@kensio/yulin 0.34.2 → 0.36.0

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.js

@@ -0,0 +1,43 @@
+/**
+ * Sim Lambda runs handler modules in a Node.js vm, so it simulates the
+ * Node.js managed runtimes.
+ */
+const nodeJsRuntimePrefix = "nodejs";
+/**
+ * Skips template functions declaring a runtime sim Lambda does not simulate.
+ *
+ * Yulin is a Node.js simulator: function code is evaluated as CommonJS modules
+ * in a vm, so a Python, Java, Go or container function cannot run whatever its
+ * code says. CDK synthesizes such functions into a user's stack without being
+ * asked to. The CDK BucketDeployment provider, for instance, is a Python
+ * function, and sim CloudFormation simulates that custom resource directly
+ * rather than running its provider.
+ *
+ * Declining those functions on their Runtime keeps the reason honest, and
+ * keeps their code from being loaded at all. A function with an executable
+ * binding is exempt, because the binding replaces the code with a real
+ * in-process handler, which is exactly how to simulate a function whose real
+ * runtime Yulin cannot run.
+ *
+ * The "Unsupported sim ... CloudFormation" wording marks the Resource as
+ * skipped rather than failing the stack.
+ */
+export class SimCfnLambdaRuntimeSkip {
+    /**
+     * A skip error when this function's runtime is not simulated, otherwise
+     * undefined.
+     */
+    findSkipError(resource, functionProperties, bound) {
+        const { runtimeName } = functionProperties;
+        if (bound ||
+            runtimeName === undefined ||
+            runtimeName.startsWith(nodeJsRuntimePrefix)) {
+            return undefined;
+        }
+        return new Error(`Unsupported sim Lambda CloudFormation Resource ${resource.logicalId}: ` +
+            `sim Lambda simulates Node.js runtimes, and this function declares ` +
+            `Runtime ${runtimeName}. Bind a real in-process handler to this ` +
+            `function to simulate it.`);
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-runtime-skip.js.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-runtime-skip.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-runtime-skip.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAErC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,uBAAuB;IAClC;;;OAGG;IACH,aAAa,CACX,QAAwB,EACxB,kBAAkD,EAClD,KAAc;QAEd,MAAM,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;QAE3C,IACE,KAAK;YACL,WAAW,KAAK,SAAS;YACzB,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,KAAK,CACd,kDAAkD,QAAQ,CAAC,SAAS,IAAI;YACtE,oEAAoE;YACpE,WAAW,WAAW,2CAA2C;YACjE,0BAA0B,CAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-target-function.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Get the function name a template property pointing at a function names.
+ *
+ * `AWS::Lambda::Url` reaches this through `TargetFunctionArn` and
+ * `AWS::Lambda::Permission` through `FunctionName`, and templates reach either
+ * in two ways: `Fn::GetAtt` on the function, giving a full ARN, or `Ref`,
+ * giving the function name. Both are accepted, as both are valid template ways
+ * to point at the same function. A version or alias qualifier on the ARN is
+ * dropped, as qualified functions are not simulated.
+ */
+export declare function simCfnLambdaTargetFunctionName(targetFunctionArn: string): string;
+//# sourceMappingURL=sim-cfn-lambda-target-function.d.ts.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-target-function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-target-function.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-target-function.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,iBAAiB,EAAE,MAAM,GACxB,MAAM,CAYR"}

package/dist/service/lambda/cfn/function/sim-cfn-lambda-target-function.js

@@ -0,0 +1,20 @@
+const functionArnSeparator = ":function:";
+/**
+ * Get the function name a template property pointing at a function names.
+ *
+ * `AWS::Lambda::Url` reaches this through `TargetFunctionArn` and
+ * `AWS::Lambda::Permission` through `FunctionName`, and templates reach either
+ * in two ways: `Fn::GetAtt` on the function, giving a full ARN, or `Ref`,
+ * giving the function name. Both are accepted, as both are valid template ways
+ * to point at the same function. A version or alias qualifier on the ARN is
+ * dropped, as qualified functions are not simulated.
+ */
+export function simCfnLambdaTargetFunctionName(targetFunctionArn) {
+    const separatorIndex = targetFunctionArn.indexOf(functionArnSeparator);
+    if (separatorIndex === -1) {
+        return targetFunctionArn;
+    }
+    const nameAndQualifier = targetFunctionArn.slice(separatorIndex + functionArnSeparator.length);
+    return nameAndQualifier.split(":", 1)[0] ?? nameAndQualifier;
+}
+//# sourceMappingURL=sim-cfn-lambda-target-function.js.map

