@kensio/yulin 1.14.0 → 1.14.2

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.d.ts

@@ -1,9 +1,9 @@
 import type { SimCfnTemplateValue, SimCfnTemplateValueRecord } from "../../../cloudformation/template/value/sim-cfn-template-value.js";
 /**
- * What a test asks for when it wants the template CDK synthesizes for
- * `origins.FunctionUrlOrigin.withOriginAccessControl()`.
+ * What a test asks for when it wants a working version of the template
+ * `origins.FunctionUrlOrigin.withOriginAccessControl()` synthesizes.
  *
- * Five Resources stand between a test and a Function URL served through a
+ * Six Resources stand between a test and a Function URL served through a
  * Distribution, and each test about that shape is about one of them being
  * wrong, so each field here is one thing a template can get wrong on its own.
  */
@@ -16,20 +16,26 @@ export interface SimCfFunctionUrlOriginTemplateInput {
      */
     readonly originAccessControl: boolean;
     /**
-     * Whether the template grants CloudFront the Function URL, which CDK always
-     * does alongside the Distribution.
+     * Whether the template grants CloudFront the Function URL at all.
      */
     readonly permitted: boolean;
+    /**
+     * The actions the grant covers.
+     *
+     * Reaching a Function URL through an origin access control takes both of
+     * them, so a template granting one is one that deploys and then answers 403.
+     */
+    readonly permittedActions: readonly string[];
     /** The Distribution the permission is granted for. */
     readonly permissionSourceArn: SimCfnTemplateValue;
 }
 /**
  * The parts of the template a template can leave out.
  *
- * Each is a Resource, or a property of one, that CDK always writes and that a
- * hand-written template can forget. The origin access control contributes two,
- * which are both there or both absent, since an Origin naming one nothing
- * created would be refused rather than reached.
+ * Each is a Resource, or a property of one, that a template can forget. The
+ * origin access control contributes two, which are both there or both absent,
+ * since an Origin naming one nothing created would be refused rather than
+ * reached. The permission contributes one Resource per action it grants.
  */
 export interface SimCfFunctionUrlOriginParts {
     readonly originAccessControl: SimCfnTemplateValueRecord;

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-fragments.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;CACtD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mCAAmC,GACzC,2BAA2B,CAgC7B"}
+{"version":3,"file":"sim-cf-function-url-origin-fragments.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,yBAAyB,EAC1B,MAAM,kEAAkE,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,sDAAsD;IACtD,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;IACxD,QAAQ,CAAC,qBAAqB,EAAE,yBAAyB,CAAC;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;CACtD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mCAAmC,GACzC,2BAA2B,CAsB7B"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.js

@@ -19,21 +19,32 @@ export function simCfFunctionUrlOriginParts(input) {
         originAccessControlId: included(input.originAccessControl, {
             OriginAccessControlId: { Ref: "SiteOac" },
         }),
-        // The permission CDK writes beside the Distribution, letting CloudFront
-        // invoke the Function URL for that Distribution alone.
-        invokePermission: included(input.permitted, {
-            InvokeFromCloudFront: {
-                Type: "AWS::Lambda::Permission",
-                Properties: {
-                    FunctionName: { "Fn::GetAtt": ["GreeterFunction", "Arn"] },
-                    Action: "lambda:InvokeFunctionUrl",
-                    Principal: "cloudfront.amazonaws.com",
-                    SourceArn: input.permissionSourceArn,
-                },
-            },
-        }),
+        // The permissions letting CloudFront invoke the Function URL for this
+        // Distribution alone. AWS takes one per action, and both of them.
+        invokePermission: included(input.permitted, invokePermissions(input)),
     };
 }
+/**
+ * One `AWS::Lambda::Permission` per granted action.
+ *
+ * The statement id is derived from the action, so a template granting both
+ * carries two Resources rather than one overwriting the other, which is how
+ * the two `aws lambda add-permission` calls in the AWS documentation land.
+ */
+function invokePermissions(input) {
+    return Object.fromEntries(input.permittedActions.map((action) => [
+        `${action.replace("lambda:", "")}FromCloudFront`,
+        {
+            Type: "AWS::Lambda::Permission",
+            Properties: {
+                FunctionName: { "Fn::GetAtt": ["GreeterFunction", "Arn"] },
+                Action: action,
+                Principal: "cloudfront.amazonaws.com",
+                SourceArn: input.permissionSourceArn,
+            },
+        },
+    ]));
+}
 /**
  * One fragment of the template, or nothing where the template omits it.
  */

