@kensio/yulin 1.14.2 → 1.15.1

package/dist/service/logs/subscription/lambda/sim-aws-logs-subscription-functions.js

@@ -0,0 +1,42 @@
+import { simLogsSubscriptionEventPayload, } from "../sim-logs-subscription-event.js";
+import { permittedSimLogsDestinationFunction } from "./sim-logs-destination-permission.js";
+import { SimLogsSubscriptionFunctionArn } from "./sim-logs-subscription-function-arn.js";
+/**
+ * The simulated Lambda functions of one simulated AWS instance, as places a
+ * subscription filter delivers to.
+ *
+ * The function is looked up when an event is delivered, and again when a
+ * filter is put, never when this is built: reaching simulated Lambda while
+ * simulated CloudWatch Logs is being constructed would be a cycle with no
+ * bottom to it, since every Lambda function records its output here.
+ */
+export class SimAwsLogsSubscriptionFunctions {
+    #simAws;
+    #accountRegionScope;
+    constructor(properties) {
+        this.#simAws = properties.simAws;
+        this.#accountRegionScope = properties.accountRegionScope;
+    }
+    /**
+     * Check the destination function is there and admits CloudWatch Logs.
+     */
+    async check(destinationArn) {
+        this.permitted(destinationArn);
+        await Promise.resolve();
+    }
+    /**
+     * Deliver matched events to the destination function.
+     */
+    async deliver(destinationArn, delivery) {
+        // Invoked directly rather than through an Invoke command, because this is
+        // already inside the background task that stands for the asynchronous
+        // delivery real CloudWatch Logs makes, and because a handler failure has
+        // to reach the delivery outcome rather than being swallowed.
+        await this.permitted(destinationArn).invoke(simLogsSubscriptionEventPayload(delivery));
+    }
+    permitted(destinationArn) {
+        const arn = SimLogsSubscriptionFunctionArn.parse(destinationArn, this.#accountRegionScope);
+        return permittedSimLogsDestinationFunction(destinationArn, arn.functionName, this.#simAws.accountRegionScope(arn.accountId, arn.regionName));
+    }
+}
+//# sourceMappingURL=sim-aws-logs-subscription-functions.js.map

package/dist/service/logs/subscription/lambda/sim-aws-logs-subscription-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-aws-logs-subscription-functions.js","sourceRoot":"","sources":["../../../../../src/service/logs/subscription/lambda/sim-aws-logs-subscription-functions.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,+BAA+B,GAEhC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAC3F,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AASzF;;;;;;;;GAQG;AACH,MAAM,OAAO,+BAA+B;IACjC,OAAO,CAAS;IAChB,mBAAmB,CAA2B;IAEvD,YAAY,UAAqD;QAC/D,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,cAAsB;QAChC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAE/B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,cAAsB,EACtB,QAAqC;QAErC,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,MAAM,CACzC,+BAA+B,CAAC,QAAQ,CAAC,CAC1C,CAAC;IACJ,CAAC;IAEO,SAAS,CACf,cAAsB;QAEtB,MAAM,GAAG,GAAG,8BAA8B,CAAC,KAAK,CAC9C,cAAc,EACd,IAAI,CAAC,mBAAmB,CACzB,CAAC;QAEF,OAAO,mCAAmC,CACxC,cAAc,EACd,GAAG,CAAC,YAAY,EAChB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAC/D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/logs/subscription/lambda/sim-logs-destination-permission.d.ts

@@ -0,0 +1,20 @@
+import type { SimAwsAccountRegionContainer } from "../../../aws/sim-aws-account-region-scope.js";
+import type { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
+/**
+ * The service principal CloudWatch Logs invokes a destination function as.
+ *
+ * Real CloudWatch Logs uses the regional form, `logs.<region>.amazonaws.com`,
+ * which is why a working `AddPermission` for a subscription filter names that
+ * rather than the plain `logs.amazonaws.com` most services use.
+ */
+export declare function simLogsServicePrincipal(regionName: string): string;
+/**
+ * The destination function, refusing one that is missing or does not admit
+ * CloudWatch Logs.
+ *
+ * The resource policy is consulted on every delivery rather than remembered
+ * from when the filter was put, so a permission taken away afterwards stops
+ * delivery, as it does in an account.
+ */
+export declare function permittedSimLogsDestinationFunction(destinationArn: string, functionName: string, scope: SimAwsAccountRegionContainer): SimLambdaFunction;
+//# sourceMappingURL=sim-logs-destination-permission.d.ts.map

