@kensio/yulin 1.17.2 → 1.18.1

package/dist/service/apigateway/api/sim-rest-api-declared-method.js

@@ -0,0 +1,61 @@
+/**
+ * Declare every path template of an API, each with its method and the
+ * integration behind it.
+ *
+ * They are declared one at a time because they share resources. Two paths
+ * under `/orders` build that resource once, and whichever gets there first
+ * creates it.
+ */
+export async function declaredMethods(apiGateway, resourcePaths, input) {
+    for (const resourcePath of resourcePaths) {
+        // oxlint-disable-next-line no-await-in-loop -- paths share resources, so one at a time
+        await declaredMethod(apiGateway, { ...input, resourcePath });
+    }
+}
+/**
+ * Declare one path template, its method, and the integration behind it.
+ */
+async function declaredMethod(apiGateway, input) {
+    const { restApiId, httpMethod } = input;
+    const resourceId = await declaredResource(apiGateway, restApiId, input.rootResourceId, input.resourcePath);
+    await apiGateway.putMethod({
+        input: { restApiId, resourceId, httpMethod, ...input.authorization },
+    });
+    await apiGateway.putIntegration({
+        input: {
+            restApiId,
+            resourceId,
+            httpMethod,
+            type: "AWS_PROXY",
+            integrationHttpMethod: "POST",
+            uri: input.functionArn,
+        },
+    });
+}
+/**
+ * Declare the chain of resources one path template needs, reusing whatever the
+ * API already has, and answer the id of the leaf.
+ */
+async function declaredResource(apiGateway, restApiId, rootResourceId, resourcePath) {
+    const pathParts = resourcePath.split("/").filter((part) => part !== "");
+    let parentId = rootResourceId;
+    for (const pathPart of pathParts) {
+        const existing = apiGateway
+            .findRestApi(restApiId)
+            ?.resources.list()
+            .find((one) => one.parentId === parentId && one.pathPart?.pathPart === pathPart);
+        if (existing !== undefined) {
+            parentId = existing.resourceId;
+            continue;
+        }
+        // Each resource is the parent of the next, so the chain is built one at a
+        // time rather than in parallel.
+        // oxlint-disable-next-line no-await-in-loop -- each parent id comes from the call before it
+        const created = await apiGateway.createResource({
+            input: { restApiId, parentId, pathPart },
+        });
+        parentId = created.id;
+    }
+    return parentId;
+}
+//# sourceMappingURL=sim-rest-api-declared-method.js.map

package/dist/service/apigateway/api/sim-rest-api-declared-method.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-declared-method.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-declared-method.ts"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAyB,EACzB,aAAgC,EAChC,KAA0D;IAE1D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,uFAAuF;QACvF,MAAM,cAAc,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,UAAyB,EACzB,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CACvC,UAAU,EACV,SAAS,EACT,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,YAAY,CACnB,CAAC;IAEF,MAAM,UAAU,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE;KACrE,CAAC,CAAC;IACH,MAAM,UAAU,CAAC,cAAc,CAAC;QAC9B,KAAK,EAAE;YACL,SAAS;YACT,UAAU;YACV,UAAU;YACV,IAAI,EAAE,WAAW;YACjB,qBAAqB,EAAE,MAAM;YAC7B,GAAG,EAAE,KAAK,CAAC,WAAW;SACvB;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAC7B,UAAyB,EACzB,SAAiB,EACjB,cAAsB,EACtB,YAAoB;IAEpB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,QAAQ,GAAG,cAAc,CAAC;IAE9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,UAAU;aACxB,WAAW,CAAC,SAAS,CAAC;YACvB,EAAE,SAAS,CAAC,IAAI,EAAE;aACjB,IAAI,CACH,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CACnE,CAAC;QAEJ,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,0EAA0E;QAC1E,gCAAgC;QAChC,4FAA4F;QAC5F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC;YAC9C,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACzC,CAAC,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/apigateway/api/sim-rest-api-execute-api-arn.d.ts