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-fragments.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AA4CA;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA0C;IAE1C,OAAO;QACL,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACvD,OAAO,EAAE;gBACP,IAAI,EAAE,sCAAsC;gBAC5C,UAAU,EAAE;oBACV,yBAAyB,EAAE;wBACzB,IAAI,EAAE,UAAU;wBAChB,6BAA6B,EAAE,QAAQ;wBACvC,eAAe,EAAE,KAAK,CAAC,eAAe;wBACtC,eAAe,EAAE,OAAO;qBACzB;iBACF;aACF;SACF,CAAC;QACF,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACzD,qBAAqB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC1C,CAAC;QACF,wEAAwE;QACxE,uDAAuD;QACvD,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1C,oBAAoB,EAAE;gBACpB,IAAI,EAAE,yBAAyB;gBAC/B,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;oBAC1D,MAAM,EAAE,0BAA0B;oBAClC,SAAS,EAAE,0BAA0B;oBACrC,SAAS,EAAE,KAAK,CAAC,mBAAmB;iBACrC;aACF;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CACf,OAAgB,EAChB,QAAmC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"sim-cf-function-url-origin-fragments.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-fragments.ts"],"names":[],"mappings":"AAkDA;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAA0C;IAE1C,OAAO;QACL,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACvD,OAAO,EAAE;gBACP,IAAI,EAAE,sCAAsC;gBAC5C,UAAU,EAAE;oBACV,yBAAyB,EAAE;wBACzB,IAAI,EAAE,UAAU;wBAChB,6BAA6B,EAAE,QAAQ;wBACvC,eAAe,EAAE,KAAK,CAAC,eAAe;wBACtC,eAAe,EAAE,OAAO;qBACzB;iBACF;aACF;SACF,CAAC;QACF,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACzD,qBAAqB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;SAC1C,CAAC;QACF,sEAAsE;QACtE,kEAAkE;QAClE,gBAAgB,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,KAA0C;IAE1C,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB;QAChD;YACE,IAAI,EAAE,yBAAyB;YAC/B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC1D,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,0BAA0B;gBACrC,SAAS,EAAE,KAAK,CAAC,mBAAmB;aACrC;SACF;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CACf,OAAgB,EAChB,QAAmC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,2CAA2C,CAAC;AAanD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAUlC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,sFAkFjD,CAAC"}
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,KAAK,mCAAmC,EAEzC,MAAM,2CAA2C,CAAC;AAanD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,mBAUlC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,sFAmFjD,CAAC"}

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js

@@ -43,6 +43,7 @@ export const simCfFunctionUrlOriginTemplateFactory = new MappedFactory(() => ({
     signingBehavior: "always",
     originAccessControl: true,
     permitted: true,
+    permittedActions: ["lambda:InvokeFunctionUrl", "lambda:InvokeFunction"],
     permissionSourceArn: simCfDistributionArn,
 }), (input) => ({
     Resources: {

package/dist/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,OAAO,EACL,gCAAgC;wBAChC,8DAA8D;iBACjE;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}
+{"version":3,"file":"sim-cf-function-url-origin-template.factory.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/origin/custom/sim-cf-function-url-origin-template.factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EAEL,2BAA2B,GAC5B,MAAM,2CAA2C,CAAC;AAEnD,MAAM,wBAAwB,GAAG;IAC/B,OAAO,EAAE,YAAY;IACrB,SAAS,EAAE;QACT;YACE,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;YAC9C,MAAM,EAAE,gBAAgB;SACzB;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,UAAU,EAAE;QACV,EAAE;QACF;YACE,sBAAsB;YACtB,EAAE,GAAG,EAAE,gBAAgB,EAAE;YACzB,gBAAgB;YAChB,EAAE,GAAG,EAAE,kBAAkB,EAAE;SAC5B;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,aAAa,CAIpE,GAAG,EAAE,CAAC,CAAC;IACL,eAAe,EAAE,QAAQ;IACzB,mBAAmB,EAAE,IAAI;IACzB,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,CAAC,0BAA0B,EAAE,uBAAuB,CAAC;IACvE,mBAAmB,EAAE,oBAAoB;CAC1C,CAAC,EACF,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACV,SAAS,EAAE;QACT,WAAW,EAAE;YACX,IAAI,EAAE,gBAAgB;YACtB,UAAU,EAAE;gBACV,QAAQ,EAAE,aAAa;gBACvB,wBAAwB,EAAE,wBAAwB;aACnD;SACF;QACD,eAAe,EAAE;YACf,IAAI,EAAE,uBAAuB;YAC7B,UAAU,EAAE;gBACV,YAAY,EAAE,SAAS;gBACvB,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE;gBAC9C,IAAI,EAAE;oBACJ,OAAO,EACL,gCAAgC;wBAChC,8DAA8D;iBACjE;gBACD,OAAO,EAAE,eAAe;gBACxB,OAAO,EAAE,YAAY;aACtB;SACF;QACD,UAAU,EAAE;YACV,IAAI,EAAE,kBAAkB;YACxB,UAAU,EAAE;gBACV,iBAAiB,EAAE,EAAE,YAAY,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE;gBAC/D,QAAQ,EAAE,SAAS;aACpB;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,mBAAmB;QACzD,gBAAgB,EAAE;YAChB,IAAI,EAAE,+BAA+B;YACrC,UAAU,EAAE;gBACV,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE;wBACP;4BACE,EAAE,EAAE,mBAAmB;4BACvB,4DAA4D;4BAC5D,iDAAiD;4BACjD,UAAU,EAAE;gCACV,YAAY,EAAE;oCACZ,CAAC;oCACD;wCACE,WAAW,EAAE;4CACX,GAAG;4CACH,EAAE,YAAY,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE;yCAChD;qCACF;iCACF;6BACF;4BACD,kBAAkB,EAAE,EAAE,oBAAoB,EAAE,YAAY,EAAE;4BAC1D,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,qBAAqB;yBAC5D;qBACF;oBACD,oBAAoB,EAAE;wBACpB,cAAc,EAAE,mBAAmB;wBACnC,oBAAoB,EAAE,mBAAmB;qBAC1C;iBACF;aACF;SACF;QACD,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC,gBAAgB;KACvD;IACD,OAAO,EAAE;QACP,sBAAsB,EAAE;YACtB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;SAC5D;QACD,eAAe,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;KACjD;CACF,CAAC,CACH,CAAC"}

