feat(util): add authType derived from the request identity

[bentsku]

1/2 of a stack. 2/2 is #297; the two are meant to land under one release.

Problem

util.authType() was missing, so a host had to patch it onto the module at request time. That mutates the singleton every resolver imports, and it left the function returning "" under EvaluateCode where AWS returns an auth mode.

What this does

util.authType() derives the mode from ctx.identity, which AppSync shapes per authorization mode. A host installs the request with a new setResolverContext export immediately before calling the resolver.

Recorded from EvaluateCode over every identity shape in the resolver context reference plus the mixtures between two modes. An identity belongs to a mode when every key of the identity is a key of that mode and every key the mode requires is present and not null:

mode	key set	required
Lambda Authorization	resolverContext	none
IAM Authorization	accountId, sourceIp, username, userArn, cognitoIdentityPoolId, cognitoIdentityId, cognitoIdentityAuthType, cognitoIdentityAuthProvider	the first four
User Pool Authorization	sourceIp, username, groups, sub, issuer, claims, defaultAuthStrategy	all but groups
Open ID Connect Authorization	sub, issuer, claims	all three

Anything unmatched, an absent identity included, is API Key Authorization. Two consequences that are easy to get wrong: an identity with no keys at all is a Lambda identity, and a key belonging to another mode rules a mode out rather than being ignored, so {sub, issuer, claims, username} is an incomplete user pool identity and not an OIDC one.

Tests

15 snapshots recorded from EvaluateCode, one per identity shape and per fallback, plus a checkValid case. A separate block asserts the setResolverContext seam with plain expect; those are not compared against AWS and the comment says so.

npm test: 345 passed, 3 skipped, 337 snapshots.

🤖 Generated with Claude Code