@@ -0,0 +1,76 @@
+import type { SimRestApiMatch } from "./match/sim-rest-api-match.js";
+import type { SimRestApi } from "./sim-rest-api.js";
+interface SimRestApiExecuteApiArnProperties {
+    readonly restApi: SimRestApi;
+    readonly stageName: string;
+    /** The method and path part, such as `GET/orders/{orderId}`. */
+    readonly methodAndPath: string;
+}
+/**
+ * The `execute-api` ARN of one request to a REST API.
+ *
+ * ```text
+ * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
+ * ```
+ *
+ * This is the `SourceArn` an `AWS::Lambda::Permission` for a proxy integration
+ * is granted on, and it is the same shape an HTTP API uses. What differs is
+ * the last part. A REST API names the resource path template with its braces
+ * intact, which is the form CDK's `arnForExecuteApi` writes, while an HTTP API
+ * names a route key.
+ *
+ * The method segment carries the verb the client used rather than the `ANY` a
+ * resource may have declared. CDK wildcards that segment, and a concrete verb
+ * matches a wildcard where a literal `ANY` would not, so this is the reading
+ * that keeps a CDK-deployed API working.
+ *
+ * Three things want this ARN and they fill the last part differently:
+ *
+ * - the invoke permission a Lambda integration is authorized against, where
+ *   the path is the matched resource's template with its braces intact;
+ * - the `methodArn` a Lambda authorizer is handed, and the resource the policy
+ *   it answers with is evaluated against, where the path is the one the client
+ *   asked for;
+ * - the ARN API Gateway invokes an authorizer's own function under, which
+ *   names the authorizer and no stage at all.
+ */
+export declare class SimRestApiExecuteApiArn {
+    private readonly restApi;
+    private readonly stageName;
+    private readonly methodAndPath;
+    constructor(properties: SimRestApiExecuteApiArnProperties);
+    /**
+     * The ARN of the method a request matched.
+     */
+    static forMatch(restApi: SimRestApi, match: SimRestApiMatch, requestMethod: string): SimRestApiExecuteApiArn;
+    /**
+     * The ARN of the request a client made, which is the `methodArn` a Lambda
+     * authorizer is handed.
+     *
+     * This names the concrete path rather than the resource template, so an
+     * authorizer behind a `{proxy+}` sees the path that was asked for. The
+     * policy it answers with is evaluated against this same ARN, which is why an
+     * authorizer allowing one path leaves another unauthorized.
+     */
+    static forRequest(restApi: SimRestApi, match: SimRestApiMatch, requestMethod: string): SimRestApiExecuteApiArn;
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage. An
+     * authorizer belongs to the API rather than to anything serving a request. A
+     * function integrated behind a method and used as that method's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(restApi: SimRestApi, authorizerId: string): SimRestApiExecuteApiArn;
+    /**
+     * The ARN as a permission or a policy names it.
+     */
+    toString(): string;
+}
+export {};
+//# sourceMappingURL=sim-rest-api-execute-api-arn.d.ts.map

package/dist/service/apigateway/api/sim-rest-api-execute-api-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-execute-api-arn.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-execute-api-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,UAAU,iCAAiC;IACzC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC,YAAY,UAAU,EAAE,iCAAiC,EAIxD;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,GACpB,uBAAuB,CAQzB;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CACf,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,GACpB,uBAAuB,CAMzB;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAMzB;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAOjB;CACF"}