package/dist/service/lambda/cfn/function/sim-cfn-lambda-target-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-target-function.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/function/sim-cfn-lambda-target-function.ts"],"names":[],"mappings":"AAAA,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAE1C;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,iBAAyB;IAEzB,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvE,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,KAAK,CAC9C,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAC7C,CAAC;IAEF,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC;AAC/D,CAAC"}

package/dist/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.d.ts

@@ -0,0 +1,31 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaPermission } from "../../function/policy/sim-lambda-permission.js";
+import type { SimLambda } from "../../sim-lambda.js";
+interface SimCfnLambdaPermissionCreatorProperties {
+    readonly lambda: SimLambda;
+}
+/**
+ * Creates simulated Lambda resource-policy permissions from CloudFormation
+ * Resources.
+ *
+ * This is what CDK emits for every `grantInvoke` and `grantInvokeUrl`, so a
+ * synthesized template reaches it whether or not the app mentions permissions
+ * itself. A template that declares one and a test that calls `AddPermission`
+ * produce the same statement, because both end up on the same function policy.
+ */
+export declare class SimCfnLambdaPermissionCreator {
+    private readonly lambda;
+    private readonly propertyParser;
+    constructor(properties: SimCfnLambdaPermissionCreatorProperties);
+    /**
+     * Create a simulated permission from an AWS::Lambda::Permission Resource.
+     *
+     * The Resource has no `StatementId` property: CloudFormation names the
+     * statement after the logical ID, so that is what the permission is
+     * addressed by afterwards, including by a later `RemovePermission`.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaPermission>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-permission-creator.d.ts.map

package/dist/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-permission-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,qBAAa,6BAA6B;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IAEnE,YAAY,UAAU,EAAE,uCAAuC,EAE9D;IAED;;;;;;OAMG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,mBAAmB,CAAC,CA6D9B;CACF"}

package/dist/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.js

@@ -0,0 +1,48 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnLambdaPropertyParser } from "../function/sim-cfn-lambda-property-parser.js";
+import { simCfnLambdaTargetFunctionName } from "../function/sim-cfn-lambda-target-function.js";
+/**
+ * Creates simulated Lambda resource-policy permissions from CloudFormation
+ * Resources.
+ *
+ * This is what CDK emits for every `grantInvoke` and `grantInvokeUrl`, so a
+ * synthesized template reaches it whether or not the app mentions permissions
+ * itself. A template that declares one and a test that calls `AddPermission`
+ * produce the same statement, because both end up on the same function policy.
+ */
+export class SimCfnLambdaPermissionCreator {
+    lambda;
+    propertyParser = new SimCfnLambdaPropertyParser();
+    constructor(properties) {
+        this.lambda = properties.lambda;
+    }
+    /**
+     * Create a simulated permission from an AWS::Lambda::Permission Resource.
+     *
+     * The Resource has no `StatementId` property: CloudFormation names the
+     * statement after the logical ID, so that is what the permission is
+     * addressed by afterwards, including by a later `RemovePermission`.
+     */
+    async create(resource, properties) {
+        const functionName = simCfnLambdaTargetFunctionName(this.propertyParser.requiredString(resource, properties["FunctionName"], "FunctionName"));
+        await this.lambda.addPermission({
+            input: {
+                FunctionName: functionName,
+                StatementId: resource.logicalId,
+                Action: this.propertyParser.requiredString(resource, properties["Action"], "Action"),
+                Principal: this.propertyParser.requiredString(resource, properties["Principal"], "Principal"),
+                FunctionUrlAuthType: this.propertyParser.optionalString(resource, properties["FunctionUrlAuthType"], "FunctionUrlAuthType"),
+                SourceArn: this.propertyParser.optionalString(resource, properties["SourceArn"], "SourceArn"),
+                SourceAccount: this.propertyParser.optionalString(resource, properties["SourceAccount"], "SourceAccount"),
+                PrincipalOrgID: this.propertyParser.optionalString(resource, properties["PrincipalOrgID"], "PrincipalOrgID"),
+                InvokedViaFunctionUrl: this.propertyParser.optionalBoolean(resource, properties["InvokedViaFunctionUrl"], "InvokedViaFunctionUrl"),
+            },
+        });
+        const permission = this.lambda
+            .getSimFunctionByName(functionName)
+            ?.resourcePolicy.get(resource.logicalId);
+        assertDefined(permission, `Sim Lambda permission ${resource.logicalId} after CloudFormation creation`);
+        return permission;
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-permission-creator.js.map