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.d.ts

@@ -6,7 +6,8 @@ import type { SimLambdaEnvironment } from "../../environment/sim-lambda-environm
  *
  * The context provides the common globals a Node.js Lambda runtime offers,
  * including an AWS-like process.env holding the standard runtime variables
- * and any variables declared for the function. Everything else must be part
+ * and any variables declared for the function, and the writable standard
+ * streams function code writes its output to. Everything else must be part
  * of the deployed function code archive, as on real Lambda.
  *
  * Zip code needs nothing like the process.env and Date handling the

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-vm-context.d.ts","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAExF;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,oBAAoB,EACjC,KAAK,GAAE,QAA6B,GACnC,EAAE,CAAC,OAAO,CAuBZ"}
+{"version":3,"file":"sim-lambda-vm-context.d.ts","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAGxF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,oBAAoB,EACjC,KAAK,GAAE,QAA6B,GACnC,EAAE,CAAC,OAAO,CAkCZ"}

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.js

@@ -1,12 +1,15 @@
+import { Console } from "node:console";
 import vm from "node:vm";
 import { makeSimClockDate } from "../../../../../util/clock/sim-clock-date.js";
 import { SimRealClock, } from "../../../../../util/clock/sim-clock.js";
+import { SimLambdaVmOutputStream } from "./sim-lambda-vm-output-stream.js";
 /**
  * Create the sandbox vm context that sim Lambda function code runs in.
  *
  * The context provides the common globals a Node.js Lambda runtime offers,
  * including an AWS-like process.env holding the standard runtime variables
- * and any variables declared for the function. Everything else must be part
+ * and any variables declared for the function, and the writable standard
+ * streams function code writes its output to. Everything else must be part
  * of the deployed function code archive, as on real Lambda.
  *
  * Zip code needs nothing like the process.env and Date handling the
@@ -15,11 +18,21 @@ import { SimRealClock, } from "../../../../../util/clock/sim-clock.js";
  * nothing outside the sandbox is touched to arrange that.
  */
 export function makeSimLambdaVmContext(environment, clock = new SimRealClock()) {
+    // Writable standard streams, as the real runtime provides. Code that builds
+    // its own console over them, as AWS Lambda Powertools' logger does, throws
+    // at module load without them.
+    const stdout = new SimLambdaVmOutputStream(() => process.stdout);
+    const stderr = new SimLambdaVmOutputStream(() => process.stderr);
     return vm.createContext({
-        console,
+        // The sandbox's console is built over those streams, as the real
+        // runtime's is, so everything function code prints goes to one place
+        // whether it printed through the console or wrote to the stream itself.
+        console: new Console({ stdout, stderr }),
         Buffer,
         process: {
             env: environment.variables(),
+            stdout,
+            stderr,
         },
         // Function code asking JavaScript for the time gets the simulation's
         // time, so a frozen or advanced clock reaches the code under test.