package/dist/service/logs/subscription/lambda/sim-logs-destination-permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-destination-permission.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/subscription/lambda/sim-logs-destination-permission.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAEjG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAIzF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,4BAA4B,GAClC,iBAAiB,CAwBnB"}

package/dist/service/logs/subscription/lambda/sim-logs-destination-permission.js

@@ -0,0 +1,39 @@
+import { SimLambdaServiceInvokeAuthorizer } from "../../../lambda/command/authorize/sim-lambda-service-invoke-authorizer.js";
+import { SimLogsDeliveryNotPermitted } from "../../error/sim-logs-delivery.error.js";
+import { SimLogsResourceNotFoundException } from "../../error/sim-logs.error.js";
+/**
+ * The service principal CloudWatch Logs invokes a destination function as.
+ *
+ * Real CloudWatch Logs uses the regional form, `logs.<region>.amazonaws.com`,
+ * which is why a working `AddPermission` for a subscription filter names that
+ * rather than the plain `logs.amazonaws.com` most services use.
+ */
+export function simLogsServicePrincipal(regionName) {
+    return `logs.${regionName}.amazonaws.com`;
+}
+/**
+ * The destination function, refusing one that is missing or does not admit
+ * CloudWatch Logs.
+ *
+ * The resource policy is consulted on every delivery rather than remembered
+ * from when the filter was put, so a permission taken away afterwards stops
+ * delivery, as it does in an account.
+ */
+export function permittedSimLogsDestinationFunction(destinationArn, functionName, scope) {
+    const simFunction = scope.lambda().getSimFunctionByName(functionName);
+    if (simFunction === undefined) {
+        throw new SimLogsResourceNotFoundException(`${destinationArn} is not a simulated Lambda function.`);
+    }
+    const servicePrincipal = simLogsServicePrincipal(scope.region.regionName);
+    const decision = new SimLambdaServiceInvokeAuthorizer({
+        iam: scope.iam(),
+    }).authorize({ simFunction, servicePrincipal });
+    if (decision.isDenied) {
+        throw new SimLogsDeliveryNotPermitted(`Could not execute the lambda function. Make sure you have given ` +
+            `CloudWatch Logs permission to execute your function: the resource ` +
+            `policy of ${destinationArn} does not allow ${servicePrincipal} to ` +
+            `invoke it. Grant it with AddPermission.`);
+    }
+    return simFunction;
+}
+//# sourceMappingURL=sim-logs-destination-permission.js.map

package/dist/service/logs/subscription/lambda/sim-logs-destination-permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-destination-permission.js","sourceRoot":"","sources":["../../../../../src/service/logs/subscription/lambda/sim-logs-destination-permission.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gCAAgC,EAAE,MAAM,2EAA2E,CAAC;AAE7H,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,QAAQ,UAAU,gBAAgB,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB,EACtB,YAAoB,EACpB,KAAmC;IAEnC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAEtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,gCAAgC,CACxC,GAAG,cAAc,sCAAsC,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,gCAAgC,CAAC;QACpD,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;KACjB,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAEhD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,2BAA2B,CACnC,kEAAkE;YAChE,oEAAoE;YACpE,aAAa,cAAc,mBAAmB,gBAAgB,MAAM;YACpE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/service/logs/subscription/lambda/sim-logs-subscription-function-arn.d.ts