package/dist/service/apigateway/api/sim-rest-api-execute-api-arn.js

@@ -0,0 +1,95 @@
+/**
+ * The `execute-api` ARN of one request to a REST API.
+ *
+ * ```text
+ * arn:aws:execute-api:<region>:<account>:<apiId>/<stage>/<METHOD>/<path>
+ * ```
+ *
+ * This is the `SourceArn` an `AWS::Lambda::Permission` for a proxy integration
+ * is granted on, and it is the same shape an HTTP API uses. What differs is
+ * the last part. A REST API names the resource path template with its braces
+ * intact, which is the form CDK's `arnForExecuteApi` writes, while an HTTP API
+ * names a route key.
+ *
+ * The method segment carries the verb the client used rather than the `ANY` a
+ * resource may have declared. CDK wildcards that segment, and a concrete verb
+ * matches a wildcard where a literal `ANY` would not, so this is the reading
+ * that keeps a CDK-deployed API working.
+ *
+ * Three things want this ARN and they fill the last part differently:
+ *
+ * - the invoke permission a Lambda integration is authorized against, where
+ *   the path is the matched resource's template with its braces intact;
+ * - the `methodArn` a Lambda authorizer is handed, and the resource the policy
+ *   it answers with is evaluated against, where the path is the one the client
+ *   asked for;
+ * - the ARN API Gateway invokes an authorizer's own function under, which
+ *   names the authorizer and no stage at all.
+ */
+export class SimRestApiExecuteApiArn {
+    restApi;
+    stageName;
+    methodAndPath;
+    constructor(properties) {
+        this.restApi = properties.restApi;
+        this.stageName = properties.stageName;
+        this.methodAndPath = properties.methodAndPath;
+    }
+    /**
+     * The ARN of the method a request matched.
+     */
+    static forMatch(restApi, match, requestMethod) {
+        return new SimRestApiExecuteApiArn({
+            restApi,
+            stageName: match.stage.stageName,
+            // The resource path carries a leading separator and the ARN supplies its
+            // own, so a root-resource request reads `<apiId>/<stage>/GET/`.
+            methodAndPath: `${requestMethod}${match.resource.path}`,
+        });
+    }
+    /**
+     * The ARN of the request a client made, which is the `methodArn` a Lambda
+     * authorizer is handed.
+     *
+     * This names the concrete path rather than the resource template, so an
+     * authorizer behind a `{proxy+}` sees the path that was asked for. The
+     * policy it answers with is evaluated against this same ARN, which is why an
+     * authorizer allowing one path leaves another unauthorized.
+     */
+    static forRequest(restApi, match, requestMethod) {
+        return new SimRestApiExecuteApiArn({
+            restApi,
+            stageName: match.stage.stageName,
+            methodAndPath: `${requestMethod.toUpperCase()}/${match.pathAfterStage}`,
+        });
+    }
+    /**
+     * The ARN API Gateway invokes one of an API's authorizers under.
+     *
+     * ```text
+     * arn:aws:execute-api:<region>:<account>:<apiId>/authorizers/<authorizerId>
+     * ```
+     *
+     * This is the `SourceArn` AWS documents for granting API Gateway permission
+     * to invoke a Lambda authorizer's function, and it names no stage. An
+     * authorizer belongs to the API rather than to anything serving a request. A
+     * function integrated behind a method and used as that method's authorizer
+     * therefore needs two permissions, as it does on AWS.
+     */
+    static forAuthorizer(restApi, authorizerId) {
+        return new SimRestApiExecuteApiArn({
+            restApi,
+            stageName: "authorizers",
+            methodAndPath: authorizerId,
+        });
+    }
+    /**
+     * The ARN as a permission or a policy names it.
+     */
+    toString() {
+        const { accountId, regionName } = this.restApi.accountRegionScope;
+        return (`arn:aws:execute-api:${regionName}:${accountId}:` +
+            `${this.restApi.apiId}/${this.stageName}/${this.methodAndPath}`);
+    }
+}
+//# sourceMappingURL=sim-rest-api-execute-api-arn.js.map

package/dist/service/apigateway/api/sim-rest-api-execute-api-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-execute-api-arn.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-execute-api-arn.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,OAAO,uBAAuB;IACjB,OAAO,CAAa;IACpB,SAAS,CAAS;IAClB,aAAa,CAAS;IAEvC,YAAY,UAA6C;QACvD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,CACb,OAAmB,EACnB,KAAsB,EACtB,aAAqB;QAErB,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,yEAAyE;YACzE,gEAAgE;YAChE,aAAa,EAAE,GAAG,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,CACf,OAAmB,EACnB,KAAsB,EACtB,aAAqB;QAErB,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,aAAa,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;SACxE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,aAAa,CAClB,OAAmB,EACnB,YAAoB;QAEpB,OAAO,IAAI,uBAAuB,CAAC;YACjC,OAAO;YACP,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAElE,OAAO,CACL,uBAAuB,UAAU,IAAI,SAAS,GAAG;YACjD,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/service/apigateway/api/sim-rest-api-host.d.ts