package/dist/service/lambda/function/code/vm/sim-lambda-vm-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-vm-context.js","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAEL,YAAY,GACb,MAAM,wCAAwC,CAAC;AAGhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAiC,EACjC,KAAK,GAAa,IAAI,YAAY,EAAE;IAEpC,OAAO,EAAE,CAAC,aAAa,CAAC;QACtB,OAAO;QACP,MAAM;QACN,OAAO,EAAE;YACP,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE;SAC7B;QACD,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC7B,UAAU;QACV,YAAY;QACZ,WAAW;QACX,aAAa;QACb,YAAY;QACZ,cAAc;QACd,WAAW;QACX,WAAW;QACX,GAAG;QACH,eAAe;QACf,eAAe;QACf,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-lambda-vm-context.js","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAEL,YAAY,GACb,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAiC,EACjC,KAAK,GAAa,IAAI,YAAY,EAAE;IAEpC,4EAA4E;IAC5E,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjE,OAAO,EAAE,CAAC,aAAa,CAAC;QACtB,iEAAiE;QACjE,qEAAqE;QACrE,wEAAwE;QACxE,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACxC,MAAM;QACN,OAAO,EAAE;YACP,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE;YAC5B,MAAM;YACN,MAAM;SACP;QACD,qEAAqE;QACrE,mEAAmE;QACnE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC;QAC7B,UAAU;QACV,YAAY;QACZ,WAAW;QACX,aAAa;QACb,YAAY;QACZ,cAAc;QACd,WAAW;QACX,WAAW;QACX,GAAG;QACH,eAAe;QACf,eAAe;QACf,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/dist/service/lambda/function/code/vm/sim-lambda-vm-output-stream.d.ts

@@ -0,0 +1,40 @@
+import { Writable } from "node:stream";
+/**
+ * One of the standard output streams the sim Lambda vm sandbox gives function
+ * code as `process.stdout` and `process.stderr`.
+ *
+ * Real Lambda gives function code writable standard streams, and libraries
+ * build their own console over them rather than the global one, so that
+ * console patching cannot affect their output. AWS Lambda Powertools' logger
+ * does exactly that, at module scope:
+ *
+ * ```javascript
+ * new Console({ stdout: process.stdout, stderr: process.stderr })
+ * ```
+ *
+ * Without the streams that construction throws
+ * (`ERR_CONSOLE_WRITABLE_STREAM`) before the handler runs.
+ *
+ * What function code writes is forwarded to the matching host stream,
+ * standard output to standard output and standard error to standard error.
+ * The sandbox's own console is built over these streams too, so a handler's
+ * output arrives there whether it printed through the console or wrote to the
+ * stream itself, instead of one of the two disappearing. The host stream is
+ * read per write, so a test that starts capturing host output after the
+ * function has cold-started still sees what the handler writes.
+ */
+export declare class SimLambdaVmOutputStream extends Writable {
+    private readonly hostStream;
+    constructor(hostStream: () => NodeJS.WritableStream);
+    /**
+     * The write is handed on and reported as done without waiting for the host
+     * stream, as Node.js's own console hands writes to process.stdout. Waiting
+     * would make a failed log write fail the code that logged: reporting the
+     * host's error here destroys this stream, and with nothing listening for
+     * its error the process goes down over a lost line. It would also mean a
+     * test capturing host output had to complete the write it captured, and the
+     * ordinary way to capture it does not.
+     */
+    _write(chunk: Buffer, _encoding: BufferEncoding, done: (error?: Error) => void): void;
+}
+//# sourceMappingURL=sim-lambda-vm-output-stream.d.ts.map

package/dist/service/lambda/function/code/vm/sim-lambda-vm-output-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-vm-output-stream.d.ts","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-output-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,MAAM,MAAM,CAAC,cAAc,EAEnE;IAED;;;;;;;;OAQG;IACM,MAAM,CACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,IAAI,GAC5B,IAAI,CAGN;CACF"}

package/dist/service/lambda/function/code/vm/sim-lambda-vm-output-stream.js

@@ -0,0 +1,46 @@
+import { Writable } from "node:stream";
+/**
+ * One of the standard output streams the sim Lambda vm sandbox gives function
+ * code as `process.stdout` and `process.stderr`.
+ *
+ * Real Lambda gives function code writable standard streams, and libraries
+ * build their own console over them rather than the global one, so that
+ * console patching cannot affect their output. AWS Lambda Powertools' logger
+ * does exactly that, at module scope:
+ *
+ * ```javascript
+ * new Console({ stdout: process.stdout, stderr: process.stderr })
+ * ```
+ *
+ * Without the streams that construction throws
+ * (`ERR_CONSOLE_WRITABLE_STREAM`) before the handler runs.
+ *
+ * What function code writes is forwarded to the matching host stream,
+ * standard output to standard output and standard error to standard error.
+ * The sandbox's own console is built over these streams too, so a handler's
+ * output arrives there whether it printed through the console or wrote to the
+ * stream itself, instead of one of the two disappearing. The host stream is
+ * read per write, so a test that starts capturing host output after the
+ * function has cold-started still sees what the handler writes.
+ */
+export class SimLambdaVmOutputStream extends Writable {
+    hostStream;
+    constructor(hostStream) {
+        super();
+        this.hostStream = hostStream;
+    }
+    /**
+     * The write is handed on and reported as done without waiting for the host
+     * stream, as Node.js's own console hands writes to process.stdout. Waiting
+     * would make a failed log write fail the code that logged: reporting the
+     * host's error here destroys this stream, and with nothing listening for
+     * its error the process goes down over a lost line. It would also mean a
+     * test capturing host output had to complete the write it captured, and the
+     * ordinary way to capture it does not.
+     */
+    _write(chunk, _encoding, done) {
+        this.hostStream().write(chunk);
+        done();
+    }
+}
+//# sourceMappingURL=sim-lambda-vm-output-stream.js.map