@@ -0,0 +1,33 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account-id.js";
+import type { SimAwsAccountRegionScope } from "../../../aws/sim-aws-account-region-scope.js";
+import type { AwsRegionName } from "../../../aws/sim-aws-region.js";
+/**
+ * The Lambda function ARN a subscription filter's destination names.
+ *
+ * The Region and the Account are read out alongside the name so that a
+ * delivery resolves the function in the scope its ARN gives.
+ */
+export declare class SimLogsSubscriptionFunctionArn {
+    readonly value: string;
+    readonly regionName: AwsRegionName;
+    readonly accountId: SimAwsAccountId;
+    readonly functionName: string;
+    private constructor();
+    /**
+     * Read a destination ARN, refusing one no simulated function is behind.
+     *
+     * Only a Lambda destination is simulated. Kinesis and Firehose are real
+     * CloudWatch Logs destinations refused here rather than accepted and never
+     * delivered to, since a subscription that takes the configuration and
+     * quietly drops every event is the hardest kind of thing to find.
+     *
+     * A function outside the filter's own Account and Region is refused too, and
+     * that one is real AWS behaviour rather than a gap: CloudWatch Logs takes a
+     * Lambda destination "belonging to the same account as the subscription
+     * filter", and reaches another Account only through a logical destination,
+     * which is a Kinesis stream. Accepting one here would let a test wire up
+     * something an account would reject.
+     */
+    static parse(destinationArn: string, scope: SimAwsAccountRegionScope): SimLogsSubscriptionFunctionArn;
+}
+//# sourceMappingURL=sim-logs-subscription-function-arn.d.ts.map

package/dist/service/logs/subscription/lambda/sim-logs-subscription-function-arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-function-arn.d.ts","sourceRoot":"","sources":["../../../../../src/service/logs/subscription/lambda/sim-logs-subscription-function-arn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAcpE;;;;;GAKG;AACH,qBAAa,8BAA8B;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,OAAO,eAKN;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CACV,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,wBAAwB,GAC9B,8BAA8B,CA0ChC;CACF"}

package/dist/service/logs/subscription/lambda/sim-logs-subscription-function-arn.js

@@ -0,0 +1,66 @@
+import { parseSimLambdaFunctionArn } from "../../../lambda/function/sim-lambda-function-arn-parts.js";
+import { SimLogsInvalidParameterException, SimLogsUnsupportedOperationException, } from "../../error/sim-logs.error.js";
+/**
+ * The Lambda function ARN a subscription filter's destination names.
+ *
+ * The Region and the Account are read out alongside the name so that a
+ * delivery resolves the function in the scope its ARN gives.
+ */
+export class SimLogsSubscriptionFunctionArn {
+    value;
+    regionName;
+    accountId;
+    functionName;
+    constructor(properties) {
+        this.value = properties.value;
+        this.regionName = properties.regionName;
+        this.accountId = properties.accountId;
+        this.functionName = properties.functionName;
+    }
+    /**
+     * Read a destination ARN, refusing one no simulated function is behind.
+     *
+     * Only a Lambda destination is simulated. Kinesis and Firehose are real
+     * CloudWatch Logs destinations refused here rather than accepted and never
+     * delivered to, since a subscription that takes the configuration and
+     * quietly drops every event is the hardest kind of thing to find.
+     *
+     * A function outside the filter's own Account and Region is refused too, and
+     * that one is real AWS behaviour rather than a gap: CloudWatch Logs takes a
+     * Lambda destination "belonging to the same account as the subscription
+     * filter", and reaches another Account only through a logical destination,
+     * which is a Kinesis stream. Accepting one here would let a test wire up
+     * something an account would reject.
+     */
+    static parse(destinationArn, scope) {
+        const parts = parseSimLambdaFunctionArn(destinationArn);
+        if (parts === undefined) {
+            throw new SimLogsUnsupportedOperationException(`${destinationArn} is not a Lambda function ARN. Only a Lambda ` +
+                `destination is simulated, which is ` +
+                `arn:aws:lambda:<region>:<account-id>:function:<function-name>`);
+        }
+        if (parts.qualifier !== undefined) {
+            throw new SimLogsInvalidParameterException(`${destinationArn} names a function version or alias, and simulated ` +
+                `Lambda has neither, so delivering to the unqualified function ` +
+                `instead would be delivering to a different one`);
+        }
+        if (parts.accountId !== scope.accountId) {
+            throw new SimLogsInvalidParameterException(`${destinationArn} is in Account ${parts.accountId}, and a Lambda ` +
+                `destination has to belong to the same Account as the subscription ` +
+                `filter, which is ${scope.accountId}. Real CloudWatch Logs reaches ` +
+                `another Account through a logical destination instead.`);
+        }
+        if (parts.regionName !== scope.regionName) {
+            throw new SimLogsInvalidParameterException(`${destinationArn} is in Region ${parts.regionName}, and a Lambda ` +
+                `destination has to be in the same Region as the log group, which ` +
+                `is in ${scope.regionName}.`);
+        }
+        return new SimLogsSubscriptionFunctionArn({
+            value: destinationArn,
+            regionName: parts.regionName,
+            accountId: parts.accountId,
+            functionName: parts.functionName,
+        });
+    }
+}
+//# sourceMappingURL=sim-logs-subscription-function-arn.js.map

