js

@@ -0,0 +1,37 @@
+import { isSimJwtClaimList, } from "./sim-jwt-claims.js";
+/**
+ * The claims of an accepted token, as they reach a handler behind API Gateway.
+ *
+ * Two things here are observed rather than published by AWS. Every claim value
+ * arrives at the handler as a string, and a list claim such as
+ * `cognito:groups` is rendered the way Go prints a slice, so two groups arrive
+ * as `[GroupA GroupB]` rather than as JSON or as a comma-separated list. Both
+ * API Gateway versions render them the same way, which is why this is here
+ * rather than in one of them.
+ */
+export function simJwtClaimStrings(claims) {
+    return Object.fromEntries(Object.entries(claims.toRecord()).map(([name, value]) => [
+        name,
+        simJwtClaimString(value),
+    ]));
+}
+/**
+ * One claim value as the string the handler receives.
+ *
+ * A nested object claim is JSON-encoded, which is the one shape here that was
+ * not observed on real AWS: no simulated issuer emits one, and neither does
+ * Cognito.
+ */
+function simJwtClaimString(value) {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (isSimJwtClaimList(value)) {
+        return `[${value.map((entry) => simJwtClaimString(entry)).join(" ")}]`;
+    }
+    if (typeof value === "object" && value !== null) {
+        return JSON.stringify(value);
+    }
+    return String(value);
+}
+//# sourceMappingURL=sim-jwt-claim-strings.js.map

package/dist/util/jwt/sim-jwt-claim-strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-claim-strings.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-claim-strings.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAGlB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAoB;IAEpB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACvD,IAAI;QACJ,iBAAiB,CAAC,KAAK,CAAC;KACzB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,KAAuB;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/util/jwt/sim-jwt-scopes.d.ts

@@ -0,0 +1,9 @@
+import type { SimJwtClaims } from "./sim-jwt-claims.js";
+/**
+ * The scopes a token claims, or null when it claims none.
+ *
+ * Null rather than an empty list is what API Gateway reports for a token
+ * carrying no scope claim at all, which is every Cognito id token.
+ */
+export declare function simJwtScopes(claims: SimJwtClaims): string[] | null;
+//# sourceMappingURL=sim-jwt-scopes.d.ts.map

package/dist/util/jwt/sim-jwt-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-scopes.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-scopes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAUxD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,GAAG,IAAI,CAUlE"}

package/dist/util/jwt/sim-jwt-scopes.js

@@ -0,0 +1,35 @@
+/**
+ * The claims a scope can be written in.
+ *
+ * `scope` is what an OAuth 2.0 access token carries, and `scp` is what some
+ * issuers use instead. Cognito writes `scope`.
+ */
+const scopeClaimNames = ["scope", "scp"];
+/**
+ * The scopes a token claims, or null when it claims none.
+ *
+ * Null rather than an empty list is what API Gateway reports for a token
+ * carrying no scope claim at all, which is every Cognito id token.
+ */
+export function simJwtScopes(claims) {
+    for (const name of scopeClaimNames) {
+        const claimed = claimedScopes(claims, name);
+        if (claimed !== undefined) {
+            return claimed;
+        }
+    }
+    return null;
+}
+/**
+ * The scopes one claim holds, whether it was written as space-separated text
+ * or as a list.
+ */
+function claimedScopes(claims, name) {
+    const text = claims.text(name);
+    if (text !== undefined) {
+        return text.split(/\s+/u).filter((scope) => scope.length > 0);
+    }
+    const list = claims.textList(name);
+    return list === undefined ? undefined : [...list];
+}
+//# sourceMappingURL=sim-jwt-scopes.js.map

package/dist/util/jwt/sim-jwt-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-scopes.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-scopes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,MAAoB,EACpB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACpD,CAAC"}

package/dist/util/jwt/sim-jwt-time-claims.d.ts

@@ -0,0 +1,31 @@
+import type { SimClock } from "../clock/sim-clock.js";
+import type { SimJwtClaims } from "./sim-jwt-claims.js";
+interface SimJwtTimeClaimsProperties {
+    readonly clock: SimClock;
+}
+/**
+ * The time claims of a token, checked against a clock.
+ *
+ * The comparison allows nothing for clock skew. That is what makes advancing
+ * the simulation's clock past a token's `exp` turn an accepted request into a
+ * refused one with nothing else changed.
+ */
+export declare class SimJwtTimeClaims {
+    private readonly clock;
+    constructor(properties: SimJwtTimeClaimsProperties);
+    /**
+     * Whether `exp`, `nbf` and `iat` all hold at this moment.
+     *
+     * A token with no `exp` holds nothing rather than never expiring: real
+     * Cognito always sets it, and admitting a token nothing can expire is the
+     * divergence worth failing on.
+     */
+    hold(claims: SimJwtClaims): boolean;
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    private isBefore;
+}
+export {};
+//# sourceMappingURL=sim-jwt-time-claims.d.ts.map

package/dist/util/jwt/sim-jwt-time-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-time-claims.d.ts","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-time-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,UAAU,0BAA0B;IAClC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IAEjC,YAAY,UAAU,EAAE,0BAA0B,EAEjD;IAED;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAYlC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/util/jwt/sim-jwt-time-claims.js

@@ -0,0 +1,37 @@
+/**
+ * The time claims of a token, checked against a clock.
+ *
+ * The comparison allows nothing for clock skew. That is what makes advancing
+ * the simulation's clock past a token's `exp` turn an accepted request into a
+ * refused one with nothing else changed.
+ */
+export class SimJwtTimeClaims {
+    clock;
+    constructor(properties) {
+        this.clock = properties.clock;
+    }
+    /**
+     * Whether `exp`, `nbf` and `iat` all hold at this moment.
+     *
+     * A token with no `exp` holds nothing rather than never expiring: real
+     * Cognito always sets it, and admitting a token nothing can expire is the
+     * divergence worth failing on.
+     */
+    hold(claims) {
+        const now = Math.floor(this.clock.now().getTime() / 1000);
+        const expiresAt = claims.number("exp");
+        if (expiresAt === undefined || now >= expiresAt) {
+            return false;
+        }
+        return (!this.isBefore(now, claims.number("nbf")) &&
+            !this.isBefore(now, claims.number("iat")));
+    }
+    /**
+     * Whether now is earlier than a time claim the token carries. A claim the
+     * token does not carry is nothing to be earlier than.
+     */
+    isBefore(now, claimed) {
+        return claimed !== undefined && now < claimed;
+    }
+}
+//# sourceMappingURL=sim-jwt-time-claims.js.map

package/dist/util/jwt/sim-jwt-time-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-jwt-time-claims.js","sourceRoot":"","sources":["../../../src/util/jwt/sim-jwt-time-claims.ts"],"names":[],"mappings":"AAOA;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACV,KAAK,CAAW;IAEjC,YAAY,UAAsC;QAChD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,MAAoB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,QAAQ,CAAC,GAAW,EAAE,OAA2B;QACvD,OAAO,OAAO,KAAK,SAAS,IAAI,GAAG,GAAG,OAAO,CAAC;IAChD,CAAC;CACF"}