package/dist/service/lambda/function/code/vm/sim-lambda-vm-output-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-vm-output-stream.js","sourceRoot":"","sources":["../../../../../../src/service/lambda/function/code/vm/sim-lambda-vm-output-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACtB,UAAU;IAAvC,YAA6B,UAAuC;QAClE,KAAK,EAAE,CAAC;0BADmB,UAAU;IAEvC,CAAC;IAED;;;;;;;;OAQG;IACM,MAAM,CACb,KAAa,EACb,SAAyB,EACzB,IAA6B;QAE7B,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,EAAE,CAAC;IACT,CAAC;CACF"}

package/dist/service/lambda/serve/auth/sim-lambda-url-authorizer.d.ts

@@ -3,15 +3,6 @@ import type { SimIamAuthorizationDecision, SimIamInterServiceAuthZ } from "../..
 import type { SimAwsRequestSource } from "../../../iam/request/sim-aws-request-source.js";
 import type { SimLambdaFunction } from "../../function/sim-lambda-function.js";
 import type { SimLambdaFunctionUrl } from "../../function/url/sim-lambda-function-url.js";
-/**
- * The IAM action a Function URL invocation is authorized against.
- *
- * This is deliberately not `lambda:InvokeFunction`, which is what the Invoke
- * API maps to. Real AWS separates the two so a policy can grant the HTTP
- * endpoint without granting the SDK operation, and a test asserting on that
- * distinction should see it hold here.
- */
-export declare const simLambdaInvokeFunctionUrlAction = "lambda:InvokeFunctionUrl";
 interface SimLambdaUrlAuthorizerProperties {
     readonly iam: SimIamInterServiceAuthZ;
 }
@@ -40,7 +31,19 @@ export declare class SimLambdaUrlAuthorizer {
     private readonly iam;
     constructor(properties: SimLambdaUrlAuthorizerProperties);
     /**
-     * Evaluate `lambda:InvokeFunctionUrl` for a caller against a Function URL.
+     * Evaluate the actions reaching this Function URL takes.
+     *
+     * `lambda:InvokeFunctionUrl` is the one a caller signing its own request
+     * needs. CloudFront reaching the URL through an origin access control needs
+     * `lambda:InvokeFunction` on top of it, so a resource policy granting only
+     * the URL action is refused here as real Lambda refuses it.
+     *
+     * Every action is judged against the same request, so a permission
+     * conditioned on the Distribution applies to both.
+     */
+    authorize(input: SimLambdaUrlAuthorizationInput): SimIamAuthorizationDecision;
+    /**
+     * Evaluate one action for a caller against a Function URL.
      *
      * The URL's auth type is supplied as `lambda:FunctionUrlAuthType`, which is
      * what a grant conditions on in practice: a permission granted for `AWS_IAM`
@@ -52,7 +55,7 @@ export declare class SimLambdaUrlAuthorizer {
      * no source supplies neither, so a permission conditioned on one does not
      * match rather than matching anything.
      */
-    authorize(input: SimLambdaUrlAuthorizationInput): SimIamAuthorizationDecision;
+    private decide;
 }
 export {};
 //# sourceMappingURL=sim-lambda-url-authorizer.d.ts.map

package/dist/service/lambda/serve/auth/sim-lambda-url-authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAOhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAE1F;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,CACP,KAAK,EAAE,8BAA8B,GACpC,2BAA2B,CAkB7B;CACF"}
+{"version":3,"file":"sim-lambda-url-authorizer.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EACV,2BAA2B,EAC3B,uBAAuB,EACxB,MAAM,wDAAwD,CAAC;AAYhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAE1F,UAAU,gCAAgC;IACxC,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC;CACvC;AAED,UAAU,8BAA8B;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0B;IAE9C,YAAY,UAAU,EAAE,gCAAgC,EAEvD;IAED;;;;;;;;;;OAUG;IACH,SAAS,CACP,KAAK,EAAE,8BAA8B,GACpC,2BAA2B,CAkB7B;IAED;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM;CAsBf"}