package/dist/service/logs/subscription/lambda/sim-logs-subscription-function-arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-function-arn.js","sourceRoot":"","sources":["../../../../../src/service/logs/subscription/lambda/sim-logs-subscription-function-arn.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,+BAA+B,CAAC;AASvC;;;;;GAKG;AACH,MAAM,OAAO,8BAA8B;IAChC,KAAK,CAAS;IACd,UAAU,CAAgB;IAC1B,SAAS,CAAkB;IAC3B,YAAY,CAAS;IAE9B,YAAoB,UAAoD;QACtE,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CACV,cAAsB,EACtB,KAA+B;QAE/B,MAAM,KAAK,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QAExD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,oCAAoC,CAC5C,GAAG,cAAc,+CAA+C;gBAC9D,qCAAqC;gBACrC,+DAA+D,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,gCAAgC,CACxC,GAAG,cAAc,oDAAoD;gBACnE,gEAAgE;gBAChE,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,gCAAgC,CACxC,GAAG,cAAc,kBAAkB,KAAK,CAAC,SAAS,iBAAiB;gBACjE,oEAAoE;gBACpE,oBAAoB,KAAK,CAAC,SAAS,iCAAiC;gBACpE,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,gCAAgC,CACxC,GAAG,cAAc,iBAAiB,KAAK,CAAC,UAAU,iBAAiB;gBACjE,mEAAmE;gBACnE,SAAS,KAAK,CAAC,UAAU,GAAG,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,8BAA8B,CAAC;YACxC,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/logs/subscription/sim-logs-subscription-destinations.d.ts

@@ -0,0 +1,41 @@
+import type { SimLogsSubscriptionDelivery } from "./sim-logs-subscription-event.js";
+/**
+ * Where a subscription filter delivers to.
+ */
+export interface SimLogsSubscriptionDestinations {
+    /**
+     * Check a destination can be delivered to, before a filter is put on it.
+     *
+     * Real CloudWatch Logs does this at `PutSubscriptionFilter`: a destination
+     * it cannot invoke fails the call rather than silently dropping every event
+     * from then on. That is worth keeping, because a subscription that accepts
+     * the configuration and delivers nothing is the hardest kind of thing to
+     * find.
+     */
+    check(destinationArn: string): Promise<void>;
+    /**
+     * Deliver matched events to a destination.
+     */
+    deliver(destinationArn: string, delivery: SimLogsSubscriptionDelivery): Promise<void>;
+}
+/**
+ * The destinations a simulated CloudWatch Logs built on its own can reach,
+ * which is none.
+ *
+ * A standalone SimLogs has no other simulated services to deliver to, and owns
+ * its own background scheduler, so nothing could wait for a delivery it made
+ * even if it could make one. Holding a filter still works, since that takes
+ * nothing but CloudWatch Logs: it is delivery that is refused.
+ */
+export declare class SimLogsNoSubscriptionDestinations implements SimLogsSubscriptionDestinations {
+    /**
+     * Refuse every destination, explaining how to get one.
+     */
+    check(destinationArn: string): Promise<void>;
+    /**
+     * Refuse every delivery, explaining how to get one.
+     */
+    deliver(destinationArn: string): Promise<void>;
+    private refusal;
+}
+//# sourceMappingURL=sim-logs-subscription-destinations.d.ts.map

package/dist/service/logs/subscription/sim-logs-subscription-destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-destinations.d.ts","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-destinations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAEpF;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;OAEG;IACH,OAAO,CACL,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,YAAW,+BAA+B;IACvF;;OAEG;IACH,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED;;OAEG;IACH,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7C;IAED,OAAO,CAAC,OAAO;CAQhB"}