package/dist/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-permission-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/permission/sim-cfn-lambda-permission-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAKvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAM/F;;;;;;;;GAQG;AACH,MAAM,OAAO,6BAA6B;IACvB,MAAM,CAAY;IAClB,cAAc,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAEnE,YAAY,UAAmD;QAC7D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,YAAY,GAAG,8BAA8B,CACjD,IAAI,CAAC,cAAc,CAAC,cAAc,CAChC,QAAQ,EACR,UAAU,CAAC,cAAc,CAAC,EAC1B,cAAc,CACf,CACF,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC9B,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,WAAW,EAAE,QAAQ,CAAC,SAAS;gBAC/B,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CACxC,QAAQ,EACR,UAAU,CAAC,QAAQ,CAAC,EACpB,QAAQ,CACT;gBACD,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC3C,QAAQ,EACR,UAAU,CAAC,WAAW,CAAC,EACvB,WAAW,CACZ;gBACD,mBAAmB,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CACrD,QAAQ,EACR,UAAU,CAAC,qBAAqB,CAAC,EACjC,qBAAqB,CACtB;gBACD,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC3C,QAAQ,EACR,UAAU,CAAC,WAAW,CAAC,EACvB,WAAW,CACZ;gBACD,aAAa,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC/C,QAAQ,EACR,UAAU,CAAC,eAAe,CAAC,EAC3B,eAAe,CAChB;gBACD,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAChD,QAAQ,EACR,UAAU,CAAC,gBAAgB,CAAC,EAC5B,gBAAgB,CACjB;gBACD,qBAAqB,EAAE,IAAI,CAAC,cAAc,CAAC,eAAe,CACxD,QAAQ,EACR,UAAU,CAAC,uBAAuB,CAAC,EACnC,uBAAuB,CACxB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;aAC3B,oBAAoB,CAAC,YAAY,CAAC;YACnC,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3C,aAAa,CACX,UAAU,EACV,yBAAyB,QAAQ,CAAC,SAAS,gCAAgC,CAC5E,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/service/lambda/cfn/sim-cfn-lambda-resource-factory.d.ts

@@ -6,6 +6,8 @@ import type { SimLambda } from "../sim-lambda.js";
  */
 export declare class SimLambdaCloudFormationResourceFactory implements SimCfnServiceResourceFactory {
     private readonly functionCreator;
+    private readonly urlCreator;
+    private readonly permissionCreator;
     constructor(lambda: SimLambda);
     /**
      * Create a simulated Lambda resource from a CloudFormation Resource.

package/dist/service/lambda/cfn/sim-cfn-lambda-resource-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/cfn/sim-cfn-lambda-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD;;GAEG;AACH,qBAAa,sCAAuC,YAAW,4BAA4B;IACzF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8B;IAE9D,YAAY,MAAM,EAAE,SAAS,EAE5B;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe7B;CACF"}
+{"version":3,"file":"sim-cfn-lambda-resource-factory.d.ts","sourceRoot":"","sources":["../../../../src/service/lambda/cfn/sim-cfn-lambda-resource-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,sCAAsC,EACvC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,wEAAwE,CAAC;AAC3H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAKlD;;GAEG;AACH,qBAAa,sCAAuC,YAAW,4BAA4B;IACzF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA8B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAgC;IAElE,YAAY,MAAM,EAAE,SAAS,EAI5B;IAED;;OAEG;IACG,MAAM,CACV,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2B7B;CACF"}