package/dist/service/lambda/serve/auth/sim-lambda-url-authorizer.js

@@ -1,14 +1,6 @@
 import { simLambdaResourcePolicies } from "../../command/authorize/sim-lambda-resource-policies.js";
 import { simLambdaFunctionUrlAuthTypeConditionKey, simLambdaSourceAccountConditionKey, simLambdaSourceArnConditionKey, } from "../../function/policy/sim-lambda-permission.js";
-/**
- * The IAM action a Function URL invocation is authorized against.
- *
- * This is deliberately not `lambda:InvokeFunction`, which is what the Invoke
- * API maps to. Real AWS separates the two so a policy can grant the HTTP
- * endpoint without granting the SDK operation, and a test asserting on that
- * distinction should see it hold here.
- */
-export const simLambdaInvokeFunctionUrlAction = "lambda:InvokeFunctionUrl";
+import { simLambdaInvokeFunctionAction, simLambdaInvokeFunctionUrlAction, simLambdaUrlRequiresInvokeFunction, } from "./sim-lambda-url-invoke-actions.js";
 /**
  * Decides whether a caller may invoke a Function URL.
  *
@@ -26,7 +18,32 @@ export class SimLambdaUrlAuthorizer {
         this.iam = properties.iam;
     }
     /**
-     * Evaluate `lambda:InvokeFunctionUrl` for a caller against a Function URL.
+     * Evaluate the actions reaching this Function URL takes.
+     *
+     * `lambda:InvokeFunctionUrl` is the one a caller signing its own request
+     * needs. CloudFront reaching the URL through an origin access control needs
+     * `lambda:InvokeFunction` on top of it, so a resource policy granting only
+     * the URL action is refused here as real Lambda refuses it.
+     *
+     * Every action is judged against the same request, so a permission
+     * conditioned on the Distribution applies to both.
+     */
+    authorize(input) {
+        const urlDecision = this.decide(simLambdaInvokeFunctionUrlAction, input);
+        if (urlDecision.isDenied) {
+            return urlDecision;
+        }
+        if (!simLambdaUrlRequiresInvokeFunction(input.caller)) {
+            return urlDecision;
+        }
+        const invokeDecision = this.decide(simLambdaInvokeFunctionAction, input);
+        if (invokeDecision.isDenied) {
+            return invokeDecision;
+        }
+        return urlDecision;
+    }
+    /**
+     * Evaluate one action for a caller against a Function URL.
      *
      * The URL's auth type is supplied as `lambda:FunctionUrlAuthType`, which is
      * what a grant conditions on in practice: a permission granted for `AWS_IAM`
@@ -38,10 +55,10 @@ export class SimLambdaUrlAuthorizer {
      * no source supplies neither, so a permission conditioned on one does not
      * match rather than matching anything.
      */
-    authorize(input) {
+    decide(action, input) {
         const { source } = input;
         return this.iam.authorize({
-            action: simLambdaInvokeFunctionUrlAction,
+            action,
             resource: input.simFunction.arn,
             caller: input.caller,
             resourcePolicies: simLambdaResourcePolicies(input.simFunction),

package/dist/service/lambda/serve/auth/sim-lambda-url-authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-authorizer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EACL,wCAAwC,EACxC,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AAKxD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,0BAA0B,CAAC;AAiB3E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAA0B;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,CACP,KAAqC;QAErC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAEzB,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,EAAE,gCAAgC;YACxC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9D,gBAAgB,EAAE;gBAChB,CAAC,wCAAwC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;gBACtE,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI;oBAC/B,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC,GAAG;iBAC7C,CAAC;gBACF,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI;oBACrC,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAAC,SAAS;iBACvD,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-url-authorizer.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-authorizer.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EACL,wCAAwC,EACxC,kCAAkC,EAClC,8BAA8B,GAC/B,MAAM,gDAAgD,CAAC;AACxD,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,oCAAoC,CAAC;AAoB5C;;;;;;;;;;GAUG;AACH,MAAM,OAAO,sBAAsB;IAChB,GAAG,CAA0B;IAE9C,YAAY,UAA4C;QACtD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACH,SAAS,CACP,KAAqC;QAErC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAEzE,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,kCAAkC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QAEzE,IAAI,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CACZ,MAAc,EACd,KAAqC;QAErC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAEzB,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM;YACN,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC;YAC9D,gBAAgB,EAAE;gBAChB,CAAC,wCAAwC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;gBACtE,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,IAAI;oBAC/B,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC,GAAG;iBAC7C,CAAC;gBACF,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI;oBACrC,CAAC,kCAAkC,CAAC,EAAE,MAAM,CAAC,SAAS;iBACvD,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/lambda/serve/auth/sim-lambda-url-invoke-actions.d.ts