package/dist/service/logs/subscription/sim-logs-subscription-destinations.js

@@ -0,0 +1,31 @@
+import { SimLogsUnsupportedOperationException } from "../error/sim-logs.error.js";
+/**
+ * The destinations a simulated CloudWatch Logs built on its own can reach,
+ * which is none.
+ *
+ * A standalone SimLogs has no other simulated services to deliver to, and owns
+ * its own background scheduler, so nothing could wait for a delivery it made
+ * even if it could make one. Holding a filter still works, since that takes
+ * nothing but CloudWatch Logs: it is delivery that is refused.
+ */
+export class SimLogsNoSubscriptionDestinations {
+    /**
+     * Refuse every destination, explaining how to get one.
+     */
+    check(destinationArn) {
+        return Promise.reject(this.refusal(destinationArn));
+    }
+    /**
+     * Refuse every delivery, explaining how to get one.
+     */
+    deliver(destinationArn) {
+        return Promise.reject(this.refusal(destinationArn));
+    }
+    refusal(destinationArn) {
+        return new SimLogsUnsupportedOperationException(`Cannot deliver to ${destinationArn}: this SimLogs was constructed on ` +
+            `its own, so it has no other simulated services to deliver to and no ` +
+            `shared background scheduler to deliver on. Reach simulated ` +
+            `CloudWatch Logs through SimAws to deliver to a function.`);
+    }
+}
+//# sourceMappingURL=sim-logs-subscription-destinations.js.map

package/dist/service/logs/subscription/sim-logs-subscription-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-destinations.js","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AA2BlF;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAiC;IAC5C;;OAEG;IACH,KAAK,CAAC,cAAsB;QAC1B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,cAAsB;QAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtD,CAAC;IAEO,OAAO,CAAC,cAAsB;QACpC,OAAO,IAAI,oCAAoC,CAC7C,qBAAqB,cAAc,oCAAoC;YACrE,sEAAsE;YACtE,6DAA6D;YAC7D,0DAA0D,CAC7D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/logs/subscription/sim-logs-subscription-event.d.ts

@@ -0,0 +1,50 @@
+import type { SimLogsStoredEvent } from "../event/sim-logs-event.js";
+/**
+ * What a subscription filter is delivering, before it is encoded.
+ */
+export interface SimLogsSubscriptionDelivery {
+    readonly owner: string;
+    readonly logGroupName: string;
+    readonly logStreamName: string;
+    readonly filterName: string;
+    readonly events: readonly SimLogsStoredEvent[];
+}
+/**
+ * The decoded document a subscription filter delivers.
+ *
+ * `messageType` is always `DATA_MESSAGE`. Real CloudWatch Logs also sends a
+ * `CONTROL_MESSAGE` to check a destination is reachable, which nothing here
+ * does: there is no destination to keep warm in this process.
+ */
+export interface SimLogsSubscriptionEventDocument {
+    readonly messageType: "DATA_MESSAGE";
+    readonly owner: string;
+    readonly logGroup: string;
+    readonly logStream: string;
+    readonly subscriptionFilters: readonly string[];
+    readonly logEvents: readonly SimLogsSubscriptionLogEvent[];
+}
+export interface SimLogsSubscriptionLogEvent {
+    readonly id: string;
+    readonly timestamp: number;
+    readonly message: string;
+}
+/**
+ * Build the document a subscription filter delivers.
+ */
+export declare function simLogsSubscriptionEventDocument(delivery: SimLogsSubscriptionDelivery): SimLogsSubscriptionEventDocument;
+/**
+ * The payload a Lambda destination receives.
+ *
+ * The document is gzipped and base64 encoded under `awslogs.data`, which is
+ * the shape every subscription handler in the wild is written against: the
+ * first thing such a handler does is gunzip that field. Delivering the
+ * document in the clear would be easier to read in a test and would break
+ * every real handler, so it is encoded exactly as AWS encodes it.
+ */
+export declare function simLogsSubscriptionEventPayload(delivery: SimLogsSubscriptionDelivery): {
+    readonly awslogs: {
+        readonly data: string;
+    };
+};
+//# sourceMappingURL=sim-logs-subscription-event.d.ts.map

package/dist/service/logs/subscription/sim-logs-subscription-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-event.d.ts","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-event.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC5D;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,2BAA2B,GACpC,gCAAgC,CAalC;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,2BAA2B,GACpC;IAAE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKjD"}