package/dist/service/lambda/cfn/sim-cfn-lambda-resource-factory.js

@@ -1,11 +1,17 @@
 import { SimCfnLambdaFunctionCreator } from "./function/sim-cfn-lambda-function-creator.js";
+import { SimCfnLambdaPermissionCreator } from "./permission/sim-cfn-lambda-permission-creator.js";
+import { SimCfnLambdaUrlCreator } from "./url/sim-cfn-lambda-url-creator.js";
 /**
  * CloudFormation Resource factory for simulated Lambda resources.
  */
 export class SimLambdaCloudFormationResourceFactory {
     functionCreator;
+    urlCreator;
+    permissionCreator;
     constructor(lambda) {
         this.functionCreator = new SimCfnLambdaFunctionCreator({ lambda });
+        this.urlCreator = new SimCfnLambdaUrlCreator({ lambda });
+        this.permissionCreator = new SimCfnLambdaPermissionCreator({ lambda });
     }
     /**
      * Create a simulated Lambda resource from a CloudFormation Resource.
@@ -15,6 +21,12 @@ export class SimLambdaCloudFormationResourceFactory {
             case "Function": {
                 return await this.functionCreator.create(resource, context.resolvedProperties ?? resource.properties, context.bindings);
             }
+            case "Url": {
+                return await this.urlCreator.create(resource, context.resolvedProperties ?? resource.properties);
+            }
+            case "Permission": {
+                return await this.permissionCreator.create(resource, context.resolvedProperties ?? resource.properties);
+            }
             default: {
                 throw new Error(`Unsupported sim Lambda CloudFormation Resource ${resourceTypeName}`);
             }

package/dist/service/lambda/cfn/sim-cfn-lambda-resource-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-lambda-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/lambda/cfn/sim-cfn-lambda-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAE5F;;GAEG;AACH,MAAM,OAAO,sCAAsC;IAChC,eAAe,CAA8B;IAE9D,YAAY,MAAiB;QAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,UAAU,EAAE,CAAC;gBAChB,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACtC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,EACjD,OAAO,CAAC,QAAQ,CACjB,CAAC;YACJ,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,kDAAkD,gBAAgB,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"sim-cfn-lambda-resource-factory.js","sourceRoot":"","sources":["../../../../src/service/lambda/cfn/sim-cfn-lambda-resource-factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mDAAmD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;GAEG;AACH,MAAM,OAAO,sCAAsC;IAChC,eAAe,CAA8B;IAC7C,UAAU,CAAyB;IACnC,iBAAiB,CAAgC;IAElE,YAAY,MAAiB;QAC3B,IAAI,CAAC,eAAe,GAAG,IAAI,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,iBAAiB,GAAG,IAAI,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,gBAAwB,EACxB,QAAwB,EACxB,OAA+C;QAE/C,QAAQ,gBAAgB,EAAE,CAAC;YACzB,KAAK,UAAU,EAAE,CAAC;gBAChB,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CACtC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,EACjD,OAAO,CAAC,QAAQ,CACjB,CAAC;YACJ,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;gBACX,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CACjC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CACxC,QAAQ,EACR,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAClD,CAAC;YACJ,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,kDAAkD,gBAAgB,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/lambda/cfn/url/sim-cfn-lambda-url-creator.d.ts

@@ -0,0 +1,25 @@
+import type { SimCfnResource } from "../../../cloudformation/resource/sim-cfn-resource.js";
+import type { SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
+import type { SimLambdaFunctionUrl } from "../../function/url/sim-lambda-function-url.js";
+import type { SimLambda } from "../../sim-lambda.js";
+interface SimCfnLambdaUrlCreatorProperties {
+    readonly lambda: SimLambda;
+}
+/**
+ * Creates simulated Lambda Function URLs from CloudFormation Resources.
+ *
+ * This is the resource CDK's `Function.addFunctionUrl()` emits, so a deployed
+ * template is the usual way a Function URL comes into existence outside a
+ * direct SDK call.
+ */
+export declare class SimCfnLambdaUrlCreator {
+    private readonly lambda;
+    private readonly propertyParser;
+    constructor(properties: SimCfnLambdaUrlCreatorProperties);
+    /**
+     * Create a simulated Function URL from an AWS::Lambda::Url Resource.
+     */
+    create(resource: SimCfnResource, properties: SimCfnTemplateValueRecord): Promise<SimLambdaFunctionUrl>;
+}
+export {};
+//# sourceMappingURL=sim-cfn-lambda-url-creator.d.ts.map

package/dist/service/lambda/cfn/url/sim-cfn-lambda-url-creator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-url-creator.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/url/sim-cfn-lambda-url-creator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAC3F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EACV,oBAAoB,EAGrB,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IAEnE,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;CACF"}