@@ -0,0 +1,23 @@
+interface SimRestApiHostProperties {
+    readonly apiId: string;
+    readonly regionName: string;
+}
+/**
+ * Build the real AWS endpoint hostname for a REST API.
+ *
+ * REST APIs and HTTP APIs are issued endpoints under the same `execute-api`
+ * host, which is why the two labels come from one place. What differs is the
+ * path. Every REST API request carries its stage as the first path segment,
+ * where an HTTP API can serve a `$default` stage at the root.
+ */
+export declare function simRestApiHost(properties: SimRestApiHostProperties): string;
+/**
+ * Build the logical hostname for a REST API: the AWS endpoint hostname without
+ * the real AWS domain.
+ *
+ * This is the form Yulin serves on localhost, where the `.amazonaws.com` tail
+ * is replaced by the local suffix.
+ */
+export declare function simRestApiLogicalHost(properties: SimRestApiHostProperties): string;
+export {};
+//# sourceMappingURL=sim-rest-api-host.d.ts.map

package/dist/service/apigateway/api/sim-rest-api-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-host.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-host.ts"],"names":[],"mappings":"AAKA,UAAU,wBAAwB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAER"}

package/dist/service/apigateway/api/sim-rest-api-host.js

@@ -0,0 +1,23 @@
+import { executeApiDomain, executeApiHostLabel, } from "../../apigatewayv2/api/sim-http-api-host.js";
+/**
+ * Build the real AWS endpoint hostname for a REST API.
+ *
+ * REST APIs and HTTP APIs are issued endpoints under the same `execute-api`
+ * host, which is why the two labels come from one place. What differs is the
+ * path. Every REST API request carries its stage as the first path segment,
+ * where an HTTP API can serve a `$default` stage at the root.
+ */
+export function simRestApiHost(properties) {
+    return `${simRestApiLogicalHost(properties)}.${executeApiDomain}`;
+}
+/**
+ * Build the logical hostname for a REST API: the AWS endpoint hostname without
+ * the real AWS domain.
+ *
+ * This is the form Yulin serves on localhost, where the `.amazonaws.com` tail
+ * is replaced by the local suffix.
+ */
+export function simRestApiLogicalHost(properties) {
+    return `${properties.apiId}.${executeApiHostLabel}.${properties.regionName}`;
+}
+//# sourceMappingURL=sim-rest-api-host.js.map

package/dist/service/apigateway/api/sim-rest-api-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-host.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-host.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6CAA6C,CAAC;AAOrD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,UAAoC;IACjE,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,gBAAgB,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAoC;IAEpC,OAAO,GAAG,UAAU,CAAC,KAAK,IAAI,mBAAmB,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;AAC/E,CAAC"}

package/dist/service/apigateway/api/sim-rest-api-id.d.ts

@@ -0,0 +1,15 @@
+import type { Brand } from "../../../util/brand.type.js";
+/**
+ * The id API Gateway allocates for one REST API, which is the leading DNS
+ * label of the endpoint it generates.
+ */
+export type SimRestApiId = Brand<string, "SimRestApiId">;
+/**
+ * Allocate a REST API id in the shape real API Gateway uses: 10 lowercase
+ * alphanumeric characters, forming one DNS label.
+ *
+ * An HTTP API id has the same shape, because both services issue endpoints
+ * under `execute-api` and neither reserves any part of that namespace.
+ */
+export declare function makeSimRestApiId(): SimRestApiId;
+//# sourceMappingURL=sim-rest-api-id.d.ts.map

package/dist/service/apigateway/api/sim-rest-api-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-id.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-id.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C"}

package/dist/service/apigateway/api/sim-rest-api-id.js

@@ -0,0 +1,12 @@
+import { faker } from "@faker-js/faker";
+/**
+ * Allocate a REST API id in the shape real API Gateway uses: 10 lowercase
+ * alphanumeric characters, forming one DNS label.
+ *
+ * An HTTP API id has the same shape, because both services issue endpoints
+ * under `execute-api` and neither reserves any part of that namespace.
+ */
+export function makeSimRestApiId() {
+    return faker.helpers.fromRegExp(/[a-z0-9]{10}/);
+}
+//# sourceMappingURL=sim-rest-api-id.js.map

package/dist/service/apigateway/api/sim-rest-api-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-id.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAUxC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAiB,CAAC;AAClE,CAAC"}