package/dist/service/logs/subscription/sim-logs-subscription-event.js

@@ -0,0 +1,33 @@
+import { gzipSync } from "node:zlib";
+/**
+ * Build the document a subscription filter delivers.
+ */
+export function simLogsSubscriptionEventDocument(delivery) {
+    return {
+        messageType: "DATA_MESSAGE",
+        owner: delivery.owner,
+        logGroup: delivery.logGroupName,
+        logStream: delivery.logStreamName,
+        subscriptionFilters: [delivery.filterName],
+        logEvents: delivery.events.map((event) => ({
+            id: event.eventId,
+            timestamp: event.timestamp,
+            message: event.message,
+        })),
+    };
+}
+/**
+ * The payload a Lambda destination receives.
+ *
+ * The document is gzipped and base64 encoded under `awslogs.data`, which is
+ * the shape every subscription handler in the wild is written against: the
+ * first thing such a handler does is gunzip that field. Delivering the
+ * document in the clear would be easier to read in a test and would break
+ * every real handler, so it is encoded exactly as AWS encodes it.
+ */
+export function simLogsSubscriptionEventPayload(delivery) {
+    const document = simLogsSubscriptionEventDocument(delivery);
+    const gzipped = gzipSync(Buffer.from(JSON.stringify(document), "utf8"));
+    return { awslogs: { data: gzipped.toString("base64") } };
+}
+//# sourceMappingURL=sim-logs-subscription-event.js.map

package/dist/service/logs/subscription/sim-logs-subscription-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-event.js","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAoCrC;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAqC;IAErC,OAAO;QACL,WAAW,EAAE,cAAc;QAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EAAE,QAAQ,CAAC,YAAY;QAC/B,SAAS,EAAE,QAAQ,CAAC,aAAa;QACjC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1C,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzC,EAAE,EAAE,KAAK,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAqC;IAErC,MAAM,QAAQ,GAAG,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAExE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC3D,CAAC"}

package/dist/service/logs/subscription/sim-logs-subscription-fan-out.d.ts

@@ -0,0 +1,53 @@
+import type { BackgroundScheduler } from "../../../util/background/background.js";
+import type { SimAwsAccountRegionScope } from "../../aws/sim-aws-account-region-scope.js";
+import type { SimLogsStoredEvent } from "../event/sim-logs-event.js";
+import type { SimLogsLogGroup } from "../group/sim-logs-log-group.js";
+import type { SimLogsSubscriptionDestinations } from "./sim-logs-subscription-destinations.js";
+/**
+ * One delivery a subscription filter could not make.
+ */
+export interface SimLogsSubscriptionFailure {
+    readonly logGroupName: string;
+    readonly filterName: string;
+    readonly destinationArn: string;
+    readonly reason: string;
+}
+interface SimLogsSubscriptionFanOutProperties {
+    readonly destinations: SimLogsSubscriptionDestinations;
+    readonly accountRegionScope: SimAwsAccountRegionScope;
+    readonly background: BackgroundScheduler;
+}
+/**
+ * Hands events written to a log group to every subscription filter that wants
+ * them.
+ *
+ * Delivery happens on the background scheduler, as real CloudWatch Logs
+ * delivers after the write has been answered: `PutLogEvents` succeeds whether
+ * or not anything downstream takes the events, and a destination that throws
+ * must not fail the write that triggered it.
+ * `simAws.backgroundTasksComplete()` is what waits for it.
+ */
+export declare class SimLogsSubscriptionFanOut {
+    #private;
+    constructor(properties: SimLogsSubscriptionFanOutProperties);
+    /**
+     * Every delivery this scope could not make.
+     *
+     * A failed delivery is invisible in an account, where it becomes a metric
+     * nobody is watching. Keeping it is what lets a test find out that the
+     * subscription it set up never reached anything.
+     */
+    get failures(): readonly SimLogsSubscriptionFailure[];
+    /**
+     * Schedule a delivery for every filter on the group that wants any of the
+     * events.
+     *
+     * Each filter gets only the events its own pattern matched, in one delivery,
+     * which is what real CloudWatch Logs batches: a handler receives the lines
+     * it subscribed to rather than everything that happened to be written.
+     */
+    written(group: SimLogsLogGroup, logStreamName: string, events: readonly SimLogsStoredEvent[]): void;
+    private schedule;
+}
+export {};
+//# sourceMappingURL=sim-logs-subscription-fan-out.d.ts.map