package/dist/service/lambda/cfn/url/sim-cfn-lambda-url-creator.js

@@ -0,0 +1,35 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimCfnLambdaPropertyParser } from "../function/sim-cfn-lambda-property-parser.js";
+import { simCfnLambdaTargetFunctionName } from "../function/sim-cfn-lambda-target-function.js";
+/**
+ * Creates simulated Lambda Function URLs from CloudFormation Resources.
+ *
+ * This is the resource CDK's `Function.addFunctionUrl()` emits, so a deployed
+ * template is the usual way a Function URL comes into existence outside a
+ * direct SDK call.
+ */
+export class SimCfnLambdaUrlCreator {
+    lambda;
+    propertyParser = new SimCfnLambdaPropertyParser();
+    constructor(properties) {
+        this.lambda = properties.lambda;
+    }
+    /**
+     * Create a simulated Function URL from an AWS::Lambda::Url Resource.
+     */
+    async create(resource, properties) {
+        const targetFunctionArn = this.propertyParser.requiredString(resource, properties["TargetFunctionArn"], "TargetFunctionArn");
+        const functionName = simCfnLambdaTargetFunctionName(targetFunctionArn);
+        await this.lambda.createFunctionUrlConfig({
+            input: {
+                FunctionName: functionName,
+                AuthType: this.propertyParser.requiredString(resource, properties["AuthType"], "AuthType"),
+                InvokeMode: this.propertyParser.optionalString(resource, properties["InvokeMode"], "InvokeMode"),
+            },
+        });
+        const functionUrl = this.lambda.getSimFunctionUrl(functionName);
+        assertDefined(functionUrl, `Sim Lambda Function URL for ${functionName} after CloudFormation creation`);
+        return functionUrl;
+    }
+}
+//# sourceMappingURL=sim-cfn-lambda-url-creator.js.map

package/dist/service/lambda/cfn/url/sim-cfn-lambda-url-creator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cfn-lambda-url-creator.js","sourceRoot":"","sources":["../../../../../src/service/lambda/cfn/url/sim-cfn-lambda-url-creator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AASvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,+CAA+C,CAAC;AAM/F;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IAChB,MAAM,CAAY;IAClB,cAAc,GAAG,IAAI,0BAA0B,EAAE,CAAC;IAEnE,YAAY,UAA4C;QACtD,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,QAAwB,EACxB,UAAqC;QAErC,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAC1D,QAAQ,EACR,UAAU,CAAC,mBAAmB,CAAC,EAC/B,mBAAmB,CACpB,CAAC;QACF,MAAM,YAAY,GAAG,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;QAEvE,MAAM,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACxC,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC1C,QAAQ,EACR,UAAU,CAAC,UAAU,CAAC,EACtB,UAAU,CACqB;gBACjC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,cAAc,CAC5C,QAAQ,EACR,UAAU,CAAC,YAAY,CAAC,EACxB,YAAY,CACiC;aAChD;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChE,aAAa,CACX,WAAW,EACX,+BAA+B,YAAY,gCAAgC,CAC5E,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/service/lambda/command/add-permission/add-permission.command.d.ts

@@ -0,0 +1,32 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim Lambda AddPermission command.
+ */
+export interface SimAddPermissionCommand {
+    readonly input: SimAddPermissionCommandInput;
+}
+/**
+ * Minimal structural sim Lambda AddPermission input.
+ */
+export interface SimAddPermissionCommandInput {
+    readonly FunctionName?: string | undefined;
+    readonly StatementId?: string | undefined;
+    readonly Action?: string | undefined;
+    readonly Principal?: string | undefined;
+    readonly FunctionUrlAuthType?: string | undefined;
+    readonly SourceArn?: string | undefined;
+    readonly SourceAccount?: string | undefined;
+    readonly PrincipalOrgID?: string | undefined;
+    readonly InvokedViaFunctionUrl?: boolean | undefined;
+}
+/**
+ * Minimal structural sim Lambda AddPermission output.
+ *
+ * Real Lambda answers with the statement it assembled, as JSON, which is the
+ * only place a caller sees what the shorthand it supplied expanded into.
+ */
+export interface SimAddPermissionCommandOutput {
+    readonly $metadata: SimResponseMetadata;
+    readonly Statement: string;
+}
+//# sourceMappingURL=add-permission.command.d.ts.map

package/dist/service/lambda/command/add-permission/add-permission.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-permission.command.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/add-permission/add-permission.command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtD;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/service/lambda/command/add-permission/add-permission.command.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=add-permission.command.js.map

package/dist/service/lambda/command/add-permission/add-permission.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-permission.command.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/add-permission/add-permission.command.ts"],"names":[],"mappings":""}