package/dist/service/apigateway/api/sim-rest-api-lambda-proxy.factory.d.ts

@@ -0,0 +1,66 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import type { SimPayload1Event } from "../../../serve/payload-1/sim-payload-1-event.type.js";
+import type { SimAws } from "../../aws/sim-aws.js";
+import { type SimRestApiProxyAuthorizerInput } from "./sim-rest-api-proxy-authorizer.js";
+import type { SimRestApi } from "./sim-rest-api.js";
+/**
+ * What a test asks for when it wants a REST API that serves something.
+ */
+export interface SimRestApiLambdaProxyInput extends SimRestApiProxyAuthorizerInput {
+    readonly apiName: string;
+    readonly functionName: string;
+    /** The function code every method of the API hands its requests to. */
+    readonly handler: (event: SimPayload1Event) => unknown;
+    readonly disableExecuteApiEndpoint: boolean;
+    /**
+     * The resource paths the API declares, written as templates such as
+     * `/orders/{orderId}` or `/{proxy+}`. Each one gets the method below.
+     */
+    readonly resourcePaths: readonly string[];
+    /** The HTTP method declared on each of those resources. */
+    readonly httpMethod: string;
+    /** The stage the API is deployed to, which every request goes through. */
+    readonly stageName: string;
+    /** The variables that stage carries. */
+    readonly stageVariables: Readonly<Record<string, string>>;
+    /**
+     * Whether the function grants the API permission to invoke it, which it
+     * needs before any method serves anything.
+     *
+     * The grant is the one CDK writes: `apigateway.amazonaws.com` may
+     * `lambda:InvokeFunction` for any stage and method of this API. A test about
+     * the permission itself turns this off and grants what it means to test.
+     */
+    readonly invokePermission: boolean;
+}
+/**
+ * Creates a REST API that proxies every request to a simulated Lambda
+ * function, through the ordinary commands.
+ *
+ * A resource per path segment, a method, an integration, a deployment and a
+ * function stand between a test and a request it can serve, and a test about
+ * serving is about none of them. Tests about the commands themselves send them
+ * one at a time instead.
+ *
+ * Supplying an `authorizerHandler` puts a `TOKEN` authorizer in front of every
+ * method, invoking a second simulated function of its own. A
+ * `requestAuthorizerHandler` puts a `REQUEST` authorizer there instead, and
+ * `cognitoUserPoolArns` puts a `COGNITO_USER_POOLS` authorizer there, which
+ * invokes nothing and verifies the token itself. Asking for
+ * `iamAuthorization` puts every method behind IAM.
+ *
+ * ```typescript
+ * const restApi = await simRestApiLambdaProxyFactory.make(
+ *   { handler: () => ({ statusCode: 200, body: "hello" }) },
+ *   simAws,
+ * );
+ * const response = await new SimAwsHttp({ simAws }).fetch(
+ *   new SimAwsLocalUrl({ input: restApi.invokeUrl("prod") }).toString(),
+ * );
+ * ```
+ *
+ * The API is created in the default Account and Region of the simulated AWS it
+ * is given, and so is the function unless another Account is asked for.
+ */
+export declare const simRestApiLambdaProxyFactory: AsyncMappedFactory<SimRestApiLambdaProxyInput, SimRestApi, SimAws>;
+//# sourceMappingURL=sim-rest-api-lambda-proxy.factory.d.ts.map

package/dist/service/apigateway/api/sim-rest-api-lambda-proxy.factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-lambda-proxy.factory.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAG7F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,oCAAoC,CAAC;AAK5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;GAEG;AACH,MAAM,WAAW,0BAA2B,SAAQ,8BAA8B;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,4BAA4B,oEAuExC,CAAC"}