package/dist/service/logs/subscription/sim-logs-subscription-fan-out.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-fan-out.d.ts","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-fan-out.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAC1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAG/F;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,YAAY,EAAE,+BAA+B,CAAC;IACvD,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,qBAAa,yBAAyB;;IAMpC,YAAY,UAAU,EAAE,mCAAmC,EAI1D;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,IAAI,SAAS,0BAA0B,EAAE,CAEpD;IAED;;;;;;;OAOG;IACH,OAAO,CACL,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,SAAS,kBAAkB,EAAE,GACpC,IAAI,CAQN;IAED,OAAO,CAAC,QAAQ;CAwBjB"}

package/dist/service/logs/subscription/sim-logs-subscription-fan-out.js

@@ -0,0 +1,69 @@
+/**
+ * Hands events written to a log group to every subscription filter that wants
+ * them.
+ *
+ * Delivery happens on the background scheduler, as real CloudWatch Logs
+ * delivers after the write has been answered: `PutLogEvents` succeeds whether
+ * or not anything downstream takes the events, and a destination that throws
+ * must not fail the write that triggered it.
+ * `simAws.backgroundTasksComplete()` is what waits for it.
+ */
+export class SimLogsSubscriptionFanOut {
+    #destinations;
+    #accountRegionScope;
+    #background;
+    #failures = [];
+    constructor(properties) {
+        this.#destinations = properties.destinations;
+        this.#accountRegionScope = properties.accountRegionScope;
+        this.#background = properties.background;
+    }
+    /**
+     * Every delivery this scope could not make.
+     *
+     * A failed delivery is invisible in an account, where it becomes a metric
+     * nobody is watching. Keeping it is what lets a test find out that the
+     * subscription it set up never reached anything.
+     */
+    get failures() {
+        return this.#failures;
+    }
+    /**
+     * Schedule a delivery for every filter on the group that wants any of the
+     * events.
+     *
+     * Each filter gets only the events its own pattern matched, in one delivery,
+     * which is what real CloudWatch Logs batches: a handler receives the lines
+     * it subscribed to rather than everything that happened to be written.
+     */
+    written(group, logStreamName, events) {
+        for (const filter of group.subscriptionFilters.all) {
+            const matched = events.filter((event) => filter.wants(event.message));
+            if (matched.length > 0) {
+                this.schedule(filter, logStreamName, matched);
+            }
+        }
+    }
+    schedule(filter, logStreamName, events) {
+        this.#background.schedule(async () => {
+            try {
+                await this.#destinations.deliver(filter.destinationArn, {
+                    owner: this.#accountRegionScope.accountId,
+                    logGroupName: filter.logGroupName,
+                    logStreamName,
+                    filterName: filter.filterName,
+                    events,
+                });
+            }
+            catch (error) {
+                this.#failures.push({
+                    logGroupName: filter.logGroupName,
+                    filterName: filter.filterName,
+                    destinationArn: filter.destinationArn,
+                    reason: error instanceof Error ? error.message : String(error),
+                });
+            }
+        });
+    }
+}
+//# sourceMappingURL=sim-logs-subscription-fan-out.js.map

package/dist/service/logs/subscription/sim-logs-subscription-fan-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-fan-out.js","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-fan-out.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,MAAM,OAAO,yBAAyB;IAC3B,aAAa,CAAkC;IAC/C,mBAAmB,CAA2B;IAC9C,WAAW,CAAsB;IACjC,SAAS,GAAiC,EAAE,CAAC;IAEtD,YAAY,UAA+C;QACzD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,YAAY,CAAC;QAC7C,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CACL,KAAsB,EACtB,aAAqB,EACrB,MAAqC;QAErC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAEtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,QAAQ,CACd,MAAiC,EACjC,aAAqB,EACrB,MAAqC;QAErC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YACnC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;oBACtD,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,SAAS;oBACzC,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,aAAa;oBACb,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAClB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC/D,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/logs/subscription/sim-logs-subscription-filter-store.d.ts