package/dist/service/lambda/command/add-permission/add-permission.handler.d.ts

@@ -0,0 +1,31 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import type { BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimLambdaFunctionLookup } from "../../function/url/sim-lambda-function-lookup.js";
+import type { SimAddPermissionCommand, SimAddPermissionCommandOutput } from "./add-permission.command.js";
+interface AddPermissionCommandHandlerProperties {
+    readonly functions: SimLambdaFunctionLookup;
+    readonly iam: SimIamInterServiceAuthZ;
+    readonly background: BackgroundScheduler;
+}
+interface AddPermissionCommandHandlerOptions {
+    readonly caller?: SimAwsCaller;
+}
+/**
+ * Simulated Lambda AddPermissionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/lambda/command/AddPermissionCommand/
+ */
+export declare class AddPermissionCommandHandler implements CommandHandler<SimAddPermissionCommand, SimAddPermissionCommandOutput> {
+    private readonly functions;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: AddPermissionCommandHandlerProperties);
+    /**
+     * Grant a permission on a sim Lambda function's resource policy.
+     */
+    handle(command: SimAddPermissionCommand, options?: AddPermissionCommandHandlerOptions): Promise<SimAddPermissionCommandOutput>;
+}
+export {};
+//# sourceMappingURL=add-permission.handler.d.ts.map

package/dist/service/lambda/command/add-permission/add-permission.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-permission.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/add-permission/add-permission.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAGhG,OAAO,KAAK,EACV,uBAAuB,EACvB,6BAA6B,EAC9B,MAAM,6BAA6B,CAAC;AAErC,UAAU,qCAAqC;IAC7C,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED,UAAU,kCAAkC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,cAAc,CAChE,uBAAuB,EACvB,6BAA6B,CAC9B;IACC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IAEjD,YAAY,UAAU,EAAE,qCAAqC,EAO5D;IAED;;OAEG;IACG,MAAM,CACV,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,kCAAkC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CA2CxC;CACF"}

package/dist/service/lambda/command/add-permission/add-permission.handler.js

@@ -0,0 +1,52 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimLambdaPermission } from "../../function/policy/sim-lambda-permission.js";
+import { FunctionUrlAuthorizer } from "../function-url/function-url-authorizer.js";
+/**
+ * Simulated Lambda AddPermissionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/lambda/command/AddPermissionCommand/
+ */
+export class AddPermissionCommandHandler {
+    functions;
+    authorizer;
+    background;
+    constructor(properties) {
+        this.functions = properties.functions;
+        this.authorizer = new FunctionUrlAuthorizer({
+            iam: properties.iam,
+            action: "lambda:AddPermission",
+        });
+        this.background = properties.background;
+    }
+    /**
+     * Grant a permission on a sim Lambda function's resource policy.
+     */
+    async handle(command, options) {
+        const { input } = command;
+        assertDefined(input.FunctionName, "AddPermissionCommand.input.FunctionName required");
+        assertDefined(input.StatementId, "AddPermissionCommand.input.StatementId required");
+        assertDefined(input.Action, "AddPermissionCommand.input.Action required");
+        assertDefined(input.Principal, "AddPermissionCommand.input.Principal required");
+        await this.background.sequence();
+        const functionName = input.FunctionName;
+        this.authorizer.authorize(this.functions.functionArn(functionName), options?.caller);
+        const simFunction = this.functions.require(functionName);
+        const permission = new SimLambdaPermission({
+            statementId: input.StatementId,
+            action: input.Action,
+            principal: input.Principal,
+            resourceArn: simFunction.arn,
+            functionUrlAuthType: input.FunctionUrlAuthType,
+            sourceArn: input.SourceArn,
+            sourceAccount: input.SourceAccount,
+            principalOrgId: input.PrincipalOrgID,
+            invokedViaFunctionUrl: input.InvokedViaFunctionUrl,
+        });
+        simFunction.resourcePolicy.add(permission);
+        return {
+            $metadata: {},
+            Statement: JSON.stringify(permission.toStatement()),
+        };
+    }
+}
+//# sourceMappingURL=add-permission.handler.js.map

package/dist/service/lambda/command/add-permission/add-permission.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-permission.handler.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/add-permission/add-permission.handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAIvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAgBnF;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IAIrB,SAAS,CAA0B;IACnC,UAAU,CAAwB;IAClC,UAAU,CAAsB;IAEjD,YAAY,UAAiD;QAC3D,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,UAAU,GAAG,IAAI,qBAAqB,CAAC;YAC1C,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CACV,OAAgC,EAChC,OAA4C;QAE5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAC1B,aAAa,CACX,KAAK,CAAC,YAAY,EAClB,kDAAkD,CACnD,CAAC;QACF,aAAa,CACX,KAAK,CAAC,WAAW,EACjB,iDAAiD,CAClD,CAAC;QACF,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;QAC1E,aAAa,CACX,KAAK,CAAC,SAAS,EACf,+CAA+C,CAChD,CAAC;QAEF,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,SAAS,CACvB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EACxC,OAAO,EAAE,MAAM,CAChB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEzD,MAAM,UAAU,GAAG,IAAI,mBAAmB,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,WAAW,CAAC,GAAG;YAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;SACnD,CAAC,CAAC;QAEH,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE3C,OAAO;YACL,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;CACF"}