package/dist/service/apigateway/api/sim-rest-api-lambda-proxy.factory.js

@@ -0,0 +1,89 @@
+import { AsyncMappedFactory } from "@kensio/part-factory";
+import { assertDefined } from "../../../util/type-guard/defined.js";
+import { DEFAULT_SIM_AWS_ACCOUNT_ID } from "../../aws/sim-aws-account.js";
+import { declaredMethods } from "./sim-rest-api-declared-method.js";
+import { simRestApiProxyAuthorization, } from "./sim-rest-api-proxy-authorizer.js";
+import { simRestApiInvokePermission, simRestApiProxyFunction, } from "./sim-rest-api-proxy-function.js";
+/**
+ * Creates a REST API that proxies every request to a simulated Lambda
+ * function, through the ordinary commands.
+ *
+ * A resource per path segment, a method, an integration, a deployment and a
+ * function stand between a test and a request it can serve, and a test about
+ * serving is about none of them. Tests about the commands themselves send them
+ * one at a time instead.
+ *
+ * Supplying an `authorizerHandler` puts a `TOKEN` authorizer in front of every
+ * method, invoking a second simulated function of its own. A
+ * `requestAuthorizerHandler` puts a `REQUEST` authorizer there instead, and
+ * `cognitoUserPoolArns` puts a `COGNITO_USER_POOLS` authorizer there, which
+ * invokes nothing and verifies the token itself. Asking for
+ * `iamAuthorization` puts every method behind IAM.
+ *
+ * ```typescript
+ * const restApi = await simRestApiLambdaProxyFactory.make(
+ *   { handler: () => ({ statusCode: 200, body: "hello" }) },
+ *   simAws,
+ * );
+ * const response = await new SimAwsHttp({ simAws }).fetch(
+ *   new SimAwsLocalUrl({ input: restApi.invokeUrl("prod") }).toString(),
+ * );
+ * ```
+ *
+ * The API is created in the default Account and Region of the simulated AWS it
+ * is given, and so is the function unless another Account is asked for.
+ */
+export const simRestApiLambdaProxyFactory = new AsyncMappedFactory(() => ({
+    apiName: "orders",
+    functionName: "orders",
+    functionAccountId: DEFAULT_SIM_AWS_ACCOUNT_ID,
+    roleArn: "arn:aws:iam::111111111111:role/OrdersRole",
+    handler: () => ({ statusCode: 200, body: "hello" }),
+    authorizerHandler: undefined,
+    requestAuthorizerHandler: undefined,
+    cognitoUserPoolArns: undefined,
+    authorizationScopes: [],
+    authorizerIdentitySource: "method.request.header.Authorization",
+    authorizerResultTtlSeconds: 0,
+    authorizerInvokePermission: true,
+    disableExecuteApiEndpoint: false,
+    iamAuthorization: false,
+    resourcePaths: ["/{proxy+}"],
+    httpMethod: "ANY",
+    stageName: "prod",
+    stageVariables: {},
+    invokePermission: true,
+}), async (input, simAws) => {
+    const functionArn = await simRestApiProxyFunction(simAws, input);
+    const apiGateway = simAws.apiGateway();
+    const created = await apiGateway.createRestApi({
+        input: {
+            name: input.apiName,
+            disableExecuteApiEndpoint: input.disableExecuteApiEndpoint,
+        },
+    });
+    const restApiId = created.id;
+    await declaredMethods(apiGateway, input.resourcePaths, {
+        restApiId,
+        rootResourceId: created.rootResourceId,
+        httpMethod: input.httpMethod,
+        functionArn,
+        authorization: await simRestApiProxyAuthorization(simAws, input, restApiId),
+    });
+    if (input.invokePermission) {
+        await simRestApiInvokePermission(simAws, input, restApiId);
+    }
+    await apiGateway.createDeployment({
+        input: {
+            restApiId,
+            stageName: input.stageName,
+            variables: input.stageVariables,
+        },
+    });
+    // An id CreateRestApi allocated is an API the store holds, so this is only
+    // missing if something is wrong with the simulator itself.
+    const restApi = apiGateway.findRestApi(restApiId);
+    assertDefined(restApi, `Simulated API Gateway created the API ${restApiId} and then did not hold it`);
+    return restApi;
+});
+//# sourceMappingURL=sim-rest-api-lambda-proxy.factory.js.map