@@ -0,0 +1,34 @@
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+/**
+ * The IAM action a Function URL invocation is authorized against.
+ *
+ * This is deliberately not `lambda:InvokeFunction`, which is what the Invoke
+ * API maps to. Real AWS separates the two so a policy can grant the HTTP
+ * endpoint without granting the SDK operation, and a test asserting on that
+ * distinction should see it hold here.
+ *
+ * That is the whole rule for a caller signing its own request. It is not the
+ * whole rule for a CloudFront origin access control, which needs
+ * `lambda:InvokeFunction` as well.
+ */
+export declare const simLambdaInvokeFunctionUrlAction = "lambda:InvokeFunctionUrl";
+/**
+ * The action the Invoke API maps to, which reaching a Function URL through a
+ * CloudFront origin access control takes on top of the URL action.
+ *
+ * Real Lambda answers an origin access control granted only the URL action
+ * with 403 and never runs the handler. Both grants go to the CloudFront
+ * service principal and both are conditioned on the Distribution, as described
+ * in [Restrict access to an AWS Lambda function URL
+ * origin](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html).
+ */
+export declare const simLambdaInvokeFunctionAction = "lambda:InvokeFunction";
+/**
+ * Whether reaching this Function URL also takes `lambda:InvokeFunction`.
+ *
+ * True for CloudFront, and false for anything else, which is the distinction
+ * real Lambda draws: a caller signing the request itself needs the URL action
+ * alone.
+ */
+export declare function simLambdaUrlRequiresInvokeFunction(caller: SimAwsCaller): boolean;
+//# sourceMappingURL=sim-lambda-url-invoke-actions.d.ts.map

package/dist/service/lambda/serve/auth/sim-lambda-url-invoke-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-invoke-actions.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-invoke-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EAEb,MAAM,uCAAuC,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gCAAgC,6BAA6B,CAAC;AAE3E;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAWrE;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,YAAY,GACnB,OAAO,CAQT"}

package/dist/service/lambda/serve/auth/sim-lambda-url-invoke-actions.js

@@ -0,0 +1,63 @@
+/**
+ * The IAM action a Function URL invocation is authorized against.
+ *
+ * This is deliberately not `lambda:InvokeFunction`, which is what the Invoke
+ * API maps to. Real AWS separates the two so a policy can grant the HTTP
+ * endpoint without granting the SDK operation, and a test asserting on that
+ * distinction should see it hold here.
+ *
+ * That is the whole rule for a caller signing its own request. It is not the
+ * whole rule for a CloudFront origin access control, which needs
+ * `lambda:InvokeFunction` as well.
+ */
+export const simLambdaInvokeFunctionUrlAction = "lambda:InvokeFunctionUrl";
+/**
+ * The action the Invoke API maps to, which reaching a Function URL through a
+ * CloudFront origin access control takes on top of the URL action.
+ *
+ * Real Lambda answers an origin access control granted only the URL action
+ * with 403 and never runs the handler. Both grants go to the CloudFront
+ * service principal and both are conditioned on the Distribution, as described
+ * in [Restrict access to an AWS Lambda function URL
+ * origin](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-lambda.html).
+ */
+export const simLambdaInvokeFunctionAction = "lambda:InvokeFunction";
+/**
+ * The service principal CloudFront reaches an Origin as.
+ *
+ * Named here rather than imported from simulated CloudFront, so that simulated
+ * Lambda goes on depending on nothing in that service. What real Lambda wants
+ * the second action for is the principal, whatever is simulating it.
+ */
+const cloudFrontServicePrincipal = "cloudfront.amazonaws.com";
+/**
+ * Whether reaching this Function URL also takes `lambda:InvokeFunction`.
+ *
+ * True for CloudFront, and false for anything else, which is the distinction
+ * real Lambda draws: a caller signing the request itself needs the URL action
+ * alone.
+ */
+export function simLambdaUrlRequiresInvokeFunction(caller) {
+    const principal = callerPrincipal(caller);
+    if (principal.kind !== "service") {
+        return false;
+    }
+    return principal.service === cloudFrontServicePrincipal;
+}
+/**
+ * The principal a caller names.
+ *
+ * Credentials name one too, but only once IAM has authenticated them, and
+ * nothing reaching a Function URL as a service principal presents any: an
+ * origin access control states who it is at the boundary instead.
+ */
+function callerPrincipal(caller) {
+    if (caller.kind === "resolved") {
+        return caller.principal;
+    }
+    if (caller.kind === "credentials") {
+        return { kind: "anonymous" };
+    }
+    return caller;
+}
+//# sourceMappingURL=sim-lambda-url-invoke-actions.js.map

package/dist/service/lambda/serve/auth/sim-lambda-url-invoke-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-lambda-url-invoke-actions.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/auth/sim-lambda-url-invoke-actions.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,0BAA0B,CAAC;AAE3E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,uBAAuB,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,MAAoB;IAEpB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,KAAK,0BAA0B,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAoB;IAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.d.ts