@@ -0,0 +1,40 @@
+import type { SimLogsSubscriptionFilter } from "./sim-logs-subscription-filter.js";
+/**
+ * How many subscription filters real CloudWatch Logs allows on one log group.
+ *
+ * Two is the current account default. It used to be one, which is why a
+ * template written a few years ago assumes a group can only have the one, and
+ * why exceeding it is worth failing on rather than quietly allowing.
+ */
+export declare const simLogsMaximumSubscriptionFilters = 2;
+/**
+ * The subscription filters on one log group.
+ *
+ * They belong to the group rather than to the service, as its streams do: a
+ * filter has no identity outside the group it watches, and deleting the group
+ * takes its filters with it.
+ */
+export declare class SimLogsSubscriptionFilterStore {
+    #private;
+    /**
+     * Every filter on this group, in the order they were put.
+     */
+    get all(): readonly SimLogsSubscriptionFilter[];
+    /**
+     * Put a filter, replacing one of the same name.
+     *
+     * Putting a filter that is already there by name is an update rather than a
+     * second filter, which is what makes `PutSubscriptionFilter` the way to
+     * change a pattern. Only a new name counts against the limit.
+     */
+    put(filter: SimLogsSubscriptionFilter): void;
+    /**
+     * Remove a filter by name, refusing one that is not there.
+     */
+    delete(filterName: string): void;
+    /**
+     * The filters whose names start with a prefix, in the order they were put.
+     */
+    withNamePrefix(prefix: string | undefined): readonly SimLogsSubscriptionFilter[];
+}
+//# sourceMappingURL=sim-logs-subscription-filter-store.d.ts.map

package/dist/service/logs/subscription/sim-logs-subscription-filter-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-logs-subscription-filter-store.d.ts","sourceRoot":"","sources":["../../../../src/service/logs/subscription/sim-logs-subscription-filter-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,qBAAa,8BAA8B;;IAGzC;;OAEG;IACH,IAAI,GAAG,IAAI,SAAS,yBAAyB,EAAE,CAE9C;IAED;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAY3C;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAM/B;IAED;;OAEG;IACH,cAAc,CACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,SAAS,yBAAyB,EAAE,CAItC;CACF"}

package/dist/service/logs/subscription/sim-logs-subscription-filter-store.js

@@ -0,0 +1,55 @@
+import { SimLogsLimitExceededException, SimLogsResourceNotFoundException, } from "../error/sim-logs.error.js";
+/**
+ * How many subscription filters real CloudWatch Logs allows on one log group.
+ *
+ * Two is the current account default. It used to be one, which is why a
+ * template written a few years ago assumes a group can only have the one, and
+ * why exceeding it is worth failing on rather than quietly allowing.
+ */
+export const simLogsMaximumSubscriptionFilters = 2;
+/**
+ * The subscription filters on one log group.
+ *
+ * They belong to the group rather than to the service, as its streams do: a
+ * filter has no identity outside the group it watches, and deleting the group
+ * takes its filters with it.
+ */
+export class SimLogsSubscriptionFilterStore {
+    #filters = new Map();
+    /**
+     * Every filter on this group, in the order they were put.
+     */
+    get all() {
+        return this.#filters.values().toArray();
+    }
+    /**
+     * Put a filter, replacing one of the same name.
+     *
+     * Putting a filter that is already there by name is an update rather than a
+     * second filter, which is what makes `PutSubscriptionFilter` the way to
+     * change a pattern. Only a new name counts against the limit.
+     */
+    put(filter) {
+        if (!this.#filters.has(filter.filterName) &&
+            this.#filters.size >= simLogsMaximumSubscriptionFilters) {
+            throw new SimLogsLimitExceededException(`Resource limit exceeded: a log group may have at most ` +
+                `${simLogsMaximumSubscriptionFilters} subscription filters`);
+        }
+        this.#filters.set(filter.filterName, filter);
+    }
+    /**
+     * Remove a filter by name, refusing one that is not there.
+     */
+    delete(filterName) {
+        if (!this.#filters.delete(filterName)) {
+            throw new SimLogsResourceNotFoundException("The specified subscription filter does not exist.");
+        }
+    }
+    /**
+     * The filters whose names start with a prefix, in the order they were put.
+     */
+    withNamePrefix(prefix) {
+        return this.all.filter((filter) => filter.filterName.startsWith(prefix ?? ""));
+    }
+}
+//# sourceMappingURL=sim-logs-subscription-filter-store.js.map