package/dist/service/apigateway/api/sim-rest-api-lambda-proxy.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-lambda-proxy.factory.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-lambda-proxy.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG1D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EACL,4BAA4B,GAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kCAAkC,CAAC;AAkC1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,IAAI,kBAAkB,CAKhE,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,iBAAiB,EAAE,0BAA0B;IAC7C,OAAO,EAAE,2CAA2C;IACpD,OAAO,EAAE,GAAY,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5D,iBAAiB,EAAE,SAAS;IAC5B,wBAAwB,EAAE,SAAS;IACnC,mBAAmB,EAAE,SAAS;IAC9B,mBAAmB,EAAE,EAAE;IACvB,wBAAwB,EAAE,qCAAqC;IAC/D,0BAA0B,EAAE,CAAC;IAC7B,0BAA0B,EAAE,IAAI;IAChC,yBAAyB,EAAE,KAAK;IAChC,gBAAgB,EAAE,KAAK;IACvB,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,MAAM;IACjB,cAAc,EAAE,EAAE;IAClB,gBAAgB,EAAE,IAAI;CACvB,CAAC,EACF,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;IACtB,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC;QAC7C,KAAK,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;SAC3D;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;IAE7B,MAAM,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE;QACrD,SAAS;QACT,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW;QACX,aAAa,EAAE,MAAM,4BAA4B,CAC/C,MAAM,EACN,KAAK,EACL,SAAS,CACV;KACF,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,0BAA0B,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,CAAC,gBAAgB,CAAC;QAChC,KAAK,EAAE;YACL,SAAS;YACT,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,cAAc;SAChC;KACF,CAAC,CAAC;IAEH,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAClD,aAAa,CACX,OAAO,EACP,yCAAyC,SAAS,2BAA2B,CAC9E,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC,CACF,CAAC"}

package/dist/service/apigateway/api/sim-rest-api-proxy-authorizer.d.ts

@@ -0,0 +1,70 @@
+import type { SimAws } from "../../aws/sim-aws.js";
+import type { SimRestApiTokenAuthorizerEvent } from "../serve/auth/sim-rest-api-authorizer-event.js";
+import type { SimRestApiRequestAuthorizerEvent } from "../serve/auth/sim-rest-api-request-authorizer-event.js";
+/**
+ * How the methods of a test's REST API say who may call them.
+ */
+export interface SimRestApiProxyAuthorization {
+    readonly authorizationType: string;
+    readonly authorizerId?: string | undefined;
+    readonly authorizationScopes?: readonly string[] | undefined;
+}
+/**
+ * What a test asks for when it wants its REST API gated by an authorizer.
+ *
+ * The two Lambda kinds hand their function different events, so a test says
+ * which it is writing by which handler it supplies rather than by naming a
+ * type. A `REQUEST` handler wins where both are given.
+ */
+export interface SimRestApiProxyAuthorizerInput {
+    /**
+     * The Account the functions belong to, which need not be the API's. An
+     * integration URI and an authorizer URI are each free to name another one.
+     */
+    readonly functionAccountId: string;
+    readonly roleArn: string;
+    /** The function a `TOKEN` authorizer invokes, which decides every request. */
+    readonly authorizerHandler: ((event: SimRestApiTokenAuthorizerEvent) => unknown) | undefined;
+    /** The function a `REQUEST` authorizer invokes instead. */
+    readonly requestAuthorizerHandler: ((event: SimRestApiRequestAuthorizerEvent) => unknown) | undefined;
+    /**
+     * The user pools a `COGNITO_USER_POOLS` authorizer accepts tokens from,
+     * named by ARN. Supplying them gates every method with that authorizer
+     * instead of a Lambda one, and it invokes nothing.
+     */
+    readonly cognitoUserPoolArns: readonly string[] | undefined;
+    /** The scopes each method asks a verified token for. */
+    readonly authorizationScopes: readonly string[];
+    /**
+     * Whether every method is authorized by IAM, which is what an `AWS_IAM`
+     * method asks for. An API asking for this names no authorizer.
+     */
+    readonly iamAuthorization: boolean;
+    /**
+     * Where the authorizer looks for what identifies a caller. A `REQUEST`
+     * authorizer writes as many expressions as it likes, separated by commas.
+     */
+    readonly authorizerIdentitySource: string;
+    /**
+     * How long a Lambda authorizer holds a decision for, with zero meaning none,
+     * which is what an authorizer says nothing about it gets.
+     */
+    readonly authorizerResultTtlSeconds: number;
+    /**
+     * Whether the authorizer's function grants the API permission to invoke it,
+     * under the ARN naming the authorizer. A test about that permission turns
+     * this off.
+     */
+    readonly authorizerInvokePermission: boolean;
+}
+/**
+ * Create the authorizer a test's REST API gates its methods with, and answer
+ * how the methods name it.
+ *
+ * An API with no authorizer function, no user pools and no IAM authorization
+ * declares open methods, which is what a test about anything else wants. An
+ * `AWS_IAM` method names no authorizer, so a test asking for both is asking
+ * for something PutMethod refuses, and gets that refusal.
+ */
+export declare function simRestApiProxyAuthorization(simAws: SimAws, input: SimRestApiProxyAuthorizerInput, restApiId: string): Promise<SimRestApiProxyAuthorization>;
+//# sourceMappingURL=sim-rest-api-proxy-authorizer.d.ts.map

