What Does This Do

Splits LambdaAppSecHandler (1211 lines) into three files, with no behaviour change:

• LambdaEventParser (new) — all payload parsing: parseEvent (event payload and JSON string), parseResponse, parseJsonValue, detectTriggerType, the five per-trigger extractors and their helpers. Holds the Moshi adapters and MAX_EVENT_SIZE. The LambdaTriggerType enum and the LambdaRequestData / LambdaResponseData value types move here as nested types. Contains no AppSec imports.
• LambdaURIDataAdapter (new) — promoted from a private nested class to a top-level one, unchanged.
• LambdaAppSecHandler — down to ~400 lines, now only the gateway-callback logic: processRequestStart, processRequestEnd, processResponseData, mergeContexts, processAppSecRequestData, TemporaryRequestContext and the single CURRENT_TRIGGER_TYPE thread-local.

Method bodies are moved verbatim. The parser keeps returning the LambdaRequestData.EMPTY sentinel (compared by identity in processRequestStart) rather than null, and the generic extractor still returns populated data for UNKNOWN triggers, so unrecognised events continue to reach the WAF exactly as before.

LambdaAppSecHandlerTest is updated only where it names moved symbols — LambdaTriggerType, detectTriggerType, and extractResponseData which is now parseResponse. No assertions changed.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

🤖 Generated with Claude Code