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.d.ts

@@ -0,0 +1,13 @@
+import type { SimIamResourcePolicyInput } from "../../../iam/authorize/context/sim-iam-auth-z-context-builder.js";
+import type { SimLambdaFunction } from "../../function/sim-lambda-function.js";
+/**
+ * The resource policies IAM should evaluate alongside identity policies for an
+ * action on a function.
+ *
+ * A function with no permissions granted contributes nothing, which leaves
+ * authorization exactly as it was before resource policies existed. A function
+ * that does not exist contributes nothing either: the caller is refused or the
+ * function is reported missing, and neither needs a policy.
+ */
+export declare function simLambdaResourcePolicies(simFunction: SimLambdaFunction | undefined): readonly SimIamResourcePolicyInput[];
+//# sourceMappingURL=sim-lambda-resource-policies.d.ts.map

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-resource-policies.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/authorize/sim-lambda-resource-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kEAAkE,CAAC;AAClH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAO/E;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAAG,SAAS,GACzC,SAAS,yBAAyB,EAAE,CAYtC"}

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.js

@@ -0,0 +1,26 @@
+/**
+ * The name real Lambda reports a function's resource policy under.
+ */
+const policyName = "FunctionPolicy";
+/**
+ * The resource policies IAM should evaluate alongside identity policies for an
+ * action on a function.
+ *
+ * A function with no permissions granted contributes nothing, which leaves
+ * authorization exactly as it was before resource policies existed. A function
+ * that does not exist contributes nothing either: the caller is refused or the
+ * function is reported missing, and neither needs a policy.
+ */
+export function simLambdaResourcePolicies(simFunction) {
+    if (simFunction === undefined || simFunction.resourcePolicy.isEmpty()) {
+        return [];
+    }
+    return [
+        {
+            document: simFunction.resourcePolicy.document(),
+            policyName,
+            resourceArn: simFunction.arn,
+        },
+    ];
+}
+//# sourceMappingURL=sim-lambda-resource-policies.js.map

package/dist/service/lambda/command/authorize/sim-lambda-resource-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-resource-policies.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/authorize/sim-lambda-resource-policies.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,WAA0C;IAE1C,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL;YACE,QAAQ,EAAE,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE;YAC/C,UAAU;YACV,WAAW,EAAE,WAAW,CAAC,GAAG;SAC7B;KACF,CAAC;AACJ,CAAC"}

package/dist/service/lambda/command/create-function/create-function-environment-names.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validate the declared environment variable names.
+ *
+ * Applies AWS's two stages in its order: the API name-pattern constraint
+ * first, then the service-level reserved-name rule. The order is what a
+ * caller sees for a name breaking both, such as the reserved `_HANDLER`,
+ * which is also an illegal name shape.
+ */
+export declare function requireValidVariableNames(declared: ReadonlyMap<string, string>): void;
+//# sourceMappingURL=create-function-environment-names.d.ts.map

package/dist/service/lambda/command/create-function/create-function-environment-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment-names.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment-names.ts"],"names":[],"mappings":"AA2EA;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,IAAI,CAGN"}

package/dist/service/lambda/command/create-function/create-function-environment-names.js