@@ -1,3 +1,11 @@
+/**
+ * What real Lambda says when it refuses a Function URL request.
+ *
+ * A refused request never reaches the handler and writes no log stream, so
+ * this body is the only thing a deployment has to go on. The wording is real
+ * Lambda's, down to the link, because that is what someone will be reading.
+ */
+export declare const simLambdaUrlForbiddenMessage: string;
 /**
  * The error responses a Function URL endpoint returns itself, before or
  * instead of the function producing one.
@@ -12,7 +20,7 @@ export declare class SimLambdaUrlErrorResponse {
      */
     notFound(): Response;
     /**
-     * The Function URL requires authentication the simulator cannot verify.
+     * The caller is not allowed to invoke this Function URL.
      */
     forbidden(): Response;
     /**

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-error-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED,OAAO,CAAC,YAAY;CASrB"}
+{"version":3,"file":"sim-lambda-url-error-response.d.ts","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAEsB,CAAC;AAEhE;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC;;OAEG;IACH,QAAQ,IAAI,QAAQ,CAEnB;IAED;;OAEG;IACH,SAAS,IAAI,QAAQ,CAEpB;IAED;;OAEG;IACH,mBAAmB,IAAI,QAAQ,CAE9B;IAED,OAAO,CAAC,YAAY;CASrB"}

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.js

@@ -1,3 +1,12 @@
+/**
+ * What real Lambda says when it refuses a Function URL request.
+ *
+ * A refused request never reaches the handler and writes no log stream, so
+ * this body is the only thing a deployment has to go on. The wording is real
+ * Lambda's, down to the link, because that is what someone will be reading.
+ */
+export const simLambdaUrlForbiddenMessage = "Forbidden. For troubleshooting Function URL authorization issues, see: " +
+    "https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html";
 /**
  * The error responses a Function URL endpoint returns itself, before or
  * instead of the function producing one.
@@ -14,10 +23,10 @@ export class SimLambdaUrlErrorResponse {
         return this.jsonResponse(404, "Not Found");
     }
     /**
-     * The Function URL requires authentication the simulator cannot verify.
+     * The caller is not allowed to invoke this Function URL.
      */
     forbidden() {
-        return this.jsonResponse(403, "Forbidden");
+        return this.jsonResponse(403, simLambdaUrlForbiddenMessage);
     }
     /**
      * The function failed to handle the invocation.

package/dist/service/lambda/serve/response/sim-lambda-url-error-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-lambda-url-error-response.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;YACE,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-lambda-url-error-response.js","sourceRoot":"","sources":["../../../../../src/service/lambda/serve/response/sim-lambda-url-error-response.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,yEAAyE;IACzE,6DAA6D,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACpC;;OAEG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACzD,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,OAAe;QAClD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,OAAO,EAAE,EACpB;YACE,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CACF,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kensio/yulin",
-  "version": "1.14.0",
+  "version": "1.14.2",
   "description": "AWS system behaviour simulation for isolated unit testing",
   "repository": "https://github.com/KensioSoftware/yulin",
   "homepage": "https://yulinsim.dev/",
@@ -163,6 +163,8 @@
   "packageManager": "pnpm@11.17.0+sha512.cca3cea332ad254bb84145f966d19f4879615210346fc92c79a047f23a0d7b3cca3c3792f0076ba1f1831d277efbcf0a9119b31a9a60eca7fb3d6231f331ef72",
   "devDependencies": {
     "@aws-crypto/sha256-js": "^5.2.0",
+    "@aws-lambda-powertools/logger": "^2.34.0",
+    "@aws-lambda-powertools/metrics": "^2.34.0",
     "@aws-sdk/client-acm": "^3.1101.0",
     "@aws-sdk/client-apigatewayv2": "^3.1101.0",
     "@aws-sdk/client-cloudformation": "^3.1101.0",
@@ -204,6 +206,7 @@
     "aws-sdk-client-mock": "^4.1.0",
     "constructs": "^10.8.0",
     "conventional-changelog-conventionalcommits": "9.3.1",
+    "esbuild": "^0.28.2",
     "eslint": "^10.8.0",
     "eslint-plugin-jsdoc": "^63.3.2",
     "eslint-plugin-no-secrets": "^2.3.3",