package/dist/service/apigateway/api/sim-rest-api-proxy-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-proxy-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-proxy-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gDAAgD,CAAC;AACrG,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAG/G;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,EACtB,CAAC,CAAC,KAAK,EAAE,8BAA8B,KAAK,OAAO,CAAC,GACpD,SAAS,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,wBAAwB,EAC7B,CAAC,CAAC,KAAK,EAAE,gCAAgC,KAAK,OAAO,CAAC,GACtD,SAAS,CAAC;IACd;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,8BAA8B,EACrC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAkCvC"}

package/dist/service/apigateway/api/sim-rest-api-proxy-authorizer.js

@@ -0,0 +1,37 @@
+import { simRestApiProxyLambdaAuthorizer } from "./sim-rest-api-proxy-lambda-authorizer.js";
+/**
+ * Create the authorizer a test's REST API gates its methods with, and answer
+ * how the methods name it.
+ *
+ * An API with no authorizer function, no user pools and no IAM authorization
+ * declares open methods, which is what a test about anything else wants. An
+ * `AWS_IAM` method names no authorizer, so a test asking for both is asking
+ * for something PutMethod refuses, and gets that refusal.
+ */
+export async function simRestApiProxyAuthorization(simAws, input, restApiId) {
+    const providerARNs = input.cognitoUserPoolArns;
+    if (providerARNs !== undefined) {
+        const { id } = await simAws.apiGateway().createAuthorizer({
+            input: {
+                restApiId,
+                name: "orders-user-pools",
+                type: "COGNITO_USER_POOLS",
+                providerARNs,
+                identitySource: input.authorizerIdentitySource,
+            },
+        });
+        return {
+            authorizationType: "COGNITO_USER_POOLS",
+            authorizerId: id,
+            authorizationScopes: input.authorizationScopes,
+        };
+    }
+    const authorizerId = await simRestApiProxyLambdaAuthorizer(simAws, input, restApiId);
+    if (authorizerId !== undefined) {
+        return { authorizationType: "CUSTOM", authorizerId };
+    }
+    return {
+        authorizationType: input.iamAuthorization ? "AWS_IAM" : "NONE",
+    };
+}
+//# sourceMappingURL=sim-rest-api-proxy-authorizer.js.map

package/dist/service/apigateway/api/sim-rest-api-proxy-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-rest-api-proxy-authorizer.js","sourceRoot":"","sources":["../../../../src/service/apigateway/api/sim-rest-api-proxy-authorizer.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,2CAA2C,CAAC;AAgE5F;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAc,EACd,KAAqC,EACrC,SAAiB;IAEjB,MAAM,YAAY,GAAG,KAAK,CAAC,mBAAmB,CAAC;IAE/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,gBAAgB,CAAC;YACxD,KAAK,EAAE;gBACL,SAAS;gBACT,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,oBAAoB;gBAC1B,YAAY;gBACZ,cAAc,EAAE,KAAK,CAAC,wBAAwB;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,oBAAoB;YACvC,YAAY,EAAE,EAAE;YAChB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,+BAA+B,CACxD,MAAM,EACN,KAAK,EACL,SAAS,CACV,CAAC;IAEF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,OAAO;QACL,iBAAiB,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;KAC/D,CAAC;AACJ,CAAC"}