@@ -0,0 +1,60 @@
+import { SimLambdaInvalidParameterValueException, SimLambdaValidationException, } from "../../error/sim-lambda.error.js";
+import { lambdaReservedVariableNames } from "./lambda-reserved-variable-names.js";
+/**
+ * The pattern real Lambda requires an environment variable name to match: a
+ * letter, then at least one more letter, digit or underscore.
+ *
+ * The trailing `+` is why a single-character name is rejected too, and why
+ * the reserved names starting with an underscore fail this before they ever
+ * reach the reserved-name check.
+ */
+const variableNamePattern = /^[a-zA-Z][a-zA-Z0-9_]+$/;
+/**
+ * The declared names failing a check, in a stable order for reporting.
+ */
+function namesFailing(declared, fails) {
+    return declared
+        .keys()
+        .filter(fails)
+        .toArray()
+        .toSorted((left, right) => left.localeCompare(right));
+}
+/**
+ * Reject variable names that break the AWS name pattern.
+ */
+function requireMatchingVariableNames(declared) {
+    const invalid = namesFailing(declared, (name) => !variableNamePattern.test(name));
+    if (invalid.length === 0) {
+        return;
+    }
+    throw new SimLambdaValidationException("1 validation error detected: Value at 'environment.variables' failed " +
+        "to satisfy constraint: Map keys must satisfy constraint: [Member " +
+        "must satisfy regular expression pattern: [a-zA-Z]([a-zA-Z0-9_])+]. " +
+        `Invalid keys used in this request: ${invalid.join(", ")}`);
+}
+/**
+ * Reject reserved variable names AWS-style, naming the offenders.
+ */
+function requireUnreservedVariableNames(declared) {
+    const reserved = namesFailing(declared, (name) => lambdaReservedVariableNames.has(name));
+    if (reserved.length === 0) {
+        return;
+    }
+    throw new SimLambdaInvalidParameterValueException("Lambda was unable to configure your environment variables because " +
+        "the environment variables you have provided contains reserved keys " +
+        "that are currently not supported for modification. Reserved keys " +
+        `used in this request: ${reserved.join(", ")}`);
+}
+/**
+ * Validate the declared environment variable names.
+ *
+ * Applies AWS's two stages in its order: the API name-pattern constraint
+ * first, then the service-level reserved-name rule. The order is what a
+ * caller sees for a name breaking both, such as the reserved `_HANDLER`,
+ * which is also an illegal name shape.
+ */
+export function requireValidVariableNames(declared) {
+    requireMatchingVariableNames(declared);
+    requireUnreservedVariableNames(declared);
+}
+//# sourceMappingURL=create-function-environment-names.js.map

package/dist/service/lambda/command/create-function/create-function-environment-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment-names.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment-names.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAEtD;;GAEG;AACH,SAAS,YAAY,CACnB,QAAqC,EACrC,KAAgC;IAEhC,OAAO,QAAQ;SACZ,IAAI,EAAE;SACN,MAAM,CAAC,KAAK,CAAC;SACb,OAAO,EAAE;SACT,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAS,4BAA4B,CACnC,QAAqC;IAErC,MAAM,OAAO,GAAG,YAAY,CAC1B,QAAQ,EACR,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,4BAA4B,CACpC,uEAAuE;QACrE,mEAAmE;QACnE,qEAAqE;QACrE,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B,CACrC,QAAqC;IAErC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAC/C,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CACtC,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,IAAI,uCAAuC,CAC/C,oEAAoE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC;IAErC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACvC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/service/lambda/command/create-function/create-function-environment.d.ts

@@ -0,0 +1,6 @@
+import type { SimLambdaFunctionEnvironment } from "./create-function.command.js";
+/**
+ * Validate the Environment input into the variables declared for a function.
+ */
+export declare function requireLambdaEnvironmentVariables(environment: SimLambdaFunctionEnvironment | undefined): ReadonlyMap<string, string>;
+//# sourceMappingURL=create-function-environment.d.ts.map

package/dist/service/lambda/command/create-function/create-function-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAEjF;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,4BAA4B,GAAG,SAAS,GACpD,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAU7B"}

package/dist/service/lambda/command/create-function/create-function-environment.js

@@ -0,0 +1,14 @@
+import { requireValidVariableNames } from "./create-function-environment-names.js";
+/**
+ * Validate the Environment input into the variables declared for a function.
+ */
+export function requireLambdaEnvironmentVariables(environment) {
+    const variables = environment?.Variables;
+    if (variables === undefined) {
+        return new Map();
+    }
+    const declared = new Map(Object.entries(variables));
+    requireValidVariableNames(declared);
+    return declared;
+}
+//# sourceMappingURL=create-function-environment.js.map

package/dist/service/lambda/command/create-function/create-function-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-function-environment.js","sourceRoot":"","sources":["../../../../../src/service/lambda/command/create-function/create-function-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAGnF;;GAEG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAAqD;IAErD,MAAM,SAAS,GAAG,WAAW,EAAE,SAAS,CAAC;IACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAEpC,OAAO,QAAQ,CAAC;AAClB,CAAC"}